@xenia-martech/sdk-js 1.0.0-dev.25 → 1.0.0-dev.26

package/dist/{cookie-names-BQ-L04A8.d.cts → cookie-names-LgNDAreS.d.cts}

@@ -46,15 +46,16 @@ interface RetryConfig {
 /**
  * Root configuration shared by client and server runtimes.
  *
- * Developers supply the minimum: `baseUrl` + tenant scope. Everything else
- * (identity, UTM, journey attribution, device id) is handled by the SDK.
+ * Developers supply the minimum: tenant scope. Everything else (identity,
+ * UTM, journey attribution, device id) is handled by the SDK.
  */
 interface XeniaConfig {
     /**
-     * Base URL of the Xenia backend, e.g. `https://app.example.com/xenia` or
-     * `/xenia` when same-origin (the FE proxies `/xenia/*`). No trailing slash.
+     * Base URL of the Xenia backend. Defaults to the hosted engine,
+     * `https://engine.xeniamartech.com/xenia` — omit this unless you're
+     * pointing at a self-hosted or non-default environment.
      */
-    baseUrl: string;
+    baseUrl?: string;
     /** Tenant id — sent as `X-Tenant-Id` on header-scoped endpoints. */
     tenantId: string;
     /** Environment key — sent as `X-Environment` on header-scoped endpoints. */
@@ -389,7 +390,8 @@ type XeniaAction = {
 /**
  * Low-level, isomorphic Xenia API client. Wraps the raw endpoints; identity,
  * UTM capture, and action rendering are layered on top by the client runtime.
- * All paths are relative to `baseUrl` (which already includes `/xenia`).
+ * All paths are relative to `baseUrl`, which defaults to the hosted engine
+ * (`https://engine.xeniamartech.com/xenia`) when omitted from config.
  */
 declare class XeniaApi {
     private readonly http;

package/dist/{cookie-names-BQ-L04A8.d.ts → cookie-names-LgNDAreS.d.ts}

@@ -46,15 +46,16 @@ interface RetryConfig {
 /**
  * Root configuration shared by client and server runtimes.
  *
- * Developers supply the minimum: `baseUrl` + tenant scope. Everything else
- * (identity, UTM, journey attribution, device id) is handled by the SDK.
+ * Developers supply the minimum: tenant scope. Everything else (identity,
+ * UTM, journey attribution, device id) is handled by the SDK.
  */
 interface XeniaConfig {
     /**
-     * Base URL of the Xenia backend, e.g. `https://app.example.com/xenia` or
-     * `/xenia` when same-origin (the FE proxies `/xenia/*`). No trailing slash.
+     * Base URL of the Xenia backend. Defaults to the hosted engine,
+     * `https://engine.xeniamartech.com/xenia` — omit this unless you're
+     * pointing at a self-hosted or non-default environment.
      */
-    baseUrl: string;
+    baseUrl?: string;
     /** Tenant id — sent as `X-Tenant-Id` on header-scoped endpoints. */
     tenantId: string;
     /** Environment key — sent as `X-Environment` on header-scoped endpoints. */
@@ -389,7 +390,8 @@ type XeniaAction = {
 /**
  * Low-level, isomorphic Xenia API client. Wraps the raw endpoints; identity,
  * UTM capture, and action rendering are layered on top by the client runtime.
- * All paths are relative to `baseUrl` (which already includes `/xenia`).
+ * All paths are relative to `baseUrl`, which defaults to the hosted engine
+ * (`https://engine.xeniamartech.com/xenia`) when omitted from config.
  */
 declare class XeniaApi {
     private readonly http;

package/dist/index.cjs

@@ -1,80 +1,80 @@
 'use strict';
 
-var chunkJEFNAD5J_cjs = require('./chunk-JEFNAD5J.cjs');
+var chunk3KYKKIIG_cjs = require('./chunk-3KYKKIIG.cjs');
 
 
 
 Object.defineProperty(exports, "CONSENT_COOKIE", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.CONSENT_COOKIE; }
+  get: function () { return chunk3KYKKIIG_cjs.CONSENT_COOKIE; }
 });
 Object.defineProperty(exports, "DEFAULT_PREFIX", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.DEFAULT_PREFIX; }
+  get: function () { return chunk3KYKKIIG_cjs.DEFAULT_PREFIX; }
 });
 Object.defineProperty(exports, "HttpClient", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.HttpClient; }
+  get: function () { return chunk3KYKKIIG_cjs.HttpClient; }
 });
 Object.defineProperty(exports, "HttpError", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.HttpError; }
+  get: function () { return chunk3KYKKIIG_cjs.HttpError; }
 });
 Object.defineProperty(exports, "LocalStorageResponseStore", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.LocalStorageResponseStore; }
+  get: function () { return chunk3KYKKIIG_cjs.LocalStorageResponseStore; }
 });
 Object.defineProperty(exports, "MAX_EVENT_ID_LENGTH", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.MAX_EVENT_ID_LENGTH; }
+  get: function () { return chunk3KYKKIIG_cjs.MAX_EVENT_ID_LENGTH; }
 });
 Object.defineProperty(exports, "MemoryResponseStore", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.MemoryResponseStore; }
+  get: function () { return chunk3KYKKIIG_cjs.MemoryResponseStore; }
 });
 Object.defineProperty(exports, "VISITOR_COOKIE", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.VISITOR_COOKIE; }
+  get: function () { return chunk3KYKKIIG_cjs.VISITOR_COOKIE; }
 });
 Object.defineProperty(exports, "XeniaApi", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.XeniaApi; }
+  get: function () { return chunk3KYKKIIG_cjs.XeniaApi; }
 });
 Object.defineProperty(exports, "buildUrl", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.buildUrl; }
+  get: function () { return chunk3KYKKIIG_cjs.buildUrl; }
 });
 Object.defineProperty(exports, "consentCookieName", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.consentCookieName; }
+  get: function () { return chunk3KYKKIIG_cjs.consentCookieName; }
 });
 Object.defineProperty(exports, "extractContentSwaps", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.extractContentSwaps; }
+  get: function () { return chunk3KYKKIIG_cjs.extractContentSwaps; }
 });
 Object.defineProperty(exports, "generateUlid", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.generateUlid; }
+  get: function () { return chunk3KYKKIIG_cjs.generateUlid; }
 });
 Object.defineProperty(exports, "isBrowser", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.isBrowser; }
+  get: function () { return chunk3KYKKIIG_cjs.isBrowser; }
 });
 Object.defineProperty(exports, "parseActions", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.parseActions; }
+  get: function () { return chunk3KYKKIIG_cjs.parseActions; }
 });
 Object.defineProperty(exports, "spliceSlots", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.spliceSlots; }
+  get: function () { return chunk3KYKKIIG_cjs.spliceSlots; }
 });
 Object.defineProperty(exports, "toEventId", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.toEventId; }
+  get: function () { return chunk3KYKKIIG_cjs.toEventId; }
 });
 Object.defineProperty(exports, "visitorCookieName", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.visitorCookieName; }
+  get: function () { return chunk3KYKKIIG_cjs.visitorCookieName; }
 });
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { R as RetryConfig, H as HttpMethod, J as JsonValue, W as WebhookResponse } from './cookie-names-BQ-L04A8.cjs';
-export { A as AnalyticsContext, a as AnalyticsEventName, b as AnalyticsIdentity, c as AnalyticsIngestResponse, C as CONSENT_COOKIE, d as ConsentState, D as DEFAULT_PREFIX, E as EventContext, e as EventIdentity, I as IdentifyRequest, f as IdentifyResponse, g as InteractionType, h as JsonObject, M as MessageCta, i as MessagePlacement, P as PersonalizationSwap, j as ResolveBatchItem, k as ResolveBatchResult, l as ResolveOptions, m as ResolveResult, T as TrackOptions, V as VISITOR_COOKIE, X as XeniaAction, n as XeniaApi, o as XeniaConfig, p as XeniaEvent, q as consentCookieName, r as parseActions, v as visitorCookieName } from './cookie-names-BQ-L04A8.cjs';
+import { R as RetryConfig, H as HttpMethod, J as JsonValue, W as WebhookResponse } from './cookie-names-LgNDAreS.cjs';
+export { A as AnalyticsContext, a as AnalyticsEventName, b as AnalyticsIdentity, c as AnalyticsIngestResponse, C as CONSENT_COOKIE, d as ConsentState, D as DEFAULT_PREFIX, E as EventContext, e as EventIdentity, I as IdentifyRequest, f as IdentifyResponse, g as InteractionType, h as JsonObject, M as MessageCta, i as MessagePlacement, P as PersonalizationSwap, j as ResolveBatchItem, k as ResolveBatchResult, l as ResolveOptions, m as ResolveResult, T as TrackOptions, V as VISITOR_COOKIE, X as XeniaAction, n as XeniaApi, o as XeniaConfig, p as XeniaEvent, q as consentCookieName, r as parseActions, v as visitorCookieName } from './cookie-names-LgNDAreS.cjs';
 
 /** Returns true when running in a browser environment (SSR-safe). */
 declare function isBrowser(): boolean;
@@ -38,7 +38,8 @@ declare class HttpError extends Error {
     constructor(status: number, data: JsonValue, message?: string);
 }
 interface HttpClientOptions {
-    baseUrl: string;
+    /** Defaults to {@link DEFAULT_BASE_URL} when omitted. */
+    baseUrl?: string;
     defaultHeaders?: Record<string, string>;
     timeout?: number;
     retry?: RetryConfig;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { R as RetryConfig, H as HttpMethod, J as JsonValue, W as WebhookResponse } from './cookie-names-BQ-L04A8.js';
-export { A as AnalyticsContext, a as AnalyticsEventName, b as AnalyticsIdentity, c as AnalyticsIngestResponse, C as CONSENT_COOKIE, d as ConsentState, D as DEFAULT_PREFIX, E as EventContext, e as EventIdentity, I as IdentifyRequest, f as IdentifyResponse, g as InteractionType, h as JsonObject, M as MessageCta, i as MessagePlacement, P as PersonalizationSwap, j as ResolveBatchItem, k as ResolveBatchResult, l as ResolveOptions, m as ResolveResult, T as TrackOptions, V as VISITOR_COOKIE, X as XeniaAction, n as XeniaApi, o as XeniaConfig, p as XeniaEvent, q as consentCookieName, r as parseActions, v as visitorCookieName } from './cookie-names-BQ-L04A8.js';
+import { R as RetryConfig, H as HttpMethod, J as JsonValue, W as WebhookResponse } from './cookie-names-LgNDAreS.js';
+export { A as AnalyticsContext, a as AnalyticsEventName, b as AnalyticsIdentity, c as AnalyticsIngestResponse, C as CONSENT_COOKIE, d as ConsentState, D as DEFAULT_PREFIX, E as EventContext, e as EventIdentity, I as IdentifyRequest, f as IdentifyResponse, g as InteractionType, h as JsonObject, M as MessageCta, i as MessagePlacement, P as PersonalizationSwap, j as ResolveBatchItem, k as ResolveBatchResult, l as ResolveOptions, m as ResolveResult, T as TrackOptions, V as VISITOR_COOKIE, X as XeniaAction, n as XeniaApi, o as XeniaConfig, p as XeniaEvent, q as consentCookieName, r as parseActions, v as visitorCookieName } from './cookie-names-LgNDAreS.js';
 
 /** Returns true when running in a browser environment (SSR-safe). */
 declare function isBrowser(): boolean;
@@ -38,7 +38,8 @@ declare class HttpError extends Error {
     constructor(status: number, data: JsonValue, message?: string);
 }
 interface HttpClientOptions {
-    baseUrl: string;
+    /** Defaults to {@link DEFAULT_BASE_URL} when omitted. */
+    baseUrl?: string;
     defaultHeaders?: Record<string, string>;
     timeout?: number;
     retry?: RetryConfig;

package/dist/index.js

@@ -1,3 +1,3 @@
-export { CONSENT_COOKIE, DEFAULT_PREFIX, HttpClient, HttpError, LocalStorageResponseStore, MAX_EVENT_ID_LENGTH, MemoryResponseStore, VISITOR_COOKIE, XeniaApi, buildUrl, consentCookieName, extractContentSwaps, generateUlid, isBrowser, parseActions, spliceSlots, toEventId, visitorCookieName } from './chunk-PTYUK4P3.js';
+export { CONSENT_COOKIE, DEFAULT_PREFIX, HttpClient, HttpError, LocalStorageResponseStore, MAX_EVENT_ID_LENGTH, MemoryResponseStore, VISITOR_COOKIE, XeniaApi, buildUrl, consentCookieName, extractContentSwaps, generateUlid, isBrowser, parseActions, spliceSlots, toEventId, visitorCookieName } from './chunk-D37RD3UC.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/server/index.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkJEFNAD5J_cjs = require('../chunk-JEFNAD5J.cjs');
+var chunk3KYKKIIG_cjs = require('../chunk-3KYKKIIG.cjs');
 
 // src/core/event-payload.ts
 var RESERVED = /* @__PURE__ */ new Set([
@@ -60,7 +60,7 @@ var XeniaServer = class {
   /** SDK-owned visitor anchor for this (per-request) client — see {@link XeniaConfig.visitorId}. */
   visitorId;
   constructor(config) {
-    this.api = new chunkJEFNAD5J_cjs.XeniaApi(config);
+    this.api = new chunk3KYKKIIG_cjs.XeniaApi(config);
     this.visitorId = config.visitorId;
   }
   /**
@@ -72,7 +72,7 @@ var XeniaServer = class {
   async track(eventName, opts = {}) {
     const event = {
       eventName,
-      eventId: opts.eventId ? chunkJEFNAD5J_cjs.toEventId(opts.eventId) : chunkJEFNAD5J_cjs.generateUlid(),
+      eventId: opts.eventId ? chunk3KYKKIIG_cjs.toEventId(opts.eventId) : chunk3KYKKIIG_cjs.generateUlid(),
       eventVersion: opts.eventVersion ?? 1,
       occurredAtMs: opts.occurredAtMs ?? Date.now(),
       source: opts.source ?? "xenia-server-sdk",
@@ -142,7 +142,7 @@ function createXeniaServer(config) {
 
 // src/server/token.ts
 async function refreshSdkToken(opts) {
-  const http = new chunkJEFNAD5J_cjs.HttpClient({ baseUrl: opts.baseUrl, timeout: opts.timeout });
+  const http = new chunk3KYKKIIG_cjs.HttpClient({ baseUrl: opts.baseUrl, timeout: opts.timeout });
   const { data } = await http.request({
     method: "POST",
     path: "/api/personalization/token/refresh",
@@ -187,10 +187,10 @@ function parseCookies(header) {
   return out;
 }
 function getVisitorId(cookieHeader, prefix) {
-  return parseCookies(cookieHeader)[chunkJEFNAD5J_cjs.visitorCookieName(prefix)] ?? null;
+  return parseCookies(cookieHeader)[chunk3KYKKIIG_cjs.visitorCookieName(prefix)] ?? null;
 }
 function getConsent(cookieHeader, prefix) {
-  const raw = parseCookies(cookieHeader)[chunkJEFNAD5J_cjs.consentCookieName(prefix)];
+  const raw = parseCookies(cookieHeader)[chunk3KYKKIIG_cjs.consentCookieName(prefix)];
   if (!raw) return { analytics: false, marketing: false, personalization: false };
   try {
     const parsed = JSON.parse(raw);
@@ -207,27 +207,27 @@ function getConsent(cookieHeader, prefix) {
 
 Object.defineProperty(exports, "CONSENT_COOKIE", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.CONSENT_COOKIE; }
+  get: function () { return chunk3KYKKIIG_cjs.CONSENT_COOKIE; }
 });
 Object.defineProperty(exports, "VISITOR_COOKIE", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.VISITOR_COOKIE; }
+  get: function () { return chunk3KYKKIIG_cjs.VISITOR_COOKIE; }
 });
 Object.defineProperty(exports, "XeniaApi", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.XeniaApi; }
+  get: function () { return chunk3KYKKIIG_cjs.XeniaApi; }
 });
 Object.defineProperty(exports, "consentCookieName", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.consentCookieName; }
+  get: function () { return chunk3KYKKIIG_cjs.consentCookieName; }
 });
 Object.defineProperty(exports, "parseActions", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.parseActions; }
+  get: function () { return chunk3KYKKIIG_cjs.parseActions; }
 });
 Object.defineProperty(exports, "visitorCookieName", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.visitorCookieName; }
+  get: function () { return chunk3KYKKIIG_cjs.visitorCookieName; }
 });
 exports.XeniaServer = XeniaServer;
 exports.createTokenRoute = createTokenRoute;

package/dist/server/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/event-payload.ts","../../src/server/xenia-server.ts","../../src/server/token.ts","../../src/server/cookies.ts"],"names":["XeniaApi","toEventId","generateUlid","HttpClient","visitorCookieName","consentCookieName"],"mappings":";;;;;AAGA,IAAM,QAAA,uBAAe,GAAA,CAAI;AAAA,EACvB,SAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,aAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAC,CAAA;AAaD,SAAS,QAAQ,GAAA,EAAuE;AACtF,EAAA,MAAM,MAAiC,EAAC;AACxC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AACxC,IAAA,IAAI,CAAA,KAAM,MAAA,EAAW,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EAChC;AACA,EAAA,OAAO,GAAA;AACT;AAWO,SAAS,kBAAkB,KAAA,EAAsC;AACtE,EAAA,MAAM,cAAyC,EAAC;AAChD,EAAA,MAAM,WAAsC,EAAC;AAC7C,EAAA,IAAI,MAAM,KAAA,EAAO;AACf,IAAA,KAAA,MAAW,CAAC,GAAG,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,KAAK,CAAA,EAAG;AAChD,MAAA,IAAI,MAAM,MAAA,EAAW;AAKrB,MAAA,IAAI,SAAS,GAAA,CAAI,CAAC,CAAA,EAAG,QAAA,CAAS,CAAC,CAAA,GAAI,CAAA;AAAA,WAC9B,WAAA,CAAY,CAAC,CAAA,GAAI,CAAA;AAAA,IACxB;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,GAAG,WAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAKH,GAAG,QAAA;AAAA,IACH,GAAG,OAAA,CAAS,KAAA,CAAM,OAAA,IAAW,EAA4C,CAAA;AAAA,IACzE,GAAG,OAAA,CAAS,KAAA,CAAM,QAAA,IAAY,EAA4C,CAAA;AAAA,IAC1E,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,GAAI,MAAM,SAAA,GAAY,EAAE,WAAW,KAAA,CAAM,SAAA,KAAc,EAAC;AAAA,IACxD,GAAI,MAAM,SAAA,GAAY,EAAE,WAAW,KAAA,CAAM,SAAA,KAAc;AAAC,GAC1D;AAEA,EAAA,OAAO,OAAA;AACT;;;ACfO,IAAM,cAAN,MAAkB;AAAA,EACd,GAAA;AAAA;AAAA,EAEQ,SAAA;AAAA,EAEjB,YAAY,MAAA,EAAqB;AAC/B,IAAA,IAAA,CAAK,GAAA,GAAM,IAAIA,0BAAA,CAAS,MAAM,CAAA;AAC9B,IAAA,IAAA,CAAK,YAAY,MAAA,CAAO,SAAA;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,CACJ,SAAA,EACA,IAAA,GAA2B,EAAC,EACM;AAClC,IAAA,MAAM,KAAA,GAAoB;AAAA,MACxB,SAAA;AAAA,MACA,SAAS,IAAA,CAAK,OAAA,GAAUC,4BAAU,IAAA,CAAK,OAAO,IAAIC,8BAAA,EAAa;AAAA,MAC/D,YAAA,EAAc,KAAK,YAAA,IAAgB,CAAA;AAAA,MACnC,YAAA,EAAc,IAAA,CAAK,YAAA,IAAgB,IAAA,CAAK,GAAA,EAAI;AAAA,MAC5C,MAAA,EAAQ,KAAK,MAAA,IAAU,kBAAA;AAAA,MACvB,QAAA,EAAU;AAAA,QACR,GAAG,IAAA,CAAK,QAAA;AAAA;AAAA;AAAA,QAGR,gBAAgB,IAAA,CAAK;AAAA,OACvB;AAAA,MACA,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,OAAA,EAAS,IAAA,CAAK,OAAA,KAAY,IAAA,GAAO,IAAA,GAAO;AAAA,KAC1C;AACA,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,UAAA,CAAW,CAAC,KAAK,CAAC,CAAA;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAA,CACJ,SAAA,EACA,IAAA,EACA,IAAA,GAA6B,EAAC,EACJ;AAC1B,IAAA,MAAM,UAAU,iBAAA,CAAkB;AAAA,MAChC,OAAA,EAAS,SAAA;AAAA,MACT,WAAW,IAAA,CAAK,SAAA;AAAA;AAAA;AAAA;AAAA,MAIhB,QAAA,EAAU,EAAE,GAAG,IAAA,CAAK,QAAA,EAAU,WAAW,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,QAAA,EAAU,SAAA,EAAU;AAAA,MACpF,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,KAAA,EAAO;AAAA,KACR,CAAA;AACD,IAAA,OAAO,KAAK,GAAA,CAAI,OAAA,CAAQ,WAAW,OAAA,EAAsB,IAAA,CAAK,UAAU,MAAM,CAAA;AAAA,EAChF;AAAA;AAAA,EAGA,MAAM,SAAS,IAAA,EAAkD;AAC/D,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,QAAA,CAAS,IAAI,CAAA;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAA,CAAQ,UAAA,EAAoB,IAAA,EAA+C;AAC/E,IAAA,OAAO,KAAK,GAAA,CAAI,OAAA,CAAQ,YAAY,IAAA,CAAK,WAAA,CAAY,IAAI,CAAC,CAAA;AAAA,EAC5D;AAAA;AAAA,EAGA,MAAM,YAAA,CACJ,KAAA,EACA,IAAA,EAC+B;AAC/B,IAAA,OAAO,KAAK,GAAA,CAAI,YAAA,CAAa,OAAO,IAAA,CAAK,WAAA,CAAY,IAAI,CAAC,CAAA;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,YAAY,IAAA,EAAmD;AACrE,IAAA,IAAI,CAAC,IAAA,CAAK,SAAA,EAAW,OAAO,IAAA;AAC5B,IAAA,OAAO,EAAE,GAAG,IAAA,EAAM,IAAA,EAAM,EAAE,GAAI,IAAA,EAAM,IAAA,IAAQ,EAAC,EAAI,UAAA,EAAY,IAAA,CAAK,WAAU,EAAE;AAAA,EAChF;AACF;AAGO,SAAS,kBAAkB,MAAA,EAAkC;AAClE,EAAA,OAAO,IAAI,YAAY,MAAM,CAAA;AAC/B;;;AC1IA,eAAsB,gBAAgB,IAAA,EAAoD;AACxF,EAAA,MAAM,IAAA,GAAO,IAAIC,4BAAA,CAAW,EAAE,OAAA,EAAS,KAAK,OAAA,EAAS,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,CAAA;AAC5E,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,KAAK,OAAA,CAAQ;AAAA,IAClC,MAAA,EAAQ,MAAA;AAAA,IACR,IAAA,EAAM,oCAAA;AAAA,IACN,SAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,QAAQ,CAAA,CAAA,EAAG;AAAA,IACpD,IAAA,EAAM,EAAE,UAAA,EAAY,IAAA,CAAK,cAAc,IAAA;AAAK,GAC7C,CAAA;AACD,EAAA,MAAM,GAAA,GAAO,QAAQ,EAAC;AACtB,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,KAAA,IAAS,EAAE,CAAA;AAAA,IAC7B,WAAW,OAAO,GAAA,CAAI,SAAA,KAAc,QAAA,GAAW,IAAI,SAAA,GAAY;AAAA,GACjE;AACF;AAiBO,SAAS,iBAAiB,MAAA,EAAsE;AACrG,EAAA,OAAO,YAA+B;AACpC,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAY,MAAM,eAAA,CAAgB,MAAM,CAAA;AAC9C,MAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,SAAS,CAAA,EAAG;AAAA,QAC7C,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,iBAAiB,UAAA;AAAW,OAC5E,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,sBAAA;AACrD,MAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG;AAAA,QACtD,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,OAC/C,CAAA;AAAA,IACH;AAAA,EACF,CAAA;AACF;;;ACtDO,SAAS,aAAa,MAAA,EAA2D;AACtF,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,IAAI,CAAC,QAAQ,OAAO,GAAA;AACpB,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAAG;AACpC,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC5B,IAAA,IAAI,QAAQ,EAAA,EAAI;AAChB,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,EAAE,IAAA,EAAK;AACpC,IAAA,MAAM,QAAQ,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AACvC,IAAA,IAAI,GAAA,EAAK,GAAA,CAAI,GAAG,CAAA,GAAI,mBAAmB,KAAK,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,GAAA;AACT;AASO,SAAS,YAAA,CACd,cACA,MAAA,EACe;AACf,EAAA,OAAO,aAAa,YAAY,CAAA,CAAEC,mCAAA,CAAkB,MAAM,CAAC,CAAA,IAAK,IAAA;AAClE;AAQO,SAAS,UAAA,CACd,cACA,MAAA,EACc;AACd,EAAA,MAAM,MAAM,YAAA,CAAa,YAAY,CAAA,CAAEC,mCAAA,CAAkB,MAAM,CAAC,CAAA;AAChE,EAAA,IAAI,CAAC,KAAK,OAAO,EAAE,WAAW,KAAA,EAAO,SAAA,EAAW,KAAA,EAAO,eAAA,EAAiB,KAAA,EAAM;AAC9E,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AAC1D,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,WAAW,CAAA;AAAA,MACjC,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,WAAW,CAAA;AAAA,MACjC,eAAA,EAAiB,MAAA,CAAO,GAAA,CAAI,iBAAiB;AAAA,KAC/C;AAAA,EACF;AACF","file":"index.cjs","sourcesContent":["import type { EventContext, EventIdentity, EventPayload, JsonValue } from \"./types\";\n\n/** Reserved keys that map to first-class fields (not passthrough data). */\nconst RESERVED = new Set([\n  \"eventId\",\n  \"eventType\",\n  \"journeyId\",\n  \"deviceId\",\n  \"visitorId\",\n  \"customerId\",\n  \"email\",\n  \"utmSource\",\n  \"utmMedium\",\n  \"utmCampaign\",\n  \"utmContent\",\n  \"utmId\",\n  \"url\",\n  \"referrer\",\n  \"path\",\n  \"query\",\n]);\n\nexport interface BuildEventInput {\n  eventId: string;\n  eventType?: string;\n  journeyId?: string;\n  identity?: EventIdentity;\n  context?: EventContext;\n  /** Arbitrary extra properties merged as passthrough data. */\n  props?: Record<string, JsonValue | undefined>;\n}\n\n/** Drop `undefined` values so the JSON body stays clean. */\nfunction compact(obj: Record<string, JsonValue | undefined>): Record<string, JsonValue> {\n  const out: Record<string, JsonValue> = {};\n  for (const [k, v] of Object.entries(obj)) {\n    if (v !== undefined) out[k] = v;\n  }\n  return out;\n}\n\n/**\n * Build the request body for the webhook `/flow` call (`XeniaApi.webhook`).\n *\n * Merge order (later wins): passthrough props < context < identity < core.\n * Field names match the backend `EventTriggerRequest` DTO exactly.\n *\n * @internal Used only by the webhook request/response path — the unified event\n * surface (`track()` → `POST /api/events/v1`) builds {@link XeniaEvent} instead.\n */\nexport function buildEventPayload(input: BuildEventInput): EventPayload {\n  const passthrough: Record<string, JsonValue> = {};\n  const reserved: Record<string, JsonValue> = {};\n  if (input.props) {\n    for (const [k, v] of Object.entries(input.props)) {\n      if (v === undefined) continue;\n      // A prop whose key matches a reserved field (e.g. `email`, `customerId`,\n      // `utmSource`) is promoted to that first-class field; everything else is\n      // custom passthrough data. Previously reserved-named props were dropped\n      // outright — so `track(\"sign_up\", { email })` never sent `email` at all.\n      if (RESERVED.has(k)) reserved[k] = v;\n      else passthrough[k] = v;\n    }\n  }\n\n  const payload = {\n    ...passthrough,\n    // Reserved-named props fill first-class fields (e.g. `email`, `customerId`)\n    // the SDK didn't auto-collect. Auto-collected context/identity still win for\n    // what they reliably know (real page url, visitor/device id), so a stray prop\n    // can't override the true page context — see merge order below.\n    ...reserved,\n    ...compact((input.context ?? {}) as Record<string, JsonValue | undefined>),\n    ...compact((input.identity ?? {}) as Record<string, JsonValue | undefined>),\n    eventId: input.eventId,\n    ...(input.eventType ? { eventType: input.eventType } : {}),\n    ...(input.journeyId ? { journeyId: input.journeyId } : {}),\n  };\n\n  return payload as EventPayload;\n}\n","import { XeniaApi } from \"../core/api\";\nimport { buildEventPayload } from \"../core/event-payload\";\nimport { generateUlid, toEventId } from \"../core/id\";\nimport type {\n  AnalyticsContext,\n  AnalyticsEventName,\n  CallerIdentity,\n  AnalyticsIngestResponse,\n  ConsentState,\n  EventContext,\n  EventIdentity,\n  IdentifyRequest,\n  IdentifyResponse,\n  JsonValue,\n  ResolveBatchItem,\n  ResolveBatchResult,\n  ResolveOptions,\n  ResolveResult,\n  WebhookResponse,\n  XeniaConfig,\n  XeniaEvent,\n} from \"../core/types\";\n\n/**\n * Extra per-call identity/context for server-side webhook calls. There's no\n * ambient `window` on the server to auto-collect `path`/`query`/`url`/UTM\n * params the way the browser client does — pass whatever's known at the call\n * site (e.g. the current request's pathname from Next.js `headers()`/route\n * params) via `context`, and `deviceId`/`visitorId`/etc. via `identity`.\n */\nexport interface ServerWebhookOptions {\n  method?: \"GET\" | \"POST\";\n  journeyId?: string;\n  identity?: EventIdentity;\n  context?: EventContext;\n}\n\n/**\n * Options for a server-side unified event (`POST /api/events/v1`). There's no\n * ambient request context on the server — pass whatever's known at the call\n * site (e.g. pathname/user-agent from the current request, session id from a\n * cookie) via `identity`/`context`.\n */\nexport interface ServerTrackOptions {\n  /** When true, also match/advance a journey (never sampled/shed). Default false. */\n  trigger?: boolean;\n  /** Stable dedup key (e.g. `\"ord-1001\"`) for idempotent conversions. */\n  eventId?: string;\n  eventVersion?: number;\n  occurredAtMs?: number;\n  /** Origin tag. Default `\"xenia-server-sdk\"`. */\n  source?: string;\n  /** Identity fields for this event (except the SDK-owned `xeniaVisitorId`,\n   *  which comes from `config.visitorId` and can't be set per call). */\n  identity?: CallerIdentity;\n  context?: AnalyticsContext;\n  properties?: Record<string, JsonValue | undefined>;\n  consent?: ConsentState;\n}\n\n/**\n * Server-native Xenia client. Same method names as the browser client, but\n * every call is stateless: identity and context are passed explicitly rather\n * than read from the DOM/localStorage. Uses global `fetch` (Node ≥18).\n */\nexport class XeniaServer {\n  readonly api: XeniaApi;\n  /** SDK-owned visitor anchor for this (per-request) client — see {@link XeniaConfig.visitorId}. */\n  private readonly visitorId?: string;\n\n  constructor(config: XeniaConfig) {\n    this.api = new XeniaApi(config);\n    this.visitorId = config.visitorId;\n  }\n\n  /**\n   * Send a unified event server-side (`POST /api/events/v1`) and return the\n   * ingest response (including per-result `triggered`). `opts.trigger: true`\n   * also matches/advances a journey; pass `opts.eventId` (e.g. `\"ord-1001\"`)\n   * as a stable dedup key for idempotent conversions.\n   */\n  async track(\n    eventName: AnalyticsEventName,\n    opts: ServerTrackOptions = {},\n  ): Promise<AnalyticsIngestResponse> {\n    const event: XeniaEvent = {\n      eventName,\n      eventId: opts.eventId ? toEventId(opts.eventId) : generateUlid(),\n      eventVersion: opts.eventVersion ?? 1,\n      occurredAtMs: opts.occurredAtMs ?? Date.now(),\n      source: opts.source ?? \"xenia-server-sdk\",\n      identity: {\n        ...opts.identity,\n        // SDK-owned, set LAST so it can't be overridden per call. Comes from\n        // `config.visitorId` (bind it per request from the `xenia_vid` cookie).\n        xeniaVisitorId: this.visitorId,\n      },\n      context: opts.context,\n      properties: opts.properties,\n      consent: opts.consent,\n      trigger: opts.trigger === true ? true : undefined,\n    };\n    return this.api.sendEvents([event]);\n  }\n\n  /**\n   * Send a webhook request and await the synchronous response. Merges\n   * `opts.identity`/`opts.context` into the payload the same way the browser\n   * client's auto-attached fields do (`path`, `query`, `url`, `referrer`,\n   * `deviceId`, `visitorId`, etc.) — see `ServerWebhookOptions`.\n   */\n  async webhook(\n    triggerId: string,\n    data?: Record<string, JsonValue | undefined>,\n    opts: ServerWebhookOptions = {},\n  ): Promise<WebhookResponse> {\n    const payload = buildEventPayload({\n      eventId: triggerId,\n      journeyId: opts.journeyId,\n      // SDK-owned visitor anchor wins: config.visitorId (bind the `xenia_vid`\n      // cookie per request) is attached automatically. Falls back to a\n      // per-call visitorId only when none is bound.\n      identity: { ...opts.identity, visitorId: this.visitorId ?? opts.identity?.visitorId },\n      context: opts.context,\n      props: data,\n    });\n    return this.api.webhook(triggerId, payload as JsonValue, opts.method ?? \"POST\");\n  }\n\n  /** Bind visitor→user server-side — `POST /api/events/v1/identify`. */\n  async identify(body: IdentifyRequest): Promise<IdentifyResponse> {\n    return this.api.identify(body);\n  }\n\n  /**\n   * Resolve in-entry content personalization for one content key\n   * (`POST /api/personalization/resolve`). Requires a configured SDK token\n   * (`token`/`getToken`) — resolve is auth-required. With `merge: true` the\n   * returned `content` is server-spliced.\n   */\n  async resolve(contentKey: string, opts?: ResolveOptions): Promise<ResolveResult> {\n    return this.api.resolve(contentKey, this.withVisitor(opts));\n  }\n\n  /** Resolve several content keys in one round-trip (`POST /api/personalization/resolve-batch`). */\n  async resolveBatch(\n    items: ResolveBatchItem[],\n    opts?: ResolveOptions,\n  ): Promise<ResolveBatchResult[]> {\n    return this.api.resolveBatch(items, this.withVisitor(opts));\n  }\n\n  /**\n   * Stamp the SDK-owned visitor id (`config.visitorId`) into the resolve `data`\n   * under the reserved `_xenia_vid` key so the backend can bucket holdout\n   * experiments and record exposure per visitor. Set last so a caller can't\n   * override it; a no-op when no `visitorId` was bound on this client.\n   */\n  private withVisitor(opts?: ResolveOptions): ResolveOptions | undefined {\n    if (!this.visitorId) return opts;\n    return { ...opts, data: { ...(opts?.data ?? {}), _xenia_vid: this.visitorId } };\n  }\n}\n\n/** Create a server-native client. */\nexport function createXeniaServer(config: XeniaConfig): XeniaServer {\n  return new XeniaServer(config);\n}\n","import { HttpClient } from \"../core/http-client\";\nimport type { JsonObject } from \"../core/types\";\n\nexport interface RefreshTokenOptions {\n  /** Xenia base URL including `/xenia`. */\n  baseUrl: string;\n  /**\n   * The personalization SDK token created once in the dashboard (API Tokens →\n   * Create token). Stays server-side; the browser never sees it — only the\n   * short-lived token this exchanges it for does.\n   */\n  sdkToken: string;\n  /** Lifetime of the returned token, in minutes. Default 15, capped server-side at 60. */\n  ttlMinutes?: number;\n  timeout?: number;\n}\n\nexport interface RefreshedToken {\n  token: string;\n  expiresAt?: string;\n}\n\n/**\n * Exchange the long-lived personalization SDK token for a short-lived one with\n * the same tenant/env scope, via `POST /api/personalization/token/refresh`.\n * Self-service — no dashboard credential needed, just the SDK token you\n * already have. Call this from your backend and hand the result to the\n * browser (e.g. from a token route the client SDK calls via `getToken`).\n */\nexport async function refreshSdkToken(opts: RefreshTokenOptions): Promise<RefreshedToken> {\n  const http = new HttpClient({ baseUrl: opts.baseUrl, timeout: opts.timeout });\n  const { data } = await http.request({\n    method: \"POST\",\n    path: \"/api/personalization/token/refresh\",\n    headers: { Authorization: `Bearer ${opts.sdkToken}` },\n    body: { ttlMinutes: opts.ttlMinutes ?? null },\n  });\n  const obj = (data ?? {}) as JsonObject;\n  return {\n    token: String(obj.token ?? \"\"),\n    expiresAt: typeof obj.expiresAt === \"string\" ? obj.expiresAt : undefined,\n  };\n}\n\n/**\n * Build a framework-agnostic request handler that hands the browser SDK a\n * personalization token — mount it at the endpoint `getToken` calls. Needs\n * only the SDK token you already created in the dashboard; mints a fresh\n * short-lived token per request so the long-lived one never reaches the\n * browser.\n *\n * @example\n * ```ts\n * export const GET = createTokenRoute({\n *   baseUrl: process.env.XENIA_URL!,\n *   sdkToken: process.env.XENIA_SDK_TOKEN!,\n * });\n * ```\n */\nexport function createTokenRoute(config: RefreshTokenOptions): (request: Request) => Promise<Response> {\n  return async (): Promise<Response> => {\n    try {\n      const refreshed = await refreshSdkToken(config);\n      return new Response(JSON.stringify(refreshed), {\n        status: 200,\n        headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n      });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"token refresh failed\";\n      return new Response(JSON.stringify({ error: message }), {\n        status: 500,\n        headers: { \"Content-Type\": \"application/json\" },\n      });\n    }\n  };\n}\n","import {\n  CONSENT_COOKIE,\n  VISITOR_COOKIE,\n  consentCookieName,\n  visitorCookieName,\n} from \"../core/cookie-names\";\nimport type { ConsentState } from \"../core/types\";\n\n/**\n * Cookie names the SDK reads server-side (set by the browser SDK / your app).\n *\n * The constants are the DEFAULT-prefix names; the functions build the name for any prefix. If you\n * pass `config.prefix` to the browser client, pass the same prefix here — the browser namespaces\n * the cookie by it, so the default name won't be there to find.\n */\nexport { CONSENT_COOKIE, VISITOR_COOKIE, consentCookieName, visitorCookieName };\n\n/**\n * Parse a raw `Cookie` header into a map. Framework-agnostic so it works with\n * `Request.headers.get(\"cookie\")`, Node `req.headers.cookie`, etc.\n */\nexport function parseCookies(header: string | null | undefined): Record<string, string> {\n  const out: Record<string, string> = {};\n  if (!header) return out;\n  for (const part of header.split(\";\")) {\n    const idx = part.indexOf(\"=\");\n    if (idx === -1) continue;\n    const key = part.slice(0, idx).trim();\n    const value = part.slice(idx + 1).trim();\n    if (key) out[key] = decodeURIComponent(value);\n  }\n  return out;\n}\n\n/**\n * Read the visitor id the browser SDK wrote, so a server-side event can be bound to the same\n * visitor (`createXeniaServer({ visitorId })`) and attribute to a browser-entered journey.\n *\n * @param prefix Must match the browser client's `config.prefix`. The cookie is namespaced by it, so\n *               a mismatch finds nothing and quietly leaves the server with no visitor.\n */\nexport function getVisitorId(\n  cookieHeader: string | null | undefined,\n  prefix?: string,\n): string | null {\n  return parseCookies(cookieHeader)[visitorCookieName(prefix)] ?? null;\n}\n\n/**\n * Read consent from a cookie header. Accepts a JSON blob or a comma-list of\n * granted scopes (e.g. `analytics,personalization`). Absent → all denied.\n *\n * @param prefix Must match the browser client's `config.prefix` — see {@link getVisitorId}.\n */\nexport function getConsent(\n  cookieHeader: string | null | undefined,\n  prefix?: string,\n): ConsentState {\n  const raw = parseCookies(cookieHeader)[consentCookieName(prefix)];\n  if (!raw) return { analytics: false, marketing: false, personalization: false };\n  try {\n    const parsed = JSON.parse(raw) as ConsentState;\n    return parsed;\n  } catch {\n    const scopes = new Set(raw.split(\",\").map((s) => s.trim()));\n    return {\n      analytics: scopes.has(\"analytics\"),\n      marketing: scopes.has(\"marketing\"),\n      personalization: scopes.has(\"personalization\"),\n    };\n  }\n}\n"]}
+{"version":3,"sources":["../../src/core/event-payload.ts","../../src/server/xenia-server.ts","../../src/server/token.ts","../../src/server/cookies.ts"],"names":["XeniaApi","toEventId","generateUlid","HttpClient","visitorCookieName","consentCookieName"],"mappings":";;;;;AAGA,IAAM,QAAA,uBAAe,GAAA,CAAI;AAAA,EACvB,SAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,aAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAC,CAAA;AAaD,SAAS,QAAQ,GAAA,EAAuE;AACtF,EAAA,MAAM,MAAiC,EAAC;AACxC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AACxC,IAAA,IAAI,CAAA,KAAM,MAAA,EAAW,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EAChC;AACA,EAAA,OAAO,GAAA;AACT;AAWO,SAAS,kBAAkB,KAAA,EAAsC;AACtE,EAAA,MAAM,cAAyC,EAAC;AAChD,EAAA,MAAM,WAAsC,EAAC;AAC7C,EAAA,IAAI,MAAM,KAAA,EAAO;AACf,IAAA,KAAA,MAAW,CAAC,GAAG,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,KAAK,CAAA,EAAG;AAChD,MAAA,IAAI,MAAM,MAAA,EAAW;AAKrB,MAAA,IAAI,SAAS,GAAA,CAAI,CAAC,CAAA,EAAG,QAAA,CAAS,CAAC,CAAA,GAAI,CAAA;AAAA,WAC9B,WAAA,CAAY,CAAC,CAAA,GAAI,CAAA;AAAA,IACxB;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,GAAG,WAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAKH,GAAG,QAAA;AAAA,IACH,GAAG,OAAA,CAAS,KAAA,CAAM,OAAA,IAAW,EAA4C,CAAA;AAAA,IACzE,GAAG,OAAA,CAAS,KAAA,CAAM,QAAA,IAAY,EAA4C,CAAA;AAAA,IAC1E,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,GAAI,MAAM,SAAA,GAAY,EAAE,WAAW,KAAA,CAAM,SAAA,KAAc,EAAC;AAAA,IACxD,GAAI,MAAM,SAAA,GAAY,EAAE,WAAW,KAAA,CAAM,SAAA,KAAc;AAAC,GAC1D;AAEA,EAAA,OAAO,OAAA;AACT;;;ACfO,IAAM,cAAN,MAAkB;AAAA,EACd,GAAA;AAAA;AAAA,EAEQ,SAAA;AAAA,EAEjB,YAAY,MAAA,EAAqB;AAC/B,IAAA,IAAA,CAAK,GAAA,GAAM,IAAIA,0BAAA,CAAS,MAAM,CAAA;AAC9B,IAAA,IAAA,CAAK,YAAY,MAAA,CAAO,SAAA;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,CACJ,SAAA,EACA,IAAA,GAA2B,EAAC,EACM;AAClC,IAAA,MAAM,KAAA,GAAoB;AAAA,MACxB,SAAA;AAAA,MACA,SAAS,IAAA,CAAK,OAAA,GAAUC,4BAAU,IAAA,CAAK,OAAO,IAAIC,8BAAA,EAAa;AAAA,MAC/D,YAAA,EAAc,KAAK,YAAA,IAAgB,CAAA;AAAA,MACnC,YAAA,EAAc,IAAA,CAAK,YAAA,IAAgB,IAAA,CAAK,GAAA,EAAI;AAAA,MAC5C,MAAA,EAAQ,KAAK,MAAA,IAAU,kBAAA;AAAA,MACvB,QAAA,EAAU;AAAA,QACR,GAAG,IAAA,CAAK,QAAA;AAAA;AAAA;AAAA,QAGR,gBAAgB,IAAA,CAAK;AAAA,OACvB;AAAA,MACA,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,OAAA,EAAS,IAAA,CAAK,OAAA,KAAY,IAAA,GAAO,IAAA,GAAO;AAAA,KAC1C;AACA,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,UAAA,CAAW,CAAC,KAAK,CAAC,CAAA;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAA,CACJ,SAAA,EACA,IAAA,EACA,IAAA,GAA6B,EAAC,EACJ;AAC1B,IAAA,MAAM,UAAU,iBAAA,CAAkB;AAAA,MAChC,OAAA,EAAS,SAAA;AAAA,MACT,WAAW,IAAA,CAAK,SAAA;AAAA;AAAA;AAAA;AAAA,MAIhB,QAAA,EAAU,EAAE,GAAG,IAAA,CAAK,QAAA,EAAU,WAAW,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,QAAA,EAAU,SAAA,EAAU;AAAA,MACpF,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,KAAA,EAAO;AAAA,KACR,CAAA;AACD,IAAA,OAAO,KAAK,GAAA,CAAI,OAAA,CAAQ,WAAW,OAAA,EAAsB,IAAA,CAAK,UAAU,MAAM,CAAA;AAAA,EAChF;AAAA;AAAA,EAGA,MAAM,SAAS,IAAA,EAAkD;AAC/D,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,QAAA,CAAS,IAAI,CAAA;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAA,CAAQ,UAAA,EAAoB,IAAA,EAA+C;AAC/E,IAAA,OAAO,KAAK,GAAA,CAAI,OAAA,CAAQ,YAAY,IAAA,CAAK,WAAA,CAAY,IAAI,CAAC,CAAA;AAAA,EAC5D;AAAA;AAAA,EAGA,MAAM,YAAA,CACJ,KAAA,EACA,IAAA,EAC+B;AAC/B,IAAA,OAAO,KAAK,GAAA,CAAI,YAAA,CAAa,OAAO,IAAA,CAAK,WAAA,CAAY,IAAI,CAAC,CAAA;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,YAAY,IAAA,EAAmD;AACrE,IAAA,IAAI,CAAC,IAAA,CAAK,SAAA,EAAW,OAAO,IAAA;AAC5B,IAAA,OAAO,EAAE,GAAG,IAAA,EAAM,IAAA,EAAM,EAAE,GAAI,IAAA,EAAM,IAAA,IAAQ,EAAC,EAAI,UAAA,EAAY,IAAA,CAAK,WAAU,EAAE;AAAA,EAChF;AACF;AAGO,SAAS,kBAAkB,MAAA,EAAkC;AAClE,EAAA,OAAO,IAAI,YAAY,MAAM,CAAA;AAC/B;;;ACvIA,eAAsB,gBAAgB,IAAA,EAAoD;AACxF,EAAA,MAAM,IAAA,GAAO,IAAIC,4BAAA,CAAW,EAAE,OAAA,EAAS,KAAK,OAAA,EAAS,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,CAAA;AAC5E,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,KAAK,OAAA,CAAQ;AAAA,IAClC,MAAA,EAAQ,MAAA;AAAA,IACR,IAAA,EAAM,oCAAA;AAAA,IACN,SAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,QAAQ,CAAA,CAAA,EAAG;AAAA,IACpD,IAAA,EAAM,EAAE,UAAA,EAAY,IAAA,CAAK,cAAc,IAAA;AAAK,GAC7C,CAAA;AACD,EAAA,MAAM,GAAA,GAAO,QAAQ,EAAC;AACtB,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,KAAA,IAAS,EAAE,CAAA;AAAA,IAC7B,WAAW,OAAO,GAAA,CAAI,SAAA,KAAc,QAAA,GAAW,IAAI,SAAA,GAAY;AAAA,GACjE;AACF;AAiBO,SAAS,iBAAiB,MAAA,EAAsE;AACrG,EAAA,OAAO,YAA+B;AACpC,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAY,MAAM,eAAA,CAAgB,MAAM,CAAA;AAC9C,MAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,SAAS,CAAA,EAAG;AAAA,QAC7C,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,iBAAiB,UAAA;AAAW,OAC5E,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,sBAAA;AACrD,MAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG;AAAA,QACtD,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,OAC/C,CAAA;AAAA,IACH;AAAA,EACF,CAAA;AACF;;;ACzDO,SAAS,aAAa,MAAA,EAA2D;AACtF,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,IAAI,CAAC,QAAQ,OAAO,GAAA;AACpB,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAAG;AACpC,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC5B,IAAA,IAAI,QAAQ,EAAA,EAAI;AAChB,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,EAAE,IAAA,EAAK;AACpC,IAAA,MAAM,QAAQ,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AACvC,IAAA,IAAI,GAAA,EAAK,GAAA,CAAI,GAAG,CAAA,GAAI,mBAAmB,KAAK,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,GAAA;AACT;AASO,SAAS,YAAA,CACd,cACA,MAAA,EACe;AACf,EAAA,OAAO,aAAa,YAAY,CAAA,CAAEC,mCAAA,CAAkB,MAAM,CAAC,CAAA,IAAK,IAAA;AAClE;AAQO,SAAS,UAAA,CACd,cACA,MAAA,EACc;AACd,EAAA,MAAM,MAAM,YAAA,CAAa,YAAY,CAAA,CAAEC,mCAAA,CAAkB,MAAM,CAAC,CAAA;AAChE,EAAA,IAAI,CAAC,KAAK,OAAO,EAAE,WAAW,KAAA,EAAO,SAAA,EAAW,KAAA,EAAO,eAAA,EAAiB,KAAA,EAAM;AAC9E,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AAC1D,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,WAAW,CAAA;AAAA,MACjC,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,WAAW,CAAA;AAAA,MACjC,eAAA,EAAiB,MAAA,CAAO,GAAA,CAAI,iBAAiB;AAAA,KAC/C;AAAA,EACF;AACF","file":"index.cjs","sourcesContent":["import type { EventContext, EventIdentity, EventPayload, JsonValue } from \"./types\";\n\n/** Reserved keys that map to first-class fields (not passthrough data). */\nconst RESERVED = new Set([\n  \"eventId\",\n  \"eventType\",\n  \"journeyId\",\n  \"deviceId\",\n  \"visitorId\",\n  \"customerId\",\n  \"email\",\n  \"utmSource\",\n  \"utmMedium\",\n  \"utmCampaign\",\n  \"utmContent\",\n  \"utmId\",\n  \"url\",\n  \"referrer\",\n  \"path\",\n  \"query\",\n]);\n\nexport interface BuildEventInput {\n  eventId: string;\n  eventType?: string;\n  journeyId?: string;\n  identity?: EventIdentity;\n  context?: EventContext;\n  /** Arbitrary extra properties merged as passthrough data. */\n  props?: Record<string, JsonValue | undefined>;\n}\n\n/** Drop `undefined` values so the JSON body stays clean. */\nfunction compact(obj: Record<string, JsonValue | undefined>): Record<string, JsonValue> {\n  const out: Record<string, JsonValue> = {};\n  for (const [k, v] of Object.entries(obj)) {\n    if (v !== undefined) out[k] = v;\n  }\n  return out;\n}\n\n/**\n * Build the request body for the webhook `/flow` call (`XeniaApi.webhook`).\n *\n * Merge order (later wins): passthrough props < context < identity < core.\n * Field names match the backend `EventTriggerRequest` DTO exactly.\n *\n * @internal Used only by the webhook request/response path — the unified event\n * surface (`track()` → `POST /api/events/v1`) builds {@link XeniaEvent} instead.\n */\nexport function buildEventPayload(input: BuildEventInput): EventPayload {\n  const passthrough: Record<string, JsonValue> = {};\n  const reserved: Record<string, JsonValue> = {};\n  if (input.props) {\n    for (const [k, v] of Object.entries(input.props)) {\n      if (v === undefined) continue;\n      // A prop whose key matches a reserved field (e.g. `email`, `customerId`,\n      // `utmSource`) is promoted to that first-class field; everything else is\n      // custom passthrough data. Previously reserved-named props were dropped\n      // outright — so `track(\"sign_up\", { email })` never sent `email` at all.\n      if (RESERVED.has(k)) reserved[k] = v;\n      else passthrough[k] = v;\n    }\n  }\n\n  const payload = {\n    ...passthrough,\n    // Reserved-named props fill first-class fields (e.g. `email`, `customerId`)\n    // the SDK didn't auto-collect. Auto-collected context/identity still win for\n    // what they reliably know (real page url, visitor/device id), so a stray prop\n    // can't override the true page context — see merge order below.\n    ...reserved,\n    ...compact((input.context ?? {}) as Record<string, JsonValue | undefined>),\n    ...compact((input.identity ?? {}) as Record<string, JsonValue | undefined>),\n    eventId: input.eventId,\n    ...(input.eventType ? { eventType: input.eventType } : {}),\n    ...(input.journeyId ? { journeyId: input.journeyId } : {}),\n  };\n\n  return payload as EventPayload;\n}\n","import { XeniaApi } from \"../core/api\";\nimport { buildEventPayload } from \"../core/event-payload\";\nimport { generateUlid, toEventId } from \"../core/id\";\nimport type {\n  AnalyticsContext,\n  AnalyticsEventName,\n  CallerIdentity,\n  AnalyticsIngestResponse,\n  ConsentState,\n  EventContext,\n  EventIdentity,\n  IdentifyRequest,\n  IdentifyResponse,\n  JsonValue,\n  ResolveBatchItem,\n  ResolveBatchResult,\n  ResolveOptions,\n  ResolveResult,\n  WebhookResponse,\n  XeniaConfig,\n  XeniaEvent,\n} from \"../core/types\";\n\n/**\n * Extra per-call identity/context for server-side webhook calls. There's no\n * ambient `window` on the server to auto-collect `path`/`query`/`url`/UTM\n * params the way the browser client does — pass whatever's known at the call\n * site (e.g. the current request's pathname from Next.js `headers()`/route\n * params) via `context`, and `deviceId`/`visitorId`/etc. via `identity`.\n */\nexport interface ServerWebhookOptions {\n  method?: \"GET\" | \"POST\";\n  journeyId?: string;\n  identity?: EventIdentity;\n  context?: EventContext;\n}\n\n/**\n * Options for a server-side unified event (`POST /api/events/v1`). There's no\n * ambient request context on the server — pass whatever's known at the call\n * site (e.g. pathname/user-agent from the current request, session id from a\n * cookie) via `identity`/`context`.\n */\nexport interface ServerTrackOptions {\n  /** When true, also match/advance a journey (never sampled/shed). Default false. */\n  trigger?: boolean;\n  /** Stable dedup key (e.g. `\"ord-1001\"`) for idempotent conversions. */\n  eventId?: string;\n  eventVersion?: number;\n  occurredAtMs?: number;\n  /** Origin tag. Default `\"xenia-server-sdk\"`. */\n  source?: string;\n  /** Identity fields for this event (except the SDK-owned `xeniaVisitorId`,\n   *  which comes from `config.visitorId` and can't be set per call). */\n  identity?: CallerIdentity;\n  context?: AnalyticsContext;\n  properties?: Record<string, JsonValue | undefined>;\n  consent?: ConsentState;\n}\n\n/**\n * Server-native Xenia client. Same method names as the browser client, but\n * every call is stateless: identity and context are passed explicitly rather\n * than read from the DOM/localStorage. Uses global `fetch` (Node ≥18).\n */\nexport class XeniaServer {\n  readonly api: XeniaApi;\n  /** SDK-owned visitor anchor for this (per-request) client — see {@link XeniaConfig.visitorId}. */\n  private readonly visitorId?: string;\n\n  constructor(config: XeniaConfig) {\n    this.api = new XeniaApi(config);\n    this.visitorId = config.visitorId;\n  }\n\n  /**\n   * Send a unified event server-side (`POST /api/events/v1`) and return the\n   * ingest response (including per-result `triggered`). `opts.trigger: true`\n   * also matches/advances a journey; pass `opts.eventId` (e.g. `\"ord-1001\"`)\n   * as a stable dedup key for idempotent conversions.\n   */\n  async track(\n    eventName: AnalyticsEventName,\n    opts: ServerTrackOptions = {},\n  ): Promise<AnalyticsIngestResponse> {\n    const event: XeniaEvent = {\n      eventName,\n      eventId: opts.eventId ? toEventId(opts.eventId) : generateUlid(),\n      eventVersion: opts.eventVersion ?? 1,\n      occurredAtMs: opts.occurredAtMs ?? Date.now(),\n      source: opts.source ?? \"xenia-server-sdk\",\n      identity: {\n        ...opts.identity,\n        // SDK-owned, set LAST so it can't be overridden per call. Comes from\n        // `config.visitorId` (bind it per request from the `xenia_vid` cookie).\n        xeniaVisitorId: this.visitorId,\n      },\n      context: opts.context,\n      properties: opts.properties,\n      consent: opts.consent,\n      trigger: opts.trigger === true ? true : undefined,\n    };\n    return this.api.sendEvents([event]);\n  }\n\n  /**\n   * Send a webhook request and await the synchronous response. Merges\n   * `opts.identity`/`opts.context` into the payload the same way the browser\n   * client's auto-attached fields do (`path`, `query`, `url`, `referrer`,\n   * `deviceId`, `visitorId`, etc.) — see `ServerWebhookOptions`.\n   */\n  async webhook(\n    triggerId: string,\n    data?: Record<string, JsonValue | undefined>,\n    opts: ServerWebhookOptions = {},\n  ): Promise<WebhookResponse> {\n    const payload = buildEventPayload({\n      eventId: triggerId,\n      journeyId: opts.journeyId,\n      // SDK-owned visitor anchor wins: config.visitorId (bind the `xenia_vid`\n      // cookie per request) is attached automatically. Falls back to a\n      // per-call visitorId only when none is bound.\n      identity: { ...opts.identity, visitorId: this.visitorId ?? opts.identity?.visitorId },\n      context: opts.context,\n      props: data,\n    });\n    return this.api.webhook(triggerId, payload as JsonValue, opts.method ?? \"POST\");\n  }\n\n  /** Bind visitor→user server-side — `POST /api/events/v1/identify`. */\n  async identify(body: IdentifyRequest): Promise<IdentifyResponse> {\n    return this.api.identify(body);\n  }\n\n  /**\n   * Resolve in-entry content personalization for one content key\n   * (`POST /api/personalization/resolve`). Requires a configured SDK token\n   * (`token`/`getToken`) — resolve is auth-required. With `merge: true` the\n   * returned `content` is server-spliced.\n   */\n  async resolve(contentKey: string, opts?: ResolveOptions): Promise<ResolveResult> {\n    return this.api.resolve(contentKey, this.withVisitor(opts));\n  }\n\n  /** Resolve several content keys in one round-trip (`POST /api/personalization/resolve-batch`). */\n  async resolveBatch(\n    items: ResolveBatchItem[],\n    opts?: ResolveOptions,\n  ): Promise<ResolveBatchResult[]> {\n    return this.api.resolveBatch(items, this.withVisitor(opts));\n  }\n\n  /**\n   * Stamp the SDK-owned visitor id (`config.visitorId`) into the resolve `data`\n   * under the reserved `_xenia_vid` key so the backend can bucket holdout\n   * experiments and record exposure per visitor. Set last so a caller can't\n   * override it; a no-op when no `visitorId` was bound on this client.\n   */\n  private withVisitor(opts?: ResolveOptions): ResolveOptions | undefined {\n    if (!this.visitorId) return opts;\n    return { ...opts, data: { ...(opts?.data ?? {}), _xenia_vid: this.visitorId } };\n  }\n}\n\n/** Create a server-native client. */\nexport function createXeniaServer(config: XeniaConfig): XeniaServer {\n  return new XeniaServer(config);\n}\n","import { HttpClient } from \"../core/http-client\";\nimport type { JsonObject } from \"../core/types\";\n\nexport interface RefreshTokenOptions {\n  /**\n   * Xenia base URL. Defaults to the hosted engine,\n   * `https://engine.xeniamartech.com/xenia` — omit unless self-hosting.\n   */\n  baseUrl?: string;\n  /**\n   * The personalization SDK token created once in the dashboard (API Tokens →\n   * Create token). Stays server-side; the browser never sees it — only the\n   * short-lived token this exchanges it for does.\n   */\n  sdkToken: string;\n  /** Lifetime of the returned token, in minutes. Default 15, capped server-side at 60. */\n  ttlMinutes?: number;\n  timeout?: number;\n}\n\nexport interface RefreshedToken {\n  token: string;\n  expiresAt?: string;\n}\n\n/**\n * Exchange the long-lived personalization SDK token for a short-lived one with\n * the same tenant/env scope, via `POST /api/personalization/token/refresh`.\n * Self-service — no dashboard credential needed, just the SDK token you\n * already have. Call this from your backend and hand the result to the\n * browser (e.g. from a token route the client SDK calls via `getToken`).\n */\nexport async function refreshSdkToken(opts: RefreshTokenOptions): Promise<RefreshedToken> {\n  const http = new HttpClient({ baseUrl: opts.baseUrl, timeout: opts.timeout });\n  const { data } = await http.request({\n    method: \"POST\",\n    path: \"/api/personalization/token/refresh\",\n    headers: { Authorization: `Bearer ${opts.sdkToken}` },\n    body: { ttlMinutes: opts.ttlMinutes ?? null },\n  });\n  const obj = (data ?? {}) as JsonObject;\n  return {\n    token: String(obj.token ?? \"\"),\n    expiresAt: typeof obj.expiresAt === \"string\" ? obj.expiresAt : undefined,\n  };\n}\n\n/**\n * Build a framework-agnostic request handler that hands the browser SDK a\n * personalization token — mount it at the endpoint `getToken` calls. Needs\n * only the SDK token you already created in the dashboard; mints a fresh\n * short-lived token per request so the long-lived one never reaches the\n * browser.\n *\n * @example\n * ```ts\n * export const GET = createTokenRoute({\n *   sdkToken: process.env.XENIA_SDK_TOKEN!,\n *   // baseUrl: process.env.XENIA_URL, // only to override the default hosted engine\n * });\n * ```\n */\nexport function createTokenRoute(config: RefreshTokenOptions): (request: Request) => Promise<Response> {\n  return async (): Promise<Response> => {\n    try {\n      const refreshed = await refreshSdkToken(config);\n      return new Response(JSON.stringify(refreshed), {\n        status: 200,\n        headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n      });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"token refresh failed\";\n      return new Response(JSON.stringify({ error: message }), {\n        status: 500,\n        headers: { \"Content-Type\": \"application/json\" },\n      });\n    }\n  };\n}\n","import {\n  CONSENT_COOKIE,\n  VISITOR_COOKIE,\n  consentCookieName,\n  visitorCookieName,\n} from \"../core/cookie-names\";\nimport type { ConsentState } from \"../core/types\";\n\n/**\n * Cookie names the SDK reads server-side (set by the browser SDK / your app).\n *\n * The constants are the DEFAULT-prefix names; the functions build the name for any prefix. If you\n * pass `config.prefix` to the browser client, pass the same prefix here — the browser namespaces\n * the cookie by it, so the default name won't be there to find.\n */\nexport { CONSENT_COOKIE, VISITOR_COOKIE, consentCookieName, visitorCookieName };\n\n/**\n * Parse a raw `Cookie` header into a map. Framework-agnostic so it works with\n * `Request.headers.get(\"cookie\")`, Node `req.headers.cookie`, etc.\n */\nexport function parseCookies(header: string | null | undefined): Record<string, string> {\n  const out: Record<string, string> = {};\n  if (!header) return out;\n  for (const part of header.split(\";\")) {\n    const idx = part.indexOf(\"=\");\n    if (idx === -1) continue;\n    const key = part.slice(0, idx).trim();\n    const value = part.slice(idx + 1).trim();\n    if (key) out[key] = decodeURIComponent(value);\n  }\n  return out;\n}\n\n/**\n * Read the visitor id the browser SDK wrote, so a server-side event can be bound to the same\n * visitor (`createXeniaServer({ visitorId })`) and attribute to a browser-entered journey.\n *\n * @param prefix Must match the browser client's `config.prefix`. The cookie is namespaced by it, so\n *               a mismatch finds nothing and quietly leaves the server with no visitor.\n */\nexport function getVisitorId(\n  cookieHeader: string | null | undefined,\n  prefix?: string,\n): string | null {\n  return parseCookies(cookieHeader)[visitorCookieName(prefix)] ?? null;\n}\n\n/**\n * Read consent from a cookie header. Accepts a JSON blob or a comma-list of\n * granted scopes (e.g. `analytics,personalization`). Absent → all denied.\n *\n * @param prefix Must match the browser client's `config.prefix` — see {@link getVisitorId}.\n */\nexport function getConsent(\n  cookieHeader: string | null | undefined,\n  prefix?: string,\n): ConsentState {\n  const raw = parseCookies(cookieHeader)[consentCookieName(prefix)];\n  if (!raw) return { analytics: false, marketing: false, personalization: false };\n  try {\n    const parsed = JSON.parse(raw) as ConsentState;\n    return parsed;\n  } catch {\n    const scopes = new Set(raw.split(\",\").map((s) => s.trim()));\n    return {\n      analytics: scopes.has(\"analytics\"),\n      marketing: scopes.has(\"marketing\"),\n      personalization: scopes.has(\"personalization\"),\n    };\n  }\n}\n"]}

package/dist/server/index.d.cts

@@ -1,5 +1,5 @@
-import { s as CallerIdentity, A as AnalyticsContext, J as JsonValue, d as ConsentState, e as EventIdentity, E as EventContext, n as XeniaApi, o as XeniaConfig, a as AnalyticsEventName, c as AnalyticsIngestResponse, W as WebhookResponse, I as IdentifyRequest, f as IdentifyResponse, l as ResolveOptions, m as ResolveResult, j as ResolveBatchItem, k as ResolveBatchResult } from '../cookie-names-BQ-L04A8.cjs';
-export { b as AnalyticsIdentity, C as CONSENT_COOKIE, P as PersonalizationSwap, V as VISITOR_COOKIE, p as XeniaEvent, q as consentCookieName, r as parseActions, v as visitorCookieName } from '../cookie-names-BQ-L04A8.cjs';
+import { s as CallerIdentity, A as AnalyticsContext, J as JsonValue, d as ConsentState, e as EventIdentity, E as EventContext, n as XeniaApi, o as XeniaConfig, a as AnalyticsEventName, c as AnalyticsIngestResponse, W as WebhookResponse, I as IdentifyRequest, f as IdentifyResponse, l as ResolveOptions, m as ResolveResult, j as ResolveBatchItem, k as ResolveBatchResult } from '../cookie-names-LgNDAreS.cjs';
+export { b as AnalyticsIdentity, C as CONSENT_COOKIE, P as PersonalizationSwap, V as VISITOR_COOKIE, p as XeniaEvent, q as consentCookieName, r as parseActions, v as visitorCookieName } from '../cookie-names-LgNDAreS.cjs';
 
 /**
  * Extra per-call identity/context for server-side webhook calls. There's no
@@ -83,8 +83,11 @@ declare class XeniaServer {
 declare function createXeniaServer(config: XeniaConfig): XeniaServer;
 
 interface RefreshTokenOptions {
-    /** Xenia base URL including `/xenia`. */
-    baseUrl: string;
+    /**
+     * Xenia base URL. Defaults to the hosted engine,
+     * `https://engine.xeniamartech.com/xenia` — omit unless self-hosting.
+     */
+    baseUrl?: string;
     /**
      * The personalization SDK token created once in the dashboard (API Tokens →
      * Create token). Stays server-side; the browser never sees it — only the
@@ -117,8 +120,8 @@ declare function refreshSdkToken(opts: RefreshTokenOptions): Promise<RefreshedTo
  * @example
  * ```ts
  * export const GET = createTokenRoute({
- *   baseUrl: process.env.XENIA_URL!,
  *   sdkToken: process.env.XENIA_SDK_TOKEN!,
+ *   // baseUrl: process.env.XENIA_URL, // only to override the default hosted engine
  * });
  * ```
  */

package/dist/server/index.d.ts

@@ -1,5 +1,5 @@
-import { s as CallerIdentity, A as AnalyticsContext, J as JsonValue, d as ConsentState, e as EventIdentity, E as EventContext, n as XeniaApi, o as XeniaConfig, a as AnalyticsEventName, c as AnalyticsIngestResponse, W as WebhookResponse, I as IdentifyRequest, f as IdentifyResponse, l as ResolveOptions, m as ResolveResult, j as ResolveBatchItem, k as ResolveBatchResult } from '../cookie-names-BQ-L04A8.js';
-export { b as AnalyticsIdentity, C as CONSENT_COOKIE, P as PersonalizationSwap, V as VISITOR_COOKIE, p as XeniaEvent, q as consentCookieName, r as parseActions, v as visitorCookieName } from '../cookie-names-BQ-L04A8.js';
+import { s as CallerIdentity, A as AnalyticsContext, J as JsonValue, d as ConsentState, e as EventIdentity, E as EventContext, n as XeniaApi, o as XeniaConfig, a as AnalyticsEventName, c as AnalyticsIngestResponse, W as WebhookResponse, I as IdentifyRequest, f as IdentifyResponse, l as ResolveOptions, m as ResolveResult, j as ResolveBatchItem, k as ResolveBatchResult } from '../cookie-names-LgNDAreS.js';
+export { b as AnalyticsIdentity, C as CONSENT_COOKIE, P as PersonalizationSwap, V as VISITOR_COOKIE, p as XeniaEvent, q as consentCookieName, r as parseActions, v as visitorCookieName } from '../cookie-names-LgNDAreS.js';
 
 /**
  * Extra per-call identity/context for server-side webhook calls. There's no
@@ -83,8 +83,11 @@ declare class XeniaServer {
 declare function createXeniaServer(config: XeniaConfig): XeniaServer;
 
 interface RefreshTokenOptions {
-    /** Xenia base URL including `/xenia`. */
-    baseUrl: string;
+    /**
+     * Xenia base URL. Defaults to the hosted engine,
+     * `https://engine.xeniamartech.com/xenia` — omit unless self-hosting.
+     */
+    baseUrl?: string;
     /**
      * The personalization SDK token created once in the dashboard (API Tokens →
      * Create token). Stays server-side; the browser never sees it — only the
@@ -117,8 +120,8 @@ declare function refreshSdkToken(opts: RefreshTokenOptions): Promise<RefreshedTo
  * @example
  * ```ts
  * export const GET = createTokenRoute({
- *   baseUrl: process.env.XENIA_URL!,
  *   sdkToken: process.env.XENIA_SDK_TOKEN!,
+ *   // baseUrl: process.env.XENIA_URL, // only to override the default hosted engine
  * });
  * ```
  */

package/dist/server/index.js

@@ -1,5 +1,5 @@
-import { XeniaApi, toEventId, generateUlid, HttpClient, visitorCookieName, consentCookieName } from '../chunk-PTYUK4P3.js';
-export { CONSENT_COOKIE, VISITOR_COOKIE, XeniaApi, consentCookieName, parseActions, visitorCookieName } from '../chunk-PTYUK4P3.js';
+import { XeniaApi, toEventId, generateUlid, HttpClient, visitorCookieName, consentCookieName } from '../chunk-D37RD3UC.js';
+export { CONSENT_COOKIE, VISITOR_COOKIE, XeniaApi, consentCookieName, parseActions, visitorCookieName } from '../chunk-D37RD3UC.js';
 
 // src/core/event-payload.ts
 var RESERVED = /* @__PURE__ */ new Set([

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/event-payload.ts","../../src/server/xenia-server.ts","../../src/server/token.ts","../../src/server/cookies.ts"],"names":[],"mappings":";;;;AAGA,IAAM,QAAA,uBAAe,GAAA,CAAI;AAAA,EACvB,SAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,aAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAC,CAAA;AAaD,SAAS,QAAQ,GAAA,EAAuE;AACtF,EAAA,MAAM,MAAiC,EAAC;AACxC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AACxC,IAAA,IAAI,CAAA,KAAM,MAAA,EAAW,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EAChC;AACA,EAAA,OAAO,GAAA;AACT;AAWO,SAAS,kBAAkB,KAAA,EAAsC;AACtE,EAAA,MAAM,cAAyC,EAAC;AAChD,EAAA,MAAM,WAAsC,EAAC;AAC7C,EAAA,IAAI,MAAM,KAAA,EAAO;AACf,IAAA,KAAA,MAAW,CAAC,GAAG,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,KAAK,CAAA,EAAG;AAChD,MAAA,IAAI,MAAM,MAAA,EAAW;AAKrB,MAAA,IAAI,SAAS,GAAA,CAAI,CAAC,CAAA,EAAG,QAAA,CAAS,CAAC,CAAA,GAAI,CAAA;AAAA,WAC9B,WAAA,CAAY,CAAC,CAAA,GAAI,CAAA;AAAA,IACxB;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,GAAG,WAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAKH,GAAG,QAAA;AAAA,IACH,GAAG,OAAA,CAAS,KAAA,CAAM,OAAA,IAAW,EAA4C,CAAA;AAAA,IACzE,GAAG,OAAA,CAAS,KAAA,CAAM,QAAA,IAAY,EAA4C,CAAA;AAAA,IAC1E,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,GAAI,MAAM,SAAA,GAAY,EAAE,WAAW,KAAA,CAAM,SAAA,KAAc,EAAC;AAAA,IACxD,GAAI,MAAM,SAAA,GAAY,EAAE,WAAW,KAAA,CAAM,SAAA,KAAc;AAAC,GAC1D;AAEA,EAAA,OAAO,OAAA;AACT;;;ACfO,IAAM,cAAN,MAAkB;AAAA,EACd,GAAA;AAAA;AAAA,EAEQ,SAAA;AAAA,EAEjB,YAAY,MAAA,EAAqB;AAC/B,IAAA,IAAA,CAAK,GAAA,GAAM,IAAI,QAAA,CAAS,MAAM,CAAA;AAC9B,IAAA,IAAA,CAAK,YAAY,MAAA,CAAO,SAAA;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,CACJ,SAAA,EACA,IAAA,GAA2B,EAAC,EACM;AAClC,IAAA,MAAM,KAAA,GAAoB;AAAA,MACxB,SAAA;AAAA,MACA,SAAS,IAAA,CAAK,OAAA,GAAU,UAAU,IAAA,CAAK,OAAO,IAAI,YAAA,EAAa;AAAA,MAC/D,YAAA,EAAc,KAAK,YAAA,IAAgB,CAAA;AAAA,MACnC,YAAA,EAAc,IAAA,CAAK,YAAA,IAAgB,IAAA,CAAK,GAAA,EAAI;AAAA,MAC5C,MAAA,EAAQ,KAAK,MAAA,IAAU,kBAAA;AAAA,MACvB,QAAA,EAAU;AAAA,QACR,GAAG,IAAA,CAAK,QAAA;AAAA;AAAA;AAAA,QAGR,gBAAgB,IAAA,CAAK;AAAA,OACvB;AAAA,MACA,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,OAAA,EAAS,IAAA,CAAK,OAAA,KAAY,IAAA,GAAO,IAAA,GAAO;AAAA,KAC1C;AACA,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,UAAA,CAAW,CAAC,KAAK,CAAC,CAAA;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAA,CACJ,SAAA,EACA,IAAA,EACA,IAAA,GAA6B,EAAC,EACJ;AAC1B,IAAA,MAAM,UAAU,iBAAA,CAAkB;AAAA,MAChC,OAAA,EAAS,SAAA;AAAA,MACT,WAAW,IAAA,CAAK,SAAA;AAAA;AAAA;AAAA;AAAA,MAIhB,QAAA,EAAU,EAAE,GAAG,IAAA,CAAK,QAAA,EAAU,WAAW,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,QAAA,EAAU,SAAA,EAAU;AAAA,MACpF,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,KAAA,EAAO;AAAA,KACR,CAAA;AACD,IAAA,OAAO,KAAK,GAAA,CAAI,OAAA,CAAQ,WAAW,OAAA,EAAsB,IAAA,CAAK,UAAU,MAAM,CAAA;AAAA,EAChF;AAAA;AAAA,EAGA,MAAM,SAAS,IAAA,EAAkD;AAC/D,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,QAAA,CAAS,IAAI,CAAA;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAA,CAAQ,UAAA,EAAoB,IAAA,EAA+C;AAC/E,IAAA,OAAO,KAAK,GAAA,CAAI,OAAA,CAAQ,YAAY,IAAA,CAAK,WAAA,CAAY,IAAI,CAAC,CAAA;AAAA,EAC5D;AAAA;AAAA,EAGA,MAAM,YAAA,CACJ,KAAA,EACA,IAAA,EAC+B;AAC/B,IAAA,OAAO,KAAK,GAAA,CAAI,YAAA,CAAa,OAAO,IAAA,CAAK,WAAA,CAAY,IAAI,CAAC,CAAA;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,YAAY,IAAA,EAAmD;AACrE,IAAA,IAAI,CAAC,IAAA,CAAK,SAAA,EAAW,OAAO,IAAA;AAC5B,IAAA,OAAO,EAAE,GAAG,IAAA,EAAM,IAAA,EAAM,EAAE,GAAI,IAAA,EAAM,IAAA,IAAQ,EAAC,EAAI,UAAA,EAAY,IAAA,CAAK,WAAU,EAAE;AAAA,EAChF;AACF;AAGO,SAAS,kBAAkB,MAAA,EAAkC;AAClE,EAAA,OAAO,IAAI,YAAY,MAAM,CAAA;AAC/B;;;AC1IA,eAAsB,gBAAgB,IAAA,EAAoD;AACxF,EAAA,MAAM,IAAA,GAAO,IAAI,UAAA,CAAW,EAAE,OAAA,EAAS,KAAK,OAAA,EAAS,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,CAAA;AAC5E,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,KAAK,OAAA,CAAQ;AAAA,IAClC,MAAA,EAAQ,MAAA;AAAA,IACR,IAAA,EAAM,oCAAA;AAAA,IACN,SAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,QAAQ,CAAA,CAAA,EAAG;AAAA,IACpD,IAAA,EAAM,EAAE,UAAA,EAAY,IAAA,CAAK,cAAc,IAAA;AAAK,GAC7C,CAAA;AACD,EAAA,MAAM,GAAA,GAAO,QAAQ,EAAC;AACtB,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,KAAA,IAAS,EAAE,CAAA;AAAA,IAC7B,WAAW,OAAO,GAAA,CAAI,SAAA,KAAc,QAAA,GAAW,IAAI,SAAA,GAAY;AAAA,GACjE;AACF;AAiBO,SAAS,iBAAiB,MAAA,EAAsE;AACrG,EAAA,OAAO,YAA+B;AACpC,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAY,MAAM,eAAA,CAAgB,MAAM,CAAA;AAC9C,MAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,SAAS,CAAA,EAAG;AAAA,QAC7C,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,iBAAiB,UAAA;AAAW,OAC5E,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,sBAAA;AACrD,MAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG;AAAA,QACtD,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,OAC/C,CAAA;AAAA,IACH;AAAA,EACF,CAAA;AACF;;;ACtDO,SAAS,aAAa,MAAA,EAA2D;AACtF,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,IAAI,CAAC,QAAQ,OAAO,GAAA;AACpB,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAAG;AACpC,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC5B,IAAA,IAAI,QAAQ,EAAA,EAAI;AAChB,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,EAAE,IAAA,EAAK;AACpC,IAAA,MAAM,QAAQ,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AACvC,IAAA,IAAI,GAAA,EAAK,GAAA,CAAI,GAAG,CAAA,GAAI,mBAAmB,KAAK,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,GAAA;AACT;AASO,SAAS,YAAA,CACd,cACA,MAAA,EACe;AACf,EAAA,OAAO,aAAa,YAAY,CAAA,CAAE,iBAAA,CAAkB,MAAM,CAAC,CAAA,IAAK,IAAA;AAClE;AAQO,SAAS,UAAA,CACd,cACA,MAAA,EACc;AACd,EAAA,MAAM,MAAM,YAAA,CAAa,YAAY,CAAA,CAAE,iBAAA,CAAkB,MAAM,CAAC,CAAA;AAChE,EAAA,IAAI,CAAC,KAAK,OAAO,EAAE,WAAW,KAAA,EAAO,SAAA,EAAW,KAAA,EAAO,eAAA,EAAiB,KAAA,EAAM;AAC9E,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AAC1D,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,WAAW,CAAA;AAAA,MACjC,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,WAAW,CAAA;AAAA,MACjC,eAAA,EAAiB,MAAA,CAAO,GAAA,CAAI,iBAAiB;AAAA,KAC/C;AAAA,EACF;AACF","file":"index.js","sourcesContent":["import type { EventContext, EventIdentity, EventPayload, JsonValue } from \"./types\";\n\n/** Reserved keys that map to first-class fields (not passthrough data). */\nconst RESERVED = new Set([\n  \"eventId\",\n  \"eventType\",\n  \"journeyId\",\n  \"deviceId\",\n  \"visitorId\",\n  \"customerId\",\n  \"email\",\n  \"utmSource\",\n  \"utmMedium\",\n  \"utmCampaign\",\n  \"utmContent\",\n  \"utmId\",\n  \"url\",\n  \"referrer\",\n  \"path\",\n  \"query\",\n]);\n\nexport interface BuildEventInput {\n  eventId: string;\n  eventType?: string;\n  journeyId?: string;\n  identity?: EventIdentity;\n  context?: EventContext;\n  /** Arbitrary extra properties merged as passthrough data. */\n  props?: Record<string, JsonValue | undefined>;\n}\n\n/** Drop `undefined` values so the JSON body stays clean. */\nfunction compact(obj: Record<string, JsonValue | undefined>): Record<string, JsonValue> {\n  const out: Record<string, JsonValue> = {};\n  for (const [k, v] of Object.entries(obj)) {\n    if (v !== undefined) out[k] = v;\n  }\n  return out;\n}\n\n/**\n * Build the request body for the webhook `/flow` call (`XeniaApi.webhook`).\n *\n * Merge order (later wins): passthrough props < context < identity < core.\n * Field names match the backend `EventTriggerRequest` DTO exactly.\n *\n * @internal Used only by the webhook request/response path — the unified event\n * surface (`track()` → `POST /api/events/v1`) builds {@link XeniaEvent} instead.\n */\nexport function buildEventPayload(input: BuildEventInput): EventPayload {\n  const passthrough: Record<string, JsonValue> = {};\n  const reserved: Record<string, JsonValue> = {};\n  if (input.props) {\n    for (const [k, v] of Object.entries(input.props)) {\n      if (v === undefined) continue;\n      // A prop whose key matches a reserved field (e.g. `email`, `customerId`,\n      // `utmSource`) is promoted to that first-class field; everything else is\n      // custom passthrough data. Previously reserved-named props were dropped\n      // outright — so `track(\"sign_up\", { email })` never sent `email` at all.\n      if (RESERVED.has(k)) reserved[k] = v;\n      else passthrough[k] = v;\n    }\n  }\n\n  const payload = {\n    ...passthrough,\n    // Reserved-named props fill first-class fields (e.g. `email`, `customerId`)\n    // the SDK didn't auto-collect. Auto-collected context/identity still win for\n    // what they reliably know (real page url, visitor/device id), so a stray prop\n    // can't override the true page context — see merge order below.\n    ...reserved,\n    ...compact((input.context ?? {}) as Record<string, JsonValue | undefined>),\n    ...compact((input.identity ?? {}) as Record<string, JsonValue | undefined>),\n    eventId: input.eventId,\n    ...(input.eventType ? { eventType: input.eventType } : {}),\n    ...(input.journeyId ? { journeyId: input.journeyId } : {}),\n  };\n\n  return payload as EventPayload;\n}\n","import { XeniaApi } from \"../core/api\";\nimport { buildEventPayload } from \"../core/event-payload\";\nimport { generateUlid, toEventId } from \"../core/id\";\nimport type {\n  AnalyticsContext,\n  AnalyticsEventName,\n  CallerIdentity,\n  AnalyticsIngestResponse,\n  ConsentState,\n  EventContext,\n  EventIdentity,\n  IdentifyRequest,\n  IdentifyResponse,\n  JsonValue,\n  ResolveBatchItem,\n  ResolveBatchResult,\n  ResolveOptions,\n  ResolveResult,\n  WebhookResponse,\n  XeniaConfig,\n  XeniaEvent,\n} from \"../core/types\";\n\n/**\n * Extra per-call identity/context for server-side webhook calls. There's no\n * ambient `window` on the server to auto-collect `path`/`query`/`url`/UTM\n * params the way the browser client does — pass whatever's known at the call\n * site (e.g. the current request's pathname from Next.js `headers()`/route\n * params) via `context`, and `deviceId`/`visitorId`/etc. via `identity`.\n */\nexport interface ServerWebhookOptions {\n  method?: \"GET\" | \"POST\";\n  journeyId?: string;\n  identity?: EventIdentity;\n  context?: EventContext;\n}\n\n/**\n * Options for a server-side unified event (`POST /api/events/v1`). There's no\n * ambient request context on the server — pass whatever's known at the call\n * site (e.g. pathname/user-agent from the current request, session id from a\n * cookie) via `identity`/`context`.\n */\nexport interface ServerTrackOptions {\n  /** When true, also match/advance a journey (never sampled/shed). Default false. */\n  trigger?: boolean;\n  /** Stable dedup key (e.g. `\"ord-1001\"`) for idempotent conversions. */\n  eventId?: string;\n  eventVersion?: number;\n  occurredAtMs?: number;\n  /** Origin tag. Default `\"xenia-server-sdk\"`. */\n  source?: string;\n  /** Identity fields for this event (except the SDK-owned `xeniaVisitorId`,\n   *  which comes from `config.visitorId` and can't be set per call). */\n  identity?: CallerIdentity;\n  context?: AnalyticsContext;\n  properties?: Record<string, JsonValue | undefined>;\n  consent?: ConsentState;\n}\n\n/**\n * Server-native Xenia client. Same method names as the browser client, but\n * every call is stateless: identity and context are passed explicitly rather\n * than read from the DOM/localStorage. Uses global `fetch` (Node ≥18).\n */\nexport class XeniaServer {\n  readonly api: XeniaApi;\n  /** SDK-owned visitor anchor for this (per-request) client — see {@link XeniaConfig.visitorId}. */\n  private readonly visitorId?: string;\n\n  constructor(config: XeniaConfig) {\n    this.api = new XeniaApi(config);\n    this.visitorId = config.visitorId;\n  }\n\n  /**\n   * Send a unified event server-side (`POST /api/events/v1`) and return the\n   * ingest response (including per-result `triggered`). `opts.trigger: true`\n   * also matches/advances a journey; pass `opts.eventId` (e.g. `\"ord-1001\"`)\n   * as a stable dedup key for idempotent conversions.\n   */\n  async track(\n    eventName: AnalyticsEventName,\n    opts: ServerTrackOptions = {},\n  ): Promise<AnalyticsIngestResponse> {\n    const event: XeniaEvent = {\n      eventName,\n      eventId: opts.eventId ? toEventId(opts.eventId) : generateUlid(),\n      eventVersion: opts.eventVersion ?? 1,\n      occurredAtMs: opts.occurredAtMs ?? Date.now(),\n      source: opts.source ?? \"xenia-server-sdk\",\n      identity: {\n        ...opts.identity,\n        // SDK-owned, set LAST so it can't be overridden per call. Comes from\n        // `config.visitorId` (bind it per request from the `xenia_vid` cookie).\n        xeniaVisitorId: this.visitorId,\n      },\n      context: opts.context,\n      properties: opts.properties,\n      consent: opts.consent,\n      trigger: opts.trigger === true ? true : undefined,\n    };\n    return this.api.sendEvents([event]);\n  }\n\n  /**\n   * Send a webhook request and await the synchronous response. Merges\n   * `opts.identity`/`opts.context` into the payload the same way the browser\n   * client's auto-attached fields do (`path`, `query`, `url`, `referrer`,\n   * `deviceId`, `visitorId`, etc.) — see `ServerWebhookOptions`.\n   */\n  async webhook(\n    triggerId: string,\n    data?: Record<string, JsonValue | undefined>,\n    opts: ServerWebhookOptions = {},\n  ): Promise<WebhookResponse> {\n    const payload = buildEventPayload({\n      eventId: triggerId,\n      journeyId: opts.journeyId,\n      // SDK-owned visitor anchor wins: config.visitorId (bind the `xenia_vid`\n      // cookie per request) is attached automatically. Falls back to a\n      // per-call visitorId only when none is bound.\n      identity: { ...opts.identity, visitorId: this.visitorId ?? opts.identity?.visitorId },\n      context: opts.context,\n      props: data,\n    });\n    return this.api.webhook(triggerId, payload as JsonValue, opts.method ?? \"POST\");\n  }\n\n  /** Bind visitor→user server-side — `POST /api/events/v1/identify`. */\n  async identify(body: IdentifyRequest): Promise<IdentifyResponse> {\n    return this.api.identify(body);\n  }\n\n  /**\n   * Resolve in-entry content personalization for one content key\n   * (`POST /api/personalization/resolve`). Requires a configured SDK token\n   * (`token`/`getToken`) — resolve is auth-required. With `merge: true` the\n   * returned `content` is server-spliced.\n   */\n  async resolve(contentKey: string, opts?: ResolveOptions): Promise<ResolveResult> {\n    return this.api.resolve(contentKey, this.withVisitor(opts));\n  }\n\n  /** Resolve several content keys in one round-trip (`POST /api/personalization/resolve-batch`). */\n  async resolveBatch(\n    items: ResolveBatchItem[],\n    opts?: ResolveOptions,\n  ): Promise<ResolveBatchResult[]> {\n    return this.api.resolveBatch(items, this.withVisitor(opts));\n  }\n\n  /**\n   * Stamp the SDK-owned visitor id (`config.visitorId`) into the resolve `data`\n   * under the reserved `_xenia_vid` key so the backend can bucket holdout\n   * experiments and record exposure per visitor. Set last so a caller can't\n   * override it; a no-op when no `visitorId` was bound on this client.\n   */\n  private withVisitor(opts?: ResolveOptions): ResolveOptions | undefined {\n    if (!this.visitorId) return opts;\n    return { ...opts, data: { ...(opts?.data ?? {}), _xenia_vid: this.visitorId } };\n  }\n}\n\n/** Create a server-native client. */\nexport function createXeniaServer(config: XeniaConfig): XeniaServer {\n  return new XeniaServer(config);\n}\n","import { HttpClient } from \"../core/http-client\";\nimport type { JsonObject } from \"../core/types\";\n\nexport interface RefreshTokenOptions {\n  /** Xenia base URL including `/xenia`. */\n  baseUrl: string;\n  /**\n   * The personalization SDK token created once in the dashboard (API Tokens →\n   * Create token). Stays server-side; the browser never sees it — only the\n   * short-lived token this exchanges it for does.\n   */\n  sdkToken: string;\n  /** Lifetime of the returned token, in minutes. Default 15, capped server-side at 60. */\n  ttlMinutes?: number;\n  timeout?: number;\n}\n\nexport interface RefreshedToken {\n  token: string;\n  expiresAt?: string;\n}\n\n/**\n * Exchange the long-lived personalization SDK token for a short-lived one with\n * the same tenant/env scope, via `POST /api/personalization/token/refresh`.\n * Self-service — no dashboard credential needed, just the SDK token you\n * already have. Call this from your backend and hand the result to the\n * browser (e.g. from a token route the client SDK calls via `getToken`).\n */\nexport async function refreshSdkToken(opts: RefreshTokenOptions): Promise<RefreshedToken> {\n  const http = new HttpClient({ baseUrl: opts.baseUrl, timeout: opts.timeout });\n  const { data } = await http.request({\n    method: \"POST\",\n    path: \"/api/personalization/token/refresh\",\n    headers: { Authorization: `Bearer ${opts.sdkToken}` },\n    body: { ttlMinutes: opts.ttlMinutes ?? null },\n  });\n  const obj = (data ?? {}) as JsonObject;\n  return {\n    token: String(obj.token ?? \"\"),\n    expiresAt: typeof obj.expiresAt === \"string\" ? obj.expiresAt : undefined,\n  };\n}\n\n/**\n * Build a framework-agnostic request handler that hands the browser SDK a\n * personalization token — mount it at the endpoint `getToken` calls. Needs\n * only the SDK token you already created in the dashboard; mints a fresh\n * short-lived token per request so the long-lived one never reaches the\n * browser.\n *\n * @example\n * ```ts\n * export const GET = createTokenRoute({\n *   baseUrl: process.env.XENIA_URL!,\n *   sdkToken: process.env.XENIA_SDK_TOKEN!,\n * });\n * ```\n */\nexport function createTokenRoute(config: RefreshTokenOptions): (request: Request) => Promise<Response> {\n  return async (): Promise<Response> => {\n    try {\n      const refreshed = await refreshSdkToken(config);\n      return new Response(JSON.stringify(refreshed), {\n        status: 200,\n        headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n      });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"token refresh failed\";\n      return new Response(JSON.stringify({ error: message }), {\n        status: 500,\n        headers: { \"Content-Type\": \"application/json\" },\n      });\n    }\n  };\n}\n","import {\n  CONSENT_COOKIE,\n  VISITOR_COOKIE,\n  consentCookieName,\n  visitorCookieName,\n} from \"../core/cookie-names\";\nimport type { ConsentState } from \"../core/types\";\n\n/**\n * Cookie names the SDK reads server-side (set by the browser SDK / your app).\n *\n * The constants are the DEFAULT-prefix names; the functions build the name for any prefix. If you\n * pass `config.prefix` to the browser client, pass the same prefix here — the browser namespaces\n * the cookie by it, so the default name won't be there to find.\n */\nexport { CONSENT_COOKIE, VISITOR_COOKIE, consentCookieName, visitorCookieName };\n\n/**\n * Parse a raw `Cookie` header into a map. Framework-agnostic so it works with\n * `Request.headers.get(\"cookie\")`, Node `req.headers.cookie`, etc.\n */\nexport function parseCookies(header: string | null | undefined): Record<string, string> {\n  const out: Record<string, string> = {};\n  if (!header) return out;\n  for (const part of header.split(\";\")) {\n    const idx = part.indexOf(\"=\");\n    if (idx === -1) continue;\n    const key = part.slice(0, idx).trim();\n    const value = part.slice(idx + 1).trim();\n    if (key) out[key] = decodeURIComponent(value);\n  }\n  return out;\n}\n\n/**\n * Read the visitor id the browser SDK wrote, so a server-side event can be bound to the same\n * visitor (`createXeniaServer({ visitorId })`) and attribute to a browser-entered journey.\n *\n * @param prefix Must match the browser client's `config.prefix`. The cookie is namespaced by it, so\n *               a mismatch finds nothing and quietly leaves the server with no visitor.\n */\nexport function getVisitorId(\n  cookieHeader: string | null | undefined,\n  prefix?: string,\n): string | null {\n  return parseCookies(cookieHeader)[visitorCookieName(prefix)] ?? null;\n}\n\n/**\n * Read consent from a cookie header. Accepts a JSON blob or a comma-list of\n * granted scopes (e.g. `analytics,personalization`). Absent → all denied.\n *\n * @param prefix Must match the browser client's `config.prefix` — see {@link getVisitorId}.\n */\nexport function getConsent(\n  cookieHeader: string | null | undefined,\n  prefix?: string,\n): ConsentState {\n  const raw = parseCookies(cookieHeader)[consentCookieName(prefix)];\n  if (!raw) return { analytics: false, marketing: false, personalization: false };\n  try {\n    const parsed = JSON.parse(raw) as ConsentState;\n    return parsed;\n  } catch {\n    const scopes = new Set(raw.split(\",\").map((s) => s.trim()));\n    return {\n      analytics: scopes.has(\"analytics\"),\n      marketing: scopes.has(\"marketing\"),\n      personalization: scopes.has(\"personalization\"),\n    };\n  }\n}\n"]}
+{"version":3,"sources":["../../src/core/event-payload.ts","../../src/server/xenia-server.ts","../../src/server/token.ts","../../src/server/cookies.ts"],"names":[],"mappings":";;;;AAGA,IAAM,QAAA,uBAAe,GAAA,CAAI;AAAA,EACvB,SAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,aAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAC,CAAA;AAaD,SAAS,QAAQ,GAAA,EAAuE;AACtF,EAAA,MAAM,MAAiC,EAAC;AACxC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AACxC,IAAA,IAAI,CAAA,KAAM,MAAA,EAAW,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EAChC;AACA,EAAA,OAAO,GAAA;AACT;AAWO,SAAS,kBAAkB,KAAA,EAAsC;AACtE,EAAA,MAAM,cAAyC,EAAC;AAChD,EAAA,MAAM,WAAsC,EAAC;AAC7C,EAAA,IAAI,MAAM,KAAA,EAAO;AACf,IAAA,KAAA,MAAW,CAAC,GAAG,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,KAAK,CAAA,EAAG;AAChD,MAAA,IAAI,MAAM,MAAA,EAAW;AAKrB,MAAA,IAAI,SAAS,GAAA,CAAI,CAAC,CAAA,EAAG,QAAA,CAAS,CAAC,CAAA,GAAI,CAAA;AAAA,WAC9B,WAAA,CAAY,CAAC,CAAA,GAAI,CAAA;AAAA,IACxB;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,GAAG,WAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAKH,GAAG,QAAA;AAAA,IACH,GAAG,OAAA,CAAS,KAAA,CAAM,OAAA,IAAW,EAA4C,CAAA;AAAA,IACzE,GAAG,OAAA,CAAS,KAAA,CAAM,QAAA,IAAY,EAA4C,CAAA;AAAA,IAC1E,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,GAAI,MAAM,SAAA,GAAY,EAAE,WAAW,KAAA,CAAM,SAAA,KAAc,EAAC;AAAA,IACxD,GAAI,MAAM,SAAA,GAAY,EAAE,WAAW,KAAA,CAAM,SAAA,KAAc;AAAC,GAC1D;AAEA,EAAA,OAAO,OAAA;AACT;;;ACfO,IAAM,cAAN,MAAkB;AAAA,EACd,GAAA;AAAA;AAAA,EAEQ,SAAA;AAAA,EAEjB,YAAY,MAAA,EAAqB;AAC/B,IAAA,IAAA,CAAK,GAAA,GAAM,IAAI,QAAA,CAAS,MAAM,CAAA;AAC9B,IAAA,IAAA,CAAK,YAAY,MAAA,CAAO,SAAA;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,CACJ,SAAA,EACA,IAAA,GAA2B,EAAC,EACM;AAClC,IAAA,MAAM,KAAA,GAAoB;AAAA,MACxB,SAAA;AAAA,MACA,SAAS,IAAA,CAAK,OAAA,GAAU,UAAU,IAAA,CAAK,OAAO,IAAI,YAAA,EAAa;AAAA,MAC/D,YAAA,EAAc,KAAK,YAAA,IAAgB,CAAA;AAAA,MACnC,YAAA,EAAc,IAAA,CAAK,YAAA,IAAgB,IAAA,CAAK,GAAA,EAAI;AAAA,MAC5C,MAAA,EAAQ,KAAK,MAAA,IAAU,kBAAA;AAAA,MACvB,QAAA,EAAU;AAAA,QACR,GAAG,IAAA,CAAK,QAAA;AAAA;AAAA;AAAA,QAGR,gBAAgB,IAAA,CAAK;AAAA,OACvB;AAAA,MACA,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,OAAA,EAAS,IAAA,CAAK,OAAA,KAAY,IAAA,GAAO,IAAA,GAAO;AAAA,KAC1C;AACA,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,UAAA,CAAW,CAAC,KAAK,CAAC,CAAA;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAA,CACJ,SAAA,EACA,IAAA,EACA,IAAA,GAA6B,EAAC,EACJ;AAC1B,IAAA,MAAM,UAAU,iBAAA,CAAkB;AAAA,MAChC,OAAA,EAAS,SAAA;AAAA,MACT,WAAW,IAAA,CAAK,SAAA;AAAA;AAAA;AAAA;AAAA,MAIhB,QAAA,EAAU,EAAE,GAAG,IAAA,CAAK,QAAA,EAAU,WAAW,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,QAAA,EAAU,SAAA,EAAU;AAAA,MACpF,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,KAAA,EAAO;AAAA,KACR,CAAA;AACD,IAAA,OAAO,KAAK,GAAA,CAAI,OAAA,CAAQ,WAAW,OAAA,EAAsB,IAAA,CAAK,UAAU,MAAM,CAAA;AAAA,EAChF;AAAA;AAAA,EAGA,MAAM,SAAS,IAAA,EAAkD;AAC/D,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,QAAA,CAAS,IAAI,CAAA;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAA,CAAQ,UAAA,EAAoB,IAAA,EAA+C;AAC/E,IAAA,OAAO,KAAK,GAAA,CAAI,OAAA,CAAQ,YAAY,IAAA,CAAK,WAAA,CAAY,IAAI,CAAC,CAAA;AAAA,EAC5D;AAAA;AAAA,EAGA,MAAM,YAAA,CACJ,KAAA,EACA,IAAA,EAC+B;AAC/B,IAAA,OAAO,KAAK,GAAA,CAAI,YAAA,CAAa,OAAO,IAAA,CAAK,WAAA,CAAY,IAAI,CAAC,CAAA;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,YAAY,IAAA,EAAmD;AACrE,IAAA,IAAI,CAAC,IAAA,CAAK,SAAA,EAAW,OAAO,IAAA;AAC5B,IAAA,OAAO,EAAE,GAAG,IAAA,EAAM,IAAA,EAAM,EAAE,GAAI,IAAA,EAAM,IAAA,IAAQ,EAAC,EAAI,UAAA,EAAY,IAAA,CAAK,WAAU,EAAE;AAAA,EAChF;AACF;AAGO,SAAS,kBAAkB,MAAA,EAAkC;AAClE,EAAA,OAAO,IAAI,YAAY,MAAM,CAAA;AAC/B;;;ACvIA,eAAsB,gBAAgB,IAAA,EAAoD;AACxF,EAAA,MAAM,IAAA,GAAO,IAAI,UAAA,CAAW,EAAE,OAAA,EAAS,KAAK,OAAA,EAAS,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,CAAA;AAC5E,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,KAAK,OAAA,CAAQ;AAAA,IAClC,MAAA,EAAQ,MAAA;AAAA,IACR,IAAA,EAAM,oCAAA;AAAA,IACN,SAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,QAAQ,CAAA,CAAA,EAAG;AAAA,IACpD,IAAA,EAAM,EAAE,UAAA,EAAY,IAAA,CAAK,cAAc,IAAA;AAAK,GAC7C,CAAA;AACD,EAAA,MAAM,GAAA,GAAO,QAAQ,EAAC;AACtB,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,KAAA,IAAS,EAAE,CAAA;AAAA,IAC7B,WAAW,OAAO,GAAA,CAAI,SAAA,KAAc,QAAA,GAAW,IAAI,SAAA,GAAY;AAAA,GACjE;AACF;AAiBO,SAAS,iBAAiB,MAAA,EAAsE;AACrG,EAAA,OAAO,YAA+B;AACpC,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAY,MAAM,eAAA,CAAgB,MAAM,CAAA;AAC9C,MAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,SAAS,CAAA,EAAG;AAAA,QAC7C,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,iBAAiB,UAAA;AAAW,OAC5E,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,sBAAA;AACrD,MAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG;AAAA,QACtD,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,OAC/C,CAAA;AAAA,IACH;AAAA,EACF,CAAA;AACF;;;ACzDO,SAAS,aAAa,MAAA,EAA2D;AACtF,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,IAAI,CAAC,QAAQ,OAAO,GAAA;AACpB,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAAG;AACpC,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC5B,IAAA,IAAI,QAAQ,EAAA,EAAI;AAChB,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,EAAE,IAAA,EAAK;AACpC,IAAA,MAAM,QAAQ,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AACvC,IAAA,IAAI,GAAA,EAAK,GAAA,CAAI,GAAG,CAAA,GAAI,mBAAmB,KAAK,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,GAAA;AACT;AASO,SAAS,YAAA,CACd,cACA,MAAA,EACe;AACf,EAAA,OAAO,aAAa,YAAY,CAAA,CAAE,iBAAA,CAAkB,MAAM,CAAC,CAAA,IAAK,IAAA;AAClE;AAQO,SAAS,UAAA,CACd,cACA,MAAA,EACc;AACd,EAAA,MAAM,MAAM,YAAA,CAAa,YAAY,CAAA,CAAE,iBAAA,CAAkB,MAAM,CAAC,CAAA;AAChE,EAAA,IAAI,CAAC,KAAK,OAAO,EAAE,WAAW,KAAA,EAAO,SAAA,EAAW,KAAA,EAAO,eAAA,EAAiB,KAAA,EAAM;AAC9E,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AAC1D,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,WAAW,CAAA;AAAA,MACjC,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,WAAW,CAAA;AAAA,MACjC,eAAA,EAAiB,MAAA,CAAO,GAAA,CAAI,iBAAiB;AAAA,KAC/C;AAAA,EACF;AACF","file":"index.js","sourcesContent":["import type { EventContext, EventIdentity, EventPayload, JsonValue } from \"./types\";\n\n/** Reserved keys that map to first-class fields (not passthrough data). */\nconst RESERVED = new Set([\n  \"eventId\",\n  \"eventType\",\n  \"journeyId\",\n  \"deviceId\",\n  \"visitorId\",\n  \"customerId\",\n  \"email\",\n  \"utmSource\",\n  \"utmMedium\",\n  \"utmCampaign\",\n  \"utmContent\",\n  \"utmId\",\n  \"url\",\n  \"referrer\",\n  \"path\",\n  \"query\",\n]);\n\nexport interface BuildEventInput {\n  eventId: string;\n  eventType?: string;\n  journeyId?: string;\n  identity?: EventIdentity;\n  context?: EventContext;\n  /** Arbitrary extra properties merged as passthrough data. */\n  props?: Record<string, JsonValue | undefined>;\n}\n\n/** Drop `undefined` values so the JSON body stays clean. */\nfunction compact(obj: Record<string, JsonValue | undefined>): Record<string, JsonValue> {\n  const out: Record<string, JsonValue> = {};\n  for (const [k, v] of Object.entries(obj)) {\n    if (v !== undefined) out[k] = v;\n  }\n  return out;\n}\n\n/**\n * Build the request body for the webhook `/flow` call (`XeniaApi.webhook`).\n *\n * Merge order (later wins): passthrough props < context < identity < core.\n * Field names match the backend `EventTriggerRequest` DTO exactly.\n *\n * @internal Used only by the webhook request/response path — the unified event\n * surface (`track()` → `POST /api/events/v1`) builds {@link XeniaEvent} instead.\n */\nexport function buildEventPayload(input: BuildEventInput): EventPayload {\n  const passthrough: Record<string, JsonValue> = {};\n  const reserved: Record<string, JsonValue> = {};\n  if (input.props) {\n    for (const [k, v] of Object.entries(input.props)) {\n      if (v === undefined) continue;\n      // A prop whose key matches a reserved field (e.g. `email`, `customerId`,\n      // `utmSource`) is promoted to that first-class field; everything else is\n      // custom passthrough data. Previously reserved-named props were dropped\n      // outright — so `track(\"sign_up\", { email })` never sent `email` at all.\n      if (RESERVED.has(k)) reserved[k] = v;\n      else passthrough[k] = v;\n    }\n  }\n\n  const payload = {\n    ...passthrough,\n    // Reserved-named props fill first-class fields (e.g. `email`, `customerId`)\n    // the SDK didn't auto-collect. Auto-collected context/identity still win for\n    // what they reliably know (real page url, visitor/device id), so a stray prop\n    // can't override the true page context — see merge order below.\n    ...reserved,\n    ...compact((input.context ?? {}) as Record<string, JsonValue | undefined>),\n    ...compact((input.identity ?? {}) as Record<string, JsonValue | undefined>),\n    eventId: input.eventId,\n    ...(input.eventType ? { eventType: input.eventType } : {}),\n    ...(input.journeyId ? { journeyId: input.journeyId } : {}),\n  };\n\n  return payload as EventPayload;\n}\n","import { XeniaApi } from \"../core/api\";\nimport { buildEventPayload } from \"../core/event-payload\";\nimport { generateUlid, toEventId } from \"../core/id\";\nimport type {\n  AnalyticsContext,\n  AnalyticsEventName,\n  CallerIdentity,\n  AnalyticsIngestResponse,\n  ConsentState,\n  EventContext,\n  EventIdentity,\n  IdentifyRequest,\n  IdentifyResponse,\n  JsonValue,\n  ResolveBatchItem,\n  ResolveBatchResult,\n  ResolveOptions,\n  ResolveResult,\n  WebhookResponse,\n  XeniaConfig,\n  XeniaEvent,\n} from \"../core/types\";\n\n/**\n * Extra per-call identity/context for server-side webhook calls. There's no\n * ambient `window` on the server to auto-collect `path`/`query`/`url`/UTM\n * params the way the browser client does — pass whatever's known at the call\n * site (e.g. the current request's pathname from Next.js `headers()`/route\n * params) via `context`, and `deviceId`/`visitorId`/etc. via `identity`.\n */\nexport interface ServerWebhookOptions {\n  method?: \"GET\" | \"POST\";\n  journeyId?: string;\n  identity?: EventIdentity;\n  context?: EventContext;\n}\n\n/**\n * Options for a server-side unified event (`POST /api/events/v1`). There's no\n * ambient request context on the server — pass whatever's known at the call\n * site (e.g. pathname/user-agent from the current request, session id from a\n * cookie) via `identity`/`context`.\n */\nexport interface ServerTrackOptions {\n  /** When true, also match/advance a journey (never sampled/shed). Default false. */\n  trigger?: boolean;\n  /** Stable dedup key (e.g. `\"ord-1001\"`) for idempotent conversions. */\n  eventId?: string;\n  eventVersion?: number;\n  occurredAtMs?: number;\n  /** Origin tag. Default `\"xenia-server-sdk\"`. */\n  source?: string;\n  /** Identity fields for this event (except the SDK-owned `xeniaVisitorId`,\n   *  which comes from `config.visitorId` and can't be set per call). */\n  identity?: CallerIdentity;\n  context?: AnalyticsContext;\n  properties?: Record<string, JsonValue | undefined>;\n  consent?: ConsentState;\n}\n\n/**\n * Server-native Xenia client. Same method names as the browser client, but\n * every call is stateless: identity and context are passed explicitly rather\n * than read from the DOM/localStorage. Uses global `fetch` (Node ≥18).\n */\nexport class XeniaServer {\n  readonly api: XeniaApi;\n  /** SDK-owned visitor anchor for this (per-request) client — see {@link XeniaConfig.visitorId}. */\n  private readonly visitorId?: string;\n\n  constructor(config: XeniaConfig) {\n    this.api = new XeniaApi(config);\n    this.visitorId = config.visitorId;\n  }\n\n  /**\n   * Send a unified event server-side (`POST /api/events/v1`) and return the\n   * ingest response (including per-result `triggered`). `opts.trigger: true`\n   * also matches/advances a journey; pass `opts.eventId` (e.g. `\"ord-1001\"`)\n   * as a stable dedup key for idempotent conversions.\n   */\n  async track(\n    eventName: AnalyticsEventName,\n    opts: ServerTrackOptions = {},\n  ): Promise<AnalyticsIngestResponse> {\n    const event: XeniaEvent = {\n      eventName,\n      eventId: opts.eventId ? toEventId(opts.eventId) : generateUlid(),\n      eventVersion: opts.eventVersion ?? 1,\n      occurredAtMs: opts.occurredAtMs ?? Date.now(),\n      source: opts.source ?? \"xenia-server-sdk\",\n      identity: {\n        ...opts.identity,\n        // SDK-owned, set LAST so it can't be overridden per call. Comes from\n        // `config.visitorId` (bind it per request from the `xenia_vid` cookie).\n        xeniaVisitorId: this.visitorId,\n      },\n      context: opts.context,\n      properties: opts.properties,\n      consent: opts.consent,\n      trigger: opts.trigger === true ? true : undefined,\n    };\n    return this.api.sendEvents([event]);\n  }\n\n  /**\n   * Send a webhook request and await the synchronous response. Merges\n   * `opts.identity`/`opts.context` into the payload the same way the browser\n   * client's auto-attached fields do (`path`, `query`, `url`, `referrer`,\n   * `deviceId`, `visitorId`, etc.) — see `ServerWebhookOptions`.\n   */\n  async webhook(\n    triggerId: string,\n    data?: Record<string, JsonValue | undefined>,\n    opts: ServerWebhookOptions = {},\n  ): Promise<WebhookResponse> {\n    const payload = buildEventPayload({\n      eventId: triggerId,\n      journeyId: opts.journeyId,\n      // SDK-owned visitor anchor wins: config.visitorId (bind the `xenia_vid`\n      // cookie per request) is attached automatically. Falls back to a\n      // per-call visitorId only when none is bound.\n      identity: { ...opts.identity, visitorId: this.visitorId ?? opts.identity?.visitorId },\n      context: opts.context,\n      props: data,\n    });\n    return this.api.webhook(triggerId, payload as JsonValue, opts.method ?? \"POST\");\n  }\n\n  /** Bind visitor→user server-side — `POST /api/events/v1/identify`. */\n  async identify(body: IdentifyRequest): Promise<IdentifyResponse> {\n    return this.api.identify(body);\n  }\n\n  /**\n   * Resolve in-entry content personalization for one content key\n   * (`POST /api/personalization/resolve`). Requires a configured SDK token\n   * (`token`/`getToken`) — resolve is auth-required. With `merge: true` the\n   * returned `content` is server-spliced.\n   */\n  async resolve(contentKey: string, opts?: ResolveOptions): Promise<ResolveResult> {\n    return this.api.resolve(contentKey, this.withVisitor(opts));\n  }\n\n  /** Resolve several content keys in one round-trip (`POST /api/personalization/resolve-batch`). */\n  async resolveBatch(\n    items: ResolveBatchItem[],\n    opts?: ResolveOptions,\n  ): Promise<ResolveBatchResult[]> {\n    return this.api.resolveBatch(items, this.withVisitor(opts));\n  }\n\n  /**\n   * Stamp the SDK-owned visitor id (`config.visitorId`) into the resolve `data`\n   * under the reserved `_xenia_vid` key so the backend can bucket holdout\n   * experiments and record exposure per visitor. Set last so a caller can't\n   * override it; a no-op when no `visitorId` was bound on this client.\n   */\n  private withVisitor(opts?: ResolveOptions): ResolveOptions | undefined {\n    if (!this.visitorId) return opts;\n    return { ...opts, data: { ...(opts?.data ?? {}), _xenia_vid: this.visitorId } };\n  }\n}\n\n/** Create a server-native client. */\nexport function createXeniaServer(config: XeniaConfig): XeniaServer {\n  return new XeniaServer(config);\n}\n","import { HttpClient } from \"../core/http-client\";\nimport type { JsonObject } from \"../core/types\";\n\nexport interface RefreshTokenOptions {\n  /**\n   * Xenia base URL. Defaults to the hosted engine,\n   * `https://engine.xeniamartech.com/xenia` — omit unless self-hosting.\n   */\n  baseUrl?: string;\n  /**\n   * The personalization SDK token created once in the dashboard (API Tokens →\n   * Create token). Stays server-side; the browser never sees it — only the\n   * short-lived token this exchanges it for does.\n   */\n  sdkToken: string;\n  /** Lifetime of the returned token, in minutes. Default 15, capped server-side at 60. */\n  ttlMinutes?: number;\n  timeout?: number;\n}\n\nexport interface RefreshedToken {\n  token: string;\n  expiresAt?: string;\n}\n\n/**\n * Exchange the long-lived personalization SDK token for a short-lived one with\n * the same tenant/env scope, via `POST /api/personalization/token/refresh`.\n * Self-service — no dashboard credential needed, just the SDK token you\n * already have. Call this from your backend and hand the result to the\n * browser (e.g. from a token route the client SDK calls via `getToken`).\n */\nexport async function refreshSdkToken(opts: RefreshTokenOptions): Promise<RefreshedToken> {\n  const http = new HttpClient({ baseUrl: opts.baseUrl, timeout: opts.timeout });\n  const { data } = await http.request({\n    method: \"POST\",\n    path: \"/api/personalization/token/refresh\",\n    headers: { Authorization: `Bearer ${opts.sdkToken}` },\n    body: { ttlMinutes: opts.ttlMinutes ?? null },\n  });\n  const obj = (data ?? {}) as JsonObject;\n  return {\n    token: String(obj.token ?? \"\"),\n    expiresAt: typeof obj.expiresAt === \"string\" ? obj.expiresAt : undefined,\n  };\n}\n\n/**\n * Build a framework-agnostic request handler that hands the browser SDK a\n * personalization token — mount it at the endpoint `getToken` calls. Needs\n * only the SDK token you already created in the dashboard; mints a fresh\n * short-lived token per request so the long-lived one never reaches the\n * browser.\n *\n * @example\n * ```ts\n * export const GET = createTokenRoute({\n *   sdkToken: process.env.XENIA_SDK_TOKEN!,\n *   // baseUrl: process.env.XENIA_URL, // only to override the default hosted engine\n * });\n * ```\n */\nexport function createTokenRoute(config: RefreshTokenOptions): (request: Request) => Promise<Response> {\n  return async (): Promise<Response> => {\n    try {\n      const refreshed = await refreshSdkToken(config);\n      return new Response(JSON.stringify(refreshed), {\n        status: 200,\n        headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n      });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"token refresh failed\";\n      return new Response(JSON.stringify({ error: message }), {\n        status: 500,\n        headers: { \"Content-Type\": \"application/json\" },\n      });\n    }\n  };\n}\n","import {\n  CONSENT_COOKIE,\n  VISITOR_COOKIE,\n  consentCookieName,\n  visitorCookieName,\n} from \"../core/cookie-names\";\nimport type { ConsentState } from \"../core/types\";\n\n/**\n * Cookie names the SDK reads server-side (set by the browser SDK / your app).\n *\n * The constants are the DEFAULT-prefix names; the functions build the name for any prefix. If you\n * pass `config.prefix` to the browser client, pass the same prefix here — the browser namespaces\n * the cookie by it, so the default name won't be there to find.\n */\nexport { CONSENT_COOKIE, VISITOR_COOKIE, consentCookieName, visitorCookieName };\n\n/**\n * Parse a raw `Cookie` header into a map. Framework-agnostic so it works with\n * `Request.headers.get(\"cookie\")`, Node `req.headers.cookie`, etc.\n */\nexport function parseCookies(header: string | null | undefined): Record<string, string> {\n  const out: Record<string, string> = {};\n  if (!header) return out;\n  for (const part of header.split(\";\")) {\n    const idx = part.indexOf(\"=\");\n    if (idx === -1) continue;\n    const key = part.slice(0, idx).trim();\n    const value = part.slice(idx + 1).trim();\n    if (key) out[key] = decodeURIComponent(value);\n  }\n  return out;\n}\n\n/**\n * Read the visitor id the browser SDK wrote, so a server-side event can be bound to the same\n * visitor (`createXeniaServer({ visitorId })`) and attribute to a browser-entered journey.\n *\n * @param prefix Must match the browser client's `config.prefix`. The cookie is namespaced by it, so\n *               a mismatch finds nothing and quietly leaves the server with no visitor.\n */\nexport function getVisitorId(\n  cookieHeader: string | null | undefined,\n  prefix?: string,\n): string | null {\n  return parseCookies(cookieHeader)[visitorCookieName(prefix)] ?? null;\n}\n\n/**\n * Read consent from a cookie header. Accepts a JSON blob or a comma-list of\n * granted scopes (e.g. `analytics,personalization`). Absent → all denied.\n *\n * @param prefix Must match the browser client's `config.prefix` — see {@link getVisitorId}.\n */\nexport function getConsent(\n  cookieHeader: string | null | undefined,\n  prefix?: string,\n): ConsentState {\n  const raw = parseCookies(cookieHeader)[consentCookieName(prefix)];\n  if (!raw) return { analytics: false, marketing: false, personalization: false };\n  try {\n    const parsed = JSON.parse(raw) as ConsentState;\n    return parsed;\n  } catch {\n    const scopes = new Set(raw.split(\",\").map((s) => s.trim()));\n    return {\n      analytics: scopes.has(\"analytics\"),\n      marketing: scopes.has(\"marketing\"),\n      personalization: scopes.has(\"personalization\"),\n    };\n  }\n}\n"]}