@datalyr/web 1.7.4 → 1.7.5

package/dist/datalyr.cjs.js

@@ -1,5 +1,5 @@
 /**
- * @datalyr/web v1.7.4
+ * @datalyr/web v1.7.5
  * Datalyr Web SDK - Modern attribution tracking for web applications
  * (c) 2026 Datalyr Inc.
  * Released under the MIT License
@@ -2302,16 +2302,22 @@ class EventQueue {
             // so only request it when the body is safely under the cap; oversized batches go via
             // a normal fetch (no cap) and succeed.
             const useKeepalive = new Blob([body]).size <= 60000;
+            // First-party endpoint (the customer's own tracking host, never *.datalyr.com — set
+            // by the script-origin auto-derive): send the cookie cross-subdomain so the edge can
+            // read/refresh the server-set, ITP-durable visitor_id. Legacy datalyr.com endpoints
+            // stay credential-less — unchanged behavior for every existing install.
+            let firstPartyEndpoint = false;
             try {
-                const response = yield fetch(currentEndpoint, {
-                    method: 'POST',
-                    headers: {
+                firstPartyEndpoint = !/(^|\.)datalyr\.com$/i.test(new URL(currentEndpoint).hostname);
+            }
+            catch (_a) {
+                /* malformed endpoint — leave false */
+            }
+            try {
+                const response = yield fetch(currentEndpoint, Object.assign({ method: 'POST', headers: {
                         'Content-Type': 'application/json',
                         'X-Batch-Size': events.length.toString()
-                    },
-                    body,
-                    keepalive: useKeepalive
-                });
+                    }, body, keepalive: useKeepalive }, (firstPartyEndpoint ? { credentials: 'include' } : {})));
                 if (!response.ok) {
                     // Handle rate limiting
                     if (response.status === 429) {