@datalyr/web 1.7.3 → 1.7.5

package/dist/datalyr.cjs.js

@@ -1,5 +1,5 @@
 /**
- * @datalyr/web v1.7.3
+ * @datalyr/web v1.7.5
  * Datalyr Web SDK - Modern attribution tracking for web applications
  * (c) 2026 Datalyr Inc.
  * Released under the MIT License
@@ -2302,16 +2302,22 @@ class EventQueue {
             // so only request it when the body is safely under the cap; oversized batches go via
             // a normal fetch (no cap) and succeed.
             const useKeepalive = new Blob([body]).size <= 60000;
+            // First-party endpoint (the customer's own tracking host, never *.datalyr.com — set
+            // by the script-origin auto-derive): send the cookie cross-subdomain so the edge can
+            // read/refresh the server-set, ITP-durable visitor_id. Legacy datalyr.com endpoints
+            // stay credential-less — unchanged behavior for every existing install.
+            let firstPartyEndpoint = false;
             try {
-                const response = yield fetch(currentEndpoint, {
-                    method: 'POST',
-                    headers: {
+                firstPartyEndpoint = !/(^|\.)datalyr\.com$/i.test(new URL(currentEndpoint).hostname);
+            }
+            catch (_a) {
+                /* malformed endpoint — leave false */
+            }
+            try {
+                const response = yield fetch(currentEndpoint, Object.assign({ method: 'POST', headers: {
                         'Content-Type': 'application/json',
                         'X-Batch-Size': events.length.toString()
-                    },
-                    body,
-                    keepalive: useKeepalive
-                });
+                    }, body, keepalive: useKeepalive }, (firstPartyEndpoint ? { credentials: 'include' } : {})));
                 if (!response.ok) {
                     // Handle rate limiting
                     if (response.status === 429) {
@@ -4340,7 +4346,7 @@ class Datalyr {
                 return this.initializationPromise;
             }
             this.initializationPromise = (() => __awaiter(this, void 0, void 0, function* () {
-                var _a;
+                var _a, _b;
                 try {
                     // SEC-03: encryption is for PII-AT-REST only — it must NOT gate event delivery,
                     // pageviews, or pixels. On a non-secure context (http://) or an old browser,
@@ -4463,6 +4469,15 @@ class Datalyr {
                         // opted-out / DNT / GPC visitor's id + click-ids aren't stamped on outbound links.
                         this.syncOutboundLinkParams(this.config.checkoutChampDomains);
                     }
+                    // Stripe Payment Link auto-decoration (D1, DEFAULT ON): stamp
+                    // client_reference_id=<visitor_id> (+ prefilled_email when identified) onto
+                    // buy.stripe.com / custom payment-link domain anchors and Stripe embeds, so a
+                    // snippet-only merchant's checkout.session.completed webhooks attribute
+                    // deterministically with zero server work. Gated on shouldTrack() so
+                    // opted-out / DNT / GPC visitors never get an id stamped into outbound links.
+                    if (this.config.stripePaymentLinks !== false && this.shouldTrack()) {
+                        this.syncStripePaymentLinks((_b = this.config.stripeLinkDomains) !== null && _b !== void 0 ? _b : []);
+                    }
                     // Track initial page view if enabled (AFTER encryption ready)
                     if (this.config.trackPageViews) {
                         this.page();
@@ -5383,6 +5398,159 @@ class Datalyr {
         }
         this.log("Checkout Champ outbound-link sync active for:", lowerDomains);
     }
+    /**
+     * Stripe Payment Link auto-decoration (D1). Structurally mirrors
+     * syncOutboundLinkParams: stampAll on init, debounced MutationObserver for
+     * SPA-rendered anchors, capture-phase click re-stamp + queue flush, disposer
+     * wired into destroy()/pagehide.
+     *
+     * Match: exact-host equality against buy.stripe.com + config.stripeLinkDomains
+     * via the URL API — NEVER substring (a[href*=...] would match
+     * evil.com/buy.stripe.com paths) and NEVER checkout.stripe.com (Checkout
+     * Session URLs ignore these params — the session is already created).
+     *
+     * Stamp (URL API preserves existing query + hash):
+     * - client_reference_id=<visitorId> only if the param is absent (merchant-set
+     *   wins) and the id passes the Stripe format guard (Stripe silently DROPS
+     *   invalid values — don't write garbage into merchant links).
+     * - prefilled_email=<email> only if identified email exists, the param is
+     *   absent, locked_prefilled_email is absent, and privacyMode !== 'strict'.
+     * - <stripe-pricing-table>/<stripe-buy-button>: client-reference-id attribute
+     *   if absent.
+     *
+     * The decorated link's checkout.session.completed arrives with
+     * client_reference_id, which stripe-connect.js already reads — zero server
+     * changes. window.open(paymentLink) is not covered (use getVisitorId()
+     * manually); iframe/shadow-DOM links are unreachable from document.
+     */
+    syncStripePaymentLinks(extraDomains) {
+        if (typeof window === "undefined" || typeof document === "undefined")
+            return;
+        const hosts = new Set(["buy.stripe.com"]);
+        for (const d of extraDomains) {
+            const h = String(d).trim().toLowerCase();
+            if (h)
+                hosts.add(h);
+        }
+        const matchesPaymentLinkHost = (href) => {
+            try {
+                const host = new URL(href, window.location.href).hostname.toLowerCase();
+                return hosts.has(host); // exact-host equality only
+            }
+            catch (_a) {
+                return false;
+            }
+        };
+        // Stripe accepts alphanumeric + `-` + `_`, max 200 chars, and silently drops
+        // invalid values. Legacy/foreign persisted cookie ids are unconstrained —
+        // skip silently rather than stamp a value Stripe would discard.
+        const CLIENT_REFERENCE_ID_RE = /^[A-Za-z0-9_-]{1,200}$/;
+        const getClientReferenceId = () => {
+            const vid = this.identity.getAnonymousId();
+            return vid && CLIENT_REFERENCE_ID_RE.test(vid) ? vid : null;
+        };
+        const getPrefilledEmail = () => {
+            var _a;
+            if (this.config.privacyMode === "strict")
+                return null;
+            const email = (_a = this.userProperties) === null || _a === void 0 ? void 0 : _a.email;
+            return typeof email === "string" && email ? email : null;
+        };
+        const stampLink = (anchor) => {
+            if (!anchor.href || !matchesPaymentLinkHost(anchor.href))
+                return;
+            try {
+                const u = new URL(anchor.href, window.location.href);
+                let mutated = false;
+                const vid = getClientReferenceId();
+                if (vid && !u.searchParams.get("client_reference_id")) {
+                    u.searchParams.set("client_reference_id", vid);
+                    mutated = true;
+                }
+                const email = getPrefilledEmail();
+                if (email &&
+                    !u.searchParams.get("prefilled_email") &&
+                    !u.searchParams.get("locked_prefilled_email")) {
+                    // URL API percent-encodes automatically.
+                    u.searchParams.set("prefilled_email", email);
+                    mutated = true;
+                }
+                if (mutated)
+                    anchor.href = u.toString();
+            }
+            catch (_a) {
+                // Ignore malformed URLs — don't break the page.
+            }
+        };
+        const stampEmbeds = () => {
+            const vid = getClientReferenceId();
+            if (!vid)
+                return;
+            document.querySelectorAll("stripe-pricing-table, stripe-buy-button").forEach((el) => {
+                if (!el.getAttribute("client-reference-id")) {
+                    el.setAttribute("client-reference-id", vid);
+                }
+            });
+        };
+        const stampAll = () => {
+            document.querySelectorAll("a[href]").forEach((el) => stampLink(el));
+            stampEmbeds();
+        };
+        const onClick = (e) => {
+            var _a, _b;
+            const target = (_a = e.target) === null || _a === void 0 ? void 0 : _a.closest("a[href]");
+            if (!target)
+                return;
+            const anchor = target;
+            if (!matchesPaymentLinkHost(anchor.href))
+                return;
+            stampLink(anchor); // re-stamp in case identify() happened since DOMReady
+            try {
+                (_b = this.queue) === null || _b === void 0 ? void 0 : _b.flush();
+            }
+            catch (_c) {
+                // Best-effort — never block navigation.
+            }
+        };
+        stampAll();
+        document.addEventListener("click", onClick, true);
+        try {
+            // Debounce re-stamping (same rationale as the CC sync): a busy SPA can fire
+            // thousands of mutations per second; 150ms is small enough to catch links
+            // before the user can click them, large enough to coalesce bursts. The
+            // click-time re-stamp is the final safety net — no pushState hook needed.
+            let restampTimer = null;
+            const scheduleRestamp = () => {
+                if (restampTimer != null)
+                    return;
+                restampTimer = setTimeout(() => {
+                    restampTimer = null;
+                    stampAll();
+                }, 150);
+            };
+            const observer = new MutationObserver(scheduleRestamp);
+            observer.observe(document.documentElement, { childList: true, subtree: true });
+            // Observer + click listener live for the session; pagehide cleans up on
+            // full-page unload, and destroy() tears them down early via this disposer
+            // (otherwise destroy()+re-init() leaks the observer + capturing listener).
+            this.stripeLinksDisposer = () => {
+                try {
+                    observer.disconnect();
+                }
+                catch ( /* idempotent */_a) { /* idempotent */ }
+                if (restampTimer != null) {
+                    clearTimeout(restampTimer);
+                    restampTimer = null;
+                }
+                document.removeEventListener("click", onClick, true);
+            };
+            window.addEventListener("pagehide", () => { var _a; return (_a = this.stripeLinksDisposer) === null || _a === void 0 ? void 0 : _a.call(this); }, { once: true });
+        }
+        catch (error) {
+            this.log("MutationObserver setup failed (Stripe Payment Link sync):", error);
+        }
+        this.log("Stripe Payment Link auto-decoration active for:", Array.from(hosts));
+    }
     /**
      * Create event payload
      */
@@ -5465,7 +5633,7 @@ class Datalyr {
             // SDK metadata. MUST stay in sync with package.json "version" — the build guard
             // (scripts/check-bundle.js, run by build:check) fails the build if the bundle's
             // sdk_version doesn't match package.json. (FSR-103)
-            sdk_version: '1.7.3',
+            sdk_version: '1.7.4',
             sdk_name: 'datalyr-web-sdk'
         };
         return payload;
@@ -5686,6 +5854,10 @@ class Datalyr {
             this.outboundDisposer();
             this.outboundDisposer = undefined;
         }
+        if (this.stripeLinksDisposer) {
+            this.stripeLinksDisposer();
+            this.stripeLinksDisposer = undefined;
+        }
         // Clean up queue
         if (this.queue) {
             this.queue.destroy();