@xenia-martech/sdk-js 1.0.1-dev.1 → 1.1.0-dev.2

package/dist/next/index.d.cts

@@ -0,0 +1,45 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { V as VisitorCookieOptions, d as ConsentState, t as XeniaConfig } from '../api-URhxxi4x.cjs';
+import { X as XeniaServer } from '../xenia-server-rs3Gpbw7.cjs';
+
+/**
+ * `@xenia-martech/sdk-js/next` — Next.js (App Router, 15+) glue for the server SDK.
+ *
+ * A Server Component can't see its own URL or set cookies during render, so the two halves split
+ * the work: `xeniaProxy()` runs in `proxy.ts`/`middleware.ts` (mints the visitor cookie, stamps the
+ * URL onto a request header), and `xeniaServerFromNext()` reads both back to bind a per-request
+ * `XeniaServer`. Use them together; each alone degrades gracefully (no URL context / a throwaway
+ * visitor id).
+ */
+
+/** Request header `xeniaProxy()` stamps with the URL being served. */
+declare const URL_HEADER = "x-xenia-url";
+interface XeniaProxyOptions {
+    /** Request headers to forward (e.g. your own additions); defaults to the incoming ones. */
+    headers?: Headers;
+    /** Must match the browser client's `config.prefix`, if you set one. */
+    prefix?: string;
+    /** Visitor cookie attributes. Default: `path=/`, `SameSite=Lax`, one year. */
+    cookie?: VisitorCookieOptions;
+}
+/**
+ * Next.js proxy/middleware step: ensure the visitor cookie exists and stamp the URL onto
+ * {@link URL_HEADER}, then continue. A new visitor id is also put on the forwarded `Cookie` header,
+ * so this very request's render already sees it.
+ *
+ * ```ts
+ * // proxy.ts
+ * export const proxy = (request: NextRequest) => xeniaProxy(request);
+ * ```
+ */
+declare function xeniaProxy(request: NextRequest, opts?: XeniaProxyOptions): NextResponse;
+/**
+ * A `XeniaServer` bound to this request's visitor (the cookie `xeniaProxy()` set) and URL context
+ * (path, query, UTMs, referrer). For Server Components, Server Actions and Route Handlers.
+ * `config.visitorId`/`config.context` still win when passed.
+ */
+declare function xeniaServerFromNext(config: XeniaConfig): Promise<XeniaServer>;
+/** This request's consent, from the cookie the browser client's `consent()` (or `consentCookie()`) wrote. */
+declare function consentFromNext(prefix?: string): Promise<ConsentState>;
+
+export { URL_HEADER, type XeniaProxyOptions, consentFromNext, xeniaProxy, xeniaServerFromNext };

package/dist/next/index.d.ts

@@ -0,0 +1,45 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { V as VisitorCookieOptions, d as ConsentState, t as XeniaConfig } from '../api-URhxxi4x.js';
+import { X as XeniaServer } from '../xenia-server-D-ozqSgv.js';
+
+/**
+ * `@xenia-martech/sdk-js/next` — Next.js (App Router, 15+) glue for the server SDK.
+ *
+ * A Server Component can't see its own URL or set cookies during render, so the two halves split
+ * the work: `xeniaProxy()` runs in `proxy.ts`/`middleware.ts` (mints the visitor cookie, stamps the
+ * URL onto a request header), and `xeniaServerFromNext()` reads both back to bind a per-request
+ * `XeniaServer`. Use them together; each alone degrades gracefully (no URL context / a throwaway
+ * visitor id).
+ */
+
+/** Request header `xeniaProxy()` stamps with the URL being served. */
+declare const URL_HEADER = "x-xenia-url";
+interface XeniaProxyOptions {
+    /** Request headers to forward (e.g. your own additions); defaults to the incoming ones. */
+    headers?: Headers;
+    /** Must match the browser client's `config.prefix`, if you set one. */
+    prefix?: string;
+    /** Visitor cookie attributes. Default: `path=/`, `SameSite=Lax`, one year. */
+    cookie?: VisitorCookieOptions;
+}
+/**
+ * Next.js proxy/middleware step: ensure the visitor cookie exists and stamp the URL onto
+ * {@link URL_HEADER}, then continue. A new visitor id is also put on the forwarded `Cookie` header,
+ * so this very request's render already sees it.
+ *
+ * ```ts
+ * // proxy.ts
+ * export const proxy = (request: NextRequest) => xeniaProxy(request);
+ * ```
+ */
+declare function xeniaProxy(request: NextRequest, opts?: XeniaProxyOptions): NextResponse;
+/**
+ * A `XeniaServer` bound to this request's visitor (the cookie `xeniaProxy()` set) and URL context
+ * (path, query, UTMs, referrer). For Server Components, Server Actions and Route Handlers.
+ * `config.visitorId`/`config.context` still win when passed.
+ */
+declare function xeniaServerFromNext(config: XeniaConfig): Promise<XeniaServer>;
+/** This request's consent, from the cookie the browser client's `consent()` (or `consentCookie()`) wrote. */
+declare function consentFromNext(prefix?: string): Promise<ConsentState>;
+
+export { URL_HEADER, type XeniaProxyOptions, consentFromNext, xeniaProxy, xeniaServerFromNext };

package/dist/next/index.js

@@ -0,0 +1,54 @@
+import { createXeniaServer, getConsent } from '../chunk-WYAMPEVV.js';
+import { visitorCookieName, generateUlid, contextFromUrl } from '../chunk-FYSEKFIY.js';
+import { cookies, headers } from 'next/headers';
+import { NextResponse } from 'next/server';
+
+var URL_HEADER = "x-xenia-url";
+function cookieAttributes(c = {}) {
+  const sameSite = c.sameSite ?? "Lax";
+  return {
+    path: "/",
+    maxAge: Math.floor((c.maxAgeDays ?? 365) * 86400),
+    sameSite: sameSite.toLowerCase(),
+    secure: c.secure || sameSite === "None",
+    ...c.domain && { domain: c.domain }
+  };
+}
+function xeniaProxy(request, opts = {}) {
+  const name = visitorCookieName(opts.prefix);
+  const existing = request.cookies.get(name)?.value;
+  const visitorId = existing ?? generateUlid();
+  const forwarded = new Headers(opts.headers ?? request.headers);
+  forwarded.set(URL_HEADER, request.url);
+  if (!existing) {
+    const header = forwarded.get("cookie");
+    forwarded.set("cookie", header ? `${header}; ${name}=${visitorId}` : `${name}=${visitorId}`);
+  }
+  const response = NextResponse.next({ request: { headers: forwarded } });
+  if (!existing) response.cookies.set(name, visitorId, cookieAttributes(opts.cookie));
+  return response;
+}
+async function xeniaServerFromNext(config) {
+  const [jar, h] = await Promise.all([cookies(), headers()]);
+  const name = visitorCookieName(config.prefix);
+  let visitorId = config.visitorId ?? jar.get(name)?.value;
+  if (!visitorId) {
+    visitorId = generateUlid();
+    try {
+      jar.set(name, visitorId, cookieAttributes());
+    } catch {
+    }
+  }
+  return createXeniaServer({
+    ...config,
+    visitorId,
+    context: { ...contextFromUrl(h.get(URL_HEADER), h.get("referer")), ...config.context }
+  });
+}
+async function consentFromNext(prefix) {
+  return getConsent((await headers()).get("cookie"), prefix);
+}
+
+export { URL_HEADER, consentFromNext, xeniaProxy, xeniaServerFromNext };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/next/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/next/index.ts"],"names":[],"mappings":";;;;;AAoBO,IAAM,UAAA,GAAa;AAW1B,SAAS,gBAAA,CAAiB,CAAA,GAA0B,EAAC,EAAG;AACtD,EAAA,MAAM,QAAA,GAAW,EAAE,QAAA,IAAY,KAAA;AAC/B,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,GAAA;AAAA,IACN,QAAQ,IAAA,CAAK,KAAA,CAAA,CAAO,CAAA,CAAE,UAAA,IAAc,OAAO,KAAK,CAAA;AAAA,IAChD,QAAA,EAAU,SAAS,WAAA,EAAY;AAAA,IAC/B,MAAA,EAAQ,CAAA,CAAE,MAAA,IAAU,QAAA,KAAa,MAAA;AAAA,IACjC,GAAI,CAAA,CAAE,MAAA,IAAU,EAAE,MAAA,EAAQ,EAAE,MAAA;AAAO,GACrC;AACF;AAYO,SAAS,UAAA,CAAW,OAAA,EAAsB,IAAA,GAA0B,EAAC,EAAiB;AAC3F,EAAA,MAAM,IAAA,GAAO,iBAAA,CAAkB,IAAA,CAAK,MAAM,CAAA;AAC1C,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA,EAAG,KAAA;AAC5C,EAAA,MAAM,SAAA,GAAY,YAAY,YAAA,EAAa;AAE3C,EAAA,MAAM,YAAY,IAAI,OAAA,CAAQ,IAAA,CAAK,OAAA,IAAW,QAAQ,OAAO,CAAA;AAC7D,EAAA,SAAA,CAAU,GAAA,CAAI,UAAA,EAAY,OAAA,CAAQ,GAAG,CAAA;AACrC,EAAA,IAAI,CAAC,QAAA,EAAU;AAEb,IAAA,MAAM,MAAA,GAAS,SAAA,CAAU,GAAA,CAAI,QAAQ,CAAA;AACrC,IAAA,SAAA,CAAU,GAAA,CAAI,QAAA,EAAU,MAAA,GAAS,CAAA,EAAG,MAAM,CAAA,EAAA,EAAK,IAAI,CAAA,CAAA,EAAI,SAAS,CAAA,CAAA,GAAK,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,SAAS,CAAA,CAAE,CAAA;AAAA,EAC7F;AAEA,EAAA,MAAM,QAAA,GAAW,aAAa,IAAA,CAAK,EAAE,SAAS,EAAE,OAAA,EAAS,SAAA,EAAU,EAAG,CAAA;AACtE,EAAA,IAAI,CAAC,QAAA,EAAU,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,MAAM,SAAA,EAAW,gBAAA,CAAiB,IAAA,CAAK,MAAM,CAAC,CAAA;AAClF,EAAA,OAAO,QAAA;AACT;AAOA,eAAsB,oBAAoB,MAAA,EAA2C;AACnF,EAAA,MAAM,CAAC,GAAA,EAAK,CAAC,CAAA,GAAI,MAAM,OAAA,CAAQ,GAAA,CAAI,CAAC,OAAA,EAAQ,EAAG,OAAA,EAAS,CAAC,CAAA;AACzD,EAAA,MAAM,IAAA,GAAO,iBAAA,CAAkB,MAAA,CAAO,MAAM,CAAA;AAC5C,EAAA,IAAI,YAAY,MAAA,CAAO,SAAA,IAAa,GAAA,CAAI,GAAA,CAAI,IAAI,CAAA,EAAG,KAAA;AACnD,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,SAAA,GAAY,YAAA,EAAa;AACzB,IAAA,IAAI;AACF,MAAA,GAAA,CAAI,GAAA,CAAI,IAAA,EAAM,SAAA,EAAW,gBAAA,EAAkB,CAAA;AAAA,IAC7C,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,iBAAA,CAAkB;AAAA,IACvB,GAAG,MAAA;AAAA,IACH,SAAA;AAAA,IACA,OAAA,EAAS,EAAE,GAAG,cAAA,CAAe,EAAE,GAAA,CAAI,UAAU,CAAA,EAAG,CAAA,CAAE,IAAI,SAAS,CAAC,CAAA,EAAG,GAAG,OAAO,OAAA;AAAQ,GACtF,CAAA;AACH;AAGA,eAAsB,gBAAgB,MAAA,EAAwC;AAC5E,EAAA,OAAO,YAAY,MAAM,OAAA,IAAW,GAAA,CAAI,QAAQ,GAAG,MAAM,CAAA;AAC3D","file":"index.js","sourcesContent":["/**\n * `@xenia-martech/sdk-js/next` — Next.js (App Router, 15+) glue for the server SDK.\n *\n * A Server Component can't see its own URL or set cookies during render, so the two halves split\n * the work: `xeniaProxy()` runs in `proxy.ts`/`middleware.ts` (mints the visitor cookie, stamps the\n * URL onto a request header), and `xeniaServerFromNext()` reads both back to bind a per-request\n * `XeniaServer`. Use them together; each alone degrades gracefully (no URL context / a throwaway\n * visitor id).\n */\n\nimport { cookies, headers } from \"next/headers\";\nimport { NextResponse, type NextRequest } from \"next/server\";\nimport { visitorCookieName } from \"../core/cookie-names\";\nimport { generateUlid } from \"../core/id\";\nimport { contextFromUrl } from \"../core/request-context\";\nimport type { ConsentState, VisitorCookieOptions, XeniaConfig } from \"../core/types\";\nimport { getConsent } from \"../server/cookies\";\nimport { createXeniaServer, type XeniaServer } from \"../server/xenia-server\";\n\n/** Request header `xeniaProxy()` stamps with the URL being served. */\nexport const URL_HEADER = \"x-xenia-url\";\n\nexport interface XeniaProxyOptions {\n  /** Request headers to forward (e.g. your own additions); defaults to the incoming ones. */\n  headers?: Headers;\n  /** Must match the browser client's `config.prefix`, if you set one. */\n  prefix?: string;\n  /** Visitor cookie attributes. Default: `path=/`, `SameSite=Lax`, one year. */\n  cookie?: VisitorCookieOptions;\n}\n\nfunction cookieAttributes(c: VisitorCookieOptions = {}) {\n  const sameSite = c.sameSite ?? \"Lax\";\n  return {\n    path: \"/\",\n    maxAge: Math.floor((c.maxAgeDays ?? 365) * 86400),\n    sameSite: sameSite.toLowerCase() as \"lax\" | \"strict\" | \"none\",\n    secure: c.secure || sameSite === \"None\",\n    ...(c.domain && { domain: c.domain }),\n  };\n}\n\n/**\n * Next.js proxy/middleware step: ensure the visitor cookie exists and stamp the URL onto\n * {@link URL_HEADER}, then continue. A new visitor id is also put on the forwarded `Cookie` header,\n * so this very request's render already sees it.\n *\n * ```ts\n * // proxy.ts\n * export const proxy = (request: NextRequest) => xeniaProxy(request);\n * ```\n */\nexport function xeniaProxy(request: NextRequest, opts: XeniaProxyOptions = {}): NextResponse {\n  const name = visitorCookieName(opts.prefix);\n  const existing = request.cookies.get(name)?.value;\n  const visitorId = existing ?? generateUlid();\n\n  const forwarded = new Headers(opts.headers ?? request.headers);\n  forwarded.set(URL_HEADER, request.url);\n  if (!existing) {\n    // NextRequest.cookies.set doesn't rewrite the forwarded Cookie header, and cookies() reads that.\n    const header = forwarded.get(\"cookie\");\n    forwarded.set(\"cookie\", header ? `${header}; ${name}=${visitorId}` : `${name}=${visitorId}`);\n  }\n\n  const response = NextResponse.next({ request: { headers: forwarded } });\n  if (!existing) response.cookies.set(name, visitorId, cookieAttributes(opts.cookie));\n  return response;\n}\n\n/**\n * A `XeniaServer` bound to this request's visitor (the cookie `xeniaProxy()` set) and URL context\n * (path, query, UTMs, referrer). For Server Components, Server Actions and Route Handlers.\n * `config.visitorId`/`config.context` still win when passed.\n */\nexport async function xeniaServerFromNext(config: XeniaConfig): Promise<XeniaServer> {\n  const [jar, h] = await Promise.all([cookies(), headers()]);\n  const name = visitorCookieName(config.prefix);\n  let visitorId = config.visitorId ?? jar.get(name)?.value;\n  if (!visitorId) {\n    visitorId = generateUlid();\n    try {\n      jar.set(name, visitorId, cookieAttributes());\n    } catch {\n      // Expected during a Server Component render; xeniaProxy() is the place that persists it.\n    }\n  }\n  return createXeniaServer({\n    ...config,\n    visitorId,\n    context: { ...contextFromUrl(h.get(URL_HEADER), h.get(\"referer\")), ...config.context },\n  });\n}\n\n/** This request's consent, from the cookie the browser client's `consent()` (or `consentCookie()`) wrote. */\nexport async function consentFromNext(prefix?: string): Promise<ConsentState> {\n  return getConsent((await headers()).get(\"cookie\"), prefix);\n}\n"]}

package/dist/server/index.cjs

@@ -1,179 +1,12 @@
 'use strict';
 
-var chunkWYM4CQVG_cjs = require('../chunk-WYM4CQVG.cjs');
-
-// src/core/event-payload.ts
-var RESERVED = /* @__PURE__ */ new Set([
-  "eventId",
-  "eventType",
-  "journeyId",
-  "deviceId",
-  "visitorId",
-  "customerId",
-  "email",
-  "utmSource",
-  "utmMedium",
-  "utmCampaign",
-  "utmContent",
-  "utmId",
-  "url",
-  "referrer",
-  "path",
-  "query"
-]);
-function compact2(obj) {
-  const out = {};
-  for (const [k, v] of Object.entries(obj)) {
-    if (v !== void 0) out[k] = v;
-  }
-  return out;
-}
-function buildEventPayload(input) {
-  const passthrough = {};
-  const reserved = {};
-  if (input.props) {
-    for (const [k, v] of Object.entries(input.props)) {
-      if (v === void 0) continue;
-      if (RESERVED.has(k)) reserved[k] = v;
-      else passthrough[k] = v;
-    }
-  }
-  const payload = {
-    ...passthrough,
-    // Reserved-named props fill first-class fields (e.g. `email`, `customerId`)
-    // the SDK didn't auto-collect. Auto-collected context/identity still win for
-    // what they reliably know (real page url, visitor/device id), so a stray prop
-    // can't override the true page context — see merge order below.
-    ...reserved,
-    ...compact2(input.context ?? {}),
-    ...compact2(input.identity ?? {}),
-    eventId: input.eventId,
-    ...input.eventType ? { eventType: input.eventType } : {},
-    ...input.journeyId ? { journeyId: input.journeyId } : {}
-  };
-  return payload;
-}
-
-// src/server/xenia-server.ts
-var XeniaServer = class {
-  api;
-  /** SDK-owned visitor anchor for this (per-request) client — see {@link XeniaConfig.visitorId}. */
-  visitorId;
-  /** Ambient request context attached to every call — see {@link XeniaConfig.context}. */
-  context;
-  constructor(config) {
-    this.api = new chunkWYM4CQVG_cjs.XeniaApi(config);
-    this.visitorId = config.visitorId;
-    this.context = config.context;
-  }
-  /**
-   * Send a unified event server-side (`POST /api/events/v1`) and return the
-   * ingest response (including per-result `triggered`). `opts.trigger: true`
-   * also matches/advances a journey; pass `opts.eventId` (e.g. `"ord-1001"`)
-   * as a stable dedup key for idempotent conversions.
-   */
-  async track(eventName, opts = {}) {
-    const event = {
-      eventName,
-      eventId: opts.eventId ? chunkWYM4CQVG_cjs.toEventId(opts.eventId) : chunkWYM4CQVG_cjs.generateUlid(),
-      eventVersion: opts.eventVersion ?? 1,
-      occurredAtMs: opts.occurredAtMs ?? Date.now(),
-      source: opts.source ?? "xenia-server-sdk",
-      identity: {
-        ...opts.identity,
-        // SDK-owned, set LAST so it can't be overridden per call. Comes from
-        // `config.visitorId` (bind it per request from the `xenia_vid` cookie).
-        xeniaVisitorId: this.visitorId
-      },
-      context: opts.context,
-      properties: opts.properties,
-      consent: opts.consent,
-      trigger: opts.trigger === true ? true : void 0
-    };
-    return this.api.sendEvents([event]);
-  }
-  /**
-   * Send a webhook request and await the synchronous response. Merges
-   * `opts.identity`/`opts.context` into the payload the same way the browser
-   * client's auto-attached fields do (`path`, `query`, `url`, `referrer`,
-   * `deviceId`, `visitorId`, etc.) — see `ServerWebhookOptions`.
-   */
-  async webhook(triggerId, data, opts = {}) {
-    const payload = buildEventPayload({
-      eventId: triggerId,
-      journeyId: opts.journeyId,
-      // SDK-owned visitor anchor wins: config.visitorId (bind the `xenia_vid`
-      // cookie per request) is attached automatically. Falls back to a
-      // per-call visitorId only when none is bound.
-      identity: { ...opts.identity, visitorId: this.visitorId ?? opts.identity?.visitorId },
-      // Ambient request context (config.context, bound once per request) under a per-call
-      // override — same precedence resolve() uses, so both surfaces carry the same fields.
-      context: { ...this.context, ...opts.context },
-      props: data
-    });
-    return this.api.webhook(triggerId, payload, opts.method ?? "POST");
-  }
-  /** Bind visitor→user server-side — `POST /api/events/v1/identify`. */
-  async identify(body) {
-    return this.api.identify(body);
-  }
-  /**
-   * Resolve in-entry content personalization for one content key
-   * (`POST /api/personalization/resolve`). Requires a configured SDK token
-   * (`token`/`getToken`) — resolve is auth-required. With `merge: true` the
-   * returned `content` is server-spliced.
-   *
-   * Pass `opts.identity`/`opts.context` to attach the same SDK-provided
-   * fields (`deviceId`, `customerId`, `email`, `path`, `url`, `referrer`,
-   * `utm*`, …) the browser client collects ambiently — there's no ambient
-   * `window`/`document` server-side, so a server caller must supply whatever
-   * it knows (e.g. from the current request) explicitly. See
-   * {@link ResolveOptions}.
-   */
-  async resolve(contentKey, opts) {
-    return this.api.resolve(contentKey, this.withVisitor(opts));
-  }
-  /** Resolve several content keys in one round-trip (`POST /api/personalization/resolve-batch`). */
-  async resolveBatch(items, opts) {
-    return this.api.resolveBatch(items, this.withVisitor(opts));
-  }
-  /**
-   * Merge the ambient `config.context` and `opts.identity`/`opts.context` into
-   * the resolve `data`, then stamp the SDK-owned visitor id
-   * (`config.visitorId`) under both the reserved `_xenia_vid` key (read by the
-   * backend for holdout/exposure bucketing) and the flat `visitorId` field —
-   * mirrors `webhook()`'s merge order/precedence exactly: caller `data` <
-   * ambient `config.context` < caller `context`/`identity` < SDK-owned
-   * `visitorId`/`_xenia_vid`, set LAST so neither can be overridden per call.
-   *
-   * `config.context` is what makes the SDK-provided fields automatic on the
-   * server: bound once per request, every `resolve()` carries `path`/`query`/
-   * `url`/`referrer`/UTMs with no per-call wiring, matching what the browser
-   * client collects from `window` on its own. A no-op when nothing is bound and
-   * nothing was passed — preserving today's behavior for callers using neither.
-   */
-  withVisitor(opts) {
-    const identity = chunkWYM4CQVG_cjs.compact({
-      ...opts?.identity,
-      visitorId: this.visitorId ?? opts?.identity?.visitorId
-    });
-    const merged = {
-      ...chunkWYM4CQVG_cjs.compact(this.context ?? {}),
-      ...chunkWYM4CQVG_cjs.compact(opts?.context ?? {}),
-      ...identity
-    };
-    if (Object.keys(merged).length === 0 && !this.visitorId) return opts;
-    if (this.visitorId) merged._xenia_vid = this.visitorId;
-    return { ...opts, data: { ...opts?.data ?? {}, ...merged } };
-  }
-};
-function createXeniaServer(config) {
-  return new XeniaServer(config);
-}
+require('../chunk-5D7SJIO4.cjs');
+var chunkU2WBBOYT_cjs = require('../chunk-U2WBBOYT.cjs');
+var chunkJEKVN7HK_cjs = require('../chunk-JEKVN7HK.cjs');
 
 // src/server/token.ts
 async function refreshSdkToken(opts) {
-  const http = new chunkWYM4CQVG_cjs.HttpClient({ baseUrl: opts.baseUrl, timeout: opts.timeout });
+  const http = new chunkJEKVN7HK_cjs.HttpClient({ baseUrl: opts.baseUrl, timeout: opts.timeout });
   const { data } = await http.request({
     method: "POST",
     path: "/api/personalization/token/refresh",
@@ -204,68 +37,59 @@ function createTokenRoute(config) {
   };
 }
 
-// src/server/cookies.ts
-function parseCookies(header) {
-  const out = {};
-  if (!header) return out;
-  for (const part of header.split(";")) {
-    const idx = part.indexOf("=");
-    if (idx === -1) continue;
-    const key = part.slice(0, idx).trim();
-    const value = part.slice(idx + 1).trim();
-    if (key) out[key] = decodeURIComponent(value);
-  }
-  return out;
-}
-function getVisitorId(cookieHeader, prefix) {
-  return parseCookies(cookieHeader)[chunkWYM4CQVG_cjs.visitorCookieName(prefix)] ?? null;
-}
-function getConsent(cookieHeader, prefix) {
-  const raw = parseCookies(cookieHeader)[chunkWYM4CQVG_cjs.consentCookieName(prefix)];
-  if (!raw) return { analytics: false, marketing: false, personalization: false };
-  try {
-    const parsed = JSON.parse(raw);
-    return parsed;
-  } catch {
-    const scopes = new Set(raw.split(",").map((s) => s.trim()));
-    return {
-      analytics: scopes.has("analytics"),
-      marketing: scopes.has("marketing"),
-      personalization: scopes.has("personalization")
-    };
-  }
-}
-
+Object.defineProperty(exports, "XeniaServer", {
+  enumerable: true,
+  get: function () { return chunkU2WBBOYT_cjs.XeniaServer; }
+});
+Object.defineProperty(exports, "createXeniaServer", {
+  enumerable: true,
+  get: function () { return chunkU2WBBOYT_cjs.createXeniaServer; }
+});
+Object.defineProperty(exports, "getConsent", {
+  enumerable: true,
+  get: function () { return chunkU2WBBOYT_cjs.getConsent; }
+});
+Object.defineProperty(exports, "getVisitorId", {
+  enumerable: true,
+  get: function () { return chunkU2WBBOYT_cjs.getVisitorId; }
+});
+Object.defineProperty(exports, "parseCookies", {
+  enumerable: true,
+  get: function () { return chunkU2WBBOYT_cjs.parseCookies; }
+});
 Object.defineProperty(exports, "CONSENT_COOKIE", {
   enumerable: true,
-  get: function () { return chunkWYM4CQVG_cjs.CONSENT_COOKIE; }
+  get: function () { return chunkJEKVN7HK_cjs.CONSENT_COOKIE; }
+});
+Object.defineProperty(exports, "CircuitOpenError", {
+  enumerable: true,
+  get: function () { return chunkJEKVN7HK_cjs.CircuitOpenError; }
 });
 Object.defineProperty(exports, "VISITOR_COOKIE", {
   enumerable: true,
-  get: function () { return chunkWYM4CQVG_cjs.VISITOR_COOKIE; }
+  get: function () { return chunkJEKVN7HK_cjs.VISITOR_COOKIE; }
 });
 Object.defineProperty(exports, "XeniaApi", {
   enumerable: true,
-  get: function () { return chunkWYM4CQVG_cjs.XeniaApi; }
+  get: function () { return chunkJEKVN7HK_cjs.XeniaApi; }
+});
+Object.defineProperty(exports, "consentCookie", {
+  enumerable: true,
+  get: function () { return chunkJEKVN7HK_cjs.consentCookie; }
 });
 Object.defineProperty(exports, "consentCookieName", {
   enumerable: true,
-  get: function () { return chunkWYM4CQVG_cjs.consentCookieName; }
+  get: function () { return chunkJEKVN7HK_cjs.consentCookieName; }
 });
 Object.defineProperty(exports, "parseActions", {
   enumerable: true,
-  get: function () { return chunkWYM4CQVG_cjs.parseActions; }
+  get: function () { return chunkJEKVN7HK_cjs.parseActions; }
 });
 Object.defineProperty(exports, "visitorCookieName", {
   enumerable: true,
-  get: function () { return chunkWYM4CQVG_cjs.visitorCookieName; }
+  get: function () { return chunkJEKVN7HK_cjs.visitorCookieName; }
 });
-exports.XeniaServer = XeniaServer;
 exports.createTokenRoute = createTokenRoute;
-exports.createXeniaServer = createXeniaServer;
-exports.getConsent = getConsent;
-exports.getVisitorId = getVisitorId;
-exports.parseCookies = parseCookies;
 exports.refreshSdkToken = refreshSdkToken;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/server/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/event-payload.ts","../../src/server/xenia-server.ts","../../src/server/token.ts","../../src/server/cookies.ts"],"names":["compact","XeniaApi","toEventId","generateUlid","HttpClient","visitorCookieName","consentCookieName"],"mappings":";;;;;AAGA,IAAM,QAAA,uBAAe,GAAA,CAAI;AAAA,EACvB,SAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,aAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAC,CAAA;AAaD,SAASA,SAAQ,GAAA,EAAuE;AACtF,EAAA,MAAM,MAAiC,EAAC;AACxC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AACxC,IAAA,IAAI,CAAA,KAAM,MAAA,EAAW,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EAChC;AACA,EAAA,OAAO,GAAA;AACT;AAWO,SAAS,kBAAkB,KAAA,EAAsC;AACtE,EAAA,MAAM,cAAyC,EAAC;AAChD,EAAA,MAAM,WAAsC,EAAC;AAC7C,EAAA,IAAI,MAAM,KAAA,EAAO;AACf,IAAA,KAAA,MAAW,CAAC,GAAG,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,KAAK,CAAA,EAAG;AAChD,MAAA,IAAI,MAAM,MAAA,EAAW;AAKrB,MAAA,IAAI,SAAS,GAAA,CAAI,CAAC,CAAA,EAAG,QAAA,CAAS,CAAC,CAAA,GAAI,CAAA;AAAA,WAC9B,WAAA,CAAY,CAAC,CAAA,GAAI,CAAA;AAAA,IACxB;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,GAAG,WAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAKH,GAAG,QAAA;AAAA,IACH,GAAGA,QAAAA,CAAS,KAAA,CAAM,OAAA,IAAW,EAA4C,CAAA;AAAA,IACzE,GAAGA,QAAAA,CAAS,KAAA,CAAM,QAAA,IAAY,EAA4C,CAAA;AAAA,IAC1E,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,GAAI,MAAM,SAAA,GAAY,EAAE,WAAW,KAAA,CAAM,SAAA,KAAc,EAAC;AAAA,IACxD,GAAI,MAAM,SAAA,GAAY,EAAE,WAAW,KAAA,CAAM,SAAA,KAAc;AAAC,GAC1D;AAEA,EAAA,OAAO,OAAA;AACT;;;ACbO,IAAM,cAAN,MAAkB;AAAA,EACd,GAAA;AAAA;AAAA,EAEQ,SAAA;AAAA;AAAA,EAEA,OAAA;AAAA,EAEjB,YAAY,MAAA,EAAqB;AAC/B,IAAA,IAAA,CAAK,GAAA,GAAM,IAAIC,0BAAA,CAAS,MAAM,CAAA;AAC9B,IAAA,IAAA,CAAK,YAAY,MAAA,CAAO,SAAA;AACxB,IAAA,IAAA,CAAK,UAAU,MAAA,CAAO,OAAA;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,CACJ,SAAA,EACA,IAAA,GAA2B,EAAC,EACM;AAClC,IAAA,MAAM,KAAA,GAAoB;AAAA,MACxB,SAAA;AAAA,MACA,SAAS,IAAA,CAAK,OAAA,GAAUC,4BAAU,IAAA,CAAK,OAAO,IAAIC,8BAAA,EAAa;AAAA,MAC/D,YAAA,EAAc,KAAK,YAAA,IAAgB,CAAA;AAAA,MACnC,YAAA,EAAc,IAAA,CAAK,YAAA,IAAgB,IAAA,CAAK,GAAA,EAAI;AAAA,MAC5C,MAAA,EAAQ,KAAK,MAAA,IAAU,kBAAA;AAAA,MACvB,QAAA,EAAU;AAAA,QACR,GAAG,IAAA,CAAK,QAAA;AAAA;AAAA;AAAA,QAGR,gBAAgB,IAAA,CAAK;AAAA,OACvB;AAAA,MACA,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,OAAA,EAAS,IAAA,CAAK,OAAA,KAAY,IAAA,GAAO,IAAA,GAAO;AAAA,KAC1C;AACA,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,UAAA,CAAW,CAAC,KAAK,CAAC,CAAA;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAA,CACJ,SAAA,EACA,IAAA,EACA,IAAA,GAA6B,EAAC,EACJ;AAC1B,IAAA,MAAM,UAAU,iBAAA,CAAkB;AAAA,MAChC,OAAA,EAAS,SAAA;AAAA,MACT,WAAW,IAAA,CAAK,SAAA;AAAA;AAAA;AAAA;AAAA,MAIhB,QAAA,EAAU,EAAE,GAAG,IAAA,CAAK,QAAA,EAAU,WAAW,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,QAAA,EAAU,SAAA,EAAU;AAAA;AAAA;AAAA,MAGpF,SAAS,EAAE,GAAG,KAAK,OAAA,EAAS,GAAG,KAAK,OAAA,EAAQ;AAAA,MAC5C,KAAA,EAAO;AAAA,KACR,CAAA;AACD,IAAA,OAAO,KAAK,GAAA,CAAI,OAAA,CAAQ,WAAW,OAAA,EAAsB,IAAA,CAAK,UAAU,MAAM,CAAA;AAAA,EAChF;AAAA;AAAA,EAGA,MAAM,SAAS,IAAA,EAAkD;AAC/D,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,QAAA,CAAS,IAAI,CAAA;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,OAAA,CAAQ,UAAA,EAAoB,IAAA,EAA+C;AAC/E,IAAA,OAAO,KAAK,GAAA,CAAI,OAAA,CAAQ,YAAY,IAAA,CAAK,WAAA,CAAY,IAAI,CAAC,CAAA;AAAA,EAC5D;AAAA;AAAA,EAGA,MAAM,YAAA,CACJ,KAAA,EACA,IAAA,EAC+B;AAC/B,IAAA,OAAO,KAAK,GAAA,CAAI,YAAA,CAAa,OAAO,IAAA,CAAK,WAAA,CAAY,IAAI,CAAC,CAAA;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBQ,YAAY,IAAA,EAAmD;AACrE,IAAA,MAAM,WAAWH,yBAAA,CAAQ;AAAA,MACvB,GAAG,IAAA,EAAM,QAAA;AAAA,MACT,SAAA,EAAW,IAAA,CAAK,SAAA,IAAa,IAAA,EAAM,QAAA,EAAU;AAAA,KAC9C,CAAA;AACD,IAAA,MAAM,MAAA,GAAS;AAAA,MACb,GAAGA,yBAAA,CAAS,IAAA,CAAK,OAAA,IAAW,EAA4C,CAAA;AAAA,MACxE,GAAGA,yBAAA,CAAS,IAAA,EAAM,OAAA,IAAW,EAA4C,CAAA;AAAA,MACzE,GAAG;AAAA,KACL;AACA,IAAA,IAAI,MAAA,CAAO,KAAK,MAAM,CAAA,CAAE,WAAW,CAAA,IAAK,CAAC,IAAA,CAAK,SAAA,EAAW,OAAO,IAAA;AAChE,IAAA,IAAI,IAAA,CAAK,SAAA,EAAW,MAAA,CAAO,UAAA,GAAa,IAAA,CAAK,SAAA;AAC7C,IAAA,OAAO,EAAE,GAAG,IAAA,EAAM,IAAA,EAAM,EAAE,GAAI,IAAA,EAAM,IAAA,IAAQ,EAAC,EAAI,GAAG,MAAA,EAAO,EAAE;AAAA,EAC/D;AACF;AAGO,SAAS,kBAAkB,MAAA,EAAkC;AAClE,EAAA,OAAO,IAAI,YAAY,MAAM,CAAA;AAC/B;;;ACxKA,eAAsB,gBAAgB,IAAA,EAAoD;AACxF,EAAA,MAAM,IAAA,GAAO,IAAII,4BAAA,CAAW,EAAE,OAAA,EAAS,KAAK,OAAA,EAAS,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,CAAA;AAC5E,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,KAAK,OAAA,CAAQ;AAAA,IAClC,MAAA,EAAQ,MAAA;AAAA,IACR,IAAA,EAAM,oCAAA;AAAA,IACN,SAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,QAAQ,CAAA,CAAA,EAAG;AAAA,IACpD,IAAA,EAAM,EAAE,UAAA,EAAY,IAAA,CAAK,cAAc,IAAA;AAAK,GAC7C,CAAA;AACD,EAAA,MAAM,GAAA,GAAO,QAAQ,EAAC;AACtB,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,KAAA,IAAS,EAAE,CAAA;AAAA,IAC7B,WAAW,OAAO,GAAA,CAAI,SAAA,KAAc,QAAA,GAAW,IAAI,SAAA,GAAY;AAAA,GACjE;AACF;AAiBO,SAAS,iBAAiB,MAAA,EAAsE;AACrG,EAAA,OAAO,YAA+B;AACpC,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAY,MAAM,eAAA,CAAgB,MAAM,CAAA;AAC9C,MAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,SAAS,CAAA,EAAG;AAAA,QAC7C,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,iBAAiB,UAAA;AAAW,OAC5E,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,sBAAA;AACrD,MAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG;AAAA,QACtD,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,OAC/C,CAAA;AAAA,IACH;AAAA,EACF,CAAA;AACF;;;ACzDO,SAAS,aAAa,MAAA,EAA2D;AACtF,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,IAAI,CAAC,QAAQ,OAAO,GAAA;AACpB,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAAG;AACpC,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC5B,IAAA,IAAI,QAAQ,EAAA,EAAI;AAChB,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,EAAE,IAAA,EAAK;AACpC,IAAA,MAAM,QAAQ,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AACvC,IAAA,IAAI,GAAA,EAAK,GAAA,CAAI,GAAG,CAAA,GAAI,mBAAmB,KAAK,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,GAAA;AACT;AASO,SAAS,YAAA,CACd,cACA,MAAA,EACe;AACf,EAAA,OAAO,aAAa,YAAY,CAAA,CAAEC,mCAAA,CAAkB,MAAM,CAAC,CAAA,IAAK,IAAA;AAClE;AAQO,SAAS,UAAA,CACd,cACA,MAAA,EACc;AACd,EAAA,MAAM,MAAM,YAAA,CAAa,YAAY,CAAA,CAAEC,mCAAA,CAAkB,MAAM,CAAC,CAAA;AAChE,EAAA,IAAI,CAAC,KAAK,OAAO,EAAE,WAAW,KAAA,EAAO,SAAA,EAAW,KAAA,EAAO,eAAA,EAAiB,KAAA,EAAM;AAC9E,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AAC1D,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,WAAW,CAAA;AAAA,MACjC,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,WAAW,CAAA;AAAA,MACjC,eAAA,EAAiB,MAAA,CAAO,GAAA,CAAI,iBAAiB;AAAA,KAC/C;AAAA,EACF;AACF","file":"index.cjs","sourcesContent":["import type { EventContext, EventIdentity, EventPayload, JsonValue } from \"./types\";\n\n/** Reserved keys that map to first-class fields (not passthrough data). */\nconst RESERVED = new Set([\n  \"eventId\",\n  \"eventType\",\n  \"journeyId\",\n  \"deviceId\",\n  \"visitorId\",\n  \"customerId\",\n  \"email\",\n  \"utmSource\",\n  \"utmMedium\",\n  \"utmCampaign\",\n  \"utmContent\",\n  \"utmId\",\n  \"url\",\n  \"referrer\",\n  \"path\",\n  \"query\",\n]);\n\nexport interface BuildEventInput {\n  eventId: string;\n  eventType?: string;\n  journeyId?: string;\n  identity?: EventIdentity;\n  context?: EventContext;\n  /** Arbitrary extra properties merged as passthrough data. */\n  props?: Record<string, JsonValue | undefined>;\n}\n\n/** Drop `undefined` values so the JSON body stays clean. */\nfunction compact(obj: Record<string, JsonValue | undefined>): Record<string, JsonValue> {\n  const out: Record<string, JsonValue> = {};\n  for (const [k, v] of Object.entries(obj)) {\n    if (v !== undefined) out[k] = v;\n  }\n  return out;\n}\n\n/**\n * Build the request body for the webhook `/flow` call (`XeniaApi.webhook`).\n *\n * Merge order (later wins): passthrough props < context < identity < core.\n * Field names match the backend `EventTriggerRequest` DTO exactly.\n *\n * @internal Used only by the webhook request/response path — the unified event\n * surface (`track()` → `POST /api/events/v1`) builds {@link XeniaEvent} instead.\n */\nexport function buildEventPayload(input: BuildEventInput): EventPayload {\n  const passthrough: Record<string, JsonValue> = {};\n  const reserved: Record<string, JsonValue> = {};\n  if (input.props) {\n    for (const [k, v] of Object.entries(input.props)) {\n      if (v === undefined) continue;\n      // A prop whose key matches a reserved field (e.g. `email`, `customerId`,\n      // `utmSource`) is promoted to that first-class field; everything else is\n      // custom passthrough data. Previously reserved-named props were dropped\n      // outright — so `track(\"sign_up\", { email })` never sent `email` at all.\n      if (RESERVED.has(k)) reserved[k] = v;\n      else passthrough[k] = v;\n    }\n  }\n\n  const payload = {\n    ...passthrough,\n    // Reserved-named props fill first-class fields (e.g. `email`, `customerId`)\n    // the SDK didn't auto-collect. Auto-collected context/identity still win for\n    // what they reliably know (real page url, visitor/device id), so a stray prop\n    // can't override the true page context — see merge order below.\n    ...reserved,\n    ...compact((input.context ?? {}) as Record<string, JsonValue | undefined>),\n    ...compact((input.identity ?? {}) as Record<string, JsonValue | undefined>),\n    eventId: input.eventId,\n    ...(input.eventType ? { eventType: input.eventType } : {}),\n    ...(input.journeyId ? { journeyId: input.journeyId } : {}),\n  };\n\n  return payload as EventPayload;\n}\n","import { compact, XeniaApi } from \"../core/api\";\nimport { buildEventPayload } from \"../core/event-payload\";\nimport { generateUlid, toEventId } from \"../core/id\";\nimport type {\n  AnalyticsContext,\n  AnalyticsEventName,\n  CallerIdentity,\n  AnalyticsIngestResponse,\n  ConsentState,\n  EventContext,\n  EventIdentity,\n  IdentifyRequest,\n  IdentifyResponse,\n  JsonValue,\n  ResolveBatchItem,\n  ResolveBatchResult,\n  ResolveOptions,\n  ResolveResult,\n  WebhookResponse,\n  XeniaConfig,\n  XeniaEvent,\n} from \"../core/types\";\n\n/**\n * Extra per-call identity/context for server-side webhook calls — an override on top of whatever the\n * client already carries.\n *\n * There's no ambient `window` on the server to auto-collect `path`/`query`/`url`/UTM params the way\n * the browser client does, so bind them ONCE per request via {@link XeniaConfig.context} (see\n * `contextFromUrl`) and every call attaches them automatically. These per-call fields are for the\n * remainder: values known only at this call site, or a deliberate override of the ambient ones.\n */\nexport interface ServerWebhookOptions {\n  method?: \"GET\" | \"POST\";\n  journeyId?: string;\n  identity?: EventIdentity;\n  context?: EventContext;\n}\n\n/**\n * Options for a server-side unified event (`POST /api/events/v1`). There's no\n * ambient request context on the server — pass whatever's known at the call\n * site (e.g. pathname/user-agent from the current request, session id from a\n * cookie) via `identity`/`context`.\n */\nexport interface ServerTrackOptions {\n  /** When true, also match/advance a journey (never sampled/shed). Default false. */\n  trigger?: boolean;\n  /** Stable dedup key (e.g. `\"ord-1001\"`) for idempotent conversions. */\n  eventId?: string;\n  eventVersion?: number;\n  occurredAtMs?: number;\n  /** Origin tag. Default `\"xenia-server-sdk\"`. */\n  source?: string;\n  /** Identity fields for this event (except the SDK-owned `xeniaVisitorId`,\n   *  which comes from `config.visitorId` and can't be set per call). */\n  identity?: CallerIdentity;\n  context?: AnalyticsContext;\n  properties?: Record<string, JsonValue | undefined>;\n  consent?: ConsentState;\n}\n\n/**\n * Server-native Xenia client. Same method names as the browser client, but\n * every call is stateless: identity and context are passed explicitly rather\n * than read from the DOM/localStorage. Uses global `fetch` (Node ≥18).\n */\nexport class XeniaServer {\n  readonly api: XeniaApi;\n  /** SDK-owned visitor anchor for this (per-request) client — see {@link XeniaConfig.visitorId}. */\n  private readonly visitorId?: string;\n  /** Ambient request context attached to every call — see {@link XeniaConfig.context}. */\n  private readonly context?: EventContext;\n\n  constructor(config: XeniaConfig) {\n    this.api = new XeniaApi(config);\n    this.visitorId = config.visitorId;\n    this.context = config.context;\n  }\n\n  /**\n   * Send a unified event server-side (`POST /api/events/v1`) and return the\n   * ingest response (including per-result `triggered`). `opts.trigger: true`\n   * also matches/advances a journey; pass `opts.eventId` (e.g. `\"ord-1001\"`)\n   * as a stable dedup key for idempotent conversions.\n   */\n  async track(\n    eventName: AnalyticsEventName,\n    opts: ServerTrackOptions = {},\n  ): Promise<AnalyticsIngestResponse> {\n    const event: XeniaEvent = {\n      eventName,\n      eventId: opts.eventId ? toEventId(opts.eventId) : generateUlid(),\n      eventVersion: opts.eventVersion ?? 1,\n      occurredAtMs: opts.occurredAtMs ?? Date.now(),\n      source: opts.source ?? \"xenia-server-sdk\",\n      identity: {\n        ...opts.identity,\n        // SDK-owned, set LAST so it can't be overridden per call. Comes from\n        // `config.visitorId` (bind it per request from the `xenia_vid` cookie).\n        xeniaVisitorId: this.visitorId,\n      },\n      context: opts.context,\n      properties: opts.properties,\n      consent: opts.consent,\n      trigger: opts.trigger === true ? true : undefined,\n    };\n    return this.api.sendEvents([event]);\n  }\n\n  /**\n   * Send a webhook request and await the synchronous response. Merges\n   * `opts.identity`/`opts.context` into the payload the same way the browser\n   * client's auto-attached fields do (`path`, `query`, `url`, `referrer`,\n   * `deviceId`, `visitorId`, etc.) — see `ServerWebhookOptions`.\n   */\n  async webhook(\n    triggerId: string,\n    data?: Record<string, JsonValue | undefined>,\n    opts: ServerWebhookOptions = {},\n  ): Promise<WebhookResponse> {\n    const payload = buildEventPayload({\n      eventId: triggerId,\n      journeyId: opts.journeyId,\n      // SDK-owned visitor anchor wins: config.visitorId (bind the `xenia_vid`\n      // cookie per request) is attached automatically. Falls back to a\n      // per-call visitorId only when none is bound.\n      identity: { ...opts.identity, visitorId: this.visitorId ?? opts.identity?.visitorId },\n      // Ambient request context (config.context, bound once per request) under a per-call\n      // override — same precedence resolve() uses, so both surfaces carry the same fields.\n      context: { ...this.context, ...opts.context },\n      props: data,\n    });\n    return this.api.webhook(triggerId, payload as JsonValue, opts.method ?? \"POST\");\n  }\n\n  /** Bind visitor→user server-side — `POST /api/events/v1/identify`. */\n  async identify(body: IdentifyRequest): Promise<IdentifyResponse> {\n    return this.api.identify(body);\n  }\n\n  /**\n   * Resolve in-entry content personalization for one content key\n   * (`POST /api/personalization/resolve`). Requires a configured SDK token\n   * (`token`/`getToken`) — resolve is auth-required. With `merge: true` the\n   * returned `content` is server-spliced.\n   *\n   * Pass `opts.identity`/`opts.context` to attach the same SDK-provided\n   * fields (`deviceId`, `customerId`, `email`, `path`, `url`, `referrer`,\n   * `utm*`, …) the browser client collects ambiently — there's no ambient\n   * `window`/`document` server-side, so a server caller must supply whatever\n   * it knows (e.g. from the current request) explicitly. See\n   * {@link ResolveOptions}.\n   */\n  async resolve(contentKey: string, opts?: ResolveOptions): Promise<ResolveResult> {\n    return this.api.resolve(contentKey, this.withVisitor(opts));\n  }\n\n  /** Resolve several content keys in one round-trip (`POST /api/personalization/resolve-batch`). */\n  async resolveBatch(\n    items: ResolveBatchItem[],\n    opts?: ResolveOptions,\n  ): Promise<ResolveBatchResult[]> {\n    return this.api.resolveBatch(items, this.withVisitor(opts));\n  }\n\n  /**\n   * Merge the ambient `config.context` and `opts.identity`/`opts.context` into\n   * the resolve `data`, then stamp the SDK-owned visitor id\n   * (`config.visitorId`) under both the reserved `_xenia_vid` key (read by the\n   * backend for holdout/exposure bucketing) and the flat `visitorId` field —\n   * mirrors `webhook()`'s merge order/precedence exactly: caller `data` <\n   * ambient `config.context` < caller `context`/`identity` < SDK-owned\n   * `visitorId`/`_xenia_vid`, set LAST so neither can be overridden per call.\n   *\n   * `config.context` is what makes the SDK-provided fields automatic on the\n   * server: bound once per request, every `resolve()` carries `path`/`query`/\n   * `url`/`referrer`/UTMs with no per-call wiring, matching what the browser\n   * client collects from `window` on its own. A no-op when nothing is bound and\n   * nothing was passed — preserving today's behavior for callers using neither.\n   */\n  private withVisitor(opts?: ResolveOptions): ResolveOptions | undefined {\n    const identity = compact({\n      ...opts?.identity,\n      visitorId: this.visitorId ?? opts?.identity?.visitorId,\n    });\n    const merged = {\n      ...compact((this.context ?? {}) as Record<string, JsonValue | undefined>),\n      ...compact((opts?.context ?? {}) as Record<string, JsonValue | undefined>),\n      ...identity,\n    };\n    if (Object.keys(merged).length === 0 && !this.visitorId) return opts;\n    if (this.visitorId) merged._xenia_vid = this.visitorId;\n    return { ...opts, data: { ...(opts?.data ?? {}), ...merged } };\n  }\n}\n\n/** Create a server-native client. */\nexport function createXeniaServer(config: XeniaConfig): XeniaServer {\n  return new XeniaServer(config);\n}\n","import { HttpClient } from \"../core/http-client\";\nimport type { JsonObject } from \"../core/types\";\n\nexport interface RefreshTokenOptions {\n  /**\n   * Xenia base URL. Defaults to the hosted engine,\n   * `https://engine.xeniamartech.com/xenia` — omit unless self-hosting.\n   */\n  baseUrl?: string;\n  /**\n   * The personalization SDK token created once in the dashboard (API Tokens →\n   * Create token). Stays server-side; the browser never sees it — only the\n   * short-lived token this exchanges it for does.\n   */\n  sdkToken: string;\n  /** Lifetime of the returned token, in minutes. Default 15, capped server-side at 60. */\n  ttlMinutes?: number;\n  timeout?: number;\n}\n\nexport interface RefreshedToken {\n  token: string;\n  expiresAt?: string;\n}\n\n/**\n * Exchange the long-lived personalization SDK token for a short-lived one with\n * the same tenant/env scope, via `POST /api/personalization/token/refresh`.\n * Self-service — no dashboard credential needed, just the SDK token you\n * already have. Call this from your backend and hand the result to the\n * browser (e.g. from a token route the client SDK calls via `getToken`).\n */\nexport async function refreshSdkToken(opts: RefreshTokenOptions): Promise<RefreshedToken> {\n  const http = new HttpClient({ baseUrl: opts.baseUrl, timeout: opts.timeout });\n  const { data } = await http.request({\n    method: \"POST\",\n    path: \"/api/personalization/token/refresh\",\n    headers: { Authorization: `Bearer ${opts.sdkToken}` },\n    body: { ttlMinutes: opts.ttlMinutes ?? null },\n  });\n  const obj = (data ?? {}) as JsonObject;\n  return {\n    token: String(obj.token ?? \"\"),\n    expiresAt: typeof obj.expiresAt === \"string\" ? obj.expiresAt : undefined,\n  };\n}\n\n/**\n * Build a framework-agnostic request handler that hands the browser SDK a\n * personalization token — mount it at the endpoint `getToken` calls. Needs\n * only the SDK token you already created in the dashboard; mints a fresh\n * short-lived token per request so the long-lived one never reaches the\n * browser.\n *\n * @example\n * ```ts\n * export const GET = createTokenRoute({\n *   sdkToken: process.env.XENIA_SDK_TOKEN!,\n *   // baseUrl: process.env.XENIA_URL, // only to override the default hosted engine\n * });\n * ```\n */\nexport function createTokenRoute(config: RefreshTokenOptions): (request: Request) => Promise<Response> {\n  return async (): Promise<Response> => {\n    try {\n      const refreshed = await refreshSdkToken(config);\n      return new Response(JSON.stringify(refreshed), {\n        status: 200,\n        headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n      });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"token refresh failed\";\n      return new Response(JSON.stringify({ error: message }), {\n        status: 500,\n        headers: { \"Content-Type\": \"application/json\" },\n      });\n    }\n  };\n}\n","import {\n  CONSENT_COOKIE,\n  VISITOR_COOKIE,\n  consentCookieName,\n  visitorCookieName,\n} from \"../core/cookie-names\";\nimport type { ConsentState } from \"../core/types\";\n\n/**\n * Cookie names the SDK reads server-side (set by the browser SDK / your app).\n *\n * The constants are the DEFAULT-prefix names; the functions build the name for any prefix. If you\n * pass `config.prefix` to the browser client, pass the same prefix here — the browser namespaces\n * the cookie by it, so the default name won't be there to find.\n */\nexport { CONSENT_COOKIE, VISITOR_COOKIE, consentCookieName, visitorCookieName };\n\n/**\n * Parse a raw `Cookie` header into a map. Framework-agnostic so it works with\n * `Request.headers.get(\"cookie\")`, Node `req.headers.cookie`, etc.\n */\nexport function parseCookies(header: string | null | undefined): Record<string, string> {\n  const out: Record<string, string> = {};\n  if (!header) return out;\n  for (const part of header.split(\";\")) {\n    const idx = part.indexOf(\"=\");\n    if (idx === -1) continue;\n    const key = part.slice(0, idx).trim();\n    const value = part.slice(idx + 1).trim();\n    if (key) out[key] = decodeURIComponent(value);\n  }\n  return out;\n}\n\n/**\n * Read the visitor id the browser SDK wrote, so a server-side event can be bound to the same\n * visitor (`createXeniaServer({ visitorId })`) and attribute to a browser-entered journey.\n *\n * @param prefix Must match the browser client's `config.prefix`. The cookie is namespaced by it, so\n *               a mismatch finds nothing and quietly leaves the server with no visitor.\n */\nexport function getVisitorId(\n  cookieHeader: string | null | undefined,\n  prefix?: string,\n): string | null {\n  return parseCookies(cookieHeader)[visitorCookieName(prefix)] ?? null;\n}\n\n/**\n * Read consent from a cookie header. Accepts a JSON blob or a comma-list of\n * granted scopes (e.g. `analytics,personalization`). Absent → all denied.\n *\n * @param prefix Must match the browser client's `config.prefix` — see {@link getVisitorId}.\n */\nexport function getConsent(\n  cookieHeader: string | null | undefined,\n  prefix?: string,\n): ConsentState {\n  const raw = parseCookies(cookieHeader)[consentCookieName(prefix)];\n  if (!raw) return { analytics: false, marketing: false, personalization: false };\n  try {\n    const parsed = JSON.parse(raw) as ConsentState;\n    return parsed;\n  } catch {\n    const scopes = new Set(raw.split(\",\").map((s) => s.trim()));\n    return {\n      analytics: scopes.has(\"analytics\"),\n      marketing: scopes.has(\"marketing\"),\n      personalization: scopes.has(\"personalization\"),\n    };\n  }\n}\n"]}
+{"version":3,"sources":["../../src/server/token.ts"],"names":["HttpClient"],"mappings":";;;;;;;AAgCA,eAAsB,gBAAgB,IAAA,EAAoD;AACxF,EAAA,MAAM,IAAA,GAAO,IAAIA,4BAAA,CAAW,EAAE,OAAA,EAAS,KAAK,OAAA,EAAS,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,CAAA;AAC5E,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,KAAK,OAAA,CAAQ;AAAA,IAClC,MAAA,EAAQ,MAAA;AAAA,IACR,IAAA,EAAM,oCAAA;AAAA,IACN,SAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,QAAQ,CAAA,CAAA,EAAG;AAAA,IACpD,IAAA,EAAM,EAAE,UAAA,EAAY,IAAA,CAAK,cAAc,IAAA;AAAK,GAC7C,CAAA;AACD,EAAA,MAAM,GAAA,GAAO,QAAQ,EAAC;AACtB,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,KAAA,IAAS,EAAE,CAAA;AAAA,IAC7B,WAAW,OAAO,GAAA,CAAI,SAAA,KAAc,QAAA,GAAW,IAAI,SAAA,GAAY;AAAA,GACjE;AACF;AAiBO,SAAS,iBAAiB,MAAA,EAAsE;AACrG,EAAA,OAAO,YAA+B;AACpC,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAY,MAAM,eAAA,CAAgB,MAAM,CAAA;AAC9C,MAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,SAAS,CAAA,EAAG;AAAA,QAC7C,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,iBAAiB,UAAA;AAAW,OAC5E,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,sBAAA;AACrD,MAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG;AAAA,QACtD,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,OAC/C,CAAA;AAAA,IACH;AAAA,EACF,CAAA;AACF","file":"index.cjs","sourcesContent":["import { HttpClient } from \"../core/http-client\";\nimport type { JsonObject } from \"../core/types\";\n\nexport interface RefreshTokenOptions {\n  /**\n   * Xenia base URL. Defaults to the hosted engine,\n   * `https://engine.xeniamartech.com/xenia` — omit unless self-hosting.\n   */\n  baseUrl?: string;\n  /**\n   * The personalization SDK token created once in the dashboard (API Tokens →\n   * Create token). Stays server-side; the browser never sees it — only the\n   * short-lived token this exchanges it for does.\n   */\n  sdkToken: string;\n  /** Lifetime of the returned token, in minutes. Default 15, capped server-side at 60. */\n  ttlMinutes?: number;\n  timeout?: number;\n}\n\nexport interface RefreshedToken {\n  token: string;\n  expiresAt?: string;\n}\n\n/**\n * Exchange the long-lived personalization SDK token for a short-lived one with\n * the same tenant/env scope, via `POST /api/personalization/token/refresh`.\n * Self-service — no dashboard credential needed, just the SDK token you\n * already have. Call this from your backend and hand the result to the\n * browser (e.g. from a token route the client SDK calls via `getToken`).\n */\nexport async function refreshSdkToken(opts: RefreshTokenOptions): Promise<RefreshedToken> {\n  const http = new HttpClient({ baseUrl: opts.baseUrl, timeout: opts.timeout });\n  const { data } = await http.request({\n    method: \"POST\",\n    path: \"/api/personalization/token/refresh\",\n    headers: { Authorization: `Bearer ${opts.sdkToken}` },\n    body: { ttlMinutes: opts.ttlMinutes ?? null },\n  });\n  const obj = (data ?? {}) as JsonObject;\n  return {\n    token: String(obj.token ?? \"\"),\n    expiresAt: typeof obj.expiresAt === \"string\" ? obj.expiresAt : undefined,\n  };\n}\n\n/**\n * Build a framework-agnostic request handler that hands the browser SDK a\n * personalization token — mount it at the endpoint `getToken` calls. Needs\n * only the SDK token you already created in the dashboard; mints a fresh\n * short-lived token per request so the long-lived one never reaches the\n * browser.\n *\n * @example\n * ```ts\n * export const GET = createTokenRoute({\n *   sdkToken: process.env.XENIA_SDK_TOKEN!,\n *   // baseUrl: process.env.XENIA_URL, // only to override the default hosted engine\n * });\n * ```\n */\nexport function createTokenRoute(config: RefreshTokenOptions): (request: Request) => Promise<Response> {\n  return async (): Promise<Response> => {\n    try {\n      const refreshed = await refreshSdkToken(config);\n      return new Response(JSON.stringify(refreshed), {\n        status: 200,\n        headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n      });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"token refresh failed\";\n      return new Response(JSON.stringify({ error: message }), {\n        status: 500,\n        headers: { \"Content-Type\": \"application/json\" },\n      });\n    }\n  };\n}\n"]}

package/dist/server/index.d.cts

@@ -1,106 +1,7 @@
-import { y as CallerIdentity, A as AnalyticsContext, J as JsonValue, d as ConsentState, e as EventIdentity, E as EventContext, s as XeniaApi, t as XeniaConfig, a as AnalyticsEventName, c as AnalyticsIngestResponse, W as WebhookResponse, I as IdentifyRequest, f as IdentifyResponse, l as ResolveOptions, m as ResolveResult, j as ResolveBatchItem, k as ResolveBatchResult } from '../cookie-names-B3b0XNc2.cjs';
-export { b as AnalyticsIdentity, C as CONSENT_COOKIE, P as PersonalizationSwap, V as VISITOR_COOKIE, u as XeniaEvent, v as consentCookieName, w as parseActions, x as visitorCookieName } from '../cookie-names-B3b0XNc2.cjs';
-
-/**
- * Extra per-call identity/context for server-side webhook calls — an override on top of whatever the
- * client already carries.
- *
- * There's no ambient `window` on the server to auto-collect `path`/`query`/`url`/UTM params the way
- * the browser client does, so bind them ONCE per request via {@link XeniaConfig.context} (see
- * `contextFromUrl`) and every call attaches them automatically. These per-call fields are for the
- * remainder: values known only at this call site, or a deliberate override of the ambient ones.
- */
-interface ServerWebhookOptions {
-    method?: "GET" | "POST";
-    journeyId?: string;
-    identity?: EventIdentity;
-    context?: EventContext;
-}
-/**
- * Options for a server-side unified event (`POST /api/events/v1`). There's no
- * ambient request context on the server — pass whatever's known at the call
- * site (e.g. pathname/user-agent from the current request, session id from a
- * cookie) via `identity`/`context`.
- */
-interface ServerTrackOptions {
-    /** When true, also match/advance a journey (never sampled/shed). Default false. */
-    trigger?: boolean;
-    /** Stable dedup key (e.g. `"ord-1001"`) for idempotent conversions. */
-    eventId?: string;
-    eventVersion?: number;
-    occurredAtMs?: number;
-    /** Origin tag. Default `"xenia-server-sdk"`. */
-    source?: string;
-    /** Identity fields for this event (except the SDK-owned `xeniaVisitorId`,
-     *  which comes from `config.visitorId` and can't be set per call). */
-    identity?: CallerIdentity;
-    context?: AnalyticsContext;
-    properties?: Record<string, JsonValue | undefined>;
-    consent?: ConsentState;
-}
-/**
- * Server-native Xenia client. Same method names as the browser client, but
- * every call is stateless: identity and context are passed explicitly rather
- * than read from the DOM/localStorage. Uses global `fetch` (Node ≥18).
- */
-declare class XeniaServer {
-    readonly api: XeniaApi;
-    /** SDK-owned visitor anchor for this (per-request) client — see {@link XeniaConfig.visitorId}. */
-    private readonly visitorId?;
-    /** Ambient request context attached to every call — see {@link XeniaConfig.context}. */
-    private readonly context?;
-    constructor(config: XeniaConfig);
-    /**
-     * Send a unified event server-side (`POST /api/events/v1`) and return the
-     * ingest response (including per-result `triggered`). `opts.trigger: true`
-     * also matches/advances a journey; pass `opts.eventId` (e.g. `"ord-1001"`)
-     * as a stable dedup key for idempotent conversions.
-     */
-    track(eventName: AnalyticsEventName, opts?: ServerTrackOptions): Promise<AnalyticsIngestResponse>;
-    /**
-     * Send a webhook request and await the synchronous response. Merges
-     * `opts.identity`/`opts.context` into the payload the same way the browser
-     * client's auto-attached fields do (`path`, `query`, `url`, `referrer`,
-     * `deviceId`, `visitorId`, etc.) — see `ServerWebhookOptions`.
-     */
-    webhook(triggerId: string, data?: Record<string, JsonValue | undefined>, opts?: ServerWebhookOptions): Promise<WebhookResponse>;
-    /** Bind visitor→user server-side — `POST /api/events/v1/identify`. */
-    identify(body: IdentifyRequest): Promise<IdentifyResponse>;
-    /**
-     * Resolve in-entry content personalization for one content key
-     * (`POST /api/personalization/resolve`). Requires a configured SDK token
-     * (`token`/`getToken`) — resolve is auth-required. With `merge: true` the
-     * returned `content` is server-spliced.
-     *
-     * Pass `opts.identity`/`opts.context` to attach the same SDK-provided
-     * fields (`deviceId`, `customerId`, `email`, `path`, `url`, `referrer`,
-     * `utm*`, …) the browser client collects ambiently — there's no ambient
-     * `window`/`document` server-side, so a server caller must supply whatever
-     * it knows (e.g. from the current request) explicitly. See
-     * {@link ResolveOptions}.
-     */
-    resolve(contentKey: string, opts?: ResolveOptions): Promise<ResolveResult>;
-    /** Resolve several content keys in one round-trip (`POST /api/personalization/resolve-batch`). */
-    resolveBatch(items: ResolveBatchItem[], opts?: ResolveOptions): Promise<ResolveBatchResult[]>;
-    /**
-     * Merge the ambient `config.context` and `opts.identity`/`opts.context` into
-     * the resolve `data`, then stamp the SDK-owned visitor id
-     * (`config.visitorId`) under both the reserved `_xenia_vid` key (read by the
-     * backend for holdout/exposure bucketing) and the flat `visitorId` field —
-     * mirrors `webhook()`'s merge order/precedence exactly: caller `data` <
-     * ambient `config.context` < caller `context`/`identity` < SDK-owned
-     * `visitorId`/`_xenia_vid`, set LAST so neither can be overridden per call.
-     *
-     * `config.context` is what makes the SDK-provided fields automatic on the
-     * server: bound once per request, every `resolve()` carries `path`/`query`/
-     * `url`/`referrer`/UTMs with no per-call wiring, matching what the browser
-     * client collects from `window` on its own. A no-op when nothing is bound and
-     * nothing was passed — preserving today's behavior for callers using neither.
-     */
-    private withVisitor;
-}
-/** Create a server-native client. */
-declare function createXeniaServer(config: XeniaConfig): XeniaServer;
+export { S as ServerResolveOptions, a as ServerTrackOptions, b as ServerWebhookOptions, W as WithFallback, X as XeniaServer, c as createXeniaServer } from '../xenia-server-rs3Gpbw7.cjs';
+import { d as ConsentState } from '../api-URhxxi4x.cjs';
+export { A as AnalyticsContext, a as AnalyticsEventName, b as AnalyticsIdentity, c as AnalyticsIngestResponse, C as CircuitBreakerConfig, E as EventContext, e as EventIdentity, I as IdentifyRequest, f as IdentifyResponse, J as JsonValue, P as PersonalizationSwap, R as ResolveBatchItem, j as ResolveBatchResult, k as ResolveOptions, l as ResolveResult, W as WebhookResponse, s as XeniaApi, t as XeniaConfig, u as XeniaEvent } from '../api-URhxxi4x.cjs';
+export { C as CONSENT_COOKIE, a as CircuitOpenError, V as VISITOR_COOKIE, f as consentCookie, g as consentCookieName, p as parseActions, v as visitorCookieName } from '../cookie-names-QYMiEMAq.cjs';
 
 interface RefreshTokenOptions {
     /**
@@ -168,4 +69,4 @@ declare function getVisitorId(cookieHeader: string | null | undefined, prefix?:
  */
 declare function getConsent(cookieHeader: string | null | undefined, prefix?: string): ConsentState;
 
-export { AnalyticsContext, AnalyticsEventName, AnalyticsIngestResponse, ConsentState, EventContext, EventIdentity, IdentifyRequest, IdentifyResponse, JsonValue, type RefreshTokenOptions, type RefreshedToken, ResolveBatchItem, ResolveBatchResult, ResolveOptions, ResolveResult, type ServerTrackOptions, type ServerWebhookOptions, WebhookResponse, XeniaApi, XeniaConfig, XeniaServer, createTokenRoute, createXeniaServer, getConsent, getVisitorId, parseCookies, refreshSdkToken };
+export { ConsentState, type RefreshTokenOptions, type RefreshedToken, createTokenRoute, getConsent, getVisitorId, parseCookies, refreshSdkToken };