@datalyr/web 1.6.2 → 1.6.4

package/dist/datalyr.js

@@ -1,5 +1,5 @@
 /**
- * @datalyr/web v1.6.2
+ * @datalyr/web v1.6.4
  * Datalyr Web SDK - Modern attribution tracking for web applications
  * (c) 2026 Datalyr Inc.
  * Released under the MIT License
@@ -585,6 +585,37 @@ var Datalyr = (function (exports) {
     /**
      * Utility Functions
      */
+    /**
+     * SHA-256 hex digest aligned with the worker's CAPI hashing (cloudflare/
+     * postback/core/utils.js `sha256()`). Always lowercases + trims the input
+     * before hashing — Meta's matching requires byte-for-byte identical hashes
+     * on the Pixel side and the CAPI server side, and the worker uniformly
+     * normalizes everything it hashes (em, ph, fn, ln, external_id, etc).
+     *
+     * Pixel-side hashes that don't match CAPI hashes silently fail to dedupe,
+     * which is why this helper does the normalization for callers — easy to
+     * forget, hard to debug after release. Returns null when Web Crypto isn't
+     * available (very old browsers, non-secure contexts) so callers can
+     * gracefully skip advanced matching rather than throwing.
+     */
+    function sha256Hex(input) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (typeof crypto === 'undefined' || !crypto.subtle)
+                return null;
+            if (!input)
+                return null;
+            try {
+                const bytes = new TextEncoder().encode(input.toLowerCase().trim());
+                const digest = yield crypto.subtle.digest('SHA-256', bytes);
+                return Array.from(new Uint8Array(digest))
+                    .map((b) => b.toString(16).padStart(2, '0'))
+                    .join('');
+            }
+            catch (_a) {
+                return null;
+            }
+        });
+    }
     /**
      * Generate UUID v4
      */
@@ -1496,6 +1527,7 @@ var Datalyr = (function (exports) {
          * Capture advertising platform cookies
          */
         captureAdCookies() {
+            var _a, _b;
             const adCookies = {};
             // Facebook/Meta cookies
             adCookies._fbp = cookies.get('_fbp');
@@ -1520,13 +1552,29 @@ var Datalyr = (function (exports) {
                 // Optionally set the cookie for future use
                 cookies.set('_fbp', adCookies._fbp, 90);
             }
+            // Persist the click time the FIRST time we see fbclid/gclid in URL so we can
+            // rebuild fbc (and stamp real click time on server-side events) later even
+            // when _fbc/_gclid cookies get evicted. Once-only: never overwrite.
+            const fbclid = this.getCurrentFbclid();
+            if (fbclid && !cookies.get('_dl_fbclid_at')) {
+                cookies.set('_dl_fbclid_at', String(Date.now()), 90);
+            }
+            const gclid = this.hasClickId('gclid') ? ((_b = (_a = this.queryParamsCache) === null || _a === void 0 ? void 0 : _a.gclid) !== null && _b !== void 0 ? _b : null) : null;
+            if (gclid && !cookies.get('_dl_gclid_at')) {
+                cookies.set('_dl_gclid_at', String(Date.now()), 90);
+            }
             // Generate _fbc if we have fbclid but no _fbc.
             // Meta's fbc format is `fb.{subdomainIndex}.{creationTime}.{fbclid}` where
             // creationTime is UNIX time in MILLISECONDS (matches the _fbp generation above
             // and the real _fbc cookie the Meta Pixel writes). Do NOT use seconds here.
-            const fbclid = this.getCurrentFbclid();
             if (fbclid && !adCookies._fbc) {
-                const timestamp = Date.now();
+                // Prefer the persisted click time when valid; fall back to now if the
+                // cookie is missing or corrupted (e.g. user edited it to garbage).
+                // Without this guard, Number("abc") = NaN and Meta would reject
+                // `fb.1.NaN.{fbclid}`.
+                const stored = cookies.get('_dl_fbclid_at');
+                const parsed = stored ? Number(stored) : NaN;
+                const timestamp = Number.isFinite(parsed) && parsed > 0 ? parsed : Date.now();
                 adCookies._fbc = `fb.1.${timestamp}.${fbclid}`;
                 // Optionally set the cookie for future use
                 cookies.set('_fbc', adCookies._fbc, 90);
@@ -2314,6 +2362,7 @@ var Datalyr = (function (exports) {
             // Container scripts use the same endpoint as tracking (ingest)
             this.endpoint = options.endpoint || 'https://ingest.datalyr.com';
             this.debug = options.debug || false;
+            this.getIdentity = options.getIdentity;
             // Load session scripts from storage
             const sessionScripts = storage.get('dl_session_scripts', []);
             this.sessionLoadedScripts = new Set(sessionScripts);
@@ -2357,9 +2406,11 @@ var Datalyr = (function (exports) {
                     // Store scripts and pixels
                     this.scripts = data.scripts || [];
                     this.pixels = data.pixels || null;
-                    // Initialize pixels if configured
+                    // Initialize pixels if configured. Awaited so advanced-matching hashes
+                    // are resolved before the first dl.track() flushes through trackToPixels
+                    // (otherwise fbq('init') would lag fbq('track') in fast-path tracks).
                     if (this.pixels) {
-                        this.initializePixels();
+                        yield this.initializePixels();
                     }
                     // Load scripts based on trigger
                     this.loadScriptsByTrigger('page_load');
@@ -2651,57 +2702,92 @@ var Datalyr = (function (exports) {
          * Initialize third-party pixels (Meta, Google, TikTok)
          */
         initializePixels() {
-            var _a, _b, _c;
-            if (!this.pixels)
-                return;
-            // Initialize Meta Pixel
-            if (((_a = this.pixels.meta) === null || _a === void 0 ? void 0 : _a.enabled) && this.pixels.meta.pixel_id) {
-                this.initializeMetaPixel(this.pixels.meta);
-            }
-            // Initialize Google Tag
-            if (((_b = this.pixels.google) === null || _b === void 0 ? void 0 : _b.enabled) && this.pixels.google.tag_id) {
-                this.initializeGoogleTag(this.pixels.google);
-            }
-            // Initialize TikTok Pixel
-            if (((_c = this.pixels.tiktok) === null || _c === void 0 ? void 0 : _c.enabled) && this.pixels.tiktok.pixel_id) {
-                this.initializeTikTokPixel(this.pixels.tiktok);
-            }
+            return __awaiter(this, void 0, void 0, function* () {
+                var _a, _b, _c;
+                if (!this.pixels)
+                    return;
+                // Initialize Meta Pixel
+                if (((_a = this.pixels.meta) === null || _a === void 0 ? void 0 : _a.enabled) && this.pixels.meta.pixel_id) {
+                    yield this.initializeMetaPixel(this.pixels.meta);
+                }
+                // Initialize Google Tag
+                if (((_b = this.pixels.google) === null || _b === void 0 ? void 0 : _b.enabled) && this.pixels.google.tag_id) {
+                    this.initializeGoogleTag(this.pixels.google);
+                }
+                // Initialize TikTok Pixel
+                if (((_c = this.pixels.tiktok) === null || _c === void 0 ? void 0 : _c.enabled) && this.pixels.tiktok.pixel_id) {
+                    this.initializeTikTokPixel(this.pixels.tiktok);
+                }
+            });
         }
         /**
          * Initialize Meta (Facebook) Pixel
+         *
+         * Async because we resolve SHA-256 hashes for advanced matching (Meta's
+         * `external_id` / `em`) before calling fbq('init'). Aligning the hashes the
+         * browser Pixel sends with what CAPI sends (meta.js shovels user_id /
+         * visitor_id / anonymous_id into external_id[], and `em` is sha256 of the
+         * lowercased email) is the dedup-quality lift the CAPI side can't fix alone.
          */
         initializeMetaPixel(config) {
-            try {
-                // Load Meta Pixel script
-                (function (f, b, e, v, n, t, s) {
-                    if (f.fbq)
-                        return;
-                    n = f.fbq = function () {
-                        n.callMethod ? n.callMethod.apply(n, arguments) : n.queue.push(arguments);
-                    };
-                    if (!f._fbq)
-                        f._fbq = n;
-                    n.push = n;
-                    n.loaded = !0;
-                    n.version = '2.0';
-                    n.queue = [];
-                    t = b.createElement(e);
-                    t.async = !0;
-                    t.src = v;
-                    s = b.getElementsByTagName(e)[0];
-                    s.parentNode.insertBefore(t, s);
-                })(window, document, 'script', 'https://connect.facebook.net/en_US/fbevents.js');
-                // Initialize pixel only — do NOT fire PageView here. The SDK's own pageview
-                // tracking (track('pageview')) routes through trackToPixels and fires a single
-                // mapped PageView with a shared eventID. Firing it again here produced TWO
-                // PageViews per load (one un-deduped). Note: if the host app disables pageview
-                // tracking entirely, no PageView is sent — which is the correct outcome.
-                window.fbq('init', config.pixel_id);
-                this.log('Meta Pixel initialized:', config.pixel_id);
-            }
-            catch (error) {
-                this.log('Error initializing Meta Pixel:', error);
-            }
+            return __awaiter(this, void 0, void 0, function* () {
+                var _a;
+                try {
+                    // Load Meta Pixel script
+                    (function (f, b, e, v, n, t, s) {
+                        if (f.fbq)
+                            return;
+                        n = f.fbq = function () {
+                            n.callMethod ? n.callMethod.apply(n, arguments) : n.queue.push(arguments);
+                        };
+                        if (!f._fbq)
+                            f._fbq = n;
+                        n.push = n;
+                        n.loaded = !0;
+                        n.version = '2.0';
+                        n.queue = [];
+                        t = b.createElement(e);
+                        t.async = !0;
+                        t.src = v;
+                        s = b.getElementsByTagName(e)[0];
+                        s.parentNode.insertBefore(t, s);
+                    })(window, document, 'script', 'https://connect.facebook.net/en_US/fbevents.js');
+                    // Build advanced-matching object. Skipped silently if Web Crypto isn't
+                    // available — Pixel still initializes, just without advanced matching.
+                    // Anonymous_id is stable across the session and always present, so we
+                    // never need to re-init on identify(): CAPI carries both anonymous_id
+                    // AND user_id in its external_id[] array, so either side matching one
+                    // hash slot is enough to dedupe.
+                    const advancedMatching = {};
+                    const identity = (_a = this.getIdentity) === null || _a === void 0 ? void 0 : _a.call(this);
+                    if (identity === null || identity === void 0 ? void 0 : identity.externalId) {
+                        const hash = yield sha256Hex(String(identity.externalId));
+                        if (hash)
+                            advancedMatching.external_id = hash;
+                    }
+                    if (identity === null || identity === void 0 ? void 0 : identity.email) {
+                        const hash = yield sha256Hex(String(identity.email).toLowerCase().trim());
+                        if (hash)
+                            advancedMatching.em = hash;
+                    }
+                    // Initialize pixel only — do NOT fire PageView here. The SDK's own pageview
+                    // tracking (track('pageview')) routes through trackToPixels and fires a single
+                    // mapped PageView with a shared eventID. Firing it again here produced TWO
+                    // PageViews per load (one un-deduped). Note: if the host app disables pageview
+                    // tracking entirely, no PageView is sent — which is the correct outcome.
+                    if (Object.keys(advancedMatching).length > 0) {
+                        window.fbq('init', config.pixel_id, advancedMatching);
+                        this.log('Meta Pixel initialized with advanced matching:', config.pixel_id, Object.keys(advancedMatching));
+                    }
+                    else {
+                        window.fbq('init', config.pixel_id);
+                        this.log('Meta Pixel initialized (no advanced matching):', config.pixel_id);
+                    }
+                }
+                catch (error) {
+                    this.log('Error initializing Meta Pixel:', error);
+                }
+            });
         }
         /**
          * Initialize Google Tag
@@ -3445,6 +3531,14 @@ var Datalyr = (function (exports) {
             }
             // Set default config values
             this.config = Object.assign({ endpoint: 'https://ingest.datalyr.com', debug: false, batchSize: 10, flushInterval: 5000, flushAt: 10, criticalEvents: undefined, highPriorityEvents: undefined, sessionTimeout: 60 * 60 * 1000, trackSessions: true, attributionWindow: 90 * 24 * 60 * 60 * 1000, trackedParams: [], respectDoNotTrack: false, respectGlobalPrivacyControl: true, privacyMode: 'standard', cookieDomain: 'auto', cookieExpires: 365, secureCookie: 'auto', sameSite: 'Lax', cookiePrefix: '__dl_', enablePerformanceTracking: true, enableFingerprinting: true, maxRetries: 5, retryDelay: 1000, maxOfflineQueueSize: 100, trackSPA: true, trackPageViews: true, fallbackEndpoints: [], plugins: [] }, config);
+            // platform:'shopify' implies cart-attribute sync: stamp visitor_id + Meta
+            // click signals into note_attributes so server-side order webhooks can
+            // attribute guest checkouts. Lets the Shopify theme app-embed enable it via
+            // data-platform="shopify" alone. `=== undefined` so an explicit
+            // shopifyCartAttributes:false still wins.
+            if (this.config.platform === 'shopify' && this.config.shopifyCartAttributes === undefined) {
+                this.config.shopifyCartAttributes = true;
+            }
             // Initialize cookie storage with config
             this.cookies = new CookieStorage({
                 domain: this.config.cookieDomain,
@@ -3456,6 +3550,12 @@ var Datalyr = (function (exports) {
             storage.migrateFromLegacyPrefix();
             // Check opt-out AFTER cookies configured (Issue #14)
             this.optedOut = this.cookies.get('__dl_opt_out') === 'true';
+            // CC funnel page entry: restore the _dl_* URL bridge BEFORE IdentityManager
+            // initializes so the storefront's visitor_id is the one used here (instead
+            // of auto-generating a fresh one on this domain).
+            if (this.config.platform === 'checkoutchamp') {
+                this.restoreFromURL();
+            }
             // Initialize modules
             this.identity = new IdentityManager();
             this.session = new SessionManager(this.config.sessionTimeout);
@@ -3521,13 +3621,35 @@ var Datalyr = (function (exports) {
                             this.container = new ContainerManager({
                                 workspaceId: this.config.workspaceId,
                                 endpoint: this.config.endpoint,
-                                debug: this.config.debug
+                                debug: this.config.debug,
+                                // Lazy: invoked at the moment a third-party pixel inits, AFTER the
+                                // /container-scripts roundtrip resolves — so a pre-init identify()
+                                // already updated this.identity / this.userProperties. distinctId
+                                // mirrors what CAPI puts in external_id[] (user_id || anonymous_id);
+                                // email lets the Pixel match on em with the same hash CAPI sends.
+                                getIdentity: () => {
+                                    var _a, _b;
+                                    return ({
+                                        externalId: (_a = this.identity) === null || _a === void 0 ? void 0 : _a.getDistinctId(),
+                                        email: (_b = this.userProperties) === null || _b === void 0 ? void 0 : _b.email,
+                                    });
+                                }
                             });
                             // Initialize container asynchronously
                             yield this.container.init().catch(error => {
                                 this.log('Container initialization failed:', error);
                             });
                         }
+                        // autoIdentify default for the CC bridge:
+                        // - platform === 'checkoutchamp' (CC funnel pages) OR
+                        // - checkoutChampDomains set (Shopify storefronts feeding a CC funnel)
+                        // turn autoIdentify on unless the caller explicitly set it to false.
+                        // The 95% claim relies on email capture on BOTH ends of the bridge.
+                        const ccBridgeActive = this.config.platform === 'checkoutchamp'
+                            || (Array.isArray(this.config.checkoutChampDomains) && this.config.checkoutChampDomains.length > 0);
+                        if (ccBridgeActive && this.config.autoIdentify === undefined) {
+                            this.config.autoIdentify = true;
+                        }
                         // Initialize auto-identify if explicitly enabled (opt-in)
                         if (this.config.autoIdentify === true) {
                             this.autoIdentify = new AutoIdentifyManager({
@@ -3560,6 +3682,12 @@ var Datalyr = (function (exports) {
                                 this.log('Shopify cart attribute sync failed:', error);
                             });
                         }
+                        // Storefront → CC bridge: stamp _dl_* params on outbound links to the
+                        // configured CC domains so visitor_id + click signals cross the domain
+                        // boundary. Inert unless checkoutChampDomains is set.
+                        if (Array.isArray(this.config.checkoutChampDomains) && this.config.checkoutChampDomains.length > 0) {
+                            this.syncOutboundLinkParams(this.config.checkoutChampDomains);
+                        }
                         // Track initial page view if enabled (AFTER encryption ready)
                         if (this.config.trackPageViews) {
                             this.page();
@@ -4030,6 +4158,7 @@ var Datalyr = (function (exports) {
                 const visitorId = this.identity.getAnonymousId();
                 const fbc = this.cookies.get("_fbc") || attribution._fbc;
                 const fbp = this.cookies.get("_fbp") || attribution._fbp;
+                const fbclidAt = this.cookies.get("_dl_fbclid_at");
                 if (visitorId)
                     attributes._datalyr_visitor_id = visitorId;
                 if (fbc)
@@ -4038,6 +4167,8 @@ var Datalyr = (function (exports) {
                     attributes._datalyr_fbp = String(fbp);
                 if (fbclid)
                     attributes._datalyr_fbclid = String(fbclid);
+                if (fbclidAt)
+                    attributes._datalyr_fbclid_at = String(fbclidAt);
                 if (Object.keys(attributes).length === 0)
                     return;
                 try {
@@ -4055,6 +4186,218 @@ var Datalyr = (function (exports) {
                 }
             });
         }
+        /**
+         * Restore _dl_* URL bridge params on a Checkout Champ funnel page.
+         * Runs BEFORE IdentityManager so the storefront's visitor_id wins over a
+         * freshly auto-generated one. Also restores _fbc / _fbp cookies and the
+         * fbclid click time so server-side rebuilds carry the real click moment.
+         *
+         * Strategy: stamp matching cookies (without clobbering pre-existing values),
+         * then rewrite the URL so `_dl_fbclid` becomes `fbclid` — that way the rest
+         * of the SDK's attribution layer (which reads `params.fbclid`) works
+         * unchanged, and any merchant analytics also see the canonical click ID.
+         */
+        restoreFromURL() {
+            var _a;
+            if (typeof window === "undefined" || typeof document === "undefined")
+                return;
+            try {
+                const params = new URLSearchParams(window.location.search);
+                const get = (k) => params.get(k);
+                const vid = get("_dl_vid");
+                const fbc = get("_dl_fbc");
+                const fbp = get("_dl_fbp");
+                const fbclid = get("_dl_fbclid");
+                const fbclidAt = get("_dl_fbclid_at");
+                const gclid = get("_dl_gclid");
+                const gclidAt = get("_dl_gclid_at");
+                // visitor_id: bridge wins. The whole point of `_dl_vid` is to unify the
+                // storefront's session with the CC funnel session. A pre-existing local
+                // cookie from a prior direct CC visit would silently sink the integration
+                // (CC events stay on the local id; storefront events use the bridged id;
+                // the two never link). Overwrite — orphaned local events are fine.
+                if (vid)
+                    this.cookies.set("__dl_visitor_id", vid, 365);
+                // Meta cookies + click-time cookies: existing wins. _fbc / _fbp may have
+                // been written by Meta Pixel on the CC funnel page itself (more recent
+                // than the bridged value); _dl_fbclid_at should record first-touch click
+                // time per device, not get reset by a bridge from a new campaign.
+                const setIfMissing = (name, value) => {
+                    if (!value)
+                        return;
+                    if (this.cookies.get(name))
+                        return;
+                    this.cookies.set(name, value, 365);
+                };
+                setIfMissing("_fbc", fbc);
+                setIfMissing("_fbp", fbp);
+                setIfMissing("_dl_fbclid_at", fbclidAt);
+                setIfMissing("_dl_gclid_at", gclidAt);
+                // Rewrite URL: _dl_fbclid → fbclid (etc.) so captureAttribution() picks
+                // them up via its existing `params.fbclid` path. Strip the _dl_* params
+                // either way so they don't leak into downstream analytics URLs.
+                let rewrote = false;
+                const mappings = [
+                    ["fbclid", fbclid],
+                    ["gclid", gclid]
+                ];
+                for (const [canonical, value] of mappings) {
+                    if (value && !params.get(canonical)) {
+                        params.set(canonical, value);
+                        rewrote = true;
+                    }
+                }
+                for (const k of ["_dl_vid", "_dl_fbc", "_dl_fbp", "_dl_fbclid", "_dl_fbclid_at", "_dl_gclid", "_dl_gclid_at"]) {
+                    if (params.has(k)) {
+                        params.delete(k);
+                        rewrote = true;
+                    }
+                }
+                if (rewrote && typeof ((_a = window.history) === null || _a === void 0 ? void 0 : _a.replaceState) === "function") {
+                    const newSearch = params.toString();
+                    const newUrl = window.location.pathname +
+                        (newSearch ? "?" + newSearch : "") +
+                        window.location.hash;
+                    window.history.replaceState(window.history.state, "", newUrl);
+                }
+                this.log("Checkout Champ bridge restored:", {
+                    had_vid: !!vid,
+                    had_fbc: !!fbc,
+                    had_fbp: !!fbp,
+                    had_fbclid: !!fbclid,
+                    had_gclid: !!gclid
+                });
+            }
+            catch (error) {
+                // Don't let bridge restoration block init — fall through to normal SDK
+                // behavior (a fresh visitor_id, no restored click signals).
+                this.log("restoreFromURL failed:", error);
+            }
+        }
+        /**
+         * Storefront → Checkout Champ link stamping. Finds every `<a href>` whose host
+         * matches the configured CC domain list and appends `?_dl_vid=…&_dl_fbc=…&
+         * _dl_fbp=…&_dl_fbclid=…&_dl_fbclid_at=…&_dl_gclid=…` so the user's
+         * visitor_id + Meta click signals cross the domain. MutationObserver watches
+         * for dynamically-injected links. On click, force-flush the event queue so
+         * any pending track() events land before the browser navigates away.
+         */
+        syncOutboundLinkParams(domains) {
+            if (typeof window === "undefined" || typeof document === "undefined")
+                return;
+            const lowerDomains = domains.map((d) => d.toLowerCase());
+            const matchesCcDomain = (href) => {
+                try {
+                    const host = new URL(href, window.location.href).hostname.toLowerCase();
+                    return lowerDomains.some((d) => host === d || host.endsWith("." + d));
+                }
+                catch (_a) {
+                    return false;
+                }
+            };
+            const buildBridgeParams = () => {
+                const attribution = this.attribution.getAttributionData();
+                const out = {};
+                const vid = this.identity.getAnonymousId();
+                const fbc = this.cookies.get("_fbc") || attribution._fbc;
+                const fbp = this.cookies.get("_fbp") || attribution._fbp;
+                const fbclid = attribution.clickIdType === "fbclid" ? attribution.clickId : null;
+                const fbclidAt = this.cookies.get("_dl_fbclid_at");
+                const gclid = attribution.clickIdType === "gclid" ? attribution.clickId : null;
+                const gclidAt = this.cookies.get("_dl_gclid_at");
+                if (vid)
+                    out._dl_vid = vid;
+                if (fbc)
+                    out._dl_fbc = String(fbc);
+                if (fbp)
+                    out._dl_fbp = String(fbp);
+                if (fbclid)
+                    out._dl_fbclid = String(fbclid);
+                if (fbclidAt)
+                    out._dl_fbclid_at = String(fbclidAt);
+                if (gclid)
+                    out._dl_gclid = String(gclid);
+                if (gclidAt)
+                    out._dl_gclid_at = String(gclidAt);
+                return out;
+            };
+            const stampLink = (anchor) => {
+                if (!anchor.href || !matchesCcDomain(anchor.href))
+                    return;
+                try {
+                    const u = new URL(anchor.href, window.location.href);
+                    const bridge = buildBridgeParams();
+                    let mutated = false;
+                    for (const [k, v] of Object.entries(bridge)) {
+                        if (!u.searchParams.get(k)) {
+                            u.searchParams.set(k, v);
+                            mutated = true;
+                        }
+                    }
+                    if (mutated)
+                        anchor.href = u.toString();
+                }
+                catch (_a) {
+                    // Ignore malformed URLs — don't break the page.
+                }
+            };
+            const stampAll = () => {
+                document.querySelectorAll("a[href]").forEach((el) => stampLink(el));
+            };
+            const onClick = (e) => {
+                var _a, _b;
+                const target = (_a = e.target) === null || _a === void 0 ? void 0 : _a.closest("a[href]");
+                if (!target)
+                    return;
+                const anchor = target;
+                if (!matchesCcDomain(anchor.href))
+                    return;
+                stampLink(anchor); // re-stamp in case attribution changed since DOMReady
+                try {
+                    (_b = this.queue) === null || _b === void 0 ? void 0 : _b.flush();
+                }
+                catch (_c) {
+                    // Best-effort — never block navigation.
+                }
+            };
+            stampAll();
+            document.addEventListener("click", onClick, true);
+            try {
+                // Debounce re-stamping. A busy SPA (infinite scroll, animations,
+                // React/Vue updates) can fire thousands of mutations per second; a naive
+                // re-stamp on every notification would burn CPU pointlessly when
+                // outbound link sets only change occasionally. 150ms is small enough to
+                // catch links before the user can click them, large enough to coalesce
+                // bursts.
+                let restampTimer = null;
+                const scheduleRestamp = () => {
+                    if (restampTimer != null)
+                        return;
+                    restampTimer = setTimeout(() => {
+                        restampTimer = null;
+                        stampAll();
+                    }, 150);
+                };
+                const observer = new MutationObserver(scheduleRestamp);
+                observer.observe(document.documentElement, { childList: true, subtree: true });
+                // Observer + click listener live for the session; pagehide cleans up on
+                // full-page unload. SPA route changes are fine — we WANT stamping to keep
+                // working across virtual navigations.
+                window.addEventListener("pagehide", () => {
+                    try {
+                        observer.disconnect();
+                    }
+                    catch ( /* idempotent */_a) { /* idempotent */ }
+                    if (restampTimer != null)
+                        clearTimeout(restampTimer);
+                    document.removeEventListener("click", onClick, true);
+                }, { once: true });
+            }
+            catch (error) {
+                this.log("MutationObserver setup failed (CC link sync):", error);
+            }
+            this.log("Checkout Champ outbound-link sync active for:", lowerDomains);
+        }
         /**
          * Create event payload
          */
@@ -4115,7 +4458,7 @@ var Datalyr = (function (exports) {
                 resolution_method: 'browser_sdk',
                 resolution_confidence: 1.0,
                 // SDK metadata (keep in sync with package.json version)
-                sdk_version: '1.6.0',
+                sdk_version: '1.6.4',
                 sdk_name: 'datalyr-web-sdk'
             };
             return payload;