@active-reach/web-sdk 1.38.0 → 1.40.0

package/dist/{analytics-Cz1ZBOxH.mjs → analytics-C-Go3Pm5.mjs}

@@ -1111,7 +1111,18 @@ class Storage {
     }
   }
 }
-const CREDENTIAL_URL_PARAMS = ["t", "k", "code", "session_code", "aegis_pair", "u"];
+const CREDENTIAL_URL_PARAMS = [
+  "t",
+  "k",
+  "code",
+  "session_code",
+  "aegis_pair",
+  "u",
+  // The Shopify CarrierService callback token (2026-09-18). Server-to-server
+  // today, so the SDK never sees one — it is here because the two lists are
+  // ONE rule, and a list that is only correct for today's callers is not.
+  "carrier_token"
+];
 const REDACTED = "REDACTED";
 const CREDENTIAL_PARAM_PATTERN = new RegExp(
   `([?&])(${CREDENTIAL_URL_PARAMS.join("|")})=([^&#\\s"'<>]+)`,
@@ -3021,6 +3032,9 @@ class Aegis {
     if (!this.assertInitialized()) return;
     const wsForGovernor = this.getEffectiveWorkspaceId() || null;
     const { sanitized: governedTraits } = this.traitGovernor.process(traits, wsForGovernor);
+    if (this.identity.getUserId() !== userId) {
+      this.contactToken = void 0;
+    }
     this.identity.setUserId(userId, governedTraits);
     const event = {
       type: "identify",
@@ -3275,6 +3289,16 @@ class Aegis {
     if (!this.identity) return null;
     return this.identity.getUserId();
   }
+  /**
+   * C1b: register the server-minted proof for the CURRENT contact (as
+   * returned by `getUserId()`). A host wiring `AegisMessageRuntime` calls
+   * this alongside `runtime.updateContactId(id, token)` so `getRewards()`
+   * can also present `X-Contact-Token`. Pass `undefined` to clear it (e.g.
+   * on logout, or when the id changes without a fresh token).
+   */
+  setContactToken(token) {
+    this.contactToken = token;
+  }
   /**
    * The Aegis short-link attribution captured from this visitor's landing URL
    * (`aegis_code` + the link row's `aegis_campaign` / `aegis_journey` /
@@ -3308,6 +3332,7 @@ class Aegis {
       "X-Contact-ID": contactId,
       "X-User-ID": contactId
     };
+    if (this.contactToken) headers["X-Contact-Token"] = this.contactToken;
     const orgId = config.organization_id;
     if (orgId) headers["X-Organization-ID"] = orgId;
     const location = this.getEffectiveLocationId();
@@ -3481,4 +3506,4 @@ export {
   murmurhash3_x86_32 as m,
   redactUrl as r
 };
-//# sourceMappingURL=analytics-Cz1ZBOxH.mjs.map
+//# sourceMappingURL=analytics-C-Go3Pm5.mjs.map