@clianta/sdk 1.6.7 → 1.7.1

package/dist/react.cjs.js

@@ -1,5 +1,5 @@
 /*!
- * Clianta SDK v1.6.7
+ * Clianta SDK v1.7.1
  * (c) 2026 Clianta
  * Released under the MIT License.
  */
@@ -14,7 +14,7 @@ var _documentCurrentScript = typeof document !== 'undefined' ? document.currentS
  * @see SDK_VERSION in core/config.ts
  */
 /** SDK Version */
-const SDK_VERSION = '1.6.7';
+const SDK_VERSION = '1.7.0';
 /** Default API endpoint — reads from env or falls back to localhost */
 const getDefaultApiEndpoint = () => {
     // Next.js (process.env)
@@ -40,6 +40,15 @@ const getDefaultApiEndpoint = () => {
     if (typeof process !== 'undefined' && process.env?.CLIANTA_API_ENDPOINT) {
         return process.env.CLIANTA_API_ENDPOINT;
     }
+    // No env var found — warn if we're not on localhost (likely a production misconfiguration)
+    const isLocalhost = typeof window !== 'undefined' &&
+        (window.location.hostname === 'localhost' || window.location.hostname === '127.0.0.1');
+    if (!isLocalhost && typeof console !== 'undefined') {
+        console.warn('[Clianta] No API endpoint configured. ' +
+            'Set NEXT_PUBLIC_CLIANTA_API_ENDPOINT (Next.js), VITE_CLIANTA_API_ENDPOINT (Vite), ' +
+            'or pass apiEndpoint directly to clianta(). ' +
+            'Falling back to localhost — tracking will not work in production.');
+    }
     return 'http://localhost:5000';
 };
 /** Core plugins enabled by default — all auto-track with zero config */
@@ -185,7 +194,9 @@ const logger = createLogger(false);
  */
 const DEFAULT_TIMEOUT = 10000; // 10 seconds
 const DEFAULT_MAX_RETRIES = 3;
-const DEFAULT_RETRY_DELAY = 1000; // 1 second
+const DEFAULT_RETRY_DELAY = 1000; // 1 second base — doubles each attempt (exponential backoff)
+/** fetch keepalive hard limit in browsers (64KB) */
+const KEEPALIVE_SIZE_LIMIT = 60000; // leave 4KB margin
 /**
  * Transport class for sending data to the backend
  */
@@ -204,6 +215,11 @@ class Transport {
     async sendEvents(events) {
         const url = `${this.config.apiEndpoint}/api/public/track/event`;
         const payload = JSON.stringify({ events });
+        // keepalive has a 64KB hard limit — fall back to beacon if too large
+        if (payload.length > KEEPALIVE_SIZE_LIMIT) {
+            const sent = this.sendBeacon(events);
+            return sent ? { success: true } : this.send(url, payload, 1, false);
+        }
         return this.send(url, payload);
     }
     /**
@@ -268,6 +284,15 @@ class Transport {
             return false;
         }
     }
+    /**
+     * Send an arbitrary POST request through the transport (with timeout + retry).
+     * Used for one-off calls like alias() that don't fit the event-batch or identify shapes.
+     */
+    async sendPost(path, body) {
+        const url = `${this.config.apiEndpoint}${path}`;
+        const payload = JSON.stringify(body);
+        return this.send(url, payload);
+    }
     /**
      * Fetch data from the tracking API (GET request)
      * Used for read-back APIs (visitor profile, activity, etc.)
@@ -302,38 +327,44 @@ class Transport {
         }
     }
     /**
-     * Internal send with retry logic
+     * Internal send with exponential backoff retry logic
      */
-    async send(url, payload, attempt = 1) {
+    async send(url, payload, attempt = 1, useKeepalive = true) {
+        // Don't bother sending when offline — caller should re-queue
+        if (typeof navigator !== 'undefined' && !navigator.onLine) {
+            logger.warn('Device offline, skipping send');
+            return { success: false, error: new Error('offline') };
+        }
         try {
             const response = await this.fetchWithTimeout(url, {
                 method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                },
+                headers: { 'Content-Type': 'application/json' },
                 body: payload,
-                keepalive: true,
+                keepalive: useKeepalive,
             });
             if (response.ok) {
                 logger.debug('Request successful:', url);
                 return { success: true, status: response.status };
             }
-            // Server error - may retry
+            // Server error — retry with exponential backoff
             if (response.status >= 500 && attempt < this.config.maxRetries) {
-                logger.warn(`Server error (${response.status}), retrying...`);
-                await this.delay(this.config.retryDelay * attempt);
-                return this.send(url, payload, attempt + 1);
+                const backoff = this.config.retryDelay * Math.pow(2, attempt - 1);
+                logger.warn(`Server error (${response.status}), retrying in ${backoff}ms...`);
+                await this.delay(backoff);
+                return this.send(url, payload, attempt + 1, useKeepalive);
             }
-            // Client error - don't retry
+            // 4xx — don't retry (bad payload, auth failure, etc.)
             logger.error(`Request failed with status ${response.status}`);
             return { success: false, status: response.status };
         }
         catch (error) {
-            // Network error - retry if possible
-            if (attempt < this.config.maxRetries) {
-                logger.warn(`Network error, retrying (${attempt}/${this.config.maxRetries})...`);
-                await this.delay(this.config.retryDelay * attempt);
-                return this.send(url, payload, attempt + 1);
+            // Network error — retry with exponential backoff if still online
+            const isOnline = typeof navigator === 'undefined' || navigator.onLine;
+            if (isOnline && attempt < this.config.maxRetries) {
+                const backoff = this.config.retryDelay * Math.pow(2, attempt - 1);
+                logger.warn(`Network error, retrying in ${backoff}ms (${attempt}/${this.config.maxRetries})...`);
+                await this.delay(backoff);
+                return this.send(url, payload, attempt + 1, useKeepalive);
             }
             logger.error('Request failed after retries:', error);
             return { success: false, error: error };
@@ -682,12 +713,17 @@ class EventQueue {
         this.queue = [];
         this.flushTimer = null;
         this.isFlushing = false;
+        this.isOnline = true;
         /** Rate limiting: timestamps of recent events */
         this.eventTimestamps = [];
         /** Unload handler references for cleanup */
         this.boundBeforeUnload = null;
         this.boundVisibilityChange = null;
         this.boundPageHide = null;
+        this.boundOnline = null;
+        this.boundOffline = null;
+        /** Guards against double-flush on unload (beforeunload + pagehide + visibilitychange all fire) */
+        this.unloadFlushed = false;
         this.transport = transport;
         this.config = {
             batchSize: config.batchSize ?? 10,
@@ -696,6 +732,7 @@ class EventQueue {
             storageKey: config.storageKey ?? STORAGE_KEYS.EVENT_QUEUE,
         };
         this.persistMode = config.persistMode || 'session';
+        this.isOnline = typeof navigator === 'undefined' || navigator.onLine;
         // Restore persisted queue
         this.restoreQueue();
         // Start auto-flush timer
@@ -744,7 +781,7 @@ class EventQueue {
      * Flush the queue (send all events)
      */
     async flush() {
-        if (this.isFlushing || this.queue.length === 0) {
+        if (this.isFlushing || this.queue.length === 0 || !this.isOnline) {
             return;
         }
         this.isFlushing = true;
@@ -775,11 +812,14 @@ class EventQueue {
         }
     }
     /**
-     * Flush synchronously using sendBeacon (for page unload)
+     * Flush synchronously using sendBeacon (for page unload).
+     * Guarded: no-ops after the first call per navigation to prevent
+     * triple-flush from beforeunload + visibilitychange + pagehide.
      */
     flushSync() {
-        if (this.queue.length === 0)
+        if (this.unloadFlushed || this.queue.length === 0)
             return;
+        this.unloadFlushed = true;
         const events = this.queue.splice(0, this.queue.length);
         logger.debug(`Sync flushing ${events.length} events via beacon`);
         const success = this.transport.sendBeacon(events);
@@ -817,17 +857,17 @@ class EventQueue {
             clearInterval(this.flushTimer);
             this.flushTimer = null;
         }
-        // Remove unload handlers
         if (typeof window !== 'undefined') {
-            if (this.boundBeforeUnload) {
+            if (this.boundBeforeUnload)
                 window.removeEventListener('beforeunload', this.boundBeforeUnload);
-            }
-            if (this.boundVisibilityChange) {
+            if (this.boundVisibilityChange)
                 window.removeEventListener('visibilitychange', this.boundVisibilityChange);
-            }
-            if (this.boundPageHide) {
+            if (this.boundPageHide)
                 window.removeEventListener('pagehide', this.boundPageHide);
-            }
+            if (this.boundOnline)
+                window.removeEventListener('online', this.boundOnline);
+            if (this.boundOffline)
+                window.removeEventListener('offline', this.boundOffline);
         }
     }
     /**
@@ -842,24 +882,38 @@ class EventQueue {
         }, this.config.flushInterval);
     }
     /**
-     * Setup page unload handlers
+     * Setup page unload handlers and online/offline listeners
      */
     setupUnloadHandlers() {
         if (typeof window === 'undefined')
             return;
-        // Flush on page unload
+        // All three unload events share the same guarded flushSync()
         this.boundBeforeUnload = () => this.flushSync();
         window.addEventListener('beforeunload', this.boundBeforeUnload);
-        // Flush when page becomes hidden
         this.boundVisibilityChange = () => {
             if (document.visibilityState === 'hidden') {
                 this.flushSync();
             }
+            else {
+                // Page became visible again (e.g. tab switch back) — reset guard
+                this.unloadFlushed = false;
+            }
         };
         window.addEventListener('visibilitychange', this.boundVisibilityChange);
-        // Flush on page hide (iOS Safari)
         this.boundPageHide = () => this.flushSync();
         window.addEventListener('pagehide', this.boundPageHide);
+        // Pause queue when offline, resume + flush when back online
+        this.boundOnline = () => {
+            logger.info('Connection restored — flushing queued events');
+            this.isOnline = true;
+            this.flush();
+        };
+        this.boundOffline = () => {
+            logger.warn('Connection lost — pausing event queue');
+            this.isOnline = false;
+        };
+        window.addEventListener('online', this.boundOnline);
+        window.addEventListener('offline', this.boundOffline);
     }
     /**
      * Persist queue to storage based on persistMode
@@ -942,6 +996,8 @@ class BasePlugin {
  * Clianta SDK - Page View Plugin
  * @see SDK_VERSION in core/config.ts
  */
+/** Sentinel flag to prevent double-wrapping history methods across multiple SDK instances */
+const WRAPPED_FLAG = '__clianta_pv_wrapped__';
 /**
  * Page View Plugin - Tracks page views
  */
@@ -951,50 +1007,64 @@ class PageViewPlugin extends BasePlugin {
         this.name = 'pageView';
         this.originalPushState = null;
         this.originalReplaceState = null;
+        this.navHandler = null;
         this.popstateHandler = null;
     }
     init(tracker) {
         super.init(tracker);
         // Track initial page view
         this.trackPageView();
-        // Track SPA navigation (History API)
-        if (typeof window !== 'undefined') {
-            // Store originals for cleanup
+        if (typeof window === 'undefined')
+            return;
+        // Only wrap history methods once — guard against multiple SDK instances (e.g. microfrontends)
+        // wrapping them repeatedly, which would cause duplicate navigation events and broken cleanup.
+        if (!history.pushState[WRAPPED_FLAG]) {
             this.originalPushState = history.pushState;
             this.originalReplaceState = history.replaceState;
-            // Intercept pushState and replaceState
-            const self = this;
+            const originalPush = this.originalPushState;
+            const originalReplace = this.originalReplaceState;
             history.pushState = function (...args) {
-                self.originalPushState.apply(history, args);
-                self.trackPageView();
-                // Notify other plugins (e.g. ScrollPlugin) about navigation
+                originalPush.apply(history, args);
+                // Dispatch event so all listening instances track the navigation
                 window.dispatchEvent(new Event('clianta:navigation'));
             };
+            history.pushState[WRAPPED_FLAG] = true;
             history.replaceState = function (...args) {
-                self.originalReplaceState.apply(history, args);
-                self.trackPageView();
+                originalReplace.apply(history, args);
                 window.dispatchEvent(new Event('clianta:navigation'));
             };
-            // Handle back/forward navigation
-            this.popstateHandler = () => this.trackPageView();
-            window.addEventListener('popstate', this.popstateHandler);
+            history.replaceState[WRAPPED_FLAG] = true;
         }
+        // Each instance listens to the shared navigation event rather than embedding
+        // tracking directly in the pushState wrapper — decouples tracking from wrapping.
+        this.navHandler = () => this.trackPageView();
+        window.addEventListener('clianta:navigation', this.navHandler);
+        // Handle back/forward navigation
+        this.popstateHandler = () => this.trackPageView();
+        window.addEventListener('popstate', this.popstateHandler);
     }
     destroy() {
-        // Restore original history methods
+        if (typeof window !== 'undefined') {
+            if (this.navHandler) {
+                window.removeEventListener('clianta:navigation', this.navHandler);
+                this.navHandler = null;
+            }
+            if (this.popstateHandler) {
+                window.removeEventListener('popstate', this.popstateHandler);
+                this.popstateHandler = null;
+            }
+        }
+        // Restore original history methods only if this instance was the one that wrapped them
         if (this.originalPushState) {
             history.pushState = this.originalPushState;
+            delete history.pushState[WRAPPED_FLAG];
             this.originalPushState = null;
         }
         if (this.originalReplaceState) {
             history.replaceState = this.originalReplaceState;
+            delete history.replaceState[WRAPPED_FLAG];
             this.originalReplaceState = null;
         }
-        // Remove popstate listener
-        if (this.popstateHandler && typeof window !== 'undefined') {
-            window.removeEventListener('popstate', this.popstateHandler);
-            this.popstateHandler = null;
-        }
         super.destroy();
     }
     trackPageView() {
@@ -1123,6 +1193,7 @@ class FormsPlugin extends BasePlugin {
         this.trackedForms = new WeakSet();
         this.formInteractions = new Set();
         this.observer = null;
+        this.observerTimer = null;
         this.listeners = [];
     }
     init(tracker) {
@@ -1131,13 +1202,21 @@ class FormsPlugin extends BasePlugin {
             return;
         // Track existing forms
         this.trackAllForms();
-        // Watch for dynamically added forms
+        // Watch for dynamically added forms — debounced to avoid O(DOM) cost on every mutation
         if (typeof MutationObserver !== 'undefined') {
-            this.observer = new MutationObserver(() => this.trackAllForms());
+            this.observer = new MutationObserver(() => {
+                if (this.observerTimer)
+                    clearTimeout(this.observerTimer);
+                this.observerTimer = setTimeout(() => this.trackAllForms(), 100);
+            });
             this.observer.observe(document.body, { childList: true, subtree: true });
         }
     }
     destroy() {
+        if (this.observerTimer) {
+            clearTimeout(this.observerTimer);
+            this.observerTimer = null;
+        }
         if (this.observer) {
             this.observer.disconnect();
             this.observer = null;
@@ -1259,8 +1338,13 @@ class ClicksPlugin extends BasePlugin {
         super.destroy();
     }
     handleClick(e) {
-        const target = e.target;
-        if (!target || !isTrackableClickElement(target))
+        // Walk up the DOM to find the nearest trackable ancestor.
+        // Without this, clicks on <span> or <img> inside a <button> are silently dropped.
+        let target = e.target;
+        while (target && !isTrackableClickElement(target)) {
+            target = target.parentElement;
+        }
+        if (!target)
             return;
         const buttonText = getElementText(target, 100);
         const elementInfo = getElementInfo(target);
@@ -1293,6 +1377,8 @@ class EngagementPlugin extends BasePlugin {
         this.engagementStartTime = 0;
         this.isEngaged = false;
         this.engagementTimeout = null;
+        /** Guard: beforeunload + visibilitychange:hidden both fire on tab close — only report once */
+        this.unloadReported = false;
         this.boundMarkEngaged = null;
         this.boundTrackTimeOnPage = null;
         this.boundVisibilityHandler = null;
@@ -1314,8 +1400,9 @@ class EngagementPlugin extends BasePlugin {
                 this.trackTimeOnPage();
             }
             else {
-                // Reset engagement timer when page becomes visible again
+                // Page is visible again — reset both the time counter and the unload guard
                 this.engagementStartTime = Date.now();
+                this.unloadReported = false;
             }
         };
         ['mousemove', 'keydown', 'touchstart', 'scroll'].forEach((event) => {
@@ -1361,6 +1448,7 @@ class EngagementPlugin extends BasePlugin {
         this.pageLoadTime = Date.now();
         this.engagementStartTime = Date.now();
         this.isEngaged = false;
+        this.unloadReported = false;
         if (this.engagementTimeout) {
             clearTimeout(this.engagementTimeout);
             this.engagementTimeout = null;
@@ -1382,6 +1470,10 @@ class EngagementPlugin extends BasePlugin {
         }, 30000); // 30 seconds of inactivity
     }
     trackTimeOnPage() {
+        // Guard: beforeunload and visibilitychange:hidden both fire on tab close — only report once
+        if (this.unloadReported)
+            return;
+        this.unloadReported = true;
         const timeSpent = Math.floor((Date.now() - this.engagementStartTime) / 1000);
         if (timeSpent > 0) {
             this.track('time_on_page', 'Time Spent', {
@@ -1540,12 +1632,16 @@ class ExitIntentPlugin extends BasePlugin {
 /**
  * Error Tracking Plugin - Tracks JavaScript errors
  */
+/** Max unique errors to track per page (prevents queue flooding from error loops) */
+const MAX_UNIQUE_ERRORS = 20;
 class ErrorsPlugin extends BasePlugin {
     constructor() {
         super(...arguments);
         this.name = 'errors';
         this.boundErrorHandler = null;
         this.boundRejectionHandler = null;
+        /** Seen error fingerprints — deduplicates repeated identical errors */
+        this.seenErrors = new Set();
     }
     init(tracker) {
         super.init(tracker);
@@ -1568,6 +1664,9 @@ class ErrorsPlugin extends BasePlugin {
         super.destroy();
     }
     handleError(e) {
+        const fingerprint = `${e.message}:${e.filename}:${e.lineno}`;
+        if (!this.dedup(fingerprint))
+            return;
         this.track('error', 'JavaScript Error', {
             message: e.message,
             filename: e.filename,
@@ -1577,9 +1676,22 @@ class ErrorsPlugin extends BasePlugin {
         });
     }
     handleRejection(e) {
-        this.track('error', 'Unhandled Promise Rejection', {
-            reason: String(e.reason).substring(0, 200),
-        });
+        const reason = String(e.reason).substring(0, 200);
+        if (!this.dedup(reason))
+            return;
+        this.track('error', 'Unhandled Promise Rejection', { reason });
+    }
+    /**
+     * Returns true if this error fingerprint is new (should be tracked).
+     * Caps at MAX_UNIQUE_ERRORS to prevent queue flooding from error loops.
+     */
+    dedup(fingerprint) {
+        if (this.seenErrors.has(fingerprint))
+            return false;
+        if (this.seenErrors.size >= MAX_UNIQUE_ERRORS)
+            return false;
+        this.seenErrors.add(fingerprint);
+        return true;
     }
 }
 
@@ -2247,113 +2359,173 @@ class PopupFormsPlugin extends BasePlugin {
 }
 
 /**
- * Clianta SDK - Auto-Identify Plugin
- * Automatically detects logged-in users by checking JWT tokens in
- * cookies, localStorage, and sessionStorage. Works with any auth provider:
- * Clerk, Firebase, Auth0, Supabase, NextAuth, Passport, custom JWT, etc.
+ * Clianta SDK - Auto-Identify Plugin (Production)
+ *
+ * Automatically detects logged-in users across ANY auth system:
+ *   - Window globals: Clerk, Firebase, Auth0, Supabase, __clianta_user
+ *   - JWT tokens in cookies (decoded client-side)
+ *   - JSON/JWT in localStorage & sessionStorage (guarded recursive deep-scan)
+ *   - Real-time storage change detection via `storage` event
+ *   - NextAuth session probing (only when NextAuth signals detected)
+ *
+ * Production safeguards:
+ *   - No monkey-patching of window.fetch or XMLHttpRequest
+ *   - Size-limited storage scanning (skips values > 50KB)
+ *   - Depth & key-count limited recursion (max 4 levels, 20 keys/level)
+ *   - Proper email regex validation
+ *   - Exponential backoff polling (2s → 5s → 10s → 30s)
+ *   - Zero console errors from probing
  *
- * How it works:
- * 1. On init + periodically, scans for JWT tokens
- * 2. Decodes the JWT payload (base64, no secret needed)
- * 3. Extracts email/name from standard JWT claims
- * 4. Calls tracker.identify() automatically
+ * Works universally: Next.js, Vite, CRA, Nuxt, SvelteKit, Remix,
+ * Astro, plain HTML, Zustand, Redux, Pinia, MobX, or any custom auth.
  *
  * @see SDK_VERSION in core/config.ts
  */
-/** Known auth cookie patterns and their JWT locations */
+// ────────────────────────────────────────────────
+// Constants
+// ────────────────────────────────────────────────
+/** Max recursion depth for JSON scanning */
+const MAX_SCAN_DEPTH = 4;
+/** Max object keys to inspect per recursion level */
+const MAX_KEYS_PER_LEVEL = 20;
+/** Max storage value size to parse (bytes) — skip large blobs */
+const MAX_STORAGE_VALUE_SIZE = 50000;
+/** Proper email regex — must have user@domain.tld (2+ char TLD) */
+const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]{2,}$/;
+/** Known auth cookie name patterns */
 const AUTH_COOKIE_PATTERNS = [
-    // Clerk
-    '__session',
-    '__clerk_db_jwt',
-    // NextAuth
-    'next-auth.session-token',
-    '__Secure-next-auth.session-token',
-    // Supabase
+    // Provider-specific
+    '__session', '__clerk_db_jwt',
+    'next-auth.session-token', '__Secure-next-auth.session-token',
     'sb-access-token',
-    // Auth0
     'auth0.is.authenticated',
-    // Firebase — uses localStorage, handled separately
-    // Generic patterns
-    'token',
-    'jwt',
-    'access_token',
-    'session_token',
-    'auth_token',
-    'id_token',
+    // Keycloak
+    'KEYCLOAK_SESSION', 'KEYCLOAK_IDENTITY', 'KC_RESTART',
+    // Generic
+    'token', 'jwt', 'access_token', 'session_token', 'auth_token', 'id_token',
 ];
-/** localStorage/sessionStorage key patterns for auth tokens */
+/** localStorage/sessionStorage key patterns */
 const STORAGE_KEY_PATTERNS = [
-    // Supabase
-    'sb-',
-    'supabase.auth.',
-    // Firebase
-    'firebase:authUser:',
-    // Auth0
-    'auth0spajs',
-    '@@auth0spajs@@',
+    // Provider-specific
+    'sb-', 'supabase.auth.', 'firebase:authUser:', 'auth0spajs', '@@auth0spajs@@',
+    // Microsoft MSAL
+    'msal.', 'msal.account',
+    // AWS Cognito / Amplify
+    'CognitoIdentityServiceProvider', 'amplify-signin-with-hostedUI',
+    // Keycloak
+    'kc-callback-',
+    // State managers
+    'persist:', '-storage',
     // Generic
-    'token',
-    'jwt',
-    'auth',
-    'user',
-    'session',
+    'token', 'jwt', 'auth', 'user', 'session', 'credential', 'account',
+];
+/** JWT/user object fields containing email */
+const EMAIL_CLAIMS = ['email', 'sub', 'preferred_username', 'user_email', 'mail', 'emailAddress', 'e_mail'];
+/** Full name fields */
+const NAME_CLAIMS = ['name', 'full_name', 'display_name', 'displayName'];
+/** First name fields */
+const FIRST_NAME_CLAIMS = ['given_name', 'first_name', 'firstName', 'fname'];
+/** Last name fields */
+const LAST_NAME_CLAIMS = ['family_name', 'last_name', 'lastName', 'lname'];
+/** Polling schedule: exponential backoff (ms) */
+const POLL_SCHEDULE = [
+    2000, // 2s — first check (auth providers need time to init)
+    5000, // 5s — second check
+    10000, // 10s
+    10000, // 10s
+    30000, // 30s — slower from here
+    30000, // 30s
+    30000, // 30s
+    60000, // 1m
+    60000, // 1m
+    60000, // 1m — stop after ~4 min total
 ];
-/** Standard JWT claim fields for email */
-const EMAIL_CLAIMS = ['email', 'sub', 'preferred_username', 'user_email', 'mail'];
-const NAME_CLAIMS = ['name', 'full_name', 'display_name', 'given_name'];
-const FIRST_NAME_CLAIMS = ['given_name', 'first_name', 'firstName'];
-const LAST_NAME_CLAIMS = ['family_name', 'last_name', 'lastName'];
 class AutoIdentifyPlugin extends BasePlugin {
     constructor() {
         super(...arguments);
         this.name = 'autoIdentify';
-        this.checkInterval = null;
+        this.pollTimeouts = [];
         this.identifiedEmail = null;
-        this.checkCount = 0;
-        this.MAX_CHECKS = 30; // Stop checking after ~5 minutes
-        this.CHECK_INTERVAL_MS = 10000; // Check every 10 seconds
+        this.storageHandler = null;
+        this.sessionProbed = false;
     }
     init(tracker) {
         super.init(tracker);
         if (typeof window === 'undefined')
             return;
-        // First check after 2 seconds (give auth providers time to init)
-        setTimeout(() => {
-            try {
-                this.checkForAuthUser();
-            }
-            catch { /* silently fail */ }
-        }, 2000);
-        // Then check periodically
-        this.checkInterval = setInterval(() => {
-            this.checkCount++;
-            if (this.checkCount >= this.MAX_CHECKS) {
-                if (this.checkInterval) {
-                    clearInterval(this.checkInterval);
-                    this.checkInterval = null;
-                }
-                return;
-            }
-            try {
-                this.checkForAuthUser();
-            }
-            catch { /* silently fail */ }
-        }, this.CHECK_INTERVAL_MS);
+        // Schedule poll checks with exponential backoff
+        this.schedulePollChecks();
+        // Listen for storage changes (real-time detection of login/logout)
+        this.listenForStorageChanges();
     }
     destroy() {
-        if (this.checkInterval) {
-            clearInterval(this.checkInterval);
-            this.checkInterval = null;
+        // Clear all scheduled polls
+        for (const t of this.pollTimeouts)
+            clearTimeout(t);
+        this.pollTimeouts = [];
+        // Remove storage listener
+        if (this.storageHandler && typeof window !== 'undefined') {
+            window.removeEventListener('storage', this.storageHandler);
+            this.storageHandler = null;
         }
         super.destroy();
     }
+    // ════════════════════════════════════════════════
+    // SCHEDULING
+    // ════════════════════════════════════════════════
     /**
-     * Main check — scan all sources for auth tokens
+     * Schedule poll checks with exponential backoff.
+     * Much lighter than setInterval — each check is self-contained.
      */
+    schedulePollChecks() {
+        let cumulativeDelay = 0;
+        for (let i = 0; i < POLL_SCHEDULE.length; i++) {
+            cumulativeDelay += POLL_SCHEDULE[i];
+            const timeout = setTimeout(() => {
+                if (this.identifiedEmail)
+                    return; // Already identified, skip
+                try {
+                    this.checkForAuthUser();
+                }
+                catch { /* silently fail */ }
+                // On the 4th check (~27s), probe NextAuth if signals detected
+                if (i === 3 && !this.sessionProbed) {
+                    this.sessionProbed = true;
+                    this.guardedSessionProbe();
+                }
+            }, cumulativeDelay);
+            this.pollTimeouts.push(timeout);
+        }
+    }
+    /**
+     * Listen for `storage` events — fired when another tab or the app
+     * modifies localStorage. Enables real-time detection after login.
+     */
+    listenForStorageChanges() {
+        this.storageHandler = (event) => {
+            if (this.identifiedEmail)
+                return; // Already identified
+            if (!event.key || !event.newValue)
+                return;
+            const keyLower = event.key.toLowerCase();
+            const isAuthKey = STORAGE_KEY_PATTERNS.some(p => keyLower.includes(p.toLowerCase()));
+            if (!isAuthKey)
+                return;
+            // Auth-related storage changed — run a check
+            try {
+                this.checkForAuthUser();
+            }
+            catch { /* silently fail */ }
+        };
+        window.addEventListener('storage', this.storageHandler);
+    }
+    // ════════════════════════════════════════════════
+    // MAIN CHECK — scan all sources (priority order)
+    // ════════════════════════════════════════════════
     checkForAuthUser() {
         if (!this.tracker || this.identifiedEmail)
             return;
-        // 0. Check well-known auth provider globals (most reliable)
+        // 0. Check well-known auth provider globals (most reliable, zero overhead)
         try {
             const providerUser = this.checkAuthProviders();
             if (providerUser) {
@@ -2362,8 +2534,8 @@ class AutoIdentifyPlugin extends BasePlugin {
             }
         }
         catch { /* provider check failed */ }
+        // 1. Check cookies for JWTs
         try {
-            // 1. Check cookies for JWTs
             const cookieUser = this.checkCookies();
             if (cookieUser) {
                 this.identifyUser(cookieUser);
@@ -2371,8 +2543,8 @@ class AutoIdentifyPlugin extends BasePlugin {
             }
         }
         catch { /* cookie access blocked */ }
+        // 2. Check localStorage (guarded deep scan)
         try {
-            // 2. Check localStorage
             if (typeof localStorage !== 'undefined') {
                 const localUser = this.checkStorage(localStorage);
                 if (localUser) {
@@ -2382,8 +2554,8 @@ class AutoIdentifyPlugin extends BasePlugin {
             }
         }
         catch { /* localStorage access blocked */ }
+        // 3. Check sessionStorage (guarded deep scan)
         try {
-            // 3. Check sessionStorage
             if (typeof sessionStorage !== 'undefined') {
                 const sessionUser = this.checkStorage(sessionStorage);
                 if (sessionUser) {
@@ -2394,20 +2566,18 @@ class AutoIdentifyPlugin extends BasePlugin {
         }
         catch { /* sessionStorage access blocked */ }
     }
-    /**
-     * Check well-known auth provider globals on window
-     * These are the most reliable — they expose user data directly
-     */
+    // ════════════════════════════════════════════════
+    // AUTH PROVIDER GLOBALS
+    // ════════════════════════════════════════════════
     checkAuthProviders() {
         const win = window;
         // ─── Clerk ───
-        // Clerk exposes window.Clerk after initialization
         try {
             const clerkUser = win.Clerk?.user;
             if (clerkUser) {
                 const email = clerkUser.primaryEmailAddress?.emailAddress
                     || clerkUser.emailAddresses?.[0]?.emailAddress;
-                if (email) {
+                if (email && this.isValidEmail(email)) {
                     return {
                         email,
                         firstName: clerkUser.firstName || undefined,
@@ -2421,7 +2591,7 @@ class AutoIdentifyPlugin extends BasePlugin {
         try {
             const fbAuth = win.firebase?.auth?.();
             const fbUser = fbAuth?.currentUser;
-            if (fbUser?.email) {
+            if (fbUser?.email && this.isValidEmail(fbUser.email)) {
                 const parts = (fbUser.displayName || '').split(' ');
                 return {
                     email: fbUser.email,
@@ -2435,10 +2605,9 @@ class AutoIdentifyPlugin extends BasePlugin {
         try {
             const sbClient = win.__SUPABASE_CLIENT__ || win.supabase;
             if (sbClient?.auth) {
-                // Supabase v2 stores session
                 const session = sbClient.auth.session?.() || sbClient.auth.getSession?.();
                 const user = session?.data?.session?.user || session?.user;
-                if (user?.email) {
+                if (user?.email && this.isValidEmail(user.email)) {
                     const meta = user.user_metadata || {};
                     return {
                         email: user.email,
@@ -2454,7 +2623,7 @@ class AutoIdentifyPlugin extends BasePlugin {
             const auth0 = win.__auth0Client || win.auth0Client;
             if (auth0?.isAuthenticated?.()) {
                 const user = auth0.getUser?.();
-                if (user?.email) {
+                if (user?.email && this.isValidEmail(user.email)) {
                     return {
                         email: user.email,
                         firstName: user.given_name || user.name?.split(' ')[0] || undefined,
@@ -2464,11 +2633,88 @@ class AutoIdentifyPlugin extends BasePlugin {
             }
         }
         catch { /* Auth0 not available */ }
+        // ─── Google Identity Services (Google OAuth / Sign In With Google) ───
+        // GIS stores the credential JWT from the callback; also check gapi
+        try {
+            const gisCredential = win.__google_credential_response?.credential;
+            if (gisCredential && typeof gisCredential === 'string') {
+                const user = this.extractUserFromToken(gisCredential);
+                if (user)
+                    return user;
+            }
+            // Legacy gapi.auth2
+            const gapiUser = win.gapi?.auth2?.getAuthInstance?.()?.currentUser?.get?.();
+            const profile = gapiUser?.getBasicProfile?.();
+            if (profile) {
+                const email = profile.getEmail?.();
+                if (email && this.isValidEmail(email)) {
+                    return {
+                        email,
+                        firstName: profile.getGivenName?.() || undefined,
+                        lastName: profile.getFamilyName?.() || undefined,
+                    };
+                }
+            }
+        }
+        catch { /* Google auth not available */ }
+        // ─── Microsoft MSAL (Microsoft OAuth / Azure AD) ───
+        // MSAL stores account info in window.msalInstance or PublicClientApplication
+        try {
+            const msalInstance = win.msalInstance || win.__msalInstance;
+            if (msalInstance) {
+                const accounts = msalInstance.getAllAccounts?.() || [];
+                const account = accounts[0];
+                if (account?.username && this.isValidEmail(account.username)) {
+                    const nameParts = (account.name || '').split(' ');
+                    return {
+                        email: account.username,
+                        firstName: nameParts[0] || undefined,
+                        lastName: nameParts.slice(1).join(' ') || undefined,
+                    };
+                }
+            }
+        }
+        catch { /* MSAL not available */ }
+        // ─── AWS Cognito / Amplify ───
+        try {
+            // Amplify v6+
+            const amplifyUser = win.aws_amplify_currentUser || win.__amplify_user;
+            if (amplifyUser?.signInDetails?.loginId && this.isValidEmail(amplifyUser.signInDetails.loginId)) {
+                return {
+                    email: amplifyUser.signInDetails.loginId,
+                    firstName: amplifyUser.attributes?.given_name || undefined,
+                    lastName: amplifyUser.attributes?.family_name || undefined,
+                };
+            }
+            // Check Cognito localStorage keys directly
+            if (typeof localStorage !== 'undefined') {
+                const cognitoUser = this.checkCognitoStorage();
+                if (cognitoUser)
+                    return cognitoUser;
+            }
+        }
+        catch { /* Cognito/Amplify not available */ }
+        // ─── Keycloak ───
+        try {
+            const keycloak = win.keycloak || win.Keycloak;
+            if (keycloak?.authenticated && keycloak.tokenParsed) {
+                const claims = keycloak.tokenParsed;
+                const email = claims.email || claims.preferred_username;
+                if (email && this.isValidEmail(email)) {
+                    return {
+                        email,
+                        firstName: claims.given_name || undefined,
+                        lastName: claims.family_name || undefined,
+                    };
+                }
+            }
+        }
+        catch { /* Keycloak not available */ }
         // ─── Global clianta identify hook ───
         // Any auth system can set: window.__clianta_user = { email, firstName, lastName }
         try {
             const manualUser = win.__clianta_user;
-            if (manualUser?.email && typeof manualUser.email === 'string' && manualUser.email.includes('@')) {
+            if (manualUser?.email && typeof manualUser.email === 'string' && this.isValidEmail(manualUser.email)) {
                 return {
                     email: manualUser.email,
                     firstName: manualUser.firstName || undefined,
@@ -2479,9 +2725,9 @@ class AutoIdentifyPlugin extends BasePlugin {
         catch { /* manual user not set */ }
         return null;
     }
-    /**
-     * Identify the user and stop checking
-     */
+    // ════════════════════════════════════════════════
+    // IDENTIFY USER
+    // ════════════════════════════════════════════════
     identifyUser(user) {
         if (!this.tracker || this.identifiedEmail === user.email)
             return;
@@ -2490,15 +2736,14 @@ class AutoIdentifyPlugin extends BasePlugin {
             firstName: user.firstName,
             lastName: user.lastName,
         });
-        // Stop interval — we found the user
-        if (this.checkInterval) {
-            clearInterval(this.checkInterval);
-            this.checkInterval = null;
-        }
-    }
-    /**
-     * Scan cookies for JWT tokens
-     */
+        // Cancel all remaining polls — we found the user
+        for (const t of this.pollTimeouts)
+            clearTimeout(t);
+        this.pollTimeouts = [];
+    }
+    // ════════════════════════════════════════════════
+    // COOKIE SCANNING
+    // ════════════════════════════════════════════════
     checkCookies() {
         if (typeof document === 'undefined')
             return null;
@@ -2508,7 +2753,6 @@ class AutoIdentifyPlugin extends BasePlugin {
                 const [name, ...valueParts] = cookie.split('=');
                 const value = valueParts.join('=');
                 const cookieName = name.trim().toLowerCase();
-                // Check if this cookie matches known auth patterns
                 const isAuthCookie = AUTH_COOKIE_PATTERNS.some(pattern => cookieName.includes(pattern.toLowerCase()));
                 if (isAuthCookie && value) {
                     const user = this.extractUserFromToken(decodeURIComponent(value));
@@ -2518,13 +2762,13 @@ class AutoIdentifyPlugin extends BasePlugin {
             }
         }
         catch {
-            // Cookie access may fail in some environments
+            // Cookie access may fail (cross-origin iframe, etc.)
         }
         return null;
     }
-    /**
-     * Scan localStorage or sessionStorage for auth tokens
-     */
+    // ════════════════════════════════════════════════
+    // STORAGE SCANNING (GUARDED DEEP RECURSIVE)
+    // ════════════════════════════════════════════════
     checkStorage(storage) {
         try {
             for (let i = 0; i < storage.length; i++) {
@@ -2537,16 +2781,19 @@ class AutoIdentifyPlugin extends BasePlugin {
                     const value = storage.getItem(key);
                     if (!value)
                         continue;
+                    // Size guard — skip values larger than 50KB
+                    if (value.length > MAX_STORAGE_VALUE_SIZE)
+                        continue;
                     // Try as direct JWT
                     const user = this.extractUserFromToken(value);
                     if (user)
                         return user;
-                    // Try as JSON containing a token
+                    // Try as JSON — guarded deep recursive scan
                     try {
                         const json = JSON.parse(value);
-                        const user = this.extractUserFromJson(json);
-                        if (user)
-                            return user;
+                        const jsonUser = this.deepScanForUser(json, 0);
+                        if (jsonUser)
+                            return jsonUser;
                     }
                     catch {
                         // Not JSON, skip
@@ -2559,11 +2806,63 @@ class AutoIdentifyPlugin extends BasePlugin {
         }
         return null;
     }
+    // ════════════════════════════════════════════════
+    // DEEP RECURSIVE SCANNING (guarded)
+    // ════════════════════════════════════════════════
     /**
-     * Try to extract user info from a JWT token string
+     * Recursively scan a JSON object for user data.
+     * Guards: max depth (4), max keys per level (20), no array traversal.
+     *
+     * Handles ANY nesting pattern:
+     *   - Zustand persist: { state: { user: { email } } }
+     *   - Redux persist:   { auth: { user: { email } } }
+     *   - Pinia:           { auth: { userData: { email } } }
+     *   - NextAuth:        { user: { email }, expires: ... }
+     *   - Direct:          { email, name }
+     */
+    deepScanForUser(data, depth) {
+        if (depth > MAX_SCAN_DEPTH || !data || typeof data !== 'object' || Array.isArray(data)) {
+            return null;
+        }
+        const obj = data;
+        const keys = Object.keys(obj);
+        // 1. Try direct extraction at this level
+        const user = this.extractUserFromClaims(obj);
+        if (user)
+            return user;
+        // Guard: limit keys scanned per level
+        const keysToScan = keys.slice(0, MAX_KEYS_PER_LEVEL);
+        // 2. Check for JWT strings at this level
+        for (const key of keysToScan) {
+            const val = obj[key];
+            if (typeof val === 'string' && val.length > 30 && val.length < 4000) {
+                // Only check strings that could plausibly be JWTs (30-4000 chars)
+                const dotCount = (val.match(/\./g) || []).length;
+                if (dotCount === 2) {
+                    const tokenUser = this.extractUserFromToken(val);
+                    if (tokenUser)
+                        return tokenUser;
+                }
+            }
+        }
+        // 3. Recurse into nested objects
+        for (const key of keysToScan) {
+            const val = obj[key];
+            if (val && typeof val === 'object' && !Array.isArray(val)) {
+                const nestedUser = this.deepScanForUser(val, depth + 1);
+                if (nestedUser)
+                    return nestedUser;
+            }
+        }
+        return null;
+    }
+    // ════════════════════════════════════════════════
+    // TOKEN & CLAIMS EXTRACTION
+    // ════════════════════════════════════════════════
+    /**
+     * Try to extract user info from a JWT token string (header.payload.signature)
      */
     extractUserFromToken(token) {
-        // JWT format: header.payload.signature
         const parts = token.split('.');
         if (parts.length !== 3)
             return null;
@@ -2576,48 +2875,29 @@ class AutoIdentifyPlugin extends BasePlugin {
         }
     }
     /**
-     * Extract user info from a JSON object (e.g., Firebase auth user stored in localStorage)
-     */
-    extractUserFromJson(data) {
-        if (!data || typeof data !== 'object')
-            return null;
-        // Direct user object
-        const user = this.extractUserFromClaims(data);
-        if (user)
-            return user;
-        // Nested: { user: { email } } or { data: { user: { email } } }
-        for (const key of ['user', 'data', 'session', 'currentUser', 'authUser', 'access_token', 'token']) {
-            if (data[key]) {
-                if (typeof data[key] === 'string') {
-                    // Might be a JWT inside JSON
-                    const tokenUser = this.extractUserFromToken(data[key]);
-                    if (tokenUser)
-                        return tokenUser;
-                }
-                else if (typeof data[key] === 'object') {
-                    const nestedUser = this.extractUserFromClaims(data[key]);
-                    if (nestedUser)
-                        return nestedUser;
-                }
-            }
-        }
-        return null;
-    }
-    /**
-     * Extract user from JWT claims or user object
+     * Extract user from JWT claims or user-like object.
+     * Uses proper email regex validation.
      */
     extractUserFromClaims(claims) {
         if (!claims || typeof claims !== 'object')
             return null;
-        // Find email
+        // Find email — check standard claim fields
         let email = null;
         for (const claim of EMAIL_CLAIMS) {
             const value = claims[claim];
-            if (value && typeof value === 'string' && value.includes('@') && value.includes('.')) {
+            if (value && typeof value === 'string' && this.isValidEmail(value)) {
                 email = value;
                 break;
             }
         }
+        // Check nested email objects (Clerk pattern)
+        if (!email) {
+            const nestedEmail = claims.primaryEmailAddress?.emailAddress
+                || claims.emailAddresses?.[0]?.emailAddress;
+            if (nestedEmail && typeof nestedEmail === 'string' && this.isValidEmail(nestedEmail)) {
+                email = nestedEmail;
+            }
+        }
         if (!email)
             return null;
         // Find name
@@ -2635,7 +2915,7 @@ class AutoIdentifyPlugin extends BasePlugin {
                 break;
             }
         }
-        // If no first/last name, try full name
+        // Try full name if no first/last found
         if (!firstName) {
             for (const claim of NAME_CLAIMS) {
                 if (claims[claim] && typeof claims[claim] === 'string') {
@@ -2648,6 +2928,117 @@ class AutoIdentifyPlugin extends BasePlugin {
         }
         return { email, firstName, lastName };
     }
+    // ════════════════════════════════════════════════
+    // GUARDED SESSION PROBING (NextAuth only)
+    // ════════════════════════════════════════════════
+    /**
+     * Probe NextAuth session endpoint ONLY if NextAuth signals are present.
+     * Signals: `next-auth.session-token` cookie, `__NEXTAUTH` or `__NEXT_DATA__` globals.
+     * This prevents unnecessary 404 errors on non-NextAuth sites.
+     */
+    async guardedSessionProbe() {
+        if (this.identifiedEmail)
+            return;
+        // Check for NextAuth signals before probing
+        const hasNextAuthCookie = typeof document !== 'undefined' &&
+            (document.cookie.includes('next-auth.session-token') ||
+                document.cookie.includes('__Secure-next-auth.session-token'));
+        const hasNextAuthGlobal = typeof window !== 'undefined' &&
+            (window.__NEXTAUTH != null || window.__NEXT_DATA__ != null);
+        if (!hasNextAuthCookie && !hasNextAuthGlobal)
+            return;
+        // NextAuth detected — safe to probe /api/auth/session
+        try {
+            const response = await fetch('/api/auth/session', {
+                method: 'GET',
+                credentials: 'include',
+                headers: { 'Accept': 'application/json' },
+            });
+            if (response.ok) {
+                const body = await response.json();
+                // NextAuth returns { user: { name, email, image }, expires }
+                if (body && typeof body === 'object' && Object.keys(body).length > 0) {
+                    const user = this.deepScanForUser(body, 0);
+                    if (user) {
+                        this.identifyUser(user);
+                    }
+                }
+            }
+        }
+        catch {
+            // Endpoint failed — silently ignore
+        }
+    }
+    // ════════════════════════════════════════════════
+    // AWS COGNITO STORAGE SCANNING
+    // ════════════════════════════════════════════════
+    /**
+     * Scan localStorage for AWS Cognito / Amplify user data.
+     * Cognito stores tokens under keys like:
+     *   CognitoIdentityServiceProvider.<clientId>.<username>.idToken
+     *   CognitoIdentityServiceProvider.<clientId>.<username>.userData
+     */
+    checkCognitoStorage() {
+        try {
+            for (let i = 0; i < localStorage.length; i++) {
+                const key = localStorage.key(i);
+                if (!key)
+                    continue;
+                // Look for Cognito ID tokens (contain email in JWT claims)
+                if (key.startsWith('CognitoIdentityServiceProvider.') && key.endsWith('.idToken')) {
+                    const value = localStorage.getItem(key);
+                    if (value && value.length < MAX_STORAGE_VALUE_SIZE) {
+                        const user = this.extractUserFromToken(value);
+                        if (user)
+                            return user;
+                    }
+                }
+                // Look for Cognito userData (JSON with email attribute)
+                if (key.startsWith('CognitoIdentityServiceProvider.') && key.endsWith('.userData')) {
+                    const value = localStorage.getItem(key);
+                    if (value && value.length < MAX_STORAGE_VALUE_SIZE) {
+                        try {
+                            const data = JSON.parse(value);
+                            // Cognito userData format: { UserAttributes: [{ Name: 'email', Value: '...' }] }
+                            const attrs = data.UserAttributes || data.attributes || [];
+                            const emailAttr = attrs.find?.((a) => a.Name === 'email' || a.name === 'email');
+                            if (emailAttr?.Value && this.isValidEmail(emailAttr.Value)) {
+                                const nameAttr = attrs.find?.((a) => a.Name === 'name' || a.name === 'name');
+                                const givenNameAttr = attrs.find?.((a) => a.Name === 'given_name' || a.name === 'given_name');
+                                const familyNameAttr = attrs.find?.((a) => a.Name === 'family_name' || a.name === 'family_name');
+                                let firstName = givenNameAttr?.Value;
+                                let lastName = familyNameAttr?.Value;
+                                if (!firstName && nameAttr?.Value) {
+                                    const parts = nameAttr.Value.split(' ');
+                                    firstName = parts[0];
+                                    lastName = lastName || parts.slice(1).join(' ') || undefined;
+                                }
+                                return {
+                                    email: emailAttr.Value,
+                                    firstName: firstName || undefined,
+                                    lastName: lastName || undefined,
+                                };
+                            }
+                        }
+                        catch { /* invalid JSON */ }
+                    }
+                }
+            }
+        }
+        catch { /* storage access failed */ }
+        return null;
+    }
+    // ════════════════════════════════════════════════
+    // UTILITIES
+    // ════════════════════════════════════════════════
+    /**
+     * Validate email with proper regex.
+     * Rejects: user@v2.0, config@internal, tokens with @ signs.
+     * Accepts: user@domain.com, user@sub.domain.co.uk
+     */
+    isValidEmail(value) {
+        return EMAIL_REGEX.test(value);
+    }
 }
 
 /**
@@ -3239,28 +3630,17 @@ class Tracker {
         }
         const prevId = previousId || this.visitorId;
         logger.info('Aliasing visitor:', { from: prevId, to: newId });
-        try {
-            const url = `${this.config.apiEndpoint}/api/public/track/alias`;
-            const response = await fetch(url, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    workspaceId: this.workspaceId,
-                    previousId: prevId,
-                    newId,
-                }),
-            });
-            if (response.ok) {
-                logger.info('Alias successful');
-                return true;
-            }
-            logger.error('Alias failed:', response.status);
-            return false;
-        }
-        catch (error) {
-            logger.error('Alias request failed:', error);
-            return false;
+        const result = await this.transport.sendPost('/api/public/track/alias', {
+            workspaceId: this.workspaceId,
+            previousId: prevId,
+            newId,
+        });
+        if (result.success) {
+            logger.info('Alias successful');
+            return true;
         }
+        logger.error('Alias failed:', result.error ?? result.status);
+        return false;
     }
     /**
      * Track a screen view (for mobile-first PWAs and SPAs).
@@ -3623,13 +4003,24 @@ let globalInstance = null;
  * });
  */
 function clianta(workspaceId, config) {
-    // Return existing instance if same workspace
+    // Return existing instance if same workspace and no config change
     if (globalInstance && globalInstance.getWorkspaceId() === workspaceId) {
+        if (config && Object.keys(config).length > 0) {
+            // Config was passed to an already-initialized instance — warn the developer
+            // because the new config is ignored. They must call destroy() first to reconfigure.
+            if (typeof console !== 'undefined') {
+                console.warn('[Clianta] clianta() called with config on an already-initialized instance ' +
+                    'for workspace "' + workspaceId + '". The new config was ignored. ' +
+                    'Call tracker.destroy() first if you need to reconfigure.');
+            }
+        }
         return globalInstance;
     }
-    // Destroy existing instance if workspace changed
+    // Destroy existing instance if workspace changed (fire-and-forget flush, then destroy)
     if (globalInstance) {
-        globalInstance.destroy();
+        // Kick off async flush+destroy without blocking the new instance creation.
+        // Using void to make the intentional fire-and-forget explicit.
+        void globalInstance.destroy();
     }
     // Create new instance
     globalInstance = new Tracker(workspaceId, config);
@@ -3657,8 +4048,21 @@ if (typeof window !== 'undefined') {
         const projectId = script.getAttribute('data-project-id');
         if (!projectId)
             return;
-        const debug = script.hasAttribute('data-debug');
-        const instance = clianta(projectId, { debug });
+        const initConfig = {
+            debug: script.hasAttribute('data-debug'),
+        };
+        // Support additional config via script tag attributes:
+        //   data-api-endpoint="https://api.yourhost.com"
+        //   data-cookieless  (boolean flag)
+        //   data-use-cookies (boolean flag)
+        const apiEndpoint = script.getAttribute('data-api-endpoint');
+        if (apiEndpoint)
+            initConfig.apiEndpoint = apiEndpoint;
+        if (script.hasAttribute('data-cookieless'))
+            initConfig.cookielessMode = true;
+        if (script.hasAttribute('data-use-cookies'))
+            initConfig.useCookies = true;
+        const instance = clianta(projectId, initConfig);
         // Expose the auto-initialized instance globally
         window.__clianta = instance;
     };
@@ -3720,15 +4124,12 @@ class CliantaErrorBoundary extends react.Component {
 function CliantaProvider({ projectId, apiEndpoint, debug, config, children, onError }) {
     const [tracker, setTracker] = react.useState(null);
     const [isReady, setIsReady] = react.useState(false);
-    const projectIdRef = react.useRef(projectId);
+    const trackerRef = react.useRef(null);
     react.useEffect(() => {
         if (!projectId) {
             console.error('[Clianta] Missing projectId prop on CliantaProvider');
             return;
         }
-        if (projectIdRef.current !== projectId) {
-            projectIdRef.current = projectId;
-        }
         try {
             const options = {
                 debug: debug ?? false,
@@ -3736,6 +4137,7 @@ function CliantaProvider({ projectId, apiEndpoint, debug, config, children, onEr
                 ...(apiEndpoint ? { apiEndpoint } : {}),
             };
             const instance = clianta(projectId, options);
+            trackerRef.current = instance;
             setTracker(instance);
             setIsReady(true);
         }
@@ -3744,7 +4146,8 @@ function CliantaProvider({ projectId, apiEndpoint, debug, config, children, onEr
             onError?.(error, { componentStack: '' });
         }
         return () => {
-            tracker?.flush();
+            // Use ref so cleanup always flushes the live instance, not the stale closure value
+            trackerRef.current?.flush();
             setIsReady(false);
         };
         // eslint-disable-next-line react-hooks/exhaustive-deps
@@ -3770,12 +4173,13 @@ function useCliantaReady() {
 }
 /**
  * useCliantaTrack — Quick tracking hook
+ * Stable function reference (useCallback) — safe to use as a dependency or pass as a prop.
  */
 function useCliantaTrack() {
     const tracker = useClianta();
-    return (eventType, eventName, properties) => {
+    return react.useCallback((eventType, eventName, properties) => {
         tracker?.track(eventType, eventName, properties);
-    };
+    }, [tracker]);
 }
 
 exports.CliantaProvider = CliantaProvider;