@datalyr/web 1.6.4 → 1.7.0

package/README.md

@@ -1,6 +1,6 @@
 # @datalyr/web
 
-Browser SDK for event tracking, user identity, and attribution. Version 1.4.1.
+Browser SDK for event tracking, user identity, and attribution. Version 1.7.0.
 
 ## Table of Contents
 
@@ -116,7 +116,7 @@ Every event includes:
   workspace_id: 'wk_xxxxx',
   source: 'web',
   timestamp: '2024-01-15T10:30:00Z',
-  sdk_version: '1.4.1',
+  sdk_version: '1.7.0',
   sdk_name: 'datalyr-web-sdk'
 }
 ```
@@ -187,7 +187,7 @@ datalyr.init({
   // Auto-Identify (opt-in)
   autoIdentify?: boolean,                   // Default: false - Automatically identify users
   autoIdentifyForms?: boolean,              // Default: true - Capture email from forms (when autoIdentify enabled)
-  autoIdentifyAPI?: boolean,                // Default: true - Capture email from API responses (when autoIdentify enabled)
+  autoIdentifyAPI?: boolean,                // Default: false - Capture email from API responses (off: same-origin scan can mis-identify; opt in explicitly)
   autoIdentifyShopify?: boolean,            // Default: true - Capture email from Shopify endpoints (when autoIdentify enabled)
   autoIdentifyTrustedDomains?: string[],    // Default: [] - Additional domains to trust for API capture
 
@@ -198,6 +198,21 @@ datalyr.init({
 
 ---
 
+## Remote config (Identity Bridge)
+
+These options can be controlled from the dashboard (**Settings → Identity & Attribution**) with **no code change** — they're delivered to the SDK at runtime in the `/container-scripts` response and merged in:
+
+- `autoIdentify`, `autoIdentifyForms`, `autoIdentifyAPI`, `autoIdentifyShopify`
+- `shopifyCartAttributes`
+- `checkoutChampDomains`
+- `respectGlobalPrivacyControl`, `respectDoNotTrack`, `privacyMode`
+
+**Precedence, per key:** built-in default ← dashboard ← explicit `init()`. An explicit value in `init()` always wins, so you can pin a value in code and still manage everything else from the dashboard. Changes propagate in ~5 minutes (edge-cached). An older worker that doesn't send the `config` envelope is a no-op — built-in defaults stand.
+
+> `platform` is **not** remote-configurable — set it at install time via the `data-platform` attribute. The CheckoutChamp behaviors run before the remote config loads, so a dashboard-set platform wouldn't drive them.
+
+---
+
 ## API Reference
 
 ### Event Tracking

package/dist/config.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Remote SDK config (Auto Identity Bridge).
+ *
+ * The `/container-scripts` response carries a `config` object — the workspace
+ * `sdk_config` with server-computed defaults already applied (e.g. auto-identify
+ * OFF for sensitive/health verticals). This module folds that remote config
+ * UNDER the caller's explicit init() options, so the dashboard controls behavior
+ * with zero snippet edits while explicit code always wins.
+ *
+ * Precedence per key:  explicit init() value  >  remote config  >  built-in default
+ */
+import type { DatalyrConfig } from './types';
+/** Subset of DatalyrConfig the worker may deliver via the config envelope. */
+export interface SdkRemoteConfig {
+    autoIdentify?: boolean;
+    autoIdentifyForms?: boolean;
+    autoIdentifyAPI?: boolean;
+    autoIdentifyShopify?: boolean;
+    shopifyCartAttributes?: boolean;
+    checkoutChampDomains?: string[];
+    respectGlobalPrivacyControl?: boolean;
+    respectDoNotTrack?: boolean;
+    privacyMode?: 'standard' | 'strict';
+}
+/**
+ * Fold `remote` into `config` IN PLACE. Precedence per key:
+ *   explicit init() value  >  remote (dashboard)  >  built-in default
+ *
+ * `explicitKeys` = the keys the CALLER passed to init() (before built-in
+ * defaults were merged in). For any remote key NOT in that set, remote
+ * OVERRIDES the built-in default. This is essential because some keys
+ * (respectDoNotTrack, respectGlobalPrivacyControl, privacyMode) get a built-in
+ * default at init() and are therefore never `undefined` — a naive
+ * "fill-if-undefined" would silently ignore the dashboard for them.
+ *
+ * No-op when there's no remote config (older worker / container disabled /
+ * failed fetch) — built-in defaults then stand.
+ */
+export declare function applyRemoteConfig(config: DatalyrConfig, remote?: SdkRemoteConfig | null, explicitKeys?: ReadonlySet<string>): void;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAMhC,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,WAAW,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;CACrC;AAeD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,aAAa,EACrB,MAAM,CAAC,EAAE,eAAe,GAAG,IAAI,EAC/B,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GACjC,IAAI,CAUN"}

package/dist/config.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=config.test.d.ts.map

package/dist/config.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.test.d.ts","sourceRoot":"","sources":["../src/config.test.ts"],"names":[],"mappings":""}

package/dist/container.d.ts

@@ -2,6 +2,7 @@
  * Container Script Manager
  * Loads and manages third-party tracking scripts and pixels
  */
+import type { SdkRemoteConfig } from './config';
 /**
  * Identity snapshot read at the moment a third-party pixel initializes.
  * Aligns the browser Pixel's advanced matching with what CAPI sends server-side
@@ -57,6 +58,10 @@ export declare class ContainerManager {
     private loadedScripts;
     private sessionLoadedScripts;
     private pixels;
+    /** SDK runtime config from the /container-scripts `config` envelope (the
+     *  dashboard sdk_config + server-computed defaults). undefined if the worker
+     *  doesn't send it — caller then falls back to built-in defaults. */
+    private remoteConfig?;
     private workspaceId;
     private endpoint;
     private debug;
@@ -75,6 +80,11 @@ export declare class ContainerManager {
      * Initialize container and load scripts
      */
     init(): Promise<void>;
+    /**
+     * The SDK runtime config delivered by /container-scripts, or undefined if the
+     * response omitted it. The SDK merges this under explicit init() options.
+     */
+    getRemoteConfig(): SdkRemoteConfig | undefined;
     /**
      * Load scripts by trigger type
      */

package/dist/container.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../src/container.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,GAAG,UAAU,GAAG,OAAO,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,WAAW,GAAG,WAAW,GAAG,aAAa,GAAG,QAAQ,CAAC;IAC9D,SAAS,EAAE,QAAQ,GAAG,eAAe,GAAG,kBAAkB,CAAC;IAC3D,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,KAAK,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,GAAG,CAAC;KACZ,CAAC,CAAC;IACH,QAAQ,CAAC,EAAE;QACT,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE;QACL,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,oBAAoB,CAAC,EAAE,OAAO,CAAC;KAChC,CAAC;IACF,MAAM,CAAC,EAAE;QACP,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,oBAAoB,CAAC,EAAE,OAAO,CAAC;KAChC,CAAC;IACF,MAAM,CAAC,EAAE;QACP,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,OAAO,CAAyB;IACxC,OAAO,CAAC,aAAa,CAAqB;IAC1C,OAAO,CAAC,oBAAoB,CAAqB;IACjD,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,KAAK,CAAU;IACvB,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,gBAAgB,CAA2B;IACnD,OAAO,CAAC,qBAAqB,CAAwC;IACrE,OAAO,CAAC,cAAc,CAAgD;IAKtE,OAAO,CAAC,WAAW,CAAC,CAAkC;gBAE1C,OAAO,EAAE;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,aAAa,GAAG,SAAS,CAAC;KAC/C;IA+BD;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA0D3B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAkBxB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA2B1B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAyB/B;;OAEG;IACH,OAAO,CAAC,UAAU;IA8BlB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IA+DxB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAyBrB;;;OAGG;IACI,iBAAiB,IAAI,IAAI;IAkBhC;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAqC1B;;OAEG;IACH,OAAO,CAAC,SAAS;IAQjB;;OAEG;YACW,gBAAgB;IAmB9B;;;;;;;;OAQG;YACW,mBAAmB;IAsDjC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAyB3B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA0C7B;;OAEG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,GAAE,GAAQ,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI;IAqF9E;;OAEG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAO3C;;OAEG;IACH,gBAAgB,IAAI,MAAM,EAAE;IAI5B;;;;;;;;;;;;;;;;;;;OAmBG;IAEH;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAoBxB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAQzB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAyB1B;;OAEG;IACH,OAAO,CAAC,aAAa;IA0BrB;;OAEG;IACH,OAAO,CAAC,GAAG;CAKZ"}
+{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../src/container.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAEhD;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,GAAG,UAAU,GAAG,OAAO,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,WAAW,GAAG,WAAW,GAAG,aAAa,GAAG,QAAQ,CAAC;IAC9D,SAAS,EAAE,QAAQ,GAAG,eAAe,GAAG,kBAAkB,CAAC;IAC3D,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,KAAK,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,GAAG,CAAC;KACZ,CAAC,CAAC;IACH,QAAQ,CAAC,EAAE;QACT,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE;QACL,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,oBAAoB,CAAC,EAAE,OAAO,CAAC;KAChC,CAAC;IACF,MAAM,CAAC,EAAE;QACP,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,oBAAoB,CAAC,EAAE,OAAO,CAAC;KAChC,CAAC;IACF,MAAM,CAAC,EAAE;QACP,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,OAAO,CAAyB;IACxC,OAAO,CAAC,aAAa,CAAqB;IAC1C,OAAO,CAAC,oBAAoB,CAAqB;IACjD,OAAO,CAAC,MAAM,CAA4B;IAC1C;;yEAEqE;IACrE,OAAO,CAAC,YAAY,CAAC,CAAkB;IACvC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,KAAK,CAAU;IACvB,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,gBAAgB,CAA2B;IACnD,OAAO,CAAC,qBAAqB,CAAwC;IACrE,OAAO,CAAC,cAAc,CAAgD;IAKtE,OAAO,CAAC,WAAW,CAAC,CAAkC;gBAE1C,OAAO,EAAE;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,aAAa,GAAG,SAAS,CAAC;KAC/C;IA+BD;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA2D3B;;;OAGG;IACH,eAAe,IAAI,eAAe,GAAG,SAAS;IAI9C;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAkBxB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA2B1B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAyB/B;;OAEG;IACH,OAAO,CAAC,UAAU;IA8BlB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IA+DxB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAyBrB;;;OAGG;IACI,iBAAiB,IAAI,IAAI;IAkBhC;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAqC1B;;OAEG;IACH,OAAO,CAAC,SAAS;IAQjB;;OAEG;YACW,gBAAgB;IAmB9B;;;;;;;;OAQG;YACW,mBAAmB;IAsDjC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAyB3B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA0C7B;;OAEG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,GAAE,GAAQ,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI;IAqF9E;;OAEG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAO3C;;OAEG;IACH,gBAAgB,IAAI,MAAM,EAAE;IAI5B;;;;;;;;;;;;;;;;;;;OAmBG;IAEH;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAoBxB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAQzB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAyB1B;;OAEG;IACH,OAAO,CAAC,aAAa;IA0BrB;;OAEG;IACH,OAAO,CAAC,GAAG;CAKZ"}

package/dist/datalyr.cjs.js

@@ -1,5 +1,5 @@
 /**
- * @datalyr/web v1.6.4
+ * @datalyr/web v1.7.0
  * Datalyr Web SDK - Modern attribution tracking for web applications
  * (c) 2026 Datalyr Inc.
  * Released under the MIT License
@@ -2404,9 +2404,10 @@ class ContainerManager {
                     throw new Error(`Failed to fetch container scripts: ${response.status}`);
                 }
                 const data = yield response.json();
-                // Store scripts and pixels
+                // Store scripts, pixels, and the SDK runtime config envelope.
                 this.scripts = data.scripts || [];
                 this.pixels = data.pixels || null;
+                this.remoteConfig = (data.config && typeof data.config === 'object') ? data.config : undefined;
                 // Initialize pixels if configured. Awaited so advanced-matching hashes
                 // are resolved before the first dl.track() flushes through trackToPixels
                 // (otherwise fbq('init') would lag fbq('track') in fast-path tracks).
@@ -2436,6 +2437,13 @@ class ContainerManager {
             }
         });
     }
+    /**
+     * The SDK runtime config delivered by /container-scripts, or undefined if the
+     * response omitted it. The SDK merges this under explicit init() options.
+     */
+    getRemoteConfig() {
+        return this.remoteConfig;
+    }
     /**
      * Load scripts by trigger type
      */
@@ -3093,7 +3101,7 @@ class AutoIdentifyManager {
         this.config = {
             enabled: config.enabled !== false,
             captureFromForms: config.captureFromForms !== false,
-            captureFromAPI: config.captureFromAPI !== false,
+            captureFromAPI: config.captureFromAPI === true, // default OFF: same-origin response-scan can mis-identify (e.g. admin views)
             captureFromShopify: config.captureFromShopify !== false,
             trustedDomains: config.trustedDomains || [],
             debug: config.debug || false
@@ -3502,12 +3510,57 @@ class AutoIdentifyManager {
     }
 }
 
+/** Keys the remote config is allowed to fill on DatalyrConfig. */
+const REMOTE_KEYS = [
+    'autoIdentify',
+    'autoIdentifyForms',
+    'autoIdentifyAPI',
+    'autoIdentifyShopify',
+    'shopifyCartAttributes',
+    'checkoutChampDomains',
+    'respectGlobalPrivacyControl',
+    'respectDoNotTrack',
+    'privacyMode',
+];
+/**
+ * Fold `remote` into `config` IN PLACE. Precedence per key:
+ *   explicit init() value  >  remote (dashboard)  >  built-in default
+ *
+ * `explicitKeys` = the keys the CALLER passed to init() (before built-in
+ * defaults were merged in). For any remote key NOT in that set, remote
+ * OVERRIDES the built-in default. This is essential because some keys
+ * (respectDoNotTrack, respectGlobalPrivacyControl, privacyMode) get a built-in
+ * default at init() and are therefore never `undefined` — a naive
+ * "fill-if-undefined" would silently ignore the dashboard for them.
+ *
+ * No-op when there's no remote config (older worker / container disabled /
+ * failed fetch) — built-in defaults then stand.
+ */
+function applyRemoteConfig(config, remote, explicitKeys) {
+    if (!remote)
+        return;
+    const target = config;
+    for (const key of REMOTE_KEYS) {
+        const remoteVal = remote[key];
+        if (remoteVal === undefined || remoteVal === null)
+            continue;
+        // Explicit init() always wins; otherwise remote overrides the built-in default.
+        if (explicitKeys === null || explicitKeys === void 0 ? void 0 : explicitKeys.has(key))
+            continue;
+        target[key] = remoteVal;
+    }
+}
+
 /**
  * Datalyr Web SDK
  * Modern attribution tracking for web applications
  */
 class Datalyr {
     constructor() {
+        // Keys the caller passed to init() (before built-in defaults were merged).
+        // Lets the remote-config merge override built-in defaults while always
+        // deferring to an explicit init() value. See applyRemoteConfig.
+        this.explicitConfigKeys = new Set();
         this.superProperties = {};
         this.userProperties = {};
         this.optedOut = false;
@@ -3530,6 +3583,10 @@ class Datalyr {
         if (!config.workspaceId) {
             throw new Error('[Datalyr] workspaceId is required');
         }
+        // Snapshot the keys the caller explicitly set, BEFORE built-in defaults are
+        // merged in — so the remote-config merge can override built-in defaults
+        // while still deferring to anything the caller passed explicitly.
+        this.explicitConfigKeys = new Set(Object.keys(config));
         // Set default config values
         this.config = Object.assign({ endpoint: 'https://ingest.datalyr.com', debug: false, batchSize: 10, flushInterval: 5000, flushAt: 10, criticalEvents: undefined, highPriorityEvents: undefined, sessionTimeout: 60 * 60 * 1000, trackSessions: true, attributionWindow: 90 * 24 * 60 * 60 * 1000, trackedParams: [], respectDoNotTrack: false, respectGlobalPrivacyControl: true, privacyMode: 'standard', cookieDomain: 'auto', cookieExpires: 365, secureCookie: 'auto', sameSite: 'Lax', cookiePrefix: '__dl_', enablePerformanceTracking: true, enableFingerprinting: true, maxRetries: 5, retryDelay: 1000, maxOfflineQueueSize: 100, trackSPA: true, trackPageViews: true, fallbackEndpoints: [], plugins: [] }, config);
         // platform:'shopify' implies cart-attribute sync: stamp visitor_id + Meta
@@ -3606,6 +3663,7 @@ class Datalyr {
                 return this.initializationPromise;
             }
             this.initializationPromise = (() => __awaiter(this, void 0, void 0, function* () {
+                var _a;
                 try {
                     // SEC-03 Fix: Initialize encryption for PII data
                     const deviceId = this.identity.getAnonymousId();
@@ -3640,6 +3698,26 @@ class Datalyr {
                         yield this.container.init().catch(error => {
                             this.log('Container initialization failed:', error);
                         });
+                        // Checkout Champ thank-you/upsell page: co-fire the browser Meta Pixel
+                        // Purchase with the SAME deterministic event_id the CC webhook stamps
+                        // server-side, so Meta dedupes the browser event against the server-side
+                        // CAPI event (dedup = event_name + event_id). Pixel-only — the CC Export
+                        // Profile webhook owns the server event + CAPI postback. No-op anywhere
+                        // except a post-purchase page (keyed on CC's sessionStorage orderData).
+                        // Must run AFTER container.init() so fbq is loaded + init'd.
+                        if (this.config.platform === 'checkoutchamp') {
+                            this.fireCheckoutChampPurchasePixel();
+                        }
+                    }
+                    // Fold the remote /container-scripts config UNDER explicit init()
+                    // overrides (precedence: defaults <- remote <- explicit). No-op if the
+                    // container is disabled or the worker didn't send `config`. This is what
+                    // makes the dashboard toggles take effect with no snippet edits.
+                    applyRemoteConfig(this.config, (_a = this.container) === null || _a === void 0 ? void 0 : _a.getRemoteConfig(), this.explicitConfigKeys);
+                    // Privacy-strict turns auto-identify (email capture) OFF regardless of
+                    // the dashboard/remote value — privacy wins over the bridge.
+                    if (this.config.privacyMode === 'strict') {
+                        this.config.autoIdentify = false;
                     }
                     // autoIdentify default for the CC bridge:
                     // - platform === 'checkoutchamp' (CC funnel pages) OR
@@ -3651,8 +3729,10 @@ class Datalyr {
                     if (ccBridgeActive && this.config.autoIdentify === undefined) {
                         this.config.autoIdentify = true;
                     }
-                    // Initialize auto-identify if explicitly enabled (opt-in)
-                    if (this.config.autoIdentify === true) {
+                    // Initialize auto-identify when enabled (explicit or remote) AND
+                    // tracking is allowed. The shouldTrack() gate keeps capture from even
+                    // setting up its form/API interceptors for opted-out / DNT / GPC users.
+                    if (this.config.autoIdentify === true && this.shouldTrack()) {
                         this.autoIdentify = new AutoIdentifyManager({
                             enabled: true,
                             captureFromForms: this.config.autoIdentifyForms,
@@ -3678,7 +3758,7 @@ class Datalyr {
                     // Lets server-side order webhooks recover the browser visitor + Meta click
                     // signals (the postback webhook reads these as note_attributes). Inert unless
                     // enabled; best-effort and never blocks init.
-                    if (this.config.shopifyCartAttributes === true) {
+                    if (this.config.shopifyCartAttributes === true && this.shouldTrack()) {
                         this.syncShopifyCartAttributes().catch((error) => {
                             this.log('Shopify cart attribute sync failed:', error);
                         });
@@ -4275,6 +4355,93 @@ class Datalyr {
             this.log("restoreFromURL failed:", error);
         }
     }
+    /**
+     * Checkout Champ Meta Pixel ⇄ CAPI deduplication.
+     *
+     * On a CC thank-you / upsell page, fire the BROWSER Meta Pixel Purchase with the
+     * exact same event_id the CC webhook stamps server-side, so Meta collapses the
+     * browser Pixel event and the server-side CAPI event into one (dedup key =
+     * event_name + event_id). This gives the EMQ lift of a matched browser+server
+     * event without double-counting conversions in Ads Manager.
+     *
+     * PIXEL-ONLY by design. We do NOT enqueue a server event here: the CC Export
+     * Profile webhook (webhooks/platforms/checkoutchamp.js) already ingests the
+     * purchase and fires CAPI. Calling track() here would create a second server
+     * event (source='web') AND double-fire CAPI — defeating the whole point.
+     *
+     * The event_id MUST stay byte-identical to the server formula:
+     *   webhooks/platforms/checkoutchamp.js:250
+     *     generateEventId('checkoutchamp', `${event_type}_${order_id}`)
+     *   webhooks/core/ingest.js:122  →  `${platform}_${webhookEventId}`
+     *   ⇒ `checkoutchamp_purchase_<order_id>`
+     * where <order_id> is the value CC posts to the webhook via its [orderId] macro.
+     * We read the browser-side counterpart from CC's own client-side order object:
+     *   JSON.parse(sessionStorage.getItem('orderData')).orderId
+     * (CC docs: referenced in custom scripts as `orderDataTmp.orderId`).
+     *
+     * ASSUMPTION TO VERIFY ON A REAL CC TEST ORDER: that sessionStorage
+     * orderData.orderId === the [orderId] CC sends to the postback. If a merchant's
+     * CC plan exposes a different id client-side, the two event_ids won't match and
+     * Meta will show duplicates — caught by the test order in the setup checklist.
+     *
+     * v1 scope: the primary order only. Per-upsell Pixel dedup (each upsell is its
+     * own order_id + parent_order_id server-side) needs the upsell sessionStorage
+     * shape confirmed on a live funnel first — tracked as a follow-up.
+     */
+    fireCheckoutChampPurchasePixel() {
+        var _a;
+        if (typeof window === "undefined")
+            return;
+        try {
+            // Needs the container (where the Meta Pixel lives). trackToPixels itself
+            // no-ops unless a Meta pixel is enabled + fbq is present, so an
+            // unconfigured workspace silently does nothing.
+            if (!this.container)
+                return;
+            const raw = (_a = window.sessionStorage) === null || _a === void 0 ? void 0 : _a.getItem("orderData");
+            if (!raw)
+                return; // not a post-purchase page — nothing to dedupe
+            const order = JSON.parse(raw) || {};
+            const orderId = order.orderId;
+            if (!orderId)
+                return;
+            // orderData persists across upsell page loads — fire the primary Purchase
+            // Pixel once per order. (Meta also dedupes by event_id over 48h, so this is
+            // belt-and-suspenders against a per-page re-fire.)
+            const guardKey = `__dl_cc_purchase_${orderId}`;
+            if (window.sessionStorage.getItem(guardKey))
+                return;
+            window.sessionStorage.setItem(guardKey, "1");
+            // KEEP IN SYNC with the server formula above.
+            const eventId = `checkoutchamp_purchase_${orderId}`;
+            // value/currency are for EMQ quality only — Meta dedup is event_id+name, so
+            // a mismatch here never breaks dedup. Best-effort parse of CC's fields.
+            const value = Number(order.totalAmount);
+            const properties = {
+                order_id: String(orderId),
+                content_type: "product",
+            };
+            if (Number.isFinite(value))
+                properties.value = value;
+            const currency = order.currencyCode || order.currency;
+            if (currency)
+                properties.currency = String(currency);
+            if (order.productId)
+                properties.content_ids = [String(order.productId)];
+            // Pixel-only co-fire. 'purchase' maps to Meta 'Purchase' in trackToPixels,
+            // matching the server-side rule's platform_event_name.
+            this.container.trackToPixels("purchase", properties, eventId);
+            this.log("Checkout Champ Purchase Pixel co-fired (CAPI dedup):", {
+                eventId,
+                value: properties.value,
+                currency: properties.currency,
+            });
+        }
+        catch (error) {
+            // Never let dedup co-fire break the page or init.
+            this.log("fireCheckoutChampPurchasePixel failed:", error);
+        }
+    }
     /**
      * Storefront → Checkout Champ link stamping. Finds every `<a href>` whose host
      * matches the configured CC domain list and appends `?_dl_vid=…&_dl_fbc=…&
@@ -4459,7 +4626,7 @@ class Datalyr {
             resolution_method: 'browser_sdk',
             resolution_confidence: 1.0,
             // SDK metadata (keep in sync with package.json version)
-            sdk_version: '1.6.4',
+            sdk_version: '1.6.5',
             sdk_name: 'datalyr-web-sdk'
         };
         return payload;