@datalyr/web 1.0.7 → 1.1.1

package/dist/datalyr.cjs.js

@@ -1,5 +1,5 @@
 /**
- * @datalyr/web v1.0.7
+ * @datalyr/web v1.1.1
  * Datalyr Web SDK - Modern attribution tracking for web applications
  * (c) 2025 Datalyr Inc.
  * Released under the MIT License
@@ -38,17 +38,214 @@ typeof SuppressedError === "function" ? SuppressedError : function (error, suppr
     return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
 };
 
+/**
+ * Encryption Module (SEC-03 Fix)
+ *
+ * Encrypts sensitive PII data before storing in localStorage
+ * Uses Web Crypto API for AES-GCM encryption
+ *
+ * SECURITY NOTE: This protects against casual localStorage reads,
+ * but determined XSS attacks can still access the encryption key in memory.
+ * Primary defense is preventing XSS (see container.ts sandboxing).
+ */
+class DataEncryption {
+    constructor() {
+        this.key = null;
+        this.salt = null;
+    }
+    /**
+     * Initialize encryption with workspace-specific key
+     *
+     * FIXED (SEC-03): Now uses random per-device salt stored in localStorage
+     *
+     * @param workspaceId - Used to derive encryption key
+     * @param deviceId - Device-specific identifier for key derivation
+     */
+    initialize(workspaceId, deviceId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!crypto.subtle) {
+                const error = new Error('Web Crypto API not available - encryption cannot be initialized');
+                console.error('[Datalyr Encryption]', error.message);
+                throw error; // FIXED: Fail loudly instead of silently
+            }
+            try {
+                const encoder = new TextEncoder();
+                // FIXED (SEC-03): Generate or retrieve random per-device salt
+                const saltKey = 'dl_encryption_salt';
+                let saltBase64 = localStorage.getItem(saltKey);
+                if (!saltBase64) {
+                    // Generate new random 32-byte salt
+                    this.salt = crypto.getRandomValues(new Uint8Array(32));
+                    saltBase64 = this.arrayBufferToBase64(this.salt);
+                    localStorage.setItem(saltKey, saltBase64);
+                }
+                else {
+                    // Use existing salt
+                    this.salt = this.base64ToArrayBuffer(saltBase64);
+                }
+                // Derive key material from workspace ID + device ID
+                const keyString = `datalyr:${workspaceId}:${deviceId}`;
+                const keyData = encoder.encode(keyString);
+                // Import key material
+                const baseKey = yield crypto.subtle.importKey('raw', keyData, 'PBKDF2', false, ['deriveKey']);
+                // Derive actual encryption key using PBKDF2 with random salt
+                this.key = yield crypto.subtle.deriveKey({
+                    name: 'PBKDF2',
+                    salt: this.salt, // FIXED: Random per-device salt instead of static
+                    iterations: 100000, // 100k iterations for security
+                    hash: 'SHA-256'
+                }, baseKey, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
+            }
+            catch (error) {
+                console.error('[Datalyr Encryption] Failed to initialize:', error);
+                this.key = null;
+                throw error; // FIXED: Fail loudly
+            }
+        });
+    }
+    /**
+     * Encrypt sensitive data
+     *
+     * FIXED (SEC-03): No longer silently falls back to unencrypted storage
+     *
+     * @param data - Plain text or object to encrypt
+     * @returns Base64-encoded encrypted data with IV
+     * @throws Error if encryption is not available or fails
+     */
+    encrypt(data) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!this.key || !crypto.subtle) {
+                // FIXED: Fail loudly instead of silently storing unencrypted
+                throw new Error('Encryption not initialized - cannot encrypt sensitive data');
+            }
+            try {
+                const plaintext = typeof data === 'string' ? data : JSON.stringify(data);
+                const encoder = new TextEncoder();
+                const plaintextBytes = encoder.encode(plaintext);
+                // Generate random IV (Initialization Vector)
+                const iv = crypto.getRandomValues(new Uint8Array(12)); // 12 bytes for GCM
+                // Encrypt
+                const ciphertext = yield crypto.subtle.encrypt({ name: 'AES-GCM', iv }, this.key, plaintextBytes);
+                // Combine IV + ciphertext for storage
+                const combined = new Uint8Array(iv.length + ciphertext.byteLength);
+                combined.set(iv, 0);
+                combined.set(new Uint8Array(ciphertext), iv.length);
+                // Return base64-encoded
+                return this.arrayBufferToBase64(combined);
+            }
+            catch (error) {
+                console.error('[Datalyr Encryption] Encryption failed:', error);
+                throw error; // FIXED: Fail loudly
+            }
+        });
+    }
+    /**
+     * Decrypt sensitive data
+     *
+     * FIXED (SEC-03): Still allows backwards compatibility for migration,
+     * but logs warnings when unencrypted data is detected
+     *
+     * @param encryptedData - Base64-encoded encrypted data
+     * @returns Decrypted data (parsed as JSON if possible)
+     */
+    decrypt(encryptedData) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!this.key || !crypto.subtle) {
+                // Backwards compatibility: Try to parse as unencrypted JSON
+                console.warn('[Datalyr Encryption] Decryption not available - reading potentially unencrypted data');
+                try {
+                    return JSON.parse(encryptedData);
+                }
+                catch (_a) {
+                    return encryptedData;
+                }
+            }
+            try {
+                // Decode base64
+                const combined = this.base64ToArrayBuffer(encryptedData);
+                // Extract IV (first 12 bytes) and ciphertext
+                const iv = combined.slice(0, 12);
+                const ciphertext = combined.slice(12);
+                // Decrypt
+                const plaintextBytes = yield crypto.subtle.decrypt({ name: 'AES-GCM', iv }, this.key, ciphertext);
+                // Decode and parse
+                const decoder = new TextDecoder();
+                const plaintext = decoder.decode(plaintextBytes);
+                // Try to parse as JSON
+                try {
+                    return JSON.parse(plaintext);
+                }
+                catch (_b) {
+                    return plaintext;
+                }
+            }
+            catch (error) {
+                // Backwards compatibility: Try to parse as unencrypted (for migration)
+                console.warn('[Datalyr Encryption] Decryption failed - attempting to read as unencrypted data (migration mode)');
+                try {
+                    return JSON.parse(encryptedData);
+                }
+                catch (_c) {
+                    return encryptedData;
+                }
+            }
+        });
+    }
+    /**
+     * Check if encryption is available and initialized
+     */
+    isAvailable() {
+        return this.key !== null && crypto.subtle !== undefined;
+    }
+    /**
+     * Helper: Convert ArrayBuffer to Base64
+     */
+    arrayBufferToBase64(buffer) {
+        let binary = '';
+        const bytes = new Uint8Array(buffer);
+        const len = bytes.byteLength;
+        for (let i = 0; i < len; i++) {
+            binary += String.fromCharCode(bytes[i]);
+        }
+        return btoa(binary);
+    }
+    /**
+     * Helper: Convert Base64 to ArrayBuffer
+     */
+    base64ToArrayBuffer(base64) {
+        const binary = atob(base64);
+        const len = binary.length;
+        const bytes = new Uint8Array(len);
+        for (let i = 0; i < len; i++) {
+            bytes[i] = binary.charCodeAt(i);
+        }
+        return bytes;
+    }
+    /**
+     * Destroy encryption keys (called on SDK destroy)
+     *
+     * FIXED (SEC-03): Also clears salt reference
+     */
+    destroy() {
+        this.key = null;
+        this.salt = null;
+    }
+}
+// Singleton instance
+const dataEncryption = new DataEncryption();
+
 /**
  * Storage Module
  * Safe storage wrapper with fallbacks for Safari private mode
+ * SEC-03 Fix: Added encryption support for PII data
  */
 class SafeStorage {
     constructor(storage) {
         this.memory = new Map();
-        this.prefix = '__dl_';
+        this.prefix = 'dl_';
         // Test if storage is available
         try {
-            const testKey = '__dl_test__' + Math.random();
+            const testKey = 'dl_test__' + Math.random();
             storage.setItem(testKey, '1');
             storage.removeItem(testKey);
             this.storage = storage;
@@ -149,6 +346,117 @@ class SafeStorage {
             return [];
         }
     }
+    /**
+     * Migrate data from legacy '__dl_dl_*' keys to new 'dl_*' keys
+     *
+     * This fixes the double-prefix issue from earlier SDK versions.
+     * Called automatically during SDK initialization.
+     *
+     * @returns Number of keys migrated
+     */
+    migrateFromLegacyPrefix() {
+        if (!this.storage) {
+            return 0; // Can't migrate in memory-only mode
+        }
+        let migratedCount = 0;
+        const legacyPrefix = '__dl_dl_';
+        try {
+            // Find all legacy keys
+            const legacyKeys = [];
+            for (let i = 0; i < this.storage.length; i++) {
+                const key = this.storage.key(i);
+                if (key && key.startsWith(legacyPrefix)) {
+                    legacyKeys.push(key);
+                }
+            }
+            // Migrate each legacy key
+            legacyKeys.forEach(legacyKey => {
+                try {
+                    // Get value from legacy key
+                    const value = this.storage.getItem(legacyKey);
+                    if (value) {
+                        // Extract the actual key name (remove '__dl_' prefix, keep 'dl_' part)
+                        const actualKey = legacyKey.slice('__dl_'.length); // e.g., '__dl_dl_anonymous_id' -> 'dl_anonymous_id'
+                        // Only migrate if new key doesn't already exist (don't overwrite newer data)
+                        if (!this.storage.getItem(actualKey)) {
+                            this.storage.setItem(actualKey, value);
+                            migratedCount++;
+                        }
+                        // Remove legacy key after successful migration
+                        this.storage.removeItem(legacyKey);
+                    }
+                }
+                catch (e) {
+                    console.warn(`[Datalyr Storage] Failed to migrate legacy key: ${legacyKey}`, e);
+                }
+            });
+            if (migratedCount > 0) {
+                console.log(`[Datalyr Storage] Migrated ${migratedCount} keys from legacy prefix`);
+            }
+        }
+        catch (e) {
+            console.warn('[Datalyr Storage] Error during legacy key migration:', e);
+        }
+        return migratedCount;
+    }
+    /**
+     * Get encrypted value from storage (SEC-03 Fix)
+     *
+     * @param key - Storage key
+     * @param defaultValue - Default value if not found
+     * @returns Decrypted value
+     */
+    getEncrypted(key_1) {
+        return __awaiter(this, arguments, void 0, function* (key, defaultValue = null) {
+            const fullKey = this.prefix + key;
+            try {
+                // Get encrypted data
+                let encryptedData = null;
+                if (this.storage) {
+                    encryptedData = this.storage.getItem(fullKey);
+                }
+                else {
+                    encryptedData = this.memory.get(fullKey) || null;
+                }
+                if (!encryptedData) {
+                    return defaultValue;
+                }
+                // Decrypt
+                const decrypted = yield dataEncryption.decrypt(encryptedData);
+                return decrypted;
+            }
+            catch (error) {
+                console.warn('[Datalyr Storage] Failed to decrypt:', key, error);
+                return defaultValue;
+            }
+        });
+    }
+    /**
+     * Set encrypted value in storage (SEC-03 Fix)
+     *
+     * FIXED (SEC-03): Now throws error if encryption fails instead of silent fallback
+     *
+     * @param key - Storage key
+     * @param value - Value to encrypt and store
+     * @returns Success boolean
+     * @throws Error if encryption is not available or fails
+     */
+    setEncrypted(key, value) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const fullKey = this.prefix + key;
+            // FIXED: encrypt() now throws instead of returning null
+            const encrypted = yield dataEncryption.encrypt(value);
+            // Store encrypted data
+            if (this.storage) {
+                this.storage.setItem(fullKey, encrypted);
+                return true;
+            }
+            else {
+                this.memory.set(fullKey, encrypted);
+                return true;
+            }
+        });
+    }
 }
 // Cookie operations
 class CookieStorage {
@@ -529,13 +837,9 @@ class IdentityManager {
             document.cookie = `${name}=${encodedValue}; domain=${rootDomain}; path=/; max-age=31536000; SameSite=Lax${secure}`;
             // Verify cookie was set successfully (cookies.get already decodes)
             const verifyValue = cookies.get(name);
-            if (verifyValue === value) {
-                console.log(`[Datalyr] Set root domain cookie: ${name} on domain: ${rootDomain}`);
-            }
-            else {
+            if (verifyValue !== value) {
                 // Fallback: try without domain (current subdomain only)
                 document.cookie = `${name}=${encodedValue}; path=/; max-age=31536000; SameSite=Lax${secure}`;
-                console.log(`[Datalyr] Set cookie without domain (fallback): ${name}`);
             }
         }
         catch (e) {
@@ -674,13 +978,14 @@ class IdentityManager {
  * Session Management Module
  */
 class SessionManager {
-    constructor(timeout = 30 * 60 * 1000) {
+    constructor(timeout = 60 * 60 * 1000) {
         this.sessionId = null;
         this.sessionData = null;
         this.lastActivity = Date.now();
         this.SESSION_KEY = 'dl_session_data';
         this.activityCheckInterval = null;
         this.activityListeners = [];
+        this.sessionCreationLock = false; // FIXED (DATA-02): Mutex to prevent race conditions
         this.sessionTimeout = timeout;
         this.initSession();
         this.setupActivityMonitor();
@@ -711,21 +1016,66 @@ class SessionManager {
     }
     /**
      * Create a new session
+     *
+     * FIXED (DATA-02): Added mutex lock to prevent race conditions
      */
     createNewSession() {
+        // FIXED (DATA-02): Check if session creation already in progress
+        if (this.sessionCreationLock) {
+            // Wait for ongoing session creation
+            console.log('[Datalyr Session] Session creation already in progress, returning existing ID');
+            return this.sessionId || '';
+        }
+        // Acquire lock
+        this.sessionCreationLock = true;
+        try {
+            const now = Date.now();
+            this.sessionId = `sess_${generateUUID()}`;
+            this.sessionData = {
+                id: this.sessionId,
+                startTime: now,
+                lastActivity: now,
+                pageViews: 0,
+                events: 0,
+                duration: 0,
+                isActive: true
+            };
+            this.saveSession();
+            // Issue #25: Increment AFTER session created successfully
+            this.incrementSessionCount();
+            return this.sessionId;
+        }
+        finally {
+            // Always release lock
+            this.sessionCreationLock = false;
+        }
+    }
+    /**
+     * Rotate session ID (security measure)
+     *
+     * FIXED (DATA-05): Called when user identifies to prevent session fixation attacks
+     * Keeps session data but generates new session ID
+     */
+    rotateSessionId() {
         const now = Date.now();
+        const oldSessionId = this.sessionId;
+        // Generate new session ID
         this.sessionId = `sess_${generateUUID()}`;
-        this.sessionData = {
-            id: this.sessionId,
-            startTime: now,
-            lastActivity: now,
-            pageViews: 0,
-            events: 0,
-            duration: 0,
-            isActive: true
-        };
-        this.incrementSessionCount();
-        this.saveSession();
+        // Preserve session data but update ID
+        if (this.sessionData) {
+            this.sessionData.id = this.sessionId;
+            this.sessionData.lastActivity = now;
+            this.saveSession();
+            // Clean up old session data
+            if (oldSessionId) {
+                storage.remove(`dl_session_${oldSessionId}_attribution`);
+            }
+            console.log(`[Datalyr Session] Rotated session ID from ${oldSessionId} to ${this.sessionId}`);
+        }
+        else {
+            // No existing session, create new one
+            this.createNewSession();
+        }
         return this.sessionId;
     }
     /**
@@ -745,18 +1095,22 @@ class SessionManager {
     }
     /**
      * Update session activity
+     * FIXED (CRITICAL-04): Check session validity BEFORE updating lastActivity
+     * This ensures sessions actually timeout after the configured period
      */
     updateActivity(eventType) {
         const now = Date.now();
-        // Check if we need a new session
+        // CRITICAL FIX: Check session validity BEFORE updating lastActivity
+        // If we update lastActivity first, sessions will never timeout!
         if (!this.sessionData || !this.isSessionValid(this.sessionData, now)) {
             this.createNewSession();
             return;
         }
+        // Session is valid - update activity timestamp
         this.lastActivity = now;
         this.sessionData.lastActivity = now;
         this.sessionData.duration = now - this.sessionData.startTime;
-        // Update counters
+        // Update counters (only if session is valid)
         if (eventType === 'pageview' || eventType === 'page_view') {
             this.sessionData.pageViews++;
         }
@@ -774,6 +1128,7 @@ class SessionManager {
     }
     /**
      * End the current session
+     * Fixed Issue #23: Stop activity monitor when session ends
      */
     endSession() {
         if (this.sessionData) {
@@ -782,6 +1137,8 @@ class SessionManager {
         }
         this.sessionId = null;
         this.sessionData = null;
+        // Issue #23: Clean up activity monitor when session ends
+        this.destroy();
     }
     /**
      * Save session to storage
@@ -805,19 +1162,29 @@ class SessionManager {
     }
     /**
      * Store session attribution
+     * Fixed Issue #24: Use single key instead of one per session
      */
     storeAttribution(attribution) {
-        const key = `dl_session_${this.sessionId}_attribution`;
-        storage.set(key, Object.assign(Object.assign({}, attribution), { sessionId: this.sessionId, timestamp: Date.now() }));
+        storage.set('dl_current_session_attribution', Object.assign(Object.assign({}, attribution), { sessionId: this.sessionId, timestamp: Date.now() }));
     }
     /**
      * Get session attribution
+     * Fixed Issue #24: Use single key instead of one per session
+     * FIXED (CRITICAL-04): Verify session is still active before returning attribution
      */
     getAttribution() {
         if (!this.sessionId)
             return null;
-        const key = `dl_session_${this.sessionId}_attribution`;
-        return storage.get(key);
+        // CRITICAL FIX: Verify session is still active
+        if (!this.isSessionActive()) {
+            return null;
+        }
+        const data = storage.get('dl_current_session_attribution');
+        // Only return if it matches current session
+        if (data && data.sessionId === this.sessionId) {
+            return data;
+        }
+        return null;
     }
     /**
      * Get session metrics
@@ -894,6 +1261,7 @@ class SessionManager {
  */
 class AttributionManager {
     constructor(options = {}) {
+        this.queryParamsCache = null;
         this.UTM_PARAMS = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content'];
         // Updated to match dl.js - includes ALL ad platform click IDs
         this.CLICK_IDS = [
@@ -922,15 +1290,27 @@ class AttributionManager {
             'medium', // Generic medium (non-UTM)
             'gad_source' // Google Ads source parameter
         ];
-        this.attributionWindow = options.attributionWindow || 30 * 24 * 60 * 60 * 1000; // 30 days
+        this.attributionWindow = options.attributionWindow || 90 * 24 * 60 * 60 * 1000; // 90 days (increased from 30 for B2B sales cycles)
         // Merge default tracked params with user-provided ones
         this.trackedParams = [...this.DEFAULT_TRACKED_PARAMS, ...(options.trackedParams || [])];
     }
+    /**
+     * Clear query params cache (called on page navigation)
+     * FIXED: Prevents stale attribution data on SPA navigation
+     */
+    clearCache() {
+        this.queryParamsCache = null;
+    }
     /**
      * Capture current attribution from URL
      */
     captureAttribution() {
-        const params = getAllQueryParams();
+        // Cache query params to avoid multiple parses within same page load (Issue #3)
+        // NOTE: Cache is cleared on page navigation to prevent stale data
+        const params = this.queryParamsCache || getAllQueryParams();
+        if (!this.queryParamsCache) {
+            this.queryParamsCache = params;
+        }
         const attribution = {
             timestamp: Date.now()
         };
@@ -977,31 +1357,57 @@ class AttributionManager {
         return attribution;
     }
     /**
-     * Store first touch attribution
+     * Store first touch attribution with 90-day expiration
+     *
+     * FIXED (DATA-01): Removed paid priority logic that was corrupting first-touch attribution.
+     * First-touch is now IMMUTABLE except for expiration - this ensures accurate revenue attribution.
      */
     storeFirstTouch(attribution) {
         const existing = storage.get('dl_first_touch');
+        let shouldStore = false;
         if (!existing) {
-            storage.set('dl_first_touch', Object.assign(Object.assign({}, attribution), { timestamp: Date.now() }));
+            // No existing attribution - store first touch
+            shouldStore = true;
+        }
+        else if (existing.expires_at && Date.now() >= existing.expires_at) {
+            // Existing attribution expired - replace it
+            shouldStore = true;
+        }
+        // REMOVED PAID PRIORITY LOGIC - First-touch must be immutable for accurate attribution
+        // If there's existing valid attribution, keep it (true first-touch strategy)
+        if (shouldStore) {
+            storage.set('dl_first_touch', Object.assign(Object.assign({}, attribution), { captured_at: Date.now(), expires_at: Date.now() + this.attributionWindow }));
         }
     }
     /**
      * Get first touch attribution
+     * Checks expiry and removes if expired (Issue #4)
      */
     getFirstTouch() {
-        return storage.get('dl_first_touch');
+        const data = storage.get('dl_first_touch');
+        if (data && data.expires_at && Date.now() >= data.expires_at) {
+            storage.remove('dl_first_touch');
+            return null;
+        }
+        return data;
     }
     /**
-     * Store last touch attribution
+     * Store last touch attribution with 90-day expiration
      */
     storeLastTouch(attribution) {
-        storage.set('dl_last_touch', Object.assign(Object.assign({}, attribution), { timestamp: Date.now() }));
+        storage.set('dl_last_touch', Object.assign(Object.assign({}, attribution), { captured_at: Date.now(), expires_at: Date.now() + this.attributionWindow }));
     }
     /**
      * Get last touch attribution
+     * Checks expiry and removes if expired (Issue #4)
      */
     getLastTouch() {
-        return storage.get('dl_last_touch');
+        const data = storage.get('dl_last_touch');
+        if (data && data.expires_at && Date.now() >= data.expires_at) {
+            storage.remove('dl_last_touch');
+            return null;
+        }
+        return data;
     }
     /**
      * Add touchpoint to customer journey
@@ -1069,16 +1475,18 @@ class AttributionManager {
     }
     /**
      * Check if we have a specific click ID in current params
+     * Uses cached params to avoid multiple URL parses (Issue #3)
      */
     hasClickId(clickIdType) {
-        const params = getAllQueryParams();
+        const params = this.queryParamsCache || getAllQueryParams();
         return !!params[clickIdType];
     }
     /**
      * Get current fbclid from URL if present
+     * Uses cached params to avoid multiple URL parses (Issue #3)
      */
     getCurrentFbclid() {
-        const params = getAllQueryParams();
+        const params = this.queryParamsCache || getAllQueryParams();
         return params.fbclid || null;
     }
     /**
@@ -1088,7 +1496,17 @@ class AttributionManager {
         const firstTouch = this.getFirstTouch();
         const lastTouch = this.getLastTouch();
         const journey = this.getJourney();
-        const current = this.captureAttribution();
+        let current = this.captureAttribution();
+        // CRITICAL FIX: If current session has no attribution (direct/organic),
+        // fallback to persistent attribution from localStorage (90-day window)
+        const hasCurrentAttribution = !!(current.source || current.medium || current.clickId || current.campaign);
+        if (!hasCurrentAttribution && firstTouch) {
+            // Check if persistent attribution is still valid
+            if (!firstTouch.expires_at || Date.now() < firstTouch.expires_at) {
+                // Use persistent attribution but keep current page context
+                current = Object.assign(Object.assign({}, firstTouch), { referrer: current.referrer, referrerHost: current.referrerHost, landingPage: current.landingPage, landingPath: current.landingPath });
+            }
+        }
         // Capture advertising cookies automatically
         const adCookies = this.captureAdCookies();
         // Update first/last touch if needed
@@ -1240,6 +1658,8 @@ class EventQueue {
         this.recentEventIds = new Set();
         this.MAX_RECENT_EVENT_IDS = 1000;
         this.OFFLINE_QUEUE_KEY = 'dl_offline_queue';
+        this.flushLock = false; // FIXED (DATA-03): Mutex to prevent race conditions
+        this.offlineQueueLock = false; // FIXED (DATA-03): Separate lock for offline queue operations
         this.config = {
             batchSize: config.batchSize || 10,
             flushInterval: config.flushInterval || 5000,
@@ -1266,16 +1686,23 @@ class EventQueue {
      * Add event to queue
      */
     enqueue(event) {
-        const eventName = event.eventName;
+        const eventName = event.event_name; // Use snake_case
         // Check for duplicates (within 500ms window)
         if (this.isDuplicateEvent(event)) {
             this.log('Duplicate event suppressed:', eventName);
             return;
         }
-        // Critical events bypass queue
+        // CRITICAL FIX (CRITICAL-05): Critical events need proper error handling
+        // Instead of calling sendBatch() without await, we add them to queue
+        // with immediate flush AND move to offline queue on failure
         if (this.config.criticalEvents.includes(eventName)) {
             this.log('Critical event, sending immediately:', eventName);
-            this.sendBatch([event]);
+            // Send immediately with proper error handling
+            this.sendBatch([event]).catch((error) => {
+                this.log('Critical event send failed, adding to offline queue:', eventName, error);
+                // Move to offline queue to ensure it's not lost
+                this.moveToOfflineQueue([event]);
+            });
             return;
         }
         // Add to queue
@@ -1288,13 +1715,15 @@ class EventQueue {
     }
     /**
      * Check if event is duplicate
+     * Fixed Issue #32: Use content-based hash instead of UUID
      */
     isDuplicateEvent(event) {
-        const eventId = event.eventId;
-        if (this.recentEventIds.has(eventId)) {
+        // Create content-based hash from eventName + timestamp + key properties
+        const contentHash = this.createEventHash(event);
+        if (this.recentEventIds.has(contentHash)) {
             return true;
         }
-        this.recentEventIds.add(eventId);
+        this.recentEventIds.add(contentHash);
         // Clean up old event IDs
         if (this.recentEventIds.size > this.MAX_RECENT_EVENT_IDS) {
             const toDelete = this.recentEventIds.size - this.MAX_RECENT_EVENT_IDS;
@@ -1308,6 +1737,24 @@ class EventQueue {
         }
         return false;
     }
+    /**
+     * Create content-based hash for duplicate detection (Issue #32)
+     */
+    createEventHash(event) {
+        const content = [
+            event.event_name, // Use snake_case
+            event.timestamp,
+            JSON.stringify(event.event_data || {}) // Use snake_case
+        ].join('|');
+        // Simple hash function
+        let hash = 0;
+        for (let i = 0; i < content.length; i++) {
+            const char = content.charCodeAt(i);
+            hash = ((hash << 5) - hash) + char;
+            hash = hash & hash; // Convert to 32bit integer
+        }
+        return hash.toString(36);
+    }
     /**
      * Check if we should flush the queue
      */
@@ -1333,20 +1780,29 @@ class EventQueue {
     }
     /**
      * Flush the queue
+     * FIXED (DATA-03): Enhanced protection against concurrent flushes
      */
     flush() {
         return __awaiter(this, void 0, void 0, function* () {
-            // Prevent concurrent flushes
-            if (this.flushPromise) {
-                return this.flushPromise;
+            // FIXED (DATA-03): Check both promise and lock for concurrent flush protection
+            if (this.flushPromise || this.flushLock) {
+                return this.flushPromise || Promise.resolve();
+            }
+            // Acquire lock
+            this.flushLock = true;
+            try {
+                this.flushPromise = this._flush();
+                yield this.flushPromise;
+            }
+            finally {
+                this.flushPromise = null;
+                this.flushLock = false;
             }
-            this.flushPromise = this._flush();
-            yield this.flushPromise;
-            this.flushPromise = null;
         });
     }
     /**
      * Internal flush implementation
+     * FIXED (CRITICAL-06): Don't remove events from queue until send succeeds
      */
     _flush() {
         return __awaiter(this, void 0, void 0, function* () {
@@ -1365,16 +1821,21 @@ class EventQueue {
                 this.moveToOfflineQueue();
                 return;
             }
-            // Get events to send
-            const events = this.queue.splice(0, this.config.batchSize);
+            // CRITICAL FIX: Use slice() to COPY events, don't remove yet
+            // Only remove after successful send to prevent data loss
+            const batchSize = Math.min(this.config.batchSize, this.queue.length);
+            const events = this.queue.slice(0, batchSize);
             try {
                 yield this.sendBatch(events);
+                // SUCCESS: Now it's safe to remove events from queue
+                this.queue.splice(0, batchSize);
+                this.log(`Successfully sent and removed ${batchSize} events from queue`);
             }
             catch (error) {
                 this.log('Failed to send batch:', error);
-                // Move to offline queue for retry
-                this.offlineQueue.push(...events);
-                this.saveOfflineQueue();
+                // Don't remove from queue - events stay for retry
+                // Move to offline queue for persistent storage
+                this.moveToOfflineQueue(events);
             }
         });
     }
@@ -1406,10 +1867,14 @@ class EventQueue {
                     if (response.status === 429) {
                         const retryAfter = parseInt(response.headers.get('Retry-After') || '60');
                         this.log(`Rate limited, retrying after ${retryAfter}s`);
+                        // FIXED (CRITICAL-06): Don't unshift() - events are still in queue!
+                        // With the new fix, events aren't removed until success, so they're
+                        // already in the queue. Just schedule a retry flush.
                         setTimeout(() => {
-                            this.queue.unshift(...events);
+                            this.flush();
                         }, retryAfter * 1000);
-                        return;
+                        // Throw to trigger catch block which moves events to offline queue
+                        throw new Error(`Rate limited (429), retry after ${retryAfter}s`);
                     }
                     throw new Error(`HTTP ${response.status}: ${response.statusText}`);
                 }
@@ -1470,11 +1935,39 @@ class EventQueue {
     }
     /**
      * Move events to offline queue
-     */
-    moveToOfflineQueue() {
-        this.offlineQueue.push(...this.queue);
-        this.queue = [];
-        this.saveOfflineQueue();
+     * Fixed Issue #33: Enforce size limit when adding, not just when saving
+     * FIXED (DATA-03): Added mutex lock to prevent race conditions
+     * FIXED (CRITICAL-06): Can now accept specific events or move entire queue
+     */
+    moveToOfflineQueue(events) {
+        // FIXED (DATA-03): Check if offline queue operation already in progress
+        if (this.offlineQueueLock) {
+            console.warn('[Datalyr Queue] Offline queue operation already in progress');
+            return;
+        }
+        // Acquire lock
+        this.offlineQueueLock = true;
+        try {
+            if (events) {
+                // Move specific events to offline queue
+                this.offlineQueue.push(...events);
+            }
+            else {
+                // Move entire queue to offline queue
+                this.offlineQueue.push(...this.queue);
+                this.queue = [];
+            }
+            // Issue #33: Enforce limit here, not just in saveOfflineQueue
+            if (this.offlineQueue.length > this.config.maxOfflineQueueSize) {
+                const excess = this.offlineQueue.length - this.config.maxOfflineQueueSize;
+                this.offlineQueue.splice(0, excess); // Remove oldest events
+            }
+            this.saveOfflineQueue();
+        }
+        finally {
+            // Always release lock
+            this.offlineQueueLock = false;
+        }
     }
     /**
      * Load offline queue from storage
@@ -1606,8 +2099,6 @@ class EventQueue {
  */
 class FingerprintCollector {
     constructor(options = {}) {
-        this.heavyFingerprintDone = false;
-        this.fingerprintCache = {};
         this.privacyMode = options.privacyMode || 'standard';
         this.enableFingerprinting = options.enableFingerprinting !== false;
     }
@@ -1625,24 +2116,40 @@ class FingerprintCollector {
     }
     /**
      * Collect minimal fingerprint data (privacy-friendly)
+     * Matches browser tag minimal fingerprinting approach
      */
     collectMinimal() {
-        return {
+        const fp = {
             timezone: this.getTimezone(),
             language: navigator.language || null,
-            platform: navigator.platform || null,
-            canvasEnabled: false,
-            localStorageAvailable: this.testStorage('localStorage'),
-            sessionStorageAvailable: this.testStorage('sessionStorage')
+            screen_bucket: this.getScreenBucket(),
+            dnt: (navigator.doNotTrack === '1' || window.globalPrivacyControl === true) || null,
+            userAgent: navigator.userAgent || null
         };
+        // User-Agent Client Hints (modern browsers)
+        if ('userAgentData' in navigator) {
+            const uaData = navigator.userAgentData;
+            fp.userAgentData = {
+                brands: uaData.brands || [],
+                mobile: uaData.mobile || false,
+                platform: uaData.platform || null
+            };
+        }
+        return fp;
     }
     /**
      * Collect standard fingerprint data
+     * PRIVACY: Minimal data collection matching browser tag approach
+     * Only collects data necessary for basic analytics and attribution
      */
     collectStandard() {
         const fingerprint = {};
         try {
-            // Basic browser data
+            // PRIVACY: Only collect minimal data needed for attribution
+            fingerprint.timezone = this.getTimezone();
+            fingerprint.language = navigator.language || null;
+            fingerprint.screen_bucket = this.getScreenBucket();
+            fingerprint.dnt = (navigator.doNotTrack === '1' || window.globalPrivacyControl === true) || null;
             fingerprint.userAgent = navigator.userAgent || null;
             // User-Agent Client Hints (modern browsers)
             if ('userAgentData' in navigator) {
@@ -1653,125 +2160,14 @@ class FingerprintCollector {
                     platform: uaData.platform || null
                 };
             }
-            // Language settings
-            fingerprint.language = navigator.language || null;
-            fingerprint.languages = navigator.languages ?
-                navigator.languages.slice(0, 2) : null; // Limit to 2 for privacy
-            // Platform and browser features
-            fingerprint.platform = navigator.platform || null;
-            fingerprint.cookieEnabled = navigator.cookieEnabled || null;
-            fingerprint.doNotTrack = navigator.doNotTrack || null;
-            // Hardware (coarsened for privacy)
-            fingerprint.hardwareConcurrency = this.coarsenHardwareConcurrency();
-            fingerprint.deviceMemory = this.coarsenDeviceMemory();
-            fingerprint.maxTouchPoints = navigator.maxTouchPoints > 0 ? 'touch' : 'no-touch';
-            // Screen (coarsened)
-            fingerprint.screenResolution = this.getScreenResolution();
-            fingerprint.colorDepth = screen.colorDepth || null;
-            fingerprint.pixelRatio = this.coarsenPixelRatio();
-            // Timezone
-            fingerprint.timezone = this.getTimezone();
-            fingerprint.timezoneOffset = this.coarsenTimezoneOffset();
-            // Canvas fingerprinting disabled for privacy
-            fingerprint.canvasEnabled = false;
-            // Plugins count only (not details for privacy)
-            fingerprint.pluginsCount = navigator.plugins ? navigator.plugins.length : null;
-            // Storage availability
-            fingerprint.localStorageAvailable = this.testStorage('localStorage');
-            fingerprint.sessionStorageAvailable = this.testStorage('sessionStorage');
-            fingerprint.indexedDBAvailable = this.testIndexedDB();
-            // Add cached heavy fingerprint data if available
-            if (this.heavyFingerprintDone) {
-                Object.assign(fingerprint, this.fingerprintCache);
-            }
         }
         catch (e) {
             console.warn('[Datalyr] Error collecting fingerprint:', e);
         }
         return fingerprint;
     }
-    /**
-     * Collect heavy fingerprint data (WebGL, Audio)
-     * Called lazily on first event to improve page load performance
-     */
-    collectHeavyFingerprint() {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (this.heavyFingerprintDone || this.privacyMode === 'strict') {
-                return;
-            }
-            try {
-                // WebGL fingerprinting
-                const webglData = this.getWebGLFingerprint();
-                if (webglData) {
-                    this.fingerprintCache.webglVendor = webglData.vendor;
-                    this.fingerprintCache.webglRenderer = webglData.renderer;
-                }
-                // Audio fingerprinting
-                const audioData = yield this.getAudioFingerprint();
-                if (audioData) {
-                    this.fingerprintCache.audioSampleRate = audioData.sampleRate;
-                    this.fingerprintCache.audioState = audioData.state;
-                    this.fingerprintCache.audioMaxChannels = audioData.maxChannels;
-                }
-                this.heavyFingerprintDone = true;
-            }
-            catch (e) {
-                console.warn('[Datalyr] Heavy fingerprinting failed:', e);
-            }
-        });
-    }
-    /**
-     * Get WebGL fingerprint
-     */
-    getWebGLFingerprint() {
-        try {
-            const canvas = document.createElement('canvas');
-            const gl = canvas.getContext('webgl') || canvas.getContext('experimental-webgl');
-            if (!gl)
-                return null;
-            const debugInfo = gl.getExtension('WEBGL_debug_renderer_info');
-            if (!debugInfo) {
-                return {
-                    vendor: gl.getParameter(gl.VENDOR) || 'unknown',
-                    renderer: gl.getParameter(gl.RENDERER) || 'unknown'
-                };
-            }
-            return {
-                vendor: gl.getParameter(debugInfo.UNMASKED_VENDOR_WEBGL) || 'unknown',
-                renderer: gl.getParameter(debugInfo.UNMASKED_RENDERER_WEBGL) || 'unknown'
-            };
-        }
-        catch (_a) {
-            return null;
-        }
-    }
-    /**
-     * Get audio fingerprint
-     */
-    getAudioFingerprint() {
-        return __awaiter(this, void 0, void 0, function* () {
-            var _a;
-            try {
-                const AudioContext = window.AudioContext || window.webkitAudioContext;
-                if (!AudioContext)
-                    return null;
-                const audioCtx = new AudioContext();
-                const result = {
-                    sampleRate: audioCtx.sampleRate || null,
-                    state: audioCtx.state || null,
-                    maxChannels: ((_a = audioCtx.destination) === null || _a === void 0 ? void 0 : _a.maxChannelCount) || null
-                };
-                // Close context to free resources
-                if (audioCtx.close) {
-                    yield audioCtx.close();
-                }
-                return result;
-            }
-            catch (_b) {
-                return null;
-            }
-        });
-    }
+    // PRIVACY: Heavy fingerprinting (WebGL, Audio) removed
+    // Minimal fingerprinting only for privacy compliance
     /**
      * Get timezone
      */
@@ -1784,10 +2180,13 @@ class FingerprintCollector {
         }
     }
     /**
-     * Get screen resolution (coarsened)
+     * Get coarse screen bucket for basic device classification
+     * Rounds to nearest 100px for privacy
      */
-    getScreenResolution() {
+    getScreenBucket() {
         try {
+            if (!window.screen)
+                return null;
             const width = Math.round(screen.width / 100) * 100;
             const height = Math.round(screen.height / 100) * 100;
             return `${width}x${height}`;
@@ -1796,131 +2195,43 @@ class FingerprintCollector {
             return null;
         }
     }
+    // PRIVACY: Unused helper methods removed (coarsen functions, storage tests)
+    // Minimal fingerprinting only
     /**
-     * Coarsen hardware concurrency for privacy
+     * Generate fingerprint hash
      */
-    coarsenHardwareConcurrency() {
-        try {
-            const cores = navigator.hardwareConcurrency;
-            if (!cores)
-                return null;
-            return cores > 8 ? '8+' : cores;
-        }
-        catch (_a) {
-            return null;
-        }
-    }
-    /**
-     * Coarsen device memory for privacy
-     */
-    coarsenDeviceMemory() {
-        try {
-            const memory = navigator.deviceMemory;
-            if (!memory)
-                return null;
-            return memory > 4 ? '4+' : memory;
-        }
-        catch (_a) {
-            return null;
-        }
-    }
-    /**
-     * Coarsen pixel ratio for privacy
-     */
-    coarsenPixelRatio() {
-        try {
-            const ratio = window.devicePixelRatio;
-            if (!ratio)
-                return null;
-            // Round to common values
-            if (ratio <= 1)
-                return '1';
-            if (ratio <= 1.5)
-                return '1.5';
-            if (ratio <= 2)
-                return '2';
-            if (ratio <= 3)
-                return '3';
-            return '3+';
-        }
-        catch (_a) {
-            return null;
-        }
-    }
-    /**
-     * Coarsen timezone offset for privacy
-     */
-    coarsenTimezoneOffset() {
-        try {
-            const offset = new Date().getTimezoneOffset();
-            // Round to nearest 30 minutes
-            return Math.round(offset / 30) * 30;
-        }
-        catch (_a) {
-            return null;
-        }
-    }
-    /**
-     * Test if storage is available
-     */
-    testStorage(type) {
-        try {
-            const storage = window[type];
-            const testKey = '__dl_test__';
-            storage.setItem(testKey, '1');
-            storage.removeItem(testKey);
-            return true;
-        }
-        catch (_a) {
-            return false;
-        }
-    }
-    /**
-     * Test if IndexedDB is available
-     */
-    testIndexedDB() {
-        try {
-            return !!window.indexedDB;
-        }
-        catch (_a) {
-            return false;
-        }
-    }
-    /**
-     * Generate fingerprint hash
-     */
-    generateHash(data) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                // Sort keys for consistent hashing
-                const sortedData = Object.keys(data)
-                    .sort()
-                    .reduce((obj, key) => {
-                    obj[key] = data[key];
-                    return obj;
-                }, {});
-                const str = JSON.stringify(sortedData);
-                // Use Web Crypto API if available
-                if (window.crypto && window.crypto.subtle) {
-                    const encoder = new TextEncoder();
-                    const data = encoder.encode(str);
-                    const hashBuffer = yield crypto.subtle.digest('SHA-256', data);
-                    const hashArray = Array.from(new Uint8Array(hashBuffer));
-                    return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
-                }
-                // Fallback to simple hash
-                let hash = 0;
-                for (let i = 0; i < str.length; i++) {
-                    const char = str.charCodeAt(i);
-                    hash = ((hash << 5) - hash) + char;
-                    hash = hash & hash; // Convert to 32bit integer
-                }
-                return Math.abs(hash).toString(16);
-            }
-            catch (_a) {
-                return '';
-            }
-        });
+    generateHash(data) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                // Sort keys for consistent hashing
+                const sortedData = Object.keys(data)
+                    .sort()
+                    .reduce((obj, key) => {
+                    obj[key] = data[key];
+                    return obj;
+                }, {});
+                const str = JSON.stringify(sortedData);
+                // Use Web Crypto API if available
+                if (window.crypto && window.crypto.subtle) {
+                    const encoder = new TextEncoder();
+                    const data = encoder.encode(str);
+                    const hashBuffer = yield crypto.subtle.digest('SHA-256', data);
+                    const hashArray = Array.from(new Uint8Array(hashBuffer));
+                    return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
+                }
+                // Fallback to simple hash
+                let hash = 0;
+                for (let i = 0; i < str.length; i++) {
+                    const char = str.charCodeAt(i);
+                    hash = ((hash << 5) - hash) + char;
+                    hash = hash & hash; // Convert to 32bit integer
+                }
+                return Math.abs(hash).toString(16);
+            }
+            catch (_a) {
+                return '';
+            }
+        });
     }
 }
 
@@ -1935,6 +2246,9 @@ class ContainerManager {
         this.sessionLoadedScripts = new Set();
         this.pixels = null;
         this.initialized = false;
+        this.sandboxedIframes = []; // FIXED (ISSUE-02): Track iframes for cleanup
+        this.iframeCleanupTimeouts = new Map(); // FIXED (ISSUE-02): Track cleanup timeouts
+        this.messageHandler = null; // FIXED (ISSUE-02): Track message listener
         this.workspaceId = options.workspaceId;
         // Container scripts use the same endpoint as tracking (ingest)
         this.endpoint = options.endpoint || 'https://ingest.datalyr.com';
@@ -1942,6 +2256,19 @@ class ContainerManager {
         // Load session scripts from storage
         const sessionScripts = storage.get('dl_session_scripts', []);
         this.sessionLoadedScripts = new Set(sessionScripts);
+        // FIXED (ISSUE-02): Set up postMessage listener for iframe cleanup
+        this.messageHandler = (event) => {
+            if (event.data && event.data.type === 'datalyr_script_complete') {
+                const scriptId = event.data.scriptId;
+                this.log('Received script completion signal:', scriptId);
+                // Find and clean up the corresponding iframe
+                const iframe = this.sandboxedIframes.find(iframe => iframe.dataset.datalyrScript === scriptId);
+                if (iframe) {
+                    this.cleanupIframe(iframe);
+                }
+            }
+        };
+        window.addEventListener('message', this.messageHandler);
     }
     /**
      * Initialize container and load scripts
@@ -2109,45 +2436,142 @@ class ContainerManager {
         }
     }
     /**
-     * Load inline JavaScript
+     * Load inline JavaScript in sandboxed iframe
+     * SECURITY: User-provided scripts run in isolated context to prevent XSS
+     * FIXED (ISSUE-02): Added cleanup mechanism to prevent memory leaks
      */
     loadInlineScript(script) {
-        // Basic XSS protection - ensure content doesn't contain obvious malicious patterns
-        if (this.containsMaliciousPatterns(script.content)) {
-            this.log('Blocked potentially malicious inline script:', script.id);
-            return;
+        // SECURITY FIX: Run in sandboxed iframe instead of main page context
+        // This prevents access to parent window, cookies, and localStorage
+        const iframe = document.createElement('iframe');
+        iframe.style.display = 'none';
+        iframe.setAttribute('sandbox', 'allow-scripts'); // Minimal permissions
+        iframe.dataset.datalyrScript = script.id;
+        // FIXED (ISSUE-02): Track iframe for cleanup
+        this.sandboxedIframes.push(iframe);
+        // Create isolated script context with completion signal
+        const iframeDoc = `
+      <!DOCTYPE html>
+      <html>
+        <head>
+          <meta charset="UTF-8">
+        </head>
+        <body>
+          <script>
+            // User-provided script runs here in isolation
+            try {
+              ${script.content}
+            } catch (error) {
+              console.error('[Datalyr Container] Script execution error:', error);
+            }
+
+            // FIXED (ISSUE-02): Signal completion for cleanup
+            // Scripts have 5 seconds to execute before iframe is removed
+            setTimeout(function() {
+              try {
+                parent.postMessage({ type: 'datalyr_script_complete', scriptId: '${script.id}' }, '*');
+              } catch (e) {
+                // Ignore postMessage errors from sandbox
+              }
+            }, 5000);
+          </script>
+        </body>
+      </html>
+    `;
+        document.body.appendChild(iframe);
+        // Write content to iframe (safe because sandbox prevents parent access)
+        if (iframe.contentDocument) {
+            iframe.contentDocument.open();
+            iframe.contentDocument.write(iframeDoc);
+            iframe.contentDocument.close();
+        }
+        // FIXED (ISSUE-02): Remove iframe after execution (30 seconds max as fallback)
+        // If script completes in 5s, postMessage will trigger early cleanup
+        const timeoutId = window.setTimeout(() => {
+            this.cleanupIframe(iframe);
+        }, 30000);
+        // Store timeout ID for cleanup
+        this.iframeCleanupTimeouts.set(iframe, timeoutId);
+        this.log('Loaded inline script in sandbox:', script.id);
+    }
+    /**
+     * Clean up a sandboxed iframe
+     * FIXED (ISSUE-02): Prevents memory leaks from iframe accumulation
+     */
+    cleanupIframe(iframe) {
+        try {
+            // FIXED (ISSUE-02): Clear pending timeout to prevent duplicate cleanup
+            const timeoutId = this.iframeCleanupTimeouts.get(iframe);
+            if (timeoutId) {
+                clearTimeout(timeoutId);
+                this.iframeCleanupTimeouts.delete(iframe);
+            }
+            // Remove from tracking array
+            const index = this.sandboxedIframes.indexOf(iframe);
+            if (index > -1) {
+                this.sandboxedIframes.splice(index, 1);
+            }
+            // Remove from DOM
+            if (iframe.parentNode) {
+                iframe.parentNode.removeChild(iframe);
+                this.log('Cleaned up sandboxed iframe:', iframe.dataset.datalyrScript);
+            }
+        }
+        catch (error) {
+            this.log('Error cleaning up iframe:', error);
         }
-        const scriptElement = document.createElement('script');
-        scriptElement.textContent = script.content;
-        scriptElement.dataset.datalyrScript = script.id;
-        scriptElement.setAttribute('data-nonce', this.generateNonce());
-        document.head.appendChild(scriptElement);
     }
     /**
-     * Load external JavaScript
+     * Clean up all sandboxed iframes
+     * FIXED (ISSUE-02): Called on SDK destroy to prevent memory leaks
+     */
+    cleanupAllIframes() {
+        // Clean up all iframes
+        const iframes = [...this.sandboxedIframes]; // Copy array since we're modifying it
+        iframes.forEach(iframe => this.cleanupIframe(iframe));
+        // FIXED (ISSUE-02): Remove message listener to prevent memory leak
+        if (this.messageHandler) {
+            window.removeEventListener('message', this.messageHandler);
+            this.messageHandler = null;
+        }
+        // Clear any remaining timeouts
+        this.iframeCleanupTimeouts.forEach(timeoutId => clearTimeout(timeoutId));
+        this.iframeCleanupTimeouts.clear();
+        this.log(`Cleaned up ${iframes.length} sandboxed iframes`);
+    }
+    /**
+     * Load external JavaScript with SRI validation
+     * SECURITY (Phase 1.2): SRI is now REQUIRED for external scripts
      */
     loadExternalScript(script) {
+        var _a;
         // Validate URL before loading
         if (!this.isValidScriptUrl(script.content)) {
             this.log('Blocked invalid script URL:', script.content);
             return;
         }
+        // SECURITY FIX: Require SRI (Subresource Integrity) for external scripts
+        if (!((_a = script.settings) === null || _a === void 0 ? void 0 : _a.integrity)) {
+            console.error(`[Datalyr Container] SECURITY: External script "${script.id}" blocked - missing SRI hash.\n` +
+                `All external scripts MUST include an integrity hash to prevent CDN compromise attacks.\n` +
+                `Generate SRI hash at: https://www.srihash.org/\n` +
+                `Example: { integrity: "sha384-..." }`);
+            return;
+        }
         const scriptElement = document.createElement('script');
         scriptElement.src = script.content;
         scriptElement.dataset.datalyrScript = script.id;
         // Apply settings
         if (script.settings) {
+            scriptElement.integrity = script.settings.integrity; // REQUIRED
+            scriptElement.crossOrigin = script.settings.crossorigin || 'anonymous'; // Required for SRI
             if (script.settings.async !== false)
                 scriptElement.async = true;
             if (script.settings.defer)
                 scriptElement.defer = true;
-            if (script.settings.integrity)
-                scriptElement.integrity = script.settings.integrity;
-            if (script.settings.crossorigin)
-                scriptElement.crossOrigin = script.settings.crossorigin;
         }
         else {
-            // Default to async for better performance
+            // This should never happen now that integrity is required
             scriptElement.async = true;
         }
         document.head.appendChild(scriptElement);
@@ -2292,10 +2716,13 @@ class ContainerManager {
      */
     trackToPixels(eventName, properties = {}) {
         var _a, _b, _c, _e, _f, _g;
+        // Sanitize inputs to prevent XSS
+        const sanitizedEventName = this.sanitizeEventName(eventName);
+        const sanitizedProperties = this.sanitizeProperties(properties);
         // Track to Meta Pixel
         if (((_b = (_a = this.pixels) === null || _a === void 0 ? void 0 : _a.meta) === null || _b === void 0 ? void 0 : _b.enabled) && window.fbq) {
             try {
-                window.fbq('track', eventName, properties);
+                window.fbq('track', sanitizedEventName, sanitizedProperties);
             }
             catch (error) {
                 this.log('Error tracking Meta Pixel event:', error);
@@ -2304,7 +2731,7 @@ class ContainerManager {
         // Track to Google Tag
         if (((_e = (_c = this.pixels) === null || _c === void 0 ? void 0 : _c.google) === null || _e === void 0 ? void 0 : _e.enabled) && window.gtag) {
             try {
-                window.gtag('event', eventName, properties);
+                window.gtag('event', sanitizedEventName, sanitizedProperties);
             }
             catch (error) {
                 this.log('Error tracking Google Tag event:', error);
@@ -2322,8 +2749,8 @@ class ContainerManager {
                     'Search': 'Search',
                     'Lead': 'SubmitForm'
                 };
-                const tiktokEvent = tiktokEventMap[eventName] || eventName;
-                window.ttq.track(tiktokEvent, properties);
+                const tiktokEvent = tiktokEventMap[sanitizedEventName] || sanitizedEventName;
+                window.ttq.track(tiktokEvent, sanitizedProperties);
             }
             catch (error) {
                 this.log('Error tracking TikTok Pixel event:', error);
@@ -2346,49 +2773,25 @@ class ContainerManager {
         return Array.from(this.loadedScripts);
     }
     /**
-     * Extract app endpoint from ingest endpoint
+     * SECURITY MODEL (Phase 1.1 Fix):
+     *
+     * Inline scripts run in sandboxed iframes with 'allow-scripts' only.
+     * This prevents:
+     * - Access to parent window/document
+     * - Access to cookies and localStorage
+     * - Cross-origin requests
+     * - Popup creation
+     * - Form submission
+     *
+     * External scripts MUST have SRI (Subresource Integrity) hashes.
+     * This prevents:
+     * - CDN compromise attacks
+     * - Man-in-the-middle script injection
+     * - Unauthorized script modifications
+     *
+     * Previous regex-based validation was removed because it's trivially bypassable.
+     * Sandboxing provides defense-in-depth regardless of script content.
      */
-    extractAppEndpoint(endpoint) {
-        if (!endpoint) {
-            return 'https://app.datalyr.com';
-        }
-        // If it's already an app endpoint, use it
-        if (endpoint.includes('app.datalyr.com')) {
-            return endpoint;
-        }
-        // Convert ingest endpoint to app endpoint
-        if (endpoint.includes('ingest.datalyr.com')) {
-            return 'https://app.datalyr.com';
-        }
-        // For local development
-        if (endpoint.includes('localhost') || endpoint.includes('127.0.0.1')) {
-            // Assume app is on port 3000 if ingest is on 3001
-            return endpoint.replace(':3001', ':3000').replace('/ingest', '');
-        }
-        // For custom endpoints, try to extract the base domain
-        try {
-            const url = new URL(endpoint);
-            return `${url.protocol}//${url.hostname}${url.port ? ':' + url.port : ''}`;
-        }
-        catch (_a) {
-            return 'https://app.datalyr.com';
-        }
-    }
-    /**
-     * Check for malicious patterns in inline scripts
-     */
-    containsMaliciousPatterns(content) {
-        // Basic patterns that might indicate malicious content
-        const dangerousPatterns = [
-            /<script[^>]*>/gi, // Script tags within content
-            /document\.cookie/gi, // Direct cookie access
-            /eval\s*\(/gi, // eval usage
-            /Function\s*\(/gi, // Function constructor
-            /innerHTML\s*=/gi, // Direct innerHTML assignment
-            /document\.write/gi, // document.write usage
-        ];
-        return dangerousPatterns.some(pattern => pattern.test(content));
-    }
     /**
      * Validate script URL
      */
@@ -2410,12 +2813,61 @@ class ContainerManager {
         }
     }
     /**
-     * Generate a nonce for CSP
+     * Sanitize event name - whitelist alphanumeric, underscore, dollar sign
      */
-    generateNonce() {
-        const array = new Uint8Array(16);
-        crypto.getRandomValues(array);
-        return btoa(String.fromCharCode(...array));
+    sanitizeEventName(eventName) {
+        if (typeof eventName !== 'string') {
+            return 'unknown_event';
+        }
+        // Allow alphanumeric, underscore, dollar sign, and spaces
+        return eventName.replace(/[^a-zA-Z0-9_$ ]/g, '').substring(0, 100);
+    }
+    /**
+     * Recursively sanitize properties object
+     */
+    sanitizeProperties(properties) {
+        if (properties === null || properties === undefined) {
+            return {};
+        }
+        if (typeof properties !== 'object') {
+            return this.sanitizeValue(properties);
+        }
+        if (Array.isArray(properties)) {
+            return properties.map(item => this.sanitizeValue(item));
+        }
+        const sanitized = {};
+        for (const [key, value] of Object.entries(properties)) {
+            // Sanitize key
+            const sanitizedKey = key.replace(/[^a-zA-Z0-9_]/g, '').substring(0, 100);
+            if (sanitizedKey) {
+                sanitized[sanitizedKey] = this.sanitizeValue(value);
+            }
+        }
+        return sanitized;
+    }
+    /**
+     * Sanitize individual value
+     */
+    sanitizeValue(value) {
+        if (value === null || value === undefined) {
+            return value;
+        }
+        if (typeof value === 'string') {
+            // Remove potential XSS patterns
+            return value
+                .replace(/<script[^>]*>.*?<\/script>/gi, '')
+                .replace(/<[^>]+>/g, '')
+                .replace(/javascript:/gi, '')
+                .replace(/on\w+\s*=/gi, '')
+                .substring(0, 1000);
+        }
+        if (typeof value === 'number' || typeof value === 'boolean') {
+            return value;
+        }
+        if (typeof value === 'object') {
+            return this.sanitizeProperties(value);
+        }
+        return String(value).substring(0, 1000);
     }
     /**
      * Debug logging
@@ -2427,6 +2879,437 @@ class ContainerManager {
     }
 }
 
+/**
+ * Auto-Identify Module
+ *
+ * Automatically captures user identity (email) from:
+ * 1. Fetch/XHR API requests (email in request/response)
+ * 2. Form submissions (email inputs)
+ * 3. Shopify-specific endpoints (/account.json)
+ *
+ * SECURITY:
+ * - Email validation to prevent false positives
+ * - Whitelist approach for trusted domains
+ * - Rate limiting to prevent spam
+ * - Privacy controls integration
+ */
+class AutoIdentifyManager {
+    constructor(config = {}) {
+        this.formListeners = [];
+        this.lastIdentifyTime = 0;
+        this.RATE_LIMIT_MS = 5000; // Don't auto-identify more than once per 5 seconds
+        this.config = {
+            enabled: config.enabled !== false,
+            captureFromForms: config.captureFromForms !== false,
+            captureFromAPI: config.captureFromAPI !== false,
+            captureFromShopify: config.captureFromShopify !== false,
+            trustedDomains: config.trustedDomains || [],
+            debug: config.debug || false
+        };
+    }
+    /**
+     * Initialize auto-identify system
+     */
+    initialize(identifyCallback) {
+        if (!this.config.enabled) {
+            this.log('Auto-identify disabled');
+            return;
+        }
+        this.identifyCallback = identifyCallback;
+        // Check if already identified
+        const existingEmail = storage.get('dl_auto_identified_email');
+        if (existingEmail) {
+            this.log('User already auto-identified:', existingEmail);
+            return;
+        }
+        // Setup monitoring
+        if (this.config.captureFromForms) {
+            this.setupFormMonitoring();
+        }
+        if (this.config.captureFromAPI) {
+            this.setupFetchInterception();
+            this.setupXHRInterception();
+        }
+        if (this.config.captureFromShopify) {
+            this.setupShopifyMonitoring();
+        }
+        this.log('Auto-identify initialized');
+    }
+    /**
+     * Setup form monitoring for email capture
+     */
+    setupFormMonitoring() {
+        // Monitor existing forms
+        this.scanForEmailForms();
+        // Watch for new forms (SPAs)
+        const observer = new MutationObserver(() => {
+            this.scanForEmailForms();
+        });
+        observer.observe(document.body, {
+            childList: true,
+            subtree: true
+        });
+        this.log('Form monitoring active');
+    }
+    /**
+     * Scan DOM for forms with email inputs
+     */
+    scanForEmailForms() {
+        const forms = document.querySelectorAll('form');
+        forms.forEach(form => {
+            // Skip if already listening
+            if (this.formListeners.some(l => l.element === form)) {
+                return;
+            }
+            // Check if form has email input
+            const emailInput = form.querySelector('input[type="email"], input[name*="email" i], input[id*="email" i]');
+            if (emailInput) {
+                const handler = (e) => this.handleFormSubmit(e, form);
+                form.addEventListener('submit', handler);
+                this.formListeners.push({ element: form, handler });
+                this.log('Monitoring form:', form);
+            }
+        });
+    }
+    /**
+     * Handle form submission
+     */
+    handleFormSubmit(_event, form) {
+        try {
+            // Find email input
+            const emailInput = form.querySelector('input[type="email"], input[name*="email" i], input[id*="email" i]');
+            if (!emailInput)
+                return;
+            const email = emailInput.value.trim();
+            if (this.isValidEmail(email)) {
+                this.log('Email captured from form:', email);
+                this.triggerIdentify(email, 'form');
+            }
+        }
+        catch (error) {
+            this.log('Error handling form submit:', error);
+        }
+    }
+    /**
+     * Setup fetch interception for API email capture
+     */
+    setupFetchInterception() {
+        if (typeof window.fetch !== 'function')
+            return;
+        this.originalFetch = window.fetch;
+        const self = this;
+        window.fetch = function (input, init) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const url = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;
+                // Check if trusted domain
+                if (!self.isTrustedDomain(url)) {
+                    return self.originalFetch.call(window, input, init);
+                }
+                try {
+                    // Check request body for email
+                    if (init === null || init === void 0 ? void 0 : init.body) {
+                        self.extractEmailFromData(init.body, 'api-request');
+                    }
+                    // Make actual request
+                    const response = self.originalFetch.call(window, input, init);
+                    // Check response for email
+                    response.then((res) => __awaiter(this, void 0, void 0, function* () {
+                        var _a;
+                        if (res.ok && ((_a = res.headers.get('content-type')) === null || _a === void 0 ? void 0 : _a.includes('application/json'))) {
+                            try {
+                                const clone = res.clone();
+                                const data = yield clone.json();
+                                self.extractEmailFromData(data, 'api-response');
+                            }
+                            catch (error) {
+                                // Ignore JSON parse errors
+                            }
+                        }
+                    })).catch(() => {
+                        // Ignore response errors
+                    });
+                    return response;
+                }
+                catch (error) {
+                    self.log('Error intercepting fetch:', error);
+                    return self.originalFetch.call(window, input, init);
+                }
+            });
+        };
+        this.log('Fetch interception active');
+    }
+    /**
+     * Setup XHR interception for API email capture
+     */
+    setupXHRInterception() {
+        if (typeof XMLHttpRequest === 'undefined')
+            return;
+        const self = this;
+        this.originalXHROpen = XMLHttpRequest.prototype.open;
+        this.originalXHRSend = XMLHttpRequest.prototype.send;
+        XMLHttpRequest.prototype.open = function (method, url, ...args) {
+            this._datalyrUrl = typeof url === 'string' ? url : url.href;
+            return self.originalXHROpen.apply(this, [method, url, ...args]);
+        };
+        XMLHttpRequest.prototype.send = function (body) {
+            const url = this._datalyrUrl;
+            if (url && self.isTrustedDomain(url)) {
+                // Check request body
+                if (body) {
+                    self.extractEmailFromData(body, 'api-request');
+                }
+                // Monitor response
+                this.addEventListener('load', function () {
+                    if (this.status >= 200 && this.status < 300) {
+                        try {
+                            const contentType = this.getResponseHeader('content-type');
+                            if (contentType === null || contentType === void 0 ? void 0 : contentType.includes('application/json')) {
+                                const data = JSON.parse(this.responseText);
+                                self.extractEmailFromData(data, 'api-response');
+                            }
+                        }
+                        catch (error) {
+                            // Ignore parse errors
+                        }
+                    }
+                });
+            }
+            return self.originalXHRSend.call(this, body);
+        };
+        this.log('XHR interception active');
+    }
+    /**
+     * Setup Shopify-specific monitoring
+     */
+    setupShopifyMonitoring() {
+        // Detect Shopify
+        if (!this.isShopify()) {
+            return;
+        }
+        this.log('Shopify detected, setting up monitoring');
+        // Try to fetch customer data immediately
+        this.checkShopifyCustomer();
+        // Check periodically (in case customer logs in later)
+        this.shopifyCheckInterval = setInterval(() => {
+            this.checkShopifyCustomer();
+        }, 10000); // Check every 10 seconds
+        this.log('Shopify monitoring active');
+    }
+    /**
+     * Check if running on Shopify
+     */
+    isShopify() {
+        return !!(window.Shopify ||
+            document.querySelector('meta[name="shopify-checkout-api-token"]') ||
+            window.location.hostname.includes('.myshopify.com'));
+    }
+    /**
+     * Check Shopify customer endpoint for email
+     */
+    checkShopifyCustomer() {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            try {
+                const response = yield fetch('/account.json', {
+                    credentials: 'same-origin'
+                });
+                if (response.ok) {
+                    const data = yield response.json();
+                    if ((_a = data === null || data === void 0 ? void 0 : data.customer) === null || _a === void 0 ? void 0 : _a.email) {
+                        this.log('Email captured from Shopify:', data.customer.email);
+                        this.triggerIdentify(data.customer.email, 'shopify');
+                        // Stop checking once we have email
+                        if (this.shopifyCheckInterval) {
+                            clearInterval(this.shopifyCheckInterval);
+                            this.shopifyCheckInterval = undefined;
+                        }
+                    }
+                }
+            }
+            catch (error) {
+                // User not logged in or endpoint unavailable
+                this.log('Shopify customer check failed:', error);
+            }
+        });
+    }
+    /**
+     * Extract email from data (object, string, FormData)
+     */
+    extractEmailFromData(data, source) {
+        try {
+            let emails = [];
+            if (typeof data === 'string') {
+                // Try to parse as JSON
+                try {
+                    const parsed = JSON.parse(data);
+                    emails = this.findEmailsInObject(parsed);
+                }
+                catch (_a) {
+                    // Try to extract from string directly
+                    const emailPattern = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
+                    const matches = data.match(emailPattern);
+                    if (matches) {
+                        emails = matches;
+                    }
+                }
+            }
+            else if (data instanceof FormData) {
+                // Extract from FormData
+                data.forEach((value) => {
+                    if (typeof value === 'string' && this.isValidEmail(value)) {
+                        emails.push(value);
+                    }
+                });
+            }
+            else if (typeof data === 'object' && data !== null) {
+                // Extract from object
+                emails = this.findEmailsInObject(data);
+            }
+            // Trigger identify for first valid email
+            if (emails.length > 0) {
+                const email = emails[0];
+                this.log(`Email found in ${source}:`, email);
+                this.triggerIdentify(email, 'api');
+            }
+        }
+        catch (error) {
+            this.log('Error extracting email from data:', error);
+        }
+    }
+    /**
+     * Recursively find emails in object
+     */
+    findEmailsInObject(obj, depth = 0) {
+        if (depth > 5)
+            return []; // Prevent infinite recursion
+        const emails = [];
+        for (const key in obj) {
+            if (!obj.hasOwnProperty(key))
+                continue;
+            const value = obj[key];
+            // Check if key suggests email field
+            if (/email/i.test(key) && typeof value === 'string' && this.isValidEmail(value)) {
+                emails.push(value);
+            }
+            // Recursively check nested objects
+            else if (typeof value === 'object' && value !== null) {
+                emails.push(...this.findEmailsInObject(value, depth + 1));
+            }
+        }
+        return emails;
+    }
+    /**
+     * Check if domain is trusted for auto-identify
+     */
+    isTrustedDomain(url) {
+        try {
+            const urlObj = new URL(url, window.location.origin);
+            // Always trust same origin
+            if (urlObj.origin === window.location.origin) {
+                return true;
+            }
+            // Check trusted domains list
+            if (this.config.trustedDomains.length === 0) {
+                // If no trusted domains specified, only trust same origin
+                return false;
+            }
+            return this.config.trustedDomains.some(domain => {
+                return urlObj.hostname === domain || urlObj.hostname.endsWith(`.${domain}`);
+            });
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    /**
+     * Validate email format
+     */
+    isValidEmail(email) {
+        if (!email || typeof email !== 'string')
+            return false;
+        // Basic email validation
+        const emailPattern = /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/;
+        if (!emailPattern.test(email))
+            return false;
+        // Exclude common test/dummy emails
+        const dummyPatterns = [
+            /test@/i,
+            /example@/i,
+            /demo@/i,
+            /fake@/i,
+            /@test\./i,
+            /@example\./i
+        ];
+        if (dummyPatterns.some(pattern => pattern.test(email))) {
+            return false;
+        }
+        return true;
+    }
+    /**
+     * Trigger identify with rate limiting
+     */
+    triggerIdentify(email, source) {
+        // Rate limiting
+        const now = Date.now();
+        if (now - this.lastIdentifyTime < this.RATE_LIMIT_MS) {
+            this.log('Rate limited, skipping identify');
+            return;
+        }
+        // Check if already identified
+        const existingEmail = storage.get('dl_auto_identified_email');
+        if (existingEmail === email) {
+            this.log('Already identified with this email');
+            return;
+        }
+        // Store email to prevent duplicate identification
+        storage.set('dl_auto_identified_email', email);
+        this.lastIdentifyTime = now;
+        // Trigger callback
+        if (this.identifyCallback) {
+            this.log(`Auto-identifying user: ${email} (source: ${source})`);
+            this.identifyCallback(email, source);
+        }
+    }
+    /**
+     * Destroy and cleanup
+     */
+    destroy() {
+        // Restore original fetch
+        if (this.originalFetch) {
+            window.fetch = this.originalFetch;
+            this.originalFetch = undefined;
+        }
+        // Restore original XHR
+        if (this.originalXHROpen) {
+            XMLHttpRequest.prototype.open = this.originalXHROpen;
+            this.originalXHROpen = undefined;
+        }
+        if (this.originalXHRSend) {
+            XMLHttpRequest.prototype.send = this.originalXHRSend;
+            this.originalXHRSend = undefined;
+        }
+        // Remove form listeners
+        this.formListeners.forEach(({ element, handler }) => {
+            element.removeEventListener('submit', handler);
+        });
+        this.formListeners = [];
+        // Clear Shopify interval
+        if (this.shopifyCheckInterval) {
+            clearInterval(this.shopifyCheckInterval);
+            this.shopifyCheckInterval = undefined;
+        }
+        this.log('Auto-identify destroyed');
+    }
+    /**
+     * Debug logging
+     */
+    log(...args) {
+        if (this.config.debug) {
+            console.log('[Datalyr Auto-Identify]', ...args);
+        }
+    }
+}
+
 /**
  * Datalyr Web SDK
  * Modern attribution tracking for web applications
@@ -2439,9 +3322,9 @@ class Datalyr {
         this.initialized = false;
         this.errors = [];
         this.MAX_ERRORS = 50;
-        this.heavyFingerprintCollected = false;
-        // Check for opt-out cookie on instantiation using default cookie instance
-        this.optedOut = cookies.get('__dl_opt_out') === 'true';
+        // FIXED (ISSUE-01): Async initialization promise to prevent race conditions
+        this.initializationPromise = null;
+        // Opt-out check moved to init() after cookies configured (Issue #14)
     }
     /**
      * Initialize the SDK
@@ -2456,7 +3339,7 @@ class Datalyr {
             throw new Error('[Datalyr] workspaceId is required');
         }
         // Set default config values
-        this.config = Object.assign({ endpoint: 'https://ingest.datalyr.com', debug: false, batchSize: 10, flushInterval: 5000, flushAt: 10, criticalEvents: undefined, highPriorityEvents: undefined, sessionTimeout: 30 * 60 * 1000, trackSessions: true, attributionWindow: 30 * 24 * 60 * 60 * 1000, trackedParams: [], respectDoNotTrack: false, respectGlobalPrivacyControl: true, privacyMode: 'standard', cookieDomain: 'auto', cookieExpires: 365, secureCookie: 'auto', sameSite: 'Lax', cookiePrefix: '__dl_', enablePerformanceTracking: true, enableFingerprinting: true, maxRetries: 5, retryDelay: 1000, maxOfflineQueueSize: 100, trackSPA: true, trackPageViews: true, fallbackEndpoints: [], plugins: [] }, config);
+        this.config = Object.assign({ endpoint: 'https://ingest.datalyr.com', debug: false, batchSize: 10, flushInterval: 5000, flushAt: 10, criticalEvents: undefined, highPriorityEvents: undefined, sessionTimeout: 60 * 60 * 1000, trackSessions: true, attributionWindow: 90 * 24 * 60 * 60 * 1000, trackedParams: [], respectDoNotTrack: false, respectGlobalPrivacyControl: true, privacyMode: 'standard', cookieDomain: 'auto', cookieExpires: 365, secureCookie: 'auto', sameSite: 'Lax', cookiePrefix: '__dl_', enablePerformanceTracking: true, enableFingerprinting: true, maxRetries: 5, retryDelay: 1000, maxOfflineQueueSize: 100, trackSPA: true, trackPageViews: true, fallbackEndpoints: [], plugins: [] }, config);
         // Initialize cookie storage with config
         this.cookies = new CookieStorage({
             domain: this.config.cookieDomain,
@@ -2464,6 +3347,10 @@ class Datalyr {
             sameSite: this.config.sameSite,
             secure: this.config.secureCookie
         });
+        // Migrate legacy storage keys (fixes double-prefix issue)
+        storage.migrateFromLegacyPrefix();
+        // Check opt-out AFTER cookies configured (Issue #14)
+        this.optedOut = this.cookies.get('__dl_opt_out') === 'true';
         // Initialize modules
         this.identity = new IdentityManager();
         this.session = new SessionManager(this.config.sessionTimeout);
@@ -2479,28 +3366,9 @@ class Datalyr {
         // Set session ID in identity manager
         const sessionId = this.session.getSessionId();
         this.identity.setSessionId(sessionId);
-        // Load stored user properties
-        this.userProperties = storage.get('dl_user_traits', {});
-        // Setup SPA tracking if enabled
-        if (this.config.trackSPA) {
-            this.setupSPATracking();
-        }
-        // Initialize container manager if enabled
-        if (this.config.enableContainer !== false) {
-            this.container = new ContainerManager({
-                workspaceId: this.config.workspaceId,
-                endpoint: this.config.endpoint,
-                debug: this.config.debug
-            });
-            // Initialize container asynchronously
-            this.container.init().catch(error => {
-                this.log('Container initialization failed:', error);
-            });
-        }
-        // Track initial page view if enabled
-        if (this.config.trackPageViews) {
-            this.page();
-        }
+        // FIXED (ISSUE-01): Start async initialization immediately but don't block constructor
+        // This allows encryption to initialize before any events are tracked
+        this.initializeAsync();
         // Setup page unload handler
         this.setupUnloadHandler();
         // Initialize plugins
@@ -2511,6 +3379,8 @@ class Datalyr {
                     this.log(`Plugin initialized: ${plugin.name}`);
                 }
                 catch (error) {
+                    // Issue #16: Always warn about plugin failures, even when debug is false
+                    console.warn(`[Datalyr] Plugin '${plugin.name}' failed to initialize:`, error);
                     this.trackError(error, { plugin: plugin.name });
                 }
             }
@@ -2518,20 +3388,103 @@ class Datalyr {
         this.initialized = true;
         this.log('SDK initialized');
     }
+    /**
+     * Complete async initialization (encryption, user properties, container, page view)
+     *
+     * FIXED (ISSUE-01): Separated async initialization to prevent race conditions
+     * Encryption must complete before first events are tracked
+     */
+    initializeAsync() {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (this.initializationPromise) {
+                return this.initializationPromise;
+            }
+            this.initializationPromise = (() => __awaiter(this, void 0, void 0, function* () {
+                try {
+                    // SEC-03 Fix: Initialize encryption for PII data
+                    const deviceId = this.identity.getAnonymousId();
+                    yield dataEncryption.initialize(this.config.workspaceId, deviceId);
+                    // Load encrypted user properties
+                    this.userProperties = yield storage.getEncrypted('dl_user_traits', {});
+                    this.log('Encryption initialized, user properties loaded');
+                    // Setup SPA tracking if enabled
+                    if (this.config.trackSPA) {
+                        this.setupSPATracking();
+                    }
+                    // Initialize container manager if enabled
+                    if (this.config.enableContainer !== false) {
+                        this.container = new ContainerManager({
+                            workspaceId: this.config.workspaceId,
+                            endpoint: this.config.endpoint,
+                            debug: this.config.debug
+                        });
+                        // Initialize container asynchronously
+                        yield this.container.init().catch(error => {
+                            this.log('Container initialization failed:', error);
+                        });
+                    }
+                    // Initialize auto-identify if explicitly enabled (opt-in)
+                    if (this.config.autoIdentify === true) {
+                        this.autoIdentify = new AutoIdentifyManager({
+                            enabled: true,
+                            captureFromForms: this.config.autoIdentifyForms,
+                            captureFromAPI: this.config.autoIdentifyAPI,
+                            captureFromShopify: this.config.autoIdentifyShopify,
+                            trustedDomains: this.config.autoIdentifyTrustedDomains,
+                            debug: this.config.debug
+                        });
+                        // Setup auto-identify callback
+                        this.autoIdentify.initialize((email, source) => {
+                            this.log(`Auto-identified user: ${email} from ${source}`);
+                            // Track auto-identify event
+                            this.track('$auto_identify', {
+                                email,
+                                source,
+                                timestamp: Date.now()
+                            });
+                            // Automatically call identify with email
+                            this.identify(email, { email });
+                        });
+                    }
+                    // Track initial page view if enabled (AFTER encryption ready)
+                    if (this.config.trackPageViews) {
+                        this.page();
+                    }
+                    this.log('Async initialization complete');
+                }
+                catch (error) {
+                    console.error('[Datalyr] Async initialization failed:', error);
+                    // Fallback: Load unencrypted and continue
+                    this.userProperties = storage.get('dl_user_traits', {});
+                }
+            }))();
+            return this.initializationPromise;
+        });
+    }
+    /**
+     * Wait for async initialization to complete
+     * FIXED (ISSUE-01): Public method to await full initialization
+     */
+    ready() {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!this.initialized) {
+                throw new Error('[Datalyr] SDK not initialized. Call init() first.');
+            }
+            return this.initializationPromise || Promise.resolve();
+        });
+    }
     /**
      * Track an event
      */
     track(eventName, properties = {}) {
+        if (!this.initialized) {
+            console.warn('[Datalyr] SDK not initialized. Call init() first.');
+            return;
+        }
         if (!this.shouldTrack())
             return;
         try {
-            // Collect heavy fingerprint on first event (lazy loading)
-            if (!this.heavyFingerprintCollected && this.config.enableFingerprinting) {
-                this.heavyFingerprintCollected = true;
-                this.fingerprint.collectHeavyFingerprint().catch(err => {
-                    this.log('Heavy fingerprint collection failed:', err);
-                });
-            }
+            // PRIVACY: Heavy fingerprinting removed - using minimal fingerprinting only
             // Update session activity
             this.session.updateActivity(eventName);
             // Create event payload
@@ -2565,6 +3518,10 @@ class Datalyr {
      * Identify a user
      */
     identify(userId, traits = {}) {
+        if (!this.initialized) {
+            console.warn('[Datalyr] SDK not initialized. Call init() first.');
+            return;
+        }
         if (!this.shouldTrack())
             return;
         if (!userId) {
@@ -2572,11 +3529,23 @@ class Datalyr {
             return;
         }
         try {
+            // FIXED (DATA-05): Rotate session ID on identify to prevent session fixation
+            if (this.session) {
+                this.session.rotateSessionId();
+            }
             // Update identity
             const identityLink = this.identity.identify(userId, traits);
-            // Store user properties
+            // SEC-03 Fix: Store user properties encrypted (contains PII)
+            // FIXED (H2): Fail loudly instead of silent fallback to unencrypted
             this.userProperties = Object.assign(Object.assign({}, this.userProperties), traits);
-            storage.set('dl_user_traits', this.userProperties);
+            storage.setEncrypted('dl_user_traits', this.userProperties).catch(error => {
+                console.error('[Datalyr] Failed to encrypt user traits - NOT storing unencrypted PII:', error);
+                console.error('[Datalyr] User traits will only persist in memory until page reload');
+                // DO NOT fallback to unencrypted storage - this would expose PII
+                // This is a breaking change from the previous silent fallback behavior
+                // If encryption fails, user traits are only stored in memory (this.userProperties)
+                // and will be lost on page reload - but PII is NOT exposed in localStorage
+            });
             // Track $identify event
             this.track('$identify', Object.assign(Object.assign({}, identityLink), { traits }));
             // Call plugin handlers
@@ -2602,6 +3571,10 @@ class Datalyr {
      * Track a page view
      */
     page(properties = {}) {
+        if (!this.initialized) {
+            console.warn('[Datalyr] SDK not initialized. Call init() first.');
+            return;
+        }
         if (!this.shouldTrack())
             return;
         const pageData = Object.assign({ title: document.title, url: window.location.href, path: window.location.pathname, search: window.location.search, referrer: document.referrer }, properties);
@@ -2640,6 +3613,10 @@ class Datalyr {
      * Associate user with a group/account
      */
     group(groupId, traits = {}) {
+        if (!this.initialized) {
+            console.warn('[Datalyr] SDK not initialized. Call init() first.');
+            return;
+        }
         this.track('$group', {
             group_id: groupId,
             traits
@@ -2649,6 +3626,10 @@ class Datalyr {
      * Alias one ID to another
      */
     alias(userId, previousId) {
+        if (!this.initialized) {
+            console.warn('[Datalyr] SDK not initialized. Call init() first.');
+            return;
+        }
         const aliasData = this.identity.alias(userId, previousId);
         this.track('$alias', aliasData);
     }
@@ -2656,6 +3637,10 @@ class Datalyr {
      * Reset the current user
      */
     reset() {
+        if (!this.initialized) {
+            console.warn('[Datalyr] SDK not initialized. Call init() first.');
+            return;
+        }
         this.identity.reset();
         this.userProperties = {};
         storage.remove('dl_user_traits');
@@ -2724,8 +3709,12 @@ class Datalyr {
      * Opt out of tracking
      */
     optOut() {
+        if (!this.initialized) {
+            console.warn('[Datalyr] SDK not initialized. Call init() first.');
+            return;
+        }
         this.optedOut = true;
-        cookies.set('__dl_opt_out', 'true', this.config.cookieExpires);
+        this.cookies.set('__dl_opt_out', 'true', this.config.cookieExpires);
         this.queue.clear();
         this.log('User opted out');
     }
@@ -2733,8 +3722,12 @@ class Datalyr {
      * Opt in to tracking
      */
     optIn() {
+        if (!this.initialized) {
+            console.warn('[Datalyr] SDK not initialized. Call init() first.');
+            return;
+        }
         this.optedOut = false;
-        cookies.set('__dl_opt_out', 'false', this.config.cookieExpires);
+        this.cookies.set('__dl_opt_out', 'false', this.config.cookieExpires);
         this.log('User opted in');
     }
     /**
@@ -2795,8 +3788,7 @@ class Datalyr {
         if (this.config.enableFingerprinting) {
             const fingerprintData = this.fingerprint.collect();
             Object.assign(eventData, {
-                fingerprint: fingerprintData,
-                device_fingerprint: fingerprintData // Snake case alias
+                device_fingerprint: fingerprintData // Use snake_case only (matches backend)
             });
         }
         // Add browser context
@@ -2810,7 +3802,7 @@ class Datalyr {
             viewport_width: window.innerWidth,
             viewport_height: window.innerHeight
         });
-        // Create payload with both camelCase and snake_case fields
+        // Create payload using snake_case only (matches backend API and production script)
         const identityFields = this.identity.getIdentityFields();
         const eventId = generateUUID();
         // Ensure we have all required identity fields
@@ -2819,31 +3811,25 @@ class Datalyr {
         const visitorId = identityFields.visitor_id || anonymousId;
         const sessionId = identityFields.session_id;
         const payload = {
-            // Required fields
-            workspaceId: this.config.workspaceId,
-            workspace_id: this.config.workspaceId, // Snake case alias
-            eventId: eventId,
-            event_id: eventId, // Snake case alias (same ID)
-            eventName,
-            event_name: eventName, // Snake case alias
-            eventData,
-            event_data: eventData, // Snake case alias
+            // Required fields (snake_case only - no duplication)
+            workspace_id: this.config.workspaceId,
+            event_id: eventId,
+            event_name: eventName,
+            event_data: eventData,
             source: 'web',
             timestamp: new Date().toISOString(),
-            // Identity fields (explicit to satisfy TypeScript)
+            // Identity fields (snake_case only)
             distinct_id: distinctId,
             anonymous_id: anonymousId,
             visitor_id: visitorId,
-            visitorId: visitorId,
             user_id: identityFields.user_id,
             canonical_id: identityFields.canonical_id,
-            sessionId: sessionId,
             session_id: sessionId,
             // Resolution metadata
             resolution_method: 'browser_sdk',
             resolution_confidence: 1.0,
             // SDK metadata
-            sdk_version: '1.0.0',
+            sdk_version: '1.1.1',
             sdk_name: 'datalyr-web-sdk'
         };
         return payload;
@@ -2868,36 +3854,48 @@ class Datalyr {
     }
     /**
      * Setup SPA tracking
+     * Fixed Issue #15: Store original methods for cleanup
+     * Fixed CRITICAL-03: Clear attribution cache on navigation to prevent stale data
      */
     setupSPATracking() {
-        // Store original methods
-        const originalPushState = history.pushState;
-        const originalReplaceState = history.replaceState;
+        // Store original methods for cleanup
+        this.originalPushState = history.pushState;
+        this.originalReplaceState = history.replaceState;
         const self = this;
         // Override pushState
         history.pushState = function (...args) {
-            originalPushState.apply(history, args);
+            self.originalPushState.apply(history, args);
             setTimeout(() => {
+                // Clear attribution cache to capture fresh URL params
+                self.attribution.clearCache();
                 self.page();
             }, 0);
         };
         // Override replaceState
         history.replaceState = function (...args) {
-            originalReplaceState.apply(history, args);
+            self.originalReplaceState.apply(history, args);
             setTimeout(() => {
+                // Clear attribution cache to capture fresh URL params
+                self.attribution.clearCache();
                 self.page();
             }, 0);
         };
         // Listen for popstate
-        window.addEventListener('popstate', () => {
+        this.popstateHandler = () => {
             setTimeout(() => {
-                this.page();
+                // Clear attribution cache to capture fresh URL params
+                self.attribution.clearCache();
+                self.page();
             }, 0);
-        });
+        };
+        window.addEventListener('popstate', this.popstateHandler);
         // Listen for hashchange
-        window.addEventListener('hashchange', () => {
-            this.page();
-        });
+        this.hashchangeHandler = () => {
+            // Clear attribution cache to capture fresh URL params
+            self.attribution.clearCache();
+            self.page();
+        };
+        window.addEventListener('hashchange', this.hashchangeHandler);
     }
     /**
      * Setup page unload handler
@@ -3004,6 +4002,20 @@ class Datalyr {
      * Destroy the SDK instance and cleanup resources
      */
     destroy() {
+        // Restore original history methods (Issue #15)
+        if (this.originalPushState) {
+            history.pushState = this.originalPushState;
+        }
+        if (this.originalReplaceState) {
+            history.replaceState = this.originalReplaceState;
+        }
+        // Remove event listeners (Issue #15)
+        if (this.popstateHandler) {
+            window.removeEventListener('popstate', this.popstateHandler);
+        }
+        if (this.hashchangeHandler) {
+            window.removeEventListener('hashchange', this.hashchangeHandler);
+        }
         // Clean up queue
         if (this.queue) {
             this.queue.destroy();
@@ -3012,6 +4024,16 @@ class Datalyr {
         if (this.session) {
             this.session.destroy();
         }
+        // FIXED (ISSUE-02): Clean up sandboxed iframes to prevent memory leaks
+        if (this.container) {
+            this.container.cleanupAllIframes();
+        }
+        // Clean up auto-identify
+        if (this.autoIdentify) {
+            this.autoIdentify.destroy();
+        }
+        // SEC-03 Fix: Clean up encryption keys
+        dataEncryption.destroy();
         // Clear any remaining data
         this.superProperties = {};
         this.userProperties = {};