@oxvo/browser 7.3.0 → 7.4.15

package/README.md

@@ -29,6 +29,38 @@ await browser.start({
 });
 ```
 
+## Cross-Origin Iframes
+
+Cross-origin iframe capture is opt-in on both pages. The top-level tracker must
+allowlist every exact child origin, and each child tracker must name its exact
+parent origin:
+
+```ts
+// Top-level page at https://www.example.com
+const parentBrowser = new Browser({
+  siteKey: 'ws_live_01HZX8M4B3',
+  crossdomain: {
+    enabled: true,
+    childOrigins: ['https://checkout.example.com'],
+  },
+});
+await parentBrowser.start();
+
+// Embedded page at https://checkout.example.com
+const childBrowser = new Browser({
+  siteKey: 'ws_live_01HZX8M4B3',
+  crossdomain: {
+    enabled: true,
+    parentDomain: 'https://www.example.com',
+  },
+});
+await childBrowser.start();
+```
+
+Wildcards and opaque origins are rejected. Parent and child pages must use the
+same current tracker release; legacy and mixed cross-frame protocols fail
+closed.
+
 ## Common Runtime Calls
 
 ```ts