@datalyr/web 1.7.9 → 1.7.12

package/dist/datalyr.esm.js

@@ -1,5 +1,5 @@
 /**
- * @datalyr/web v1.7.9
+ * @datalyr/web v1.7.12
  * Datalyr Web SDK - Modern attribution tracking for web applications
  * (c) 2026 Datalyr Inc.
  * Released under the MIT License
@@ -815,7 +815,11 @@ const REDACTED_URL_PARAMS = new Set([
     'token', 'access_token', 'refresh_token', 'id_token', 'auth', 'authorization',
     'password', 'pass', 'pwd', 'secret', 'api_key', 'apikey', 'key',
     'session', 'session_id', 'sid', 'email', 'e', 'phone', 'tel',
-    'signature', 'sig', 'otp', 'reset', 'hash'
+    'signature', 'sig', 'otp', 'reset', 'hash',
+    // Klaviyo profile IDs are deterministic customer identifiers. Capture them
+    // through the dedicated identity envelope, but never retain them in URLs,
+    // referrers, first/last-touch records, or generic event properties.
+    'dl_kprofile_id'
 ]);
 // BATCH-2(e): `code` is CONDITIONAL, not in the always-redact set above. An OAuth
 // authorization code (account-takeover-grade if it leaks to ad platforms) ALWAYS travels
@@ -1760,7 +1764,8 @@ class SessionManager {
 class AttributionManager {
     constructor(options = {}) {
         this.queryParamsCache = null;
-        this.UTM_PARAMS = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content'];
+        this.pendingKlaviyoProfileId = null;
+        this.UTM_PARAMS = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'utm_id'];
         // Updated to match dl.js - includes ALL ad platform click IDs
         this.CLICK_IDS = [
             'fbclid', // Facebook/Meta
@@ -1805,7 +1810,11 @@ class AttributionManager {
             'source', // Generic source (non-UTM)
             'campaign', // Generic campaign (non-UTM)
             'medium', // Generic medium (non-UTM)
-            'gad_source' // Google Ads source parameter
+            'gad_source', // Google Ads source parameter
+            // Datalyr-owned Klaviyo parameters. These live beside merchant UTMs so
+            // account-level setup never replaces customer values.
+            'dl_ksource',
+            'dl_kmessage_id'
         ];
         // TR-03: ad-cookie fields (Meta/Google Ads/TikTok/Snap) that are MARKETING-scoped. When
         // marketing consent is declined these are neither synthesized/written nor shipped. Google
@@ -1815,6 +1824,69 @@ class AttributionManager {
         // Merge default tracked params with user-provided ones
         this.trackedParams = [...this.DEFAULT_TRACKED_PARAMS, ...(options.trackedParams || [])];
         this.marketingAllowedFn = options.marketingAllowed;
+        this.replaceVisibleUrl = options.replaceVisibleUrl;
+    }
+    validKlaviyoProfileId(value) {
+        const id = typeof value === 'string' ? value.trim() : '';
+        if (!id || id.length > 512 || /[\u0000-\u001f\u007f]/.test(id))
+            return null;
+        return id;
+    }
+    /** Capture the dedicated Klaviyo identity parameter before URL redaction.
+     * It deliberately never enters the Attribution object or touch storage. */
+    captureKlaviyoProfileBinding(params) {
+        if (!Object.prototype.hasOwnProperty.call(params, 'dl_kprofile_id'))
+            return;
+        const profileId = this.validKlaviyoProfileId(params.dl_kprofile_id);
+        delete params.dl_kprofile_id;
+        if (profileId && this.isMarketingAllowed())
+            this.pendingKlaviyoProfileId = profileId;
+        try {
+            const url = new URL(window.location.href);
+            if (url.searchParams.has('dl_kprofile_id')) {
+                url.searchParams.delete('dl_kprofile_id');
+                const clean = `${url.pathname}${url.search}${url.hash}`;
+                if (this.replaceVisibleUrl)
+                    this.replaceVisibleUrl(clean);
+                else
+                    window.history.replaceState(window.history.state, '', clean);
+            }
+        }
+        catch (_a) {
+            // Capture still succeeds when a synthetic test/browser URL cannot parse.
+        }
+    }
+    /** Called once encryption is ready. The short TTL only bridges async init or
+     * a reload before the landing event is queued; it is not a profile cache. */
+    hydrateKlaviyoProfileBinding() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const now = Date.now();
+            if (!this.pendingKlaviyoProfileId) {
+                const stored = yield storage.getEncrypted(AttributionManager.KLAVIYO_BINDING_KEY, null);
+                const restored = this.validKlaviyoProfileId(stored === null || stored === void 0 ? void 0 : stored.profileId);
+                if (restored && Number(stored === null || stored === void 0 ? void 0 : stored.expiresAt) > now && this.isMarketingAllowed()) {
+                    this.pendingKlaviyoProfileId = restored;
+                }
+                else {
+                    storage.remove(AttributionManager.KLAVIYO_BINDING_KEY);
+                }
+            }
+            if (this.pendingKlaviyoProfileId) {
+                yield storage.setEncrypted(AttributionManager.KLAVIYO_BINDING_KEY, {
+                    profileId: this.pendingKlaviyoProfileId,
+                    expiresAt: now + AttributionManager.KLAVIYO_BINDING_TTL_MS,
+                });
+            }
+        });
+    }
+    /** One-shot binding for the next queued event. */
+    consumeKlaviyoProfileBinding() {
+        if (!this.isMarketingAllowed())
+            this.pendingKlaviyoProfileId = null;
+        const profileId = this.pendingKlaviyoProfileId;
+        this.pendingKlaviyoProfileId = null;
+        storage.remove(AttributionManager.KLAVIYO_BINDING_KEY);
+        return profileId;
     }
     // TR-03: default (no predicate / no signal) = allowed → byte-identical to prior behavior.
     isMarketingAllowed() {
@@ -1837,6 +1909,7 @@ class AttributionManager {
         if (!this.queryParamsCache) {
             this.queryParamsCache = params;
         }
+        this.captureKlaviyoProfileBinding(params);
         const attribution = {
             timestamp: Date.now()
         };
@@ -1851,8 +1924,13 @@ class AttributionManager {
             const value = params[utm];
             if (value) {
                 attribution[utm] = value; // canonical: utm_source, utm_campaign, ...
-                const key = utm.replace('utm_', '');
-                attribution[key] = value; // alias: source, campaign, ...
+                // The five original UTM dimensions keep their legacy stripped aliases.
+                // `utm_id` is intentionally canonical-only: writing it to a generic `id`
+                // property would collide with event/customer identifiers downstream.
+                if (utm !== 'utm_id') {
+                    const key = utm.replace('utm_', '');
+                    attribution[key] = value; // alias: source, campaign, ...
+                }
             }
         }
         // Capture click IDs. The first present (by CLICK_IDS priority) is the primary
@@ -1889,6 +1967,12 @@ class AttributionManager {
                 attribution[param] = value;
             }
         }
+        // The namespaced source is Datalyr's routing authority. Keep any
+        // merchant-owned utm_source intact while still classifying this visit as
+        // Klaviyo everywhere source-level attribution is displayed.
+        if (attribution.dl_ksource === 'klaviyo') {
+            attribution.source = 'klaviyo';
+        }
         // Capture referrer. 9.A.4: redact secret/PII query-param values (reset tokens,
         // OAuth codes, emails) — this attribution object is stamped onto every event AND
         // persisted into dl_first_touch/dl_last_touch, so it must be clean at capture.
@@ -2152,6 +2236,21 @@ class AttributionManager {
                 current = Object.assign(Object.assign({}, fallback), { referrer: current.referrer, referrerHost: current.referrerHost, landingPage: current.landingPage, landingPath: current.landingPath });
             }
         }
+        // A real signal WITHOUT its own link tag must not erase the stored one. The
+        // creator/bio-link journey is click-link-today, return-from-instagram-next-week:
+        // that organic revisit scores hasRealAttribution (external referrer) with no
+        // `lyr`, and before this carry-forward storeLastTouch below replaced the tagged
+        // touch wholesale — every later event (and the Track page's conversion count,
+        // which keys on the event's own lyr) silently lost the link. Semantics = "last
+        // non-empty lyr within the window", the same answer the server's resolveLyr
+        // argMax gives webhook conversions; a NEW ?lyr= still wins because current.lyr
+        // is already set. source/medium/campaign still update — lyr is an independent
+        // dimension (which link), not a channel claim.
+        if (hasRealAttribution && !current.lyr) {
+            const storedLyr = (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.lyr) || (firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.lyr);
+            if (storedLyr)
+                current.lyr = storedLyr;
+        }
         // Capture advertising cookies automatically
         const adCookies = this.captureAdCookies();
         // Only (re)write first/last touch when this pageview carried a REAL signal — never
@@ -2328,6 +2427,8 @@ class AttributionManager {
         }
     }
 }
+AttributionManager.KLAVIYO_BINDING_KEY = 'dl_klaviyo_profile_binding';
+AttributionManager.KLAVIYO_BINDING_TTL_MS = 10 * 60 * 1000;
 
 /**
  * Event Queue and Batching Module
@@ -4988,6 +5089,7 @@ class Datalyr {
         this.initialized = false;
         this.errors = [];
         this.MAX_ERRORS = 50;
+        this.shopifyConsentUnresolvable = false; // loadFeatures failed or never yielded customerPrivacy → stop fail-closing
         this.lastSpaPath = null; // dedups SPA pageviews (replaceState-on-mount double-fire)
         // Shopify loads Customer Privacy asynchronously. Keep the initial pageview
         // pending until initialization is complete and analytics consent is known,
@@ -5067,7 +5169,15 @@ class Datalyr {
             // TR-03: gate ad-signal synthesis + shipping on LIVE marketing consent. Returns true by
             // default (no consent signal) so behavior is unchanged for the common case; false only on
             // an explicit decline (Shopify marketing:false / setConsent marketing|sale=false).
-            marketingAllowed: () => this.consentAllowsMarketing()
+            marketingAllowed: () => this.consentAllowsMarketing(),
+            // Bypass our SPA wrapper when removing the one-time profile parameter,
+            // otherwise the privacy cleanup itself would manufacture a pageview.
+            replaceVisibleUrl: (url) => {
+                var _a;
+                const replace = (_a = this.originalReplaceState) !== null && _a !== void 0 ? _a : history.replaceState;
+                replace.call(history, history.state, '', url);
+                this.lastSpaPath = window.location.pathname + window.location.search + window.location.hash;
+            },
         });
         this.queue = new EventQueue(this.config);
         this.fingerprint = new FingerprintCollector({
@@ -5157,6 +5267,7 @@ class Datalyr {
                         // in the IdentityManager constructor. It never overwrites an id already
                         // set by an explicit identify() earlier in this page load.
                         yield this.identity.hydrateEncryptedUserId();
+                        yield this.attribution.hydrateKlaviyoProfileBinding();
                         this.log('Encryption initialized, user properties loaded');
                     }
                     catch (encErr) {
@@ -5420,6 +5531,14 @@ class Datalyr {
                     referrerParams.set('utm_content', lastTouch.content);
                 if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.term)
                     referrerParams.set('utm_term', lastTouch.term);
+                if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.utm_id)
+                    referrerParams.set('utm_id', lastTouch.utm_id);
+                // The trackable-link tag rides the referrer too — the edge worker's own
+                // server-side appendPlayReferrer packs it, and ingest parses it back out
+                // of install_referrer_url. Without it, interstitial-mode Android installs
+                // lose the deterministic link tag that a bare 302 would have carried.
+                if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.lyr)
+                    referrerParams.set('lyr', lastTouch.lyr);
                 try {
                     const url = new URL(options.appStoreUrl);
                     url.searchParams.set('referrer', referrerParams.toString());
@@ -6420,6 +6539,16 @@ class Datalyr {
         // Add attribution data (caller wins on collisions)
         const attributionData = this.attribution.getAttributionData();
         assignMissing(eventData, attributionData);
+        // A Klaviyo landing URL may carry the profile ID as a dedicated custom
+        // parameter. Emit it once through the deterministic external-id envelope;
+        // never copy it into generic attribution or user-visible URL fields.
+        const klaviyoProfileId = this.attribution.consumeKlaviyoProfileBinding();
+        if (klaviyoProfileId) {
+            const existingExternalIds = eventData.external_ids;
+            eventData.external_ids = Object.assign(Object.assign({}, (existingExternalIds && typeof existingExternalIds === 'object' && !Array.isArray(existingExternalIds)
+                ? existingExternalIds
+                : {})), { klaviyo: klaviyoProfileId });
+        }
         // Add session metrics (SDK-authoritative — session_id et al. must not be overridden)
         const sessionMetrics = this.session.getMetrics();
         Object.assign(eventData, sessionMetrics);
@@ -6487,7 +6616,7 @@ class Datalyr {
             // drift from the package again (it sat at 1.7.4 across the 1.7.5 release). The
             // build guard (scripts/check-bundle.js, run by build:check) still verifies the
             // deployable bundles carry the package.json version. (FSR-103)
-            sdk_version: '1.7.9',
+            sdk_version: '1.7.12',
             sdk_name: 'datalyr-web-sdk',
             // A3-25: versioned-envelope stamp. Every SDK emits schema_version so the ingest/contract
             // layer can key on ONE canonical envelope version (snake_case fields, event_name/event_data
@@ -6576,6 +6705,27 @@ class Datalyr {
             return false;
         }
     }
+    /**
+     * TR-15 refinement: fail closed ONLY while the Customer Privacy API can still
+     * arrive (Shopify.loadFeatures exists and hasn't failed). A storefront with no
+     * loadFeatures (headless installs, `platform:'shopify'` on a non-Shopify page)
+     * has NO path to a consent answer — blocking there is not a pre-load window,
+     * it is zero events forever, silently. No signal possible → null (fail open);
+     * false is reserved for an explicit decline from the API.
+     */
+    shopifyConsentPendingBlock() {
+        var _a;
+        if (!this.isShopifyStorefront())
+            return null;
+        if (this.shopifyConsentUnresolvable)
+            return null;
+        try {
+            return typeof ((_a = window.Shopify) === null || _a === void 0 ? void 0 : _a.loadFeatures) === 'function' ? false : null;
+        }
+        catch (_b) {
+            return null;
+        }
+    }
     /**
      * Shopify's analytics-consent signal: true/false when the Customer Privacy API is
      * present and answers, null when there's no signal (API absent / unexpected shape)
@@ -6585,7 +6735,7 @@ class Datalyr {
         try {
             const cp = this.getShopifyCustomerPrivacy();
             if (!cp)
-                return this.isShopifyStorefront() ? false : null;
+                return this.shopifyConsentPendingBlock();
             if (typeof cp.analyticsProcessingAllowed === 'function') {
                 const allowed = cp.analyticsProcessingAllowed();
                 return typeof allowed === 'boolean' ? allowed : null;
@@ -6595,10 +6745,10 @@ class Datalyr {
                 const allowed = cp.userCanBeTracked();
                 return typeof allowed === 'boolean' ? allowed : null;
             }
-            return this.isShopifyStorefront() ? false : null;
+            return this.shopifyConsentPendingBlock();
         }
         catch (_a) {
-            return this.isShopifyStorefront() ? false : null;
+            return this.shopifyConsentPendingBlock();
         }
     }
     /**
@@ -6610,15 +6760,15 @@ class Datalyr {
         try {
             const cp = this.getShopifyCustomerPrivacy();
             if (!cp || typeof cp.marketingAllowed !== 'function') {
-                return this.isShopifyStorefront() ? false : null;
+                return this.shopifyConsentPendingBlock();
             }
             const allowed = cp.marketingAllowed();
             return typeof allowed === 'boolean'
                 ? allowed
-                : (this.isShopifyStorefront() ? false : null);
+                : (this.shopifyConsentPendingBlock());
         }
         catch (_a) {
-            return this.isShopifyStorefront() ? false : null;
+            return this.shopifyConsentPendingBlock();
         }
     }
     /**
@@ -6654,18 +6804,31 @@ class Datalyr {
             // banner interaction. Guarded — a missing/changed loadFeatures must never break tracking.
             const shopify = window.Shopify;
             if (shopify && typeof shopify.loadFeatures === 'function') {
-                shopify.loadFeatures([{ name: 'consent-tracking-api', version: '0.1' }], (error) => {
-                    if (error) {
-                        this.log('Shopify loadFeatures(consent-tracking-api) failed:', error);
-                        return;
-                    }
-                    try {
-                        this.onShopifyConsentChanged();
-                    }
-                    catch (e) {
-                        this.log('Shopify post-load consent eval failed:', e);
-                    }
-                });
+                // One retry before declaring the API unreachable: a TRANSIENT loadFeatures
+                // failure must not fail-open the whole session for a previously-declined
+                // shopper. Only after the retry (or a success that still yields no
+                // customerPrivacy) is the pre-load window declared over — then the
+                // fail-closed gate releases and consent re-evaluates (a decline gates).
+                const attempt = (retriesLeft) => {
+                    shopify.loadFeatures([{ name: 'consent-tracking-api', version: '0.1' }], (error) => {
+                        if (error && retriesLeft > 0) {
+                            this.log('Shopify loadFeatures(consent-tracking-api) failed, retrying:', error);
+                            setTimeout(() => attempt(retriesLeft - 1), 1000);
+                            return;
+                        }
+                        if (error)
+                            this.log('Shopify loadFeatures(consent-tracking-api) failed:', error);
+                        if (error || !this.getShopifyCustomerPrivacy())
+                            this.shopifyConsentUnresolvable = true;
+                        try {
+                            this.onShopifyConsentChanged();
+                        }
+                        catch (e) {
+                            this.log('Shopify post-load consent eval failed:', e);
+                        }
+                    });
+                };
+                attempt(1);
             }
         }
         catch (error) {