@vio-live/web-sdk 0.29.0 → 0.32.0

package/dist/{chunk-AG4G2S2M.js → chunk-IR4XYTZL.js}

@@ -207,9 +207,9 @@ function slotDeclarationKey(location2, pageCampaignId) {
   const kind = normalizeSlotKind(location2.kind);
   return location2.id + (location2.displayName ? `${location2.displayName}` : "") + (campaignId !== void 0 ? `${campaignId}` : "") + (kind !== void 0 ? `${kind}` : "");
 }
-function pendingSlotKeys(memory, keys, now = Date.now(), ttl = SLOT_DECLARATION_TTL_MS) {
+function pendingSlotKeys(memory2, keys, now = Date.now(), ttl = SLOT_DECLARATION_TTL_MS) {
   return keys.filter((key) => {
-    const at = memory?.[key];
+    const at = memory2?.[key];
     if (typeof at !== "number" || !Number.isFinite(at)) return true;
     return now - at >= ttl || now < at;
   });
@@ -218,8 +218,8 @@ function slotKeyId(key) {
   const cut4 = key.search(/[\u001f\u001e\u001d]/);
   return cut4 >= 0 ? key.slice(0, cut4) : key;
 }
-function rememberSlotKeys(memory, keys, at, cap = SLOT_DECLARATION_MEMORY_CAP) {
-  const next = { ...memory ?? {} };
+function rememberSlotKeys(memory2, keys, at, cap = SLOT_DECLARATION_MEMORY_CAP) {
+  const next = { ...memory2 ?? {} };
   const ids = new Set(keys.map(slotKeyId));
   for (const existing of Object.keys(next)) {
     if (ids.has(slotKeyId(existing)) && !keys.includes(existing)) delete next[existing];
@@ -258,10 +258,10 @@ function readSlotDeclaration(storageKey) {
     return {};
   }
 }
-function writeSlotDeclaration(storageKey, memory) {
+function writeSlotDeclaration(storageKey, memory2) {
   try {
     if (typeof localStorage === "undefined") return;
-    localStorage.setItem(storageKey, JSON.stringify(memory));
+    localStorage.setItem(storageKey, JSON.stringify(memory2));
   } catch {
   }
 }
@@ -466,6 +466,51 @@ function createVioApi(options) {
   return new VioApi(options);
 }
 
+// src/core/safe-storage.ts
+var memory = {
+  local: /* @__PURE__ */ new Map(),
+  session: /* @__PURE__ */ new Map()
+};
+function area(kind) {
+  try {
+    const s = globalThis[kind === "local" ? "localStorage" : "sessionStorage"];
+    return s && typeof s.getItem === "function" ? s : null;
+  } catch {
+    return null;
+  }
+}
+function storageGet(kind, key) {
+  const kept = memory[kind];
+  if (kept.has(key)) return kept.get(key) ?? null;
+  const s = area(kind);
+  if (!s) return null;
+  try {
+    return s.getItem(key);
+  } catch {
+    return null;
+  }
+}
+function storageSet(kind, key, value, opts = {}) {
+  try {
+    const s = area(kind);
+    if (s) {
+      s.setItem(key, value);
+      memory[kind].delete(key);
+      return true;
+    }
+  } catch {
+  }
+  if (opts.memory !== false) memory[kind].set(key, value);
+  return false;
+}
+function storageRemove(kind, key) {
+  memory[kind].delete(key);
+  try {
+    area(kind)?.removeItem(key);
+  } catch {
+  }
+}
+
 // src/core/types.ts
 function displayPrice(product) {
   const p = product.price;
@@ -475,37 +520,24 @@ function displayPrice(product) {
 function getGlobalCountryCode() {
   const g = globalThis;
   if (g.__VIO_COUNTRY__) return g.__VIO_COUNTRY__;
-  if (typeof localStorage !== "undefined") {
-    try {
-      const v = localStorage.getItem("vio.country");
-      if (v) return v;
-    } catch {
-    }
-  }
+  const stored = storageGet("local", "vio.country");
+  if (stored) return stored;
   return "NO";
 }
 function getGlobalLocale() {
   const g = globalThis;
   if (g.__VIO_LOCALE__) return g.__VIO_LOCALE__;
-  if (typeof localStorage !== "undefined") {
-    try {
-      const v = localStorage.getItem("vio.locale");
-      if (v) return v;
-    } catch {
-    }
-  }
+  const stored = storageGet("local", "vio.locale");
+  if (stored) return stored;
   return "nb-NO";
 }
 function getGlobalSymbol(currency) {
   const activeCurrency = currency || getGlobalCurrency();
   const g = globalThis;
   if (!currency && g.__VIO_SYMBOL__) return g.__VIO_SYMBOL__;
-  if (!currency && typeof localStorage !== "undefined") {
-    try {
-      const v = localStorage.getItem("vio.symbol");
-      if (v) return v;
-    } catch {
-    }
+  if (!currency) {
+    const v = storageGet("local", "vio.symbol");
+    if (v) return v;
   }
   const curr = String(activeCurrency).toUpperCase();
   if (curr === "NOK" || curr === "DKK") return "Kr";
@@ -519,13 +551,8 @@ function getGlobalSymbol(currency) {
 function getGlobalCurrency() {
   const g = globalThis;
   if (g.__VIO_CURRENCY__) return g.__VIO_CURRENCY__;
-  if (typeof localStorage !== "undefined") {
-    try {
-      const v = localStorage.getItem("vio.currency");
-      if (v) return v;
-    } catch {
-    }
-  }
+  const stored = storageGet("local", "vio.currency");
+  if (stored) return stored;
   return "NOK";
 }
 var validatedLocales = /* @__PURE__ */ new Map();
@@ -665,6 +692,80 @@ var GET_PRODUCT_SELLER = (
   }
 `
 );
+var GET_PRODUCT_SHIPPING = (
+  /* GraphQL */
+  `
+  query GetProductShipping(
+    $productIds: [Int!]
+    $useCache: Boolean!
+    $currency: String
+    $shippingCountryCode: String
+  ) {
+    Channel {
+      GetProductsByIds(
+        product_ids: $productIds
+        useCache: $useCache
+        currency: $currency
+        shipping_country_code: $shippingCountryCode
+      ) {
+        id
+        product_shipping {
+          id
+          name
+          description
+          default
+          shipping_country {
+            country
+            price {
+              amount
+              amount_incl_taxes
+              currency_code
+            }
+          }
+        }
+      }
+    }
+  }
+`
+);
+var GET_PRODUCT_SHIPPING_WITH_LOGO = (
+  /* GraphQL */
+  `
+  query GetProductShippingWithLogo(
+    $productIds: [Int!]
+    $useCache: Boolean!
+    $currency: String
+    $shippingCountryCode: String
+  ) {
+    Channel {
+      GetProductsByIds(
+        product_ids: $productIds
+        useCache: $useCache
+        currency: $currency
+        shipping_country_code: $shippingCountryCode
+      ) {
+        id
+        product_shipping {
+          id
+          name
+          description
+          logo_url
+          default
+          shipping_country {
+            country
+            price {
+              amount
+              amount_incl_taxes
+              currency_code
+            }
+          }
+        }
+      }
+    }
+  }
+`
+);
+var gatewayHasShippingLogo;
 var ChannelProduct = class {
   constructor(client) {
     this.client = client;
@@ -704,7 +805,64 @@ var ChannelProduct = class {
       return null;
     }
   }
+  /**
+   * The product's shipping rates for the page's market (or `country`),
+   * cheapest first; `[]` when it has none there, `null` when they could not
+   * be read. Never throws. Never from the cache, for the reason given at
+   * getSellerCompany.
+   */
+  async getShippingRates(productId, options = {}) {
+    const country = options.country || getGlobalCountryCode();
+    const variables = {
+      productIds: [productId],
+      useCache: false,
+      currency: options.currency ?? getGlobalCurrency(),
+      shippingCountryCode: country
+    };
+    try {
+      let data;
+      if (gatewayHasShippingLogo === false) {
+        data = await this.client.request(GET_PRODUCT_SHIPPING, variables);
+      } else {
+        try {
+          data = await this.client.request(GET_PRODUCT_SHIPPING_WITH_LOGO, variables);
+          gatewayHasShippingLogo = true;
+        } catch (err) {
+          if (!/logo_url/.test(String(err?.message ?? ""))) throw err;
+          gatewayHasShippingLogo = false;
+          data = await this.client.request(GET_PRODUCT_SHIPPING, variables);
+        }
+      }
+      const product = data.Channel?.GetProductsByIds?.[0];
+      if (!product) return null;
+      return shippingRatesFor(product.product_shipping, country);
+    } catch {
+      return null;
+    }
+  }
 };
+function shippingRatesFor(productShipping, country) {
+  if (!Array.isArray(productShipping)) return [];
+  const want = String(country || "").trim().toUpperCase();
+  const out = [];
+  for (const s of productShipping) {
+    const countries = Array.isArray(s?.shipping_country) ? s.shipping_country : [];
+    const row = countries.find((c) => String(c?.country ?? "").trim().toUpperCase() === want);
+    const price = row?.price;
+    const amount = typeof price?.amount_incl_taxes === "number" ? price.amount_incl_taxes : price?.amount;
+    if (typeof amount !== "number" || !Number.isFinite(amount) || amount < 0) continue;
+    out.push({
+      id: String(s.id ?? ""),
+      name: String(s.name ?? ""),
+      price: amount,
+      currency: String(price?.currency_code ?? ""),
+      default: s.default === true,
+      description: typeof s.description === "string" ? s.description.trim() : "",
+      logoUrl: httpsUrlOrEmpty(s.logo_url ?? s.logoUrl)
+    });
+  }
+  return out.sort((a, b) => a.price - b.price);
+}
 var Channel = class {
   constructor(client) {
     this.product = new ChannelProduct(client);
@@ -723,6 +881,11 @@ var CommerceClient = class {
 function createCommerceClient(options) {
   return new CommerceClient(options);
 }
+function httpsUrlOrEmpty(value) {
+  if (typeof value !== "string") return "";
+  const url = value.trim();
+  return /^https:\/\/[^\s]+$/i.test(url) ? url : "";
+}
 
 // src/core/content.ts
 var CONTENT_ID_QUERY = "vio_content";
@@ -1890,11 +2053,10 @@ async function getCartGraphQLOptions(sponsorId) {
 }
 var CUSTOMER_SESSION_KEY = "vio.customer_session_id.v1";
 function getCustomerSessionId() {
-  if (typeof localStorage === "undefined") return "cs_session_default";
-  let id = localStorage.getItem(CUSTOMER_SESSION_KEY);
+  let id = storageGet("local", CUSTOMER_SESSION_KEY);
   if (!id) {
     id = "cs_" + Math.random().toString(36).slice(2, 11) + Date.now().toString(36);
-    localStorage.setItem(CUSTOMER_SESSION_KEY, id);
+    storageSet("local", CUSTOMER_SESSION_KEY, id);
   }
   return id;
 }
@@ -2881,19 +3043,23 @@ var CartManager = class extends EventTarget {
     return formatPrice(this.totalAcrossSponsors, this.primaryCurrency);
   }
   // MARK: - Persistence
+  /**
+   * Keep the carts for the next page and the other tabs. Where storage
+   * refuses (in-app browsers, private modes) nothing throws (safe-storage.ts):
+   * the carts stay in this manager's own map, the add to cart and the
+   * checkout go on, and the cart just does not survive a reload there.
+   */
   persist() {
-    if (typeof localStorage === "undefined") return;
     try {
       const obj = {};
       for (const [k, v] of this.cartsBySponsor) obj[String(k)] = v;
-      localStorage.setItem(STORAGE_KEY, JSON.stringify(obj));
+      storageSet("local", STORAGE_KEY, JSON.stringify(obj), { memory: false });
     } catch {
     }
   }
   loadFromStorage() {
-    if (typeof localStorage === "undefined") return /* @__PURE__ */ new Map();
     try {
-      const raw = localStorage.getItem(STORAGE_KEY);
+      const raw = storageGet("local", STORAGE_KEY);
       if (!raw) return /* @__PURE__ */ new Map();
       const obj = JSON.parse(raw);
       const map = /* @__PURE__ */ new Map();
@@ -3055,13 +3221,15 @@ function sponsorIdentityFrom(boot, sponsorId) {
     if (!name && !logoUrl) return null;
     const termsUrl = pageUrlOrNull(sponsor.termsUrl);
     const refundPolicyUrl = pageUrlOrNull(sponsor.refundPolicyUrl);
+    const highlights = highlightsOf(sponsor.highlights);
     return {
       id,
       name,
       logoUrl,
       avatarUrl: urlOrNull(sponsor.avatarUrl),
       ...termsUrl ? { termsUrl } : {},
-      ...refundPolicyUrl ? { refundPolicyUrl } : {}
+      ...refundPolicyUrl ? { refundPolicyUrl } : {},
+      ...highlights.length ? { highlights } : {}
     };
   } catch {
     return null;
@@ -3156,6 +3324,20 @@ function rememberedSponsor(sponsorId) {
     return null;
   }
 }
+function highlightsOf(value) {
+  if (!Array.isArray(value)) return [];
+  const out = [];
+  for (const item of value) {
+    if (!item || typeof item !== "object") continue;
+    const { icon, title, text: text3 } = item;
+    const t = typeof title === "string" ? title.trim() : "";
+    if (!t) continue;
+    const body = typeof text3 === "string" ? text3.trim() : "";
+    out.push({ icon: typeof icon === "string" ? icon.trim() : "", title: t, ...body ? { text: body } : {} });
+    if (out.length === 3) break;
+  }
+  return out;
+}
 
 // src/core/checkout/payments/apple-pay.ts
 var STRIPE_JS_URL = "https://js.stripe.com/v3";
@@ -3353,7 +3535,7 @@ async function prepareApplePay(config) {
 }
 
 // src/core/version.ts
-var SDK_VERSION = "0.29.0";
+var SDK_VERSION = "0.32.0";
 
 // src/core/checkout/payments/stripe-embedded.ts
 var CREATE_PAYMENT_INTENT_STRIPE_MUTATION = `
@@ -3519,11 +3701,8 @@ async function mountKlarnaExpressButton(opts) {
   const returnUrl = opts.returnUrl ?? (typeof window !== "undefined" ? window.location.origin + window.location.pathname : "");
   let settled = false;
   button.on("click", () => {
-    if (opts.pendingKey && opts.pendingContext && typeof sessionStorage !== "undefined") {
-      try {
-        sessionStorage.setItem(opts.pendingKey, JSON.stringify(opts.pendingContext));
-      } catch {
-      }
+    if (opts.pendingKey && opts.pendingContext) {
+      storageSet("session", opts.pendingKey, JSON.stringify(opts.pendingContext));
     }
     const promise = sdk.Payment.initiate(() => ({
       currency: opts.paymentRequest.currency,
@@ -4601,6 +4780,74 @@ function adyenReturnOutcome(payment) {
   }
 }
 
+// src/core/checkout/phone.ts
+var CALLING_CODES = {
+  NO: "47",
+  SE: "46",
+  DK: "45",
+  FI: "358",
+  IS: "354",
+  DE: "49",
+  GB: "44",
+  UK: "44",
+  IE: "353",
+  NL: "31",
+  BE: "32",
+  FR: "33",
+  ES: "34",
+  PT: "351",
+  IT: "39",
+  AT: "43",
+  CH: "41",
+  PL: "48",
+  EE: "372",
+  LV: "371",
+  LT: "370",
+  CZ: "420",
+  SK: "421",
+  HU: "36",
+  US: "1",
+  CA: "1"
+};
+var KNOWN_CODES = [...new Set(Object.values(CALLING_CODES))].sort((a, b) => b.length - a.length);
+var NATIONAL_LENGTH = {
+  "47": [8, 8],
+  "45": [8, 8],
+  "46": [7, 9],
+  "358": [6, 10],
+  "49": [10, 11],
+  "44": [10, 10],
+  "1": [10, 10]
+};
+function callingCodeFor(country) {
+  return CALLING_CODES[String(country ?? "").trim().toUpperCase()] ?? null;
+}
+function parsePhone(raw, country) {
+  const typed = String(raw ?? "").trim().replace(/[\s\-().]/g, "");
+  if (!typed) return null;
+  let code = null;
+  let national;
+  if (/^(\+|00)/.test(typed)) {
+    const digits = typed.replace(/^(\+|00)/, "");
+    if (!/^\d+$/.test(digits)) return null;
+    code = KNOWN_CODES.find((c) => digits.startsWith(c)) ?? null;
+    if (!code) return null;
+    national = digits.slice(code.length);
+  } else {
+    if (!/^\d+$/.test(typed)) return null;
+    code = callingCodeFor(country);
+    if (!code) return null;
+    national = typed;
+  }
+  if (national.startsWith("0") && code !== "47" && code !== "45") national = national.slice(1);
+  const [min, max] = NATIONAL_LENGTH[code] ?? [6, 12];
+  if (national.length < min || national.length > max) return null;
+  return { phone: national, phone_code: code };
+}
+function isValidPhone(raw, country) {
+  return parsePhone(raw, country) !== null;
+}
+
 // src/core/checkout/checkout-manager.ts
 function describeError(err) {
   if (err instanceof Error) return err.message;
@@ -4618,6 +4865,7 @@ function describeError(err) {
   }
   return String(err);
 }
+var KLARNA_CONFIRMED_KEY = "vio.klarna.confirmed.v1";
 var KLARNA_PENDING_KEY = "vio.klarna.pending.v1";
 var KLARNA_SHIPPING_OPTIONS = [
   {
@@ -4781,15 +5029,20 @@ function buildCheckoutAddress(address) {
   const zip = address.postalCode || address.postal_code || address.zip || null;
   const country_code = address.countryCode || address.country_code || address.country || getGlobalCountryCode();
   if (!firstName && !lastName && !address1 && !city && !zip) return null;
+  const phone = parsePhone(address.phone, country_code);
   return {
     first_name: firstName,
     last_name: lastName,
     address1,
     city,
     zip,
-    country_code
+    country_code,
+    ...phone ? { phone: phone.phone, phone_code: phone.phone_code } : {}
   };
 }
+function isCompleteCheckoutAddress(a) {
+  return !!a && ["first_name", "last_name", "address1", "city", "zip"].every((k) => String(a[k] ?? "").trim().length > 0);
+}
 function adyenReturnUrl(params) {
   let page = null;
   if (typeof window !== "undefined" && window.location?.href) {
@@ -4854,6 +5107,18 @@ function resolveHttpsReturnUrl(overrideUrl, params = null) {
 async function executeKlarnaGraphQL(query, variables, sponsorId) {
   return executeCartGraphQL(query, variables, await getCartGraphQLOptions(sponsorId));
 }
+function usesStripe(methods) {
+  if (!Array.isArray(methods)) return false;
+  return methods.some((m) => {
+    if (String(m?.name ?? "").toLowerCase() !== "stripe") return false;
+    const config = Array.isArray(m?.config) ? m.config : [];
+    const key = config.find((c) => c?.name === "publishableKey")?.value;
+    return typeof key === "string" && key.startsWith("pk_");
+  });
+}
+function cartTotal(items) {
+  return items.reduce((sum, i) => sum + (Number(i.unitPrice) || 0) * (Number(i.quantity) || 0), 0);
+}
 var CheckoutManager = class _CheckoutManager extends EventTarget {
   constructor(cartManager, deps = {}) {
     super();
@@ -4907,7 +5172,9 @@ var CheckoutManager = class _CheckoutManager extends EventTarget {
     /** In-flight `getOrderReference` per checkout id (see there). */
     this.referenceInFlight = /* @__PURE__ */ new Map();
     this.kustomController = null;
-    preloadStripeJs();
+    if (Configuration.isInitialized && Configuration.get()?.stripePublishableKey) {
+      preloadStripeJs();
+    }
     if (typeof cartManager.addEventListener === "function") {
       cartManager.addEventListener("change", () => this.onCartChange());
     }
@@ -4944,6 +5211,9 @@ var CheckoutManager = class _CheckoutManager extends EventTarget {
     if (!cart || cart.items.length === 0) {
       throw new Error(`[VioCheckout] sponsor ${sponsorId} has no cart items`);
     }
+    if (!(cartTotal(cart.items) > 0)) {
+      throw new Error(`[VioCheckout] sponsor ${sponsorId} has a cart that totals 0`);
+    }
     this.state = {
       sponsorId,
       session: ++this.sessionSeq,
@@ -5059,6 +5329,21 @@ var CheckoutManager = class _CheckoutManager extends EventTarget {
     } catch {
     }
   }
+  /**
+   * Nothing is created or paid for a cart that is empty or totals 0 — as
+   * the SERVER has it (the callers read it from the server first). Throws,
+   * so a payment button ends in its error path, never at a provider asking
+   * for 0 kr.
+   */
+  assertPayableCart(sponsorId) {
+    const cart = this.cartManager.getCart(sponsorId);
+    if (!cart || !Array.isArray(cart.items) || cart.items.length === 0) {
+      throw new Error(`[CheckoutManager] the cart of sponsor ${sponsorId} is empty \u2014 nothing to pay`);
+    }
+    if (!(cartTotal(cart.items) > 0)) {
+      throw new Error(`[CheckoutManager] the cart of sponsor ${sponsorId} totals 0 \u2014 nothing to pay`);
+    }
+  }
   /** Update the backend checkout (terms are re-asserted unless overridden; the attribution rides along unless the caller gives its own). */
   async updateCheckout(variables, sponsorId) {
     const spId = sponsorId ?? this.state?.sponsorId;
@@ -5189,6 +5474,7 @@ var CheckoutManager = class _CheckoutManager extends EventTarget {
         const opts = await getCartGraphQLOptions(spId);
         const res = await getAvailablePaymentMethods(opts);
         if (res) this.paymentMethodsCache.set(spId, res);
+        if (usesStripe(res)) preloadStripeJs();
         return res;
       } finally {
         this.paymentMethodsPromises.delete(spId);
@@ -5288,11 +5574,21 @@ var CheckoutManager = class _CheckoutManager extends EventTarget {
    * backend cart + checkout exist, push email/address onto the checkout, and
    * return everything the payment mutation needs.
    */
-  async prepareRedirectPayment(sponsorId, formData, extraUpdateVars = {}, leaving = false) {
+  async prepareRedirectPayment(sponsorId, formData, extraUpdateVars = {}, leaving = false, vippsWithAddress = false) {
     const spId = sponsorId ?? this.state?.sponsorId;
     if (!spId) throw new Error("[CheckoutManager] no sponsor for payment");
     await this.cartManager.waitForCartMutations(spId);
     await this.cartManager.refreshFromServer(spId);
+    this.assertPayableCart(spId);
+    const isVipps = extraUpdateVars?.paymentMethod === "Vipps";
+    const addr = typeof formData === "object" && formData !== null ? formData : this.state?.address;
+    const built = buildCheckoutAddress(addr);
+    if (isVipps && vippsWithAddress && !(isCompleteCheckoutAddress(built) && built?.phone)) {
+      throw new Error(
+        "[CheckoutManager] the standard Vipps payment needs the complete delivery address (name, street, postcode, city and a mobile number) \u2014 no payment started"
+      );
+    }
+    const addressObj = !isVipps ? built : vippsWithAddress ? built : null;
     const cart = this.cartManager.getCart(spId);
     let cartId = cart?.cartId;
     if (!cartId) {
@@ -5315,9 +5611,6 @@ var CheckoutManager = class _CheckoutManager extends EventTarget {
     if (!checkoutId) {
       throw new Error("[CheckoutManager] no backend checkout \u2014 cannot start the payment");
     }
-    const isVipps = extraUpdateVars?.paymentMethod === "Vipps";
-    const addr = typeof formData === "object" && formData !== null ? formData : this.state?.address;
-    const addressObj = !isVipps ? buildCheckoutAddress(addr) : null;
     const emailVal = (typeof formData === "string" ? formData : formData?.email) || this.state?.address?.email || "";
     const hasEmail = !!emailVal && emailVal.includes("@");
     if (!hasEmail && !isVipps) {
@@ -5412,6 +5705,11 @@ var CheckoutManager = class _CheckoutManager extends EventTarget {
    * so the caller can open the ordinary checkout instead. Without the flag
    * the backend decides: Express while the cart has no delivery yet, a
    * plain payment once the shopper chose one in our form.
+   *
+   * `express: false` is the checkout's standard path (2026-10-28): the
+   * form's address — name, street, mobile — goes on the checkout before the
+   * payment is created, and the delivery already chosen on the cart is what
+   * Vipps charges for.
    */
   async startVippsPayment(sponsorId, formData, options = {}) {
     const waitFor = sponsorId ?? this.state?.sponsorId;
@@ -5420,7 +5718,8 @@ var CheckoutManager = class _CheckoutManager extends EventTarget {
       sponsorId,
       formData,
       { paymentMethod: "Vipps" },
-      true
+      true,
+      options.express === false
     );
     const returnUrl = resolveHttpsReturnUrl(null, {
       vio_payment: "success",
@@ -6757,14 +7056,13 @@ var CheckoutManager = class _CheckoutManager extends EventTarget {
    * the SDK's resumed `complete` event — finish creating the order + confirm.
    */
   async resumeKlarnaReturn() {
-    if (typeof sessionStorage === "undefined") return;
-    const raw = sessionStorage.getItem(KLARNA_PENDING_KEY);
+    const raw = storageGet("session", KLARNA_PENDING_KEY);
     if (!raw) return;
     let pending2;
     try {
       pending2 = JSON.parse(raw);
     } catch {
-      sessionStorage.removeItem(KLARNA_PENDING_KEY);
+      storageRemove("session", KLARNA_PENDING_KEY);
       return;
     }
     const fromUrl = readKlarnaTokenFromUrl();
@@ -6822,7 +7120,7 @@ var CheckoutManager = class _CheckoutManager extends EventTarget {
   async completeKlarnaOrder(authorizationToken, ctx, result) {
     if (this.klarnaOrderInFlight) return;
     this.klarnaOrderInFlight = true;
-    if (typeof sessionStorage !== "undefined" && sessionStorage.getItem("vio.klarna.confirmed.v1") === authorizationToken) {
+    if (storageGet("session", KLARNA_CONFIRMED_KEY) === authorizationToken) {
       this.klarnaOrderInFlight = false;
       return;
     }
@@ -6850,10 +7148,8 @@ var CheckoutManager = class _CheckoutManager extends EventTarget {
       }
       const orderData = confirmRes.order || confirmRes;
       const buyerRef = normalizeBuyerRef(confirmRes[BUYER_REF_FIELD]);
-      if (typeof sessionStorage !== "undefined") {
-        sessionStorage.setItem("vio.klarna.confirmed.v1", authorizationToken);
-        sessionStorage.removeItem(KLARNA_PENDING_KEY);
-      }
+      storageSet("session", KLARNA_CONFIRMED_KEY, authorizationToken);
+      storageRemove("session", KLARNA_PENDING_KEY);
       const state = this.state ?? { sponsorId: ctx.sponsorId, subtotal: ctx.orderAmount, currency: ctx.currency };
       this.dispatchEvent(
         new CustomEvent("payment-complete", {
@@ -7095,6 +7391,54 @@ function safeCall(fn) {
   }
 }
 
+// src/core/analytics/internal-traffic.ts
+var INTERNAL_KEY = "vio.internal.v1";
+var INTERNAL_PARAM = "vio_internal";
+function defaultInternalEnvironment() {
+  return {
+    location: typeof location !== "undefined" ? location : null,
+    storage: localStorageOrNull()
+  };
+}
+function resolveInternal(env = defaultInternalEnvironment()) {
+  const param = internalParam(env.location?.search);
+  if (param !== void 0) {
+    writeInternal(param, env.storage);
+    return param;
+  }
+  return readInternal(env.storage);
+}
+function readInternal(storage2 = defaultInternalEnvironment().storage) {
+  try {
+    return storage2?.getItem(INTERNAL_KEY) === "1";
+  } catch {
+    return false;
+  }
+}
+function writeInternal(internal, storage2 = defaultInternalEnvironment().storage) {
+  try {
+    if (internal) storage2?.setItem(INTERNAL_KEY, "1");
+    else storage2?.removeItem?.(INTERNAL_KEY);
+  } catch {
+  }
+}
+function internalParam(search) {
+  try {
+    const value = new URLSearchParams(typeof search === "string" ? search : "").get(INTERNAL_PARAM)?.trim();
+    if (value === "1") return true;
+    if (value === "0") return false;
+  } catch {
+  }
+  return void 0;
+}
+function localStorageOrNull() {
+  try {
+    return typeof window !== "undefined" && window.localStorage ? window.localStorage : null;
+  } catch {
+    return null;
+  }
+}
+
 // src/core/cart/slices.ts
 function cartSlicesFrom(lines, resolveCampaign, fallbackCurrency) {
   if (!Array.isArray(lines) || lines.length === 0) return [];
@@ -7171,6 +7515,7 @@ var FLUSH_AT_COUNT = 20;
 var MAX_QUEUE = 500;
 var RETRY_BACKOFF_MS = [2e3, 4e3, 8e3];
 var ANON_KEY = "vio.anon.v1";
+var MAX_ITEMS = 100;
 var SESSION_KEY = "vio.session.v1";
 var IMPRESSION_THRESHOLD = 0.5;
 var IMPRESSION_DWELL_MS = 1e3;
@@ -7178,7 +7523,14 @@ var AnalyticsManager = class extends EventTarget {
   constructor() {
     super(...arguments);
     this.started = false;
-    this.options = { host: "custom", collector: true, dataLayer: false, debug: false, autoTrack: true };
+    this.options = {
+      host: "custom",
+      collector: true,
+      dataLayer: false,
+      debug: false,
+      autoTrack: true,
+      privateContent: false
+    };
     this.queue = [];
     this.flushTimer = null;
     this.retryAttempt = 0;
@@ -7199,6 +7551,14 @@ var AnalyticsManager = class extends EventTarget {
     this.client = null;
     /** The landing it was read from — persisted later when consent arrives after the first event. */
     this.landing = null;
+    /**
+     * Internal traffic (ADR-0041): `client.internal: true` on every event while
+     * set. Read once (`?vio_internal=1|0`, else `localStorage`) at `Vio.init()`
+     * or on the first event; `setInternal()` changes it. `null` = not read yet.
+     */
+    this.internal = null;
+    /** The console line for testers goes out once per page load. */
+    this.internalAnnounced = false;
     /** Checkouts (`c:<id>`) and orders (`o:<number>`) this page load reported a `purchase` for: one each. */
     this.purchased = /* @__PURE__ */ new Set();
     /** Checkouts this page load reported an `add_payment_info` for: one each. */
@@ -7248,7 +7608,8 @@ var AnalyticsManager = class extends EventTarget {
       collector: options.collector ?? this.options.collector,
       dataLayer: options.dataLayer ?? this.options.dataLayer,
       debug: options.debug ?? this.options.debug,
-      autoTrack: options.autoTrack ?? this.options.autoTrack
+      autoTrack: options.autoTrack ?? this.options.autoTrack,
+      privateContent: options.privateContent ?? this.options.privateContent
     };
     if (options.sessionId) this.externalSessionId = options.sessionId;
     if (this.started || !hasDom()) return;
@@ -7291,6 +7652,43 @@ var AnalyticsManager = class extends EventTarget {
   identify(externalUserId) {
     this.externalUserId = externalUserId ?? void 0;
   }
+  /**
+   * Mark (or unmark) this browser as Vio's own traffic (ADR-0041): while
+   * marked, every event carries `client.internal: true` and the collector's
+   * reads leave it out. Remembered in `localStorage` (`vio.internal.v1`) —
+   * the same mark `?vio_internal=1` / `?vio_internal=0` sets on any page.
+   */
+  setInternal(internal) {
+    this.internal = internal === true;
+    writeInternal(this.internal);
+    this.announceInternal();
+  }
+  /** Whether this browser is marked as internal traffic (reads the mark the first time). */
+  get isInternal() {
+    return this.syncInternal();
+  }
+  /**
+   * Read the mark: the page's `?vio_internal=1|0` (remembered), else what the
+   * browser remembers. Once per page load — `Vio.init()` calls it so a page
+   * with the parameter marks the browser even if it never starts analytics;
+   * `force` reads again.
+   */
+  syncInternal(force = false) {
+    if (this.internal === null || force) {
+      this.internal = hasDom() ? resolveInternal() : readInternal(null);
+      this.announceInternal();
+    }
+    return this.internal;
+  }
+  /** One console line when marked, so a tester can see the mark took. */
+  announceInternal() {
+    if (!this.internal || this.internalAnnounced) return;
+    this.internalAnnounced = true;
+    try {
+      console.info("[Vio.analytics] this browser is marked as internal traffic (vio_internal=1): its events are not counted. Open any page with ?vio_internal=0 to undo.");
+    } catch {
+    }
+  }
   /** Queue one event. Works pre-init and pre-start (SSR: no-op). */
   track(name, opts = {}) {
     if (!hasDom()) return;
@@ -7335,7 +7733,7 @@ var AnalyticsManager = class extends EventTarget {
               this.ensureSession();
               if (this.impressedComponents.has(key)) return;
               this.impressedComponents.add(key);
-              this.track(name, { context });
+              this.track(name, { context, commerce: impressionCommerce(opts.commerce) });
               opts.onImpression?.();
               observer.disconnect();
             }, IMPRESSION_DWELL_MS);
@@ -7416,26 +7814,28 @@ var AnalyticsManager = class extends EventTarget {
       // one is usually the tracking tail, not the page. The other host-given
       // fields (broadcastId, componentTemplateId, errorCode, variant, …) are
       // the host's responsibility: the SDK does not touch them.
-      content_url: capContentUrl(ctx.contentUrl ?? (typeof location !== "undefined" ? location.href : void 0)),
+      // Con `privateContent` ninguno de los tres sale del dispositivo.
+      content_url: this.options.privateContent ? void 0 : capContentUrl(ctx.contentUrl ?? (typeof location !== "undefined" ? location.href : void 0)),
       // The host's own content id — its join key back onto its reporting.
       // Explicit on the event when it fits, else what the SDK resolved for
       // the page (already capped per source), else nothing.
-      content_id: explicitContentId ?? fitsId(content.id),
+      content_id: this.options.privateContent ? void 0 : explicitContentId ?? fitsId(content.id),
       // Deletion-proof reporting: sources have no trash bin — the title
       // snapshotted at event time keeps reports legible if content dies.
       error_code: ctx.errorCode,
-      content_title: capTitle(
+      content_title: this.options.privateContent ? void 0 : capTitle(
         ctx.contentTitle ?? content.title ?? (typeof document !== "undefined" && document.title ? document.title : void 0)
       ),
       variant: ctx.variant
     });
     const com = opts.commerce;
     const commerce = com ? compact({
-      items: com.items?.map(
+      // The collector rejects an event with more lines than its cap, whole.
+      items: com.items?.slice(0, MAX_ITEMS).map(
         (i) => compact({
           product_id: String(i.productId),
-          name: i.name,
-          brand: i.brand,
+          name: this.options.privateContent ? void 0 : i.name,
+          brand: this.options.privateContent ? void 0 : i.brand,
           variant_id: i.variantId !== void 0 ? String(i.variantId) : void 0,
           price: i.price,
           quantity: i.quantity
@@ -7452,7 +7852,8 @@ var AnalyticsManager = class extends EventTarget {
       // ids does not carry a stable identifier of a person either.
       buyer_id: this.canPersist ? normalizeBuyerRef(com.buyerId) : void 0
     }) : void 0;
-    const client = this.clientBlock();
+    const base = this.clientBlock();
+    const client = this.syncInternal() ? { ...base ?? {}, internal: true } : base;
     return {
       event_id: uuid(),
       name,
@@ -7981,6 +8382,15 @@ function safeStorageSet(key, value) {
   } catch {
   }
 }
+function impressionCommerce(read) {
+  if (!read) return void 0;
+  try {
+    const commerce = read();
+    return commerce?.items?.length ? commerce : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function compact(obj) {
   const out = {};
   for (const [k, v] of Object.entries(obj)) {
@@ -8314,6 +8724,10 @@ var VioFacade = class {
     this.surfaceMode = null;
     this.surfaceRequest = null;
     this.preloadPrivacyMode();
+    try {
+      this.analytics.syncInternal(true);
+    } catch {
+    }
     this.checkoutManager?.clearPaymentMethodsCache();
     if (this.slotDeclareTimer) {
       clearTimeout(this.slotDeclareTimer);
@@ -8505,9 +8919,9 @@ var VioFacade = class {
       for (const l of all) {
         if (l.campaignId !== void 0 && l.campaignId === pageCampaignId) delete l.campaignId;
       }
-      const memory = readSlotDeclaration(storageKey);
+      const memory2 = readSlotDeclaration(storageKey);
       const keyOf = (l) => slotDeclarationKey(l, pageCampaignId);
-      const pending2 = new Set(pendingSlotKeys(memory, all.map(keyOf), now));
+      const pending2 = new Set(pendingSlotKeys(memory2, all.map(keyOf), now));
       let locations = opts.force ? all : all.filter((l) => pending2.has(keyOf(l)));
       if (locations.length === 0) return null;
       if (locations.length > MAX_LOCATIONS_PER_DECLARATION) {
@@ -8540,11 +8954,11 @@ var VioFacade = class {
       if (result?.mode === "merge") {
         const unhandled = this.campaignNotTakenUp(result, locations, pageCampaignId);
         const settled = keys.filter((k) => !unhandled.has(k));
-        let next = rememberSlotKeys(memory, settled, now);
+        let next = rememberSlotKeys(memory2, settled, now);
         if (unhandled.size > 0) next = rememberSlotKeys(next, [...unhandled], failedAt(now));
         writeSlotDeclaration(storageKey, next);
       } else {
-        writeSlotDeclaration(storageKey, rememberSlotKeys(memory, keys, failedAt(now)));
+        writeSlotDeclaration(storageKey, rememberSlotKeys(memory2, keys, failedAt(now)));
         warn(
           "slots declared but the server ignored mode=merge (old server); not caching, will retry next load"
         );
@@ -8994,6 +9408,6 @@ function vippsButtonAttributes(verb = "buy", opts = {}) {
   };
 }
 
-export { ADD_ITEM_MUTATION, ADYEN_RETURN_METHOD, ADYEN_RETURN_QUERY_KEYS, AdyenOriginError, AnalyticsManager, BUYER_REF_MAX_LENGTH, CHECKOUT_ATTRIBUTION_CAPS, CHECKOUT_SPONSOR_STORAGE_KEY, CLIENT_LANDING_URL_MAX_LENGTH, CONTENT_URL_MAX_LENGTH, CREATE_CART_MUTATION, CREATE_CHECKOUT_MUTATION, CREATE_CHECKOUT_WITH_ATTRIBUTION_MUTATION, CREATE_PAYMENT_STRIPE_MUTATION, CREATE_PAYMENT_VIPPS_MUTATION, CartManager, CheckoutManager, CommerceClient, Configuration, DELETE_ITEM_MUTATION, GET_AVAILABLE_PAYMENT_METHODS_QUERY, GET_CART_QUERY, GET_CHECKOUT_QUERY, GET_LINE_ITEMS_BY_SUPPLIER_QUERY, GET_VIPPS_STATUS_QUERY, GRAPHQL_INT_MAX, KUSTOM_RETURN_QUERY_KEYS, LINE_ORIGIN_CAPS, SDK_VERSION, UPDATE_CHECKOUT_MUTATION, UPDATE_CHECKOUT_WITH_ATTRIBUTION_MUTATION, UPDATE_ITEM_MUTATION, UPDATE_ITEM_WITH_ORIGIN_MUTATION, UPDATE_SHIPPINGS_BY_SUPPLIER_MUTATION, VIPPS_BUTTON_SCRIPT, VIPPS_BUTTON_TAG, Vio, VioApi, VioApiError, __decorateClass, activeCampaignEntry, addItem, adyenReturnOutcome, adyenReturnParams, autoSlotDisplayName, autoSlotId, buyerRefOf, campaignCandidates, capContentUrl, cartSlicesFrom, checkApplePayAvailability, checkoutAttributionOf, checkoutSponsorOf, componentKindOf, createCart, createCheckout, createCommerceClient, createPaymentStripe, createPaymentVipps, createVioApi, deleteItem, displayPrice, dominantCampaignOf, ensureVippsButton, entryContextOf, executeCartGraphQL, formatPrice, gatewayHas, gatewayHasBuyerRef, getAvailablePaymentMethods, getCart, getCartGraphQLOptions, getCheckout, getCheckoutReference, getCustomerSessionId, getGlobalCurrency, getLineItemsBySupplier, getVippsStatus, isUnknownFeatureError, isUnknownTokenError, kustomReturnOutcome, landingUrl, lineOriginWire, lineOrigins, nexiReturnPaymentId, normalizeBuyerRef, normalizeOrigin, normalizeScope, normalizeSlotId, normalizeSlotKind, originAndPath, primaryImageUrl, purchaseFromPaymentSuccess, purchaseIdsOf, readNexiPending, rememberedCheckoutSponsor, resetGatewayFeatures, resolveCampaignId, resolveClientContext, resolveContent, resolveLanding, resolveSlotCampaign, sameOrigin, showApplePaySheet, sponsorCampaignEntry, sponsorIdentityFrom, storedLanding, toCampaignId, updateCheckout, updateItem, updateShippingsBySupplier, vippsButtonAttributes, withGatewayFeature };
-//# sourceMappingURL=chunk-AG4G2S2M.js.map
-//# sourceMappingURL=chunk-AG4G2S2M.js.map
+export { ADD_ITEM_MUTATION, ADYEN_RETURN_METHOD, ADYEN_RETURN_QUERY_KEYS, AdyenOriginError, AnalyticsManager, BUYER_REF_MAX_LENGTH, CHECKOUT_ATTRIBUTION_CAPS, CHECKOUT_SPONSOR_STORAGE_KEY, CLIENT_LANDING_URL_MAX_LENGTH, CONTENT_URL_MAX_LENGTH, CREATE_CART_MUTATION, CREATE_CHECKOUT_MUTATION, CREATE_CHECKOUT_WITH_ATTRIBUTION_MUTATION, CREATE_PAYMENT_STRIPE_MUTATION, CREATE_PAYMENT_VIPPS_MUTATION, CartManager, CheckoutManager, CommerceClient, Configuration, DELETE_ITEM_MUTATION, GET_AVAILABLE_PAYMENT_METHODS_QUERY, GET_CART_QUERY, GET_CHECKOUT_QUERY, GET_LINE_ITEMS_BY_SUPPLIER_QUERY, GET_VIPPS_STATUS_QUERY, GRAPHQL_INT_MAX, INTERNAL_KEY, INTERNAL_PARAM, KUSTOM_RETURN_QUERY_KEYS, LINE_ORIGIN_CAPS, SDK_VERSION, UPDATE_CHECKOUT_MUTATION, UPDATE_CHECKOUT_WITH_ATTRIBUTION_MUTATION, UPDATE_ITEM_MUTATION, UPDATE_ITEM_WITH_ORIGIN_MUTATION, UPDATE_SHIPPINGS_BY_SUPPLIER_MUTATION, VIPPS_BUTTON_SCRIPT, VIPPS_BUTTON_TAG, Vio, VioApi, VioApiError, __decorateClass, activeCampaignEntry, addItem, adyenReturnOutcome, adyenReturnParams, autoSlotDisplayName, autoSlotId, buyerRefOf, campaignCandidates, capContentUrl, cartSlicesFrom, checkApplePayAvailability, checkoutAttributionOf, checkoutSponsorOf, componentKindOf, createCart, createCheckout, createCommerceClient, createPaymentStripe, createPaymentVipps, createVioApi, deleteItem, displayPrice, dominantCampaignOf, ensureVippsButton, entryContextOf, executeCartGraphQL, formatPrice, gatewayHas, gatewayHasBuyerRef, getAvailablePaymentMethods, getCart, getCartGraphQLOptions, getCheckout, getCheckoutReference, getCustomerSessionId, getGlobalCountryCode, getGlobalCurrency, getLineItemsBySupplier, getVippsStatus, isUnknownFeatureError, isUnknownTokenError, isValidPhone, kustomReturnOutcome, landingUrl, lineOriginWire, lineOrigins, nexiReturnPaymentId, normalizeBuyerRef, normalizeOrigin, normalizeScope, normalizeSlotId, normalizeSlotKind, originAndPath, primaryImageUrl, purchaseFromPaymentSuccess, purchaseIdsOf, readInternal, readNexiPending, rememberedCheckoutSponsor, resetGatewayFeatures, resolveCampaignId, resolveClientContext, resolveContent, resolveInternal, resolveLanding, resolveSlotCampaign, sameOrigin, showApplePaySheet, sponsorCampaignEntry, sponsorIdentityFrom, storageGet, storedLanding, toCampaignId, updateCheckout, updateItem, updateShippingsBySupplier, vippsButtonAttributes, withGatewayFeature, writeInternal };
+//# sourceMappingURL=chunk-IR4XYTZL.js.map
+//# sourceMappingURL=chunk-IR4XYTZL.js.map