@datalyr/web 1.6.4 → 1.7.0

package/dist/datalyr.js

@@ -1,5 +1,5 @@
 /**
- * @datalyr/web v1.6.4
+ * @datalyr/web v1.7.0
  * Datalyr Web SDK - Modern attribution tracking for web applications
  * (c) 2026 Datalyr Inc.
  * Released under the MIT License
@@ -2403,9 +2403,10 @@ var Datalyr = (function (exports) {
                         throw new Error(`Failed to fetch container scripts: ${response.status}`);
                     }
                     const data = yield response.json();
-                    // Store scripts and pixels
+                    // Store scripts, pixels, and the SDK runtime config envelope.
                     this.scripts = data.scripts || [];
                     this.pixels = data.pixels || null;
+                    this.remoteConfig = (data.config && typeof data.config === 'object') ? data.config : undefined;
                     // Initialize pixels if configured. Awaited so advanced-matching hashes
                     // are resolved before the first dl.track() flushes through trackToPixels
                     // (otherwise fbq('init') would lag fbq('track') in fast-path tracks).
@@ -2435,6 +2436,13 @@ var Datalyr = (function (exports) {
                 }
             });
         }
+        /**
+         * The SDK runtime config delivered by /container-scripts, or undefined if the
+         * response omitted it. The SDK merges this under explicit init() options.
+         */
+        getRemoteConfig() {
+            return this.remoteConfig;
+        }
         /**
          * Load scripts by trigger type
          */
@@ -3092,7 +3100,7 @@ var Datalyr = (function (exports) {
             this.config = {
                 enabled: config.enabled !== false,
                 captureFromForms: config.captureFromForms !== false,
-                captureFromAPI: config.captureFromAPI !== false,
+                captureFromAPI: config.captureFromAPI === true, // default OFF: same-origin response-scan can mis-identify (e.g. admin views)
                 captureFromShopify: config.captureFromShopify !== false,
                 trustedDomains: config.trustedDomains || [],
                 debug: config.debug || false
@@ -3501,12 +3509,57 @@ var Datalyr = (function (exports) {
         }
     }
 
+    /** Keys the remote config is allowed to fill on DatalyrConfig. */
+    const REMOTE_KEYS = [
+        'autoIdentify',
+        'autoIdentifyForms',
+        'autoIdentifyAPI',
+        'autoIdentifyShopify',
+        'shopifyCartAttributes',
+        'checkoutChampDomains',
+        'respectGlobalPrivacyControl',
+        'respectDoNotTrack',
+        'privacyMode',
+    ];
+    /**
+     * Fold `remote` into `config` IN PLACE. Precedence per key:
+     *   explicit init() value  >  remote (dashboard)  >  built-in default
+     *
+     * `explicitKeys` = the keys the CALLER passed to init() (before built-in
+     * defaults were merged in). For any remote key NOT in that set, remote
+     * OVERRIDES the built-in default. This is essential because some keys
+     * (respectDoNotTrack, respectGlobalPrivacyControl, privacyMode) get a built-in
+     * default at init() and are therefore never `undefined` — a naive
+     * "fill-if-undefined" would silently ignore the dashboard for them.
+     *
+     * No-op when there's no remote config (older worker / container disabled /
+     * failed fetch) — built-in defaults then stand.
+     */
+    function applyRemoteConfig(config, remote, explicitKeys) {
+        if (!remote)
+            return;
+        const target = config;
+        for (const key of REMOTE_KEYS) {
+            const remoteVal = remote[key];
+            if (remoteVal === undefined || remoteVal === null)
+                continue;
+            // Explicit init() always wins; otherwise remote overrides the built-in default.
+            if (explicitKeys === null || explicitKeys === void 0 ? void 0 : explicitKeys.has(key))
+                continue;
+            target[key] = remoteVal;
+        }
+    }
+
     /**
      * Datalyr Web SDK
      * Modern attribution tracking for web applications
      */
     class Datalyr {
         constructor() {
+            // Keys the caller passed to init() (before built-in defaults were merged).
+            // Lets the remote-config merge override built-in defaults while always
+            // deferring to an explicit init() value. See applyRemoteConfig.
+            this.explicitConfigKeys = new Set();
             this.superProperties = {};
             this.userProperties = {};
             this.optedOut = false;
@@ -3529,6 +3582,10 @@ var Datalyr = (function (exports) {
             if (!config.workspaceId) {
                 throw new Error('[Datalyr] workspaceId is required');
             }
+            // Snapshot the keys the caller explicitly set, BEFORE built-in defaults are
+            // merged in — so the remote-config merge can override built-in defaults
+            // while still deferring to anything the caller passed explicitly.
+            this.explicitConfigKeys = new Set(Object.keys(config));
             // Set default config values
             this.config = Object.assign({ endpoint: 'https://ingest.datalyr.com', debug: false, batchSize: 10, flushInterval: 5000, flushAt: 10, criticalEvents: undefined, highPriorityEvents: undefined, sessionTimeout: 60 * 60 * 1000, trackSessions: true, attributionWindow: 90 * 24 * 60 * 60 * 1000, trackedParams: [], respectDoNotTrack: false, respectGlobalPrivacyControl: true, privacyMode: 'standard', cookieDomain: 'auto', cookieExpires: 365, secureCookie: 'auto', sameSite: 'Lax', cookiePrefix: '__dl_', enablePerformanceTracking: true, enableFingerprinting: true, maxRetries: 5, retryDelay: 1000, maxOfflineQueueSize: 100, trackSPA: true, trackPageViews: true, fallbackEndpoints: [], plugins: [] }, config);
             // platform:'shopify' implies cart-attribute sync: stamp visitor_id + Meta
@@ -3605,6 +3662,7 @@ var Datalyr = (function (exports) {
                     return this.initializationPromise;
                 }
                 this.initializationPromise = (() => __awaiter(this, void 0, void 0, function* () {
+                    var _a;
                     try {
                         // SEC-03 Fix: Initialize encryption for PII data
                         const deviceId = this.identity.getAnonymousId();
@@ -3639,6 +3697,26 @@ var Datalyr = (function (exports) {
                             yield this.container.init().catch(error => {
                                 this.log('Container initialization failed:', error);
                             });
+                            // Checkout Champ thank-you/upsell page: co-fire the browser Meta Pixel
+                            // Purchase with the SAME deterministic event_id the CC webhook stamps
+                            // server-side, so Meta dedupes the browser event against the server-side
+                            // CAPI event (dedup = event_name + event_id). Pixel-only — the CC Export
+                            // Profile webhook owns the server event + CAPI postback. No-op anywhere
+                            // except a post-purchase page (keyed on CC's sessionStorage orderData).
+                            // Must run AFTER container.init() so fbq is loaded + init'd.
+                            if (this.config.platform === 'checkoutchamp') {
+                                this.fireCheckoutChampPurchasePixel();
+                            }
+                        }
+                        // Fold the remote /container-scripts config UNDER explicit init()
+                        // overrides (precedence: defaults <- remote <- explicit). No-op if the
+                        // container is disabled or the worker didn't send `config`. This is what
+                        // makes the dashboard toggles take effect with no snippet edits.
+                        applyRemoteConfig(this.config, (_a = this.container) === null || _a === void 0 ? void 0 : _a.getRemoteConfig(), this.explicitConfigKeys);
+                        // Privacy-strict turns auto-identify (email capture) OFF regardless of
+                        // the dashboard/remote value — privacy wins over the bridge.
+                        if (this.config.privacyMode === 'strict') {
+                            this.config.autoIdentify = false;
                         }
                         // autoIdentify default for the CC bridge:
                         // - platform === 'checkoutchamp' (CC funnel pages) OR
@@ -3650,8 +3728,10 @@ var Datalyr = (function (exports) {
                         if (ccBridgeActive && this.config.autoIdentify === undefined) {
                             this.config.autoIdentify = true;
                         }
-                        // Initialize auto-identify if explicitly enabled (opt-in)
-                        if (this.config.autoIdentify === true) {
+                        // Initialize auto-identify when enabled (explicit or remote) AND
+                        // tracking is allowed. The shouldTrack() gate keeps capture from even
+                        // setting up its form/API interceptors for opted-out / DNT / GPC users.
+                        if (this.config.autoIdentify === true && this.shouldTrack()) {
                             this.autoIdentify = new AutoIdentifyManager({
                                 enabled: true,
                                 captureFromForms: this.config.autoIdentifyForms,
@@ -3677,7 +3757,7 @@ var Datalyr = (function (exports) {
                         // Lets server-side order webhooks recover the browser visitor + Meta click
                         // signals (the postback webhook reads these as note_attributes). Inert unless
                         // enabled; best-effort and never blocks init.
-                        if (this.config.shopifyCartAttributes === true) {
+                        if (this.config.shopifyCartAttributes === true && this.shouldTrack()) {
                             this.syncShopifyCartAttributes().catch((error) => {
                                 this.log('Shopify cart attribute sync failed:', error);
                             });
@@ -4274,6 +4354,93 @@ var Datalyr = (function (exports) {
                 this.log("restoreFromURL failed:", error);
             }
         }
+        /**
+         * Checkout Champ Meta Pixel ⇄ CAPI deduplication.
+         *
+         * On a CC thank-you / upsell page, fire the BROWSER Meta Pixel Purchase with the
+         * exact same event_id the CC webhook stamps server-side, so Meta collapses the
+         * browser Pixel event and the server-side CAPI event into one (dedup key =
+         * event_name + event_id). This gives the EMQ lift of a matched browser+server
+         * event without double-counting conversions in Ads Manager.
+         *
+         * PIXEL-ONLY by design. We do NOT enqueue a server event here: the CC Export
+         * Profile webhook (webhooks/platforms/checkoutchamp.js) already ingests the
+         * purchase and fires CAPI. Calling track() here would create a second server
+         * event (source='web') AND double-fire CAPI — defeating the whole point.
+         *
+         * The event_id MUST stay byte-identical to the server formula:
+         *   webhooks/platforms/checkoutchamp.js:250
+         *     generateEventId('checkoutchamp', `${event_type}_${order_id}`)
+         *   webhooks/core/ingest.js:122  →  `${platform}_${webhookEventId}`
+         *   ⇒ `checkoutchamp_purchase_<order_id>`
+         * where <order_id> is the value CC posts to the webhook via its [orderId] macro.
+         * We read the browser-side counterpart from CC's own client-side order object:
+         *   JSON.parse(sessionStorage.getItem('orderData')).orderId
+         * (CC docs: referenced in custom scripts as `orderDataTmp.orderId`).
+         *
+         * ASSUMPTION TO VERIFY ON A REAL CC TEST ORDER: that sessionStorage
+         * orderData.orderId === the [orderId] CC sends to the postback. If a merchant's
+         * CC plan exposes a different id client-side, the two event_ids won't match and
+         * Meta will show duplicates — caught by the test order in the setup checklist.
+         *
+         * v1 scope: the primary order only. Per-upsell Pixel dedup (each upsell is its
+         * own order_id + parent_order_id server-side) needs the upsell sessionStorage
+         * shape confirmed on a live funnel first — tracked as a follow-up.
+         */
+        fireCheckoutChampPurchasePixel() {
+            var _a;
+            if (typeof window === "undefined")
+                return;
+            try {
+                // Needs the container (where the Meta Pixel lives). trackToPixels itself
+                // no-ops unless a Meta pixel is enabled + fbq is present, so an
+                // unconfigured workspace silently does nothing.
+                if (!this.container)
+                    return;
+                const raw = (_a = window.sessionStorage) === null || _a === void 0 ? void 0 : _a.getItem("orderData");
+                if (!raw)
+                    return; // not a post-purchase page — nothing to dedupe
+                const order = JSON.parse(raw) || {};
+                const orderId = order.orderId;
+                if (!orderId)
+                    return;
+                // orderData persists across upsell page loads — fire the primary Purchase
+                // Pixel once per order. (Meta also dedupes by event_id over 48h, so this is
+                // belt-and-suspenders against a per-page re-fire.)
+                const guardKey = `__dl_cc_purchase_${orderId}`;
+                if (window.sessionStorage.getItem(guardKey))
+                    return;
+                window.sessionStorage.setItem(guardKey, "1");
+                // KEEP IN SYNC with the server formula above.
+                const eventId = `checkoutchamp_purchase_${orderId}`;
+                // value/currency are for EMQ quality only — Meta dedup is event_id+name, so
+                // a mismatch here never breaks dedup. Best-effort parse of CC's fields.
+                const value = Number(order.totalAmount);
+                const properties = {
+                    order_id: String(orderId),
+                    content_type: "product",
+                };
+                if (Number.isFinite(value))
+                    properties.value = value;
+                const currency = order.currencyCode || order.currency;
+                if (currency)
+                    properties.currency = String(currency);
+                if (order.productId)
+                    properties.content_ids = [String(order.productId)];
+                // Pixel-only co-fire. 'purchase' maps to Meta 'Purchase' in trackToPixels,
+                // matching the server-side rule's platform_event_name.
+                this.container.trackToPixels("purchase", properties, eventId);
+                this.log("Checkout Champ Purchase Pixel co-fired (CAPI dedup):", {
+                    eventId,
+                    value: properties.value,
+                    currency: properties.currency,
+                });
+            }
+            catch (error) {
+                // Never let dedup co-fire break the page or init.
+                this.log("fireCheckoutChampPurchasePixel failed:", error);
+            }
+        }
         /**
          * Storefront → Checkout Champ link stamping. Finds every `<a href>` whose host
          * matches the configured CC domain list and appends `?_dl_vid=…&_dl_fbc=…&
@@ -4458,7 +4625,7 @@ var Datalyr = (function (exports) {
                 resolution_method: 'browser_sdk',
                 resolution_confidence: 1.0,
                 // SDK metadata (keep in sync with package.json version)
-                sdk_version: '1.6.4',
+                sdk_version: '1.6.5',
                 sdk_name: 'datalyr-web-sdk'
             };
             return payload;