@xenia-martech/sdk-js 1.2.0-dev.2 → 1.2.0-dev.4

package/dist/chunk-BQ5PJCZ7.js

@@ -0,0 +1,179 @@
+// src/core/http-client.ts
+var DEFAULT_BASE_URL = "https://engine.xeniamartech.com/xenia";
+function isBrowser() {
+  return typeof window !== "undefined" && typeof document !== "undefined";
+}
+function buildUrl(url, queryParams) {
+  if (!queryParams || Object.keys(queryParams).length === 0) return url;
+  const params = new URLSearchParams(queryParams);
+  const sep = url.includes("?") ? "&" : "?";
+  return `${url}${sep}${params.toString()}`;
+}
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+var HttpError = class extends Error {
+  constructor(status, data, message) {
+    super(message ?? `Request failed with status ${status}`);
+    this.status = status;
+    this.data = data;
+    this.name = "HttpError";
+  }
+  status;
+  data;
+};
+var CircuitOpenError = class extends Error {
+  constructor(endpoint) {
+    super(`Circuit open for ${endpoint}: failing fast until the cooldown passes`);
+    this.endpoint = endpoint;
+    this.name = "CircuitOpenError";
+  }
+  endpoint;
+};
+var breakers = /* @__PURE__ */ new Map();
+var HttpClient = class {
+  baseUrl;
+  defaultHeaders;
+  timeout;
+  retry;
+  debug;
+  breaker;
+  constructor(opts) {
+    this.baseUrl = (opts.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+    this.defaultHeaders = opts.defaultHeaders ?? {};
+    this.timeout = opts.timeout ?? 8e3;
+    this.retry = {
+      attempts: opts.retry?.attempts ?? 2,
+      baseDelayMs: opts.retry?.baseDelayMs ?? 300
+    };
+    this.debug = opts.debug ?? false;
+    const cb = opts.circuitBreaker === true ? {} : opts.circuitBreaker || null;
+    this.breaker = cb && { failureThreshold: cb.failureThreshold ?? 3, cooldownMs: cb.cooldownMs ?? 3e4 };
+  }
+  async request(opts) {
+    if (!this.breaker) return this.send(opts);
+    const key = buildUrl(this.baseUrl + opts.path, opts.query);
+    const b = breakers.get(key) ?? { failures: 0, openedAt: 0 };
+    if (b.openedAt) {
+      if (Date.now() - b.openedAt < this.breaker.cooldownMs) throw new CircuitOpenError(key);
+      b.openedAt = 0;
+      b.failures = this.breaker.failureThreshold - 1;
+    }
+    try {
+      const result = await this.send(opts);
+      breakers.delete(key);
+      return result;
+    } catch (err) {
+      if (err instanceof HttpError && !this.isRetryableStatus(err.status)) {
+        breakers.delete(key);
+        throw err;
+      }
+      b.failures += 1;
+      if (b.failures >= this.breaker.failureThreshold) {
+        b.openedAt = Date.now();
+        this.log(`circuit opened for ${opts.path} after ${b.failures} failures`);
+      }
+      breakers.set(key, b);
+      throw err;
+    }
+  }
+  async send(opts) {
+    const url = buildUrl(this.baseUrl + opts.path, opts.query);
+    const method = opts.method ?? "GET";
+    const headers = {
+      "Content-Type": "application/json",
+      ...this.defaultHeaders,
+      ...opts.headers
+    };
+    const body = opts.body !== void 0 ? JSON.stringify(opts.body) : void 0;
+    const timeout = opts.timeout ?? this.timeout;
+    const maxAttempts = opts.noRetry ? 1 : (opts.retry?.attempts ?? this.retry.attempts) + 1;
+    const baseDelay = opts.retry?.baseDelayMs ?? this.retry.baseDelayMs;
+    let lastError;
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+      try {
+        const response = await this.fetchWithTimeout(
+          url,
+          { method, headers, body, ...opts.keepalive ? { keepalive: true } : {} },
+          timeout
+        );
+        const data = await this.parseBody(response);
+        if (response.ok) {
+          return { response, data };
+        }
+        if (this.isRetryableStatus(response.status) && attempt < maxAttempts - 1) {
+          const wait = this.retryAfterMs(response, baseDelay, attempt);
+          this.log(`retrying ${opts.path} after ${wait}ms (status ${response.status})`);
+          await delay(wait);
+          continue;
+        }
+        throw new HttpError(response.status, data);
+      } catch (err) {
+        lastError = err;
+        if (err instanceof HttpError) throw err;
+        if (attempt < maxAttempts - 1) {
+          const wait = baseDelay * 2 ** attempt;
+          this.log(`retrying ${opts.path} after ${wait}ms (network error)`);
+          await delay(wait);
+          continue;
+        }
+      }
+    }
+    throw lastError instanceof Error ? lastError : new Error("Request failed");
+  }
+  async fetchWithTimeout(url, init, timeout) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeout);
+    try {
+      return await fetch(url, { ...init, signal: controller.signal });
+    } catch (err) {
+      if (err instanceof Error && err.name === "AbortError") {
+        throw new Error(`Request timeout after ${timeout}ms`, { cause: err });
+      }
+      throw err;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  async parseBody(response) {
+    const text = await response.text().catch(() => "");
+    if (!text) return null;
+    try {
+      return JSON.parse(text);
+    } catch {
+      return text;
+    }
+  }
+  isRetryableStatus(status) {
+    return status === 429 || status >= 500 && status <= 599;
+  }
+  retryAfterMs(response, baseDelay, attempt) {
+    const header = response.headers.get("Retry-After");
+    if (header) {
+      const seconds = Number(header);
+      if (!Number.isNaN(seconds)) return seconds * 1e3;
+    }
+    return baseDelay * 2 ** attempt;
+  }
+  log(msg) {
+    if (this.debug) console.warn(`[xenia] ${msg}`);
+  }
+};
+
+// src/core/cookie-names.ts
+var DEFAULT_PREFIX = "xenia";
+function visitorCookieName(prefix = DEFAULT_PREFIX) {
+  return `${prefix || DEFAULT_PREFIX}_vid`;
+}
+function consentCookieName(prefix = DEFAULT_PREFIX) {
+  return `${prefix || DEFAULT_PREFIX}_consent`;
+}
+var VISITOR_COOKIE = visitorCookieName();
+var CONSENT_COOKIE = consentCookieName();
+function consentCookie(state, prefix, maxAgeDays = 365) {
+  return `${consentCookieName(prefix)}=${encodeURIComponent(JSON.stringify(state))}; path=/; max-age=${Math.floor(maxAgeDays * 86400)}; SameSite=Lax`;
+}
+
+export { CONSENT_COOKIE, CircuitOpenError, DEFAULT_BASE_URL, DEFAULT_PREFIX, HttpClient, HttpError, VISITOR_COOKIE, buildUrl, consentCookie, consentCookieName, isBrowser, visitorCookieName };
+//# sourceMappingURL=chunk-BQ5PJCZ7.js.map
+//# sourceMappingURL=chunk-BQ5PJCZ7.js.map

package/dist/chunk-BQ5PJCZ7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/http-client.ts","../src/core/cookie-names.ts"],"names":[],"mappings":";AAOO,IAAM,gBAAA,GAAmB;AAGzB,SAAS,SAAA,GAAqB;AACnC,EAAA,OAAO,OAAO,MAAA,KAAW,WAAA,IAAe,OAAO,QAAA,KAAa,WAAA;AAC9D;AAGO,SAAS,QAAA,CAAS,KAAa,WAAA,EAA8C;AAClF,EAAA,IAAI,CAAC,eAAe,MAAA,CAAO,IAAA,CAAK,WAAW,CAAA,CAAE,MAAA,KAAW,GAAG,OAAO,GAAA;AAClE,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,WAAW,CAAA;AAC9C,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,QAAA,CAAS,GAAG,IAAI,GAAA,GAAM,GAAA;AACtC,EAAA,OAAO,GAAG,GAAG,CAAA,EAAG,GAAG,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,CAAA;AACzC;AAGA,SAAS,MAAM,EAAA,EAA2B;AACxC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AACzD;AA+BO,IAAM,SAAA,GAAN,cAAwB,KAAA,CAAM;AAAA,EACnC,WAAA,CACkB,MAAA,EACA,IAAA,EAChB,OAAA,EACA;AACA,IAAA,KAAA,CAAM,OAAA,IAAW,CAAA,2BAAA,EAA8B,MAAM,CAAA,CAAE,CAAA;AAJvC,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAIhB,IAAA,IAAA,CAAK,IAAA,GAAO,WAAA;AAAA,EACd;AAAA,EANkB,MAAA;AAAA,EACA,IAAA;AAMpB;AAGO,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EAC1C,YAA4B,QAAA,EAAkB;AAC5C,IAAA,KAAA,CAAM,CAAA,iBAAA,EAAoB,QAAQ,CAAA,wCAAA,CAA0C,CAAA;AADlD,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAE1B,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AAAA,EACd;AAAA,EAH4B,QAAA;AAI9B;AAOA,IAAM,QAAA,uBAAe,GAAA,EAAoD;AAqBlE,IAAM,aAAN,MAAiB;AAAA,EACL,OAAA;AAAA,EACA,cAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,OAAA;AAAA,EAEjB,YAAY,IAAA,EAAyB;AACnC,IAAA,IAAA,CAAK,WAAW,IAAA,CAAK,OAAA,IAAW,gBAAA,EAAkB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AACpE,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAA,CAAK,cAAA,IAAkB,EAAC;AAC9C,IAAA,IAAA,CAAK,OAAA,GAAU,KAAK,OAAA,IAAW,GAAA;AAC/B,IAAA,IAAA,CAAK,KAAA,GAAQ;AAAA,MACX,QAAA,EAAU,IAAA,CAAK,KAAA,EAAO,QAAA,IAAY,CAAA;AAAA,MAClC,WAAA,EAAa,IAAA,CAAK,KAAA,EAAO,WAAA,IAAe;AAAA,KAC1C;AACA,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAK,KAAA,IAAS,KAAA;AAC3B,IAAA,MAAM,KAAK,IAAA,CAAK,cAAA,KAAmB,OAAO,EAAC,GAAI,KAAK,cAAA,IAAkB,IAAA;AACtE,IAAA,IAAA,CAAK,OAAA,GAAU,EAAA,IAAM,EAAE,gBAAA,EAAkB,EAAA,CAAG,oBAAoB,CAAA,EAAG,UAAA,EAAY,EAAA,CAAG,UAAA,IAAc,GAAA,EAAO;AAAA,EACzG;AAAA,EAEA,MAAM,QAAQ,IAAA,EAA2C;AACvD,IAAA,IAAI,CAAC,IAAA,CAAK,OAAA,EAAS,OAAO,IAAA,CAAK,KAAK,IAAI,CAAA;AAGxC,IAAA,MAAM,MAAM,QAAA,CAAS,IAAA,CAAK,UAAU,IAAA,CAAK,IAAA,EAAM,KAAK,KAAK,CAAA;AACzD,IAAA,MAAM,CAAA,GAAI,SAAS,GAAA,CAAI,GAAG,KAAK,EAAE,QAAA,EAAU,CAAA,EAAG,QAAA,EAAU,CAAA,EAAE;AAC1D,IAAA,IAAI,EAAE,QAAA,EAAU;AACd,MAAA,IAAI,IAAA,CAAK,GAAA,EAAI,GAAI,CAAA,CAAE,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,UAAA,EAAY,MAAM,IAAI,gBAAA,CAAiB,GAAG,CAAA;AAErF,MAAA,CAAA,CAAE,QAAA,GAAW,CAAA;AACb,MAAA,CAAA,CAAE,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,gBAAA,GAAmB,CAAA;AAAA,IAC/C;AACA,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,IAAI,CAAA;AACnC,MAAA,QAAA,CAAS,OAAO,GAAG,CAAA;AACnB,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,eAAe,SAAA,IAAa,CAAC,KAAK,iBAAA,CAAkB,GAAA,CAAI,MAAM,CAAA,EAAG;AACnE,QAAA,QAAA,CAAS,OAAO,GAAG,CAAA;AACnB,QAAA,MAAM,GAAA;AAAA,MACR;AACA,MAAA,CAAA,CAAE,QAAA,IAAY,CAAA;AACd,MAAA,IAAI,CAAA,CAAE,QAAA,IAAY,IAAA,CAAK,OAAA,CAAQ,gBAAA,EAAkB;AAC/C,QAAA,CAAA,CAAE,QAAA,GAAW,KAAK,GAAA,EAAI;AACtB,QAAA,IAAA,CAAK,IAAI,CAAA,mBAAA,EAAsB,IAAA,CAAK,IAAI,CAAA,OAAA,EAAU,CAAA,CAAE,QAAQ,CAAA,SAAA,CAAW,CAAA;AAAA,MACzE;AACA,MAAA,QAAA,CAAS,GAAA,CAAI,KAAK,CAAC,CAAA;AACnB,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAc,KAAK,IAAA,EAA2C;AAC5D,IAAA,MAAM,MAAM,QAAA,CAAS,IAAA,CAAK,UAAU,IAAA,CAAK,IAAA,EAAM,KAAK,KAAK,CAAA;AACzD,IAAA,MAAM,MAAA,GAAS,KAAK,MAAA,IAAU,KAAA;AAC9B,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,cAAA,EAAgB,kBAAA;AAAA,MAChB,GAAG,IAAA,CAAK,cAAA;AAAA,MACR,GAAG,IAAA,CAAK;AAAA,KACV;AACA,IAAA,MAAM,IAAA,GAAO,KAAK,IAAA,KAAS,MAAA,GAAY,KAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,GAAI,MAAA;AACnE,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,IAAW,IAAA,CAAK,OAAA;AACrC,IAAA,MAAM,WAAA,GAAc,KAAK,OAAA,GAAU,CAAA,GAAA,CAAK,KAAK,KAAA,EAAO,QAAA,IAAY,IAAA,CAAK,KAAA,CAAM,QAAA,IAAY,CAAA;AACvF,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,EAAO,WAAA,IAAe,KAAK,KAAA,CAAM,WAAA;AAExD,IAAA,IAAI,SAAA;AACJ,IAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,GAAU,WAAA,EAAa,OAAA,EAAA,EAAW;AACtD,MAAA,IAAI;AACF,QAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,gBAAA;AAAA,UAC1B,GAAA;AAAA,UACA,EAAE,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,GAAI,IAAA,CAAK,SAAA,GAAY,EAAE,SAAA,EAAW,IAAA,EAAK,GAAI,EAAC,EAAG;AAAA,UACxE;AAAA,SACF;AACA,QAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAA;AAE1C,QAAA,IAAI,SAAS,EAAA,EAAI;AACf,UAAA,OAAO,EAAE,UAAU,IAAA,EAAK;AAAA,QAC1B;AAGA,QAAA,IAAI,KAAK,iBAAA,CAAkB,QAAA,CAAS,MAAM,CAAA,IAAK,OAAA,GAAU,cAAc,CAAA,EAAG;AACxE,UAAA,MAAM,IAAA,GAAO,IAAA,CAAK,YAAA,CAAa,QAAA,EAAU,WAAW,OAAO,CAAA;AAC3D,UAAA,IAAA,CAAK,GAAA,CAAI,YAAY,IAAA,CAAK,IAAI,UAAU,IAAI,CAAA,WAAA,EAAc,QAAA,CAAS,MAAM,CAAA,CAAA,CAAG,CAAA;AAC5E,UAAA,MAAM,MAAM,IAAI,CAAA;AAChB,UAAA;AAAA,QACF;AACA,QAAA,MAAM,IAAI,SAAA,CAAU,QAAA,CAAS,MAAA,EAAQ,IAAI,CAAA;AAAA,MAC3C,SAAS,GAAA,EAAK;AACZ,QAAA,SAAA,GAAY,GAAA;AAEZ,QAAA,IAAI,GAAA,YAAe,WAAW,MAAM,GAAA;AAEpC,QAAA,IAAI,OAAA,GAAU,cAAc,CAAA,EAAG;AAC7B,UAAA,MAAM,IAAA,GAAO,YAAY,CAAA,IAAK,OAAA;AAC9B,UAAA,IAAA,CAAK,IAAI,CAAA,SAAA,EAAY,IAAA,CAAK,IAAI,CAAA,OAAA,EAAU,IAAI,CAAA,kBAAA,CAAoB,CAAA;AAChE,UAAA,MAAM,MAAM,IAAI,CAAA;AAChB,UAAA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,IAAA,MAAM,SAAA,YAAqB,KAAA,GAAQ,SAAA,GAAY,IAAI,MAAM,gBAAgB,CAAA;AAAA,EAC3E;AAAA,EAEA,MAAc,gBAAA,CACZ,GAAA,EACA,IAAA,EACA,OAAA,EACmB;AACnB,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,OAAO,CAAA;AAC1D,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,MAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AAAA,IAChE,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAe,KAAA,IAAS,GAAA,CAAI,IAAA,KAAS,YAAA,EAAc;AACrD,QAAA,MAAM,IAAI,MAAM,CAAA,sBAAA,EAAyB,OAAO,MAAM,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,MACtE;AACA,MAAA,MAAM,GAAA;AAAA,IACR,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AAAA,EAEA,MAAc,UAAU,QAAA,EAAwC;AAC9D,IAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AACjD,IAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,IAAA,IAAI;AACF,MAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,IACxB,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,kBAAkB,MAAA,EAAyB;AACjD,IAAA,OAAO,MAAA,KAAW,GAAA,IAAQ,MAAA,IAAU,GAAA,IAAO,MAAA,IAAU,GAAA;AAAA,EACvD;AAAA,EAEQ,YAAA,CAAa,QAAA,EAAoB,SAAA,EAAmB,OAAA,EAAyB;AACnF,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AACjD,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,MAAM,OAAA,GAAU,OAAO,MAAM,CAAA;AAC7B,MAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,SAAU,OAAA,GAAU,GAAA;AAAA,IAC/C;AACA,IAAA,OAAO,YAAY,CAAA,IAAK,OAAA;AAAA,EAC1B;AAAA,EAEQ,IAAI,GAAA,EAAmB;AAC7B,IAAA,IAAI,KAAK,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,CAAA,QAAA,EAAW,GAAG,CAAA,CAAE,CAAA;AAAA,EAC/C;AACF;;;ACzOO,IAAM,cAAA,GAAiB;AAGvB,SAAS,iBAAA,CAAkB,SAAiB,cAAA,EAAwB;AACzE,EAAA,OAAO,CAAA,EAAG,UAAU,cAAc,CAAA,IAAA,CAAA;AACpC;AAGO,SAAS,iBAAA,CAAkB,SAAiB,cAAA,EAAwB;AACzE,EAAA,OAAO,CAAA,EAAG,UAAU,cAAc,CAAA,QAAA,CAAA;AACpC;AASO,IAAM,iBAAiB,iBAAA;AAMvB,IAAM,iBAAiB,iBAAA;AAOvB,SAAS,aAAA,CAAc,KAAA,EAAqB,MAAA,EAAiB,UAAA,GAAa,GAAA,EAAa;AAC5F,EAAA,OAAO,GAAG,iBAAA,CAAkB,MAAM,CAAC,CAAA,CAAA,EAAI,mBAAmB,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAC,CAAA,kBAAA,EAAqB,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,KAAK,CAAC,CAAA,cAAA,CAAA;AACrI","file":"chunk-BQ5PJCZ7.js","sourcesContent":["import type { CircuitBreakerConfig, HttpMethod, JsonValue, RetryConfig } from \"./types\";\n\n/**\n * Default Xenia backend base URL, used whenever `baseUrl` is omitted from\n * config. Points at the hosted engine — override only for a self-hosted or\n * non-default environment.\n */\nexport const DEFAULT_BASE_URL = \"https://engine.xeniamartech.com/xenia\";\n\n/** Returns true when running in a browser environment (SSR-safe). */\nexport function isBrowser(): boolean {\n  return typeof window !== \"undefined\" && typeof document !== \"undefined\";\n}\n\n/** Appends query parameters to a URL. Returns the URL unchanged when empty. */\nexport function buildUrl(url: string, queryParams?: Record<string, string>): string {\n  if (!queryParams || Object.keys(queryParams).length === 0) return url;\n  const params = new URLSearchParams(queryParams);\n  const sep = url.includes(\"?\") ? \"&\" : \"?\";\n  return `${url}${sep}${params.toString()}`;\n}\n\n/** Sleep helper used by the retry backoff. */\nfunction delay(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\n/** Options for a single request. */\nexport interface RequestOptions {\n  method?: HttpMethod;\n  /** Path appended to `baseUrl` (should start with `/`). */\n  path: string;\n  headers?: Record<string, string>;\n  query?: Record<string, string>;\n  body?: JsonValue;\n  /** Per-request timeout override in ms. */\n  timeout?: number;\n  /** Disable retry for this request (e.g. long-polling webhook). */\n  noRetry?: boolean;\n  /** Per-request retry override. */\n  retry?: RetryConfig;\n  /**\n   * Keep the request alive past page unload (`fetch`'s `keepalive` flag).\n   * Used for best-effort flushes on `pagehide`, where `sendBeacon` can't be\n   * used instead because it doesn't support custom headers (tenant scope).\n   */\n  keepalive?: boolean;\n}\n\n/** Result of a request: the raw Response plus the parsed JSON (or null). */\nexport interface HttpResult {\n  response: Response;\n  data: JsonValue;\n}\n\n/** Error thrown for non-2xx responses (after retries are exhausted). */\nexport class HttpError extends Error {\n  constructor(\n    public readonly status: number,\n    public readonly data: JsonValue,\n    message?: string,\n  ) {\n    super(message ?? `Request failed with status ${status}`);\n    this.name = \"HttpError\";\n  }\n}\n\n/** Thrown without a network call while an endpoint's circuit is open (see {@link CircuitBreakerConfig}). */\nexport class CircuitOpenError extends Error {\n  constructor(public readonly endpoint: string) {\n    super(`Circuit open for ${endpoint}: failing fast until the cooldown passes`);\n    this.name = \"CircuitOpenError\";\n  }\n}\n\n/**\n * Per-endpoint breaker state, module-wide so it outlives a single client.\n * ponytail: after the cooldown every concurrent caller probes, not just one; fine for a fail-fast\n * guard, add a probe lock if a thundering herd on recovery ever matters.\n */\nconst breakers = new Map<string, { failures: number; openedAt: number }>();\n\nexport interface HttpClientOptions {\n  /** Defaults to {@link DEFAULT_BASE_URL} when omitted. */\n  baseUrl?: string;\n  defaultHeaders?: Record<string, string>;\n  timeout?: number;\n  retry?: RetryConfig;\n  circuitBreaker?: boolean | CircuitBreakerConfig;\n  debug?: boolean;\n}\n\n/**\n * Minimal fetch wrapper shared by all runtimes.\n *\n * - Injects default headers (tenant scope, content-type).\n * - Applies an `AbortController` timeout.\n * - Retries transient failures (network error, `429`, `5xx`) with exponential\n *   backoff, honoring a `Retry-After` header when present.\n * - Parses JSON, falling back to `null` on empty/invalid bodies.\n */\nexport class HttpClient {\n  private readonly baseUrl: string;\n  private readonly defaultHeaders: Record<string, string>;\n  private readonly timeout: number;\n  private readonly retry: Required<RetryConfig>;\n  private readonly debug: boolean;\n  private readonly breaker: Required<CircuitBreakerConfig> | null;\n\n  constructor(opts: HttpClientOptions) {\n    this.baseUrl = (opts.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/+$/, \"\");\n    this.defaultHeaders = opts.defaultHeaders ?? {};\n    this.timeout = opts.timeout ?? 8000;\n    this.retry = {\n      attempts: opts.retry?.attempts ?? 2,\n      baseDelayMs: opts.retry?.baseDelayMs ?? 300,\n    };\n    this.debug = opts.debug ?? false;\n    const cb = opts.circuitBreaker === true ? {} : opts.circuitBreaker || null;\n    this.breaker = cb && { failureThreshold: cb.failureThreshold ?? 3, cooldownMs: cb.cooldownMs ?? 30_000 };\n  }\n\n  async request(opts: RequestOptions): Promise<HttpResult> {\n    if (!this.breaker) return this.send(opts);\n    // Keyed by full URL, query included: every webhook shares `/flow`, and one slow journey\n    // (`?id=`) must not short-circuit the others.\n    const key = buildUrl(this.baseUrl + opts.path, opts.query);\n    const b = breakers.get(key) ?? { failures: 0, openedAt: 0 };\n    if (b.openedAt) {\n      if (Date.now() - b.openedAt < this.breaker.cooldownMs) throw new CircuitOpenError(key);\n      // Half-open: let this call probe; one more failure re-opens.\n      b.openedAt = 0;\n      b.failures = this.breaker.failureThreshold - 1;\n    }\n    try {\n      const result = await this.send(opts);\n      breakers.delete(key);\n      return result;\n    } catch (err) {\n      if (err instanceof HttpError && !this.isRetryableStatus(err.status)) {\n        breakers.delete(key); // the backend answered: it's up\n        throw err;\n      }\n      b.failures += 1;\n      if (b.failures >= this.breaker.failureThreshold) {\n        b.openedAt = Date.now();\n        this.log(`circuit opened for ${opts.path} after ${b.failures} failures`);\n      }\n      breakers.set(key, b);\n      throw err;\n    }\n  }\n\n  private async send(opts: RequestOptions): Promise<HttpResult> {\n    const url = buildUrl(this.baseUrl + opts.path, opts.query);\n    const method = opts.method ?? \"GET\";\n    const headers: Record<string, string> = {\n      \"Content-Type\": \"application/json\",\n      ...this.defaultHeaders,\n      ...opts.headers,\n    };\n    const body = opts.body !== undefined ? JSON.stringify(opts.body) : undefined;\n    const timeout = opts.timeout ?? this.timeout;\n    const maxAttempts = opts.noRetry ? 1 : (opts.retry?.attempts ?? this.retry.attempts) + 1;\n    const baseDelay = opts.retry?.baseDelayMs ?? this.retry.baseDelayMs;\n\n    let lastError: unknown;\n    for (let attempt = 0; attempt < maxAttempts; attempt++) {\n      try {\n        const response = await this.fetchWithTimeout(\n          url,\n          { method, headers, body, ...(opts.keepalive ? { keepalive: true } : {}) },\n          timeout,\n        );\n        const data = await this.parseBody(response);\n\n        if (response.ok) {\n          return { response, data };\n        }\n\n        // Retry on 429/5xx if attempts remain; otherwise throw.\n        if (this.isRetryableStatus(response.status) && attempt < maxAttempts - 1) {\n          const wait = this.retryAfterMs(response, baseDelay, attempt);\n          this.log(`retrying ${opts.path} after ${wait}ms (status ${response.status})`);\n          await delay(wait);\n          continue;\n        }\n        throw new HttpError(response.status, data);\n      } catch (err) {\n        lastError = err;\n        // Non-retryable HttpError → rethrow immediately.\n        if (err instanceof HttpError) throw err;\n        // Network/timeout error → retry if attempts remain.\n        if (attempt < maxAttempts - 1) {\n          const wait = baseDelay * 2 ** attempt;\n          this.log(`retrying ${opts.path} after ${wait}ms (network error)`);\n          await delay(wait);\n          continue;\n        }\n      }\n    }\n    throw lastError instanceof Error ? lastError : new Error(\"Request failed\");\n  }\n\n  private async fetchWithTimeout(\n    url: string,\n    init: RequestInit,\n    timeout: number,\n  ): Promise<Response> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), timeout);\n    try {\n      return await fetch(url, { ...init, signal: controller.signal });\n    } catch (err) {\n      if (err instanceof Error && err.name === \"AbortError\") {\n        throw new Error(`Request timeout after ${timeout}ms`, { cause: err });\n      }\n      throw err;\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n\n  private async parseBody(response: Response): Promise<JsonValue> {\n    const text = await response.text().catch(() => \"\");\n    if (!text) return null;\n    try {\n      return JSON.parse(text) as JsonValue;\n    } catch {\n      return text;\n    }\n  }\n\n  private isRetryableStatus(status: number): boolean {\n    return status === 429 || (status >= 500 && status <= 599);\n  }\n\n  private retryAfterMs(response: Response, baseDelay: number, attempt: number): number {\n    const header = response.headers.get(\"Retry-After\");\n    if (header) {\n      const seconds = Number(header);\n      if (!Number.isNaN(seconds)) return seconds * 1000;\n    }\n    return baseDelay * 2 ** attempt;\n  }\n\n  private log(msg: string): void {\n    if (this.debug) console.warn(`[xenia] ${msg}`);\n  }\n}\n","/**\n * Cookie names shared by the browser and server halves of the SDK.\n *\n * The visitor cookie is the one channel where two runtimes must agree on a literal string: the\n * browser writes it, a same-origin server reads it back, and that match is what lets a server-side\n * conversion attribute to a browser-entered journey. `config.prefix` namespaces it — so two Xenia\n * apps on one domain keep separate visitors — which means **both halves must derive the name the\n * same way**. Deriving it on one side and hardcoding it on the other silently breaks the link for\n * anyone using a custom prefix: the server just finds no cookie and falls back to no visitor.\n *\n * Always build the name with these helpers rather than interpolating it by hand.\n */\n\nimport type { ConsentState } from \"./types\";\n\n/** Default storage/cookie prefix, matching `XeniaConfig.prefix`. */\nexport const DEFAULT_PREFIX = \"xenia\";\n\n/** Name of the first-party cookie carrying the SDK-owned visitor id, for a given prefix. */\nexport function visitorCookieName(prefix: string = DEFAULT_PREFIX): string {\n  return `${prefix || DEFAULT_PREFIX}_vid`;\n}\n\n/** Name of the first-party cookie carrying consent scopes, for a given prefix. */\nexport function consentCookieName(prefix: string = DEFAULT_PREFIX): string {\n  return `${prefix || DEFAULT_PREFIX}_consent`;\n}\n\n/**\n * The visitor cookie name for the DEFAULT prefix (`\"xenia_vid\"`).\n *\n * Correct for the common case, and kept so existing code (e.g. reading the cookie straight out of a\n * framework's cookie jar) keeps working. If you set `config.prefix`, use {@link visitorCookieName}\n * instead — this constant will not match what the browser wrote.\n */\nexport const VISITOR_COOKIE = visitorCookieName();\n\n/**\n * The consent cookie name for the DEFAULT prefix (`\"xenia_consent\"`). Same custom-prefix caveat as\n * {@link VISITOR_COOKIE}.\n */\nexport const CONSENT_COOKIE = consentCookieName();\n\n/**\n * A `document.cookie` string carrying consent, in the JSON form the server SDK's `getConsent()`\n * reads back. The browser client's `consent()` writes it; a page with its own consent banner and no\n * browser client can write it directly, so server-side calls see the visitor's choice.\n */\nexport function consentCookie(state: ConsentState, prefix?: string, maxAgeDays = 365): string {\n  return `${consentCookieName(prefix)}=${encodeURIComponent(JSON.stringify(state))}; path=/; max-age=${Math.floor(maxAgeDays * 86400)}; SameSite=Lax`;\n}\n"]}

package/dist/{chunk-DWFVDNU5.js → chunk-GWRDZIVA.js}

@@ -1,4 +1,4 @@
-import { XeniaApi, toEventId, generateUlid, personalizeContent, personalizePage, compact, visitorCookieName, consentCookieName } from './chunk-7NGJC7CF.js';
+import { XeniaApi, toEventId, generateUlid, personalizeContent, personalizePage, compact } from './chunk-LW5AEJ6K.js';
 
 // src/core/event-payload.ts
 var RESERVED = /* @__PURE__ */ new Set([
@@ -179,7 +179,7 @@ var XeniaServer = class {
       identity: opts.identity,
       context: opts.context
     });
-    return async (ids) => (await this.api.resolveEntries(ids, resolveOpts)).decisions ?? [];
+    return async (ids) => (await this.api.resolveEntries(ids, { ...resolveOpts, contentKey: opts.contentKey })).decisions ?? [];
   }
   /**
    * Merge the ambient `config.context` and `opts.identity`/`opts.context` into
@@ -215,38 +215,6 @@ function createXeniaServer(config) {
   return new XeniaServer(config);
 }
 
-// src/server/cookies.ts
-function parseCookies(header) {
-  const out = {};
-  if (!header) return out;
-  for (const part of header.split(";")) {
-    const idx = part.indexOf("=");
-    if (idx === -1) continue;
-    const key = part.slice(0, idx).trim();
-    const value = part.slice(idx + 1).trim();
-    if (key) out[key] = decodeURIComponent(value);
-  }
-  return out;
-}
-function getVisitorId(cookieHeader, prefix) {
-  return parseCookies(cookieHeader)[visitorCookieName(prefix)] ?? null;
-}
-function getConsent(cookieHeader, prefix) {
-  const raw = parseCookies(cookieHeader)[consentCookieName(prefix)];
-  if (!raw) return { analytics: false, marketing: false, personalization: false };
-  try {
-    const parsed = JSON.parse(raw);
-    return parsed;
-  } catch {
-    const scopes = new Set(raw.split(",").map((s) => s.trim()));
-    return {
-      analytics: scopes.has("analytics"),
-      marketing: scopes.has("marketing"),
-      personalization: scopes.has("personalization")
-    };
-  }
-}
-
-export { XeniaServer, createXeniaServer, getConsent, getVisitorId, parseCookies };
-//# sourceMappingURL=chunk-DWFVDNU5.js.map
-//# sourceMappingURL=chunk-DWFVDNU5.js.map
+export { XeniaServer, createXeniaServer };
+//# sourceMappingURL=chunk-GWRDZIVA.js.map
+//# sourceMappingURL=chunk-GWRDZIVA.js.map

package/dist/chunk-GWRDZIVA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/event-payload.ts","../src/server/xenia-server.ts"],"names":["compact"],"mappings":";;;AAGA,IAAM,QAAA,uBAAe,GAAA,CAAI;AAAA,EACvB,SAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,aAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA,EACA,UAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAC,CAAA;AAaD,SAASA,SAAQ,GAAA,EAAuE;AACtF,EAAA,MAAM,MAAiC,EAAC;AACxC,EAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AACxC,IAAA,IAAI,CAAA,KAAM,MAAA,EAAW,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EAChC;AACA,EAAA,OAAO,GAAA;AACT;AAWO,SAAS,kBAAkB,KAAA,EAAsC;AACtE,EAAA,MAAM,cAAyC,EAAC;AAChD,EAAA,MAAM,WAAsC,EAAC;AAC7C,EAAA,IAAI,MAAM,KAAA,EAAO;AACf,IAAA,KAAA,MAAW,CAAC,GAAG,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,KAAK,CAAA,EAAG;AAChD,MAAA,IAAI,MAAM,MAAA,EAAW;AAKrB,MAAA,IAAI,SAAS,GAAA,CAAI,CAAC,CAAA,EAAG,QAAA,CAAS,CAAC,CAAA,GAAI,CAAA;AAAA,WAC9B,WAAA,CAAY,CAAC,CAAA,GAAI,CAAA;AAAA,IACxB;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,GAAG,WAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAKH,GAAG,QAAA;AAAA,IACH,GAAGA,QAAAA,CAAS,KAAA,CAAM,OAAA,IAAW,EAA4C,CAAA;AAAA,IACzE,GAAGA,QAAAA,CAAS,KAAA,CAAM,QAAA,IAAY,EAA4C,CAAA;AAAA,IAC1E,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,GAAI,MAAM,SAAA,GAAY,EAAE,WAAW,KAAA,CAAM,SAAA,KAAc,EAAC;AAAA,IACxD,GAAI,MAAM,SAAA,GAAY,EAAE,WAAW,KAAA,CAAM,SAAA,KAAc;AAAC,GAC1D;AAEA,EAAA,OAAO,OAAA;AACT;;;ACzBA,eAAe,UAAA,CAAiB,MAAwB,IAAA,EAAwC;AAC9F,EAAA,IAAI,CAAC,IAAA,IAAQ,EAAE,UAAA,IAAc,IAAA,CAAA,SAAc,IAAA,EAAK;AAChD,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,IAAA,EAAK;AAAA,EACpB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA,CAAK,QAAA;AAAA,EACd;AACF;AA8BO,IAAM,cAAN,MAAkB;AAAA,EACd,GAAA;AAAA;AAAA,EAEA,SAAA;AAAA;AAAA,EAEQ,OAAA;AAAA,EAEjB,YAAY,MAAA,EAAqB;AAC/B,IAAA,IAAA,CAAK,GAAA,GAAM,IAAI,QAAA,CAAS,MAAM,CAAA;AAC9B,IAAA,IAAA,CAAK,YAAY,MAAA,CAAO,SAAA;AACxB,IAAA,IAAA,CAAK,UAAU,MAAA,CAAO,OAAA;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAA,CACJ,SAAA,EACA,IAAA,GAA2B,EAAC,EACM;AAClC,IAAA,MAAM,KAAA,GAAoB;AAAA,MACxB,SAAA;AAAA,MACA,SAAS,IAAA,CAAK,OAAA,GAAU,UAAU,IAAA,CAAK,OAAO,IAAI,YAAA,EAAa;AAAA,MAC/D,YAAA,EAAc,KAAK,YAAA,IAAgB,CAAA;AAAA,MACnC,YAAA,EAAc,IAAA,CAAK,YAAA,IAAgB,IAAA,CAAK,GAAA,EAAI;AAAA,MAC5C,MAAA,EAAQ,KAAK,MAAA,IAAU,kBAAA;AAAA,MACvB,QAAA,EAAU;AAAA,QACR,GAAG,IAAA,CAAK,QAAA;AAAA;AAAA;AAAA,QAGR,gBAAgB,IAAA,CAAK;AAAA,OACvB;AAAA,MACA,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,OAAA,EAAS,IAAA,CAAK,OAAA,KAAY,IAAA,GAAO,IAAA,GAAO;AAAA,KAC1C;AACA,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,UAAA,CAAW,CAAC,KAAK,CAAC,CAAA;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,OAAA,CACJ,SAAA,EACA,IAAA,EACA,IAAA,GAAgC,EAAC,EACH;AAC9B,IAAA,MAAM,UAAU,iBAAA,CAAkB;AAAA,MAChC,OAAA,EAAS,SAAA;AAAA,MACT,WAAW,IAAA,CAAK,SAAA;AAAA;AAAA;AAAA;AAAA,MAIhB,QAAA,EAAU,EAAE,GAAG,IAAA,CAAK,QAAA,EAAU,WAAW,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,QAAA,EAAU,SAAA,EAAU;AAAA;AAAA;AAAA,MAGpF,SAAS,EAAE,GAAG,KAAK,OAAA,EAAS,GAAG,KAAK,OAAA,EAAQ;AAAA,MAC5C,KAAA,EAAO;AAAA,KACR,CAAA;AACD,IAAA,OAAO,UAAA,CAAW,MAAM,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ,SAAA,EAAW,OAAA,EAAsB,IAAA,CAAK,MAAA,IAAU,MAAM,CAAA,EAAG,IAAI,CAAA;AAAA,EACxG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,SACJ,IAAA,EAC2B;AAC3B,IAAA,MAAM,cAAA,GAAiB,IAAA,CAAK,cAAA,IAAkB,IAAA,CAAK,SAAA;AACnD,IAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,MAAA,MAAM,IAAI,MAAM,0EAA0E,CAAA;AAAA,IAC5F;AACA,IAAA,OAAO,KAAK,GAAA,CAAI,QAAA,CAAS,EAAE,GAAG,IAAA,EAAM,gBAAgB,CAAA;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,OAAA,CAAmB,UAAA,EAAoB,IAAA,EAA4D;AACvG,IAAA,OAAO,UAAA,CAAW,MAAM,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ,UAAA,EAAY,IAAA,CAAK,WAAA,CAAY,IAAI,CAAC,CAAA,EAAG,IAAI,CAAA;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,YAAA,CACJ,KAAA,EACA,IAAA,EACmC;AACnC,IAAA,OAAO,UAAA,CAAW,MAAM,IAAA,CAAK,GAAA,CAAI,YAAA,CAAa,KAAA,EAAO,IAAA,CAAK,WAAA,CAAY,IAAI,CAAC,CAAA,EAAG,IAAI,CAAA;AAAA,EACpF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,kBAAA,CAAsB,IAAA,EAAS,IAAA,EAAoE;AACvG,IAAA,OAAO,kBAAA,CAAmB,IAAA,EAAM,EAAE,GAAG,IAAA,EAAM,SAAS,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA,EAAG,CAAA;AAAA,EAChF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,eAAA,CAA6B,GAAA,EAAc,IAAA,EAA2E;AAC1H,IAAA,OAAO,eAAA,CAAmB,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,SAAS,IAAA,CAAK,aAAA,CAAc,IAAI,CAAA,EAAG,CAAA;AAAA,EAC/E;AAAA,EAEQ,cAAc,IAAA,EAA6C;AACjE,IAAA,MAAM,WAAA,GAAc,KAAK,WAAA,CAAY;AAAA,MACnC,MAAM,IAAA,CAAK,IAAA;AAAA,MAAM,QAAQ,IAAA,CAAK,MAAA;AAAA,MAAQ,UAAU,IAAA,CAAK,QAAA;AAAA,MAAU,SAAS,IAAA,CAAK;AAAA,KAC9E,CAAA;AACD,IAAA,OAAO,OAAO,GAAA,KAAA,CACX,MAAM,IAAA,CAAK,GAAA,CAAI,eAAe,GAAA,EAAK,EAAE,GAAG,WAAA,EAAa,YAAY,IAAA,CAAK,UAAA,EAAY,CAAA,EAAG,aAAa,EAAC;AAAA,EACxG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBQ,YAAY,IAAA,EAAmD;AACrE,IAAA,MAAM,WAAW,OAAA,CAAQ;AAAA,MACvB,GAAG,IAAA,EAAM,QAAA;AAAA,MACT,SAAA,EAAW,IAAA,CAAK,SAAA,IAAa,IAAA,EAAM,QAAA,EAAU;AAAA,KAC9C,CAAA;AACD,IAAA,MAAM,MAAA,GAAS;AAAA,MACb,GAAG,OAAA,CAAS,IAAA,CAAK,OAAA,IAAW,EAA4C,CAAA;AAAA,MACxE,GAAG,OAAA,CAAS,IAAA,EAAM,OAAA,IAAW,EAA4C,CAAA;AAAA,MACzE,GAAG;AAAA,KACL;AACA,IAAA,IAAI,MAAA,CAAO,KAAK,MAAM,CAAA,CAAE,WAAW,CAAA,IAAK,CAAC,IAAA,CAAK,SAAA,EAAW,OAAO,IAAA;AAChE,IAAA,IAAI,IAAA,CAAK,SAAA,EAAW,MAAA,CAAO,UAAA,GAAa,IAAA,CAAK,SAAA;AAC7C,IAAA,OAAO,EAAE,GAAG,IAAA,EAAM,IAAA,EAAM,EAAE,GAAI,IAAA,EAAM,IAAA,IAAQ,EAAC,EAAI,GAAG,MAAA,EAAO,EAAE;AAAA,EAC/D;AACF;AAGO,SAAS,kBAAkB,MAAA,EAAkC;AAClE,EAAA,OAAO,IAAI,YAAY,MAAM,CAAA;AAC/B","file":"chunk-GWRDZIVA.js","sourcesContent":["import type { EventContext, EventIdentity, EventPayload, JsonValue } from \"./types\";\n\n/** Reserved keys that map to first-class fields (not passthrough data). */\nconst RESERVED = new Set([\n  \"eventId\",\n  \"eventType\",\n  \"journeyId\",\n  \"deviceId\",\n  \"visitorId\",\n  \"customerId\",\n  \"email\",\n  \"utmSource\",\n  \"utmMedium\",\n  \"utmCampaign\",\n  \"utmContent\",\n  \"utmId\",\n  \"url\",\n  \"referrer\",\n  \"path\",\n  \"query\",\n]);\n\nexport interface BuildEventInput {\n  eventId: string;\n  eventType?: string;\n  journeyId?: string;\n  identity?: EventIdentity;\n  context?: EventContext;\n  /** Arbitrary extra properties merged as passthrough data. */\n  props?: Record<string, JsonValue | undefined>;\n}\n\n/** Drop `undefined` values so the JSON body stays clean. */\nfunction compact(obj: Record<string, JsonValue | undefined>): Record<string, JsonValue> {\n  const out: Record<string, JsonValue> = {};\n  for (const [k, v] of Object.entries(obj)) {\n    if (v !== undefined) out[k] = v;\n  }\n  return out;\n}\n\n/**\n * Build the request body for the webhook `/flow` call (`XeniaApi.webhook`).\n *\n * Merge order (later wins): passthrough props < context < identity < core.\n * Field names match the backend `EventTriggerRequest` DTO exactly.\n *\n * @internal Used only by the webhook request/response path — the unified event\n * surface (`track()` → `POST /api/events/v1`) builds {@link XeniaEvent} instead.\n */\nexport function buildEventPayload(input: BuildEventInput): EventPayload {\n  const passthrough: Record<string, JsonValue> = {};\n  const reserved: Record<string, JsonValue> = {};\n  if (input.props) {\n    for (const [k, v] of Object.entries(input.props)) {\n      if (v === undefined) continue;\n      // A prop whose key matches a reserved field (e.g. `email`, `customerId`,\n      // `utmSource`) is promoted to that first-class field; everything else is\n      // custom passthrough data. Previously reserved-named props were dropped\n      // outright — so `track(\"sign_up\", { email })` never sent `email` at all.\n      if (RESERVED.has(k)) reserved[k] = v;\n      else passthrough[k] = v;\n    }\n  }\n\n  const payload = {\n    ...passthrough,\n    // Reserved-named props fill first-class fields (e.g. `email`, `customerId`)\n    // the SDK didn't auto-collect. Auto-collected context/identity still win for\n    // what they reliably know (real page url, visitor/device id), so a stray prop\n    // can't override the true page context — see merge order below.\n    ...reserved,\n    ...compact((input.context ?? {}) as Record<string, JsonValue | undefined>),\n    ...compact((input.identity ?? {}) as Record<string, JsonValue | undefined>),\n    eventId: input.eventId,\n    ...(input.eventType ? { eventType: input.eventType } : {}),\n    ...(input.journeyId ? { journeyId: input.journeyId } : {}),\n  };\n\n  return payload as EventPayload;\n}\n","import { compact, XeniaApi } from \"../core/api\";\nimport { buildEventPayload } from \"../core/event-payload\";\nimport { generateUlid, toEventId } from \"../core/id\";\nimport { personalizeContent, personalizePage } from \"../core/personalize-content\";\nimport type { EntryResolver, PageRef, PagePersonalizeOptions, PersonalizeContentResult } from \"../core/personalize-content\";\nimport type {\n  AnalyticsContext,\n  AnalyticsEventName,\n  CallerIdentity,\n  AnalyticsIngestResponse,\n  ConsentState,\n  EventContext,\n  EventIdentity,\n  IdentifyRequest,\n  IdentifyResponse,\n  JsonValue,\n  ResolveBatchItem,\n  ResolveBatchResult,\n  ResolveOptions,\n  ResolveResult,\n  WebhookResponse,\n  XeniaConfig,\n  XeniaEvent,\n} from \"../core/types\";\n\n/**\n * Extra per-call identity/context for server-side webhook calls — an override on top of whatever the\n * client already carries.\n *\n * There's no ambient `window` on the server to auto-collect `path`/`query`/`url`/UTM params the way\n * the browser client does, so bind them ONCE per request via {@link XeniaConfig.context} (see\n * `contextFromUrl`) and every call attaches them automatically. These per-call fields are for the\n * remainder: values known only at this call site, or a deliberate override of the ambient ones.\n */\nexport interface ServerWebhookOptions<F = never> extends WithFallback<F> {\n  method?: \"GET\" | \"POST\";\n  journeyId?: string;\n  identity?: EventIdentity;\n  context?: EventContext;\n}\n\n/**\n * Opt-in \"never throw\" for calls a page renders from. When `fallback` is set (even to `null`), any\n * failure (timeout, network error, non-2xx, open circuit) resolves to it instead of throwing, so a\n * caller can render its default content without a `try/catch`. Errors are swallowed silently: leave\n * it unset where you need to see them.\n */\nexport interface WithFallback<F> {\n  fallback?: F;\n}\n\n/** {@link ResolveOptions} plus {@link WithFallback}. */\nexport type ServerResolveOptions<F = never> = ResolveOptions & WithFallback<F>;\n\n/** Runs `call`, or resolves to `opts.fallback` on any error when one was given. */\nasync function orFallback<T, F>(call: () => Promise<T>, opts?: WithFallback<F>): Promise<T | F> {\n  if (!opts || !(\"fallback\" in opts)) return call();\n  try {\n    return await call();\n  } catch {\n    return opts.fallback as F;\n  }\n}\n\n/**\n * Options for a server-side unified event (`POST /api/events/v1`). There's no\n * ambient request context on the server — pass whatever's known at the call\n * site (e.g. pathname/user-agent from the current request, session id from a\n * cookie) via `identity`/`context`.\n */\nexport interface ServerTrackOptions {\n  /** When true, also match/advance a journey (never sampled/shed). Default false. */\n  trigger?: boolean;\n  /** Stable dedup key (e.g. `\"ord-1001\"`) for idempotent conversions. */\n  eventId?: string;\n  eventVersion?: number;\n  occurredAtMs?: number;\n  /** Origin tag. Default `\"xenia-server-sdk\"`. */\n  source?: string;\n  /** Identity fields for this event (except the SDK-owned `xeniaVisitorId`,\n   *  which comes from `config.visitorId` and can't be set per call). */\n  identity?: CallerIdentity;\n  context?: AnalyticsContext;\n  properties?: Record<string, JsonValue | undefined>;\n  consent?: ConsentState;\n}\n\n/**\n * Server-native Xenia client. Same method names as the browser client, but\n * every call is stateless: identity and context are passed explicitly rather\n * than read from the DOM/localStorage. Uses global `fetch` (Node ≥18).\n */\nexport class XeniaServer {\n  readonly api: XeniaApi;\n  /** SDK-owned visitor anchor for this (per-request) client — see {@link XeniaConfig.visitorId}. */\n  readonly visitorId?: string;\n  /** Ambient request context attached to every call — see {@link XeniaConfig.context}. */\n  private readonly context?: EventContext;\n\n  constructor(config: XeniaConfig) {\n    this.api = new XeniaApi(config);\n    this.visitorId = config.visitorId;\n    this.context = config.context;\n  }\n\n  /**\n   * Send a unified event server-side (`POST /api/events/v1`) and return the\n   * ingest response (including per-result `triggered`). `opts.trigger: true`\n   * also matches/advances a journey; pass `opts.eventId` (e.g. `\"ord-1001\"`)\n   * as a stable dedup key for idempotent conversions.\n   */\n  async track(\n    eventName: AnalyticsEventName,\n    opts: ServerTrackOptions = {},\n  ): Promise<AnalyticsIngestResponse> {\n    const event: XeniaEvent = {\n      eventName,\n      eventId: opts.eventId ? toEventId(opts.eventId) : generateUlid(),\n      eventVersion: opts.eventVersion ?? 1,\n      occurredAtMs: opts.occurredAtMs ?? Date.now(),\n      source: opts.source ?? \"xenia-server-sdk\",\n      identity: {\n        ...opts.identity,\n        // SDK-owned, set LAST so it can't be overridden per call. Comes from\n        // `config.visitorId` (bind it per request from the `xenia_vid` cookie).\n        xeniaVisitorId: this.visitorId,\n      },\n      context: opts.context,\n      properties: opts.properties,\n      consent: opts.consent,\n      trigger: opts.trigger === true ? true : undefined,\n    };\n    return this.api.sendEvents([event]);\n  }\n\n  /**\n   * Send a webhook request and await the synchronous response. Merges\n   * `opts.identity`/`opts.context` into the payload the same way the browser\n   * client's auto-attached fields do (`path`, `query`, `url`, `referrer`,\n   * `deviceId`, `visitorId`, etc.) — see `ServerWebhookOptions`. Pass `opts.fallback` to get it\n   * back instead of an error (see {@link WithFallback}).\n   */\n  async webhook<F = never>(\n    triggerId: string,\n    data?: Record<string, JsonValue | undefined>,\n    opts: ServerWebhookOptions<F> = {},\n  ): Promise<WebhookResponse | F> {\n    const payload = buildEventPayload({\n      eventId: triggerId,\n      journeyId: opts.journeyId,\n      // SDK-owned visitor anchor wins: config.visitorId (bind the `xenia_vid`\n      // cookie per request) is attached automatically. Falls back to a\n      // per-call visitorId only when none is bound.\n      identity: { ...opts.identity, visitorId: this.visitorId ?? opts.identity?.visitorId },\n      // Ambient request context (config.context, bound once per request) under a per-call\n      // override — same precedence resolve() uses, so both surfaces carry the same fields.\n      context: { ...this.context, ...opts.context },\n      props: data,\n    });\n    return orFallback(() => this.api.webhook(triggerId, payload as JsonValue, opts.method ?? \"POST\"), opts);\n  }\n\n  /**\n   * Bind visitor→user server-side — `POST /api/events/v1/identify`. `xeniaVisitorId` defaults to\n   * the bound `config.visitorId`, so a per-request client only passes what it learned (e.g. an email\n   * from a submitted form).\n   */\n  async identify(\n    body: Omit<IdentifyRequest, \"xeniaVisitorId\"> & { xeniaVisitorId?: string },\n  ): Promise<IdentifyResponse> {\n    const xeniaVisitorId = body.xeniaVisitorId ?? this.visitorId;\n    if (!xeniaVisitorId) {\n      throw new Error(\"identify() needs a visitor: bind config.visitorId or pass xeniaVisitorId\");\n    }\n    return this.api.identify({ ...body, xeniaVisitorId });\n  }\n\n  /**\n   * Resolve in-entry content personalization for one content key\n   * (`POST /api/personalization/resolve`). Requires a configured SDK token\n   * (`token`/`getToken`) — resolve is auth-required. With `merge: true` the\n   * returned `content` is server-spliced.\n   *\n   * Pass `opts.identity`/`opts.context` to attach the same SDK-provided\n   * fields (`deviceId`, `customerId`, `email`, `path`, `url`, `referrer`,\n   * `utm*`, …) the browser client collects ambiently — there's no ambient\n   * `window`/`document` server-side, so a server caller must supply whatever\n   * it knows (e.g. from the current request) explicitly. See\n   * {@link ResolveOptions}. Pass `opts.fallback` to get it back instead of an\n   * error (see {@link WithFallback}).\n   */\n  async resolve<F = never>(contentKey: string, opts?: ServerResolveOptions<F>): Promise<ResolveResult | F> {\n    return orFallback(() => this.api.resolve(contentKey, this.withVisitor(opts)), opts);\n  }\n\n  /**\n   * Resolve several content keys in one round-trip (`POST /api/personalization/resolve-batch`).\n   * `opts.fallback` as in {@link resolve}.\n   */\n  async resolveBatch<F = never>(\n    items: ResolveBatchItem[],\n    opts?: ServerResolveOptions<F>,\n  ): Promise<ResolveBatchResult[] | F> {\n    return orFallback(() => this.api.resolveBatch(items, this.withVisitor(opts)), opts);\n  }\n\n  /**\n   * Personalize a fetched CMS page server-side — see `XeniaClient.personalizeContent`. Never\n   * throws: on error or timeout the page renders with whatever was decided (base content otherwise).\n   * Pass `opts.identity`/`opts.context` like `resolve()`.\n   */\n  async personalizeContent<T>(page: T, opts: PagePersonalizeOptions): Promise<PersonalizeContentResult<T>> {\n    return personalizeContent(page, { ...opts, resolve: this.entryResolver(opts) });\n  }\n\n  /**\n   * Fetch a page through `opts.cms` and personalize it — the app passes only the page's identity\n   * (entry id, or `{ contentType, fields: { slug } }`). Never throws: a failed fetch is `content:\n   * null` with `error`, a missing page `content: null`.\n   */\n  async personalizePage<T = unknown>(ref: PageRef, opts: PagePersonalizeOptions): Promise<PersonalizeContentResult<T | null>> {\n    return personalizePage<T>(ref, { ...opts, resolve: this.entryResolver(opts) });\n  }\n\n  private entryResolver(opts: PagePersonalizeOptions): EntryResolver {\n    const resolveOpts = this.withVisitor({\n      data: opts.data, locale: opts.locale, identity: opts.identity, context: opts.context,\n    });\n    return async (ids) =>\n      (await this.api.resolveEntries(ids, { ...resolveOpts, contentKey: opts.contentKey })).decisions ?? [];\n  }\n\n  /**\n   * Merge the ambient `config.context` and `opts.identity`/`opts.context` into\n   * the resolve `data`, then stamp the SDK-owned visitor id\n   * (`config.visitorId`) under both the reserved `_xenia_vid` key (read by the\n   * backend for holdout/exposure bucketing) and the flat `visitorId` field —\n   * mirrors `webhook()`'s merge order/precedence exactly: caller `data` <\n   * ambient `config.context` < caller `context`/`identity` < SDK-owned\n   * `visitorId`/`_xenia_vid`, set LAST so neither can be overridden per call.\n   *\n   * `config.context` is what makes the SDK-provided fields automatic on the\n   * server: bound once per request, every `resolve()` carries `path`/`query`/\n   * `url`/`referrer`/UTMs with no per-call wiring, matching what the browser\n   * client collects from `window` on its own. A no-op when nothing is bound and\n   * nothing was passed — preserving today's behavior for callers using neither.\n   */\n  private withVisitor(opts?: ResolveOptions): ResolveOptions | undefined {\n    const identity = compact({\n      ...opts?.identity,\n      visitorId: this.visitorId ?? opts?.identity?.visitorId,\n    });\n    const merged = {\n      ...compact((this.context ?? {}) as Record<string, JsonValue | undefined>),\n      ...compact((opts?.context ?? {}) as Record<string, JsonValue | undefined>),\n      ...identity,\n    };\n    if (Object.keys(merged).length === 0 && !this.visitorId) return opts;\n    if (this.visitorId) merged._xenia_vid = this.visitorId;\n    return { ...opts, data: { ...(opts?.data ?? {}), ...merged } };\n  }\n}\n\n/** Create a server-native client. */\nexport function createXeniaServer(config: XeniaConfig): XeniaServer {\n  return new XeniaServer(config);\n}\n"]}

package/dist/{chunk-7NGJC7CF.js → chunk-LW5AEJ6K.js}

@@ -1,3 +1,5 @@
+import { HttpClient } from './chunk-BQ5PJCZ7.js';
+
 // src/core/actions.ts
 var MESSAGE_TYPES = /* @__PURE__ */ new Set([
   "banner",
@@ -137,168 +139,6 @@ function parseActions(body) {
   return actions;
 }
 
-// src/core/http-client.ts
-var DEFAULT_BASE_URL = "https://engine.xeniamartech.com/xenia";
-function isBrowser() {
-  return typeof window !== "undefined" && typeof document !== "undefined";
-}
-function buildUrl(url, queryParams) {
-  if (!queryParams || Object.keys(queryParams).length === 0) return url;
-  const params = new URLSearchParams(queryParams);
-  const sep = url.includes("?") ? "&" : "?";
-  return `${url}${sep}${params.toString()}`;
-}
-function delay(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-var HttpError = class extends Error {
-  constructor(status, data, message) {
-    super(message ?? `Request failed with status ${status}`);
-    this.status = status;
-    this.data = data;
-    this.name = "HttpError";
-  }
-  status;
-  data;
-};
-var CircuitOpenError = class extends Error {
-  constructor(endpoint) {
-    super(`Circuit open for ${endpoint}: failing fast until the cooldown passes`);
-    this.endpoint = endpoint;
-    this.name = "CircuitOpenError";
-  }
-  endpoint;
-};
-var breakers = /* @__PURE__ */ new Map();
-var HttpClient = class {
-  baseUrl;
-  defaultHeaders;
-  timeout;
-  retry;
-  debug;
-  breaker;
-  constructor(opts) {
-    this.baseUrl = (opts.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
-    this.defaultHeaders = opts.defaultHeaders ?? {};
-    this.timeout = opts.timeout ?? 8e3;
-    this.retry = {
-      attempts: opts.retry?.attempts ?? 2,
-      baseDelayMs: opts.retry?.baseDelayMs ?? 300
-    };
-    this.debug = opts.debug ?? false;
-    const cb = opts.circuitBreaker === true ? {} : opts.circuitBreaker || null;
-    this.breaker = cb && { failureThreshold: cb.failureThreshold ?? 3, cooldownMs: cb.cooldownMs ?? 3e4 };
-  }
-  async request(opts) {
-    if (!this.breaker) return this.send(opts);
-    const key = buildUrl(this.baseUrl + opts.path, opts.query);
-    const b = breakers.get(key) ?? { failures: 0, openedAt: 0 };
-    if (b.openedAt) {
-      if (Date.now() - b.openedAt < this.breaker.cooldownMs) throw new CircuitOpenError(key);
-      b.openedAt = 0;
-      b.failures = this.breaker.failureThreshold - 1;
-    }
-    try {
-      const result = await this.send(opts);
-      breakers.delete(key);
-      return result;
-    } catch (err) {
-      if (err instanceof HttpError && !this.isRetryableStatus(err.status)) {
-        breakers.delete(key);
-        throw err;
-      }
-      b.failures += 1;
-      if (b.failures >= this.breaker.failureThreshold) {
-        b.openedAt = Date.now();
-        this.log(`circuit opened for ${opts.path} after ${b.failures} failures`);
-      }
-      breakers.set(key, b);
-      throw err;
-    }
-  }
-  async send(opts) {
-    const url = buildUrl(this.baseUrl + opts.path, opts.query);
-    const method = opts.method ?? "GET";
-    const headers = {
-      "Content-Type": "application/json",
-      ...this.defaultHeaders,
-      ...opts.headers
-    };
-    const body = opts.body !== void 0 ? JSON.stringify(opts.body) : void 0;
-    const timeout = opts.timeout ?? this.timeout;
-    const maxAttempts = opts.noRetry ? 1 : (opts.retry?.attempts ?? this.retry.attempts) + 1;
-    const baseDelay = opts.retry?.baseDelayMs ?? this.retry.baseDelayMs;
-    let lastError;
-    for (let attempt = 0; attempt < maxAttempts; attempt++) {
-      try {
-        const response = await this.fetchWithTimeout(
-          url,
-          { method, headers, body, ...opts.keepalive ? { keepalive: true } : {} },
-          timeout
-        );
-        const data = await this.parseBody(response);
-        if (response.ok) {
-          return { response, data };
-        }
-        if (this.isRetryableStatus(response.status) && attempt < maxAttempts - 1) {
-          const wait = this.retryAfterMs(response, baseDelay, attempt);
-          this.log(`retrying ${opts.path} after ${wait}ms (status ${response.status})`);
-          await delay(wait);
-          continue;
-        }
-        throw new HttpError(response.status, data);
-      } catch (err) {
-        lastError = err;
-        if (err instanceof HttpError) throw err;
-        if (attempt < maxAttempts - 1) {
-          const wait = baseDelay * 2 ** attempt;
-          this.log(`retrying ${opts.path} after ${wait}ms (network error)`);
-          await delay(wait);
-          continue;
-        }
-      }
-    }
-    throw lastError instanceof Error ? lastError : new Error("Request failed");
-  }
-  async fetchWithTimeout(url, init, timeout) {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), timeout);
-    try {
-      return await fetch(url, { ...init, signal: controller.signal });
-    } catch (err) {
-      if (err instanceof Error && err.name === "AbortError") {
-        throw new Error(`Request timeout after ${timeout}ms`, { cause: err });
-      }
-      throw err;
-    } finally {
-      clearTimeout(timer);
-    }
-  }
-  async parseBody(response) {
-    const text = await response.text().catch(() => "");
-    if (!text) return null;
-    try {
-      return JSON.parse(text);
-    } catch {
-      return text;
-    }
-  }
-  isRetryableStatus(status) {
-    return status === 429 || status >= 500 && status <= 599;
-  }
-  retryAfterMs(response, baseDelay, attempt) {
-    const header = response.headers.get("Retry-After");
-    if (header) {
-      const seconds = Number(header);
-      if (!Number.isNaN(seconds)) return seconds * 1e3;
-    }
-    return baseDelay * 2 ** attempt;
-  }
-  log(msg) {
-    if (this.debug) console.warn(`[xenia] ${msg}`);
-  }
-};
-
 // src/core/token-provider.ts
 function decodeExp(token) {
   try {
@@ -546,7 +386,7 @@ var XeniaApi = class {
    * ({@link personalizeContent}) calls this once per round with the runtime
    * targets it found; callers rarely need it directly.
    */
-  async resolveEntries(entryIds, opts = {}) {
+  async resolveEntries(entryIds, opts) {
     const { data } = await this.http.request({
       method: "POST",
       path: "/api/personalization/resolve-entries",
@@ -554,7 +394,8 @@ var XeniaApi = class {
       body: compact({
         entryIds,
         data: opts.data,
-        locale: opts.locale
+        locale: opts.locale,
+        contentKey: opts.contentKey
       })
     });
     return data;
@@ -609,20 +450,6 @@ function toEventId(raw) {
   return digest;
 }
 
-// src/core/cookie-names.ts
-var DEFAULT_PREFIX = "xenia";
-function visitorCookieName(prefix = DEFAULT_PREFIX) {
-  return `${prefix || DEFAULT_PREFIX}_vid`;
-}
-function consentCookieName(prefix = DEFAULT_PREFIX) {
-  return `${prefix || DEFAULT_PREFIX}_consent`;
-}
-var VISITOR_COOKIE = visitorCookieName();
-var CONSENT_COOKIE = consentCookieName();
-function consentCookie(state, prefix, maxAgeDays = 365) {
-  return `${consentCookieName(prefix)}=${encodeURIComponent(JSON.stringify(state))}; path=/; max-age=${Math.floor(maxAgeDays * 86400)}; SameSite=Lax`;
-}
-
 // src/core/request-context.ts
 function contextFromUrl(url, referrer) {
   const ctx = {};
@@ -656,7 +483,7 @@ var DEFAULT_TIMEOUT_MS = 300;
 var DEFAULT_MAX_ROUNDS = 3;
 var copyOf = (v) => v && typeof v === "object" && typeof structuredClone === "function" ? structuredClone(v) : v;
 async function personalizeContent(payload, options) {
-  const { cms } = options;
+  const cms = scopedAdapter(options.cms, options.contentKey);
   const maxRounds = options.maxRounds ?? DEFAULT_MAX_ROUNDS;
   const deadline = Date.now() + (options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
   const applied = [];
@@ -855,7 +682,8 @@ function withDeadline(promise, deadline) {
     })
   ]).finally(() => clearTimeout(timer));
 }
-function pendingTargets(payload, cms) {
+function pendingTargets(payload, adapter, contentKey) {
+  const cms = scopedAdapter(adapter, contentKey);
   try {
     let content = typeof structuredClone === "function" ? structuredClone(payload) : payload;
     content = cms.prepare ? cms.prepare(content) : content;
@@ -866,6 +694,15 @@ function pendingTargets(payload, cms) {
     return [];
   }
 }
+function scopedAdapter(cms, contentKey) {
+  return {
+    ...cms,
+    marker(entry) {
+      const m = cms.marker(entry);
+      return m && contentKey && m.keys?.includes(contentKey) ? m : null;
+    }
+  };
+}
 async function personalizePage(ref, options) {
   let page;
   try {
@@ -878,6 +715,6 @@ async function personalizePage(ref, options) {
   return personalizeContent(page, options);
 }
 
-export { CONSENT_COOKIE, CircuitOpenError, DEFAULT_PREFIX, HttpClient, HttpError, MAX_EVENT_ID_LENGTH, VISITOR_COOKIE, XeniaApi, buildUrl, compact, consentCookie, consentCookieName, contextFromUrl, generateUlid, isBrowser, parseActions, pendingTargets, personalizeContent, personalizePage, toEventId, visitorCookieName };
-//# sourceMappingURL=chunk-7NGJC7CF.js.map
-//# sourceMappingURL=chunk-7NGJC7CF.js.map
+export { MAX_EVENT_ID_LENGTH, XeniaApi, compact, contextFromUrl, generateUlid, parseActions, pendingTargets, personalizeContent, personalizePage, toEventId };
+//# sourceMappingURL=chunk-LW5AEJ6K.js.map
+//# sourceMappingURL=chunk-LW5AEJ6K.js.map