@datalyr/web 1.6.5 → 1.7.0

package/dist/datalyr.esm.js

@@ -1,5 +1,5 @@
 /**
- * @datalyr/web v1.6.5
+ * @datalyr/web v1.7.0
  * Datalyr Web SDK - Modern attribution tracking for web applications
  * (c) 2026 Datalyr Inc.
  * Released under the MIT License
@@ -2400,9 +2400,10 @@ class ContainerManager {
                     throw new Error(`Failed to fetch container scripts: ${response.status}`);
                 }
                 const data = yield response.json();
-                // Store scripts and pixels
+                // Store scripts, pixels, and the SDK runtime config envelope.
                 this.scripts = data.scripts || [];
                 this.pixels = data.pixels || null;
+                this.remoteConfig = (data.config && typeof data.config === 'object') ? data.config : undefined;
                 // Initialize pixels if configured. Awaited so advanced-matching hashes
                 // are resolved before the first dl.track() flushes through trackToPixels
                 // (otherwise fbq('init') would lag fbq('track') in fast-path tracks).
@@ -2432,6 +2433,13 @@ class ContainerManager {
             }
         });
     }
+    /**
+     * The SDK runtime config delivered by /container-scripts, or undefined if the
+     * response omitted it. The SDK merges this under explicit init() options.
+     */
+    getRemoteConfig() {
+        return this.remoteConfig;
+    }
     /**
      * Load scripts by trigger type
      */
@@ -3089,7 +3097,7 @@ class AutoIdentifyManager {
         this.config = {
             enabled: config.enabled !== false,
             captureFromForms: config.captureFromForms !== false,
-            captureFromAPI: config.captureFromAPI !== false,
+            captureFromAPI: config.captureFromAPI === true, // default OFF: same-origin response-scan can mis-identify (e.g. admin views)
             captureFromShopify: config.captureFromShopify !== false,
             trustedDomains: config.trustedDomains || [],
             debug: config.debug || false
@@ -3498,12 +3506,57 @@ class AutoIdentifyManager {
     }
 }
 
+/** Keys the remote config is allowed to fill on DatalyrConfig. */
+const REMOTE_KEYS = [
+    'autoIdentify',
+    'autoIdentifyForms',
+    'autoIdentifyAPI',
+    'autoIdentifyShopify',
+    'shopifyCartAttributes',
+    'checkoutChampDomains',
+    'respectGlobalPrivacyControl',
+    'respectDoNotTrack',
+    'privacyMode',
+];
+/**
+ * Fold `remote` into `config` IN PLACE. Precedence per key:
+ *   explicit init() value  >  remote (dashboard)  >  built-in default
+ *
+ * `explicitKeys` = the keys the CALLER passed to init() (before built-in
+ * defaults were merged in). For any remote key NOT in that set, remote
+ * OVERRIDES the built-in default. This is essential because some keys
+ * (respectDoNotTrack, respectGlobalPrivacyControl, privacyMode) get a built-in
+ * default at init() and are therefore never `undefined` — a naive
+ * "fill-if-undefined" would silently ignore the dashboard for them.
+ *
+ * No-op when there's no remote config (older worker / container disabled /
+ * failed fetch) — built-in defaults then stand.
+ */
+function applyRemoteConfig(config, remote, explicitKeys) {
+    if (!remote)
+        return;
+    const target = config;
+    for (const key of REMOTE_KEYS) {
+        const remoteVal = remote[key];
+        if (remoteVal === undefined || remoteVal === null)
+            continue;
+        // Explicit init() always wins; otherwise remote overrides the built-in default.
+        if (explicitKeys === null || explicitKeys === void 0 ? void 0 : explicitKeys.has(key))
+            continue;
+        target[key] = remoteVal;
+    }
+}
+
 /**
  * Datalyr Web SDK
  * Modern attribution tracking for web applications
  */
 class Datalyr {
     constructor() {
+        // Keys the caller passed to init() (before built-in defaults were merged).
+        // Lets the remote-config merge override built-in defaults while always
+        // deferring to an explicit init() value. See applyRemoteConfig.
+        this.explicitConfigKeys = new Set();
         this.superProperties = {};
         this.userProperties = {};
         this.optedOut = false;
@@ -3526,6 +3579,10 @@ class Datalyr {
         if (!config.workspaceId) {
             throw new Error('[Datalyr] workspaceId is required');
         }
+        // Snapshot the keys the caller explicitly set, BEFORE built-in defaults are
+        // merged in — so the remote-config merge can override built-in defaults
+        // while still deferring to anything the caller passed explicitly.
+        this.explicitConfigKeys = new Set(Object.keys(config));
         // Set default config values
         this.config = Object.assign({ endpoint: 'https://ingest.datalyr.com', debug: false, batchSize: 10, flushInterval: 5000, flushAt: 10, criticalEvents: undefined, highPriorityEvents: undefined, sessionTimeout: 60 * 60 * 1000, trackSessions: true, attributionWindow: 90 * 24 * 60 * 60 * 1000, trackedParams: [], respectDoNotTrack: false, respectGlobalPrivacyControl: true, privacyMode: 'standard', cookieDomain: 'auto', cookieExpires: 365, secureCookie: 'auto', sameSite: 'Lax', cookiePrefix: '__dl_', enablePerformanceTracking: true, enableFingerprinting: true, maxRetries: 5, retryDelay: 1000, maxOfflineQueueSize: 100, trackSPA: true, trackPageViews: true, fallbackEndpoints: [], plugins: [] }, config);
         // platform:'shopify' implies cart-attribute sync: stamp visitor_id + Meta
@@ -3602,6 +3659,7 @@ class Datalyr {
                 return this.initializationPromise;
             }
             this.initializationPromise = (() => __awaiter(this, void 0, void 0, function* () {
+                var _a;
                 try {
                     // SEC-03 Fix: Initialize encryption for PII data
                     const deviceId = this.identity.getAnonymousId();
@@ -3647,6 +3705,16 @@ class Datalyr {
                             this.fireCheckoutChampPurchasePixel();
                         }
                     }
+                    // Fold the remote /container-scripts config UNDER explicit init()
+                    // overrides (precedence: defaults <- remote <- explicit). No-op if the
+                    // container is disabled or the worker didn't send `config`. This is what
+                    // makes the dashboard toggles take effect with no snippet edits.
+                    applyRemoteConfig(this.config, (_a = this.container) === null || _a === void 0 ? void 0 : _a.getRemoteConfig(), this.explicitConfigKeys);
+                    // Privacy-strict turns auto-identify (email capture) OFF regardless of
+                    // the dashboard/remote value — privacy wins over the bridge.
+                    if (this.config.privacyMode === 'strict') {
+                        this.config.autoIdentify = false;
+                    }
                     // autoIdentify default for the CC bridge:
                     // - platform === 'checkoutchamp' (CC funnel pages) OR
                     // - checkoutChampDomains set (Shopify storefronts feeding a CC funnel)
@@ -3657,8 +3725,10 @@ class Datalyr {
                     if (ccBridgeActive && this.config.autoIdentify === undefined) {
                         this.config.autoIdentify = true;
                     }
-                    // Initialize auto-identify if explicitly enabled (opt-in)
-                    if (this.config.autoIdentify === true) {
+                    // Initialize auto-identify when enabled (explicit or remote) AND
+                    // tracking is allowed. The shouldTrack() gate keeps capture from even
+                    // setting up its form/API interceptors for opted-out / DNT / GPC users.
+                    if (this.config.autoIdentify === true && this.shouldTrack()) {
                         this.autoIdentify = new AutoIdentifyManager({
                             enabled: true,
                             captureFromForms: this.config.autoIdentifyForms,
@@ -3684,7 +3754,7 @@ class Datalyr {
                     // Lets server-side order webhooks recover the browser visitor + Meta click
                     // signals (the postback webhook reads these as note_attributes). Inert unless
                     // enabled; best-effort and never blocks init.
-                    if (this.config.shopifyCartAttributes === true) {
+                    if (this.config.shopifyCartAttributes === true && this.shouldTrack()) {
                         this.syncShopifyCartAttributes().catch((error) => {
                             this.log('Shopify cart attribute sync failed:', error);
                         });