@datalyr/web 1.6.5 → 1.7.0

package/dist/datalyr.js

@@ -1,5 +1,5 @@
 /**
- * @datalyr/web v1.6.5
+ * @datalyr/web v1.7.0
  * Datalyr Web SDK - Modern attribution tracking for web applications
  * (c) 2026 Datalyr Inc.
  * Released under the MIT License
@@ -2403,9 +2403,10 @@ var Datalyr = (function (exports) {
                         throw new Error(`Failed to fetch container scripts: ${response.status}`);
                     }
                     const data = yield response.json();
-                    // Store scripts and pixels
+                    // Store scripts, pixels, and the SDK runtime config envelope.
                     this.scripts = data.scripts || [];
                     this.pixels = data.pixels || null;
+                    this.remoteConfig = (data.config && typeof data.config === 'object') ? data.config : undefined;
                     // Initialize pixels if configured. Awaited so advanced-matching hashes
                     // are resolved before the first dl.track() flushes through trackToPixels
                     // (otherwise fbq('init') would lag fbq('track') in fast-path tracks).
@@ -2435,6 +2436,13 @@ var Datalyr = (function (exports) {
                 }
             });
         }
+        /**
+         * The SDK runtime config delivered by /container-scripts, or undefined if the
+         * response omitted it. The SDK merges this under explicit init() options.
+         */
+        getRemoteConfig() {
+            return this.remoteConfig;
+        }
         /**
          * Load scripts by trigger type
          */
@@ -3092,7 +3100,7 @@ var Datalyr = (function (exports) {
             this.config = {
                 enabled: config.enabled !== false,
                 captureFromForms: config.captureFromForms !== false,
-                captureFromAPI: config.captureFromAPI !== false,
+                captureFromAPI: config.captureFromAPI === true, // default OFF: same-origin response-scan can mis-identify (e.g. admin views)
                 captureFromShopify: config.captureFromShopify !== false,
                 trustedDomains: config.trustedDomains || [],
                 debug: config.debug || false
@@ -3501,12 +3509,57 @@ var Datalyr = (function (exports) {
         }
     }
 
+    /** Keys the remote config is allowed to fill on DatalyrConfig. */
+    const REMOTE_KEYS = [
+        'autoIdentify',
+        'autoIdentifyForms',
+        'autoIdentifyAPI',
+        'autoIdentifyShopify',
+        'shopifyCartAttributes',
+        'checkoutChampDomains',
+        'respectGlobalPrivacyControl',
+        'respectDoNotTrack',
+        'privacyMode',
+    ];
+    /**
+     * Fold `remote` into `config` IN PLACE. Precedence per key:
+     *   explicit init() value  >  remote (dashboard)  >  built-in default
+     *
+     * `explicitKeys` = the keys the CALLER passed to init() (before built-in
+     * defaults were merged in). For any remote key NOT in that set, remote
+     * OVERRIDES the built-in default. This is essential because some keys
+     * (respectDoNotTrack, respectGlobalPrivacyControl, privacyMode) get a built-in
+     * default at init() and are therefore never `undefined` — a naive
+     * "fill-if-undefined" would silently ignore the dashboard for them.
+     *
+     * No-op when there's no remote config (older worker / container disabled /
+     * failed fetch) — built-in defaults then stand.
+     */
+    function applyRemoteConfig(config, remote, explicitKeys) {
+        if (!remote)
+            return;
+        const target = config;
+        for (const key of REMOTE_KEYS) {
+            const remoteVal = remote[key];
+            if (remoteVal === undefined || remoteVal === null)
+                continue;
+            // Explicit init() always wins; otherwise remote overrides the built-in default.
+            if (explicitKeys === null || explicitKeys === void 0 ? void 0 : explicitKeys.has(key))
+                continue;
+            target[key] = remoteVal;
+        }
+    }
+
     /**
      * Datalyr Web SDK
      * Modern attribution tracking for web applications
      */
     class Datalyr {
         constructor() {
+            // Keys the caller passed to init() (before built-in defaults were merged).
+            // Lets the remote-config merge override built-in defaults while always
+            // deferring to an explicit init() value. See applyRemoteConfig.
+            this.explicitConfigKeys = new Set();
             this.superProperties = {};
             this.userProperties = {};
             this.optedOut = false;
@@ -3529,6 +3582,10 @@ var Datalyr = (function (exports) {
             if (!config.workspaceId) {
                 throw new Error('[Datalyr] workspaceId is required');
             }
+            // Snapshot the keys the caller explicitly set, BEFORE built-in defaults are
+            // merged in — so the remote-config merge can override built-in defaults
+            // while still deferring to anything the caller passed explicitly.
+            this.explicitConfigKeys = new Set(Object.keys(config));
             // Set default config values
             this.config = Object.assign({ endpoint: 'https://ingest.datalyr.com', debug: false, batchSize: 10, flushInterval: 5000, flushAt: 10, criticalEvents: undefined, highPriorityEvents: undefined, sessionTimeout: 60 * 60 * 1000, trackSessions: true, attributionWindow: 90 * 24 * 60 * 60 * 1000, trackedParams: [], respectDoNotTrack: false, respectGlobalPrivacyControl: true, privacyMode: 'standard', cookieDomain: 'auto', cookieExpires: 365, secureCookie: 'auto', sameSite: 'Lax', cookiePrefix: '__dl_', enablePerformanceTracking: true, enableFingerprinting: true, maxRetries: 5, retryDelay: 1000, maxOfflineQueueSize: 100, trackSPA: true, trackPageViews: true, fallbackEndpoints: [], plugins: [] }, config);
             // platform:'shopify' implies cart-attribute sync: stamp visitor_id + Meta
@@ -3605,6 +3662,7 @@ var Datalyr = (function (exports) {
                     return this.initializationPromise;
                 }
                 this.initializationPromise = (() => __awaiter(this, void 0, void 0, function* () {
+                    var _a;
                     try {
                         // SEC-03 Fix: Initialize encryption for PII data
                         const deviceId = this.identity.getAnonymousId();
@@ -3650,6 +3708,16 @@ var Datalyr = (function (exports) {
                                 this.fireCheckoutChampPurchasePixel();
                             }
                         }
+                        // Fold the remote /container-scripts config UNDER explicit init()
+                        // overrides (precedence: defaults <- remote <- explicit). No-op if the
+                        // container is disabled or the worker didn't send `config`. This is what
+                        // makes the dashboard toggles take effect with no snippet edits.
+                        applyRemoteConfig(this.config, (_a = this.container) === null || _a === void 0 ? void 0 : _a.getRemoteConfig(), this.explicitConfigKeys);
+                        // Privacy-strict turns auto-identify (email capture) OFF regardless of
+                        // the dashboard/remote value — privacy wins over the bridge.
+                        if (this.config.privacyMode === 'strict') {
+                            this.config.autoIdentify = false;
+                        }
                         // autoIdentify default for the CC bridge:
                         // - platform === 'checkoutchamp' (CC funnel pages) OR
                         // - checkoutChampDomains set (Shopify storefronts feeding a CC funnel)
@@ -3660,8 +3728,10 @@ var Datalyr = (function (exports) {
                         if (ccBridgeActive && this.config.autoIdentify === undefined) {
                             this.config.autoIdentify = true;
                         }
-                        // Initialize auto-identify if explicitly enabled (opt-in)
-                        if (this.config.autoIdentify === true) {
+                        // Initialize auto-identify when enabled (explicit or remote) AND
+                        // tracking is allowed. The shouldTrack() gate keeps capture from even
+                        // setting up its form/API interceptors for opted-out / DNT / GPC users.
+                        if (this.config.autoIdentify === true && this.shouldTrack()) {
                             this.autoIdentify = new AutoIdentifyManager({
                                 enabled: true,
                                 captureFromForms: this.config.autoIdentifyForms,
@@ -3687,7 +3757,7 @@ var Datalyr = (function (exports) {
                         // Lets server-side order webhooks recover the browser visitor + Meta click
                         // signals (the postback webhook reads these as note_attributes). Inert unless
                         // enabled; best-effort and never blocks init.
-                        if (this.config.shopifyCartAttributes === true) {
+                        if (this.config.shopifyCartAttributes === true && this.shouldTrack()) {
                             this.syncShopifyCartAttributes().catch((error) => {
                                 this.log('Shopify cart attribute sync failed:', error);
                             });