tatvic-implementation-sdk 0.0.0-stage → 1.0.0

package/dist/index.js

@@ -0,0 +1,871 @@
+// src/defaults.ts
+var DEFAULT_PROXY_ENDPOINT = "/_tatvic/relay";
+var DEFAULT_HEADER_NAME = "x-tatvic-target";
+var DEFAULT_TARGET_DOMAINS = [
+  "google-analytics.com",
+  "analytics.google.com",
+  "googletagmanager.com",
+  "stats.g.doubleclick.net",
+  "googleadservices.com",
+  "googleads.g.doubleclick.net",
+  "pagead2.googlesyndication.com",
+  "google.com",
+  "stape.io",
+  "stape.net",
+  "a.run.app",
+  "appspot.com",
+  "connect.facebook.net",
+  "facebook.com",
+  "graph.facebook.com",
+  "facebook.net",
+  "clarity.ms",
+  "c.bing.com",
+  "bat.bing.com",
+  "analytics.tiktok.com",
+  "tiktok.com",
+  "static.hotjar.com",
+  "script.hotjar.com",
+  "in.hotjar.com",
+  "static.ads-twitter.com",
+  "ads-twitter.com",
+  "snap.licdn.com",
+  "px.ads.linkedin.com",
+  "ct.pinterest.com",
+  "pintrk.com",
+  "sc-static.net",
+  "tr.snapchat.com",
+  "static.criteo.net",
+  "sslwidget.criteo.com",
+  "widgets.outbrain.com",
+  "tr.outbrain.com",
+  "cdn.taboola.com",
+  "trc.taboola.com",
+  "segment.io",
+  "api.segment.io",
+  "cdn.segment.com",
+  "mixpanel.com",
+  "api-js.mixpanel.com",
+  "amplitude.com",
+  "api.amplitude.com",
+  "api2.amplitude.com",
+  "heapanalytics.com",
+  "cdn.heapanalytics.com",
+  "posthog.com",
+  "app.posthog.com",
+  "eu.posthog.com"
+];
+var DEFAULT_EXCLUDE_DOMAINS = [
+  "api.stripe.com",
+  "js.stripe.com",
+  "m.stripe.network",
+  "paypal.com",
+  "sandbox.paypal.com",
+  "razorpay.com",
+  "checkout.razorpay.com",
+  "square.com",
+  "squareup.com",
+  "auth0.com",
+  "clerk.dev",
+  "clerk.com",
+  "supabase.co",
+  "firebaseio.com",
+  "accounts.google.com",
+  "appleid.apple.com",
+  "amazonaws.com",
+  "googleapis.com",
+  "cloudflare.com"
+];
+
+// src/url-matcher.ts
+class UrlMatcher {
+  targetDomains;
+  excludeDomains;
+  proxyEndpoint;
+  targetHeaderName;
+  obfuscateTarget;
+  routingMode;
+  debug;
+  constructor(options = {}) {
+    this.targetDomains = options.targetDomains ?? DEFAULT_TARGET_DOMAINS;
+    this.excludeDomains = options.excludeDomains ?? DEFAULT_EXCLUDE_DOMAINS;
+    this.proxyEndpoint = options.proxyEndpoint ?? DEFAULT_PROXY_ENDPOINT;
+    this.targetHeaderName = (options.targetHeaderName ?? DEFAULT_HEADER_NAME).toLowerCase();
+    this.obfuscateTarget = options.obfuscateTarget ?? false;
+    this.routingMode = options.routingMode ?? "auto";
+    this.debug = options.debug ?? false;
+  }
+  shouldProxy(urlStr) {
+    const parsed = this.parseUrl(urlStr);
+    if (!parsed)
+      return false;
+    const hostname = parsed.hostname.toLowerCase();
+    if (typeof window !== "undefined" && window.location?.origin && parsed.origin === window.location.origin) {
+      if (parsed.pathname.startsWith(this.proxyEndpoint)) {
+        return false;
+      }
+    }
+    for (const rule of this.excludeDomains) {
+      if (this.matchesRule(hostname, rule)) {
+        return false;
+      }
+    }
+    for (const rule of this.targetDomains) {
+      if (this.matchesRule(hostname, rule)) {
+        return true;
+      }
+    }
+    return false;
+  }
+  encodeTarget(targetUrl) {
+    if (this.obfuscateTarget) {
+      if (typeof btoa !== "undefined") {
+        return btoa(targetUrl);
+      }
+      return Buffer.from(targetUrl).toString("base64");
+    }
+    return targetUrl;
+  }
+  getProxiedRequestInfo(originalUrl, forcedMode) {
+    const mode = forcedMode ?? (this.routingMode === "auto" ? "header" : this.routingMode);
+    const encodedTarget = this.encodeTarget(originalUrl);
+    if (mode === "query") {
+      const separator = this.proxyEndpoint.includes("?") ? "&" : "?";
+      const proxyUrl = `${this.proxyEndpoint}${separator}_tgt=${encodeURIComponent(encodedTarget)}`;
+      return { proxyUrl };
+    }
+    return {
+      proxyUrl: this.proxyEndpoint,
+      headerName: this.targetHeaderName,
+      headerValue: encodedTarget
+    };
+  }
+  log(...args) {
+    if (this.debug) {
+      console.log("[Tatvic Proxy SDK]", ...args);
+    }
+  }
+  matchesRule(hostname, rule) {
+    if (rule instanceof RegExp) {
+      return rule.test(hostname);
+    }
+    const cleanRule = rule.toLowerCase().trim();
+    return hostname === cleanRule || hostname.endsWith(`.${cleanRule}`);
+  }
+  parseUrl(urlStr) {
+    try {
+      if (typeof window !== "undefined" && window.location?.origin) {
+        return new URL(urlStr, window.location.origin);
+      }
+      return new URL(urlStr);
+    } catch {
+      return null;
+    }
+  }
+}
+
+// src/interceptor.ts
+class RequestInterceptor {
+  matcher;
+  options;
+  isInstalled = false;
+  originalFetch;
+  originalXhrOpen;
+  originalXhrSend;
+  originalSendBeacon;
+  originalScriptSrcDesc;
+  originalImageSrcDesc;
+  constructor(options = {}) {
+    this.options = options;
+    this.matcher = new UrlMatcher(options);
+  }
+  install() {
+    if (this.isInstalled || typeof window === "undefined") {
+      return;
+    }
+    if (this.options.enabled === false) {
+      this.matcher.log("SDK disabled via configuration.");
+      return;
+    }
+    this.patchFetch();
+    this.patchXhr();
+    this.patchSendBeacon();
+    this.patchScriptElements();
+    this.patchImageElements();
+    this.isInstalled = true;
+    this.matcher.log("First-party request interceptor active.");
+  }
+  uninstall() {
+    if (!this.isInstalled || typeof window === "undefined") {
+      return;
+    }
+    if (this.originalFetch) {
+      window.fetch = this.originalFetch;
+      this.originalFetch = undefined;
+    }
+    if (this.originalXhrOpen) {
+      XMLHttpRequest.prototype.open = this.originalXhrOpen;
+      this.originalXhrOpen = undefined;
+    }
+    if (this.originalXhrSend) {
+      XMLHttpRequest.prototype.send = this.originalXhrSend;
+      this.originalXhrSend = undefined;
+    }
+    if (this.originalSendBeacon && navigator.sendBeacon) {
+      navigator.sendBeacon = this.originalSendBeacon;
+      this.originalSendBeacon = undefined;
+    }
+    if (this.originalScriptSrcDesc && typeof HTMLScriptElement !== "undefined") {
+      Object.defineProperty(HTMLScriptElement.prototype, "src", this.originalScriptSrcDesc);
+      this.originalScriptSrcDesc = undefined;
+    }
+    if (this.originalImageSrcDesc && typeof HTMLImageElement !== "undefined") {
+      Object.defineProperty(HTMLImageElement.prototype, "src", this.originalImageSrcDesc);
+      this.originalImageSrcDesc = undefined;
+    }
+    this.isInstalled = false;
+    this.matcher.log("First-party request interceptor uninstalled.");
+  }
+  patchFetch() {
+    if (!window.fetch)
+      return;
+    this.originalFetch = window.fetch.bind(window);
+    const originalFetch = this.originalFetch;
+    const matcher = this.matcher;
+    const patchedFetch = async (input, init) => {
+      let targetUrl;
+      if (typeof input === "string") {
+        targetUrl = input;
+      } else if (input instanceof URL) {
+        targetUrl = input.toString();
+      } else if (typeof Request !== "undefined" && input instanceof Request) {
+        targetUrl = input.url;
+      } else {
+        targetUrl = String(input);
+      }
+      if (!matcher.shouldProxy(targetUrl)) {
+        return originalFetch(input, init);
+      }
+      matcher.log("Intercepted fetch:", targetUrl);
+      const isNoCors = init?.mode === "no-cors" || typeof Request !== "undefined" && input instanceof Request && input.mode === "no-cors";
+      const info = matcher.getProxiedRequestInfo(targetUrl, isNoCors ? "query" : undefined);
+      const previewToken = this.options.serverPreviewToken || this.detectPreviewToken();
+      if (typeof Request !== "undefined" && input instanceof Request) {
+        const headers = new Headers(input.headers);
+        if (init?.headers) {
+          new Headers(init.headers).forEach((val, key) => headers.set(key, val));
+        }
+        if (info.headerName && info.headerValue && !isNoCors) {
+          headers.set(info.headerName, info.headerValue);
+        }
+        if (previewToken && !headers.has("x-gtm-server-preview")) {
+          headers.set("x-gtm-server-preview", previewToken);
+        }
+        const proxiedRequest = new Request(info.proxyUrl, {
+          method: init?.method ?? input.method,
+          headers,
+          body: init?.body ?? input.body,
+          mode: isNoCors ? "cors" : init?.mode ?? input.mode ?? "cors",
+          credentials: init?.credentials ?? input.credentials,
+          cache: init?.cache ?? input.cache,
+          redirect: init?.redirect ?? input.redirect,
+          referrer: init?.referrer ?? input.referrer,
+          integrity: init?.integrity ?? input.integrity,
+          keepalive: init?.keepalive ?? input.keepalive,
+          signal: init?.signal ?? input.signal
+        });
+        return originalFetch(proxiedRequest);
+      }
+      const headers = new Headers(init?.headers);
+      if (info.headerName && info.headerValue && !isNoCors) {
+        headers.set(info.headerName, info.headerValue);
+      }
+      if (previewToken && !headers.has("x-gtm-server-preview")) {
+        headers.set("x-gtm-server-preview", previewToken);
+      }
+      const modifiedInit = {
+        ...init,
+        headers,
+        mode: isNoCors ? "cors" : init?.mode ?? "cors"
+      };
+      return originalFetch(info.proxyUrl, modifiedInit);
+    };
+    Object.assign(patchedFetch, originalFetch);
+    window.fetch = patchedFetch;
+  }
+  patchXhr() {
+    if (typeof XMLHttpRequest === "undefined")
+      return;
+    this.originalXhrOpen = XMLHttpRequest.prototype.open;
+    this.originalXhrSend = XMLHttpRequest.prototype.send;
+    const originalOpen = this.originalXhrOpen;
+    const originalSend = this.originalXhrSend;
+    const matcher = this.matcher;
+    const getPreviewToken = () => this.options.serverPreviewToken || this.detectPreviewToken();
+    XMLHttpRequest.prototype.open = function(method, url, async = true, username, password) {
+      const targetUrl = url.toString();
+      if (matcher.shouldProxy(targetUrl)) {
+        matcher.log("Intercepted XHR:", targetUrl);
+        const info = matcher.getProxiedRequestInfo(targetUrl);
+        const previewToken = getPreviewToken();
+        this.__tatvicMeta = {
+          isProxied: true,
+          originalUrl: targetUrl,
+          headerName: info.headerName,
+          headerValue: info.headerValue,
+          previewToken
+        };
+        return originalOpen.call(this, method, info.proxyUrl, async, username, password);
+      }
+      this.__tatvicMeta = { isProxied: false };
+      return originalOpen.call(this, method, url, async, username, password);
+    };
+    XMLHttpRequest.prototype.send = function(body) {
+      if (this.__tatvicMeta?.isProxied) {
+        const { headerName, headerValue, previewToken } = this.__tatvicMeta;
+        if (headerName && headerValue) {
+          try {
+            this.setRequestHeader(headerName, headerValue);
+          } catch (e) {
+            matcher.log("Failed to set proxy header on XHR:", e);
+          }
+        }
+        if (previewToken) {
+          try {
+            this.setRequestHeader("x-gtm-server-preview", previewToken);
+          } catch (e) {
+            matcher.log("Failed to set preview header on XHR:", e);
+          }
+        }
+      }
+      return originalSend.call(this, body);
+    };
+  }
+  patchSendBeacon() {
+    if (typeof navigator === "undefined" || !navigator.sendBeacon)
+      return;
+    this.originalSendBeacon = navigator.sendBeacon.bind(navigator);
+    const originalSendBeacon = this.originalSendBeacon;
+    const matcher = this.matcher;
+    const polyfillWithKeepalive = this.options.polyfillBeaconWithKeepalive !== false;
+    navigator.sendBeacon = (url, data) => {
+      const targetUrl = url.toString();
+      if (!matcher.shouldProxy(targetUrl)) {
+        return originalSendBeacon(url, data);
+      }
+      matcher.log("Intercepted sendBeacon:", targetUrl);
+      if (polyfillWithKeepalive && typeof window.fetch === "function") {
+        const info = matcher.getProxiedRequestInfo(targetUrl);
+        const previewToken = this.options.serverPreviewToken || this.detectPreviewToken();
+        const headers = new Headers;
+        if (info.headerName && info.headerValue) {
+          headers.set(info.headerName, info.headerValue);
+        }
+        if (previewToken) {
+          headers.set("x-gtm-server-preview", previewToken);
+        }
+        try {
+          window.fetch(info.proxyUrl, {
+            method: "POST",
+            body: data,
+            headers,
+            keepalive: true,
+            mode: "cors"
+          }).catch((err) => {
+            matcher.log("Async sendBeacon keepalive fetch error:", err);
+          });
+          return true;
+        } catch {}
+      }
+      const queryInfo = matcher.getProxiedRequestInfo(targetUrl, "query");
+      let fallbackUrl = queryInfo.proxyUrl;
+      const previewToken = this.options.serverPreviewToken || this.detectPreviewToken();
+      if (previewToken) {
+        fallbackUrl += (fallbackUrl.includes("?") ? "&" : "?") + "_gtm_server_preview=" + encodeURIComponent(previewToken);
+      }
+      return originalSendBeacon(fallbackUrl, data);
+    };
+  }
+  patchScriptElements() {
+    if (typeof HTMLScriptElement === "undefined")
+      return;
+    const desc = Object.getOwnPropertyDescriptor(HTMLScriptElement.prototype, "src");
+    if (!desc || !desc.set || !desc.get)
+      return;
+    this.originalScriptSrcDesc = desc;
+    const matcher = this.matcher;
+    const originalSet = desc.set;
+    const originalGet = desc.get;
+    Object.defineProperty(HTMLScriptElement.prototype, "src", {
+      set(val) {
+        if (typeof val === "string" && (val.includes("googletagmanager.com/gtm.js") || val.includes("/_tatvic/gtm.js") || val.includes("/_tatvic/loader.js"))) {
+          try {
+            const pageSearch = typeof window !== "undefined" && window.location ? window.location.search : "";
+            const pageParams = new URLSearchParams(pageSearch);
+            const targetUrl = new URL(val, typeof window !== "undefined" && window.location ? window.location.origin : "http://localhost");
+            const containerId = targetUrl.searchParams.get("cid") || targetUrl.searchParams.get("container") || targetUrl.searchParams.get("tag") || targetUrl.searchParams.get("id") || "GTM-T32XGF8F";
+            const morphedParams = new URLSearchParams;
+            morphedParams.set("cid", containerId);
+            targetUrl.searchParams.forEach((v, k) => {
+              if (k !== "id" && k !== "cid" && k !== "container" && k !== "tag") {
+                morphedParams.set(k, v);
+              }
+            });
+            for (const param of ["gtm_debug", "gtm_auth", "gtm_preview", "gtm_cookies_win"]) {
+              if (pageParams.has(param) && !morphedParams.has(param)) {
+                morphedParams.set(param, pageParams.get(param));
+              }
+            }
+            const morphedUrl = `/_tatvic/loader.js?${morphedParams.toString()}`;
+            matcher.log("Morphed GTM script element to stealth loader:", val, "->", morphedUrl);
+            return originalSet.call(this, morphedUrl);
+          } catch {}
+        }
+        if (matcher.shouldProxy(val)) {
+          const info = matcher.getProxiedRequestInfo(val, "query");
+          matcher.log("Intercepted dynamic script element:", val, "->", info.proxyUrl);
+          return originalSet.call(this, info.proxyUrl);
+        }
+        return originalSet.call(this, val);
+      },
+      get() {
+        return originalGet.call(this);
+      },
+      configurable: true,
+      enumerable: true
+    });
+  }
+  patchImageElements() {
+    if (typeof HTMLImageElement === "undefined")
+      return;
+    const desc = Object.getOwnPropertyDescriptor(HTMLImageElement.prototype, "src");
+    if (!desc || !desc.set || !desc.get)
+      return;
+    this.originalImageSrcDesc = desc;
+    const matcher = this.matcher;
+    const originalSet = desc.set;
+    const originalGet = desc.get;
+    Object.defineProperty(HTMLImageElement.prototype, "src", {
+      set(val) {
+        if (matcher.shouldProxy(val)) {
+          const info = matcher.getProxiedRequestInfo(val, "query");
+          matcher.log("Intercepted tracking pixel image:", val, "->", info.proxyUrl);
+          return originalSet.call(this, info.proxyUrl);
+        }
+        return originalSet.call(this, val);
+      },
+      get() {
+        return originalGet.call(this);
+      },
+      configurable: true,
+      enumerable: true
+    });
+  }
+  detectPreviewToken() {
+    if (typeof window === "undefined" || !window.location)
+      return;
+    try {
+      const params = new URLSearchParams(window.location.search);
+      return params.get("gtm_server_preview") || undefined;
+    } catch {
+      return;
+    }
+  }
+}
+// src/morph-gtm.ts
+function morphGtmScript(originalCode, relayEndpoint = "/_tatvic/relay") {
+  let morphed = originalCode;
+  const endpointReplacements = [
+    [/https:\/\/adservice\.google\.com\//g, `${relayEndpoint}?_tgt=https%3A%2F%2Fadservice.google.com%2F`],
+    [/https:\/\/www\.googleadservices\.com\//g, `${relayEndpoint}?_tgt=https%3A%2F%2Fwww.googleadservices.com%2F`],
+    [/https:\/\/pagead2\.googlesyndication\.com\//g, `${relayEndpoint}?_tgt=https%3A%2F%2Fpagead2.googlesyndication.com%2F`],
+    [/https:\/\/ad\.doubleclick\.net\//g, `${relayEndpoint}?_tgt=https%3A%2F%2Fad.doubleclick.net%2F`],
+    [/https:\/\/www\.google-analytics\.com\//g, `${relayEndpoint}?_tgt=https%3A%2F%2Fwww.google-analytics.com%2F`],
+    [/https:\/\/analytics\.google\.com\//g, `${relayEndpoint}?_tgt=https%3A%2F%2Fanalytics.google.com%2F`],
+    [/https:\/\/region1\.google-analytics\.com\//g, `${relayEndpoint}?_tgt=https%3A%2F%2Fregion1.google-analytics.com%2F`]
+  ];
+  for (const [pattern, replacement] of endpointReplacements) {
+    morphed = morphed.replace(pattern, replacement);
+  }
+  return morphed;
+}
+
+// src/server-proxy.ts
+function createProxyHandler(options = {}) {
+  const headerName = (options.targetHeaderName ?? DEFAULT_HEADER_NAME).toLowerCase();
+  const allowedDomains = options.allowedDomains ?? DEFAULT_TARGET_DOMAINS;
+  const timeoutMs = options.timeoutMs ?? 1e4;
+  const relayEndpoint = DEFAULT_PROXY_ENDPOINT;
+  const stripHeaders = new Set((options.stripHeaders ?? ["host", "authorization", "connection"]).map((h) => h.toLowerCase()));
+  return async function handleProxyRequest(request) {
+    try {
+      const reqUrl = new URL(request.url);
+      const pathname = reqUrl.pathname;
+      if (pathname.endsWith("/gtm.js") || pathname.endsWith("/loader.js") || pathname.endsWith("/core.js") || pathname.endsWith("/loader") || pathname.includes("/_tatvic/loader.js") || pathname.includes("/_tatvic/gtm.js") || pathname.includes("/_tatvic/core.js")) {
+        return handleMorphedGtmRequest(request, reqUrl);
+      }
+      let targetUrlStr = request.headers.get(headerName);
+      if (!targetUrlStr) {
+        targetUrlStr = reqUrl.searchParams.get("_tgt");
+      }
+      if (!targetUrlStr) {
+        return new Response(JSON.stringify({ error: "Missing target destination" }), {
+          status: 400,
+          headers: { "Content-Type": "application/json" }
+        });
+      }
+      if (options.obfuscateTarget) {
+        try {
+          if (typeof atob !== "undefined") {
+            targetUrlStr = atob(targetUrlStr);
+          } else {
+            targetUrlStr = Buffer.from(targetUrlStr, "base64").toString("utf-8");
+          }
+        } catch {
+          return new Response(JSON.stringify({ error: "Invalid obfuscated target" }), {
+            status: 400,
+            headers: { "Content-Type": "application/json" }
+          });
+        }
+      }
+      let targetUrl;
+      try {
+        targetUrl = new URL(targetUrlStr);
+      } catch {
+        return new Response(JSON.stringify({ error: "Malformed target URL" }), {
+          status: 400,
+          headers: { "Content-Type": "application/json" }
+        });
+      }
+      if (targetUrl.protocol !== "http:" && targetUrl.protocol !== "https:") {
+        return new Response(JSON.stringify({ error: "Unsupported protocol" }), {
+          status: 403,
+          headers: { "Content-Type": "application/json" }
+        });
+      }
+      const isAllowed = matchesAllowlist(targetUrl.hostname, allowedDomains);
+      if (!isAllowed) {
+        return new Response(JSON.stringify({ error: "Target host is not permitted" }), {
+          status: 403,
+          headers: { "Content-Type": "application/json" }
+        });
+      }
+      if (options.serverContainerUrl && (targetUrl.hostname.includes("google-analytics.com") || targetUrl.hostname.includes("analytics.google.com"))) {
+        try {
+          const sGtmOrigin = new URL(options.serverContainerUrl);
+          targetUrl.protocol = sGtmOrigin.protocol;
+          targetUrl.host = sGtmOrigin.host;
+          targetUrl.port = sGtmOrigin.port;
+        } catch {}
+      }
+      const upstreamHeaders = new Headers;
+      request.headers.forEach((val, key) => {
+        const lowerKey = key.toLowerCase();
+        if (!stripHeaders.has(lowerKey) && lowerKey !== headerName) {
+          upstreamHeaders.set(key, val);
+        }
+      });
+      const serverPreviewToken = request.headers.get("x-gtm-server-preview") || reqUrl.searchParams.get("_gtm_server_preview") || options.serverPreviewToken;
+      if (serverPreviewToken) {
+        upstreamHeaders.set("x-gtm-server-preview", serverPreviewToken);
+        if (targetUrl.pathname.includes("/collect") || targetUrl.pathname.includes("/g/collect")) {
+          if (!targetUrl.searchParams.has("_dbg")) {
+            targetUrl.searchParams.set("_dbg", "1");
+          }
+          if (!targetUrl.searchParams.has("ep.debug_mode")) {
+            targetUrl.searchParams.set("ep.debug_mode", "true");
+          }
+        }
+      }
+      const clientIp = request.headers.get("x-forwarded-for") ?? request.headers.get("cf-connecting-ip");
+      if (clientIp) {
+        upstreamHeaders.set("x-forwarded-for", clientIp);
+      }
+      const controller = new AbortController;
+      const timer = setTimeout(() => controller.abort(), timeoutMs);
+      const hasBody = request.method !== "GET" && request.method !== "HEAD";
+      const body = hasBody ? await request.arrayBuffer() : undefined;
+      const upstreamResponse = await fetch(targetUrl.toString(), {
+        method: request.method,
+        headers: upstreamHeaders,
+        body,
+        redirect: "follow",
+        signal: controller.signal
+      });
+      clearTimeout(timer);
+      if (targetUrl.hostname.includes("googletagmanager.com") && targetUrl.pathname.includes("/gtm.js")) {
+        const rawCode = await upstreamResponse.text();
+        const morphedCode = morphGtmScript(rawCode, relayEndpoint);
+        const isDebug = targetUrl.searchParams.has("gtm_debug");
+        return new Response(morphedCode, {
+          status: upstreamResponse.status,
+          headers: {
+            "Content-Type": "application/javascript; charset=UTF-8",
+            "Access-Control-Allow-Origin": "*",
+            "Cache-Control": isDebug ? "no-cache, no-store, must-revalidate" : "public, max-age=900"
+          }
+        });
+      }
+      const responseHeaders = new Headers(upstreamResponse.headers);
+      responseHeaders.delete("transfer-encoding");
+      responseHeaders.delete("content-encoding");
+      responseHeaders.delete("content-length");
+      responseHeaders.set("Access-Control-Allow-Origin", "*");
+      responseHeaders.set("Access-Control-Allow-Headers", `*, ${headerName}`);
+      return new Response(upstreamResponse.body, {
+        status: upstreamResponse.status,
+        statusText: upstreamResponse.statusText,
+        headers: responseHeaders
+      });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Proxy forwarding failed";
+      return new Response(JSON.stringify({ error: message }), {
+        status: 502,
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+  };
+  async function handleMorphedGtmRequest(request, reqUrl) {
+    const containerId = reqUrl.searchParams.get("cid") || reqUrl.searchParams.get("container") || reqUrl.searchParams.get("tag") || reqUrl.searchParams.get("id");
+    if (!containerId || !/^[A-Z0-9-_]+$/i.test(containerId)) {
+      return new Response(JSON.stringify({ error: "Invalid or missing container id" }), {
+        status: 400,
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    const upstreamUrl = new URL("https://www.googletagmanager.com/gtm.js");
+    upstreamUrl.searchParams.set("id", containerId);
+    reqUrl.searchParams.forEach((val, key) => {
+      if (key !== "cid" && key !== "container" && key !== "tag" && key !== "id") {
+        upstreamUrl.searchParams.set(key, val);
+      }
+    });
+    try {
+      const upstreamRes = await fetch(upstreamUrl.toString(), {
+        headers: {
+          "User-Agent": request.headers.get("user-agent") || "Mozilla/5.0",
+          Accept: "application/javascript, */*"
+        }
+      });
+      if (!upstreamRes.ok) {
+        return new Response(JSON.stringify({ error: `Upstream GTM returned ${upstreamRes.status}` }), {
+          status: upstreamRes.status,
+          headers: { "Content-Type": "application/json" }
+        });
+      }
+      const rawCode = await upstreamRes.text();
+      const morphedCode = morphGtmScript(rawCode, relayEndpoint);
+      const isDebug = reqUrl.searchParams.has("gtm_debug");
+      return new Response(morphedCode, {
+        status: 200,
+        headers: {
+          "Content-Type": "application/javascript; charset=UTF-8",
+          "Access-Control-Allow-Origin": "*",
+          "Access-Control-Allow-Methods": "GET, OPTIONS",
+          "Cache-Control": isDebug ? "no-cache, no-store, must-revalidate" : "public, max-age=900"
+        }
+      });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : "Failed to fetch upstream GTM";
+      return new Response(JSON.stringify({ error: msg }), {
+        status: 502,
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+  }
+}
+function matchesAllowlist(hostname, allowlist) {
+  const cleanHost = hostname.toLowerCase();
+  for (const rule of allowlist) {
+    if (rule instanceof RegExp) {
+      if (rule.test(cleanHost))
+        return true;
+    } else {
+      const cleanRule = rule.toLowerCase().trim();
+      if (cleanHost === cleanRule || cleanHost.endsWith(`.${cleanRule}`)) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+// src/custom-element.ts
+class TatvicWrapperElement extends (typeof HTMLElement !== "undefined" ? HTMLElement : Object) {
+  connectedCallback() {
+    if (typeof window === "undefined")
+      return;
+    if (this.style) {
+      this.style.display = "contents";
+    }
+    const endpoint = this.getAttribute ? this.getAttribute("endpoint") ?? undefined : undefined;
+    const debug = this.getAttribute ? this.getAttribute("debug") === "true" : false;
+    const serverPreview = this.getAttribute ? this.getAttribute("server-preview") || this.getAttribute("server-preview-token") || undefined : undefined;
+    const options = {};
+    if (endpoint)
+      options.proxyEndpoint = endpoint;
+    if (debug)
+      options.debug = true;
+    if (serverPreview)
+      options.serverPreviewToken = serverPreview;
+    initFirstPartyWrapper(options);
+    const morphScripts = () => {
+      try {
+        if (this.querySelectorAll && typeof document !== "undefined") {
+          const scripts = this.querySelectorAll("script[src]");
+          scripts.forEach((s) => {
+            const src = s.getAttribute("src");
+            if (!src)
+              return;
+            if (src.includes("googletagmanager.com/gtm.js") || src.includes("/_tatvic/gtm.js") || src.includes("/_tatvic/loader.js")) {
+              const pageSearch = typeof window !== "undefined" && window.location ? window.location.search : "";
+              const pageParams = new URLSearchParams(pageSearch);
+              const targetUrl = new URL(src, typeof window !== "undefined" && window.location ? window.location.origin : "http://localhost");
+              const containerId = targetUrl.searchParams.get("cid") || targetUrl.searchParams.get("container") || targetUrl.searchParams.get("tag") || targetUrl.searchParams.get("id") || "GTM-T32XGF8F";
+              const morphedParams = new URLSearchParams;
+              morphedParams.set("cid", containerId);
+              targetUrl.searchParams.forEach((v, k) => {
+                if (k !== "id" && k !== "cid" && k !== "container" && k !== "tag") {
+                  morphedParams.set(k, v);
+                }
+              });
+              for (const param of ["gtm_debug", "gtm_auth", "gtm_preview", "gtm_cookies_win"]) {
+                if (pageParams.has(param) && !morphedParams.has(param)) {
+                  morphedParams.set(param, pageParams.get(param));
+                }
+              }
+              const morphedUrl = `/_tatvic/loader.js?${morphedParams.toString()}`;
+              if (s.getAttribute("src") !== morphedUrl) {
+                s.setAttribute("src", morphedUrl);
+                const replacement = document.createElement("script");
+                replacement.async = s.hasAttribute("async");
+                replacement.src = morphedUrl;
+                s.parentNode?.replaceChild(replacement, s);
+              }
+              return;
+            }
+            if (!src.startsWith("/_tatvic/")) {
+              const separator = (options.proxyEndpoint || "/_tatvic/relay").includes("?") ? "&" : "?";
+              const proxied = `${options.proxyEndpoint || "/_tatvic/relay"}${separator}_tgt=${encodeURIComponent(src)}`;
+              s.setAttribute("src", proxied);
+            }
+          });
+        }
+      } catch {}
+    };
+    morphScripts();
+    if (typeof queueMicrotask !== "undefined") {
+      queueMicrotask(morphScripts);
+    } else if (typeof setTimeout !== "undefined") {
+      setTimeout(morphScripts, 0);
+    }
+  }
+}
+if (typeof window !== "undefined" && typeof customElements !== "undefined" && !customElements.get("tatvic-wrapper")) {
+  try {
+    customElements.define("tatvic-wrapper", TatvicWrapperElement);
+  } catch {}
+}
+// src/react.tsx
+import React, { useEffect } from "react";
+"use client";
+function TatvicWrapper({
+  children,
+  className,
+  style,
+  ...options
+}) {
+  useEffect(() => {
+    initFirstPartyWrapper(options);
+  }, [options.proxyEndpoint, options.debug]);
+  return React.createElement("tatvic-wrapper", {
+    class: className,
+    style: { display: "contents", ...style },
+    endpoint: options.proxyEndpoint,
+    debug: options.debug ? "true" : undefined
+  }, children);
+}
+// src/next.ts
+function tatvicRelayRoute(options = {}) {
+  const handler = createProxyHandler(options);
+  return {
+    GET: handler,
+    POST: handler,
+    OPTIONS: handler
+  };
+}
+// src/express.ts
+function tatvicExpressMiddleware(options = {}) {
+  const handler = createProxyHandler(options);
+  return async function(req, res, next) {
+    try {
+      const host = req.headers["host"] || "localhost";
+      const fullUrl = `http://${host}${req.originalUrl || req.url || "/_tatvic/relay"}`;
+      const headers = new Headers;
+      for (const [key, val] of Object.entries(req.headers)) {
+        if (Array.isArray(val)) {
+          val.forEach((v) => headers.append(key, v));
+        } else if (typeof val === "string") {
+          headers.set(key, val);
+        }
+      }
+      let body = undefined;
+      if (req.method !== "GET" && req.method !== "HEAD") {
+        if (typeof req.body === "string" || Buffer.isBuffer(req.body)) {
+          body = req.body;
+        } else if (req.body && typeof req.body === "object") {
+          body = JSON.stringify(req.body);
+        }
+      }
+      const webRequest = new Request(fullUrl, {
+        method: req.method,
+        headers,
+        body
+      });
+      const webResponse = await handler(webRequest);
+      res.status(webResponse.status);
+      webResponse.headers.forEach((value, key) => {
+        res.setHeader(key, value);
+      });
+      const arrayBuffer = await webResponse.arrayBuffer();
+      res.end(Buffer.from(arrayBuffer));
+    } catch (err) {
+      if (next) {
+        next(err);
+      } else {
+        res.status(500).send("Tatvic Relay Error");
+      }
+    }
+  };
+}
+
+// src/index.ts
+var activeInterceptor = null;
+function initFirstPartyWrapper(options = {}) {
+  if (activeInterceptor) {
+    activeInterceptor.uninstall();
+  }
+  activeInterceptor = new RequestInterceptor(options);
+  activeInterceptor.install();
+  return activeInterceptor;
+}
+function uninstallFirstPartyWrapper() {
+  if (activeInterceptor) {
+    activeInterceptor.uninstall();
+    activeInterceptor = null;
+  }
+}
+export {
+  DEFAULT_EXCLUDE_DOMAINS,
+  DEFAULT_HEADER_NAME,
+  DEFAULT_PROXY_ENDPOINT,
+  DEFAULT_TARGET_DOMAINS,
+  RequestInterceptor,
+  TatvicWrapper,
+  TatvicWrapperElement,
+  UrlMatcher,
+  createProxyHandler,
+  initFirstPartyWrapper,
+  morphGtmScript,
+  tatvicExpressMiddleware,
+  tatvicRelayRoute,
+  uninstallFirstPartyWrapper
+};