@cross-deck/web 1.9.1 → 1.10.3

package/CHANGELOG.md

@@ -2,6 +2,72 @@
 
 All notable changes to `@cross-deck/web` will be documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.10.3] — 2026-07-22
+
+**Fixed — browser-injected globals no longer blamed on your code.** A browser (not
+your app) injects private globals into every page — `window.__firefox__` (Firefox
+for iOS reader mode), `__gCrWeb` (Chrome for iOS), `zaloJSV2` (Zalo). Their content
+script races page setup and throws in the page's own global scope, so the throwing
+frame wears your URL (`https://you.app/x:1:19`, "global code") and looked like your
+code. Now: when the message names one of these globals, every frame is marked
+`in_app: false` (it's the browser's code, not yours), and the error is fingerprinted
+by the injected global — so the whole class, across pages and both race shapes
+(`.reader` vs `Can't find variable`), collapses into a single grouped, de-emphasised
+issue instead of thousands of per-page reds. Same family as the `iabjs://` in-app
+browser handling. No public API change.
+
+## [1.10.2] — 2026-07-22
+
+**First published 1.10.x — same SDK, release pipeline fully green.** 1.10.0/1.10.1
+were staged but blocked in CI before publish (1.10.0: `npm@latest` engine mismatch;
+1.10.1: the bundle-size budget, which the 1.10.x feature growth crossed by ~80 bytes
+on core CJS). Both fixed (npm pinned to `npm@^11`; core budget raised 60 → 62 KB for
+a ~2 KB margin). SDK contents are identical to 1.10.0 below — see that entry for the
+campaign-arrival feature and the in-app-browser fixes.
+
+## [1.10.1] — 2026-07-22
+
+**Republish of 1.10.0 — same SDK, working release pipeline.** The 1.10.0 tag never
+reached npm: the release runner upgraded npm via `npm@latest`, which had rolled to
+12.x (Node ≥22) and hard-failed `EBADENGINE` on the Node 20 runner, before the
+publish step. That's fixed (the workflow now pins `npm@^11`). This is the first
+version to actually publish; the SDK contents are identical to 1.10.0 below —
+see that entry for the campaign-arrival feature and the in-app-browser fixes.
+
+## [1.10.0] — 2026-07-22
+
+**Added — campaign-arrival connect (the HubSpot identity bridge).** When a page is
+reached from a Crossdeck-tagged campaign link, the landing URL carries an opaque
+`cd_ref` tag (the partner contact id — **never an email**). On session start the
+SDK posts `{ anonymousId, ref }` once to the arrival endpoint, so the backend binds
+this anonymous session to the tagged person and pulls their integration record
+(deals, pipeline) onto their journey — no login required. A later real login still
+converges (the anon anchor leaves `developerUserId` free — never a blind email
+merge). Browser-only, fire-and-forget (never throws, never blocks init), and
+backend-idempotent so a re-fire is harmless. Automatic; no new public method.
+
+**Fixed — don't manufacture noise from in-app browsers.** Instagram/Facebook's
+Android in-app browser injects its own script (`iabjs://…`) into its WebView and,
+during page teardown, its Java bridge is garbage-collected and throws
+`Error invoking …: Java object is gone`. Two changes so the SDK never turns the
+host shell's own teardown into the developer's error:
+
+- **Unload handlers are now exception-safe.** The SDK's terminal-flush and
+  session-persist work fires on `pagehide` / `beforeunload` /
+  `visibilitychange→hidden` — exactly when the in-app browser hooks browser APIs
+  and throws from its own teardown. Every such handler (auto-track session
+  persist, web-vitals flush, the shared unload flush) now swallows a throw at the
+  handler boundary, so a host-shell teardown error can no longer propagate to
+  `window.onerror` and be self-reported. The page is going away; nothing there can
+  be meaningfully handled.
+- **Injected in-app-browser frames are no longer marked `in_app`.** The stack
+  parser treats `iabjs://` / `webview://` / `inappbrowser://` frames as
+  third-party (like extension frames), so the dashboard's "your code vs library
+  code" view no longer attributes the in-app browser's errors to the developer.
+
+No new or changed public methods (campaign-arrival is automatic; the iabjs work is
+internal robustness).
+
 ## [1.9.1] — 2026-06-30
 
 **Docs — knowledge-backbone governance release.** No runtime API change. This

package/README.md

@@ -97,6 +97,8 @@ Every event — auto-tracked and developer-emitted — is enriched with the devi
 
 **Per-session acquisition (v0.6.0+):** when a session starts the SDK reads `window.location.search` and `document.referrer` and captures `utm_source`, `utm_medium`, `utm_campaign`, `utm_content`, `utm_term`, plus `referrer`. Non-empty values are auto-attached to every subsequent event of that session — first-touch attribution stays pinned to the entry URL even after SPA route changes strip the params away, and now stays pinned across full-page navigations within the session too. A new session (>30 min idle) re-reads the URL.
 
+**Campaign-arrival connect (v1.10.0+):** when a page is reached from a Crossdeck-tagged campaign link, the landing URL carries an opaque `cd_ref` tag (a partner contact id — never an email). On session start the SDK posts it once to the arrival endpoint so the backend can bind this anonymous session to the tagged person and pull their integration record (e.g. HubSpot deals/pipeline) onto their journey — no login required. It's automatic (no method to call), browser-only, fire-and-forget (never throws, never blocks page init), and idempotent server-side. A later real `identify(userId)` still converges the same person.
+
 ## Auto-attached device info
 
 Every event's `properties` is enriched with whatever the SDK can detect:
@@ -254,7 +256,7 @@ Diagnostic snapshot — useful for development consoles and bug reports:
   anonymousId: "anon_…",
   crossdeckCustomerId: "cdcust_…" | null,
   developerUserId: "user_…" | null,
-  sdkVersion: "1.9.0",
+  sdkVersion: "1.9.1",
   baseUrl: "https://api.cross-deck.com/v1",
   entitlements: { count: 2, lastUpdated: 1717891200000 },
   events: { buffered: 0, dropped: 0, inFlight: 0, lastFlushAt: 1717891200000, lastError: null },
@@ -276,8 +278,8 @@ CrossdeckContracts.byId("per-user-cache-isolation");
 CrossdeckContracts.byPillar("entitlements");
 CrossdeckContracts.withStatus("proposed");
 CrossdeckContracts.findByTestName("identify(B) makes A's entitlements unreachable from in-memory");
-CrossdeckContracts.sdkVersion;        // "1.9.0"
-CrossdeckContracts.bundledIn;         // "@cross-deck/web@1.9.0"
+CrossdeckContracts.sdkVersion;        // "1.9.1"
+CrossdeckContracts.bundledIn;         // "@cross-deck/web@1.9.1"
 ```
 
 The `Contract` type is exported alongside; the binary-stability promise (which fields are guaranteed across patch/minor releases) is documented inline on `src/contracts.ts` and in [`contracts/README.md`](https://github.com/VistaApps-za/crossdeck/blob/main/contracts/README.md).