@xenia-martech/sdk-js 1.2.0-dev.3 → 1.2.0-dev.5

package/dist/personalize-content-c2DDAV6g.d.ts

@@ -0,0 +1,140 @@
+import { h as EntrySwapOp, g as EntryQuery, e as EntryDecision, p as ResolveOptions } from './types-DgVHS4Qw.js';
+
+/**
+ * CMS page personalization — walk a fetched CMS page breadth-first, swap the
+ * entries Xenia marked as personalized, and do it in as few round trips as
+ * the page's nesting allows.
+ *
+ * Rules (see the "Rounds" section of the feature plan):
+ * - **Static** targets carry their replacement in the payload (`xeniaVariants`)
+ *   and are swapped inline — no network at all.
+ * - **Runtime** targets are a barrier: their id is collected, their subtree is
+ *   NOT walked (it may be replaced). One `resolve-entries` call decides every
+ *   target found in a round, one parallel CMS fetch loads every replacement,
+ *   and the next round walks whatever now sits at each position.
+ * - Never throws: on error or when `timeoutMs` runs out, whatever is not yet
+ *   decided keeps its base content.
+ *
+ * CMS specifics live behind {@link CmsAdapter}; built-in adapters ship as
+ * `@xenia-martech/sdk-js/cms/contentful` (and later `/cms/contentstack`). Any
+ * other CMS works by implementing the interface.
+ */
+
+/** Any value inside a CMS payload — the walker is shape-agnostic; adapters give it meaning. */
+type Node = any;
+/** The parsed `xenia` marker field of a personalized entry. */
+interface XeniaMarker {
+    kind: "static" | "runtime";
+    op?: EntrySwapOp;
+    /** Array field replaced by `op: "items"`. */
+    field?: string;
+    limit?: number;
+    /**
+     * The content keys (Personalization Resolve identifiers) that personalize this entry. A page only
+     * acts on markers that list its `contentKey`; a marker without keys is ignored.
+     */
+    keys?: string[];
+}
+/** What the page resolver needs to know about a CMS's entries. `N` is the entry shape. */
+interface CmsAdapter<N extends object = Node> {
+    /** The entry id when `value` is a CMS entry (not a link stub, asset or plain object). */
+    entryId(value: unknown): string | undefined;
+    /** The entry's Xenia marker, or null when it is not personalized. */
+    marker(entry: N): XeniaMarker | null;
+    /** Static replacements pinned on the entry (its resolved `xeniaVariants`). */
+    staticVariants(entry: N): N[];
+    getField(entry: N, field: string): unknown;
+    setField(entry: N, field: string, value: unknown): void;
+    /** Legacy `items` without a field: copy the replacement's array fields onto the entry. */
+    mergeItems?(entry: N, replacement: N): void;
+    /**
+     * Remove the marker from an entry that has been dealt with (kept base, or had its items replaced),
+     * so personalizing the output again — e.g. the browser continuing a server render — never decides
+     * it twice. Optional; without it a re-run re-asks Xenia about those entries.
+     */
+    clearMarker?(entry: N): void;
+    /** Normalize a fetched payload before walking (e.g. resolve links). Defaults to identity. */
+    prepare?(payload: unknown): unknown;
+    /** Load entries by id in ONE call; order does not matter. */
+    fetchEntries(ids: string[], locale?: string): Promise<N[]>;
+    /** Run a content-type query in ONE call, in the query's order. */
+    queryEntries(query: EntryQuery, locale?: string): Promise<N[]>;
+    /**
+     * Load one page with its whole tree (links resolved), or null when there is none. Optional; it
+     * is what lets `personalizePage(ref)` do the fetch, so apps never fetch the page themselves.
+     */
+    fetchPage?(ref: PageRef, locale?: string): Promise<N | null>;
+}
+/** Identifies a page in the CMS: its entry id, or a content type plus exact field values (a slug). */
+type PageRef = string | {
+    contentType: string;
+    fields: Record<string, string | number | boolean>;
+};
+/** Resolves a round's runtime targets — `XeniaApi.resolveEntries` bound to the visitor. */
+type EntryResolver = (entryIds: string[]) => Promise<EntryDecision[]>;
+/** Reported for every swap actually applied (for impressions / analytics). */
+interface AppliedSwap {
+    target: string;
+    kind: "static" | "runtime";
+    op: EntrySwapOp;
+    /** Ids of the entries now at the target's position (or in its field). */
+    entryIds: string[];
+    contentKey?: string;
+    bucket?: string;
+    round: number;
+}
+interface PersonalizeContentOptions {
+    cms: CmsAdapter;
+    /** Decides runtime targets. Omit to apply static swaps only (zero network). */
+    resolve?: EntryResolver;
+    locale?: string;
+    /**
+     * The page's Personalization Resolve identifier (required). Only that journey personalizes the
+     * page: a marker that doesn't list this key is plain content, and the backend decides for this key
+     * alone — another journey targeting the same section is neither consulted nor run.
+     */
+    contentKey: string;
+    /** Max network rounds (nesting depth of runtime targets). Default 3. */
+    maxRounds?: number;
+    /** Total budget for all rounds, in ms. Undecided targets keep their base. Default 300. */
+    timeoutMs?: number;
+    /** Mutate the payload in place instead of personalizing a copy. Default false. */
+    inPlace?: boolean;
+    onApplied?(swap: AppliedSwap): void;
+    /**
+     * Called when a round starts waiting on the network (`pending` = targets being decided) and when
+     * it has been applied (`pending` empty). `content` is the live, partially personalized tree —
+     * lets a UI render level by level instead of waiting for every round.
+     */
+    onProgress?(progress: {
+        content: unknown;
+        round: number;
+        pending: string[];
+    }): void;
+}
+/** `personalizeContent` options as taken by `XeniaClient` / `XeniaServer`, which supply `resolve`. */
+type PagePersonalizeOptions = Omit<PersonalizeContentOptions, "resolve"> & Pick<ResolveOptions, "data" | "identity" | "context">;
+interface PersonalizeContentResult<T> {
+    content: T;
+    applied: AppliedSwap[];
+    /** False when the budget ran out, a call failed, or `maxRounds` was hit with targets left. */
+    complete: boolean;
+    error?: unknown;
+}
+declare function personalizeContent<T>(payload: T, options: PersonalizeContentOptions): Promise<PersonalizeContentResult<T>>;
+/**
+ * The entries Xenia still has to decide on this page — runtime targets reachable without crossing
+ * another undecided one. Synchronous and network-free (it reads the `xenia` markers), so a page can
+ * render a skeleton in exactly those places from the first frame instead of flashing base content.
+ * Nested targets inside a pending one are found once it is decided.
+ */
+declare function pendingTargets(payload: unknown, adapter: CmsAdapter, contentKey: string): string[];
+/**
+ * Fetch a page through `options.cms` and personalize it — {@link personalizeContent} without the
+ * fetch in app code. Never throws: a failed fetch comes back as `content: null` with `error`; a page
+ * that does not exist as `content: null`, `complete: true`. The page fetch is not counted against
+ * `timeoutMs` — that budget is for personalization only.
+ */
+declare function personalizePage<T>(ref: PageRef, options: PersonalizeContentOptions): Promise<PersonalizeContentResult<T | null>>;
+
+export { type AppliedSwap as A, type CmsAdapter as C, type EntryResolver as E, type PagePersonalizeOptions as P, type XeniaMarker as X, type PageRef as a, type PersonalizeContentOptions as b, type PersonalizeContentResult as c, personalizeContent as d, personalizePage as e, pendingTargets as p };

package/dist/personalize-content-ghZPKlf1.d.cts

@@ -0,0 +1,140 @@
+import { h as EntrySwapOp, g as EntryQuery, e as EntryDecision, p as ResolveOptions } from './types-DgVHS4Qw.cjs';
+
+/**
+ * CMS page personalization — walk a fetched CMS page breadth-first, swap the
+ * entries Xenia marked as personalized, and do it in as few round trips as
+ * the page's nesting allows.
+ *
+ * Rules (see the "Rounds" section of the feature plan):
+ * - **Static** targets carry their replacement in the payload (`xeniaVariants`)
+ *   and are swapped inline — no network at all.
+ * - **Runtime** targets are a barrier: their id is collected, their subtree is
+ *   NOT walked (it may be replaced). One `resolve-entries` call decides every
+ *   target found in a round, one parallel CMS fetch loads every replacement,
+ *   and the next round walks whatever now sits at each position.
+ * - Never throws: on error or when `timeoutMs` runs out, whatever is not yet
+ *   decided keeps its base content.
+ *
+ * CMS specifics live behind {@link CmsAdapter}; built-in adapters ship as
+ * `@xenia-martech/sdk-js/cms/contentful` (and later `/cms/contentstack`). Any
+ * other CMS works by implementing the interface.
+ */
+
+/** Any value inside a CMS payload — the walker is shape-agnostic; adapters give it meaning. */
+type Node = any;
+/** The parsed `xenia` marker field of a personalized entry. */
+interface XeniaMarker {
+    kind: "static" | "runtime";
+    op?: EntrySwapOp;
+    /** Array field replaced by `op: "items"`. */
+    field?: string;
+    limit?: number;
+    /**
+     * The content keys (Personalization Resolve identifiers) that personalize this entry. A page only
+     * acts on markers that list its `contentKey`; a marker without keys is ignored.
+     */
+    keys?: string[];
+}
+/** What the page resolver needs to know about a CMS's entries. `N` is the entry shape. */
+interface CmsAdapter<N extends object = Node> {
+    /** The entry id when `value` is a CMS entry (not a link stub, asset or plain object). */
+    entryId(value: unknown): string | undefined;
+    /** The entry's Xenia marker, or null when it is not personalized. */
+    marker(entry: N): XeniaMarker | null;
+    /** Static replacements pinned on the entry (its resolved `xeniaVariants`). */
+    staticVariants(entry: N): N[];
+    getField(entry: N, field: string): unknown;
+    setField(entry: N, field: string, value: unknown): void;
+    /** Legacy `items` without a field: copy the replacement's array fields onto the entry. */
+    mergeItems?(entry: N, replacement: N): void;
+    /**
+     * Remove the marker from an entry that has been dealt with (kept base, or had its items replaced),
+     * so personalizing the output again — e.g. the browser continuing a server render — never decides
+     * it twice. Optional; without it a re-run re-asks Xenia about those entries.
+     */
+    clearMarker?(entry: N): void;
+    /** Normalize a fetched payload before walking (e.g. resolve links). Defaults to identity. */
+    prepare?(payload: unknown): unknown;
+    /** Load entries by id in ONE call; order does not matter. */
+    fetchEntries(ids: string[], locale?: string): Promise<N[]>;
+    /** Run a content-type query in ONE call, in the query's order. */
+    queryEntries(query: EntryQuery, locale?: string): Promise<N[]>;
+    /**
+     * Load one page with its whole tree (links resolved), or null when there is none. Optional; it
+     * is what lets `personalizePage(ref)` do the fetch, so apps never fetch the page themselves.
+     */
+    fetchPage?(ref: PageRef, locale?: string): Promise<N | null>;
+}
+/** Identifies a page in the CMS: its entry id, or a content type plus exact field values (a slug). */
+type PageRef = string | {
+    contentType: string;
+    fields: Record<string, string | number | boolean>;
+};
+/** Resolves a round's runtime targets — `XeniaApi.resolveEntries` bound to the visitor. */
+type EntryResolver = (entryIds: string[]) => Promise<EntryDecision[]>;
+/** Reported for every swap actually applied (for impressions / analytics). */
+interface AppliedSwap {
+    target: string;
+    kind: "static" | "runtime";
+    op: EntrySwapOp;
+    /** Ids of the entries now at the target's position (or in its field). */
+    entryIds: string[];
+    contentKey?: string;
+    bucket?: string;
+    round: number;
+}
+interface PersonalizeContentOptions {
+    cms: CmsAdapter;
+    /** Decides runtime targets. Omit to apply static swaps only (zero network). */
+    resolve?: EntryResolver;
+    locale?: string;
+    /**
+     * The page's Personalization Resolve identifier (required). Only that journey personalizes the
+     * page: a marker that doesn't list this key is plain content, and the backend decides for this key
+     * alone — another journey targeting the same section is neither consulted nor run.
+     */
+    contentKey: string;
+    /** Max network rounds (nesting depth of runtime targets). Default 3. */
+    maxRounds?: number;
+    /** Total budget for all rounds, in ms. Undecided targets keep their base. Default 300. */
+    timeoutMs?: number;
+    /** Mutate the payload in place instead of personalizing a copy. Default false. */
+    inPlace?: boolean;
+    onApplied?(swap: AppliedSwap): void;
+    /**
+     * Called when a round starts waiting on the network (`pending` = targets being decided) and when
+     * it has been applied (`pending` empty). `content` is the live, partially personalized tree —
+     * lets a UI render level by level instead of waiting for every round.
+     */
+    onProgress?(progress: {
+        content: unknown;
+        round: number;
+        pending: string[];
+    }): void;
+}
+/** `personalizeContent` options as taken by `XeniaClient` / `XeniaServer`, which supply `resolve`. */
+type PagePersonalizeOptions = Omit<PersonalizeContentOptions, "resolve"> & Pick<ResolveOptions, "data" | "identity" | "context">;
+interface PersonalizeContentResult<T> {
+    content: T;
+    applied: AppliedSwap[];
+    /** False when the budget ran out, a call failed, or `maxRounds` was hit with targets left. */
+    complete: boolean;
+    error?: unknown;
+}
+declare function personalizeContent<T>(payload: T, options: PersonalizeContentOptions): Promise<PersonalizeContentResult<T>>;
+/**
+ * The entries Xenia still has to decide on this page — runtime targets reachable without crossing
+ * another undecided one. Synchronous and network-free (it reads the `xenia` markers), so a page can
+ * render a skeleton in exactly those places from the first frame instead of flashing base content.
+ * Nested targets inside a pending one are found once it is decided.
+ */
+declare function pendingTargets(payload: unknown, adapter: CmsAdapter, contentKey: string): string[];
+/**
+ * Fetch a page through `options.cms` and personalize it — {@link personalizeContent} without the
+ * fetch in app code. Never throws: a failed fetch comes back as `content: null` with `error`; a page
+ * that does not exist as `content: null`, `complete: true`. The page fetch is not counted against
+ * `timeoutMs` — that budget is for personalization only.
+ */
+declare function personalizePage<T>(ref: PageRef, options: PersonalizeContentOptions): Promise<PersonalizeContentResult<T | null>>;
+
+export { type AppliedSwap as A, type CmsAdapter as C, type EntryResolver as E, type PagePersonalizeOptions as P, type XeniaMarker as X, type PageRef as a, type PersonalizeContentOptions as b, type PersonalizeContentResult as c, personalizeContent as d, personalizePage as e, pendingTargets as p };

package/dist/server/index.cjs

@@ -1,12 +1,14 @@
 'use strict';
 
 require('../chunk-PKWANLT7.cjs');
-var chunkTRRMMPBH_cjs = require('../chunk-TRRMMPBH.cjs');
-var chunkYZG6JR4E_cjs = require('../chunk-YZG6JR4E.cjs');
+var chunk2DR5AVPX_cjs = require('../chunk-2DR5AVPX.cjs');
+var chunkRWE2OCQL_cjs = require('../chunk-RWE2OCQL.cjs');
+var chunkWHGK55JP_cjs = require('../chunk-WHGK55JP.cjs');
+var chunkN5M4PI7C_cjs = require('../chunk-N5M4PI7C.cjs');
 
 // src/server/token.ts
 async function refreshSdkToken(opts) {
-  const http = new chunkYZG6JR4E_cjs.HttpClient({ baseUrl: opts.baseUrl, timeout: opts.timeout });
+  const http = new chunkN5M4PI7C_cjs.HttpClient({ baseUrl: opts.baseUrl, timeout: opts.timeout });
   const { data } = await http.request({
     method: "POST",
     path: "/api/personalization/token/refresh",
@@ -39,67 +41,67 @@ function createTokenRoute(config) {
 
 Object.defineProperty(exports, "XeniaServer", {
   enumerable: true,
-  get: function () { return chunkTRRMMPBH_cjs.XeniaServer; }
+  get: function () { return chunk2DR5AVPX_cjs.XeniaServer; }
 });
 Object.defineProperty(exports, "createXeniaServer", {
   enumerable: true,
-  get: function () { return chunkTRRMMPBH_cjs.createXeniaServer; }
+  get: function () { return chunk2DR5AVPX_cjs.createXeniaServer; }
 });
-Object.defineProperty(exports, "getConsent", {
+Object.defineProperty(exports, "XeniaApi", {
   enumerable: true,
-  get: function () { return chunkTRRMMPBH_cjs.getConsent; }
+  get: function () { return chunkRWE2OCQL_cjs.XeniaApi; }
 });
-Object.defineProperty(exports, "getVisitorId", {
+Object.defineProperty(exports, "parseActions", {
   enumerable: true,
-  get: function () { return chunkTRRMMPBH_cjs.getVisitorId; }
+  get: function () { return chunkRWE2OCQL_cjs.parseActions; }
 });
-Object.defineProperty(exports, "parseCookies", {
+Object.defineProperty(exports, "pendingTargets", {
   enumerable: true,
-  get: function () { return chunkTRRMMPBH_cjs.parseCookies; }
+  get: function () { return chunkRWE2OCQL_cjs.pendingTargets; }
 });
-Object.defineProperty(exports, "CONSENT_COOKIE", {
+Object.defineProperty(exports, "personalizeContent", {
   enumerable: true,
-  get: function () { return chunkYZG6JR4E_cjs.CONSENT_COOKIE; }
+  get: function () { return chunkRWE2OCQL_cjs.personalizeContent; }
 });
-Object.defineProperty(exports, "CircuitOpenError", {
+Object.defineProperty(exports, "personalizePage", {
   enumerable: true,
-  get: function () { return chunkYZG6JR4E_cjs.CircuitOpenError; }
+  get: function () { return chunkRWE2OCQL_cjs.personalizePage; }
 });
-Object.defineProperty(exports, "VISITOR_COOKIE", {
+Object.defineProperty(exports, "getConsent", {
   enumerable: true,
-  get: function () { return chunkYZG6JR4E_cjs.VISITOR_COOKIE; }
+  get: function () { return chunkWHGK55JP_cjs.getConsent; }
 });
-Object.defineProperty(exports, "XeniaApi", {
+Object.defineProperty(exports, "getVisitorId", {
   enumerable: true,
-  get: function () { return chunkYZG6JR4E_cjs.XeniaApi; }
+  get: function () { return chunkWHGK55JP_cjs.getVisitorId; }
 });
-Object.defineProperty(exports, "consentCookie", {
+Object.defineProperty(exports, "parseCookies", {
   enumerable: true,
-  get: function () { return chunkYZG6JR4E_cjs.consentCookie; }
+  get: function () { return chunkWHGK55JP_cjs.parseCookies; }
 });
-Object.defineProperty(exports, "consentCookieName", {
+Object.defineProperty(exports, "CONSENT_COOKIE", {
   enumerable: true,
-  get: function () { return chunkYZG6JR4E_cjs.consentCookieName; }
+  get: function () { return chunkN5M4PI7C_cjs.CONSENT_COOKIE; }
 });
-Object.defineProperty(exports, "parseActions", {
+Object.defineProperty(exports, "CircuitOpenError", {
   enumerable: true,
-  get: function () { return chunkYZG6JR4E_cjs.parseActions; }
+  get: function () { return chunkN5M4PI7C_cjs.CircuitOpenError; }
 });
-Object.defineProperty(exports, "pendingTargets", {
+Object.defineProperty(exports, "VISITOR_COOKIE", {
   enumerable: true,
-  get: function () { return chunkYZG6JR4E_cjs.pendingTargets; }
+  get: function () { return chunkN5M4PI7C_cjs.VISITOR_COOKIE; }
 });
-Object.defineProperty(exports, "personalizeContent", {
+Object.defineProperty(exports, "consentCookie", {
   enumerable: true,
-  get: function () { return chunkYZG6JR4E_cjs.personalizeContent; }
+  get: function () { return chunkN5M4PI7C_cjs.consentCookie; }
 });
-Object.defineProperty(exports, "personalizePage", {
+Object.defineProperty(exports, "consentCookieName", {
   enumerable: true,
-  get: function () { return chunkYZG6JR4E_cjs.personalizePage; }
+  get: function () { return chunkN5M4PI7C_cjs.consentCookieName; }
 });
 Object.defineProperty(exports, "visitorCookieName", {
   enumerable: true,
-  get: function () { return chunkYZG6JR4E_cjs.visitorCookieName; }
+  get: function () { return chunkN5M4PI7C_cjs.visitorCookieName; }
 });
 exports.createTokenRoute = createTokenRoute;
 exports.refreshSdkToken = refreshSdkToken;

package/dist/server/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/token.ts"],"names":["HttpClient"],"mappings":";;;;;;;AAgCA,eAAsB,gBAAgB,IAAA,EAAoD;AACxF,EAAA,MAAM,IAAA,GAAO,IAAIA,4BAAA,CAAW,EAAE,OAAA,EAAS,KAAK,OAAA,EAAS,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,CAAA;AAC5E,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,KAAK,OAAA,CAAQ;AAAA,IAClC,MAAA,EAAQ,MAAA;AAAA,IACR,IAAA,EAAM,oCAAA;AAAA,IACN,SAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,QAAQ,CAAA,CAAA,EAAG;AAAA,IACpD,IAAA,EAAM,EAAE,UAAA,EAAY,IAAA,CAAK,cAAc,IAAA;AAAK,GAC7C,CAAA;AACD,EAAA,MAAM,GAAA,GAAO,QAAQ,EAAC;AACtB,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,KAAA,IAAS,EAAE,CAAA;AAAA,IAC7B,WAAW,OAAO,GAAA,CAAI,SAAA,KAAc,QAAA,GAAW,IAAI,SAAA,GAAY;AAAA,GACjE;AACF;AAiBO,SAAS,iBAAiB,MAAA,EAAsE;AACrG,EAAA,OAAO,YAA+B;AACpC,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAY,MAAM,eAAA,CAAgB,MAAM,CAAA;AAC9C,MAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,SAAS,CAAA,EAAG;AAAA,QAC7C,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,iBAAiB,UAAA;AAAW,OAC5E,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,sBAAA;AACrD,MAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG;AAAA,QACtD,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,OAC/C,CAAA;AAAA,IACH;AAAA,EACF,CAAA;AACF","file":"index.cjs","sourcesContent":["import { HttpClient } from \"../core/http-client\";\nimport type { JsonObject } from \"../core/types\";\n\nexport interface RefreshTokenOptions {\n  /**\n   * Xenia base URL. Defaults to the hosted engine,\n   * `https://engine.xeniamartech.com/xenia` — omit unless self-hosting.\n   */\n  baseUrl?: string;\n  /**\n   * The personalization SDK token created once in the dashboard (API Tokens →\n   * Create token). Stays server-side; the browser never sees it — only the\n   * short-lived token this exchanges it for does.\n   */\n  sdkToken: string;\n  /** Lifetime of the returned token, in minutes. Default 15, capped server-side at 60. */\n  ttlMinutes?: number;\n  timeout?: number;\n}\n\nexport interface RefreshedToken {\n  token: string;\n  expiresAt?: string;\n}\n\n/**\n * Exchange the long-lived personalization SDK token for a short-lived one with\n * the same tenant/env scope, via `POST /api/personalization/token/refresh`.\n * Self-service — no dashboard credential needed, just the SDK token you\n * already have. Call this from your backend and hand the result to the\n * browser (e.g. from a token route the client SDK calls via `getToken`).\n */\nexport async function refreshSdkToken(opts: RefreshTokenOptions): Promise<RefreshedToken> {\n  const http = new HttpClient({ baseUrl: opts.baseUrl, timeout: opts.timeout });\n  const { data } = await http.request({\n    method: \"POST\",\n    path: \"/api/personalization/token/refresh\",\n    headers: { Authorization: `Bearer ${opts.sdkToken}` },\n    body: { ttlMinutes: opts.ttlMinutes ?? null },\n  });\n  const obj = (data ?? {}) as JsonObject;\n  return {\n    token: String(obj.token ?? \"\"),\n    expiresAt: typeof obj.expiresAt === \"string\" ? obj.expiresAt : undefined,\n  };\n}\n\n/**\n * Build a framework-agnostic request handler that hands the browser SDK a\n * personalization token — mount it at the endpoint `getToken` calls. Needs\n * only the SDK token you already created in the dashboard; mints a fresh\n * short-lived token per request so the long-lived one never reaches the\n * browser.\n *\n * @example\n * ```ts\n * export const GET = createTokenRoute({\n *   sdkToken: process.env.XENIA_SDK_TOKEN!,\n *   // baseUrl: process.env.XENIA_URL, // only to override the default hosted engine\n * });\n * ```\n */\nexport function createTokenRoute(config: RefreshTokenOptions): (request: Request) => Promise<Response> {\n  return async (): Promise<Response> => {\n    try {\n      const refreshed = await refreshSdkToken(config);\n      return new Response(JSON.stringify(refreshed), {\n        status: 200,\n        headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n      });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"token refresh failed\";\n      return new Response(JSON.stringify({ error: message }), {\n        status: 500,\n        headers: { \"Content-Type\": \"application/json\" },\n      });\n    }\n  };\n}\n"]}
+{"version":3,"sources":["../../src/server/token.ts"],"names":["HttpClient"],"mappings":";;;;;;;;;AAgCA,eAAsB,gBAAgB,IAAA,EAAoD;AACxF,EAAA,MAAM,IAAA,GAAO,IAAIA,4BAAA,CAAW,EAAE,OAAA,EAAS,KAAK,OAAA,EAAS,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,CAAA;AAC5E,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,KAAK,OAAA,CAAQ;AAAA,IAClC,MAAA,EAAQ,MAAA;AAAA,IACR,IAAA,EAAM,oCAAA;AAAA,IACN,SAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,QAAQ,CAAA,CAAA,EAAG;AAAA,IACpD,IAAA,EAAM,EAAE,UAAA,EAAY,IAAA,CAAK,cAAc,IAAA;AAAK,GAC7C,CAAA;AACD,EAAA,MAAM,GAAA,GAAO,QAAQ,EAAC;AACtB,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,KAAA,IAAS,EAAE,CAAA;AAAA,IAC7B,WAAW,OAAO,GAAA,CAAI,SAAA,KAAc,QAAA,GAAW,IAAI,SAAA,GAAY;AAAA,GACjE;AACF;AAiBO,SAAS,iBAAiB,MAAA,EAAsE;AACrG,EAAA,OAAO,YAA+B;AACpC,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAY,MAAM,eAAA,CAAgB,MAAM,CAAA;AAC9C,MAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,SAAS,CAAA,EAAG;AAAA,QAC7C,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,iBAAiB,UAAA;AAAW,OAC5E,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,sBAAA;AACrD,MAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG;AAAA,QACtD,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,OAC/C,CAAA;AAAA,IACH;AAAA,EACF,CAAA;AACF","file":"index.cjs","sourcesContent":["import { HttpClient } from \"../core/http-client\";\nimport type { JsonObject } from \"../core/types\";\n\nexport interface RefreshTokenOptions {\n  /**\n   * Xenia base URL. Defaults to the hosted engine,\n   * `https://engine.xeniamartech.com/xenia` — omit unless self-hosting.\n   */\n  baseUrl?: string;\n  /**\n   * The personalization SDK token created once in the dashboard (API Tokens →\n   * Create token). Stays server-side; the browser never sees it — only the\n   * short-lived token this exchanges it for does.\n   */\n  sdkToken: string;\n  /** Lifetime of the returned token, in minutes. Default 15, capped server-side at 60. */\n  ttlMinutes?: number;\n  timeout?: number;\n}\n\nexport interface RefreshedToken {\n  token: string;\n  expiresAt?: string;\n}\n\n/**\n * Exchange the long-lived personalization SDK token for a short-lived one with\n * the same tenant/env scope, via `POST /api/personalization/token/refresh`.\n * Self-service — no dashboard credential needed, just the SDK token you\n * already have. Call this from your backend and hand the result to the\n * browser (e.g. from a token route the client SDK calls via `getToken`).\n */\nexport async function refreshSdkToken(opts: RefreshTokenOptions): Promise<RefreshedToken> {\n  const http = new HttpClient({ baseUrl: opts.baseUrl, timeout: opts.timeout });\n  const { data } = await http.request({\n    method: \"POST\",\n    path: \"/api/personalization/token/refresh\",\n    headers: { Authorization: `Bearer ${opts.sdkToken}` },\n    body: { ttlMinutes: opts.ttlMinutes ?? null },\n  });\n  const obj = (data ?? {}) as JsonObject;\n  return {\n    token: String(obj.token ?? \"\"),\n    expiresAt: typeof obj.expiresAt === \"string\" ? obj.expiresAt : undefined,\n  };\n}\n\n/**\n * Build a framework-agnostic request handler that hands the browser SDK a\n * personalization token — mount it at the endpoint `getToken` calls. Needs\n * only the SDK token you already created in the dashboard; mints a fresh\n * short-lived token per request so the long-lived one never reaches the\n * browser.\n *\n * @example\n * ```ts\n * export const GET = createTokenRoute({\n *   sdkToken: process.env.XENIA_SDK_TOKEN!,\n *   // baseUrl: process.env.XENIA_URL, // only to override the default hosted engine\n * });\n * ```\n */\nexport function createTokenRoute(config: RefreshTokenOptions): (request: Request) => Promise<Response> {\n  return async (): Promise<Response> => {\n    try {\n      const refreshed = await refreshSdkToken(config);\n      return new Response(JSON.stringify(refreshed), {\n        status: 200,\n        headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n      });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"token refresh failed\";\n      return new Response(JSON.stringify({ error: message }), {\n        status: 500,\n        headers: { \"Content-Type\": \"application/json\" },\n      });\n    }\n  };\n}\n"]}

package/dist/server/index.d.cts

@@ -1,8 +1,9 @@
-export { S as ServerResolveOptions, a as ServerTrackOptions, b as ServerWebhookOptions, W as WithFallback, X as XeniaServer, c as createXeniaServer } from '../xenia-server-MlI3Khya.cjs';
-import { f as ConsentState } from '../personalize-content-Bf6YZdkZ.cjs';
-export { A as AnalyticsContext, a as AnalyticsEventName, b as AnalyticsIdentity, c as AnalyticsIngestResponse, d as AppliedSwap, e as CircuitBreakerConfig, C as CmsAdapter, E as EventContext, l as EventIdentity, I as IdentifyRequest, m as IdentifyResponse, J as JsonValue, P as PagePersonalizeOptions, q as PageRef, r as PersonalizationSwap, t as PersonalizeContentResult, R as ResolveBatchItem, u as ResolveBatchResult, w as ResolveOptions, x as ResolveResult, W as WebhookResponse, L as XeniaConfig, N as XeniaEvent, X as XeniaMarker, O as pendingTargets, Q as personalizeContent, S as personalizePage } from '../personalize-content-Bf6YZdkZ.cjs';
-export { X as XeniaApi } from '../api-BqSvWgBZ.cjs';
-export { C as CONSENT_COOKIE, a as CircuitOpenError, V as VISITOR_COOKIE, f as consentCookie, g as consentCookieName, p as parseActions, v as visitorCookieName } from '../cookie-names-RXVfGYPE.cjs';
+export { S as ServerResolveOptions, a as ServerTrackOptions, b as ServerWebhookOptions, W as WithFallback, X as XeniaServer, c as createXeniaServer } from '../xenia-server-C3O-cWQT.cjs';
+import { d as ConsentState } from '../types-DgVHS4Qw.cjs';
+export { A as AnalyticsContext, a as AnalyticsEventName, b as AnalyticsIdentity, c as AnalyticsIngestResponse, C as CircuitBreakerConfig, E as EventContext, i as EventIdentity, I as IdentifyRequest, j as IdentifyResponse, J as JsonValue, P as PersonalizationSwap, R as ResolveBatchItem, n as ResolveBatchResult, p as ResolveOptions, q as ResolveResult, W as WebhookResponse, x as XeniaConfig, y as XeniaEvent } from '../types-DgVHS4Qw.cjs';
+export { X as XeniaApi } from '../api-0IycTYJR.cjs';
+export { C as CONSENT_COOKIE, a as CircuitOpenError, V as VISITOR_COOKIE, f as consentCookie, g as consentCookieName, p as parseActions, v as visitorCookieName } from '../cookie-names-CnL65Oly.cjs';
+export { A as AppliedSwap, C as CmsAdapter, P as PagePersonalizeOptions, a as PageRef, c as PersonalizeContentResult, X as XeniaMarker, p as pendingTargets, d as personalizeContent, e as personalizePage } from '../personalize-content-ghZPKlf1.cjs';
 
 interface RefreshTokenOptions {
     /**

package/dist/server/index.d.ts

@@ -1,8 +1,9 @@
-export { S as ServerResolveOptions, a as ServerTrackOptions, b as ServerWebhookOptions, W as WithFallback, X as XeniaServer, c as createXeniaServer } from '../xenia-server-CcjQenru.js';
-import { f as ConsentState } from '../personalize-content-Bf6YZdkZ.js';
-export { A as AnalyticsContext, a as AnalyticsEventName, b as AnalyticsIdentity, c as AnalyticsIngestResponse, d as AppliedSwap, e as CircuitBreakerConfig, C as CmsAdapter, E as EventContext, l as EventIdentity, I as IdentifyRequest, m as IdentifyResponse, J as JsonValue, P as PagePersonalizeOptions, q as PageRef, r as PersonalizationSwap, t as PersonalizeContentResult, R as ResolveBatchItem, u as ResolveBatchResult, w as ResolveOptions, x as ResolveResult, W as WebhookResponse, L as XeniaConfig, N as XeniaEvent, X as XeniaMarker, O as pendingTargets, Q as personalizeContent, S as personalizePage } from '../personalize-content-Bf6YZdkZ.js';
-export { X as XeniaApi } from '../api-ByoECRhR.js';
-export { C as CONSENT_COOKIE, a as CircuitOpenError, V as VISITOR_COOKIE, f as consentCookie, g as consentCookieName, p as parseActions, v as visitorCookieName } from '../cookie-names-Bxd-VNyJ.js';
+export { S as ServerResolveOptions, a as ServerTrackOptions, b as ServerWebhookOptions, W as WithFallback, X as XeniaServer, c as createXeniaServer } from '../xenia-server-DV8Sjmoo.js';
+import { d as ConsentState } from '../types-DgVHS4Qw.js';
+export { A as AnalyticsContext, a as AnalyticsEventName, b as AnalyticsIdentity, c as AnalyticsIngestResponse, C as CircuitBreakerConfig, E as EventContext, i as EventIdentity, I as IdentifyRequest, j as IdentifyResponse, J as JsonValue, P as PersonalizationSwap, R as ResolveBatchItem, n as ResolveBatchResult, p as ResolveOptions, q as ResolveResult, W as WebhookResponse, x as XeniaConfig, y as XeniaEvent } from '../types-DgVHS4Qw.js';
+export { X as XeniaApi } from '../api-COXWLL5L.js';
+export { C as CONSENT_COOKIE, a as CircuitOpenError, V as VISITOR_COOKIE, f as consentCookie, g as consentCookieName, p as parseActions, v as visitorCookieName } from '../cookie-names-BvUaW3uo.js';
+export { A as AppliedSwap, C as CmsAdapter, P as PagePersonalizeOptions, a as PageRef, c as PersonalizeContentResult, X as XeniaMarker, p as pendingTargets, d as personalizeContent, e as personalizePage } from '../personalize-content-c2DDAV6g.js';
 
 interface RefreshTokenOptions {
     /**

package/dist/server/index.js

@@ -1,7 +1,9 @@
 import '../chunk-OUZU4Z5B.js';
-export { XeniaServer, createXeniaServer, getConsent, getVisitorId, parseCookies } from '../chunk-INM2SPH4.js';
-import { HttpClient } from '../chunk-TGG5Y4QD.js';
-export { CONSENT_COOKIE, CircuitOpenError, VISITOR_COOKIE, XeniaApi, consentCookie, consentCookieName, parseActions, pendingTargets, personalizeContent, personalizePage, visitorCookieName } from '../chunk-TGG5Y4QD.js';
+export { XeniaServer, createXeniaServer } from '../chunk-GWRDZIVA.js';
+export { XeniaApi, parseActions, pendingTargets, personalizeContent, personalizePage } from '../chunk-LW5AEJ6K.js';
+export { getConsent, getVisitorId, parseCookies } from '../chunk-QEYONKWY.js';
+import { HttpClient } from '../chunk-BQ5PJCZ7.js';
+export { CONSENT_COOKIE, CircuitOpenError, VISITOR_COOKIE, consentCookie, consentCookieName, visitorCookieName } from '../chunk-BQ5PJCZ7.js';
 
 // src/server/token.ts
 async function refreshSdkToken(opts) {

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/server/token.ts"],"names":[],"mappings":";;;;;;AAgCA,eAAsB,gBAAgB,IAAA,EAAoD;AACxF,EAAA,MAAM,IAAA,GAAO,IAAI,UAAA,CAAW,EAAE,OAAA,EAAS,KAAK,OAAA,EAAS,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,CAAA;AAC5E,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,KAAK,OAAA,CAAQ;AAAA,IAClC,MAAA,EAAQ,MAAA;AAAA,IACR,IAAA,EAAM,oCAAA;AAAA,IACN,SAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,QAAQ,CAAA,CAAA,EAAG;AAAA,IACpD,IAAA,EAAM,EAAE,UAAA,EAAY,IAAA,CAAK,cAAc,IAAA;AAAK,GAC7C,CAAA;AACD,EAAA,MAAM,GAAA,GAAO,QAAQ,EAAC;AACtB,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,KAAA,IAAS,EAAE,CAAA;AAAA,IAC7B,WAAW,OAAO,GAAA,CAAI,SAAA,KAAc,QAAA,GAAW,IAAI,SAAA,GAAY;AAAA,GACjE;AACF;AAiBO,SAAS,iBAAiB,MAAA,EAAsE;AACrG,EAAA,OAAO,YAA+B;AACpC,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAY,MAAM,eAAA,CAAgB,MAAM,CAAA;AAC9C,MAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,SAAS,CAAA,EAAG;AAAA,QAC7C,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,iBAAiB,UAAA;AAAW,OAC5E,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,sBAAA;AACrD,MAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG;AAAA,QACtD,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,OAC/C,CAAA;AAAA,IACH;AAAA,EACF,CAAA;AACF","file":"index.js","sourcesContent":["import { HttpClient } from \"../core/http-client\";\nimport type { JsonObject } from \"../core/types\";\n\nexport interface RefreshTokenOptions {\n  /**\n   * Xenia base URL. Defaults to the hosted engine,\n   * `https://engine.xeniamartech.com/xenia` — omit unless self-hosting.\n   */\n  baseUrl?: string;\n  /**\n   * The personalization SDK token created once in the dashboard (API Tokens →\n   * Create token). Stays server-side; the browser never sees it — only the\n   * short-lived token this exchanges it for does.\n   */\n  sdkToken: string;\n  /** Lifetime of the returned token, in minutes. Default 15, capped server-side at 60. */\n  ttlMinutes?: number;\n  timeout?: number;\n}\n\nexport interface RefreshedToken {\n  token: string;\n  expiresAt?: string;\n}\n\n/**\n * Exchange the long-lived personalization SDK token for a short-lived one with\n * the same tenant/env scope, via `POST /api/personalization/token/refresh`.\n * Self-service — no dashboard credential needed, just the SDK token you\n * already have. Call this from your backend and hand the result to the\n * browser (e.g. from a token route the client SDK calls via `getToken`).\n */\nexport async function refreshSdkToken(opts: RefreshTokenOptions): Promise<RefreshedToken> {\n  const http = new HttpClient({ baseUrl: opts.baseUrl, timeout: opts.timeout });\n  const { data } = await http.request({\n    method: \"POST\",\n    path: \"/api/personalization/token/refresh\",\n    headers: { Authorization: `Bearer ${opts.sdkToken}` },\n    body: { ttlMinutes: opts.ttlMinutes ?? null },\n  });\n  const obj = (data ?? {}) as JsonObject;\n  return {\n    token: String(obj.token ?? \"\"),\n    expiresAt: typeof obj.expiresAt === \"string\" ? obj.expiresAt : undefined,\n  };\n}\n\n/**\n * Build a framework-agnostic request handler that hands the browser SDK a\n * personalization token — mount it at the endpoint `getToken` calls. Needs\n * only the SDK token you already created in the dashboard; mints a fresh\n * short-lived token per request so the long-lived one never reaches the\n * browser.\n *\n * @example\n * ```ts\n * export const GET = createTokenRoute({\n *   sdkToken: process.env.XENIA_SDK_TOKEN!,\n *   // baseUrl: process.env.XENIA_URL, // only to override the default hosted engine\n * });\n * ```\n */\nexport function createTokenRoute(config: RefreshTokenOptions): (request: Request) => Promise<Response> {\n  return async (): Promise<Response> => {\n    try {\n      const refreshed = await refreshSdkToken(config);\n      return new Response(JSON.stringify(refreshed), {\n        status: 200,\n        headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n      });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"token refresh failed\";\n      return new Response(JSON.stringify({ error: message }), {\n        status: 500,\n        headers: { \"Content-Type\": \"application/json\" },\n      });\n    }\n  };\n}\n"]}
+{"version":3,"sources":["../../src/server/token.ts"],"names":[],"mappings":";;;;;;;;AAgCA,eAAsB,gBAAgB,IAAA,EAAoD;AACxF,EAAA,MAAM,IAAA,GAAO,IAAI,UAAA,CAAW,EAAE,OAAA,EAAS,KAAK,OAAA,EAAS,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,CAAA;AAC5E,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,KAAK,OAAA,CAAQ;AAAA,IAClC,MAAA,EAAQ,MAAA;AAAA,IACR,IAAA,EAAM,oCAAA;AAAA,IACN,SAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,QAAQ,CAAA,CAAA,EAAG;AAAA,IACpD,IAAA,EAAM,EAAE,UAAA,EAAY,IAAA,CAAK,cAAc,IAAA;AAAK,GAC7C,CAAA;AACD,EAAA,MAAM,GAAA,GAAO,QAAQ,EAAC;AACtB,EAAA,OAAO;AAAA,IACL,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,KAAA,IAAS,EAAE,CAAA;AAAA,IAC7B,WAAW,OAAO,GAAA,CAAI,SAAA,KAAc,QAAA,GAAW,IAAI,SAAA,GAAY;AAAA,GACjE;AACF;AAiBO,SAAS,iBAAiB,MAAA,EAAsE;AACrG,EAAA,OAAO,YAA+B;AACpC,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAY,MAAM,eAAA,CAAgB,MAAM,CAAA;AAC9C,MAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,SAAS,CAAA,EAAG;AAAA,QAC7C,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,iBAAiB,UAAA;AAAW,OAC5E,CAAA;AAAA,IACH,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,sBAAA;AACrD,MAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA,EAAG;AAAA,QACtD,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,OAC/C,CAAA;AAAA,IACH;AAAA,EACF,CAAA;AACF","file":"index.js","sourcesContent":["import { HttpClient } from \"../core/http-client\";\nimport type { JsonObject } from \"../core/types\";\n\nexport interface RefreshTokenOptions {\n  /**\n   * Xenia base URL. Defaults to the hosted engine,\n   * `https://engine.xeniamartech.com/xenia` — omit unless self-hosting.\n   */\n  baseUrl?: string;\n  /**\n   * The personalization SDK token created once in the dashboard (API Tokens →\n   * Create token). Stays server-side; the browser never sees it — only the\n   * short-lived token this exchanges it for does.\n   */\n  sdkToken: string;\n  /** Lifetime of the returned token, in minutes. Default 15, capped server-side at 60. */\n  ttlMinutes?: number;\n  timeout?: number;\n}\n\nexport interface RefreshedToken {\n  token: string;\n  expiresAt?: string;\n}\n\n/**\n * Exchange the long-lived personalization SDK token for a short-lived one with\n * the same tenant/env scope, via `POST /api/personalization/token/refresh`.\n * Self-service — no dashboard credential needed, just the SDK token you\n * already have. Call this from your backend and hand the result to the\n * browser (e.g. from a token route the client SDK calls via `getToken`).\n */\nexport async function refreshSdkToken(opts: RefreshTokenOptions): Promise<RefreshedToken> {\n  const http = new HttpClient({ baseUrl: opts.baseUrl, timeout: opts.timeout });\n  const { data } = await http.request({\n    method: \"POST\",\n    path: \"/api/personalization/token/refresh\",\n    headers: { Authorization: `Bearer ${opts.sdkToken}` },\n    body: { ttlMinutes: opts.ttlMinutes ?? null },\n  });\n  const obj = (data ?? {}) as JsonObject;\n  return {\n    token: String(obj.token ?? \"\"),\n    expiresAt: typeof obj.expiresAt === \"string\" ? obj.expiresAt : undefined,\n  };\n}\n\n/**\n * Build a framework-agnostic request handler that hands the browser SDK a\n * personalization token — mount it at the endpoint `getToken` calls. Needs\n * only the SDK token you already created in the dashboard; mints a fresh\n * short-lived token per request so the long-lived one never reaches the\n * browser.\n *\n * @example\n * ```ts\n * export const GET = createTokenRoute({\n *   sdkToken: process.env.XENIA_SDK_TOKEN!,\n *   // baseUrl: process.env.XENIA_URL, // only to override the default hosted engine\n * });\n * ```\n */\nexport function createTokenRoute(config: RefreshTokenOptions): (request: Request) => Promise<Response> {\n  return async (): Promise<Response> => {\n    try {\n      const refreshed = await refreshSdkToken(config);\n      return new Response(JSON.stringify(refreshed), {\n        status: 200,\n        headers: { \"Content-Type\": \"application/json\", \"Cache-Control\": \"no-store\" },\n      });\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"token refresh failed\";\n      return new Response(JSON.stringify({ error: message }), {\n        status: 500,\n        headers: { \"Content-Type\": \"application/json\" },\n      });\n    }\n  };\n}\n"]}