@xenia-martech/sdk-js 1.0.1-dev.1 → 1.1.0-dev.2

package/dist/chunk-U2WBBOYT.cjs

@@ -0,0 +1,233 @@
+'use strict';
+
+var chunkJEKVN7HK_cjs = require('./chunk-JEKVN7HK.cjs');
+
+// src/core/event-payload.ts
+var RESERVED = /* @__PURE__ */ new Set([
+  "eventId",
+  "eventType",
+  "journeyId",
+  "deviceId",
+  "visitorId",
+  "customerId",
+  "email",
+  "utmSource",
+  "utmMedium",
+  "utmCampaign",
+  "utmContent",
+  "utmId",
+  "url",
+  "referrer",
+  "path",
+  "query"
+]);
+function compact2(obj) {
+  const out = {};
+  for (const [k, v] of Object.entries(obj)) {
+    if (v !== void 0) out[k] = v;
+  }
+  return out;
+}
+function buildEventPayload(input) {
+  const passthrough = {};
+  const reserved = {};
+  if (input.props) {
+    for (const [k, v] of Object.entries(input.props)) {
+      if (v === void 0) continue;
+      if (RESERVED.has(k)) reserved[k] = v;
+      else passthrough[k] = v;
+    }
+  }
+  const payload = {
+    ...passthrough,
+    // Reserved-named props fill first-class fields (e.g. `email`, `customerId`)
+    // the SDK didn't auto-collect. Auto-collected context/identity still win for
+    // what they reliably know (real page url, visitor/device id), so a stray prop
+    // can't override the true page context — see merge order below.
+    ...reserved,
+    ...compact2(input.context ?? {}),
+    ...compact2(input.identity ?? {}),
+    eventId: input.eventId,
+    ...input.eventType ? { eventType: input.eventType } : {},
+    ...input.journeyId ? { journeyId: input.journeyId } : {}
+  };
+  return payload;
+}
+
+// src/server/xenia-server.ts
+async function orFallback(call, opts) {
+  if (!opts || !("fallback" in opts)) return call();
+  try {
+    return await call();
+  } catch {
+    return opts.fallback;
+  }
+}
+var XeniaServer = class {
+  api;
+  /** SDK-owned visitor anchor for this (per-request) client — see {@link XeniaConfig.visitorId}. */
+  visitorId;
+  /** Ambient request context attached to every call — see {@link XeniaConfig.context}. */
+  context;
+  constructor(config) {
+    this.api = new chunkJEKVN7HK_cjs.XeniaApi(config);
+    this.visitorId = config.visitorId;
+    this.context = config.context;
+  }
+  /**
+   * Send a unified event server-side (`POST /api/events/v1`) and return the
+   * ingest response (including per-result `triggered`). `opts.trigger: true`
+   * also matches/advances a journey; pass `opts.eventId` (e.g. `"ord-1001"`)
+   * as a stable dedup key for idempotent conversions.
+   */
+  async track(eventName, opts = {}) {
+    const event = {
+      eventName,
+      eventId: opts.eventId ? chunkJEKVN7HK_cjs.toEventId(opts.eventId) : chunkJEKVN7HK_cjs.generateUlid(),
+      eventVersion: opts.eventVersion ?? 1,
+      occurredAtMs: opts.occurredAtMs ?? Date.now(),
+      source: opts.source ?? "xenia-server-sdk",
+      identity: {
+        ...opts.identity,
+        // SDK-owned, set LAST so it can't be overridden per call. Comes from
+        // `config.visitorId` (bind it per request from the `xenia_vid` cookie).
+        xeniaVisitorId: this.visitorId
+      },
+      context: opts.context,
+      properties: opts.properties,
+      consent: opts.consent,
+      trigger: opts.trigger === true ? true : void 0
+    };
+    return this.api.sendEvents([event]);
+  }
+  /**
+   * Send a webhook request and await the synchronous response. Merges
+   * `opts.identity`/`opts.context` into the payload the same way the browser
+   * client's auto-attached fields do (`path`, `query`, `url`, `referrer`,
+   * `deviceId`, `visitorId`, etc.) — see `ServerWebhookOptions`. Pass `opts.fallback` to get it
+   * back instead of an error (see {@link WithFallback}).
+   */
+  async webhook(triggerId, data, opts = {}) {
+    const payload = buildEventPayload({
+      eventId: triggerId,
+      journeyId: opts.journeyId,
+      // SDK-owned visitor anchor wins: config.visitorId (bind the `xenia_vid`
+      // cookie per request) is attached automatically. Falls back to a
+      // per-call visitorId only when none is bound.
+      identity: { ...opts.identity, visitorId: this.visitorId ?? opts.identity?.visitorId },
+      // Ambient request context (config.context, bound once per request) under a per-call
+      // override — same precedence resolve() uses, so both surfaces carry the same fields.
+      context: { ...this.context, ...opts.context },
+      props: data
+    });
+    return orFallback(() => this.api.webhook(triggerId, payload, opts.method ?? "POST"), opts);
+  }
+  /**
+   * Bind visitor→user server-side — `POST /api/events/v1/identify`. `xeniaVisitorId` defaults to
+   * the bound `config.visitorId`, so a per-request client only passes what it learned (e.g. an email
+   * from a submitted form).
+   */
+  async identify(body) {
+    const xeniaVisitorId = body.xeniaVisitorId ?? this.visitorId;
+    if (!xeniaVisitorId) {
+      throw new Error("identify() needs a visitor: bind config.visitorId or pass xeniaVisitorId");
+    }
+    return this.api.identify({ ...body, xeniaVisitorId });
+  }
+  /**
+   * Resolve in-entry content personalization for one content key
+   * (`POST /api/personalization/resolve`). Requires a configured SDK token
+   * (`token`/`getToken`) — resolve is auth-required. With `merge: true` the
+   * returned `content` is server-spliced.
+   *
+   * Pass `opts.identity`/`opts.context` to attach the same SDK-provided
+   * fields (`deviceId`, `customerId`, `email`, `path`, `url`, `referrer`,
+   * `utm*`, …) the browser client collects ambiently — there's no ambient
+   * `window`/`document` server-side, so a server caller must supply whatever
+   * it knows (e.g. from the current request) explicitly. See
+   * {@link ResolveOptions}. Pass `opts.fallback` to get it back instead of an
+   * error (see {@link WithFallback}).
+   */
+  async resolve(contentKey, opts) {
+    return orFallback(() => this.api.resolve(contentKey, this.withVisitor(opts)), opts);
+  }
+  /**
+   * Resolve several content keys in one round-trip (`POST /api/personalization/resolve-batch`).
+   * `opts.fallback` as in {@link resolve}.
+   */
+  async resolveBatch(items, opts) {
+    return orFallback(() => this.api.resolveBatch(items, this.withVisitor(opts)), opts);
+  }
+  /**
+   * Merge the ambient `config.context` and `opts.identity`/`opts.context` into
+   * the resolve `data`, then stamp the SDK-owned visitor id
+   * (`config.visitorId`) under both the reserved `_xenia_vid` key (read by the
+   * backend for holdout/exposure bucketing) and the flat `visitorId` field —
+   * mirrors `webhook()`'s merge order/precedence exactly: caller `data` <
+   * ambient `config.context` < caller `context`/`identity` < SDK-owned
+   * `visitorId`/`_xenia_vid`, set LAST so neither can be overridden per call.
+   *
+   * `config.context` is what makes the SDK-provided fields automatic on the
+   * server: bound once per request, every `resolve()` carries `path`/`query`/
+   * `url`/`referrer`/UTMs with no per-call wiring, matching what the browser
+   * client collects from `window` on its own. A no-op when nothing is bound and
+   * nothing was passed — preserving today's behavior for callers using neither.
+   */
+  withVisitor(opts) {
+    const identity = chunkJEKVN7HK_cjs.compact({
+      ...opts?.identity,
+      visitorId: this.visitorId ?? opts?.identity?.visitorId
+    });
+    const merged = {
+      ...chunkJEKVN7HK_cjs.compact(this.context ?? {}),
+      ...chunkJEKVN7HK_cjs.compact(opts?.context ?? {}),
+      ...identity
+    };
+    if (Object.keys(merged).length === 0 && !this.visitorId) return opts;
+    if (this.visitorId) merged._xenia_vid = this.visitorId;
+    return { ...opts, data: { ...opts?.data ?? {}, ...merged } };
+  }
+};
+function createXeniaServer(config) {
+  return new XeniaServer(config);
+}
+
+// src/server/cookies.ts
+function parseCookies(header) {
+  const out = {};
+  if (!header) return out;
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1) continue;
+    const key = part.slice(0, idx).trim();
+    const value = part.slice(idx + 1).trim();
+    if (key) out[key] = decodeURIComponent(value);
+  }
+  return out;
+}
+function getVisitorId(cookieHeader, prefix) {
+  return parseCookies(cookieHeader)[chunkJEKVN7HK_cjs.visitorCookieName(prefix)] ?? null;
+}
+function getConsent(cookieHeader, prefix) {
+  const raw = parseCookies(cookieHeader)[chunkJEKVN7HK_cjs.consentCookieName(prefix)];
+  if (!raw) return { analytics: false, marketing: false, personalization: false };
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed;
+  } catch {
+    const scopes = new Set(raw.split(",").map((s) => s.trim()));
+    return {
+      analytics: scopes.has("analytics"),
+      marketing: scopes.has("marketing"),
+      personalization: scopes.has("personalization")
+    };
+  }
+}
+
+exports.XeniaServer = XeniaServer;
+exports.createXeniaServer = createXeniaServer;
+exports.getConsent = getConsent;
+exports.getVisitorId = getVisitorId;
+exports.parseCookies = parseCookies;
+//# sourceMappingURL=chunk-U2WBBOYT.cjs.map
+//# sourceMappingURL=chunk-U2WBBOYT.cjs.map

package/dist/chunk-U2WBBOYT.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/event-payload.ts","../src/server/xenia-server.ts","../src/server/cookies.ts"],"names":["compact","XeniaApi","toEventId","generateUlid","visitorCookieName","consentCookieName"],"mappings":";;;;;AAGA,IAAM,QAAA,uBAAe,GAAA,CAAI;AAAA,EACvB,SAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,aAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAC,CAAA;AAaD,SAASA,SAAQ,GAAA,EAAuE;AACtF,EAAA,MAAM,MAAiC,EAAC;AACxC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AACxC,IAAA,IAAI,CAAA,KAAM,MAAA,EAAW,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EAChC;AACA,EAAA,OAAO,GAAA;AACT;AAWO,SAAS,kBAAkB,KAAA,EAAsC;AACtE,EAAA,MAAM,cAAyC,EAAC;AAChD,EAAA,MAAM,WAAsC,EAAC;AAC7C,EAAA,IAAI,MAAM,KAAA,EAAO;AACf,IAAA,KAAA,MAAW,CAAC,GAAG,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,KAAK,CAAA,EAAG;AAChD,MAAA,IAAI,MAAM,MAAA,EAAW;AAKrB,MAAA,IAAI,SAAS,GAAA,CAAI,CAAC,CAAA,EAAG,QAAA,CAAS,CAAC,CAAA,GAAI,CAAA;AAAA,WAC9B,WAAA,CAAY,CAAC,CAAA,GAAI,CAAA;AAAA,IACxB;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,GAAG,WAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAKH,GAAG,QAAA;AAAA,IACH,GAAGA,QAAAA,CAAS,KAAA,CAAM,OAAA,IAAW,EAA4C,CAAA;AAAA,IACzE,GAAGA,QAAAA,CAAS,KAAA,CAAM,QAAA,IAAY,EAA4C,CAAA;AAAA,IAC1E,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,GAAI,MAAM,SAAA,GAAY,EAAE,WAAW,KAAA,CAAM,SAAA,KAAc,EAAC;AAAA,IACxD,GAAI,MAAM,SAAA,GAAY,EAAE,WAAW,KAAA,CAAM,SAAA,KAAc;AAAC,GAC1D;AAEA,EAAA,OAAO,OAAA;AACT;;;AC3BA,eAAe,UAAA,CAAiB,MAAwB,IAAA,EAAwC;AAC9F,EAAA,IAAI,CAAC,IAAA,IAAQ,EAAE,UAAA,IAAc,IAAA,CAAA,SAAc,IAAA,EAAK;AAChD,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,IAAA,EAAK;AAAA,EACpB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA,CAAK,QAAA;AAAA,EACd;AACF;AA8BO,IAAM,cAAN,MAAkB;AAAA,EACd,GAAA;AAAA;AAAA,EAEA,SAAA;AAAA;AAAA,EAEQ,OAAA;AAAA,EAEjB,YAAY,MAAA,EAAqB;AAC/B,IAAA,IAAA,CAAK,GAAA,GAAM,IAAIC,0BAAA,CAAS,MAAM,CAAA;AAC9B,IAAA,IAAA,CAAK,YAAY,MAAA,CAAO,SAAA;AACxB,IAAA,IAAA,CAAK,UAAU,MAAA,CAAO,OAAA;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,CACJ,SAAA,EACA,IAAA,GAA2B,EAAC,EACM;AAClC,IAAA,MAAM,KAAA,GAAoB;AAAA,MACxB,SAAA;AAAA,MACA,SAAS,IAAA,CAAK,OAAA,GAAUC,4BAAU,IAAA,CAAK,OAAO,IAAIC,8BAAA,EAAa;AAAA,MAC/D,YAAA,EAAc,KAAK,YAAA,IAAgB,CAAA;AAAA,MACnC,YAAA,EAAc,IAAA,CAAK,YAAA,IAAgB,IAAA,CAAK,GAAA,EAAI;AAAA,MAC5C,MAAA,EAAQ,KAAK,MAAA,IAAU,kBAAA;AAAA,MACvB,QAAA,EAAU;AAAA,QACR,GAAG,IAAA,CAAK,QAAA;AAAA;AAAA;AAAA,QAGR,gBAAgB,IAAA,CAAK;AAAA,OACvB;AAAA,MACA,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,OAAA,EAAS,IAAA,CAAK,OAAA,KAAY,IAAA,GAAO,IAAA,GAAO;AAAA,KAC1C;AACA,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,UAAA,CAAW,CAAC,KAAK,CAAC,CAAA;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,OAAA,CACJ,SAAA,EACA,IAAA,EACA,IAAA,GAAgC,EAAC,EACH;AAC9B,IAAA,MAAM,UAAU,iBAAA,CAAkB;AAAA,MAChC,OAAA,EAAS,SAAA;AAAA,MACT,WAAW,IAAA,CAAK,SAAA;AAAA;AAAA;AAAA;AAAA,MAIhB,QAAA,EAAU,EAAE,GAAG,IAAA,CAAK,QAAA,EAAU,WAAW,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,QAAA,EAAU,SAAA,EAAU;AAAA;AAAA;AAAA,MAGpF,SAAS,EAAE,GAAG,KAAK,OAAA,EAAS,GAAG,KAAK,OAAA,EAAQ;AAAA,MAC5C,KAAA,EAAO;AAAA,KACR,CAAA;AACD,IAAA,OAAO,UAAA,CAAW,MAAM,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ,SAAA,EAAW,OAAA,EAAsB,IAAA,CAAK,MAAA,IAAU,MAAM,CAAA,EAAG,IAAI,CAAA;AAAA,EACxG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,SACJ,IAAA,EAC2B;AAC3B,IAAA,MAAM,cAAA,GAAiB,IAAA,CAAK,cAAA,IAAkB,IAAA,CAAK,SAAA;AACnD,IAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,MAAA,MAAM,IAAI,MAAM,0EAA0E,CAAA;AAAA,IAC5F;AACA,IAAA,OAAO,KAAK,GAAA,CAAI,QAAA,CAAS,EAAE,GAAG,IAAA,EAAM,gBAAgB,CAAA;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,OAAA,CAAmB,UAAA,EAAoB,IAAA,EAA4D;AACvG,IAAA,OAAO,UAAA,CAAW,MAAM,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ,UAAA,EAAY,IAAA,CAAK,WAAA,CAAY,IAAI,CAAC,CAAA,EAAG,IAAI,CAAA;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,YAAA,CACJ,KAAA,EACA,IAAA,EACmC;AACnC,IAAA,OAAO,UAAA,CAAW,MAAM,IAAA,CAAK,GAAA,CAAI,YAAA,CAAa,KAAA,EAAO,IAAA,CAAK,WAAA,CAAY,IAAI,CAAC,CAAA,EAAG,IAAI,CAAA;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBQ,YAAY,IAAA,EAAmD;AACrE,IAAA,MAAM,WAAWH,yBAAA,CAAQ;AAAA,MACvB,GAAG,IAAA,EAAM,QAAA;AAAA,MACT,SAAA,EAAW,IAAA,CAAK,SAAA,IAAa,IAAA,EAAM,QAAA,EAAU;AAAA,KAC9C,CAAA;AACD,IAAA,MAAM,MAAA,GAAS;AAAA,MACb,GAAGA,yBAAA,CAAS,IAAA,CAAK,OAAA,IAAW,EAA4C,CAAA;AAAA,MACxE,GAAGA,yBAAA,CAAS,IAAA,EAAM,OAAA,IAAW,EAA4C,CAAA;AAAA,MACzE,GAAG;AAAA,KACL;AACA,IAAA,IAAI,MAAA,CAAO,KAAK,MAAM,CAAA,CAAE,WAAW,CAAA,IAAK,CAAC,IAAA,CAAK,SAAA,EAAW,OAAO,IAAA;AAChE,IAAA,IAAI,IAAA,CAAK,SAAA,EAAW,MAAA,CAAO,UAAA,GAAa,IAAA,CAAK,SAAA;AAC7C,IAAA,OAAO,EAAE,GAAG,IAAA,EAAM,IAAA,EAAM,EAAE,GAAI,IAAA,EAAM,IAAA,IAAQ,EAAC,EAAI,GAAG,MAAA,EAAO,EAAE;AAAA,EAC/D;AACF;AAGO,SAAS,kBAAkB,MAAA,EAAkC;AAClE,EAAA,OAAO,IAAI,YAAY,MAAM,CAAA;AAC/B;;;ACxNO,SAAS,aAAa,MAAA,EAA2D;AACtF,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,IAAI,CAAC,QAAQ,OAAO,GAAA;AACpB,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAAG;AACpC,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC5B,IAAA,IAAI,QAAQ,EAAA,EAAI;AAChB,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,EAAE,IAAA,EAAK;AACpC,IAAA,MAAM,QAAQ,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AACvC,IAAA,IAAI,GAAA,EAAK,GAAA,CAAI,GAAG,CAAA,GAAI,mBAAmB,KAAK,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,GAAA;AACT;AASO,SAAS,YAAA,CACd,cACA,MAAA,EACe;AACf,EAAA,OAAO,aAAa,YAAY,CAAA,CAAEI,mCAAA,CAAkB,MAAM,CAAC,CAAA,IAAK,IAAA;AAClE;AAQO,SAAS,UAAA,CACd,cACA,MAAA,EACc;AACd,EAAA,MAAM,MAAM,YAAA,CAAa,YAAY,CAAA,CAAEC,mCAAA,CAAkB,MAAM,CAAC,CAAA;AAChE,EAAA,IAAI,CAAC,KAAK,OAAO,EAAE,WAAW,KAAA,EAAO,SAAA,EAAW,KAAA,EAAO,eAAA,EAAiB,KAAA,EAAM;AAC9E,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AAC1D,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,WAAW,CAAA;AAAA,MACjC,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,WAAW,CAAA;AAAA,MACjC,eAAA,EAAiB,MAAA,CAAO,GAAA,CAAI,iBAAiB;AAAA,KAC/C;AAAA,EACF;AACF","file":"chunk-U2WBBOYT.cjs","sourcesContent":["import type { EventContext, EventIdentity, EventPayload, JsonValue } from \"./types\";\n\n/** Reserved keys that map to first-class fields (not passthrough data). */\nconst RESERVED = new Set([\n  \"eventId\",\n  \"eventType\",\n  \"journeyId\",\n  \"deviceId\",\n  \"visitorId\",\n  \"customerId\",\n  \"email\",\n  \"utmSource\",\n  \"utmMedium\",\n  \"utmCampaign\",\n  \"utmContent\",\n  \"utmId\",\n  \"url\",\n  \"referrer\",\n  \"path\",\n  \"query\",\n]);\n\nexport interface BuildEventInput {\n  eventId: string;\n  eventType?: string;\n  journeyId?: string;\n  identity?: EventIdentity;\n  context?: EventContext;\n  /** Arbitrary extra properties merged as passthrough data. */\n  props?: Record<string, JsonValue | undefined>;\n}\n\n/** Drop `undefined` values so the JSON body stays clean. */\nfunction compact(obj: Record<string, JsonValue | undefined>): Record<string, JsonValue> {\n  const out: Record<string, JsonValue> = {};\n  for (const [k, v] of Object.entries(obj)) {\n    if (v !== undefined) out[k] = v;\n  }\n  return out;\n}\n\n/**\n * Build the request body for the webhook `/flow` call (`XeniaApi.webhook`).\n *\n * Merge order (later wins): passthrough props < context < identity < core.\n * Field names match the backend `EventTriggerRequest` DTO exactly.\n *\n * @internal Used only by the webhook request/response path — the unified event\n * surface (`track()` → `POST /api/events/v1`) builds {@link XeniaEvent} instead.\n */\nexport function buildEventPayload(input: BuildEventInput): EventPayload {\n  const passthrough: Record<string, JsonValue> = {};\n  const reserved: Record<string, JsonValue> = {};\n  if (input.props) {\n    for (const [k, v] of Object.entries(input.props)) {\n      if (v === undefined) continue;\n      // A prop whose key matches a reserved field (e.g. `email`, `customerId`,\n      // `utmSource`) is promoted to that first-class field; everything else is\n      // custom passthrough data. Previously reserved-named props were dropped\n      // outright — so `track(\"sign_up\", { email })` never sent `email` at all.\n      if (RESERVED.has(k)) reserved[k] = v;\n      else passthrough[k] = v;\n    }\n  }\n\n  const payload = {\n    ...passthrough,\n    // Reserved-named props fill first-class fields (e.g. `email`, `customerId`)\n    // the SDK didn't auto-collect. Auto-collected context/identity still win for\n    // what they reliably know (real page url, visitor/device id), so a stray prop\n    // can't override the true page context — see merge order below.\n    ...reserved,\n    ...compact((input.context ?? {}) as Record<string, JsonValue | undefined>),\n    ...compact((input.identity ?? {}) as Record<string, JsonValue | undefined>),\n    eventId: input.eventId,\n    ...(input.eventType ? { eventType: input.eventType } : {}),\n    ...(input.journeyId ? { journeyId: input.journeyId } : {}),\n  };\n\n  return payload as EventPayload;\n}\n","import { compact, XeniaApi } from \"../core/api\";\nimport { buildEventPayload } from \"../core/event-payload\";\nimport { generateUlid, toEventId } from \"../core/id\";\nimport type {\n  AnalyticsContext,\n  AnalyticsEventName,\n  CallerIdentity,\n  AnalyticsIngestResponse,\n  ConsentState,\n  EventContext,\n  EventIdentity,\n  IdentifyRequest,\n  IdentifyResponse,\n  JsonValue,\n  ResolveBatchItem,\n  ResolveBatchResult,\n  ResolveOptions,\n  ResolveResult,\n  WebhookResponse,\n  XeniaConfig,\n  XeniaEvent,\n} from \"../core/types\";\n\n/**\n * Extra per-call identity/context for server-side webhook calls — an override on top of whatever the\n * client already carries.\n *\n * There's no ambient `window` on the server to auto-collect `path`/`query`/`url`/UTM params the way\n * the browser client does, so bind them ONCE per request via {@link XeniaConfig.context} (see\n * `contextFromUrl`) and every call attaches them automatically. These per-call fields are for the\n * remainder: values known only at this call site, or a deliberate override of the ambient ones.\n */\nexport interface ServerWebhookOptions<F = never> extends WithFallback<F> {\n  method?: \"GET\" | \"POST\";\n  journeyId?: string;\n  identity?: EventIdentity;\n  context?: EventContext;\n}\n\n/**\n * Opt-in \"never throw\" for calls a page renders from. When `fallback` is set (even to `null`), any\n * failure (timeout, network error, non-2xx, open circuit) resolves to it instead of throwing, so a\n * caller can render its default content without a `try/catch`. Errors are swallowed silently: leave\n * it unset where you need to see them.\n */\nexport interface WithFallback<F> {\n  fallback?: F;\n}\n\n/** {@link ResolveOptions} plus {@link WithFallback}. */\nexport type ServerResolveOptions<F = never> = ResolveOptions & WithFallback<F>;\n\n/** Runs `call`, or resolves to `opts.fallback` on any error when one was given. */\nasync function orFallback<T, F>(call: () => Promise<T>, opts?: WithFallback<F>): Promise<T | F> {\n  if (!opts || !(\"fallback\" in opts)) return call();\n  try {\n    return await call();\n  } catch {\n    return opts.fallback as F;\n  }\n}\n\n/**\n * Options for a server-side unified event (`POST /api/events/v1`). There's no\n * ambient request context on the server — pass whatever's known at the call\n * site (e.g. pathname/user-agent from the current request, session id from a\n * cookie) via `identity`/`context`.\n */\nexport interface ServerTrackOptions {\n  /** When true, also match/advance a journey (never sampled/shed). Default false. */\n  trigger?: boolean;\n  /** Stable dedup key (e.g. `\"ord-1001\"`) for idempotent conversions. */\n  eventId?: string;\n  eventVersion?: number;\n  occurredAtMs?: number;\n  /** Origin tag. Default `\"xenia-server-sdk\"`. */\n  source?: string;\n  /** Identity fields for this event (except the SDK-owned `xeniaVisitorId`,\n   *  which comes from `config.visitorId` and can't be set per call). */\n  identity?: CallerIdentity;\n  context?: AnalyticsContext;\n  properties?: Record<string, JsonValue | undefined>;\n  consent?: ConsentState;\n}\n\n/**\n * Server-native Xenia client. Same method names as the browser client, but\n * every call is stateless: identity and context are passed explicitly rather\n * than read from the DOM/localStorage. Uses global `fetch` (Node ≥18).\n */\nexport class XeniaServer {\n  readonly api: XeniaApi;\n  /** SDK-owned visitor anchor for this (per-request) client — see {@link XeniaConfig.visitorId}. */\n  readonly visitorId?: string;\n  /** Ambient request context attached to every call — see {@link XeniaConfig.context}. */\n  private readonly context?: EventContext;\n\n  constructor(config: XeniaConfig) {\n    this.api = new XeniaApi(config);\n    this.visitorId = config.visitorId;\n    this.context = config.context;\n  }\n\n  /**\n   * Send a unified event server-side (`POST /api/events/v1`) and return the\n   * ingest response (including per-result `triggered`). `opts.trigger: true`\n   * also matches/advances a journey; pass `opts.eventId` (e.g. `\"ord-1001\"`)\n   * as a stable dedup key for idempotent conversions.\n   */\n  async track(\n    eventName: AnalyticsEventName,\n    opts: ServerTrackOptions = {},\n  ): Promise<AnalyticsIngestResponse> {\n    const event: XeniaEvent = {\n      eventName,\n      eventId: opts.eventId ? toEventId(opts.eventId) : generateUlid(),\n      eventVersion: opts.eventVersion ?? 1,\n      occurredAtMs: opts.occurredAtMs ?? Date.now(),\n      source: opts.source ?? \"xenia-server-sdk\",\n      identity: {\n        ...opts.identity,\n        // SDK-owned, set LAST so it can't be overridden per call. Comes from\n        // `config.visitorId` (bind it per request from the `xenia_vid` cookie).\n        xeniaVisitorId: this.visitorId,\n      },\n      context: opts.context,\n      properties: opts.properties,\n      consent: opts.consent,\n      trigger: opts.trigger === true ? true : undefined,\n    };\n    return this.api.sendEvents([event]);\n  }\n\n  /**\n   * Send a webhook request and await the synchronous response. Merges\n   * `opts.identity`/`opts.context` into the payload the same way the browser\n   * client's auto-attached fields do (`path`, `query`, `url`, `referrer`,\n   * `deviceId`, `visitorId`, etc.) — see `ServerWebhookOptions`. Pass `opts.fallback` to get it\n   * back instead of an error (see {@link WithFallback}).\n   */\n  async webhook<F = never>(\n    triggerId: string,\n    data?: Record<string, JsonValue | undefined>,\n    opts: ServerWebhookOptions<F> = {},\n  ): Promise<WebhookResponse | F> {\n    const payload = buildEventPayload({\n      eventId: triggerId,\n      journeyId: opts.journeyId,\n      // SDK-owned visitor anchor wins: config.visitorId (bind the `xenia_vid`\n      // cookie per request) is attached automatically. Falls back to a\n      // per-call visitorId only when none is bound.\n      identity: { ...opts.identity, visitorId: this.visitorId ?? opts.identity?.visitorId },\n      // Ambient request context (config.context, bound once per request) under a per-call\n      // override — same precedence resolve() uses, so both surfaces carry the same fields.\n      context: { ...this.context, ...opts.context },\n      props: data,\n    });\n    return orFallback(() => this.api.webhook(triggerId, payload as JsonValue, opts.method ?? \"POST\"), opts);\n  }\n\n  /**\n   * Bind visitor→user server-side — `POST /api/events/v1/identify`. `xeniaVisitorId` defaults to\n   * the bound `config.visitorId`, so a per-request client only passes what it learned (e.g. an email\n   * from a submitted form).\n   */\n  async identify(\n    body: Omit<IdentifyRequest, \"xeniaVisitorId\"> & { xeniaVisitorId?: string },\n  ): Promise<IdentifyResponse> {\n    const xeniaVisitorId = body.xeniaVisitorId ?? this.visitorId;\n    if (!xeniaVisitorId) {\n      throw new Error(\"identify() needs a visitor: bind config.visitorId or pass xeniaVisitorId\");\n    }\n    return this.api.identify({ ...body, xeniaVisitorId });\n  }\n\n  /**\n   * Resolve in-entry content personalization for one content key\n   * (`POST /api/personalization/resolve`). Requires a configured SDK token\n   * (`token`/`getToken`) — resolve is auth-required. With `merge: true` the\n   * returned `content` is server-spliced.\n   *\n   * Pass `opts.identity`/`opts.context` to attach the same SDK-provided\n   * fields (`deviceId`, `customerId`, `email`, `path`, `url`, `referrer`,\n   * `utm*`, …) the browser client collects ambiently — there's no ambient\n   * `window`/`document` server-side, so a server caller must supply whatever\n   * it knows (e.g. from the current request) explicitly. See\n   * {@link ResolveOptions}. Pass `opts.fallback` to get it back instead of an\n   * error (see {@link WithFallback}).\n   */\n  async resolve<F = never>(contentKey: string, opts?: ServerResolveOptions<F>): Promise<ResolveResult | F> {\n    return orFallback(() => this.api.resolve(contentKey, this.withVisitor(opts)), opts);\n  }\n\n  /**\n   * Resolve several content keys in one round-trip (`POST /api/personalization/resolve-batch`).\n   * `opts.fallback` as in {@link resolve}.\n   */\n  async resolveBatch<F = never>(\n    items: ResolveBatchItem[],\n    opts?: ServerResolveOptions<F>,\n  ): Promise<ResolveBatchResult[] | F> {\n    return orFallback(() => this.api.resolveBatch(items, this.withVisitor(opts)), opts);\n  }\n\n  /**\n   * Merge the ambient `config.context` and `opts.identity`/`opts.context` into\n   * the resolve `data`, then stamp the SDK-owned visitor id\n   * (`config.visitorId`) under both the reserved `_xenia_vid` key (read by the\n   * backend for holdout/exposure bucketing) and the flat `visitorId` field —\n   * mirrors `webhook()`'s merge order/precedence exactly: caller `data` <\n   * ambient `config.context` < caller `context`/`identity` < SDK-owned\n   * `visitorId`/`_xenia_vid`, set LAST so neither can be overridden per call.\n   *\n   * `config.context` is what makes the SDK-provided fields automatic on the\n   * server: bound once per request, every `resolve()` carries `path`/`query`/\n   * `url`/`referrer`/UTMs with no per-call wiring, matching what the browser\n   * client collects from `window` on its own. A no-op when nothing is bound and\n   * nothing was passed — preserving today's behavior for callers using neither.\n   */\n  private withVisitor(opts?: ResolveOptions): ResolveOptions | undefined {\n    const identity = compact({\n      ...opts?.identity,\n      visitorId: this.visitorId ?? opts?.identity?.visitorId,\n    });\n    const merged = {\n      ...compact((this.context ?? {}) as Record<string, JsonValue | undefined>),\n      ...compact((opts?.context ?? {}) as Record<string, JsonValue | undefined>),\n      ...identity,\n    };\n    if (Object.keys(merged).length === 0 && !this.visitorId) return opts;\n    if (this.visitorId) merged._xenia_vid = this.visitorId;\n    return { ...opts, data: { ...(opts?.data ?? {}), ...merged } };\n  }\n}\n\n/** Create a server-native client. */\nexport function createXeniaServer(config: XeniaConfig): XeniaServer {\n  return new XeniaServer(config);\n}\n","import {\n  CONSENT_COOKIE,\n  VISITOR_COOKIE,\n  consentCookie,\n  consentCookieName,\n  visitorCookieName,\n} from \"../core/cookie-names\";\nimport type { ConsentState } from \"../core/types\";\n\n/**\n * Cookie names the SDK reads server-side (set by the browser SDK / your app).\n *\n * The constants are the DEFAULT-prefix names; the functions build the name for any prefix. If you\n * pass `config.prefix` to the browser client, pass the same prefix here — the browser namespaces\n * the cookie by it, so the default name won't be there to find.\n */\nexport { CONSENT_COOKIE, VISITOR_COOKIE, consentCookie, consentCookieName, visitorCookieName };\n\n/**\n * Parse a raw `Cookie` header into a map. Framework-agnostic so it works with\n * `Request.headers.get(\"cookie\")`, Node `req.headers.cookie`, etc.\n */\nexport function parseCookies(header: string | null | undefined): Record<string, string> {\n  const out: Record<string, string> = {};\n  if (!header) return out;\n  for (const part of header.split(\";\")) {\n    const idx = part.indexOf(\"=\");\n    if (idx === -1) continue;\n    const key = part.slice(0, idx).trim();\n    const value = part.slice(idx + 1).trim();\n    if (key) out[key] = decodeURIComponent(value);\n  }\n  return out;\n}\n\n/**\n * Read the visitor id the browser SDK wrote, so a server-side event can be bound to the same\n * visitor (`createXeniaServer({ visitorId })`) and attribute to a browser-entered journey.\n *\n * @param prefix Must match the browser client's `config.prefix`. The cookie is namespaced by it, so\n *               a mismatch finds nothing and quietly leaves the server with no visitor.\n */\nexport function getVisitorId(\n  cookieHeader: string | null | undefined,\n  prefix?: string,\n): string | null {\n  return parseCookies(cookieHeader)[visitorCookieName(prefix)] ?? null;\n}\n\n/**\n * Read consent from a cookie header. Accepts a JSON blob or a comma-list of\n * granted scopes (e.g. `analytics,personalization`). Absent → all denied.\n *\n * @param prefix Must match the browser client's `config.prefix` — see {@link getVisitorId}.\n */\nexport function getConsent(\n  cookieHeader: string | null | undefined,\n  prefix?: string,\n): ConsentState {\n  const raw = parseCookies(cookieHeader)[consentCookieName(prefix)];\n  if (!raw) return { analytics: false, marketing: false, personalization: false };\n  try {\n    const parsed = JSON.parse(raw) as ConsentState;\n    return parsed;\n  } catch {\n    const scopes = new Set(raw.split(\",\").map((s) => s.trim()));\n    return {\n      analytics: scopes.has(\"analytics\"),\n      marketing: scopes.has(\"marketing\"),\n      personalization: scopes.has(\"personalization\"),\n    };\n  }\n}\n"]}

package/dist/chunk-WYAMPEVV.js

@@ -0,0 +1,227 @@
+import { XeniaApi, toEventId, generateUlid, compact, visitorCookieName, consentCookieName } from './chunk-FYSEKFIY.js';
+
+// src/core/event-payload.ts
+var RESERVED = /* @__PURE__ */ new Set([
+  "eventId",
+  "eventType",
+  "journeyId",
+  "deviceId",
+  "visitorId",
+  "customerId",
+  "email",
+  "utmSource",
+  "utmMedium",
+  "utmCampaign",
+  "utmContent",
+  "utmId",
+  "url",
+  "referrer",
+  "path",
+  "query"
+]);
+function compact2(obj) {
+  const out = {};
+  for (const [k, v] of Object.entries(obj)) {
+    if (v !== void 0) out[k] = v;
+  }
+  return out;
+}
+function buildEventPayload(input) {
+  const passthrough = {};
+  const reserved = {};
+  if (input.props) {
+    for (const [k, v] of Object.entries(input.props)) {
+      if (v === void 0) continue;
+      if (RESERVED.has(k)) reserved[k] = v;
+      else passthrough[k] = v;
+    }
+  }
+  const payload = {
+    ...passthrough,
+    // Reserved-named props fill first-class fields (e.g. `email`, `customerId`)
+    // the SDK didn't auto-collect. Auto-collected context/identity still win for
+    // what they reliably know (real page url, visitor/device id), so a stray prop
+    // can't override the true page context — see merge order below.
+    ...reserved,
+    ...compact2(input.context ?? {}),
+    ...compact2(input.identity ?? {}),
+    eventId: input.eventId,
+    ...input.eventType ? { eventType: input.eventType } : {},
+    ...input.journeyId ? { journeyId: input.journeyId } : {}
+  };
+  return payload;
+}
+
+// src/server/xenia-server.ts
+async function orFallback(call, opts) {
+  if (!opts || !("fallback" in opts)) return call();
+  try {
+    return await call();
+  } catch {
+    return opts.fallback;
+  }
+}
+var XeniaServer = class {
+  api;
+  /** SDK-owned visitor anchor for this (per-request) client — see {@link XeniaConfig.visitorId}. */
+  visitorId;
+  /** Ambient request context attached to every call — see {@link XeniaConfig.context}. */
+  context;
+  constructor(config) {
+    this.api = new XeniaApi(config);
+    this.visitorId = config.visitorId;
+    this.context = config.context;
+  }
+  /**
+   * Send a unified event server-side (`POST /api/events/v1`) and return the
+   * ingest response (including per-result `triggered`). `opts.trigger: true`
+   * also matches/advances a journey; pass `opts.eventId` (e.g. `"ord-1001"`)
+   * as a stable dedup key for idempotent conversions.
+   */
+  async track(eventName, opts = {}) {
+    const event = {
+      eventName,
+      eventId: opts.eventId ? toEventId(opts.eventId) : generateUlid(),
+      eventVersion: opts.eventVersion ?? 1,
+      occurredAtMs: opts.occurredAtMs ?? Date.now(),
+      source: opts.source ?? "xenia-server-sdk",
+      identity: {
+        ...opts.identity,
+        // SDK-owned, set LAST so it can't be overridden per call. Comes from
+        // `config.visitorId` (bind it per request from the `xenia_vid` cookie).
+        xeniaVisitorId: this.visitorId
+      },
+      context: opts.context,
+      properties: opts.properties,
+      consent: opts.consent,
+      trigger: opts.trigger === true ? true : void 0
+    };
+    return this.api.sendEvents([event]);
+  }
+  /**
+   * Send a webhook request and await the synchronous response. Merges
+   * `opts.identity`/`opts.context` into the payload the same way the browser
+   * client's auto-attached fields do (`path`, `query`, `url`, `referrer`,
+   * `deviceId`, `visitorId`, etc.) — see `ServerWebhookOptions`. Pass `opts.fallback` to get it
+   * back instead of an error (see {@link WithFallback}).
+   */
+  async webhook(triggerId, data, opts = {}) {
+    const payload = buildEventPayload({
+      eventId: triggerId,
+      journeyId: opts.journeyId,
+      // SDK-owned visitor anchor wins: config.visitorId (bind the `xenia_vid`
+      // cookie per request) is attached automatically. Falls back to a
+      // per-call visitorId only when none is bound.
+      identity: { ...opts.identity, visitorId: this.visitorId ?? opts.identity?.visitorId },
+      // Ambient request context (config.context, bound once per request) under a per-call
+      // override — same precedence resolve() uses, so both surfaces carry the same fields.
+      context: { ...this.context, ...opts.context },
+      props: data
+    });
+    return orFallback(() => this.api.webhook(triggerId, payload, opts.method ?? "POST"), opts);
+  }
+  /**
+   * Bind visitor→user server-side — `POST /api/events/v1/identify`. `xeniaVisitorId` defaults to
+   * the bound `config.visitorId`, so a per-request client only passes what it learned (e.g. an email
+   * from a submitted form).
+   */
+  async identify(body) {
+    const xeniaVisitorId = body.xeniaVisitorId ?? this.visitorId;
+    if (!xeniaVisitorId) {
+      throw new Error("identify() needs a visitor: bind config.visitorId or pass xeniaVisitorId");
+    }
+    return this.api.identify({ ...body, xeniaVisitorId });
+  }
+  /**
+   * Resolve in-entry content personalization for one content key
+   * (`POST /api/personalization/resolve`). Requires a configured SDK token
+   * (`token`/`getToken`) — resolve is auth-required. With `merge: true` the
+   * returned `content` is server-spliced.
+   *
+   * Pass `opts.identity`/`opts.context` to attach the same SDK-provided
+   * fields (`deviceId`, `customerId`, `email`, `path`, `url`, `referrer`,
+   * `utm*`, …) the browser client collects ambiently — there's no ambient
+   * `window`/`document` server-side, so a server caller must supply whatever
+   * it knows (e.g. from the current request) explicitly. See
+   * {@link ResolveOptions}. Pass `opts.fallback` to get it back instead of an
+   * error (see {@link WithFallback}).
+   */
+  async resolve(contentKey, opts) {
+    return orFallback(() => this.api.resolve(contentKey, this.withVisitor(opts)), opts);
+  }
+  /**
+   * Resolve several content keys in one round-trip (`POST /api/personalization/resolve-batch`).
+   * `opts.fallback` as in {@link resolve}.
+   */
+  async resolveBatch(items, opts) {
+    return orFallback(() => this.api.resolveBatch(items, this.withVisitor(opts)), opts);
+  }
+  /**
+   * Merge the ambient `config.context` and `opts.identity`/`opts.context` into
+   * the resolve `data`, then stamp the SDK-owned visitor id
+   * (`config.visitorId`) under both the reserved `_xenia_vid` key (read by the
+   * backend for holdout/exposure bucketing) and the flat `visitorId` field —
+   * mirrors `webhook()`'s merge order/precedence exactly: caller `data` <
+   * ambient `config.context` < caller `context`/`identity` < SDK-owned
+   * `visitorId`/`_xenia_vid`, set LAST so neither can be overridden per call.
+   *
+   * `config.context` is what makes the SDK-provided fields automatic on the
+   * server: bound once per request, every `resolve()` carries `path`/`query`/
+   * `url`/`referrer`/UTMs with no per-call wiring, matching what the browser
+   * client collects from `window` on its own. A no-op when nothing is bound and
+   * nothing was passed — preserving today's behavior for callers using neither.
+   */
+  withVisitor(opts) {
+    const identity = compact({
+      ...opts?.identity,
+      visitorId: this.visitorId ?? opts?.identity?.visitorId
+    });
+    const merged = {
+      ...compact(this.context ?? {}),
+      ...compact(opts?.context ?? {}),
+      ...identity
+    };
+    if (Object.keys(merged).length === 0 && !this.visitorId) return opts;
+    if (this.visitorId) merged._xenia_vid = this.visitorId;
+    return { ...opts, data: { ...opts?.data ?? {}, ...merged } };
+  }
+};
+function createXeniaServer(config) {
+  return new XeniaServer(config);
+}
+
+// src/server/cookies.ts
+function parseCookies(header) {
+  const out = {};
+  if (!header) return out;
+  for (const part of header.split(";")) {
+    const idx = part.indexOf("=");
+    if (idx === -1) continue;
+    const key = part.slice(0, idx).trim();
+    const value = part.slice(idx + 1).trim();
+    if (key) out[key] = decodeURIComponent(value);
+  }
+  return out;
+}
+function getVisitorId(cookieHeader, prefix) {
+  return parseCookies(cookieHeader)[visitorCookieName(prefix)] ?? null;
+}
+function getConsent(cookieHeader, prefix) {
+  const raw = parseCookies(cookieHeader)[consentCookieName(prefix)];
+  if (!raw) return { analytics: false, marketing: false, personalization: false };
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed;
+  } catch {
+    const scopes = new Set(raw.split(",").map((s) => s.trim()));
+    return {
+      analytics: scopes.has("analytics"),
+      marketing: scopes.has("marketing"),
+      personalization: scopes.has("personalization")
+    };
+  }
+}
+
+export { XeniaServer, createXeniaServer, getConsent, getVisitorId, parseCookies };
+//# sourceMappingURL=chunk-WYAMPEVV.js.map
+//# sourceMappingURL=chunk-WYAMPEVV.js.map

package/dist/chunk-WYAMPEVV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/event-payload.ts","../src/server/xenia-server.ts","../src/server/cookies.ts"],"names":["compact"],"mappings":";;;AAGA,IAAM,QAAA,uBAAe,GAAA,CAAI;AAAA,EACvB,SAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,aAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAC,CAAA;AAaD,SAASA,SAAQ,GAAA,EAAuE;AACtF,EAAA,MAAM,MAAiC,EAAC;AACxC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AACxC,IAAA,IAAI,CAAA,KAAM,MAAA,EAAW,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EAChC;AACA,EAAA,OAAO,GAAA;AACT;AAWO,SAAS,kBAAkB,KAAA,EAAsC;AACtE,EAAA,MAAM,cAAyC,EAAC;AAChD,EAAA,MAAM,WAAsC,EAAC;AAC7C,EAAA,IAAI,MAAM,KAAA,EAAO;AACf,IAAA,KAAA,MAAW,CAAC,GAAG,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,KAAK,CAAA,EAAG;AAChD,MAAA,IAAI,MAAM,MAAA,EAAW;AAKrB,MAAA,IAAI,SAAS,GAAA,CAAI,CAAC,CAAA,EAAG,QAAA,CAAS,CAAC,CAAA,GAAI,CAAA;AAAA,WAC9B,WAAA,CAAY,CAAC,CAAA,GAAI,CAAA;AAAA,IACxB;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,GAAG,WAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAKH,GAAG,QAAA;AAAA,IACH,GAAGA,QAAAA,CAAS,KAAA,CAAM,OAAA,IAAW,EAA4C,CAAA;AAAA,IACzE,GAAGA,QAAAA,CAAS,KAAA,CAAM,QAAA,IAAY,EAA4C,CAAA;AAAA,IAC1E,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,GAAI,MAAM,SAAA,GAAY,EAAE,WAAW,KAAA,CAAM,SAAA,KAAc,EAAC;AAAA,IACxD,GAAI,MAAM,SAAA,GAAY,EAAE,WAAW,KAAA,CAAM,SAAA,KAAc;AAAC,GAC1D;AAEA,EAAA,OAAO,OAAA;AACT;;;AC3BA,eAAe,UAAA,CAAiB,MAAwB,IAAA,EAAwC;AAC9F,EAAA,IAAI,CAAC,IAAA,IAAQ,EAAE,UAAA,IAAc,IAAA,CAAA,SAAc,IAAA,EAAK;AAChD,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,IAAA,EAAK;AAAA,EACpB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA,CAAK,QAAA;AAAA,EACd;AACF;AA8BO,IAAM,cAAN,MAAkB;AAAA,EACd,GAAA;AAAA;AAAA,EAEA,SAAA;AAAA;AAAA,EAEQ,OAAA;AAAA,EAEjB,YAAY,MAAA,EAAqB;AAC/B,IAAA,IAAA,CAAK,GAAA,GAAM,IAAI,QAAA,CAAS,MAAM,CAAA;AAC9B,IAAA,IAAA,CAAK,YAAY,MAAA,CAAO,SAAA;AACxB,IAAA,IAAA,CAAK,UAAU,MAAA,CAAO,OAAA;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,CACJ,SAAA,EACA,IAAA,GAA2B,EAAC,EACM;AAClC,IAAA,MAAM,KAAA,GAAoB;AAAA,MACxB,SAAA;AAAA,MACA,SAAS,IAAA,CAAK,OAAA,GAAU,UAAU,IAAA,CAAK,OAAO,IAAI,YAAA,EAAa;AAAA,MAC/D,YAAA,EAAc,KAAK,YAAA,IAAgB,CAAA;AAAA,MACnC,YAAA,EAAc,IAAA,CAAK,YAAA,IAAgB,IAAA,CAAK,GAAA,EAAI;AAAA,MAC5C,MAAA,EAAQ,KAAK,MAAA,IAAU,kBAAA;AAAA,MACvB,QAAA,EAAU;AAAA,QACR,GAAG,IAAA,CAAK,QAAA;AAAA;AAAA;AAAA,QAGR,gBAAgB,IAAA,CAAK;AAAA,OACvB;AAAA,MACA,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,OAAA,EAAS,IAAA,CAAK,OAAA,KAAY,IAAA,GAAO,IAAA,GAAO;AAAA,KAC1C;AACA,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,UAAA,CAAW,CAAC,KAAK,CAAC,CAAA;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,OAAA,CACJ,SAAA,EACA,IAAA,EACA,IAAA,GAAgC,EAAC,EACH;AAC9B,IAAA,MAAM,UAAU,iBAAA,CAAkB;AAAA,MAChC,OAAA,EAAS,SAAA;AAAA,MACT,WAAW,IAAA,CAAK,SAAA;AAAA;AAAA;AAAA;AAAA,MAIhB,QAAA,EAAU,EAAE,GAAG,IAAA,CAAK,QAAA,EAAU,WAAW,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,QAAA,EAAU,SAAA,EAAU;AAAA;AAAA;AAAA,MAGpF,SAAS,EAAE,GAAG,KAAK,OAAA,EAAS,GAAG,KAAK,OAAA,EAAQ;AAAA,MAC5C,KAAA,EAAO;AAAA,KACR,CAAA;AACD,IAAA,OAAO,UAAA,CAAW,MAAM,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ,SAAA,EAAW,OAAA,EAAsB,IAAA,CAAK,MAAA,IAAU,MAAM,CAAA,EAAG,IAAI,CAAA;AAAA,EACxG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,SACJ,IAAA,EAC2B;AAC3B,IAAA,MAAM,cAAA,GAAiB,IAAA,CAAK,cAAA,IAAkB,IAAA,CAAK,SAAA;AACnD,IAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,MAAA,MAAM,IAAI,MAAM,0EAA0E,CAAA;AAAA,IAC5F;AACA,IAAA,OAAO,KAAK,GAAA,CAAI,QAAA,CAAS,EAAE,GAAG,IAAA,EAAM,gBAAgB,CAAA;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,OAAA,CAAmB,UAAA,EAAoB,IAAA,EAA4D;AACvG,IAAA,OAAO,UAAA,CAAW,MAAM,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ,UAAA,EAAY,IAAA,CAAK,WAAA,CAAY,IAAI,CAAC,CAAA,EAAG,IAAI,CAAA;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,YAAA,CACJ,KAAA,EACA,IAAA,EACmC;AACnC,IAAA,OAAO,UAAA,CAAW,MAAM,IAAA,CAAK,GAAA,CAAI,YAAA,CAAa,KAAA,EAAO,IAAA,CAAK,WAAA,CAAY,IAAI,CAAC,CAAA,EAAG,IAAI,CAAA;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBQ,YAAY,IAAA,EAAmD;AACrE,IAAA,MAAM,WAAW,OAAA,CAAQ;AAAA,MACvB,GAAG,IAAA,EAAM,QAAA;AAAA,MACT,SAAA,EAAW,IAAA,CAAK,SAAA,IAAa,IAAA,EAAM,QAAA,EAAU;AAAA,KAC9C,CAAA;AACD,IAAA,MAAM,MAAA,GAAS;AAAA,MACb,GAAG,OAAA,CAAS,IAAA,CAAK,OAAA,IAAW,EAA4C,CAAA;AAAA,MACxE,GAAG,OAAA,CAAS,IAAA,EAAM,OAAA,IAAW,EAA4C,CAAA;AAAA,MACzE,GAAG;AAAA,KACL;AACA,IAAA,IAAI,MAAA,CAAO,KAAK,MAAM,CAAA,CAAE,WAAW,CAAA,IAAK,CAAC,IAAA,CAAK,SAAA,EAAW,OAAO,IAAA;AAChE,IAAA,IAAI,IAAA,CAAK,SAAA,EAAW,MAAA,CAAO,UAAA,GAAa,IAAA,CAAK,SAAA;AAC7C,IAAA,OAAO,EAAE,GAAG,IAAA,EAAM,IAAA,EAAM,EAAE,GAAI,IAAA,EAAM,IAAA,IAAQ,EAAC,EAAI,GAAG,MAAA,EAAO,EAAE;AAAA,EAC/D;AACF;AAGO,SAAS,kBAAkB,MAAA,EAAkC;AAClE,EAAA,OAAO,IAAI,YAAY,MAAM,CAAA;AAC/B;;;ACxNO,SAAS,aAAa,MAAA,EAA2D;AACtF,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,IAAI,CAAC,QAAQ,OAAO,GAAA;AACpB,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAAG;AACpC,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC5B,IAAA,IAAI,QAAQ,EAAA,EAAI;AAChB,IAAA,MAAM,MAAM,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,GAAG,EAAE,IAAA,EAAK;AACpC,IAAA,MAAM,QAAQ,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,CAAC,EAAE,IAAA,EAAK;AACvC,IAAA,IAAI,GAAA,EAAK,GAAA,CAAI,GAAG,CAAA,GAAI,mBAAmB,KAAK,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,GAAA;AACT;AASO,SAAS,YAAA,CACd,cACA,MAAA,EACe;AACf,EAAA,OAAO,aAAa,YAAY,CAAA,CAAE,iBAAA,CAAkB,MAAM,CAAC,CAAA,IAAK,IAAA;AAClE;AAQO,SAAS,UAAA,CACd,cACA,MAAA,EACc;AACd,EAAA,MAAM,MAAM,YAAA,CAAa,YAAY,CAAA,CAAE,iBAAA,CAAkB,MAAM,CAAC,CAAA;AAChE,EAAA,IAAI,CAAC,KAAK,OAAO,EAAE,WAAW,KAAA,EAAO,SAAA,EAAW,KAAA,EAAO,eAAA,EAAiB,KAAA,EAAM;AAC9E,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AAC1D,IAAA,OAAO;AAAA,MACL,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,WAAW,CAAA;AAAA,MACjC,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,WAAW,CAAA;AAAA,MACjC,eAAA,EAAiB,MAAA,CAAO,GAAA,CAAI,iBAAiB;AAAA,KAC/C;AAAA,EACF;AACF","file":"chunk-WYAMPEVV.js","sourcesContent":["import type { EventContext, EventIdentity, EventPayload, JsonValue } from \"./types\";\n\n/** Reserved keys that map to first-class fields (not passthrough data). */\nconst RESERVED = new Set([\n  \"eventId\",\n  \"eventType\",\n  \"journeyId\",\n  \"deviceId\",\n  \"visitorId\",\n  \"customerId\",\n  \"email\",\n  \"utmSource\",\n  \"utmMedium\",\n  \"utmCampaign\",\n  \"utmContent\",\n  \"utmId\",\n  \"url\",\n  \"referrer\",\n  \"path\",\n  \"query\",\n]);\n\nexport interface BuildEventInput {\n  eventId: string;\n  eventType?: string;\n  journeyId?: string;\n  identity?: EventIdentity;\n  context?: EventContext;\n  /** Arbitrary extra properties merged as passthrough data. */\n  props?: Record<string, JsonValue | undefined>;\n}\n\n/** Drop `undefined` values so the JSON body stays clean. */\nfunction compact(obj: Record<string, JsonValue | undefined>): Record<string, JsonValue> {\n  const out: Record<string, JsonValue> = {};\n  for (const [k, v] of Object.entries(obj)) {\n    if (v !== undefined) out[k] = v;\n  }\n  return out;\n}\n\n/**\n * Build the request body for the webhook `/flow` call (`XeniaApi.webhook`).\n *\n * Merge order (later wins): passthrough props < context < identity < core.\n * Field names match the backend `EventTriggerRequest` DTO exactly.\n *\n * @internal Used only by the webhook request/response path — the unified event\n * surface (`track()` → `POST /api/events/v1`) builds {@link XeniaEvent} instead.\n */\nexport function buildEventPayload(input: BuildEventInput): EventPayload {\n  const passthrough: Record<string, JsonValue> = {};\n  const reserved: Record<string, JsonValue> = {};\n  if (input.props) {\n    for (const [k, v] of Object.entries(input.props)) {\n      if (v === undefined) continue;\n      // A prop whose key matches a reserved field (e.g. `email`, `customerId`,\n      // `utmSource`) is promoted to that first-class field; everything else is\n      // custom passthrough data. Previously reserved-named props were dropped\n      // outright — so `track(\"sign_up\", { email })` never sent `email` at all.\n      if (RESERVED.has(k)) reserved[k] = v;\n      else passthrough[k] = v;\n    }\n  }\n\n  const payload = {\n    ...passthrough,\n    // Reserved-named props fill first-class fields (e.g. `email`, `customerId`)\n    // the SDK didn't auto-collect. Auto-collected context/identity still win for\n    // what they reliably know (real page url, visitor/device id), so a stray prop\n    // can't override the true page context — see merge order below.\n    ...reserved,\n    ...compact((input.context ?? {}) as Record<string, JsonValue | undefined>),\n    ...compact((input.identity ?? {}) as Record<string, JsonValue | undefined>),\n    eventId: input.eventId,\n    ...(input.eventType ? { eventType: input.eventType } : {}),\n    ...(input.journeyId ? { journeyId: input.journeyId } : {}),\n  };\n\n  return payload as EventPayload;\n}\n","import { compact, XeniaApi } from \"../core/api\";\nimport { buildEventPayload } from \"../core/event-payload\";\nimport { generateUlid, toEventId } from \"../core/id\";\nimport type {\n  AnalyticsContext,\n  AnalyticsEventName,\n  CallerIdentity,\n  AnalyticsIngestResponse,\n  ConsentState,\n  EventContext,\n  EventIdentity,\n  IdentifyRequest,\n  IdentifyResponse,\n  JsonValue,\n  ResolveBatchItem,\n  ResolveBatchResult,\n  ResolveOptions,\n  ResolveResult,\n  WebhookResponse,\n  XeniaConfig,\n  XeniaEvent,\n} from \"../core/types\";\n\n/**\n * Extra per-call identity/context for server-side webhook calls — an override on top of whatever the\n * client already carries.\n *\n * There's no ambient `window` on the server to auto-collect `path`/`query`/`url`/UTM params the way\n * the browser client does, so bind them ONCE per request via {@link XeniaConfig.context} (see\n * `contextFromUrl`) and every call attaches them automatically. These per-call fields are for the\n * remainder: values known only at this call site, or a deliberate override of the ambient ones.\n */\nexport interface ServerWebhookOptions<F = never> extends WithFallback<F> {\n  method?: \"GET\" | \"POST\";\n  journeyId?: string;\n  identity?: EventIdentity;\n  context?: EventContext;\n}\n\n/**\n * Opt-in \"never throw\" for calls a page renders from. When `fallback` is set (even to `null`), any\n * failure (timeout, network error, non-2xx, open circuit) resolves to it instead of throwing, so a\n * caller can render its default content without a `try/catch`. Errors are swallowed silently: leave\n * it unset where you need to see them.\n */\nexport interface WithFallback<F> {\n  fallback?: F;\n}\n\n/** {@link ResolveOptions} plus {@link WithFallback}. */\nexport type ServerResolveOptions<F = never> = ResolveOptions & WithFallback<F>;\n\n/** Runs `call`, or resolves to `opts.fallback` on any error when one was given. */\nasync function orFallback<T, F>(call: () => Promise<T>, opts?: WithFallback<F>): Promise<T | F> {\n  if (!opts || !(\"fallback\" in opts)) return call();\n  try {\n    return await call();\n  } catch {\n    return opts.fallback as F;\n  }\n}\n\n/**\n * Options for a server-side unified event (`POST /api/events/v1`). There's no\n * ambient request context on the server — pass whatever's known at the call\n * site (e.g. pathname/user-agent from the current request, session id from a\n * cookie) via `identity`/`context`.\n */\nexport interface ServerTrackOptions {\n  /** When true, also match/advance a journey (never sampled/shed). Default false. */\n  trigger?: boolean;\n  /** Stable dedup key (e.g. `\"ord-1001\"`) for idempotent conversions. */\n  eventId?: string;\n  eventVersion?: number;\n  occurredAtMs?: number;\n  /** Origin tag. Default `\"xenia-server-sdk\"`. */\n  source?: string;\n  /** Identity fields for this event (except the SDK-owned `xeniaVisitorId`,\n   *  which comes from `config.visitorId` and can't be set per call). */\n  identity?: CallerIdentity;\n  context?: AnalyticsContext;\n  properties?: Record<string, JsonValue | undefined>;\n  consent?: ConsentState;\n}\n\n/**\n * Server-native Xenia client. Same method names as the browser client, but\n * every call is stateless: identity and context are passed explicitly rather\n * than read from the DOM/localStorage. Uses global `fetch` (Node ≥18).\n */\nexport class XeniaServer {\n  readonly api: XeniaApi;\n  /** SDK-owned visitor anchor for this (per-request) client — see {@link XeniaConfig.visitorId}. */\n  readonly visitorId?: string;\n  /** Ambient request context attached to every call — see {@link XeniaConfig.context}. */\n  private readonly context?: EventContext;\n\n  constructor(config: XeniaConfig) {\n    this.api = new XeniaApi(config);\n    this.visitorId = config.visitorId;\n    this.context = config.context;\n  }\n\n  /**\n   * Send a unified event server-side (`POST /api/events/v1`) and return the\n   * ingest response (including per-result `triggered`). `opts.trigger: true`\n   * also matches/advances a journey; pass `opts.eventId` (e.g. `\"ord-1001\"`)\n   * as a stable dedup key for idempotent conversions.\n   */\n  async track(\n    eventName: AnalyticsEventName,\n    opts: ServerTrackOptions = {},\n  ): Promise<AnalyticsIngestResponse> {\n    const event: XeniaEvent = {\n      eventName,\n      eventId: opts.eventId ? toEventId(opts.eventId) : generateUlid(),\n      eventVersion: opts.eventVersion ?? 1,\n      occurredAtMs: opts.occurredAtMs ?? Date.now(),\n      source: opts.source ?? \"xenia-server-sdk\",\n      identity: {\n        ...opts.identity,\n        // SDK-owned, set LAST so it can't be overridden per call. Comes from\n        // `config.visitorId` (bind it per request from the `xenia_vid` cookie).\n        xeniaVisitorId: this.visitorId,\n      },\n      context: opts.context,\n      properties: opts.properties,\n      consent: opts.consent,\n      trigger: opts.trigger === true ? true : undefined,\n    };\n    return this.api.sendEvents([event]);\n  }\n\n  /**\n   * Send a webhook request and await the synchronous response. Merges\n   * `opts.identity`/`opts.context` into the payload the same way the browser\n   * client's auto-attached fields do (`path`, `query`, `url`, `referrer`,\n   * `deviceId`, `visitorId`, etc.) — see `ServerWebhookOptions`. Pass `opts.fallback` to get it\n   * back instead of an error (see {@link WithFallback}).\n   */\n  async webhook<F = never>(\n    triggerId: string,\n    data?: Record<string, JsonValue | undefined>,\n    opts: ServerWebhookOptions<F> = {},\n  ): Promise<WebhookResponse | F> {\n    const payload = buildEventPayload({\n      eventId: triggerId,\n      journeyId: opts.journeyId,\n      // SDK-owned visitor anchor wins: config.visitorId (bind the `xenia_vid`\n      // cookie per request) is attached automatically. Falls back to a\n      // per-call visitorId only when none is bound.\n      identity: { ...opts.identity, visitorId: this.visitorId ?? opts.identity?.visitorId },\n      // Ambient request context (config.context, bound once per request) under a per-call\n      // override — same precedence resolve() uses, so both surfaces carry the same fields.\n      context: { ...this.context, ...opts.context },\n      props: data,\n    });\n    return orFallback(() => this.api.webhook(triggerId, payload as JsonValue, opts.method ?? \"POST\"), opts);\n  }\n\n  /**\n   * Bind visitor→user server-side — `POST /api/events/v1/identify`. `xeniaVisitorId` defaults to\n   * the bound `config.visitorId`, so a per-request client only passes what it learned (e.g. an email\n   * from a submitted form).\n   */\n  async identify(\n    body: Omit<IdentifyRequest, \"xeniaVisitorId\"> & { xeniaVisitorId?: string },\n  ): Promise<IdentifyResponse> {\n    const xeniaVisitorId = body.xeniaVisitorId ?? this.visitorId;\n    if (!xeniaVisitorId) {\n      throw new Error(\"identify() needs a visitor: bind config.visitorId or pass xeniaVisitorId\");\n    }\n    return this.api.identify({ ...body, xeniaVisitorId });\n  }\n\n  /**\n   * Resolve in-entry content personalization for one content key\n   * (`POST /api/personalization/resolve`). Requires a configured SDK token\n   * (`token`/`getToken`) — resolve is auth-required. With `merge: true` the\n   * returned `content` is server-spliced.\n   *\n   * Pass `opts.identity`/`opts.context` to attach the same SDK-provided\n   * fields (`deviceId`, `customerId`, `email`, `path`, `url`, `referrer`,\n   * `utm*`, …) the browser client collects ambiently — there's no ambient\n   * `window`/`document` server-side, so a server caller must supply whatever\n   * it knows (e.g. from the current request) explicitly. See\n   * {@link ResolveOptions}. Pass `opts.fallback` to get it back instead of an\n   * error (see {@link WithFallback}).\n   */\n  async resolve<F = never>(contentKey: string, opts?: ServerResolveOptions<F>): Promise<ResolveResult | F> {\n    return orFallback(() => this.api.resolve(contentKey, this.withVisitor(opts)), opts);\n  }\n\n  /**\n   * Resolve several content keys in one round-trip (`POST /api/personalization/resolve-batch`).\n   * `opts.fallback` as in {@link resolve}.\n   */\n  async resolveBatch<F = never>(\n    items: ResolveBatchItem[],\n    opts?: ServerResolveOptions<F>,\n  ): Promise<ResolveBatchResult[] | F> {\n    return orFallback(() => this.api.resolveBatch(items, this.withVisitor(opts)), opts);\n  }\n\n  /**\n   * Merge the ambient `config.context` and `opts.identity`/`opts.context` into\n   * the resolve `data`, then stamp the SDK-owned visitor id\n   * (`config.visitorId`) under both the reserved `_xenia_vid` key (read by the\n   * backend for holdout/exposure bucketing) and the flat `visitorId` field —\n   * mirrors `webhook()`'s merge order/precedence exactly: caller `data` <\n   * ambient `config.context` < caller `context`/`identity` < SDK-owned\n   * `visitorId`/`_xenia_vid`, set LAST so neither can be overridden per call.\n   *\n   * `config.context` is what makes the SDK-provided fields automatic on the\n   * server: bound once per request, every `resolve()` carries `path`/`query`/\n   * `url`/`referrer`/UTMs with no per-call wiring, matching what the browser\n   * client collects from `window` on its own. A no-op when nothing is bound and\n   * nothing was passed — preserving today's behavior for callers using neither.\n   */\n  private withVisitor(opts?: ResolveOptions): ResolveOptions | undefined {\n    const identity = compact({\n      ...opts?.identity,\n      visitorId: this.visitorId ?? opts?.identity?.visitorId,\n    });\n    const merged = {\n      ...compact((this.context ?? {}) as Record<string, JsonValue | undefined>),\n      ...compact((opts?.context ?? {}) as Record<string, JsonValue | undefined>),\n      ...identity,\n    };\n    if (Object.keys(merged).length === 0 && !this.visitorId) return opts;\n    if (this.visitorId) merged._xenia_vid = this.visitorId;\n    return { ...opts, data: { ...(opts?.data ?? {}), ...merged } };\n  }\n}\n\n/** Create a server-native client. */\nexport function createXeniaServer(config: XeniaConfig): XeniaServer {\n  return new XeniaServer(config);\n}\n","import {\n  CONSENT_COOKIE,\n  VISITOR_COOKIE,\n  consentCookie,\n  consentCookieName,\n  visitorCookieName,\n} from \"../core/cookie-names\";\nimport type { ConsentState } from \"../core/types\";\n\n/**\n * Cookie names the SDK reads server-side (set by the browser SDK / your app).\n *\n * The constants are the DEFAULT-prefix names; the functions build the name for any prefix. If you\n * pass `config.prefix` to the browser client, pass the same prefix here — the browser namespaces\n * the cookie by it, so the default name won't be there to find.\n */\nexport { CONSENT_COOKIE, VISITOR_COOKIE, consentCookie, consentCookieName, visitorCookieName };\n\n/**\n * Parse a raw `Cookie` header into a map. Framework-agnostic so it works with\n * `Request.headers.get(\"cookie\")`, Node `req.headers.cookie`, etc.\n */\nexport function parseCookies(header: string | null | undefined): Record<string, string> {\n  const out: Record<string, string> = {};\n  if (!header) return out;\n  for (const part of header.split(\";\")) {\n    const idx = part.indexOf(\"=\");\n    if (idx === -1) continue;\n    const key = part.slice(0, idx).trim();\n    const value = part.slice(idx + 1).trim();\n    if (key) out[key] = decodeURIComponent(value);\n  }\n  return out;\n}\n\n/**\n * Read the visitor id the browser SDK wrote, so a server-side event can be bound to the same\n * visitor (`createXeniaServer({ visitorId })`) and attribute to a browser-entered journey.\n *\n * @param prefix Must match the browser client's `config.prefix`. The cookie is namespaced by it, so\n *               a mismatch finds nothing and quietly leaves the server with no visitor.\n */\nexport function getVisitorId(\n  cookieHeader: string | null | undefined,\n  prefix?: string,\n): string | null {\n  return parseCookies(cookieHeader)[visitorCookieName(prefix)] ?? null;\n}\n\n/**\n * Read consent from a cookie header. Accepts a JSON blob or a comma-list of\n * granted scopes (e.g. `analytics,personalization`). Absent → all denied.\n *\n * @param prefix Must match the browser client's `config.prefix` — see {@link getVisitorId}.\n */\nexport function getConsent(\n  cookieHeader: string | null | undefined,\n  prefix?: string,\n): ConsentState {\n  const raw = parseCookies(cookieHeader)[consentCookieName(prefix)];\n  if (!raw) return { analytics: false, marketing: false, personalization: false };\n  try {\n    const parsed = JSON.parse(raw) as ConsentState;\n    return parsed;\n  } catch {\n    const scopes = new Set(raw.split(\",\").map((s) => s.trim()));\n    return {\n      analytics: scopes.has(\"analytics\"),\n      marketing: scopes.has(\"marketing\"),\n      personalization: scopes.has(\"personalization\"),\n    };\n  }\n}\n"]}