@datalyr/web 1.7.3 → 1.7.5

package/dist/datalyr.js

@@ -1,5 +1,5 @@
 /**
- * @datalyr/web v1.7.3
+ * @datalyr/web v1.7.5
  * Datalyr Web SDK - Modern attribution tracking for web applications
  * (c) 2026 Datalyr Inc.
  * Released under the MIT License
@@ -2301,16 +2301,22 @@ var Datalyr = (function (exports) {
                 // so only request it when the body is safely under the cap; oversized batches go via
                 // a normal fetch (no cap) and succeed.
                 const useKeepalive = new Blob([body]).size <= 60000;
+                // First-party endpoint (the customer's own tracking host, never *.datalyr.com — set
+                // by the script-origin auto-derive): send the cookie cross-subdomain so the edge can
+                // read/refresh the server-set, ITP-durable visitor_id. Legacy datalyr.com endpoints
+                // stay credential-less — unchanged behavior for every existing install.
+                let firstPartyEndpoint = false;
                 try {
-                    const response = yield fetch(currentEndpoint, {
-                        method: 'POST',
-                        headers: {
+                    firstPartyEndpoint = !/(^|\.)datalyr\.com$/i.test(new URL(currentEndpoint).hostname);
+                }
+                catch (_a) {
+                    /* malformed endpoint — leave false */
+                }
+                try {
+                    const response = yield fetch(currentEndpoint, Object.assign({ method: 'POST', headers: {
                             'Content-Type': 'application/json',
                             'X-Batch-Size': events.length.toString()
-                        },
-                        body,
-                        keepalive: useKeepalive
-                    });
+                        }, body, keepalive: useKeepalive }, (firstPartyEndpoint ? { credentials: 'include' } : {})));
                     if (!response.ok) {
                         // Handle rate limiting
                         if (response.status === 429) {
@@ -4339,7 +4345,7 @@ var Datalyr = (function (exports) {
                     return this.initializationPromise;
                 }
                 this.initializationPromise = (() => __awaiter(this, void 0, void 0, function* () {
-                    var _a;
+                    var _a, _b;
                     try {
                         // SEC-03: encryption is for PII-AT-REST only — it must NOT gate event delivery,
                         // pageviews, or pixels. On a non-secure context (http://) or an old browser,
@@ -4462,6 +4468,15 @@ var Datalyr = (function (exports) {
                             // opted-out / DNT / GPC visitor's id + click-ids aren't stamped on outbound links.
                             this.syncOutboundLinkParams(this.config.checkoutChampDomains);
                         }
+                        // Stripe Payment Link auto-decoration (D1, DEFAULT ON): stamp
+                        // client_reference_id=<visitor_id> (+ prefilled_email when identified) onto
+                        // buy.stripe.com / custom payment-link domain anchors and Stripe embeds, so a
+                        // snippet-only merchant's checkout.session.completed webhooks attribute
+                        // deterministically with zero server work. Gated on shouldTrack() so
+                        // opted-out / DNT / GPC visitors never get an id stamped into outbound links.
+                        if (this.config.stripePaymentLinks !== false && this.shouldTrack()) {
+                            this.syncStripePaymentLinks((_b = this.config.stripeLinkDomains) !== null && _b !== void 0 ? _b : []);
+                        }
                         // Track initial page view if enabled (AFTER encryption ready)
                         if (this.config.trackPageViews) {
                             this.page();
@@ -5382,6 +5397,159 @@ var Datalyr = (function (exports) {
             }
             this.log("Checkout Champ outbound-link sync active for:", lowerDomains);
         }
+        /**
+         * Stripe Payment Link auto-decoration (D1). Structurally mirrors
+         * syncOutboundLinkParams: stampAll on init, debounced MutationObserver for
+         * SPA-rendered anchors, capture-phase click re-stamp + queue flush, disposer
+         * wired into destroy()/pagehide.
+         *
+         * Match: exact-host equality against buy.stripe.com + config.stripeLinkDomains
+         * via the URL API — NEVER substring (a[href*=...] would match
+         * evil.com/buy.stripe.com paths) and NEVER checkout.stripe.com (Checkout
+         * Session URLs ignore these params — the session is already created).
+         *
+         * Stamp (URL API preserves existing query + hash):
+         * - client_reference_id=<visitorId> only if the param is absent (merchant-set
+         *   wins) and the id passes the Stripe format guard (Stripe silently DROPS
+         *   invalid values — don't write garbage into merchant links).
+         * - prefilled_email=<email> only if identified email exists, the param is
+         *   absent, locked_prefilled_email is absent, and privacyMode !== 'strict'.
+         * - <stripe-pricing-table>/<stripe-buy-button>: client-reference-id attribute
+         *   if absent.
+         *
+         * The decorated link's checkout.session.completed arrives with
+         * client_reference_id, which stripe-connect.js already reads — zero server
+         * changes. window.open(paymentLink) is not covered (use getVisitorId()
+         * manually); iframe/shadow-DOM links are unreachable from document.
+         */
+        syncStripePaymentLinks(extraDomains) {
+            if (typeof window === "undefined" || typeof document === "undefined")
+                return;
+            const hosts = new Set(["buy.stripe.com"]);
+            for (const d of extraDomains) {
+                const h = String(d).trim().toLowerCase();
+                if (h)
+                    hosts.add(h);
+            }
+            const matchesPaymentLinkHost = (href) => {
+                try {
+                    const host = new URL(href, window.location.href).hostname.toLowerCase();
+                    return hosts.has(host); // exact-host equality only
+                }
+                catch (_a) {
+                    return false;
+                }
+            };
+            // Stripe accepts alphanumeric + `-` + `_`, max 200 chars, and silently drops
+            // invalid values. Legacy/foreign persisted cookie ids are unconstrained —
+            // skip silently rather than stamp a value Stripe would discard.
+            const CLIENT_REFERENCE_ID_RE = /^[A-Za-z0-9_-]{1,200}$/;
+            const getClientReferenceId = () => {
+                const vid = this.identity.getAnonymousId();
+                return vid && CLIENT_REFERENCE_ID_RE.test(vid) ? vid : null;
+            };
+            const getPrefilledEmail = () => {
+                var _a;
+                if (this.config.privacyMode === "strict")
+                    return null;
+                const email = (_a = this.userProperties) === null || _a === void 0 ? void 0 : _a.email;
+                return typeof email === "string" && email ? email : null;
+            };
+            const stampLink = (anchor) => {
+                if (!anchor.href || !matchesPaymentLinkHost(anchor.href))
+                    return;
+                try {
+                    const u = new URL(anchor.href, window.location.href);
+                    let mutated = false;
+                    const vid = getClientReferenceId();
+                    if (vid && !u.searchParams.get("client_reference_id")) {
+                        u.searchParams.set("client_reference_id", vid);
+                        mutated = true;
+                    }
+                    const email = getPrefilledEmail();
+                    if (email &&
+                        !u.searchParams.get("prefilled_email") &&
+                        !u.searchParams.get("locked_prefilled_email")) {
+                        // URL API percent-encodes automatically.
+                        u.searchParams.set("prefilled_email", email);
+                        mutated = true;
+                    }
+                    if (mutated)
+                        anchor.href = u.toString();
+                }
+                catch (_a) {
+                    // Ignore malformed URLs — don't break the page.
+                }
+            };
+            const stampEmbeds = () => {
+                const vid = getClientReferenceId();
+                if (!vid)
+                    return;
+                document.querySelectorAll("stripe-pricing-table, stripe-buy-button").forEach((el) => {
+                    if (!el.getAttribute("client-reference-id")) {
+                        el.setAttribute("client-reference-id", vid);
+                    }
+                });
+            };
+            const stampAll = () => {
+                document.querySelectorAll("a[href]").forEach((el) => stampLink(el));
+                stampEmbeds();
+            };
+            const onClick = (e) => {
+                var _a, _b;
+                const target = (_a = e.target) === null || _a === void 0 ? void 0 : _a.closest("a[href]");
+                if (!target)
+                    return;
+                const anchor = target;
+                if (!matchesPaymentLinkHost(anchor.href))
+                    return;
+                stampLink(anchor); // re-stamp in case identify() happened since DOMReady
+                try {
+                    (_b = this.queue) === null || _b === void 0 ? void 0 : _b.flush();
+                }
+                catch (_c) {
+                    // Best-effort — never block navigation.
+                }
+            };
+            stampAll();
+            document.addEventListener("click", onClick, true);
+            try {
+                // Debounce re-stamping (same rationale as the CC sync): a busy SPA can fire
+                // thousands of mutations per second; 150ms is small enough to catch links
+                // before the user can click them, large enough to coalesce bursts. The
+                // click-time re-stamp is the final safety net — no pushState hook needed.
+                let restampTimer = null;
+                const scheduleRestamp = () => {
+                    if (restampTimer != null)
+                        return;
+                    restampTimer = setTimeout(() => {
+                        restampTimer = null;
+                        stampAll();
+                    }, 150);
+                };
+                const observer = new MutationObserver(scheduleRestamp);
+                observer.observe(document.documentElement, { childList: true, subtree: true });
+                // Observer + click listener live for the session; pagehide cleans up on
+                // full-page unload, and destroy() tears them down early via this disposer
+                // (otherwise destroy()+re-init() leaks the observer + capturing listener).
+                this.stripeLinksDisposer = () => {
+                    try {
+                        observer.disconnect();
+                    }
+                    catch ( /* idempotent */_a) { /* idempotent */ }
+                    if (restampTimer != null) {
+                        clearTimeout(restampTimer);
+                        restampTimer = null;
+                    }
+                    document.removeEventListener("click", onClick, true);
+                };
+                window.addEventListener("pagehide", () => { var _a; return (_a = this.stripeLinksDisposer) === null || _a === void 0 ? void 0 : _a.call(this); }, { once: true });
+            }
+            catch (error) {
+                this.log("MutationObserver setup failed (Stripe Payment Link sync):", error);
+            }
+            this.log("Stripe Payment Link auto-decoration active for:", Array.from(hosts));
+        }
         /**
          * Create event payload
          */
@@ -5464,7 +5632,7 @@ var Datalyr = (function (exports) {
                 // SDK metadata. MUST stay in sync with package.json "version" — the build guard
                 // (scripts/check-bundle.js, run by build:check) fails the build if the bundle's
                 // sdk_version doesn't match package.json. (FSR-103)
-                sdk_version: '1.7.3',
+                sdk_version: '1.7.4',
                 sdk_name: 'datalyr-web-sdk'
             };
             return payload;
@@ -5685,6 +5853,10 @@ var Datalyr = (function (exports) {
                 this.outboundDisposer();
                 this.outboundDisposer = undefined;
             }
+            if (this.stripeLinksDisposer) {
+                this.stripeLinksDisposer();
+                this.stripeLinksDisposer = undefined;
+            }
             // Clean up queue
             if (this.queue) {
                 this.queue.destroy();