[SURF-1836] feat(tag): support custom-domain script attribute

[0xgautam]

Problem

The Surface tag hard-codes forms.withsurface.com for lead identification, journey tracking,
external-form events, and open-trigger lookups. Environments whose forms are served from a
verified custom domain therefore still send tag traffic to the default Surface hostname, and
custom-domain iframes are not part of the tag's postMessage allowlist.

Changes

• Adds a documented data-custom-domain="demo.example.com" script attribute.
• Normalizes hostname or HTTPS-origin values into a shared runtime configuration and safely
  falls back to the current defaults for absent or invalid values.
• Routes lead identification, journey tracking, external-form traffic, and open-trigger lookups
  through https://<custom-domain>/api/v1.
• Adds the exact custom origin to inbound and outbound iframe messaging while preserving the
  existing Surface origins.
• Replaces substring iframe checks with exact URL-origin matching.
• Preserves the explicit SurfaceExternalForm({ serverBaseUrl }) override.
• Keys the open-trigger session cache by API base as well as environment.
• Rebuilds surface_tag.js and surface_embed_v1.js.

Client usage

<script
  src="https://cdn.jsdelivr.net/.../surface_tag.min.js"
  site-id="your-environment-id"
  data-custom-domain="demo.example.com">
</script>

Without the attribute, existing integrations continue to use https://forms.withsurface.com.

Validation

• pnpm typecheck
• pnpm test — 25/25 tests
• pnpm test:unit — 6/6 tests
• pnpm build
• Generated bundle copies verified identical
• git diff --check

[notion-workspace]

Add custom domain attribute support for Surface Tag

[greptile-apps]

Greptile Summary

Adds validated data-custom-domain support so tag API requests and iframe messaging can use a verified HTTPS custom origin while retaining existing Surface origins and default behavior.

• Introduces shared runtime configuration for lead identification, journey tracking, external forms, and open-trigger requests.
• Replaces substring-based iframe checks with exact origin validation.
• Scopes open-trigger session caching by API base and environment.
• Adds focused tests, documentation, and rebuilt browser bundles.

Confidence Score: 5/5

The PR appears safe to merge with no concrete changed-code defects identified.

Custom-domain values are constrained to pathless HTTPS origins, propagated consistently to network and messaging paths, and invalid or absent values preserve existing defaults.

_{Reviews (1): Last reviewed commit: "feat(tag): support custom-domain script ..." | Re-trigger Greptile}