@datalyr/web 1.6.2 → 1.6.4

package/dist/attribution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attribution.d.ts","sourceRoot":"","sources":["../src/attribution.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAEvD,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,aAAa,CAAW;IAChC,OAAO,CAAC,gBAAgB,CAAuC;IAC/D,OAAO,CAAC,UAAU,CAA2E;IAE7F,OAAO,CAAC,SAAS,CAgBf;IAEF,OAAO,CAAC,sBAAsB,CAO5B;gBAEU,OAAO,GAAE;QACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB;IAMN;;;OAGG;IACH,UAAU,IAAI,IAAI;IAIlB;;OAEG;IACH,kBAAkB,IAAI,WAAW;IA8DjC;;;;;OAKG;IACH,eAAe,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI;IAwB/C;;;OAGG;IACH,aAAa,IAAI,WAAW,GAAG,IAAI;IASnC;;OAEG;IACH,cAAc,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI;IAQ9C;;;OAGG;IACH,YAAY,IAAI,WAAW,GAAG,IAAI;IASlC;;OAEG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,GAAG,IAAI;IAqBhE;;OAEG;IACH,UAAU,IAAI,UAAU,EAAE;IAI1B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAiDxB;;;OAGG;IACH,OAAO,CAAC,UAAU;IAKlB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAKxB;;OAEG;IACH,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IA0EzC;;OAEG;IACH,OAAO,CAAC,eAAe;IA6CvB;;OAEG;IACH,OAAO,CAAC,eAAe;IA2BvB;;OAEG;IACH,OAAO,CAAC,eAAe;IAQvB;;OAEG;IACH,oBAAoB,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO;IAKvD;;OAEG;IACH,uBAAuB,IAAI,IAAI;CAYhC"}
+{"version":3,"file":"attribution.d.ts","sourceRoot":"","sources":["../src/attribution.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAEvD,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,aAAa,CAAW;IAChC,OAAO,CAAC,gBAAgB,CAAuC;IAC/D,OAAO,CAAC,UAAU,CAA2E;IAE7F,OAAO,CAAC,SAAS,CAgBf;IAEF,OAAO,CAAC,sBAAsB,CAO5B;gBAEU,OAAO,GAAE;QACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB;IAMN;;;OAGG;IACH,UAAU,IAAI,IAAI;IAIlB;;OAEG;IACH,kBAAkB,IAAI,WAAW;IA8DjC;;;;;OAKG;IACH,eAAe,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI;IAwB/C;;;OAGG;IACH,aAAa,IAAI,WAAW,GAAG,IAAI;IASnC;;OAEG;IACH,cAAc,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI;IAQ9C;;;OAGG;IACH,YAAY,IAAI,WAAW,GAAG,IAAI;IASlC;;OAEG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,GAAG,IAAI;IAqBhE;;OAEG;IACH,UAAU,IAAI,UAAU,EAAE;IAI1B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAkExB;;;OAGG;IACH,OAAO,CAAC,UAAU;IAKlB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAKxB;;OAEG;IACH,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IA0EzC;;OAEG;IACH,OAAO,CAAC,eAAe;IA6CvB;;OAEG;IACH,OAAO,CAAC,eAAe;IA2BvB;;OAEG;IACH,OAAO,CAAC,eAAe;IAQvB;;OAEG;IACH,oBAAoB,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO;IAKvD;;OAEG;IACH,uBAAuB,IAAI,IAAI;CAYhC"}

package/dist/container.d.ts

@@ -2,6 +2,20 @@
  * Container Script Manager
  * Loads and manages third-party tracking scripts and pixels
  */
+/**
+ * Identity snapshot read at the moment a third-party pixel initializes.
+ * Aligns the browser Pixel's advanced matching with what CAPI sends server-side
+ * (meta.js shovels all of {user_id, visitor_id, anonymous_id} into the CAPI
+ * external_id array) — so any one of those hashes coincides between surfaces.
+ *
+ * `externalId` should be the SDK's distinct_id (user_id when identified, else
+ * anonymous_id). `email` is only populated after identify(); when present, lets
+ * the Pixel match on `em` too.
+ */
+export interface PixelIdentity {
+    externalId?: string | null;
+    email?: string | null;
+}
 export interface ContainerScript {
     id: string;
     name: string;
@@ -50,10 +64,12 @@ export declare class ContainerManager {
     private sandboxedIframes;
     private iframeCleanupTimeouts;
     private messageHandler;
+    private getIdentity?;
     constructor(options: {
         workspaceId: string;
         endpoint?: string;
         debug?: boolean;
+        getIdentity?: () => PixelIdentity | undefined;
     });
     /**
      * Initialize container and load scripts
@@ -110,6 +126,12 @@ export declare class ContainerManager {
     private initializePixels;
     /**
      * Initialize Meta (Facebook) Pixel
+     *
+     * Async because we resolve SHA-256 hashes for advanced matching (Meta's
+     * `external_id` / `em`) before calling fbq('init'). Aligning the hashes the
+     * browser Pixel sends with what CAPI sends (meta.js shovels user_id /
+     * visitor_id / anonymous_id into external_id[], and `em` is sha256 of the
+     * lowercased email) is the dedup-quality lift the CAPI side can't fix alone.
      */
     private initializeMetaPixel;
     /**

package/dist/container.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../src/container.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,GAAG,UAAU,GAAG,OAAO,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,WAAW,GAAG,WAAW,GAAG,aAAa,GAAG,QAAQ,CAAC;IAC9D,SAAS,EAAE,QAAQ,GAAG,eAAe,GAAG,kBAAkB,CAAC;IAC3D,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,KAAK,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,GAAG,CAAC;KACZ,CAAC,CAAC;IACH,QAAQ,CAAC,EAAE;QACT,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE;QACL,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,oBAAoB,CAAC,EAAE,OAAO,CAAC;KAChC,CAAC;IACF,MAAM,CAAC,EAAE;QACP,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,oBAAoB,CAAC,EAAE,OAAO,CAAC;KAChC,CAAC;IACF,MAAM,CAAC,EAAE;QACP,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,OAAO,CAAyB;IACxC,OAAO,CAAC,aAAa,CAAqB;IAC1C,OAAO,CAAC,oBAAoB,CAAqB;IACjD,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,KAAK,CAAU;IACvB,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,gBAAgB,CAA2B;IACnD,OAAO,CAAC,qBAAqB,CAAwC;IACrE,OAAO,CAAC,cAAc,CAAgD;gBAE1D,OAAO,EAAE;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB;IA8BD;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAwD3B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAkBxB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA2B1B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAyB/B;;OAEG;IACH,OAAO,CAAC,UAAU;IA8BlB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IA+DxB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAyBrB;;;OAGG;IACI,iBAAiB,IAAI,IAAI;IAkBhC;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAqC1B;;OAEG;IACH,OAAO,CAAC,SAAS;IAQjB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAmBxB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAiC3B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAyB3B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA0C7B;;OAEG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,GAAE,GAAQ,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI;IAqF9E;;OAEG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAO3C;;OAEG;IACH,gBAAgB,IAAI,MAAM,EAAE;IAI5B;;;;;;;;;;;;;;;;;;;OAmBG;IAEH;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAoBxB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAQzB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAyB1B;;OAEG;IACH,OAAO,CAAC,aAAa;IA0BrB;;OAEG;IACH,OAAO,CAAC,GAAG;CAKZ"}
+{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../src/container.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,GAAG,UAAU,GAAG,OAAO,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,WAAW,GAAG,WAAW,GAAG,aAAa,GAAG,QAAQ,CAAC;IAC9D,SAAS,EAAE,QAAQ,GAAG,eAAe,GAAG,kBAAkB,CAAC;IAC3D,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,KAAK,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,GAAG,CAAC;KACZ,CAAC,CAAC;IACH,QAAQ,CAAC,EAAE;QACT,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE;QACL,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,oBAAoB,CAAC,EAAE,OAAO,CAAC;KAChC,CAAC;IACF,MAAM,CAAC,EAAE;QACP,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,oBAAoB,CAAC,EAAE,OAAO,CAAC;KAChC,CAAC;IACF,MAAM,CAAC,EAAE;QACP,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,OAAO,CAAyB;IACxC,OAAO,CAAC,aAAa,CAAqB;IAC1C,OAAO,CAAC,oBAAoB,CAAqB;IACjD,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,KAAK,CAAU;IACvB,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,gBAAgB,CAA2B;IACnD,OAAO,CAAC,qBAAqB,CAAwC;IACrE,OAAO,CAAC,cAAc,CAAgD;IAKtE,OAAO,CAAC,WAAW,CAAC,CAAkC;gBAE1C,OAAO,EAAE;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,aAAa,GAAG,SAAS,CAAC;KAC/C;IA+BD;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA0D3B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAkBxB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA2B1B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAyB/B;;OAEG;IACH,OAAO,CAAC,UAAU;IA8BlB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IA+DxB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAyBrB;;;OAGG;IACI,iBAAiB,IAAI,IAAI;IAkBhC;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAqC1B;;OAEG;IACH,OAAO,CAAC,SAAS;IAQjB;;OAEG;YACW,gBAAgB;IAmB9B;;;;;;;;OAQG;YACW,mBAAmB;IAsDjC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAyB3B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA0C7B;;OAEG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,GAAE,GAAQ,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI;IAqF9E;;OAEG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAO3C;;OAEG;IACH,gBAAgB,IAAI,MAAM,EAAE;IAI5B;;;;;;;;;;;;;;;;;;;OAmBG;IAEH;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAoBxB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAQzB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAyB1B;;OAEG;IACH,OAAO,CAAC,aAAa;IA0BrB;;OAEG;IACH,OAAO,CAAC,GAAG;CAKZ"}

package/dist/datalyr.cjs.js

@@ -1,5 +1,5 @@
 /**
- * @datalyr/web v1.6.2
+ * @datalyr/web v1.6.4
  * Datalyr Web SDK - Modern attribution tracking for web applications
  * (c) 2026 Datalyr Inc.
  * Released under the MIT License
@@ -586,6 +586,37 @@ const cookies = new CookieStorage();
 /**
  * Utility Functions
  */
+/**
+ * SHA-256 hex digest aligned with the worker's CAPI hashing (cloudflare/
+ * postback/core/utils.js `sha256()`). Always lowercases + trims the input
+ * before hashing — Meta's matching requires byte-for-byte identical hashes
+ * on the Pixel side and the CAPI server side, and the worker uniformly
+ * normalizes everything it hashes (em, ph, fn, ln, external_id, etc).
+ *
+ * Pixel-side hashes that don't match CAPI hashes silently fail to dedupe,
+ * which is why this helper does the normalization for callers — easy to
+ * forget, hard to debug after release. Returns null when Web Crypto isn't
+ * available (very old browsers, non-secure contexts) so callers can
+ * gracefully skip advanced matching rather than throwing.
+ */
+function sha256Hex(input) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (typeof crypto === 'undefined' || !crypto.subtle)
+            return null;
+        if (!input)
+            return null;
+        try {
+            const bytes = new TextEncoder().encode(input.toLowerCase().trim());
+            const digest = yield crypto.subtle.digest('SHA-256', bytes);
+            return Array.from(new Uint8Array(digest))
+                .map((b) => b.toString(16).padStart(2, '0'))
+                .join('');
+        }
+        catch (_a) {
+            return null;
+        }
+    });
+}
 /**
  * Generate UUID v4
  */
@@ -1497,6 +1528,7 @@ class AttributionManager {
      * Capture advertising platform cookies
      */
     captureAdCookies() {
+        var _a, _b;
         const adCookies = {};
         // Facebook/Meta cookies
         adCookies._fbp = cookies.get('_fbp');
@@ -1521,13 +1553,29 @@ class AttributionManager {
             // Optionally set the cookie for future use
             cookies.set('_fbp', adCookies._fbp, 90);
         }
+        // Persist the click time the FIRST time we see fbclid/gclid in URL so we can
+        // rebuild fbc (and stamp real click time on server-side events) later even
+        // when _fbc/_gclid cookies get evicted. Once-only: never overwrite.
+        const fbclid = this.getCurrentFbclid();
+        if (fbclid && !cookies.get('_dl_fbclid_at')) {
+            cookies.set('_dl_fbclid_at', String(Date.now()), 90);
+        }
+        const gclid = this.hasClickId('gclid') ? ((_b = (_a = this.queryParamsCache) === null || _a === void 0 ? void 0 : _a.gclid) !== null && _b !== void 0 ? _b : null) : null;
+        if (gclid && !cookies.get('_dl_gclid_at')) {
+            cookies.set('_dl_gclid_at', String(Date.now()), 90);
+        }
         // Generate _fbc if we have fbclid but no _fbc.
         // Meta's fbc format is `fb.{subdomainIndex}.{creationTime}.{fbclid}` where
         // creationTime is UNIX time in MILLISECONDS (matches the _fbp generation above
         // and the real _fbc cookie the Meta Pixel writes). Do NOT use seconds here.
-        const fbclid = this.getCurrentFbclid();
         if (fbclid && !adCookies._fbc) {
-            const timestamp = Date.now();
+            // Prefer the persisted click time when valid; fall back to now if the
+            // cookie is missing or corrupted (e.g. user edited it to garbage).
+            // Without this guard, Number("abc") = NaN and Meta would reject
+            // `fb.1.NaN.{fbclid}`.
+            const stored = cookies.get('_dl_fbclid_at');
+            const parsed = stored ? Number(stored) : NaN;
+            const timestamp = Number.isFinite(parsed) && parsed > 0 ? parsed : Date.now();
             adCookies._fbc = `fb.1.${timestamp}.${fbclid}`;
             // Optionally set the cookie for future use
             cookies.set('_fbc', adCookies._fbc, 90);
@@ -2315,6 +2363,7 @@ class ContainerManager {
         // Container scripts use the same endpoint as tracking (ingest)
         this.endpoint = options.endpoint || 'https://ingest.datalyr.com';
         this.debug = options.debug || false;
+        this.getIdentity = options.getIdentity;
         // Load session scripts from storage
         const sessionScripts = storage.get('dl_session_scripts', []);
         this.sessionLoadedScripts = new Set(sessionScripts);
@@ -2358,9 +2407,11 @@ class ContainerManager {
                 // Store scripts and pixels
                 this.scripts = data.scripts || [];
                 this.pixels = data.pixels || null;
-                // Initialize pixels if configured
+                // Initialize pixels if configured. Awaited so advanced-matching hashes
+                // are resolved before the first dl.track() flushes through trackToPixels
+                // (otherwise fbq('init') would lag fbq('track') in fast-path tracks).
                 if (this.pixels) {
-                    this.initializePixels();
+                    yield this.initializePixels();
                 }
                 // Load scripts based on trigger
                 this.loadScriptsByTrigger('page_load');
@@ -2652,57 +2703,92 @@ class ContainerManager {
      * Initialize third-party pixels (Meta, Google, TikTok)
      */
     initializePixels() {
-        var _a, _b, _c;
-        if (!this.pixels)
-            return;
-        // Initialize Meta Pixel
-        if (((_a = this.pixels.meta) === null || _a === void 0 ? void 0 : _a.enabled) && this.pixels.meta.pixel_id) {
-            this.initializeMetaPixel(this.pixels.meta);
-        }
-        // Initialize Google Tag
-        if (((_b = this.pixels.google) === null || _b === void 0 ? void 0 : _b.enabled) && this.pixels.google.tag_id) {
-            this.initializeGoogleTag(this.pixels.google);
-        }
-        // Initialize TikTok Pixel
-        if (((_c = this.pixels.tiktok) === null || _c === void 0 ? void 0 : _c.enabled) && this.pixels.tiktok.pixel_id) {
-            this.initializeTikTokPixel(this.pixels.tiktok);
-        }
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            if (!this.pixels)
+                return;
+            // Initialize Meta Pixel
+            if (((_a = this.pixels.meta) === null || _a === void 0 ? void 0 : _a.enabled) && this.pixels.meta.pixel_id) {
+                yield this.initializeMetaPixel(this.pixels.meta);
+            }
+            // Initialize Google Tag
+            if (((_b = this.pixels.google) === null || _b === void 0 ? void 0 : _b.enabled) && this.pixels.google.tag_id) {
+                this.initializeGoogleTag(this.pixels.google);
+            }
+            // Initialize TikTok Pixel
+            if (((_c = this.pixels.tiktok) === null || _c === void 0 ? void 0 : _c.enabled) && this.pixels.tiktok.pixel_id) {
+                this.initializeTikTokPixel(this.pixels.tiktok);
+            }
+        });
     }
     /**
      * Initialize Meta (Facebook) Pixel
+     *
+     * Async because we resolve SHA-256 hashes for advanced matching (Meta's
+     * `external_id` / `em`) before calling fbq('init'). Aligning the hashes the
+     * browser Pixel sends with what CAPI sends (meta.js shovels user_id /
+     * visitor_id / anonymous_id into external_id[], and `em` is sha256 of the
+     * lowercased email) is the dedup-quality lift the CAPI side can't fix alone.
      */
     initializeMetaPixel(config) {
-        try {
-            // Load Meta Pixel script
-            (function (f, b, e, v, n, t, s) {
-                if (f.fbq)
-                    return;
-                n = f.fbq = function () {
-                    n.callMethod ? n.callMethod.apply(n, arguments) : n.queue.push(arguments);
-                };
-                if (!f._fbq)
-                    f._fbq = n;
-                n.push = n;
-                n.loaded = !0;
-                n.version = '2.0';
-                n.queue = [];
-                t = b.createElement(e);
-                t.async = !0;
-                t.src = v;
-                s = b.getElementsByTagName(e)[0];
-                s.parentNode.insertBefore(t, s);
-            })(window, document, 'script', 'https://connect.facebook.net/en_US/fbevents.js');
-            // Initialize pixel only — do NOT fire PageView here. The SDK's own pageview
-            // tracking (track('pageview')) routes through trackToPixels and fires a single
-            // mapped PageView with a shared eventID. Firing it again here produced TWO
-            // PageViews per load (one un-deduped). Note: if the host app disables pageview
-            // tracking entirely, no PageView is sent — which is the correct outcome.
-            window.fbq('init', config.pixel_id);
-            this.log('Meta Pixel initialized:', config.pixel_id);
-        }
-        catch (error) {
-            this.log('Error initializing Meta Pixel:', error);
-        }
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            try {
+                // Load Meta Pixel script
+                (function (f, b, e, v, n, t, s) {
+                    if (f.fbq)
+                        return;
+                    n = f.fbq = function () {
+                        n.callMethod ? n.callMethod.apply(n, arguments) : n.queue.push(arguments);
+                    };
+                    if (!f._fbq)
+                        f._fbq = n;
+                    n.push = n;
+                    n.loaded = !0;
+                    n.version = '2.0';
+                    n.queue = [];
+                    t = b.createElement(e);
+                    t.async = !0;
+                    t.src = v;
+                    s = b.getElementsByTagName(e)[0];
+                    s.parentNode.insertBefore(t, s);
+                })(window, document, 'script', 'https://connect.facebook.net/en_US/fbevents.js');
+                // Build advanced-matching object. Skipped silently if Web Crypto isn't
+                // available — Pixel still initializes, just without advanced matching.
+                // Anonymous_id is stable across the session and always present, so we
+                // never need to re-init on identify(): CAPI carries both anonymous_id
+                // AND user_id in its external_id[] array, so either side matching one
+                // hash slot is enough to dedupe.
+                const advancedMatching = {};
+                const identity = (_a = this.getIdentity) === null || _a === void 0 ? void 0 : _a.call(this);
+                if (identity === null || identity === void 0 ? void 0 : identity.externalId) {
+                    const hash = yield sha256Hex(String(identity.externalId));
+                    if (hash)
+                        advancedMatching.external_id = hash;
+                }
+                if (identity === null || identity === void 0 ? void 0 : identity.email) {
+                    const hash = yield sha256Hex(String(identity.email).toLowerCase().trim());
+                    if (hash)
+                        advancedMatching.em = hash;
+                }
+                // Initialize pixel only — do NOT fire PageView here. The SDK's own pageview
+                // tracking (track('pageview')) routes through trackToPixels and fires a single
+                // mapped PageView with a shared eventID. Firing it again here produced TWO
+                // PageViews per load (one un-deduped). Note: if the host app disables pageview
+                // tracking entirely, no PageView is sent — which is the correct outcome.
+                if (Object.keys(advancedMatching).length > 0) {
+                    window.fbq('init', config.pixel_id, advancedMatching);
+                    this.log('Meta Pixel initialized with advanced matching:', config.pixel_id, Object.keys(advancedMatching));
+                }
+                else {
+                    window.fbq('init', config.pixel_id);
+                    this.log('Meta Pixel initialized (no advanced matching):', config.pixel_id);
+                }
+            }
+            catch (error) {
+                this.log('Error initializing Meta Pixel:', error);
+            }
+        });
     }
     /**
      * Initialize Google Tag
@@ -3446,6 +3532,14 @@ class Datalyr {
         }
         // Set default config values
         this.config = Object.assign({ endpoint: 'https://ingest.datalyr.com', debug: false, batchSize: 10, flushInterval: 5000, flushAt: 10, criticalEvents: undefined, highPriorityEvents: undefined, sessionTimeout: 60 * 60 * 1000, trackSessions: true, attributionWindow: 90 * 24 * 60 * 60 * 1000, trackedParams: [], respectDoNotTrack: false, respectGlobalPrivacyControl: true, privacyMode: 'standard', cookieDomain: 'auto', cookieExpires: 365, secureCookie: 'auto', sameSite: 'Lax', cookiePrefix: '__dl_', enablePerformanceTracking: true, enableFingerprinting: true, maxRetries: 5, retryDelay: 1000, maxOfflineQueueSize: 100, trackSPA: true, trackPageViews: true, fallbackEndpoints: [], plugins: [] }, config);
+        // platform:'shopify' implies cart-attribute sync: stamp visitor_id + Meta
+        // click signals into note_attributes so server-side order webhooks can
+        // attribute guest checkouts. Lets the Shopify theme app-embed enable it via
+        // data-platform="shopify" alone. `=== undefined` so an explicit
+        // shopifyCartAttributes:false still wins.
+        if (this.config.platform === 'shopify' && this.config.shopifyCartAttributes === undefined) {
+            this.config.shopifyCartAttributes = true;
+        }
         // Initialize cookie storage with config
         this.cookies = new CookieStorage({
             domain: this.config.cookieDomain,
@@ -3457,6 +3551,12 @@ class Datalyr {
         storage.migrateFromLegacyPrefix();
         // Check opt-out AFTER cookies configured (Issue #14)
         this.optedOut = this.cookies.get('__dl_opt_out') === 'true';
+        // CC funnel page entry: restore the _dl_* URL bridge BEFORE IdentityManager
+        // initializes so the storefront's visitor_id is the one used here (instead
+        // of auto-generating a fresh one on this domain).
+        if (this.config.platform === 'checkoutchamp') {
+            this.restoreFromURL();
+        }
         // Initialize modules
         this.identity = new IdentityManager();
         this.session = new SessionManager(this.config.sessionTimeout);
@@ -3522,13 +3622,35 @@ class Datalyr {
                         this.container = new ContainerManager({
                             workspaceId: this.config.workspaceId,
                             endpoint: this.config.endpoint,
-                            debug: this.config.debug
+                            debug: this.config.debug,
+                            // Lazy: invoked at the moment a third-party pixel inits, AFTER the
+                            // /container-scripts roundtrip resolves — so a pre-init identify()
+                            // already updated this.identity / this.userProperties. distinctId
+                            // mirrors what CAPI puts in external_id[] (user_id || anonymous_id);
+                            // email lets the Pixel match on em with the same hash CAPI sends.
+                            getIdentity: () => {
+                                var _a, _b;
+                                return ({
+                                    externalId: (_a = this.identity) === null || _a === void 0 ? void 0 : _a.getDistinctId(),
+                                    email: (_b = this.userProperties) === null || _b === void 0 ? void 0 : _b.email,
+                                });
+                            }
                         });
                         // Initialize container asynchronously
                         yield this.container.init().catch(error => {
                             this.log('Container initialization failed:', error);
                         });
                     }
+                    // autoIdentify default for the CC bridge:
+                    // - platform === 'checkoutchamp' (CC funnel pages) OR
+                    // - checkoutChampDomains set (Shopify storefronts feeding a CC funnel)
+                    // turn autoIdentify on unless the caller explicitly set it to false.
+                    // The 95% claim relies on email capture on BOTH ends of the bridge.
+                    const ccBridgeActive = this.config.platform === 'checkoutchamp'
+                        || (Array.isArray(this.config.checkoutChampDomains) && this.config.checkoutChampDomains.length > 0);
+                    if (ccBridgeActive && this.config.autoIdentify === undefined) {
+                        this.config.autoIdentify = true;
+                    }
                     // Initialize auto-identify if explicitly enabled (opt-in)
                     if (this.config.autoIdentify === true) {
                         this.autoIdentify = new AutoIdentifyManager({
@@ -3561,6 +3683,12 @@ class Datalyr {
                             this.log('Shopify cart attribute sync failed:', error);
                         });
                     }
+                    // Storefront → CC bridge: stamp _dl_* params on outbound links to the
+                    // configured CC domains so visitor_id + click signals cross the domain
+                    // boundary. Inert unless checkoutChampDomains is set.
+                    if (Array.isArray(this.config.checkoutChampDomains) && this.config.checkoutChampDomains.length > 0) {
+                        this.syncOutboundLinkParams(this.config.checkoutChampDomains);
+                    }
                     // Track initial page view if enabled (AFTER encryption ready)
                     if (this.config.trackPageViews) {
                         this.page();
@@ -4031,6 +4159,7 @@ class Datalyr {
             const visitorId = this.identity.getAnonymousId();
             const fbc = this.cookies.get("_fbc") || attribution._fbc;
             const fbp = this.cookies.get("_fbp") || attribution._fbp;
+            const fbclidAt = this.cookies.get("_dl_fbclid_at");
             if (visitorId)
                 attributes._datalyr_visitor_id = visitorId;
             if (fbc)
@@ -4039,6 +4168,8 @@ class Datalyr {
                 attributes._datalyr_fbp = String(fbp);
             if (fbclid)
                 attributes._datalyr_fbclid = String(fbclid);
+            if (fbclidAt)
+                attributes._datalyr_fbclid_at = String(fbclidAt);
             if (Object.keys(attributes).length === 0)
                 return;
             try {
@@ -4056,6 +4187,218 @@ class Datalyr {
             }
         });
     }
+    /**
+     * Restore _dl_* URL bridge params on a Checkout Champ funnel page.
+     * Runs BEFORE IdentityManager so the storefront's visitor_id wins over a
+     * freshly auto-generated one. Also restores _fbc / _fbp cookies and the
+     * fbclid click time so server-side rebuilds carry the real click moment.
+     *
+     * Strategy: stamp matching cookies (without clobbering pre-existing values),
+     * then rewrite the URL so `_dl_fbclid` becomes `fbclid` — that way the rest
+     * of the SDK's attribution layer (which reads `params.fbclid`) works
+     * unchanged, and any merchant analytics also see the canonical click ID.
+     */
+    restoreFromURL() {
+        var _a;
+        if (typeof window === "undefined" || typeof document === "undefined")
+            return;
+        try {
+            const params = new URLSearchParams(window.location.search);
+            const get = (k) => params.get(k);
+            const vid = get("_dl_vid");
+            const fbc = get("_dl_fbc");
+            const fbp = get("_dl_fbp");
+            const fbclid = get("_dl_fbclid");
+            const fbclidAt = get("_dl_fbclid_at");
+            const gclid = get("_dl_gclid");
+            const gclidAt = get("_dl_gclid_at");
+            // visitor_id: bridge wins. The whole point of `_dl_vid` is to unify the
+            // storefront's session with the CC funnel session. A pre-existing local
+            // cookie from a prior direct CC visit would silently sink the integration
+            // (CC events stay on the local id; storefront events use the bridged id;
+            // the two never link). Overwrite — orphaned local events are fine.
+            if (vid)
+                this.cookies.set("__dl_visitor_id", vid, 365);
+            // Meta cookies + click-time cookies: existing wins. _fbc / _fbp may have
+            // been written by Meta Pixel on the CC funnel page itself (more recent
+            // than the bridged value); _dl_fbclid_at should record first-touch click
+            // time per device, not get reset by a bridge from a new campaign.
+            const setIfMissing = (name, value) => {
+                if (!value)
+                    return;
+                if (this.cookies.get(name))
+                    return;
+                this.cookies.set(name, value, 365);
+            };
+            setIfMissing("_fbc", fbc);
+            setIfMissing("_fbp", fbp);
+            setIfMissing("_dl_fbclid_at", fbclidAt);
+            setIfMissing("_dl_gclid_at", gclidAt);
+            // Rewrite URL: _dl_fbclid → fbclid (etc.) so captureAttribution() picks
+            // them up via its existing `params.fbclid` path. Strip the _dl_* params
+            // either way so they don't leak into downstream analytics URLs.
+            let rewrote = false;
+            const mappings = [
+                ["fbclid", fbclid],
+                ["gclid", gclid]
+            ];
+            for (const [canonical, value] of mappings) {
+                if (value && !params.get(canonical)) {
+                    params.set(canonical, value);
+                    rewrote = true;
+                }
+            }
+            for (const k of ["_dl_vid", "_dl_fbc", "_dl_fbp", "_dl_fbclid", "_dl_fbclid_at", "_dl_gclid", "_dl_gclid_at"]) {
+                if (params.has(k)) {
+                    params.delete(k);
+                    rewrote = true;
+                }
+            }
+            if (rewrote && typeof ((_a = window.history) === null || _a === void 0 ? void 0 : _a.replaceState) === "function") {
+                const newSearch = params.toString();
+                const newUrl = window.location.pathname +
+                    (newSearch ? "?" + newSearch : "") +
+                    window.location.hash;
+                window.history.replaceState(window.history.state, "", newUrl);
+            }
+            this.log("Checkout Champ bridge restored:", {
+                had_vid: !!vid,
+                had_fbc: !!fbc,
+                had_fbp: !!fbp,
+                had_fbclid: !!fbclid,
+                had_gclid: !!gclid
+            });
+        }
+        catch (error) {
+            // Don't let bridge restoration block init — fall through to normal SDK
+            // behavior (a fresh visitor_id, no restored click signals).
+            this.log("restoreFromURL failed:", error);
+        }
+    }
+    /**
+     * Storefront → Checkout Champ link stamping. Finds every `<a href>` whose host
+     * matches the configured CC domain list and appends `?_dl_vid=…&_dl_fbc=…&
+     * _dl_fbp=…&_dl_fbclid=…&_dl_fbclid_at=…&_dl_gclid=…` so the user's
+     * visitor_id + Meta click signals cross the domain. MutationObserver watches
+     * for dynamically-injected links. On click, force-flush the event queue so
+     * any pending track() events land before the browser navigates away.
+     */
+    syncOutboundLinkParams(domains) {
+        if (typeof window === "undefined" || typeof document === "undefined")
+            return;
+        const lowerDomains = domains.map((d) => d.toLowerCase());
+        const matchesCcDomain = (href) => {
+            try {
+                const host = new URL(href, window.location.href).hostname.toLowerCase();
+                return lowerDomains.some((d) => host === d || host.endsWith("." + d));
+            }
+            catch (_a) {
+                return false;
+            }
+        };
+        const buildBridgeParams = () => {
+            const attribution = this.attribution.getAttributionData();
+            const out = {};
+            const vid = this.identity.getAnonymousId();
+            const fbc = this.cookies.get("_fbc") || attribution._fbc;
+            const fbp = this.cookies.get("_fbp") || attribution._fbp;
+            const fbclid = attribution.clickIdType === "fbclid" ? attribution.clickId : null;
+            const fbclidAt = this.cookies.get("_dl_fbclid_at");
+            const gclid = attribution.clickIdType === "gclid" ? attribution.clickId : null;
+            const gclidAt = this.cookies.get("_dl_gclid_at");
+            if (vid)
+                out._dl_vid = vid;
+            if (fbc)
+                out._dl_fbc = String(fbc);
+            if (fbp)
+                out._dl_fbp = String(fbp);
+            if (fbclid)
+                out._dl_fbclid = String(fbclid);
+            if (fbclidAt)
+                out._dl_fbclid_at = String(fbclidAt);
+            if (gclid)
+                out._dl_gclid = String(gclid);
+            if (gclidAt)
+                out._dl_gclid_at = String(gclidAt);
+            return out;
+        };
+        const stampLink = (anchor) => {
+            if (!anchor.href || !matchesCcDomain(anchor.href))
+                return;
+            try {
+                const u = new URL(anchor.href, window.location.href);
+                const bridge = buildBridgeParams();
+                let mutated = false;
+                for (const [k, v] of Object.entries(bridge)) {
+                    if (!u.searchParams.get(k)) {
+                        u.searchParams.set(k, v);
+                        mutated = true;
+                    }
+                }
+                if (mutated)
+                    anchor.href = u.toString();
+            }
+            catch (_a) {
+                // Ignore malformed URLs — don't break the page.
+            }
+        };
+        const stampAll = () => {
+            document.querySelectorAll("a[href]").forEach((el) => stampLink(el));
+        };
+        const onClick = (e) => {
+            var _a, _b;
+            const target = (_a = e.target) === null || _a === void 0 ? void 0 : _a.closest("a[href]");
+            if (!target)
+                return;
+            const anchor = target;
+            if (!matchesCcDomain(anchor.href))
+                return;
+            stampLink(anchor); // re-stamp in case attribution changed since DOMReady
+            try {
+                (_b = this.queue) === null || _b === void 0 ? void 0 : _b.flush();
+            }
+            catch (_c) {
+                // Best-effort — never block navigation.
+            }
+        };
+        stampAll();
+        document.addEventListener("click", onClick, true);
+        try {
+            // Debounce re-stamping. A busy SPA (infinite scroll, animations,
+            // React/Vue updates) can fire thousands of mutations per second; a naive
+            // re-stamp on every notification would burn CPU pointlessly when
+            // outbound link sets only change occasionally. 150ms is small enough to
+            // catch links before the user can click them, large enough to coalesce
+            // bursts.
+            let restampTimer = null;
+            const scheduleRestamp = () => {
+                if (restampTimer != null)
+                    return;
+                restampTimer = setTimeout(() => {
+                    restampTimer = null;
+                    stampAll();
+                }, 150);
+            };
+            const observer = new MutationObserver(scheduleRestamp);
+            observer.observe(document.documentElement, { childList: true, subtree: true });
+            // Observer + click listener live for the session; pagehide cleans up on
+            // full-page unload. SPA route changes are fine — we WANT stamping to keep
+            // working across virtual navigations.
+            window.addEventListener("pagehide", () => {
+                try {
+                    observer.disconnect();
+                }
+                catch ( /* idempotent */_a) { /* idempotent */ }
+                if (restampTimer != null)
+                    clearTimeout(restampTimer);
+                document.removeEventListener("click", onClick, true);
+            }, { once: true });
+        }
+        catch (error) {
+            this.log("MutationObserver setup failed (CC link sync):", error);
+        }
+        this.log("Checkout Champ outbound-link sync active for:", lowerDomains);
+    }
     /**
      * Create event payload
      */
@@ -4116,7 +4459,7 @@ class Datalyr {
             resolution_method: 'browser_sdk',
             resolution_confidence: 1.0,
             // SDK metadata (keep in sync with package.json version)
-            sdk_version: '1.6.0',
+            sdk_version: '1.6.4',
             sdk_name: 'datalyr-web-sdk'
         };
         return payload;