@bidkernel/analytics 0.7.0 → 0.9.0

package/dist/index.js

@@ -24,6 +24,7 @@ __export(src_exports, {
   PrebidEventDeduper: () => PrebidEventDeduper,
   getPrebidEventKey: () => getPrebidEventKey,
   getbidkernel: () => getbidkernel,
+  isTrustedEndpoint: () => isTrustedEndpoint,
   registerPrebidAnalytics: () => registerPrebidAnalytics
 });
 module.exports = __toCommonJS(src_exports);
@@ -34,26 +35,33 @@ var TraceEventType = {
   TRACE_EVENT_TYPE_UNSPECIFIED: 0,
   AUCTION_START: 1,
   AUCTION_END: 2,
-  BID_REQUEST: 3,
-  BID_RESPONSE: 4,
-  BID_WIN: 5,
-  BID_TIMEOUT: 6,
+  BID_RESPONSE: 3,
+  BID_WIN: 4,
   /** IMPRESSION - ad rendered into DOM */
-  IMPRESSION: 7,
+  IMPRESSION: 5,
   /** VIEWABLE - IAB viewability threshold met (boolean, once per render cycle) */
-  VIEWABLE: 8,
+  VIEWABLE: 6,
   /** TIME_IN_VIEW - accumulated in-viewport duration (once per render cycle end) */
-  TIME_IN_VIEW: 14,
-  REFRESH: 9,
-  ERROR: 10,
-  SLOT_DEFINED: 11,
-  SLOT_DESTROYED: 12,
+  TIME_IN_VIEW: 7,
+  REFRESH: 8,
+  ERROR: 9,
+  SLOT_DEFINED: 10,
+  SLOT_DESTROYED: 11,
   /** CLICK - ad click-through */
-  CLICK: 13,
-  /** NO_BID - bidder responded with no bid */
-  NO_BID: 15,
+  CLICK: 12,
   /** AD_RENDER_FAILED - Prebid failed to render the winning ad */
-  AD_RENDER_FAILED: 16,
+  AD_RENDER_FAILED: 13,
+  UNRECOGNIZED: -1
+};
+var BidderOutcome = {
+  BIDDER_OUTCOME_UNSPECIFIED: 0,
+  /** BIDDER_OUTCOME_BID - returned a bid (CPM > 0) */
+  BIDDER_OUTCOME_BID: 1,
+  BIDDER_OUTCOME_NO_BID: 2,
+  BIDDER_OUTCOME_TIMEOUT: 3,
+  BIDDER_OUTCOME_ERROR: 4,
+  /** BIDDER_OUTCOME_NO_RESPONSE - requested, nothing came back by auction end */
+  BIDDER_OUTCOME_NO_RESPONSE: 5,
   UNRECOGNIZED: -1
 };
 function createBaseTraceEventBatch() {
@@ -284,7 +292,8 @@ function createBaseTraceEvent() {
     namespace: "",
     eventId: "",
     metadata: {},
-    viewableDurationMs: void 0
+    viewableDurationMs: void 0,
+    bidderOutcomes: []
   };
 }
 var TraceEvent = {
@@ -322,6 +331,11 @@ var TraceEvent = {
     if (message.viewableDurationMs !== void 0) {
       writer.uint32(89).double(message.viewableDurationMs);
     }
+    if (message.bidderOutcomes !== void 0 && message.bidderOutcomes.length !== 0) {
+      for (const v of message.bidderOutcomes) {
+        BidderOutcomeEntry.encode(v, writer.uint32(98).fork()).join();
+      }
+    }
     return writer;
   },
   decode(input, length) {
@@ -411,6 +425,16 @@ var TraceEvent = {
           message.viewableDurationMs = reader.double();
           continue;
         }
+        case 12: {
+          if (tag !== 98) {
+            break;
+          }
+          const el = BidderOutcomeEntry.decode(reader, reader.uint32());
+          if (el !== void 0) {
+            message.bidderOutcomes.push(el);
+          }
+          continue;
+        }
       }
       if ((tag & 7) === 4 || tag === 0) {
         break;
@@ -443,6 +467,7 @@ var TraceEvent = {
       {}
     );
     message.viewableDurationMs = object.viewableDurationMs ?? void 0;
+    message.bidderOutcomes = object.bidderOutcomes?.map((e) => BidderOutcomeEntry.fromPartial(e)) || [];
     return message;
   }
 };
@@ -498,6 +523,91 @@ var TraceEvent_MetadataEntry = {
     return message;
   }
 };
+function createBaseBidderOutcomeEntry() {
+  return { bidder: "", adUnitCode: "", mediaType: "", outcome: 0, latencyMs: 0 };
+}
+var BidderOutcomeEntry = {
+  encode(message, writer = new import_wire.BinaryWriter()) {
+    if (message.bidder !== void 0 && message.bidder !== "") {
+      writer.uint32(10).string(message.bidder);
+    }
+    if (message.adUnitCode !== void 0 && message.adUnitCode !== "") {
+      writer.uint32(18).string(message.adUnitCode);
+    }
+    if (message.mediaType !== void 0 && message.mediaType !== "") {
+      writer.uint32(26).string(message.mediaType);
+    }
+    if (message.outcome !== void 0 && message.outcome !== 0) {
+      writer.uint32(32).int32(message.outcome);
+    }
+    if (message.latencyMs !== void 0 && message.latencyMs !== 0) {
+      writer.uint32(41).double(message.latencyMs);
+    }
+    return writer;
+  },
+  decode(input, length) {
+    const reader = input instanceof import_wire.BinaryReader ? input : new import_wire.BinaryReader(input);
+    const end = length === void 0 ? reader.len : reader.pos + length;
+    const message = createBaseBidderOutcomeEntry();
+    while (reader.pos < end) {
+      const tag = reader.uint32();
+      switch (tag >>> 3) {
+        case 1: {
+          if (tag !== 10) {
+            break;
+          }
+          message.bidder = reader.string();
+          continue;
+        }
+        case 2: {
+          if (tag !== 18) {
+            break;
+          }
+          message.adUnitCode = reader.string();
+          continue;
+        }
+        case 3: {
+          if (tag !== 26) {
+            break;
+          }
+          message.mediaType = reader.string();
+          continue;
+        }
+        case 4: {
+          if (tag !== 32) {
+            break;
+          }
+          message.outcome = reader.int32();
+          continue;
+        }
+        case 5: {
+          if (tag !== 41) {
+            break;
+          }
+          message.latencyMs = reader.double();
+          continue;
+        }
+      }
+      if ((tag & 7) === 4 || tag === 0) {
+        break;
+      }
+      reader.skip(tag & 7);
+    }
+    return message;
+  },
+  create(base) {
+    return BidderOutcomeEntry.fromPartial(base ?? {});
+  },
+  fromPartial(object) {
+    const message = createBaseBidderOutcomeEntry();
+    message.bidder = object.bidder ?? "";
+    message.adUnitCode = object.adUnitCode ?? "";
+    message.mediaType = object.mediaType ?? "";
+    message.outcome = object.outcome ?? 0;
+    message.latencyMs = object.latencyMs ?? 0;
+    return message;
+  }
+};
 function createBaseBidTrace() {
   return {
     bidder: "",
@@ -658,6 +768,8 @@ var MAX_QUEUE_SIZE = 200;
 var MAX_SEND_BACKOFF_MS = 5 * 60 * 1e3;
 var MAX_CONSECUTIVE_SEND_FAILURES = 10;
 var MAX_PAYLOAD_BYTES = 32 * 1024;
+var MAX_METADATA_VALUE_CHARS = 1024;
+var MAX_METADATA_ENTRIES = 16;
 var SAFE_CONTENT_TYPE = "text/plain";
 var PENDING_BATCH_KEY_PREFIX = "_bidkernel_pending_";
 var MAX_PENDING_BATCHES = 20;
@@ -666,11 +778,8 @@ var PENDING_BATCH_CLEANUP_DELAY_MS = 1e4;
 var EVENT_NAME_TO_TYPE = {
   auctionStart: TraceEventType.AUCTION_START,
   auctionEnd: TraceEventType.AUCTION_END,
-  bidRequest: TraceEventType.BID_REQUEST,
   bidResponse: TraceEventType.BID_RESPONSE,
-  bidTimeout: TraceEventType.BID_TIMEOUT,
   bidWin: TraceEventType.BID_WIN,
-  noBid: TraceEventType.NO_BID,
   adRenderFailed: TraceEventType.AD_RENDER_FAILED,
   click: TraceEventType.CLICK,
   impression: TraceEventType.IMPRESSION,
@@ -683,6 +792,10 @@ var IMMEDIATE_FLUSH_TYPES = /* @__PURE__ */ new Set([
   TraceEventType.BID_WIN,
   TraceEventType.CLICK
 ]);
+var CACHED_BID_TTL_MS = 30 * 60 * 1e3;
+var MAX_CACHED_BID_KEYS = 200;
+var MAX_IMPRESSION_KEYS = 1e3;
+var MAX_TRACKED_AUCTIONS = 50;
 var SESSION_KEY = "_bidkernel_session";
 var SESSION_TS_KEY = "_bidkernel_session_ts";
 var THIRTY_MINUTES_MS = 30 * 60 * 1e3;
@@ -714,6 +827,46 @@ function base64ToBytes(b64) {
   }
   return bytes;
 }
+function isTrustedEndpoint(raw) {
+  if (!raw) return false;
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return false;
+  }
+  if (url.username || url.password) return false;
+  if (url.protocol === "https:") return true;
+  if (url.protocol === "http:") {
+    return url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  }
+  return false;
+}
+function boundMetadata(metadata) {
+  const bounded = {};
+  let count = 0;
+  for (const key of Object.keys(metadata)) {
+    if (count >= MAX_METADATA_ENTRIES) break;
+    const value = metadata[key];
+    if (value === void 0 || value === null) continue;
+    const str = String(value);
+    bounded[key] = str.length > MAX_METADATA_VALUE_CHARS ? `${str.slice(0, MAX_METADATA_VALUE_CHARS)}...[truncated]` : str;
+    count++;
+  }
+  return bounded;
+}
+function isLegacyPendingKey(key) {
+  const parts = key.slice(PENDING_BATCH_KEY_PREFIX.length).split("_");
+  return parts.length === 2 && /^\d+$/.test(parts[0]);
+}
+function sameEndpointOrigin(a, b) {
+  if (!a || !b) return false;
+  try {
+    return new URL(a).origin === new URL(b).origin;
+  } catch {
+    return false;
+  }
+}
 function extendSession() {
   const now = Date.now();
   inMemorySessionTs = now;
@@ -830,22 +983,6 @@ var PrebidEventDeduper = class {
     return false;
   }
 };
-function parseSize(raw) {
-  if (!raw) return { width: 0, height: 0 };
-  let cur = raw;
-  while (Array.isArray(cur) && cur.length > 0 && Array.isArray(cur[0])) {
-    cur = cur[0];
-  }
-  if (Array.isArray(cur) && cur.length >= 2) {
-    const w = Number(cur[0]);
-    const h = Number(cur[1]);
-    return {
-      width: Number.isFinite(w) ? w : 0,
-      height: Number.isFinite(h) ? h : 0
-    };
-  }
-  return { width: 0, height: 0 };
-}
 function parseBidDimensions(bid) {
   if (Number.isFinite(bid?.width) && Number.isFinite(bid?.height)) {
     return { width: bid.width, height: bid.height };
@@ -897,9 +1034,13 @@ var BidkernelPrebidAnalytics = class _BidkernelPrebidAnalytics {
   cachedWinningBids = /* @__PURE__ */ new Map();
   // Active video player attachment cleanup routines
   videoDetachCleanups = /* @__PURE__ */ new Set();
+  // Compacted bidder participation map per auction: auctionId -> Map<`${bidder}:${adUnitCode}`, BidderOutcomeEntry>
+  auctionBidderOutcomes = /* @__PURE__ */ new Map();
   constructor(config) {
+    const requestedEndpoint = config.endpoint || "";
+    const endpoint = !requestedEndpoint || isTrustedEndpoint(requestedEndpoint) ? requestedEndpoint : "";
     this.config = {
-      endpoint: config.endpoint || "",
+      endpoint,
       propertyId: config.propertyId || "",
       pageviewId: config.pageviewId || generateUUID(),
       sessionId: config.sessionId || getOrCreateSessionId(),
@@ -915,6 +1056,12 @@ var BidkernelPrebidAnalytics = class _BidkernelPrebidAnalytics {
       pbjsGlobalName: config.pbjsGlobalName || "pbjs",
       attachPbjsListeners: config.attachPbjsListeners ?? true
     };
+    if (requestedEndpoint && !endpoint) {
+      this.log(
+        "ERROR",
+        `Rejected untrusted analytics endpoint ${requestedEndpoint}: must be an absolute https:// URL without embedded credentials. Events will not be transmitted.`
+      );
+    }
     this.boundFlushBeacon = () => {
       this.flushAllSlotsTimeInView();
       this.flushBeacon();
@@ -1052,6 +1199,7 @@ var BidkernelPrebidAnalytics = class _BidkernelPrebidAnalytics {
     this.cachedWinningBids.clear();
     this.slotEmittedImpressionKeys.clear();
     this.slotLastAuctionIds.clear();
+    this.auctionBidderOutcomes.clear();
     if (this.flushTimer) {
       clearInterval(this.flushTimer);
       this.flushTimer = null;
@@ -1455,7 +1603,73 @@ var BidkernelPrebidAnalytics = class _BidkernelPrebidAnalytics {
         this.slotEmittedImpressionKeys.delete(key);
       }
     }
-    this.cachedWinningBids.delete(slotId);
+    const cached = this.cachedWinningBids.get(slotId);
+    if (cached) this.deleteCachedBidEntry(cached);
+  }
+  // --- Bounded caches -------------------------------------------------------
+  /**
+   * Reads a cached winning bid, treating an entry past CACHED_BID_TTL_MS as
+   * absent and dropping it. Every read goes through here so a stale bid can
+   * never be married to a much later render.
+   */
+  getCachedBid(key) {
+    const entry = this.cachedWinningBids.get(key);
+    if (!entry) return void 0;
+    if (Date.now() - entry.timestamp > CACHED_BID_TTL_MS) {
+      this.deleteCachedBidEntry(entry);
+      return void 0;
+    }
+    return entry;
+  }
+  /** Removes every alias pointing at one entry. Aliases are stored by identity. */
+  deleteCachedBidEntry(entry) {
+    for (const [key, value] of Array.from(this.cachedWinningBids)) {
+      if (value === entry) this.cachedWinningBids.delete(key);
+    }
+  }
+  /**
+   * Drops expired entries, then evicts oldest-first until the key cap holds.
+   * Map iterates in insertion order and one win's aliases are written
+   * consecutively, so eviction takes a whole bid's aliases together.
+   */
+  pruneCachedWinningBids() {
+    const now = Date.now();
+    for (const [key, entry] of Array.from(this.cachedWinningBids)) {
+      if (now - entry.timestamp > CACHED_BID_TTL_MS) this.cachedWinningBids.delete(key);
+    }
+    while (this.cachedWinningBids.size > MAX_CACHED_BID_KEYS) {
+      const oldest = this.cachedWinningBids.keys().next();
+      if (oldest.done) break;
+      this.cachedWinningBids.delete(oldest.value);
+    }
+  }
+  /** Records a dedup key, evicting oldest-first at the cap. */
+  addImpressionKey(key) {
+    if (this.slotEmittedImpressionKeys.has(key)) return;
+    while (this.slotEmittedImpressionKeys.size >= MAX_IMPRESSION_KEYS) {
+      const oldest = this.slotEmittedImpressionKeys.values().next();
+      if (oldest.done) break;
+      this.slotEmittedImpressionKeys.delete(oldest.value);
+    }
+    this.slotEmittedImpressionKeys.add(key);
+  }
+  /**
+   * The bidder-outcome map for an auction, creating it if absent. Evicts the
+   * oldest auction at the cap: without this, any auction whose auctionEnd never
+   * fires (abandoned, navigated away from mid-flight) leaks its map forever.
+   */
+  getOrCreateAuctionOutcomes(auctionId) {
+    let auctionMap = this.auctionBidderOutcomes.get(auctionId);
+    if (!auctionMap) {
+      auctionMap = /* @__PURE__ */ new Map();
+      this.auctionBidderOutcomes.set(auctionId, auctionMap);
+    }
+    while (this.auctionBidderOutcomes.size > MAX_TRACKED_AUCTIONS) {
+      const oldest = this.auctionBidderOutcomes.keys().next();
+      if (oldest.done || oldest.value === auctionId) break;
+      this.auctionBidderOutcomes.delete(oldest.value);
+    }
+    return auctionMap;
   }
   hasImpressionEmitted(slotId, refreshIndex, auctionId, creativeId) {
     const rIndex = refreshIndex ?? this.slotRefreshIndices.get(slotId) ?? 0;
@@ -1475,14 +1689,14 @@ var BidkernelPrebidAnalytics = class _BidkernelPrebidAnalytics {
   }
   markImpressionEmitted(slotId, refreshIndex, auctionId, creativeId) {
     const baseSlotKey = `${escapeKeyPart(slotId)}:${refreshIndex}`;
-    this.slotEmittedImpressionKeys.add(baseSlotKey);
+    this.addImpressionKey(baseSlotKey);
     if (creativeId) {
-      this.slotEmittedImpressionKeys.add(`${baseSlotKey}:${escapeKeyPart(creativeId)}`);
+      this.addImpressionKey(`${baseSlotKey}:${escapeKeyPart(creativeId)}`);
     }
     if (auctionId) {
-      this.slotEmittedImpressionKeys.add(`${baseSlotKey}:auc:${escapeKeyPart(auctionId)}`);
+      this.addImpressionKey(`${baseSlotKey}:auc:${escapeKeyPart(auctionId)}`);
       if (creativeId) {
-        this.slotEmittedImpressionKeys.add(
+        this.addImpressionKey(
           `${baseSlotKey}:auc:${escapeKeyPart(auctionId)}:${escapeKeyPart(creativeId)}`
         );
       }
@@ -1492,7 +1706,7 @@ var BidkernelPrebidAnalytics = class _BidkernelPrebidAnalytics {
     if (!this.isEnabled) return false;
     const resolvedSlotId = slotId || options?.adUnitCode || "";
     const adUnitCode = options?.adUnitCode || resolvedSlotId;
-    const cached = (options?.auctionId && resolvedSlotId ? this.cachedWinningBids.get(`${options.auctionId}:${resolvedSlotId}`) : void 0) || (options?.auctionId && adUnitCode ? this.cachedWinningBids.get(`${options.auctionId}:${adUnitCode}`) : void 0) || (resolvedSlotId ? this.cachedWinningBids.get(resolvedSlotId) : void 0) || (adUnitCode ? this.cachedWinningBids.get(adUnitCode) : void 0);
+    const cached = (options?.auctionId && resolvedSlotId ? this.getCachedBid(`${options.auctionId}:${resolvedSlotId}`) : void 0) || (options?.auctionId && adUnitCode ? this.getCachedBid(`${options.auctionId}:${adUnitCode}`) : void 0) || (resolvedSlotId ? this.getCachedBid(resolvedSlotId) : void 0) || (adUnitCode ? this.getCachedBid(adUnitCode) : void 0);
     const rawBid = options?.bid || cached?.rawBid || {};
     const auctionId = options?.auctionId || rawBid.auctionId || cached?.auctionId || "";
     const transactionId = options?.transactionId || rawBid.transactionId || cached?.transactionId || "";
@@ -1593,7 +1807,7 @@ var BidkernelPrebidAnalytics = class _BidkernelPrebidAnalytics {
     const auctionId = options?.auctionId || "";
     const transactionId = options?.transactionId || "";
     const getWinningBid = () => {
-      return (auctionId ? this.cachedWinningBids.get(`${auctionId}:${adUnitCode}`) : void 0) || (auctionId && slotId !== adUnitCode ? this.cachedWinningBids.get(`${auctionId}:${slotId}`) : void 0) || this.cachedWinningBids.get(adUnitCode) || (slotId !== adUnitCode ? this.cachedWinningBids.get(slotId) : void 0);
+      return (auctionId ? this.getCachedBid(`${auctionId}:${adUnitCode}`) : void 0) || (auctionId && slotId !== adUnitCode ? this.getCachedBid(`${auctionId}:${slotId}`) : void 0) || this.getCachedBid(adUnitCode) || (slotId !== adUnitCode ? this.getCachedBid(slotId) : void 0);
     };
     const onAdStartedOrImpression = (event) => {
       this.log("DEBUG", "IMA AdEvent.STARTED / IMPRESSION received", event);
@@ -1757,7 +1971,7 @@ var BidkernelPrebidAnalytics = class _BidkernelPrebidAnalytics {
     const auctionId = options?.auctionId || "";
     const transactionId = options?.transactionId || "";
     const getWinningBid = () => {
-      return (auctionId ? this.cachedWinningBids.get(`${auctionId}:${adUnitCode}`) : void 0) || (auctionId && slotId !== adUnitCode ? this.cachedWinningBids.get(`${auctionId}:${slotId}`) : void 0) || this.cachedWinningBids.get(adUnitCode) || (slotId !== adUnitCode ? this.cachedWinningBids.get(slotId) : void 0);
+      return (auctionId ? this.getCachedBid(`${auctionId}:${adUnitCode}`) : void 0) || (auctionId && slotId !== adUnitCode ? this.getCachedBid(`${auctionId}:${slotId}`) : void 0) || this.getCachedBid(adUnitCode) || (slotId !== adUnitCode ? this.getCachedBid(slotId) : void 0);
     };
     let videoEl = null;
     if (el) {
@@ -1993,6 +2207,10 @@ var BidkernelPrebidAnalytics = class _BidkernelPrebidAnalytics {
       refreshIndex: record.refreshIndex
     };
   }
+  /** The validated ingest endpoint in use, or "" when none passed validation. */
+  getEndpoint() {
+    return this.config.endpoint;
+  }
   getRefreshIndex(slotId) {
     return this.slotRefreshIndices.get(slotId) ?? 0;
   }
@@ -2033,17 +2251,29 @@ var BidkernelPrebidAnalytics = class _BidkernelPrebidAnalytics {
   handleAuctionInit(data) {
     if (this.isDuplicate("auctionInit", data)) return;
     this.log("DEBUG", "auctionInit", data);
+    const auctionId = data.auctionId || "";
+    if (auctionId) {
+      this.auctionBidderOutcomes.delete(auctionId);
+      this.getOrCreateAuctionOutcomes(auctionId);
+    }
     this.enqueue(TraceEventType.AUCTION_START, "auctionStart", {
-      auctionId: data.auctionId || "",
+      auctionId,
       transactionId: data.transactionId || ""
     });
   }
   handleAuctionEnd(data) {
     if (this.isDuplicate("auctionEnd", data)) return;
     this.log("DEBUG", "auctionEnd", data);
+    const auctionId = data.auctionId || "";
+    const outcomesMap = auctionId ? this.auctionBidderOutcomes.get(auctionId) : void 0;
+    const bidderOutcomes = outcomesMap ? Array.from(outcomesMap.values()) : [];
+    if (auctionId) {
+      this.auctionBidderOutcomes.delete(auctionId);
+    }
     this.enqueue(TraceEventType.AUCTION_END, "auctionEnd", {
-      auctionId: data.auctionId || "",
-      transactionId: data.transactionId || ""
+      auctionId,
+      transactionId: data.transactionId || "",
+      bidderOutcomes
     });
   }
   handleBidRequested(data) {
@@ -2051,88 +2281,99 @@ var BidkernelPrebidAnalytics = class _BidkernelPrebidAnalytics {
     this.log("DEBUG", "bidRequested", data);
     const auctionId = data.auctionId || "";
     const bidder = data.bidderCode || data.bidder || "";
+    if (!auctionId || !bidder) return;
+    const auctionMap = this.getOrCreateAuctionOutcomes(auctionId);
     if (Array.isArray(data.bids)) {
       data.bids.forEach((bid) => {
+        const adUnitCode = bid.adUnitCode || "";
         const mediaTypes = Object.keys(bid.mediaTypes || {});
-        const gpid = bid.ortb2Imp?.ext?.gpid || bid.gpid || data.gpid || "";
-        const transactionId = bid.transactionId || bid.ortb2Imp?.id || data.transactionId || "";
-        if (mediaTypes.length === 0) {
-          const mediaType = bid.mediaType || "banner";
-          const { width, height } = parseSize(bid.sizes || bid.playerSize);
-          this.enqueue(TraceEventType.BID_REQUEST, "bidRequest", {
-            auctionId,
-            transactionId,
-            adUnitCode: bid.adUnitCode || "",
-            gpid,
-            bid: {
-              bidder,
-              mediaType,
-              width,
-              height
-            }
+        const mediaType = mediaTypes.length > 0 ? mediaTypes[0] : bid.mediaType || "banner";
+        const key = `${bidder}:${adUnitCode}`;
+        if (!auctionMap.has(key)) {
+          auctionMap.set(key, {
+            bidder,
+            adUnitCode,
+            mediaType,
+            outcome: BidderOutcome.BIDDER_OUTCOME_NO_RESPONSE,
+            latencyMs: 0
           });
-          return;
         }
-        mediaTypes.forEach((mediaType) => {
-          let rawSize = null;
-          if (mediaType === "banner") {
-            rawSize = bid.mediaTypes?.banner?.sizes || bid.sizes;
-          } else if (mediaType === "video") {
-            rawSize = bid.mediaTypes?.video?.playerSize || bid.mediaTypes?.video?.sizes || bid.playerSize;
-          } else {
-            rawSize = bid.mediaTypes?.[mediaType]?.sizes;
-          }
-          const { width, height } = parseSize(rawSize);
-          this.enqueue(TraceEventType.BID_REQUEST, "bidRequest", {
-            auctionId,
-            transactionId,
-            adUnitCode: bid.adUnitCode || "",
-            gpid,
-            bid: {
-              bidder,
-              mediaType,
-              width,
-              height
-            }
-          });
-        });
       });
     }
   }
   handleBidResponse(data) {
     if (this.isDuplicate("bidResponse", data)) return;
     this.log("DEBUG", "bidResponse", data);
-    this.enqueue(TraceEventType.BID_RESPONSE, "bidResponse", {
-      auctionId: data.auctionId || "",
-      transactionId: data.transactionId || "",
-      adUnitCode: data.adUnitCode || "",
-      bid: {
-        bidder: data.bidderCode || data.bidder || "",
-        cpm: Number.isFinite(data.originalCpm) ? data.originalCpm : Number.isFinite(data.cpm) ? data.cpm : 0,
-        currency: data.originalCurrency ?? data.currency ?? "USD",
-        ...parseBidDimensions(data),
-        dealId: data.dealId || "",
-        mediaType: data.mediaType || "banner",
-        latencyMs: Number.isFinite(data.timeToRespond) ? data.timeToRespond : 0,
-        advertiserDomain: data.meta?.advertiserDomains?.[0] || "",
-        creativeId: data.creativeId || ""
+    const auctionId = data.auctionId || "";
+    const bidder = data.bidderCode || data.bidder || "";
+    const adUnitCode = data.adUnitCode || "";
+    const cpm = Number.isFinite(data.originalCpm) ? data.originalCpm : Number.isFinite(data.cpm) ? data.cpm : 0;
+    const latencyMs = Number.isFinite(data.timeToRespond) ? data.timeToRespond : 0;
+    const mediaType = data.mediaType || "banner";
+    if (auctionId && bidder) {
+      const auctionMap = this.getOrCreateAuctionOutcomes(auctionId);
+      const key = `${bidder}:${adUnitCode}`;
+      const entry = auctionMap.get(key);
+      const outcome = cpm > 0 ? BidderOutcome.BIDDER_OUTCOME_BID : BidderOutcome.BIDDER_OUTCOME_NO_BID;
+      if (entry) {
+        entry.outcome = outcome;
+        entry.latencyMs = latencyMs;
+        if (mediaType) entry.mediaType = mediaType;
+      } else {
+        auctionMap.set(key, {
+          bidder,
+          adUnitCode,
+          mediaType,
+          outcome,
+          latencyMs
+        });
       }
-    });
+    }
+    if (cpm > 0) {
+      this.enqueue(TraceEventType.BID_RESPONSE, "bidResponse", {
+        auctionId,
+        transactionId: data.transactionId || "",
+        adUnitCode,
+        bid: {
+          bidder,
+          cpm,
+          currency: data.originalCurrency ?? data.currency ?? "USD",
+          ...parseBidDimensions(data),
+          dealId: data.dealId || "",
+          mediaType,
+          latencyMs,
+          advertiserDomain: data.meta?.advertiserDomains?.[0] || "",
+          creativeId: data.creativeId || ""
+        }
+      });
+    }
   }
   handleBidTimeout(data) {
     if (this.isDuplicate("bidTimeout", data)) return;
     this.log("DEBUG", "bidTimeout", data);
     const items = Array.isArray(data) ? data : data ? [data] : [];
     for (const t of items) {
-      this.enqueue(TraceEventType.BID_TIMEOUT, "bidTimeout", {
-        auctionId: t.auctionId || "",
-        transactionId: t.transactionId || "",
-        adUnitCode: t.adUnitCode || "",
-        bid: {
-          bidder: t.bidderCode || t.bidder || "",
-          latencyMs: Number.isFinite(t.timeout) ? t.timeout : 0
+      const auctionId = t.auctionId || "";
+      const bidder = t.bidderCode || t.bidder || "";
+      const adUnitCode = t.adUnitCode || "";
+      const latencyMs = Number.isFinite(t.timeout) ? t.timeout : 0;
+      if (auctionId && bidder) {
+        const auctionMap = this.getOrCreateAuctionOutcomes(auctionId);
+        const key = `${bidder}:${adUnitCode}`;
+        const entry = auctionMap.get(key);
+        if (entry) {
+          entry.outcome = BidderOutcome.BIDDER_OUTCOME_TIMEOUT;
+          if (latencyMs > 0) entry.latencyMs = latencyMs;
+        } else {
+          auctionMap.set(key, {
+            bidder,
+            adUnitCode,
+            mediaType: "banner",
+            outcome: BidderOutcome.BIDDER_OUTCOME_TIMEOUT,
+            latencyMs
+          });
         }
-      });
+      }
     }
   }
   handleBidWon(data) {
@@ -2171,6 +2412,7 @@ var BidkernelPrebidAnalytics = class _BidkernelPrebidAnalytics {
           this.cachedWinningBids.set(`${auctionId}:${data.adId}`, cachedEntry);
         }
       }
+      this.pruneCachedWinningBids();
     }
     this.enqueue(TraceEventType.BID_WIN, "bidWon", {
       auctionId,
@@ -2182,14 +2424,27 @@ var BidkernelPrebidAnalytics = class _BidkernelPrebidAnalytics {
   handleNoBid(data) {
     if (this.isDuplicate("noBid", data)) return;
     this.log("DEBUG", "noBid", data);
-    this.enqueue(TraceEventType.NO_BID, "noBid", {
-      auctionId: data.auctionId || "",
-      transactionId: data.transactionId || "",
-      adUnitCode: data.adUnitCode || "",
-      bid: {
-        bidder: data.bidderCode || data.bidder || ""
+    const auctionId = data.auctionId || "";
+    const bidder = data.bidderCode || data.bidder || "";
+    const adUnitCode = data.adUnitCode || "";
+    if (auctionId && bidder) {
+      const auctionMap = this.getOrCreateAuctionOutcomes(auctionId);
+      const key = `${bidder}:${adUnitCode}`;
+      const entry = auctionMap.get(key);
+      if (entry) {
+        if (entry.outcome === BidderOutcome.BIDDER_OUTCOME_NO_RESPONSE) {
+          entry.outcome = BidderOutcome.BIDDER_OUTCOME_NO_BID;
+        }
+      } else {
+        auctionMap.set(key, {
+          bidder,
+          adUnitCode,
+          mediaType: "banner",
+          outcome: BidderOutcome.BIDDER_OUTCOME_NO_BID,
+          latencyMs: 0
+        });
       }
-    });
+    }
   }
   handleAdRenderFailed(data) {
     if (this.isDuplicate("adRenderFailed", data)) return;
@@ -2221,7 +2476,7 @@ var BidkernelPrebidAnalytics = class _BidkernelPrebidAnalytics {
     const mediaType = bid.mediaType || "banner";
     const slotKey = data.adUnitCode || bid.adUnitCode || "";
     const altKey = data.adId || bid.adId || "";
-    const cached = (auctionId && slotKey ? this.cachedWinningBids.get(`${auctionId}:${slotKey}`) : void 0) || (auctionId && altKey ? this.cachedWinningBids.get(`${auctionId}:${altKey}`) : void 0) || (slotKey ? this.cachedWinningBids.get(slotKey) : void 0) || (altKey ? this.cachedWinningBids.get(altKey) : void 0);
+    const cached = (auctionId && slotKey ? this.getCachedBid(`${auctionId}:${slotKey}`) : void 0) || (auctionId && altKey ? this.getCachedBid(`${auctionId}:${altKey}`) : void 0) || (slotKey ? this.getCachedBid(slotKey) : void 0) || (altKey ? this.getCachedBid(altKey) : void 0);
     const bidTrace = {
       bidder: bid.bidderCode || bid.bidder || cached?.bidTrace?.bidder || "",
       cpm: Number.isFinite(bid.originalCpm) ? bid.originalCpm : Number.isFinite(bid.cpm) ? bid.cpm : cached?.bidTrace?.cpm ?? 0,
@@ -2310,7 +2565,12 @@ var BidkernelPrebidAnalytics = class _BidkernelPrebidAnalytics {
       }
       if (!el && targetId) {
         try {
-          el = document.querySelector(`[data-ad-slot="${targetId}"]`) || document.querySelector(`#${targetId}`);
+          for (const candidate of Array.from(document.querySelectorAll("[data-ad-slot]"))) {
+            if (candidate.getAttribute("data-ad-slot") === targetId) {
+              el = candidate;
+              break;
+            }
+          }
         } catch {
         }
       }
@@ -2364,6 +2624,9 @@ var BidkernelPrebidAnalytics = class _BidkernelPrebidAnalytics {
     if (data.viewableDurationMs !== void 0) {
       protoEvent.viewableDurationMs = Number.isFinite(data.viewableDurationMs) ? data.viewableDurationMs : 0;
     }
+    if (data.bidderOutcomes && Array.isArray(data.bidderOutcomes)) {
+      protoEvent.bidderOutcomes = data.bidderOutcomes;
+    }
     const metadata = { ...data.metadata };
     if (data.error !== void 0 && data.error !== null) {
       metadata.error = typeof data.error === "object" && data.error.message ? String(data.error.message) : String(data.error);
@@ -2374,8 +2637,9 @@ var BidkernelPrebidAnalytics = class _BidkernelPrebidAnalytics {
     if (data.refreshIndex !== void 0 && metadata.refresh_index === void 0) {
       metadata.refresh_index = String(data.refreshIndex);
     }
-    if (Object.keys(metadata).length > 0) {
-      protoEvent.metadata = metadata;
+    const boundedMetadata = boundMetadata(metadata);
+    if (Object.keys(boundedMetadata).length > 0) {
+      protoEvent.metadata = boundedMetadata;
     }
     this.queue.push(protoEvent);
     if (this.queue.length > MAX_QUEUE_SIZE) {
@@ -2413,7 +2677,6 @@ var BidkernelPrebidAnalytics = class _BidkernelPrebidAnalytics {
   // Shared by flush() and flushBeacon().
   drainBatch() {
     if (this.queue.length === 0 || !this.config.endpoint) return null;
-    let events = this.queue;
     const domain = typeof window !== "undefined" ? window.location.hostname : "";
     const buildBatch = (evts) => ({
       propertyId: this.config.propertyId,
@@ -2427,25 +2690,37 @@ var BidkernelPrebidAnalytics = class _BidkernelPrebidAnalytics {
       domain,
       events: evts
     });
-    let encoded = TraceEventBatch.encode(
-      buildBatch(events)
-    ).finish();
-    while (events.length > 1 && encoded.byteLength > MAX_PAYLOAD_BYTES) {
-      events = events.slice(0, Math.floor(events.length / 2));
-      encoded = TraceEventBatch.encode(
+    for (; ; ) {
+      if (this.queue.length === 0) return null;
+      let events = this.queue;
+      let encoded = TraceEventBatch.encode(
         buildBatch(events)
       ).finish();
+      while (events.length > 1 && encoded.byteLength > MAX_PAYLOAD_BYTES) {
+        events = events.slice(0, Math.floor(events.length / 2));
+        encoded = TraceEventBatch.encode(
+          buildBatch(events)
+        ).finish();
+      }
+      if (encoded.byteLength > MAX_PAYLOAD_BYTES) {
+        const [dropped] = this.queue.splice(0, 1);
+        this.log(
+          "WARN",
+          `Dropping oversized event ${dropped?.eventName || dropped?.eventId} (${encoded.byteLength} bytes exceeds the ${MAX_PAYLOAD_BYTES}-byte cap on its own)`
+        );
+        continue;
+      }
+      this.queue = this.queue.slice(events.length);
+      return {
+        url: `${this.config.endpoint}/${this.config.propertyId}`,
+        // protobufjs types finish() as Uint8Array<ArrayBufferLike>; the buffer is
+        // always a plain ArrayBuffer, so narrow for fetch/Blob compatibility.
+        encoded,
+        events
+      };
     }
-    this.queue = this.queue.slice(events.length);
-    return {
-      url: `${this.config.endpoint}/${this.config.propertyId}`,
-      // protobufjs types finish() as Uint8Array<ArrayBufferLike>; the buffer is
-      // always a plain ArrayBuffer, so narrow for fetch/Blob compatibility.
-      encoded,
-      events
-    };
   }
-  sendFetch(payload, useKeepalive = false, onDelivered) {
+  sendFetch(payload, useKeepalive = false, onDelivered, isReplay = false) {
     const fetchOpts = {
       method: "POST",
       // Safelisted content type: no CORS preflight (see SAFE_CONTENT_TYPE).
@@ -2462,15 +2737,17 @@ var BidkernelPrebidAnalytics = class _BidkernelPrebidAnalytics {
           this.log("WARN", `Dropping batch due to non-retryable client error HTTP ${res.status}`);
           return;
         }
-        this.handleSendFailure(payload.events);
+        if (!isReplay) this.handleSendFailure(payload.events);
       } else {
-        this.consecutiveSendFailures = 0;
-        this.nextSendAllowedAt = 0;
+        if (!isReplay) {
+          this.consecutiveSendFailures = 0;
+          this.nextSendAllowedAt = 0;
+        }
         if (onDelivered) onDelivered();
       }
     }).catch((err) => {
       this.log("ERROR", "Failed to send batch", err);
-      this.handleSendFailure(payload.events);
+      if (!isReplay) this.handleSendFailure(payload.events);
     });
     const proc = typeof globalThis !== "undefined" ? globalThis.process : void 0;
     if (proc && typeof proc._tickCallback === "function") {
@@ -2526,16 +2803,23 @@ var BidkernelPrebidAnalytics = class _BidkernelPrebidAnalytics {
     this.schedulePersistedCleanup();
   }
   // --- Exit-batch persistence -----------------------------------------------
+  // Key prefix for this instance's property. encodeURIComponent keeps the
+  // property segment free of the "_" the timestamp suffix is parsed against,
+  // so a property ID containing one cannot forge another property's prefix.
+  pendingKeyPrefix() {
+    return `${PENDING_BATCH_KEY_PREFIX}${encodeURIComponent(this.config.propertyId)}_`;
+  }
   persistBatch(encoded) {
     try {
       if (typeof localStorage === "undefined") return null;
+      if (!this.config.propertyId) return null;
       let pendingCount = 0;
       for (let i = 0; i < localStorage.length; i++) {
         const k = localStorage.key(i);
         if (k && k.startsWith(PENDING_BATCH_KEY_PREFIX)) pendingCount++;
       }
       if (pendingCount >= MAX_PENDING_BATCHES) return null;
-      const key = `${PENDING_BATCH_KEY_PREFIX}${Date.now()}_${Math.floor(Math.random() * 1e6)}`;
+      const key = `${this.pendingKeyPrefix()}${Date.now()}_${Math.floor(Math.random() * 1e6)}`;
       localStorage.setItem(key, bytesToBase64(encoded));
       this.persistedBatchKeys.push(key);
       return key;
@@ -2566,16 +2850,33 @@ var BidkernelPrebidAnalytics = class _BidkernelPrebidAnalytics {
     }, PENDING_BATCH_CLEANUP_DELAY_MS);
   }
   // Resend batches a previous pageview persisted at exit but could not
-  // confirm. Keys are claimed (removed) before sending so concurrent tabs
-  // don't double-send; the batch bytes carry their original pageview, session,
-  // and event timestamps, so late rows attribute correctly.
+  // confirm. Only this property's own keys are claimed: batches belonging to
+  // another property sharing this origin are left for that property's next
+  // pageview, since resending them here would file them under this property.
+  // Keys are claimed (removed) before sending so concurrent tabs don't
+  // double-send; the batch bytes carry their original pageview, session, and
+  // event timestamps, so late rows attribute correctly.
   resendPersistedBatches() {
     try {
       if (typeof localStorage === "undefined" || !this.config.endpoint) return;
+      if (!this.config.propertyId) return;
+      const ownPrefix = this.pendingKeyPrefix();
       const keys = [];
+      const legacyKeys = [];
       for (let i = 0; i < localStorage.length; i++) {
         const k = localStorage.key(i);
-        if (k && k.startsWith(PENDING_BATCH_KEY_PREFIX)) keys.push(k);
+        if (!k || !k.startsWith(PENDING_BATCH_KEY_PREFIX)) continue;
+        if (k.startsWith(ownPrefix)) {
+          keys.push(k);
+        } else if (isLegacyPendingKey(k)) {
+          legacyKeys.push(k);
+        }
+      }
+      for (const key of legacyKeys) {
+        try {
+          localStorage.removeItem(key);
+        } catch {
+        }
       }
       for (const key of keys) {
         let value = null;
@@ -2586,7 +2887,7 @@ var BidkernelPrebidAnalytics = class _BidkernelPrebidAnalytics {
           continue;
         }
         if (!value) continue;
-        const ts = parseInt(key.slice(PENDING_BATCH_KEY_PREFIX.length), 10);
+        const ts = parseInt(key.slice(ownPrefix.length), 10);
         if (!Number.isFinite(ts) || Date.now() - ts > PENDING_BATCH_MAX_AGE_MS) continue;
         let encoded;
         try {
@@ -2596,11 +2897,16 @@ var BidkernelPrebidAnalytics = class _BidkernelPrebidAnalytics {
         }
         if (encoded.byteLength === 0) continue;
         this.log("DEBUG", `Resending persisted exit batch (${encoded.byteLength} bytes)`);
-        this.sendFetch({
-          url: `${this.config.endpoint}/${this.config.propertyId}`,
-          encoded,
-          events: []
-        });
+        this.sendFetch(
+          {
+            url: `${this.config.endpoint}/${this.config.propertyId}`,
+            encoded,
+            events: []
+          },
+          false,
+          void 0,
+          true
+        );
       }
     } catch {
     }
@@ -2625,11 +2931,13 @@ var BidkernelPrebidAnalytics = class _BidkernelPrebidAnalytics {
     }
   }
 };
-function extractAnalyticsOptions(config) {
+function extractAnalyticsOptions(config, allowProviderless = true) {
   if (!config) return null;
   if (Array.isArray(config)) {
-    const matched = config.find((item) => item?.provider === "bidkernel") ?? config.find((item) => item && typeof item === "object" && item.provider === void 0);
-    return matched ? extractAnalyticsOptions(matched) : null;
+    const matched = config.find((item) => item?.provider === "bidkernel") ?? (allowProviderless ? config.find(
+      (item) => item && typeof item === "object" && item.provider === void 0
+    ) : void 0);
+    return matched ? extractAnalyticsOptions(matched, allowProviderless) : null;
   }
   if (typeof config === "object") {
     if (config.options && typeof config.options === "object") {
@@ -2671,18 +2979,27 @@ function registerPrebidAnalytics(pbjsGlobalName = "pbjs", defaults) {
   win[pbjsGlobalName] = win[pbjsGlobalName] || {};
   const pbjs = win[pbjsGlobalName];
   const enableInstance = (options) => {
-    if (win._bidkernelPrebidAnalytics) {
+    const previous = win._bidkernelPrebidAnalytics;
+    const pinnedEndpoint = previous?.getEndpoint?.() || "";
+    const merged = {
+      pbjsGlobalName,
+      ...defaults,
+      ...options
+    };
+    if (pinnedEndpoint && !sameEndpointOrigin(merged.endpoint || "", pinnedEndpoint)) {
+      console.warn(
+        `[bidkernel] Ignoring analytics endpoint change to ${merged.endpoint || "(empty)"}: this page is pinned to ${pinnedEndpoint}. Reload to change the ingest endpoint.`
+      );
+      merged.endpoint = pinnedEndpoint;
+    }
+    if (previous) {
       try {
-        win._bidkernelPrebidAnalytics.disable();
+        previous.disable();
       } catch (e) {
         console.warn("[bidkernel] Failed to disable previous analytics instance:", e);
       }
     }
-    const analytics = new BidkernelPrebidAnalytics({
-      pbjsGlobalName,
-      ...defaults,
-      ...options
-    });
+    const analytics = new BidkernelPrebidAnalytics(merged);
     analytics.enable();
     win._bidkernelPrebidAnalytics = analytics;
     return analytics;
@@ -2693,7 +3010,7 @@ function registerPrebidAnalytics(pbjsGlobalName = "pbjs", defaults) {
         pbjs.adapterManager.registerAnalyticsAdapter({
           adapter: {
             enableAnalytics: (config) => {
-              const options = extractAnalyticsOptions(config);
+              const options = extractAnalyticsOptions(config, !Array.isArray(config));
               if (options) {
                 enableInstance(options);
               }
@@ -2759,5 +3076,6 @@ function getbidkernel(alias = "bidkernel") {
   PrebidEventDeduper,
   getPrebidEventKey,
   getbidkernel,
+  isTrustedEndpoint,
   registerPrebidAnalytics
 });