@cross-deck/web 1.10.2 → 1.11.1

package/dist/{types-B9sxUuKh.d.mts → types-iqtsOTGy.d.mts}

@@ -106,6 +106,20 @@ interface CrossdeckOptions {
     storage?: KeyValueStorage;
     /** Storage key prefix for the SDK's persisted state. Default "crossdeck:". */
     storagePrefix?: string;
+    /**
+     * Cross-subdomain identity. The anonymous-ID cookie is scoped to this domain so
+     * a visitor is ONE person across every subdomain — your marketing site
+     * (`example.com`) and your app (`app.example.com`) share one identity, so
+     * first-touch source, journey, and conversion stitch into one timeline.
+     *
+     *   - `"auto"` (default) — the registrable domain (eTLD+1), detected safely.
+     *   - a domain string (`".example.com"` / `"example.com"`) — set it explicitly.
+     *   - `"none"` — host-only (each subdomain is its own identity; pre-1.11 behaviour).
+     *
+     * No effect in Node/native — cookies + subdomains are browser-only. Cross-*device*
+     * / cross-platform identity is resolved server-side by email/userId, not here.
+     */
+    cookieDomain?: string;
     /**
      * Send a heartbeat to /v1/sdk/heartbeat on start(). Default true.
      * Disable for high-frequency boot scenarios where the heartbeat is

package/dist/{types-B9sxUuKh.d.ts → types-iqtsOTGy.d.ts}

@@ -106,6 +106,20 @@ interface CrossdeckOptions {
     storage?: KeyValueStorage;
     /** Storage key prefix for the SDK's persisted state. Default "crossdeck:". */
     storagePrefix?: string;
+    /**
+     * Cross-subdomain identity. The anonymous-ID cookie is scoped to this domain so
+     * a visitor is ONE person across every subdomain — your marketing site
+     * (`example.com`) and your app (`app.example.com`) share one identity, so
+     * first-touch source, journey, and conversion stitch into one timeline.
+     *
+     *   - `"auto"` (default) — the registrable domain (eTLD+1), detected safely.
+     *   - a domain string (`".example.com"` / `"example.com"`) — set it explicitly.
+     *   - `"none"` — host-only (each subdomain is its own identity; pre-1.11 behaviour).
+     *
+     * No effect in Node/native — cookies + subdomains are browser-only. Cross-*device*
+     * / cross-platform identity is resolved server-side by email/userId, not here.
+     */
+    cookieDomain?: string;
     /**
      * Send a heartbeat to /v1/sdk/heartbeat on start(). Default true.
      * Disable for high-frequency boot scenarios where the heartbeat is

package/dist/vue.cjs

@@ -97,7 +97,7 @@ function typeMapForStatus(status) {
 }
 
 // src/_version.ts
-var SDK_VERSION = "1.10.2";
+var SDK_VERSION = "1.11.1";
 var SDK_NAME = "@cross-deck/web";
 
 // src/http.ts
@@ -1325,6 +1325,7 @@ var CookieStorage = class {
     this.maxAgeSec = options?.maxAgeSec ?? 63072e3;
     this.secure = options?.secure ?? defaultSecure();
     this.sameSite = options?.sameSite ?? "Lax";
+    this.domain = options?.domain || void 0;
   }
   getItem(key) {
     if (!hasDocument()) return null;
@@ -1351,6 +1352,7 @@ var CookieStorage = class {
       `Max-Age=${this.maxAgeSec}`,
       `SameSite=${this.sameSite}`
     ];
+    if (this.domain) parts.push(`Domain=${this.domain}`);
     if (this.secure) parts.push("Secure");
     try {
       doc.cookie = parts.join("; ");
@@ -1366,6 +1368,7 @@ var CookieStorage = class {
       "Max-Age=0",
       `SameSite=${this.sameSite}`
     ];
+    if (this.domain) parts.push(`Domain=${this.domain}`);
     if (this.secure) parts.push("Secure");
     try {
       doc.cookie = parts.join("; ");
@@ -1373,6 +1376,34 @@ var CookieStorage = class {
     }
   }
 };
+function resolveCookieDomain(config) {
+  if (config === void 0 || config === "none" || config === "") return void 0;
+  if (config !== "auto") {
+    const d = config.trim().toLowerCase();
+    return d.startsWith(".") ? d : `.${d}`;
+  }
+  if (!hasDocument()) return void 0;
+  const doc = globalThis.document;
+  const loc = globalThis.location;
+  const host = (loc?.hostname ?? "").toLowerCase();
+  if (!host || host === "localhost" || /^\d{1,3}(\.\d{1,3}){3}$/.test(host) || host.indexOf(".") === -1) {
+    return void 0;
+  }
+  const labels = host.split(".");
+  for (let i = labels.length - 2; i >= 0; i--) {
+    const candidate = "." + labels.slice(i).join(".");
+    const testKey = "__cd_domain_probe";
+    try {
+      doc.cookie = `${testKey}=1; Domain=${candidate}; Path=/; SameSite=Lax`;
+      const accepted = doc.cookie.indexOf(`${testKey}=1`) !== -1;
+      doc.cookie = `${testKey}=; Domain=${candidate}; Path=/; Max-Age=0; SameSite=Lax`;
+      if (accepted) return candidate;
+    } catch {
+      return void 0;
+    }
+  }
+  return void 0;
+}
 function detectDefaultStorage() {
   try {
     const ls = globalThis.localStorage;
@@ -3836,7 +3867,18 @@ function isInAppFrame(filename) {
   if (/\/crossdeck\.umd\.min\.js$/.test(filename)) return false;
   return true;
 }
+var BROWSER_INJECTED_GLOBAL = /(__firefox__|__gCrWeb|zaloJSV2)/;
+function injectedGlobalName(message) {
+  const m = BROWSER_INJECTED_GLOBAL.exec(message ?? "");
+  return m ? m[1] : null;
+}
+function demoteVendorInjectedFrames(frames, message) {
+  if (!injectedGlobalName(message)) return frames;
+  return frames.map((f) => f.in_app ? { ...f, in_app: false } : f);
+}
 function fingerprintError(message, frames, location2) {
+  const injected = injectedGlobalName(message);
+  if (injected) return djb2Hex(`injected-global:${injected}`);
   const inAppFrames = frames.filter((f) => f.in_app).slice(0, 3);
   const parts = [
     (message || "").slice(0, 200),
@@ -4193,7 +4235,7 @@ var ErrorTracker = class {
     const payload = coerceErrorPayload(err);
     const message = (payload.message || event.message || "Unknown error").slice(0, 1024);
     const stack = err instanceof Error ? err.stack ?? null : null;
-    const frames = parseStack(stack);
+    const frames = demoteVendorInjectedFrames(parseStack(stack), message);
     const errorType = payload.errorType ?? null;
     const context = payload.extras ? { ...this.opts.getContext(), __error_extras: payload.extras } : this.opts.getContext();
     return {
@@ -4225,7 +4267,7 @@ var ErrorTracker = class {
     const payload = coerceErrorPayload(err);
     const message = (payload.message || "Unknown error").slice(0, 1024);
     const stack = err instanceof Error ? err.stack ?? null : null;
-    const frames = parseStack(stack);
+    const frames = demoteVendorInjectedFrames(parseStack(stack), message);
     const errorType = payload.errorType ?? null;
     const context = payload.extras ? { ...this.opts.getContext(), __error_extras: payload.extras } : this.opts.getContext();
     return {
@@ -4641,7 +4683,7 @@ var CrossdeckClient = class {
     const effectiveStorage = persistIdentity ? storage : new MemoryStorage();
     const useCookieRedundancy = persistIdentity && !options.storage && // honour caller's adapter choice
     typeof globalThis.document !== "undefined";
-    const cookieStore = useCookieRedundancy ? new CookieStorage() : void 0;
+    const cookieStore = useCookieRedundancy ? new CookieStorage({ domain: resolveCookieDomain(options.cookieDomain ?? "auto") }) : void 0;
     const identity = new IdentityStore(effectiveStorage, opts.storagePrefix, cookieStore);
     const entitlements = new EntitlementCache(
       effectiveStorage,