@cross-deck/web 1.2.0 → 1.4.2

package/dist/index.mjs

@@ -63,9 +63,11 @@ function typeMapForStatus(status) {
   return "internal_error";
 }
 
-// src/http.ts
+// src/_version.ts
+var SDK_VERSION = "1.4.2";
 var SDK_NAME = "@cross-deck/web";
-var SDK_VERSION = "1.1.0";
+
+// src/http.ts
 var DEFAULT_BASE_URL = "https://api.cross-deck.com/v1";
 var DEFAULT_TIMEOUT_MS = 15e3;
 var HttpClient = class {
@@ -312,29 +314,258 @@ function randomChars(count) {
   return out.join("");
 }
 
+// src/hash.ts
+var K = new Uint32Array([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+function utf8Bytes(input) {
+  if (typeof TextEncoder !== "undefined") {
+    return new TextEncoder().encode(input);
+  }
+  const out = [];
+  for (let i = 0; i < input.length; i++) {
+    let codePoint = input.charCodeAt(i);
+    if (codePoint >= 55296 && codePoint <= 56319 && i + 1 < input.length) {
+      const next = input.charCodeAt(i + 1);
+      if (next >= 56320 && next <= 57343) {
+        codePoint = 65536 + (codePoint - 55296 << 10) + (next - 56320);
+        i++;
+      }
+    }
+    if (codePoint < 128) {
+      out.push(codePoint);
+    } else if (codePoint < 2048) {
+      out.push(192 | codePoint >> 6);
+      out.push(128 | codePoint & 63);
+    } else if (codePoint < 65536) {
+      out.push(224 | codePoint >> 12);
+      out.push(128 | codePoint >> 6 & 63);
+      out.push(128 | codePoint & 63);
+    } else {
+      out.push(240 | codePoint >> 18);
+      out.push(128 | codePoint >> 12 & 63);
+      out.push(128 | codePoint >> 6 & 63);
+      out.push(128 | codePoint & 63);
+    }
+  }
+  return new Uint8Array(out);
+}
+function sha256Hex(input) {
+  const bytes = utf8Bytes(input);
+  const bitLength = bytes.length * 8;
+  const blockCount = Math.floor((bytes.length + 9 + 63) / 64);
+  const padded = new Uint8Array(blockCount * 64);
+  padded.set(bytes);
+  padded[bytes.length] = 128;
+  const high = Math.floor(bitLength / 4294967296);
+  const low = bitLength >>> 0;
+  const lenOffset = padded.length - 8;
+  padded[lenOffset + 0] = high >>> 24 & 255;
+  padded[lenOffset + 1] = high >>> 16 & 255;
+  padded[lenOffset + 2] = high >>> 8 & 255;
+  padded[lenOffset + 3] = high & 255;
+  padded[lenOffset + 4] = low >>> 24 & 255;
+  padded[lenOffset + 5] = low >>> 16 & 255;
+  padded[lenOffset + 6] = low >>> 8 & 255;
+  padded[lenOffset + 7] = low & 255;
+  const H = new Uint32Array([
+    1779033703,
+    3144134277,
+    1013904242,
+    2773480762,
+    1359893119,
+    2600822924,
+    528734635,
+    1541459225
+  ]);
+  const W = new Uint32Array(64);
+  for (let block = 0; block < blockCount; block++) {
+    const offset = block * 64;
+    for (let t = 0; t < 16; t++) {
+      W[t] = (padded[offset + t * 4] << 24 | padded[offset + t * 4 + 1] << 16 | padded[offset + t * 4 + 2] << 8 | padded[offset + t * 4 + 3]) >>> 0;
+    }
+    for (let t = 16; t < 64; t++) {
+      const w15 = W[t - 15];
+      const w2 = W[t - 2];
+      const s0 = (w15 >>> 7 | w15 << 25) ^ (w15 >>> 18 | w15 << 14) ^ w15 >>> 3;
+      const s1 = (w2 >>> 17 | w2 << 15) ^ (w2 >>> 19 | w2 << 13) ^ w2 >>> 10;
+      W[t] = W[t - 16] + s0 + W[t - 7] + s1 >>> 0;
+    }
+    let a = H[0], b = H[1], c = H[2], d = H[3];
+    let e = H[4], f = H[5], g = H[6], h = H[7];
+    for (let t = 0; t < 64; t++) {
+      const S1 = (e >>> 6 | e << 26) ^ (e >>> 11 | e << 21) ^ (e >>> 25 | e << 7);
+      const ch = e & f ^ ~e & g;
+      const temp1 = h + S1 + ch + K[t] + W[t] >>> 0;
+      const S0 = (a >>> 2 | a << 30) ^ (a >>> 13 | a << 19) ^ (a >>> 22 | a << 10);
+      const maj = a & b ^ a & c ^ b & c;
+      const temp2 = S0 + maj >>> 0;
+      h = g;
+      g = f;
+      f = e;
+      e = d + temp1 >>> 0;
+      d = c;
+      c = b;
+      b = a;
+      a = temp1 + temp2 >>> 0;
+    }
+    H[0] = H[0] + a >>> 0;
+    H[1] = H[1] + b >>> 0;
+    H[2] = H[2] + c >>> 0;
+    H[3] = H[3] + d >>> 0;
+    H[4] = H[4] + e >>> 0;
+    H[5] = H[5] + f >>> 0;
+    H[6] = H[6] + g >>> 0;
+    H[7] = H[7] + h >>> 0;
+  }
+  let hex = "";
+  for (let i = 0; i < 8; i++) {
+    hex += H[i].toString(16).padStart(8, "0");
+  }
+  return hex;
+}
+
 // src/entitlement-cache.ts
 var DEFAULT_STALE_AFTER_MS = 24 * 60 * 60 * 1e3;
-var EntitlementCache = class {
+var ANON_SUFFIX = "_anon";
+var INDEX_SUFFIX = "_index";
+var EntitlementCache = class _EntitlementCache {
   /**
-   * @param storage      Device storage adapter. When omitted (tests) or
-   *                     a MemoryStorage (strict-consent / no-persistence
-   *                     mode) the cache is session-only — durability is
-   *                     simply absent, never wrong.
-   * @param storageKey   Full key the persisted blob lives under.
-   * @param staleAfterMs Age past which last-known-good is flagged stale
-   *                     even without a failed refresh. Default 24h.
+   * @param storage          Device storage adapter. When omitted (tests) or
+   *                         a MemoryStorage (strict-consent / no-persistence
+   *                         mode) the cache is session-only — durability is
+   *                         simply absent, never wrong.
+   * @param storageKeyPrefix Prefix used to derive per-user storage keys
+   *                         (`<prefix>:<sha256(userId)>`). Default
+   *                         `crossdeck:entitlements`. The trailing user
+   *                         suffix is filled at identify() / reset()
+   *                         time — see [[setUserKey]].
+   * @param staleAfterMs     Age past which last-known-good is flagged stale
+   *                         even without a failed refresh. Default 24h.
    */
-  constructor(storage, storageKey = "crossdeck:entitlements", staleAfterMs = DEFAULT_STALE_AFTER_MS) {
+  constructor(storage, storageKeyPrefix = "crossdeck:entitlements", staleAfterMs = DEFAULT_STALE_AFTER_MS) {
     this.all = [];
     this.lastUpdated = 0;
     this.lastRefreshFailedAt = 0;
     this.listeners = /* @__PURE__ */ new Set();
     this.listenerErrorCount = 0;
+    this.currentSuffix = ANON_SUFFIX;
     this.storage = storage;
-    this.storageKey = storageKey;
+    this.storageKeyPrefix = storageKeyPrefix;
     this.staleAfterMs = staleAfterMs;
     this.hydrate();
   }
+  /** The full storage key the current-user blob is persisted under. */
+  get storageKey() {
+    return `${this.storageKeyPrefix}:${this.currentSuffix}`;
+  }
+  /** Key of the index blob — a JSON array of every suffix we've
+   * written. Used by clearAll() to scope a logout-wipe. */
+  get indexKey() {
+    return `${this.storageKeyPrefix}:${INDEX_SUFFIX}`;
+  }
+  /** Derive a stable suffix for a developerUserId via SHA-256. The
+   * raw userId never lands in the storage key — protects against
+   * accidentally leaking email-style identifiers through DevTools
+   * inspection. Pass `null` to switch back to the anonymous slot. */
+  static suffixForUserId(userId) {
+    if (userId == null || userId === "") return ANON_SUFFIX;
+    return sha256Hex(userId);
+  }
+  /**
+   * Switch the cache to a different user's storage slot. Bank-grade
+   * three-layer isolation:
+   *   (a) Physical key separation — `<prefix>:<sha256(userId)>` so
+   *       a user-switch can't physically read prior user's data
+   *       even if the in-memory clear was skipped.
+   *   (b) Unconditional in-memory clear — invoked whenever the
+   *       active suffix changes, even on same-id re-identify.
+   *   (c) Re-hydrate from the new slot — a returning user observes
+   *       their last-known-good cache from storage immediately.
+   *
+   * Caller (identify() / reset()) MUST invoke this BEFORE the next
+   * setFromList() so the write lands under the right key.
+   */
+  setUserKey(userId) {
+    const nextSuffix = _EntitlementCache.suffixForUserId(userId);
+    if (nextSuffix === this.currentSuffix) {
+      this.all = [];
+      this.lastUpdated = 0;
+      this.lastRefreshFailedAt = 0;
+      this.notify();
+      this.hydrate();
+      return;
+    }
+    this.currentSuffix = nextSuffix;
+    this.all = [];
+    this.lastUpdated = 0;
+    this.lastRefreshFailedAt = 0;
+    this.hydrate();
+    this.notify();
+  }
   /**
    * Sync read — true iff the entitlement is currently granting access.
    *
@@ -404,12 +635,13 @@ var EntitlementCache = class {
     this.lastUpdated = Date.now();
     this.lastRefreshFailedAt = 0;
     this.persist();
+    this.recordSuffixInIndex(this.currentSuffix);
     this.notify();
   }
   /**
-   * Wipe — used on reset() (logout) and on an identity switch. Clears
-   * BOTH memory and durable storage so a prior user's entitlements can
-   * never leak to the next person on this device.
+   * Wipe the CURRENT user's slot. Used internally when a single
+   * user's cache needs to be invalidated without affecting other
+   * persisted slots. The full-logout path is [[clearAll]].
    */
   clear() {
     this.all = [];
@@ -421,6 +653,40 @@ var EntitlementCache = class {
       } catch {
       }
     }
+    this.removeSuffixFromIndex(this.currentSuffix);
+    this.notify();
+  }
+  /**
+   * Logout-grade wipe — bank-grade contract: removes EVERY per-user
+   * entitlement slot the SDK has ever written on this device, then
+   * clears the index. Used by `Crossdeck.reset()` so a logout on a
+   * shared device can never leave another user's entitlements
+   * readable (layer (c) of the v1.4.0 isolation fix).
+   *
+   * After clearAll(), the cache is back to anonymous + empty.
+   */
+  clearAll() {
+    this.all = [];
+    this.lastUpdated = 0;
+    this.lastRefreshFailedAt = 0;
+    this.currentSuffix = ANON_SUFFIX;
+    if (this.storage) {
+      const suffixes = this.readIndex();
+      for (const suffix of suffixes) {
+        try {
+          this.storage.removeItem(`${this.storageKeyPrefix}:${suffix}`);
+        } catch {
+        }
+      }
+      try {
+        this.storage.removeItem(`${this.storageKeyPrefix}:${ANON_SUFFIX}`);
+      } catch {
+      }
+      try {
+        this.storage.removeItem(this.indexKey);
+      } catch {
+      }
+    }
     this.notify();
   }
   /**
@@ -470,6 +736,47 @@ var EntitlementCache = class {
     } catch {
     }
   }
+  /** Read the index of all per-user suffixes the SDK has written. */
+  readIndex() {
+    if (!this.storage) return [];
+    try {
+      const raw = this.storage.getItem(this.indexKey);
+      if (!raw) return [];
+      const parsed = JSON.parse(raw);
+      if (Array.isArray(parsed)) {
+        return parsed.filter((x) => typeof x === "string");
+      }
+      return [];
+    } catch {
+      return [];
+    }
+  }
+  /** Add a suffix to the persisted index. Idempotent. */
+  recordSuffixInIndex(suffix) {
+    if (!this.storage) return;
+    const existing = this.readIndex();
+    if (existing.includes(suffix)) return;
+    existing.push(suffix);
+    try {
+      this.storage.setItem(this.indexKey, JSON.stringify(existing));
+    } catch {
+    }
+  }
+  /** Remove a suffix from the persisted index. No-op if absent. */
+  removeSuffixFromIndex(suffix) {
+    if (!this.storage) return;
+    const existing = this.readIndex();
+    const next = existing.filter((s) => s !== suffix);
+    if (next.length === existing.length) return;
+    try {
+      if (next.length === 0) {
+        this.storage.removeItem(this.indexKey);
+      } else {
+        this.storage.setItem(this.indexKey, JSON.stringify(next));
+      }
+    } catch {
+    }
+  }
   notify() {
     if (this.listeners.size === 0) return;
     const snapshot = this.all.slice();
@@ -484,6 +791,34 @@ var EntitlementCache = class {
   }
 };
 
+// src/idempotency-key.ts
+function formatAsUuid(hex) {
+  return [
+    hex.slice(0, 8),
+    hex.slice(8, 12),
+    hex.slice(12, 16),
+    hex.slice(16, 20),
+    hex.slice(20, 32)
+  ].join("-");
+}
+function deriveIdempotencyKeyForPurchase(body) {
+  let identifier;
+  if (body.rail === "apple") {
+    identifier = body.signedTransactionInfo ?? "";
+  } else if (body.rail === "google") {
+    identifier = body.purchaseToken ?? "";
+  } else {
+    identifier = "";
+  }
+  if (!identifier) {
+    throw new Error(
+      `deriveIdempotencyKeyForPurchase: no stable identifier in body (rail=${body.rail}). Apple needs signedTransactionInfo; Google needs purchaseToken.`
+    );
+  }
+  const namespaced = `crossdeck:purchases/sync:${body.rail}:${identifier}`;
+  return formatAsUuid(sha256Hex(namespaced));
+}
+
 // src/retry-policy.ts
 var DEFAULT_BASE = 1e3;
 var DEFAULT_MAX = 6e4;
@@ -496,8 +831,10 @@ function computeNextDelay(attempts, retryAfterMs, options = {}, random = Math.ra
   const safeAttempts = Math.min(attempts, 30);
   const ceiling = Math.min(max, base * Math.pow(factor, safeAttempts));
   const jittered = ceiling * random();
-  if (retryAfterMs !== void 0 && retryAfterMs > jittered) {
-    return Math.min(max, retryAfterMs);
+  if (retryAfterMs !== void 0) {
+    const ABSOLUTE_MAX_MS = 24 * 60 * 60 * 1e3;
+    const honoured = Math.min(ABSOLUTE_MAX_MS, retryAfterMs);
+    if (honoured > jittered) return honoured;
   }
   return Math.max(0, Math.round(jittered));
 }
@@ -532,6 +869,27 @@ var EventQueue = class {
   constructor(cfg) {
     this.cfg = cfg;
     this.buffer = [];
+    /**
+     * In-flight events that have been spliced from `buffer` for the
+     * current batch but haven't yet been confirmed (success or permanent
+     * failure). On a retry-driven re-flush we re-use this slot alongside
+     * `pendingBatchId` so the Stripe-style Idempotency-Key is preserved
+     * across retries of the SAME logical batch.
+     *
+     * Pre-fix the splice cleared the buffer AND we immediately
+     * `persistent.save(empty)` BEFORE awaiting the network call — a
+     * crash mid-flight wiped the persisted blob and the batch was lost
+     * with no replay on next boot. Now the persisted blob always carries
+     * `[...pendingBatch, ...buffer]` so the in-flight events survive
+     * until the server confirms them.
+     *
+     * Pre-fix every retry attempt also minted a NEW batchId via
+     * `splice + mintBatchId`, defeating the backend's
+     * `Idempotency-Key` dedup. Reuse via this slot brings web in
+     * lockstep with node (which already had the field).
+     */
+    this.pendingBatch = null;
+    this.pendingBatchId = null;
     this.dropped = 0;
     this.inFlight = 0;
     this.lastFlushAt = 0;
@@ -564,7 +922,7 @@ var EventQueue = class {
       this.cfg.onDrop?.(overflow);
     }
     this.cfg.onBufferChange?.(this.buffer.length);
-    this.persistent?.save(this.buffer);
+    this.persistAll();
     if (this.buffer.length >= this.cfg.batchSize) {
       void this.flush();
     } else {
@@ -573,22 +931,44 @@ var EventQueue = class {
   }
   /**
    * Flush the buffer to /v1/events. Resolves when the network call
-   * completes (success or failure). On failure, events stay in the
-   * buffer for the next scheduled retry.
+   * completes (success or failure). On a retryable failure the batch
+   * stays in `pendingBatch` for the next scheduled retry — the SAME
+   * batch with the SAME `Idempotency-Key` is re-sent (Stripe pattern).
+   *
+   * Three terminal states from one call:
+   *   - 2xx success: pendingBatch cleared, persisted state collapses to
+   *     just `buffer` (any new events that arrived during in-flight).
+   *   - 4xx permanent (except 408/429): pendingBatch DROPPED, `dropped`
+   *     counter increments, a `permanent_failure` signal fires. The
+   *     server is telling us our request is malformed / our key is
+   *     revoked / we lack permission — retrying with the same key
+   *     forever just grows the queue while the customer thinks events
+   *     are landing.
+   *   - 5xx / network / 408 / 429: pendingBatch + batchId stay; backoff
+   *     schedules a retry; the next `flush()` re-uses both.
    *
    * `options.keepalive` marks the underlying fetch as keepalive so the
-   * browser keeps the request alive past page unload. Use this for
-   * terminal flushes (pagehide / visibilitychange→hidden / beforeunload).
+   * browser keeps the request alive past page unload. Use for terminal
+   * flushes (pagehide / visibilitychange→hidden / beforeunload).
    */
   async flush(options = {}) {
-    if (this.buffer.length === 0) return null;
+    let batch;
+    let batchId;
+    if (this.pendingBatch !== null && this.pendingBatchId !== null) {
+      batch = this.pendingBatch;
+      batchId = this.pendingBatchId;
+    } else {
+      if (this.buffer.length === 0) return null;
+      batch = this.buffer.splice(0);
+      batchId = this.mintBatchId();
+      this.pendingBatch = batch;
+      this.pendingBatchId = batchId;
+      this.inFlight += batch.length;
+      this.cfg.onBufferChange?.(this.buffer.length);
+      this.persistAll();
+    }
     this.cancelTimerIfSet();
     this.nextRetryAt = null;
-    const batch = this.buffer.splice(0);
-    const batchId = this.mintBatchId();
-    this.inFlight += batch.length;
-    this.persistent?.save(this.buffer);
-    this.cfg.onBufferChange?.(this.buffer.length);
     try {
       const env = this.cfg.envelope();
       const result = await this.cfg.http.request("POST", "/events", {
@@ -607,20 +987,33 @@ var EventQueue = class {
       this.lastFlushAt = Date.now();
       this.lastError = null;
       this.inFlight -= batch.length;
+      this.pendingBatch = null;
+      this.pendingBatchId = null;
       this.retry.recordSuccess();
-      this.persistent?.save(this.buffer);
+      this.persistAll();
       if (!this.firstFlushFired) {
         this.firstFlushFired = true;
         this.cfg.onFirstFlushSuccess?.();
       }
       return result;
     } catch (err) {
-      this.buffer.unshift(...batch);
-      this.inFlight -= batch.length;
       const message = err instanceof Error ? err.message : String(err);
       this.lastError = message;
-      this.persistent?.save(this.buffer);
-      this.cfg.onBufferChange?.(this.buffer.length);
+      if (isPermanent4xx(err)) {
+        const droppedCount = batch.length;
+        this.pendingBatch = null;
+        this.pendingBatchId = null;
+        this.inFlight -= droppedCount;
+        this.dropped += droppedCount;
+        this.persistAll();
+        this.cfg.onDrop?.(droppedCount);
+        this.cfg.onPermanentFailure?.({
+          status: err.status ?? 0,
+          droppedCount,
+          lastError: message
+        });
+        return null;
+      }
       const retryAfterMs = extractRetryAfterMs(err);
       const delay = this.retry.nextDelay(retryAfterMs);
       this.scheduleRetry(delay);
@@ -638,6 +1031,8 @@ var EventQueue = class {
     this.cancelTimerIfSet();
     this.nextRetryAt = null;
     this.buffer = [];
+    this.pendingBatch = null;
+    this.pendingBatchId = null;
     this.dropped = 0;
     this.inFlight = 0;
     this.lastError = null;
@@ -647,6 +1042,10 @@ var EventQueue = class {
   }
   getStats() {
     return {
+      // `buffered` counts events waiting for their FIRST flush. The
+      // in-flight pendingBatch (retrying) is tracked separately via
+      // `inFlight` — surfacing both lets diagnostics show "we have
+      // events stuck retrying" distinct from "new events arriving".
       buffered: this.buffer.length,
       dropped: this.dropped,
       inFlight: this.inFlight,
@@ -656,6 +1055,29 @@ var EventQueue = class {
       nextRetryAt: this.nextRetryAt
     };
   }
+  /**
+   * The Idempotency-Key of the in-flight pending batch (if any).
+   * Exposed for testing the Stripe-style retry-reuse contract.
+   * Production callers don't need this.
+   */
+  get pendingIdempotencyKey() {
+    return this.pendingBatchId;
+  }
+  /**
+   * Persist `[...pendingBatch, ...buffer]` — the full set of
+   * not-yet-confirmed events. The next boot rehydrates this exact set
+   * into `buffer` and replays. The server dedups via eventId
+   * (ReplacingMergeTree on the warehouse side), so re-sending an event
+   * that may have already landed is safe.
+   */
+  persistAll() {
+    if (!this.persistent) return;
+    if (this.pendingBatch === null) {
+      this.persistent.save(this.buffer);
+      return;
+    }
+    this.persistent.save([...this.pendingBatch, ...this.buffer]);
+  }
   // ---------- internal scheduling ----------
   scheduleIdleFlush() {
     this.cancelTimerIfSet();
@@ -689,6 +1111,14 @@ function extractRetryAfterMs(err) {
   }
   return void 0;
 }
+function isPermanent4xx(err) {
+  if (!err || typeof err !== "object") return false;
+  const status = err.status;
+  if (typeof status !== "number" || !Number.isFinite(status)) return false;
+  if (status < 400 || status >= 500) return false;
+  if (status === 408 || status === 429) return false;
+  return true;
+}
 function defaultScheduler(fn, ms) {
   const id = setTimeout(fn, ms);
   if (typeof id.unref === "function") {
@@ -1030,6 +1460,7 @@ var AutoTracker = class {
   /** Exposed for tests + consumers that want to reset the session manually. */
   resetSession() {
     if (this.session && !this.session.endedSent) this.emitSessionEnd();
+    this.pageviewId = null;
     this.session = this.startNewSession();
     this.emitSessionStart();
   }
@@ -1066,6 +1497,7 @@ var AutoTracker = class {
         const hiddenFor = this.session.hiddenAt ? Date.now() - this.session.hiddenAt : 0;
         if (hiddenFor >= SESSION_RESUME_THRESHOLD_MS) {
           this.emitSessionEnd();
+          this.pageviewId = null;
           this.session = this.startNewSession();
           this.emitSessionStart();
         } else {
@@ -1439,7 +1871,7 @@ function validateEventProperties(input, options = {}) {
   const maxStringLength = options.maxStringLength ?? DEFAULT_MAX_STRING;
   const maxBatchPropertyBytes = options.maxBatchPropertyBytes ?? DEFAULT_MAX_BYTES;
   const maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;
-  const seen = /* @__PURE__ */ new WeakSet();
+  const seen = /* @__PURE__ */ new Set();
   const visit = (value, key, depth) => {
     if (depth > maxDepth) {
       warnings.push({ kind: "depth_exceeded", key });
@@ -1527,6 +1959,7 @@ function validateEventProperties(input, options = {}) {
         const result = visit(value[i], `${key}[${i}]`, depth + 1);
         if (result.keep) out.push(result.value);
       }
+      seen.delete(value);
       return { keep: true, value: out };
     }
     if (t === "object") {
@@ -1541,6 +1974,7 @@ function validateEventProperties(input, options = {}) {
         const result = visit(obj[k], `${key}.${k}`, depth + 1);
         if (result.keep) out[k] = result.value;
       }
+      seen.delete(obj);
       return { keep: true, value: out };
     }
     warnings.push({ kind: "non_serialisable", key });
@@ -1883,35 +2317,27 @@ var ConsentManager = class {
 };
 var EMAIL_PATTERN = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
 var CARD_PATTERN = /\b\d(?:[ -]?\d){12,18}\b/g;
-var REPLACEMENT_EMAIL = "[email]";
-var REPLACEMENT_CARD = "[card]";
+var REPLACEMENT_EMAIL = "<email>";
+var REPLACEMENT_CARD = "<card>";
 function scrubPii(value) {
   if (!value) return value;
-  let out = value;
-  if (EMAIL_PATTERN.test(out)) {
-    out = out.replace(EMAIL_PATTERN, REPLACEMENT_EMAIL);
-  }
-  EMAIL_PATTERN.lastIndex = 0;
-  if (CARD_PATTERN.test(out)) {
-    out = out.replace(CARD_PATTERN, REPLACEMENT_CARD);
-  }
-  CARD_PATTERN.lastIndex = 0;
-  return out;
+  return value.replace(EMAIL_PATTERN, REPLACEMENT_EMAIL).replace(CARD_PATTERN, REPLACEMENT_CARD);
 }
 function scrubPiiFromProperties(properties) {
   const out = {};
   for (const k of Object.keys(properties)) {
-    const v = properties[k];
-    if (typeof v === "string") {
-      out[k] = scrubPii(v);
-    } else if (Array.isArray(v)) {
-      out[k] = v.map((item) => typeof item === "string" ? scrubPii(item) : item);
-    } else {
-      out[k] = v;
-    }
+    out[k] = scrubValue(properties[k]);
   }
   return out;
 }
+function scrubValue(v) {
+  if (typeof v === "string") return scrubPii(v);
+  if (Array.isArray(v)) return v.map(scrubValue);
+  if (v && typeof v === "object" && v.constructor === Object) {
+    return scrubPiiFromProperties(v);
+  }
+  return v;
+}
 
 // src/breadcrumbs.ts
 var BreadcrumbBuffer = class {
@@ -2201,16 +2627,18 @@ var ErrorTracker = class {
       const url = typeof input === "string" ? input : input?.url ?? "";
       const method = (init.method || "GET").toUpperCase();
       const start = Date.now();
-      this.opts.breadcrumbs.add({
-        timestamp: start,
-        category: "http",
-        message: `${method} ${url}`,
-        data: { url, method }
-      });
+      if (!isSelfRequest(url, this.opts.selfHostname)) {
+        this.opts.breadcrumbs.add({
+          timestamp: start,
+          category: "http",
+          message: `${method} ${url}`,
+          data: { url, method }
+        });
+      }
       try {
         const response = await origFetch(...args);
         if (response.status >= 500 && this.opts.isConsented()) {
-          if (!url.includes("api.cross-deck.com")) {
+          if (!isSelfRequest(url, this.opts.selfHostname)) {
             this.captureHttp({
               url,
               method,
@@ -2259,7 +2687,7 @@ var ErrorTracker = class {
         try {
           if (xhr.status >= 500 && tracker.opts.isConsented()) {
             const url = xhr._cdUrl ?? "";
-            if (!url.includes("api.cross-deck.com")) {
+            if (!isSelfRequest(url, tracker.opts.selfHostname)) {
               tracker.captureHttp({
                 url,
                 method: (xhr._cdMethod ?? "GET").toUpperCase(),
@@ -2419,9 +2847,10 @@ var ErrorTracker = class {
     if (!this.passesSample(err)) return;
     if (!this.passesRateLimit(err)) return;
     let finalErr = err;
-    if (this.opts.beforeSend) {
+    const hook = this.opts.beforeSend?.();
+    if (hook) {
       try {
-        finalErr = this.opts.beforeSend(err);
+        finalErr = hook(err);
       } catch {
         finalErr = err;
       }
@@ -2603,6 +3032,22 @@ function safeClone(v) {
 function safeStringify2(v) {
   return coerceErrorPayload(v).message;
 }
+function extractSelfHostname(baseUrl) {
+  if (!baseUrl || typeof baseUrl !== "string") return null;
+  try {
+    return new URL(baseUrl).hostname.toLowerCase();
+  } catch {
+    return null;
+  }
+}
+function isSelfRequest(requestUrl, selfHostname) {
+  if (!selfHostname || !requestUrl) return false;
+  try {
+    return new URL(requestUrl).hostname.toLowerCase() === selfHostname;
+  } catch {
+    return false;
+  }
+}
 
 // src/crossdeck.ts
 var CrossdeckClient = class {
@@ -2619,6 +3064,28 @@ var CrossdeckClient = class {
    * mismatched env fails fast at boot rather than at first event-flush.
    */
   init(options) {
+    if (this.state) {
+      try {
+        this.state.uninstallUnloadFlush?.();
+      } catch {
+      }
+      try {
+        this.state.autoTracker?.uninstall();
+      } catch {
+      }
+      try {
+        this.state.webVitals?.uninstall();
+      } catch {
+      }
+      try {
+        this.state.errors?.uninstall();
+      } catch {
+      }
+      try {
+        void this.state.events.flush({ keepalive: true });
+      } catch {
+      }
+    }
     if (!options.publicKey || !options.publicKey.startsWith("cd_pub_")) {
       throw new CrossdeckError({
         type: "configuration_error",
@@ -2665,7 +3132,12 @@ var CrossdeckClient = class {
       // load still flushes if the user leaves quickly (the keepalive
       // pagehide handler picks up anything that doesn't); long enough
       // that bursts of clicks coalesce into one network round-trip.
-      eventFlushIntervalMs: options.eventFlushIntervalMs ?? 1500,
+      // v1.4.0 Phase 3.3 — flush interval default parity. Pre-
+      // v1.4.0: Web/Node 1500ms, RN/Swift/Android 5000ms. All
+      // converged on 2000ms (the Stripe-adjacent industry norm)
+      // so cross-platform funnels show events landing at the
+      // same cadence on every SDK. Per-instance override stays.
+      eventFlushIntervalMs: options.eventFlushIntervalMs ?? 2e3,
       sdkVersion: options.sdkVersion ?? SDK_VERSION,
       autoTrack,
       appVersion: options.appVersion ?? null
@@ -2726,6 +3198,15 @@ var CrossdeckClient = class {
           `Event flush failed (${info.lastError}). Retrying in ${info.delayMs}ms (attempt ${info.consecutiveFailures}).`,
           { ...info }
         );
+      },
+      onPermanentFailure: (info) => {
+        const headline = `[crossdeck] Event batch DROPPED (status ${info.status}): ${info.lastError}. ${info.droppedCount} event(s) lost \u2014 check your publishable key + app config.`;
+        console.error(headline);
+        debug.emit(
+          "sdk.flush_permanent_failure",
+          headline,
+          { ...info }
+        );
       }
     });
     const deviceInfo = autoTrack.deviceInfo ? collectDeviceInfo({ appVersion: opts.appVersion ?? void 0 }) : opts.appVersion ? { appVersion: opts.appVersion } : {};
@@ -2792,8 +3273,20 @@ var CrossdeckClient = class {
         report: (err) => this.reportError(err),
         getContext: () => ({ ...this.state.errorContext }),
         getTags: () => ({ ...this.state.errorTags }),
-        beforeSend: this.state.errorBeforeSend,
-        isConsented: () => this.state.consent.errors
+        // GETTER, not a captured value — `setErrorBeforeSend()` mutates
+        // `state.errorBeforeSend` after init() and the tracker MUST
+        // pick up the new hook on the next error. The pre-fix shape
+        // (`beforeSend: this.state!.errorBeforeSend`) snapshotted
+        // `null` at construction and made the customer's PII scrubber
+        // silently inert. See error-capture.ts:ErrorTrackerOptions.beforeSend.
+        beforeSend: () => this.state.errorBeforeSend,
+        isConsented: () => this.state.consent.errors,
+        // Derived from the configured baseUrl at init() time. Used by
+        // the fetch / XHR wrappers to skip captureHttp on Crossdeck's
+        // own requests — pre-fix the skip was hardcoded to
+        // `api.cross-deck.com` and broke for customers on staging /
+        // regional / self-hosted base URLs (recursive capture loop).
+        selfHostname: extractSelfHostname(opts.baseUrl)
       });
       this.state.errors = tracker;
       tracker.install();
@@ -2872,13 +3365,10 @@ var CrossdeckClient = class {
     };
     if (options?.email) body.email = options.email;
     if (traits) body.traits = traits;
+    s.entitlements.setUserKey(userId);
     const result = await s.http.request("POST", "/identity/alias", {
       body
     });
-    const priorCdcust = s.identity.crossdeckCustomerId;
-    if (priorCdcust && result.crossdeckCustomerId && priorCdcust !== result.crossdeckCustomerId) {
-      s.entitlements.clear();
-    }
     s.identity.setCrossdeckCustomerId(result.crossdeckCustomerId);
     s.developerUserId = userId;
     return result;
@@ -3318,11 +3808,25 @@ var CrossdeckClient = class {
         message: "syncPurchases requires a signedTransactionInfo string from StoreKit 2."
       });
     }
+    const rail = input.rail ?? "apple";
+    const body = { ...input, rail };
+    const idempotencyKey = deriveIdempotencyKeyForPurchase(body);
     const result = await s.http.request("POST", "/purchases/sync", {
-      body: { rail: input.rail ?? "apple", ...input }
+      body,
+      idempotencyKey
     });
     s.identity.setCrossdeckCustomerId(result.crossdeckCustomerId);
     s.entitlements.setFromList(result.entitlements);
+    try {
+      const sourceProductId = result.entitlements[0]?.source.productId;
+      const sourceSubscriptionId = result.entitlements[0]?.source.subscriptionId;
+      const props = { rail };
+      if (sourceProductId) props.productId = sourceProductId;
+      if (sourceSubscriptionId) props.subscriptionId = sourceSubscriptionId;
+      if (result.idempotent_replay) props.idempotent_replay = true;
+      this.track("purchase.completed", props);
+    } catch {
+    }
     s.debug.emit(
       "sdk.purchase_evidence_sent",
       "StoreKit transaction forwarded. Waiting for backend verification.",
@@ -3378,13 +3882,15 @@ var CrossdeckClient = class {
     }
     this.state.autoTracker?.uninstall();
     this.state.identity.reset();
-    this.state.entitlements.clear();
+    this.state.entitlements.clearAll();
     this.state.events.reset();
     this.state.superProps.clear();
     this.state.breadcrumbs.clear();
     this.state.errorContext = {};
     this.state.errorTags = {};
     this.state.developerUserId = null;
+    this.state.lastServerTime = null;
+    this.state.lastClientTime = null;
     if (this.state.autoTracker) {
       const tracker = new AutoTracker(
         this.state.options.autoTrack,
@@ -3513,7 +4019,9 @@ function isLocalHostname() {
   const hostname = w?.location?.hostname;
   if (!hostname) return false;
   if (hostname === "localhost" || hostname === "127.0.0.1") return true;
+  if (hostname === "0.0.0.0") return true;
   if (hostname === "::1" || hostname === "[::1]") return true;
+  if (/^\[?fe80::/i.test(hostname)) return true;
   if (hostname.endsWith(".local")) return true;
   if (/^10\./.test(hostname)) return true;
   if (/^192\.168\./.test(hostname)) return true;
@@ -3649,6 +4157,116 @@ var CROSSDECK_ERROR_CODES = Object.freeze([
     description: "The server returned a 2xx with an unparseable body.",
     resolution: "Likely a transient backend bug. Retry; if it persists, contact support with the requestId.",
     retryable: true
+  },
+  // ----- Backend-emitted codes (v1.4.0 Phase 6.2 backfill) -----
+  // Mirror of backend/src/api/v1-errors.ts ApiErrorCode. A developer
+  // hitting any of these on the wire can look them up via
+  // getErrorCode(code) for a canonical remediation step instead of
+  // hunting through Slack history.
+  {
+    code: "missing_api_key",
+    type: "authentication_error",
+    description: "No Authorization header (or Crossdeck-Api-Key header) on the request.",
+    resolution: "Make sure Crossdeck.init({ publicKey }) was called with a cd_pub_\u2026 key before the request fired. Re-check your env-vars in CI / Docker if the key is empty at runtime.",
+    retryable: false
+  },
+  {
+    code: "invalid_api_key",
+    type: "authentication_error",
+    description: "The API key is malformed, unknown, or doesn't resolve to a project.",
+    resolution: "Copy the key from your Crossdeck dashboard \u2192 API keys. Confirm prefix is cd_pub_test_ / cd_pub_live_ for client SDKs and cd_sk_test_ / cd_sk_live_ for the Node server SDK.",
+    retryable: false
+  },
+  {
+    code: "key_revoked",
+    type: "authentication_error",
+    description: "The API key was revoked in the Crossdeck dashboard.",
+    resolution: "Mint a fresh key in the dashboard \u2192 API keys \u2192 Create new, swap it in, and redeploy. The revoked key cannot be reactivated.",
+    retryable: false
+  },
+  {
+    code: "identity_token_invalid",
+    type: "authentication_error",
+    description: "The Firebase / Apple / Google ID token supplied with the request didn't verify against the dashboard's configured signers.",
+    resolution: "Refresh the token client-side (Firebase auth.currentUser.getIdToken(true)) and retry. If the failure persists, confirm the signer is registered under dashboard \u2192 Authentication \u2192 Identity sources.",
+    retryable: true
+  },
+  {
+    code: "origin_not_allowed",
+    type: "permission_error",
+    description: "The Origin header isn't in the project's Allowed origins list.",
+    resolution: "Add the origin (e.g. https://app.example.com) under dashboard \u2192 Settings \u2192 Allowed origins. Wildcards like https://*.example.com are supported.",
+    retryable: false
+  },
+  {
+    code: "bundle_id_not_allowed",
+    type: "permission_error",
+    description: "The iOS bundle ID sent via X-Crossdeck-Bundle-Id isn't registered under this app's Apple identity lock.",
+    resolution: "Add the bundle ID under dashboard \u2192 Apps \u2192 <your app> \u2192 iOS bundle IDs.",
+    retryable: false
+  },
+  {
+    code: "package_name_not_allowed",
+    type: "permission_error",
+    description: "The Android package name sent via X-Crossdeck-Package-Name isn't registered under this app's Android identity lock.",
+    resolution: "Add the package name under dashboard \u2192 Apps \u2192 <your app> \u2192 Android package names.",
+    retryable: false
+  },
+  {
+    code: "env_mismatch",
+    type: "permission_error",
+    description: "The request env (inferred from key prefix) doesn't match the resolved app's configured env.",
+    resolution: "Use a cd_pub_live_ / cd_sk_live_ key with a production app, cd_pub_test_ / cd_sk_test_ with a sandbox app. The two cannot cross.",
+    retryable: false
+  },
+  {
+    code: "idempotency_key_in_use",
+    type: "invalid_request_error",
+    description: "An Idempotency-Key was reused for a request with a different body (Stripe-grade contract).",
+    resolution: "Generate a fresh key for a different transaction, or reuse the key only with the EXACT same body. The v1.4.0 SDKs derive keys deterministically from the body so this should never fire on SDK-managed calls.",
+    retryable: false
+  },
+  {
+    code: "rate_limited",
+    type: "rate_limit_error",
+    description: "Request rate exceeded the project's per-second cap.",
+    resolution: "Honour the Retry-After header \u2014 the SDK does this automatically on managed retries. If you're hitting it from a custom code path, throttle to <100 req/s/key.",
+    retryable: true
+  },
+  {
+    code: "internal_error",
+    type: "internal_error",
+    description: "Server-side issue. Safe to retry with backoff.",
+    resolution: "The SDK retries automatically. If your code paths through to this error, contact support with the requestId from the response envelope.",
+    retryable: true
+  },
+  {
+    code: "google_not_supported",
+    type: "invalid_request_error",
+    description: "POST /purchases/sync with rail=google is gated until the Play Developer API reconciliation worker ships.",
+    resolution: "Until v1.5+, Google Play purchases verify via Real-time Developer Notifications. The SDK auto-track path handles this transparently for Android consumers.",
+    retryable: false
+  },
+  {
+    code: "stripe_not_supported",
+    type: "invalid_request_error",
+    description: "POST /purchases/sync with rail=stripe is unsupported \u2014 Stripe Checkout's redirect flow uses platform webhooks instead.",
+    resolution: "Wire Stripe via the standard Checkout / Customer Portal flow; Crossdeck reconciles via the platform webhook automatically. No SDK call needed.",
+    retryable: false
+  },
+  {
+    code: "missing_required_param",
+    type: "invalid_request_error",
+    description: "A required field is absent from the request body.",
+    resolution: "Inspect the error.message \u2014 the missing field name is included verbatim. Refer to the SDK's TypeScript types for the canonical request shape.",
+    retryable: false
+  },
+  {
+    code: "invalid_param_value",
+    type: "invalid_request_error",
+    description: "A field is present but the value failed validation (wrong shape, wrong length, wrong enum value).",
+    resolution: "Read error.message for the specific field + reason. SDK-managed call sites should never emit this \u2014 file a bug if you do.",
+    retryable: false
   }
 ]);
 function getErrorCode(code) {