@xenia-martech/sdk-js 1.0.0-dev.26 → 1.0.0-dev.27

package/dist/{cookie-names-LgNDAreS.d.cts → cookie-names-C3LKDhsg.d.cts}

@@ -86,6 +86,23 @@ interface XeniaConfig {
      *   cookie read via `getVisitorId()`.
      */
     visitorId?: string;
+    /**
+     * The ambient request context for a **server** client — the SDK-provided page/campaign fields
+     * (`path`, `query`, `url`, `referrer`, `utmSource`/`utmMedium`/`utmCampaign`/`utmContent`/`utmId`)
+     * that get attached to EVERY `resolve()`/`resolveBatch()`/`webhook()` made with this client, so
+     * journey rules can gate on `query.<name>` or `path` without any per-call wiring.
+     *
+     * The browser client needs nothing here — it reads these off `window.location` itself. A server
+     * runtime has no ambient request, so bind it once when constructing the per-request client:
+     *
+     * ```ts
+     * createXeniaServer({ …, context: contextFromUrl(currentUrl, referrer) })
+     * ```
+     *
+     * Lowest precedence: a per-call `context`/`identity` overrides it, and the SDK-owned `visitorId`
+     * still wins over everything.
+     */
+    context?: EventContext;
     /**
      * Persist the SDK visitor id to a first-party `xenia_vid` cookie so your
      * **same-origin** server can read it (`getVisitorId(cookieHeader)`) and bind
@@ -304,6 +321,23 @@ interface ResolveOptions {
     locale?: string;
     /** When true, ask the server to splice and return `content`. */
     merge?: boolean;
+    /**
+     * Caller-supplied identity fields (`deviceId`/`visitorId`/`customerId`/
+     * `email`), merged into `data` the same way `ServerWebhookOptions.identity`
+     * is merged for `webhook()`. Only relevant server-side — the browser client
+     * collects these ambiently instead and ignores this field. The SDK-owned
+     * `visitorId` (from `config.visitorId`) still wins over a value supplied
+     * here, same precedence as `webhook()`.
+     */
+    identity?: EventIdentity;
+    /**
+     * Caller-supplied page context (`path`/`query`/`url`/`referrer`/`utm*`),
+     * merged into `data` the same way `ServerWebhookOptions.context` is merged
+     * for `webhook()`. There's no ambient `window`/`document` server-side, so a
+     * server caller who wants these SDK-provided fields on a resolve() call
+     * must pass them explicitly (e.g. from the current request's headers).
+     */
+    context?: EventContext;
 }
 /** Body posted to `POST /api/events/v1/identify` — binds visitor to a known user. */
 interface IdentifyRequest {

package/dist/{cookie-names-LgNDAreS.d.ts → cookie-names-C3LKDhsg.d.ts}

@@ -86,6 +86,23 @@ interface XeniaConfig {
      *   cookie read via `getVisitorId()`.
      */
     visitorId?: string;
+    /**
+     * The ambient request context for a **server** client — the SDK-provided page/campaign fields
+     * (`path`, `query`, `url`, `referrer`, `utmSource`/`utmMedium`/`utmCampaign`/`utmContent`/`utmId`)
+     * that get attached to EVERY `resolve()`/`resolveBatch()`/`webhook()` made with this client, so
+     * journey rules can gate on `query.<name>` or `path` without any per-call wiring.
+     *
+     * The browser client needs nothing here — it reads these off `window.location` itself. A server
+     * runtime has no ambient request, so bind it once when constructing the per-request client:
+     *
+     * ```ts
+     * createXeniaServer({ …, context: contextFromUrl(currentUrl, referrer) })
+     * ```
+     *
+     * Lowest precedence: a per-call `context`/`identity` overrides it, and the SDK-owned `visitorId`
+     * still wins over everything.
+     */
+    context?: EventContext;
     /**
      * Persist the SDK visitor id to a first-party `xenia_vid` cookie so your
      * **same-origin** server can read it (`getVisitorId(cookieHeader)`) and bind
@@ -304,6 +321,23 @@ interface ResolveOptions {
     locale?: string;
     /** When true, ask the server to splice and return `content`. */
     merge?: boolean;
+    /**
+     * Caller-supplied identity fields (`deviceId`/`visitorId`/`customerId`/
+     * `email`), merged into `data` the same way `ServerWebhookOptions.identity`
+     * is merged for `webhook()`. Only relevant server-side — the browser client
+     * collects these ambiently instead and ignores this field. The SDK-owned
+     * `visitorId` (from `config.visitorId`) still wins over a value supplied
+     * here, same precedence as `webhook()`.
+     */
+    identity?: EventIdentity;
+    /**
+     * Caller-supplied page context (`path`/`query`/`url`/`referrer`/`utm*`),
+     * merged into `data` the same way `ServerWebhookOptions.context` is merged
+     * for `webhook()`. There's no ambient `window`/`document` server-side, so a
+     * server caller who wants these SDK-provided fields on a resolve() call
+     * must pass them explicitly (e.g. from the current request's headers).
+     */
+    context?: EventContext;
 }
 /** Body posted to `POST /api/events/v1/identify` — binds visitor to a known user. */
 interface IdentifyRequest {

package/dist/index.cjs

@@ -1,80 +1,84 @@
 'use strict';
 
-var chunk3KYKKIIG_cjs = require('./chunk-3KYKKIIG.cjs');
+var chunkUOW3GK4I_cjs = require('./chunk-UOW3GK4I.cjs');
 
 
 
 Object.defineProperty(exports, "CONSENT_COOKIE", {
   enumerable: true,
-  get: function () { return chunk3KYKKIIG_cjs.CONSENT_COOKIE; }
+  get: function () { return chunkUOW3GK4I_cjs.CONSENT_COOKIE; }
 });
 Object.defineProperty(exports, "DEFAULT_PREFIX", {
   enumerable: true,
-  get: function () { return chunk3KYKKIIG_cjs.DEFAULT_PREFIX; }
+  get: function () { return chunkUOW3GK4I_cjs.DEFAULT_PREFIX; }
 });
 Object.defineProperty(exports, "HttpClient", {
   enumerable: true,
-  get: function () { return chunk3KYKKIIG_cjs.HttpClient; }
+  get: function () { return chunkUOW3GK4I_cjs.HttpClient; }
 });
 Object.defineProperty(exports, "HttpError", {
   enumerable: true,
-  get: function () { return chunk3KYKKIIG_cjs.HttpError; }
+  get: function () { return chunkUOW3GK4I_cjs.HttpError; }
 });
 Object.defineProperty(exports, "LocalStorageResponseStore", {
   enumerable: true,
-  get: function () { return chunk3KYKKIIG_cjs.LocalStorageResponseStore; }
+  get: function () { return chunkUOW3GK4I_cjs.LocalStorageResponseStore; }
 });
 Object.defineProperty(exports, "MAX_EVENT_ID_LENGTH", {
   enumerable: true,
-  get: function () { return chunk3KYKKIIG_cjs.MAX_EVENT_ID_LENGTH; }
+  get: function () { return chunkUOW3GK4I_cjs.MAX_EVENT_ID_LENGTH; }
 });
 Object.defineProperty(exports, "MemoryResponseStore", {
   enumerable: true,
-  get: function () { return chunk3KYKKIIG_cjs.MemoryResponseStore; }
+  get: function () { return chunkUOW3GK4I_cjs.MemoryResponseStore; }
 });
 Object.defineProperty(exports, "VISITOR_COOKIE", {
   enumerable: true,
-  get: function () { return chunk3KYKKIIG_cjs.VISITOR_COOKIE; }
+  get: function () { return chunkUOW3GK4I_cjs.VISITOR_COOKIE; }
 });
 Object.defineProperty(exports, "XeniaApi", {
   enumerable: true,
-  get: function () { return chunk3KYKKIIG_cjs.XeniaApi; }
+  get: function () { return chunkUOW3GK4I_cjs.XeniaApi; }
 });
 Object.defineProperty(exports, "buildUrl", {
   enumerable: true,
-  get: function () { return chunk3KYKKIIG_cjs.buildUrl; }
+  get: function () { return chunkUOW3GK4I_cjs.buildUrl; }
 });
 Object.defineProperty(exports, "consentCookieName", {
   enumerable: true,
-  get: function () { return chunk3KYKKIIG_cjs.consentCookieName; }
+  get: function () { return chunkUOW3GK4I_cjs.consentCookieName; }
+});
+Object.defineProperty(exports, "contextFromUrl", {
+  enumerable: true,
+  get: function () { return chunkUOW3GK4I_cjs.contextFromUrl; }
 });
 Object.defineProperty(exports, "extractContentSwaps", {
   enumerable: true,
-  get: function () { return chunk3KYKKIIG_cjs.extractContentSwaps; }
+  get: function () { return chunkUOW3GK4I_cjs.extractContentSwaps; }
 });
 Object.defineProperty(exports, "generateUlid", {
   enumerable: true,
-  get: function () { return chunk3KYKKIIG_cjs.generateUlid; }
+  get: function () { return chunkUOW3GK4I_cjs.generateUlid; }
 });
 Object.defineProperty(exports, "isBrowser", {
   enumerable: true,
-  get: function () { return chunk3KYKKIIG_cjs.isBrowser; }
+  get: function () { return chunkUOW3GK4I_cjs.isBrowser; }
 });
 Object.defineProperty(exports, "parseActions", {
   enumerable: true,
-  get: function () { return chunk3KYKKIIG_cjs.parseActions; }
+  get: function () { return chunkUOW3GK4I_cjs.parseActions; }
 });
 Object.defineProperty(exports, "spliceSlots", {
   enumerable: true,
-  get: function () { return chunk3KYKKIIG_cjs.spliceSlots; }
+  get: function () { return chunkUOW3GK4I_cjs.spliceSlots; }
 });
 Object.defineProperty(exports, "toEventId", {
   enumerable: true,
-  get: function () { return chunk3KYKKIIG_cjs.toEventId; }
+  get: function () { return chunkUOW3GK4I_cjs.toEventId; }
 });
 Object.defineProperty(exports, "visitorCookieName", {
   enumerable: true,
-  get: function () { return chunk3KYKKIIG_cjs.visitorCookieName; }
+  get: function () { return chunkUOW3GK4I_cjs.visitorCookieName; }
 });
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { R as RetryConfig, H as HttpMethod, J as JsonValue, W as WebhookResponse } from './cookie-names-LgNDAreS.cjs';
-export { A as AnalyticsContext, a as AnalyticsEventName, b as AnalyticsIdentity, c as AnalyticsIngestResponse, C as CONSENT_COOKIE, d as ConsentState, D as DEFAULT_PREFIX, E as EventContext, e as EventIdentity, I as IdentifyRequest, f as IdentifyResponse, g as InteractionType, h as JsonObject, M as MessageCta, i as MessagePlacement, P as PersonalizationSwap, j as ResolveBatchItem, k as ResolveBatchResult, l as ResolveOptions, m as ResolveResult, T as TrackOptions, V as VISITOR_COOKIE, X as XeniaAction, n as XeniaApi, o as XeniaConfig, p as XeniaEvent, q as consentCookieName, r as parseActions, v as visitorCookieName } from './cookie-names-LgNDAreS.cjs';
+import { R as RetryConfig, H as HttpMethod, J as JsonValue, E as EventContext, W as WebhookResponse } from './cookie-names-C3LKDhsg.cjs';
+export { A as AnalyticsContext, a as AnalyticsEventName, b as AnalyticsIdentity, c as AnalyticsIngestResponse, C as CONSENT_COOKIE, d as ConsentState, D as DEFAULT_PREFIX, e as EventIdentity, I as IdentifyRequest, f as IdentifyResponse, g as InteractionType, h as JsonObject, M as MessageCta, i as MessagePlacement, P as PersonalizationSwap, j as ResolveBatchItem, k as ResolveBatchResult, l as ResolveOptions, m as ResolveResult, T as TrackOptions, V as VISITOR_COOKIE, X as XeniaAction, n as XeniaApi, o as XeniaConfig, p as XeniaEvent, q as consentCookieName, r as parseActions, v as visitorCookieName } from './cookie-names-C3LKDhsg.cjs';
 
 /** Returns true when running in a browser environment (SSR-safe). */
 declare function isBrowser(): boolean;
@@ -121,6 +121,26 @@ declare function spliceSlots(slots: Record<string, JsonValue>, swaps: ContentSwa
 /** Extract `xeniaContentSwaps` from a webhook-response body, if present and well-formed. */
 declare function extractContentSwaps(body: JsonValue): ContentSwap[] | undefined;
 
+/**
+ * Derive the SDK-provided page/campaign fields from a URL — the server-side counterpart to the
+ * browser client's `Identity.collectContext()`, which reads the same fields off `window.location`.
+ *
+ * Exists because a server runtime has no ambient `window`: a Node client is constructed per request,
+ * so the one thing it needs handed over is the URL being served. Everything a journey rule can
+ * reference — `path`, `query.<name>`, `url`, `referrer`, `utmSource`/`utmMedium`/`utmCampaign`/
+ * `utmContent`/`utmId` — is derived here rather than by each app, so a server-rendered page gets the
+ * same field set a browser page does without hand-rolling UTM parsing at every call site.
+ *
+ * Field names and semantics deliberately mirror `collectContext()` exactly: `query` is the flattened
+ * search params, UTMs come from the standard `utm_*` params, and absent values are omitted rather
+ * than set to `""` (a blank string is a value a condition could accidentally match).
+ *
+ * @param url Absolute URL of the request being served (e.g. `https://shop.example/product/x?ref=a`).
+ *            A relative or unparseable value yields an empty context rather than throwing.
+ * @param referrer Optional referring URL, typically the request's `Referer` header.
+ */
+declare function contextFromUrl(url: string | null | undefined, referrer?: string | null): EventContext;
+
 /**
  * Persists webhook responses the SDK receives, keyed by an arbitrary string
  * (typically the eventId, triggerId, or journeyId). Lets the app read back the
@@ -155,4 +175,4 @@ declare class LocalStorageResponseStore implements ResponseStore {
     clear(): void;
 }
 
-export { type ContentSwap, HttpClient, type HttpClientOptions, HttpError, HttpMethod, type HttpResult, JsonValue, LocalStorageResponseStore, MAX_EVENT_ID_LENGTH, MemoryResponseStore, type RequestOptions, type ResponseStore, RetryConfig, WebhookResponse, buildUrl, extractContentSwaps, generateUlid, isBrowser, spliceSlots, toEventId };
+export { type ContentSwap, EventContext, HttpClient, type HttpClientOptions, HttpError, HttpMethod, type HttpResult, JsonValue, LocalStorageResponseStore, MAX_EVENT_ID_LENGTH, MemoryResponseStore, type RequestOptions, type ResponseStore, RetryConfig, WebhookResponse, buildUrl, contextFromUrl, extractContentSwaps, generateUlid, isBrowser, spliceSlots, toEventId };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { R as RetryConfig, H as HttpMethod, J as JsonValue, W as WebhookResponse } from './cookie-names-LgNDAreS.js';
-export { A as AnalyticsContext, a as AnalyticsEventName, b as AnalyticsIdentity, c as AnalyticsIngestResponse, C as CONSENT_COOKIE, d as ConsentState, D as DEFAULT_PREFIX, E as EventContext, e as EventIdentity, I as IdentifyRequest, f as IdentifyResponse, g as InteractionType, h as JsonObject, M as MessageCta, i as MessagePlacement, P as PersonalizationSwap, j as ResolveBatchItem, k as ResolveBatchResult, l as ResolveOptions, m as ResolveResult, T as TrackOptions, V as VISITOR_COOKIE, X as XeniaAction, n as XeniaApi, o as XeniaConfig, p as XeniaEvent, q as consentCookieName, r as parseActions, v as visitorCookieName } from './cookie-names-LgNDAreS.js';
+import { R as RetryConfig, H as HttpMethod, J as JsonValue, E as EventContext, W as WebhookResponse } from './cookie-names-C3LKDhsg.js';
+export { A as AnalyticsContext, a as AnalyticsEventName, b as AnalyticsIdentity, c as AnalyticsIngestResponse, C as CONSENT_COOKIE, d as ConsentState, D as DEFAULT_PREFIX, e as EventIdentity, I as IdentifyRequest, f as IdentifyResponse, g as InteractionType, h as JsonObject, M as MessageCta, i as MessagePlacement, P as PersonalizationSwap, j as ResolveBatchItem, k as ResolveBatchResult, l as ResolveOptions, m as ResolveResult, T as TrackOptions, V as VISITOR_COOKIE, X as XeniaAction, n as XeniaApi, o as XeniaConfig, p as XeniaEvent, q as consentCookieName, r as parseActions, v as visitorCookieName } from './cookie-names-C3LKDhsg.js';
 
 /** Returns true when running in a browser environment (SSR-safe). */
 declare function isBrowser(): boolean;
@@ -121,6 +121,26 @@ declare function spliceSlots(slots: Record<string, JsonValue>, swaps: ContentSwa
 /** Extract `xeniaContentSwaps` from a webhook-response body, if present and well-formed. */
 declare function extractContentSwaps(body: JsonValue): ContentSwap[] | undefined;
 
+/**
+ * Derive the SDK-provided page/campaign fields from a URL — the server-side counterpart to the
+ * browser client's `Identity.collectContext()`, which reads the same fields off `window.location`.
+ *
+ * Exists because a server runtime has no ambient `window`: a Node client is constructed per request,
+ * so the one thing it needs handed over is the URL being served. Everything a journey rule can
+ * reference — `path`, `query.<name>`, `url`, `referrer`, `utmSource`/`utmMedium`/`utmCampaign`/
+ * `utmContent`/`utmId` — is derived here rather than by each app, so a server-rendered page gets the
+ * same field set a browser page does without hand-rolling UTM parsing at every call site.
+ *
+ * Field names and semantics deliberately mirror `collectContext()` exactly: `query` is the flattened
+ * search params, UTMs come from the standard `utm_*` params, and absent values are omitted rather
+ * than set to `""` (a blank string is a value a condition could accidentally match).
+ *
+ * @param url Absolute URL of the request being served (e.g. `https://shop.example/product/x?ref=a`).
+ *            A relative or unparseable value yields an empty context rather than throwing.
+ * @param referrer Optional referring URL, typically the request's `Referer` header.
+ */
+declare function contextFromUrl(url: string | null | undefined, referrer?: string | null): EventContext;
+
 /**
  * Persists webhook responses the SDK receives, keyed by an arbitrary string
  * (typically the eventId, triggerId, or journeyId). Lets the app read back the
@@ -155,4 +175,4 @@ declare class LocalStorageResponseStore implements ResponseStore {
     clear(): void;
 }
 
-export { type ContentSwap, HttpClient, type HttpClientOptions, HttpError, HttpMethod, type HttpResult, JsonValue, LocalStorageResponseStore, MAX_EVENT_ID_LENGTH, MemoryResponseStore, type RequestOptions, type ResponseStore, RetryConfig, WebhookResponse, buildUrl, extractContentSwaps, generateUlid, isBrowser, spliceSlots, toEventId };
+export { type ContentSwap, EventContext, HttpClient, type HttpClientOptions, HttpError, HttpMethod, type HttpResult, JsonValue, LocalStorageResponseStore, MAX_EVENT_ID_LENGTH, MemoryResponseStore, type RequestOptions, type ResponseStore, RetryConfig, WebhookResponse, buildUrl, contextFromUrl, extractContentSwaps, generateUlid, isBrowser, spliceSlots, toEventId };

package/dist/index.js

@@ -1,3 +1,3 @@
-export { CONSENT_COOKIE, DEFAULT_PREFIX, HttpClient, HttpError, LocalStorageResponseStore, MAX_EVENT_ID_LENGTH, MemoryResponseStore, VISITOR_COOKIE, XeniaApi, buildUrl, consentCookieName, extractContentSwaps, generateUlid, isBrowser, parseActions, spliceSlots, toEventId, visitorCookieName } from './chunk-D37RD3UC.js';
+export { CONSENT_COOKIE, DEFAULT_PREFIX, HttpClient, HttpError, LocalStorageResponseStore, MAX_EVENT_ID_LENGTH, MemoryResponseStore, VISITOR_COOKIE, XeniaApi, buildUrl, consentCookieName, contextFromUrl, extractContentSwaps, generateUlid, isBrowser, parseActions, spliceSlots, toEventId, visitorCookieName } from './chunk-7D2HJMW6.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/server/index.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunk3KYKKIIG_cjs = require('../chunk-3KYKKIIG.cjs');
+var chunkUOW3GK4I_cjs = require('../chunk-UOW3GK4I.cjs');
 
 // src/core/event-payload.ts
 var RESERVED = /* @__PURE__ */ new Set([
@@ -21,7 +21,7 @@ var RESERVED = /* @__PURE__ */ new Set([
   "path",
   "query"
 ]);
-function compact(obj) {
+function compact2(obj) {
   const out = {};
   for (const [k, v] of Object.entries(obj)) {
     if (v !== void 0) out[k] = v;
@@ -45,8 +45,8 @@ function buildEventPayload(input) {
     // what they reliably know (real page url, visitor/device id), so a stray prop
     // can't override the true page context — see merge order below.
     ...reserved,
-    ...compact(input.context ?? {}),
-    ...compact(input.identity ?? {}),
+    ...compact2(input.context ?? {}),
+    ...compact2(input.identity ?? {}),
     eventId: input.eventId,
     ...input.eventType ? { eventType: input.eventType } : {},
     ...input.journeyId ? { journeyId: input.journeyId } : {}
@@ -59,9 +59,12 @@ var XeniaServer = class {
   api;
   /** SDK-owned visitor anchor for this (per-request) client — see {@link XeniaConfig.visitorId}. */
   visitorId;
+  /** Ambient request context attached to every call — see {@link XeniaConfig.context}. */
+  context;
   constructor(config) {
-    this.api = new chunk3KYKKIIG_cjs.XeniaApi(config);
+    this.api = new chunkUOW3GK4I_cjs.XeniaApi(config);
     this.visitorId = config.visitorId;
+    this.context = config.context;
   }
   /**
    * Send a unified event server-side (`POST /api/events/v1`) and return the
@@ -72,7 +75,7 @@ var XeniaServer = class {
   async track(eventName, opts = {}) {
     const event = {
       eventName,
-      eventId: opts.eventId ? chunk3KYKKIIG_cjs.toEventId(opts.eventId) : chunk3KYKKIIG_cjs.generateUlid(),
+      eventId: opts.eventId ? chunkUOW3GK4I_cjs.toEventId(opts.eventId) : chunkUOW3GK4I_cjs.generateUlid(),
       eventVersion: opts.eventVersion ?? 1,
       occurredAtMs: opts.occurredAtMs ?? Date.now(),
       source: opts.source ?? "xenia-server-sdk",
@@ -103,7 +106,9 @@ var XeniaServer = class {
       // cookie per request) is attached automatically. Falls back to a
       // per-call visitorId only when none is bound.
       identity: { ...opts.identity, visitorId: this.visitorId ?? opts.identity?.visitorId },
-      context: opts.context,
+      // Ambient request context (config.context, bound once per request) under a per-call
+      // override — same precedence resolve() uses, so both surfaces carry the same fields.
+      context: { ...this.context, ...opts.context },
       props: data
     });
     return this.api.webhook(triggerId, payload, opts.method ?? "POST");
@@ -117,6 +122,13 @@ var XeniaServer = class {
    * (`POST /api/personalization/resolve`). Requires a configured SDK token
    * (`token`/`getToken`) — resolve is auth-required. With `merge: true` the
    * returned `content` is server-spliced.
+   *
+   * Pass `opts.identity`/`opts.context` to attach the same SDK-provided
+   * fields (`deviceId`, `customerId`, `email`, `path`, `url`, `referrer`,
+   * `utm*`, …) the browser client collects ambiently — there's no ambient
+   * `window`/`document` server-side, so a server caller must supply whatever
+   * it knows (e.g. from the current request) explicitly. See
+   * {@link ResolveOptions}.
    */
   async resolve(contentKey, opts) {
     return this.api.resolve(contentKey, this.withVisitor(opts));
@@ -126,14 +138,33 @@ var XeniaServer = class {
     return this.api.resolveBatch(items, this.withVisitor(opts));
   }
   /**
-   * Stamp the SDK-owned visitor id (`config.visitorId`) into the resolve `data`
-   * under the reserved `_xenia_vid` key so the backend can bucket holdout
-   * experiments and record exposure per visitor. Set last so a caller can't
-   * override it; a no-op when no `visitorId` was bound on this client.
+   * Merge the ambient `config.context` and `opts.identity`/`opts.context` into
+   * the resolve `data`, then stamp the SDK-owned visitor id
+   * (`config.visitorId`) under both the reserved `_xenia_vid` key (read by the
+   * backend for holdout/exposure bucketing) and the flat `visitorId` field —
+   * mirrors `webhook()`'s merge order/precedence exactly: caller `data` <
+   * ambient `config.context` < caller `context`/`identity` < SDK-owned
+   * `visitorId`/`_xenia_vid`, set LAST so neither can be overridden per call.
+   *
+   * `config.context` is what makes the SDK-provided fields automatic on the
+   * server: bound once per request, every `resolve()` carries `path`/`query`/
+   * `url`/`referrer`/UTMs with no per-call wiring, matching what the browser
+   * client collects from `window` on its own. A no-op when nothing is bound and
+   * nothing was passed — preserving today's behavior for callers using neither.
    */
   withVisitor(opts) {
-    if (!this.visitorId) return opts;
-    return { ...opts, data: { ...opts?.data ?? {}, _xenia_vid: this.visitorId } };
+    const identity = chunkUOW3GK4I_cjs.compact({
+      ...opts?.identity,
+      visitorId: this.visitorId ?? opts?.identity?.visitorId
+    });
+    const merged = {
+      ...chunkUOW3GK4I_cjs.compact(this.context ?? {}),
+      ...chunkUOW3GK4I_cjs.compact(opts?.context ?? {}),
+      ...identity
+    };
+    if (Object.keys(merged).length === 0 && !this.visitorId) return opts;
+    if (this.visitorId) merged._xenia_vid = this.visitorId;
+    return { ...opts, data: { ...opts?.data ?? {}, ...merged } };
   }
 };
 function createXeniaServer(config) {
@@ -142,7 +173,7 @@ function createXeniaServer(config) {
 
 // src/server/token.ts
 async function refreshSdkToken(opts) {
-  const http = new chunk3KYKKIIG_cjs.HttpClient({ baseUrl: opts.baseUrl, timeout: opts.timeout });
+  const http = new chunkUOW3GK4I_cjs.HttpClient({ baseUrl: opts.baseUrl, timeout: opts.timeout });
   const { data } = await http.request({
     method: "POST",
     path: "/api/personalization/token/refresh",
@@ -187,10 +218,10 @@ function parseCookies(header) {
   return out;
 }
 function getVisitorId(cookieHeader, prefix) {
-  return parseCookies(cookieHeader)[chunk3KYKKIIG_cjs.visitorCookieName(prefix)] ?? null;
+  return parseCookies(cookieHeader)[chunkUOW3GK4I_cjs.visitorCookieName(prefix)] ?? null;
 }
 function getConsent(cookieHeader, prefix) {
-  const raw = parseCookies(cookieHeader)[chunk3KYKKIIG_cjs.consentCookieName(prefix)];
+  const raw = parseCookies(cookieHeader)[chunkUOW3GK4I_cjs.consentCookieName(prefix)];
   if (!raw) return { analytics: false, marketing: false, personalization: false };
   try {
     const parsed = JSON.parse(raw);
@@ -207,27 +238,27 @@ function getConsent(cookieHeader, prefix) {
 
 Object.defineProperty(exports, "CONSENT_COOKIE", {
   enumerable: true,
-  get: function () { return chunk3KYKKIIG_cjs.CONSENT_COOKIE; }
+  get: function () { return chunkUOW3GK4I_cjs.CONSENT_COOKIE; }
 });
 Object.defineProperty(exports, "VISITOR_COOKIE", {
   enumerable: true,
-  get: function () { return chunk3KYKKIIG_cjs.VISITOR_COOKIE; }
+  get: function () { return chunkUOW3GK4I_cjs.VISITOR_COOKIE; }
 });
 Object.defineProperty(exports, "XeniaApi", {
   enumerable: true,
-  get: function () { return chunk3KYKKIIG_cjs.XeniaApi; }
+  get: function () { return chunkUOW3GK4I_cjs.XeniaApi; }
 });
 Object.defineProperty(exports, "consentCookieName", {
   enumerable: true,
-  get: function () { return chunk3KYKKIIG_cjs.consentCookieName; }
+  get: function () { return chunkUOW3GK4I_cjs.consentCookieName; }
 });
 Object.defineProperty(exports, "parseActions", {
   enumerable: true,
-  get: function () { return chunk3KYKKIIG_cjs.parseActions; }
+  get: function () { return chunkUOW3GK4I_cjs.parseActions; }
 });
 Object.defineProperty(exports, "visitorCookieName", {
   enumerable: true,
-  get: function () { return chunk3KYKKIIG_cjs.visitorCookieName; }
+  get: function () { return chunkUOW3GK4I_cjs.visitorCookieName; }
 });
 exports.XeniaServer = XeniaServer;
 exports.createTokenRoute = createTokenRoute;

package/dist/server/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/event-payload.ts","../../src/server/xenia-server.ts","../../src/server/token.ts","../../src/server/cookies.ts"],"names":["XeniaApi","toEventId","generateUlid","HttpClient","visitorCookieName","consentCookieName"],"mappings":";;;;;AAGA,IAAM,QAAA,uBAAe,GAAA,CAAI;AAAA,EACvB,SAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,aAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAC,CAAA;AAaD,SAAS,QAAQ,GAAA,EAAuE;AACtF,EAAA,MAAM,MAAiC,EAAC;AACxC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AACxC,IAAA,IAAI,CAAA,KAAM,MAAA,EAAW,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EAChC;AACA,EAAA,OAAO,GAAA;AACT;AAWO,SAAS,kBAAkB,KAAA,EAAsC;AACtE,EAAA,MAAM,cAAyC,EAAC;AAChD,EAAA,MAAM,WAAsC,EAAC;AAC7C,EAAA,IAAI,MAAM,KAAA,EAAO;AACf,IAAA,KAAA,MAAW,CAAC,GAAG,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,KAAK,CAAA,EAAG;AAChD,MAAA,IAAI,MAAM,MAAA,EAAW;AAKrB,MAAA,IAAI,SAAS,GAAA,CAAI,CAAC,CAAA,EAAG,QAAA,CAAS,CAAC,CAAA,GAAI,CAAA;AAAA,WAC9B,WAAA,CAAY,CAAC,CAAA,GAAI,CAAA;AAAA,IACxB;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,GAAG,WAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAKH,GAAG,QAAA;AAAA,IACH,GAAG,OAAA,CAAS,KAAA,CAAM,OAAA,IAAW,EAA4C,CAAA;AAAA,IACzE,GAAG,OAAA,CAAS,KAAA,CAAM,QAAA,IAAY,EAA4C,CAAA;AAAA,IAC1E,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,GAAI,MAAM,SAAA,GAAY,EAAE,WAAW,KAAA,CAAM,SAAA,KAAc,EAAC;AAAA,IACxD,GAAI,MAAM,SAAA,GAAY,EAAE,WAAW,KAAA,CAAM,SAAA,KAAc;AAAC,GAC1D;AAEA,EAAA,OAAO,OAAA;AACT;;;ACfO,IAAM,cAAN,MAAkB;AAAA,EACd,GAAA;AAAA;AAAA,EAEQ,SAAA;AAAA,EAEjB,YAAY,MAAA,EAAqB;AAC/B,IAAA,IAAA,CAAK,GAAA,GAAM,IAAIA,0BAAA,CAAS,MAAM,CAAA;AAC9B,IAAA,IAAA,CAAK,YAAY,MAAA,CAAO,SAAA;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,CACJ,SAAA,EACA,IAAA,GAA2B,EAAC,EACM;AAClC,IAAA,MAAM,KAAA,GAAoB;AAAA,MACxB,SAAA;AAAA,MACA,SAAS,IAAA,CAAK,OAAA,GAAUC,4BAAU,IAAA,CAAK,OAAO,IAAIC,8BAAA,EAAa;AAAA,MAC/D,YAAA,EAAc,KAAK,YAAA,IAAgB,CAAA;AAAA,MACnC,YAAA,EAAc,IAAA,CAAK,YAAA,IAAgB,IAAA,CAAK,GAAA,EAAI;AAAA,MAC5C,MAAA,EAAQ,KAAK,MAAA,IAAU,kBAAA;AAAA,MACvB,QAAA,EAAU;AAAA,QACR,GAAG,IAAA,CAAK,QAAA;AAAA;AAAA;AAAA,QAGR,gBAAgB,IAAA,CAAK;AAAA,OACvB;AAAA,MACA,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,OAAA,EAAS,IAAA,CAAK,OAAA,KAAY,IAAA,GAAO,IAAA,GAAO;AAAA,KAC1C;AACA,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,UAAA,CAAW,CAAC,KAAK,CAAC,CAAA;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAA,CACJ,SAAA,EACA,IAAA,EACA,IAAA,GAA6B,EAAC,EACJ;AAC1B,IAAA,MAAM,UAAU,iBAAA,CAAkB;AAAA,MAChC,OAAA,EAAS,SAAA;AAAA,MACT,WAAW,IAAA,CAAK,SAAA;AAAA;AAAA;AAAA;AAAA,MAIhB,QAAA,EAAU,EAAE,GAAG,IAAA,CAAK,QAAA,EAAU,WAAW,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,QAAA,EAAU,SAAA,EAAU;AAAA,MACpF,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,KAAA,EAAO;AAAA,KACR,CAAA;AACD,IAAA,OAAO,KAAK,GAAA,CAAI,OAAA,CAAQ,WAAW,OAAA,EAAsB,IAAA,CAAK,UAAU,MAAM,CAAA;AAAA,EAChF;AAAA;AAAA,EAGA,MAAM,SAAS,IAAA,EAAkD;AAC/D,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,QAAA,CAAS,IAAI,CAAA;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAA,CAAQ,UAAA,EAAoB,IAAA,EAA+C;AAC/E,IAAA,OAAO,KAAK,GAAA,CAAI,OAAA,CAAQ,YAAY,IAAA,CAAK,WAAA,CAAY,IAAI,CAAC,CAAA;AAAA,EAC5D;AAAA;AAAA,EAGA,MAAM,YAAA,CACJ,KAAA,EACA,IAAA,EAC+B;AAC/B,IAAA,OAAO,KAAK,GAAA,CAAI,YAAA,CAAa,OAAO,IAAA,CAAK,WAAA,CAAY,IAAI,CAAC,CAAA;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,YAAY,IAAA,EAAmD;AACrE,IAAA,IAAI,CAAC,IAAA,CAAK,SAAA,EAAW,OAAO,IAAA;AAC5B,IAAA,OAAO,EAAE,GAAG,IAAA,EAAM,IAAA,EAAM,EAAE,GAAI,IAAA,EAAM,IAAA,IAAQ,EAAC,EAAI,UAAA,EAAY,IAAA,CAAK,WAAU,EAAE;AAAA,EAChF;AACF;AAGO,SAAS,kBAAkB,MAAA,EAAkC;AAClE,EAAA,OAAO,IAAI,YAAY,MAAM,CAAA;AAC/B;;;ACvIA,eAAsB,gBAAgB,IAAA,EAAoD;AACxF,EAAA,MAAM,IAAA,GAAO,IAAIC,4BAAA,CAAW,EAAE,OAAA,EAAS,KAAK,OAAA,EAAS,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,CAAA;AAC5E,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,KAAK,OAAA,CAAQ;AAAA,IAClC,MAAA,EAAQ,MAAA;AAAA,IACR,IAAA,EAAM,oCAAA;AAAA,IACN,SAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,QAAQ,CAAA,CAAA,EAAG;AAAA,IACpD,IAAA,EAAM,EAAE,UAAA,EAAY,IAAA,CAAK,cAAc,IAAA;AAAK,GAC7C,CAAA;AACD,EAAA,MAAM,GAAA,GAAO,QAAQ,EAAC;AACtB,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,KAAA,IAAS,EAAE,CAAA;AAAA,IAC7B,WAAW,OAAO,GAAA,CAAI,SAAA,KAAc,QAAA,GAAW,IAAI,SAAA,GAAY;AAAA,GACjE;AACF;AAiBO,SAAS,iBAAiB,MAAA,EAAsE;AACrG,EAAA,OAAO,YAA+B;AACpC,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAY,MAAM,eAAA,CAAgB,MAAM,CAAA;AAC9C,MAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,SAAS,CAAA,EAAG;AAAA,QAC7C,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,iBAAiB,UAAA;AAAW,OAC5E,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,sBAAA;AACrD,MAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG;AAAA,QACtD,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,OAC/C,CAAA;AAAA,IACH;AAAA,EACF,CAAA;AACF;;;ACzDO,SAAS,aAAa,MAAA,EAA2D;AACtF,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,IAAI,CAAC,QAAQ,OAAO,GAAA;AACpB,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAAG;AACpC,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC5B,IAAA,IAAI,QAAQ,EAAA,EAAI;AAChB,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,EAAE,IAAA,EAAK;AACpC,IAAA,MAAM,QAAQ,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AACvC,IAAA,IAAI,GAAA,EAAK,GAAA,CAAI,GAAG,CAAA,GAAI,mBAAmB,KAAK,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,GAAA;AACT;AASO,SAAS,YAAA,CACd,cACA,MAAA,EACe;AACf,EAAA,OAAO,aAAa,YAAY,CAAA,CAAEC,mCAAA,CAAkB,MAAM,CAAC,CAAA,IAAK,IAAA;AAClE;AAQO,SAAS,UAAA,CACd,cACA,MAAA,EACc;AACd,EAAA,MAAM,MAAM,YAAA,CAAa,YAAY,CAAA,CAAEC,mCAAA,CAAkB,MAAM,CAAC,CAAA;AAChE,EAAA,IAAI,CAAC,KAAK,OAAO,EAAE,WAAW,KAAA,EAAO,SAAA,EAAW,KAAA,EAAO,eAAA,EAAiB,KAAA,EAAM;AAC9E,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AAC1D,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,WAAW,CAAA;AAAA,MACjC,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,WAAW,CAAA;AAAA,MACjC,eAAA,EAAiB,MAAA,CAAO,GAAA,CAAI,iBAAiB;AAAA,KAC/C;AAAA,EACF;AACF","file":"index.cjs","sourcesContent":["import type { EventContext, EventIdentity, EventPayload, JsonValue } from \"./types\";\n\n/** Reserved keys that map to first-class fields (not passthrough data). */\nconst RESERVED = new Set([\n  \"eventId\",\n  \"eventType\",\n  \"journeyId\",\n  \"deviceId\",\n  \"visitorId\",\n  \"customerId\",\n  \"email\",\n  \"utmSource\",\n  \"utmMedium\",\n  \"utmCampaign\",\n  \"utmContent\",\n  \"utmId\",\n  \"url\",\n  \"referrer\",\n  \"path\",\n  \"query\",\n]);\n\nexport interface BuildEventInput {\n  eventId: string;\n  eventType?: string;\n  journeyId?: string;\n  identity?: EventIdentity;\n  context?: EventContext;\n  /** Arbitrary extra properties merged as passthrough data. */\n  props?: Record<string, JsonValue | undefined>;\n}\n\n/** Drop `undefined` values so the JSON body stays clean. */\nfunction compact(obj: Record<string, JsonValue | undefined>): Record<string, JsonValue> {\n  const out: Record<string, JsonValue> = {};\n  for (const [k, v] of Object.entries(obj)) {\n    if (v !== undefined) out[k] = v;\n  }\n  return out;\n}\n\n/**\n * Build the request body for the webhook `/flow` call (`XeniaApi.webhook`).\n *\n * Merge order (later wins): passthrough props < context < identity < core.\n * Field names match the backend `EventTriggerRequest` DTO exactly.\n *\n * @internal Used only by the webhook request/response path — the unified event\n * surface (`track()` → `POST /api/events/v1`) builds {@link XeniaEvent} instead.\n */\nexport function buildEventPayload(input: BuildEventInput): EventPayload {\n  const passthrough: Record<string, JsonValue> = {};\n  const reserved: Record<string, JsonValue> = {};\n  if (input.props) {\n    for (const [k, v] of Object.entries(input.props)) {\n      if (v === undefined) continue;\n      // A prop whose key matches a reserved field (e.g. `email`, `customerId`,\n      // `utmSource`) is promoted to that first-class field; everything else is\n      // custom passthrough data. Previously reserved-named props were dropped\n      // outright — so `track(\"sign_up\", { email })` never sent `email` at all.\n      if (RESERVED.has(k)) reserved[k] = v;\n      else passthrough[k] = v;\n    }\n  }\n\n  const payload = {\n    ...passthrough,\n    // Reserved-named props fill first-class fields (e.g. `email`, `customerId`)\n    // the SDK didn't auto-collect. Auto-collected context/identity still win for\n    // what they reliably know (real page url, visitor/device id), so a stray prop\n    // can't override the true page context — see merge order below.\n    ...reserved,\n    ...compact((input.context ?? {}) as Record<string, JsonValue | undefined>),\n    ...compact((input.identity ?? {}) as Record<string, JsonValue | undefined>),\n    eventId: input.eventId,\n    ...(input.eventType ? { eventType: input.eventType } : {}),\n    ...(input.journeyId ? { journeyId: input.journeyId } : {}),\n  };\n\n  return payload as EventPayload;\n}\n","import { XeniaApi } from \"../core/api\";\nimport { buildEventPayload } from \"../core/event-payload\";\nimport { generateUlid, toEventId } from \"../core/id\";\nimport type {\n  AnalyticsContext,\n  AnalyticsEventName,\n  CallerIdentity,\n  AnalyticsIngestResponse,\n  ConsentState,\n  EventContext,\n  EventIdentity,\n  IdentifyRequest,\n  IdentifyResponse,\n  JsonValue,\n  ResolveBatchItem,\n  ResolveBatchResult,\n  ResolveOptions,\n  ResolveResult,\n  WebhookResponse,\n  XeniaConfig,\n  XeniaEvent,\n} from \"../core/types\";\n\n/**\n * Extra per-call identity/context for server-side webhook calls. There's no\n * ambient `window` on the server to auto-collect `path`/`query`/`url`/UTM\n * params the way the browser client does — pass whatever's known at the call\n * site (e.g. the current request's pathname from Next.js `headers()`/route\n * params) via `context`, and `deviceId`/`visitorId`/etc. via `identity`.\n */\nexport interface ServerWebhookOptions {\n  method?: \"GET\" | \"POST\";\n  journeyId?: string;\n  identity?: EventIdentity;\n  context?: EventContext;\n}\n\n/**\n * Options for a server-side unified event (`POST /api/events/v1`). There's no\n * ambient request context on the server — pass whatever's known at the call\n * site (e.g. pathname/user-agent from the current request, session id from a\n * cookie) via `identity`/`context`.\n */\nexport interface ServerTrackOptions {\n  /** When true, also match/advance a journey (never sampled/shed). Default false. */\n  trigger?: boolean;\n  /** Stable dedup key (e.g. `\"ord-1001\"`) for idempotent conversions. */\n  eventId?: string;\n  eventVersion?: number;\n  occurredAtMs?: number;\n  /** Origin tag. Default `\"xenia-server-sdk\"`. */\n  source?: string;\n  /** Identity fields for this event (except the SDK-owned `xeniaVisitorId`,\n   *  which comes from `config.visitorId` and can't be set per call). */\n  identity?: CallerIdentity;\n  context?: AnalyticsContext;\n  properties?: Record<string, JsonValue | undefined>;\n  consent?: ConsentState;\n}\n\n/**\n * Server-native Xenia client. Same method names as the browser client, but\n * every call is stateless: identity and context are passed explicitly rather\n * than read from the DOM/localStorage. Uses global `fetch` (Node ≥18).\n */\nexport class XeniaServer {\n  readonly api: XeniaApi;\n  /** SDK-owned visitor anchor for this (per-request) client — see {@link XeniaConfig.visitorId}. */\n  private readonly visitorId?: string;\n\n  constructor(config: XeniaConfig) {\n    this.api = new XeniaApi(config);\n    this.visitorId = config.visitorId;\n  }\n\n  /**\n   * Send a unified event server-side (`POST /api/events/v1`) and return the\n   * ingest response (including per-result `triggered`). `opts.trigger: true`\n   * also matches/advances a journey; pass `opts.eventId` (e.g. `\"ord-1001\"`)\n   * as a stable dedup key for idempotent conversions.\n   */\n  async track(\n    eventName: AnalyticsEventName,\n    opts: ServerTrackOptions = {},\n  ): Promise<AnalyticsIngestResponse> {\n    const event: XeniaEvent = {\n      eventName,\n      eventId: opts.eventId ? toEventId(opts.eventId) : generateUlid(),\n      eventVersion: opts.eventVersion ?? 1,\n      occurredAtMs: opts.occurredAtMs ?? Date.now(),\n      source: opts.source ?? \"xenia-server-sdk\",\n      identity: {\n        ...opts.identity,\n        // SDK-owned, set LAST so it can't be overridden per call. Comes from\n        // `config.visitorId` (bind it per request from the `xenia_vid` cookie).\n        xeniaVisitorId: this.visitorId,\n      },\n      context: opts.context,\n      properties: opts.properties,\n      consent: opts.consent,\n      trigger: opts.trigger === true ? true : undefined,\n    };\n    return this.api.sendEvents([event]);\n  }\n\n  /**\n   * Send a webhook request and await the synchronous response. Merges\n   * `opts.identity`/`opts.context` into the payload the same way the browser\n   * client's auto-attached fields do (`path`, `query`, `url`, `referrer`,\n   * `deviceId`, `visitorId`, etc.) — see `ServerWebhookOptions`.\n   */\n  async webhook(\n    triggerId: string,\n    data?: Record<string, JsonValue | undefined>,\n    opts: ServerWebhookOptions = {},\n  ): Promise<WebhookResponse> {\n    const payload = buildEventPayload({\n      eventId: triggerId,\n      journeyId: opts.journeyId,\n      // SDK-owned visitor anchor wins: config.visitorId (bind the `xenia_vid`\n      // cookie per request) is attached automatically. Falls back to a\n      // per-call visitorId only when none is bound.\n      identity: { ...opts.identity, visitorId: this.visitorId ?? opts.identity?.visitorId },\n      context: opts.context,\n      props: data,\n    });\n    return this.api.webhook(triggerId, payload as JsonValue, opts.method ?? \"POST\");\n  }\n\n  /** Bind visitor→user server-side — `POST /api/events/v1/identify`. */\n  async identify(body: IdentifyRequest): Promise<IdentifyResponse> {\n    return this.api.identify(body);\n  }\n\n  /**\n   * Resolve in-entry content personalization for one content key\n   * (`POST /api/personalization/resolve`). Requires a configured SDK token\n   * (`token`/`getToken`) — resolve is auth-required. With `merge: true` the\n   * returned `content` is server-spliced.\n   */\n  async resolve(contentKey: string, opts?: ResolveOptions): Promise<ResolveResult> {\n    return this.api.resolve(contentKey, this.withVisitor(opts));\n  }\n\n  /** Resolve several content keys in one round-trip (`POST /api/personalization/resolve-batch`). */\n  async resolveBatch(\n    items: ResolveBatchItem[],\n    opts?: ResolveOptions,\n  ): Promise<ResolveBatchResult[]> {\n    return this.api.resolveBatch(items, this.withVisitor(opts));\n  }\n\n  /**\n   * Stamp the SDK-owned visitor id (`config.visitorId`) into the resolve `data`\n   * under the reserved `_xenia_vid` key so the backend can bucket holdout\n   * experiments and record exposure per visitor. Set last so a caller can't\n   * override it; a no-op when no `visitorId` was bound on this client.\n   */\n  private withVisitor(opts?: ResolveOptions): ResolveOptions | undefined {\n    if (!this.visitorId) return opts;\n    return { ...opts, data: { ...(opts?.data ?? {}), _xenia_vid: this.visitorId } };\n  }\n}\n\n/** Create a server-native client. */\nexport function createXeniaServer(config: XeniaConfig): XeniaServer {\n  return new XeniaServer(config);\n}\n","import { HttpClient } from \"../core/http-client\";\nimport type { JsonObject } from \"../core/types\";\n\nexport interface RefreshTokenOptions {\n  /**\n   * Xenia base URL. Defaults to the hosted engine,\n   * `https://engine.xeniamartech.com/xenia` — omit unless self-hosting.\n   */\n  baseUrl?: string;\n  /**\n   * The personalization SDK token created once in the dashboard (API Tokens →\n   * Create token). Stays server-side; the browser never sees it — only the\n   * short-lived token this exchanges it for does.\n   */\n  sdkToken: string;\n  /** Lifetime of the returned token, in minutes. Default 15, capped server-side at 60. */\n  ttlMinutes?: number;\n  timeout?: number;\n}\n\nexport interface RefreshedToken {\n  token: string;\n  expiresAt?: string;\n}\n\n/**\n * Exchange the long-lived personalization SDK token for a short-lived one with\n * the same tenant/env scope, via `POST /api/personalization/token/refresh`.\n * Self-service — no dashboard credential needed, just the SDK token you\n * already have. Call this from your backend and hand the result to the\n * browser (e.g. from a token route the client SDK calls via `getToken`).\n */\nexport async function refreshSdkToken(opts: RefreshTokenOptions): Promise<RefreshedToken> {\n  const http = new HttpClient({ baseUrl: opts.baseUrl, timeout: opts.timeout });\n  const { data } = await http.request({\n    method: \"POST\",\n    path: \"/api/personalization/token/refresh\",\n    headers: { Authorization: `Bearer ${opts.sdkToken}` },\n    body: { ttlMinutes: opts.ttlMinutes ?? null },\n  });\n  const obj = (data ?? {}) as JsonObject;\n  return {\n    token: String(obj.token ?? \"\"),\n    expiresAt: typeof obj.expiresAt === \"string\" ? obj.expiresAt : undefined,\n  };\n}\n\n/**\n * Build a framework-agnostic request handler that hands the browser SDK a\n * personalization token — mount it at the endpoint `getToken` calls. Needs\n * only the SDK token you already created in the dashboard; mints a fresh\n * short-lived token per request so the long-lived one never reaches the\n * browser.\n *\n * @example\n * ```ts\n * export const GET = createTokenRoute({\n *   sdkToken: process.env.XENIA_SDK_TOKEN!,\n *   // baseUrl: process.env.XENIA_URL, // only to override the default hosted engine\n * });\n * ```\n */\nexport function createTokenRoute(config: RefreshTokenOptions): (request: Request) => Promise<Response> {\n  return async (): Promise<Response> => {\n    try {\n      const refreshed = await refreshSdkToken(config);\n      return new Response(JSON.stringify(refreshed), {\n        status: 200,\n        headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n      });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"token refresh failed\";\n      return new Response(JSON.stringify({ error: message }), {\n        status: 500,\n        headers: { \"Content-Type\": \"application/json\" },\n      });\n    }\n  };\n}\n","import {\n  CONSENT_COOKIE,\n  VISITOR_COOKIE,\n  consentCookieName,\n  visitorCookieName,\n} from \"../core/cookie-names\";\nimport type { ConsentState } from \"../core/types\";\n\n/**\n * Cookie names the SDK reads server-side (set by the browser SDK / your app).\n *\n * The constants are the DEFAULT-prefix names; the functions build the name for any prefix. If you\n * pass `config.prefix` to the browser client, pass the same prefix here — the browser namespaces\n * the cookie by it, so the default name won't be there to find.\n */\nexport { CONSENT_COOKIE, VISITOR_COOKIE, consentCookieName, visitorCookieName };\n\n/**\n * Parse a raw `Cookie` header into a map. Framework-agnostic so it works with\n * `Request.headers.get(\"cookie\")`, Node `req.headers.cookie`, etc.\n */\nexport function parseCookies(header: string | null | undefined): Record<string, string> {\n  const out: Record<string, string> = {};\n  if (!header) return out;\n  for (const part of header.split(\";\")) {\n    const idx = part.indexOf(\"=\");\n    if (idx === -1) continue;\n    const key = part.slice(0, idx).trim();\n    const value = part.slice(idx + 1).trim();\n    if (key) out[key] = decodeURIComponent(value);\n  }\n  return out;\n}\n\n/**\n * Read the visitor id the browser SDK wrote, so a server-side event can be bound to the same\n * visitor (`createXeniaServer({ visitorId })`) and attribute to a browser-entered journey.\n *\n * @param prefix Must match the browser client's `config.prefix`. The cookie is namespaced by it, so\n *               a mismatch finds nothing and quietly leaves the server with no visitor.\n */\nexport function getVisitorId(\n  cookieHeader: string | null | undefined,\n  prefix?: string,\n): string | null {\n  return parseCookies(cookieHeader)[visitorCookieName(prefix)] ?? null;\n}\n\n/**\n * Read consent from a cookie header. Accepts a JSON blob or a comma-list of\n * granted scopes (e.g. `analytics,personalization`). Absent → all denied.\n *\n * @param prefix Must match the browser client's `config.prefix` — see {@link getVisitorId}.\n */\nexport function getConsent(\n  cookieHeader: string | null | undefined,\n  prefix?: string,\n): ConsentState {\n  const raw = parseCookies(cookieHeader)[consentCookieName(prefix)];\n  if (!raw) return { analytics: false, marketing: false, personalization: false };\n  try {\n    const parsed = JSON.parse(raw) as ConsentState;\n    return parsed;\n  } catch {\n    const scopes = new Set(raw.split(\",\").map((s) => s.trim()));\n    return {\n      analytics: scopes.has(\"analytics\"),\n      marketing: scopes.has(\"marketing\"),\n      personalization: scopes.has(\"personalization\"),\n    };\n  }\n}\n"]}
+{"version":3,"sources":["../../src/core/event-payload.ts","../../src/server/xenia-server.ts","../../src/server/token.ts","../../src/server/cookies.ts"],"names":["compact","XeniaApi","toEventId","generateUlid","HttpClient","visitorCookieName","consentCookieName"],"mappings":";;;;;AAGA,IAAM,QAAA,uBAAe,GAAA,CAAI;AAAA,EACvB,SAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,aAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAC,CAAA;AAaD,SAASA,SAAQ,GAAA,EAAuE;AACtF,EAAA,MAAM,MAAiC,EAAC;AACxC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AACxC,IAAA,IAAI,CAAA,KAAM,MAAA,EAAW,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EAChC;AACA,EAAA,OAAO,GAAA;AACT;AAWO,SAAS,kBAAkB,KAAA,EAAsC;AACtE,EAAA,MAAM,cAAyC,EAAC;AAChD,EAAA,MAAM,WAAsC,EAAC;AAC7C,EAAA,IAAI,MAAM,KAAA,EAAO;AACf,IAAA,KAAA,MAAW,CAAC,GAAG,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,KAAK,CAAA,EAAG;AAChD,MAAA,IAAI,MAAM,MAAA,EAAW;AAKrB,MAAA,IAAI,SAAS,GAAA,CAAI,CAAC,CAAA,EAAG,QAAA,CAAS,CAAC,CAAA,GAAI,CAAA;AAAA,WAC9B,WAAA,CAAY,CAAC,CAAA,GAAI,CAAA;AAAA,IACxB;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,GAAG,WAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAKH,GAAG,QAAA;AAAA,IACH,GAAGA,QAAAA,CAAS,KAAA,CAAM,OAAA,IAAW,EAA4C,CAAA;AAAA,IACzE,GAAGA,QAAAA,CAAS,KAAA,CAAM,QAAA,IAAY,EAA4C,CAAA;AAAA,IAC1E,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,GAAI,MAAM,SAAA,GAAY,EAAE,WAAW,KAAA,CAAM,SAAA,KAAc,EAAC;AAAA,IACxD,GAAI,MAAM,SAAA,GAAY,EAAE,WAAW,KAAA,CAAM,SAAA,KAAc;AAAC,GAC1D;AAEA,EAAA,OAAO,OAAA;AACT;;;ACbO,IAAM,cAAN,MAAkB;AAAA,EACd,GAAA;AAAA;AAAA,EAEQ,SAAA;AAAA;AAAA,EAEA,OAAA;AAAA,EAEjB,YAAY,MAAA,EAAqB;AAC/B,IAAA,IAAA,CAAK,GAAA,GAAM,IAAIC,0BAAA,CAAS,MAAM,CAAA;AAC9B,IAAA,IAAA,CAAK,YAAY,MAAA,CAAO,SAAA;AACxB,IAAA,IAAA,CAAK,UAAU,MAAA,CAAO,OAAA;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,CACJ,SAAA,EACA,IAAA,GAA2B,EAAC,EACM;AAClC,IAAA,MAAM,KAAA,GAAoB;AAAA,MACxB,SAAA;AAAA,MACA,SAAS,IAAA,CAAK,OAAA,GAAUC,4BAAU,IAAA,CAAK,OAAO,IAAIC,8BAAA,EAAa;AAAA,MAC/D,YAAA,EAAc,KAAK,YAAA,IAAgB,CAAA;AAAA,MACnC,YAAA,EAAc,IAAA,CAAK,YAAA,IAAgB,IAAA,CAAK,GAAA,EAAI;AAAA,MAC5C,MAAA,EAAQ,KAAK,MAAA,IAAU,kBAAA;AAAA,MACvB,QAAA,EAAU;AAAA,QACR,GAAG,IAAA,CAAK,QAAA;AAAA;AAAA;AAAA,QAGR,gBAAgB,IAAA,CAAK;AAAA,OACvB;AAAA,MACA,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,OAAA,EAAS,IAAA,CAAK,OAAA,KAAY,IAAA,GAAO,IAAA,GAAO;AAAA,KAC1C;AACA,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,UAAA,CAAW,CAAC,KAAK,CAAC,CAAA;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAA,CACJ,SAAA,EACA,IAAA,EACA,IAAA,GAA6B,EAAC,EACJ;AAC1B,IAAA,MAAM,UAAU,iBAAA,CAAkB;AAAA,MAChC,OAAA,EAAS,SAAA;AAAA,MACT,WAAW,IAAA,CAAK,SAAA;AAAA;AAAA;AAAA;AAAA,MAIhB,QAAA,EAAU,EAAE,GAAG,IAAA,CAAK,QAAA,EAAU,WAAW,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,QAAA,EAAU,SAAA,EAAU;AAAA;AAAA;AAAA,MAGpF,SAAS,EAAE,GAAG,KAAK,OAAA,EAAS,GAAG,KAAK,OAAA,EAAQ;AAAA,MAC5C,KAAA,EAAO;AAAA,KACR,CAAA;AACD,IAAA,OAAO,KAAK,GAAA,CAAI,OAAA,CAAQ,WAAW,OAAA,EAAsB,IAAA,CAAK,UAAU,MAAM,CAAA;AAAA,EAChF;AAAA;AAAA,EAGA,MAAM,SAAS,IAAA,EAAkD;AAC/D,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,QAAA,CAAS,IAAI,CAAA;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,OAAA,CAAQ,UAAA,EAAoB,IAAA,EAA+C;AAC/E,IAAA,OAAO,KAAK,GAAA,CAAI,OAAA,CAAQ,YAAY,IAAA,CAAK,WAAA,CAAY,IAAI,CAAC,CAAA;AAAA,EAC5D;AAAA;AAAA,EAGA,MAAM,YAAA,CACJ,KAAA,EACA,IAAA,EAC+B;AAC/B,IAAA,OAAO,KAAK,GAAA,CAAI,YAAA,CAAa,OAAO,IAAA,CAAK,WAAA,CAAY,IAAI,CAAC,CAAA;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBQ,YAAY,IAAA,EAAmD;AACrE,IAAA,MAAM,WAAWH,yBAAA,CAAQ;AAAA,MACvB,GAAG,IAAA,EAAM,QAAA;AAAA,MACT,SAAA,EAAW,IAAA,CAAK,SAAA,IAAa,IAAA,EAAM,QAAA,EAAU;AAAA,KAC9C,CAAA;AACD,IAAA,MAAM,MAAA,GAAS;AAAA,MACb,GAAGA,yBAAA,CAAS,IAAA,CAAK,OAAA,IAAW,EAA4C,CAAA;AAAA,MACxE,GAAGA,yBAAA,CAAS,IAAA,EAAM,OAAA,IAAW,EAA4C,CAAA;AAAA,MACzE,GAAG;AAAA,KACL;AACA,IAAA,IAAI,MAAA,CAAO,KAAK,MAAM,CAAA,CAAE,WAAW,CAAA,IAAK,CAAC,IAAA,CAAK,SAAA,EAAW,OAAO,IAAA;AAChE,IAAA,IAAI,IAAA,CAAK,SAAA,EAAW,MAAA,CAAO,UAAA,GAAa,IAAA,CAAK,SAAA;AAC7C,IAAA,OAAO,EAAE,GAAG,IAAA,EAAM,IAAA,EAAM,EAAE,GAAI,IAAA,EAAM,IAAA,IAAQ,EAAC,EAAI,GAAG,MAAA,EAAO,EAAE;AAAA,EAC/D;AACF;AAGO,SAAS,kBAAkB,MAAA,EAAkC;AAClE,EAAA,OAAO,IAAI,YAAY,MAAM,CAAA;AAC/B;;;ACxKA,eAAsB,gBAAgB,IAAA,EAAoD;AACxF,EAAA,MAAM,IAAA,GAAO,IAAII,4BAAA,CAAW,EAAE,OAAA,EAAS,KAAK,OAAA,EAAS,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,CAAA;AAC5E,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,KAAK,OAAA,CAAQ;AAAA,IAClC,MAAA,EAAQ,MAAA;AAAA,IACR,IAAA,EAAM,oCAAA;AAAA,IACN,SAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,QAAQ,CAAA,CAAA,EAAG;AAAA,IACpD,IAAA,EAAM,EAAE,UAAA,EAAY,IAAA,CAAK,cAAc,IAAA;AAAK,GAC7C,CAAA;AACD,EAAA,MAAM,GAAA,GAAO,QAAQ,EAAC;AACtB,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,KAAA,IAAS,EAAE,CAAA;AAAA,IAC7B,WAAW,OAAO,GAAA,CAAI,SAAA,KAAc,QAAA,GAAW,IAAI,SAAA,GAAY;AAAA,GACjE;AACF;AAiBO,SAAS,iBAAiB,MAAA,EAAsE;AACrG,EAAA,OAAO,YAA+B;AACpC,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAY,MAAM,eAAA,CAAgB,MAAM,CAAA;AAC9C,MAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,SAAS,CAAA,EAAG;AAAA,QAC7C,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,iBAAiB,UAAA;AAAW,OAC5E,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,sBAAA;AACrD,MAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG;AAAA,QACtD,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,OAC/C,CAAA;AAAA,IACH;AAAA,EACF,CAAA;AACF;;;ACzDO,SAAS,aAAa,MAAA,EAA2D;AACtF,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,IAAI,CAAC,QAAQ,OAAO,GAAA;AACpB,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAAG;AACpC,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC5B,IAAA,IAAI,QAAQ,EAAA,EAAI;AAChB,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,EAAE,IAAA,EAAK;AACpC,IAAA,MAAM,QAAQ,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AACvC,IAAA,IAAI,GAAA,EAAK,GAAA,CAAI,GAAG,CAAA,GAAI,mBAAmB,KAAK,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,GAAA;AACT;AASO,SAAS,YAAA,CACd,cACA,MAAA,EACe;AACf,EAAA,OAAO,aAAa,YAAY,CAAA,CAAEC,mCAAA,CAAkB,MAAM,CAAC,CAAA,IAAK,IAAA;AAClE;AAQO,SAAS,UAAA,CACd,cACA,MAAA,EACc;AACd,EAAA,MAAM,MAAM,YAAA,CAAa,YAAY,CAAA,CAAEC,mCAAA,CAAkB,MAAM,CAAC,CAAA;AAChE,EAAA,IAAI,CAAC,KAAK,OAAO,EAAE,WAAW,KAAA,EAAO,SAAA,EAAW,KAAA,EAAO,eAAA,EAAiB,KAAA,EAAM;AAC9E,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AAC1D,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,WAAW,CAAA;AAAA,MACjC,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,WAAW,CAAA;AAAA,MACjC,eAAA,EAAiB,MAAA,CAAO,GAAA,CAAI,iBAAiB;AAAA,KAC/C;AAAA,EACF;AACF","file":"index.cjs","sourcesContent":["import type { EventContext, EventIdentity, EventPayload, JsonValue } from \"./types\";\n\n/** Reserved keys that map to first-class fields (not passthrough data). */\nconst RESERVED = new Set([\n  \"eventId\",\n  \"eventType\",\n  \"journeyId\",\n  \"deviceId\",\n  \"visitorId\",\n  \"customerId\",\n  \"email\",\n  \"utmSource\",\n  \"utmMedium\",\n  \"utmCampaign\",\n  \"utmContent\",\n  \"utmId\",\n  \"url\",\n  \"referrer\",\n  \"path\",\n  \"query\",\n]);\n\nexport interface BuildEventInput {\n  eventId: string;\n  eventType?: string;\n  journeyId?: string;\n  identity?: EventIdentity;\n  context?: EventContext;\n  /** Arbitrary extra properties merged as passthrough data. */\n  props?: Record<string, JsonValue | undefined>;\n}\n\n/** Drop `undefined` values so the JSON body stays clean. */\nfunction compact(obj: Record<string, JsonValue | undefined>): Record<string, JsonValue> {\n  const out: Record<string, JsonValue> = {};\n  for (const [k, v] of Object.entries(obj)) {\n    if (v !== undefined) out[k] = v;\n  }\n  return out;\n}\n\n/**\n * Build the request body for the webhook `/flow` call (`XeniaApi.webhook`).\n *\n * Merge order (later wins): passthrough props < context < identity < core.\n * Field names match the backend `EventTriggerRequest` DTO exactly.\n *\n * @internal Used only by the webhook request/response path — the unified event\n * surface (`track()` → `POST /api/events/v1`) builds {@link XeniaEvent} instead.\n */\nexport function buildEventPayload(input: BuildEventInput): EventPayload {\n  const passthrough: Record<string, JsonValue> = {};\n  const reserved: Record<string, JsonValue> = {};\n  if (input.props) {\n    for (const [k, v] of Object.entries(input.props)) {\n      if (v === undefined) continue;\n      // A prop whose key matches a reserved field (e.g. `email`, `customerId`,\n      // `utmSource`) is promoted to that first-class field; everything else is\n      // custom passthrough data. Previously reserved-named props were dropped\n      // outright — so `track(\"sign_up\", { email })` never sent `email` at all.\n      if (RESERVED.has(k)) reserved[k] = v;\n      else passthrough[k] = v;\n    }\n  }\n\n  const payload = {\n    ...passthrough,\n    // Reserved-named props fill first-class fields (e.g. `email`, `customerId`)\n    // the SDK didn't auto-collect. Auto-collected context/identity still win for\n    // what they reliably know (real page url, visitor/device id), so a stray prop\n    // can't override the true page context — see merge order below.\n    ...reserved,\n    ...compact((input.context ?? {}) as Record<string, JsonValue | undefined>),\n    ...compact((input.identity ?? {}) as Record<string, JsonValue | undefined>),\n    eventId: input.eventId,\n    ...(input.eventType ? { eventType: input.eventType } : {}),\n    ...(input.journeyId ? { journeyId: input.journeyId } : {}),\n  };\n\n  return payload as EventPayload;\n}\n","import { compact, XeniaApi } from \"../core/api\";\nimport { buildEventPayload } from \"../core/event-payload\";\nimport { generateUlid, toEventId } from \"../core/id\";\nimport type {\n  AnalyticsContext,\n  AnalyticsEventName,\n  CallerIdentity,\n  AnalyticsIngestResponse,\n  ConsentState,\n  EventContext,\n  EventIdentity,\n  IdentifyRequest,\n  IdentifyResponse,\n  JsonValue,\n  ResolveBatchItem,\n  ResolveBatchResult,\n  ResolveOptions,\n  ResolveResult,\n  WebhookResponse,\n  XeniaConfig,\n  XeniaEvent,\n} from \"../core/types\";\n\n/**\n * Extra per-call identity/context for server-side webhook calls — an override on top of whatever the\n * client already carries.\n *\n * There's no ambient `window` on the server to auto-collect `path`/`query`/`url`/UTM params the way\n * the browser client does, so bind them ONCE per request via {@link XeniaConfig.context} (see\n * `contextFromUrl`) and every call attaches them automatically. These per-call fields are for the\n * remainder: values known only at this call site, or a deliberate override of the ambient ones.\n */\nexport interface ServerWebhookOptions {\n  method?: \"GET\" | \"POST\";\n  journeyId?: string;\n  identity?: EventIdentity;\n  context?: EventContext;\n}\n\n/**\n * Options for a server-side unified event (`POST /api/events/v1`). There's no\n * ambient request context on the server — pass whatever's known at the call\n * site (e.g. pathname/user-agent from the current request, session id from a\n * cookie) via `identity`/`context`.\n */\nexport interface ServerTrackOptions {\n  /** When true, also match/advance a journey (never sampled/shed). Default false. */\n  trigger?: boolean;\n  /** Stable dedup key (e.g. `\"ord-1001\"`) for idempotent conversions. */\n  eventId?: string;\n  eventVersion?: number;\n  occurredAtMs?: number;\n  /** Origin tag. Default `\"xenia-server-sdk\"`. */\n  source?: string;\n  /** Identity fields for this event (except the SDK-owned `xeniaVisitorId`,\n   *  which comes from `config.visitorId` and can't be set per call). */\n  identity?: CallerIdentity;\n  context?: AnalyticsContext;\n  properties?: Record<string, JsonValue | undefined>;\n  consent?: ConsentState;\n}\n\n/**\n * Server-native Xenia client. Same method names as the browser client, but\n * every call is stateless: identity and context are passed explicitly rather\n * than read from the DOM/localStorage. Uses global `fetch` (Node ≥18).\n */\nexport class XeniaServer {\n  readonly api: XeniaApi;\n  /** SDK-owned visitor anchor for this (per-request) client — see {@link XeniaConfig.visitorId}. */\n  private readonly visitorId?: string;\n  /** Ambient request context attached to every call — see {@link XeniaConfig.context}. */\n  private readonly context?: EventContext;\n\n  constructor(config: XeniaConfig) {\n    this.api = new XeniaApi(config);\n    this.visitorId = config.visitorId;\n    this.context = config.context;\n  }\n\n  /**\n   * Send a unified event server-side (`POST /api/events/v1`) and return the\n   * ingest response (including per-result `triggered`). `opts.trigger: true`\n   * also matches/advances a journey; pass `opts.eventId` (e.g. `\"ord-1001\"`)\n   * as a stable dedup key for idempotent conversions.\n   */\n  async track(\n    eventName: AnalyticsEventName,\n    opts: ServerTrackOptions = {},\n  ): Promise<AnalyticsIngestResponse> {\n    const event: XeniaEvent = {\n      eventName,\n      eventId: opts.eventId ? toEventId(opts.eventId) : generateUlid(),\n      eventVersion: opts.eventVersion ?? 1,\n      occurredAtMs: opts.occurredAtMs ?? Date.now(),\n      source: opts.source ?? \"xenia-server-sdk\",\n      identity: {\n        ...opts.identity,\n        // SDK-owned, set LAST so it can't be overridden per call. Comes from\n        // `config.visitorId` (bind it per request from the `xenia_vid` cookie).\n        xeniaVisitorId: this.visitorId,\n      },\n      context: opts.context,\n      properties: opts.properties,\n      consent: opts.consent,\n      trigger: opts.trigger === true ? true : undefined,\n    };\n    return this.api.sendEvents([event]);\n  }\n\n  /**\n   * Send a webhook request and await the synchronous response. Merges\n   * `opts.identity`/`opts.context` into the payload the same way the browser\n   * client's auto-attached fields do (`path`, `query`, `url`, `referrer`,\n   * `deviceId`, `visitorId`, etc.) — see `ServerWebhookOptions`.\n   */\n  async webhook(\n    triggerId: string,\n    data?: Record<string, JsonValue | undefined>,\n    opts: ServerWebhookOptions = {},\n  ): Promise<WebhookResponse> {\n    const payload = buildEventPayload({\n      eventId: triggerId,\n      journeyId: opts.journeyId,\n      // SDK-owned visitor anchor wins: config.visitorId (bind the `xenia_vid`\n      // cookie per request) is attached automatically. Falls back to a\n      // per-call visitorId only when none is bound.\n      identity: { ...opts.identity, visitorId: this.visitorId ?? opts.identity?.visitorId },\n      // Ambient request context (config.context, bound once per request) under a per-call\n      // override — same precedence resolve() uses, so both surfaces carry the same fields.\n      context: { ...this.context, ...opts.context },\n      props: data,\n    });\n    return this.api.webhook(triggerId, payload as JsonValue, opts.method ?? \"POST\");\n  }\n\n  /** Bind visitor→user server-side — `POST /api/events/v1/identify`. */\n  async identify(body: IdentifyRequest): Promise<IdentifyResponse> {\n    return this.api.identify(body);\n  }\n\n  /**\n   * Resolve in-entry content personalization for one content key\n   * (`POST /api/personalization/resolve`). Requires a configured SDK token\n   * (`token`/`getToken`) — resolve is auth-required. With `merge: true` the\n   * returned `content` is server-spliced.\n   *\n   * Pass `opts.identity`/`opts.context` to attach the same SDK-provided\n   * fields (`deviceId`, `customerId`, `email`, `path`, `url`, `referrer`,\n   * `utm*`, …) the browser client collects ambiently — there's no ambient\n   * `window`/`document` server-side, so a server caller must supply whatever\n   * it knows (e.g. from the current request) explicitly. See\n   * {@link ResolveOptions}.\n   */\n  async resolve(contentKey: string, opts?: ResolveOptions): Promise<ResolveResult> {\n    return this.api.resolve(contentKey, this.withVisitor(opts));\n  }\n\n  /** Resolve several content keys in one round-trip (`POST /api/personalization/resolve-batch`). */\n  async resolveBatch(\n    items: ResolveBatchItem[],\n    opts?: ResolveOptions,\n  ): Promise<ResolveBatchResult[]> {\n    return this.api.resolveBatch(items, this.withVisitor(opts));\n  }\n\n  /**\n   * Merge the ambient `config.context` and `opts.identity`/`opts.context` into\n   * the resolve `data`, then stamp the SDK-owned visitor id\n   * (`config.visitorId`) under both the reserved `_xenia_vid` key (read by the\n   * backend for holdout/exposure bucketing) and the flat `visitorId` field —\n   * mirrors `webhook()`'s merge order/precedence exactly: caller `data` <\n   * ambient `config.context` < caller `context`/`identity` < SDK-owned\n   * `visitorId`/`_xenia_vid`, set LAST so neither can be overridden per call.\n   *\n   * `config.context` is what makes the SDK-provided fields automatic on the\n   * server: bound once per request, every `resolve()` carries `path`/`query`/\n   * `url`/`referrer`/UTMs with no per-call wiring, matching what the browser\n   * client collects from `window` on its own. A no-op when nothing is bound and\n   * nothing was passed — preserving today's behavior for callers using neither.\n   */\n  private withVisitor(opts?: ResolveOptions): ResolveOptions | undefined {\n    const identity = compact({\n      ...opts?.identity,\n      visitorId: this.visitorId ?? opts?.identity?.visitorId,\n    });\n    const merged = {\n      ...compact((this.context ?? {}) as Record<string, JsonValue | undefined>),\n      ...compact((opts?.context ?? {}) as Record<string, JsonValue | undefined>),\n      ...identity,\n    };\n    if (Object.keys(merged).length === 0 && !this.visitorId) return opts;\n    if (this.visitorId) merged._xenia_vid = this.visitorId;\n    return { ...opts, data: { ...(opts?.data ?? {}), ...merged } };\n  }\n}\n\n/** Create a server-native client. */\nexport function createXeniaServer(config: XeniaConfig): XeniaServer {\n  return new XeniaServer(config);\n}\n","import { HttpClient } from \"../core/http-client\";\nimport type { JsonObject } from \"../core/types\";\n\nexport interface RefreshTokenOptions {\n  /**\n   * Xenia base URL. Defaults to the hosted engine,\n   * `https://engine.xeniamartech.com/xenia` — omit unless self-hosting.\n   */\n  baseUrl?: string;\n  /**\n   * The personalization SDK token created once in the dashboard (API Tokens →\n   * Create token). Stays server-side; the browser never sees it — only the\n   * short-lived token this exchanges it for does.\n   */\n  sdkToken: string;\n  /** Lifetime of the returned token, in minutes. Default 15, capped server-side at 60. */\n  ttlMinutes?: number;\n  timeout?: number;\n}\n\nexport interface RefreshedToken {\n  token: string;\n  expiresAt?: string;\n}\n\n/**\n * Exchange the long-lived personalization SDK token for a short-lived one with\n * the same tenant/env scope, via `POST /api/personalization/token/refresh`.\n * Self-service — no dashboard credential needed, just the SDK token you\n * already have. Call this from your backend and hand the result to the\n * browser (e.g. from a token route the client SDK calls via `getToken`).\n */\nexport async function refreshSdkToken(opts: RefreshTokenOptions): Promise<RefreshedToken> {\n  const http = new HttpClient({ baseUrl: opts.baseUrl, timeout: opts.timeout });\n  const { data } = await http.request({\n    method: \"POST\",\n    path: \"/api/personalization/token/refresh\",\n    headers: { Authorization: `Bearer ${opts.sdkToken}` },\n    body: { ttlMinutes: opts.ttlMinutes ?? null },\n  });\n  const obj = (data ?? {}) as JsonObject;\n  return {\n    token: String(obj.token ?? \"\"),\n    expiresAt: typeof obj.expiresAt === \"string\" ? obj.expiresAt : undefined,\n  };\n}\n\n/**\n * Build a framework-agnostic request handler that hands the browser SDK a\n * personalization token — mount it at the endpoint `getToken` calls. Needs\n * only the SDK token you already created in the dashboard; mints a fresh\n * short-lived token per request so the long-lived one never reaches the\n * browser.\n *\n * @example\n * ```ts\n * export const GET = createTokenRoute({\n *   sdkToken: process.env.XENIA_SDK_TOKEN!,\n *   // baseUrl: process.env.XENIA_URL, // only to override the default hosted engine\n * });\n * ```\n */\nexport function createTokenRoute(config: RefreshTokenOptions): (request: Request) => Promise<Response> {\n  return async (): Promise<Response> => {\n    try {\n      const refreshed = await refreshSdkToken(config);\n      return new Response(JSON.stringify(refreshed), {\n        status: 200,\n        headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n      });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"token refresh failed\";\n      return new Response(JSON.stringify({ error: message }), {\n        status: 500,\n        headers: { \"Content-Type\": \"application/json\" },\n      });\n    }\n  };\n}\n","import {\n  CONSENT_COOKIE,\n  VISITOR_COOKIE,\n  consentCookieName,\n  visitorCookieName,\n} from \"../core/cookie-names\";\nimport type { ConsentState } from \"../core/types\";\n\n/**\n * Cookie names the SDK reads server-side (set by the browser SDK / your app).\n *\n * The constants are the DEFAULT-prefix names; the functions build the name for any prefix. If you\n * pass `config.prefix` to the browser client, pass the same prefix here — the browser namespaces\n * the cookie by it, so the default name won't be there to find.\n */\nexport { CONSENT_COOKIE, VISITOR_COOKIE, consentCookieName, visitorCookieName };\n\n/**\n * Parse a raw `Cookie` header into a map. Framework-agnostic so it works with\n * `Request.headers.get(\"cookie\")`, Node `req.headers.cookie`, etc.\n */\nexport function parseCookies(header: string | null | undefined): Record<string, string> {\n  const out: Record<string, string> = {};\n  if (!header) return out;\n  for (const part of header.split(\";\")) {\n    const idx = part.indexOf(\"=\");\n    if (idx === -1) continue;\n    const key = part.slice(0, idx).trim();\n    const value = part.slice(idx + 1).trim();\n    if (key) out[key] = decodeURIComponent(value);\n  }\n  return out;\n}\n\n/**\n * Read the visitor id the browser SDK wrote, so a server-side event can be bound to the same\n * visitor (`createXeniaServer({ visitorId })`) and attribute to a browser-entered journey.\n *\n * @param prefix Must match the browser client's `config.prefix`. The cookie is namespaced by it, so\n *               a mismatch finds nothing and quietly leaves the server with no visitor.\n */\nexport function getVisitorId(\n  cookieHeader: string | null | undefined,\n  prefix?: string,\n): string | null {\n  return parseCookies(cookieHeader)[visitorCookieName(prefix)] ?? null;\n}\n\n/**\n * Read consent from a cookie header. Accepts a JSON blob or a comma-list of\n * granted scopes (e.g. `analytics,personalization`). Absent → all denied.\n *\n * @param prefix Must match the browser client's `config.prefix` — see {@link getVisitorId}.\n */\nexport function getConsent(\n  cookieHeader: string | null | undefined,\n  prefix?: string,\n): ConsentState {\n  const raw = parseCookies(cookieHeader)[consentCookieName(prefix)];\n  if (!raw) return { analytics: false, marketing: false, personalization: false };\n  try {\n    const parsed = JSON.parse(raw) as ConsentState;\n    return parsed;\n  } catch {\n    const scopes = new Set(raw.split(\",\").map((s) => s.trim()));\n    return {\n      analytics: scopes.has(\"analytics\"),\n      marketing: scopes.has(\"marketing\"),\n      personalization: scopes.has(\"personalization\"),\n    };\n  }\n}\n"]}