@vio-live/web-sdk 0.23.1 → 0.26.0

package/dist/core/index.d.ts

@@ -36,6 +36,25 @@ interface VioConfig {
     contentId?: string | number;
     /** Human-readable title of that content (`content_title`); see `contentId`. */
     contentTitle?: string;
+    /**
+     * The campaign this PAGE belongs to (ADR-0034, amendment 3) — an editorial
+     * page (a Vev article, a Replit article) that is part of one campaign. Its
+     * slots are declared with it (the micro assigns them unless the dashboard
+     * already did) and, until that round-trips, the elements already resolve to
+     * it: assignment → page campaign → default. DOM alternative, inheritable:
+     * `data-vio-campaign` on any ancestor, or `vio-campaign` on the element.
+     */
+    campaignId?: number;
+    /** Log the SDK's slot/attribution decisions at `console.debug` (manifest assignments per slot). */
+    debug?: boolean;
+    /**
+     * The surface's privacy mode, when the host knows it (ADR-0035): `minimal`
+     * keeps the entry context (referrer, utm, landing page) off the order
+     * attribution. Without it the SDK asks the surface itself
+     * (`GET /v2/mobile/surface`), once per page load; a host-set `minimal`
+     * always wins.
+     */
+    privacyMode?: 'standard' | 'minimal';
     /** Override REST API base. Defaults are env-aware. */
     apiBase?: string;
     /** Override GraphQL base. Defaults are env-aware. */
@@ -71,6 +90,9 @@ interface ResolvedConfig {
     platform: VioPlatform;
     contentId?: string | number;
     contentTitle?: string;
+    campaignId?: number;
+    debug: boolean;
+    privacyMode?: 'standard' | 'minimal';
     apiBase: string;
     graphQLBase: string;
     eventsBase: string;
@@ -194,6 +216,8 @@ interface BootstrapSlot {
     platform?: string | null;
     startDate?: string | null;
     endDate?: string | null;
+    /** Who assigned it: the dashboard (always wins) or a page's own campaign (campaigns micro PR #16). */
+    source?: 'dashboard' | 'page' | null;
 }
 /**
  * One entry of `campaigns[]`: every active campaign of the surface, with its
@@ -231,6 +255,12 @@ interface BootstrapResponse {
         countryCode: string;
         currencyCode: string;
     };
+    /**
+     * The surface of the key, when the bootstrap says it (the campaigns
+     * service answers it on `/v2/mobile/surface` today; here when it adds it).
+     * Its `privacyMode` decides what the order attribution may carry.
+     */
+    surface?: SurfaceResponse['surface'];
 }
 /**
  * A slot this page declares to the campaigns service (ADR-0027 / ADR-0034):
@@ -240,6 +270,10 @@ interface BootstrapResponse {
 interface ManifestLocation {
     id: string;
     displayName?: string;
+    /** The campaign this location belongs to when it differs from the page's (`ManifestRequest.campaignId`). */
+    campaignId?: number;
+    /** The kind of element the slot holds — `card` | `carousel` | `detail` for the SDK's, a host's own word otherwise. For the dashboard. */
+    kind?: string;
 }
 /**
  * Where something happened, as `Vio.attribution(slot)` answers it — the ONE
@@ -254,6 +288,29 @@ interface Attribution {
     sponsorId?: number;
     contentId?: string;
     contentTitle?: string;
+    /** The page's URL within the 2 048 cap (`content_url`) — what Commerce keeps on the order and its lines. */
+    contentUrl?: string;
+}
+/**
+ * How much context analytics and Commerce may keep of a visit to this
+ * surface. `minimal` drops what says WHICH screen someone was on and WHY —
+ * the page (`content_url`, `content_title`), the slot (`location_id`) and
+ * the entry (referrer, utm, landing page) — the collector drops it from the
+ * events on its side (vio-analytics `privacy.ts`); the SDK keeps it off the
+ * order and off the cart lines it sends to Commerce. What measures the
+ * funnel and bills the sale stays: the surface, the campaign, the kind of
+ * component, the products and the amounts. A mode the SDK could not learn
+ * counts as `minimal`.
+ */
+type SurfacePrivacyMode = 'standard' | 'minimal';
+/** Response of `GET /v2/mobile/surface`: what the key may know of its own surface. */
+interface SurfaceResponse {
+    surface?: {
+        id?: number;
+        name?: string;
+        status?: string;
+        privacyMode?: SurfacePrivacyMode | string | null;
+    } | null;
 }
 /** Body of `POST /v2/mobile/components/manifest`. */
 interface ManifestRequest {
@@ -265,6 +322,12 @@ interface ManifestRequest {
      */
     mode: 'merge' | 'replace';
     locations: ManifestLocation[];
+    /**
+     * The campaign the PAGE belongs to (`Vio.init({ campaignId })`): the micro
+     * assigns every declared location to it (`source: 'page'`) unless the
+     * dashboard already assigned that slot.
+     */
+    campaignId?: number;
 }
 /** Response of `POST /v2/mobile/components/manifest`. */
 interface ManifestResult {
@@ -275,6 +338,12 @@ interface ManifestResult {
         id: number | string;
         locationId: string;
         displayName?: string | null;
+        /**
+         * What the micro did with the page's campaign for this slot: `created` /
+         * `kept` / `replaced` a page assignment, `dashboard` (the dashboard's
+         * assignment stands — the page's campaign is ignored there), `none`.
+         */
+        assignment?: 'created' | 'kept' | 'replaced' | 'dashboard' | 'none';
     }>;
     deprecatedCount: number;
     warnings: Array<{
@@ -353,6 +422,12 @@ declare class VioApi {
      * sends `mode: 'merge'`; see `Vio.declareSlots()` for the dedupe on top.
      */
     declareManifest(body: ManifestRequest): Promise<ManifestResult>;
+    /**
+     * The surface of the key (`GET /v2/mobile/surface`): its id, name, status
+     * and `privacyMode` — what decides whether the order attribution may carry
+     * the entry context (ADR-0035). A 404 means a service that predates it.
+     */
+    surface(): Promise<SurfaceResponse>;
     /**
      * Get placement components for a campaign. Used by the carousel auto-fetch
      * mode (`<vio-product-carousel campaign-id="36" location="news-favorites">`).
@@ -440,15 +515,29 @@ declare function createCommerceClient(options: CommerceClientOptions): CommerceC
  * mental model stays consistent across platforms.
  */
 /**
- * Where a unit in the cart came from (ADR-0027 / ADR-0034): the campaign
- * the place showed when it was added, the place (`slot`) and the content
- * (article). What `Vio.attribution(slot)` answers, minus the sponsor and the
- * title. The purchase is split per campaign from these.
+ * Where a unit in the cart came from (ADR-0027 / ADR-0034 / ADR-0035): the
+ * campaign the place showed when it was added, the place (`slot`), the kind
+ * of element it was added from, and the content (article: its id, URL and
+ * title). What `Vio.attribution(slot)` answers, minus the sponsor, plus the
+ * element's kind. The purchase is split per campaign from these, and since
+ * 0.26 Commerce receives them with every add (`origin` on the line, ADR-0035
+ * phase B) so the order knows where each unit was sold from.
  */
 interface CartOrigin {
     campaignId?: number;
     slot?: string;
     contentId?: string;
+    /**
+     * The kind of component the units were added from, as Commerce and the
+     * collector name it: `card` | `carousel` | `detail` for the SDK's elements
+     * (`componentKindOf()` — from the element's `componentTemplateId`, else
+     * the kind word in the slot id).
+     */
+    componentKind?: string;
+    /** The page the units were added from (`content_url`, ≤ 2 048), kept so a later +1 from the cart credits the same page. */
+    contentUrl?: string;
+    /** Its title (`content_title`, ≤ 255). */
+    contentTitle?: string;
 }
 /** One origin of a line and how many of its units came from it. */
 interface CartLineOrigin extends CartOrigin {
@@ -509,9 +598,10 @@ interface SponsorCartState {
  * CustomEvent that UI components subscribe to (Web Components react via
  * `requestUpdate()`).
  *
- * Server-side cart sync (Vio Commerce GraphQL CreateCart / AddToCart
- * mutations) is deferred to checkout time via the CheckoutManager —
- * this manager is purely client-side state for now.
+ * The backend cart (Vio Commerce GraphQL CreateCart / AddItem / UpdateItem /
+ * DeleteItem) is kept in sync optimistically from here; since 0.26 every add
+ * and every increase tells it where the units come from (`origin`, ADR-0035
+ * phase B) so the order is born attributed — see `origin-wire.ts`.
  */
 
 interface CartChangeDetail {
@@ -660,12 +750,15 @@ declare class CartManager extends EventTarget {
         origin?: CartOrigin;
     }): void;
     /** Send a line's target quantity to the backend — ONE request in flight per
-     * line. A target that arrives while one is in flight replaces any earlier
-     * waiting one and goes out when the current request settles, so the server
-     * ends on the last intent and never sees two updates racing each other.
-     * While the sync is active the line keeps its optimistic quantity through
-     * any backend response (see `updateFromBackendCart`); a rejection drops
-     * what was queued and reconciles the cart from the server. */
+     * line. Targets that arrive while one is in flight queue behind it as
+     * steps (`queueStep`): reduced like the line's origins, sent in order once
+     * the current request settles — one request per queued increase from a
+     * different origin, one for a net decrease — so the server ends on the
+     * last intent, credits every increase to its own origin, and never sees two
+     * updates racing each other. While the sync is active the line keeps its
+     * optimistic quantity through any backend response (see
+     * `updateFromBackendCart`); a rejection drops what was queued and
+     * reconciles the cart from the server. */
     private syncQuantity;
     removeItem(lineItemId: string, sponsorId: number): void;
     clearSponsorCart(sponsorId: number): void;
@@ -690,9 +783,15 @@ declare class CartManager extends EventTarget {
     private loadFromStorage;
     private emit;
 }
-/** Only the three attribution fields, trimmed; `{}` when nothing is known. */
+/**
+ * Only the attribution fields, trimmed; `{}` when nothing is known. The kind
+ * of element is kept as Commerce and the collector name it (`card`,
+ * `carousel`, `detail` — `componentKindOf`), from `componentKind` or from
+ * the `componentTemplateId` an element's attribution carries (`product-card`);
+ * the page as origin + path (`contentUrl`) and its title, within Commerce's caps.
+ */
 declare function normalizeOrigin(origin: CartOrigin | null | undefined): CartOrigin;
-/** Two origins are the same place when campaign, slot and content all match. */
+/** Two origins are the same place when campaign, slot, content and kind of element all match (the page's URL and title are attributes of the place, not its identity). */
 declare function sameOrigin(a: CartOrigin, b: CartOrigin): boolean;
 /**
  * The origins of a line for reporting: what it carries, plus an empty origin
@@ -702,188 +801,983 @@ declare function sameOrigin(a: CartOrigin, b: CartOrigin): boolean;
 declare function lineOrigins(line: Pick<CartLineItem, 'origins' | 'quantity'>): CartLineOrigin[];
 
 /**
- * Vipps MobilePay Payment Adapter — GraphQL Integration & Types.
+ * What the commerce gateway may not know yet.
  *
- * Vipps payment integration uses 2 GraphQL operations:
- *
- * 1. `CreatePaymentVipps` mutation:
- *    Initiates a Vipps payment session for a checkout and returns `payment_url`.
+ * The SDK ships ahead of the gateway more than once a quarter: a selection
+ * (`buyer_ref`, 2026-10-19), an argument (`origin` on the cart lines,
+ * `attribution` on the checkout — ADR-0035 phase B). A gateway that does not
+ * have the field refuses the WHOLE operation at validation — before anything
+ * runs, with no `data` — so each such operation is sent again without the
+ * field, once, and the answer remembered for the page load. An operation that
+ * DID run and failed is never repeated: for a mutation that would be a second
+ * charge, a second line in the cart.
  *
- * 2. `GetVippsStatus` query:
- *    Queries Vipps payment state directly for a checkout (`state`).
+ * One mechanism for all of them, so the next field costs a token here and a
+ * call to `withGatewayFeature`, not a new copy of the retry.
  */
-
+type GatewayFeature = 'buyer_ref' | 'line_origin' | 'checkout_attribution';
+/** Whether this page load still expects the gateway to know `feature` (false once it refused it). */
+declare function gatewayHas(feature: GatewayFeature): boolean;
+/** Forget what this page load learned (tests). One feature, or all of them. */
+declare function resetGatewayFeatures(feature?: GatewayFeature): void;
 /**
- * GraphQL mutation to create a Vipps payment session.
+ * True when `err` is the gateway refusing something it does not know, named
+ * `token` (`Cannot query field "buyer_ref" on type …`, `Unknown argument
+ * "origin" on field …`, `Unknown type "CartLineOriginInput"`, `Field "origin" is
+ * not defined by type "LineItemInput"`): a validation error, with no `data`
+ * and no `path` because nothing ran — safe to send again without it, a
+ * mutation included. Anything that ran (data present, or an error with a
+ * path) or any other message is not.
  */
-declare const CREATE_PAYMENT_VIPPS_MUTATION = "\nmutation CreatePaymentVipps($checkoutId: String!, $email: String, $returnUrl: String!, $express: Boolean) {\n  Payment {\n    CreatePaymentVipps(checkout_id: $checkoutId, email: $email, return_url: $returnUrl, express: $express) {\n      payment_url\n      reference\n      express\n      reason\n    }\n  }\n}\n";
+declare function isUnknownTokenError(err: unknown, token: string): boolean;
+/** `isUnknownTokenError` for any of the names a feature goes by. */
+declare function isUnknownFeatureError(err: unknown, feature: GatewayFeature): boolean;
 /**
- * GraphQL query to fetch current Vipps payment status.
+ * Runs `request(true)` (the operation with the feature); when the gateway
+ * does not know it, `request(false)` (without it) — and from then on, for
+ * this page load, straight to the latter. Said once in the console: a
+ * gateway behind the SDK is worth knowing about, and so is a renamed type.
  */
-declare const GET_VIPPS_STATUS_QUERY = "\nquery GetVippsStatus($checkoutId: String!) {\n  Payment {\n    GetVippsStatus(checkout_id: $checkoutId) {\n      state\n      duplicate_of\n    }\n  }\n}\n";
-interface CreatePaymentVippsVariables extends Record<string, unknown> {
-    checkoutId: string;
-    /** Optional since Express: Vipps hands the email back with the payment. */
-    email?: string;
-    returnUrl: string;
+declare function withGatewayFeature<T>(feature: GatewayFeature, request: (supported: boolean) => Promise<T>): Promise<T>;
+
+/**
+ * A line origin as Commerce receives it (ADR-0035 phase B): `origin` on each
+ * line of `AddItem` and, when the quantity goes UP, on `UpdateItem` — the
+ * origin of the units that update adds. shopcart keeps every origin of a
+ * line with its units (`cart_item.origins`) and writes the order from them:
+ * `order_item.campaign_id` / `location_id` / `component_kind`, and the
+ * order's page when the checkout does not name one.
+ *
+ * snake_case on the wire, the caps of shopcart's `LineOriginDto` enforced
+ * here, once. Pure: `lineOriginWire()` takes the origin and the page.
+ */
+
+/** The largest `Int` GraphQL coerces; a bigger id would fail the whole mutation. */
+declare const GRAPHQL_INT_MAX = 2147483647;
+/** `LineOriginDto` (shopcart `cart/dtos/send/line-origin.dto.ts`). */
+interface LineOriginWire {
+    campaign_id?: number;
+    location_id?: string;
+    component_kind?: string;
+    content_url?: string;
+    content_title?: string;
+}
+/** The caps of `LineOriginDto` — a longer value is refused whole by the API, so it is cut here. */
+declare const LINE_ORIGIN_CAPS: Readonly<{
+    locationId: 100;
+    componentKind: 32;
+    contentUrl: 2048;
+    contentTitle: 255;
+}>;
+/** The page the units are added from, for an origin that does not carry its own. */
+interface OriginPage {
+    contentUrl?: string;
+    contentTitle?: string;
+}
+interface LineOriginWireOptions {
+    /** The current page, for an origin that does not carry its own. */
+    page?: OriginPage;
     /**
-     * `true` asks for Express — address and delivery chosen inside the Vipps
-     * app. When the cart cannot have it, no payment is created and the answer
-     * says `express: false` with the reason; the caller then opens the
-     * ordinary checkout.
+     * The surface's privacy mode. Only on a `standard` surface do the slot
+     * (`location_id`) and the page (`content_url`, `content_title`) travel —
+     * which screen a unit was sold from is what `minimal` keeps private, the
+     * same promise the collector keeps for the events. `campaign_id` and
+     * `component_kind` always do. Default `unknown`: fail closed.
      */
-    express?: boolean;
-}
-interface CreatePaymentVippsResponse {
-    /** Absent when Express was asked for and refused. */
-    payment_url?: string;
-    /** The reference the seller reads in its Vipps portal. */
-    reference?: string;
-    express?: boolean;
-    reason?: string;
-}
-interface GetVippsStatusVariables extends Record<string, unknown> {
-    checkoutId: string;
-}
-interface VippsStatusResult {
-    state: string;
-    /** Set when this checkout was closed as a duplicate: the checkout that paid the cart. */
-    duplicate_of?: string | null;
+    privacyMode?: SurfacePrivacyMode | 'unknown';
 }
-type VippsPaymentState = 'CREATED' | 'INITIATED' | 'AUTHORIZED' | 'TERMINATED' | 'EXPIRED' | string;
 /**
- * Executes the `CreatePaymentVipps` GraphQL mutation.
+ * The origin for the wire, or `undefined` when the SDK knows no PLACE for the
+ * units — no campaign, no slot, no kind of element (a host adding with no
+ * attribution): then nothing is sent and the line inherits the order's
+ * campaign on the server. The page is the origin's own when it has one — the
+ * page the units were added from — else the current page's, as origin + path;
+ * `campaign_id` only as a positive `Int` (the DTO's `@IsInt() @Min(1)`, the
+ * gateway's 32-bit coercion).
  */
-declare function createPaymentVipps(variables: CreatePaymentVippsVariables | Record<string, unknown>, options?: CartQueryOptions): Promise<CreatePaymentVippsResponse | null>;
+declare function lineOriginWire(origin: CartOrigin | null | undefined, options?: LineOriginWireOptions): LineOriginWire | undefined;
+
 /**
- * Executes the `GetVippsStatus` GraphQL query.
+ * The `client` block — the standard context of the visit (EVENTS_CONTRACT
+ * "client", 2026-10-19): language, where the session landed from (the
+ * referrer and `utm_*` of the LANDING page, remembered for the session),
+ * screen size and time zone. What the collector derives from the request
+ * itself — device type, OS, browser, country — is NOT sent: no User-Agent
+ * parsing here, no duplicate of what the server knows better.
+ *
+ * Pure like `content.ts`: everything takes the globals it reads (defaults to
+ * the real ones), never throws, and answers `{}` where there is no browser
+ * (SSR, old engines). Capped to the collector's limits in ONE place: an
+ * over-long value is cut — none of these is an identity, so a cut referrer
+ * is still the right dimension.
+ *
+ * Landing memory: the first page of a session writes its referrer and utm
+ * parameters to `sessionStorage`; later pages read them back, so an event on
+ * page three still says the visit came from the newsletter — their own
+ * `document.referrer` (an internal page) is never a source. The referrer is
+ * kept as origin + path (no query, no fragment: a referrer's query is its
+ * tracking tail, not where the visit came from) and dropped altogether when
+ * it is this same host (a self-referral says nothing about the entry). A URL
+ * with utm parameters is a new landing (another campaign click) that replaces
+ * the memory — unless it was reached from this same host, i.e. an internal
+ * link that propagates utm, which keeps the landing that was. Without
+ * storage, or without consent to persist, each page stands alone.
  */
-declare function getVippsStatus(variables: GetVippsStatusVariables | Record<string, unknown>, options?: CartQueryOptions): Promise<VippsStatusResult | null>;
-
-declare const CREATE_CART_MUTATION = "\nmutation CreateCart($customerSessionId: String!, $currency: String!, $shippingCountry: String) {\n  Cart {\n    CreateCart(customer_session_id: $customerSessionId, currency: $currency, shipping_country: $shippingCountry) {\n      cart_id\n      customer_session_id\n      shipping_country\n      line_items {\n        id\n        supplier\n        image {\n          id\n          url\n          width\n          height\n        }\n        sku\n        barcode\n        brand\n        product_id\n        title\n        variant_id\n        variant_title\n        variant {\n          option\n          value\n        }\n        quantity\n        price {\n          amount\n          currency_code\n          discount\n          compare_at\n          compare_at_incl_taxes\n          amount_incl_taxes\n          tax_amount\n          tax_rate\n        }\n        shipping {\n          id\n          name\n          description\n          price {\n            amount\n            currency_code\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n        }\n        available_shippings {\n          id\n          name\n          description\n          country_code\n          price {\n            amount\n            currency_code\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n        }\n      }\n      subtotal\n      shipping\n      currency\n      available_shipping_countries\n    }\n  }\n}\n";
-declare const ADD_ITEM_MUTATION = "\nmutation AddItem($cartId: String!, $lineItems: [LineItemInput!]!) {\n  Cart {\n    AddItem(cart_id: $cartId, line_items: $lineItems) {\n      cart_id\n      customer_session_id\n      shipping_country\n      line_items {\n        id\n        supplier\n        image {\n          id\n          url\n          width\n          height\n        }\n        sku\n        barcode\n        brand\n        product_id\n        title\n        variant_id\n        variant_title\n        variant {\n          option\n          value\n        }\n        quantity\n        price {\n          amount\n          currency_code\n          discount\n          compare_at\n          compare_at_incl_taxes\n          amount_incl_taxes\n          tax_amount\n          tax_rate\n        }\n        shipping {\n          id\n          name\n          description\n          price {\n            amount\n            currency_code\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n        }\n        available_shippings {\n          id\n          name\n          description\n          country_code\n          price {\n            amount\n            currency_code\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n        }\n      }\n      subtotal\n      shipping\n      currency\n      available_shipping_countries\n    }\n  }\n}\n";
-declare const DELETE_ITEM_MUTATION = "\nmutation DeleteItem($cartId: String!, $cartItemId: String!) {\n  Cart {\n    DeleteItem(cart_id: $cartId, cart_item_id: $cartItemId) {\n      cart_id\n      customer_session_id\n      shipping_country\n      line_items {\n        id\n        supplier\n        image {\n          id\n          url\n          width\n          height\n        }\n        sku\n        barcode\n        brand\n        product_id\n        title\n        variant_id\n        variant_title\n        variant {\n          option\n          value\n        }\n        quantity\n        price {\n          amount\n          currency_code\n          discount\n          compare_at\n          compare_at_incl_taxes\n          amount_incl_taxes\n          tax_amount\n          tax_rate\n        }\n        shipping {\n          id\n          name\n          description\n          price {\n            amount\n            currency_code\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n        }\n        available_shippings {\n          id\n          name\n          description\n          country_code\n          price {\n            amount\n            currency_code\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n        }\n      }\n      subtotal\n      shipping\n      currency\n      available_shipping_countries\n    }\n  }\n}\n";
-declare const UPDATE_ITEM_MUTATION = "\nmutation UpdateItem($cartId: String!, $cartItemId: String!, $shippingId: String, $qty: Int) {\n  Cart {\n    UpdateItem(cart_id: $cartId, cart_item_id: $cartItemId, shipping_id: $shippingId, qty: $qty) {\n      cart_id\n      customer_session_id\n      shipping_country\n      line_items {\n        id\n        supplier\n        image {\n          id\n          url\n          width\n          height\n        }\n        sku\n        barcode\n        brand\n        product_id\n        title\n        variant_id\n        variant_title\n        variant {\n          option\n          value\n        }\n        quantity\n        price {\n          amount\n          currency_code\n          discount\n          compare_at\n          compare_at_incl_taxes\n          amount_incl_taxes\n          tax_amount\n          tax_rate\n        }\n        shipping {\n          id\n          name\n          description\n          price {\n            amount\n            currency_code\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n        }\n        available_shippings {\n          id\n          name\n          description\n          country_code\n          price {\n            amount\n            currency_code\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n        }\n      }\n      subtotal\n      shipping\n      currency\n      available_shipping_countries\n    }\n  }\n}\n";
-declare const GET_CART_QUERY = "\nquery GetCart($cartId: String!) {\n  Cart {\n    GetCart(cart_id: $cartId) {\n      cart_id\n      customer_session_id\n      shipping_country\n      line_items {\n        id\n        supplier\n        image {\n          id\n          url\n          width\n          height\n        }\n        sku\n        barcode\n        brand\n        product_id\n        title\n        variant_id\n        variant_title\n        variant {\n          option\n          value\n        }\n        quantity\n        price {\n          amount\n          currency_code\n          discount\n          compare_at\n          compare_at_incl_taxes\n          amount_incl_taxes\n          tax_amount\n          tax_rate\n        }\n        shipping {\n          id\n          name\n          description\n          price {\n            amount\n            currency_code\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n        }\n        available_shippings {\n          id\n          name\n          description\n          country_code\n          price {\n            amount\n            currency_code\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n        }\n      }\n      subtotal\n      shipping\n      currency\n      available_shipping_countries\n    }\n  }\n}\n";
-declare const GET_LINE_ITEMS_BY_SUPPLIER_QUERY = "\nquery GetLineItemsBySupplier($cartId: String!) {\n  Cart {\n    GetLineItemsBySupplier(cart_id: $cartId) {\n      supplier {\n        id\n        name\n      }\n      available_shippings {\n        id\n        name\n        description\n        country_code\n        price {\n          amount\n          currency_code\n          amount_incl_taxes\n          tax_amount\n          tax_rate\n        }\n      }\n      line_items {\n        id\n        supplier\n        image {\n          id\n          url\n          width\n          height\n        }\n        sku\n        barcode\n        brand\n        product_id\n        title\n        variant_id\n        variant_title\n        variant {\n          option\n          value\n        }\n        quantity\n        price {\n          amount\n          currency_code\n          discount\n          compare_at\n          compare_at_incl_taxes\n          amount_incl_taxes\n          tax_amount\n          tax_rate\n        }\n        shipping {\n          id\n          name\n          description\n          price {\n            amount\n            currency_code\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n        }\n      }\n    }\n  }\n}\n";
-declare const UPDATE_SHIPPINGS_BY_SUPPLIER_MUTATION = "\nmutation UpdateShippingsBySupplier($cartId: String!, $data: [DataUpdateShippingsBySupplier!]!) {\n  Cart {\n    UpdateShippingsBySupplier(cart_id: $cartId, data: $data) {\n      cart_id\n      customer_session_id\n      shipping_country\n      line_items {\n        id\n        supplier\n        image {\n          id\n          url\n          width\n          height\n        }\n        sku\n        barcode\n        brand\n        product_id\n        title\n        variant_id\n        variant_title\n        variant {\n          option\n          value\n        }\n        quantity\n        price {\n          amount\n          currency_code\n          discount\n          compare_at\n          compare_at_incl_taxes\n          amount_incl_taxes\n          tax_amount\n          tax_rate\n        }\n        shipping {\n          id\n          name\n          description\n          price {\n            amount\n            currency_code\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n        }\n        available_shippings {\n          id\n          name\n          description\n          country_code\n          price {\n            amount\n            currency_code\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n        }\n      }\n      subtotal\n      shipping\n      currency\n      available_shipping_countries\n    }\n  }\n}\n";
-declare const CREATE_CHECKOUT_MUTATION = "\nmutation CreateCheckout($cartId: String!) {\n  Checkout {\n    CreateCheckout(cart_id: $cartId) {\n      buyer_accepts_purchase_conditions\n      buyer_accepts_terms_conditions\n      created_at\n      updated_at\n      id\n      deleted_at\n      success_url\n      cancel_url\n      payment_method\n      email\n      status\n      checkout_url\n      origin_payment_id\n      billing_address {\n        id\n        first_name\n        last_name\n        phone_code\n        phone\n        company\n        address1\n        address2\n        city\n        province\n        province_code\n        country\n        country_code\n        zip\n      }\n      shipping_address {\n        id\n        first_name\n        last_name\n        phone_code\n        phone\n        company\n        address1\n        address2\n        city\n        province\n        province_code\n        country\n        country_code\n        zip\n      }\n      available_payment_methods {\n        name\n      }\n      discount_code\n      cart {\n        cart_id\n        customer_session_id\n        shipping_country\n        line_items {\n          id\n          supplier\n          image {\n            id\n            url\n            width\n            height\n          }\n          sku\n          barcode\n          brand\n          product_id\n          title\n          variant_id\n          variant_title\n          variant {\n            option\n            value\n          }\n          quantity\n          price {\n            amount\n            currency_code\n            discount\n            compare_at\n            compare_at_incl_taxes\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n          shipping {\n            id\n            name\n            description\n            price {\n              amount\n              currency_code\n              amount_incl_taxes\n              tax_amount\n              tax_rate\n            }\n          }\n          available_shippings {\n            id\n            name\n            description\n            country_code\n            price {\n              amount\n              currency_code\n              amount_incl_taxes\n              tax_amount\n              tax_rate\n            }\n          }\n        }\n        subtotal\n        shipping\n        currency\n        available_shipping_countries\n      }\n      totals {\n        currency_code\n        subtotal\n        shipping\n        total\n        taxes\n        tax_rate\n        discounts\n      }\n    }\n  }\n}\n";
-declare const UPDATE_CHECKOUT_MUTATION = "\nmutation UpdateCheckout($checkoutId: String!, $status: String, $successUrl: String, $email: String, $cancelUrl: String, $paymentMethod: String, $shippingAddress: AddressArgs, $billingAddress: AddressArgs, $buyerAcceptsPurchaseConditions: Boolean, $buyerAcceptsTermsConditions: Boolean) {\n  Checkout {\n    UpdateCheckout(checkout_id: $checkoutId, status: $status, success_url: $successUrl, email: $email, cancel_url: $cancelUrl, payment_method: $paymentMethod, shipping_address: $shippingAddress, billing_address: $billingAddress, buyer_accepts_purchase_conditions: $buyerAcceptsPurchaseConditions, buyer_accepts_terms_conditions: $buyerAcceptsTermsConditions) {\n      buyer_accepts_purchase_conditions\n      buyer_accepts_terms_conditions\n      created_at\n      updated_at\n      id\n      deleted_at\n      success_url\n      cancel_url\n      payment_method\n      email\n      status\n      checkout_url\n      origin_payment_id\n      billing_address {\n        id\n        first_name\n        last_name\n        phone_code\n        phone\n        company\n        address1\n        address2\n        city\n        province\n        province_code\n        country\n        country_code\n        zip\n      }\n      shipping_address {\n        id\n        first_name\n        last_name\n        phone_code\n        phone\n        company\n        address1\n        address2\n        city\n        province\n        province_code\n        country\n        country_code\n        zip\n      }\n      available_payment_methods {\n        name\n      }\n      discount_code\n      cart {\n        cart_id\n        customer_session_id\n        shipping_country\n        line_items {\n          id\n          supplier\n          image {\n            id\n            url\n            width\n            height\n          }\n          sku\n          barcode\n          brand\n          product_id\n          title\n          variant_id\n          variant_title\n          variant {\n            option\n            value\n          }\n          quantity\n          price {\n            amount\n            currency_code\n            discount\n            compare_at\n            compare_at_incl_taxes\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n          shipping {\n            id\n            name\n            description\n            price {\n              amount\n              currency_code\n              amount_incl_taxes\n              tax_amount\n              tax_rate\n            }\n          }\n          available_shippings {\n            id\n            name\n            description\n            country_code\n            price {\n              amount\n              currency_code\n              amount_incl_taxes\n              tax_amount\n              tax_rate\n            }\n          }\n        }\n        subtotal\n        shipping\n        currency\n        available_shipping_countries\n      }\n      totals {\n        currency_code\n        subtotal\n        shipping\n        total\n        taxes\n        tax_rate\n        discounts\n      }\n    }\n  }\n}\n";
-declare const GET_CHECKOUT_QUERY = "\nquery GetCheckout($checkoutId: String!) {\n  Checkout {\n    GetCheckout(checkout_id: $checkoutId) {\n      buyer_accepts_purchase_conditions\n      buyer_accepts_terms_conditions\n      created_at\n      updated_at\n      id\n      deleted_at\n      success_url\n      cancel_url\n      payment_method\n      email\n      status\n      checkout_url\n      origin_payment_id\n      duplicate_of\n      billing_address {\n        id\n        first_name\n        last_name\n        phone_code\n        phone\n        company\n        address1\n        address2\n        city\n        province\n        province_code\n        country\n        country_code\n        zip\n      }\n      shipping_address {\n        id\n        first_name\n        last_name\n        phone_code\n        phone\n        company\n        address1\n        address2\n        city\n        province\n        province_code\n        country\n        country_code\n        zip\n      }\n      available_payment_methods {\n        name\n      }\n      discount_code\n      cart {\n        cart_id\n        customer_session_id\n        shipping_country\n        line_items {\n          id\n          supplier\n          image {\n            id\n            url\n            width\n            height\n          }\n          sku\n          barcode\n          brand\n          product_id\n          title\n          variant_id\n          variant_title\n          variant {\n            option\n            value\n          }\n          quantity\n          price {\n            amount\n            currency_code\n            discount\n            compare_at\n            compare_at_incl_taxes\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n          shipping {\n            id\n            name\n            description\n            price {\n              amount\n              currency_code\n              amount_incl_taxes\n              tax_amount\n              tax_rate\n            }\n          }\n          available_shippings {\n            id\n            name\n            description\n            country_code\n            price {\n              amount\n              currency_code\n              amount_incl_taxes\n              tax_amount\n              tax_rate\n            }\n          }\n        }\n        subtotal\n        shipping\n        currency\n        available_shipping_countries\n      }\n      totals {\n        currency_code\n        subtotal\n        shipping\n        total\n        taxes\n        tax_rate\n        discounts\n      }\n    }\n  }\n}\n";
-declare const GET_AVAILABLE_PAYMENT_METHODS_QUERY = "\nquery Config {\n  Payment {\n    GetAvailablePaymentMethods {\n      config {\n        name\n        type\n        value\n      }\n      name\n    }\n  }\n}\n";
-/** Transport options for a cart/checkout GraphQL call. */
-interface CartQueryOptions {
-    endpoint?: string;
-    apiKey?: string;
-    /** Sponsor commerce key — goes in the Authorization header. */
-    commerceKey?: string;
-    /** True when the commerce key came from a resolved sponsor (bootstrap).
-     * False = we fell back to the host apiKey — writes like CreateCart should
-     * NOT proceed with the wrong key (the cart would be orphaned). */
-    sponsorResolved?: boolean;
-}
+interface ClientContext {
+    language?: string;
+    referrer?: string;
+    utm_source?: string;
+    utm_medium?: string;
+    utm_campaign?: string;
+    utm_term?: string;
+    utm_content?: string;
+    screen_w?: number;
+    screen_h?: number;
+    tz?: string;
+}
+declare const UTM_KEYS: readonly ["utm_source", "utm_medium", "utm_campaign", "utm_term", "utm_content"];
+type UtmKey = (typeof UTM_KEYS)[number];
+/** Commerce's cap for the landing page on the order's entry context (`entry.landing_url`, ADR-0035). */
+declare const CLIENT_LANDING_URL_MAX_LENGTH = 2048;
 /**
- * Resolve endpoint + keys for cart GraphQL calls. Awaits Vio.bootstrap() once
- * if it hasn't run yet (the sponsor commerce keys come from bootstrap), then
- * uses the sponsor's commerce apiKey (via the Vio facade on globalThis,
- * avoiding an import cycle); falls back to the host apiKey.
+ * What a session remembers of the page it landed on. `url` is the landing
+ * page itself — origin + path, like the referrer: no query (the utm are kept
+ * apart, the rest is a tracking tail), no fragment — for the order's entry
+ * context; the events do not carry it (the collector derives the landing).
  */
-declare function getCartGraphQLOptions(sponsorId?: number): Promise<CartQueryOptions>;
-/** Stable per-browser customer session id (backend CreateCart requires one). */
-declare function getCustomerSessionId(): string;
-interface GraphQLEnvelope {
-    data?: Record<string, Record<string, unknown>>;
-    errors?: Array<{
-        message?: string;
-    }>;
+interface Landing {
+    referrer?: string;
+    utm?: Partial<Record<UtmKey, string>>;
+    url?: string;
+}
+interface StorageLike {
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem?(key: string): void;
+}
+/** The globals the block is read from — injectable for tests; defaults to the real ones. */
+interface ClientEnvironment {
+    navigator?: {
+        language?: unknown;
+    } | null;
+    document?: {
+        referrer?: unknown;
+    } | null;
+    location?: {
+        search?: unknown;
+        host?: unknown;
+        href?: unknown;
+    } | null;
+    screen?: {
+        width?: unknown;
+        height?: unknown;
+    } | null;
+    /** The session memory for the landing; `null` = none (SSR, private mode, blocked). */
+    storage?: StorageLike | null;
+    /** The time zone; defaults to `Intl.DateTimeFormat().resolvedOptions().timeZone`. */
+    timeZone?: () => unknown;
 }
-/** Execute a GraphQL query/mutation against the configured commerce endpoint.
- * Callers that skip `getCartGraphQLOptions()` (or pass a bare sponsorId) get
- * it resolved here instead of silently sending an unauthenticated request.
- * Rejects after `CART_GRAPHQL_TIMEOUT_MS` (and aborts the fetch). */
-declare function executeCartGraphQL(query: string, variables: Record<string, unknown>, options?: CartQueryOptions | number | undefined): Promise<GraphQLEnvelope>;
-declare function createCart(customerSessionId: string, currency: string, shippingCountry?: string | null, options?: CartQueryOptions): Promise<any>;
-declare function addItem(cartId: string, lineItems: unknown[], options?: CartQueryOptions): Promise<any>;
-declare function deleteItem(cartId: string, cartItemId: string, options?: CartQueryOptions): Promise<any>;
-declare function updateItem(cartId: string, cartItemId: string, shippingId?: string | null, qty?: number | null, options?: CartQueryOptions): Promise<any>;
-declare function getCart(cartId: string, options?: CartQueryOptions): Promise<any>;
-declare function getLineItemsBySupplier(cartId: string, options?: CartQueryOptions): Promise<any>;
-declare function updateShippingsBySupplier(cartId: string, data: unknown[], options?: CartQueryOptions): Promise<any>;
-declare function createCheckout(cartId: string, options?: CartQueryOptions): Promise<any>;
-declare function updateCheckout(variables: Record<string, unknown>, options?: CartQueryOptions): Promise<any>;
-declare function getCheckout(checkoutId: string, options?: CartQueryOptions): Promise<any>;
-declare function getAvailablePaymentMethods(options?: CartQueryOptions): Promise<any>;
-declare const CREATE_PAYMENT_STRIPE_MUTATION = "\nmutation CreatePaymentStripe($checkoutId: String!, $successUrl: String!, $paymentMethod: String!, $email: String!) {\n  Payment {\n    CreatePaymentStripe(checkout_id: $checkoutId, success_url: $successUrl, payment_method: $paymentMethod, email: $email) {\n      order_id\n      checkout_url\n    }\n  }\n}\n";
-declare function createPaymentStripe(variables: Record<string, unknown>, options?: CartQueryOptions): Promise<any>;
+/**
+ * The landing of this session: what is remembered — unless this page is a
+ * landing itself (utm parameters in its URL, reached from outside this host)
+ * or nothing is remembered yet, when this page's referrer and utm are taken
+ * (and, with `persist`, kept).
+ */
+declare function resolveLanding(env?: ClientEnvironment, persist?: boolean): Landing;
+/** The landing page as the landing keeps it: origin + path, no query, no fragment; capped. */
+declare function landingUrl(raw: unknown): string | undefined;
+/**
+ * The landing this session REMEMBERS — what was written by the first page —
+ * or null when nothing is stored (no storage, no consent, analytics never
+ * started). Read only: for the order's entry context, which must not take the
+ * page the shopper pays on for the page they came in through.
+ */
+declare function storedLanding(storage?: StorageLike | null | undefined): Landing | null;
+/** The block for the wire — read once per page load by the manager and reused on every event. */
+declare function resolveClientContext(env?: ClientEnvironment, landing?: Landing): ClientContext;
 
 /**
- * Stripe on our own page — the Payment Element, no redirect.
+ * Slots — the pure half of ADR-0027 / ADR-0034 on the web.
  *
- * The older web flow minted a Stripe Payment Link and sent the shopper to a
- * page hosted by Stripe. This one keeps them here (Angelo, 2026-09-24):
+ * A slot is a NAME for a place on a page. The page declares its slots to the
+ * campaigns service (`Vio.declareSlots()` / `Vio.registerSlot()` in client.ts),
+ * the dashboard assigns a campaign to each one, optionally with a date window,
+ * and `GET /v2/mobile/config` answers with `campaigns[].slots[]` — only the
+ * assignments whose window is open NOW. Whatever no slot names shows the
+ * surface's default campaign (`campaign`).
  *
- *   1. Vio Commerce creates a PaymentIntent for the checkout
- *      (`Payment { CreatePaymentIntentStripe }`) and answers with its client
- *      secret AND the publishable key of the account that minted it — the
- *      seller's when they brought both keys, ours otherwise. The two are
- *      halves of one account: the browser confirms with the key what the
- *      server minted with the secret one.
- *   2. Stripe's Payment Element is mounted in a LIGHT-DOM container, the way
- *      the other embedded widgets are. Card fields are Stripe's own iframes,
- *      so card data never touches this SDK or our servers.
- *   3. `confirm()` pays. A 3-D Secure challenge opens in Stripe's own modal
- *      over the page: `redirect: 'if_required'` keeps the shopper here for
- *      cards, and still redirects for a method that has no other way.
- *   4. The Commerce order is NOT born here. Stripe's `payment_intent.succeeded`
- *      webhook creates it, verified server-side; the checkout is polled for
- *      its status afterwards, exactly as the redirect return does.
+ * Everything here is side-effect free and never throws on a malformed
+ * bootstrap: a broken `campaigns[]` must never blank a product block or break
+ * `track()`.
  */
 
-/** What the backend hands over to pay a checkout on our page. */
-interface StripeIntent {
-    /** `pi_..._secret_...`: what the browser confirms. */
-    client_secret: string;
-    /** The key of the SAME account that minted the secret. */
-    publishable_key: string;
-    customer?: string;
-    /**
-     * Stripe Connect (ADR-0022): the seller's connected account, where the
-     * intent lives. The browser must name it or Stripe answers "no such
-     * payment_intent". Absent for every seller not on Connect.
-     */
-    stripe_account?: string;
-}
-/** What `confirm()` answers. The browser's word is never the order. */
-type StripeConfirmOutcome = {
-    status: 'succeeded';
-    paymentIntentId?: string;
-}
-/** Authorised but not settled yet, or Stripe redirected and will return. */
- | {
-    status: 'pending';
-    paymentIntentId?: string;
-} | {
-    status: 'failed';
-    message?: string;
-    code?: string;
+/** What `Vio.declareSlots()` accepts per slot. */
+type SlotInput = string | {
+    id: string;
+    displayName?: string;
+    campaignId?: number;
+    kind?: string;
 };
-interface StripeElementHandle {
-    confirm(): Promise<StripeConfirmOutcome>;
-    unmount(): void;
+/** The third argument of `Vio.registerSlot(id, displayName, …)`: the element's own campaign and what kind of element it is. */
+interface RegisterSlotOptions {
+    campaignId?: number | string | null;
+    /** `card` | `carousel` | `detail` for the SDK's elements; a host may name its own kind. */
+    kind?: string;
 }
+/**
+ * The kind of component some units were sold from, as Commerce keeps it on
+ * the order line (`order_item.component_kind`, ≤ 32) — the SAME rule the
+ * collector applies for `breakdown?by=component_kind` (vio-analytics
+ * `componentKind`), so the order and the events agree: what the element says
+ * it is (`component_template_id`: `product-card`, `product-carousel`,
+ * `product-detail`, a Vev block's `vev-card`) lower-cased and without its
+ * `product-` / `vev-` prefix, else the kind word in the slot id the page
+ * declared (`card-<key>`, `<scope>-carousel-2`, `detail-1`); `undefined` when
+ * neither says.
+ */
+declare function componentKindOf(templateId: unknown, slot?: unknown): string | undefined;
+/** The kind as the manifest carries it: trimmed, lower-case, cut at 32 chars; `undefined` for nothing. */
+declare function normalizeSlotKind(value: unknown): string | undefined;
+type BootLike = Pick<BootstrapResponse, 'campaign' | 'campaigns' | 'primarySponsor' | 'secondarySponsors'>;
+/**
+ * The campaign a slot shows right now. Among the `status === 'active'`
+ * entries of `campaigns[]`, the one with an assignment named `slot` for this
+ * platform (`platform` null on the assignment, or equal to `platform`) whose
+ * window contains `now` (`startDate <= now < endDate`, null = open). When
+ * several qualify, the surface's default campaign wins, else the first the
+ * backend lists.
+ *
+ * No assignment → the PAGE's campaign (`pageCampaignId`: the element's own
+ * `vio-campaign`, an ancestor's `data-vio-campaign`, or `Vio.init({ campaignId })`)
+ * when `campaigns[]` lists it as active — an editorial page resolves to its
+ * campaign before (and regardless of) the manifest round-trip. Else the
+ * default campaign: the `campaigns[]` entry whose id is `campaign.id`, or a
+ * minimal entry built from `campaign` (+ the top-level sponsors) when the
+ * list does not carry it. No bootstrap → null.
+ */
+declare function resolveSlotCampaign(boot: BootLike | null | undefined, slot: string | null | undefined, now?: number, platform?: string | null, pageCampaignId?: CampaignHint, sponsorId?: number | null): BootstrapCampaignEntry | null;
+/**
+ * The sponsor rule: the active campaign of `campaigns[]` the sponsor takes
+ * part in, as its primary or one of its secondaries — when it is in several,
+ * the surface's default campaign if it is one of them, else the first one
+ * the backend lists. Null when none (or on a malformed list).
+ */
+declare function sponsorCampaignEntry(boot: BootLike | null | undefined, sponsorId: number | null | undefined): BootstrapCampaignEntry | null;
+/**
+ * A page campaign as the callers give it: one id, or the candidates in
+ * precedence order (the element's `vio-campaign`, an ancestor's
+ * `data-vio-campaign`, `Vio.init`'s). An unusable level (invalid, paused,
+ * unknown) falls through to the next one; `0`, `null`, `''` mean unset.
+ */
+type CampaignHint = number | string | null | undefined | ReadonlyArray<number | string | null | undefined>;
+/**
+ * A campaign id as the SDK accepts it: a positive safe integer, given as a
+ * number or as a string of decimal digits (an attribute). Anything else —
+ * `true`, `'0x10'`, `'1e3'`, an array, a float — is "absent".
+ */
+declare function toCampaignId(value: unknown): number | undefined;
+/** The usable ids of a hint, in order, without duplicates. */
+declare function campaignCandidates(hint: CampaignHint): number[];
+/**
+ * The first candidate of `hint` that `campaigns[]` lists as ACTIVE (and, when
+ * `sponsorId` is given, that the sponsor takes part in — primary or
+ * secondary); null when none — a paused, ended or unknown page campaign is
+ * ignored and the resolution moves on.
+ */
+declare function activeCampaignEntry(boot: BootLike | null | undefined, hint: CampaignHint, sponsorId?: number): BootstrapCampaignEntry | null;
+/** The kinds of Vio element that register themselves. */
+type SlotKind = 'card' | 'carousel' | 'detail';
+/**
+ * The id an element gets when the host set no `vio-slot`:
+ * `${scope ? scope + '-' : ''}${kind}-${ordinal + 1}` (`carousel-1`, `card-3`,
+ * `article-123-carousel-1`), `ordinal` being the element's index among the
+ * same-kind Vio elements WITH THE SAME SCOPE, in document order at connect
+ * time. The scope is inherited from the DOM (`vio-scope` on the element, else
+ * the nearest `data-vio-scope` ancestor): a Vev page or a Replit article
+ * (`<body data-vio-scope="article-123">`) gets per-page slots with one line
+ * and no per-element naming; a template that wants slots shared across
+ * articles simply sets no scope. On purpose there is NO page path in the id:
+ * the article goes to analytics as `content_id`, not into the slot. Stable
+ * across reloads while the layout is; a layout change leaves a stale entry,
+ * which ADR-0034 accepts.
+ */
+declare function autoSlotId(kind: SlotKind, ordinal: number, scope?: string | null): string;
+/** `"Carousel 1"`, `"Card 3"` — with ` · ${scopeName}` when the scope has a human label. */
+declare function autoSlotDisplayName(kind: SlotKind, ordinal: number, scopeName?: string | null): string;
+/** A scope value fit for an id: trimmed, inner whitespace → `-`. */
+declare function normalizeScope(scope: string | null | undefined): string;
 
 /**
- * Apple Pay on the Web — via Stripe Payment Request API.
+ * Vio.analytics — the web SDK's half of the Vio Analytics pipeline.
  *
- * Architecture decision (matches iOS Vio SDK pattern):
- *   - One Stripe **publishable key** for the Vio platform (global, set
- *     via `Vio.init({ stripePublishableKey })`).
- *   - One **Stripe Connect account id** per sponsor — sourced from
- *     `Vio.bootstrap()` response. Without it, the payment lands on the
- *     platform account instead of the merchant.
+ * Events flow to the Vio collector (`POST <eventsBase>/v1/events`, repo
+ * vio-live/vio-analytics) which owns raw storage (ClickHouse) and vendor
+ * fan-out (Mixpanel today). THE SDK NEVER TALKS TO VENDORS — swapping or
+ * dropping a vendor is a server-side change, zero client releases.
+ * Wire contract: vio-analytics `docs/EVENTS_CONTRACT.md` (v1, snake_case).
  *
- * Apple Pay on the Web prerequisites (Stripe-managed for us):
- *   - Stripe Connect account is enabled for Apple Pay
+ * Design rules:
+ * - SIDE-EFFECT-FREE MODULE. Nothing runs at import time (tsup/tree-shaking
+ *   contract, see lessons/web-sdk-tsup-singleton-and-build). Listeners are
+ *   installed by an explicit `Vio.analytics.start()`.
+ * - `track()` works BEFORE `Vio.init()` — events queue and flush once the
+ *   SDK is configured (transport resolves at flush time, not at track time).
+ * - SSR-safe: without `window` every call is a silent no-op.
+ * - Retries are safe: `event_id` is stable per event, the collector
+ *   dedupes. Queue is bounded (drop-oldest) so a dead collector can never
+ *   grow memory unbounded.
+ * - Anti-double-count: the SDK only reports what the server can't see.
+ *   Votes/participations are server truth; `ad_activation`/`cart_intent`
+ *   are mirrored server-side, never from here.
+ *
+ * Three sinks, matching the Vev precedent (vio-vev analytics.ts, which
+ * becomes an adapter over this in F3):
+ *   1. collector (default ON once started)
+ *   2. window.dataLayer — GA4/GTM (opt-in `start({ dataLayer: true })`,
+ *      the publisher-facing feature; NOT part of the Vio pipeline)
+ *   3. `vio:analytics` DOM event — always when started (inspector/bridges)
+ */
+
+declare const ANALYTICS_EVENT_NAMES: readonly ["view_item_list", "select_item", "view_item", "add_to_cart", "remove_from_cart", "view_cart", "begin_checkout", "purchase", "component_impression", "component_click", "ad_impression", "ad_click", "poll_impression", "contest_impression", "session_start", "session_end", "checkout_error", "sdk_error"];
+type AnalyticsEventName = (typeof ANALYTICS_EVENT_NAMES)[number];
+/** Camel-case for DX; mapped to the snake_case wire format at build time. */
+interface AnalyticsContext {
+    campaignId?: number;
+    broadcastId?: string;
+    campaignComponentId?: number;
+    appPlacementId?: number;
+    locationId?: string;
+    componentTemplateId?: string;
+    sponsorId?: number;
+    activationId?: number;
+    contentUrl?: string;
+    /**
+     * The host's own id for the piece of content the component sits in — an
+     * article id in a CMS, a page id in a site builder. Carried verbatim so the
+     * host can join Vio's funnel back onto its own per-article reporting
+     * (revenue stops being an estimate). Left alone by the SDK.
+     */
+    contentId?: string | number;
+    /** Human-readable content snapshot; auto-filled from document.title. */
+    contentTitle?: string;
+    /** Código corto del fallo (`sdk_error` / `checkout_error`). */
+    errorCode?: string;
+    variant?: string;
+    /**
+     * The slot (ADR-0027) the component sits in — its `vio-slot`. Attribution
+     * follows it: the event's `campaign_id` is the campaign assigned to the slot
+     * right now, before the sponsor rule. On the wire it fills `location_id`
+     * when no explicit `locationId` is given (a slot IS a location id to the
+     * campaigns service).
+     */
+    slot?: string;
+}
+interface AnalyticsItemInput {
+    productId: number | string;
+    name?: string;
+    brand?: string;
+    variantId?: number | string;
+    price?: number;
+    quantity?: number;
+}
+interface AnalyticsCommerce {
+    items?: AnalyticsItemInput[];
+    value?: number;
+    currency?: string;
+    orderId?: string;
+    paymentMethod?: string;
+    /**
+     * The buyer reference (`buyer_id` on the wire): shopcart's `buyer_ref`, a
+     * keyed hash of the buyer's email — one person, one ref across orders and
+     * devices, nothing reversible. Never an email (see core/buyer-ref.ts).
+     */
+    buyerId?: string;
+}
+interface TrackOptions {
+    context?: AnalyticsContext;
+    commerce?: AnalyticsCommerce;
+    props?: Record<string, unknown>;
+}
+interface AnalyticsStartOptions {
+    /** Where the SDK is embedded: 'vev' | 'replit' | 'custom' | … Default 'custom'. */
+    host?: string;
+    /**
+     * Arrancar en modo cookieless hasta que el host llame `setConsent(true)`.
+     * Default false: el SDK asume que el CMP del publisher ya decidió si nos
+     * carga. Los publishers EU que necesitan medir antes del consentimiento
+     * (o no pueden persistir sin él) ponen true.
+     */
+    requireConsent?: boolean;
+    /**
+     * Install the automatic funnel listeners (vio:added-to-cart,
+     * vio:checkout-open, vio:open-cart, vio:payment-success). Default true.
+     * Hosts with their OWN instrumentation choke point (e.g. the Vev module,
+     * which forwards every event through trackEvent()) set false so the same
+     * user action is never tracked twice — they keep the session/batching/
+     * transport engine and call track() themselves.
+     */
+    autoTrack?: boolean;
+    /**
+     * Adopt the host's session id instead of minting one. A host that already
+     * tracks its readers (its own impressions, dwell, clicks) needs Vio's
+     * purchases to land in the SAME session, or the two datasets cannot be
+     * joined. Pass the id the host already stores; omit it and the SDK keeps
+     * its own rotating session.
+     */
+    sessionId?: string;
+    /** Send to the Vio collector. Default true. */
+    collector?: boolean;
+    /** Also push GA4 e-commerce events to window.dataLayer (publisher feature). */
+    dataLayer?: boolean;
+    /** console.debug every event. */
+    debug?: boolean;
+}
+declare class AnalyticsManager extends EventTarget {
+    private started;
+    private options;
+    private queue;
+    private flushTimer;
+    private retryAttempt;
+    private retryNotBefore;
+    private externalUserId;
+    private sessionId;
+    private requireConsent;
+    private consentGranted;
+    private anonIdCache;
+    /** Set via start({ sessionId }) — the host owns the session, we follow. */
+    private externalSessionId;
+    private sessionStartedAt;
+    /** Impression once-per-(session, component) guard; reset on session rotation. */
+    private impressedComponents;
+    /** Last NON-EMPTY cart snapshot — `purchase` uses it because several flows
+     * (Apple Pay) clear the cart BEFORE `vio:payment-success` fires. */
+    private lastCartSnapshot;
+    /** The `client` block (language, landing referrer / utm, screen, tz): read once per page load, reused on every event. */
+    private client;
+    /** The landing it was read from — persisted later when consent arrives after the first event. */
+    private landing;
+    /** The landing this manager resolved on this page load (the first event's), or null before it; read only — for the order's entry context when nothing is stored yet. */
+    get currentLanding(): Landing | null;
+    private teardown;
+    /**
+     * Install listeners + begin flushing. Explicit on purpose (no module
+     * side-effects). Safe to call twice (second call only updates options).
+     */
+    /**
+     * Consentimiento (ePrivacy/GDPR). Por defecto el SDK asume que el host ya
+     * lo gestionó — su CMP decide si nos carga. Con `requireConsent: true`
+     * arranca en modo **cookieless**: mide la visita con ids efímeros en
+     * memoria y NO escribe nada en localStorage hasta que el host llame
+     * `setConsent(true)`. Retirarlo borra lo persistido.
+     */
+    setConsent(granted: boolean): void;
+    /** ¿Podemos escribir en el dispositivo? */
+    private get canPersist();
+    start(options?: AnalyticsStartOptions): void;
+    /** Stop timers + listeners (tests / SPA unmount). Queue survives. */
+    stop(): void;
+    /** Attach the partner's user id (opaque) to all subsequent events. */
+    identify(externalUserId: string | null): void;
+    /** Queue one event. Works pre-init and pre-start (SSR: no-op). */
+    track(name: AnalyticsEventName, opts?: TrackOptions): void;
+    /**
+     * Impression helper: observes an element and tracks ONE
+     * `component_impression` per (session, campaignComponentId) when the
+     * contract's rule is met (≥50% visible, ≥1s dwell). Returns an
+     * unobserve function.
+     */
+    observeImpression(element: Element, context?: AnalyticsContext, opts?: {
+        name?: Extract<AnalyticsEventName, 'component_impression' | 'ad_impression'>;
+        /** Dedupe key override. Defaults to the strongest id available:
+         *  campaignComponentId → locationId → componentTemplateId. */
+        key?: string;
+        /** Called the one time the impression is tracked (e.g. to fire a
+         *  companion view_item_list). */
+        onImpression?: () => void;
+    }): () => void;
+    /** Force a flush (mostly for tests). */
+    flush(): Promise<void>;
+    private buildEvent;
+    /**
+     * The `client` block: read once — the landing is remembered for the session
+     * only when we may persist — then the same (frozen) object on every event.
+     * `null` when there is nothing to say (no browser).
+     */
+    private clientBlock;
+    /** Guarda la sesión solo si podemos escribir en el dispositivo. */
+    private persistSession;
+    private anonId;
+    /** Rolling session: renewed by activity, rotated after 30 min idle. */
+    private ensureSession;
+    private trackSessionEnd;
+    private flushWithBeacon;
+    /**
+     * Auto-instrumentation over the SDK's own DOM events — the host app
+     * writes ZERO tracking code for the commerce funnel.
+     */
+    private installAutoListeners;
+    /** The lines of the cart (current, else the pre-clear snapshot), optionally one sponsor's. */
+    private cartLines;
+    /**
+     * The cart split per campaign — the shared rule of cart/slices.ts over the
+     * current cart (else the pre-clear snapshot), plus whether any unit named
+     * its campaign itself (a cart without origins is reported as before).
+     */
+    private cartSlices;
+    /**
+     * The context of one of several per-campaign events: the slice's campaign,
+     * slot and content — only its own; when the slice spans several slots or
+     * articles the event names none rather than the one the click came from.
+     */
+    private sliceContext;
+    /**
+     * The context of a single-campaign checkout/purchase: when the cart's origins
+     * say which campaign they came from, the event says it too (plus the slot /
+     * content when unique) — a cart without origins is exactly as before.
+     */
+    private singleSliceContext;
+    /** Current cart → commerce payload; falls back to the pre-clear snapshot. */
+    private cartCommerce;
+    private findLine;
+}
+/**
+ * The `campaign_id` of an event. In order: the context's explicit id; the
+ * campaign assigned to the context's `slot` right now (ADR-0027 — only an
+ * open assignment for the init platform counts, see `findSlotAssignment`);
+ * the PAGE's campaign (`opts.pageCampaignId`, else `Vio.init({ campaignId })`)
+ * when `campaigns[]` lists it as active (ADR-0034, amendment 3);
+ * the active campaign of `campaigns[]` the event's sponsor takes part in, as
+ * its primary or one of its secondaries — when it is in several, the
+ * surface's default campaign if it is one of them, else the first one the
+ * backend lists; the default campaign (`campaign.id`). `/v2/mobile/config`
+ * has no top-level `campaignId` — reading one is why every event used to
+ * leave with `campaign_id: 0` and the campaigns screen stayed empty.
+ *
+ * A malformed `campaigns[]` (not an array, a null entry) never breaks
+ * `track()`: it falls back to `campaign.id`.
+ */
+declare function resolveCampaignId(ctx: Pick<AnalyticsContext, 'campaignId' | 'sponsorId' | 'slot'>, boot: Pick<BootstrapResponse, 'campaign' | 'campaigns'> | null | undefined, opts?: {
+    pageCampaignId?: CampaignHint;
+}): number | undefined;
+/**
+ * `detail` of `vio:payment-success` as the checkout emits it. Four paths,
+ * three shapes: a redirect return (`orderId` = Vio's checkout id), the
+ * confirmation drawer and a provider's own receipt (`result` from the
+ * provider or the backend, plus Vio's `checkoutId`), and Apple Pay express
+ * from the cart (`result` with the backend's `confirmation`, no sponsor).
+ */
+interface PaymentSuccessDetail {
+    method?: string;
+    sponsorId?: number | string;
+    /** The slot the purchase started from, when the emitter knows it. */
+    slot?: string;
+    /** The campaign the emitter attributed the purchase to (its `Vio.attribution`). */
+    campaignId?: number;
+    /** Per-element content override (`vio-content-id` / `vio-content-title`), when the emitter carries one. */
+    contentId?: string | number;
+    contentTitle?: string;
+    /** Redirect return: Vio's checkout id (the name predates `checkoutId`). */
+    orderId?: string | number;
+    /** Vio's checkout id — from the checkout state or the return URL. */
+    checkoutId?: string | number;
+    /**
+     * The buyer reference the emitter learned with the payment — shopcart's
+     * `buyer_ref`, a keyed hash of the email (`buyerRef` from the SDK's own
+     * checkout; `buyer_ref` when a host passes the backend's answer through).
+     * Becomes `commerce.buyer_id`; never an email.
+     */
+    buyerRef?: string | null;
+    buyer_ref?: string | null;
+    result?: PaymentSuccessResult | null;
+}
+/**
+ * What the checkout attaches as `result`. Only `confirmation` carries a Vio
+ * id: the order `ConfirmPaymentApplePay` created. `order.orderId` / `orderId`
+ * are the PROVIDER's references (Qliro's, Walley's — the checkout itself
+ * shows them as `providerRef`), and `chargedTotal` includes shipping on some
+ * methods only. Analytics reads none of those.
+ */
+interface PaymentSuccessResult {
+    confirmation?: {
+        orderId?: string | number | null;
+        status?: string;
+        buyerRef?: string | null;
+        buyer_ref?: string | null;
+    } | null;
+    /** The checkout as a host's backend answered it, when the host passes it through. */
+    checkout?: {
+        buyerRef?: string | null;
+        buyer_ref?: string | null;
+    } | null;
+    buyerRef?: string | null;
+    buyer_ref?: string | null;
+    [key: string]: unknown;
+}
+/**
+ * The buyer reference of a `vio:payment-success` / `vio:checkout-open`
+ * detail, wherever its emitter put it: top-level (`buyerRef`, or `buyer_ref`
+ * as the backend spells it), on the result, on the result's `confirmation`
+ * (Apple Pay) or `checkout`. Only a reference survives — never an email
+ * (`normalizeBuyerRef`).
+ */
+declare function buyerRefOf(d: {
+    buyerRef?: unknown;
+    buyer_ref?: unknown;
+    result?: PaymentSuccessResult | null;
+} | null | undefined): string | undefined;
+/**
+ * The `order_id` and `buyer_id` of a `purchase`. The id is ALWAYS a Vio id, never a provider's
+ * reference. Normalized across every emitter: `orderId` (redirect return) →
+ * `result.confirmation.orderId` (Apple Pay) → `checkoutId`. `value` and
+ * `currency` are deliberately NOT read from the result: on every path they
+ * come from the cart snapshot (sum of the items, no shipping), so revenue
+ * stays comparable across payment methods — the charged total will arrive
+ * through the server-side `order_paid` event. With nothing to say it
+ * returns `{}`, so the cart snapshot keeps its keys.
+ */
+declare function purchaseFromPaymentSuccess(d: PaymentSuccessDetail): Pick<AnalyticsCommerce, 'orderId' | 'buyerId'>;
+
+/**
+ * The cart split per campaign (ADR-0034) — ONE rule, shared by the SDK's own
+ * `begin_checkout` / `purchase` events, by `Vio.cartSlices()` and so by any
+ * host with its own analytics sink (Vev).
+ *
+ * Every unit of every line goes to the campaign of its origin — the one the
+ * place showed when it was added — and units without one to the campaign the
+ * caller's rule resolves for the line's sponsor (`resolveCampaign`). One slice
+ * per campaign: its items (quantities from the origins, merged per product +
+ * variant), its value with two decimals, and `slot` / `contentId` /
+ * `sponsorId` only when they are the same for the whole slice. A cart with
+ * one campaign is one slice. Pure; never throws on odd lines.
+ */
+
+/** An item of a slice — the analytics item shape (ids as given, normalized on the wire). */
+type VioItem = AnalyticsItemInput;
+/** One campaign's share of the cart. */
+interface CartSlice {
+    campaignId?: number;
+    sponsorId?: number;
+    slot?: string;
+    contentId?: string;
+    items: VioItem[];
+    value: number;
+    currency?: string;
+    /** 1-based position of this slice and how many there are. */
+    slice: number;
+    slices: number;
+}
+/** The campaign of a unit without an explicit one: the caller's rule (slot assignment → sponsor → default). */
+type ResolveCampaign = (slot: string | undefined, sponsorId: number) => number | undefined;
+declare function cartSlicesFrom(lines: ReadonlyArray<CartLineItem>, resolveCampaign: ResolveCampaign, fallbackCurrency?: string): CartSlice[];
+
+/**
+ * The attribution of a checkout (ADR-0035 phase B): what the order is born
+ * knowing about the surface it was sold from, the campaign of the page, the
+ * page itself and where the shopper came in from. Sent as `attribution` on
+ * `CreateCheckout` and on the `UpdateCheckout` right before paying; shopcart
+ * keeps it on the checkout (`checkout.attribution`, merged key by key) and
+ * writes `order.surface_id` / `campaign_id` / `content_url` / `content_title`
+ * / `entry_source` from it when the order is created. The surface itself is
+ * checked there against the cart's channel: a page cannot credit a sale to
+ * somebody else's surface.
+ *
+ * Pure: `checkoutAttributionOf()` takes what the facade gathered. snake_case
+ * on the wire, the caps of shopcart's `CheckoutAttributionDto` enforced here.
+ */
+
+/** `EntryContextDto`: what the page knew when the shopper came in (the SDK's landing memory). */
+interface EntryContextWire {
+    referrer?: string;
+    utm_source?: string;
+    utm_medium?: string;
+    utm_campaign?: string;
+    landing_url?: string;
+}
+/** `CheckoutAttributionDto` (shopcart `checkout/dtos/checkout-attribution.dto.ts`). */
+interface CheckoutAttributionWire {
+    surface_key?: string;
+    campaign_id?: number;
+    content_url?: string;
+    content_title?: string;
+    entry?: EntryContextWire;
+}
+/** The caps of `CheckoutAttributionDto` / `EntryContextDto`. */
+declare const CHECKOUT_ATTRIBUTION_CAPS: Readonly<{
+    surfaceKey: 255;
+    contentUrl: 2048;
+    contentTitle: 255;
+    referrer: 2048;
+    utm: 128;
+    landingUrl: 2048;
+}>;
+interface CheckoutAttributionInput {
+    /** The surface's SDK key (`Vio.init({ apiKey })`) — shopcart resolves the surface from it. */
+    surfaceKey?: string;
+    /** The campaign the PAGE belongs to, when the bootstrap lists it as active (`Vio.pageCampaign()`). */
+    pageCampaignId?: number;
+    /** The cart split per campaign (`Vio.cartSlices(sponsorId)`), for the campaign that explains most units when the page has none. */
+    slices?: ReadonlyArray<CartSlice>;
+    /** The page at pay time: `Vio.content()`'s url and title. */
+    content?: {
+        url?: string;
+        title?: string;
+    };
+    /** Where the session came in (`resolveLanding()`): referrer, utm, landing page. */
+    landing?: Landing | null;
+    /**
+     * The surface's privacy mode. Only on a `standard` surface do the page
+     * (`content_url`, `content_title`) and the entry context travel: which
+     * screen the sale was made on and why the shopper was there is what
+     * `minimal` keeps private — the same promise the collector keeps for the
+     * events. `unknown` (it could not be learnt) counts as `minimal`: what can
+     * reveal it is only sent when the surface is known to allow it. The surface
+     * and the campaign always travel.
+     */
+    privacyMode?: SurfacePrivacyMode | 'unknown';
+}
+/**
+ * The attribution for the wire, or `undefined` when there is nothing to say.
+ * The campaign is the page's; without one, the campaign that explains most
+ * units of the cart under the same rule `purchase` is split by (ties: the
+ * higher value, then the first). The page (origin + path) and the entry go
+ * only on a `standard` surface.
+ */
+declare function checkoutAttributionOf(input: CheckoutAttributionInput): CheckoutAttributionWire | undefined;
+/** The landing as `entry`, capped; `undefined` when it says nothing. */
+declare function entryContextOf(landing: Landing | null | undefined): EntryContextWire | undefined;
+/**
+ * The campaign that explains most units of the cart — over the slices
+ * `purchase` is split by, so the order names the campaign the biggest
+ * purchase event names. Ties go to the higher value, then to the first
+ * slice. Units nobody attributes (a slice without campaign) never win.
+ */
+declare function dominantCampaignOf(slices: ReadonlyArray<CartSlice> | null | undefined): number | undefined;
+
+/**
+ * Vipps MobilePay Payment Adapter — GraphQL Integration & Types.
+ *
+ * Vipps payment integration uses 2 GraphQL operations:
+ *
+ * 1. `CreatePaymentVipps` mutation:
+ *    Initiates a Vipps payment session for a checkout and returns `payment_url`.
+ *
+ * 2. `GetVippsStatus` query:
+ *    Queries Vipps payment state directly for a checkout (`state`).
+ */
+
+/**
+ * GraphQL mutation to create a Vipps payment session.
+ */
+declare const CREATE_PAYMENT_VIPPS_MUTATION = "\nmutation CreatePaymentVipps($checkoutId: String!, $email: String, $returnUrl: String!, $express: Boolean) {\n  Payment {\n    CreatePaymentVipps(checkout_id: $checkoutId, email: $email, return_url: $returnUrl, express: $express) {\n      payment_url\n      reference\n      express\n      reason\n    }\n  }\n}\n";
+/**
+ * GraphQL query to fetch current Vipps payment status.
+ */
+declare const GET_VIPPS_STATUS_QUERY = "\nquery GetVippsStatus($checkoutId: String!) {\n  Payment {\n    GetVippsStatus(checkout_id: $checkoutId) {\n      state\n      duplicate_of\n    }\n  }\n}\n";
+interface CreatePaymentVippsVariables extends Record<string, unknown> {
+    checkoutId: string;
+    /** Optional since Express: Vipps hands the email back with the payment. */
+    email?: string;
+    returnUrl: string;
+    /**
+     * `true` asks for Express — address and delivery chosen inside the Vipps
+     * app. When the cart cannot have it, no payment is created and the answer
+     * says `express: false` with the reason; the caller then opens the
+     * ordinary checkout.
+     */
+    express?: boolean;
+}
+interface CreatePaymentVippsResponse {
+    /** Absent when Express was asked for and refused. */
+    payment_url?: string;
+    /** The reference the seller reads in its Vipps portal. */
+    reference?: string;
+    express?: boolean;
+    reason?: string;
+}
+interface GetVippsStatusVariables extends Record<string, unknown> {
+    checkoutId: string;
+}
+interface VippsStatusResult {
+    state: string;
+    /** Set when this checkout was closed as a duplicate: the checkout that paid the cart. */
+    duplicate_of?: string | null;
+}
+type VippsPaymentState = 'CREATED' | 'INITIATED' | 'AUTHORIZED' | 'TERMINATED' | 'EXPIRED' | string;
+/**
+ * Executes the `CreatePaymentVipps` GraphQL mutation.
+ */
+declare function createPaymentVipps(variables: CreatePaymentVippsVariables | Record<string, unknown>, options?: CartQueryOptions): Promise<CreatePaymentVippsResponse | null>;
+/**
+ * Executes the `GetVippsStatus` GraphQL query.
+ */
+declare function getVippsStatus(variables: GetVippsStatusVariables | Record<string, unknown>, options?: CartQueryOptions): Promise<VippsStatusResult | null>;
+
+declare const CREATE_CART_MUTATION = "\nmutation CreateCart($customerSessionId: String!, $currency: String!, $shippingCountry: String) {\n  Cart {\n    CreateCart(customer_session_id: $customerSessionId, currency: $currency, shipping_country: $shippingCountry) {\n      cart_id\n      customer_session_id\n      shipping_country\n      line_items {\n        id\n        supplier\n        image {\n          id\n          url\n          width\n          height\n        }\n        sku\n        barcode\n        brand\n        product_id\n        title\n        variant_id\n        variant_title\n        variant {\n          option\n          value\n        }\n        quantity\n        price {\n          amount\n          currency_code\n          discount\n          compare_at\n          compare_at_incl_taxes\n          amount_incl_taxes\n          tax_amount\n          tax_rate\n        }\n        shipping {\n          id\n          name\n          description\n          price {\n            amount\n            currency_code\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n        }\n        available_shippings {\n          id\n          name\n          description\n          country_code\n          price {\n            amount\n            currency_code\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n        }\n      }\n      subtotal\n      shipping\n      currency\n      available_shipping_countries\n    }\n  }\n}\n";
+declare const ADD_ITEM_MUTATION = "\nmutation AddItem($cartId: String!, $lineItems: [LineItemInput!]!) {\n  Cart {\n    AddItem(cart_id: $cartId, line_items: $lineItems) {\n      cart_id\n      customer_session_id\n      shipping_country\n      line_items {\n        id\n        supplier\n        image {\n          id\n          url\n          width\n          height\n        }\n        sku\n        barcode\n        brand\n        product_id\n        title\n        variant_id\n        variant_title\n        variant {\n          option\n          value\n        }\n        quantity\n        price {\n          amount\n          currency_code\n          discount\n          compare_at\n          compare_at_incl_taxes\n          amount_incl_taxes\n          tax_amount\n          tax_rate\n        }\n        shipping {\n          id\n          name\n          description\n          price {\n            amount\n            currency_code\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n        }\n        available_shippings {\n          id\n          name\n          description\n          country_code\n          price {\n            amount\n            currency_code\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n        }\n      }\n      subtotal\n      shipping\n      currency\n      available_shipping_countries\n    }\n  }\n}\n";
+declare const DELETE_ITEM_MUTATION = "\nmutation DeleteItem($cartId: String!, $cartItemId: String!) {\n  Cart {\n    DeleteItem(cart_id: $cartId, cart_item_id: $cartItemId) {\n      cart_id\n      customer_session_id\n      shipping_country\n      line_items {\n        id\n        supplier\n        image {\n          id\n          url\n          width\n          height\n        }\n        sku\n        barcode\n        brand\n        product_id\n        title\n        variant_id\n        variant_title\n        variant {\n          option\n          value\n        }\n        quantity\n        price {\n          amount\n          currency_code\n          discount\n          compare_at\n          compare_at_incl_taxes\n          amount_incl_taxes\n          tax_amount\n          tax_rate\n        }\n        shipping {\n          id\n          name\n          description\n          price {\n            amount\n            currency_code\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n        }\n        available_shippings {\n          id\n          name\n          description\n          country_code\n          price {\n            amount\n            currency_code\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n        }\n      }\n      subtotal\n      shipping\n      currency\n      available_shipping_countries\n    }\n  }\n}\n";
+declare const UPDATE_ITEM_MUTATION: string;
+/** `UpdateItem` with the `origin` of the added units (`CartLineOriginInput`, snake_case fields — see `lineOriginWire`). */
+declare const UPDATE_ITEM_WITH_ORIGIN_MUTATION: string;
+declare const GET_CART_QUERY = "\nquery GetCart($cartId: String!) {\n  Cart {\n    GetCart(cart_id: $cartId) {\n      cart_id\n      customer_session_id\n      shipping_country\n      line_items {\n        id\n        supplier\n        image {\n          id\n          url\n          width\n          height\n        }\n        sku\n        barcode\n        brand\n        product_id\n        title\n        variant_id\n        variant_title\n        variant {\n          option\n          value\n        }\n        quantity\n        price {\n          amount\n          currency_code\n          discount\n          compare_at\n          compare_at_incl_taxes\n          amount_incl_taxes\n          tax_amount\n          tax_rate\n        }\n        shipping {\n          id\n          name\n          description\n          price {\n            amount\n            currency_code\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n        }\n        available_shippings {\n          id\n          name\n          description\n          country_code\n          price {\n            amount\n            currency_code\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n        }\n      }\n      subtotal\n      shipping\n      currency\n      available_shipping_countries\n    }\n  }\n}\n";
+declare const GET_LINE_ITEMS_BY_SUPPLIER_QUERY = "\nquery GetLineItemsBySupplier($cartId: String!) {\n  Cart {\n    GetLineItemsBySupplier(cart_id: $cartId) {\n      supplier {\n        id\n        name\n      }\n      available_shippings {\n        id\n        name\n        description\n        country_code\n        price {\n          amount\n          currency_code\n          amount_incl_taxes\n          tax_amount\n          tax_rate\n        }\n      }\n      line_items {\n        id\n        supplier\n        image {\n          id\n          url\n          width\n          height\n        }\n        sku\n        barcode\n        brand\n        product_id\n        title\n        variant_id\n        variant_title\n        variant {\n          option\n          value\n        }\n        quantity\n        price {\n          amount\n          currency_code\n          discount\n          compare_at\n          compare_at_incl_taxes\n          amount_incl_taxes\n          tax_amount\n          tax_rate\n        }\n        shipping {\n          id\n          name\n          description\n          price {\n            amount\n            currency_code\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n        }\n      }\n    }\n  }\n}\n";
+declare const UPDATE_SHIPPINGS_BY_SUPPLIER_MUTATION = "\nmutation UpdateShippingsBySupplier($cartId: String!, $data: [DataUpdateShippingsBySupplier!]!) {\n  Cart {\n    UpdateShippingsBySupplier(cart_id: $cartId, data: $data) {\n      cart_id\n      customer_session_id\n      shipping_country\n      line_items {\n        id\n        supplier\n        image {\n          id\n          url\n          width\n          height\n        }\n        sku\n        barcode\n        brand\n        product_id\n        title\n        variant_id\n        variant_title\n        variant {\n          option\n          value\n        }\n        quantity\n        price {\n          amount\n          currency_code\n          discount\n          compare_at\n          compare_at_incl_taxes\n          amount_incl_taxes\n          tax_amount\n          tax_rate\n        }\n        shipping {\n          id\n          name\n          description\n          price {\n            amount\n            currency_code\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n        }\n        available_shippings {\n          id\n          name\n          description\n          country_code\n          price {\n            amount\n            currency_code\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n        }\n      }\n      subtotal\n      shipping\n      currency\n      available_shipping_countries\n    }\n  }\n}\n";
+declare const CREATE_CHECKOUT_MUTATION: string;
+/** `CreateCheckout` with the checkout's `attribution` (`CheckoutAttributionInput`, snake_case fields — see `checkoutAttributionOf`). */
+declare const CREATE_CHECKOUT_WITH_ATTRIBUTION_MUTATION: string;
+declare const UPDATE_CHECKOUT_MUTATION: string;
+/** `UpdateCheckout` with the checkout's `attribution` (`CheckoutAttributionInput`). */
+declare const UPDATE_CHECKOUT_WITH_ATTRIBUTION_MUTATION: string;
+declare const GET_CHECKOUT_QUERY = "\nquery GetCheckout($checkoutId: String!) {\n  Checkout {\n    GetCheckout(checkout_id: $checkoutId) {\n      buyer_accepts_purchase_conditions\n      buyer_accepts_terms_conditions\n      created_at\n      updated_at\n      id\n      deleted_at\n      success_url\n      cancel_url\n      payment_method\n      email\n      status\n      checkout_url\n      origin_payment_id\n      duplicate_of\n      billing_address {\n        id\n        first_name\n        last_name\n        phone_code\n        phone\n        company\n        address1\n        address2\n        city\n        province\n        province_code\n        country\n        country_code\n        zip\n      }\n      shipping_address {\n        id\n        first_name\n        last_name\n        phone_code\n        phone\n        company\n        address1\n        address2\n        city\n        province\n        province_code\n        country\n        country_code\n        zip\n      }\n      available_payment_methods {\n        name\n      }\n      discount_code\n      cart {\n        cart_id\n        customer_session_id\n        shipping_country\n        line_items {\n          id\n          supplier\n          image {\n            id\n            url\n            width\n            height\n          }\n          sku\n          barcode\n          brand\n          product_id\n          title\n          variant_id\n          variant_title\n          variant {\n            option\n            value\n          }\n          quantity\n          price {\n            amount\n            currency_code\n            discount\n            compare_at\n            compare_at_incl_taxes\n            amount_incl_taxes\n            tax_amount\n            tax_rate\n          }\n          shipping {\n            id\n            name\n            description\n            price {\n              amount\n              currency_code\n              amount_incl_taxes\n              tax_amount\n              tax_rate\n            }\n          }\n          available_shippings {\n            id\n            name\n            description\n            country_code\n            price {\n              amount\n              currency_code\n              amount_incl_taxes\n              tax_amount\n              tax_rate\n            }\n          }\n        }\n        subtotal\n        shipping\n        currency\n        available_shipping_countries\n      }\n      totals {\n        currency_code\n        subtotal\n        shipping\n        total\n        taxes\n        tax_rate\n        discounts\n      }\n    }\n  }\n}\n";
+declare const GET_AVAILABLE_PAYMENT_METHODS_QUERY = "\nquery Config {\n  Payment {\n    GetAvailablePaymentMethods {\n      config {\n        name\n        type\n        value\n      }\n      name\n    }\n  }\n}\n";
+
+/** Transport options for a cart/checkout GraphQL call. */
+interface CartQueryOptions {
+    endpoint?: string;
+    apiKey?: string;
+    /** Sponsor commerce key — goes in the Authorization header. */
+    commerceKey?: string;
+    /** True when the commerce key came from a resolved sponsor (bootstrap).
+     * False = we fell back to the host apiKey — writes like CreateCart should
+     * NOT proceed with the wrong key (the cart would be orphaned). */
+    sponsorResolved?: boolean;
+}
+/**
+ * Resolve endpoint + keys for cart GraphQL calls. Awaits Vio.bootstrap() once
+ * if it hasn't run yet (the sponsor commerce keys come from bootstrap), then
+ * uses the sponsor's commerce apiKey (via the Vio facade on globalThis,
+ * avoiding an import cycle); falls back to the host apiKey.
+ */
+declare function getCartGraphQLOptions(sponsorId?: number): Promise<CartQueryOptions>;
+/** Stable per-browser customer session id (backend CreateCart requires one). */
+declare function getCustomerSessionId(): string;
+interface GraphQLEnvelope {
+    data?: Record<string, Record<string, unknown>> | null;
+    errors?: Array<{
+        message?: string;
+        path?: unknown;
+    }>;
+}
+/** Execute a GraphQL query/mutation against the configured commerce endpoint.
+ * Callers that skip `getCartGraphQLOptions()` (or pass a bare sponsorId) get
+ * it resolved here instead of silently sending an unauthenticated request.
+ * Rejects after `CART_GRAPHQL_TIMEOUT_MS` (and aborts the fetch). */
+declare function executeCartGraphQL(query: string, variables: Record<string, unknown>, options?: CartQueryOptions | number | undefined): Promise<GraphQLEnvelope>;
+declare function createCart(customerSessionId: string, currency: string, shippingCountry?: string | null, options?: CartQueryOptions): Promise<any>;
+/**
+ * `AddItem`. A line may carry `origin` (`LineOriginWire`: where its units
+ * come from — ADR-0035 phase B). A gateway that predates the field refuses
+ * the whole mutation at validation (`LineItemInput` has no `origin`), so the
+ * lines are sent again without it, once per page load — see gateway-features.
+ */
+declare function addItem(cartId: string, lineItems: unknown[], options?: CartQueryOptions): Promise<any>;
+declare function deleteItem(cartId: string, cartItemId: string, options?: CartQueryOptions): Promise<any>;
+/**
+ * `UpdateItem`. `extra.origin` is where the units a quantity INCREASE adds
+ * come from (ADR-0035 phase B); the server credits the new units to it. Sent
+ * only with it; a gateway that predates the argument gets the legacy
+ * mutation instead, once per page load — see gateway-features.
+ */
+declare function updateItem(cartId: string, cartItemId: string, shippingId?: string | null, qty?: number | null, options?: CartQueryOptions, extra?: {
+    origin?: LineOriginWire;
+}): Promise<any>;
+declare function getCart(cartId: string, options?: CartQueryOptions): Promise<any>;
+declare function getLineItemsBySupplier(cartId: string, options?: CartQueryOptions): Promise<any>;
+declare function updateShippingsBySupplier(cartId: string, data: unknown[], options?: CartQueryOptions): Promise<any>;
+/**
+ * `CreateCheckout`. With `extra.attribution` (`CheckoutAttributionWire`:
+ * the surface, the page's campaign, the page and the entry — ADR-0035 phase
+ * B) the checkout is born attributed; a gateway that predates the argument
+ * gets the legacy mutation, once per page load — see gateway-features.
+ */
+declare function createCheckout(cartId: string, options?: CartQueryOptions, extra?: {
+    attribution?: CheckoutAttributionWire;
+}): Promise<any>;
+/**
+ * `UpdateCheckout`. `variables.attribution` (`CheckoutAttributionWire`) is
+ * merged key by key over what the checkout has; a gateway that predates the
+ * argument gets the legacy mutation without it, once per page load.
+ */
+declare function updateCheckout(variables: Record<string, unknown>, options?: CartQueryOptions): Promise<any>;
+declare function getCheckout(checkoutId: string, options?: CartQueryOptions): Promise<any>;
+/** What a checkout says of itself after paying: its Vio order number, once the order exists, and its buyer reference. */
+interface CheckoutReference {
+    orderNumber: number | null;
+    buyerRef: string | null;
+}
+/** The order number (null while the order does not exist yet) and the buyer reference (null when the API does not say it). */
+declare function getCheckoutReference(checkoutId: string, options?: CartQueryOptions): Promise<CheckoutReference>;
+declare function getAvailablePaymentMethods(options?: CartQueryOptions): Promise<any>;
+declare const CREATE_PAYMENT_STRIPE_MUTATION = "\nmutation CreatePaymentStripe($checkoutId: String!, $successUrl: String!, $paymentMethod: String!, $email: String!) {\n  Payment {\n    CreatePaymentStripe(checkout_id: $checkoutId, success_url: $successUrl, payment_method: $paymentMethod, email: $email) {\n      order_id\n      checkout_url\n    }\n  }\n}\n";
+declare function createPaymentStripe(variables: Record<string, unknown>, options?: CartQueryOptions): Promise<any>;
+
+/**
+ * Stripe on our own page — the Payment Element, no redirect.
+ *
+ * The older web flow minted a Stripe Payment Link and sent the shopper to a
+ * page hosted by Stripe. This one keeps them here (Angelo, 2026-09-24):
+ *
+ *   1. Vio Commerce creates a PaymentIntent for the checkout
+ *      (`Payment { CreatePaymentIntentStripe }`) and answers with its client
+ *      secret AND the publishable key of the account that minted it — the
+ *      seller's when they brought both keys, ours otherwise. The two are
+ *      halves of one account: the browser confirms with the key what the
+ *      server minted with the secret one.
+ *   2. Stripe's Payment Element is mounted in a LIGHT-DOM container, the way
+ *      the other embedded widgets are. Card fields are Stripe's own iframes,
+ *      so card data never touches this SDK or our servers.
+ *   3. `confirm()` pays. A 3-D Secure challenge opens in Stripe's own modal
+ *      over the page: `redirect: 'if_required'` keeps the shopper here for
+ *      cards, and still redirects for a method that has no other way.
+ *   4. The Commerce order is NOT born here. Stripe's `payment_intent.succeeded`
+ *      webhook creates it, verified server-side; the checkout is polled for
+ *      its status afterwards, exactly as the redirect return does.
+ */
+
+/** What the backend hands over to pay a checkout on our page. */
+interface StripeIntent {
+    /** `pi_..._secret_...`: what the browser confirms. */
+    client_secret: string;
+    /** The key of the SAME account that minted the secret. */
+    publishable_key: string;
+    customer?: string;
+    /**
+     * Stripe Connect (ADR-0022): the seller's connected account, where the
+     * intent lives. The browser must name it or Stripe answers "no such
+     * payment_intent". Absent for every seller not on Connect.
+     */
+    stripe_account?: string;
+}
+/** What `confirm()` answers. The browser's word is never the order. */
+type StripeConfirmOutcome = {
+    status: 'succeeded';
+    paymentIntentId?: string;
+}
+/** Authorised but not settled yet, or Stripe redirected and will return. */
+ | {
+    status: 'pending';
+    paymentIntentId?: string;
+} | {
+    status: 'failed';
+    message?: string;
+    code?: string;
+};
+interface StripeElementHandle {
+    confirm(): Promise<StripeConfirmOutcome>;
+    unmount(): void;
+}
+
+/**
+ * Apple Pay on the Web — via Stripe Payment Request API.
+ *
+ * Architecture decision (matches iOS Vio SDK pattern):
+ *   - One Stripe **publishable key** for the Vio platform (global, set
+ *     via `Vio.init({ stripePublishableKey })`).
+ *   - One **Stripe Connect account id** per sponsor — sourced from
+ *     `Vio.bootstrap()` response. Without it, the payment lands on the
+ *     platform account instead of the merchant.
+ *
+ * Apple Pay on the Web prerequisites (Stripe-managed for us):
+ *   - Stripe Connect account is enabled for Apple Pay
  *   - Domain registration for Apple Pay (Stripe handles via Dashboard)
  *   - Safari + macOS/iOS device with Apple Pay configured
  *
@@ -1492,8 +2386,20 @@ interface KlarnaPaymentsHandle {
     /** Tear down the mounted widget. */
     unmount(): void;
 }
+/**
+ * What the facade lends the manager. `orderAttribution` answers the
+ * attribution of the order about to be created for a sponsor's cart
+ * (`Vio.orderAttribution`, ADR-0035 phase B) — the surface, the page's
+ * campaign, the page and the entry; sent as `attribution` on `CreateCheckout`
+ * and on the `UpdateCheckout` before paying. Optional: without it (a manager
+ * built apart from the facade) nothing is sent and nothing changes.
+ */
+interface CheckoutManagerDeps {
+    orderAttribution?: (sponsorId: number) => Promise<CheckoutAttributionWire | undefined> | CheckoutAttributionWire | undefined;
+}
 declare class CheckoutManager extends EventTarget {
     private readonly cartManager;
+    private readonly deps;
     private state;
     /** Counts `open()` calls — see CheckoutState.session. */
     private sessionSeq;
@@ -1531,12 +2437,18 @@ declare class CheckoutManager extends EventTarget {
     /** Per-sponsor payment methods cache + in-flight dedupe. */
     private paymentMethodsCache;
     private paymentMethodsPromises;
-    constructor(cartManager: CartManager);
+    constructor(cartManager: CartManager, deps?: CheckoutManagerDeps);
     open(sponsorId: number): CheckoutState;
     close(): void;
-    /** Create the backend checkout for the sponsor's cart (auto-accepts terms). */
+    /**
+     * The attribution of the order this sponsor's cart is about to become
+     * (ADR-0035 phase B), through the facade; `undefined` when there is none
+     * to give or it fails — attribution never costs a checkout.
+     */
+    private attributionFor;
+    /** Create the backend checkout for the sponsor's cart (auto-accepts terms); born attributed when the facade knows the attribution. */
     createCheckout(sponsorId: number): Promise<any>;
-    /** Update the backend checkout (terms are re-asserted unless overridden). */
+    /** Update the backend checkout (terms are re-asserted unless overridden; the attribution rides along unless the caller gives its own). */
     updateCheckout(variables: Record<string, unknown>, sponsorId?: number): Promise<any>;
     getCheckout(checkoutId: string, sponsorId?: number): Promise<any>;
     /**
@@ -1545,6 +2457,15 @@ declare class CheckoutManager extends EventTarget {
      * receipt, and a receipt does not fail for it.
      */
     getOrderNumber(checkoutId: string, sponsorId?: number): Promise<number | null>;
+    /**
+     * What a paid checkout says of itself: the order number (as above) and the
+     * buyer reference — shopcart's keyed hash of the buyer's email, what the
+     * `vio:payment-success` detail carries as `buyerRef` and analytics sends as
+     * `buyer_id`. Never throws; `null` for whatever the API does not say.
+     */
+    getOrderReference(checkoutId: string, sponsorId?: number): Promise<CheckoutReference>;
+    /** In-flight `getOrderReference` per checkout id (see there). */
+    private referenceInFlight;
     /**
      * Payment methods enabled for the sponsor (backend-configured). Memoised per
      * sponsor with in-flight dedupe — several UI components ask on every open.
@@ -1866,339 +2787,60 @@ declare class CheckoutManager extends EventTarget {
      *
      * Returns the button handle so the UI can unmount on teardown.
      */
-    mountKlarnaExpress(container: HTMLElement): Promise<KlarnaButtonHandle>;
-    /**
-     * Klarna Payments — classic widget flow (server client_token). Creates a
-     * session on vio-backend, then mounts Klarna's inline widget into
-     * `container`. Returns a handle to switch category and to authorize → which
-     * on approval creates the order via the same backend /orders route as KEC.
-     *
-     * Unlike `mountKlarnaExpress`, this needs no public `klarnaClientId` and no
-     * origin handshake — auth is the server-side API key.
-     */
-    mountKlarnaPayments(container: HTMLElement, opts?: {
-        withShipping?: boolean;
-        shippingId?: string;
-        category?: string;
-    }): Promise<KlarnaPaymentsHandle>;
-    /** True if the Klarna Payments widget lib can load (UI gate). */
-    klarnaPaymentsAvailable(): Promise<boolean>;
-    /** Cart snapshot + chosen shipping line/amount, for express purchases. */
-    private buildKlarnaInstantContext;
-    /**
-     * Express instant purchase — go straight to Klarna's own modal, no checkout
-     * overlay. Creates a session (with shipping options), loads the widget into a
-     * hidden container, then authorizes (which opens Klarna's confirm modal). On
-     * approval creates the order → `payment-complete` (host shows confirmation);
-     * on failure → `payment-error`. Call `open(sponsorId)` first.
-     */
-    startKlarnaInstant(): Promise<void>;
-    /**
-     * REDIRECT path: call once on app load. If a Klarna purchase was launched
-     * (pending context persisted) and we're back with a token — from the URL or
-     * the SDK's resumed `complete` event — finish creating the order + confirm.
-     */
-    resumeKlarnaReturn(): Promise<void>;
-    /** Snapshot of the active cart for redirect recovery (minor units). */
-    private buildKlarnaPendingContext;
-    /**
-     * POST the token + order lines to vio-backend (it holds the secret API key
-     * and creates the real Klarna order). On success → `payment-complete`; on
-     * failure → `payment-error`. Idempotent: clears the pending key so the
-     * popup and redirect paths can't double-fire.
-     */
-    private completeKlarnaOrder;
-    get currentState(): CheckoutState | null;
-    get items(): CartLineItem[];
-    /**
-     * Resolve the Stripe Connect account for the active sponsor — for now
-     * pulled from bootstrap cache if present. Returns undefined if not set
-     * (Stripe will route to the platform account in that case).
-     */
-    private findStripeConnectAccount;
-    /** The sponsor's connected account, read fresh from its channel config. */
-    private resolveStripeConnectAccount;
-    private emit;
-}
-
-/**
- * Vio.analytics — the web SDK's half of the Vio Analytics pipeline.
- *
- * Events flow to the Vio collector (`POST <eventsBase>/v1/events`, repo
- * vio-live/vio-analytics) which owns raw storage (ClickHouse) and vendor
- * fan-out (Mixpanel today). THE SDK NEVER TALKS TO VENDORS — swapping or
- * dropping a vendor is a server-side change, zero client releases.
- * Wire contract: vio-analytics `docs/EVENTS_CONTRACT.md` (v1, snake_case).
- *
- * Design rules:
- * - SIDE-EFFECT-FREE MODULE. Nothing runs at import time (tsup/tree-shaking
- *   contract, see lessons/web-sdk-tsup-singleton-and-build). Listeners are
- *   installed by an explicit `Vio.analytics.start()`.
- * - `track()` works BEFORE `Vio.init()` — events queue and flush once the
- *   SDK is configured (transport resolves at flush time, not at track time).
- * - SSR-safe: without `window` every call is a silent no-op.
- * - Retries are safe: `event_id` is stable per event, the collector
- *   dedupes. Queue is bounded (drop-oldest) so a dead collector can never
- *   grow memory unbounded.
- * - Anti-double-count: the SDK only reports what the server can't see.
- *   Votes/participations are server truth; `ad_activation`/`cart_intent`
- *   are mirrored server-side, never from here.
- *
- * Three sinks, matching the Vev precedent (vio-vev analytics.ts, which
- * becomes an adapter over this in F3):
- *   1. collector (default ON once started)
- *   2. window.dataLayer — GA4/GTM (opt-in `start({ dataLayer: true })`,
- *      the publisher-facing feature; NOT part of the Vio pipeline)
- *   3. `vio:analytics` DOM event — always when started (inspector/bridges)
- */
-
-declare const ANALYTICS_EVENT_NAMES: readonly ["view_item_list", "select_item", "view_item", "add_to_cart", "remove_from_cart", "view_cart", "begin_checkout", "purchase", "component_impression", "component_click", "ad_impression", "ad_click", "poll_impression", "contest_impression", "session_start", "session_end", "checkout_error", "sdk_error"];
-type AnalyticsEventName = (typeof ANALYTICS_EVENT_NAMES)[number];
-/** Camel-case for DX; mapped to the snake_case wire format at build time. */
-interface AnalyticsContext {
-    campaignId?: number;
-    broadcastId?: string;
-    campaignComponentId?: number;
-    appPlacementId?: number;
-    locationId?: string;
-    componentTemplateId?: string;
-    sponsorId?: number;
-    activationId?: number;
-    contentUrl?: string;
-    /**
-     * The host's own id for the piece of content the component sits in — an
-     * article id in a CMS, a page id in a site builder. Carried verbatim so the
-     * host can join Vio's funnel back onto its own per-article reporting
-     * (revenue stops being an estimate). Left alone by the SDK.
-     */
-    contentId?: string | number;
-    /** Human-readable content snapshot; auto-filled from document.title. */
-    contentTitle?: string;
-    /** Código corto del fallo (`sdk_error` / `checkout_error`). */
-    errorCode?: string;
-    variant?: string;
-    /**
-     * The slot (ADR-0027) the component sits in — its `vio-slot`. Attribution
-     * follows it: the event's `campaign_id` is the campaign assigned to the slot
-     * right now, before the sponsor rule. On the wire it fills `location_id`
-     * when no explicit `locationId` is given (a slot IS a location id to the
-     * campaigns service).
-     */
-    slot?: string;
-}
-interface AnalyticsItemInput {
-    productId: number | string;
-    name?: string;
-    brand?: string;
-    variantId?: number | string;
-    price?: number;
-    quantity?: number;
-}
-interface AnalyticsCommerce {
-    items?: AnalyticsItemInput[];
-    value?: number;
-    currency?: string;
-    orderId?: string;
-    paymentMethod?: string;
-}
-interface TrackOptions {
-    context?: AnalyticsContext;
-    commerce?: AnalyticsCommerce;
-    props?: Record<string, unknown>;
-}
-interface AnalyticsStartOptions {
-    /** Where the SDK is embedded: 'vev' | 'replit' | 'custom' | … Default 'custom'. */
-    host?: string;
-    /**
-     * Arrancar en modo cookieless hasta que el host llame `setConsent(true)`.
-     * Default false: el SDK asume que el CMP del publisher ya decidió si nos
-     * carga. Los publishers EU que necesitan medir antes del consentimiento
-     * (o no pueden persistir sin él) ponen true.
-     */
-    requireConsent?: boolean;
-    /**
-     * Install the automatic funnel listeners (vio:added-to-cart,
-     * vio:checkout-open, vio:open-cart, vio:payment-success). Default true.
-     * Hosts with their OWN instrumentation choke point (e.g. the Vev module,
-     * which forwards every event through trackEvent()) set false so the same
-     * user action is never tracked twice — they keep the session/batching/
-     * transport engine and call track() themselves.
-     */
-    autoTrack?: boolean;
-    /**
-     * Adopt the host's session id instead of minting one. A host that already
-     * tracks its readers (its own impressions, dwell, clicks) needs Vio's
-     * purchases to land in the SAME session, or the two datasets cannot be
-     * joined. Pass the id the host already stores; omit it and the SDK keeps
-     * its own rotating session.
-     */
-    sessionId?: string;
-    /** Send to the Vio collector. Default true. */
-    collector?: boolean;
-    /** Also push GA4 e-commerce events to window.dataLayer (publisher feature). */
-    dataLayer?: boolean;
-    /** console.debug every event. */
-    debug?: boolean;
-}
-declare class AnalyticsManager extends EventTarget {
-    private started;
-    private options;
-    private queue;
-    private flushTimer;
-    private retryAttempt;
-    private retryNotBefore;
-    private externalUserId;
-    private sessionId;
-    private requireConsent;
-    private consentGranted;
-    private anonIdCache;
-    /** Set via start({ sessionId }) — the host owns the session, we follow. */
-    private externalSessionId;
-    private sessionStartedAt;
-    /** Impression once-per-(session, component) guard; reset on session rotation. */
-    private impressedComponents;
-    /** Last NON-EMPTY cart snapshot — `purchase` uses it because several flows
-     * (Apple Pay) clear the cart BEFORE `vio:payment-success` fires. */
-    private lastCartSnapshot;
-    private teardown;
-    /**
-     * Install listeners + begin flushing. Explicit on purpose (no module
-     * side-effects). Safe to call twice (second call only updates options).
-     */
-    /**
-     * Consentimiento (ePrivacy/GDPR). Por defecto el SDK asume que el host ya
-     * lo gestionó — su CMP decide si nos carga. Con `requireConsent: true`
-     * arranca en modo **cookieless**: mide la visita con ids efímeros en
-     * memoria y NO escribe nada en localStorage hasta que el host llame
-     * `setConsent(true)`. Retirarlo borra lo persistido.
-     */
-    setConsent(granted: boolean): void;
-    /** ¿Podemos escribir en el dispositivo? */
-    private get canPersist();
-    start(options?: AnalyticsStartOptions): void;
-    /** Stop timers + listeners (tests / SPA unmount). Queue survives. */
-    stop(): void;
-    /** Attach the partner's user id (opaque) to all subsequent events. */
-    identify(externalUserId: string | null): void;
-    /** Queue one event. Works pre-init and pre-start (SSR: no-op). */
-    track(name: AnalyticsEventName, opts?: TrackOptions): void;
+    mountKlarnaExpress(container: HTMLElement): Promise<KlarnaButtonHandle>;
     /**
-     * Impression helper: observes an element and tracks ONE
-     * `component_impression` per (session, campaignComponentId) when the
-     * contract's rule is met (≥50% visible, ≥1s dwell). Returns an
-     * unobserve function.
+     * Klarna Payments — classic widget flow (server client_token). Creates a
+     * session on vio-backend, then mounts Klarna's inline widget into
+     * `container`. Returns a handle to switch category and to authorize → which
+     * on approval creates the order via the same backend /orders route as KEC.
+     *
+     * Unlike `mountKlarnaExpress`, this needs no public `klarnaClientId` and no
+     * origin handshake — auth is the server-side API key.
      */
-    observeImpression(element: Element, context?: AnalyticsContext, opts?: {
-        name?: Extract<AnalyticsEventName, 'component_impression' | 'ad_impression'>;
-        /** Dedupe key override. Defaults to the strongest id available:
-         *  campaignComponentId → locationId → componentTemplateId. */
-        key?: string;
-        /** Called the one time the impression is tracked (e.g. to fire a
-         *  companion view_item_list). */
-        onImpression?: () => void;
-    }): () => void;
-    /** Force a flush (mostly for tests). */
-    flush(): Promise<void>;
-    private buildEvent;
-    /** Guarda la sesión solo si podemos escribir en el dispositivo. */
-    private persistSession;
-    private anonId;
-    /** Rolling session: renewed by activity, rotated after 30 min idle. */
-    private ensureSession;
-    private trackSessionEnd;
-    private flushWithBeacon;
+    mountKlarnaPayments(container: HTMLElement, opts?: {
+        withShipping?: boolean;
+        shippingId?: string;
+        category?: string;
+    }): Promise<KlarnaPaymentsHandle>;
+    /** True if the Klarna Payments widget lib can load (UI gate). */
+    klarnaPaymentsAvailable(): Promise<boolean>;
+    /** Cart snapshot + chosen shipping line/amount, for express purchases. */
+    private buildKlarnaInstantContext;
     /**
-     * Auto-instrumentation over the SDK's own DOM events — the host app
-     * writes ZERO tracking code for the commerce funnel.
+     * Express instant purchase — go straight to Klarna's own modal, no checkout
+     * overlay. Creates a session (with shipping options), loads the widget into a
+     * hidden container, then authorizes (which opens Klarna's confirm modal). On
+     * approval creates the order → `payment-complete` (host shows confirmation);
+     * on failure → `payment-error`. Call `open(sponsorId)` first.
      */
-    private installAutoListeners;
-    /** The lines of the cart (current, else the pre-clear snapshot), optionally one sponsor's. */
-    private cartLines;
+    startKlarnaInstant(): Promise<void>;
     /**
-     * The cart split per campaign — the shared rule of cart/slices.ts over the
-     * current cart (else the pre-clear snapshot), plus whether any unit named
-     * its campaign itself (a cart without origins is reported as before).
+     * REDIRECT path: call once on app load. If a Klarna purchase was launched
+     * (pending context persisted) and we're back with a token — from the URL or
+     * the SDK's resumed `complete` event — finish creating the order + confirm.
      */
-    private cartSlices;
+    resumeKlarnaReturn(): Promise<void>;
+    /** Snapshot of the active cart for redirect recovery (minor units). */
+    private buildKlarnaPendingContext;
     /**
-     * The context of one of several per-campaign events: the slice's campaign,
-     * slot and content — only its own; when the slice spans several slots or
-     * articles the event names none rather than the one the click came from.
+     * POST the token + order lines to vio-backend (it holds the secret API key
+     * and creates the real Klarna order). On success → `payment-complete`; on
+     * failure → `payment-error`. Idempotent: clears the pending key so the
+     * popup and redirect paths can't double-fire.
      */
-    private sliceContext;
+    private completeKlarnaOrder;
+    get currentState(): CheckoutState | null;
+    get items(): CartLineItem[];
     /**
-     * The context of a single-campaign checkout/purchase: when the cart's origins
-     * say which campaign they came from, the event says it too (plus the slot /
-     * content when unique) — a cart without origins is exactly as before.
+     * Resolve the Stripe Connect account for the active sponsor — for now
+     * pulled from bootstrap cache if present. Returns undefined if not set
+     * (Stripe will route to the platform account in that case).
      */
-    private singleSliceContext;
-    /** Current cart → commerce payload; falls back to the pre-clear snapshot. */
-    private cartCommerce;
-    private findLine;
-}
-/**
- * The `campaign_id` of an event. In order: the context's explicit id; the
- * campaign assigned to the context's `slot` right now (ADR-0027 — only an
- * open assignment for the init platform counts, see `findSlotAssignment`);
- * the active campaign of `campaigns[]` the event's sponsor takes part in, as
- * its primary or one of its secondaries — when it is in several, the
- * surface's default campaign if it is one of them, else the first one the
- * backend lists; the default campaign (`campaign.id`). `/v2/mobile/config`
- * has no top-level `campaignId` — reading one is why every event used to
- * leave with `campaign_id: 0` and the campaigns screen stayed empty.
- *
- * A malformed `campaigns[]` (not an array, a null entry) never breaks
- * `track()`: it falls back to `campaign.id`.
- */
-declare function resolveCampaignId(ctx: Pick<AnalyticsContext, 'campaignId' | 'sponsorId' | 'slot'>, boot: Pick<BootstrapResponse, 'campaign' | 'campaigns'> | null | undefined): number | undefined;
-/**
- * `detail` of `vio:payment-success` as the checkout emits it. Four paths,
- * three shapes: a redirect return (`orderId` = Vio's checkout id), the
- * confirmation drawer and a provider's own receipt (`result` from the
- * provider or the backend, plus Vio's `checkoutId`), and Apple Pay express
- * from the cart (`result` with the backend's `confirmation`, no sponsor).
- */
-interface PaymentSuccessDetail {
-    method?: string;
-    sponsorId?: number | string;
-    /** The slot the purchase started from, when the emitter knows it. */
-    slot?: string;
-    /** The campaign the emitter attributed the purchase to (its `Vio.attribution`). */
-    campaignId?: number;
-    /** Per-element content override (`vio-content-id` / `vio-content-title`), when the emitter carries one. */
-    contentId?: string | number;
-    contentTitle?: string;
-    /** Redirect return: Vio's checkout id (the name predates `checkoutId`). */
-    orderId?: string | number;
-    /** Vio's checkout id — from the checkout state or the return URL. */
-    checkoutId?: string | number;
-    result?: PaymentSuccessResult | null;
-}
-/**
- * What the checkout attaches as `result`. Only `confirmation` carries a Vio
- * id: the order `ConfirmPaymentApplePay` created. `order.orderId` / `orderId`
- * are the PROVIDER's references (Qliro's, Walley's — the checkout itself
- * shows them as `providerRef`), and `chargedTotal` includes shipping on some
- * methods only. Analytics reads none of those.
- */
-interface PaymentSuccessResult {
-    confirmation?: {
-        orderId?: string | number | null;
-        status?: string;
-    } | null;
-    [key: string]: unknown;
+    private findStripeConnectAccount;
+    /** The sponsor's connected account, read fresh from its channel config. */
+    private resolveStripeConnectAccount;
+    private emit;
 }
-/**
- * The `order_id` of a `purchase`: ALWAYS a Vio id, never a provider's
- * reference. Normalized across every emitter: `orderId` (redirect return) →
- * `result.confirmation.orderId` (Apple Pay) → `checkoutId`. `value` and
- * `currency` are deliberately NOT read from the result: on every path they
- * come from the cart snapshot (sum of the items, no shipping), so revenue
- * stays comparable across payment methods — the charged total will arrive
- * through the server-side `order_paid` event. With nothing to say it
- * returns `{}`, so the cart snapshot keeps its keys.
- */
-declare function purchaseFromPaymentSuccess(d: PaymentSuccessDetail): Pick<AnalyticsCommerce, 'orderId'>;
 
 /**
  * Content (article) attribution — the other half of "where did this happen".
@@ -2217,11 +2859,32 @@ declare function purchaseFromPaymentSuccess(d: PaymentSuccessDetail): Pick<Analy
 interface ContentRef {
     id?: string;
     title?: string;
+    /** The page's URL as origin + path (no query, no fragment), capped — what the order and the cart's origins carry as `content_url`. */
+    url?: string;
 }
 interface ContentInit {
     contentId?: string | number | null;
     contentTitle?: string | null;
 }
+/** The collector (and Commerce's `order.content_url`) cap `content_url` at 2 048 chars. */
+declare const CONTENT_URL_MAX_LENGTH = 2048;
+/**
+ * A page as the ORDER and the cart's origins name it (`content_url` to
+ * Commerce): origin + path — no query string, no fragment — within the cap.
+ * The query is where a page carries e-mails, tokens and tracking tails
+ * (`?email=…&utm_…#frag`); none of that belongs on an order row. A site whose
+ * article lives in the query or the hash identifies it through `contentId`
+ * (`Vio.init({ contentId })`, `?vio_content=`), not through the URL. Also
+ * the shape of the landing's referrer and page (client-context.ts).
+ */
+declare function originAndPath(raw: unknown, max?: number): string | undefined;
+/**
+ * A page URL within the cap for the analytics EVENTS — as is, else without
+ * its query string (a long one is usually the tracking tail, not the page),
+ * else cut. The collector keeps the query there (`page_views` strip it
+ * themselves); the order does not (`originAndPath`).
+ */
+declare function capContentUrl(value: unknown): string | undefined;
 /**
  * Id: `Vio.init({ contentId })` → `?vio_content=` → `<meta name="vio:content-id">`
  * → `<link rel="canonical">` href or `<meta property="og:url">` (without query
@@ -2235,95 +2898,7 @@ declare function resolveContent(init?: ContentInit | null, doc?: Document | null
     search?: string;
 } | null | undefined): ContentRef;
 
-/**
- * Slots — the pure half of ADR-0027 / ADR-0034 on the web.
- *
- * A slot is a NAME for a place on a page. The page declares its slots to the
- * campaigns service (`Vio.declareSlots()` / `Vio.registerSlot()` in client.ts),
- * the dashboard assigns a campaign to each one, optionally with a date window,
- * and `GET /v2/mobile/config` answers with `campaigns[].slots[]` — only the
- * assignments whose window is open NOW. Whatever no slot names shows the
- * surface's default campaign (`campaign`).
- *
- * Everything here is side-effect free and never throws on a malformed
- * bootstrap: a broken `campaigns[]` must never blank a product block or break
- * `track()`.
- */
-
-/** What `Vio.declareSlots()` accepts per slot. */
-type SlotInput = string | {
-    id: string;
-    displayName?: string;
-};
-type BootLike = Pick<BootstrapResponse, 'campaign' | 'campaigns' | 'primarySponsor' | 'secondarySponsors'>;
-/**
- * The campaign a slot shows right now. Among the `status === 'active'`
- * entries of `campaigns[]`, the one with an assignment named `slot` for this
- * platform (`platform` null on the assignment, or equal to `platform`) whose
- * window contains `now` (`startDate <= now < endDate`, null = open). When
- * several qualify, the surface's default campaign wins, else the first the
- * backend lists.
- *
- * No slot, or no assignment → the default campaign: the `campaigns[]` entry
- * whose id is `campaign.id`, or a minimal entry built from `campaign` (+ the
- * top-level sponsors) when the list does not carry it. No bootstrap → null.
- */
-declare function resolveSlotCampaign(boot: BootLike | null | undefined, slot: string | null | undefined, now?: number, platform?: string | null): BootstrapCampaignEntry | null;
-/** The kinds of Vio element that register themselves. */
-type SlotKind = 'card' | 'carousel' | 'detail';
-/**
- * The id an element gets when the host set no `vio-slot`:
- * `${scope ? scope + '-' : ''}${kind}-${ordinal + 1}` (`carousel-1`, `card-3`,
- * `article-123-carousel-1`), `ordinal` being the element's index among the
- * same-kind Vio elements WITH THE SAME SCOPE, in document order at connect
- * time. The scope is inherited from the DOM (`vio-scope` on the element, else
- * the nearest `data-vio-scope` ancestor): a Vev page or a Replit article
- * (`<body data-vio-scope="article-123">`) gets per-page slots with one line
- * and no per-element naming; a template that wants slots shared across
- * articles simply sets no scope. On purpose there is NO page path in the id:
- * the article goes to analytics as `content_id`, not into the slot. Stable
- * across reloads while the layout is; a layout change leaves a stale entry,
- * which ADR-0034 accepts.
- */
-declare function autoSlotId(kind: SlotKind, ordinal: number, scope?: string | null): string;
-/** `"Carousel 1"`, `"Card 3"` — with ` · ${scopeName}` when the scope has a human label. */
-declare function autoSlotDisplayName(kind: SlotKind, ordinal: number, scopeName?: string | null): string;
-/** A scope value fit for an id: trimmed, inner whitespace → `-`. */
-declare function normalizeScope(scope: string | null | undefined): string;
-
-/**
- * The cart split per campaign (ADR-0034) — ONE rule, shared by the SDK's own
- * `begin_checkout` / `purchase` events, by `Vio.cartSlices()` and so by any
- * host with its own analytics sink (Vev).
- *
- * Every unit of every line goes to the campaign of its origin — the one the
- * place showed when it was added — and units without one to the campaign the
- * caller's rule resolves for the line's sponsor (`resolveCampaign`). One slice
- * per campaign: its items (quantities from the origins, merged per product +
- * variant), its value with two decimals, and `slot` / `contentId` /
- * `sponsorId` only when they are the same for the whole slice. A cart with
- * one campaign is one slice. Pure; never throws on odd lines.
- */
-
-/** An item of a slice — the analytics item shape (ids as given, normalized on the wire). */
-type VioItem = AnalyticsItemInput;
-/** One campaign's share of the cart. */
-interface CartSlice {
-    campaignId?: number;
-    sponsorId?: number;
-    slot?: string;
-    contentId?: string;
-    items: VioItem[];
-    value: number;
-    currency?: string;
-    /** 1-based position of this slice and how many there are. */
-    slice: number;
-    slices: number;
-}
-/** The campaign of a unit without an explicit one: the caller's rule (slot assignment → sponsor → default). */
-type ResolveCampaign = (slot: string | undefined, sponsorId: number) => number | undefined;
-declare function cartSlicesFrom(lines: ReadonlyArray<CartLineItem>, resolveCampaign: ResolveCampaign, fallbackCurrency?: string): CartSlice[];
-
+type PrivacyAnswer = SurfacePrivacyMode | 'unknown';
 declare class VioFacade {
     private apiInstance;
     private commerceClients;
@@ -2336,8 +2911,11 @@ declare class VioFacade {
      * (another key or environment) is still in flight after a re-init; its answer
      * belongs to that configuration and must not land in this one. */
     private generation;
-    /** Slot ids present on the page (`Vio.registerSlot`): how many elements hold each + its display name. */
+    /** Slot ids present on the page (`Vio.registerSlot`): how many elements hold each, its display name, its own campaign and its kind. */
     private slotRegistry;
+    /** Slots already warned about (`dashboard`: the dashboard's assignment stands; `replaced`: this page moved it). */
+    private warnedDashboardSlots;
+    private warnedReplacedSlots;
     /** Pending debounced declaration of the registry. */
     private slotDeclareTimer;
     /** A name appeared (or the key changed) since the registry was last declared. */
@@ -2350,6 +2928,10 @@ declare class VioFacade {
     private cartManager;
     private checkoutManager;
     private analyticsManager;
+    /** What the surface answered of its privacy mode (`GET /v2/mobile/surface`) and when; `unknown` expires after a minute. */
+    private surfaceMode;
+    /** The request in flight for it, if any. */
+    private surfaceRequest;
     init(config: VioConfig): void;
     /**
      * The content (article, page) this SDK instance is rendered in — what every
@@ -2365,7 +2947,7 @@ declare class VioFacade {
     get config(): ResolvedConfig;
     /** Multi-sponsor cart manager. Reactive — listen via addEventListener('change', ...). */
     get cart(): CartManager;
-    /** Checkout flow manager. Subscribes to cart state via the CartManager. */
+    /** Checkout flow manager. Subscribes to cart state via the CartManager; asks here for the order's attribution. */
     get checkout(): CheckoutManager;
     /**
      * Analytics — track() queues even pre-init; nothing is sent (and no
@@ -2406,19 +2988,39 @@ declare class VioFacade {
     /**
      * Register a slot present on the page (the `<vio-*>` elements call it with
      * their effective id — the host's `vio-slot` or the auto-generated one —
-     * and the optional display name). The registry is declared ONCE, debounced,
-     * after the first successful bootstrap — and again whenever a new id or a
-     * new display name appears. A `displayName` given later for an id already
-     * registered replaces the one kept; `undefined` leaves it alone. The
-     * returned function unregisters; removal never re-declares.
-     */
-    registerSlot(name: string, displayName?: string): () => void;
+     * the optional display name, and the element's own campaign when it has
+     * one: `vio-campaign` or an ancestor's `data-vio-campaign`). The registry is
+     * declared ONCE, debounced, after the first successful bootstrap — and again
+     * whenever a new id, display name, campaign or kind appears. A `displayName` /
+     * `campaignId` given later for an id already registered replaces the one
+     * kept; `undefined` leaves it alone. The third argument is the campaign id
+     * (as before) or `{ campaignId?, kind? }`, and a fourth `{ kind? }` may
+     * follow a positional campaign — the elements call
+     * `registerSlot(id, name, campaignId, { kind })` so a facade from an older
+     * bundle, which reads only three arguments, still gets the campaign. `kind`
+     * is what kind of element holds the slot (`card` | `carousel` | `detail`);
+     * the FIRST kind an id gets stays (the cards a carousel renders share its
+     * id: the slot is the carousel's). The returned function unregisters;
+     * removal never re-declares.
+     */
+    registerSlot(name: string, displayName?: string, campaignIdOrOptions?: number | string | null | RegisterSlotOptions, options?: RegisterSlotOptions): () => void;
     /**
      * The campaign a slot shows now, from the last bootstrap: its assigned and
      * open campaign for the init platform, else the surface's default. With no
      * slot, the default. `null` before the bootstrap. See `resolveSlotCampaign`.
      */
-    campaignForSlot(slot?: string | null): BootstrapCampaignEntry | null;
+    campaignForSlot(slot?: string | null, hint?: {
+        campaignId?: CampaignHint;
+        sponsorId?: number | string | null;
+    }): BootstrapCampaignEntry | null;
+    /** The page-campaign candidates in precedence order: the element's (own, ancestor), then `Vio.init`'s. */
+    private pageCampaignCandidates;
+    /**
+     * The campaign the PAGE belongs to (`Vio.init({ campaignId })`, ADR-0034
+     * amendment 3), as the last bootstrap lists it — only when it is there and
+     * active; `null` otherwise (no page campaign, paused, unknown, no bootstrap).
+     */
+    pageCampaign(): BootstrapCampaignEntry | null;
     /**
      * THE attribution helper — the SDK elements, Vev and Replit all use this
      * one. For a place (`slot`): the campaign it shows right now
@@ -2429,12 +3031,69 @@ declare class VioFacade {
      *
      * `hint.sponsorId` — when the caller already knows the sponsor (a card with
      * `sponsor-id`) it is kept as `sponsorId`, and the campaign follows the same
-     * cascade analytics uses (slot assignment → the sponsor's active campaign →
-     * default), so what the cart remembers matches what the events say.
+     * cascade analytics uses (slot assignment → page campaign → the sponsor's
+     * active campaign → default), so what the cart remembers matches what the
+     * events say — the page campaign applies there only when that sponsor takes
+     * part in it. `hint.campaignId` — the element's own page campaign
+     * candidates (`vio-campaign`, an ancestor's `data-vio-campaign`), ahead of
+     * `Vio.init`'s; an unusable one falls through to the next; `0` = unset.
      */
     attribution(slot?: string | null, hint?: {
         sponsorId?: number | string;
+        campaignId?: CampaignHint;
     }): Attribution;
+    /**
+     * What the surface answered and is still believed: `standard` / `minimal`
+     * for the configuration; `unknown` for a minute after a timeout or a
+     * failure (then it is asked again). `null` = nothing believed.
+     */
+    private believedSurfaceMode;
+    /**
+     * Ask the surface its privacy mode (`GET /v2/mobile/surface`), once —
+     * started at `init()` and again by `bootstrap()`, never by the payment
+     * path, which only reads what is known (`privacyModeNow`). Resolves what
+     * was learnt within 1.5 s: the mode; `standard` for a service that predates
+     * the endpoint (404) or a surface that names none; `unknown` for a word the
+     * SDK does not know, a timeout or any other failure — believed for a
+     * minute, then asked again. An answer that arrives after the cap still
+     * lands for the next step. Never throws.
+     */
+    preloadPrivacyMode(): Promise<PrivacyAnswer>;
+    /**
+     * How much of the visit the order attribution may carry (ADR-0035): the
+     * surface's privacy mode, as known RIGHT NOW, without waiting —
+     * `Vio.init({ privacyMode: 'minimal' })` when the host says so, else what
+     * the bootstrap says of the surface, else what the surface answered to the
+     * ask `init()` started (`preloadPrivacyMode`), else the host's `standard`
+     * once the surface could not tell. `unknown` while nothing is known: then
+     * the page, the slot and the entry stay off what goes to Commerce, because
+     * what can reveal which screen someone was on, and why, is only sent when
+     * the surface is known to allow it. The payment path reads this one.
+     */
+    privacyModeNow(): PrivacyAnswer;
+    /**
+     * `privacyModeNow`, but waiting for the ask in flight when there is one
+     * (at most its 1.5 s cap) — for the cart's lines, which are not the
+     * payment path. Never throws.
+     */
+    privacyMode(): Promise<PrivacyAnswer>;
+    /**
+     * The attribution of the order a sponsor's cart is about to become
+     * (ADR-0035 phase B) — what `CreateCheckout` / `UpdateCheckout` send as
+     * `attribution` and shopcart writes on the order: the surface (its SDK
+     * key), the page's campaign (`pageCampaign()`; without one, the campaign
+     * that explains most units of the cart under the same rule `purchase` is
+     * split by — `cartSlices`) and, on a surface KNOWN to be `standard`
+     * (`privacyModeNow`), the page (`content()`'s url as origin + path, and
+     * title) and where the session came in: the landing the session REMEMBERS
+     * (`storedLanding`, else the one analytics resolved on this page) — never
+     * the page the shopper pays on taken for a landing. Synchronous: nothing
+     * on the way to a payment waits for it. snake_case, capped to Commerce's
+     * limits. `undefined` when there is nothing to say; never throws.
+     */
+    orderAttribution(sponsorId?: number): CheckoutAttributionWire | undefined;
+    /** The landing the session remembers: what the first page stored, else what analytics resolved on this page load (consent pending); null otherwise. */
+    private rememberedLanding;
     /**
      * The cart split per campaign — the SAME rule `begin_checkout` / `purchase`
      * use, for hosts with their own analytics sink (Vev). Every unit of every
@@ -2448,11 +3107,40 @@ declare class VioFacade {
     cartSlices(sponsorId?: number, opts?: {
         items?: CartLineItem[];
     }): CartSlice[];
+    /**
+     * What the micro did with the page's campaign per slot (`assignment`):
+     * `console.debug` when `Vio.init({ debug: true })`; a warning once per
+     * slot when the dashboard's own assignment stands (only for a slot this
+     * page actually sent a campaign for) and once per slot when this page moved
+     * it from an earlier page assignment (`replaced`).
+     */
+    private reportAssignments;
+    /**
+     * The memory keys of the sent locations whose campaign the micro did not
+     * take up: every location when a campaign was sent and no answer carries
+     * `assignment` (an older micro), or the ones answered `none` for a campaign
+     * the bootstrap lists as active. They are remembered with the 1 h TTL.
+     */
+    private campaignNotTakenUp;
     private scheduleSlotDeclaration;
     private findSponsor;
 }
 declare const Vio: VioFacade;
 
+/**
+ * The buyer reference — shopcart's `buyer_ref`: the keyed hash Commerce
+ * computes from the buyer's email, so one person is one ref across orders,
+ * devices and platforms, and nothing in it can be turned back into an email
+ * without Commerce's secret. The SDK forwards it as analytics `buyer_id`
+ * (EVENTS_CONTRACT `commerce.buyer_id`, ≤ 128 chars in the collector's
+ * schema) and never puts anything else in its place: an email, a name, an
+ * over-long value are dropped — not hashed client-side, not cut (a cut hash
+ * is another identity).
+ */
+declare const BUYER_REF_MAX_LENGTH = 128;
+/** The reference when `value` is one; `undefined` for anything else (never an email). */
+declare function normalizeBuyerRef(value: unknown): string | undefined;
+
 /**
  * SDK version reported in analytics events (`sdk_version`) and available
  * to consumers. Kept as a constant (not a package.json import) so the
@@ -2460,7 +3148,7 @@ declare const Vio: VioFacade;
  *
  * RELEASE CHECKLIST: bump together with package.json (see CONTRIBUTING).
  */
-declare const SDK_VERSION = "0.23.1";
+declare const SDK_VERSION = "0.25.0";
 
 /**
  * Vipps MobilePay's own button, the way the design guidelines ask for it.
@@ -2489,4 +3177,4 @@ declare function vippsButtonAttributes(verb?: 'buy' | 'pay' | 'express' | 'conti
     language?: string;
 }): Record<string, string>;
 
-export { ADD_ITEM_MUTATION, type AddManualOptions, type AddProductOptions, type AnalyticsCommerce, type AnalyticsContext, type AnalyticsEventName, type AnalyticsItemInput, AnalyticsManager, type AnalyticsStartOptions, type ApplePayConfig, type ApplePayResult, type Attribution, type BootstrapCampaign, type BootstrapCampaignEntry, type BootstrapCampaignStatus, type BootstrapResponse, type BootstrapSlot, CREATE_CART_MUTATION, CREATE_CHECKOUT_MUTATION, CREATE_PAYMENT_STRIPE_MUTATION, CREATE_PAYMENT_VIPPS_MUTATION, type CartChangeDetail, type CartLineItem, type CartLineOrigin, CartManager, type CartOrigin, type CartQueryOptions, type CartSlice, type CheckoutAddress, type CheckoutChangeDetail, CheckoutManager, type CheckoutState, CommerceClient, Configuration, type ContentRef, type CreatePaymentVippsResponse, type CreatePaymentVippsVariables, DELETE_ITEM_MUTATION, type Environment, GET_AVAILABLE_PAYMENT_METHODS_QUERY, GET_CART_QUERY, GET_CHECKOUT_QUERY, GET_LINE_ITEMS_BY_SUPPLIER_QUERY, GET_VIPPS_STATUS_QUERY, type GetVippsStatusVariables, type ImageSize, type ManifestLocation, type ManifestRequest, type ManifestResult, type PaymentCompleteDetail, type PaymentMethod, type PaymentSelectDetail, type PaymentSuccessDetail, type PaymentSuccessResult, type PlacementComponent, type Product, type ProductCategory, type ProductImage, type ProductOption, type ProductPrice, type ProductVariant, type ResolvedConfig, SDK_VERSION, type SlotInput, type SlotKind, type Sponsor, type SponsorCartState, type SponsorCommerceBlock, type TrackOptions, UPDATE_CHECKOUT_MUTATION, UPDATE_ITEM_MUTATION, UPDATE_SHIPPINGS_BY_SUPPLIER_MUTATION, VIPPS_BUTTON_SCRIPT, VIPPS_BUTTON_TAG, Vio, VioApi, VioApiError, type VioConfig, type VioItem, type VioPlatform, type VippsPaymentState, type VippsStatusResult, addItem, autoSlotDisplayName, autoSlotId, cartSlicesFrom, checkApplePayAvailability, createCart, createCheckout, createCommerceClient, createPaymentStripe, createPaymentVipps, createVioApi, deleteItem, displayPrice, ensureVippsButton, executeCartGraphQL, formatPrice, getAvailablePaymentMethods, getCart, getCartGraphQLOptions, getCheckout, getCustomerSessionId, getGlobalCurrency, getLineItemsBySupplier, getVippsStatus, lineOrigins, normalizeOrigin, normalizeScope, primaryImageUrl, purchaseFromPaymentSuccess, resolveCampaignId, resolveContent, resolveSlotCampaign, sameOrigin, showApplePaySheet, updateCheckout, updateItem, updateShippingsBySupplier, vippsButtonAttributes };
+export { ADD_ITEM_MUTATION, type AddManualOptions, type AddProductOptions, type AnalyticsCommerce, type AnalyticsContext, type AnalyticsEventName, type AnalyticsItemInput, AnalyticsManager, type AnalyticsStartOptions, type ApplePayConfig, type ApplePayResult, type Attribution, BUYER_REF_MAX_LENGTH, type BootstrapCampaign, type BootstrapCampaignEntry, type BootstrapCampaignStatus, type BootstrapResponse, type BootstrapSlot, CHECKOUT_ATTRIBUTION_CAPS, CLIENT_LANDING_URL_MAX_LENGTH, CONTENT_URL_MAX_LENGTH, CREATE_CART_MUTATION, CREATE_CHECKOUT_MUTATION, CREATE_CHECKOUT_WITH_ATTRIBUTION_MUTATION, CREATE_PAYMENT_STRIPE_MUTATION, CREATE_PAYMENT_VIPPS_MUTATION, type CampaignHint, type CartChangeDetail, type CartLineItem, type CartLineOrigin, CartManager, type CartOrigin, type CartQueryOptions, type CartSlice, type CheckoutAddress, type CheckoutAttributionInput, type CheckoutAttributionWire, type CheckoutChangeDetail, CheckoutManager, type CheckoutManagerDeps, type CheckoutReference, type CheckoutState, type ClientContext, CommerceClient, Configuration, type ContentRef, type CreatePaymentVippsResponse, type CreatePaymentVippsVariables, DELETE_ITEM_MUTATION, type EntryContextWire, type Environment, GET_AVAILABLE_PAYMENT_METHODS_QUERY, GET_CART_QUERY, GET_CHECKOUT_QUERY, GET_LINE_ITEMS_BY_SUPPLIER_QUERY, GET_VIPPS_STATUS_QUERY, GRAPHQL_INT_MAX, type GatewayFeature, type GetVippsStatusVariables, type ImageSize, LINE_ORIGIN_CAPS, type Landing, type LineOriginWire, type LineOriginWireOptions, type ManifestLocation, type ManifestRequest, type ManifestResult, type OriginPage, type PaymentCompleteDetail, type PaymentMethod, type PaymentSelectDetail, type PaymentSuccessDetail, type PaymentSuccessResult, type PlacementComponent, type Product, type ProductCategory, type ProductImage, type ProductOption, type ProductPrice, type ProductVariant, type RegisterSlotOptions, type ResolvedConfig, SDK_VERSION, type SlotInput, type SlotKind, type Sponsor, type SponsorCartState, type SponsorCommerceBlock, type SurfacePrivacyMode, type SurfaceResponse, type TrackOptions, UPDATE_CHECKOUT_MUTATION, UPDATE_CHECKOUT_WITH_ATTRIBUTION_MUTATION, UPDATE_ITEM_MUTATION, UPDATE_ITEM_WITH_ORIGIN_MUTATION, UPDATE_SHIPPINGS_BY_SUPPLIER_MUTATION, VIPPS_BUTTON_SCRIPT, VIPPS_BUTTON_TAG, Vio, VioApi, VioApiError, type VioConfig, type VioItem, type VioPlatform, type VippsPaymentState, type VippsStatusResult, activeCampaignEntry, addItem, autoSlotDisplayName, autoSlotId, buyerRefOf, campaignCandidates, capContentUrl, cartSlicesFrom, checkApplePayAvailability, checkoutAttributionOf, componentKindOf, createCart, createCheckout, createCommerceClient, createPaymentStripe, createPaymentVipps, createVioApi, deleteItem, displayPrice, dominantCampaignOf, ensureVippsButton, entryContextOf, executeCartGraphQL, formatPrice, gatewayHas, getAvailablePaymentMethods, getCart, getCartGraphQLOptions, getCheckout, getCheckoutReference, getCustomerSessionId, getGlobalCurrency, getLineItemsBySupplier, getVippsStatus, isUnknownFeatureError, isUnknownTokenError, landingUrl, lineOriginWire, lineOrigins, normalizeBuyerRef, normalizeOrigin, normalizeScope, normalizeSlotKind, originAndPath, primaryImageUrl, purchaseFromPaymentSuccess, resetGatewayFeatures, resolveCampaignId, resolveClientContext, resolveContent, resolveLanding, resolveSlotCampaign, sameOrigin, showApplePaySheet, sponsorCampaignEntry, storedLanding, toCampaignId, updateCheckout, updateItem, updateShippingsBySupplier, vippsButtonAttributes, withGatewayFeature };