@cross-deck/web 1.10.2 → 1.11.1

package/CHANGELOG.md

@@ -2,6 +2,48 @@
 
 All notable changes to `@cross-deck/web` will be documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.11.1] — 2026-07-23
+
+**Republish of 1.11.0 — release-pipeline fix only, identical SDK.** 1.11.0 never
+reached npm: the react/vue bundle crossed its size budget by ~70 bytes (they bundle
+the core, which grew with the cross-subdomain identity feature). Budget raised
+55 → 57 KB. No SDK change from 1.11.0 — see that entry.
+
+## [1.11.0] — 2026-07-23
+
+**Added — cross-subdomain identity (marketing ↔ app is now ONE person).** Until now
+the anonymous-ID cookie was host-only, so a visitor on your marketing site
+(`example.com`) and your app (`app.example.com`) were two different anonymous
+people — first-touch source, journey, and conversion never stitched across the
+hop. Now the SDK scopes that cookie to the **registrable domain** by default, so a
+visitor is one identity across every subdomain of your site. The whole funnel —
+anonymous marketing visit → true source (referrer/UTM) → signup → revenue → errors
+— lands on one timeline.
+
+- New `cookieDomain` option: `"auto"` (default — the registrable domain, detected
+  the GA4 way: probe from the broadest candidate up, take the broadest the browser
+  accepts, so public suffixes like `.co.za`/`.com` are skipped with no bundled
+  list); an explicit domain (`".example.com"`); or `"none"` for the old host-only
+  behaviour. No config needed for the common case — it just works.
+- **Non-breaking for existing identities:** localStorage still wins on read, so a
+  returning visitor keeps their id; it's simply also written to the shared domain
+  cookie now. Node/native are unaffected (cookies + subdomains are browser-only;
+  cross-*device* identity is resolved server-side by email/userId).
+
+## [1.10.3] — 2026-07-22
+
+**Fixed — browser-injected globals no longer blamed on your code.** A browser (not
+your app) injects private globals into every page — `window.__firefox__` (Firefox
+for iOS reader mode), `__gCrWeb` (Chrome for iOS), `zaloJSV2` (Zalo). Their content
+script races page setup and throws in the page's own global scope, so the throwing
+frame wears your URL (`https://you.app/x:1:19`, "global code") and looked like your
+code. Now: when the message names one of these globals, every frame is marked
+`in_app: false` (it's the browser's code, not yours), and the error is fingerprinted
+by the injected global — so the whole class, across pages and both race shapes
+(`.reader` vs `Can't find variable`), collapses into a single grouped, de-emphasised
+issue instead of thousands of per-page reds. Same family as the `iabjs://` in-app
+browser handling. No public API change.
+
 ## [1.10.2] — 2026-07-22
 
 **First published 1.10.x — same SDK, release pipeline fully green.** 1.10.0/1.10.1

package/README.md

@@ -93,7 +93,9 @@ That's the full happy path.
 
 Every event — auto-tracked and developer-emitted — is enriched with the device-info payload below.
 
-**Sessions survive page loads (v1.6.0+).** A session is a *visit*, not a page. The SDK persists the session (id, start time, last-activity time, first-touch acquisition) to the same storage as identity, so a full-page navigation on a multi-page site **resumes the same session** rather than starting a new one. The window is a rolling 30-minute inactivity timer bumped by every tracked event (auto or custom); only real 30-min inactivity or `Crossdeck.stop()` ends it. A page unload (`pagehide`/`beforeunload`) is treated as a navigation, not an end. Quick tab switches (Cmd-Tab) likewise don't end the session — matching GA4's session-window convention. Continuity is same-origin; cross-subdomain stitching is on the roadmap. With `persistIdentity: false` (or a `MemoryStorage` adapter) the session is in-memory only and resets per page.
+**Sessions survive page loads (v1.6.0+).** A session is a *visit*, not a page. The SDK persists the session (id, start time, last-activity time, first-touch acquisition) to the same storage as identity, so a full-page navigation on a multi-page site **resumes the same session** rather than starting a new one. The window is a rolling 30-minute inactivity timer bumped by every tracked event (auto or custom); only real 30-min inactivity or `Crossdeck.stop()` ends it. A page unload (`pagehide`/`beforeunload`) is treated as a navigation, not an end. Quick tab switches (Cmd-Tab) likewise don't end the session — matching GA4's session-window convention. With `persistIdentity: false` (or a `MemoryStorage` adapter) the session is in-memory only and resets per page.
+
+**Cross-subdomain identity (v1.11.0+).** A visitor is **one person across every subdomain** of your site — your marketing site (`example.com`) and your app (`app.example.com`) share one anonymous identity, so first-touch source, journey, and conversion stitch into one timeline instead of splitting at the hop. The SDK scopes its identity cookie to your **registrable domain** by default (`cookieDomain: "auto"`); set an explicit `cookieDomain: ".example.com"` to pin it, or `"none"` for host-only. Cross-*device* identity (same person, phone + laptop) is resolved server-side by `identify(userId)` — this is the browser half.
 
 **Per-session acquisition (v0.6.0+):** when a session starts the SDK reads `window.location.search` and `document.referrer` and captures `utm_source`, `utm_medium`, `utm_campaign`, `utm_content`, `utm_term`, plus `referrer`. Non-empty values are auto-attached to every subsequent event of that session — first-touch attribution stays pinned to the entry URL even after SPA route changes strip the params away, and now stays pinned across full-page navigations within the session too. A new session (>30 min idle) re-reads the URL.