@blotoutio/providers-dataflywheel-sdk 1.63.3 → 1.64.1

package/index.cjs.js

@@ -17,6 +17,21 @@ const isEnabledFlag = (value, defaultValue = true) => {
     return value !== '0' && value.toLowerCase() !== 'false';
 };
 const shouldBootstrap = (now, expiresAt) => expiresAt == null || now >= expiresAt;
+const browserOrigin = () => {
+    var _a, _b;
+    try {
+        if (typeof window === 'undefined')
+            return null;
+        return typeof window.origin === 'string'
+            ? window.origin
+            : (_b = (_a = window.location) === null || _a === void 0 ? void 0 : _a.origin) !== null && _b !== void 0 ? _b : null;
+    }
+    catch {
+        // If a sandbox prevents origin inspection, fail closed before issuing a
+        // credentialed request that the DFW Worker cannot safely authorize.
+        return 'null';
+    }
+};
 const stateKey = (merchantId) => `${sessionStateKeyPrefix}:${merchantId}`;
 const browserStorage = () => {
     var _a;
@@ -138,6 +153,13 @@ function ensureSession(input) {
     if (!shouldBootstrap(now, expiresAtMs(existing))) {
         return Promise.resolve(existing);
     }
+    // Opaque origins (sandboxed iframes like Shopify pixels) serialize to the
+    // string 'null' per the HTML spec — that is what window.origin returns and
+    // what the fail-closed browserOrigin() catch emits. JS null means no window
+    // at all (non-browser host), which is not an opaque-origin sandbox.
+    if ((input.origin === undefined ? browserOrigin() : input.origin) === 'null') {
+        return Promise.resolve(null);
+    }
     const key = stateKey(merchantId);
     const existingBootstrap = inFlight.get(key);
     if (existingBootstrap)

package/index.js

@@ -18,6 +18,21 @@ var ProvidersDataflywheelSdk = (function () {
         return value !== '0' && value.toLowerCase() !== 'false';
     };
     const shouldBootstrap = (now, expiresAt) => expiresAt == null || now >= expiresAt;
+    const browserOrigin = () => {
+        var _a, _b;
+        try {
+            if (typeof window === 'undefined')
+                return null;
+            return typeof window.origin === 'string'
+                ? window.origin
+                : (_b = (_a = window.location) === null || _a === void 0 ? void 0 : _a.origin) !== null && _b !== void 0 ? _b : null;
+        }
+        catch {
+            // If a sandbox prevents origin inspection, fail closed before issuing a
+            // credentialed request that the DFW Worker cannot safely authorize.
+            return 'null';
+        }
+    };
     const stateKey = (merchantId) => `${sessionStateKeyPrefix}:${merchantId}`;
     const browserStorage = () => {
         var _a;
@@ -139,6 +154,13 @@ var ProvidersDataflywheelSdk = (function () {
         if (!shouldBootstrap(now, expiresAtMs(existing))) {
             return Promise.resolve(existing);
         }
+        // Opaque origins (sandboxed iframes like Shopify pixels) serialize to the
+        // string 'null' per the HTML spec — that is what window.origin returns and
+        // what the fail-closed browserOrigin() catch emits. JS null means no window
+        // at all (non-browser host), which is not an opaque-origin sandbox.
+        if ((input.origin === undefined ? browserOrigin() : input.origin) === 'null') {
+            return Promise.resolve(null);
+        }
         const key = stateKey(merchantId);
         const existingBootstrap = inFlight.get(key);
         if (existingBootstrap)

package/index.mjs

@@ -15,6 +15,21 @@ const isEnabledFlag = (value, defaultValue = true) => {
     return value !== '0' && value.toLowerCase() !== 'false';
 };
 const shouldBootstrap = (now, expiresAt) => expiresAt == null || now >= expiresAt;
+const browserOrigin = () => {
+    var _a, _b;
+    try {
+        if (typeof window === 'undefined')
+            return null;
+        return typeof window.origin === 'string'
+            ? window.origin
+            : (_b = (_a = window.location) === null || _a === void 0 ? void 0 : _a.origin) !== null && _b !== void 0 ? _b : null;
+    }
+    catch {
+        // If a sandbox prevents origin inspection, fail closed before issuing a
+        // credentialed request that the DFW Worker cannot safely authorize.
+        return 'null';
+    }
+};
 const stateKey = (merchantId) => `${sessionStateKeyPrefix}:${merchantId}`;
 const browserStorage = () => {
     var _a;
@@ -136,6 +151,13 @@ function ensureSession(input) {
     if (!shouldBootstrap(now, expiresAtMs(existing))) {
         return Promise.resolve(existing);
     }
+    // Opaque origins (sandboxed iframes like Shopify pixels) serialize to the
+    // string 'null' per the HTML spec — that is what window.origin returns and
+    // what the fail-closed browserOrigin() catch emits. JS null means no window
+    // at all (non-browser host), which is not an opaque-origin sandbox.
+    if ((input.origin === undefined ? browserOrigin() : input.origin) === 'null') {
+        return Promise.resolve(null);
+    }
     const key = stateKey(merchantId);
     const existingBootstrap = inFlight.get(key);
     if (existingBootstrap)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blotoutio/providers-dataflywheel-sdk",
-  "version": "1.63.3",
+  "version": "1.64.1",
   "description": "DataFlywheel browser SDK for EdgeTag",
   "author": "Blotout",
   "license": "MIT",