@xenia-martech/sdk-js 1.2.0-dev.3 → 1.2.0-dev.4

package/dist/chunk-N5M4PI7C.cjs

@@ -0,0 +1,192 @@
+'use strict';
+
+// src/core/http-client.ts
+var DEFAULT_BASE_URL = "https://engine.xeniamartech.com/xenia";
+function isBrowser() {
+  return typeof window !== "undefined" && typeof document !== "undefined";
+}
+function buildUrl(url, queryParams) {
+  if (!queryParams || Object.keys(queryParams).length === 0) return url;
+  const params = new URLSearchParams(queryParams);
+  const sep = url.includes("?") ? "&" : "?";
+  return `${url}${sep}${params.toString()}`;
+}
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+var HttpError = class extends Error {
+  constructor(status, data, message) {
+    super(message ?? `Request failed with status ${status}`);
+    this.status = status;
+    this.data = data;
+    this.name = "HttpError";
+  }
+  status;
+  data;
+};
+var CircuitOpenError = class extends Error {
+  constructor(endpoint) {
+    super(`Circuit open for ${endpoint}: failing fast until the cooldown passes`);
+    this.endpoint = endpoint;
+    this.name = "CircuitOpenError";
+  }
+  endpoint;
+};
+var breakers = /* @__PURE__ */ new Map();
+var HttpClient = class {
+  baseUrl;
+  defaultHeaders;
+  timeout;
+  retry;
+  debug;
+  breaker;
+  constructor(opts) {
+    this.baseUrl = (opts.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+    this.defaultHeaders = opts.defaultHeaders ?? {};
+    this.timeout = opts.timeout ?? 8e3;
+    this.retry = {
+      attempts: opts.retry?.attempts ?? 2,
+      baseDelayMs: opts.retry?.baseDelayMs ?? 300
+    };
+    this.debug = opts.debug ?? false;
+    const cb = opts.circuitBreaker === true ? {} : opts.circuitBreaker || null;
+    this.breaker = cb && { failureThreshold: cb.failureThreshold ?? 3, cooldownMs: cb.cooldownMs ?? 3e4 };
+  }
+  async request(opts) {
+    if (!this.breaker) return this.send(opts);
+    const key = buildUrl(this.baseUrl + opts.path, opts.query);
+    const b = breakers.get(key) ?? { failures: 0, openedAt: 0 };
+    if (b.openedAt) {
+      if (Date.now() - b.openedAt < this.breaker.cooldownMs) throw new CircuitOpenError(key);
+      b.openedAt = 0;
+      b.failures = this.breaker.failureThreshold - 1;
+    }
+    try {
+      const result = await this.send(opts);
+      breakers.delete(key);
+      return result;
+    } catch (err) {
+      if (err instanceof HttpError && !this.isRetryableStatus(err.status)) {
+        breakers.delete(key);
+        throw err;
+      }
+      b.failures += 1;
+      if (b.failures >= this.breaker.failureThreshold) {
+        b.openedAt = Date.now();
+        this.log(`circuit opened for ${opts.path} after ${b.failures} failures`);
+      }
+      breakers.set(key, b);
+      throw err;
+    }
+  }
+  async send(opts) {
+    const url = buildUrl(this.baseUrl + opts.path, opts.query);
+    const method = opts.method ?? "GET";
+    const headers = {
+      "Content-Type": "application/json",
+      ...this.defaultHeaders,
+      ...opts.headers
+    };
+    const body = opts.body !== void 0 ? JSON.stringify(opts.body) : void 0;
+    const timeout = opts.timeout ?? this.timeout;
+    const maxAttempts = opts.noRetry ? 1 : (opts.retry?.attempts ?? this.retry.attempts) + 1;
+    const baseDelay = opts.retry?.baseDelayMs ?? this.retry.baseDelayMs;
+    let lastError;
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+      try {
+        const response = await this.fetchWithTimeout(
+          url,
+          { method, headers, body, ...opts.keepalive ? { keepalive: true } : {} },
+          timeout
+        );
+        const data = await this.parseBody(response);
+        if (response.ok) {
+          return { response, data };
+        }
+        if (this.isRetryableStatus(response.status) && attempt < maxAttempts - 1) {
+          const wait = this.retryAfterMs(response, baseDelay, attempt);
+          this.log(`retrying ${opts.path} after ${wait}ms (status ${response.status})`);
+          await delay(wait);
+          continue;
+        }
+        throw new HttpError(response.status, data);
+      } catch (err) {
+        lastError = err;
+        if (err instanceof HttpError) throw err;
+        if (attempt < maxAttempts - 1) {
+          const wait = baseDelay * 2 ** attempt;
+          this.log(`retrying ${opts.path} after ${wait}ms (network error)`);
+          await delay(wait);
+          continue;
+        }
+      }
+    }
+    throw lastError instanceof Error ? lastError : new Error("Request failed");
+  }
+  async fetchWithTimeout(url, init, timeout) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeout);
+    try {
+      return await fetch(url, { ...init, signal: controller.signal });
+    } catch (err) {
+      if (err instanceof Error && err.name === "AbortError") {
+        throw new Error(`Request timeout after ${timeout}ms`, { cause: err });
+      }
+      throw err;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  async parseBody(response) {
+    const text = await response.text().catch(() => "");
+    if (!text) return null;
+    try {
+      return JSON.parse(text);
+    } catch {
+      return text;
+    }
+  }
+  isRetryableStatus(status) {
+    return status === 429 || status >= 500 && status <= 599;
+  }
+  retryAfterMs(response, baseDelay, attempt) {
+    const header = response.headers.get("Retry-After");
+    if (header) {
+      const seconds = Number(header);
+      if (!Number.isNaN(seconds)) return seconds * 1e3;
+    }
+    return baseDelay * 2 ** attempt;
+  }
+  log(msg) {
+    if (this.debug) console.warn(`[xenia] ${msg}`);
+  }
+};
+
+// src/core/cookie-names.ts
+var DEFAULT_PREFIX = "xenia";
+function visitorCookieName(prefix = DEFAULT_PREFIX) {
+  return `${prefix || DEFAULT_PREFIX}_vid`;
+}
+function consentCookieName(prefix = DEFAULT_PREFIX) {
+  return `${prefix || DEFAULT_PREFIX}_consent`;
+}
+var VISITOR_COOKIE = visitorCookieName();
+var CONSENT_COOKIE = consentCookieName();
+function consentCookie(state, prefix, maxAgeDays = 365) {
+  return `${consentCookieName(prefix)}=${encodeURIComponent(JSON.stringify(state))}; path=/; max-age=${Math.floor(maxAgeDays * 86400)}; SameSite=Lax`;
+}
+
+exports.CONSENT_COOKIE = CONSENT_COOKIE;
+exports.CircuitOpenError = CircuitOpenError;
+exports.DEFAULT_BASE_URL = DEFAULT_BASE_URL;
+exports.DEFAULT_PREFIX = DEFAULT_PREFIX;
+exports.HttpClient = HttpClient;
+exports.HttpError = HttpError;
+exports.VISITOR_COOKIE = VISITOR_COOKIE;
+exports.buildUrl = buildUrl;
+exports.consentCookie = consentCookie;
+exports.consentCookieName = consentCookieName;
+exports.isBrowser = isBrowser;
+exports.visitorCookieName = visitorCookieName;
+//# sourceMappingURL=chunk-N5M4PI7C.cjs.map
+//# sourceMappingURL=chunk-N5M4PI7C.cjs.map

package/dist/chunk-N5M4PI7C.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/http-client.ts","../src/core/cookie-names.ts"],"names":[],"mappings":";;;AAOO,IAAM,gBAAA,GAAmB;AAGzB,SAAS,SAAA,GAAqB;AACnC,EAAA,OAAO,OAAO,MAAA,KAAW,WAAA,IAAe,OAAO,QAAA,KAAa,WAAA;AAC9D;AAGO,SAAS,QAAA,CAAS,KAAa,WAAA,EAA8C;AAClF,EAAA,IAAI,CAAC,eAAe,MAAA,CAAO,IAAA,CAAK,WAAW,CAAA,CAAE,MAAA,KAAW,GAAG,OAAO,GAAA;AAClE,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,WAAW,CAAA;AAC9C,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,QAAA,CAAS,GAAG,IAAI,GAAA,GAAM,GAAA;AACtC,EAAA,OAAO,GAAG,GAAG,CAAA,EAAG,GAAG,CAAA,EAAG,MAAA,CAAO,UAAU,CAAA,CAAA;AACzC;AAGA,SAAS,MAAM,EAAA,EAA2B;AACxC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AACzD;AA+BO,IAAM,SAAA,GAAN,cAAwB,KAAA,CAAM;AAAA,EACnC,WAAA,CACkB,MAAA,EACA,IAAA,EAChB,OAAA,EACA;AACA,IAAA,KAAA,CAAM,OAAA,IAAW,CAAA,2BAAA,EAA8B,MAAM,CAAA,CAAE,CAAA;AAJvC,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AACA,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAIhB,IAAA,IAAA,CAAK,IAAA,GAAO,WAAA;AAAA,EACd;AAAA,EANkB,MAAA;AAAA,EACA,IAAA;AAMpB;AAGO,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EAC1C,YAA4B,QAAA,EAAkB;AAC5C,IAAA,KAAA,CAAM,CAAA,iBAAA,EAAoB,QAAQ,CAAA,wCAAA,CAA0C,CAAA;AADlD,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAE1B,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AAAA,EACd;AAAA,EAH4B,QAAA;AAI9B;AAOA,IAAM,QAAA,uBAAe,GAAA,EAAoD;AAqBlE,IAAM,aAAN,MAAiB;AAAA,EACL,OAAA;AAAA,EACA,cAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,OAAA;AAAA,EAEjB,YAAY,IAAA,EAAyB;AACnC,IAAA,IAAA,CAAK,WAAW,IAAA,CAAK,OAAA,IAAW,gBAAA,EAAkB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AACpE,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAA,CAAK,cAAA,IAAkB,EAAC;AAC9C,IAAA,IAAA,CAAK,OAAA,GAAU,KAAK,OAAA,IAAW,GAAA;AAC/B,IAAA,IAAA,CAAK,KAAA,GAAQ;AAAA,MACX,QAAA,EAAU,IAAA,CAAK,KAAA,EAAO,QAAA,IAAY,CAAA;AAAA,MAClC,WAAA,EAAa,IAAA,CAAK,KAAA,EAAO,WAAA,IAAe;AAAA,KAC1C;AACA,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAK,KAAA,IAAS,KAAA;AAC3B,IAAA,MAAM,KAAK,IAAA,CAAK,cAAA,KAAmB,OAAO,EAAC,GAAI,KAAK,cAAA,IAAkB,IAAA;AACtE,IAAA,IAAA,CAAK,OAAA,GAAU,EAAA,IAAM,EAAE,gBAAA,EAAkB,EAAA,CAAG,oBAAoB,CAAA,EAAG,UAAA,EAAY,EAAA,CAAG,UAAA,IAAc,GAAA,EAAO;AAAA,EACzG;AAAA,EAEA,MAAM,QAAQ,IAAA,EAA2C;AACvD,IAAA,IAAI,CAAC,IAAA,CAAK,OAAA,EAAS,OAAO,IAAA,CAAK,KAAK,IAAI,CAAA;AAGxC,IAAA,MAAM,MAAM,QAAA,CAAS,IAAA,CAAK,UAAU,IAAA,CAAK,IAAA,EAAM,KAAK,KAAK,CAAA;AACzD,IAAA,MAAM,CAAA,GAAI,SAAS,GAAA,CAAI,GAAG,KAAK,EAAE,QAAA,EAAU,CAAA,EAAG,QAAA,EAAU,CAAA,EAAE;AAC1D,IAAA,IAAI,EAAE,QAAA,EAAU;AACd,MAAA,IAAI,IAAA,CAAK,GAAA,EAAI,GAAI,CAAA,CAAE,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,UAAA,EAAY,MAAM,IAAI,gBAAA,CAAiB,GAAG,CAAA;AAErF,MAAA,CAAA,CAAE,QAAA,GAAW,CAAA;AACb,MAAA,CAAA,CAAE,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,gBAAA,GAAmB,CAAA;AAAA,IAC/C;AACA,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,IAAA,CAAK,IAAI,CAAA;AACnC,MAAA,QAAA,CAAS,OAAO,GAAG,CAAA;AACnB,MAAA,OAAO,MAAA;AAAA,IACT,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,eAAe,SAAA,IAAa,CAAC,KAAK,iBAAA,CAAkB,GAAA,CAAI,MAAM,CAAA,EAAG;AACnE,QAAA,QAAA,CAAS,OAAO,GAAG,CAAA;AACnB,QAAA,MAAM,GAAA;AAAA,MACR;AACA,MAAA,CAAA,CAAE,QAAA,IAAY,CAAA;AACd,MAAA,IAAI,CAAA,CAAE,QAAA,IAAY,IAAA,CAAK,OAAA,CAAQ,gBAAA,EAAkB;AAC/C,QAAA,CAAA,CAAE,QAAA,GAAW,KAAK,GAAA,EAAI;AACtB,QAAA,IAAA,CAAK,IAAI,CAAA,mBAAA,EAAsB,IAAA,CAAK,IAAI,CAAA,OAAA,EAAU,CAAA,CAAE,QAAQ,CAAA,SAAA,CAAW,CAAA;AAAA,MACzE;AACA,MAAA,QAAA,CAAS,GAAA,CAAI,KAAK,CAAC,CAAA;AACnB,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAc,KAAK,IAAA,EAA2C;AAC5D,IAAA,MAAM,MAAM,QAAA,CAAS,IAAA,CAAK,UAAU,IAAA,CAAK,IAAA,EAAM,KAAK,KAAK,CAAA;AACzD,IAAA,MAAM,MAAA,GAAS,KAAK,MAAA,IAAU,KAAA;AAC9B,IAAA,MAAM,OAAA,GAAkC;AAAA,MACtC,cAAA,EAAgB,kBAAA;AAAA,MAChB,GAAG,IAAA,CAAK,cAAA;AAAA,MACR,GAAG,IAAA,CAAK;AAAA,KACV;AACA,IAAA,MAAM,IAAA,GAAO,KAAK,IAAA,KAAS,MAAA,GAAY,KAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,GAAI,MAAA;AACnE,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,IAAW,IAAA,CAAK,OAAA;AACrC,IAAA,MAAM,WAAA,GAAc,KAAK,OAAA,GAAU,CAAA,GAAA,CAAK,KAAK,KAAA,EAAO,QAAA,IAAY,IAAA,CAAK,KAAA,CAAM,QAAA,IAAY,CAAA;AACvF,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,EAAO,WAAA,IAAe,KAAK,KAAA,CAAM,WAAA;AAExD,IAAA,IAAI,SAAA;AACJ,IAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,GAAU,WAAA,EAAa,OAAA,EAAA,EAAW;AACtD,MAAA,IAAI;AACF,QAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,gBAAA;AAAA,UAC1B,GAAA;AAAA,UACA,EAAE,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,GAAI,IAAA,CAAK,SAAA,GAAY,EAAE,SAAA,EAAW,IAAA,EAAK,GAAI,EAAC,EAAG;AAAA,UACxE;AAAA,SACF;AACA,QAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAA;AAE1C,QAAA,IAAI,SAAS,EAAA,EAAI;AACf,UAAA,OAAO,EAAE,UAAU,IAAA,EAAK;AAAA,QAC1B;AAGA,QAAA,IAAI,KAAK,iBAAA,CAAkB,QAAA,CAAS,MAAM,CAAA,IAAK,OAAA,GAAU,cAAc,CAAA,EAAG;AACxE,UAAA,MAAM,IAAA,GAAO,IAAA,CAAK,YAAA,CAAa,QAAA,EAAU,WAAW,OAAO,CAAA;AAC3D,UAAA,IAAA,CAAK,GAAA,CAAI,YAAY,IAAA,CAAK,IAAI,UAAU,IAAI,CAAA,WAAA,EAAc,QAAA,CAAS,MAAM,CAAA,CAAA,CAAG,CAAA;AAC5E,UAAA,MAAM,MAAM,IAAI,CAAA;AAChB,UAAA;AAAA,QACF;AACA,QAAA,MAAM,IAAI,SAAA,CAAU,QAAA,CAAS,MAAA,EAAQ,IAAI,CAAA;AAAA,MAC3C,SAAS,GAAA,EAAK;AACZ,QAAA,SAAA,GAAY,GAAA;AAEZ,QAAA,IAAI,GAAA,YAAe,WAAW,MAAM,GAAA;AAEpC,QAAA,IAAI,OAAA,GAAU,cAAc,CAAA,EAAG;AAC7B,UAAA,MAAM,IAAA,GAAO,YAAY,CAAA,IAAK,OAAA;AAC9B,UAAA,IAAA,CAAK,IAAI,CAAA,SAAA,EAAY,IAAA,CAAK,IAAI,CAAA,OAAA,EAAU,IAAI,CAAA,kBAAA,CAAoB,CAAA;AAChE,UAAA,MAAM,MAAM,IAAI,CAAA;AAChB,UAAA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,IAAA,MAAM,SAAA,YAAqB,KAAA,GAAQ,SAAA,GAAY,IAAI,MAAM,gBAAgB,CAAA;AAAA,EAC3E;AAAA,EAEA,MAAc,gBAAA,CACZ,GAAA,EACA,IAAA,EACA,OAAA,EACmB;AACnB,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,OAAO,CAAA;AAC1D,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,MAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AAAA,IAChE,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAe,KAAA,IAAS,GAAA,CAAI,IAAA,KAAS,YAAA,EAAc;AACrD,QAAA,MAAM,IAAI,MAAM,CAAA,sBAAA,EAAyB,OAAO,MAAM,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,MACtE;AACA,MAAA,MAAM,GAAA;AAAA,IACR,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAAA,EACF;AAAA,EAEA,MAAc,UAAU,QAAA,EAAwC;AAC9D,IAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AACjD,IAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,IAAA,IAAI;AACF,MAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,IACxB,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,kBAAkB,MAAA,EAAyB;AACjD,IAAA,OAAO,MAAA,KAAW,GAAA,IAAQ,MAAA,IAAU,GAAA,IAAO,MAAA,IAAU,GAAA;AAAA,EACvD;AAAA,EAEQ,YAAA,CAAa,QAAA,EAAoB,SAAA,EAAmB,OAAA,EAAyB;AACnF,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AACjD,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,MAAM,OAAA,GAAU,OAAO,MAAM,CAAA;AAC7B,MAAA,IAAI,CAAC,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA,SAAU,OAAA,GAAU,GAAA;AAAA,IAC/C;AACA,IAAA,OAAO,YAAY,CAAA,IAAK,OAAA;AAAA,EAC1B;AAAA,EAEQ,IAAI,GAAA,EAAmB;AAC7B,IAAA,IAAI,KAAK,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,CAAA,QAAA,EAAW,GAAG,CAAA,CAAE,CAAA;AAAA,EAC/C;AACF;;;ACzOO,IAAM,cAAA,GAAiB;AAGvB,SAAS,iBAAA,CAAkB,SAAiB,cAAA,EAAwB;AACzE,EAAA,OAAO,CAAA,EAAG,UAAU,cAAc,CAAA,IAAA,CAAA;AACpC;AAGO,SAAS,iBAAA,CAAkB,SAAiB,cAAA,EAAwB;AACzE,EAAA,OAAO,CAAA,EAAG,UAAU,cAAc,CAAA,QAAA,CAAA;AACpC;AASO,IAAM,iBAAiB,iBAAA;AAMvB,IAAM,iBAAiB,iBAAA;AAOvB,SAAS,aAAA,CAAc,KAAA,EAAqB,MAAA,EAAiB,UAAA,GAAa,GAAA,EAAa;AAC5F,EAAA,OAAO,GAAG,iBAAA,CAAkB,MAAM,CAAC,CAAA,CAAA,EAAI,mBAAmB,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAC,CAAA,kBAAA,EAAqB,IAAA,CAAK,KAAA,CAAM,UAAA,GAAa,KAAK,CAAC,CAAA,cAAA,CAAA;AACrI","file":"chunk-N5M4PI7C.cjs","sourcesContent":["import type { CircuitBreakerConfig, HttpMethod, JsonValue, RetryConfig } from \"./types\";\n\n/**\n * Default Xenia backend base URL, used whenever `baseUrl` is omitted from\n * config. Points at the hosted engine — override only for a self-hosted or\n * non-default environment.\n */\nexport const DEFAULT_BASE_URL = \"https://engine.xeniamartech.com/xenia\";\n\n/** Returns true when running in a browser environment (SSR-safe). */\nexport function isBrowser(): boolean {\n  return typeof window !== \"undefined\" && typeof document !== \"undefined\";\n}\n\n/** Appends query parameters to a URL. Returns the URL unchanged when empty. */\nexport function buildUrl(url: string, queryParams?: Record<string, string>): string {\n  if (!queryParams || Object.keys(queryParams).length === 0) return url;\n  const params = new URLSearchParams(queryParams);\n  const sep = url.includes(\"?\") ? \"&\" : \"?\";\n  return `${url}${sep}${params.toString()}`;\n}\n\n/** Sleep helper used by the retry backoff. */\nfunction delay(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\n/** Options for a single request. */\nexport interface RequestOptions {\n  method?: HttpMethod;\n  /** Path appended to `baseUrl` (should start with `/`). */\n  path: string;\n  headers?: Record<string, string>;\n  query?: Record<string, string>;\n  body?: JsonValue;\n  /** Per-request timeout override in ms. */\n  timeout?: number;\n  /** Disable retry for this request (e.g. long-polling webhook). */\n  noRetry?: boolean;\n  /** Per-request retry override. */\n  retry?: RetryConfig;\n  /**\n   * Keep the request alive past page unload (`fetch`'s `keepalive` flag).\n   * Used for best-effort flushes on `pagehide`, where `sendBeacon` can't be\n   * used instead because it doesn't support custom headers (tenant scope).\n   */\n  keepalive?: boolean;\n}\n\n/** Result of a request: the raw Response plus the parsed JSON (or null). */\nexport interface HttpResult {\n  response: Response;\n  data: JsonValue;\n}\n\n/** Error thrown for non-2xx responses (after retries are exhausted). */\nexport class HttpError extends Error {\n  constructor(\n    public readonly status: number,\n    public readonly data: JsonValue,\n    message?: string,\n  ) {\n    super(message ?? `Request failed with status ${status}`);\n    this.name = \"HttpError\";\n  }\n}\n\n/** Thrown without a network call while an endpoint's circuit is open (see {@link CircuitBreakerConfig}). */\nexport class CircuitOpenError extends Error {\n  constructor(public readonly endpoint: string) {\n    super(`Circuit open for ${endpoint}: failing fast until the cooldown passes`);\n    this.name = \"CircuitOpenError\";\n  }\n}\n\n/**\n * Per-endpoint breaker state, module-wide so it outlives a single client.\n * ponytail: after the cooldown every concurrent caller probes, not just one; fine for a fail-fast\n * guard, add a probe lock if a thundering herd on recovery ever matters.\n */\nconst breakers = new Map<string, { failures: number; openedAt: number }>();\n\nexport interface HttpClientOptions {\n  /** Defaults to {@link DEFAULT_BASE_URL} when omitted. */\n  baseUrl?: string;\n  defaultHeaders?: Record<string, string>;\n  timeout?: number;\n  retry?: RetryConfig;\n  circuitBreaker?: boolean | CircuitBreakerConfig;\n  debug?: boolean;\n}\n\n/**\n * Minimal fetch wrapper shared by all runtimes.\n *\n * - Injects default headers (tenant scope, content-type).\n * - Applies an `AbortController` timeout.\n * - Retries transient failures (network error, `429`, `5xx`) with exponential\n *   backoff, honoring a `Retry-After` header when present.\n * - Parses JSON, falling back to `null` on empty/invalid bodies.\n */\nexport class HttpClient {\n  private readonly baseUrl: string;\n  private readonly defaultHeaders: Record<string, string>;\n  private readonly timeout: number;\n  private readonly retry: Required<RetryConfig>;\n  private readonly debug: boolean;\n  private readonly breaker: Required<CircuitBreakerConfig> | null;\n\n  constructor(opts: HttpClientOptions) {\n    this.baseUrl = (opts.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/+$/, \"\");\n    this.defaultHeaders = opts.defaultHeaders ?? {};\n    this.timeout = opts.timeout ?? 8000;\n    this.retry = {\n      attempts: opts.retry?.attempts ?? 2,\n      baseDelayMs: opts.retry?.baseDelayMs ?? 300,\n    };\n    this.debug = opts.debug ?? false;\n    const cb = opts.circuitBreaker === true ? {} : opts.circuitBreaker || null;\n    this.breaker = cb && { failureThreshold: cb.failureThreshold ?? 3, cooldownMs: cb.cooldownMs ?? 30_000 };\n  }\n\n  async request(opts: RequestOptions): Promise<HttpResult> {\n    if (!this.breaker) return this.send(opts);\n    // Keyed by full URL, query included: every webhook shares `/flow`, and one slow journey\n    // (`?id=`) must not short-circuit the others.\n    const key = buildUrl(this.baseUrl + opts.path, opts.query);\n    const b = breakers.get(key) ?? { failures: 0, openedAt: 0 };\n    if (b.openedAt) {\n      if (Date.now() - b.openedAt < this.breaker.cooldownMs) throw new CircuitOpenError(key);\n      // Half-open: let this call probe; one more failure re-opens.\n      b.openedAt = 0;\n      b.failures = this.breaker.failureThreshold - 1;\n    }\n    try {\n      const result = await this.send(opts);\n      breakers.delete(key);\n      return result;\n    } catch (err) {\n      if (err instanceof HttpError && !this.isRetryableStatus(err.status)) {\n        breakers.delete(key); // the backend answered: it's up\n        throw err;\n      }\n      b.failures += 1;\n      if (b.failures >= this.breaker.failureThreshold) {\n        b.openedAt = Date.now();\n        this.log(`circuit opened for ${opts.path} after ${b.failures} failures`);\n      }\n      breakers.set(key, b);\n      throw err;\n    }\n  }\n\n  private async send(opts: RequestOptions): Promise<HttpResult> {\n    const url = buildUrl(this.baseUrl + opts.path, opts.query);\n    const method = opts.method ?? \"GET\";\n    const headers: Record<string, string> = {\n      \"Content-Type\": \"application/json\",\n      ...this.defaultHeaders,\n      ...opts.headers,\n    };\n    const body = opts.body !== undefined ? JSON.stringify(opts.body) : undefined;\n    const timeout = opts.timeout ?? this.timeout;\n    const maxAttempts = opts.noRetry ? 1 : (opts.retry?.attempts ?? this.retry.attempts) + 1;\n    const baseDelay = opts.retry?.baseDelayMs ?? this.retry.baseDelayMs;\n\n    let lastError: unknown;\n    for (let attempt = 0; attempt < maxAttempts; attempt++) {\n      try {\n        const response = await this.fetchWithTimeout(\n          url,\n          { method, headers, body, ...(opts.keepalive ? { keepalive: true } : {}) },\n          timeout,\n        );\n        const data = await this.parseBody(response);\n\n        if (response.ok) {\n          return { response, data };\n        }\n\n        // Retry on 429/5xx if attempts remain; otherwise throw.\n        if (this.isRetryableStatus(response.status) && attempt < maxAttempts - 1) {\n          const wait = this.retryAfterMs(response, baseDelay, attempt);\n          this.log(`retrying ${opts.path} after ${wait}ms (status ${response.status})`);\n          await delay(wait);\n          continue;\n        }\n        throw new HttpError(response.status, data);\n      } catch (err) {\n        lastError = err;\n        // Non-retryable HttpError → rethrow immediately.\n        if (err instanceof HttpError) throw err;\n        // Network/timeout error → retry if attempts remain.\n        if (attempt < maxAttempts - 1) {\n          const wait = baseDelay * 2 ** attempt;\n          this.log(`retrying ${opts.path} after ${wait}ms (network error)`);\n          await delay(wait);\n          continue;\n        }\n      }\n    }\n    throw lastError instanceof Error ? lastError : new Error(\"Request failed\");\n  }\n\n  private async fetchWithTimeout(\n    url: string,\n    init: RequestInit,\n    timeout: number,\n  ): Promise<Response> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), timeout);\n    try {\n      return await fetch(url, { ...init, signal: controller.signal });\n    } catch (err) {\n      if (err instanceof Error && err.name === \"AbortError\") {\n        throw new Error(`Request timeout after ${timeout}ms`, { cause: err });\n      }\n      throw err;\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n\n  private async parseBody(response: Response): Promise<JsonValue> {\n    const text = await response.text().catch(() => \"\");\n    if (!text) return null;\n    try {\n      return JSON.parse(text) as JsonValue;\n    } catch {\n      return text;\n    }\n  }\n\n  private isRetryableStatus(status: number): boolean {\n    return status === 429 || (status >= 500 && status <= 599);\n  }\n\n  private retryAfterMs(response: Response, baseDelay: number, attempt: number): number {\n    const header = response.headers.get(\"Retry-After\");\n    if (header) {\n      const seconds = Number(header);\n      if (!Number.isNaN(seconds)) return seconds * 1000;\n    }\n    return baseDelay * 2 ** attempt;\n  }\n\n  private log(msg: string): void {\n    if (this.debug) console.warn(`[xenia] ${msg}`);\n  }\n}\n","/**\n * Cookie names shared by the browser and server halves of the SDK.\n *\n * The visitor cookie is the one channel where two runtimes must agree on a literal string: the\n * browser writes it, a same-origin server reads it back, and that match is what lets a server-side\n * conversion attribute to a browser-entered journey. `config.prefix` namespaces it — so two Xenia\n * apps on one domain keep separate visitors — which means **both halves must derive the name the\n * same way**. Deriving it on one side and hardcoding it on the other silently breaks the link for\n * anyone using a custom prefix: the server just finds no cookie and falls back to no visitor.\n *\n * Always build the name with these helpers rather than interpolating it by hand.\n */\n\nimport type { ConsentState } from \"./types\";\n\n/** Default storage/cookie prefix, matching `XeniaConfig.prefix`. */\nexport const DEFAULT_PREFIX = \"xenia\";\n\n/** Name of the first-party cookie carrying the SDK-owned visitor id, for a given prefix. */\nexport function visitorCookieName(prefix: string = DEFAULT_PREFIX): string {\n  return `${prefix || DEFAULT_PREFIX}_vid`;\n}\n\n/** Name of the first-party cookie carrying consent scopes, for a given prefix. */\nexport function consentCookieName(prefix: string = DEFAULT_PREFIX): string {\n  return `${prefix || DEFAULT_PREFIX}_consent`;\n}\n\n/**\n * The visitor cookie name for the DEFAULT prefix (`\"xenia_vid\"`).\n *\n * Correct for the common case, and kept so existing code (e.g. reading the cookie straight out of a\n * framework's cookie jar) keeps working. If you set `config.prefix`, use {@link visitorCookieName}\n * instead — this constant will not match what the browser wrote.\n */\nexport const VISITOR_COOKIE = visitorCookieName();\n\n/**\n * The consent cookie name for the DEFAULT prefix (`\"xenia_consent\"`). Same custom-prefix caveat as\n * {@link VISITOR_COOKIE}.\n */\nexport const CONSENT_COOKIE = consentCookieName();\n\n/**\n * A `document.cookie` string carrying consent, in the JSON form the server SDK's `getConsent()`\n * reads back. The browser client's `consent()` writes it; a page with its own consent banner and no\n * browser client can write it directly, so server-side calls see the visitor's choice.\n */\nexport function consentCookie(state: ConsentState, prefix?: string, maxAgeDays = 365): string {\n  return `${consentCookieName(prefix)}=${encodeURIComponent(JSON.stringify(state))}; path=/; max-age=${Math.floor(maxAgeDays * 86400)}; SameSite=Lax`;\n}\n"]}

package/dist/chunk-OMMIRSPK.js

@@ -0,0 +1,336 @@
+import { parseCookies } from './chunk-QEYONKWY.js';
+import { DEFAULT_PREFIX, consentCookieName, DEFAULT_BASE_URL } from './chunk-BQ5PJCZ7.js';
+
+// src/edge/consent.ts
+function edgeConsent(headers, opts = {}) {
+  const raw = parseCookies(headers.get("cookie"))[consentCookieName(opts.prefix)];
+  let consent = { personalization: true, analytics: true };
+  if (raw) {
+    try {
+      const parsed = JSON.parse(raw);
+      if (parsed && typeof parsed === "object") {
+        const p = parsed;
+        consent = { personalization: p.personalization !== false, analytics: p.analytics !== false };
+      }
+    } catch {
+      if (/^[a-z]+(\s*,\s*[a-z]+)*$/i.test(raw.trim())) {
+        const scopes = new Set(raw.split(",").map((s) => s.trim()));
+        consent = { personalization: scopes.has("personalization"), analytics: scopes.has("analytics") };
+      }
+    }
+  }
+  const privacySignal = headers.get("sec-gpc") === "1" || headers.get("dnt") === "1";
+  if (opts.respectDnt !== false && privacySignal) consent = { ...consent, analytics: false };
+  return consent;
+}
+
+// src/edge/request-facts.ts
+var GEO_KEYS = [
+  "country",
+  "countryName",
+  "region",
+  "regionName",
+  "city",
+  "postalCode",
+  "timeZone",
+  "latitude",
+  "longitude",
+  "source"
+];
+function toViewerGeo(g, source) {
+  if (!g) return void 0;
+  const country = typeof g.country === "string" ? g.country : g.country?.code;
+  if (!country) return void 0;
+  const raw = {
+    country: country.toUpperCase(),
+    countryName: g.countryName ?? (typeof g.country === "object" ? g.country?.name : void 0),
+    region: g.region ?? g.subdivision?.code,
+    regionName: g.regionName ?? g.subdivision?.name,
+    city: g.city,
+    postalCode: g.postalCode,
+    timeZone: g.timeZone ?? g.timezone,
+    latitude: g.latitude?.toString(),
+    longitude: g.longitude?.toString(),
+    source
+  };
+  const geo = {};
+  for (const k of GEO_KEYS) {
+    const v = raw[k];
+    if (typeof v === "string" && v && v.length <= 100) geo[k] = v;
+  }
+  return geo;
+}
+var parseJson = (text) => {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+};
+function safeDecode(v) {
+  try {
+    return decodeURIComponent(v);
+  } catch {
+    return v;
+  }
+}
+function safeBase64(v) {
+  try {
+    return atob(v);
+  } catch {
+    return "";
+  }
+}
+function netlifyContext() {
+  try {
+    return globalThis.Netlify?.context ?? void 0;
+  } catch {
+    return void 0;
+  }
+}
+var COUNTRY_HEADERS = ["x-country", "x-vercel-ip-country", "cloudfront-viewer-country", "cf-ipcountry"];
+function companions(h, country) {
+  const of = (name) => h.get(name) ?? void 0;
+  if (country === "x-vercel-ip-country") {
+    return { region: of("x-vercel-ip-country-region"), city: safeDecode(of("x-vercel-ip-city") ?? "") || void 0, timeZone: of("x-vercel-ip-timezone") };
+  }
+  if (country === "cloudfront-viewer-country") {
+    return { region: of("cloudfront-viewer-country-region"), city: safeDecode(of("cloudfront-viewer-city") ?? "") || void 0, timeZone: of("cloudfront-viewer-time-zone") };
+  }
+  return {};
+}
+function viewerGeo(request, opts = {}) {
+  const trusted = new Set(opts.trust ?? []);
+  const fromNetlify = toViewerGeo(netlifyContext()?.geo, "edge");
+  if (fromNetlify) return { geo: fromNetlify, via: "Netlify.context" };
+  const h = { get: (name) => trusted.has(name) ? request.headers.get(name) : null };
+  const xn = h.get("x-xn-geo");
+  const fromXn = xn ? toViewerGeo(parseJson(safeDecode(xn)), "edge") : void 0;
+  if (fromXn) return { geo: fromXn, via: "x-xn-geo (edge function)" };
+  const fromRuntime = toViewerGeo(request.geo, "edge");
+  if (fromRuntime) return { geo: fromRuntime, via: "request.geo" };
+  const nf = h.get("x-nf-geo");
+  if (nf) {
+    const fromNf = toViewerGeo(parseJson(safeBase64(nf)) ?? parseJson(safeDecode(nf)), "edge");
+    if (fromNf) return { geo: fromNf, via: "x-nf-geo" };
+  }
+  const via = COUNTRY_HEADERS.find((n) => h.get(n));
+  const headerCountry = via ? h.get(via) : null;
+  if (via && headerCountry && /^[a-z]{2}$/i.test(headerCountry)) {
+    const geo = toViewerGeo(
+      {
+        country: headerCountry,
+        // The region, city and time zone of the same provider as the country header.
+        ...companions(request.headers, via)
+      },
+      "edge"
+    );
+    return { geo, via };
+  }
+  const override = new URL(request.url).searchParams.get("xn_country");
+  if (opts.devOverride && override && /^[a-z]{2}$/i.test(override)) {
+    return { geo: { country: override.toUpperCase(), source: "dev" }, via: "?xn_country (dev)" };
+  }
+  return { via: "none" };
+}
+function deviceOf(headers) {
+  const ua = headers.get("user-agent") ?? "";
+  if (/iPad|Tablet/i.test(ua)) return "tablet";
+  if (headers.get("sec-ch-ua-mobile") === "?1" || /Mobi|Android|iPhone/i.test(ua)) return "mobile";
+  return "desktop";
+}
+var BOT = /bot|crawl|spider|slurp|facebookexternalhit|embedly|preview|whatsapp|bingpreview/i;
+function isBot(userAgent) {
+  return BOT.test(userAgent ?? "");
+}
+function isPrefetch(headers) {
+  return headers.has("next-router-prefetch") || /prefetch/i.test(headers.get("purpose") ?? "") || /prefetch/i.test(headers.get("sec-purpose") ?? "");
+}
+function isPageLoad(headers) {
+  return (headers.get("sec-fetch-dest") ?? "document") === "document" && !isPrefetch(headers);
+}
+var UTM = {
+  utm_source: "utmSource",
+  utm_medium: "utmMedium",
+  utm_campaign: "utmCampaign",
+  utm_content: "utmContent",
+  utm_term: "utmTerm",
+  utm_id: "utmId"
+};
+function landingContext(url, referrer, saved) {
+  const fromQuery = {};
+  for (const [param, fact] of Object.entries(UTM)) {
+    const v = url.searchParams.get(param);
+    if (v) fromQuery[fact] = v.slice(0, 200);
+  }
+  const external = referrer && !referrer.startsWith(url.origin) ? referrer.slice(0, 500) : null;
+  let kept;
+  try {
+    const parsed = saved ? JSON.parse(saved) : null;
+    kept = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    kept = null;
+  }
+  if (kept && !Object.keys(fromQuery).length) return { ctx: kept, changed: false };
+  return { ctx: { ...fromQuery, ...external ? { referrer: external } : {} }, changed: true };
+}
+var WEEKDAYS = ["sunday", "monday", "tuesday", "wednesday", "thursday", "friday", "saturday"];
+function seasonOf(month, southernHemisphere = false) {
+  const north = ["winter", "winter", "spring", "spring", "spring", "summer", "summer", "summer", "fall", "fall", "fall", "winter"];
+  const season = north[(month - 1 + 12) % 12];
+  if (!southernHemisphere) return season;
+  return { winter: "summer", summer: "winter", spring: "fall", fall: "spring" }[season] ?? season;
+}
+function validTimeZone(tz) {
+  if (!tz) return void 0;
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: tz });
+    return tz;
+  } catch {
+    return void 0;
+  }
+}
+function localTime(geo, now) {
+  const timeZone = validTimeZone(geo?.timeZone) ?? "UTC";
+  const parts = Object.fromEntries(
+    new Intl.DateTimeFormat("en-US", { timeZone, weekday: "long", month: "numeric", hour: "numeric", hourCycle: "h23" }).formatToParts(now).map((p) => [p.type, p.value])
+  );
+  const weekday = String(parts.weekday ?? WEEKDAYS[now.getUTCDay()]).toLowerCase();
+  const month = Number(parts.month) || now.getUTCMonth() + 1;
+  return {
+    local_weekday: weekday,
+    local_month: month,
+    local_hour: Number(parts.hour) % 24,
+    is_weekend: weekday === "saturday" || weekday === "sunday",
+    season: seasonOf(month, Number(geo?.latitude) < 0)
+  };
+}
+
+// src/edge/trail.ts
+var MAX_TRAIL = 8;
+var TRAIL_MAX_AGE_S = 30 * 60;
+function trailCookieName(prefix = DEFAULT_PREFIX) {
+  return `${prefix}_trail`;
+}
+var decode = (v) => {
+  try {
+    return decodeURIComponent(v);
+  } catch {
+    return v;
+  }
+};
+function readTrail(value) {
+  if (!value) return [];
+  try {
+    const parsed = JSON.parse(decode(value));
+    if (!Array.isArray(parsed)) return [];
+    return parsed.filter((t) => Array.isArray(t) && typeof t[0] === "string" && typeof t[1] === "number").slice(0, MAX_TRAIL).map(
+      ([path, at, seconds]) => typeof seconds === "number" && seconds >= 0 && seconds <= 86400 ? { path, at, seconds } : { path, at }
+    );
+  } catch {
+    return [];
+  }
+}
+function withView(trail, path, now = Date.now()) {
+  if (trail[0]?.path === path) return trail;
+  const earlier = trail.find((t) => t.path === path);
+  return [{ path, at: earlier?.at ?? now }, ...trail.filter((t) => t.path !== path)].slice(0, MAX_TRAIL);
+}
+function trailCookieValue(trail) {
+  return JSON.stringify(
+    trail.slice(0, MAX_TRAIL).map((t) => t.seconds === void 0 ? [t.path, t.at] : [t.path, t.at, t.seconds])
+  );
+}
+
+// src/edge/webhook.ts
+var enc = new TextEncoder();
+async function hmacHex(secret, payload) {
+  const key = await crypto.subtle.importKey("raw", enc.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const mac = new Uint8Array(await crypto.subtle.sign("HMAC", key, enc.encode(payload)));
+  return Array.from(mac, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+function sameString(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+async function verifyWebhook(input, secret, toleranceS = 300) {
+  const header = input.headers.get("x-xenia-signature") ?? "";
+  if (!secret || !header) return false;
+  const parts = Object.fromEntries(header.split(",").map((p) => p.trim().split("=", 2)));
+  const t = Number(parts.t);
+  if (!Number.isFinite(t) || Math.abs(Date.now() / 1e3 - t) > toleranceS || !parts.v1) return false;
+  return sameString(await hmacHex(secret, `${parts.t}.${input.body}`), String(parts.v1).toLowerCase());
+}
+
+// src/edge/variant.ts
+var MAX_PAYLOAD = 4096;
+var enc2 = new TextEncoder();
+var b64url = (bytes) => btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+var fromB64url = (s) => Uint8Array.from(atob(s.replace(/-/g, "+").replace(/_/g, "/")), (c) => c.charCodeAt(0));
+var keys = /* @__PURE__ */ new Map();
+var keyFor = (secret) => {
+  let key = keys.get(secret);
+  if (!key) {
+    key = crypto.subtle.importKey("raw", enc2.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    keys.set(secret, key);
+  }
+  return key;
+};
+async function sign(secret, payload) {
+  const mac = await crypto.subtle.sign("HMAC", await keyFor(secret), enc2.encode(payload));
+  return b64url(new Uint8Array(mac).slice(0, 16));
+}
+function swapGroups(decisions) {
+  const byBase = /* @__PURE__ */ new Map();
+  for (const d of decisions) {
+    if (!d.personalized || !d.baseEntryId) continue;
+    for (const s of d.swaps) {
+      if (!s.identifier || !s.replacementEntryId) continue;
+      if (!byBase.has(d.baseEntryId)) byBase.set(d.baseEntryId, /* @__PURE__ */ new Map());
+      byBase.get(d.baseEntryId).set(s.identifier, [s.identifier, s.replacementEntryId, d.contentKey]);
+    }
+  }
+  return [...byBase.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([base, swaps]) => ({ base, swaps: [...swaps.values()].sort(([a], [b]) => a.localeCompare(b)) }));
+}
+async function encodeVariant(groups, secret, extra) {
+  const g = groups.map((x) => [x.base, x.swaps]);
+  const payloadOf = (x) => b64url(enc2.encode(JSON.stringify(x === void 0 ? { g } : { g, x })));
+  let payload = payloadOf(extra);
+  if (payload.length > MAX_PAYLOAD && extra !== void 0) payload = payloadOf(void 0);
+  return `${payload}.${await sign(secret, payload)}`;
+}
+async function decodeVariant(token, secret) {
+  const [payload, mac, rest] = token.split(".");
+  if (!payload || !mac || rest !== void 0 || payload.length > MAX_PAYLOAD) return null;
+  if (!sameString(await sign(secret, payload), mac)) return null;
+  try {
+    const raw = JSON.parse(new TextDecoder().decode(fromB64url(payload)));
+    const groups = raw.g.map(([base, swaps]) => ({ base, swaps }));
+    return raw.x === void 0 ? { groups } : { groups, extra: raw.x };
+  } catch {
+    return null;
+  }
+}
+
+// src/edge/manifest.ts
+async function fetchManifest(opts) {
+  const base = (opts.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+  const res = await (opts.fetch ?? fetch)(`${base}/api/personalization/edge/manifest`, {
+    ...opts.init,
+    headers: { Authorization: `Bearer ${opts.token}` },
+    signal: AbortSignal.timeout(opts.timeoutMs ?? 5e3)
+  });
+  if (!res.ok) throw new Error(`[xenia] manifest ${res.status}`);
+  return await res.json();
+}
+function trimManifest(m) {
+  const pages = /* @__PURE__ */ new Set();
+  for (const k of m.keys ?? []) if (k.mode !== "off") for (const p of k.pages ?? []) pages.add(p);
+  return { version: m.version, pages: [...pages].sort() };
+}
+
+export { MAX_TRAIL, TRAIL_MAX_AGE_S, decodeVariant, deviceOf, edgeConsent, encodeVariant, fetchManifest, isBot, isPageLoad, isPrefetch, landingContext, localTime, readTrail, seasonOf, swapGroups, trailCookieName, trailCookieValue, trimManifest, verifyWebhook, viewerGeo, withView };
+//# sourceMappingURL=chunk-OMMIRSPK.js.map
+//# sourceMappingURL=chunk-OMMIRSPK.js.map

package/dist/chunk-OMMIRSPK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/edge/consent.ts","../src/edge/request-facts.ts","../src/edge/trail.ts","../src/edge/webhook.ts","../src/edge/variant.ts","../src/edge/manifest.ts"],"names":["enc"],"mappings":";;;;AAqBO,SAAS,WAAA,CAAY,OAAA,EAAkB,IAAA,GAAkD,EAAC,EAAgB;AAC/G,EAAA,MAAM,GAAA,GAAM,YAAA,CAAa,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAC,CAAA,CAAE,iBAAA,CAAkB,IAAA,CAAK,MAAM,CAAC,CAAA;AAC9E,EAAA,IAAI,OAAA,GAAuB,EAAE,eAAA,EAAiB,IAAA,EAAM,WAAW,IAAA,EAAK;AACpE,EAAA,IAAI,GAAA,EAAK;AACP,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAkB,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AACtC,MAAA,IAAI,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AACxC,QAAA,MAAM,CAAA,GAAI,MAAA;AACV,QAAA,OAAA,GAAU,EAAE,iBAAiB,CAAA,CAAE,eAAA,KAAoB,OAAO,SAAA,EAAW,CAAA,CAAE,cAAc,KAAA,EAAM;AAAA,MAC7F;AAAA,IACF,CAAA,CAAA,MAAQ;AACN,MAAA,IAAI,2BAAA,CAA4B,IAAA,CAAK,GAAA,CAAI,IAAA,EAAM,CAAA,EAAG;AAChD,QAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AAC1D,QAAA,OAAA,GAAU,EAAE,eAAA,EAAiB,MAAA,CAAO,GAAA,CAAI,iBAAiB,GAAG,SAAA,EAAW,MAAA,CAAO,GAAA,CAAI,WAAW,CAAA,EAAE;AAAA,MACjG;AAAA,IACF;AAAA,EACF;AACA,EAAA,MAAM,aAAA,GAAgB,QAAQ,GAAA,CAAI,SAAS,MAAM,GAAA,IAAO,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA,KAAM,GAAA;AAC/E,EAAA,IAAI,IAAA,CAAK,eAAe,KAAA,IAAS,aAAA,YAAyB,EAAE,GAAG,OAAA,EAAS,SAAA,EAAW,KAAA,EAAM;AACzF,EAAA,OAAO,OAAA;AACT;;;ACnCA,IAAM,QAAA,GAAW;AAAA,EACf,SAAA;AAAA,EACA,aAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,MAAA;AAAA,EACA,YAAA;AAAA,EACA,UAAA;AAAA,EACA,UAAA;AAAA,EACA,WAAA;AAAA,EACA;AACF,CAAA;AAkBA,SAAS,WAAA,CAAY,GAAwB,MAAA,EAAuC;AAClF,EAAA,IAAI,CAAC,GAAG,OAAO,MAAA;AACf,EAAA,MAAM,OAAA,GAAU,OAAO,CAAA,CAAE,OAAA,KAAY,WAAW,CAAA,CAAE,OAAA,GAAU,EAAE,OAAA,EAAS,IAAA;AACvE,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,MAAM,GAAA,GAA+B;AAAA,IACnC,OAAA,EAAS,QAAQ,WAAA,EAAY;AAAA,IAC7B,WAAA,EAAa,EAAE,WAAA,KAAgB,OAAO,EAAE,OAAA,KAAY,QAAA,GAAW,CAAA,CAAE,OAAA,EAAS,IAAA,GAAO,MAAA,CAAA;AAAA,IACjF,MAAA,EAAQ,CAAA,CAAE,MAAA,IAAU,CAAA,CAAE,WAAA,EAAa,IAAA;AAAA,IACnC,UAAA,EAAY,CAAA,CAAE,UAAA,IAAc,CAAA,CAAE,WAAA,EAAa,IAAA;AAAA,IAC3C,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,YAAY,CAAA,CAAE,UAAA;AAAA,IACd,QAAA,EAAU,CAAA,CAAE,QAAA,IAAY,CAAA,CAAE,QAAA;AAAA,IAC1B,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,QAAA,EAAS;AAAA,IAC/B,SAAA,EAAW,CAAA,CAAE,SAAA,EAAW,QAAA,EAAS;AAAA,IACjC;AAAA,GACF;AACA,EAAA,MAAM,MAAiB,EAAC;AACxB,EAAA,KAAA,MAAW,KAAK,QAAA,EAAU;AACxB,IAAA,MAAM,CAAA,GAAI,IAAI,CAAC,CAAA;AACf,IAAA,IAAI,OAAO,MAAM,QAAA,IAAY,CAAA,IAAK,EAAE,MAAA,IAAU,GAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,CAAA;AAAA,EAC9D;AACA,EAAA,OAAO,GAAA;AACT;AAEA,IAAM,SAAA,GAAY,CAAC,IAAA,KAAsC;AACvD,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF,CAAA;AAEA,SAAS,WAAW,CAAA,EAAmB;AACrC,EAAA,IAAI;AACF,IAAA,OAAO,mBAAmB,CAAC,CAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,CAAA;AAAA,EACT;AACF;AAEA,SAAS,WAAW,CAAA,EAAmB;AACrC,EAAA,IAAI;AACF,IAAA,OAAO,KAAK,CAAC,CAAA;AAAA,EACf,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAA;AAAA,EACT;AACF;AAGA,SAAS,cAAA,GAAgD;AACvD,EAAA,IAAI;AACF,IAAA,OAAQ,UAAA,CAA+E,SAAS,OAAA,IAAW,KAAA,CAAA;AAAA,EAC7G,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,IAAM,eAAA,GAAkB,CAAC,WAAA,EAAa,qBAAA,EAAuB,6BAA6B,cAAc,CAAA;AAKxG,SAAS,UAAA,CAAW,GAAY,OAAA,EAA0B;AACxD,EAAA,MAAM,KAAK,CAAC,IAAA,KAAiB,CAAA,CAAE,GAAA,CAAI,IAAI,CAAA,IAAK,MAAA;AAC5C,EAAA,IAAI,YAAY,qBAAA,EAAuB;AACrC,IAAA,OAAO,EAAE,MAAA,EAAQ,EAAA,CAAG,4BAA4B,CAAA,EAAG,MAAM,UAAA,CAAW,EAAA,CAAG,kBAAkB,CAAA,IAAK,EAAE,CAAA,IAAK,MAAA,EAAW,QAAA,EAAU,EAAA,CAAG,sBAAsB,CAAA,EAAE;AAAA,EACvJ;AACA,EAAA,IAAI,YAAY,2BAAA,EAA6B;AAC3C,IAAA,OAAO,EAAE,MAAA,EAAQ,EAAA,CAAG,kCAAkC,CAAA,EAAG,MAAM,UAAA,CAAW,EAAA,CAAG,wBAAwB,CAAA,IAAK,EAAE,CAAA,IAAK,MAAA,EAAW,QAAA,EAAU,EAAA,CAAG,6BAA6B,CAAA,EAAE;AAAA,EAC1K;AACA,EAAA,OAAO,EAAC;AACV;AAkBO,SAAS,SAAA,CACd,OAAA,EACA,IAAA,GAAgE,EAAC,EAC/B;AAClC,EAAA,MAAM,UAAU,IAAI,GAAA,CAAY,IAAA,CAAK,KAAA,IAAS,EAAE,CAAA;AAChD,EAAA,MAAM,WAAA,GAAc,WAAA,CAAY,cAAA,EAAe,EAAG,KAAK,MAAM,CAAA;AAC7D,EAAA,IAAI,aAAa,OAAO,EAAE,GAAA,EAAK,WAAA,EAAa,KAAK,iBAAA,EAAkB;AAEnE,EAAA,MAAM,CAAA,GAAI,EAAE,GAAA,EAAK,CAAC,SAAkB,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA,GAAI,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,IAAI,IAAI,IAAA,EAAM;AAC1F,EAAA,MAAM,EAAA,GAAK,CAAA,CAAE,GAAA,CAAI,UAAU,CAAA;AAC3B,EAAA,MAAM,MAAA,GAAS,KAAK,WAAA,CAAY,SAAA,CAAU,WAAW,EAAE,CAAC,CAAA,EAAG,MAAM,CAAA,GAAI,MAAA;AACrE,EAAA,IAAI,QAAQ,OAAO,EAAE,GAAA,EAAK,MAAA,EAAQ,KAAK,0BAAA,EAA2B;AAElE,EAAA,MAAM,WAAA,GAAc,WAAA,CAAa,OAAA,CAAyC,GAAA,EAAK,MAAM,CAAA;AACrF,EAAA,IAAI,aAAa,OAAO,EAAE,GAAA,EAAK,WAAA,EAAa,KAAK,aAAA,EAAc;AAE/D,EAAA,MAAM,EAAA,GAAK,CAAA,CAAE,GAAA,CAAI,UAAU,CAAA;AAC3B,EAAA,IAAI,EAAA,EAAI;AACN,IAAA,MAAM,MAAA,GAAS,WAAA,CAAY,SAAA,CAAU,UAAA,CAAW,EAAE,CAAC,CAAA,IAAK,SAAA,CAAU,UAAA,CAAW,EAAE,CAAC,CAAA,EAAG,MAAM,CAAA;AACzF,IAAA,IAAI,QAAQ,OAAO,EAAE,GAAA,EAAK,MAAA,EAAQ,KAAK,UAAA,EAAW;AAAA,EACpD;AAEA,EAAA,MAAM,GAAA,GAAM,gBAAgB,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,GAAA,CAAI,CAAC,CAAC,CAAA;AAChD,EAAA,MAAM,aAAA,GAAgB,GAAA,GAAM,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,GAAI,IAAA;AACzC,EAAA,IAAI,GAAA,IAAO,aAAA,IAAiB,aAAA,CAAc,IAAA,CAAK,aAAa,CAAA,EAAG;AAC7D,IAAA,MAAM,GAAA,GAAM,WAAA;AAAA,MACV;AAAA,QACE,OAAA,EAAS,aAAA;AAAA;AAAA,QAET,GAAG,UAAA,CAAW,OAAA,CAAQ,OAAA,EAAS,GAAG;AAAA,OACpC;AAAA,MACA;AAAA,KACF;AACA,IAAA,OAAO,EAAE,KAAK,GAAA,EAAI;AAAA,EACpB;AAEA,EAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA,CAAE,YAAA,CAAa,IAAI,YAAY,CAAA;AACnE,EAAA,IAAI,KAAK,WAAA,IAAe,QAAA,IAAY,aAAA,CAAc,IAAA,CAAK,QAAQ,CAAA,EAAG;AAChE,IAAA,OAAO,EAAE,GAAA,EAAK,EAAE,OAAA,EAAS,QAAA,CAAS,WAAA,EAAY,EAAG,MAAA,EAAQ,KAAA,EAAM,EAAG,GAAA,EAAK,mBAAA,EAAoB;AAAA,EAC7F;AACA,EAAA,OAAO,EAAE,KAAK,MAAA,EAAO;AACvB;AAEO,SAAS,SAAS,OAAA,EAAmD;AAC1E,EAAA,MAAM,EAAA,GAAK,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA,IAAK,EAAA;AACxC,EAAA,IAAI,cAAA,CAAe,IAAA,CAAK,EAAE,CAAA,EAAG,OAAO,QAAA;AACpC,EAAA,IAAI,OAAA,CAAQ,IAAI,kBAAkB,CAAA,KAAM,QAAQ,sBAAA,CAAuB,IAAA,CAAK,EAAE,CAAA,EAAG,OAAO,QAAA;AACxF,EAAA,OAAO,SAAA;AACT;AAEA,IAAM,GAAA,GAAM,kFAAA;AAGL,SAAS,MAAM,SAAA,EAA+C;AACnE,EAAA,OAAO,GAAA,CAAI,IAAA,CAAK,SAAA,IAAa,EAAE,CAAA;AACjC;AAGO,SAAS,WAAW,OAAA,EAA2B;AACpD,EAAA,OACE,QAAQ,GAAA,CAAI,sBAAsB,KAClC,WAAA,CAAY,IAAA,CAAK,QAAQ,GAAA,CAAI,SAAS,CAAA,IAAK,EAAE,KAC7C,WAAA,CAAY,IAAA,CAAK,QAAQ,GAAA,CAAI,aAAa,KAAK,EAAE,CAAA;AAErD;AAMO,SAAS,WAAW,OAAA,EAA2B;AACpD,EAAA,OAAA,CAAQ,OAAA,CAAQ,IAAI,gBAAgB,CAAA,IAAK,gBAAgB,UAAA,IAAc,CAAC,WAAW,OAAO,CAAA;AAC5F;AAEA,IAAM,GAAA,GAA8B;AAAA,EAClC,UAAA,EAAY,WAAA;AAAA,EACZ,UAAA,EAAY,WAAA;AAAA,EACZ,YAAA,EAAc,aAAA;AAAA,EACd,WAAA,EAAa,YAAA;AAAA,EACb,QAAA,EAAU,SAAA;AAAA,EACV,MAAA,EAAQ;AACV,CAAA;AAOO,SAAS,cAAA,CACd,GAAA,EACA,QAAA,EACA,KAAA,EACmD;AACnD,EAAA,MAAM,YAAoC,EAAC;AAC3C,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,IAAI,KAAK,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,EAAG;AAC/C,IAAA,MAAM,CAAA,GAAI,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,KAAK,CAAA;AACpC,IAAA,IAAI,GAAG,SAAA,CAAU,IAAI,IAAI,CAAA,CAAE,KAAA,CAAM,GAAG,GAAG,CAAA;AAAA,EACzC;AACA,EAAA,MAAM,QAAA,GAAW,QAAA,IAAY,CAAC,QAAA,CAAS,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA,GAAI,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA,GAAI,IAAA;AAEzF,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAkB,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,KAAK,CAAA,GAAI,IAAA;AACpD,IAAA,IAAA,GAAO,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,GAAK,MAAA,GAAoC,IAAA;AAAA,EAC/G,CAAA,CAAA,MAAQ;AACN,IAAA,IAAA,GAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI,IAAA,IAAQ,CAAC,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA,CAAE,MAAA,EAAQ,OAAO,EAAE,GAAA,EAAK,IAAA,EAAM,OAAA,EAAS,KAAA,EAAM;AAC/E,EAAA,OAAO,EAAE,GAAA,EAAK,EAAE,GAAG,WAAW,GAAI,QAAA,GAAW,EAAE,QAAA,EAAU,UAAS,GAAI,EAAC,EAAG,EAAG,SAAS,IAAA,EAAK;AAC7F;AAEA,IAAM,QAAA,GAAW,CAAC,QAAA,EAAU,QAAA,EAAU,WAAW,WAAA,EAAa,UAAA,EAAY,UAAU,UAAU,CAAA;AAGvF,SAAS,QAAA,CAAS,KAAA,EAAe,kBAAA,GAAqB,KAAA,EAAe;AAC1E,EAAA,MAAM,KAAA,GAAQ,CAAC,QAAA,EAAU,QAAA,EAAU,QAAA,EAAU,QAAA,EAAU,QAAA,EAAU,QAAA,EAAU,QAAA,EAAU,QAAA,EAAU,MAAA,EAAQ,MAAA,EAAQ,QAAQ,QAAQ,CAAA;AAC/H,EAAA,MAAM,MAAA,GAAS,KAAA,CAAA,CAAO,KAAA,GAAQ,CAAA,GAAI,MAAM,EAAE,CAAA;AAC1C,EAAA,IAAI,CAAC,oBAAoB,OAAO,MAAA;AAChC,EAAA,OAAQ,EAAE,MAAA,EAAQ,QAAA,EAAU,MAAA,EAAQ,QAAA,EAAU,MAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,QAAA,EAAS,CAA6B,MAAM,CAAA,IAAK,MAAA;AACvH;AAEA,SAAS,cAAc,EAAA,EAA4C;AACjE,EAAA,IAAI,CAAC,IAAI,OAAO,MAAA;AAChB,EAAA,IAAI;AACF,IAAA,IAAI,KAAK,cAAA,CAAe,OAAA,EAAS,EAAE,QAAA,EAAU,IAAI,CAAA;AACjD,IAAA,OAAO,EAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAWO,SAAS,SAAA,CAAU,KAA4B,GAAA,EAAsB;AAC1E,EAAA,MAAM,QAAA,GAAW,aAAA,CAAc,GAAA,EAAK,QAAQ,CAAA,IAAK,KAAA;AACjD,EAAA,MAAM,QAAQ,MAAA,CAAO,WAAA;AAAA,IACnB,IAAI,IAAA,CAAK,cAAA,CAAe,OAAA,EAAS,EAAE,QAAA,EAAU,OAAA,EAAS,MAAA,EAAQ,KAAA,EAAO,SAAA,EAAW,IAAA,EAAM,SAAA,EAAW,SAAA,EAAW,KAAA,EAAO,CAAA,CAChH,aAAA,CAAc,GAAG,CAAA,CACjB,GAAA,CAAI,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,KAAK,CAAC;AAAA,GACjC;AACA,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,KAAA,CAAM,OAAA,IAAW,QAAA,CAAS,IAAI,SAAA,EAAW,CAAC,CAAA,CAAE,WAAA,EAAY;AAC/E,EAAA,MAAM,QAAQ,MAAA,CAAO,KAAA,CAAM,KAAK,CAAA,IAAK,GAAA,CAAI,aAAY,GAAI,CAAA;AACzD,EAAA,OAAO;AAAA,IACL,aAAA,EAAe,OAAA;AAAA,IACf,WAAA,EAAa,KAAA;AAAA,IACb,UAAA,EAAY,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA,GAAI,EAAA;AAAA,IACjC,UAAA,EAAY,OAAA,KAAY,UAAA,IAAc,OAAA,KAAY,QAAA;AAAA,IAClD,QAAQ,QAAA,CAAS,KAAA,EAAO,OAAO,GAAA,EAAK,QAAQ,IAAI,CAAC;AAAA,GACnD;AACF;;;AC/QO,IAAM,SAAA,GAAY;AAElB,IAAM,kBAAkB,EAAA,GAAK;AAE7B,SAAS,eAAA,CAAgB,SAAiB,cAAA,EAAwB;AACvE,EAAA,OAAO,GAAG,MAAM,CAAA,MAAA,CAAA;AAClB;AAEA,IAAM,MAAA,GAAS,CAAC,CAAA,KAAc;AAC5B,EAAA,IAAI;AACF,IAAA,OAAO,mBAAmB,CAAC,CAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,CAAA;AAAA,EACT;AACF,CAAA;AAGO,SAAS,UAAU,KAAA,EAA+C;AACvE,EAAA,IAAI,CAAC,KAAA,EAAO,OAAO,EAAC;AACpB,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAkB,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AAChD,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,SAAU,EAAC;AACpC,IAAA,OAAO,MAAA,CACJ,OAAO,CAAC,CAAA,KAAsC,MAAM,OAAA,CAAQ,CAAC,CAAA,IAAK,OAAO,CAAA,CAAE,CAAC,MAAM,QAAA,IAAY,OAAO,EAAE,CAAC,CAAA,KAAM,QAAQ,CAAA,CACtH,KAAA,CAAM,CAAA,EAAG,SAAS,CAAA,CAClB,GAAA;AAAA,MAAI,CAAC,CAAC,IAAA,EAAM,EAAA,EAAI,OAAO,CAAA,KACtB,OAAO,YAAY,QAAA,IAAY,OAAA,IAAW,KAAK,OAAA,IAAW,KAAA,GAAS,EAAE,IAAA,EAAM,EAAA,EAAI,SAAQ,GAAI,EAAE,MAAM,EAAA;AAAG,KACxG;AAAA,EACJ,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAMO,SAAS,SAAS,KAAA,EAAoB,IAAA,EAAc,GAAA,GAAc,IAAA,CAAK,KAAI,EAAgB;AAChG,EAAA,IAAI,KAAA,CAAM,CAAC,CAAA,EAAG,IAAA,KAAS,MAAM,OAAO,KAAA;AACpC,EAAA,MAAM,UAAU,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,IAAI,CAAA;AACjD,EAAA,OAAO,CAAC,EAAE,IAAA,EAAM,EAAA,EAAI,SAAS,EAAA,IAAM,GAAA,IAAO,GAAG,KAAA,CAAM,OAAO,CAAC,CAAA,KAAM,EAAE,IAAA,KAAS,IAAI,CAAC,CAAA,CAAE,KAAA,CAAM,GAAG,SAAS,CAAA;AACvG;AAGO,SAAS,iBAAiB,KAAA,EAA4B;AAC3D,EAAA,OAAO,IAAA,CAAK,SAAA;AAAA,IACV,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,SAAS,CAAA,CAAE,IAAI,CAAC,CAAA,KAAO,CAAA,CAAE,OAAA,KAAY,MAAA,GAAY,CAAC,EAAE,IAAA,EAAM,CAAA,CAAE,EAAE,CAAA,GAAI,CAAC,CAAA,CAAE,MAAM,CAAA,CAAE,EAAA,EAAI,CAAA,CAAE,OAAO,CAAE;AAAA,GAC7G;AACF;;;ACzDA,IAAM,GAAA,GAAM,IAAI,WAAA,EAAY;AAE5B,eAAe,OAAA,CAAQ,QAAgB,OAAA,EAAkC;AACvE,EAAA,MAAM,MAAM,MAAM,MAAA,CAAO,OAAO,SAAA,CAAU,KAAA,EAAO,IAAI,MAAA,CAAO,MAAM,GAAG,EAAE,IAAA,EAAM,QAAQ,IAAA,EAAM,SAAA,IAAa,KAAA,EAAO,CAAC,MAAM,CAAC,CAAA;AACvH,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,MAAA,EAAQ,GAAA,EAAK,GAAA,CAAI,MAAA,CAAO,OAAO,CAAC,CAAC,CAAA;AACrF,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,GAAA,EAAK,CAAC,MAAM,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AACxE;AAGO,SAAS,UAAA,CAAW,GAAW,CAAA,EAAoB;AACxD,EAAA,IAAI,CAAA,CAAE,MAAA,KAAW,CAAA,CAAE,MAAA,EAAQ,OAAO,KAAA;AAClC,EAAA,IAAI,IAAA,GAAO,CAAA;AACX,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,CAAE,MAAA,EAAQ,CAAA,EAAA,EAAK,IAAA,IAAQ,CAAA,CAAE,UAAA,CAAW,CAAC,CAAA,GAAI,CAAA,CAAE,WAAW,CAAC,CAAA;AAC3E,EAAA,OAAO,IAAA,KAAS,CAAA;AAClB;AAOA,eAAsB,aAAA,CACpB,KAAA,EACA,MAAA,EACA,UAAA,GAAa,GAAA,EACK;AAClB,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,mBAAmB,CAAA,IAAK,EAAA;AACzD,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,MAAA,EAAQ,OAAO,KAAA;AAC/B,EAAA,MAAM,QAAQ,MAAA,CAAO,WAAA,CAAY,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,IAAA,EAAK,CAAE,MAAM,GAAA,EAAK,CAAC,CAAC,CAAC,CAAA;AACrF,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AACxB,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,CAAC,CAAA,IAAK,KAAK,GAAA,CAAI,IAAA,CAAK,GAAA,EAAI,GAAI,MAAO,CAAC,CAAA,GAAI,cAAc,CAAC,KAAA,CAAM,IAAI,OAAO,KAAA;AAC7F,EAAA,OAAO,WAAW,MAAM,OAAA,CAAQ,MAAA,EAAQ,CAAA,EAAG,MAAM,CAAC,CAAA,CAAA,EAAI,KAAA,CAAM,IAAI,EAAE,CAAA,EAAG,MAAA,CAAO,MAAM,EAAE,CAAA,CAAE,aAAa,CAAA;AACrG;;;ACPA,IAAM,WAAA,GAAc,IAAA;AAEpB,IAAMA,IAAAA,GAAM,IAAI,WAAA,EAAY;AAE5B,IAAM,MAAA,GAAS,CAAC,KAAA,KACd,IAAA,CAAK,OAAO,YAAA,CAAa,GAAG,KAAK,CAAC,CAAA,CAC/B,QAAQ,KAAA,EAAO,GAAG,EAClB,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,OAAO,EAAE,CAAA;AAEtB,IAAM,UAAA,GAAa,CAAC,CAAA,KAClB,UAAA,CAAW,KAAK,IAAA,CAAK,CAAA,CAAE,QAAQ,IAAA,EAAM,GAAG,EAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAC,CAAA,EAAG,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,CAAC,CAAC,CAAA;AAEvF,IAAM,IAAA,uBAAW,GAAA,EAAgC;AACjD,IAAM,MAAA,GAAS,CAAC,MAAA,KAAmB;AACjC,EAAA,IAAI,GAAA,GAAM,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA;AACzB,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,GAAA,GAAM,OAAO,MAAA,CAAO,SAAA,CAAU,KAAA,EAAOA,IAAAA,CAAI,OAAO,MAAM,CAAA,EAAG,EAAE,IAAA,EAAM,QAAQ,IAAA,EAAM,SAAA,IAAa,KAAA,EAAO,CAAC,MAAM,CAAC,CAAA;AAC3G,IAAA,IAAA,CAAK,GAAA,CAAI,QAAQ,GAAG,CAAA;AAAA,EACtB;AACA,EAAA,OAAO,GAAA;AACT,CAAA;AAEA,eAAe,IAAA,CAAK,QAAgB,OAAA,EAAkC;AACpE,EAAA,MAAM,GAAA,GAAM,MAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,MAAA,EAAQ,MAAM,MAAA,CAAO,MAAM,CAAA,EAAGA,IAAAA,CAAI,MAAA,CAAO,OAAO,CAAC,CAAA;AACtF,EAAA,OAAO,MAAA,CAAO,IAAI,UAAA,CAAW,GAAG,EAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA;AAChD;AAGO,SAAS,WAAW,SAAA,EAAwC;AACjE,EAAA,MAAM,MAAA,uBAAa,GAAA,EAAsC;AACzD,EAAA,KAAA,MAAW,KAAK,SAAA,EAAW;AACzB,IAAA,IAAI,CAAC,CAAA,CAAE,YAAA,IAAgB,CAAC,EAAE,WAAA,EAAa;AACvC,IAAA,KAAA,MAAW,CAAA,IAAK,EAAE,KAAA,EAAO;AACvB,MAAA,IAAI,CAAC,CAAA,CAAE,UAAA,IAAc,CAAC,EAAE,kBAAA,EAAoB;AAC5C,MAAA,IAAI,CAAC,MAAA,CAAO,GAAA,CAAI,CAAA,CAAE,WAAW,CAAA,EAAG,MAAA,CAAO,GAAA,CAAI,CAAA,CAAE,WAAA,kBAAa,IAAI,GAAA,EAAK,CAAA;AACnE,MAAA,MAAA,CAAO,GAAA,CAAI,CAAA,CAAE,WAAW,CAAA,CAAG,IAAI,CAAA,CAAE,UAAA,EAAY,CAAC,CAAA,CAAE,UAAA,EAAY,CAAA,CAAE,kBAAA,EAAoB,CAAA,CAAE,UAAU,CAAC,CAAA;AAAA,IACjG;AAAA,EACF;AACA,EAAA,OAAO,CAAC,GAAG,MAAA,CAAO,OAAA,EAAS,CAAA,CACxB,IAAA,CAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA,CAAE,aAAA,CAAc,CAAC,CAAC,CAAA,CACrC,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,KAAK,CAAA,MAAO,EAAE,MAAM,KAAA,EAAO,CAAC,GAAG,KAAA,CAAM,MAAA,EAAQ,CAAA,CAAE,IAAA,CAAK,CAAC,CAAC,CAAC,CAAA,EAAG,CAAC,CAAC,CAAA,KAAM,EAAE,aAAA,CAAc,CAAC,CAAC,CAAA,EAAE,CAAE,CAAA;AACzG;AAMA,eAAsB,aAAA,CAAc,MAAA,EAAqB,MAAA,EAAgB,KAAA,EAAkC;AACzG,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,KAAK,CAAC,CAAA;AAC7C,EAAA,MAAM,YAAY,CAAC,CAAA,KAAe,OAAOA,IAAAA,CAAI,MAAA,CAAO,KAAK,SAAA,CAAU,CAAA,KAAM,MAAA,GAAY,EAAE,GAAE,GAAI,EAAE,GAAG,CAAA,EAAG,CAAC,CAAC,CAAA;AACvG,EAAA,IAAI,OAAA,GAAU,UAAU,KAAK,CAAA;AAC7B,EAAA,IAAI,QAAQ,MAAA,GAAS,WAAA,IAAe,UAAU,MAAA,EAAW,OAAA,GAAU,UAAU,MAAS,CAAA;AACtF,EAAA,OAAO,GAAG,OAAO,CAAA,CAAA,EAAI,MAAM,IAAA,CAAK,MAAA,EAAQ,OAAO,CAAC,CAAA,CAAA;AAClD;AAGA,eAAsB,aAAA,CACpB,OACA,MAAA,EACoD;AACpD,EAAA,MAAM,CAAC,OAAA,EAAS,GAAA,EAAK,IAAI,CAAA,GAAI,KAAA,CAAM,MAAM,GAAG,CAAA;AAC5C,EAAA,IAAI,CAAC,WAAW,CAAC,GAAA,IAAO,SAAS,MAAA,IAAa,OAAA,CAAQ,MAAA,GAAS,WAAA,EAAa,OAAO,IAAA;AACnF,EAAA,IAAI,CAAC,WAAW,MAAM,IAAA,CAAK,QAAQ,OAAO,CAAA,EAAG,GAAG,CAAA,EAAG,OAAO,IAAA;AAC1D,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,IAAI,WAAA,GAAc,MAAA,CAAO,UAAA,CAAW,OAAO,CAAC,CAAC,CAAA;AACpE,IAAA,MAAM,MAAA,GAAS,GAAA,CAAI,CAAA,CAAE,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,KAAK,CAAA,MAAO,EAAE,IAAA,EAAM,KAAA,EAAM,CAAE,CAAA;AAC7D,IAAA,OAAO,GAAA,CAAI,CAAA,KAAM,KAAA,CAAA,GAAY,EAAE,MAAA,KAAW,EAAE,MAAA,EAAQ,KAAA,EAAO,GAAA,CAAI,CAAA,EAAE;AAAA,EACnE,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;;;AChFA,eAAsB,cAAc,IAAA,EAA+C;AACjF,EAAA,MAAM,QAAQ,IAAA,CAAK,OAAA,IAAW,gBAAA,EAAkB,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAClE,EAAA,MAAM,MAAM,MAAA,CAAO,IAAA,CAAK,SAAS,KAAA,EAAO,CAAA,EAAG,IAAI,CAAA,kCAAA,CAAA,EAAsC;AAAA,IACnF,GAAG,IAAA,CAAK,IAAA;AAAA,IACR,SAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,KAAK,CAAA,CAAA,EAAG;AAAA,IACjD,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,IAAA,CAAK,aAAa,GAAK;AAAA,GACpD,CAAA;AACD,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,iBAAA,EAAoB,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAC7D,EAAA,OAAQ,MAAM,IAAI,IAAA,EAAK;AACzB;AAOO,SAAS,aAAa,CAAA,EAA6B;AACxD,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAY;AAC9B,EAAA,KAAA,MAAW,KAAK,CAAA,CAAE,IAAA,IAAQ,EAAC,MAAO,CAAA,CAAE,IAAA,KAAS,KAAA,EAAO,KAAA,MAAW,KAAK,CAAA,CAAE,KAAA,IAAS,EAAC,EAAG,KAAA,CAAM,IAAI,CAAC,CAAA;AAC9F,EAAA,OAAO,EAAE,OAAA,EAAS,CAAA,CAAE,OAAA,EAAS,KAAA,EAAO,CAAC,GAAG,KAAK,CAAA,CAAE,IAAA,EAAK,EAAE;AACxD","file":"chunk-OMMIRSPK.js","sourcesContent":["import { consentCookieName } from \"../core/cookie-names\";\nimport { parseCookies } from \"../server/cookies\";\n\nexport interface EdgeConsent {\n  /** Off: don't ask Xenia, serve base content. */\n  personalization: boolean;\n  /** Off: decide, but keep no trail or click cookies and send no trail. */\n  analytics: boolean;\n}\n\n/**\n * What the edge flow may do for this request, from the consent cookie the browser client's\n * `consent()` writes and the visitor's privacy signals:\n * - no consent cookie (or an unreadable one) → no choice made: everything on, as before;\n * - an explicit choice → followed (JSON `{analytics, personalization}`, or the scopes form\n *   `analytics,personalization` where an unlisted scope is refused);\n * - `Sec-GPC: 1` / `DNT: 1` → analytics off, like the browser client's `respectDnt` (default on).\n *\n * Unlike `getConsent()`, an absent cookie isn't \"all denied\": the edge can't tell a visitor who\n * refused from one who was never asked, and refusing both would change every first page view.\n */\nexport function edgeConsent(headers: Headers, opts: { prefix?: string; respectDnt?: boolean } = {}): EdgeConsent {\n  const raw = parseCookies(headers.get(\"cookie\"))[consentCookieName(opts.prefix)];\n  let consent: EdgeConsent = { personalization: true, analytics: true };\n  if (raw) {\n    try {\n      const parsed: unknown = JSON.parse(raw);\n      if (parsed && typeof parsed === \"object\") {\n        const p = parsed as Record<string, unknown>;\n        consent = { personalization: p.personalization !== false, analytics: p.analytics !== false };\n      }\n    } catch {\n      if (/^[a-z]+(\\s*,\\s*[a-z]+)*$/i.test(raw.trim())) {\n        const scopes = new Set(raw.split(\",\").map((s) => s.trim()));\n        consent = { personalization: scopes.has(\"personalization\"), analytics: scopes.has(\"analytics\") };\n      }\n    }\n  }\n  const privacySignal = headers.get(\"sec-gpc\") === \"1\" || headers.get(\"dnt\") === \"1\";\n  if (opts.respectDnt !== false && privacySignal) consent = { ...consent, analytics: false };\n  return consent;\n}\n","/**\n * Facts about a request that journey rules read — where the visitor is, on what device, where they\n * came from, their local time — derived from a standard `Request` in any runtime.\n */\nimport type { ViewerGeo } from \"./types\";\n\nconst GEO_KEYS = [\n  \"country\",\n  \"countryName\",\n  \"region\",\n  \"regionName\",\n  \"city\",\n  \"postalCode\",\n  \"timeZone\",\n  \"latitude\",\n  \"longitude\",\n  \"source\",\n] as const;\n\n/** Any host's geo object (Netlify, Next.js runtimes, our own edge function). */\ntype GeoLike = {\n  country?: string | { code?: string; name?: string };\n  countryName?: string;\n  region?: string;\n  subdivision?: { code?: string; name?: string };\n  regionName?: string;\n  city?: string;\n  postalCode?: string;\n  timeZone?: string;\n  timezone?: string;\n  latitude?: string | number;\n  longitude?: string | number;\n};\n\n/** Normalizes any host's geo object into Xenia's `ViewerGeo` keys (values over 100 chars dropped). */\nfunction toViewerGeo(g: GeoLike | undefined, source: string): ViewerGeo | undefined {\n  if (!g) return undefined;\n  const country = typeof g.country === \"string\" ? g.country : g.country?.code;\n  if (!country) return undefined;\n  const raw: Record<string, unknown> = {\n    country: country.toUpperCase(),\n    countryName: g.countryName ?? (typeof g.country === \"object\" ? g.country?.name : undefined),\n    region: g.region ?? g.subdivision?.code,\n    regionName: g.regionName ?? g.subdivision?.name,\n    city: g.city,\n    postalCode: g.postalCode,\n    timeZone: g.timeZone ?? g.timezone,\n    latitude: g.latitude?.toString(),\n    longitude: g.longitude?.toString(),\n    source,\n  };\n  const geo: ViewerGeo = {};\n  for (const k of GEO_KEYS) {\n    const v = raw[k];\n    if (typeof v === \"string\" && v && v.length <= 100) geo[k] = v;\n  }\n  return geo;\n}\n\nconst parseJson = (text: string): GeoLike | undefined => {\n  try {\n    return JSON.parse(text) as GeoLike;\n  } catch {\n    return undefined;\n  }\n};\n\nfunction safeDecode(v: string): string {\n  try {\n    return decodeURIComponent(v);\n  } catch {\n    return v;\n  }\n}\n\nfunction safeBase64(v: string): string {\n  try {\n    return atob(v);\n  } catch {\n    return \"\";\n  }\n}\n\n/** Netlify's per-request context, when running in Netlify's runtime. */\nfunction netlifyContext(): { geo?: GeoLike } | undefined {\n  try {\n    return (globalThis as unknown as { Netlify?: { context?: { geo?: GeoLike } | null } }).Netlify?.context ?? undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nconst COUNTRY_HEADERS = [\"x-country\", \"x-vercel-ip-country\", \"cloudfront-viewer-country\", \"cf-ipcountry\"];\n\n/** The location headers `viewerGeo` can read, when trusted. */\nexport type GeoHeader = \"x-xn-geo\" | \"x-nf-geo\" | \"x-country\" | \"x-vercel-ip-country\" | \"cloudfront-viewer-country\" | \"cf-ipcountry\";\n\nfunction companions(h: Headers, country: string): GeoLike {\n  const of = (name: string) => h.get(name) ?? undefined;\n  if (country === \"x-vercel-ip-country\") {\n    return { region: of(\"x-vercel-ip-country-region\"), city: safeDecode(of(\"x-vercel-ip-city\") ?? \"\") || undefined, timeZone: of(\"x-vercel-ip-timezone\") };\n  }\n  if (country === \"cloudfront-viewer-country\") {\n    return { region: of(\"cloudfront-viewer-country-region\"), city: safeDecode(of(\"cloudfront-viewer-city\") ?? \"\") || undefined, timeZone: of(\"cloudfront-viewer-time-zone\") };\n  }\n  return {};\n}\n\n/**\n * The visitor's location as the hosting edge resolved it, and which source supplied it (`via`).\n * Geo must come from the storefront's edge, never Xenia's: `/decide` is server to server. Tried in\n * order — whichever the host provides:\n * 1. Netlify's per-request `Netlify.context.geo` (can't be spoofed by the client, unlike a header)\n * 2. `x-xn-geo` (URI-encoded JSON) from the site's own edge function\n * 3. a `request.geo` some runtimes attach\n * 4. Netlify's `x-nf-geo` header (base64 or URI-encoded JSON)\n * 5. `x-country` (Netlify), `x-vercel-ip-*`, `cloudfront-viewer-*`, `cf-ipcountry`\n * 6. `?xn_country=GB` — only with `devOverride`, for testing geo rules without an edge\n *\n * Headers (2, 4 and 5) are read only when named in `trust`: a visitor can send any header, and only\n * the site knows which ones its own host or edge function sets (and overwrites). Name exactly those,\n * e.g. `[\"x-vercel-ip-country\"]` on Vercel, `[\"cf-ipcountry\"]` behind Cloudflare,\n * `[\"x-nf-geo\", \"x-country\"]` on Netlify. 1 and 3 come from the runtime and are always used.\n */\nexport function viewerGeo(\n  request: Request,\n  opts: { devOverride?: boolean; trust?: readonly GeoHeader[] } = {},\n): { geo?: ViewerGeo; via: string } {\n  const trusted = new Set<string>(opts.trust ?? []);\n  const fromNetlify = toViewerGeo(netlifyContext()?.geo, \"edge\");\n  if (fromNetlify) return { geo: fromNetlify, via: \"Netlify.context\" };\n\n  const h = { get: (name: string) => (trusted.has(name) ? request.headers.get(name) : null) };\n  const xn = h.get(\"x-xn-geo\");\n  const fromXn = xn ? toViewerGeo(parseJson(safeDecode(xn)), \"edge\") : undefined;\n  if (fromXn) return { geo: fromXn, via: \"x-xn-geo (edge function)\" };\n\n  const fromRuntime = toViewerGeo((request as unknown as { geo?: GeoLike }).geo, \"edge\");\n  if (fromRuntime) return { geo: fromRuntime, via: \"request.geo\" };\n\n  const nf = h.get(\"x-nf-geo\");\n  if (nf) {\n    const fromNf = toViewerGeo(parseJson(safeBase64(nf)) ?? parseJson(safeDecode(nf)), \"edge\");\n    if (fromNf) return { geo: fromNf, via: \"x-nf-geo\" };\n  }\n\n  const via = COUNTRY_HEADERS.find((n) => h.get(n));\n  const headerCountry = via ? h.get(via) : null;\n  if (via && headerCountry && /^[a-z]{2}$/i.test(headerCountry)) {\n    const geo = toViewerGeo(\n      {\n        country: headerCountry,\n        // The region, city and time zone of the same provider as the country header.\n        ...companions(request.headers, via),\n      },\n      \"edge\",\n    );\n    return { geo, via };\n  }\n\n  const override = new URL(request.url).searchParams.get(\"xn_country\");\n  if (opts.devOverride && override && /^[a-z]{2}$/i.test(override)) {\n    return { geo: { country: override.toUpperCase(), source: \"dev\" }, via: \"?xn_country (dev)\" };\n  }\n  return { via: \"none\" };\n}\n\nexport function deviceOf(headers: Headers): \"mobile\" | \"tablet\" | \"desktop\" {\n  const ua = headers.get(\"user-agent\") ?? \"\";\n  if (/iPad|Tablet/i.test(ua)) return \"tablet\";\n  if (headers.get(\"sec-ch-ua-mobile\") === \"?1\" || /Mobi|Android|iPhone/i.test(ua)) return \"mobile\";\n  return \"desktop\";\n}\n\nconst BOT = /bot|crawl|spider|slurp|facebookexternalhit|embedly|preview|whatsapp|bingpreview/i;\n\n/** Crawlers and link-preview fetchers: never decided, never recorded. */\nexport function isBot(userAgent: string | null | undefined): boolean {\n  return BOT.test(userAgent ?? \"\");\n}\n\n/** Link prefetches pass through a proxy too; they aren't page views. */\nexport function isPrefetch(headers: Headers): boolean {\n  return (\n    headers.has(\"next-router-prefetch\") ||\n    /prefetch/i.test(headers.get(\"purpose\") ?? \"\") ||\n    /prefetch/i.test(headers.get(\"sec-purpose\") ?? \"\")\n  );\n}\n\n/**\n * Whether this is the browser loading a page (a full page load), by `Sec-Fetch-Dest`. Requests\n * without it (old browsers, curl) count as page loads.\n */\nexport function isPageLoad(headers: Headers): boolean {\n  return (headers.get(\"sec-fetch-dest\") ?? \"document\") === \"document\" && !isPrefetch(headers);\n}\n\nconst UTM: Record<string, string> = {\n  utm_source: \"utmSource\",\n  utm_medium: \"utmMedium\",\n  utm_campaign: \"utmCampaign\",\n  utm_content: \"utmContent\",\n  utm_term: \"utmTerm\",\n  utm_id: \"utmId\",\n};\n\n/**\n * This session's landing context — first-touch attribution, so a campaign carries across pages:\n * the UTMs (≤200 chars each) and an external referrer (≤500), refreshed when the visitor arrives\n * from a new campaign. `saved` is the value kept from earlier (a cookie); `changed` says to save it.\n */\nexport function landingContext(\n  url: URL,\n  referrer: string | null | undefined,\n  saved: string | undefined,\n): { ctx: Record<string, string>; changed: boolean } {\n  const fromQuery: Record<string, string> = {};\n  for (const [param, fact] of Object.entries(UTM)) {\n    const v = url.searchParams.get(param);\n    if (v) fromQuery[fact] = v.slice(0, 200);\n  }\n  const external = referrer && !referrer.startsWith(url.origin) ? referrer.slice(0, 500) : null;\n\n  let kept: Record<string, string> | null;\n  try {\n    const parsed: unknown = saved ? JSON.parse(saved) : null;\n    kept = parsed && typeof parsed === \"object\" && !Array.isArray(parsed) ? (parsed as Record<string, string>) : null;\n  } catch {\n    kept = null;\n  }\n  if (kept && !Object.keys(fromQuery).length) return { ctx: kept, changed: false };\n  return { ctx: { ...fromQuery, ...(external ? { referrer: external } : {}) }, changed: true };\n}\n\nconst WEEKDAYS = [\"sunday\", \"monday\", \"tuesday\", \"wednesday\", \"thursday\", \"friday\", \"saturday\"];\n\n/** Meteorological seasons: Dec–Feb winter, Mar–May spring, Jun–Aug summer, Sep–Nov fall. */\nexport function seasonOf(month: number, southernHemisphere = false): string {\n  const north = [\"winter\", \"winter\", \"spring\", \"spring\", \"spring\", \"summer\", \"summer\", \"summer\", \"fall\", \"fall\", \"fall\", \"winter\"];\n  const season = north[(month - 1 + 12) % 12];\n  if (!southernHemisphere) return season;\n  return ({ winter: \"summer\", summer: \"winter\", spring: \"fall\", fall: \"spring\" } as Record<string, string>)[season] ?? season;\n}\n\nfunction validTimeZone(tz: string | undefined): string | undefined {\n  if (!tz) return undefined;\n  try {\n    new Intl.DateTimeFormat(\"en-US\", { timeZone: tz });\n    return tz;\n  } catch {\n    return undefined;\n  }\n}\n\nexport interface LocalTime {\n  local_weekday: string;\n  local_month: number;\n  local_hour: number;\n  is_weekend: boolean;\n  season: string;\n}\n\n/** Weekday, month, hour and season where the visitor is (their time zone; UTC when unknown). */\nexport function localTime(geo: ViewerGeo | undefined, now: Date): LocalTime {\n  const timeZone = validTimeZone(geo?.timeZone) ?? \"UTC\";\n  const parts = Object.fromEntries(\n    new Intl.DateTimeFormat(\"en-US\", { timeZone, weekday: \"long\", month: \"numeric\", hour: \"numeric\", hourCycle: \"h23\" })\n      .formatToParts(now)\n      .map((p) => [p.type, p.value]),\n  );\n  const weekday = String(parts.weekday ?? WEEKDAYS[now.getUTCDay()]).toLowerCase();\n  const month = Number(parts.month) || now.getUTCMonth() + 1;\n  return {\n    local_weekday: weekday,\n    local_month: month,\n    local_hour: Number(parts.hour) % 24,\n    is_weekend: weekday === \"saturday\" || weekday === \"sunday\",\n    season: seasonOf(month, Number(geo?.latitude) < 0),\n  };\n}\n","/**\n * The visitor's recent page views, most recent first, kept in a short-lived first-party cookie\n * (`[[path, at], [path, at, seconds], …]`). The proxy sends it with `/decide`, so profile rules see\n * pages whose analytics events haven't been processed yet; the browser adds client-side navigations\n * and the time spent on a page as the visitor leaves it. Shared by both sides.\n */\nimport { DEFAULT_PREFIX } from \"../core/cookie-names\";\nimport type { TrailView } from \"./types\";\n\nexport const MAX_TRAIL = 8;\n/** Cookie lifetime: a visit ends after 30 idle minutes, like the SDK's session. */\nexport const TRAIL_MAX_AGE_S = 30 * 60;\n\nexport function trailCookieName(prefix: string = DEFAULT_PREFIX): string {\n  return `${prefix}_trail`;\n}\n\nconst decode = (v: string) => {\n  try {\n    return decodeURIComponent(v);\n  } catch {\n    return v;\n  }\n};\n\n/** The trail in a cookie value (raw or URI-encoded); anything malformed reads as no trail. */\nexport function readTrail(value: string | undefined | null): TrailView[] {\n  if (!value) return [];\n  try {\n    const parsed: unknown = JSON.parse(decode(value));\n    if (!Array.isArray(parsed)) return [];\n    return parsed\n      .filter((t): t is [string, number, number?] => Array.isArray(t) && typeof t[0] === \"string\" && typeof t[1] === \"number\")\n      .slice(0, MAX_TRAIL)\n      .map(([path, at, seconds]) =>\n        typeof seconds === \"number\" && seconds >= 0 && seconds <= 86_400 ? { path, at, seconds } : { path, at },\n      );\n  } catch {\n    return [];\n  }\n}\n\n/**\n * The trail with this view first: a revisit moves to the front and keeps its first time (its old\n * time on page is dropped — this view's isn't known yet). The same array when `path` is already first.\n */\nexport function withView(trail: TrailView[], path: string, now: number = Date.now()): TrailView[] {\n  if (trail[0]?.path === path) return trail;\n  const earlier = trail.find((t) => t.path === path);\n  return [{ path, at: earlier?.at ?? now }, ...trail.filter((t) => t.path !== path)].slice(0, MAX_TRAIL);\n}\n\n/** The cookie value for a trail (not URI-encoded; cookie setters encode it). */\nexport function trailCookieValue(trail: TrailView[]): string {\n  return JSON.stringify(\n    trail.slice(0, MAX_TRAIL).map((t) => (t.seconds === undefined ? [t.path, t.at] : [t.path, t.at, t.seconds])),\n  );\n}\n","const enc = new TextEncoder();\n\nasync function hmacHex(secret: string, payload: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\"raw\", enc.encode(secret), { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"]);\n  const mac = new Uint8Array(await crypto.subtle.sign(\"HMAC\", key, enc.encode(payload)));\n  return Array.from(mac, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/** Constant-time comparison, so a signature can't be guessed byte by byte. */\nexport function sameString(a: string, b: string): boolean {\n  if (a.length !== b.length) return false;\n  let diff = 0;\n  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  return diff === 0;\n}\n\n/**\n * Whether a storefront webhook from Xenia is genuine and fresh:\n * `X-Xenia-Signature: t=<unix s>,v1=<hex HMAC-SHA256(secret, \"<t>.<body>\")>`. Requests older than\n * `toleranceS` are refused, so a captured request can't be replayed. Pass the raw body text.\n */\nexport async function verifyWebhook(\n  input: { headers: Headers; body: string },\n  secret: string,\n  toleranceS = 300,\n): Promise<boolean> {\n  const header = input.headers.get(\"x-xenia-signature\") ?? \"\";\n  if (!secret || !header) return false;\n  const parts = Object.fromEntries(header.split(\",\").map((p) => p.trim().split(\"=\", 2)));\n  const t = Number(parts.t);\n  if (!Number.isFinite(t) || Math.abs(Date.now() / 1000 - t) > toleranceS || !parts.v1) return false;\n  return sameString(await hmacHex(secret, `${parts.t}.${input.body}`), String(parts.v1).toLowerCase());\n}\n","/**\n * The proxy hands a decision to the page as a signed token in the rewritten URL\n * (`/xv/<token>/women`). The token is just the swaps — identical for every visitor in the same\n * variant — so each variant renders once and is then served from the ISR/CDN cache like any static\n * page. A site may carry its own data along (`extra`), e.g. what the page fills itself from.\n *\n * Signed (HMAC-SHA256) so nobody can craft a URL that renders arbitrary entries. Web Crypto only, so\n * it runs in any runtime.\n */\nimport type { EdgeDecision } from \"./types\";\nimport { sameString } from \"./webhook\";\n\n/**\n * One swap: the base entry's field, the entry shown in its place, and the content key whose\n * decision it is — so the page can report impressions and clicks per journey and entry.\n */\nexport type VariantSwap = [identifier: string, replacementEntryId: string, contentKey?: string];\n\n/** Swaps for one base entry. */\nexport interface SwapGroup {\n  base: string;\n  swaps: VariantSwap[];\n}\n\n/** The longest payload `decodeVariant` accepts. */\nconst MAX_PAYLOAD = 4096;\n\nconst enc = new TextEncoder();\n\nconst b64url = (bytes: Uint8Array) =>\n  btoa(String.fromCharCode(...bytes))\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n\nconst fromB64url = (s: string) =>\n  Uint8Array.from(atob(s.replace(/-/g, \"+\").replace(/_/g, \"/\")), (c) => c.charCodeAt(0));\n\nconst keys = new Map<string, Promise<CryptoKey>>();\nconst keyFor = (secret: string) => {\n  let key = keys.get(secret);\n  if (!key) {\n    key = crypto.subtle.importKey(\"raw\", enc.encode(secret), { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"]);\n    keys.set(secret, key);\n  }\n  return key;\n};\n\nasync function sign(secret: string, payload: string): Promise<string> {\n  const mac = await crypto.subtle.sign(\"HMAC\", await keyFor(secret), enc.encode(payload));\n  return b64url(new Uint8Array(mac).slice(0, 16));\n}\n\n/** The swap groups of the personalized decisions, in a stable order (stable cache keys). */\nexport function swapGroups(decisions: EdgeDecision[]): SwapGroup[] {\n  const byBase = new Map<string, Map<string, VariantSwap>>();\n  for (const d of decisions) {\n    if (!d.personalized || !d.baseEntryId) continue;\n    for (const s of d.swaps) {\n      if (!s.identifier || !s.replacementEntryId) continue;\n      if (!byBase.has(d.baseEntryId)) byBase.set(d.baseEntryId, new Map());\n      byBase.get(d.baseEntryId)!.set(s.identifier, [s.identifier, s.replacementEntryId, d.contentKey]);\n    }\n  }\n  return [...byBase.entries()]\n    .sort(([a], [b]) => a.localeCompare(b))\n    .map(([base, swaps]) => ({ base, swaps: [...swaps.values()].sort(([a], [b]) => a.localeCompare(b)) }));\n}\n\n/**\n * The token for a variant. An `extra` that would push it past the payload limit is left out — the\n * page still renders its swaps — rather than making a token no page accepts.\n */\nexport async function encodeVariant(groups: SwapGroup[], secret: string, extra?: unknown): Promise<string> {\n  const g = groups.map((x) => [x.base, x.swaps]);\n  const payloadOf = (x: unknown) => b64url(enc.encode(JSON.stringify(x === undefined ? { g } : { g, x })));\n  let payload = payloadOf(extra);\n  if (payload.length > MAX_PAYLOAD && extra !== undefined) payload = payloadOf(undefined);\n  return `${payload}.${await sign(secret, payload)}`;\n}\n\n/** The variant in a token, or `null` if it is malformed or not signed with `secret`. */\nexport async function decodeVariant<E = unknown>(\n  token: string,\n  secret: string,\n): Promise<{ groups: SwapGroup[]; extra?: E } | null> {\n  const [payload, mac, rest] = token.split(\".\");\n  if (!payload || !mac || rest !== undefined || payload.length > MAX_PAYLOAD) return null;\n  if (!sameString(await sign(secret, payload), mac)) return null;\n  try {\n    const raw = JSON.parse(new TextDecoder().decode(fromB64url(payload))) as { g: [string, VariantSwap[]][]; x?: E };\n    const groups = raw.g.map(([base, swaps]) => ({ base, swaps }));\n    return raw.x === undefined ? { groups } : { groups, extra: raw.x };\n  } catch {\n    return null;\n  }\n}\n","import { DEFAULT_BASE_URL } from \"../core/http-client\";\nimport type { Manifest, PublicManifest } from \"./types\";\n\nexport interface FetchManifestOptions {\n  /** Xenia engine base URL. Default the hosted engine. */\n  baseUrl?: string;\n  /** A server-type SDK token. */\n  token: string;\n  /** Default 5000 ms. */\n  timeoutMs?: number;\n  fetch?: typeof fetch;\n  /** Extra fetch options, e.g. Next.js `{ next: { revalidate } }`. */\n  init?: RequestInit;\n}\n\n/** Xenia's manifest (`GET /api/personalization/edge/manifest`). Throws on a non-2xx answer. */\nexport async function fetchManifest(opts: FetchManifestOptions): Promise<Manifest> {\n  const base = (opts.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/+$/, \"\");\n  const res = await (opts.fetch ?? fetch)(`${base}/api/personalization/edge/manifest`, {\n    ...opts.init,\n    headers: { Authorization: `Bearer ${opts.token}` },\n    signal: AbortSignal.timeout(opts.timeoutMs ?? 5_000),\n  });\n  if (!res.ok) throw new Error(`[xenia] manifest ${res.status}`);\n  return (await res.json()) as Manifest;\n}\n\n/**\n * The manifest as a storefront may serve it publicly (e.g. from a CDN): the version and the page\n * patterns any live journey targets — no content keys, modes or rules. A proxy reading it decides by\n * path, and Xenia picks the content keys itself.\n */\nexport function trimManifest(m: Manifest): PublicManifest {\n  const pages = new Set<string>();\n  for (const k of m.keys ?? []) if (k.mode !== \"off\") for (const p of k.pages ?? []) pages.add(p);\n  return { version: m.version, pages: [...pages].sort() };\n}\n"]}