@clianta/sdk 1.6.7 → 1.7.1

package/dist/clianta.umd.js

@@ -1,5 +1,5 @@
 /*!
- * Clianta SDK v1.6.7
+ * Clianta SDK v1.7.1
  * (c) 2026 Clianta
  * Released under the MIT License.
  */
@@ -15,7 +15,7 @@
      * @see SDK_VERSION in core/config.ts
      */
     /** SDK Version */
-    const SDK_VERSION = '1.6.7';
+    const SDK_VERSION = '1.7.0';
     /** Default API endpoint — reads from env or falls back to localhost */
     const getDefaultApiEndpoint = () => {
         // Next.js (process.env)
@@ -41,6 +41,15 @@
         if (typeof process !== 'undefined' && process.env?.CLIANTA_API_ENDPOINT) {
             return process.env.CLIANTA_API_ENDPOINT;
         }
+        // No env var found — warn if we're not on localhost (likely a production misconfiguration)
+        const isLocalhost = typeof window !== 'undefined' &&
+            (window.location.hostname === 'localhost' || window.location.hostname === '127.0.0.1');
+        if (!isLocalhost && typeof console !== 'undefined') {
+            console.warn('[Clianta] No API endpoint configured. ' +
+                'Set NEXT_PUBLIC_CLIANTA_API_ENDPOINT (Next.js), VITE_CLIANTA_API_ENDPOINT (Vite), ' +
+                'or pass apiEndpoint directly to clianta(). ' +
+                'Falling back to localhost — tracking will not work in production.');
+        }
         return 'http://localhost:5000';
     };
     /** Core plugins enabled by default — all auto-track with zero config */
@@ -186,7 +195,9 @@
      */
     const DEFAULT_TIMEOUT = 10000; // 10 seconds
     const DEFAULT_MAX_RETRIES = 3;
-    const DEFAULT_RETRY_DELAY = 1000; // 1 second
+    const DEFAULT_RETRY_DELAY = 1000; // 1 second base — doubles each attempt (exponential backoff)
+    /** fetch keepalive hard limit in browsers (64KB) */
+    const KEEPALIVE_SIZE_LIMIT = 60000; // leave 4KB margin
     /**
      * Transport class for sending data to the backend
      */
@@ -205,6 +216,11 @@
         async sendEvents(events) {
             const url = `${this.config.apiEndpoint}/api/public/track/event`;
             const payload = JSON.stringify({ events });
+            // keepalive has a 64KB hard limit — fall back to beacon if too large
+            if (payload.length > KEEPALIVE_SIZE_LIMIT) {
+                const sent = this.sendBeacon(events);
+                return sent ? { success: true } : this.send(url, payload, 1, false);
+            }
             return this.send(url, payload);
         }
         /**
@@ -269,6 +285,15 @@
                 return false;
             }
         }
+        /**
+         * Send an arbitrary POST request through the transport (with timeout + retry).
+         * Used for one-off calls like alias() that don't fit the event-batch or identify shapes.
+         */
+        async sendPost(path, body) {
+            const url = `${this.config.apiEndpoint}${path}`;
+            const payload = JSON.stringify(body);
+            return this.send(url, payload);
+        }
         /**
          * Fetch data from the tracking API (GET request)
          * Used for read-back APIs (visitor profile, activity, etc.)
@@ -303,38 +328,44 @@
             }
         }
         /**
-         * Internal send with retry logic
+         * Internal send with exponential backoff retry logic
          */
-        async send(url, payload, attempt = 1) {
+        async send(url, payload, attempt = 1, useKeepalive = true) {
+            // Don't bother sending when offline — caller should re-queue
+            if (typeof navigator !== 'undefined' && !navigator.onLine) {
+                logger.warn('Device offline, skipping send');
+                return { success: false, error: new Error('offline') };
+            }
             try {
                 const response = await this.fetchWithTimeout(url, {
                     method: 'POST',
-                    headers: {
-                        'Content-Type': 'application/json',
-                    },
+                    headers: { 'Content-Type': 'application/json' },
                     body: payload,
-                    keepalive: true,
+                    keepalive: useKeepalive,
                 });
                 if (response.ok) {
                     logger.debug('Request successful:', url);
                     return { success: true, status: response.status };
                 }
-                // Server error - may retry
+                // Server error — retry with exponential backoff
                 if (response.status >= 500 && attempt < this.config.maxRetries) {
-                    logger.warn(`Server error (${response.status}), retrying...`);
-                    await this.delay(this.config.retryDelay * attempt);
-                    return this.send(url, payload, attempt + 1);
+                    const backoff = this.config.retryDelay * Math.pow(2, attempt - 1);
+                    logger.warn(`Server error (${response.status}), retrying in ${backoff}ms...`);
+                    await this.delay(backoff);
+                    return this.send(url, payload, attempt + 1, useKeepalive);
                 }
-                // Client error - don't retry
+                // 4xx — don't retry (bad payload, auth failure, etc.)
                 logger.error(`Request failed with status ${response.status}`);
                 return { success: false, status: response.status };
             }
             catch (error) {
-                // Network error - retry if possible
-                if (attempt < this.config.maxRetries) {
-                    logger.warn(`Network error, retrying (${attempt}/${this.config.maxRetries})...`);
-                    await this.delay(this.config.retryDelay * attempt);
-                    return this.send(url, payload, attempt + 1);
+                // Network error — retry with exponential backoff if still online
+                const isOnline = typeof navigator === 'undefined' || navigator.onLine;
+                if (isOnline && attempt < this.config.maxRetries) {
+                    const backoff = this.config.retryDelay * Math.pow(2, attempt - 1);
+                    logger.warn(`Network error, retrying in ${backoff}ms (${attempt}/${this.config.maxRetries})...`);
+                    await this.delay(backoff);
+                    return this.send(url, payload, attempt + 1, useKeepalive);
                 }
                 logger.error('Request failed after retries:', error);
                 return { success: false, error: error };
@@ -683,12 +714,17 @@
             this.queue = [];
             this.flushTimer = null;
             this.isFlushing = false;
+            this.isOnline = true;
             /** Rate limiting: timestamps of recent events */
             this.eventTimestamps = [];
             /** Unload handler references for cleanup */
             this.boundBeforeUnload = null;
             this.boundVisibilityChange = null;
             this.boundPageHide = null;
+            this.boundOnline = null;
+            this.boundOffline = null;
+            /** Guards against double-flush on unload (beforeunload + pagehide + visibilitychange all fire) */
+            this.unloadFlushed = false;
             this.transport = transport;
             this.config = {
                 batchSize: config.batchSize ?? 10,
@@ -697,6 +733,7 @@
                 storageKey: config.storageKey ?? STORAGE_KEYS.EVENT_QUEUE,
             };
             this.persistMode = config.persistMode || 'session';
+            this.isOnline = typeof navigator === 'undefined' || navigator.onLine;
             // Restore persisted queue
             this.restoreQueue();
             // Start auto-flush timer
@@ -745,7 +782,7 @@
          * Flush the queue (send all events)
          */
         async flush() {
-            if (this.isFlushing || this.queue.length === 0) {
+            if (this.isFlushing || this.queue.length === 0 || !this.isOnline) {
                 return;
             }
             this.isFlushing = true;
@@ -776,11 +813,14 @@
             }
         }
         /**
-         * Flush synchronously using sendBeacon (for page unload)
+         * Flush synchronously using sendBeacon (for page unload).
+         * Guarded: no-ops after the first call per navigation to prevent
+         * triple-flush from beforeunload + visibilitychange + pagehide.
          */
         flushSync() {
-            if (this.queue.length === 0)
+            if (this.unloadFlushed || this.queue.length === 0)
                 return;
+            this.unloadFlushed = true;
             const events = this.queue.splice(0, this.queue.length);
             logger.debug(`Sync flushing ${events.length} events via beacon`);
             const success = this.transport.sendBeacon(events);
@@ -818,17 +858,17 @@
                 clearInterval(this.flushTimer);
                 this.flushTimer = null;
             }
-            // Remove unload handlers
             if (typeof window !== 'undefined') {
-                if (this.boundBeforeUnload) {
+                if (this.boundBeforeUnload)
                     window.removeEventListener('beforeunload', this.boundBeforeUnload);
-                }
-                if (this.boundVisibilityChange) {
+                if (this.boundVisibilityChange)
                     window.removeEventListener('visibilitychange', this.boundVisibilityChange);
-                }
-                if (this.boundPageHide) {
+                if (this.boundPageHide)
                     window.removeEventListener('pagehide', this.boundPageHide);
-                }
+                if (this.boundOnline)
+                    window.removeEventListener('online', this.boundOnline);
+                if (this.boundOffline)
+                    window.removeEventListener('offline', this.boundOffline);
             }
         }
         /**
@@ -843,24 +883,38 @@
             }, this.config.flushInterval);
         }
         /**
-         * Setup page unload handlers
+         * Setup page unload handlers and online/offline listeners
          */
         setupUnloadHandlers() {
             if (typeof window === 'undefined')
                 return;
-            // Flush on page unload
+            // All three unload events share the same guarded flushSync()
             this.boundBeforeUnload = () => this.flushSync();
             window.addEventListener('beforeunload', this.boundBeforeUnload);
-            // Flush when page becomes hidden
             this.boundVisibilityChange = () => {
                 if (document.visibilityState === 'hidden') {
                     this.flushSync();
                 }
+                else {
+                    // Page became visible again (e.g. tab switch back) — reset guard
+                    this.unloadFlushed = false;
+                }
             };
             window.addEventListener('visibilitychange', this.boundVisibilityChange);
-            // Flush on page hide (iOS Safari)
             this.boundPageHide = () => this.flushSync();
             window.addEventListener('pagehide', this.boundPageHide);
+            // Pause queue when offline, resume + flush when back online
+            this.boundOnline = () => {
+                logger.info('Connection restored — flushing queued events');
+                this.isOnline = true;
+                this.flush();
+            };
+            this.boundOffline = () => {
+                logger.warn('Connection lost — pausing event queue');
+                this.isOnline = false;
+            };
+            window.addEventListener('online', this.boundOnline);
+            window.addEventListener('offline', this.boundOffline);
         }
         /**
          * Persist queue to storage based on persistMode
@@ -943,6 +997,8 @@
      * Clianta SDK - Page View Plugin
      * @see SDK_VERSION in core/config.ts
      */
+    /** Sentinel flag to prevent double-wrapping history methods across multiple SDK instances */
+    const WRAPPED_FLAG = '__clianta_pv_wrapped__';
     /**
      * Page View Plugin - Tracks page views
      */
@@ -952,50 +1008,64 @@
             this.name = 'pageView';
             this.originalPushState = null;
             this.originalReplaceState = null;
+            this.navHandler = null;
             this.popstateHandler = null;
         }
         init(tracker) {
             super.init(tracker);
             // Track initial page view
             this.trackPageView();
-            // Track SPA navigation (History API)
-            if (typeof window !== 'undefined') {
-                // Store originals for cleanup
+            if (typeof window === 'undefined')
+                return;
+            // Only wrap history methods once — guard against multiple SDK instances (e.g. microfrontends)
+            // wrapping them repeatedly, which would cause duplicate navigation events and broken cleanup.
+            if (!history.pushState[WRAPPED_FLAG]) {
                 this.originalPushState = history.pushState;
                 this.originalReplaceState = history.replaceState;
-                // Intercept pushState and replaceState
-                const self = this;
+                const originalPush = this.originalPushState;
+                const originalReplace = this.originalReplaceState;
                 history.pushState = function (...args) {
-                    self.originalPushState.apply(history, args);
-                    self.trackPageView();
-                    // Notify other plugins (e.g. ScrollPlugin) about navigation
+                    originalPush.apply(history, args);
+                    // Dispatch event so all listening instances track the navigation
                     window.dispatchEvent(new Event('clianta:navigation'));
                 };
+                history.pushState[WRAPPED_FLAG] = true;
                 history.replaceState = function (...args) {
-                    self.originalReplaceState.apply(history, args);
-                    self.trackPageView();
+                    originalReplace.apply(history, args);
                     window.dispatchEvent(new Event('clianta:navigation'));
                 };
-                // Handle back/forward navigation
-                this.popstateHandler = () => this.trackPageView();
-                window.addEventListener('popstate', this.popstateHandler);
+                history.replaceState[WRAPPED_FLAG] = true;
             }
+            // Each instance listens to the shared navigation event rather than embedding
+            // tracking directly in the pushState wrapper — decouples tracking from wrapping.
+            this.navHandler = () => this.trackPageView();
+            window.addEventListener('clianta:navigation', this.navHandler);
+            // Handle back/forward navigation
+            this.popstateHandler = () => this.trackPageView();
+            window.addEventListener('popstate', this.popstateHandler);
         }
         destroy() {
-            // Restore original history methods
+            if (typeof window !== 'undefined') {
+                if (this.navHandler) {
+                    window.removeEventListener('clianta:navigation', this.navHandler);
+                    this.navHandler = null;
+                }
+                if (this.popstateHandler) {
+                    window.removeEventListener('popstate', this.popstateHandler);
+                    this.popstateHandler = null;
+                }
+            }
+            // Restore original history methods only if this instance was the one that wrapped them
             if (this.originalPushState) {
                 history.pushState = this.originalPushState;
+                delete history.pushState[WRAPPED_FLAG];
                 this.originalPushState = null;
             }
             if (this.originalReplaceState) {
                 history.replaceState = this.originalReplaceState;
+                delete history.replaceState[WRAPPED_FLAG];
                 this.originalReplaceState = null;
             }
-            // Remove popstate listener
-            if (this.popstateHandler && typeof window !== 'undefined') {
-                window.removeEventListener('popstate', this.popstateHandler);
-                this.popstateHandler = null;
-            }
             super.destroy();
         }
         trackPageView() {
@@ -1124,6 +1194,7 @@
             this.trackedForms = new WeakSet();
             this.formInteractions = new Set();
             this.observer = null;
+            this.observerTimer = null;
             this.listeners = [];
         }
         init(tracker) {
@@ -1132,13 +1203,21 @@
                 return;
             // Track existing forms
             this.trackAllForms();
-            // Watch for dynamically added forms
+            // Watch for dynamically added forms — debounced to avoid O(DOM) cost on every mutation
             if (typeof MutationObserver !== 'undefined') {
-                this.observer = new MutationObserver(() => this.trackAllForms());
+                this.observer = new MutationObserver(() => {
+                    if (this.observerTimer)
+                        clearTimeout(this.observerTimer);
+                    this.observerTimer = setTimeout(() => this.trackAllForms(), 100);
+                });
                 this.observer.observe(document.body, { childList: true, subtree: true });
             }
         }
         destroy() {
+            if (this.observerTimer) {
+                clearTimeout(this.observerTimer);
+                this.observerTimer = null;
+            }
             if (this.observer) {
                 this.observer.disconnect();
                 this.observer = null;
@@ -1260,8 +1339,13 @@
             super.destroy();
         }
         handleClick(e) {
-            const target = e.target;
-            if (!target || !isTrackableClickElement(target))
+            // Walk up the DOM to find the nearest trackable ancestor.
+            // Without this, clicks on <span> or <img> inside a <button> are silently dropped.
+            let target = e.target;
+            while (target && !isTrackableClickElement(target)) {
+                target = target.parentElement;
+            }
+            if (!target)
                 return;
             const buttonText = getElementText(target, 100);
             const elementInfo = getElementInfo(target);
@@ -1294,6 +1378,8 @@
             this.engagementStartTime = 0;
             this.isEngaged = false;
             this.engagementTimeout = null;
+            /** Guard: beforeunload + visibilitychange:hidden both fire on tab close — only report once */
+            this.unloadReported = false;
             this.boundMarkEngaged = null;
             this.boundTrackTimeOnPage = null;
             this.boundVisibilityHandler = null;
@@ -1315,8 +1401,9 @@
                     this.trackTimeOnPage();
                 }
                 else {
-                    // Reset engagement timer when page becomes visible again
+                    // Page is visible again — reset both the time counter and the unload guard
                     this.engagementStartTime = Date.now();
+                    this.unloadReported = false;
                 }
             };
             ['mousemove', 'keydown', 'touchstart', 'scroll'].forEach((event) => {
@@ -1362,6 +1449,7 @@
             this.pageLoadTime = Date.now();
             this.engagementStartTime = Date.now();
             this.isEngaged = false;
+            this.unloadReported = false;
             if (this.engagementTimeout) {
                 clearTimeout(this.engagementTimeout);
                 this.engagementTimeout = null;
@@ -1383,6 +1471,10 @@
             }, 30000); // 30 seconds of inactivity
         }
         trackTimeOnPage() {
+            // Guard: beforeunload and visibilitychange:hidden both fire on tab close — only report once
+            if (this.unloadReported)
+                return;
+            this.unloadReported = true;
             const timeSpent = Math.floor((Date.now() - this.engagementStartTime) / 1000);
             if (timeSpent > 0) {
                 this.track('time_on_page', 'Time Spent', {
@@ -1541,12 +1633,16 @@
     /**
      * Error Tracking Plugin - Tracks JavaScript errors
      */
+    /** Max unique errors to track per page (prevents queue flooding from error loops) */
+    const MAX_UNIQUE_ERRORS = 20;
     class ErrorsPlugin extends BasePlugin {
         constructor() {
             super(...arguments);
             this.name = 'errors';
             this.boundErrorHandler = null;
             this.boundRejectionHandler = null;
+            /** Seen error fingerprints — deduplicates repeated identical errors */
+            this.seenErrors = new Set();
         }
         init(tracker) {
             super.init(tracker);
@@ -1569,6 +1665,9 @@
             super.destroy();
         }
         handleError(e) {
+            const fingerprint = `${e.message}:${e.filename}:${e.lineno}`;
+            if (!this.dedup(fingerprint))
+                return;
             this.track('error', 'JavaScript Error', {
                 message: e.message,
                 filename: e.filename,
@@ -1578,9 +1677,22 @@
             });
         }
         handleRejection(e) {
-            this.track('error', 'Unhandled Promise Rejection', {
-                reason: String(e.reason).substring(0, 200),
-            });
+            const reason = String(e.reason).substring(0, 200);
+            if (!this.dedup(reason))
+                return;
+            this.track('error', 'Unhandled Promise Rejection', { reason });
+        }
+        /**
+         * Returns true if this error fingerprint is new (should be tracked).
+         * Caps at MAX_UNIQUE_ERRORS to prevent queue flooding from error loops.
+         */
+        dedup(fingerprint) {
+            if (this.seenErrors.has(fingerprint))
+                return false;
+            if (this.seenErrors.size >= MAX_UNIQUE_ERRORS)
+                return false;
+            this.seenErrors.add(fingerprint);
+            return true;
         }
     }
 
@@ -2248,113 +2360,173 @@
     }
 
     /**
-     * Clianta SDK - Auto-Identify Plugin
-     * Automatically detects logged-in users by checking JWT tokens in
-     * cookies, localStorage, and sessionStorage. Works with any auth provider:
-     * Clerk, Firebase, Auth0, Supabase, NextAuth, Passport, custom JWT, etc.
+     * Clianta SDK - Auto-Identify Plugin (Production)
+     *
+     * Automatically detects logged-in users across ANY auth system:
+     *   - Window globals: Clerk, Firebase, Auth0, Supabase, __clianta_user
+     *   - JWT tokens in cookies (decoded client-side)
+     *   - JSON/JWT in localStorage & sessionStorage (guarded recursive deep-scan)
+     *   - Real-time storage change detection via `storage` event
+     *   - NextAuth session probing (only when NextAuth signals detected)
      *
-     * How it works:
-     * 1. On init + periodically, scans for JWT tokens
-     * 2. Decodes the JWT payload (base64, no secret needed)
-     * 3. Extracts email/name from standard JWT claims
-     * 4. Calls tracker.identify() automatically
+     * Production safeguards:
+     *   - No monkey-patching of window.fetch or XMLHttpRequest
+     *   - Size-limited storage scanning (skips values > 50KB)
+     *   - Depth & key-count limited recursion (max 4 levels, 20 keys/level)
+     *   - Proper email regex validation
+     *   - Exponential backoff polling (2s → 5s → 10s → 30s)
+     *   - Zero console errors from probing
+     *
+     * Works universally: Next.js, Vite, CRA, Nuxt, SvelteKit, Remix,
+     * Astro, plain HTML, Zustand, Redux, Pinia, MobX, or any custom auth.
      *
      * @see SDK_VERSION in core/config.ts
      */
-    /** Known auth cookie patterns and their JWT locations */
+    // ────────────────────────────────────────────────
+    // Constants
+    // ────────────────────────────────────────────────
+    /** Max recursion depth for JSON scanning */
+    const MAX_SCAN_DEPTH = 4;
+    /** Max object keys to inspect per recursion level */
+    const MAX_KEYS_PER_LEVEL = 20;
+    /** Max storage value size to parse (bytes) — skip large blobs */
+    const MAX_STORAGE_VALUE_SIZE = 50000;
+    /** Proper email regex — must have user@domain.tld (2+ char TLD) */
+    const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]{2,}$/;
+    /** Known auth cookie name patterns */
     const AUTH_COOKIE_PATTERNS = [
-        // Clerk
-        '__session',
-        '__clerk_db_jwt',
-        // NextAuth
-        'next-auth.session-token',
-        '__Secure-next-auth.session-token',
-        // Supabase
+        // Provider-specific
+        '__session', '__clerk_db_jwt',
+        'next-auth.session-token', '__Secure-next-auth.session-token',
         'sb-access-token',
-        // Auth0
         'auth0.is.authenticated',
-        // Firebase — uses localStorage, handled separately
-        // Generic patterns
-        'token',
-        'jwt',
-        'access_token',
-        'session_token',
-        'auth_token',
-        'id_token',
+        // Keycloak
+        'KEYCLOAK_SESSION', 'KEYCLOAK_IDENTITY', 'KC_RESTART',
+        // Generic
+        'token', 'jwt', 'access_token', 'session_token', 'auth_token', 'id_token',
     ];
-    /** localStorage/sessionStorage key patterns for auth tokens */
+    /** localStorage/sessionStorage key patterns */
     const STORAGE_KEY_PATTERNS = [
-        // Supabase
-        'sb-',
-        'supabase.auth.',
-        // Firebase
-        'firebase:authUser:',
-        // Auth0
-        'auth0spajs',
-        '@@auth0spajs@@',
+        // Provider-specific
+        'sb-', 'supabase.auth.', 'firebase:authUser:', 'auth0spajs', '@@auth0spajs@@',
+        // Microsoft MSAL
+        'msal.', 'msal.account',
+        // AWS Cognito / Amplify
+        'CognitoIdentityServiceProvider', 'amplify-signin-with-hostedUI',
+        // Keycloak
+        'kc-callback-',
+        // State managers
+        'persist:', '-storage',
         // Generic
-        'token',
-        'jwt',
-        'auth',
-        'user',
-        'session',
+        'token', 'jwt', 'auth', 'user', 'session', 'credential', 'account',
+    ];
+    /** JWT/user object fields containing email */
+    const EMAIL_CLAIMS = ['email', 'sub', 'preferred_username', 'user_email', 'mail', 'emailAddress', 'e_mail'];
+    /** Full name fields */
+    const NAME_CLAIMS = ['name', 'full_name', 'display_name', 'displayName'];
+    /** First name fields */
+    const FIRST_NAME_CLAIMS = ['given_name', 'first_name', 'firstName', 'fname'];
+    /** Last name fields */
+    const LAST_NAME_CLAIMS = ['family_name', 'last_name', 'lastName', 'lname'];
+    /** Polling schedule: exponential backoff (ms) */
+    const POLL_SCHEDULE = [
+        2000, // 2s — first check (auth providers need time to init)
+        5000, // 5s — second check
+        10000, // 10s
+        10000, // 10s
+        30000, // 30s — slower from here
+        30000, // 30s
+        30000, // 30s
+        60000, // 1m
+        60000, // 1m
+        60000, // 1m — stop after ~4 min total
     ];
-    /** Standard JWT claim fields for email */
-    const EMAIL_CLAIMS = ['email', 'sub', 'preferred_username', 'user_email', 'mail'];
-    const NAME_CLAIMS = ['name', 'full_name', 'display_name', 'given_name'];
-    const FIRST_NAME_CLAIMS = ['given_name', 'first_name', 'firstName'];
-    const LAST_NAME_CLAIMS = ['family_name', 'last_name', 'lastName'];
     class AutoIdentifyPlugin extends BasePlugin {
         constructor() {
             super(...arguments);
             this.name = 'autoIdentify';
-            this.checkInterval = null;
+            this.pollTimeouts = [];
             this.identifiedEmail = null;
-            this.checkCount = 0;
-            this.MAX_CHECKS = 30; // Stop checking after ~5 minutes
-            this.CHECK_INTERVAL_MS = 10000; // Check every 10 seconds
+            this.storageHandler = null;
+            this.sessionProbed = false;
         }
         init(tracker) {
             super.init(tracker);
             if (typeof window === 'undefined')
                 return;
-            // First check after 2 seconds (give auth providers time to init)
-            setTimeout(() => {
-                try {
-                    this.checkForAuthUser();
-                }
-                catch { /* silently fail */ }
-            }, 2000);
-            // Then check periodically
-            this.checkInterval = setInterval(() => {
-                this.checkCount++;
-                if (this.checkCount >= this.MAX_CHECKS) {
-                    if (this.checkInterval) {
-                        clearInterval(this.checkInterval);
-                        this.checkInterval = null;
-                    }
-                    return;
-                }
-                try {
-                    this.checkForAuthUser();
-                }
-                catch { /* silently fail */ }
-            }, this.CHECK_INTERVAL_MS);
+            // Schedule poll checks with exponential backoff
+            this.schedulePollChecks();
+            // Listen for storage changes (real-time detection of login/logout)
+            this.listenForStorageChanges();
         }
         destroy() {
-            if (this.checkInterval) {
-                clearInterval(this.checkInterval);
-                this.checkInterval = null;
+            // Clear all scheduled polls
+            for (const t of this.pollTimeouts)
+                clearTimeout(t);
+            this.pollTimeouts = [];
+            // Remove storage listener
+            if (this.storageHandler && typeof window !== 'undefined') {
+                window.removeEventListener('storage', this.storageHandler);
+                this.storageHandler = null;
             }
             super.destroy();
         }
+        // ════════════════════════════════════════════════
+        // SCHEDULING
+        // ════════════════════════════════════════════════
+        /**
+         * Schedule poll checks with exponential backoff.
+         * Much lighter than setInterval — each check is self-contained.
+         */
+        schedulePollChecks() {
+            let cumulativeDelay = 0;
+            for (let i = 0; i < POLL_SCHEDULE.length; i++) {
+                cumulativeDelay += POLL_SCHEDULE[i];
+                const timeout = setTimeout(() => {
+                    if (this.identifiedEmail)
+                        return; // Already identified, skip
+                    try {
+                        this.checkForAuthUser();
+                    }
+                    catch { /* silently fail */ }
+                    // On the 4th check (~27s), probe NextAuth if signals detected
+                    if (i === 3 && !this.sessionProbed) {
+                        this.sessionProbed = true;
+                        this.guardedSessionProbe();
+                    }
+                }, cumulativeDelay);
+                this.pollTimeouts.push(timeout);
+            }
+        }
         /**
-         * Main check — scan all sources for auth tokens
+         * Listen for `storage` events — fired when another tab or the app
+         * modifies localStorage. Enables real-time detection after login.
          */
+        listenForStorageChanges() {
+            this.storageHandler = (event) => {
+                if (this.identifiedEmail)
+                    return; // Already identified
+                if (!event.key || !event.newValue)
+                    return;
+                const keyLower = event.key.toLowerCase();
+                const isAuthKey = STORAGE_KEY_PATTERNS.some(p => keyLower.includes(p.toLowerCase()));
+                if (!isAuthKey)
+                    return;
+                // Auth-related storage changed — run a check
+                try {
+                    this.checkForAuthUser();
+                }
+                catch { /* silently fail */ }
+            };
+            window.addEventListener('storage', this.storageHandler);
+        }
+        // ════════════════════════════════════════════════
+        // MAIN CHECK — scan all sources (priority order)
+        // ════════════════════════════════════════════════
         checkForAuthUser() {
             if (!this.tracker || this.identifiedEmail)
                 return;
-            // 0. Check well-known auth provider globals (most reliable)
+            // 0. Check well-known auth provider globals (most reliable, zero overhead)
             try {
                 const providerUser = this.checkAuthProviders();
                 if (providerUser) {
@@ -2363,8 +2535,8 @@
                 }
             }
             catch { /* provider check failed */ }
+            // 1. Check cookies for JWTs
             try {
-                // 1. Check cookies for JWTs
                 const cookieUser = this.checkCookies();
                 if (cookieUser) {
                     this.identifyUser(cookieUser);
@@ -2372,8 +2544,8 @@
                 }
             }
             catch { /* cookie access blocked */ }
+            // 2. Check localStorage (guarded deep scan)
             try {
-                // 2. Check localStorage
                 if (typeof localStorage !== 'undefined') {
                     const localUser = this.checkStorage(localStorage);
                     if (localUser) {
@@ -2383,8 +2555,8 @@
                 }
             }
             catch { /* localStorage access blocked */ }
+            // 3. Check sessionStorage (guarded deep scan)
             try {
-                // 3. Check sessionStorage
                 if (typeof sessionStorage !== 'undefined') {
                     const sessionUser = this.checkStorage(sessionStorage);
                     if (sessionUser) {
@@ -2395,20 +2567,18 @@
             }
             catch { /* sessionStorage access blocked */ }
         }
-        /**
-         * Check well-known auth provider globals on window
-         * These are the most reliable — they expose user data directly
-         */
+        // ════════════════════════════════════════════════
+        // AUTH PROVIDER GLOBALS
+        // ════════════════════════════════════════════════
         checkAuthProviders() {
             const win = window;
             // ─── Clerk ───
-            // Clerk exposes window.Clerk after initialization
             try {
                 const clerkUser = win.Clerk?.user;
                 if (clerkUser) {
                     const email = clerkUser.primaryEmailAddress?.emailAddress
                         || clerkUser.emailAddresses?.[0]?.emailAddress;
-                    if (email) {
+                    if (email && this.isValidEmail(email)) {
                         return {
                             email,
                             firstName: clerkUser.firstName || undefined,
@@ -2422,7 +2592,7 @@
             try {
                 const fbAuth = win.firebase?.auth?.();
                 const fbUser = fbAuth?.currentUser;
-                if (fbUser?.email) {
+                if (fbUser?.email && this.isValidEmail(fbUser.email)) {
                     const parts = (fbUser.displayName || '').split(' ');
                     return {
                         email: fbUser.email,
@@ -2436,10 +2606,9 @@
             try {
                 const sbClient = win.__SUPABASE_CLIENT__ || win.supabase;
                 if (sbClient?.auth) {
-                    // Supabase v2 stores session
                     const session = sbClient.auth.session?.() || sbClient.auth.getSession?.();
                     const user = session?.data?.session?.user || session?.user;
-                    if (user?.email) {
+                    if (user?.email && this.isValidEmail(user.email)) {
                         const meta = user.user_metadata || {};
                         return {
                             email: user.email,
@@ -2455,7 +2624,7 @@
                 const auth0 = win.__auth0Client || win.auth0Client;
                 if (auth0?.isAuthenticated?.()) {
                     const user = auth0.getUser?.();
-                    if (user?.email) {
+                    if (user?.email && this.isValidEmail(user.email)) {
                         return {
                             email: user.email,
                             firstName: user.given_name || user.name?.split(' ')[0] || undefined,
@@ -2465,11 +2634,88 @@
                 }
             }
             catch { /* Auth0 not available */ }
+            // ─── Google Identity Services (Google OAuth / Sign In With Google) ───
+            // GIS stores the credential JWT from the callback; also check gapi
+            try {
+                const gisCredential = win.__google_credential_response?.credential;
+                if (gisCredential && typeof gisCredential === 'string') {
+                    const user = this.extractUserFromToken(gisCredential);
+                    if (user)
+                        return user;
+                }
+                // Legacy gapi.auth2
+                const gapiUser = win.gapi?.auth2?.getAuthInstance?.()?.currentUser?.get?.();
+                const profile = gapiUser?.getBasicProfile?.();
+                if (profile) {
+                    const email = profile.getEmail?.();
+                    if (email && this.isValidEmail(email)) {
+                        return {
+                            email,
+                            firstName: profile.getGivenName?.() || undefined,
+                            lastName: profile.getFamilyName?.() || undefined,
+                        };
+                    }
+                }
+            }
+            catch { /* Google auth not available */ }
+            // ─── Microsoft MSAL (Microsoft OAuth / Azure AD) ───
+            // MSAL stores account info in window.msalInstance or PublicClientApplication
+            try {
+                const msalInstance = win.msalInstance || win.__msalInstance;
+                if (msalInstance) {
+                    const accounts = msalInstance.getAllAccounts?.() || [];
+                    const account = accounts[0];
+                    if (account?.username && this.isValidEmail(account.username)) {
+                        const nameParts = (account.name || '').split(' ');
+                        return {
+                            email: account.username,
+                            firstName: nameParts[0] || undefined,
+                            lastName: nameParts.slice(1).join(' ') || undefined,
+                        };
+                    }
+                }
+            }
+            catch { /* MSAL not available */ }
+            // ─── AWS Cognito / Amplify ───
+            try {
+                // Amplify v6+
+                const amplifyUser = win.aws_amplify_currentUser || win.__amplify_user;
+                if (amplifyUser?.signInDetails?.loginId && this.isValidEmail(amplifyUser.signInDetails.loginId)) {
+                    return {
+                        email: amplifyUser.signInDetails.loginId,
+                        firstName: amplifyUser.attributes?.given_name || undefined,
+                        lastName: amplifyUser.attributes?.family_name || undefined,
+                    };
+                }
+                // Check Cognito localStorage keys directly
+                if (typeof localStorage !== 'undefined') {
+                    const cognitoUser = this.checkCognitoStorage();
+                    if (cognitoUser)
+                        return cognitoUser;
+                }
+            }
+            catch { /* Cognito/Amplify not available */ }
+            // ─── Keycloak ───
+            try {
+                const keycloak = win.keycloak || win.Keycloak;
+                if (keycloak?.authenticated && keycloak.tokenParsed) {
+                    const claims = keycloak.tokenParsed;
+                    const email = claims.email || claims.preferred_username;
+                    if (email && this.isValidEmail(email)) {
+                        return {
+                            email,
+                            firstName: claims.given_name || undefined,
+                            lastName: claims.family_name || undefined,
+                        };
+                    }
+                }
+            }
+            catch { /* Keycloak not available */ }
             // ─── Global clianta identify hook ───
             // Any auth system can set: window.__clianta_user = { email, firstName, lastName }
             try {
                 const manualUser = win.__clianta_user;
-                if (manualUser?.email && typeof manualUser.email === 'string' && manualUser.email.includes('@')) {
+                if (manualUser?.email && typeof manualUser.email === 'string' && this.isValidEmail(manualUser.email)) {
                     return {
                         email: manualUser.email,
                         firstName: manualUser.firstName || undefined,
@@ -2480,9 +2726,9 @@
             catch { /* manual user not set */ }
             return null;
         }
-        /**
-         * Identify the user and stop checking
-         */
+        // ════════════════════════════════════════════════
+        // IDENTIFY USER
+        // ════════════════════════════════════════════════
         identifyUser(user) {
             if (!this.tracker || this.identifiedEmail === user.email)
                 return;
@@ -2491,15 +2737,14 @@
                 firstName: user.firstName,
                 lastName: user.lastName,
             });
-            // Stop interval — we found the user
-            if (this.checkInterval) {
-                clearInterval(this.checkInterval);
-                this.checkInterval = null;
-            }
-        }
-        /**
-         * Scan cookies for JWT tokens
-         */
+            // Cancel all remaining polls — we found the user
+            for (const t of this.pollTimeouts)
+                clearTimeout(t);
+            this.pollTimeouts = [];
+        }
+        // ════════════════════════════════════════════════
+        // COOKIE SCANNING
+        // ════════════════════════════════════════════════
         checkCookies() {
             if (typeof document === 'undefined')
                 return null;
@@ -2509,7 +2754,6 @@
                     const [name, ...valueParts] = cookie.split('=');
                     const value = valueParts.join('=');
                     const cookieName = name.trim().toLowerCase();
-                    // Check if this cookie matches known auth patterns
                     const isAuthCookie = AUTH_COOKIE_PATTERNS.some(pattern => cookieName.includes(pattern.toLowerCase()));
                     if (isAuthCookie && value) {
                         const user = this.extractUserFromToken(decodeURIComponent(value));
@@ -2519,13 +2763,13 @@
                 }
             }
             catch {
-                // Cookie access may fail in some environments
+                // Cookie access may fail (cross-origin iframe, etc.)
             }
             return null;
         }
-        /**
-         * Scan localStorage or sessionStorage for auth tokens
-         */
+        // ════════════════════════════════════════════════
+        // STORAGE SCANNING (GUARDED DEEP RECURSIVE)
+        // ════════════════════════════════════════════════
         checkStorage(storage) {
             try {
                 for (let i = 0; i < storage.length; i++) {
@@ -2538,16 +2782,19 @@
                         const value = storage.getItem(key);
                         if (!value)
                             continue;
+                        // Size guard — skip values larger than 50KB
+                        if (value.length > MAX_STORAGE_VALUE_SIZE)
+                            continue;
                         // Try as direct JWT
                         const user = this.extractUserFromToken(value);
                         if (user)
                             return user;
-                        // Try as JSON containing a token
+                        // Try as JSON — guarded deep recursive scan
                         try {
                             const json = JSON.parse(value);
-                            const user = this.extractUserFromJson(json);
-                            if (user)
-                                return user;
+                            const jsonUser = this.deepScanForUser(json, 0);
+                            if (jsonUser)
+                                return jsonUser;
                         }
                         catch {
                             // Not JSON, skip
@@ -2560,11 +2807,63 @@
             }
             return null;
         }
+        // ════════════════════════════════════════════════
+        // DEEP RECURSIVE SCANNING (guarded)
+        // ════════════════════════════════════════════════
+        /**
+         * Recursively scan a JSON object for user data.
+         * Guards: max depth (4), max keys per level (20), no array traversal.
+         *
+         * Handles ANY nesting pattern:
+         *   - Zustand persist: { state: { user: { email } } }
+         *   - Redux persist:   { auth: { user: { email } } }
+         *   - Pinia:           { auth: { userData: { email } } }
+         *   - NextAuth:        { user: { email }, expires: ... }
+         *   - Direct:          { email, name }
+         */
+        deepScanForUser(data, depth) {
+            if (depth > MAX_SCAN_DEPTH || !data || typeof data !== 'object' || Array.isArray(data)) {
+                return null;
+            }
+            const obj = data;
+            const keys = Object.keys(obj);
+            // 1. Try direct extraction at this level
+            const user = this.extractUserFromClaims(obj);
+            if (user)
+                return user;
+            // Guard: limit keys scanned per level
+            const keysToScan = keys.slice(0, MAX_KEYS_PER_LEVEL);
+            // 2. Check for JWT strings at this level
+            for (const key of keysToScan) {
+                const val = obj[key];
+                if (typeof val === 'string' && val.length > 30 && val.length < 4000) {
+                    // Only check strings that could plausibly be JWTs (30-4000 chars)
+                    const dotCount = (val.match(/\./g) || []).length;
+                    if (dotCount === 2) {
+                        const tokenUser = this.extractUserFromToken(val);
+                        if (tokenUser)
+                            return tokenUser;
+                    }
+                }
+            }
+            // 3. Recurse into nested objects
+            for (const key of keysToScan) {
+                const val = obj[key];
+                if (val && typeof val === 'object' && !Array.isArray(val)) {
+                    const nestedUser = this.deepScanForUser(val, depth + 1);
+                    if (nestedUser)
+                        return nestedUser;
+                }
+            }
+            return null;
+        }
+        // ════════════════════════════════════════════════
+        // TOKEN & CLAIMS EXTRACTION
+        // ════════════════════════════════════════════════
         /**
-         * Try to extract user info from a JWT token string
+         * Try to extract user info from a JWT token string (header.payload.signature)
          */
         extractUserFromToken(token) {
-            // JWT format: header.payload.signature
             const parts = token.split('.');
             if (parts.length !== 3)
                 return null;
@@ -2577,48 +2876,29 @@
             }
         }
         /**
-         * Extract user info from a JSON object (e.g., Firebase auth user stored in localStorage)
-         */
-        extractUserFromJson(data) {
-            if (!data || typeof data !== 'object')
-                return null;
-            // Direct user object
-            const user = this.extractUserFromClaims(data);
-            if (user)
-                return user;
-            // Nested: { user: { email } } or { data: { user: { email } } }
-            for (const key of ['user', 'data', 'session', 'currentUser', 'authUser', 'access_token', 'token']) {
-                if (data[key]) {
-                    if (typeof data[key] === 'string') {
-                        // Might be a JWT inside JSON
-                        const tokenUser = this.extractUserFromToken(data[key]);
-                        if (tokenUser)
-                            return tokenUser;
-                    }
-                    else if (typeof data[key] === 'object') {
-                        const nestedUser = this.extractUserFromClaims(data[key]);
-                        if (nestedUser)
-                            return nestedUser;
-                    }
-                }
-            }
-            return null;
-        }
-        /**
-         * Extract user from JWT claims or user object
+         * Extract user from JWT claims or user-like object.
+         * Uses proper email regex validation.
          */
         extractUserFromClaims(claims) {
             if (!claims || typeof claims !== 'object')
                 return null;
-            // Find email
+            // Find email — check standard claim fields
             let email = null;
             for (const claim of EMAIL_CLAIMS) {
                 const value = claims[claim];
-                if (value && typeof value === 'string' && value.includes('@') && value.includes('.')) {
+                if (value && typeof value === 'string' && this.isValidEmail(value)) {
                     email = value;
                     break;
                 }
             }
+            // Check nested email objects (Clerk pattern)
+            if (!email) {
+                const nestedEmail = claims.primaryEmailAddress?.emailAddress
+                    || claims.emailAddresses?.[0]?.emailAddress;
+                if (nestedEmail && typeof nestedEmail === 'string' && this.isValidEmail(nestedEmail)) {
+                    email = nestedEmail;
+                }
+            }
             if (!email)
                 return null;
             // Find name
@@ -2636,7 +2916,7 @@
                     break;
                 }
             }
-            // If no first/last name, try full name
+            // Try full name if no first/last found
             if (!firstName) {
                 for (const claim of NAME_CLAIMS) {
                     if (claims[claim] && typeof claims[claim] === 'string') {
@@ -2649,6 +2929,117 @@
             }
             return { email, firstName, lastName };
         }
+        // ════════════════════════════════════════════════
+        // GUARDED SESSION PROBING (NextAuth only)
+        // ════════════════════════════════════════════════
+        /**
+         * Probe NextAuth session endpoint ONLY if NextAuth signals are present.
+         * Signals: `next-auth.session-token` cookie, `__NEXTAUTH` or `__NEXT_DATA__` globals.
+         * This prevents unnecessary 404 errors on non-NextAuth sites.
+         */
+        async guardedSessionProbe() {
+            if (this.identifiedEmail)
+                return;
+            // Check for NextAuth signals before probing
+            const hasNextAuthCookie = typeof document !== 'undefined' &&
+                (document.cookie.includes('next-auth.session-token') ||
+                    document.cookie.includes('__Secure-next-auth.session-token'));
+            const hasNextAuthGlobal = typeof window !== 'undefined' &&
+                (window.__NEXTAUTH != null || window.__NEXT_DATA__ != null);
+            if (!hasNextAuthCookie && !hasNextAuthGlobal)
+                return;
+            // NextAuth detected — safe to probe /api/auth/session
+            try {
+                const response = await fetch('/api/auth/session', {
+                    method: 'GET',
+                    credentials: 'include',
+                    headers: { 'Accept': 'application/json' },
+                });
+                if (response.ok) {
+                    const body = await response.json();
+                    // NextAuth returns { user: { name, email, image }, expires }
+                    if (body && typeof body === 'object' && Object.keys(body).length > 0) {
+                        const user = this.deepScanForUser(body, 0);
+                        if (user) {
+                            this.identifyUser(user);
+                        }
+                    }
+                }
+            }
+            catch {
+                // Endpoint failed — silently ignore
+            }
+        }
+        // ════════════════════════════════════════════════
+        // AWS COGNITO STORAGE SCANNING
+        // ════════════════════════════════════════════════
+        /**
+         * Scan localStorage for AWS Cognito / Amplify user data.
+         * Cognito stores tokens under keys like:
+         *   CognitoIdentityServiceProvider.<clientId>.<username>.idToken
+         *   CognitoIdentityServiceProvider.<clientId>.<username>.userData
+         */
+        checkCognitoStorage() {
+            try {
+                for (let i = 0; i < localStorage.length; i++) {
+                    const key = localStorage.key(i);
+                    if (!key)
+                        continue;
+                    // Look for Cognito ID tokens (contain email in JWT claims)
+                    if (key.startsWith('CognitoIdentityServiceProvider.') && key.endsWith('.idToken')) {
+                        const value = localStorage.getItem(key);
+                        if (value && value.length < MAX_STORAGE_VALUE_SIZE) {
+                            const user = this.extractUserFromToken(value);
+                            if (user)
+                                return user;
+                        }
+                    }
+                    // Look for Cognito userData (JSON with email attribute)
+                    if (key.startsWith('CognitoIdentityServiceProvider.') && key.endsWith('.userData')) {
+                        const value = localStorage.getItem(key);
+                        if (value && value.length < MAX_STORAGE_VALUE_SIZE) {
+                            try {
+                                const data = JSON.parse(value);
+                                // Cognito userData format: { UserAttributes: [{ Name: 'email', Value: '...' }] }
+                                const attrs = data.UserAttributes || data.attributes || [];
+                                const emailAttr = attrs.find?.((a) => a.Name === 'email' || a.name === 'email');
+                                if (emailAttr?.Value && this.isValidEmail(emailAttr.Value)) {
+                                    const nameAttr = attrs.find?.((a) => a.Name === 'name' || a.name === 'name');
+                                    const givenNameAttr = attrs.find?.((a) => a.Name === 'given_name' || a.name === 'given_name');
+                                    const familyNameAttr = attrs.find?.((a) => a.Name === 'family_name' || a.name === 'family_name');
+                                    let firstName = givenNameAttr?.Value;
+                                    let lastName = familyNameAttr?.Value;
+                                    if (!firstName && nameAttr?.Value) {
+                                        const parts = nameAttr.Value.split(' ');
+                                        firstName = parts[0];
+                                        lastName = lastName || parts.slice(1).join(' ') || undefined;
+                                    }
+                                    return {
+                                        email: emailAttr.Value,
+                                        firstName: firstName || undefined,
+                                        lastName: lastName || undefined,
+                                    };
+                                }
+                            }
+                            catch { /* invalid JSON */ }
+                        }
+                    }
+                }
+            }
+            catch { /* storage access failed */ }
+            return null;
+        }
+        // ════════════════════════════════════════════════
+        // UTILITIES
+        // ════════════════════════════════════════════════
+        /**
+         * Validate email with proper regex.
+         * Rejects: user@v2.0, config@internal, tokens with @ signs.
+         * Accepts: user@domain.com, user@sub.domain.co.uk
+         */
+        isValidEmail(value) {
+            return EMAIL_REGEX.test(value);
+        }
     }
 
     /**
@@ -3240,28 +3631,17 @@
             }
             const prevId = previousId || this.visitorId;
             logger.info('Aliasing visitor:', { from: prevId, to: newId });
-            try {
-                const url = `${this.config.apiEndpoint}/api/public/track/alias`;
-                const response = await fetch(url, {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({
-                        workspaceId: this.workspaceId,
-                        previousId: prevId,
-                        newId,
-                    }),
-                });
-                if (response.ok) {
-                    logger.info('Alias successful');
-                    return true;
-                }
-                logger.error('Alias failed:', response.status);
-                return false;
-            }
-            catch (error) {
-                logger.error('Alias request failed:', error);
-                return false;
+            const result = await this.transport.sendPost('/api/public/track/alias', {
+                workspaceId: this.workspaceId,
+                previousId: prevId,
+                newId,
+            });
+            if (result.success) {
+                logger.info('Alias successful');
+                return true;
             }
+            logger.error('Alias failed:', result.error ?? result.status);
+            return false;
         }
         /**
          * Track a screen view (for mobile-first PWAs and SPAs).
@@ -3624,13 +4004,24 @@
      * });
      */
     function clianta(workspaceId, config) {
-        // Return existing instance if same workspace
+        // Return existing instance if same workspace and no config change
         if (globalInstance && globalInstance.getWorkspaceId() === workspaceId) {
+            if (config && Object.keys(config).length > 0) {
+                // Config was passed to an already-initialized instance — warn the developer
+                // because the new config is ignored. They must call destroy() first to reconfigure.
+                if (typeof console !== 'undefined') {
+                    console.warn('[Clianta] clianta() called with config on an already-initialized instance ' +
+                        'for workspace "' + workspaceId + '". The new config was ignored. ' +
+                        'Call tracker.destroy() first if you need to reconfigure.');
+                }
+            }
             return globalInstance;
         }
-        // Destroy existing instance if workspace changed
+        // Destroy existing instance if workspace changed (fire-and-forget flush, then destroy)
         if (globalInstance) {
-            globalInstance.destroy();
+            // Kick off async flush+destroy without blocking the new instance creation.
+            // Using void to make the intentional fire-and-forget explicit.
+            void globalInstance.destroy();
         }
         // Create new instance
         globalInstance = new Tracker(workspaceId, config);
@@ -3658,8 +4049,21 @@
             const projectId = script.getAttribute('data-project-id');
             if (!projectId)
                 return;
-            const debug = script.hasAttribute('data-debug');
-            const instance = clianta(projectId, { debug });
+            const initConfig = {
+                debug: script.hasAttribute('data-debug'),
+            };
+            // Support additional config via script tag attributes:
+            //   data-api-endpoint="https://api.yourhost.com"
+            //   data-cookieless  (boolean flag)
+            //   data-use-cookies (boolean flag)
+            const apiEndpoint = script.getAttribute('data-api-endpoint');
+            if (apiEndpoint)
+                initConfig.apiEndpoint = apiEndpoint;
+            if (script.hasAttribute('data-cookieless'))
+                initConfig.cookielessMode = true;
+            if (script.hasAttribute('data-use-cookies'))
+                initConfig.useCookies = true;
+            const instance = clianta(projectId, initConfig);
             // Expose the auto-initialized instance globally
             window.__clianta = instance;
         };