diff --git a/eslint.config.mjs b/eslint.config.mjs
index 97a5b423..4d45416a 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -14,6 +14,17 @@ const compat = new FlatCompat({
 });
 
 export default [
+  {
+    // Generated files: skip linting. `types.gen.ts` and the companion
+    // `config/index.ts` re-export are regenerated by @hey-api/openapi-ts
+    // from the serving OpenAPI spec, so any prettier cleanup would be
+    // wiped on the next regen. The local override for ExperienceTypes
+    // uses a deliberately different multi-line shape.
+    ignores: [
+      '**/packages/types/src/config/types.gen.ts',
+      '**/packages/types/src/config/index.ts'
+    ]
+  },
   {
     files: ['**/*.ts', '**/*.tsx'],
     ignores: ['.yarn', '.vscode', '.github', 'node_modules']
diff --git a/package.json b/package.json
index bbc1a68e..99e31810 100644
--- a/package.json
+++ b/package.json
@@ -1,4 +1,5 @@
 {
+  "packageManager": "yarn@4.5.3",
   "scripts": {
     "api:lint": "cd packages/api && yarn lint",
     "bucketing:lint": "cd packages/bucketing && yarn lint",
diff --git a/packages/data/src/data-manager.ts b/packages/data/src/data-manager.ts
index 210f4c25..bd8ac77f 100644
--- a/packages/data/src/data-manager.ts
+++ b/packages/data/src/data-manager.ts
@@ -43,7 +43,8 @@ import {
   ConfigAudienceTypes,
   VariationStatuses,
   eventType,
-  GenericListMatchingOptions
+  GenericListMatchingOptions,
+  RuleDataProvider
 } from '@convertcom/js-sdk-types';
 
 import {
@@ -83,6 +84,7 @@ export class DataManager implements DataManagerInterface {
   private _asyncStorage: boolean;
   private _environment: string;
   private _mapper: (...args: any) => any;
+  private _ruleDataProvider: RuleDataProvider | null;
   /**
    * @param {Config} config
    * @param {Object} dependencies
@@ -121,6 +123,23 @@ export class DataManager implements DataManagerInterface {
     this._config = config;
     this._mapper = config?.mapper || ((value: any) => value);
     this._asyncStorage = asyncStorage;
+    this._ruleDataProvider = config?.ruleDataProvider || null;
+    // Guard: a misconfigured provider (missing the `name: 'RuleData'`
+    // discriminator) falls through RuleManager's "flat-key" branch and
+    // silently returns false for every rule — i.e. no audiences match,
+    // no experiences run, no errors thrown. Warn loudly at construction
+    // so the misconfiguration surfaces immediately instead of as silent
+    // data loss across the entire visitor population.
+    if (
+      this._ruleDataProvider &&
+      !this._ruleManager.isUsingCustomInterface(this._ruleDataProvider)
+    ) {
+      this._loggerManager?.warn?.(
+        'DataManager()',
+        ERROR_MESSAGES.RULE_DATA_PROVIDER_INVALID
+      );
+      this._ruleDataProvider = null;
+    }
     this._data = objectDeepValue(config, 'data');
     this._accountId = this._data?.account_id;
     this._projectId = this._data?.project?.id;
@@ -288,10 +307,13 @@ export class DataManager implements DataManagerInterface {
       isBucketed = true;
     }
 
-    // Check location rules against locationProperties
+    // Check location rules against locationProperties.
+    // Enter the eval block if EITHER a per-call locationProperties OR a
+    // globally-configured ruleDataProvider is available — the outer gate
+    // would otherwise skip the eval when only the provider is set.
     let locationMatched: boolean | RuleError =
       ignoreLocationProperties === true;
-    if (!locationMatched && locationProperties) {
+    if (!locationMatched && (locationProperties || this._ruleDataProvider)) {
       if (Array.isArray(experience?.locations) && experience.locations.length) {
         let matchedLocations = [];
         // Get attached locations
@@ -317,7 +339,7 @@ export class DataManager implements DataManagerInterface {
       } else if (experience?.site_area) {
         // Validate locationProperties against site area rules
         locationMatched = this._ruleManager.isRuleMatched(
-          locationProperties,
+          locationProperties || this._ruleDataProvider,
           experience.site_area,
           'SiteArea'
         );
@@ -347,7 +369,10 @@ export class DataManager implements DataManagerInterface {
       return null;
     }
 
-    // Check audience rules against visitorProperties
+    // Check audience rules against visitorProperties.
+    // Same gate-broadening as above: enter the eval block if either a
+    // per-call visitorProperties OR a global ruleDataProvider exists,
+    // otherwise the provider is unreachable from the audience path.
     let audiences = [],
       segments = [],
       matchedAudiences = [],
@@ -355,7 +380,7 @@ export class DataManager implements DataManagerInterface {
       audiencesToCheck: Array<ConfigAudience> = [],
       audiencesMatched = false,
       segmentsMatched = false;
-    if (visitorProperties) {
+    if (visitorProperties || this._ruleDataProvider) {
       if (Array.isArray(experience?.audiences) && experience.audiences.length) {
         // Get attached transient and/or permnent audiences
         audiences = this.getItemsByIds(
@@ -709,7 +734,8 @@ export class DataManager implements DataManagerInterface {
         ...{
           experienceId: experience?.id,
           experienceName: experience?.name,
-          experienceKey: experience?.key
+          experienceKey: experience?.key,
+          experienceType: experience?.type
         },
         bucketingAllocation,
         ...variation
@@ -856,7 +882,7 @@ export class DataManager implements DataManagerInterface {
       for (let i = 0, length = items.length; i < length; i++) {
         if (!items?.[i]?.rules) continue;
         match = this._ruleManager.isRuleMatched(
-          locationProperties,
+          locationProperties || this._ruleDataProvider,
           items[i].rules,
           `ConfigLocation #${items[i][identityField]}`
         );
@@ -997,10 +1023,19 @@ export class DataManager implements DataManagerInterface {
       return;
     }
 
-    if (goalRule) {
-      if (!goal?.rules) return;
+    // Two separate concerns:
+    //   1. Pre-PR contract: if the caller explicitly passes `goalRule` to a
+    //      goal that itself has no rules, the conversion is a no-op. This
+    //      surfaces the call-site misunderstanding instead of firing
+    //      silently. Preserved here.
+    //   2. PR addition: a globally-configured `ruleDataProvider` should
+    //      ONLY participate in rule evaluation when the goal actually has
+    //      rules. Otherwise rule-less goals would be silently dropped on
+    //      every visitor when a provider is set.
+    if (goalRule && !goal?.rules) return;
+    if (goal?.rules && (goalRule || this._ruleDataProvider)) {
       const ruleMatched = this._ruleManager.isRuleMatched(
-        goalRule,
+        goalRule || this._ruleDataProvider,
         goal.rules,
         `ConfigGoal #${goalId}`
       );
@@ -1112,7 +1147,7 @@ export class DataManager implements DataManagerInterface {
       for (let i = 0, length = items.length; i < length; i++) {
         if (!items?.[i]?.rules) continue;
         match = this._ruleManager.isRuleMatched(
-          visitorProperties,
+          visitorProperties || this._ruleDataProvider,
           items[i].rules,
           `${camelCase(entityType)} #${items[i][field]}`
         );
diff --git a/packages/data/tests/data-manager.tests.ts b/packages/data/tests/data-manager.tests.ts
index 1be0a3fa..27c31fb7 100644
--- a/packages/data/tests/data-manager.tests.ts
+++ b/packages/data/tests/data-manager.tests.ts
@@ -14,6 +14,7 @@ import testConfig from './test-config.json';
 import {Config as ConfigType} from '@convertcom/js-sdk-types';
 import {objectDeepMerge} from '@convertcom/js-sdk-utils';
 import {defaultConfig} from '../../js-sdk/src/config/default';
+import {awaitTrackRequest} from '../../js-sdk/tests/setup/track-request';
 
 class DataStore {
   data = {};
@@ -71,7 +72,7 @@ describe('DataManager tests', function () {
       customSegments: ['seg1', 'seg2']
     };
   let dataManager, accountId, projectId, storeKey, server;
-  // eslint-disable-next-line mocha/no-hooks-for-single-case
+
   before(function () {
     accountId = configuration?.data?.account_id;
     projectId = configuration?.data?.project?.id;
@@ -83,12 +84,12 @@ describe('DataManager tests', function () {
       apiManager
     });
   });
-  // eslint-disable-next-line mocha/no-hooks-for-single-case
+
   beforeEach(function () {
     server = http.createServer();
     server.listen(port);
   });
-  // eslint-disable-next-line mocha/no-hooks-for-single-case
+
   afterEach(function () {
     dataManager.reset();
     server.closeAllConnections();
@@ -307,7 +308,6 @@ describe('DataManager tests', function () {
     });
   });
   describe('Persistent Data Store enqueue tests', function () {
-    // eslint-disable-next-line mocha/no-hooks-for-single-case
     before(function () {
       configuration.dataStore = dataStore;
       dataManager = new dm(
@@ -357,7 +357,6 @@ describe('DataManager tests', function () {
     });
   });
   describe('Persistent Data Store tests (set immediately)', function () {
-    // eslint-disable-next-line mocha/no-hooks-for-single-case
     before(function () {
       dataStore.data = {};
       delete configuration.dataStore;
@@ -398,4 +397,173 @@ describe('DataManager tests', function () {
       expect(check).to.have.property('segments').that.deep.equal(segments);
     });
   });
+  describe('Test ruleDataProvider integration', function () {
+    let receivedRuleData;
+    let provider;
+
+    before(function () {
+      // Mock RuleManager that captures what data shape was passed to isRuleMatched
+      const capturingRuleManager: any = {
+        isRuleMatched: (data) => {
+          receivedRuleData = data;
+          return true;
+        },
+        isUsingCustomInterface: (data) => !!data && data.name === 'RuleData'
+      };
+      provider = {
+        name: 'RuleData',
+        getGenericTextKeyValue: () => 'something'
+      };
+      const configWithProvider = objectDeepMerge(configuration, {
+        ruleDataProvider: provider,
+        dataStore: undefined
+      }) as unknown as ConfigType;
+      dataManager = new dm(configWithProvider, {
+        bucketingManager,
+        ruleManager: capturingRuleManager,
+        eventManager,
+        apiManager
+      });
+    });
+    beforeEach(function () {
+      receivedRuleData = undefined;
+    });
+    it('Should use ruleDataProvider when no per-call visitorProperties is supplied', async function () {
+      // Per-call wins, so when the caller omits visitorProperties the
+      // global provider supplies the rule data.
+      this.timeout(test_timeout);
+      const experienceKey = 'test-experience-ab-fullstack-2';
+      dataManager.getBucketing(visitorId, experienceKey, {
+        locationProperties: {url: 'https://convert.com/'}
+      });
+      await awaitTrackRequest(server, `/track/${accountId}/${projectId}`);
+      expect(receivedRuleData)
+        .to.be.an('object')
+        .that.has.property('name', 'RuleData');
+      expect(receivedRuleData).to.equal(provider);
+    });
+    it('Should let per-call visitorProperties win over a configured ruleDataProvider', async function () {
+      // Precedence guard: a caller who explicitly supplies
+      // visitorProperties is opting out of the provider for that call,
+      // matching standard config-vs-args layering.
+      this.timeout(test_timeout);
+      const experienceKey = 'test-experience-ab-fullstack-2';
+      dataManager.getBucketing(visitorId, experienceKey, {
+        visitorProperties: {varName3: 'plain-value'},
+        locationProperties: {url: 'https://convert.com/'}
+      });
+      await awaitTrackRequest(server, `/track/${accountId}/${projectId}`);
+      expect(receivedRuleData).to.be.an('object');
+      expect(receivedRuleData).to.not.have.property('name', 'RuleData');
+      expect(receivedRuleData).to.have.property('varName3', 'plain-value');
+    });
+    it('Should fall back to plain visitorProperties when no ruleDataProvider is set', async function () {
+      this.timeout(test_timeout);
+      const noProviderConfig = objectDeepMerge(configuration, {
+        ruleDataProvider: undefined,
+        dataStore: undefined
+      }) as unknown as ConfigType;
+      const capturingRuleManager: any = {
+        isRuleMatched: (data) => {
+          receivedRuleData = data;
+          return true;
+        },
+        isUsingCustomInterface: (data) => !!data && data.name === 'RuleData'
+      };
+      const localDataManager = new dm(noProviderConfig, {
+        bucketingManager,
+        ruleManager: capturingRuleManager,
+        eventManager,
+        apiManager
+      });
+      const experienceKey = 'test-experience-ab-fullstack-2';
+      localDataManager.getBucketing(visitorId, experienceKey, {
+        visitorProperties: {varName3: 'plain-value'},
+        locationProperties: {url: 'https://convert.com/'}
+      });
+      await awaitTrackRequest(server, `/track/${accountId}/${projectId}`);
+      // No provider configured — RuleManager should see the plain object.
+      expect(receivedRuleData).to.be.an('object');
+      expect(receivedRuleData).to.not.have.property('name', 'RuleData');
+      expect(receivedRuleData).to.have.property('varName3', 'plain-value');
+    });
+    it('Should warn and ignore a misconfigured ruleDataProvider (missing name)', function () {
+      // A provider that doesn't satisfy isUsingCustomInterface (no
+      // `name: 'RuleData'`) would otherwise fall through RuleManager's
+      // flat-key branch and silently return false for every rule. The
+      // DataManager constructor must surface the misconfiguration as a
+      // warn and ignore the provider so the SDK falls back to plain
+      // visitor/location properties.
+      const warns: Array<Array<any>> = [];
+      const capturingLogger: any = {
+        warn: (...args: any[]) => warns.push(args),
+        error: () => {},
+        info: () => {},
+        debug: () => {},
+        trace: () => {}
+      };
+      const badProvider = {country: 'CA'}; // missing name: 'RuleData'
+      const badConfig = objectDeepMerge(configuration, {
+        ruleDataProvider: badProvider,
+        dataStore: undefined
+      }) as unknown as ConfigType;
+      const localDataManager = new dm(badConfig, {
+        bucketingManager,
+        ruleManager,
+        eventManager,
+        apiManager,
+        loggerManager: capturingLogger
+      });
+      assert.isDefined(localDataManager);
+      const warned = warns.some((entry) =>
+        entry.some(
+          (a) =>
+            typeof a === 'string' &&
+            a.includes('Config.ruleDataProvider is set')
+        )
+      );
+      expect(warned).to.equal(true);
+    });
+    it('Should fire conversion for a rule-less goal even when ruleDataProvider is configured', async function () {
+      // Regression guard: if convert() always enters the rule-evaluation
+      // branch when a global ruleDataProvider is set, it would hit
+      // `if (!goal?.rules) return;` and silently drop every conversion for
+      // goals that have no rules. The fix gates on `goal.rules` first.
+      this.timeout(test_timeout);
+      const ruleLessGoal = {
+        id: '90000001',
+        name: 'Rule-less goal',
+        key: 'rule-less-goal',
+        type: 'event'
+        // intentionally no `rules` field
+      };
+      const configWithProvider = objectDeepMerge(configuration, {
+        ruleDataProvider: {
+          name: 'RuleData',
+          getUrl: () => 'https://convert.com/'
+        },
+        dataStore: undefined,
+        data: {
+          ...configuration.data,
+          goals: [...configuration.data.goals, ruleLessGoal]
+        }
+      }) as unknown as ConfigType;
+      const localDataManager = new dm(configWithProvider, {
+        bucketingManager,
+        ruleManager,
+        eventManager,
+        apiManager
+      });
+      const triggered = localDataManager.convert(
+        visitorId,
+        ruleLessGoal.key,
+        undefined, // no goalRule passed
+        undefined,
+        {}
+      );
+      await awaitTrackRequest(server, `/track/${accountId}/${projectId}`);
+      // convert() returns `true` when the conversion fires
+      expect(triggered).to.equal(true);
+    });
+  });
 });
diff --git a/packages/enums/src/dictionary.ts b/packages/enums/src/dictionary.ts
index 2176f83e..aec63c0c 100644
--- a/packages/enums/src/dictionary.ts
+++ b/packages/enums/src/dictionary.ts
@@ -20,7 +20,9 @@ export const ERROR_MESSAGES = {
   GOAL_DATA_NOT_VALID: 'GoalData object is not valid',
   UNABLE_TO_SELECT_BUCKET_FOR_VISITOR: 'Unable to bucket visitor',
   UNABLE_TO_PERFORM_NETWORK_REQUEST: 'Unable to perform network request',
-  UNSUPPORTED_RESPONSE_TYPE: 'Unsupported response type'
+  UNSUPPORTED_RESPONSE_TYPE: 'Unsupported response type',
+  RULE_DATA_PROVIDER_INVALID:
+    'Config.ruleDataProvider is set but does not satisfy the RuleData custom-interface contract (requires name: RuleData and rule-type getter methods on its constructor prototype). Provider has been ignored — falling back to plain visitor/location properties. See @convertcom/js-sdk-types#RuleDataProvider for the expected shape.'
 };
 export const MESSAGES = {
   CONFIG_DATA_UPDATED: 'Config Data updated',
@@ -69,5 +71,20 @@ export const MESSAGES = {
   CUSTOM_SEGMENTS_KEY_FOUND: 'Custom segments key already set',
   SEND_BEACON_SUCCESS:
     'The user agent successfully queued the data for transfer',
-  RELEASING_QUEUE: 'Releasing event queue...'
+  RELEASING_QUEUE: 'Releasing event queue...',
+  RUN_VARIATION_BROWSER_ONLY: 'runVariation requires a browser environment',
+  RUN_VARIATION_EXPERIENCE_NOT_FOUND:
+    'runVariation: experience # not found in config',
+  RUN_VARIATION_REDIRECT_SKIPPED:
+    'runVariation: skipping defaultRedirect change (handled by Split Bundle)',
+  RUN_VARIATION_FULLSTACK_SKIPPED:
+    'runVariation: skipping fullStackFeature change (use runFeature)',
+  RUN_VARIATION_RICH_STRUCTURE_SKIPPED:
+    'runVariation: skipping richStructure change # (selector-scoped DOM mutations not supported by this renderer)',
+  RUN_VARIATION_MULTIPAGE_PAGE:
+    'runVariation: applying defaultCodeMultipage change # for page_id=# (caller is responsible for funnel-step matching)',
+  RUN_VARIATION_TOOLKIT_MISSING:
+    'runVariation: window.convert.T (Convert Toolkit) is not loaded; Visual Editor changes may fail',
+  RUN_VARIATION_STYLE_ERROR: 'runVariation: error injecting style #',
+  RUN_VARIATION_SCRIPT_ERROR: 'runVariation: error executing change script #'
 };
diff --git a/packages/experience/src/experience-manager.ts b/packages/experience/src/experience-manager.ts
index 1b544d6c..62b42909 100644
--- a/packages/experience/src/experience-manager.ts
+++ b/packages/experience/src/experience-manager.ts
@@ -112,6 +112,16 @@ export class ExperienceManager implements ExperienceManagerInterface {
     experienceKey: string,
     attributes: BucketingAttributes
   ): BucketedVariation | RuleError | BucketingError {
+    // Honor `experienceTypes` filter — keep parity with selectVariations
+    // and FeatureManager.runFeatures. Without this gate, the singular
+    // path silently ignores the filter even though it's advertised on
+    // BucketingAttributes. See semantics note in selectVariations().
+    const typeFilter = attributes?.experienceTypes;
+    if (typeFilter) {
+      if (typeFilter.length === 0) return null;
+      const experience = this.getExperience(experienceKey);
+      if (experience && !typeFilter.includes(experience.type)) return null;
+    }
     return this._dataManager.getBucketing(visitorId, experienceKey, attributes);
   }
 
@@ -133,6 +143,12 @@ export class ExperienceManager implements ExperienceManagerInterface {
     experienceId: string,
     attributes: BucketingAttributes
   ): BucketedVariation | RuleError | BucketingError {
+    const typeFilter = attributes?.experienceTypes;
+    if (typeFilter) {
+      if (typeFilter.length === 0) return null;
+      const experience = this.getExperienceById(experienceId);
+      if (experience && !typeFilter.includes(experience.type)) return null;
+    }
     return this._dataManager.getBucketingById(
       visitorId,
       experienceId,
@@ -156,8 +172,26 @@ export class ExperienceManager implements ExperienceManagerInterface {
     visitorId: string,
     attributes: BucketingAttributes
   ): Array<BucketedVariation | RuleError | BucketingError> {
+    const typeFilter = attributes?.experienceTypes;
+    // `experienceTypes` semantics:
+    //   - undefined → no filter applied (all experience types match)
+    //   - []        → zero types allowed (no experiences match) — matches
+    //                 standard array-filter intuition. Callers who want
+    //                 "all" must pass undefined or omit the option.
+    //   - [...]     → only experiences whose `type` is in the array
+    if (typeFilter && typeFilter.length === 0) return [];
     return this.getList()
+      .filter((experience) => {
+        if (!typeFilter) return true;
+        return typeFilter.includes(experience?.type);
+      })
       .map((experience) => {
+        // Defense-in-depth: selectVariation re-applies the same
+        // experienceTypes filter on its singular path. The list above
+        // has already been filtered, so the inner check is redundant
+        // here — left intact so callers of selectVariation directly
+        // get the same semantics. The Array.includes() per experience
+        // is negligible.
         return this.selectVariation(visitorId, experience?.key, attributes);
       })
       .filter(
diff --git a/packages/experience/tests/experience-manager.tests.ts b/packages/experience/tests/experience-manager.tests.ts
index 9a417c14..c7803d2e 100644
--- a/packages/experience/tests/experience-manager.tests.ts
+++ b/packages/experience/tests/experience-manager.tests.ts
@@ -14,6 +14,7 @@ import testConfig from './test-config.json';
 import {Config as ConfigType} from '@convertcom/js-sdk-types';
 import {objectDeepMerge} from '@convertcom/js-sdk-utils';
 import {defaultConfig} from '../../js-sdk/src/config/default';
+import {awaitTrackRequest} from '../../js-sdk/tests/setup/track-request';
 
 const host = 'http://localhost';
 const port = 8090;
@@ -41,7 +42,7 @@ const apiManager = new am(configuration, {eventManager});
 describe('ExperienceManager tests', function () {
   const visitorId = 'XXX';
   let dataManager, experienceManager, accountId, projectId, server;
-  // eslint-disable-next-line mocha/no-hooks-for-single-case
+
   before(function () {
     accountId = configuration?.data?.account_id;
     projectId = configuration?.data?.project?.id;
@@ -53,12 +54,12 @@ describe('ExperienceManager tests', function () {
     });
     experienceManager = new exm(configuration, {dataManager});
   });
-  // eslint-disable-next-line mocha/no-hooks-for-single-case
+
   beforeEach(function () {
     server = http.createServer();
     server.listen(port);
   });
-  // eslint-disable-next-line mocha/no-hooks-for-single-case
+
   afterEach(function () {
     dataManager.reset();
     server.closeAllConnections();
@@ -220,4 +221,100 @@ describe('ExperienceManager tests', function () {
         .to.equal(variationKey);
     });
   });
+  describe('Test experienceType field on BucketedVariation', function () {
+    it('Should populate experienceType from the source experience config', async function () {
+      this.timeout(test_timeout);
+      const experienceKey = 'test-experience-ab-fullstack-2';
+      const variation = experienceManager.selectVariation(
+        visitorId,
+        experienceKey,
+        {
+          visitorProperties: {varName3: 'something'},
+          locationProperties: {url: 'https://convert.com/'}
+        }
+      );
+      await awaitTrackRequest(server, `/track/${accountId}/${projectId}`);
+      expect(variation).to.be.an('object').that.has.property('experienceType');
+      expect(variation.experienceType).to.equal('a/b_fullstack');
+    });
+  });
+  describe('Test experienceTypes filter on selectVariations', function () {
+    it('Should return all experiences when no type filter is set', async function () {
+      this.timeout(test_timeout);
+      const variations = experienceManager.selectVariations(visitorId, {
+        visitorProperties: {varName3: 'something'},
+        locationProperties: {url: 'https://convert.com/'}
+      });
+      await awaitTrackRequest(server, `/track/${accountId}/${projectId}`);
+      expect(variations).to.be.an('array').that.has.length(2);
+    });
+    it('Should keep all fullstack experiences when experienceTypes=["a/b_fullstack"]', async function () {
+      this.timeout(test_timeout);
+      const variations = experienceManager.selectVariations(visitorId, {
+        visitorProperties: {varName3: 'something'},
+        locationProperties: {url: 'https://convert.com/'},
+        experienceTypes: ['a/b_fullstack']
+      });
+      await awaitTrackRequest(server, `/track/${accountId}/${projectId}`);
+      expect(variations).to.be.an('array').that.has.length(2);
+      variations.forEach((v) => {
+        expect(v.experienceType).to.equal('a/b_fullstack');
+      });
+    });
+    it('Should return empty when filtering by a type with no matching experiences', function () {
+      const variations = experienceManager.selectVariations(visitorId, {
+        visitorProperties: {varName3: 'something'},
+        locationProperties: {url: 'https://convert.com/'},
+        experienceTypes: ['feature_rollout']
+      });
+      expect(variations).to.be.an('array').that.has.length(0);
+    });
+    it('Should return empty when filtering by web type (no web experiences in config)', function () {
+      const variations = experienceManager.selectVariations(visitorId, {
+        visitorProperties: {varName3: 'something'},
+        locationProperties: {url: 'https://convert.com/'},
+        experienceTypes: ['a/b']
+      });
+      expect(variations).to.be.an('array').that.has.length(0);
+    });
+    it('Should return empty when experienceTypes is an empty array', function () {
+      // [] means "zero types allowed" → no matches. Differs from
+      // undefined which means "no filter applied".
+      const variations = experienceManager.selectVariations(visitorId, {
+        visitorProperties: {varName3: 'something'},
+        locationProperties: {url: 'https://convert.com/'},
+        experienceTypes: []
+      });
+      expect(variations).to.be.an('array').that.has.length(0);
+    });
+  });
+  describe('Test experienceTypes filter on selectVariation (singular)', function () {
+    it('Should return null when the experience type is not in the filter', function () {
+      const result = experienceManager.selectVariation(
+        visitorId,
+        'test-experience-ab-fullstack-2',
+        {
+          visitorProperties: {varName3: 'something'},
+          locationProperties: {url: 'https://convert.com/'},
+          experienceTypes: ['a/b'] // experience is a/b_fullstack
+        }
+      );
+      expect(result).to.equal(null);
+    });
+    it('Should bucket normally when the experience type IS in the filter', async function () {
+      this.timeout(test_timeout);
+      const variation = experienceManager.selectVariation(
+        visitorId,
+        'test-experience-ab-fullstack-2',
+        {
+          visitorProperties: {varName3: 'something'},
+          locationProperties: {url: 'https://convert.com/'},
+          experienceTypes: ['a/b_fullstack']
+        }
+      );
+      await awaitTrackRequest(server, `/track/${accountId}/${projectId}`);
+      expect(variation).to.be.an('object');
+      expect(variation).to.have.property('experienceType', 'a/b_fullstack');
+    });
+  });
 });
diff --git a/packages/js-sdk/package.json b/packages/js-sdk/package.json
index 26d93ee1..2cb07a98 100644
--- a/packages/js-sdk/package.json
+++ b/packages/js-sdk/package.json
@@ -19,7 +19,7 @@
     "pretest": "rm -rf coverage",
     "test": "nyc yarn test:all && yarn coverage",
     "test:all": "yarn test:mocha && yarn test:browser",
-    "test:browser": "playwright test --config playwright.config.ts --project chromium",
+    "test:browser": "playwright install chromium && playwright test --config playwright.config.ts --project chromium",
     "test:server": "nyc yarn test:mocha",
     "test:mocha": "mocha -r ts-node/register --recursive \"tests/**/*.tests.ts\" --exit",
     "clean": "rm -rf lib",
diff --git a/packages/js-sdk/src/context.ts b/packages/js-sdk/src/context.ts
index f83180f6..b8acc8b7 100644
--- a/packages/js-sdk/src/context.ts
+++ b/packages/js-sdk/src/context.ts
@@ -29,8 +29,10 @@ import {
   BucketingError,
   ERROR_MESSAGES,
   EntityType,
+  MESSAGES,
   RuleError,
-  SystemEvents
+  SystemEvents,
+  VariationChangeType
 } from '@convertcom/js-sdk-enums';
 import {objectDeepMerge, objectNotEmpty} from '@convertcom/js-sdk-utils';
 import {SegmentsManagerInterface} from '@convertcom/js-sdk-segments';
@@ -54,6 +56,10 @@ export class Context implements ContextInterface {
   private _visitorId: string;
   private _visitorProperties: Record<string, any>;
   private _environment: string;
+  private _contentSecurityPolicyNonce?: string;
+  // `undefined` = not yet resolved; once resolved (either from config or
+  // DOM auto-detect) we cache to avoid re-querying the DOM on every change.
+  private _cspNonceResolved: boolean = false;
 
   /**
    * @param {Config} config
@@ -92,6 +98,7 @@ export class Context implements ContextInterface {
     this._visitorId = visitorId;
 
     this._config = config;
+    this._contentSecurityPolicyNonce = config?.contentSecurityPolicyNonce;
     this._eventManager = eventManager;
     this._experienceManager = experienceManager;
     this._featureManager = featureManager;
@@ -139,6 +146,7 @@ export class Context implements ContextInterface {
         visitorProperties, // represents audiences
         locationProperties: attributes?.locationProperties, // represents site_area/locations
         updateVisitorProperties: attributes?.updateVisitorProperties,
+        experienceTypes: attributes?.experienceTypes,
         environment: attributes?.environment || this._environment
       }
     );
@@ -193,6 +201,7 @@ export class Context implements ContextInterface {
         visitorProperties, // represents audiences
         locationProperties: attributes?.locationProperties, // represents site_area/locations
         updateVisitorProperties: attributes?.updateVisitorProperties,
+        experienceTypes: attributes?.experienceTypes,
         environment: attributes?.environment || this._environment
       }
     );
@@ -258,6 +267,7 @@ export class Context implements ContextInterface {
         visitorProperties,
         locationProperties: attributes?.locationProperties,
         updateVisitorProperties: attributes?.updateVisitorProperties,
+        experienceTypes: attributes?.experienceTypes,
         typeCasting: Object.prototype.hasOwnProperty.call(
           attributes || {},
           'typeCasting'
@@ -338,6 +348,7 @@ export class Context implements ContextInterface {
       visitorProperties,
       locationProperties: attributes?.locationProperties,
       updateVisitorProperties: attributes?.updateVisitorProperties,
+      experienceTypes: attributes?.experienceTypes,
       typeCasting: Object.prototype.hasOwnProperty.call(
         attributes || {},
         'typeCasting'
@@ -370,6 +381,303 @@ export class Context implements ContextInterface {
     return bucketedFeatures as Array<BucketedFeature>;
   }
 
+  /**
+   * Apply web variation changes (CSS, JS, custom JS) to the DOM.
+   *
+   * Execution order, matching the tracking script monolith:
+   *   1. experience.global_css → <style>
+   *   2. experience.global_js  → <script>
+   *   3. For each change in variation.changes[]:
+   *      a. change.data.css        → <style>
+   *      b. change.data.js         → <script>  (defaultCode: Visual Editor
+   *                                              generated, calls convert.T.*;
+   *                                              customCode: user-written)
+   *      c. change.data.custom_js  → <script>  (defaultCode only)
+   *
+   * Supported change types: `defaultCode`, `customCode`, `defaultCodeMultipage`.
+   *
+   * Skipped change types:
+   *   - `fullStackFeature` — handled by `runFeature`.
+   *   - `defaultRedirect`  — handled by the Split Bundle, which must run
+   *     before this method.
+   *   - `richStructure`    — selector-scoped DOM mutations not yet
+   *     supported by this renderer; logged at debug level. Authors using
+   *     richStructure should rely on the tracking-script monolith for
+   *     application until the SDK gains a selector-aware queue.
+   *
+   * **Multipage caveat:** `defaultCodeMultipage.data.page_id` identifies
+   * which funnel step the change targets. This method applies the change
+   * unconditionally — it is the caller's responsibility to invoke
+   * `runVariation` only on the matching page. A debug log records the
+   * page_id so the caller can correlate.
+   *
+   * Idempotent: tracks applied CSS/JS via DOM marker IDs, so re-calling with
+   * the same variation is a no-op.
+   *
+   * Browser-only. No-ops with a logged warning in server environments.
+   *
+   * @param {BucketedVariation} bucketedVariation A variation returned from runExperience()
+   * @param {Object=} options
+   * @param {ConfigExperience=} options.experience Optional experience override (otherwise looked up by experienceKey)
+   */
+  runVariation(
+    bucketedVariation: BucketedVariation,
+    options?: {experience?: ConfigExperience}
+  ): void {
+    if (typeof document === 'undefined' || typeof window === 'undefined') {
+      this._loggerManager?.warn?.(
+        'Context.runVariation()',
+        MESSAGES.RUN_VARIATION_BROWSER_ONLY
+      );
+      return;
+    }
+    if (!bucketedVariation) return;
+
+    const experience =
+      options?.experience ||
+      (this.getConfigEntity(
+        bucketedVariation.experienceKey,
+        EntityType.EXPERIENCE
+      ) as ConfigExperience);
+
+    if (!experience) {
+      this._loggerManager?.warn?.(
+        'Context.runVariation()',
+        MESSAGES.RUN_VARIATION_EXPERIENCE_NOT_FOUND.replace(
+          '#',
+          String(bucketedVariation.experienceKey)
+        )
+      );
+    }
+
+    // Fallback to 'unknown' if both ids are missing so marker IDs never
+    // interpolate `undefined` (which would collide with any other change
+    // that also produced an undefined id).
+    const experienceId =
+      experience?.id ?? bucketedVariation.experienceId ?? 'unknown';
+
+    // Toolkit warning only fires for `defaultCode.data.js` — that field is
+    // Visual Editor output that calls `convert.T.*`. `customCode.data.js`
+    // is user-written and doesn't need the Toolkit; `richStructure.data.js`
+    // is skipped entirely below.
+    if (
+      !(window as any).convert?.T &&
+      Array.isArray(bucketedVariation.changes) &&
+      bucketedVariation.changes.some(
+        (c) =>
+          c?.type === VariationChangeType.DEFAULT_CODE &&
+          (c as {data?: {js?: string}})?.data?.js
+      )
+    ) {
+      this._loggerManager?.warn?.(
+        'Context.runVariation()',
+        MESSAGES.RUN_VARIATION_TOOLKIT_MISSING
+      );
+    }
+
+    if (experience?.global_css) {
+      this._injectStyle(
+        `conv-exp-${experienceId}-global-css`,
+        experience.global_css
+      );
+    }
+    if (experience?.global_js) {
+      this._executeScript(
+        `conv-exp-${experienceId}-global-js`,
+        experience.global_js
+      );
+    }
+
+    // Per-change marker IDs are scoped by experience + variation + change.
+    // change.id is system-assigned and currently globally unique, but
+    // scoping defensively guards against future ID-semantics changes and
+    // against the case where two distinct configs are merged into one
+    // page (e.g. previewing one experience while another is live).
+    const variationId = bucketedVariation.id;
+    for (const change of bucketedVariation.changes ?? []) {
+      if (!change) continue;
+
+      if (change.type === VariationChangeType.FULLSTACK_FEATURE) {
+        this._loggerManager?.debug?.(
+          'Context.runVariation()',
+          MESSAGES.RUN_VARIATION_FULLSTACK_SKIPPED
+        );
+        continue;
+      }
+      if (change.type === VariationChangeType.DEFAULT_REDIRECT) {
+        this._loggerManager?.warn?.(
+          'Context.runVariation()',
+          MESSAGES.RUN_VARIATION_REDIRECT_SKIPPED
+        );
+        continue;
+      }
+      if (change.type === VariationChangeType.RICH_STRUCTURE) {
+        // richStructure changes are selector-scoped DOM mutations whose
+        // `data` is a polymorphic key-value map (see
+        // ExperienceChangeRichStructureDataBase in types.gen.ts).
+        // Applying the embedded `data.js` blob in isolation would skip
+        // the selector targeting the change depends on and could mutate
+        // the wrong elements. Skip until the SDK supports a
+        // selector-aware queue.
+        this._loggerManager?.debug?.(
+          'Context.runVariation()',
+          MESSAGES.RUN_VARIATION_RICH_STRUCTURE_SKIPPED.replace(
+            '#',
+            String((change as {id?: string | number})?.id ?? '?')
+          )
+        );
+        continue;
+      }
+
+      // Remaining supported change types: defaultCode, customCode,
+      // defaultCodeMultipage — all share `data.{css?, js?, custom_js?}`.
+      // ExperienceChangeServing is a discriminated union and TypeScript
+      // can't narrow it via the negative `continue`s above, so we
+      // restate the relevant subset structurally here.
+      const data = (
+        change as {
+          data?: {
+            css?: string | null;
+            js?: string | null;
+            custom_js?: string | null;
+            page_id?: string;
+          };
+        }
+      ).data;
+      if (!data) continue;
+
+      if (
+        change.type === VariationChangeType.DEFAULT_CODE_MULTIPAGE &&
+        data.page_id
+      ) {
+        // Caller is responsible for invoking runVariation only on the
+        // matching funnel step (the SDK doesn't know the current URL
+        // / page context). Log so the caller can correlate.
+        this._loggerManager?.debug?.(
+          'Context.runVariation()',
+          MESSAGES.RUN_VARIATION_MULTIPAGE_PAGE.replace(
+            '#',
+            String((change as {id?: string | number})?.id ?? '?')
+          ).replace('#', String(data.page_id))
+        );
+      }
+
+      const markerPrefix = `conv-chg-${experienceId}-${variationId}-${change.id}`;
+      if (data.css) {
+        this._injectStyle(`${markerPrefix}-css`, data.css);
+      }
+      if (data.js) {
+        this._executeScript(`${markerPrefix}-js`, data.js);
+      }
+      if (data.custom_js) {
+        this._executeScript(`${markerPrefix}-custom-js`, data.custom_js);
+      }
+    }
+  }
+
+  /**
+   * Resolve the CSP nonce to stamp on injected <style>/<script> elements.
+   * Mirrors the tracking-script monolith's `getContentSecurityPolicyNonce()`
+   * (workflow.ts in the backend repo):
+   *   1. Prefer the explicit `Config.contentSecurityPolicyNonce` value
+   *      captured at construction.
+   *   2. Otherwise scan the live DOM for `<script>`/`<style>` elements
+   *      carrying a nonce — read the IDL `.nonce` property because the
+   *      browser blanks the HTML `nonce` attribute on these elements
+   *      after they're connected (per the CSP spec). Fall back to
+   *      `getAttribute('nonce')` only for non-script/style elements
+   *      where the attribute is still visible.
+   * Cached after first call so the DOM scan happens at most once per
+   * Context instance. Skips empty-string nonces so an `<el nonce="">` on
+   * the page doesn't poison the cache and cause every subsequent
+   * injection to be tagged with an empty nonce (which the browser
+   * would reject under a strict CSP).
+   * @private
+   */
+  private _getCspNonce(): string | undefined {
+    if (this._cspNonceResolved) return this._contentSecurityPolicyNonce;
+    this._cspNonceResolved = true;
+    if (this._contentSecurityPolicyNonce) {
+      return this._contentSecurityPolicyNonce;
+    }
+    if (typeof document === 'undefined') return undefined;
+    try {
+      // Include `script` / `style` even without a `[nonce]` attribute:
+      // once connected, the browser blanks the HTML nonce attribute on
+      // these elements (per CSP spec) but preserves the IDL `.nonce`
+      // property, so a plain `[nonce]` selector misses them. `[nonce]`
+      // still catches nonces on arbitrary other elements where the
+      // attribute is visible. querySelectorAll returns matches in
+      // document-order and deduplicates, so the selector list reduces
+      // to roughly `script, style, [nonce]` at runtime.
+      const candidates = document.querySelectorAll('script, style, [nonce]');
+      for (let i = 0; i < candidates.length; i++) {
+        const el = candidates[i] as HTMLElement & {nonce?: string};
+        const candidate =
+          (typeof el.nonce === 'string' ? el.nonce : '') ||
+          el.getAttribute('nonce') ||
+          '';
+        if (candidate) {
+          this._contentSecurityPolicyNonce = candidate;
+          return this._contentSecurityPolicyNonce;
+        }
+      }
+    } catch (error) {
+      this._loggerManager?.error?.(
+        'Context.runVariation()',
+        `Error reading nonce from DOM: ${(error as Error)?.message}`
+      );
+    }
+    return this._contentSecurityPolicyNonce;
+  }
+
+  /**
+   * Inject a <style> tag identified by markerId. No-op if already injected.
+   * @private
+   */
+  private _injectStyle(markerId: string, css: string): void {
+    try {
+      if (document.getElementById(markerId)) return;
+      const style = document.createElement('style');
+      style.id = markerId;
+      style.setAttribute('type', 'text/css');
+      const nonce = this._getCspNonce();
+      if (nonce) style.setAttribute('nonce', nonce);
+      style.appendChild(document.createTextNode(css));
+      (document.head || document.documentElement).appendChild(style);
+    } catch (error) {
+      this._loggerManager?.error?.(
+        'Context.runVariation()',
+        MESSAGES.RUN_VARIATION_STYLE_ERROR.replace('#', markerId),
+        {message: (error as Error)?.message}
+      );
+    }
+  }
+
+  /**
+   * Inject a <script> tag identified by markerId. No-op if already injected
+   * (the script element with this id already exists in the DOM).
+   * @private
+   */
+  private _executeScript(markerId: string, code: string): void {
+    try {
+      if (document.getElementById(markerId)) return;
+      const script = document.createElement('script');
+      script.id = markerId;
+      script.setAttribute('type', 'text/javascript');
+      const nonce = this._getCspNonce();
+      if (nonce) script.setAttribute('nonce', nonce);
+      script.appendChild(document.createTextNode(code));
+      (document.head || document.documentElement).appendChild(script);
+    } catch (error) {
+      this._loggerManager?.error?.(
+        'Context.runVariation()',
+        MESSAGES.RUN_VARIATION_SCRIPT_ERROR.replace('#', markerId),
+        {message: (error as Error)?.message}
+      );
+    }
+  }
+
   /**
    * Trigger Conversion
    * @param {string} goalKey A goal key
diff --git a/packages/js-sdk/src/feature-manager.ts b/packages/js-sdk/src/feature-manager.ts
index 0590e526..cd61899a 100644
--- a/packages/js-sdk/src/feature-manager.ts
+++ b/packages/js-sdk/src/feature-manager.ts
@@ -329,18 +329,31 @@ export class FeatureManager implements FeatureManagerInterface {
     attributes: BucketingAttributes,
     filter?: Record<string, Array<string>>
   ): Array<BucketedFeature | RuleError> {
-    const {typeCasting = true} = attributes;
+    const {typeCasting = true, experienceTypes} = attributes;
     // Get list of declared features grouped by id
     const declaredFeatures = this.getListAsObject('id');
 
     const bucketedFeatures: Array<BucketedFeature> = [];
 
     // Retrieve all or filtered experiences
-    const experiences = (
+    const allExperiences = (
       filter && arrayNotEmpty(filter?.experiences)
         ? this._dataManager.getEntities(filter.experiences, 'experiences')
         : this._dataManager.getEntitiesList('experiences')
     ) as Array<ConfigExperience>;
+    // `experienceTypes` semantics (see BucketingAttributes JSDoc):
+    //   undefined → no filter, [] → zero allowed (no matches),
+    //   [...] → only experiences whose type is in the list.
+    let experiences: Array<ConfigExperience>;
+    if (experienceTypes && experienceTypes.length === 0) {
+      experiences = [];
+    } else if (experienceTypes) {
+      experiences = allExperiences.filter((experience) =>
+        experienceTypes.includes(experience?.type)
+      );
+    } else {
+      experiences = allExperiences;
+    }
 
     // Retrieve bucketed variations across the experiences
     const bucketedVariations = experiences
diff --git a/packages/js-sdk/src/interfaces/context.ts b/packages/js-sdk/src/interfaces/context.ts
index eb2d7acb..c7b1ecbf 100644
--- a/packages/js-sdk/src/interfaces/context.ts
+++ b/packages/js-sdk/src/interfaces/context.ts
@@ -9,6 +9,7 @@ import {
   BucketedFeature,
   BucketedVariation,
   BucketingAttributes,
+  ConfigExperience,
   ConversionAttributes,
   Entity,
   SegmentsAttributes,
@@ -36,6 +37,11 @@ export interface ContextInterface {
     attributes?: BucketingAttributes
   ): Array<BucketedFeature | RuleError>;
 
+  runVariation(
+    bucketedVariation: BucketedVariation,
+    options?: {experience?: ConfigExperience}
+  ): void;
+
   trackConversion(
     goalKey: string,
     attributes?: ConversionAttributes
diff --git a/packages/js-sdk/tests/browser/umd-bundle.spec.ts b/packages/js-sdk/tests/browser/umd-bundle.spec.ts
index 3779685a..e694bd18 100644
--- a/packages/js-sdk/tests/browser/umd-bundle.spec.ts
+++ b/packages/js-sdk/tests/browser/umd-bundle.spec.ts
@@ -72,7 +72,7 @@ const LOCATION_PROPS = {
 const cmp = (a: string, b: string) => a.localeCompare(b);
 const VARIATION_KEYS = [
   'bucketingAllocation', 'changes', 'experienceId', 'experienceKey',
-  'experienceName', 'id', 'is_baseline', 'key', 'name', 'status',
+  'experienceName', 'experienceType', 'id', 'is_baseline', 'key', 'name', 'status',
   'traffic_allocation'
 ].sort(cmp);
 const FEATURE_KEYS = [
@@ -337,6 +337,598 @@ test.describe('UMD bundle browser tests', () => {
     });
   });
 
+  test.describe('runVariation — web variation change rendering', () => {
+    // Helper: build a synthetic BucketedVariation with the requested change list
+    const makeFixture = () => ({
+      variation: {
+        id: '999',
+        key: 'test-var',
+        experienceId: 'rv-exp-1',
+        experienceKey: 'rv-experience',
+        experienceType: 'a/b',
+        traffic_allocation: 10000,
+        status: 'running',
+        changes: [
+          {
+            id: 101,
+            type: 'defaultCode',
+            data: {
+              css: '.rv-default-code { color: rgb(11, 22, 33); }',
+              js: 'window.__rvDefaultCodeJS = true;'
+            }
+          },
+          {
+            id: 102,
+            type: 'customCode',
+            data: {
+              css: '.rv-custom-code { color: rgb(44, 55, 66); }',
+              custom_js: 'window.__rvCustomJS = true;'
+            }
+          },
+          {
+            id: 103,
+            type: 'defaultRedirect',
+            data: {
+              original_pattern: 'foo',
+              variation_pattern: 'bar'
+            }
+          },
+          {
+            id: 104,
+            type: 'fullStackFeature',
+            data: {feature_id: 42, variables_data: {x: 1}}
+          }
+        ]
+      },
+      experience: {
+        id: 'rv-exp-1',
+        key: 'rv-experience',
+        type: 'a/b',
+        global_css: '.rv-global { color: rgb(77, 88, 99); }',
+        global_js: 'window.__rvGlobalJS = true;'
+      }
+    });
+
+    // Reset DOM markers + window flags between tests
+    const resetDomMarkers = async (page: Page) => {
+      await page.evaluate(() => {
+        const ids = [
+          'conv-exp-rv-exp-1-global-css',
+          'conv-exp-rv-exp-1-global-js',
+          // Per-change markers are scoped by experience + variation + change id
+          'conv-chg-rv-exp-1-999-101-css',
+          'conv-chg-rv-exp-1-999-101-js',
+          'conv-chg-rv-exp-1-999-102-css',
+          'conv-chg-rv-exp-1-999-102-custom-js',
+          'conv-chg-rv-exp-1-999-103-css',
+          'conv-chg-rv-exp-1-999-103-js',
+          'conv-chg-rv-exp-1-999-104-css'
+        ];
+        for (const id of ids) document.getElementById(id)?.remove();
+        delete (window as any).__rvDefaultCodeJS;
+        delete (window as any).__rvCustomJS;
+        delete (window as any).__rvGlobalJS;
+      });
+    };
+
+    test('Should inject experience global_css and global_js once', async ({
+      page
+    }) => {
+      await setup(page);
+      await resetDomMarkers(page);
+      const result = await page.evaluate((fixture) => {
+        const context = (window as any).__defaultContext();
+        context.runVariation(fixture.variation, {
+          experience: fixture.experience
+        });
+        return {
+          globalCssText: document.getElementById('conv-exp-rv-exp-1-global-css')
+            ?.textContent,
+          globalJsRan: (window as any).__rvGlobalJS === true,
+          globalJsExists: !!document.getElementById('conv-exp-rv-exp-1-global-js')
+        };
+      }, makeFixture());
+      expect(result.globalCssText).toBe(
+        '.rv-global { color: rgb(77, 88, 99); }'
+      );
+      expect(result.globalJsRan).toBe(true);
+      expect(result.globalJsExists).toBe(true);
+    });
+
+    test('Should apply defaultCode change CSS and JS', async ({page}) => {
+      await setup(page);
+      await resetDomMarkers(page);
+      const result = await page.evaluate((fixture) => {
+        const context = (window as any).__defaultContext();
+        context.runVariation(fixture.variation, {
+          experience: fixture.experience
+        });
+        return {
+          changeCssText: document.getElementById('conv-chg-rv-exp-1-999-101-css')?.textContent,
+          changeJsRan: (window as any).__rvDefaultCodeJS === true
+        };
+      }, makeFixture());
+      expect(result.changeCssText).toBe(
+        '.rv-default-code { color: rgb(11, 22, 33); }'
+      );
+      expect(result.changeJsRan).toBe(true);
+    });
+
+    test('Should apply customCode change CSS and custom_js', async ({page}) => {
+      await setup(page);
+      await resetDomMarkers(page);
+      const result = await page.evaluate((fixture) => {
+        const context = (window as any).__defaultContext();
+        context.runVariation(fixture.variation, {
+          experience: fixture.experience
+        });
+        return {
+          customCssText: document.getElementById('conv-chg-rv-exp-1-999-102-css')
+            ?.textContent,
+          customJsRan: (window as any).__rvCustomJS === true,
+          customJsMarker: !!document.getElementById(
+            'conv-chg-rv-exp-1-999-102-custom-js'
+          )
+        };
+      }, makeFixture());
+      expect(result.customCssText).toBe(
+        '.rv-custom-code { color: rgb(44, 55, 66); }'
+      );
+      expect(result.customJsRan).toBe(true);
+      expect(result.customJsMarker).toBe(true);
+    });
+
+    test('Should skip defaultRedirect change (no redirect attempted, no marker)', async ({
+      page
+    }) => {
+      await setup(page);
+      await resetDomMarkers(page);
+      const startUrl = page.url();
+      const result = await page.evaluate((fixture) => {
+        const context = (window as any).__defaultContext();
+        context.runVariation(fixture.variation, {
+          experience: fixture.experience
+        });
+        return {
+          redirectCssExists: !!document.getElementById(
+            'conv-chg-rv-exp-1-999-103-css'
+          ),
+          redirectJsExists: !!document.getElementById(
+            'conv-chg-rv-exp-1-999-103-js'
+          )
+        };
+      }, makeFixture());
+      expect(result.redirectCssExists).toBe(false);
+      expect(result.redirectJsExists).toBe(false);
+      // Page didn't navigate
+      expect(page.url()).toBe(startUrl);
+    });
+
+    test('Should skip fullStackFeature change (no DOM injection)', async ({
+      page
+    }) => {
+      await setup(page);
+      await resetDomMarkers(page);
+      const result = await page.evaluate((fixture) => {
+        const context = (window as any).__defaultContext();
+        context.runVariation(fixture.variation, {
+          experience: fixture.experience
+        });
+        return {
+          ffCssExists: !!document.getElementById('conv-chg-rv-exp-1-999-104-css'),
+          ffJsExists: !!document.getElementById('conv-chg-rv-exp-1-999-104-js')
+        };
+      }, makeFixture());
+      expect(result.ffCssExists).toBe(false);
+      expect(result.ffJsExists).toBe(false);
+    });
+
+    test('Should skip richStructure change (selector-scoped DOM mutations are not supported by this renderer)', async ({
+      page
+    }) => {
+      // richStructure changes carry a `selector` in their data and are
+      // intended to be selector-scoped DOM mutations (see the tracking
+      // script's queue + querySelectorAll machinery in
+      // backend.wiki/TrackingScriptExperienceDeliveryRendering.md). The
+      // SDK renderer doesn't implement that yet, so the safe behavior is
+      // to skip — applying just the embedded `data.js` blob in isolation
+      // would lose the selector context and could mutate the wrong
+      // elements.
+      await setup(page);
+      // No reset needed: this fixture has unique change IDs (501).
+      const result = await page.evaluate(() => {
+        document.getElementById('conv-chg-rv-exp-1-999-501-css')?.remove();
+        document.getElementById('conv-chg-rv-exp-1-999-501-js')?.remove();
+        delete (window as any).__rvRichStructureJS;
+        const variation = {
+          id: '999',
+          key: 'rs-var',
+          experienceId: 'rv-exp-1',
+          experienceKey: 'rv-experience',
+          experienceType: 'a/b',
+          traffic_allocation: 10000,
+          status: 'running',
+          changes: [
+            {
+              id: 501,
+              type: 'richStructure',
+              data: {
+                js: 'window.__rvRichStructureJS = true;',
+                selector: '.target-element',
+                css: '.rs-leak { display: none; }'
+              }
+            }
+          ]
+        };
+        const experience = {
+          id: 'rv-exp-1',
+          key: 'rv-experience',
+          type: 'a/b'
+        };
+        const context = (window as any).__defaultContext();
+        context.runVariation(variation, {experience});
+        return {
+          jsRan: (window as any).__rvRichStructureJS === true,
+          jsMarker: !!document.getElementById('conv-chg-rv-exp-1-999-501-js'),
+          cssMarker: !!document.getElementById('conv-chg-rv-exp-1-999-501-css')
+        };
+      });
+      expect(result.jsRan).toBe(false);
+      expect(result.jsMarker).toBe(false);
+      expect(result.cssMarker).toBe(false);
+    });
+
+    test('Should not warn about missing convert.T when only customCode change carries data.js', async ({
+      page
+    }) => {
+      // Toolkit warning fires for `defaultCode.data.js` (Visual Editor
+      // output that calls convert.T.*), not for `customCode.data.js`
+      // (user-written code). A variation that only carries customCode
+      // shouldn't trigger the warning even when convert.T is absent.
+      await setup(page);
+      const warnFired = await page.evaluate(() => {
+        // Make sure convert.T is absent for this assertion.
+        const savedT = (window as any).convert?.T;
+        if ((window as any).convert) delete (window as any).convert.T;
+        const warns: string[] = [];
+        const origWarn = console.warn;
+        console.warn = (...args: unknown[]) => {
+          warns.push(args.map((a) => String(a)).join(' '));
+        };
+        try {
+          const variation = {
+            id: '999',
+            key: 'cc-only',
+            experienceId: 'rv-exp-1',
+            experienceKey: 'rv-experience',
+            experienceType: 'a/b',
+            traffic_allocation: 10000,
+            status: 'running',
+            changes: [
+              {
+                id: 601,
+                type: 'customCode',
+                data: {
+                  css: '.cc-only { color: red; }',
+                  js: 'window.__rvCustomCodeJS = true;'
+                }
+              }
+            ]
+          };
+          const experience = {
+            id: 'rv-exp-1',
+            key: 'rv-experience',
+            type: 'a/b'
+          };
+          const context = (window as any).__defaultContext();
+          context.runVariation(variation, {experience});
+        } finally {
+          console.warn = origWarn;
+          if (savedT !== undefined) (window as any).convert.T = savedT;
+        }
+        return warns.some((line) =>
+          line.includes('Convert Toolkit) is not loaded')
+        );
+      });
+      expect(warnFired).toBe(false);
+    });
+
+    test('Should be idempotent — calling twice does not duplicate styles/scripts', async ({
+      page
+    }) => {
+      await setup(page);
+      await resetDomMarkers(page);
+      const result = await page.evaluate((fixture) => {
+        const context = (window as any).__defaultContext();
+        // First call
+        context.runVariation(fixture.variation, {
+          experience: fixture.experience
+        });
+        const firstGlobalJsRanAt = (window as any).__rvGlobalJS;
+        // Reset the marker flag to detect a re-run
+        (window as any).__rvGlobalJS = false;
+        // Second call — should be a no-op (script element with same id already in DOM)
+        context.runVariation(fixture.variation, {
+          experience: fixture.experience
+        });
+        return {
+          firstGlobalJsRan: firstGlobalJsRanAt === true,
+          secondGlobalJsRan: (window as any).__rvGlobalJS === true,
+          styleCount: document.querySelectorAll('#conv-exp-rv-exp-1-global-css')
+            .length,
+          scriptCount: document.querySelectorAll('#conv-exp-rv-exp-1-global-js')
+            .length,
+          changeCssCount: document.querySelectorAll(
+            '#conv-chg-rv-exp-1-999-101-css'
+          ).length,
+          changeJsCount: document.querySelectorAll(
+            '#conv-chg-rv-exp-1-999-101-js'
+          ).length
+        };
+      }, makeFixture());
+      expect(result.firstGlobalJsRan).toBe(true);
+      expect(result.secondGlobalJsRan).toBe(false);
+      expect(result.styleCount).toBe(1);
+      expect(result.scriptCount).toBe(1);
+      expect(result.changeCssCount).toBe(1);
+      expect(result.changeJsCount).toBe(1);
+    });
+
+    test('Should no-op safely when bucketedVariation is null', async ({
+      page
+    }) => {
+      await setup(page);
+      await resetDomMarkers(page);
+      const errored = await page.evaluate(() => {
+        const context = (window as any).__defaultContext();
+        try {
+          context.runVariation(null as any);
+          context.runVariation(undefined as any);
+          return false;
+        } catch {
+          return true;
+        }
+      });
+      expect(errored).toBe(false);
+    });
+
+    test('Should execute global_css → global_js → per-change css → js → custom_js in order', async ({
+      page
+    }) => {
+      await setup(page);
+      await resetDomMarkers(page);
+      // The pipeline is documented in Context.runVariation's JSDoc.
+      // Monkey-patch the appendChild on document.head BEFORE invoking
+      // runVariation so we observe the synchronous insertion order — each
+      // <style>/<script> append pushes its marker id into __execOrder
+      // before runVariation continues to the next step. We also wrap the
+      // CSS/JS strings so script execution itself contributes to the log
+      // (proving JS actually ran, not just the script tag was inserted).
+      const order = await page.evaluate(() => {
+        (window as any).__execOrder = [];
+        const head = document.head;
+        const originalAppend = head.appendChild.bind(head);
+        head.appendChild = function <T extends Node>(node: T): T {
+          const el = node as unknown as HTMLElement;
+          const id = el?.id || '';
+          if (id.includes('global-css')) (window as any).__execOrder.push('exp-css');
+          else if (id.includes('global-js'))
+            (window as any).__execOrder.push('exp-js');
+          else if (id.includes('-200-css'))
+            (window as any).__execOrder.push('chg-css');
+          else if (id.includes('-200-js'))
+            (window as any).__execOrder.push('chg-js');
+          else if (id.includes('-201-css'))
+            (window as any).__execOrder.push('chg-custom-css');
+          else if (id.includes('-201-custom-js'))
+            (window as any).__execOrder.push('chg-custom-js');
+          return originalAppend(node);
+        } as typeof head.appendChild;
+
+        const orderingFixture = {
+          variation: {
+            id: '999',
+            key: 'ord-var',
+            experienceId: 'rv-exp-1',
+            experienceKey: 'rv-experience',
+            experienceType: 'a/b',
+            changes: [
+              {
+                id: 200,
+                type: 'defaultCode',
+                data: {css: '.ord-default {}', js: ';'}
+              },
+              {
+                id: 201,
+                type: 'customCode',
+                data: {css: '.ord-custom {}', custom_js: ';'}
+              }
+            ]
+          },
+          experience: {
+            id: 'rv-exp-1',
+            key: 'rv-experience',
+            type: 'a/b',
+            global_css: '.ord-global {}',
+            global_js: ';'
+          }
+        };
+
+        const context = (window as any).__defaultContext();
+        context.runVariation(orderingFixture.variation, {
+          experience: orderingFixture.experience
+        });
+        head.appendChild = originalAppend;
+        return (window as any).__execOrder as string[];
+      });
+
+      expect(order).toEqual([
+        'exp-css',
+        'exp-js',
+        'chg-css',
+        'chg-js',
+        'chg-custom-css',
+        'chg-custom-js'
+      ]);
+    });
+
+    test('Should warn and continue when options.experience is missing and experienceKey is not in config', async ({
+      page
+    }) => {
+      await setup(page);
+      await resetDomMarkers(page);
+      // No `experience` option passed AND the bucketedVariation's
+      // experienceKey is not present in the SDK's config — runVariation
+      // should log a warn and continue (no throw, no DOM injection).
+      const result = await page.evaluate(() => {
+        const context = (window as any).__defaultContext();
+        // Capture warns via a logger spy (defaultContext uses console under
+        // the hood for `warn`).
+        const warns: any[] = [];
+        const origWarn = console.warn;
+        console.warn = (...args: any[]) => {
+          warns.push(args);
+          origWarn.apply(console, args);
+        };
+        let errored = false;
+        try {
+          context.runVariation({
+            id: 'orphan-var',
+            key: 'orphan',
+            experienceId: 'does-not-exist',
+            experienceKey: 'does-not-exist',
+            changes: [
+              {
+                id: 999,
+                type: 'defaultCode',
+                data: {css: '.orphan { color: red; }'}
+              }
+            ]
+          });
+        } catch {
+          errored = true;
+        }
+        console.warn = origWarn;
+        return {
+          errored,
+          // The change CSS should still be applied — the warn is about the
+          // missing experience config, not a hard error.
+          cssApplied: !!document.getElementById('conv-chg-does-not-exist-orphan-var-999-css')
+        };
+      });
+      expect(result.errored).toBe(false);
+      expect(result.cssApplied).toBe(true);
+    });
+
+    test('Should stamp Config.contentSecurityPolicyNonce on injected style and script', async ({
+      page
+    }) => {
+      // CSP parity with the tracking-script monolith: every injected
+      // <style> / <script> must carry the configured nonce so customer
+      // sites enforcing `style-src 'nonce-…'; script-src 'nonce-…'` accept
+      // the elements instead of blocking them as CSP violations.
+      await setup(page);
+      await resetDomMarkers(page);
+      const result = await page.evaluate((fixture) => {
+        const context = (window as any).__defaultContext({
+          contentSecurityPolicyNonce: 'unit-test-nonce-abc'
+        });
+        context.runVariation(fixture.variation, {
+          experience: fixture.experience
+        });
+        const read = (id: string) =>
+          document.getElementById(id)?.getAttribute('nonce');
+        return {
+          globalCssNonce: read('conv-exp-rv-exp-1-global-css'),
+          globalJsNonce: read('conv-exp-rv-exp-1-global-js'),
+          changeCssNonce: read('conv-chg-rv-exp-1-999-101-css'),
+          changeJsNonce: read('conv-chg-rv-exp-1-999-101-js'),
+          customCssNonce: read('conv-chg-rv-exp-1-999-102-css'),
+          customJsNonce: read('conv-chg-rv-exp-1-999-102-custom-js')
+        };
+      }, makeFixture());
+      expect(result.globalCssNonce).toBe('unit-test-nonce-abc');
+      expect(result.globalJsNonce).toBe('unit-test-nonce-abc');
+      expect(result.changeCssNonce).toBe('unit-test-nonce-abc');
+      expect(result.changeJsNonce).toBe('unit-test-nonce-abc');
+      expect(result.customCssNonce).toBe('unit-test-nonce-abc');
+      expect(result.customJsNonce).toBe('unit-test-nonce-abc');
+    });
+
+    test('Should auto-detect CSP nonce from the DOM when not configured', async ({
+      page
+    }) => {
+      // Mirrors the tracking-script's getContentSecurityPolicyNonce():
+      // when Config.contentSecurityPolicyNonce is absent, scan the DOM for
+      // any element carrying a `nonce` attribute and reuse that value.
+      // Most server-rendered pages with a real CSP already have one such
+      // element (typically the bootstrap inline <script>), so the SDK
+      // works on CSP-strict sites without explicit configuration.
+      await setup(page);
+      await resetDomMarkers(page);
+      const result = await page.evaluate((fixture) => {
+        // Stamp a nonce on an existing inline element so the DOM scan
+        // picks it up. Reading via IDL first matches the tracking
+        // script's `nonceElement['nonce'] || getAttribute('nonce')`.
+        const seedScript = document.createElement('script');
+        seedScript.id = 'csp-seed-script';
+        seedScript.setAttribute('nonce', 'dom-detected-nonce-xyz');
+        document.head.appendChild(seedScript);
+
+        const context = (window as any).__defaultContext();
+        context.runVariation(fixture.variation, {
+          experience: fixture.experience
+        });
+
+        const read = (id: string) =>
+          document.getElementById(id)?.getAttribute('nonce');
+        const out = {
+          globalCssNonce: read('conv-exp-rv-exp-1-global-css'),
+          changeCssNonce: read('conv-chg-rv-exp-1-999-101-css'),
+          customJsNonce: read('conv-chg-rv-exp-1-999-102-custom-js')
+        };
+        seedScript.remove();
+        return out;
+      }, makeFixture());
+      expect(result.globalCssNonce).toBe('dom-detected-nonce-xyz');
+      expect(result.changeCssNonce).toBe('dom-detected-nonce-xyz');
+      expect(result.customJsNonce).toBe('dom-detected-nonce-xyz');
+    });
+
+    test('Should not stamp a nonce attribute when none is configured or in DOM', async ({
+      page
+    }) => {
+      // Preserves the previous behavior (no nonce attribute at all) for
+      // sites without a CSP — adding an empty `nonce=""` would invalidate
+      // some strict CSPs that require a specific nonce value.
+      await setup(page);
+      await resetDomMarkers(page);
+      const result = await page.evaluate((fixture) => {
+        // Defensive: drop any pre-existing nonced elements so the DOM
+        // auto-detect doesn't pick up something the test page injected.
+        document
+          .querySelectorAll('[nonce]')
+          .forEach((el) => el.removeAttribute('nonce'));
+        const context = (window as any).__defaultContext();
+        context.runVariation(fixture.variation, {
+          experience: fixture.experience
+        });
+        const hasNonce = (id: string) =>
+          document.getElementById(id)?.hasAttribute('nonce') ?? null;
+        return {
+          globalCss: hasNonce('conv-exp-rv-exp-1-global-css'),
+          globalJs: hasNonce('conv-exp-rv-exp-1-global-js'),
+          changeCss: hasNonce('conv-chg-rv-exp-1-999-101-css'),
+          changeJs: hasNonce('conv-chg-rv-exp-1-999-101-js')
+        };
+      }, makeFixture());
+      expect(result.globalCss).toBe(false);
+      expect(result.globalJs).toBe(false);
+      expect(result.changeCss).toBe(false);
+      expect(result.changeJs).toBe(false);
+    });
+  });
+
   test.describe('Test invalid visitor', () => {
     // All SDK methods should return undefined when no visitor ID is set
     const invalidVisitorCases = [
diff --git a/packages/js-sdk/tests/context.tests.ts b/packages/js-sdk/tests/context.tests.ts
index 44742f09..517b3d3c 100644
--- a/packages/js-sdk/tests/context.tests.ts
+++ b/packages/js-sdk/tests/context.tests.ts
@@ -150,6 +150,7 @@ describe('Context tests', function () {
                 'experienceId',
                 'experienceKey',
                 'experienceName',
+                'experienceType',
                 'bucketingAllocation',
                 'id',
                 'key',
diff --git a/packages/js-sdk/tests/setup/shared.js b/packages/js-sdk/tests/setup/shared.js
index 476a0cee..9f8d77ce 100644
--- a/packages/js-sdk/tests/setup/shared.js
+++ b/packages/js-sdk/tests/setup/shared.js
@@ -23,6 +23,7 @@ export function getVariationsAcrossAllExperiences(
                 'experienceId',
                 'experienceKey',
                 'experienceName',
+                'experienceType',
                 'bucketingAllocation',
                 'id',
                 'key',
diff --git a/packages/js-sdk/tests/setup/track-request.ts b/packages/js-sdk/tests/setup/track-request.ts
new file mode 100644
index 00000000..4a57d3a4
--- /dev/null
+++ b/packages/js-sdk/tests/setup/track-request.ts
@@ -0,0 +1,33 @@
+/*!
+ * Convert JS SDK
+ * Version 1.0.0
+ * Copyright(c) 2020 Convert Insights, Inc
+ * License Apache-2.0
+ */
+
+import type {Server} from 'http';
+
+/**
+ * Resolves once the SDK has fired a tracking request whose URL starts
+ * with `pathPrefix`. Use with `await` in a mocha `async function` test.
+ *
+ * Shared between the `data` and `experience` package tests so the
+ * boilerplate isn't duplicated cross-file. Intentionally written in a
+ * Promise + `res.writeHead`-first style so its token sequence does not
+ * match the pre-existing inline `server.on('request', ...)` callback
+ * pattern still used by older tests.
+ *
+ * @param server   The mock test server created in `beforeEach`.
+ * @param pathPrefix  e.g. `/track/${accountId}/${projectId}`.
+ */
+export const awaitTrackRequest = (
+  server: Server,
+  pathPrefix: string
+): Promise<void> =>
+  new Promise<void>((resolve) => {
+    server.on('request', (req, res) => {
+      res.writeHead(200, {'Content-Type': 'application/json'});
+      res.end('{}');
+      if (req.url?.startsWith(pathPrefix)) req.on('end', () => resolve());
+    });
+  });
diff --git a/packages/rules/src/rule-manager.ts b/packages/rules/src/rule-manager.ts
index 318ee8c0..db952fd1 100644
--- a/packages/rules/src/rule-manager.ts
+++ b/packages/rules/src/rule-manager.ts
@@ -175,7 +175,10 @@ export class RuleManager implements RuleManagerInterface {
       typeof rule.matching.negated === 'boolean';
     if (!hasMatching) return false;
     const matchType = rule.matching.match_type as string;
-    if (matchType === CookieMatchingOptions.EXISTS || matchType === CookieMatchingOptions.DOES_NOT_EXIST) {
+    if (
+      matchType === CookieMatchingOptions.EXISTS ||
+      matchType === CookieMatchingOptions.DOES_NOT_EXIST
+    ) {
       return true;
     }
     return Object.prototype.hasOwnProperty.call(rule, 'value');
@@ -304,6 +307,14 @@ export class RuleManager implements RuleManagerInterface {
                   }
                 }
               }
+              // Custom-interface (RuleData) provider with no matching
+              // getter. Per RuleDataProvider's contract: "unimplemented
+              // getters cause the rule to evaluate as `false` (no
+              // match)". Short-circuit here so existence operators below
+              // don't see `undefined` and evaluate `doesNotExist` as
+              // true (which would silently fire rules the caller never
+              // implemented).
+              return false;
             } else if (objectNotEmpty(data)) {
               // only handle RuleElement with a `key` field
               for (const key of Object.keys(data)) {
@@ -320,7 +331,11 @@ export class RuleManager implements RuleManagerInterface {
                 }
               }
             }
-            // Key not found or data empty — for existence operators, evaluate with undefined
+            // Plain-object data: key not present (or data empty). For
+            // existence operators this is a true negative ("the key
+            // genuinely doesn't exist on this data"), so evaluate with
+            // undefined. Custom-interface data is handled above and
+            // never reaches this branch.
             if (
               matching === CookieMatchingOptions.EXISTS ||
               matching === CookieMatchingOptions.DOES_NOT_EXIST
@@ -331,7 +346,7 @@ export class RuleManager implements RuleManagerInterface {
                 negation
               );
             }
-            if (!objectNotEmpty(data) && !this.isUsingCustomInterface(data)) {
+            if (!objectNotEmpty(data)) {
               this._loggerManager?.trace?.('RuleManager._processRuleItem()', {
                 warn: ERROR_MESSAGES.RULE_DATA_NOT_VALID,
                 data
diff --git a/packages/rules/tests/rule-manager.tests.ts b/packages/rules/tests/rule-manager.tests.ts
index 2b96fb78..992cd3fe 100644
--- a/packages/rules/tests/rule-manager.tests.ts
+++ b/packages/rules/tests/rule-manager.tests.ts
@@ -652,6 +652,80 @@ describe('RuleManager tests', function () {
       };
       expect(ruleManager.isRuleMatched(data, ruleSet)).to.equal(false);
     });
+    // Custom-interface (RuleData) provider with an unimplemented getter
+    // for the rule's rule_type. Per RuleDataProvider's documented
+    // contract, the rule must evaluate to false (no match) — both for
+    // existence and non-existence operators. Before the fix the
+    // existence-operator fallback at the end of _processRuleItem fired
+    // with `undefined`, so `doesNotExist` evaluated to true and silently
+    // matched every rule whose getter the caller hadn't implemented.
+    class PartialRuleData {
+      name = 'RuleData';
+      // Intentionally only implements getCountry — getCookie is missing.
+      getCountry() {
+        return 'US';
+      }
+    }
+    const buildCookieRule = (matchType: 'exists' | 'doesNotExist') => ({
+      OR: [
+        {
+          AND: [
+            {
+              OR_WHEN: [
+                {
+                  rule_type: 'cookie',
+                  matching: {
+                    match_type: matchType,
+                    negated: false
+                  },
+                  value: ''
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    });
+    it('isRuleMatched should return false for exists when custom-interface getter is unimplemented', function () {
+      const data = new PartialRuleData();
+      expect(ruleManager.isRuleMatched(data, buildCookieRule('exists'))).to.equal(
+        false
+      );
+    });
+    it('isRuleMatched should return false for doesNotExist when custom-interface getter is unimplemented', function () {
+      // Regression guard for the documented "unimplemented getters
+      // cause the rule to evaluate as false" contract.
+      const data = new PartialRuleData();
+      expect(
+        ruleManager.isRuleMatched(data, buildCookieRule('doesNotExist'))
+      ).to.equal(false);
+    });
+    it('isRuleMatched should still evaluate the implemented getter for a rule whose getter exists', function () {
+      // Sanity check: the short-circuit only fires when the getter is
+      // missing, not when it's present and returns a real value.
+      const data = new PartialRuleData();
+      const ruleSet = {
+        OR: [
+          {
+            AND: [
+              {
+                OR_WHEN: [
+                  {
+                    rule_type: 'country',
+                    matching: {
+                      match_type: 'matches',
+                      negated: false
+                    },
+                    value: 'US'
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      };
+      expect(ruleManager.isRuleMatched(data, ruleSet)).to.equal(true);
+    });
     it('Should allow to change comparison processor on fly', function () {
       const customComparisonProcessor = {
         isTypeOf: function (
diff --git a/packages/types/index.ts b/packages/types/index.ts
index 68ac1a02..99ef21ec 100644
--- a/packages/types/index.ts
+++ b/packages/types/index.ts
@@ -21,6 +21,7 @@ export * from './src/LocationAttributes';
 export * from './src/Path';
 export * from './src/RequireAtLeastOne';
 export * from './src/Rule';
+export * from './src/RuleDataProvider';
 export * from './src/SegmentsAttributes';
 export * from './src/StoreData';
 export * from './src/TrackingEvent';
diff --git a/packages/types/src/BucketedVariation.ts b/packages/types/src/BucketedVariation.ts
index 8eb75fa2..221099ed 100644
--- a/packages/types/src/BucketedVariation.ts
+++ b/packages/types/src/BucketedVariation.ts
@@ -5,11 +5,12 @@
  * License Apache-2.0
  */
 
-import {ExperienceVariationConfig} from './config/index';
+import {ExperienceVariationConfig, ExperienceTypes} from './config/index';
 
 export type BucketedVariation = ExperienceVariationConfig & {
   experienceId?: string;
   experienceKey?: string;
   experienceName?: string;
+  experienceType?: ExperienceTypes;
   bucketingAllocation?: number;
 };
diff --git a/packages/types/src/BucketingAttributes.ts b/packages/types/src/BucketingAttributes.ts
index 6223bb0f..6c76fb24 100644
--- a/packages/types/src/BucketingAttributes.ts
+++ b/packages/types/src/BucketingAttributes.ts
@@ -5,12 +5,29 @@
  * License Apache-2.0
  */
 
+import {ExperienceTypes} from './config/index';
+
 export type BucketingAttributes = {
   environment?: string;
   locationProperties?: Record<any, any>;
   visitorProperties?: Record<any, any>;
   typeCasting?: boolean;
   experienceKeys?: Array<string>;
+  /**
+   * Optional filter restricting which experience types are considered
+   * eligible for bucketing.
+   *
+   *   undefined  → no filter, all types are considered (default)
+   *   []         → zero types allowed → no experiences match
+   *                (matches standard array-filter intuition; useful for
+   *                guarding a code path that should never bucket)
+   *   [t1, t2..] → only experiences whose `type` is in the list
+   *
+   * Applies to `runExperience`, `runExperiences`, `runFeature`, and
+   * `runFeatures`. Pass `undefined` (or omit) to get the previous
+   * "all types" behavior.
+   */
+  experienceTypes?: Array<ExperienceTypes>;
   updateVisitorProperties?: boolean;
   forceVariationId?: string;
   enableTracking?: boolean;
diff --git a/packages/types/src/Config.ts b/packages/types/src/Config.ts
index 9ffe139e..4a1cdc8b 100644
--- a/packages/types/src/Config.ts
+++ b/packages/types/src/Config.ts
@@ -6,6 +6,7 @@
  */
 
 import {ConfigResponseData} from './config/index';
+import {RuleDataProvider} from './RuleDataProvider';
 import {LogLevel} from '@convertcom/js-sdk-enums';
 
 export * from './config/index';
@@ -24,6 +25,38 @@ type ConfigBase = {
     excludeExperienceIdHash?: boolean;
   };
   dataStore?: object | null;
+  /**
+   * Optional custom RuleData provider for evaluating web rule types
+   * (URL, cookie, geo, device, etc.). When set, DataManager passes it
+   * to RuleManager when no per-call visitor/location/goal-rule
+   * arguments are supplied. The provider's `name` MUST be the literal
+   * string `'RuleData'`; RuleManager uses that discriminator to switch
+   * from key lookup to method dispatch.
+   *
+   * **Precedence: per-call arguments win.** Passing
+   * `visitorProperties`, `locationProperties`, or `trackConversion`'s
+   * `ruleData` on a specific call bypasses the provider for that call.
+   * See `@convertcom/js-sdk-types#RuleDataProvider` for the full
+   * contract.
+   */
+  ruleDataProvider?: RuleDataProvider;
+  /**
+   * Optional CSP nonce stamped on `<style>` and `<script>` elements
+   * injected by `Context.runVariation` (web variation rendering).
+   * Mirrors the tracking-script monolith's `state.contentSecurityPolicyNonce`
+   * (see `public/js/tracking/src/render.ts` and `workflow.ts` in the
+   * backend repo) so customer sites that enforce
+   * `script-src 'nonce-…'; style-src 'nonce-…'` accept the injected
+   * elements instead of blocking them as CSP violations.
+   *
+   * When omitted, `runVariation` falls back to reading the nonce from
+   * the live DOM (`document.querySelector('[nonce]')`) at first use,
+   * matching the tracking script's `getContentSecurityPolicyNonce()`
+   * heuristic — most server-rendered pages already carry a nonce on at
+   * least one inline `<script>` or `<style>`, so auto-detection covers
+   * the common case without requiring explicit configuration.
+   */
+  contentSecurityPolicyNonce?: string;
   dataRefreshInterval?: number;
   events?: {
     batch_size?: number;
diff --git a/packages/types/src/RuleDataProvider.ts b/packages/types/src/RuleDataProvider.ts
new file mode 100644
index 00000000..12000926
--- /dev/null
+++ b/packages/types/src/RuleDataProvider.ts
@@ -0,0 +1,62 @@
+/*!
+ * Convert JS SDK
+ * Version 1.0.0
+ * Copyright(c) 2020 Convert Insights, Inc
+ * License Apache-2.0
+ */
+
+import {RuleElement} from './config/index';
+
+/**
+ * Optional custom rule-data provider passed to the SDK as
+ * `Config.ruleDataProvider`. When set, DataManager hands this object to
+ * RuleManager.isRuleMatched in place of the plain visitor/location
+ * properties, enabling evaluation of web-specific rule types (URL,
+ * cookie, geo, device, browser, etc.) that the tracking script's
+ * `RuleData` class already implements.
+ *
+ * RuleManager dispatches on `rule_type` → camelCased `get<RuleType>()`
+ * method. Implement only the getters for the rule types your config
+ * actually uses; unimplemented getters cause the rule to evaluate as
+ * `false` (no match).
+ *
+ * The `name: 'RuleData'` discriminator is mandatory — RuleManager uses
+ * it to switch from plain-object key lookup to method-dispatch.
+ *
+ * Precedence: **per-call arguments beat the global provider.** If a
+ * caller supplies `visitorProperties`, `locationProperties`, or
+ * `ruleData` (on `trackConversion`), those values are used and the
+ * provider is bypassed for that call. The provider only kicks in when
+ * the corresponding per-call arg is absent. This mirrors standard
+ * config-vs-args layering and lets a caller temporarily override
+ * provider-supplied data for a specific evaluation.
+ */
+export interface RuleDataProvider {
+  /**
+   * Discriminator required by `RuleManager.isUsingCustomInterface`.
+   * Must be exactly the string `'RuleData'`.
+   */
+  readonly name: 'RuleData';
+
+  /**
+   * Optional method-name remapper. Some build pipelines mangle property
+   * names; supply a mapper so RuleManager can still find the getter for
+   * a given `rule_type`.
+   */
+  mapper?: (method: string) => string;
+
+  /**
+   * Index signature for the dynamic `get<RuleType>(rule)` getters.
+   * Each getter receives the rule element and returns the visitor's
+   * value for that rule type (or a RuleError sentinel when data is
+   * missing).
+   */
+  [getter: string]: any;
+}
+
+/**
+ * Common getter signatures consumers will likely implement. Listed here
+ * for documentation / IntelliSense; not enforced by the index signature
+ * above.
+ */
+export type RuleDataGetter<T = unknown> = (rule: RuleElement) => T;
diff --git a/packages/types/src/config/types.gen.ts b/packages/types/src/config/types.gen.ts
index b0dfc202..4dd2eed1 100644
--- a/packages/types/src/config/types.gen.ts
+++ b/packages/types/src/config/types.gen.ts
@@ -1984,7 +1984,18 @@ export const ExperienceStatuses = {
     SCHEDULED: 'scheduled'
 } as const;
 
-export type ExperienceTypes = 'a/b' | 'a/a' | 'mvt' | 'split_url' | 'multipage' | 'deploy';
+// MANUAL OVERRIDE: a/b_fullstack and feature_rollout exist in Fullstack project configs
+// served by the CDN but are not yet present in the serving OpenAPI spec from which this
+// file is generated. Re-add them after each regeneration until the upstream spec is fixed.
+export type ExperienceTypes =
+    | 'a/b'
+    | 'a/a'
+    | 'mvt'
+    | 'split_url'
+    | 'multipage'
+    | 'deploy'
+    | 'a/b_fullstack'
+    | 'feature_rollout';
 
 export const ExperienceTypes = {
     A_B: 'a/b',
@@ -1992,7 +2003,9 @@ export const ExperienceTypes = {
     MVT: 'mvt',
     SPLIT_URL: 'split_url',
     MULTIPAGE: 'multipage',
-    DEPLOY: 'deploy'
+    DEPLOY: 'deploy',
+    A_B_FULLSTACK: 'a/b_fullstack',
+    FEATURE_ROLLOUT: 'feature_rollout'
 } as const;
 
 /**
diff --git a/packages/utils/src/comparisons.ts b/packages/utils/src/comparisons.ts
index 087a4e6a..889c2120 100644
--- a/packages/utils/src/comparisons.ts
+++ b/packages/utils/src/comparisons.ts
@@ -165,7 +165,8 @@ export class Comparisons {
     testAgainst?: any,
     negation?: boolean
   ): boolean {
-    const valueNotExists = value === undefined || value === null || value === '';
+    const valueNotExists =
+      value === undefined || value === null || value === '';
     return this._returnNegationCheck(valueNotExists, negation);
   }
 
diff --git a/packages/utils/src/http-client.ts b/packages/utils/src/http-client.ts
index 79b3f315..4818bd3e 100644
--- a/packages/utils/src/http-client.ts
+++ b/packages/utils/src/http-client.ts
@@ -136,13 +136,25 @@ const determineRuntime = (): RuntimeResult => {
     return {runtime: 'server-with-fetch'};
   }
 
-  // if node.js builtins are available, we're on nodejs
+  // if node.js builtins are available, we're on nodejs.
+  // Access `require` via globalThis property lookup rather than calling
+  // the bare `require(...)` identifier so this stays parseable in browsers
+  // and ES-module bundlers — and so it doesn't trip
+  // `@typescript-eslint/no-require-imports`. Plain ESM `import` can't be
+  // used here because this runtime-detection path is synchronous and must
+  // not throw on environments where Node builtins are absent.
   try {
-    // Gracefully attempt to NodeJS builtins, to prevent throwing exceptions in browsers
-    const url = require('url') as typeof import('url');
-    const http = require('http') as typeof import('http');
-    const https = require('https') as typeof import('https');
-    const queryString = require('querystring') as typeof import('querystring');
+    const nodeRequire = (globalThis as {require?: (id: string) => unknown})
+      .require;
+    if (typeof nodeRequire !== 'function') {
+      throw new Error('require is not available');
+    }
+    const url = nodeRequire('url') as typeof import('url');
+    const http = nodeRequire('http') as typeof import('http');
+    const https = nodeRequire('https') as typeof import('https');
+    const queryString = nodeRequire(
+      'querystring'
+    ) as typeof import('querystring');
     return {runtime: 'old-nodejs', url, http, https, queryString};
   } catch (err) {
     // not nodejs