@datalyr/web 1.7.9 → 1.7.12

package/dist/datalyr.js

@@ -1,5 +1,5 @@
 /**
- * @datalyr/web v1.7.9
+ * @datalyr/web v1.7.12
  * Datalyr Web SDK - Modern attribution tracking for web applications
  * (c) 2026 Datalyr Inc.
  * Released under the MIT License
@@ -818,7 +818,11 @@ var Datalyr = (function (exports) {
         'token', 'access_token', 'refresh_token', 'id_token', 'auth', 'authorization',
         'password', 'pass', 'pwd', 'secret', 'api_key', 'apikey', 'key',
         'session', 'session_id', 'sid', 'email', 'e', 'phone', 'tel',
-        'signature', 'sig', 'otp', 'reset', 'hash'
+        'signature', 'sig', 'otp', 'reset', 'hash',
+        // Klaviyo profile IDs are deterministic customer identifiers. Capture them
+        // through the dedicated identity envelope, but never retain them in URLs,
+        // referrers, first/last-touch records, or generic event properties.
+        'dl_kprofile_id'
     ]);
     // BATCH-2(e): `code` is CONDITIONAL, not in the always-redact set above. An OAuth
     // authorization code (account-takeover-grade if it leaks to ad platforms) ALWAYS travels
@@ -1763,7 +1767,8 @@ var Datalyr = (function (exports) {
     class AttributionManager {
         constructor(options = {}) {
             this.queryParamsCache = null;
-            this.UTM_PARAMS = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content'];
+            this.pendingKlaviyoProfileId = null;
+            this.UTM_PARAMS = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'utm_id'];
             // Updated to match dl.js - includes ALL ad platform click IDs
             this.CLICK_IDS = [
                 'fbclid', // Facebook/Meta
@@ -1808,7 +1813,11 @@ var Datalyr = (function (exports) {
                 'source', // Generic source (non-UTM)
                 'campaign', // Generic campaign (non-UTM)
                 'medium', // Generic medium (non-UTM)
-                'gad_source' // Google Ads source parameter
+                'gad_source', // Google Ads source parameter
+                // Datalyr-owned Klaviyo parameters. These live beside merchant UTMs so
+                // account-level setup never replaces customer values.
+                'dl_ksource',
+                'dl_kmessage_id'
             ];
             // TR-03: ad-cookie fields (Meta/Google Ads/TikTok/Snap) that are MARKETING-scoped. When
             // marketing consent is declined these are neither synthesized/written nor shipped. Google
@@ -1818,6 +1827,69 @@ var Datalyr = (function (exports) {
             // Merge default tracked params with user-provided ones
             this.trackedParams = [...this.DEFAULT_TRACKED_PARAMS, ...(options.trackedParams || [])];
             this.marketingAllowedFn = options.marketingAllowed;
+            this.replaceVisibleUrl = options.replaceVisibleUrl;
+        }
+        validKlaviyoProfileId(value) {
+            const id = typeof value === 'string' ? value.trim() : '';
+            if (!id || id.length > 512 || /[\u0000-\u001f\u007f]/.test(id))
+                return null;
+            return id;
+        }
+        /** Capture the dedicated Klaviyo identity parameter before URL redaction.
+         * It deliberately never enters the Attribution object or touch storage. */
+        captureKlaviyoProfileBinding(params) {
+            if (!Object.prototype.hasOwnProperty.call(params, 'dl_kprofile_id'))
+                return;
+            const profileId = this.validKlaviyoProfileId(params.dl_kprofile_id);
+            delete params.dl_kprofile_id;
+            if (profileId && this.isMarketingAllowed())
+                this.pendingKlaviyoProfileId = profileId;
+            try {
+                const url = new URL(window.location.href);
+                if (url.searchParams.has('dl_kprofile_id')) {
+                    url.searchParams.delete('dl_kprofile_id');
+                    const clean = `${url.pathname}${url.search}${url.hash}`;
+                    if (this.replaceVisibleUrl)
+                        this.replaceVisibleUrl(clean);
+                    else
+                        window.history.replaceState(window.history.state, '', clean);
+                }
+            }
+            catch (_a) {
+                // Capture still succeeds when a synthetic test/browser URL cannot parse.
+            }
+        }
+        /** Called once encryption is ready. The short TTL only bridges async init or
+         * a reload before the landing event is queued; it is not a profile cache. */
+        hydrateKlaviyoProfileBinding() {
+            return __awaiter(this, void 0, void 0, function* () {
+                const now = Date.now();
+                if (!this.pendingKlaviyoProfileId) {
+                    const stored = yield storage.getEncrypted(AttributionManager.KLAVIYO_BINDING_KEY, null);
+                    const restored = this.validKlaviyoProfileId(stored === null || stored === void 0 ? void 0 : stored.profileId);
+                    if (restored && Number(stored === null || stored === void 0 ? void 0 : stored.expiresAt) > now && this.isMarketingAllowed()) {
+                        this.pendingKlaviyoProfileId = restored;
+                    }
+                    else {
+                        storage.remove(AttributionManager.KLAVIYO_BINDING_KEY);
+                    }
+                }
+                if (this.pendingKlaviyoProfileId) {
+                    yield storage.setEncrypted(AttributionManager.KLAVIYO_BINDING_KEY, {
+                        profileId: this.pendingKlaviyoProfileId,
+                        expiresAt: now + AttributionManager.KLAVIYO_BINDING_TTL_MS,
+                    });
+                }
+            });
+        }
+        /** One-shot binding for the next queued event. */
+        consumeKlaviyoProfileBinding() {
+            if (!this.isMarketingAllowed())
+                this.pendingKlaviyoProfileId = null;
+            const profileId = this.pendingKlaviyoProfileId;
+            this.pendingKlaviyoProfileId = null;
+            storage.remove(AttributionManager.KLAVIYO_BINDING_KEY);
+            return profileId;
         }
         // TR-03: default (no predicate / no signal) = allowed → byte-identical to prior behavior.
         isMarketingAllowed() {
@@ -1840,6 +1912,7 @@ var Datalyr = (function (exports) {
             if (!this.queryParamsCache) {
                 this.queryParamsCache = params;
             }
+            this.captureKlaviyoProfileBinding(params);
             const attribution = {
                 timestamp: Date.now()
             };
@@ -1854,8 +1927,13 @@ var Datalyr = (function (exports) {
                 const value = params[utm];
                 if (value) {
                     attribution[utm] = value; // canonical: utm_source, utm_campaign, ...
-                    const key = utm.replace('utm_', '');
-                    attribution[key] = value; // alias: source, campaign, ...
+                    // The five original UTM dimensions keep their legacy stripped aliases.
+                    // `utm_id` is intentionally canonical-only: writing it to a generic `id`
+                    // property would collide with event/customer identifiers downstream.
+                    if (utm !== 'utm_id') {
+                        const key = utm.replace('utm_', '');
+                        attribution[key] = value; // alias: source, campaign, ...
+                    }
                 }
             }
             // Capture click IDs. The first present (by CLICK_IDS priority) is the primary
@@ -1892,6 +1970,12 @@ var Datalyr = (function (exports) {
                     attribution[param] = value;
                 }
             }
+            // The namespaced source is Datalyr's routing authority. Keep any
+            // merchant-owned utm_source intact while still classifying this visit as
+            // Klaviyo everywhere source-level attribution is displayed.
+            if (attribution.dl_ksource === 'klaviyo') {
+                attribution.source = 'klaviyo';
+            }
             // Capture referrer. 9.A.4: redact secret/PII query-param values (reset tokens,
             // OAuth codes, emails) — this attribution object is stamped onto every event AND
             // persisted into dl_first_touch/dl_last_touch, so it must be clean at capture.
@@ -2155,6 +2239,21 @@ var Datalyr = (function (exports) {
                     current = Object.assign(Object.assign({}, fallback), { referrer: current.referrer, referrerHost: current.referrerHost, landingPage: current.landingPage, landingPath: current.landingPath });
                 }
             }
+            // A real signal WITHOUT its own link tag must not erase the stored one. The
+            // creator/bio-link journey is click-link-today, return-from-instagram-next-week:
+            // that organic revisit scores hasRealAttribution (external referrer) with no
+            // `lyr`, and before this carry-forward storeLastTouch below replaced the tagged
+            // touch wholesale — every later event (and the Track page's conversion count,
+            // which keys on the event's own lyr) silently lost the link. Semantics = "last
+            // non-empty lyr within the window", the same answer the server's resolveLyr
+            // argMax gives webhook conversions; a NEW ?lyr= still wins because current.lyr
+            // is already set. source/medium/campaign still update — lyr is an independent
+            // dimension (which link), not a channel claim.
+            if (hasRealAttribution && !current.lyr) {
+                const storedLyr = (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.lyr) || (firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.lyr);
+                if (storedLyr)
+                    current.lyr = storedLyr;
+            }
             // Capture advertising cookies automatically
             const adCookies = this.captureAdCookies();
             // Only (re)write first/last touch when this pageview carried a REAL signal — never
@@ -2331,6 +2430,8 @@ var Datalyr = (function (exports) {
             }
         }
     }
+    AttributionManager.KLAVIYO_BINDING_KEY = 'dl_klaviyo_profile_binding';
+    AttributionManager.KLAVIYO_BINDING_TTL_MS = 10 * 60 * 1000;
 
     /**
      * Event Queue and Batching Module
@@ -4991,6 +5092,7 @@ var Datalyr = (function (exports) {
             this.initialized = false;
             this.errors = [];
             this.MAX_ERRORS = 50;
+            this.shopifyConsentUnresolvable = false; // loadFeatures failed or never yielded customerPrivacy → stop fail-closing
             this.lastSpaPath = null; // dedups SPA pageviews (replaceState-on-mount double-fire)
             // Shopify loads Customer Privacy asynchronously. Keep the initial pageview
             // pending until initialization is complete and analytics consent is known,
@@ -5070,7 +5172,15 @@ var Datalyr = (function (exports) {
                 // TR-03: gate ad-signal synthesis + shipping on LIVE marketing consent. Returns true by
                 // default (no consent signal) so behavior is unchanged for the common case; false only on
                 // an explicit decline (Shopify marketing:false / setConsent marketing|sale=false).
-                marketingAllowed: () => this.consentAllowsMarketing()
+                marketingAllowed: () => this.consentAllowsMarketing(),
+                // Bypass our SPA wrapper when removing the one-time profile parameter,
+                // otherwise the privacy cleanup itself would manufacture a pageview.
+                replaceVisibleUrl: (url) => {
+                    var _a;
+                    const replace = (_a = this.originalReplaceState) !== null && _a !== void 0 ? _a : history.replaceState;
+                    replace.call(history, history.state, '', url);
+                    this.lastSpaPath = window.location.pathname + window.location.search + window.location.hash;
+                },
             });
             this.queue = new EventQueue(this.config);
             this.fingerprint = new FingerprintCollector({
@@ -5160,6 +5270,7 @@ var Datalyr = (function (exports) {
                             // in the IdentityManager constructor. It never overwrites an id already
                             // set by an explicit identify() earlier in this page load.
                             yield this.identity.hydrateEncryptedUserId();
+                            yield this.attribution.hydrateKlaviyoProfileBinding();
                             this.log('Encryption initialized, user properties loaded');
                         }
                         catch (encErr) {
@@ -5423,6 +5534,14 @@ var Datalyr = (function (exports) {
                         referrerParams.set('utm_content', lastTouch.content);
                     if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.term)
                         referrerParams.set('utm_term', lastTouch.term);
+                    if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.utm_id)
+                        referrerParams.set('utm_id', lastTouch.utm_id);
+                    // The trackable-link tag rides the referrer too — the edge worker's own
+                    // server-side appendPlayReferrer packs it, and ingest parses it back out
+                    // of install_referrer_url. Without it, interstitial-mode Android installs
+                    // lose the deterministic link tag that a bare 302 would have carried.
+                    if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.lyr)
+                        referrerParams.set('lyr', lastTouch.lyr);
                     try {
                         const url = new URL(options.appStoreUrl);
                         url.searchParams.set('referrer', referrerParams.toString());
@@ -6423,6 +6542,16 @@ var Datalyr = (function (exports) {
             // Add attribution data (caller wins on collisions)
             const attributionData = this.attribution.getAttributionData();
             assignMissing(eventData, attributionData);
+            // A Klaviyo landing URL may carry the profile ID as a dedicated custom
+            // parameter. Emit it once through the deterministic external-id envelope;
+            // never copy it into generic attribution or user-visible URL fields.
+            const klaviyoProfileId = this.attribution.consumeKlaviyoProfileBinding();
+            if (klaviyoProfileId) {
+                const existingExternalIds = eventData.external_ids;
+                eventData.external_ids = Object.assign(Object.assign({}, (existingExternalIds && typeof existingExternalIds === 'object' && !Array.isArray(existingExternalIds)
+                    ? existingExternalIds
+                    : {})), { klaviyo: klaviyoProfileId });
+            }
             // Add session metrics (SDK-authoritative — session_id et al. must not be overridden)
             const sessionMetrics = this.session.getMetrics();
             Object.assign(eventData, sessionMetrics);
@@ -6490,7 +6619,7 @@ var Datalyr = (function (exports) {
                 // drift from the package again (it sat at 1.7.4 across the 1.7.5 release). The
                 // build guard (scripts/check-bundle.js, run by build:check) still verifies the
                 // deployable bundles carry the package.json version. (FSR-103)
-                sdk_version: '1.7.9',
+                sdk_version: '1.7.12',
                 sdk_name: 'datalyr-web-sdk',
                 // A3-25: versioned-envelope stamp. Every SDK emits schema_version so the ingest/contract
                 // layer can key on ONE canonical envelope version (snake_case fields, event_name/event_data
@@ -6579,6 +6708,27 @@ var Datalyr = (function (exports) {
                 return false;
             }
         }
+        /**
+         * TR-15 refinement: fail closed ONLY while the Customer Privacy API can still
+         * arrive (Shopify.loadFeatures exists and hasn't failed). A storefront with no
+         * loadFeatures (headless installs, `platform:'shopify'` on a non-Shopify page)
+         * has NO path to a consent answer — blocking there is not a pre-load window,
+         * it is zero events forever, silently. No signal possible → null (fail open);
+         * false is reserved for an explicit decline from the API.
+         */
+        shopifyConsentPendingBlock() {
+            var _a;
+            if (!this.isShopifyStorefront())
+                return null;
+            if (this.shopifyConsentUnresolvable)
+                return null;
+            try {
+                return typeof ((_a = window.Shopify) === null || _a === void 0 ? void 0 : _a.loadFeatures) === 'function' ? false : null;
+            }
+            catch (_b) {
+                return null;
+            }
+        }
         /**
          * Shopify's analytics-consent signal: true/false when the Customer Privacy API is
          * present and answers, null when there's no signal (API absent / unexpected shape)
@@ -6588,7 +6738,7 @@ var Datalyr = (function (exports) {
             try {
                 const cp = this.getShopifyCustomerPrivacy();
                 if (!cp)
-                    return this.isShopifyStorefront() ? false : null;
+                    return this.shopifyConsentPendingBlock();
                 if (typeof cp.analyticsProcessingAllowed === 'function') {
                     const allowed = cp.analyticsProcessingAllowed();
                     return typeof allowed === 'boolean' ? allowed : null;
@@ -6598,10 +6748,10 @@ var Datalyr = (function (exports) {
                     const allowed = cp.userCanBeTracked();
                     return typeof allowed === 'boolean' ? allowed : null;
                 }
-                return this.isShopifyStorefront() ? false : null;
+                return this.shopifyConsentPendingBlock();
             }
             catch (_a) {
-                return this.isShopifyStorefront() ? false : null;
+                return this.shopifyConsentPendingBlock();
             }
         }
         /**
@@ -6613,15 +6763,15 @@ var Datalyr = (function (exports) {
             try {
                 const cp = this.getShopifyCustomerPrivacy();
                 if (!cp || typeof cp.marketingAllowed !== 'function') {
-                    return this.isShopifyStorefront() ? false : null;
+                    return this.shopifyConsentPendingBlock();
                 }
                 const allowed = cp.marketingAllowed();
                 return typeof allowed === 'boolean'
                     ? allowed
-                    : (this.isShopifyStorefront() ? false : null);
+                    : (this.shopifyConsentPendingBlock());
             }
             catch (_a) {
-                return this.isShopifyStorefront() ? false : null;
+                return this.shopifyConsentPendingBlock();
             }
         }
         /**
@@ -6657,18 +6807,31 @@ var Datalyr = (function (exports) {
                 // banner interaction. Guarded — a missing/changed loadFeatures must never break tracking.
                 const shopify = window.Shopify;
                 if (shopify && typeof shopify.loadFeatures === 'function') {
-                    shopify.loadFeatures([{ name: 'consent-tracking-api', version: '0.1' }], (error) => {
-                        if (error) {
-                            this.log('Shopify loadFeatures(consent-tracking-api) failed:', error);
-                            return;
-                        }
-                        try {
-                            this.onShopifyConsentChanged();
-                        }
-                        catch (e) {
-                            this.log('Shopify post-load consent eval failed:', e);
-                        }
-                    });
+                    // One retry before declaring the API unreachable: a TRANSIENT loadFeatures
+                    // failure must not fail-open the whole session for a previously-declined
+                    // shopper. Only after the retry (or a success that still yields no
+                    // customerPrivacy) is the pre-load window declared over — then the
+                    // fail-closed gate releases and consent re-evaluates (a decline gates).
+                    const attempt = (retriesLeft) => {
+                        shopify.loadFeatures([{ name: 'consent-tracking-api', version: '0.1' }], (error) => {
+                            if (error && retriesLeft > 0) {
+                                this.log('Shopify loadFeatures(consent-tracking-api) failed, retrying:', error);
+                                setTimeout(() => attempt(retriesLeft - 1), 1000);
+                                return;
+                            }
+                            if (error)
+                                this.log('Shopify loadFeatures(consent-tracking-api) failed:', error);
+                            if (error || !this.getShopifyCustomerPrivacy())
+                                this.shopifyConsentUnresolvable = true;
+                            try {
+                                this.onShopifyConsentChanged();
+                            }
+                            catch (e) {
+                                this.log('Shopify post-load consent eval failed:', e);
+                            }
+                        });
+                    };
+                    attempt(1);
                 }
             }
             catch (error) {