` where you want it |\n| **Standalone page** | The campaign gets its own tokenized URL (great for SMS / email / QR) | Link to the URL shown in the dashboard |\n\n#### Embedded cards (inline placement)\n\nDrop an empty element wherever you want the card to appear. Its `data-aegis-slot` value must equal the campaign's **category** (`widget_category` in the dashboard). On load, the SDK fills the first eligible campaign for that category:\n\n```html\n\n
\n```\n\nNo per-slot script and no manual registration — `runtime.initialize()` scans for every `[data-aegis-slot]` element and fills it. It re-scans on each SSE/poll refresh and skips slots it has already filled.\n\n### Cart state — one store, fed the CEP-standard way\n\nEvery cart-reactive surface — the **free-delivery progress card**, the standalone\n**progress bar**, cart-value **targeting rules**, and **cart-recovery** widgets —\nreads ONE cart store. You feed it the same way you'd feed WebEngage/CleverTap: by\nfiring the **ecommerce events** you already fire. The SDK derives the live cart\nfrom them; no separate cart call.\n\n```typescript\n// 1) Wire the ecommerce tracker into the cart store, once at boot:\nruntime.bindEcommerce(aegis.ecommerce);\n\n// 2) Fire ecommerce events as the shopper shops — the cart is derived from these:\naegis.ecommerce.addToCart({ product_id: 'p1', name: 'Cap', price: 499, quantity: 1 });\naegis.ecommerce.cartViewed({ value: 998, currency: 'INR', products: [/* … */] }); // authoritative snapshot\n```\n\n**Platform installs need no event wiring** — the plugin does it for you. Carts are\ndetected and fed into the same store automatically:\n\n| Platform | Detection method | Setup |\n|----------|-----------------|-------|\n| **Shopify** | `/cart.js` poll + `cart:updated` (plugin) | Install the Shopify app |\n| **WooCommerce** | `aegis_cart` + WC Store API on cart events (plugin) | Install the WP plugin |\n| **Magento 2** | `localStorage['mage-cache-storage']` | Install the extension |\n| **Custom / headless / mobile** | Fire `aegis.ecommerce.*` (above) | `runtime.bindEcommerce(...)` |\n\n**Escape hatch** — a headless host that doesn't emit ecommerce events can push the\ncart directly; this writes the same one store:\n\n```typescript\nruntime.setCartState({ total: 149.99, itemCount: 2, currency: 'INR' });\n```\n\n---\n\n## Plugin System\n\nExtend the SDK with custom plugins:\n\n```typescript\nimport type { Plugin } from '@active-reach/web-sdk';\n\nconst myPlugin: Plugin = {\n name: 'my-plugin',\n version: '1.0.0',\n\n async init(config) { /* called on SDK init */ },\n\n async beforeEventCapture(event) {\n // Modify or enrich events before capture\n event.properties = { ...event.properties, enriched: true };\n return event;\n },\n\n async afterEventCapture(event) {\n // Post-capture logic (external forwarding, logging, etc.)\n },\n};\n\naegis.use(myPlugin);\n```\n\n---\n\n## TypeScript Support\n\nFull type definitions included. Extend for type-safe event tracking:\n\n```typescript\n// types/aegis.d.ts\nimport '@active-reach/web-sdk';\n\ndeclare module '@active-reach/web-sdk' {\n interface TrackEventProperties {\n 'Purchase Completed': {\n order_id: string;\n revenue: number;\n currency: string;\n };\n 'Product Viewed': {\n product_id: string;\n product_name: string;\n price: number;\n };\n }\n}\n```\n\n---\n\n## Cookies & Storage\n\n| Name | Type | Purpose | Duration |\n|------|------|---------|----------|\n| `aegis_anon_id` | Cookie | Anonymous user identifier | 365 days |\n| `aegis_user_id` | Cookie | Identified user ID | 365 days |\n| `aegis_session_id` | Cookie | Current session ID | Session |\n| `aegis_session_time` | Cookie | Last activity timestamp | Session |\n| `aegis_consent` | Cookie | Consent preferences | 365 days |\n| `aegis_offline_queue` | localStorage | Offline event queue | Persistent |\n| `aegis_active_cell` | localStorage | Active regional cell | 7 days |\n\nAll cookies: `SameSite=Lax`, `Secure` (HTTPS only), domain-scoped (optional).\n\n---\n\n## Content Security Policy (CSP)\n\nIf your site uses a Content Security Policy, add these directives:\n\n```\nscript-src: 'self' https://cdn.activereach.ai;\nconnect-src: 'self' https://*.activereach.ai;\nstyle-src: 'self' 'unsafe-inline';\nimg-src: 'self' https://*.activereach.ai data:;\n```\n\nIf using DOMPurify via CDN, also add:\n\n```\nscript-src: https://cdnjs.cloudflare.com;\n```\n\n**Common error when CSP is missing:** `Refused to connect to 'https://...activereach.ai'` — add the domain to `connect-src`.\n\n---\n\n## Security\n\n- **Write Key**: Publishable client-side identifier. Cannot read data or modify server state. Safe to embed in source code.\n- **HTML Sanitization**: Uses [DOMPurify](https://github.com/cure53/DOMPurify) when available with a strict allowlist. Falls back to text-only rendering.\n- **URL Validation**: All URLs validated — `javascript:` and `data:` protocols blocked.\n- **Consent**: Events are dropped (not queued) when consent is denied and `wait_for_consent` is enabled.\n- **Transport**: All API calls use HTTPS with bearer token authentication.\n\n### What NOT to track\n\nNever pass sensitive data as event properties:\n\n```typescript\n// Never do this\naegis.track('Login', { password: '...' });\naegis.identify('user_123', { ssn: '...', credit_card: '...' });\n```\n\nThe SDK does not filter or redact properties. You are responsible for ensuring no PII beyond what you intend to collect is included in event payloads.\n\n---\n\n## Debugging\n\n```typescript\naegis.debug(true);\n\n// Or via init\naegis.init('KEY', { debug: true });\n```\n\nConsole output:\n\n```\n[Aegis] Initializing SDK...\n[Aegis] Event queued: track { button_name: 'Sign Up' }\n[Aegis] Flushing 5 events\n[Aegis] Batch sent successfully\n```\n\n---\n\n## Subpath Exports\n\n| Import Path | Description |\n|-------------|-------------|\n| `@active-reach/web-sdk` | Core SDK (track, identify, page, group, alias) |\n| `@active-reach/web-sdk/react` | React Provider + hooks |\n| `@active-reach/web-sdk/push` | Web Push notification manager |\n| `@active-reach/web-sdk/cdn` | IIFE bundle for `