@datalyr/web 1.6.4 → 1.7.0

package/dist/datalyr.esm.js

@@ -1,5 +1,5 @@
 /**
- * @datalyr/web v1.6.4
+ * @datalyr/web v1.7.0
  * Datalyr Web SDK - Modern attribution tracking for web applications
  * (c) 2026 Datalyr Inc.
  * Released under the MIT License
@@ -2400,9 +2400,10 @@ class ContainerManager {
                     throw new Error(`Failed to fetch container scripts: ${response.status}`);
                 }
                 const data = yield response.json();
-                // Store scripts and pixels
+                // Store scripts, pixels, and the SDK runtime config envelope.
                 this.scripts = data.scripts || [];
                 this.pixels = data.pixels || null;
+                this.remoteConfig = (data.config && typeof data.config === 'object') ? data.config : undefined;
                 // Initialize pixels if configured. Awaited so advanced-matching hashes
                 // are resolved before the first dl.track() flushes through trackToPixels
                 // (otherwise fbq('init') would lag fbq('track') in fast-path tracks).
@@ -2432,6 +2433,13 @@ class ContainerManager {
             }
         });
     }
+    /**
+     * The SDK runtime config delivered by /container-scripts, or undefined if the
+     * response omitted it. The SDK merges this under explicit init() options.
+     */
+    getRemoteConfig() {
+        return this.remoteConfig;
+    }
     /**
      * Load scripts by trigger type
      */
@@ -3089,7 +3097,7 @@ class AutoIdentifyManager {
         this.config = {
             enabled: config.enabled !== false,
             captureFromForms: config.captureFromForms !== false,
-            captureFromAPI: config.captureFromAPI !== false,
+            captureFromAPI: config.captureFromAPI === true, // default OFF: same-origin response-scan can mis-identify (e.g. admin views)
             captureFromShopify: config.captureFromShopify !== false,
             trustedDomains: config.trustedDomains || [],
             debug: config.debug || false
@@ -3498,12 +3506,57 @@ class AutoIdentifyManager {
     }
 }
 
+/** Keys the remote config is allowed to fill on DatalyrConfig. */
+const REMOTE_KEYS = [
+    'autoIdentify',
+    'autoIdentifyForms',
+    'autoIdentifyAPI',
+    'autoIdentifyShopify',
+    'shopifyCartAttributes',
+    'checkoutChampDomains',
+    'respectGlobalPrivacyControl',
+    'respectDoNotTrack',
+    'privacyMode',
+];
+/**
+ * Fold `remote` into `config` IN PLACE. Precedence per key:
+ *   explicit init() value  >  remote (dashboard)  >  built-in default
+ *
+ * `explicitKeys` = the keys the CALLER passed to init() (before built-in
+ * defaults were merged in). For any remote key NOT in that set, remote
+ * OVERRIDES the built-in default. This is essential because some keys
+ * (respectDoNotTrack, respectGlobalPrivacyControl, privacyMode) get a built-in
+ * default at init() and are therefore never `undefined` — a naive
+ * "fill-if-undefined" would silently ignore the dashboard for them.
+ *
+ * No-op when there's no remote config (older worker / container disabled /
+ * failed fetch) — built-in defaults then stand.
+ */
+function applyRemoteConfig(config, remote, explicitKeys) {
+    if (!remote)
+        return;
+    const target = config;
+    for (const key of REMOTE_KEYS) {
+        const remoteVal = remote[key];
+        if (remoteVal === undefined || remoteVal === null)
+            continue;
+        // Explicit init() always wins; otherwise remote overrides the built-in default.
+        if (explicitKeys === null || explicitKeys === void 0 ? void 0 : explicitKeys.has(key))
+            continue;
+        target[key] = remoteVal;
+    }
+}
+
 /**
  * Datalyr Web SDK
  * Modern attribution tracking for web applications
  */
 class Datalyr {
     constructor() {
+        // Keys the caller passed to init() (before built-in defaults were merged).
+        // Lets the remote-config merge override built-in defaults while always
+        // deferring to an explicit init() value. See applyRemoteConfig.
+        this.explicitConfigKeys = new Set();
         this.superProperties = {};
         this.userProperties = {};
         this.optedOut = false;
@@ -3526,6 +3579,10 @@ class Datalyr {
         if (!config.workspaceId) {
             throw new Error('[Datalyr] workspaceId is required');
         }
+        // Snapshot the keys the caller explicitly set, BEFORE built-in defaults are
+        // merged in — so the remote-config merge can override built-in defaults
+        // while still deferring to anything the caller passed explicitly.
+        this.explicitConfigKeys = new Set(Object.keys(config));
         // Set default config values
         this.config = Object.assign({ endpoint: 'https://ingest.datalyr.com', debug: false, batchSize: 10, flushInterval: 5000, flushAt: 10, criticalEvents: undefined, highPriorityEvents: undefined, sessionTimeout: 60 * 60 * 1000, trackSessions: true, attributionWindow: 90 * 24 * 60 * 60 * 1000, trackedParams: [], respectDoNotTrack: false, respectGlobalPrivacyControl: true, privacyMode: 'standard', cookieDomain: 'auto', cookieExpires: 365, secureCookie: 'auto', sameSite: 'Lax', cookiePrefix: '__dl_', enablePerformanceTracking: true, enableFingerprinting: true, maxRetries: 5, retryDelay: 1000, maxOfflineQueueSize: 100, trackSPA: true, trackPageViews: true, fallbackEndpoints: [], plugins: [] }, config);
         // platform:'shopify' implies cart-attribute sync: stamp visitor_id + Meta
@@ -3602,6 +3659,7 @@ class Datalyr {
                 return this.initializationPromise;
             }
             this.initializationPromise = (() => __awaiter(this, void 0, void 0, function* () {
+                var _a;
                 try {
                     // SEC-03 Fix: Initialize encryption for PII data
                     const deviceId = this.identity.getAnonymousId();
@@ -3636,6 +3694,26 @@ class Datalyr {
                         yield this.container.init().catch(error => {
                             this.log('Container initialization failed:', error);
                         });
+                        // Checkout Champ thank-you/upsell page: co-fire the browser Meta Pixel
+                        // Purchase with the SAME deterministic event_id the CC webhook stamps
+                        // server-side, so Meta dedupes the browser event against the server-side
+                        // CAPI event (dedup = event_name + event_id). Pixel-only — the CC Export
+                        // Profile webhook owns the server event + CAPI postback. No-op anywhere
+                        // except a post-purchase page (keyed on CC's sessionStorage orderData).
+                        // Must run AFTER container.init() so fbq is loaded + init'd.
+                        if (this.config.platform === 'checkoutchamp') {
+                            this.fireCheckoutChampPurchasePixel();
+                        }
+                    }
+                    // Fold the remote /container-scripts config UNDER explicit init()
+                    // overrides (precedence: defaults <- remote <- explicit). No-op if the
+                    // container is disabled or the worker didn't send `config`. This is what
+                    // makes the dashboard toggles take effect with no snippet edits.
+                    applyRemoteConfig(this.config, (_a = this.container) === null || _a === void 0 ? void 0 : _a.getRemoteConfig(), this.explicitConfigKeys);
+                    // Privacy-strict turns auto-identify (email capture) OFF regardless of
+                    // the dashboard/remote value — privacy wins over the bridge.
+                    if (this.config.privacyMode === 'strict') {
+                        this.config.autoIdentify = false;
                     }
                     // autoIdentify default for the CC bridge:
                     // - platform === 'checkoutchamp' (CC funnel pages) OR
@@ -3647,8 +3725,10 @@ class Datalyr {
                     if (ccBridgeActive && this.config.autoIdentify === undefined) {
                         this.config.autoIdentify = true;
                     }
-                    // Initialize auto-identify if explicitly enabled (opt-in)
-                    if (this.config.autoIdentify === true) {
+                    // Initialize auto-identify when enabled (explicit or remote) AND
+                    // tracking is allowed. The shouldTrack() gate keeps capture from even
+                    // setting up its form/API interceptors for opted-out / DNT / GPC users.
+                    if (this.config.autoIdentify === true && this.shouldTrack()) {
                         this.autoIdentify = new AutoIdentifyManager({
                             enabled: true,
                             captureFromForms: this.config.autoIdentifyForms,
@@ -3674,7 +3754,7 @@ class Datalyr {
                     // Lets server-side order webhooks recover the browser visitor + Meta click
                     // signals (the postback webhook reads these as note_attributes). Inert unless
                     // enabled; best-effort and never blocks init.
-                    if (this.config.shopifyCartAttributes === true) {
+                    if (this.config.shopifyCartAttributes === true && this.shouldTrack()) {
                         this.syncShopifyCartAttributes().catch((error) => {
                             this.log('Shopify cart attribute sync failed:', error);
                         });
@@ -4271,6 +4351,93 @@ class Datalyr {
             this.log("restoreFromURL failed:", error);
         }
     }
+    /**
+     * Checkout Champ Meta Pixel ⇄ CAPI deduplication.
+     *
+     * On a CC thank-you / upsell page, fire the BROWSER Meta Pixel Purchase with the
+     * exact same event_id the CC webhook stamps server-side, so Meta collapses the
+     * browser Pixel event and the server-side CAPI event into one (dedup key =
+     * event_name + event_id). This gives the EMQ lift of a matched browser+server
+     * event without double-counting conversions in Ads Manager.
+     *
+     * PIXEL-ONLY by design. We do NOT enqueue a server event here: the CC Export
+     * Profile webhook (webhooks/platforms/checkoutchamp.js) already ingests the
+     * purchase and fires CAPI. Calling track() here would create a second server
+     * event (source='web') AND double-fire CAPI — defeating the whole point.
+     *
+     * The event_id MUST stay byte-identical to the server formula:
+     *   webhooks/platforms/checkoutchamp.js:250
+     *     generateEventId('checkoutchamp', `${event_type}_${order_id}`)
+     *   webhooks/core/ingest.js:122  →  `${platform}_${webhookEventId}`
+     *   ⇒ `checkoutchamp_purchase_<order_id>`
+     * where <order_id> is the value CC posts to the webhook via its [orderId] macro.
+     * We read the browser-side counterpart from CC's own client-side order object:
+     *   JSON.parse(sessionStorage.getItem('orderData')).orderId
+     * (CC docs: referenced in custom scripts as `orderDataTmp.orderId`).
+     *
+     * ASSUMPTION TO VERIFY ON A REAL CC TEST ORDER: that sessionStorage
+     * orderData.orderId === the [orderId] CC sends to the postback. If a merchant's
+     * CC plan exposes a different id client-side, the two event_ids won't match and
+     * Meta will show duplicates — caught by the test order in the setup checklist.
+     *
+     * v1 scope: the primary order only. Per-upsell Pixel dedup (each upsell is its
+     * own order_id + parent_order_id server-side) needs the upsell sessionStorage
+     * shape confirmed on a live funnel first — tracked as a follow-up.
+     */
+    fireCheckoutChampPurchasePixel() {
+        var _a;
+        if (typeof window === "undefined")
+            return;
+        try {
+            // Needs the container (where the Meta Pixel lives). trackToPixels itself
+            // no-ops unless a Meta pixel is enabled + fbq is present, so an
+            // unconfigured workspace silently does nothing.
+            if (!this.container)
+                return;
+            const raw = (_a = window.sessionStorage) === null || _a === void 0 ? void 0 : _a.getItem("orderData");
+            if (!raw)
+                return; // not a post-purchase page — nothing to dedupe
+            const order = JSON.parse(raw) || {};
+            const orderId = order.orderId;
+            if (!orderId)
+                return;
+            // orderData persists across upsell page loads — fire the primary Purchase
+            // Pixel once per order. (Meta also dedupes by event_id over 48h, so this is
+            // belt-and-suspenders against a per-page re-fire.)
+            const guardKey = `__dl_cc_purchase_${orderId}`;
+            if (window.sessionStorage.getItem(guardKey))
+                return;
+            window.sessionStorage.setItem(guardKey, "1");
+            // KEEP IN SYNC with the server formula above.
+            const eventId = `checkoutchamp_purchase_${orderId}`;
+            // value/currency are for EMQ quality only — Meta dedup is event_id+name, so
+            // a mismatch here never breaks dedup. Best-effort parse of CC's fields.
+            const value = Number(order.totalAmount);
+            const properties = {
+                order_id: String(orderId),
+                content_type: "product",
+            };
+            if (Number.isFinite(value))
+                properties.value = value;
+            const currency = order.currencyCode || order.currency;
+            if (currency)
+                properties.currency = String(currency);
+            if (order.productId)
+                properties.content_ids = [String(order.productId)];
+            // Pixel-only co-fire. 'purchase' maps to Meta 'Purchase' in trackToPixels,
+            // matching the server-side rule's platform_event_name.
+            this.container.trackToPixels("purchase", properties, eventId);
+            this.log("Checkout Champ Purchase Pixel co-fired (CAPI dedup):", {
+                eventId,
+                value: properties.value,
+                currency: properties.currency,
+            });
+        }
+        catch (error) {
+            // Never let dedup co-fire break the page or init.
+            this.log("fireCheckoutChampPurchasePixel failed:", error);
+        }
+    }
     /**
      * Storefront → Checkout Champ link stamping. Finds every `<a href>` whose host
      * matches the configured CC domain list and appends `?_dl_vid=…&_dl_fbc=…&
@@ -4455,7 +4622,7 @@ class Datalyr {
             resolution_method: 'browser_sdk',
             resolution_confidence: 1.0,
             // SDK metadata (keep in sync with package.json version)
-            sdk_version: '1.6.4',
+            sdk_version: '1.6.5',
             sdk_name: 'datalyr-web-sdk'
         };
         return payload;