mixpanel-browser 2.76.0 → 2.77.0

package/dist/mixpanel.umd.js

@@ -31,7 +31,7 @@
 
     var Config = {
         DEBUG: false,
-        LIB_VERSION: '2.76.0'
+        LIB_VERSION: '2.77.0'
     };
 
     // Window global names for async modules
@@ -10739,13 +10739,7 @@
                 };
                 while(_this.mapRemoves.length){
                     var removedNode = _this.mapRemoves.shift();
-                    if (removedNode.nodeName === "IFRAME") {
-                        try {
-                            _this.iframeManager.removeIframe(removedNode);
-                        } catch (e2) {}
-                    } else {
-                        _this.stylesheetManager.cleanupStylesheetsForRemovedNode(removedNode);
-                    }
+                    _this.cleanupRemovedNode(removedNode);
                     _this.mirror.removeNodeFromMap(removedNode);
                 }
                 for(var _iterator = _create_for_of_iterator_helper_loose(_this.movedSet), _step; !(_step = _iterator()).done;){
@@ -11065,6 +11059,20 @@
                     }
                 }
             });
+            __publicField$1(this, "cleanupRemovedNode", function(node2) {
+                if (node2.nodeName === "IFRAME") {
+                    try {
+                        _this.iframeManager.removeIframe(node2);
+                    } catch (e2) {}
+                } else {
+                    try {
+                        _this.stylesheetManager.cleanupStylesheetsForRemovedNode(node2);
+                    } catch (e2) {}
+                }
+                node2.childNodes.forEach(function(child) {
+                    _this.cleanupRemovedNode(child);
+                });
+            });
         }
         var _proto = MutationBuffer.prototype;
         _proto.init = function init(options) {
@@ -13292,6 +13300,31 @@
         _proto.destroy = function destroy() {};
         return ProcessedNodeManager;
     }();
+    function toOrigin(url) {
+        try {
+            var origin = new URL(url).origin;
+            return origin !== "null" ? origin : null;
+        } catch (e) {
+            return null;
+        }
+    }
+    function buildAllowedOriginSet(origins) {
+        if (!Array.isArray(origins) || origins.length === 0) {
+            throw new Error("[rrweb] allowedIframeOrigins must be a non-empty array of origin strings.");
+        }
+        var set = /* @__PURE__ */ new Set();
+        for(var i2 = 0; i2 < origins.length; i2++){
+            var entry = origins[i2];
+            if (typeof entry !== "string") {
+                throw new Error("[rrweb] allowedIframeOrigins[" + i2 + "] must be a string, got " + (typeof entry === "undefined" ? "undefined" : _type_of(entry)) + ".");
+            }
+            var origin = toOrigin(entry);
+            if (origin) {
+                set.add(origin);
+            }
+        }
+        return Object.freeze(set);
+    }
     var wrappedEmit;
     var takeFullSnapshot$1;
     var canvasManager;
@@ -13313,10 +13346,17 @@
     var mirror = createMirror$2();
     function record(options) {
         if (options === void 0) options = {};
-        var emit = options.emit, checkoutEveryNms = options.checkoutEveryNms, checkoutEveryNth = options.checkoutEveryNth, _options_blockClass = options.blockClass, blockClass = _options_blockClass === void 0 ? "rr-block" : _options_blockClass, _options_blockSelector = options.blockSelector, blockSelector = _options_blockSelector === void 0 ? null : _options_blockSelector, _options_ignoreClass = options.ignoreClass, ignoreClass = _options_ignoreClass === void 0 ? "rr-ignore" : _options_ignoreClass, _options_ignoreSelector = options.ignoreSelector, ignoreSelector = _options_ignoreSelector === void 0 ? null : _options_ignoreSelector, _options_maskTextClass = options.maskTextClass, maskTextClass = _options_maskTextClass === void 0 ? "rr-mask" : _options_maskTextClass, _options_maskTextSelector = options.maskTextSelector, maskTextSelector = _options_maskTextSelector === void 0 ? null : _options_maskTextSelector, _options_inlineStylesheet = options.inlineStylesheet, inlineStylesheet = _options_inlineStylesheet === void 0 ? true : _options_inlineStylesheet, maskAllInputs = options.maskAllInputs, _maskInputOptions = options.maskInputOptions, _slimDOMOptions = options.slimDOMOptions, maskInputFn = options.maskInputFn, maskTextFn = options.maskTextFn, hooks = options.hooks, packFn = options.packFn, _options_sampling = options.sampling, sampling = _options_sampling === void 0 ? {} : _options_sampling, _options_dataURLOptions = options.dataURLOptions, dataURLOptions = _options_dataURLOptions === void 0 ? {} : _options_dataURLOptions, mousemoveWait = options.mousemoveWait, _options_recordDOM = options.recordDOM, recordDOM = _options_recordDOM === void 0 ? true : _options_recordDOM, _options_recordCanvas = options.recordCanvas, recordCanvas = _options_recordCanvas === void 0 ? false : _options_recordCanvas, _options_recordCrossOriginIframes = options.recordCrossOriginIframes, recordCrossOriginIframes = _options_recordCrossOriginIframes === void 0 ? false : _options_recordCrossOriginIframes, _options_recordAfter = options.recordAfter, recordAfter = _options_recordAfter === void 0 ? options.recordAfter === "DOMContentLoaded" ? options.recordAfter : "load" : _options_recordAfter, _options_userTriggeredOnInput = options.userTriggeredOnInput, userTriggeredOnInput = _options_userTriggeredOnInput === void 0 ? false : _options_userTriggeredOnInput, _options_collectFonts = options.collectFonts, collectFonts = _options_collectFonts === void 0 ? false : _options_collectFonts, _options_inlineImages = options.inlineImages, inlineImages = _options_inlineImages === void 0 ? false : _options_inlineImages, plugins = options.plugins, _options_keepIframeSrcFn = options.keepIframeSrcFn, keepIframeSrcFn = _options_keepIframeSrcFn === void 0 ? function() {
+        var emit = options.emit, checkoutEveryNms = options.checkoutEveryNms, checkoutEveryNth = options.checkoutEveryNth, _options_blockClass = options.blockClass, blockClass = _options_blockClass === void 0 ? "rr-block" : _options_blockClass, _options_blockSelector = options.blockSelector, blockSelector = _options_blockSelector === void 0 ? null : _options_blockSelector, _options_ignoreClass = options.ignoreClass, ignoreClass = _options_ignoreClass === void 0 ? "rr-ignore" : _options_ignoreClass, _options_ignoreSelector = options.ignoreSelector, ignoreSelector = _options_ignoreSelector === void 0 ? null : _options_ignoreSelector, _options_maskTextClass = options.maskTextClass, maskTextClass = _options_maskTextClass === void 0 ? "rr-mask" : _options_maskTextClass, _options_maskTextSelector = options.maskTextSelector, maskTextSelector = _options_maskTextSelector === void 0 ? null : _options_maskTextSelector, _options_inlineStylesheet = options.inlineStylesheet, inlineStylesheet = _options_inlineStylesheet === void 0 ? true : _options_inlineStylesheet, maskAllInputs = options.maskAllInputs, _maskInputOptions = options.maskInputOptions, _slimDOMOptions = options.slimDOMOptions, maskInputFn = options.maskInputFn, maskTextFn = options.maskTextFn, hooks = options.hooks, packFn = options.packFn, _options_sampling = options.sampling, sampling = _options_sampling === void 0 ? {} : _options_sampling, _options_dataURLOptions = options.dataURLOptions, dataURLOptions = _options_dataURLOptions === void 0 ? {} : _options_dataURLOptions, mousemoveWait = options.mousemoveWait, _options_recordDOM = options.recordDOM, recordDOM = _options_recordDOM === void 0 ? true : _options_recordDOM, _options_recordCanvas = options.recordCanvas, recordCanvas = _options_recordCanvas === void 0 ? false : _options_recordCanvas, _options_recordCrossOriginIframes = options.recordCrossOriginIframes, recordCrossOriginIframes = _options_recordCrossOriginIframes === void 0 ? false : _options_recordCrossOriginIframes, allowedIframeOrigins = options.allowedIframeOrigins, _options_recordAfter = options.recordAfter, recordAfter = _options_recordAfter === void 0 ? options.recordAfter === "DOMContentLoaded" ? options.recordAfter : "load" : _options_recordAfter, _options_userTriggeredOnInput = options.userTriggeredOnInput, userTriggeredOnInput = _options_userTriggeredOnInput === void 0 ? false : _options_userTriggeredOnInput, _options_collectFonts = options.collectFonts, collectFonts = _options_collectFonts === void 0 ? false : _options_collectFonts, _options_inlineImages = options.inlineImages, inlineImages = _options_inlineImages === void 0 ? false : _options_inlineImages, plugins = options.plugins, _options_keepIframeSrcFn = options.keepIframeSrcFn, keepIframeSrcFn = _options_keepIframeSrcFn === void 0 ? function() {
             return false;
         } : _options_keepIframeSrcFn, _options_ignoreCSSAttributes = options.ignoreCSSAttributes, ignoreCSSAttributes = _options_ignoreCSSAttributes === void 0 ? /* @__PURE__ */ new Set([]) : _options_ignoreCSSAttributes, errorHandler2 = options.errorHandler;
         registerErrorHandler(errorHandler2);
+        var validatedOrigins;
+        if (recordCrossOriginIframes && allowedIframeOrigins && allowedIframeOrigins.length > 0) {
+            validatedOrigins = buildAllowedOriginSet(allowedIframeOrigins);
+            if (validatedOrigins.size === 0) {
+                validatedOrigins = void 0;
+            }
+        }
         var inEmittingFrame = recordCrossOriginIframes ? window.parent === window : true;
         var passEmitsToParent = false;
         if (!inEmittingFrame) {
@@ -13408,7 +13448,14 @@
                     origin: window.location.origin,
                     isCheckout: isCheckout
                 };
-                window.parent.postMessage(message, "*");
+                if (validatedOrigins) {
+                    for(var _iterator = _create_for_of_iterator_helper_loose(validatedOrigins), _step; !(_step = _iterator()).done;){
+                        var targetOrigin = _step.value;
+                        window.parent.postMessage(message, targetOrigin);
+                    }
+                } else {
+                    window.parent.postMessage(message, "*");
+                }
             }
             if (e2.type === EventType.FullSnapshot) {
                 lastFullSnapshotEvent = e2;
@@ -21192,7 +21239,7 @@
         };
     }
 
-    var logger$7 = console_with_prefix('lock');
+    var logger$8 = console_with_prefix('lock');
 
     /**
      * SharedLock: a mutex built on HTML5 localStorage, to ensure that only one browser
@@ -21244,7 +21291,7 @@
 
             var delay = function(cb) {
                 if (new Date().getTime() - startTime > timeoutMS) {
-                    logger$7.error('Timeout waiting for mutex on ' + key + '; clearing lock. [' + i + ']');
+                    logger$8.error('Timeout waiting for mutex on ' + key + '; clearing lock. [' + i + ']');
                     storage.removeItem(keyZ);
                     storage.removeItem(keyY);
                     loop();
@@ -21391,7 +21438,7 @@
         }, this));
     };
 
-    var logger$6 = console_with_prefix('batch');
+    var logger$7 = console_with_prefix('batch');
 
     /**
      * RequestQueue: queue for batching API requests with localStorage backup for retries.
@@ -21420,7 +21467,7 @@
                 timeoutMS: options.sharedLockTimeoutMS,
             });
         }
-        this.reportError = options.errorReporter || _.bind(logger$6.error, logger$6);
+        this.reportError = options.errorReporter || _.bind(logger$7.error, logger$7);
 
         this.pid = options.pid || null; // pass pid to test out storage lock contention scenarios
 
@@ -21753,7 +21800,7 @@
     // maximum interval between request retries after exponential backoff
     var MAX_RETRY_INTERVAL_MS = 10 * 60 * 1000; // 10 minutes
 
-    var logger$5 = console_with_prefix('batch');
+    var logger$6 = console_with_prefix('batch');
 
     /**
      * RequestBatcher: manages the queueing, flushing, retry etc of requests of one
@@ -21881,7 +21928,7 @@
      */
     RequestBatcher.prototype.flush = function(options) {
         if (this.requestInProgress) {
-            logger$5.log('Flush: Request already in progress');
+            logger$6.log('Flush: Request already in progress');
             return PromisePolyfill.resolve();
         }
 
@@ -22058,7 +22105,7 @@
                 if (options.unloading) {
                     requestOptions.transport = 'sendBeacon';
                 }
-                logger$5.log('MIXPANEL REQUEST:', dataForRequest);
+                logger$6.log('MIXPANEL REQUEST:', dataForRequest);
                 return this.sendRequestPromise(dataForRequest, requestOptions).then(batchSendCallback);
             }, this))
             .catch(_.bind(function(err) {
@@ -22071,7 +22118,7 @@
      * Log error to global logger and optional user-defined logger.
      */
     RequestBatcher.prototype.reportError = function(msg, err) {
-        logger$5.error.apply(logger$5.error, arguments);
+        logger$6.error.apply(logger$6.error, arguments);
         if (this.errorReporter) {
             try {
                 if (!(err instanceof Error)) {
@@ -22079,7 +22126,7 @@
                 }
                 this.errorReporter(msg, err);
             } catch(err) {
-                logger$5.error(err);
+                logger$6.error(err);
             }
         }
     };
@@ -22096,6 +22143,29 @@
 
     var RECORD_ENQUEUE_THROTTLE_MS = 250;
 
+    var validateAllowedOrigins = function(origins, logger) {
+        if (!_.isArray(origins)) {
+            if (origins) {
+                logger.critical('record_allowed_iframe_origins must be an array of origin strings, cross-origin recording will be disabled.');
+            }
+            return [];
+        }
+        var valid = [];
+        for (var i = 0; i < origins.length; i++) {
+            try {
+                var origin = new URL(origins[i]).origin;
+                if (origin === 'null') {
+                    logger.critical(origins[i] + ' has an opaque origin. Skipping this entry.');
+                    continue;
+                }
+                valid.push(origin);
+            } catch (e) {
+                logger.critical(origins[i] + ' is not a valid origin URL. Skipping this entry.');
+            }
+        }
+        return valid;
+    };
+
     // stateless utils
     // mostly from https://github.com/mixpanel/mixpanel-js/blob/989ada50f518edab47b9c4fd9535f9fbd5ec5fc0/src/autotrack-utils.js
 
@@ -22201,7 +22271,7 @@
 
     var MAX_DEPTH = 5;
 
-    var logger$4 = console_with_prefix('autocapture');
+    var logger$5 = console_with_prefix('autocapture');
 
 
     function getClasses(el) {
@@ -22465,7 +22535,7 @@
                     return false;
                 }
             } catch (err) {
-                logger$4.critical('Error while checking element in allowElementCallback', err);
+                logger$5.critical('Error while checking element in allowElementCallback', err);
                 return false;
             }
         }
@@ -22482,7 +22552,7 @@
                     return true;
                 }
             } catch (err) {
-                logger$4.critical('Error while checking selector: ' + sel, err);
+                logger$5.critical('Error while checking selector: ' + sel, err);
             }
         }
         return false;
@@ -22497,7 +22567,7 @@
                     return true;
                 }
             } catch (err) {
-                logger$4.critical('Error while checking element in blockElementCallback', err);
+                logger$5.critical('Error while checking element in blockElementCallback', err);
                 return true;
             }
         }
@@ -22511,7 +22581,7 @@
                         return true;
                     }
                 } catch (err) {
-                    logger$4.critical('Error while checking selector: ' + sel, err);
+                    logger$5.critical('Error while checking selector: ' + sel, err);
                 }
             }
         }
@@ -23067,7 +23137,7 @@
      *
      */
 
-    var logger$3 = console_with_prefix('network-plugin');
+    var logger$4 = console_with_prefix('network-plugin');
 
     /**
      * Get the time origin for converting performance timestamps to absolute timestamps.
@@ -23219,7 +23289,7 @@
             return str;
         }
         if (str.length > MAX_BODY_SIZE) {
-            logger$3.error('Body truncated from ' + str.length + ' to ' + MAX_BODY_SIZE + ' characters');
+            logger$4.error('Body truncated from ' + str.length + ' to ' + MAX_BODY_SIZE + ' characters');
             return str.substring(0, MAX_BODY_SIZE) + '... [truncated]';
         }
         return str;
@@ -23233,7 +23303,7 @@
      */
     function initPerformanceObserver(cb, win, options) {
         if (!win.PerformanceObserver) {
-            logger$3.error('PerformanceObserver not supported');
+            logger$4.error('PerformanceObserver not supported');
             return function() {
                 //
             };
@@ -23386,7 +23456,7 @@
             attempt = 0;
         }
         if (attempt > 10) {
-            logger$3.error('Cannot find performance entry');
+            logger$4.error('Cannot find performance entry');
             return Promise.resolve(null);
         }
         var urlPerformanceEntries = /** @type {PerformanceResourceTiming[]} */ (
@@ -23507,7 +23577,7 @@
                         )
                             .then(function(entry) {
                                 if (!entry) {
-                                    logger$3.error('Failed to get performance entry for XHR request to ' + req.url);
+                                    logger$4.error('Failed to get performance entry for XHR request to ' + req.url);
                                     return;
                                 }
                                 /** @type {NetworkRequest} */
@@ -23527,7 +23597,7 @@
                                 cb({ requests: [request] });
                             })
                             .catch(function(e) {
-                                logger$3.error('Error recording XHR request to ' + req.url + ': ' + String(e));
+                                logger$4.error('Error recording XHR request to ' + req.url + ': ' + String(e));
                             });
                     });
 
@@ -23619,7 +23689,7 @@
                     })
                     .then(function(entry) {
                         if (!entry) {
-                            logger$3.error('Failed to get performance entry for fetch request to ' + req.url);
+                            logger$4.error('Failed to get performance entry for fetch request to ' + req.url);
                             return;
                         }
                         /** @type {NetworkRequest} */
@@ -23639,7 +23709,7 @@
                         cb({ requests: [request] });
                     })
                     .catch(function (e) {
-                        logger$3.error('Error recording fetch request to ' + req.url + ': ' + String(e));
+                        logger$4.error('Error recording fetch request to ' + req.url + ': ' + String(e));
                     });
 
                 return originalFetchPromise;
@@ -23712,7 +23782,7 @@
      */
 
 
-    var logger$2 = console_with_prefix('recorder');
+    var logger$3 = console_with_prefix('recorder');
     var CompressionStream = win['CompressionStream'];
 
     var RECORDER_BATCHER_LIB_CONFIG = {
@@ -23892,14 +23962,14 @@
         }
 
         if (this._stopRecording !== null) {
-            logger$2.log('Recording already in progress, skipping startRecording.');
+            logger$3.log('Recording already in progress, skipping startRecording.');
             return;
         }
 
         this.recordMaxMs = this.getConfig('record_max_ms');
         if (this.recordMaxMs > MAX_RECORDING_MS) {
             this.recordMaxMs = MAX_RECORDING_MS;
-            logger$2.critical('record_max_ms cannot be greater than ' + MAX_RECORDING_MS + 'ms. Capping value.');
+            logger$3.critical('record_max_ms cannot be greater than ' + MAX_RECORDING_MS + 'ms. Capping value.');
         }
 
         if (!this.maxExpires) {
@@ -23963,6 +24033,8 @@
             );
         }
 
+        var validatedOrigins = validateAllowedOrigins(this.getConfig('record_allowed_iframe_origins'), logger$3);
+
         try {
             this._stopRecording = this._rrwebRecord({
                 'emit': function (ev) {
@@ -23997,6 +24069,8 @@
                 'maskTextSelector': '*',
                 'maskInputFn': this._getMaskFn(shouldMaskInput, privacyConfig),
                 'maskTextFn': this._getMaskFn(shouldMaskText, privacyConfig),
+                'recordCrossOriginIframes': validatedOrigins.length > 0,
+                'allowedIframeOrigins': validatedOrigins,
                 'recordCanvas': this.getConfig('record_canvas'),
                 'sampling': {
                     'canvas': 15
@@ -24221,14 +24295,14 @@
 
 
     SessionRecording.prototype.reportError = function(msg, err) {
-        logger$2.error.apply(logger$2.error, arguments);
+        logger$3.error.apply(logger$3.error, arguments);
         try {
             if (!err && !(msg instanceof Error)) {
                 msg = new Error(msg);
             }
             this.getConfig('error_reporter')(msg, err);
         } catch(err) {
-            logger$2.error(err);
+            logger$3.error(err);
         }
     };
 
@@ -24257,7 +24331,7 @@
         var configValue = this.getConfig('record_min_ms');
 
         if (configValue > MAX_VALUE_FOR_MIN_RECORDING_MS) {
-            logger$2.critical('record_min_ms cannot be greater than ' + MAX_VALUE_FOR_MIN_RECORDING_MS + 'ms. Capping value.');
+            logger$3.critical('record_min_ms cannot be greater than ' + MAX_VALUE_FOR_MIN_RECORDING_MS + 'ms. Capping value.');
             return MAX_VALUE_FOR_MIN_RECORDING_MS;
         }
 
@@ -24420,7 +24494,7 @@
             .catch(this.handleError.bind(this));
     };
 
-    var logger$1 = console_with_prefix('recorder');
+    var logger$2 = console_with_prefix('recorder');
 
     /**
      * Recorder API: bundles rrweb and and exposes methods to start and stop recordings.
@@ -24436,7 +24510,7 @@
          */
         this.recordingRegistry = new RecordingRegistry({
             mixpanelInstance: this.mixpanelInstance,
-            errorReporter: logger$1.error,
+            errorReporter: logger$2.error,
             sharedLockStorage: sharedLockStorage
         });
         this._flushInactivePromise = this.recordingRegistry.flushInactiveRecordings();
@@ -24448,17 +24522,17 @@
     MixpanelRecorder.prototype.startRecording = function(options) {
         options = options || {};
         if (this.activeRecording && !this.activeRecording.isRrwebStopped()) {
-            logger$1.log('Recording already in progress, skipping startRecording.');
+            logger$2.log('Recording already in progress, skipping startRecording.');
             return;
         }
 
         var onIdleTimeout = function () {
-            logger$1.log('Idle timeout reached, restarting recording.');
+            logger$2.log('Idle timeout reached, restarting recording.');
             this.resetRecording();
         }.bind(this);
 
         var onMaxLengthReached = function () {
-            logger$1.log('Max recording length reached, stopping recording.');
+            logger$2.log('Max recording length reached, stopping recording.');
             this.resetRecording();
         }.bind(this);
 
@@ -24528,7 +24602,7 @@
                 } else if (startNewIfInactive) {
                     return this.startRecording({shouldStopBatcher: false});
                 } else {
-                    logger$1.log('No resumable recording found.');
+                    logger$2.log('No resumable recording found.');
                     return null;
                 }
             }.bind(this));
@@ -25193,7 +25267,7 @@
             observer.observe(shadowRoot, this.observerConfig);
             this.shadowObservers.push(observer);
         } catch (e) {
-            logger$4.critical('Error while observing shadow root', e);
+            logger$5.critical('Error while observing shadow root', e);
         }
     };
 
@@ -25204,7 +25278,7 @@
         }
 
         if (!weakSetSupported()) {
-            logger$4.critical('Shadow DOM observation unavailable: WeakSet not supported');
+            logger$5.critical('Shadow DOM observation unavailable: WeakSet not supported');
             return;
         }
 
@@ -25220,7 +25294,7 @@
             try {
                 this.shadowObservers[i].disconnect();
             } catch (e) {
-                logger$4.critical('Error while disconnecting shadow DOM observer', e);
+                logger$5.critical('Error while disconnecting shadow DOM observer', e);
             }
         }
         this.shadowObservers = [];
@@ -25408,7 +25482,7 @@
 
                 this.mutationObserver.observe(document.body || document.documentElement, MUTATION_OBSERVER_CONFIG);
             } catch (e) {
-                logger$4.critical('Error while setting up mutation observer', e);
+                logger$5.critical('Error while setting up mutation observer', e);
             }
         }
 
@@ -25423,7 +25497,7 @@
                 );
                 this.shadowDOMObserver.start();
             } catch (e) {
-                logger$4.critical('Error while setting up shadow DOM observer', e);
+                logger$5.critical('Error while setting up shadow DOM observer', e);
                 this.shadowDOMObserver = null;
             }
         }
@@ -25450,7 +25524,7 @@
             try {
                 listener.target.removeEventListener(listener.event, listener.handler, listener.options);
             } catch (e) {
-                logger$4.critical('Error while removing event listener', e);
+                logger$5.critical('Error while removing event listener', e);
             }
         }
         this.eventListeners = [];
@@ -25459,7 +25533,7 @@
             try {
                 this.mutationObserver.disconnect();
             } catch (e) {
-                logger$4.critical('Error while disconnecting mutation observer', e);
+                logger$5.critical('Error while disconnecting mutation observer', e);
             }
             this.mutationObserver = null;
         }
@@ -25468,7 +25542,7 @@
             try {
                 this.shadowDOMObserver.stop();
             } catch (e) {
-                logger$4.critical('Error while stopping shadow DOM observer', e);
+                logger$5.critical('Error while stopping shadow DOM observer', e);
             }
             this.shadowDOMObserver = null;
         }
@@ -25546,7 +25620,7 @@
 
     Autocapture.prototype.init = function() {
         if (!minDOMApisSupported()) {
-            logger$4.critical('Autocapture unavailable: missing required DOM APIs');
+            logger$5.critical('Autocapture unavailable: missing required DOM APIs');
             return;
         }
         this.initPageListeners();
@@ -25586,7 +25660,7 @@
             try {
                 return !urlMatchesRegexList(currentUrl, allowUrlRegexes);
             } catch (err) {
-                logger$4.critical('Error while checking block URL regexes: ', err);
+                logger$5.critical('Error while checking block URL regexes: ', err);
                 return true;
             }
         }
@@ -25599,7 +25673,7 @@
         try {
             return urlMatchesRegexList(currentUrl, blockUrlRegexes);
         } catch (err) {
-            logger$4.critical('Error while checking block URL regexes: ', err);
+            logger$5.critical('Error while checking block URL regexes: ', err);
             return true;
         }
     };
@@ -25737,7 +25811,7 @@
             return;
         }
 
-        logger$4.log('Initializing scroll depth tracking');
+        logger$5.log('Initializing scroll depth tracking');
 
         this.maxScrollViewDepth = Math.max(document$1.documentElement.clientHeight, win.innerHeight || 0);
 
@@ -25763,7 +25837,7 @@
         if (!this.getConfig(CONFIG_TRACK_CLICK) && !this.mp.get_config('record_heatmap_data')) {
             return;
         }
-        logger$4.log('Initializing click tracking');
+        logger$5.log('Initializing click tracking');
 
         this.listenerClick = function(ev) {
             if (!this.getConfig(CONFIG_TRACK_CLICK) && !this.mp.is_recording_heatmap_data()) {
@@ -25782,7 +25856,7 @@
             return;
         }
 
-        logger$4.log('Initializing dead click tracking');
+        logger$5.log('Initializing dead click tracking');
         if (!this._deadClickTracker) {
             this._deadClickTracker = new DeadClickTracker(function(deadClickEvent) {
                 this.trackDomEvent(deadClickEvent, MP_EV_DEAD_CLICK);
@@ -25816,7 +25890,7 @@
         if (!this.getConfig(CONFIG_TRACK_INPUT)) {
             return;
         }
-        logger$4.log('Initializing input tracking');
+        logger$5.log('Initializing input tracking');
 
         this.listenerChange = function(ev) {
             if (!this.getConfig(CONFIG_TRACK_INPUT)) {
@@ -25833,7 +25907,7 @@
         if (!this.pageviewTrackingConfig()) {
             return;
         }
-        logger$4.log('Initializing pageview tracking');
+        logger$5.log('Initializing pageview tracking');
 
         var previousTrackedUrl = '';
         var tracked = false;
@@ -25868,7 +25942,7 @@
                 }
                 if (didPathChange) {
                     this.lastScrollCheckpoint = 0;
-                    logger$4.log('Path change: re-initializing scroll depth checkpoints');
+                    logger$5.log('Path change: re-initializing scroll depth checkpoints');
                 }
             }
         }.bind(this));
@@ -25883,7 +25957,7 @@
             return;
         }
 
-        logger$4.log('Initializing rage click tracking');
+        logger$5.log('Initializing rage click tracking');
         if (!this._rageClickTracker) {
             this._rageClickTracker = new RageClickTracker();
         }
@@ -25913,7 +25987,7 @@
         if (!this.getConfig(CONFIG_TRACK_SCROLL)) {
             return;
         }
-        logger$4.log('Initializing scroll tracking');
+        logger$5.log('Initializing scroll tracking');
         this.lastScrollCheckpoint = 0;
 
         var scrollTrackFunction = function() {
@@ -25950,7 +26024,7 @@
                     }
                 }
             } catch (err) {
-                logger$4.critical('Error while calculating scroll percentage', err);
+                logger$5.critical('Error while calculating scroll percentage', err);
             }
             if (shouldTrack) {
                 this.mp.track(MP_EV_SCROLL, props);
@@ -25968,7 +26042,7 @@
         if (!this.getConfig(CONFIG_TRACK_SUBMIT)) {
             return;
         }
-        logger$4.log('Initializing submit tracking');
+        logger$5.log('Initializing submit tracking');
 
         this.listenerSubmit = function(ev) {
             if (!this.getConfig(CONFIG_TRACK_SUBMIT)) {
@@ -25990,7 +26064,7 @@
             return;
         }
 
-        logger$4.log('Initializing page visibility tracking.');
+        logger$5.log('Initializing page visibility tracking.');
         this._initScrollDepthTracking();
         var previousTrackedUrl = _.info.currentUrl();
 
@@ -26075,7 +26149,7 @@
         return win[TARGETING_GLOBAL_NAME];
     };
 
-    var logger = console_with_prefix('flags');
+    var logger$1 = console_with_prefix('flags');
     var FLAGS_CONFIG_KEY = 'flags';
 
     var CONFIG_CONTEXT = 'context';
@@ -26118,7 +26192,7 @@
 
     FeatureFlagManager.prototype.init = function() {
         if (!this.minApisSupported()) {
-            logger.critical('Feature Flags unavailable: missing minimum required APIs');
+            logger$1.critical('Feature Flags unavailable: missing minimum required APIs');
             return;
         }
 
@@ -26153,7 +26227,7 @@
 
     FeatureFlagManager.prototype.updateContext = function(newContext, options) {
         if (!this.isSystemEnabled()) {
-            logger.critical('Feature Flags not enabled, cannot update context');
+            logger$1.critical('Feature Flags not enabled, cannot update context');
             return Promise.resolve();
         }
 
@@ -26170,7 +26244,7 @@
 
     FeatureFlagManager.prototype.areFlagsReady = function() {
         if (!this.isSystemEnabled()) {
-            logger.error('Feature Flags not enabled');
+            logger$1.error('Feature Flags not enabled');
         }
         return !!this.flags;
     };
@@ -26183,7 +26257,7 @@
         var distinctId = this.getMpProperty('distinct_id');
         var deviceId = this.getMpProperty('$device_id');
         var traceparent = generateTraceparent();
-        logger.log('Fetching flags for distinct ID: ' + distinctId);
+        logger$1.log('Fetching flags for distinct ID: ' + distinctId);
 
         var context = _.extend({'distinct_id': distinctId, 'device_id': deviceId}, this.getConfig(CONFIG_CONTEXT));
         var searchParams = new URLSearchParams();
@@ -26282,11 +26356,11 @@
                 this._loadTargetingIfNeeded();
             }.bind(this)).catch(function(error) {
                 this.markFetchComplete();
-                logger.error(error);
+                logger$1.error(error);
             }.bind(this));
         }.bind(this)).catch(function(error) {
             this.markFetchComplete();
-            logger.error(error);
+            logger$1.error(error);
         }.bind(this));
 
         return this.fetchPromise;
@@ -26294,7 +26368,7 @@
 
     FeatureFlagManager.prototype.markFetchComplete = function() {
         if (!this._fetchInProgressStartTime) {
-            logger.error('Fetch in progress started time not set, cannot mark fetch complete');
+            logger$1.error('Fetch in progress started time not set, cannot mark fetch complete');
             return;
         }
         this._fetchStartTime = this._fetchInProgressStartTime;
@@ -26316,7 +26390,7 @@
 
         if (hasPropertyFilters) {
             this.getTargeting().then(function() {
-                logger.log('targeting loaded for property filter evaluation');
+                logger$1.log('targeting loaded for property filter evaluation');
             });
         }
     };
@@ -26331,7 +26405,7 @@
             this.loadExtraBundle.bind(this),
             this.targetingSrc
         ).catch(function(error) {
-            logger.error('Failed to load targeting: ' + error);
+            logger$1.error('Failed to load targeting: ' + error);
         }.bind(this));
     };
 
@@ -26385,7 +26459,7 @@
 
             // If no targeting library and event has property filters, skip it
             if (!targeting && pendingEvent['property_filters'] && !_.isEmptyObject(pendingEvent['property_filters'])) {
-                logger.warn('Skipping event check for "' + flagKey + '" - property filters require targeting library');
+                logger$1.warn('Skipping event check for "' + flagKey + '" - property filters require targeting library');
                 return;
             }
 
@@ -26408,7 +26482,7 @@
             }
 
             if (matchResult.error) {
-                logger.error('Error checking first-time event for flag "' + flagKey + '": ' + matchResult.error);
+                logger$1.error('Error checking first-time event for flag "' + flagKey + '": ' + matchResult.error);
                 return;
             }
 
@@ -26416,7 +26490,7 @@
                 return;
             }
 
-            logger.log('First-time event matched for flag "' + flagKey + '": ' + eventName);
+            logger$1.log('First-time event matched for flag "' + flagKey + '": ' + eventName);
 
             var newVariant = {
                 'key': pendingEvent['pending_variant']['variant_key'],
@@ -26457,7 +26531,7 @@
             'first_time_event_hash': firstTimeEventHash
         };
 
-        logger.log('Recording first-time event for flag: ' + flagId);
+        logger$1.log('Recording first-time event for flag: ' + flagId);
 
         // Fire-and-forget POST request
         this.fetch.call(win, url, {
@@ -26470,14 +26544,14 @@
             'body': JSON.stringify(payload)
         }).catch(function(error) {
             // Silent failure - cohort sync will catch up
-            logger.error('Failed to record first-time event for flag ' + flagId + ': ' + error);
+            logger$1.error('Failed to record first-time event for flag ' + flagId + ': ' + error);
         });
     };
 
     FeatureFlagManager.prototype.getVariant = function(featureName, fallback) {
         if (!this.fetchPromise) {
             return new Promise(function(resolve) {
-                logger.critical('Feature Flags not initialized');
+                logger$1.critical('Feature Flags not initialized');
                 resolve(fallback);
             });
         }
@@ -26485,19 +26559,19 @@
         return this.fetchPromise.then(function() {
             return this.getVariantSync(featureName, fallback);
         }.bind(this)).catch(function(error) {
-            logger.error(error);
+            logger$1.error(error);
             return fallback;
         });
     };
 
     FeatureFlagManager.prototype.getVariantSync = function(featureName, fallback) {
         if (!this.areFlagsReady()) {
-            logger.log('Flags not loaded yet');
+            logger$1.log('Flags not loaded yet');
             return fallback;
         }
         var feature = this.flags.get(featureName);
         if (!feature) {
-            logger.log('No flag found: "' + featureName + '"');
+            logger$1.log('No flag found: "' + featureName + '"');
             return fallback;
         }
         this.trackFeatureCheck(featureName, feature);
@@ -26508,14 +26582,14 @@
         return this.getVariant(featureName, {'value': fallbackValue}).then(function(feature) {
             return feature['value'];
         }).catch(function(error) {
-            logger.error(error);
+            logger$1.error(error);
             return fallbackValue;
         });
     };
 
     // TODO remove deprecated method
     FeatureFlagManager.prototype.getFeatureData = function(featureName, fallbackValue) {
-        logger.critical('mixpanel.flags.get_feature_data() is deprecated and will be removed in a future release. Use mixpanel.flags.get_variant_value() instead.');
+        logger$1.critical('mixpanel.flags.get_feature_data() is deprecated and will be removed in a future release. Use mixpanel.flags.get_variant_value() instead.');
         return this.getVariantValue(featureName, fallbackValue);
     };
 
@@ -26527,7 +26601,7 @@
         return this.getVariantValue(featureName).then(function() {
             return this.isEnabledSync(featureName, fallbackValue);
         }.bind(this)).catch(function(error) {
-            logger.error(error);
+            logger$1.error(error);
             return fallbackValue;
         });
     };
@@ -26536,7 +26610,7 @@
         fallbackValue = fallbackValue || false;
         var val = this.getVariantValueSync(featureName, fallbackValue);
         if (val !== true && val !== false) {
-            logger.error('Feature flag "' + featureName + '" value: ' + val + ' is not a boolean; returning fallback value: ' + fallbackValue);
+            logger$1.error('Feature flag "' + featureName + '" value: ' + val + ' is not a boolean; returning fallback value: ' + fallbackValue);
             val = fallbackValue;
         }
         return val;
@@ -26598,6 +26672,12 @@
     /* eslint camelcase: "off" */
 
 
+    var logger = console_with_prefix('recorder');
+
+    var IFRAME_HANDSHAKE_REQUEST  = 'mp_iframe_handshake_request';
+    var IFRAME_HANDSHAKE_RESPONSE = 'mp_iframe_handshake_response';
+
+
     /**
      * RecorderManager: manages session recording initialization, lifecycle and state
      * @constructor
@@ -26617,6 +26697,8 @@
         this.libBasePath = initOptions.libBasePath;
 
         this._recorder = null;
+        this._parentReplayId = null;
+        this._parentFrameRetryInterval = null;
     };
 
     RecorderManager.prototype.shouldLoadRecorder = function() {
@@ -26670,6 +26752,22 @@
             }, this));
         }, this);
 
+        // Cross-origin iframe handling
+        var allowedOrigins = validateAllowedOrigins(this.getMpConfig('record_allowed_iframe_origins'), logger);
+        var isCrossOriginRecordingEnabled = allowedOrigins.length > 0;
+
+        if (isCrossOriginRecordingEnabled) {
+            // listen for handshake requests from their own child iframes (including nested)
+            this._setupParentFrameListener(allowedOrigins);
+
+            if (win.parent !== win) {
+                // also wait for parent's replay ID
+                this._setupChildFrameListener(allowedOrigins, loadRecorder);
+                this._sendParentFrameRequestWithRetry(allowedOrigins);
+                return PromisePolyfill.resolve();
+            }
+        }
+
         /**
          * If the user is sampled or start_session_recording is called, we always load the recorder since it's guaranteed a recording should start.
          * Otherwise, if the recording registry has any records then it's likely there's a recording in progress or orphaned data that needs to be flushed.
@@ -26789,6 +26887,10 @@
     };
 
     RecorderManager.prototype.getSessionReplayId = function() {
+        // Child iframe uses parent's replay ID
+        if (this._parentReplayId) {
+            return this._parentReplayId;
+        }
         var replay_id = null;
         if (this._recorder) {
             replay_id = this._recorder['replayId'];
@@ -26801,6 +26903,86 @@
         return this._recorder;
     };
 
+    RecorderManager.prototype._setupChildFrameListener = function(allowedOrigins, loadRecorder) {
+        if (this._childFrameMessageHandler) {
+            return;
+        }
+        var self = this;
+        this._childFrameMessageHandler = function(event) {
+            if (allowedOrigins.indexOf(event.origin) === -1) return;
+            var data = event.data;
+            if (data && data['type'] === IFRAME_HANDSHAKE_RESPONSE && data['token'] === self.getMpConfig('token') && data['replayId']) {
+                self._parentReplayId = data['replayId'];
+                if (data['distinctId']) {
+                    self.mixpanelInstance['identify'](data['distinctId']);
+                }
+                self._parentFrameRetryActive = false;
+                win.removeEventListener('message', self._childFrameMessageHandler);
+                self._childFrameMessageHandler = null;
+                loadRecorder(true);
+            }
+        };
+        win.addEventListener('message', this._childFrameMessageHandler);
+    };
+
+    RecorderManager.prototype._sendParentFrameRequest = function(allowedOrigins) {
+        var message = {};
+        message['type'] = IFRAME_HANDSHAKE_REQUEST;
+        message['token'] = this.getMpConfig('token');
+        for (var i = 0; i < allowedOrigins.length; i++) {
+            try {
+                win.parent.postMessage(message, allowedOrigins[i]);
+            } catch (e) {
+                // origin mismatch - ignore
+            }
+        }
+    };
+
+    RecorderManager.prototype._sendParentFrameRequestWithRetry = function(allowedOrigins) {
+        var self = this;
+        var maxRetries = 10;
+        var retryCount = 0;
+        var delay = 50;
+        this._parentFrameRetryActive = true;
+
+        this._sendParentFrameRequest(allowedOrigins);
+
+        function scheduleRetry() {
+            setTimeout(function() {
+                if (!self._parentFrameRetryActive || self._parentReplayId || ++retryCount >= maxRetries) {
+                    return;
+                }
+                self._sendParentFrameRequest(allowedOrigins);
+                delay *= 2;
+                scheduleRetry();
+            }, delay);
+        }
+        scheduleRetry();
+    };
+
+    RecorderManager.prototype._setupParentFrameListener = function(allowedOrigins) {
+        if (this._parentFrameMessageHandler) {
+            return;
+        }
+        var self = this;
+        this._parentFrameMessageHandler = function(event) {
+            if (allowedOrigins.indexOf(event.origin) === -1) return;
+            var data = event.data;
+            if (data && data['type'] === IFRAME_HANDSHAKE_REQUEST && data['token'] === self.getMpConfig('token')) {
+                var replayId = self.getSessionReplayId();
+                if (replayId) {
+                    var response = {};
+                    response['type'] = IFRAME_HANDSHAKE_RESPONSE;
+                    response['token'] = self.getMpConfig('token');
+                    response['replayId'] = replayId;
+                    response['distinctId'] = self.getDistinctId();
+                    event.source.postMessage(response, event.origin);
+                }
+            }
+        };
+        win.addEventListener('message', this._parentFrameMessageHandler);
+    };
+
     safewrapClass(RecorderManager);
 
     /* eslint camelcase: "off" */
@@ -28175,7 +28357,6 @@
     /** @const */ var SETTING_FALLBACK      = 'fallback';
     /** @const */ var SETTING_DISABLED      = 'disabled';
 
-
     /*
      * Dynamic... constants? Is that an oxymoron?
      */
@@ -28260,6 +28441,7 @@
         'batch_request_timeout_ms':          90000,
         'batch_autostart':                   true,
         'hooks':                             {},
+        'record_allowed_iframe_origins':     [],
         'record_block_class':                new RegExp('^(mp-block|fs-exclude|amp-block|rr-block|ph-no-capture)$'),
         'record_block_selector':             'img, video, audio',
         'record_canvas':                     false,