@xenia-martech/sdk-js 1.0.0-dev.25 → 1.0.0-dev.27

package/dist/{cookie-names-BQ-L04A8.d.cts → cookie-names-C3LKDhsg.d.cts}

@@ -46,15 +46,16 @@ interface RetryConfig {
 /**
  * Root configuration shared by client and server runtimes.
  *
- * Developers supply the minimum: `baseUrl` + tenant scope. Everything else
- * (identity, UTM, journey attribution, device id) is handled by the SDK.
+ * Developers supply the minimum: tenant scope. Everything else (identity,
+ * UTM, journey attribution, device id) is handled by the SDK.
  */
 interface XeniaConfig {
     /**
-     * Base URL of the Xenia backend, e.g. `https://app.example.com/xenia` or
-     * `/xenia` when same-origin (the FE proxies `/xenia/*`). No trailing slash.
+     * Base URL of the Xenia backend. Defaults to the hosted engine,
+     * `https://engine.xeniamartech.com/xenia` — omit this unless you're
+     * pointing at a self-hosted or non-default environment.
      */
-    baseUrl: string;
+    baseUrl?: string;
     /** Tenant id — sent as `X-Tenant-Id` on header-scoped endpoints. */
     tenantId: string;
     /** Environment key — sent as `X-Environment` on header-scoped endpoints. */
@@ -85,6 +86,23 @@ interface XeniaConfig {
      *   cookie read via `getVisitorId()`.
      */
     visitorId?: string;
+    /**
+     * The ambient request context for a **server** client — the SDK-provided page/campaign fields
+     * (`path`, `query`, `url`, `referrer`, `utmSource`/`utmMedium`/`utmCampaign`/`utmContent`/`utmId`)
+     * that get attached to EVERY `resolve()`/`resolveBatch()`/`webhook()` made with this client, so
+     * journey rules can gate on `query.<name>` or `path` without any per-call wiring.
+     *
+     * The browser client needs nothing here — it reads these off `window.location` itself. A server
+     * runtime has no ambient request, so bind it once when constructing the per-request client:
+     *
+     * ```ts
+     * createXeniaServer({ …, context: contextFromUrl(currentUrl, referrer) })
+     * ```
+     *
+     * Lowest precedence: a per-call `context`/`identity` overrides it, and the SDK-owned `visitorId`
+     * still wins over everything.
+     */
+    context?: EventContext;
     /**
      * Persist the SDK visitor id to a first-party `xenia_vid` cookie so your
      * **same-origin** server can read it (`getVisitorId(cookieHeader)`) and bind
@@ -303,6 +321,23 @@ interface ResolveOptions {
     locale?: string;
     /** When true, ask the server to splice and return `content`. */
     merge?: boolean;
+    /**
+     * Caller-supplied identity fields (`deviceId`/`visitorId`/`customerId`/
+     * `email`), merged into `data` the same way `ServerWebhookOptions.identity`
+     * is merged for `webhook()`. Only relevant server-side — the browser client
+     * collects these ambiently instead and ignores this field. The SDK-owned
+     * `visitorId` (from `config.visitorId`) still wins over a value supplied
+     * here, same precedence as `webhook()`.
+     */
+    identity?: EventIdentity;
+    /**
+     * Caller-supplied page context (`path`/`query`/`url`/`referrer`/`utm*`),
+     * merged into `data` the same way `ServerWebhookOptions.context` is merged
+     * for `webhook()`. There's no ambient `window`/`document` server-side, so a
+     * server caller who wants these SDK-provided fields on a resolve() call
+     * must pass them explicitly (e.g. from the current request's headers).
+     */
+    context?: EventContext;
 }
 /** Body posted to `POST /api/events/v1/identify` — binds visitor to a known user. */
 interface IdentifyRequest {
@@ -389,7 +424,8 @@ type XeniaAction = {
 /**
  * Low-level, isomorphic Xenia API client. Wraps the raw endpoints; identity,
  * UTM capture, and action rendering are layered on top by the client runtime.
- * All paths are relative to `baseUrl` (which already includes `/xenia`).
+ * All paths are relative to `baseUrl`, which defaults to the hosted engine
+ * (`https://engine.xeniamartech.com/xenia`) when omitted from config.
  */
 declare class XeniaApi {
     private readonly http;

package/dist/{cookie-names-BQ-L04A8.d.ts → cookie-names-C3LKDhsg.d.ts}

@@ -46,15 +46,16 @@ interface RetryConfig {
 /**
  * Root configuration shared by client and server runtimes.
  *
- * Developers supply the minimum: `baseUrl` + tenant scope. Everything else
- * (identity, UTM, journey attribution, device id) is handled by the SDK.
+ * Developers supply the minimum: tenant scope. Everything else (identity,
+ * UTM, journey attribution, device id) is handled by the SDK.
  */
 interface XeniaConfig {
     /**
-     * Base URL of the Xenia backend, e.g. `https://app.example.com/xenia` or
-     * `/xenia` when same-origin (the FE proxies `/xenia/*`). No trailing slash.
+     * Base URL of the Xenia backend. Defaults to the hosted engine,
+     * `https://engine.xeniamartech.com/xenia` — omit this unless you're
+     * pointing at a self-hosted or non-default environment.
      */
-    baseUrl: string;
+    baseUrl?: string;
     /** Tenant id — sent as `X-Tenant-Id` on header-scoped endpoints. */
     tenantId: string;
     /** Environment key — sent as `X-Environment` on header-scoped endpoints. */
@@ -85,6 +86,23 @@ interface XeniaConfig {
      *   cookie read via `getVisitorId()`.
      */
     visitorId?: string;
+    /**
+     * The ambient request context for a **server** client — the SDK-provided page/campaign fields
+     * (`path`, `query`, `url`, `referrer`, `utmSource`/`utmMedium`/`utmCampaign`/`utmContent`/`utmId`)
+     * that get attached to EVERY `resolve()`/`resolveBatch()`/`webhook()` made with this client, so
+     * journey rules can gate on `query.<name>` or `path` without any per-call wiring.
+     *
+     * The browser client needs nothing here — it reads these off `window.location` itself. A server
+     * runtime has no ambient request, so bind it once when constructing the per-request client:
+     *
+     * ```ts
+     * createXeniaServer({ …, context: contextFromUrl(currentUrl, referrer) })
+     * ```
+     *
+     * Lowest precedence: a per-call `context`/`identity` overrides it, and the SDK-owned `visitorId`
+     * still wins over everything.
+     */
+    context?: EventContext;
     /**
      * Persist the SDK visitor id to a first-party `xenia_vid` cookie so your
      * **same-origin** server can read it (`getVisitorId(cookieHeader)`) and bind
@@ -303,6 +321,23 @@ interface ResolveOptions {
     locale?: string;
     /** When true, ask the server to splice and return `content`. */
     merge?: boolean;
+    /**
+     * Caller-supplied identity fields (`deviceId`/`visitorId`/`customerId`/
+     * `email`), merged into `data` the same way `ServerWebhookOptions.identity`
+     * is merged for `webhook()`. Only relevant server-side — the browser client
+     * collects these ambiently instead and ignores this field. The SDK-owned
+     * `visitorId` (from `config.visitorId`) still wins over a value supplied
+     * here, same precedence as `webhook()`.
+     */
+    identity?: EventIdentity;
+    /**
+     * Caller-supplied page context (`path`/`query`/`url`/`referrer`/`utm*`),
+     * merged into `data` the same way `ServerWebhookOptions.context` is merged
+     * for `webhook()`. There's no ambient `window`/`document` server-side, so a
+     * server caller who wants these SDK-provided fields on a resolve() call
+     * must pass them explicitly (e.g. from the current request's headers).
+     */
+    context?: EventContext;
 }
 /** Body posted to `POST /api/events/v1/identify` — binds visitor to a known user. */
 interface IdentifyRequest {
@@ -389,7 +424,8 @@ type XeniaAction = {
 /**
  * Low-level, isomorphic Xenia API client. Wraps the raw endpoints; identity,
  * UTM capture, and action rendering are layered on top by the client runtime.
- * All paths are relative to `baseUrl` (which already includes `/xenia`).
+ * All paths are relative to `baseUrl`, which defaults to the hosted engine
+ * (`https://engine.xeniamartech.com/xenia`) when omitted from config.
  */
 declare class XeniaApi {
     private readonly http;

package/dist/index.cjs

@@ -1,80 +1,84 @@
 'use strict';
 
-var chunkJEFNAD5J_cjs = require('./chunk-JEFNAD5J.cjs');
+var chunkUOW3GK4I_cjs = require('./chunk-UOW3GK4I.cjs');
 
 
 
 Object.defineProperty(exports, "CONSENT_COOKIE", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.CONSENT_COOKIE; }
+  get: function () { return chunkUOW3GK4I_cjs.CONSENT_COOKIE; }
 });
 Object.defineProperty(exports, "DEFAULT_PREFIX", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.DEFAULT_PREFIX; }
+  get: function () { return chunkUOW3GK4I_cjs.DEFAULT_PREFIX; }
 });
 Object.defineProperty(exports, "HttpClient", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.HttpClient; }
+  get: function () { return chunkUOW3GK4I_cjs.HttpClient; }
 });
 Object.defineProperty(exports, "HttpError", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.HttpError; }
+  get: function () { return chunkUOW3GK4I_cjs.HttpError; }
 });
 Object.defineProperty(exports, "LocalStorageResponseStore", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.LocalStorageResponseStore; }
+  get: function () { return chunkUOW3GK4I_cjs.LocalStorageResponseStore; }
 });
 Object.defineProperty(exports, "MAX_EVENT_ID_LENGTH", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.MAX_EVENT_ID_LENGTH; }
+  get: function () { return chunkUOW3GK4I_cjs.MAX_EVENT_ID_LENGTH; }
 });
 Object.defineProperty(exports, "MemoryResponseStore", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.MemoryResponseStore; }
+  get: function () { return chunkUOW3GK4I_cjs.MemoryResponseStore; }
 });
 Object.defineProperty(exports, "VISITOR_COOKIE", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.VISITOR_COOKIE; }
+  get: function () { return chunkUOW3GK4I_cjs.VISITOR_COOKIE; }
 });
 Object.defineProperty(exports, "XeniaApi", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.XeniaApi; }
+  get: function () { return chunkUOW3GK4I_cjs.XeniaApi; }
 });
 Object.defineProperty(exports, "buildUrl", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.buildUrl; }
+  get: function () { return chunkUOW3GK4I_cjs.buildUrl; }
 });
 Object.defineProperty(exports, "consentCookieName", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.consentCookieName; }
+  get: function () { return chunkUOW3GK4I_cjs.consentCookieName; }
+});
+Object.defineProperty(exports, "contextFromUrl", {
+  enumerable: true,
+  get: function () { return chunkUOW3GK4I_cjs.contextFromUrl; }
 });
 Object.defineProperty(exports, "extractContentSwaps", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.extractContentSwaps; }
+  get: function () { return chunkUOW3GK4I_cjs.extractContentSwaps; }
 });
 Object.defineProperty(exports, "generateUlid", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.generateUlid; }
+  get: function () { return chunkUOW3GK4I_cjs.generateUlid; }
 });
 Object.defineProperty(exports, "isBrowser", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.isBrowser; }
+  get: function () { return chunkUOW3GK4I_cjs.isBrowser; }
 });
 Object.defineProperty(exports, "parseActions", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.parseActions; }
+  get: function () { return chunkUOW3GK4I_cjs.parseActions; }
 });
 Object.defineProperty(exports, "spliceSlots", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.spliceSlots; }
+  get: function () { return chunkUOW3GK4I_cjs.spliceSlots; }
 });
 Object.defineProperty(exports, "toEventId", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.toEventId; }
+  get: function () { return chunkUOW3GK4I_cjs.toEventId; }
 });
 Object.defineProperty(exports, "visitorCookieName", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.visitorCookieName; }
+  get: function () { return chunkUOW3GK4I_cjs.visitorCookieName; }
 });
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { R as RetryConfig, H as HttpMethod, J as JsonValue, W as WebhookResponse } from './cookie-names-BQ-L04A8.cjs';
-export { A as AnalyticsContext, a as AnalyticsEventName, b as AnalyticsIdentity, c as AnalyticsIngestResponse, C as CONSENT_COOKIE, d as ConsentState, D as DEFAULT_PREFIX, E as EventContext, e as EventIdentity, I as IdentifyRequest, f as IdentifyResponse, g as InteractionType, h as JsonObject, M as MessageCta, i as MessagePlacement, P as PersonalizationSwap, j as ResolveBatchItem, k as ResolveBatchResult, l as ResolveOptions, m as ResolveResult, T as TrackOptions, V as VISITOR_COOKIE, X as XeniaAction, n as XeniaApi, o as XeniaConfig, p as XeniaEvent, q as consentCookieName, r as parseActions, v as visitorCookieName } from './cookie-names-BQ-L04A8.cjs';
+import { R as RetryConfig, H as HttpMethod, J as JsonValue, E as EventContext, W as WebhookResponse } from './cookie-names-C3LKDhsg.cjs';
+export { A as AnalyticsContext, a as AnalyticsEventName, b as AnalyticsIdentity, c as AnalyticsIngestResponse, C as CONSENT_COOKIE, d as ConsentState, D as DEFAULT_PREFIX, e as EventIdentity, I as IdentifyRequest, f as IdentifyResponse, g as InteractionType, h as JsonObject, M as MessageCta, i as MessagePlacement, P as PersonalizationSwap, j as ResolveBatchItem, k as ResolveBatchResult, l as ResolveOptions, m as ResolveResult, T as TrackOptions, V as VISITOR_COOKIE, X as XeniaAction, n as XeniaApi, o as XeniaConfig, p as XeniaEvent, q as consentCookieName, r as parseActions, v as visitorCookieName } from './cookie-names-C3LKDhsg.cjs';
 
 /** Returns true when running in a browser environment (SSR-safe). */
 declare function isBrowser(): boolean;
@@ -38,7 +38,8 @@ declare class HttpError extends Error {
     constructor(status: number, data: JsonValue, message?: string);
 }
 interface HttpClientOptions {
-    baseUrl: string;
+    /** Defaults to {@link DEFAULT_BASE_URL} when omitted. */
+    baseUrl?: string;
     defaultHeaders?: Record<string, string>;
     timeout?: number;
     retry?: RetryConfig;
@@ -120,6 +121,26 @@ declare function spliceSlots(slots: Record<string, JsonValue>, swaps: ContentSwa
 /** Extract `xeniaContentSwaps` from a webhook-response body, if present and well-formed. */
 declare function extractContentSwaps(body: JsonValue): ContentSwap[] | undefined;
 
+/**
+ * Derive the SDK-provided page/campaign fields from a URL — the server-side counterpart to the
+ * browser client's `Identity.collectContext()`, which reads the same fields off `window.location`.
+ *
+ * Exists because a server runtime has no ambient `window`: a Node client is constructed per request,
+ * so the one thing it needs handed over is the URL being served. Everything a journey rule can
+ * reference — `path`, `query.<name>`, `url`, `referrer`, `utmSource`/`utmMedium`/`utmCampaign`/
+ * `utmContent`/`utmId` — is derived here rather than by each app, so a server-rendered page gets the
+ * same field set a browser page does without hand-rolling UTM parsing at every call site.
+ *
+ * Field names and semantics deliberately mirror `collectContext()` exactly: `query` is the flattened
+ * search params, UTMs come from the standard `utm_*` params, and absent values are omitted rather
+ * than set to `""` (a blank string is a value a condition could accidentally match).
+ *
+ * @param url Absolute URL of the request being served (e.g. `https://shop.example/product/x?ref=a`).
+ *            A relative or unparseable value yields an empty context rather than throwing.
+ * @param referrer Optional referring URL, typically the request's `Referer` header.
+ */
+declare function contextFromUrl(url: string | null | undefined, referrer?: string | null): EventContext;
+
 /**
  * Persists webhook responses the SDK receives, keyed by an arbitrary string
  * (typically the eventId, triggerId, or journeyId). Lets the app read back the
@@ -154,4 +175,4 @@ declare class LocalStorageResponseStore implements ResponseStore {
     clear(): void;
 }
 
-export { type ContentSwap, HttpClient, type HttpClientOptions, HttpError, HttpMethod, type HttpResult, JsonValue, LocalStorageResponseStore, MAX_EVENT_ID_LENGTH, MemoryResponseStore, type RequestOptions, type ResponseStore, RetryConfig, WebhookResponse, buildUrl, extractContentSwaps, generateUlid, isBrowser, spliceSlots, toEventId };
+export { type ContentSwap, EventContext, HttpClient, type HttpClientOptions, HttpError, HttpMethod, type HttpResult, JsonValue, LocalStorageResponseStore, MAX_EVENT_ID_LENGTH, MemoryResponseStore, type RequestOptions, type ResponseStore, RetryConfig, WebhookResponse, buildUrl, contextFromUrl, extractContentSwaps, generateUlid, isBrowser, spliceSlots, toEventId };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { R as RetryConfig, H as HttpMethod, J as JsonValue, W as WebhookResponse } from './cookie-names-BQ-L04A8.js';
-export { A as AnalyticsContext, a as AnalyticsEventName, b as AnalyticsIdentity, c as AnalyticsIngestResponse, C as CONSENT_COOKIE, d as ConsentState, D as DEFAULT_PREFIX, E as EventContext, e as EventIdentity, I as IdentifyRequest, f as IdentifyResponse, g as InteractionType, h as JsonObject, M as MessageCta, i as MessagePlacement, P as PersonalizationSwap, j as ResolveBatchItem, k as ResolveBatchResult, l as ResolveOptions, m as ResolveResult, T as TrackOptions, V as VISITOR_COOKIE, X as XeniaAction, n as XeniaApi, o as XeniaConfig, p as XeniaEvent, q as consentCookieName, r as parseActions, v as visitorCookieName } from './cookie-names-BQ-L04A8.js';
+import { R as RetryConfig, H as HttpMethod, J as JsonValue, E as EventContext, W as WebhookResponse } from './cookie-names-C3LKDhsg.js';
+export { A as AnalyticsContext, a as AnalyticsEventName, b as AnalyticsIdentity, c as AnalyticsIngestResponse, C as CONSENT_COOKIE, d as ConsentState, D as DEFAULT_PREFIX, e as EventIdentity, I as IdentifyRequest, f as IdentifyResponse, g as InteractionType, h as JsonObject, M as MessageCta, i as MessagePlacement, P as PersonalizationSwap, j as ResolveBatchItem, k as ResolveBatchResult, l as ResolveOptions, m as ResolveResult, T as TrackOptions, V as VISITOR_COOKIE, X as XeniaAction, n as XeniaApi, o as XeniaConfig, p as XeniaEvent, q as consentCookieName, r as parseActions, v as visitorCookieName } from './cookie-names-C3LKDhsg.js';
 
 /** Returns true when running in a browser environment (SSR-safe). */
 declare function isBrowser(): boolean;
@@ -38,7 +38,8 @@ declare class HttpError extends Error {
     constructor(status: number, data: JsonValue, message?: string);
 }
 interface HttpClientOptions {
-    baseUrl: string;
+    /** Defaults to {@link DEFAULT_BASE_URL} when omitted. */
+    baseUrl?: string;
     defaultHeaders?: Record<string, string>;
     timeout?: number;
     retry?: RetryConfig;
@@ -120,6 +121,26 @@ declare function spliceSlots(slots: Record<string, JsonValue>, swaps: ContentSwa
 /** Extract `xeniaContentSwaps` from a webhook-response body, if present and well-formed. */
 declare function extractContentSwaps(body: JsonValue): ContentSwap[] | undefined;
 
+/**
+ * Derive the SDK-provided page/campaign fields from a URL — the server-side counterpart to the
+ * browser client's `Identity.collectContext()`, which reads the same fields off `window.location`.
+ *
+ * Exists because a server runtime has no ambient `window`: a Node client is constructed per request,
+ * so the one thing it needs handed over is the URL being served. Everything a journey rule can
+ * reference — `path`, `query.<name>`, `url`, `referrer`, `utmSource`/`utmMedium`/`utmCampaign`/
+ * `utmContent`/`utmId` — is derived here rather than by each app, so a server-rendered page gets the
+ * same field set a browser page does without hand-rolling UTM parsing at every call site.
+ *
+ * Field names and semantics deliberately mirror `collectContext()` exactly: `query` is the flattened
+ * search params, UTMs come from the standard `utm_*` params, and absent values are omitted rather
+ * than set to `""` (a blank string is a value a condition could accidentally match).
+ *
+ * @param url Absolute URL of the request being served (e.g. `https://shop.example/product/x?ref=a`).
+ *            A relative or unparseable value yields an empty context rather than throwing.
+ * @param referrer Optional referring URL, typically the request's `Referer` header.
+ */
+declare function contextFromUrl(url: string | null | undefined, referrer?: string | null): EventContext;
+
 /**
  * Persists webhook responses the SDK receives, keyed by an arbitrary string
  * (typically the eventId, triggerId, or journeyId). Lets the app read back the
@@ -154,4 +175,4 @@ declare class LocalStorageResponseStore implements ResponseStore {
     clear(): void;
 }
 
-export { type ContentSwap, HttpClient, type HttpClientOptions, HttpError, HttpMethod, type HttpResult, JsonValue, LocalStorageResponseStore, MAX_EVENT_ID_LENGTH, MemoryResponseStore, type RequestOptions, type ResponseStore, RetryConfig, WebhookResponse, buildUrl, extractContentSwaps, generateUlid, isBrowser, spliceSlots, toEventId };
+export { type ContentSwap, EventContext, HttpClient, type HttpClientOptions, HttpError, HttpMethod, type HttpResult, JsonValue, LocalStorageResponseStore, MAX_EVENT_ID_LENGTH, MemoryResponseStore, type RequestOptions, type ResponseStore, RetryConfig, WebhookResponse, buildUrl, contextFromUrl, extractContentSwaps, generateUlid, isBrowser, spliceSlots, toEventId };

package/dist/index.js

@@ -1,3 +1,3 @@
-export { CONSENT_COOKIE, DEFAULT_PREFIX, HttpClient, HttpError, LocalStorageResponseStore, MAX_EVENT_ID_LENGTH, MemoryResponseStore, VISITOR_COOKIE, XeniaApi, buildUrl, consentCookieName, extractContentSwaps, generateUlid, isBrowser, parseActions, spliceSlots, toEventId, visitorCookieName } from './chunk-PTYUK4P3.js';
+export { CONSENT_COOKIE, DEFAULT_PREFIX, HttpClient, HttpError, LocalStorageResponseStore, MAX_EVENT_ID_LENGTH, MemoryResponseStore, VISITOR_COOKIE, XeniaApi, buildUrl, consentCookieName, contextFromUrl, extractContentSwaps, generateUlid, isBrowser, parseActions, spliceSlots, toEventId, visitorCookieName } from './chunk-7D2HJMW6.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/server/index.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkJEFNAD5J_cjs = require('../chunk-JEFNAD5J.cjs');
+var chunkUOW3GK4I_cjs = require('../chunk-UOW3GK4I.cjs');
 
 // src/core/event-payload.ts
 var RESERVED = /* @__PURE__ */ new Set([
@@ -21,7 +21,7 @@ var RESERVED = /* @__PURE__ */ new Set([
   "path",
   "query"
 ]);
-function compact(obj) {
+function compact2(obj) {
   const out = {};
   for (const [k, v] of Object.entries(obj)) {
     if (v !== void 0) out[k] = v;
@@ -45,8 +45,8 @@ function buildEventPayload(input) {
     // what they reliably know (real page url, visitor/device id), so a stray prop
     // can't override the true page context — see merge order below.
     ...reserved,
-    ...compact(input.context ?? {}),
-    ...compact(input.identity ?? {}),
+    ...compact2(input.context ?? {}),
+    ...compact2(input.identity ?? {}),
     eventId: input.eventId,
     ...input.eventType ? { eventType: input.eventType } : {},
     ...input.journeyId ? { journeyId: input.journeyId } : {}
@@ -59,9 +59,12 @@ var XeniaServer = class {
   api;
   /** SDK-owned visitor anchor for this (per-request) client — see {@link XeniaConfig.visitorId}. */
   visitorId;
+  /** Ambient request context attached to every call — see {@link XeniaConfig.context}. */
+  context;
   constructor(config) {
-    this.api = new chunkJEFNAD5J_cjs.XeniaApi(config);
+    this.api = new chunkUOW3GK4I_cjs.XeniaApi(config);
     this.visitorId = config.visitorId;
+    this.context = config.context;
   }
   /**
    * Send a unified event server-side (`POST /api/events/v1`) and return the
@@ -72,7 +75,7 @@ var XeniaServer = class {
   async track(eventName, opts = {}) {
     const event = {
       eventName,
-      eventId: opts.eventId ? chunkJEFNAD5J_cjs.toEventId(opts.eventId) : chunkJEFNAD5J_cjs.generateUlid(),
+      eventId: opts.eventId ? chunkUOW3GK4I_cjs.toEventId(opts.eventId) : chunkUOW3GK4I_cjs.generateUlid(),
       eventVersion: opts.eventVersion ?? 1,
       occurredAtMs: opts.occurredAtMs ?? Date.now(),
       source: opts.source ?? "xenia-server-sdk",
@@ -103,7 +106,9 @@ var XeniaServer = class {
       // cookie per request) is attached automatically. Falls back to a
       // per-call visitorId only when none is bound.
       identity: { ...opts.identity, visitorId: this.visitorId ?? opts.identity?.visitorId },
-      context: opts.context,
+      // Ambient request context (config.context, bound once per request) under a per-call
+      // override — same precedence resolve() uses, so both surfaces carry the same fields.
+      context: { ...this.context, ...opts.context },
       props: data
     });
     return this.api.webhook(triggerId, payload, opts.method ?? "POST");
@@ -117,6 +122,13 @@ var XeniaServer = class {
    * (`POST /api/personalization/resolve`). Requires a configured SDK token
    * (`token`/`getToken`) — resolve is auth-required. With `merge: true` the
    * returned `content` is server-spliced.
+   *
+   * Pass `opts.identity`/`opts.context` to attach the same SDK-provided
+   * fields (`deviceId`, `customerId`, `email`, `path`, `url`, `referrer`,
+   * `utm*`, …) the browser client collects ambiently — there's no ambient
+   * `window`/`document` server-side, so a server caller must supply whatever
+   * it knows (e.g. from the current request) explicitly. See
+   * {@link ResolveOptions}.
    */
   async resolve(contentKey, opts) {
     return this.api.resolve(contentKey, this.withVisitor(opts));
@@ -126,14 +138,33 @@ var XeniaServer = class {
     return this.api.resolveBatch(items, this.withVisitor(opts));
   }
   /**
-   * Stamp the SDK-owned visitor id (`config.visitorId`) into the resolve `data`
-   * under the reserved `_xenia_vid` key so the backend can bucket holdout
-   * experiments and record exposure per visitor. Set last so a caller can't
-   * override it; a no-op when no `visitorId` was bound on this client.
+   * Merge the ambient `config.context` and `opts.identity`/`opts.context` into
+   * the resolve `data`, then stamp the SDK-owned visitor id
+   * (`config.visitorId`) under both the reserved `_xenia_vid` key (read by the
+   * backend for holdout/exposure bucketing) and the flat `visitorId` field —
+   * mirrors `webhook()`'s merge order/precedence exactly: caller `data` <
+   * ambient `config.context` < caller `context`/`identity` < SDK-owned
+   * `visitorId`/`_xenia_vid`, set LAST so neither can be overridden per call.
+   *
+   * `config.context` is what makes the SDK-provided fields automatic on the
+   * server: bound once per request, every `resolve()` carries `path`/`query`/
+   * `url`/`referrer`/UTMs with no per-call wiring, matching what the browser
+   * client collects from `window` on its own. A no-op when nothing is bound and
+   * nothing was passed — preserving today's behavior for callers using neither.
    */
   withVisitor(opts) {
-    if (!this.visitorId) return opts;
-    return { ...opts, data: { ...opts?.data ?? {}, _xenia_vid: this.visitorId } };
+    const identity = chunkUOW3GK4I_cjs.compact({
+      ...opts?.identity,
+      visitorId: this.visitorId ?? opts?.identity?.visitorId
+    });
+    const merged = {
+      ...chunkUOW3GK4I_cjs.compact(this.context ?? {}),
+      ...chunkUOW3GK4I_cjs.compact(opts?.context ?? {}),
+      ...identity
+    };
+    if (Object.keys(merged).length === 0 && !this.visitorId) return opts;
+    if (this.visitorId) merged._xenia_vid = this.visitorId;
+    return { ...opts, data: { ...opts?.data ?? {}, ...merged } };
   }
 };
 function createXeniaServer(config) {
@@ -142,7 +173,7 @@ function createXeniaServer(config) {
 
 // src/server/token.ts
 async function refreshSdkToken(opts) {
-  const http = new chunkJEFNAD5J_cjs.HttpClient({ baseUrl: opts.baseUrl, timeout: opts.timeout });
+  const http = new chunkUOW3GK4I_cjs.HttpClient({ baseUrl: opts.baseUrl, timeout: opts.timeout });
   const { data } = await http.request({
     method: "POST",
     path: "/api/personalization/token/refresh",
@@ -187,10 +218,10 @@ function parseCookies(header) {
   return out;
 }
 function getVisitorId(cookieHeader, prefix) {
-  return parseCookies(cookieHeader)[chunkJEFNAD5J_cjs.visitorCookieName(prefix)] ?? null;
+  return parseCookies(cookieHeader)[chunkUOW3GK4I_cjs.visitorCookieName(prefix)] ?? null;
 }
 function getConsent(cookieHeader, prefix) {
-  const raw = parseCookies(cookieHeader)[chunkJEFNAD5J_cjs.consentCookieName(prefix)];
+  const raw = parseCookies(cookieHeader)[chunkUOW3GK4I_cjs.consentCookieName(prefix)];
   if (!raw) return { analytics: false, marketing: false, personalization: false };
   try {
     const parsed = JSON.parse(raw);
@@ -207,27 +238,27 @@ function getConsent(cookieHeader, prefix) {
 
 Object.defineProperty(exports, "CONSENT_COOKIE", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.CONSENT_COOKIE; }
+  get: function () { return chunkUOW3GK4I_cjs.CONSENT_COOKIE; }
 });
 Object.defineProperty(exports, "VISITOR_COOKIE", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.VISITOR_COOKIE; }
+  get: function () { return chunkUOW3GK4I_cjs.VISITOR_COOKIE; }
 });
 Object.defineProperty(exports, "XeniaApi", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.XeniaApi; }
+  get: function () { return chunkUOW3GK4I_cjs.XeniaApi; }
 });
 Object.defineProperty(exports, "consentCookieName", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.consentCookieName; }
+  get: function () { return chunkUOW3GK4I_cjs.consentCookieName; }
 });
 Object.defineProperty(exports, "parseActions", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.parseActions; }
+  get: function () { return chunkUOW3GK4I_cjs.parseActions; }
 });
 Object.defineProperty(exports, "visitorCookieName", {
   enumerable: true,
-  get: function () { return chunkJEFNAD5J_cjs.visitorCookieName; }
+  get: function () { return chunkUOW3GK4I_cjs.visitorCookieName; }
 });
 exports.XeniaServer = XeniaServer;
 exports.createTokenRoute = createTokenRoute;