@datalyr/web 1.0.7 → 1.1.1

package/dist/datalyr.js

@@ -1,5 +1,5 @@
 /**
- * @datalyr/web v1.0.7
+ * @datalyr/web v1.1.1
  * Datalyr Web SDK - Modern attribution tracking for web applications
  * (c) 2025 Datalyr Inc.
  * Released under the MIT License
@@ -39,17 +39,214 @@ var Datalyr = (function () {
         return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
     };
 
+    /**
+     * Encryption Module (SEC-03 Fix)
+     *
+     * Encrypts sensitive PII data before storing in localStorage
+     * Uses Web Crypto API for AES-GCM encryption
+     *
+     * SECURITY NOTE: This protects against casual localStorage reads,
+     * but determined XSS attacks can still access the encryption key in memory.
+     * Primary defense is preventing XSS (see container.ts sandboxing).
+     */
+    class DataEncryption {
+        constructor() {
+            this.key = null;
+            this.salt = null;
+        }
+        /**
+         * Initialize encryption with workspace-specific key
+         *
+         * FIXED (SEC-03): Now uses random per-device salt stored in localStorage
+         *
+         * @param workspaceId - Used to derive encryption key
+         * @param deviceId - Device-specific identifier for key derivation
+         */
+        initialize(workspaceId, deviceId) {
+            return __awaiter(this, void 0, void 0, function* () {
+                if (!crypto.subtle) {
+                    const error = new Error('Web Crypto API not available - encryption cannot be initialized');
+                    console.error('[Datalyr Encryption]', error.message);
+                    throw error; // FIXED: Fail loudly instead of silently
+                }
+                try {
+                    const encoder = new TextEncoder();
+                    // FIXED (SEC-03): Generate or retrieve random per-device salt
+                    const saltKey = 'dl_encryption_salt';
+                    let saltBase64 = localStorage.getItem(saltKey);
+                    if (!saltBase64) {
+                        // Generate new random 32-byte salt
+                        this.salt = crypto.getRandomValues(new Uint8Array(32));
+                        saltBase64 = this.arrayBufferToBase64(this.salt);
+                        localStorage.setItem(saltKey, saltBase64);
+                    }
+                    else {
+                        // Use existing salt
+                        this.salt = this.base64ToArrayBuffer(saltBase64);
+                    }
+                    // Derive key material from workspace ID + device ID
+                    const keyString = `datalyr:${workspaceId}:${deviceId}`;
+                    const keyData = encoder.encode(keyString);
+                    // Import key material
+                    const baseKey = yield crypto.subtle.importKey('raw', keyData, 'PBKDF2', false, ['deriveKey']);
+                    // Derive actual encryption key using PBKDF2 with random salt
+                    this.key = yield crypto.subtle.deriveKey({
+                        name: 'PBKDF2',
+                        salt: this.salt, // FIXED: Random per-device salt instead of static
+                        iterations: 100000, // 100k iterations for security
+                        hash: 'SHA-256'
+                    }, baseKey, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
+                }
+                catch (error) {
+                    console.error('[Datalyr Encryption] Failed to initialize:', error);
+                    this.key = null;
+                    throw error; // FIXED: Fail loudly
+                }
+            });
+        }
+        /**
+         * Encrypt sensitive data
+         *
+         * FIXED (SEC-03): No longer silently falls back to unencrypted storage
+         *
+         * @param data - Plain text or object to encrypt
+         * @returns Base64-encoded encrypted data with IV
+         * @throws Error if encryption is not available or fails
+         */
+        encrypt(data) {
+            return __awaiter(this, void 0, void 0, function* () {
+                if (!this.key || !crypto.subtle) {
+                    // FIXED: Fail loudly instead of silently storing unencrypted
+                    throw new Error('Encryption not initialized - cannot encrypt sensitive data');
+                }
+                try {
+                    const plaintext = typeof data === 'string' ? data : JSON.stringify(data);
+                    const encoder = new TextEncoder();
+                    const plaintextBytes = encoder.encode(plaintext);
+                    // Generate random IV (Initialization Vector)
+                    const iv = crypto.getRandomValues(new Uint8Array(12)); // 12 bytes for GCM
+                    // Encrypt
+                    const ciphertext = yield crypto.subtle.encrypt({ name: 'AES-GCM', iv }, this.key, plaintextBytes);
+                    // Combine IV + ciphertext for storage
+                    const combined = new Uint8Array(iv.length + ciphertext.byteLength);
+                    combined.set(iv, 0);
+                    combined.set(new Uint8Array(ciphertext), iv.length);
+                    // Return base64-encoded
+                    return this.arrayBufferToBase64(combined);
+                }
+                catch (error) {
+                    console.error('[Datalyr Encryption] Encryption failed:', error);
+                    throw error; // FIXED: Fail loudly
+                }
+            });
+        }
+        /**
+         * Decrypt sensitive data
+         *
+         * FIXED (SEC-03): Still allows backwards compatibility for migration,
+         * but logs warnings when unencrypted data is detected
+         *
+         * @param encryptedData - Base64-encoded encrypted data
+         * @returns Decrypted data (parsed as JSON if possible)
+         */
+        decrypt(encryptedData) {
+            return __awaiter(this, void 0, void 0, function* () {
+                if (!this.key || !crypto.subtle) {
+                    // Backwards compatibility: Try to parse as unencrypted JSON
+                    console.warn('[Datalyr Encryption] Decryption not available - reading potentially unencrypted data');
+                    try {
+                        return JSON.parse(encryptedData);
+                    }
+                    catch (_a) {
+                        return encryptedData;
+                    }
+                }
+                try {
+                    // Decode base64
+                    const combined = this.base64ToArrayBuffer(encryptedData);
+                    // Extract IV (first 12 bytes) and ciphertext
+                    const iv = combined.slice(0, 12);
+                    const ciphertext = combined.slice(12);
+                    // Decrypt
+                    const plaintextBytes = yield crypto.subtle.decrypt({ name: 'AES-GCM', iv }, this.key, ciphertext);
+                    // Decode and parse
+                    const decoder = new TextDecoder();
+                    const plaintext = decoder.decode(plaintextBytes);
+                    // Try to parse as JSON
+                    try {
+                        return JSON.parse(plaintext);
+                    }
+                    catch (_b) {
+                        return plaintext;
+                    }
+                }
+                catch (error) {
+                    // Backwards compatibility: Try to parse as unencrypted (for migration)
+                    console.warn('[Datalyr Encryption] Decryption failed - attempting to read as unencrypted data (migration mode)');
+                    try {
+                        return JSON.parse(encryptedData);
+                    }
+                    catch (_c) {
+                        return encryptedData;
+                    }
+                }
+            });
+        }
+        /**
+         * Check if encryption is available and initialized
+         */
+        isAvailable() {
+            return this.key !== null && crypto.subtle !== undefined;
+        }
+        /**
+         * Helper: Convert ArrayBuffer to Base64
+         */
+        arrayBufferToBase64(buffer) {
+            let binary = '';
+            const bytes = new Uint8Array(buffer);
+            const len = bytes.byteLength;
+            for (let i = 0; i < len; i++) {
+                binary += String.fromCharCode(bytes[i]);
+            }
+            return btoa(binary);
+        }
+        /**
+         * Helper: Convert Base64 to ArrayBuffer
+         */
+        base64ToArrayBuffer(base64) {
+            const binary = atob(base64);
+            const len = binary.length;
+            const bytes = new Uint8Array(len);
+            for (let i = 0; i < len; i++) {
+                bytes[i] = binary.charCodeAt(i);
+            }
+            return bytes;
+        }
+        /**
+         * Destroy encryption keys (called on SDK destroy)
+         *
+         * FIXED (SEC-03): Also clears salt reference
+         */
+        destroy() {
+            this.key = null;
+            this.salt = null;
+        }
+    }
+    // Singleton instance
+    const dataEncryption = new DataEncryption();
+
     /**
      * Storage Module
      * Safe storage wrapper with fallbacks for Safari private mode
+     * SEC-03 Fix: Added encryption support for PII data
      */
     class SafeStorage {
         constructor(storage) {
             this.memory = new Map();
-            this.prefix = '__dl_';
+            this.prefix = 'dl_';
             // Test if storage is available
             try {
-                const testKey = '__dl_test__' + Math.random();
+                const testKey = 'dl_test__' + Math.random();
                 storage.setItem(testKey, '1');
                 storage.removeItem(testKey);
                 this.storage = storage;
@@ -150,6 +347,117 @@ var Datalyr = (function () {
                 return [];
             }
         }
+        /**
+         * Migrate data from legacy '__dl_dl_*' keys to new 'dl_*' keys
+         *
+         * This fixes the double-prefix issue from earlier SDK versions.
+         * Called automatically during SDK initialization.
+         *
+         * @returns Number of keys migrated
+         */
+        migrateFromLegacyPrefix() {
+            if (!this.storage) {
+                return 0; // Can't migrate in memory-only mode
+            }
+            let migratedCount = 0;
+            const legacyPrefix = '__dl_dl_';
+            try {
+                // Find all legacy keys
+                const legacyKeys = [];
+                for (let i = 0; i < this.storage.length; i++) {
+                    const key = this.storage.key(i);
+                    if (key && key.startsWith(legacyPrefix)) {
+                        legacyKeys.push(key);
+                    }
+                }
+                // Migrate each legacy key
+                legacyKeys.forEach(legacyKey => {
+                    try {
+                        // Get value from legacy key
+                        const value = this.storage.getItem(legacyKey);
+                        if (value) {
+                            // Extract the actual key name (remove '__dl_' prefix, keep 'dl_' part)
+                            const actualKey = legacyKey.slice('__dl_'.length); // e.g., '__dl_dl_anonymous_id' -> 'dl_anonymous_id'
+                            // Only migrate if new key doesn't already exist (don't overwrite newer data)
+                            if (!this.storage.getItem(actualKey)) {
+                                this.storage.setItem(actualKey, value);
+                                migratedCount++;
+                            }
+                            // Remove legacy key after successful migration
+                            this.storage.removeItem(legacyKey);
+                        }
+                    }
+                    catch (e) {
+                        console.warn(`[Datalyr Storage] Failed to migrate legacy key: ${legacyKey}`, e);
+                    }
+                });
+                if (migratedCount > 0) {
+                    console.log(`[Datalyr Storage] Migrated ${migratedCount} keys from legacy prefix`);
+                }
+            }
+            catch (e) {
+                console.warn('[Datalyr Storage] Error during legacy key migration:', e);
+            }
+            return migratedCount;
+        }
+        /**
+         * Get encrypted value from storage (SEC-03 Fix)
+         *
+         * @param key - Storage key
+         * @param defaultValue - Default value if not found
+         * @returns Decrypted value
+         */
+        getEncrypted(key_1) {
+            return __awaiter(this, arguments, void 0, function* (key, defaultValue = null) {
+                const fullKey = this.prefix + key;
+                try {
+                    // Get encrypted data
+                    let encryptedData = null;
+                    if (this.storage) {
+                        encryptedData = this.storage.getItem(fullKey);
+                    }
+                    else {
+                        encryptedData = this.memory.get(fullKey) || null;
+                    }
+                    if (!encryptedData) {
+                        return defaultValue;
+                    }
+                    // Decrypt
+                    const decrypted = yield dataEncryption.decrypt(encryptedData);
+                    return decrypted;
+                }
+                catch (error) {
+                    console.warn('[Datalyr Storage] Failed to decrypt:', key, error);
+                    return defaultValue;
+                }
+            });
+        }
+        /**
+         * Set encrypted value in storage (SEC-03 Fix)
+         *
+         * FIXED (SEC-03): Now throws error if encryption fails instead of silent fallback
+         *
+         * @param key - Storage key
+         * @param value - Value to encrypt and store
+         * @returns Success boolean
+         * @throws Error if encryption is not available or fails
+         */
+        setEncrypted(key, value) {
+            return __awaiter(this, void 0, void 0, function* () {
+                const fullKey = this.prefix + key;
+                // FIXED: encrypt() now throws instead of returning null
+                const encrypted = yield dataEncryption.encrypt(value);
+                // Store encrypted data
+                if (this.storage) {
+                    this.storage.setItem(fullKey, encrypted);
+                    return true;
+                }
+                else {
+                    this.memory.set(fullKey, encrypted);
+                    return true;
+                }
+            });
+        }
     }
     // Cookie operations
     class CookieStorage {
@@ -530,13 +838,9 @@ var Datalyr = (function () {
                 document.cookie = `${name}=${encodedValue}; domain=${rootDomain}; path=/; max-age=31536000; SameSite=Lax${secure}`;
                 // Verify cookie was set successfully (cookies.get already decodes)
                 const verifyValue = cookies.get(name);
-                if (verifyValue === value) {
-                    console.log(`[Datalyr] Set root domain cookie: ${name} on domain: ${rootDomain}`);
-                }
-                else {
+                if (verifyValue !== value) {
                     // Fallback: try without domain (current subdomain only)
                     document.cookie = `${name}=${encodedValue}; path=/; max-age=31536000; SameSite=Lax${secure}`;
-                    console.log(`[Datalyr] Set cookie without domain (fallback): ${name}`);
                 }
             }
             catch (e) {
@@ -675,13 +979,14 @@ var Datalyr = (function () {
      * Session Management Module
      */
     class SessionManager {
-        constructor(timeout = 30 * 60 * 1000) {
+        constructor(timeout = 60 * 60 * 1000) {
             this.sessionId = null;
             this.sessionData = null;
             this.lastActivity = Date.now();
             this.SESSION_KEY = 'dl_session_data';
             this.activityCheckInterval = null;
             this.activityListeners = [];
+            this.sessionCreationLock = false; // FIXED (DATA-02): Mutex to prevent race conditions
             this.sessionTimeout = timeout;
             this.initSession();
             this.setupActivityMonitor();
@@ -712,21 +1017,66 @@ var Datalyr = (function () {
         }
         /**
          * Create a new session
+         *
+         * FIXED (DATA-02): Added mutex lock to prevent race conditions
          */
         createNewSession() {
+            // FIXED (DATA-02): Check if session creation already in progress
+            if (this.sessionCreationLock) {
+                // Wait for ongoing session creation
+                console.log('[Datalyr Session] Session creation already in progress, returning existing ID');
+                return this.sessionId || '';
+            }
+            // Acquire lock
+            this.sessionCreationLock = true;
+            try {
+                const now = Date.now();
+                this.sessionId = `sess_${generateUUID()}`;
+                this.sessionData = {
+                    id: this.sessionId,
+                    startTime: now,
+                    lastActivity: now,
+                    pageViews: 0,
+                    events: 0,
+                    duration: 0,
+                    isActive: true
+                };
+                this.saveSession();
+                // Issue #25: Increment AFTER session created successfully
+                this.incrementSessionCount();
+                return this.sessionId;
+            }
+            finally {
+                // Always release lock
+                this.sessionCreationLock = false;
+            }
+        }
+        /**
+         * Rotate session ID (security measure)
+         *
+         * FIXED (DATA-05): Called when user identifies to prevent session fixation attacks
+         * Keeps session data but generates new session ID
+         */
+        rotateSessionId() {
             const now = Date.now();
+            const oldSessionId = this.sessionId;
+            // Generate new session ID
             this.sessionId = `sess_${generateUUID()}`;
-            this.sessionData = {
-                id: this.sessionId,
-                startTime: now,
-                lastActivity: now,
-                pageViews: 0,
-                events: 0,
-                duration: 0,
-                isActive: true
-            };
-            this.incrementSessionCount();
-            this.saveSession();
+            // Preserve session data but update ID
+            if (this.sessionData) {
+                this.sessionData.id = this.sessionId;
+                this.sessionData.lastActivity = now;
+                this.saveSession();
+                // Clean up old session data
+                if (oldSessionId) {
+                    storage.remove(`dl_session_${oldSessionId}_attribution`);
+                }
+                console.log(`[Datalyr Session] Rotated session ID from ${oldSessionId} to ${this.sessionId}`);
+            }
+            else {
+                // No existing session, create new one
+                this.createNewSession();
+            }
             return this.sessionId;
         }
         /**
@@ -746,18 +1096,22 @@ var Datalyr = (function () {
         }
         /**
          * Update session activity
+         * FIXED (CRITICAL-04): Check session validity BEFORE updating lastActivity
+         * This ensures sessions actually timeout after the configured period
          */
         updateActivity(eventType) {
             const now = Date.now();
-            // Check if we need a new session
+            // CRITICAL FIX: Check session validity BEFORE updating lastActivity
+            // If we update lastActivity first, sessions will never timeout!
             if (!this.sessionData || !this.isSessionValid(this.sessionData, now)) {
                 this.createNewSession();
                 return;
             }
+            // Session is valid - update activity timestamp
             this.lastActivity = now;
             this.sessionData.lastActivity = now;
             this.sessionData.duration = now - this.sessionData.startTime;
-            // Update counters
+            // Update counters (only if session is valid)
             if (eventType === 'pageview' || eventType === 'page_view') {
                 this.sessionData.pageViews++;
             }
@@ -775,6 +1129,7 @@ var Datalyr = (function () {
         }
         /**
          * End the current session
+         * Fixed Issue #23: Stop activity monitor when session ends
          */
         endSession() {
             if (this.sessionData) {
@@ -783,6 +1138,8 @@ var Datalyr = (function () {
             }
             this.sessionId = null;
             this.sessionData = null;
+            // Issue #23: Clean up activity monitor when session ends
+            this.destroy();
         }
         /**
          * Save session to storage
@@ -806,19 +1163,29 @@ var Datalyr = (function () {
         }
         /**
          * Store session attribution
+         * Fixed Issue #24: Use single key instead of one per session
          */
         storeAttribution(attribution) {
-            const key = `dl_session_${this.sessionId}_attribution`;
-            storage.set(key, Object.assign(Object.assign({}, attribution), { sessionId: this.sessionId, timestamp: Date.now() }));
+            storage.set('dl_current_session_attribution', Object.assign(Object.assign({}, attribution), { sessionId: this.sessionId, timestamp: Date.now() }));
         }
         /**
          * Get session attribution
+         * Fixed Issue #24: Use single key instead of one per session
+         * FIXED (CRITICAL-04): Verify session is still active before returning attribution
          */
         getAttribution() {
             if (!this.sessionId)
                 return null;
-            const key = `dl_session_${this.sessionId}_attribution`;
-            return storage.get(key);
+            // CRITICAL FIX: Verify session is still active
+            if (!this.isSessionActive()) {
+                return null;
+            }
+            const data = storage.get('dl_current_session_attribution');
+            // Only return if it matches current session
+            if (data && data.sessionId === this.sessionId) {
+                return data;
+            }
+            return null;
         }
         /**
          * Get session metrics
@@ -895,6 +1262,7 @@ var Datalyr = (function () {
      */
     class AttributionManager {
         constructor(options = {}) {
+            this.queryParamsCache = null;
             this.UTM_PARAMS = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content'];
             // Updated to match dl.js - includes ALL ad platform click IDs
             this.CLICK_IDS = [
@@ -923,15 +1291,27 @@ var Datalyr = (function () {
                 'medium', // Generic medium (non-UTM)
                 'gad_source' // Google Ads source parameter
             ];
-            this.attributionWindow = options.attributionWindow || 30 * 24 * 60 * 60 * 1000; // 30 days
+            this.attributionWindow = options.attributionWindow || 90 * 24 * 60 * 60 * 1000; // 90 days (increased from 30 for B2B sales cycles)
             // Merge default tracked params with user-provided ones
             this.trackedParams = [...this.DEFAULT_TRACKED_PARAMS, ...(options.trackedParams || [])];
         }
+        /**
+         * Clear query params cache (called on page navigation)
+         * FIXED: Prevents stale attribution data on SPA navigation
+         */
+        clearCache() {
+            this.queryParamsCache = null;
+        }
         /**
          * Capture current attribution from URL
          */
         captureAttribution() {
-            const params = getAllQueryParams();
+            // Cache query params to avoid multiple parses within same page load (Issue #3)
+            // NOTE: Cache is cleared on page navigation to prevent stale data
+            const params = this.queryParamsCache || getAllQueryParams();
+            if (!this.queryParamsCache) {
+                this.queryParamsCache = params;
+            }
             const attribution = {
                 timestamp: Date.now()
             };
@@ -978,31 +1358,57 @@ var Datalyr = (function () {
             return attribution;
         }
         /**
-         * Store first touch attribution
+         * Store first touch attribution with 90-day expiration
+         *
+         * FIXED (DATA-01): Removed paid priority logic that was corrupting first-touch attribution.
+         * First-touch is now IMMUTABLE except for expiration - this ensures accurate revenue attribution.
          */
         storeFirstTouch(attribution) {
             const existing = storage.get('dl_first_touch');
+            let shouldStore = false;
             if (!existing) {
-                storage.set('dl_first_touch', Object.assign(Object.assign({}, attribution), { timestamp: Date.now() }));
+                // No existing attribution - store first touch
+                shouldStore = true;
+            }
+            else if (existing.expires_at && Date.now() >= existing.expires_at) {
+                // Existing attribution expired - replace it
+                shouldStore = true;
+            }
+            // REMOVED PAID PRIORITY LOGIC - First-touch must be immutable for accurate attribution
+            // If there's existing valid attribution, keep it (true first-touch strategy)
+            if (shouldStore) {
+                storage.set('dl_first_touch', Object.assign(Object.assign({}, attribution), { captured_at: Date.now(), expires_at: Date.now() + this.attributionWindow }));
             }
         }
         /**
          * Get first touch attribution
+         * Checks expiry and removes if expired (Issue #4)
          */
         getFirstTouch() {
-            return storage.get('dl_first_touch');
+            const data = storage.get('dl_first_touch');
+            if (data && data.expires_at && Date.now() >= data.expires_at) {
+                storage.remove('dl_first_touch');
+                return null;
+            }
+            return data;
         }
         /**
-         * Store last touch attribution
+         * Store last touch attribution with 90-day expiration
          */
         storeLastTouch(attribution) {
-            storage.set('dl_last_touch', Object.assign(Object.assign({}, attribution), { timestamp: Date.now() }));
+            storage.set('dl_last_touch', Object.assign(Object.assign({}, attribution), { captured_at: Date.now(), expires_at: Date.now() + this.attributionWindow }));
         }
         /**
          * Get last touch attribution
+         * Checks expiry and removes if expired (Issue #4)
          */
         getLastTouch() {
-            return storage.get('dl_last_touch');
+            const data = storage.get('dl_last_touch');
+            if (data && data.expires_at && Date.now() >= data.expires_at) {
+                storage.remove('dl_last_touch');
+                return null;
+            }
+            return data;
         }
         /**
          * Add touchpoint to customer journey
@@ -1070,16 +1476,18 @@ var Datalyr = (function () {
         }
         /**
          * Check if we have a specific click ID in current params
+         * Uses cached params to avoid multiple URL parses (Issue #3)
          */
         hasClickId(clickIdType) {
-            const params = getAllQueryParams();
+            const params = this.queryParamsCache || getAllQueryParams();
             return !!params[clickIdType];
         }
         /**
          * Get current fbclid from URL if present
+         * Uses cached params to avoid multiple URL parses (Issue #3)
          */
         getCurrentFbclid() {
-            const params = getAllQueryParams();
+            const params = this.queryParamsCache || getAllQueryParams();
             return params.fbclid || null;
         }
         /**
@@ -1089,7 +1497,17 @@ var Datalyr = (function () {
             const firstTouch = this.getFirstTouch();
             const lastTouch = this.getLastTouch();
             const journey = this.getJourney();
-            const current = this.captureAttribution();
+            let current = this.captureAttribution();
+            // CRITICAL FIX: If current session has no attribution (direct/organic),
+            // fallback to persistent attribution from localStorage (90-day window)
+            const hasCurrentAttribution = !!(current.source || current.medium || current.clickId || current.campaign);
+            if (!hasCurrentAttribution && firstTouch) {
+                // Check if persistent attribution is still valid
+                if (!firstTouch.expires_at || Date.now() < firstTouch.expires_at) {
+                    // Use persistent attribution but keep current page context
+                    current = Object.assign(Object.assign({}, firstTouch), { referrer: current.referrer, referrerHost: current.referrerHost, landingPage: current.landingPage, landingPath: current.landingPath });
+                }
+            }
             // Capture advertising cookies automatically
             const adCookies = this.captureAdCookies();
             // Update first/last touch if needed
@@ -1241,6 +1659,8 @@ var Datalyr = (function () {
             this.recentEventIds = new Set();
             this.MAX_RECENT_EVENT_IDS = 1000;
             this.OFFLINE_QUEUE_KEY = 'dl_offline_queue';
+            this.flushLock = false; // FIXED (DATA-03): Mutex to prevent race conditions
+            this.offlineQueueLock = false; // FIXED (DATA-03): Separate lock for offline queue operations
             this.config = {
                 batchSize: config.batchSize || 10,
                 flushInterval: config.flushInterval || 5000,
@@ -1267,16 +1687,23 @@ var Datalyr = (function () {
          * Add event to queue
          */
         enqueue(event) {
-            const eventName = event.eventName;
+            const eventName = event.event_name; // Use snake_case
             // Check for duplicates (within 500ms window)
             if (this.isDuplicateEvent(event)) {
                 this.log('Duplicate event suppressed:', eventName);
                 return;
             }
-            // Critical events bypass queue
+            // CRITICAL FIX (CRITICAL-05): Critical events need proper error handling
+            // Instead of calling sendBatch() without await, we add them to queue
+            // with immediate flush AND move to offline queue on failure
             if (this.config.criticalEvents.includes(eventName)) {
                 this.log('Critical event, sending immediately:', eventName);
-                this.sendBatch([event]);
+                // Send immediately with proper error handling
+                this.sendBatch([event]).catch((error) => {
+                    this.log('Critical event send failed, adding to offline queue:', eventName, error);
+                    // Move to offline queue to ensure it's not lost
+                    this.moveToOfflineQueue([event]);
+                });
                 return;
             }
             // Add to queue
@@ -1289,13 +1716,15 @@ var Datalyr = (function () {
         }
         /**
          * Check if event is duplicate
+         * Fixed Issue #32: Use content-based hash instead of UUID
          */
         isDuplicateEvent(event) {
-            const eventId = event.eventId;
-            if (this.recentEventIds.has(eventId)) {
+            // Create content-based hash from eventName + timestamp + key properties
+            const contentHash = this.createEventHash(event);
+            if (this.recentEventIds.has(contentHash)) {
                 return true;
             }
-            this.recentEventIds.add(eventId);
+            this.recentEventIds.add(contentHash);
             // Clean up old event IDs
             if (this.recentEventIds.size > this.MAX_RECENT_EVENT_IDS) {
                 const toDelete = this.recentEventIds.size - this.MAX_RECENT_EVENT_IDS;
@@ -1309,6 +1738,24 @@ var Datalyr = (function () {
             }
             return false;
         }
+        /**
+         * Create content-based hash for duplicate detection (Issue #32)
+         */
+        createEventHash(event) {
+            const content = [
+                event.event_name, // Use snake_case
+                event.timestamp,
+                JSON.stringify(event.event_data || {}) // Use snake_case
+            ].join('|');
+            // Simple hash function
+            let hash = 0;
+            for (let i = 0; i < content.length; i++) {
+                const char = content.charCodeAt(i);
+                hash = ((hash << 5) - hash) + char;
+                hash = hash & hash; // Convert to 32bit integer
+            }
+            return hash.toString(36);
+        }
         /**
          * Check if we should flush the queue
          */
@@ -1334,20 +1781,29 @@ var Datalyr = (function () {
         }
         /**
          * Flush the queue
+         * FIXED (DATA-03): Enhanced protection against concurrent flushes
          */
         flush() {
             return __awaiter(this, void 0, void 0, function* () {
-                // Prevent concurrent flushes
-                if (this.flushPromise) {
-                    return this.flushPromise;
+                // FIXED (DATA-03): Check both promise and lock for concurrent flush protection
+                if (this.flushPromise || this.flushLock) {
+                    return this.flushPromise || Promise.resolve();
+                }
+                // Acquire lock
+                this.flushLock = true;
+                try {
+                    this.flushPromise = this._flush();
+                    yield this.flushPromise;
+                }
+                finally {
+                    this.flushPromise = null;
+                    this.flushLock = false;
                 }
-                this.flushPromise = this._flush();
-                yield this.flushPromise;
-                this.flushPromise = null;
             });
         }
         /**
          * Internal flush implementation
+         * FIXED (CRITICAL-06): Don't remove events from queue until send succeeds
          */
         _flush() {
             return __awaiter(this, void 0, void 0, function* () {
@@ -1366,16 +1822,21 @@ var Datalyr = (function () {
                     this.moveToOfflineQueue();
                     return;
                 }
-                // Get events to send
-                const events = this.queue.splice(0, this.config.batchSize);
+                // CRITICAL FIX: Use slice() to COPY events, don't remove yet
+                // Only remove after successful send to prevent data loss
+                const batchSize = Math.min(this.config.batchSize, this.queue.length);
+                const events = this.queue.slice(0, batchSize);
                 try {
                     yield this.sendBatch(events);
+                    // SUCCESS: Now it's safe to remove events from queue
+                    this.queue.splice(0, batchSize);
+                    this.log(`Successfully sent and removed ${batchSize} events from queue`);
                 }
                 catch (error) {
                     this.log('Failed to send batch:', error);
-                    // Move to offline queue for retry
-                    this.offlineQueue.push(...events);
-                    this.saveOfflineQueue();
+                    // Don't remove from queue - events stay for retry
+                    // Move to offline queue for persistent storage
+                    this.moveToOfflineQueue(events);
                 }
             });
         }
@@ -1407,10 +1868,14 @@ var Datalyr = (function () {
                         if (response.status === 429) {
                             const retryAfter = parseInt(response.headers.get('Retry-After') || '60');
                             this.log(`Rate limited, retrying after ${retryAfter}s`);
+                            // FIXED (CRITICAL-06): Don't unshift() - events are still in queue!
+                            // With the new fix, events aren't removed until success, so they're
+                            // already in the queue. Just schedule a retry flush.
                             setTimeout(() => {
-                                this.queue.unshift(...events);
+                                this.flush();
                             }, retryAfter * 1000);
-                            return;
+                            // Throw to trigger catch block which moves events to offline queue
+                            throw new Error(`Rate limited (429), retry after ${retryAfter}s`);
                         }
                         throw new Error(`HTTP ${response.status}: ${response.statusText}`);
                     }
@@ -1471,11 +1936,39 @@ var Datalyr = (function () {
         }
         /**
          * Move events to offline queue
-         */
-        moveToOfflineQueue() {
-            this.offlineQueue.push(...this.queue);
-            this.queue = [];
-            this.saveOfflineQueue();
+         * Fixed Issue #33: Enforce size limit when adding, not just when saving
+         * FIXED (DATA-03): Added mutex lock to prevent race conditions
+         * FIXED (CRITICAL-06): Can now accept specific events or move entire queue
+         */
+        moveToOfflineQueue(events) {
+            // FIXED (DATA-03): Check if offline queue operation already in progress
+            if (this.offlineQueueLock) {
+                console.warn('[Datalyr Queue] Offline queue operation already in progress');
+                return;
+            }
+            // Acquire lock
+            this.offlineQueueLock = true;
+            try {
+                if (events) {
+                    // Move specific events to offline queue
+                    this.offlineQueue.push(...events);
+                }
+                else {
+                    // Move entire queue to offline queue
+                    this.offlineQueue.push(...this.queue);
+                    this.queue = [];
+                }
+                // Issue #33: Enforce limit here, not just in saveOfflineQueue
+                if (this.offlineQueue.length > this.config.maxOfflineQueueSize) {
+                    const excess = this.offlineQueue.length - this.config.maxOfflineQueueSize;
+                    this.offlineQueue.splice(0, excess); // Remove oldest events
+                }
+                this.saveOfflineQueue();
+            }
+            finally {
+                // Always release lock
+                this.offlineQueueLock = false;
+            }
         }
         /**
          * Load offline queue from storage
@@ -1607,8 +2100,6 @@ var Datalyr = (function () {
      */
     class FingerprintCollector {
         constructor(options = {}) {
-            this.heavyFingerprintDone = false;
-            this.fingerprintCache = {};
             this.privacyMode = options.privacyMode || 'standard';
             this.enableFingerprinting = options.enableFingerprinting !== false;
         }
@@ -1626,24 +2117,40 @@ var Datalyr = (function () {
         }
         /**
          * Collect minimal fingerprint data (privacy-friendly)
+         * Matches browser tag minimal fingerprinting approach
          */
         collectMinimal() {
-            return {
+            const fp = {
                 timezone: this.getTimezone(),
                 language: navigator.language || null,
-                platform: navigator.platform || null,
-                canvasEnabled: false,
-                localStorageAvailable: this.testStorage('localStorage'),
-                sessionStorageAvailable: this.testStorage('sessionStorage')
+                screen_bucket: this.getScreenBucket(),
+                dnt: (navigator.doNotTrack === '1' || window.globalPrivacyControl === true) || null,
+                userAgent: navigator.userAgent || null
             };
+            // User-Agent Client Hints (modern browsers)
+            if ('userAgentData' in navigator) {
+                const uaData = navigator.userAgentData;
+                fp.userAgentData = {
+                    brands: uaData.brands || [],
+                    mobile: uaData.mobile || false,
+                    platform: uaData.platform || null
+                };
+            }
+            return fp;
         }
         /**
          * Collect standard fingerprint data
+         * PRIVACY: Minimal data collection matching browser tag approach
+         * Only collects data necessary for basic analytics and attribution
          */
         collectStandard() {
             const fingerprint = {};
             try {
-                // Basic browser data
+                // PRIVACY: Only collect minimal data needed for attribution
+                fingerprint.timezone = this.getTimezone();
+                fingerprint.language = navigator.language || null;
+                fingerprint.screen_bucket = this.getScreenBucket();
+                fingerprint.dnt = (navigator.doNotTrack === '1' || window.globalPrivacyControl === true) || null;
                 fingerprint.userAgent = navigator.userAgent || null;
                 // User-Agent Client Hints (modern browsers)
                 if ('userAgentData' in navigator) {
@@ -1654,125 +2161,14 @@ var Datalyr = (function () {
                         platform: uaData.platform || null
                     };
                 }
-                // Language settings
-                fingerprint.language = navigator.language || null;
-                fingerprint.languages = navigator.languages ?
-                    navigator.languages.slice(0, 2) : null; // Limit to 2 for privacy
-                // Platform and browser features
-                fingerprint.platform = navigator.platform || null;
-                fingerprint.cookieEnabled = navigator.cookieEnabled || null;
-                fingerprint.doNotTrack = navigator.doNotTrack || null;
-                // Hardware (coarsened for privacy)
-                fingerprint.hardwareConcurrency = this.coarsenHardwareConcurrency();
-                fingerprint.deviceMemory = this.coarsenDeviceMemory();
-                fingerprint.maxTouchPoints = navigator.maxTouchPoints > 0 ? 'touch' : 'no-touch';
-                // Screen (coarsened)
-                fingerprint.screenResolution = this.getScreenResolution();
-                fingerprint.colorDepth = screen.colorDepth || null;
-                fingerprint.pixelRatio = this.coarsenPixelRatio();
-                // Timezone
-                fingerprint.timezone = this.getTimezone();
-                fingerprint.timezoneOffset = this.coarsenTimezoneOffset();
-                // Canvas fingerprinting disabled for privacy
-                fingerprint.canvasEnabled = false;
-                // Plugins count only (not details for privacy)
-                fingerprint.pluginsCount = navigator.plugins ? navigator.plugins.length : null;
-                // Storage availability
-                fingerprint.localStorageAvailable = this.testStorage('localStorage');
-                fingerprint.sessionStorageAvailable = this.testStorage('sessionStorage');
-                fingerprint.indexedDBAvailable = this.testIndexedDB();
-                // Add cached heavy fingerprint data if available
-                if (this.heavyFingerprintDone) {
-                    Object.assign(fingerprint, this.fingerprintCache);
-                }
             }
             catch (e) {
                 console.warn('[Datalyr] Error collecting fingerprint:', e);
             }
             return fingerprint;
         }
-        /**
-         * Collect heavy fingerprint data (WebGL, Audio)
-         * Called lazily on first event to improve page load performance
-         */
-        collectHeavyFingerprint() {
-            return __awaiter(this, void 0, void 0, function* () {
-                if (this.heavyFingerprintDone || this.privacyMode === 'strict') {
-                    return;
-                }
-                try {
-                    // WebGL fingerprinting
-                    const webglData = this.getWebGLFingerprint();
-                    if (webglData) {
-                        this.fingerprintCache.webglVendor = webglData.vendor;
-                        this.fingerprintCache.webglRenderer = webglData.renderer;
-                    }
-                    // Audio fingerprinting
-                    const audioData = yield this.getAudioFingerprint();
-                    if (audioData) {
-                        this.fingerprintCache.audioSampleRate = audioData.sampleRate;
-                        this.fingerprintCache.audioState = audioData.state;
-                        this.fingerprintCache.audioMaxChannels = audioData.maxChannels;
-                    }
-                    this.heavyFingerprintDone = true;
-                }
-                catch (e) {
-                    console.warn('[Datalyr] Heavy fingerprinting failed:', e);
-                }
-            });
-        }
-        /**
-         * Get WebGL fingerprint
-         */
-        getWebGLFingerprint() {
-            try {
-                const canvas = document.createElement('canvas');
-                const gl = canvas.getContext('webgl') || canvas.getContext('experimental-webgl');
-                if (!gl)
-                    return null;
-                const debugInfo = gl.getExtension('WEBGL_debug_renderer_info');
-                if (!debugInfo) {
-                    return {
-                        vendor: gl.getParameter(gl.VENDOR) || 'unknown',
-                        renderer: gl.getParameter(gl.RENDERER) || 'unknown'
-                    };
-                }
-                return {
-                    vendor: gl.getParameter(debugInfo.UNMASKED_VENDOR_WEBGL) || 'unknown',
-                    renderer: gl.getParameter(debugInfo.UNMASKED_RENDERER_WEBGL) || 'unknown'
-                };
-            }
-            catch (_a) {
-                return null;
-            }
-        }
-        /**
-         * Get audio fingerprint
-         */
-        getAudioFingerprint() {
-            return __awaiter(this, void 0, void 0, function* () {
-                var _a;
-                try {
-                    const AudioContext = window.AudioContext || window.webkitAudioContext;
-                    if (!AudioContext)
-                        return null;
-                    const audioCtx = new AudioContext();
-                    const result = {
-                        sampleRate: audioCtx.sampleRate || null,
-                        state: audioCtx.state || null,
-                        maxChannels: ((_a = audioCtx.destination) === null || _a === void 0 ? void 0 : _a.maxChannelCount) || null
-                    };
-                    // Close context to free resources
-                    if (audioCtx.close) {
-                        yield audioCtx.close();
-                    }
-                    return result;
-                }
-                catch (_b) {
-                    return null;
-                }
-            });
-        }
+        // PRIVACY: Heavy fingerprinting (WebGL, Audio) removed
+        // Minimal fingerprinting only for privacy compliance
         /**
          * Get timezone
          */
@@ -1785,10 +2181,13 @@ var Datalyr = (function () {
             }
         }
         /**
-         * Get screen resolution (coarsened)
+         * Get coarse screen bucket for basic device classification
+         * Rounds to nearest 100px for privacy
          */
-        getScreenResolution() {
+        getScreenBucket() {
             try {
+                if (!window.screen)
+                    return null;
                 const width = Math.round(screen.width / 100) * 100;
                 const height = Math.round(screen.height / 100) * 100;
                 return `${width}x${height}`;
@@ -1797,131 +2196,43 @@ var Datalyr = (function () {
                 return null;
             }
         }
+        // PRIVACY: Unused helper methods removed (coarsen functions, storage tests)
+        // Minimal fingerprinting only
         /**
-         * Coarsen hardware concurrency for privacy
+         * Generate fingerprint hash
          */
-        coarsenHardwareConcurrency() {
-            try {
-                const cores = navigator.hardwareConcurrency;
-                if (!cores)
-                    return null;
-                return cores > 8 ? '8+' : cores;
-            }
-            catch (_a) {
-                return null;
-            }
-        }
-        /**
-         * Coarsen device memory for privacy
-         */
-        coarsenDeviceMemory() {
-            try {
-                const memory = navigator.deviceMemory;
-                if (!memory)
-                    return null;
-                return memory > 4 ? '4+' : memory;
-            }
-            catch (_a) {
-                return null;
-            }
-        }
-        /**
-         * Coarsen pixel ratio for privacy
-         */
-        coarsenPixelRatio() {
-            try {
-                const ratio = window.devicePixelRatio;
-                if (!ratio)
-                    return null;
-                // Round to common values
-                if (ratio <= 1)
-                    return '1';
-                if (ratio <= 1.5)
-                    return '1.5';
-                if (ratio <= 2)
-                    return '2';
-                if (ratio <= 3)
-                    return '3';
-                return '3+';
-            }
-            catch (_a) {
-                return null;
-            }
-        }
-        /**
-         * Coarsen timezone offset for privacy
-         */
-        coarsenTimezoneOffset() {
-            try {
-                const offset = new Date().getTimezoneOffset();
-                // Round to nearest 30 minutes
-                return Math.round(offset / 30) * 30;
-            }
-            catch (_a) {
-                return null;
-            }
-        }
-        /**
-         * Test if storage is available
-         */
-        testStorage(type) {
-            try {
-                const storage = window[type];
-                const testKey = '__dl_test__';
-                storage.setItem(testKey, '1');
-                storage.removeItem(testKey);
-                return true;
-            }
-            catch (_a) {
-                return false;
-            }
-        }
-        /**
-         * Test if IndexedDB is available
-         */
-        testIndexedDB() {
-            try {
-                return !!window.indexedDB;
-            }
-            catch (_a) {
-                return false;
-            }
-        }
-        /**
-         * Generate fingerprint hash
-         */
-        generateHash(data) {
-            return __awaiter(this, void 0, void 0, function* () {
-                try {
-                    // Sort keys for consistent hashing
-                    const sortedData = Object.keys(data)
-                        .sort()
-                        .reduce((obj, key) => {
-                        obj[key] = data[key];
-                        return obj;
-                    }, {});
-                    const str = JSON.stringify(sortedData);
-                    // Use Web Crypto API if available
-                    if (window.crypto && window.crypto.subtle) {
-                        const encoder = new TextEncoder();
-                        const data = encoder.encode(str);
-                        const hashBuffer = yield crypto.subtle.digest('SHA-256', data);
-                        const hashArray = Array.from(new Uint8Array(hashBuffer));
-                        return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
-                    }
-                    // Fallback to simple hash
-                    let hash = 0;
-                    for (let i = 0; i < str.length; i++) {
-                        const char = str.charCodeAt(i);
-                        hash = ((hash << 5) - hash) + char;
-                        hash = hash & hash; // Convert to 32bit integer
-                    }
-                    return Math.abs(hash).toString(16);
-                }
-                catch (_a) {
-                    return '';
-                }
-            });
+        generateHash(data) {
+            return __awaiter(this, void 0, void 0, function* () {
+                try {
+                    // Sort keys for consistent hashing
+                    const sortedData = Object.keys(data)
+                        .sort()
+                        .reduce((obj, key) => {
+                        obj[key] = data[key];
+                        return obj;
+                    }, {});
+                    const str = JSON.stringify(sortedData);
+                    // Use Web Crypto API if available
+                    if (window.crypto && window.crypto.subtle) {
+                        const encoder = new TextEncoder();
+                        const data = encoder.encode(str);
+                        const hashBuffer = yield crypto.subtle.digest('SHA-256', data);
+                        const hashArray = Array.from(new Uint8Array(hashBuffer));
+                        return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
+                    }
+                    // Fallback to simple hash
+                    let hash = 0;
+                    for (let i = 0; i < str.length; i++) {
+                        const char = str.charCodeAt(i);
+                        hash = ((hash << 5) - hash) + char;
+                        hash = hash & hash; // Convert to 32bit integer
+                    }
+                    return Math.abs(hash).toString(16);
+                }
+                catch (_a) {
+                    return '';
+                }
+            });
         }
     }
 
@@ -1936,6 +2247,9 @@ var Datalyr = (function () {
             this.sessionLoadedScripts = new Set();
             this.pixels = null;
             this.initialized = false;
+            this.sandboxedIframes = []; // FIXED (ISSUE-02): Track iframes for cleanup
+            this.iframeCleanupTimeouts = new Map(); // FIXED (ISSUE-02): Track cleanup timeouts
+            this.messageHandler = null; // FIXED (ISSUE-02): Track message listener
             this.workspaceId = options.workspaceId;
             // Container scripts use the same endpoint as tracking (ingest)
             this.endpoint = options.endpoint || 'https://ingest.datalyr.com';
@@ -1943,6 +2257,19 @@ var Datalyr = (function () {
             // Load session scripts from storage
             const sessionScripts = storage.get('dl_session_scripts', []);
             this.sessionLoadedScripts = new Set(sessionScripts);
+            // FIXED (ISSUE-02): Set up postMessage listener for iframe cleanup
+            this.messageHandler = (event) => {
+                if (event.data && event.data.type === 'datalyr_script_complete') {
+                    const scriptId = event.data.scriptId;
+                    this.log('Received script completion signal:', scriptId);
+                    // Find and clean up the corresponding iframe
+                    const iframe = this.sandboxedIframes.find(iframe => iframe.dataset.datalyrScript === scriptId);
+                    if (iframe) {
+                        this.cleanupIframe(iframe);
+                    }
+                }
+            };
+            window.addEventListener('message', this.messageHandler);
         }
         /**
          * Initialize container and load scripts
@@ -2110,45 +2437,142 @@ var Datalyr = (function () {
             }
         }
         /**
-         * Load inline JavaScript
+         * Load inline JavaScript in sandboxed iframe
+         * SECURITY: User-provided scripts run in isolated context to prevent XSS
+         * FIXED (ISSUE-02): Added cleanup mechanism to prevent memory leaks
          */
         loadInlineScript(script) {
-            // Basic XSS protection - ensure content doesn't contain obvious malicious patterns
-            if (this.containsMaliciousPatterns(script.content)) {
-                this.log('Blocked potentially malicious inline script:', script.id);
-                return;
+            // SECURITY FIX: Run in sandboxed iframe instead of main page context
+            // This prevents access to parent window, cookies, and localStorage
+            const iframe = document.createElement('iframe');
+            iframe.style.display = 'none';
+            iframe.setAttribute('sandbox', 'allow-scripts'); // Minimal permissions
+            iframe.dataset.datalyrScript = script.id;
+            // FIXED (ISSUE-02): Track iframe for cleanup
+            this.sandboxedIframes.push(iframe);
+            // Create isolated script context with completion signal
+            const iframeDoc = `
+      <!DOCTYPE html>
+      <html>
+        <head>
+          <meta charset="UTF-8">
+        </head>
+        <body>
+          <script>
+            // User-provided script runs here in isolation
+            try {
+              ${script.content}
+            } catch (error) {
+              console.error('[Datalyr Container] Script execution error:', error);
+            }
+
+            // FIXED (ISSUE-02): Signal completion for cleanup
+            // Scripts have 5 seconds to execute before iframe is removed
+            setTimeout(function() {
+              try {
+                parent.postMessage({ type: 'datalyr_script_complete', scriptId: '${script.id}' }, '*');
+              } catch (e) {
+                // Ignore postMessage errors from sandbox
+              }
+            }, 5000);
+          </script>
+        </body>
+      </html>
+    `;
+            document.body.appendChild(iframe);
+            // Write content to iframe (safe because sandbox prevents parent access)
+            if (iframe.contentDocument) {
+                iframe.contentDocument.open();
+                iframe.contentDocument.write(iframeDoc);
+                iframe.contentDocument.close();
+            }
+            // FIXED (ISSUE-02): Remove iframe after execution (30 seconds max as fallback)
+            // If script completes in 5s, postMessage will trigger early cleanup
+            const timeoutId = window.setTimeout(() => {
+                this.cleanupIframe(iframe);
+            }, 30000);
+            // Store timeout ID for cleanup
+            this.iframeCleanupTimeouts.set(iframe, timeoutId);
+            this.log('Loaded inline script in sandbox:', script.id);
+        }
+        /**
+         * Clean up a sandboxed iframe
+         * FIXED (ISSUE-02): Prevents memory leaks from iframe accumulation
+         */
+        cleanupIframe(iframe) {
+            try {
+                // FIXED (ISSUE-02): Clear pending timeout to prevent duplicate cleanup
+                const timeoutId = this.iframeCleanupTimeouts.get(iframe);
+                if (timeoutId) {
+                    clearTimeout(timeoutId);
+                    this.iframeCleanupTimeouts.delete(iframe);
+                }
+                // Remove from tracking array
+                const index = this.sandboxedIframes.indexOf(iframe);
+                if (index > -1) {
+                    this.sandboxedIframes.splice(index, 1);
+                }
+                // Remove from DOM
+                if (iframe.parentNode) {
+                    iframe.parentNode.removeChild(iframe);
+                    this.log('Cleaned up sandboxed iframe:', iframe.dataset.datalyrScript);
+                }
+            }
+            catch (error) {
+                this.log('Error cleaning up iframe:', error);
             }
-            const scriptElement = document.createElement('script');
-            scriptElement.textContent = script.content;
-            scriptElement.dataset.datalyrScript = script.id;
-            scriptElement.setAttribute('data-nonce', this.generateNonce());
-            document.head.appendChild(scriptElement);
         }
         /**
-         * Load external JavaScript
+         * Clean up all sandboxed iframes
+         * FIXED (ISSUE-02): Called on SDK destroy to prevent memory leaks
+         */
+        cleanupAllIframes() {
+            // Clean up all iframes
+            const iframes = [...this.sandboxedIframes]; // Copy array since we're modifying it
+            iframes.forEach(iframe => this.cleanupIframe(iframe));
+            // FIXED (ISSUE-02): Remove message listener to prevent memory leak
+            if (this.messageHandler) {
+                window.removeEventListener('message', this.messageHandler);
+                this.messageHandler = null;
+            }
+            // Clear any remaining timeouts
+            this.iframeCleanupTimeouts.forEach(timeoutId => clearTimeout(timeoutId));
+            this.iframeCleanupTimeouts.clear();
+            this.log(`Cleaned up ${iframes.length} sandboxed iframes`);
+        }
+        /**
+         * Load external JavaScript with SRI validation
+         * SECURITY (Phase 1.2): SRI is now REQUIRED for external scripts
          */
         loadExternalScript(script) {
+            var _a;
             // Validate URL before loading
             if (!this.isValidScriptUrl(script.content)) {
                 this.log('Blocked invalid script URL:', script.content);
                 return;
             }
+            // SECURITY FIX: Require SRI (Subresource Integrity) for external scripts
+            if (!((_a = script.settings) === null || _a === void 0 ? void 0 : _a.integrity)) {
+                console.error(`[Datalyr Container] SECURITY: External script "${script.id}" blocked - missing SRI hash.\n` +
+                    `All external scripts MUST include an integrity hash to prevent CDN compromise attacks.\n` +
+                    `Generate SRI hash at: https://www.srihash.org/\n` +
+                    `Example: { integrity: "sha384-..." }`);
+                return;
+            }
             const scriptElement = document.createElement('script');
             scriptElement.src = script.content;
             scriptElement.dataset.datalyrScript = script.id;
             // Apply settings
             if (script.settings) {
+                scriptElement.integrity = script.settings.integrity; // REQUIRED
+                scriptElement.crossOrigin = script.settings.crossorigin || 'anonymous'; // Required for SRI
                 if (script.settings.async !== false)
                     scriptElement.async = true;
                 if (script.settings.defer)
                     scriptElement.defer = true;
-                if (script.settings.integrity)
-                    scriptElement.integrity = script.settings.integrity;
-                if (script.settings.crossorigin)
-                    scriptElement.crossOrigin = script.settings.crossorigin;
             }
             else {
-                // Default to async for better performance
+                // This should never happen now that integrity is required
                 scriptElement.async = true;
             }
             document.head.appendChild(scriptElement);
@@ -2293,10 +2717,13 @@ var Datalyr = (function () {
          */
         trackToPixels(eventName, properties = {}) {
             var _a, _b, _c, _e, _f, _g;
+            // Sanitize inputs to prevent XSS
+            const sanitizedEventName = this.sanitizeEventName(eventName);
+            const sanitizedProperties = this.sanitizeProperties(properties);
             // Track to Meta Pixel
             if (((_b = (_a = this.pixels) === null || _a === void 0 ? void 0 : _a.meta) === null || _b === void 0 ? void 0 : _b.enabled) && window.fbq) {
                 try {
-                    window.fbq('track', eventName, properties);
+                    window.fbq('track', sanitizedEventName, sanitizedProperties);
                 }
                 catch (error) {
                     this.log('Error tracking Meta Pixel event:', error);
@@ -2305,7 +2732,7 @@ var Datalyr = (function () {
             // Track to Google Tag
             if (((_e = (_c = this.pixels) === null || _c === void 0 ? void 0 : _c.google) === null || _e === void 0 ? void 0 : _e.enabled) && window.gtag) {
                 try {
-                    window.gtag('event', eventName, properties);
+                    window.gtag('event', sanitizedEventName, sanitizedProperties);
                 }
                 catch (error) {
                     this.log('Error tracking Google Tag event:', error);
@@ -2323,8 +2750,8 @@ var Datalyr = (function () {
                         'Search': 'Search',
                         'Lead': 'SubmitForm'
                     };
-                    const tiktokEvent = tiktokEventMap[eventName] || eventName;
-                    window.ttq.track(tiktokEvent, properties);
+                    const tiktokEvent = tiktokEventMap[sanitizedEventName] || sanitizedEventName;
+                    window.ttq.track(tiktokEvent, sanitizedProperties);
                 }
                 catch (error) {
                     this.log('Error tracking TikTok Pixel event:', error);
@@ -2347,49 +2774,25 @@ var Datalyr = (function () {
             return Array.from(this.loadedScripts);
         }
         /**
-         * Extract app endpoint from ingest endpoint
+         * SECURITY MODEL (Phase 1.1 Fix):
+         *
+         * Inline scripts run in sandboxed iframes with 'allow-scripts' only.
+         * This prevents:
+         * - Access to parent window/document
+         * - Access to cookies and localStorage
+         * - Cross-origin requests
+         * - Popup creation
+         * - Form submission
+         *
+         * External scripts MUST have SRI (Subresource Integrity) hashes.
+         * This prevents:
+         * - CDN compromise attacks
+         * - Man-in-the-middle script injection
+         * - Unauthorized script modifications
+         *
+         * Previous regex-based validation was removed because it's trivially bypassable.
+         * Sandboxing provides defense-in-depth regardless of script content.
          */
-        extractAppEndpoint(endpoint) {
-            if (!endpoint) {
-                return 'https://app.datalyr.com';
-            }
-            // If it's already an app endpoint, use it
-            if (endpoint.includes('app.datalyr.com')) {
-                return endpoint;
-            }
-            // Convert ingest endpoint to app endpoint
-            if (endpoint.includes('ingest.datalyr.com')) {
-                return 'https://app.datalyr.com';
-            }
-            // For local development
-            if (endpoint.includes('localhost') || endpoint.includes('127.0.0.1')) {
-                // Assume app is on port 3000 if ingest is on 3001
-                return endpoint.replace(':3001', ':3000').replace('/ingest', '');
-            }
-            // For custom endpoints, try to extract the base domain
-            try {
-                const url = new URL(endpoint);
-                return `${url.protocol}//${url.hostname}${url.port ? ':' + url.port : ''}`;
-            }
-            catch (_a) {
-                return 'https://app.datalyr.com';
-            }
-        }
-        /**
-         * Check for malicious patterns in inline scripts
-         */
-        containsMaliciousPatterns(content) {
-            // Basic patterns that might indicate malicious content
-            const dangerousPatterns = [
-                /<script[^>]*>/gi, // Script tags within content
-                /document\.cookie/gi, // Direct cookie access
-                /eval\s*\(/gi, // eval usage
-                /Function\s*\(/gi, // Function constructor
-                /innerHTML\s*=/gi, // Direct innerHTML assignment
-                /document\.write/gi, // document.write usage
-            ];
-            return dangerousPatterns.some(pattern => pattern.test(content));
-        }
         /**
          * Validate script URL
          */
@@ -2411,12 +2814,61 @@ var Datalyr = (function () {
             }
         }
         /**
-         * Generate a nonce for CSP
+         * Sanitize event name - whitelist alphanumeric, underscore, dollar sign
          */
-        generateNonce() {
-            const array = new Uint8Array(16);
-            crypto.getRandomValues(array);
-            return btoa(String.fromCharCode(...array));
+        sanitizeEventName(eventName) {
+            if (typeof eventName !== 'string') {
+                return 'unknown_event';
+            }
+            // Allow alphanumeric, underscore, dollar sign, and spaces
+            return eventName.replace(/[^a-zA-Z0-9_$ ]/g, '').substring(0, 100);
+        }
+        /**
+         * Recursively sanitize properties object
+         */
+        sanitizeProperties(properties) {
+            if (properties === null || properties === undefined) {
+                return {};
+            }
+            if (typeof properties !== 'object') {
+                return this.sanitizeValue(properties);
+            }
+            if (Array.isArray(properties)) {
+                return properties.map(item => this.sanitizeValue(item));
+            }
+            const sanitized = {};
+            for (const [key, value] of Object.entries(properties)) {
+                // Sanitize key
+                const sanitizedKey = key.replace(/[^a-zA-Z0-9_]/g, '').substring(0, 100);
+                if (sanitizedKey) {
+                    sanitized[sanitizedKey] = this.sanitizeValue(value);
+                }
+            }
+            return sanitized;
+        }
+        /**
+         * Sanitize individual value
+         */
+        sanitizeValue(value) {
+            if (value === null || value === undefined) {
+                return value;
+            }
+            if (typeof value === 'string') {
+                // Remove potential XSS patterns
+                return value
+                    .replace(/<script[^>]*>.*?<\/script>/gi, '')
+                    .replace(/<[^>]+>/g, '')
+                    .replace(/javascript:/gi, '')
+                    .replace(/on\w+\s*=/gi, '')
+                    .substring(0, 1000);
+            }
+            if (typeof value === 'number' || typeof value === 'boolean') {
+                return value;
+            }
+            if (typeof value === 'object') {
+                return this.sanitizeProperties(value);
+            }
+            return String(value).substring(0, 1000);
         }
         /**
          * Debug logging
@@ -2428,6 +2880,437 @@ var Datalyr = (function () {
         }
     }
 
+    /**
+     * Auto-Identify Module
+     *
+     * Automatically captures user identity (email) from:
+     * 1. Fetch/XHR API requests (email in request/response)
+     * 2. Form submissions (email inputs)
+     * 3. Shopify-specific endpoints (/account.json)
+     *
+     * SECURITY:
+     * - Email validation to prevent false positives
+     * - Whitelist approach for trusted domains
+     * - Rate limiting to prevent spam
+     * - Privacy controls integration
+     */
+    class AutoIdentifyManager {
+        constructor(config = {}) {
+            this.formListeners = [];
+            this.lastIdentifyTime = 0;
+            this.RATE_LIMIT_MS = 5000; // Don't auto-identify more than once per 5 seconds
+            this.config = {
+                enabled: config.enabled !== false,
+                captureFromForms: config.captureFromForms !== false,
+                captureFromAPI: config.captureFromAPI !== false,
+                captureFromShopify: config.captureFromShopify !== false,
+                trustedDomains: config.trustedDomains || [],
+                debug: config.debug || false
+            };
+        }
+        /**
+         * Initialize auto-identify system
+         */
+        initialize(identifyCallback) {
+            if (!this.config.enabled) {
+                this.log('Auto-identify disabled');
+                return;
+            }
+            this.identifyCallback = identifyCallback;
+            // Check if already identified
+            const existingEmail = storage.get('dl_auto_identified_email');
+            if (existingEmail) {
+                this.log('User already auto-identified:', existingEmail);
+                return;
+            }
+            // Setup monitoring
+            if (this.config.captureFromForms) {
+                this.setupFormMonitoring();
+            }
+            if (this.config.captureFromAPI) {
+                this.setupFetchInterception();
+                this.setupXHRInterception();
+            }
+            if (this.config.captureFromShopify) {
+                this.setupShopifyMonitoring();
+            }
+            this.log('Auto-identify initialized');
+        }
+        /**
+         * Setup form monitoring for email capture
+         */
+        setupFormMonitoring() {
+            // Monitor existing forms
+            this.scanForEmailForms();
+            // Watch for new forms (SPAs)
+            const observer = new MutationObserver(() => {
+                this.scanForEmailForms();
+            });
+            observer.observe(document.body, {
+                childList: true,
+                subtree: true
+            });
+            this.log('Form monitoring active');
+        }
+        /**
+         * Scan DOM for forms with email inputs
+         */
+        scanForEmailForms() {
+            const forms = document.querySelectorAll('form');
+            forms.forEach(form => {
+                // Skip if already listening
+                if (this.formListeners.some(l => l.element === form)) {
+                    return;
+                }
+                // Check if form has email input
+                const emailInput = form.querySelector('input[type="email"], input[name*="email" i], input[id*="email" i]');
+                if (emailInput) {
+                    const handler = (e) => this.handleFormSubmit(e, form);
+                    form.addEventListener('submit', handler);
+                    this.formListeners.push({ element: form, handler });
+                    this.log('Monitoring form:', form);
+                }
+            });
+        }
+        /**
+         * Handle form submission
+         */
+        handleFormSubmit(_event, form) {
+            try {
+                // Find email input
+                const emailInput = form.querySelector('input[type="email"], input[name*="email" i], input[id*="email" i]');
+                if (!emailInput)
+                    return;
+                const email = emailInput.value.trim();
+                if (this.isValidEmail(email)) {
+                    this.log('Email captured from form:', email);
+                    this.triggerIdentify(email, 'form');
+                }
+            }
+            catch (error) {
+                this.log('Error handling form submit:', error);
+            }
+        }
+        /**
+         * Setup fetch interception for API email capture
+         */
+        setupFetchInterception() {
+            if (typeof window.fetch !== 'function')
+                return;
+            this.originalFetch = window.fetch;
+            const self = this;
+            window.fetch = function (input, init) {
+                return __awaiter(this, void 0, void 0, function* () {
+                    const url = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;
+                    // Check if trusted domain
+                    if (!self.isTrustedDomain(url)) {
+                        return self.originalFetch.call(window, input, init);
+                    }
+                    try {
+                        // Check request body for email
+                        if (init === null || init === void 0 ? void 0 : init.body) {
+                            self.extractEmailFromData(init.body, 'api-request');
+                        }
+                        // Make actual request
+                        const response = self.originalFetch.call(window, input, init);
+                        // Check response for email
+                        response.then((res) => __awaiter(this, void 0, void 0, function* () {
+                            var _a;
+                            if (res.ok && ((_a = res.headers.get('content-type')) === null || _a === void 0 ? void 0 : _a.includes('application/json'))) {
+                                try {
+                                    const clone = res.clone();
+                                    const data = yield clone.json();
+                                    self.extractEmailFromData(data, 'api-response');
+                                }
+                                catch (error) {
+                                    // Ignore JSON parse errors
+                                }
+                            }
+                        })).catch(() => {
+                            // Ignore response errors
+                        });
+                        return response;
+                    }
+                    catch (error) {
+                        self.log('Error intercepting fetch:', error);
+                        return self.originalFetch.call(window, input, init);
+                    }
+                });
+            };
+            this.log('Fetch interception active');
+        }
+        /**
+         * Setup XHR interception for API email capture
+         */
+        setupXHRInterception() {
+            if (typeof XMLHttpRequest === 'undefined')
+                return;
+            const self = this;
+            this.originalXHROpen = XMLHttpRequest.prototype.open;
+            this.originalXHRSend = XMLHttpRequest.prototype.send;
+            XMLHttpRequest.prototype.open = function (method, url, ...args) {
+                this._datalyrUrl = typeof url === 'string' ? url : url.href;
+                return self.originalXHROpen.apply(this, [method, url, ...args]);
+            };
+            XMLHttpRequest.prototype.send = function (body) {
+                const url = this._datalyrUrl;
+                if (url && self.isTrustedDomain(url)) {
+                    // Check request body
+                    if (body) {
+                        self.extractEmailFromData(body, 'api-request');
+                    }
+                    // Monitor response
+                    this.addEventListener('load', function () {
+                        if (this.status >= 200 && this.status < 300) {
+                            try {
+                                const contentType = this.getResponseHeader('content-type');
+                                if (contentType === null || contentType === void 0 ? void 0 : contentType.includes('application/json')) {
+                                    const data = JSON.parse(this.responseText);
+                                    self.extractEmailFromData(data, 'api-response');
+                                }
+                            }
+                            catch (error) {
+                                // Ignore parse errors
+                            }
+                        }
+                    });
+                }
+                return self.originalXHRSend.call(this, body);
+            };
+            this.log('XHR interception active');
+        }
+        /**
+         * Setup Shopify-specific monitoring
+         */
+        setupShopifyMonitoring() {
+            // Detect Shopify
+            if (!this.isShopify()) {
+                return;
+            }
+            this.log('Shopify detected, setting up monitoring');
+            // Try to fetch customer data immediately
+            this.checkShopifyCustomer();
+            // Check periodically (in case customer logs in later)
+            this.shopifyCheckInterval = setInterval(() => {
+                this.checkShopifyCustomer();
+            }, 10000); // Check every 10 seconds
+            this.log('Shopify monitoring active');
+        }
+        /**
+         * Check if running on Shopify
+         */
+        isShopify() {
+            return !!(window.Shopify ||
+                document.querySelector('meta[name="shopify-checkout-api-token"]') ||
+                window.location.hostname.includes('.myshopify.com'));
+        }
+        /**
+         * Check Shopify customer endpoint for email
+         */
+        checkShopifyCustomer() {
+            return __awaiter(this, void 0, void 0, function* () {
+                var _a;
+                try {
+                    const response = yield fetch('/account.json', {
+                        credentials: 'same-origin'
+                    });
+                    if (response.ok) {
+                        const data = yield response.json();
+                        if ((_a = data === null || data === void 0 ? void 0 : data.customer) === null || _a === void 0 ? void 0 : _a.email) {
+                            this.log('Email captured from Shopify:', data.customer.email);
+                            this.triggerIdentify(data.customer.email, 'shopify');
+                            // Stop checking once we have email
+                            if (this.shopifyCheckInterval) {
+                                clearInterval(this.shopifyCheckInterval);
+                                this.shopifyCheckInterval = undefined;
+                            }
+                        }
+                    }
+                }
+                catch (error) {
+                    // User not logged in or endpoint unavailable
+                    this.log('Shopify customer check failed:', error);
+                }
+            });
+        }
+        /**
+         * Extract email from data (object, string, FormData)
+         */
+        extractEmailFromData(data, source) {
+            try {
+                let emails = [];
+                if (typeof data === 'string') {
+                    // Try to parse as JSON
+                    try {
+                        const parsed = JSON.parse(data);
+                        emails = this.findEmailsInObject(parsed);
+                    }
+                    catch (_a) {
+                        // Try to extract from string directly
+                        const emailPattern = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
+                        const matches = data.match(emailPattern);
+                        if (matches) {
+                            emails = matches;
+                        }
+                    }
+                }
+                else if (data instanceof FormData) {
+                    // Extract from FormData
+                    data.forEach((value) => {
+                        if (typeof value === 'string' && this.isValidEmail(value)) {
+                            emails.push(value);
+                        }
+                    });
+                }
+                else if (typeof data === 'object' && data !== null) {
+                    // Extract from object
+                    emails = this.findEmailsInObject(data);
+                }
+                // Trigger identify for first valid email
+                if (emails.length > 0) {
+                    const email = emails[0];
+                    this.log(`Email found in ${source}:`, email);
+                    this.triggerIdentify(email, 'api');
+                }
+            }
+            catch (error) {
+                this.log('Error extracting email from data:', error);
+            }
+        }
+        /**
+         * Recursively find emails in object
+         */
+        findEmailsInObject(obj, depth = 0) {
+            if (depth > 5)
+                return []; // Prevent infinite recursion
+            const emails = [];
+            for (const key in obj) {
+                if (!obj.hasOwnProperty(key))
+                    continue;
+                const value = obj[key];
+                // Check if key suggests email field
+                if (/email/i.test(key) && typeof value === 'string' && this.isValidEmail(value)) {
+                    emails.push(value);
+                }
+                // Recursively check nested objects
+                else if (typeof value === 'object' && value !== null) {
+                    emails.push(...this.findEmailsInObject(value, depth + 1));
+                }
+            }
+            return emails;
+        }
+        /**
+         * Check if domain is trusted for auto-identify
+         */
+        isTrustedDomain(url) {
+            try {
+                const urlObj = new URL(url, window.location.origin);
+                // Always trust same origin
+                if (urlObj.origin === window.location.origin) {
+                    return true;
+                }
+                // Check trusted domains list
+                if (this.config.trustedDomains.length === 0) {
+                    // If no trusted domains specified, only trust same origin
+                    return false;
+                }
+                return this.config.trustedDomains.some(domain => {
+                    return urlObj.hostname === domain || urlObj.hostname.endsWith(`.${domain}`);
+                });
+            }
+            catch (error) {
+                return false;
+            }
+        }
+        /**
+         * Validate email format
+         */
+        isValidEmail(email) {
+            if (!email || typeof email !== 'string')
+                return false;
+            // Basic email validation
+            const emailPattern = /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/;
+            if (!emailPattern.test(email))
+                return false;
+            // Exclude common test/dummy emails
+            const dummyPatterns = [
+                /test@/i,
+                /example@/i,
+                /demo@/i,
+                /fake@/i,
+                /@test\./i,
+                /@example\./i
+            ];
+            if (dummyPatterns.some(pattern => pattern.test(email))) {
+                return false;
+            }
+            return true;
+        }
+        /**
+         * Trigger identify with rate limiting
+         */
+        triggerIdentify(email, source) {
+            // Rate limiting
+            const now = Date.now();
+            if (now - this.lastIdentifyTime < this.RATE_LIMIT_MS) {
+                this.log('Rate limited, skipping identify');
+                return;
+            }
+            // Check if already identified
+            const existingEmail = storage.get('dl_auto_identified_email');
+            if (existingEmail === email) {
+                this.log('Already identified with this email');
+                return;
+            }
+            // Store email to prevent duplicate identification
+            storage.set('dl_auto_identified_email', email);
+            this.lastIdentifyTime = now;
+            // Trigger callback
+            if (this.identifyCallback) {
+                this.log(`Auto-identifying user: ${email} (source: ${source})`);
+                this.identifyCallback(email, source);
+            }
+        }
+        /**
+         * Destroy and cleanup
+         */
+        destroy() {
+            // Restore original fetch
+            if (this.originalFetch) {
+                window.fetch = this.originalFetch;
+                this.originalFetch = undefined;
+            }
+            // Restore original XHR
+            if (this.originalXHROpen) {
+                XMLHttpRequest.prototype.open = this.originalXHROpen;
+                this.originalXHROpen = undefined;
+            }
+            if (this.originalXHRSend) {
+                XMLHttpRequest.prototype.send = this.originalXHRSend;
+                this.originalXHRSend = undefined;
+            }
+            // Remove form listeners
+            this.formListeners.forEach(({ element, handler }) => {
+                element.removeEventListener('submit', handler);
+            });
+            this.formListeners = [];
+            // Clear Shopify interval
+            if (this.shopifyCheckInterval) {
+                clearInterval(this.shopifyCheckInterval);
+                this.shopifyCheckInterval = undefined;
+            }
+            this.log('Auto-identify destroyed');
+        }
+        /**
+         * Debug logging
+         */
+        log(...args) {
+            if (this.config.debug) {
+                console.log('[Datalyr Auto-Identify]', ...args);
+            }
+        }
+    }
+
     /**
      * Datalyr Web SDK
      * Modern attribution tracking for web applications
@@ -2440,9 +3323,9 @@ var Datalyr = (function () {
             this.initialized = false;
             this.errors = [];
             this.MAX_ERRORS = 50;
-            this.heavyFingerprintCollected = false;
-            // Check for opt-out cookie on instantiation using default cookie instance
-            this.optedOut = cookies.get('__dl_opt_out') === 'true';
+            // FIXED (ISSUE-01): Async initialization promise to prevent race conditions
+            this.initializationPromise = null;
+            // Opt-out check moved to init() after cookies configured (Issue #14)
         }
         /**
          * Initialize the SDK
@@ -2457,7 +3340,7 @@ var Datalyr = (function () {
                 throw new Error('[Datalyr] workspaceId is required');
             }
             // Set default config values
-            this.config = Object.assign({ endpoint: 'https://ingest.datalyr.com', debug: false, batchSize: 10, flushInterval: 5000, flushAt: 10, criticalEvents: undefined, highPriorityEvents: undefined, sessionTimeout: 30 * 60 * 1000, trackSessions: true, attributionWindow: 30 * 24 * 60 * 60 * 1000, trackedParams: [], respectDoNotTrack: false, respectGlobalPrivacyControl: true, privacyMode: 'standard', cookieDomain: 'auto', cookieExpires: 365, secureCookie: 'auto', sameSite: 'Lax', cookiePrefix: '__dl_', enablePerformanceTracking: true, enableFingerprinting: true, maxRetries: 5, retryDelay: 1000, maxOfflineQueueSize: 100, trackSPA: true, trackPageViews: true, fallbackEndpoints: [], plugins: [] }, config);
+            this.config = Object.assign({ endpoint: 'https://ingest.datalyr.com', debug: false, batchSize: 10, flushInterval: 5000, flushAt: 10, criticalEvents: undefined, highPriorityEvents: undefined, sessionTimeout: 60 * 60 * 1000, trackSessions: true, attributionWindow: 90 * 24 * 60 * 60 * 1000, trackedParams: [], respectDoNotTrack: false, respectGlobalPrivacyControl: true, privacyMode: 'standard', cookieDomain: 'auto', cookieExpires: 365, secureCookie: 'auto', sameSite: 'Lax', cookiePrefix: '__dl_', enablePerformanceTracking: true, enableFingerprinting: true, maxRetries: 5, retryDelay: 1000, maxOfflineQueueSize: 100, trackSPA: true, trackPageViews: true, fallbackEndpoints: [], plugins: [] }, config);
             // Initialize cookie storage with config
             this.cookies = new CookieStorage({
                 domain: this.config.cookieDomain,
@@ -2465,6 +3348,10 @@ var Datalyr = (function () {
                 sameSite: this.config.sameSite,
                 secure: this.config.secureCookie
             });
+            // Migrate legacy storage keys (fixes double-prefix issue)
+            storage.migrateFromLegacyPrefix();
+            // Check opt-out AFTER cookies configured (Issue #14)
+            this.optedOut = this.cookies.get('__dl_opt_out') === 'true';
             // Initialize modules
             this.identity = new IdentityManager();
             this.session = new SessionManager(this.config.sessionTimeout);
@@ -2480,28 +3367,9 @@ var Datalyr = (function () {
             // Set session ID in identity manager
             const sessionId = this.session.getSessionId();
             this.identity.setSessionId(sessionId);
-            // Load stored user properties
-            this.userProperties = storage.get('dl_user_traits', {});
-            // Setup SPA tracking if enabled
-            if (this.config.trackSPA) {
-                this.setupSPATracking();
-            }
-            // Initialize container manager if enabled
-            if (this.config.enableContainer !== false) {
-                this.container = new ContainerManager({
-                    workspaceId: this.config.workspaceId,
-                    endpoint: this.config.endpoint,
-                    debug: this.config.debug
-                });
-                // Initialize container asynchronously
-                this.container.init().catch(error => {
-                    this.log('Container initialization failed:', error);
-                });
-            }
-            // Track initial page view if enabled
-            if (this.config.trackPageViews) {
-                this.page();
-            }
+            // FIXED (ISSUE-01): Start async initialization immediately but don't block constructor
+            // This allows encryption to initialize before any events are tracked
+            this.initializeAsync();
             // Setup page unload handler
             this.setupUnloadHandler();
             // Initialize plugins
@@ -2512,6 +3380,8 @@ var Datalyr = (function () {
                         this.log(`Plugin initialized: ${plugin.name}`);
                     }
                     catch (error) {
+                        // Issue #16: Always warn about plugin failures, even when debug is false
+                        console.warn(`[Datalyr] Plugin '${plugin.name}' failed to initialize:`, error);
                         this.trackError(error, { plugin: plugin.name });
                     }
                 }
@@ -2519,20 +3389,103 @@ var Datalyr = (function () {
             this.initialized = true;
             this.log('SDK initialized');
         }
+        /**
+         * Complete async initialization (encryption, user properties, container, page view)
+         *
+         * FIXED (ISSUE-01): Separated async initialization to prevent race conditions
+         * Encryption must complete before first events are tracked
+         */
+        initializeAsync() {
+            return __awaiter(this, void 0, void 0, function* () {
+                if (this.initializationPromise) {
+                    return this.initializationPromise;
+                }
+                this.initializationPromise = (() => __awaiter(this, void 0, void 0, function* () {
+                    try {
+                        // SEC-03 Fix: Initialize encryption for PII data
+                        const deviceId = this.identity.getAnonymousId();
+                        yield dataEncryption.initialize(this.config.workspaceId, deviceId);
+                        // Load encrypted user properties
+                        this.userProperties = yield storage.getEncrypted('dl_user_traits', {});
+                        this.log('Encryption initialized, user properties loaded');
+                        // Setup SPA tracking if enabled
+                        if (this.config.trackSPA) {
+                            this.setupSPATracking();
+                        }
+                        // Initialize container manager if enabled
+                        if (this.config.enableContainer !== false) {
+                            this.container = new ContainerManager({
+                                workspaceId: this.config.workspaceId,
+                                endpoint: this.config.endpoint,
+                                debug: this.config.debug
+                            });
+                            // Initialize container asynchronously
+                            yield this.container.init().catch(error => {
+                                this.log('Container initialization failed:', error);
+                            });
+                        }
+                        // Initialize auto-identify if explicitly enabled (opt-in)
+                        if (this.config.autoIdentify === true) {
+                            this.autoIdentify = new AutoIdentifyManager({
+                                enabled: true,
+                                captureFromForms: this.config.autoIdentifyForms,
+                                captureFromAPI: this.config.autoIdentifyAPI,
+                                captureFromShopify: this.config.autoIdentifyShopify,
+                                trustedDomains: this.config.autoIdentifyTrustedDomains,
+                                debug: this.config.debug
+                            });
+                            // Setup auto-identify callback
+                            this.autoIdentify.initialize((email, source) => {
+                                this.log(`Auto-identified user: ${email} from ${source}`);
+                                // Track auto-identify event
+                                this.track('$auto_identify', {
+                                    email,
+                                    source,
+                                    timestamp: Date.now()
+                                });
+                                // Automatically call identify with email
+                                this.identify(email, { email });
+                            });
+                        }
+                        // Track initial page view if enabled (AFTER encryption ready)
+                        if (this.config.trackPageViews) {
+                            this.page();
+                        }
+                        this.log('Async initialization complete');
+                    }
+                    catch (error) {
+                        console.error('[Datalyr] Async initialization failed:', error);
+                        // Fallback: Load unencrypted and continue
+                        this.userProperties = storage.get('dl_user_traits', {});
+                    }
+                }))();
+                return this.initializationPromise;
+            });
+        }
+        /**
+         * Wait for async initialization to complete
+         * FIXED (ISSUE-01): Public method to await full initialization
+         */
+        ready() {
+            return __awaiter(this, void 0, void 0, function* () {
+                if (!this.initialized) {
+                    throw new Error('[Datalyr] SDK not initialized. Call init() first.');
+                }
+                return this.initializationPromise || Promise.resolve();
+            });
+        }
         /**
          * Track an event
          */
         track(eventName, properties = {}) {
+            if (!this.initialized) {
+                console.warn('[Datalyr] SDK not initialized. Call init() first.');
+                return;
+            }
             if (!this.shouldTrack())
                 return;
             try {
-                // Collect heavy fingerprint on first event (lazy loading)
-                if (!this.heavyFingerprintCollected && this.config.enableFingerprinting) {
-                    this.heavyFingerprintCollected = true;
-                    this.fingerprint.collectHeavyFingerprint().catch(err => {
-                        this.log('Heavy fingerprint collection failed:', err);
-                    });
-                }
+                // PRIVACY: Heavy fingerprinting removed - using minimal fingerprinting only
                 // Update session activity
                 this.session.updateActivity(eventName);
                 // Create event payload
@@ -2566,6 +3519,10 @@ var Datalyr = (function () {
          * Identify a user
          */
         identify(userId, traits = {}) {
+            if (!this.initialized) {
+                console.warn('[Datalyr] SDK not initialized. Call init() first.');
+                return;
+            }
             if (!this.shouldTrack())
                 return;
             if (!userId) {
@@ -2573,11 +3530,23 @@ var Datalyr = (function () {
                 return;
             }
             try {
+                // FIXED (DATA-05): Rotate session ID on identify to prevent session fixation
+                if (this.session) {
+                    this.session.rotateSessionId();
+                }
                 // Update identity
                 const identityLink = this.identity.identify(userId, traits);
-                // Store user properties
+                // SEC-03 Fix: Store user properties encrypted (contains PII)
+                // FIXED (H2): Fail loudly instead of silent fallback to unencrypted
                 this.userProperties = Object.assign(Object.assign({}, this.userProperties), traits);
-                storage.set('dl_user_traits', this.userProperties);
+                storage.setEncrypted('dl_user_traits', this.userProperties).catch(error => {
+                    console.error('[Datalyr] Failed to encrypt user traits - NOT storing unencrypted PII:', error);
+                    console.error('[Datalyr] User traits will only persist in memory until page reload');
+                    // DO NOT fallback to unencrypted storage - this would expose PII
+                    // This is a breaking change from the previous silent fallback behavior
+                    // If encryption fails, user traits are only stored in memory (this.userProperties)
+                    // and will be lost on page reload - but PII is NOT exposed in localStorage
+                });
                 // Track $identify event
                 this.track('$identify', Object.assign(Object.assign({}, identityLink), { traits }));
                 // Call plugin handlers
@@ -2603,6 +3572,10 @@ var Datalyr = (function () {
          * Track a page view
          */
         page(properties = {}) {
+            if (!this.initialized) {
+                console.warn('[Datalyr] SDK not initialized. Call init() first.');
+                return;
+            }
             if (!this.shouldTrack())
                 return;
             const pageData = Object.assign({ title: document.title, url: window.location.href, path: window.location.pathname, search: window.location.search, referrer: document.referrer }, properties);
@@ -2641,6 +3614,10 @@ var Datalyr = (function () {
          * Associate user with a group/account
          */
         group(groupId, traits = {}) {
+            if (!this.initialized) {
+                console.warn('[Datalyr] SDK not initialized. Call init() first.');
+                return;
+            }
             this.track('$group', {
                 group_id: groupId,
                 traits
@@ -2650,6 +3627,10 @@ var Datalyr = (function () {
          * Alias one ID to another
          */
         alias(userId, previousId) {
+            if (!this.initialized) {
+                console.warn('[Datalyr] SDK not initialized. Call init() first.');
+                return;
+            }
             const aliasData = this.identity.alias(userId, previousId);
             this.track('$alias', aliasData);
         }
@@ -2657,6 +3638,10 @@ var Datalyr = (function () {
          * Reset the current user
          */
         reset() {
+            if (!this.initialized) {
+                console.warn('[Datalyr] SDK not initialized. Call init() first.');
+                return;
+            }
             this.identity.reset();
             this.userProperties = {};
             storage.remove('dl_user_traits');
@@ -2725,8 +3710,12 @@ var Datalyr = (function () {
          * Opt out of tracking
          */
         optOut() {
+            if (!this.initialized) {
+                console.warn('[Datalyr] SDK not initialized. Call init() first.');
+                return;
+            }
             this.optedOut = true;
-            cookies.set('__dl_opt_out', 'true', this.config.cookieExpires);
+            this.cookies.set('__dl_opt_out', 'true', this.config.cookieExpires);
             this.queue.clear();
             this.log('User opted out');
         }
@@ -2734,8 +3723,12 @@ var Datalyr = (function () {
          * Opt in to tracking
          */
         optIn() {
+            if (!this.initialized) {
+                console.warn('[Datalyr] SDK not initialized. Call init() first.');
+                return;
+            }
             this.optedOut = false;
-            cookies.set('__dl_opt_out', 'false', this.config.cookieExpires);
+            this.cookies.set('__dl_opt_out', 'false', this.config.cookieExpires);
             this.log('User opted in');
         }
         /**
@@ -2796,8 +3789,7 @@ var Datalyr = (function () {
             if (this.config.enableFingerprinting) {
                 const fingerprintData = this.fingerprint.collect();
                 Object.assign(eventData, {
-                    fingerprint: fingerprintData,
-                    device_fingerprint: fingerprintData // Snake case alias
+                    device_fingerprint: fingerprintData // Use snake_case only (matches backend)
                 });
             }
             // Add browser context
@@ -2811,7 +3803,7 @@ var Datalyr = (function () {
                 viewport_width: window.innerWidth,
                 viewport_height: window.innerHeight
             });
-            // Create payload with both camelCase and snake_case fields
+            // Create payload using snake_case only (matches backend API and production script)
             const identityFields = this.identity.getIdentityFields();
             const eventId = generateUUID();
             // Ensure we have all required identity fields
@@ -2820,31 +3812,25 @@ var Datalyr = (function () {
             const visitorId = identityFields.visitor_id || anonymousId;
             const sessionId = identityFields.session_id;
             const payload = {
-                // Required fields
-                workspaceId: this.config.workspaceId,
-                workspace_id: this.config.workspaceId, // Snake case alias
-                eventId: eventId,
-                event_id: eventId, // Snake case alias (same ID)
-                eventName,
-                event_name: eventName, // Snake case alias
-                eventData,
-                event_data: eventData, // Snake case alias
+                // Required fields (snake_case only - no duplication)
+                workspace_id: this.config.workspaceId,
+                event_id: eventId,
+                event_name: eventName,
+                event_data: eventData,
                 source: 'web',
                 timestamp: new Date().toISOString(),
-                // Identity fields (explicit to satisfy TypeScript)
+                // Identity fields (snake_case only)
                 distinct_id: distinctId,
                 anonymous_id: anonymousId,
                 visitor_id: visitorId,
-                visitorId: visitorId,
                 user_id: identityFields.user_id,
                 canonical_id: identityFields.canonical_id,
-                sessionId: sessionId,
                 session_id: sessionId,
                 // Resolution metadata
                 resolution_method: 'browser_sdk',
                 resolution_confidence: 1.0,
                 // SDK metadata
-                sdk_version: '1.0.0',
+                sdk_version: '1.1.1',
                 sdk_name: 'datalyr-web-sdk'
             };
             return payload;
@@ -2869,36 +3855,48 @@ var Datalyr = (function () {
         }
         /**
          * Setup SPA tracking
+         * Fixed Issue #15: Store original methods for cleanup
+         * Fixed CRITICAL-03: Clear attribution cache on navigation to prevent stale data
          */
         setupSPATracking() {
-            // Store original methods
-            const originalPushState = history.pushState;
-            const originalReplaceState = history.replaceState;
+            // Store original methods for cleanup
+            this.originalPushState = history.pushState;
+            this.originalReplaceState = history.replaceState;
             const self = this;
             // Override pushState
             history.pushState = function (...args) {
-                originalPushState.apply(history, args);
+                self.originalPushState.apply(history, args);
                 setTimeout(() => {
+                    // Clear attribution cache to capture fresh URL params
+                    self.attribution.clearCache();
                     self.page();
                 }, 0);
             };
             // Override replaceState
             history.replaceState = function (...args) {
-                originalReplaceState.apply(history, args);
+                self.originalReplaceState.apply(history, args);
                 setTimeout(() => {
+                    // Clear attribution cache to capture fresh URL params
+                    self.attribution.clearCache();
                     self.page();
                 }, 0);
             };
             // Listen for popstate
-            window.addEventListener('popstate', () => {
+            this.popstateHandler = () => {
                 setTimeout(() => {
-                    this.page();
+                    // Clear attribution cache to capture fresh URL params
+                    self.attribution.clearCache();
+                    self.page();
                 }, 0);
-            });
+            };
+            window.addEventListener('popstate', this.popstateHandler);
             // Listen for hashchange
-            window.addEventListener('hashchange', () => {
-                this.page();
-            });
+            this.hashchangeHandler = () => {
+                // Clear attribution cache to capture fresh URL params
+                self.attribution.clearCache();
+                self.page();
+            };
+            window.addEventListener('hashchange', this.hashchangeHandler);
         }
         /**
          * Setup page unload handler
@@ -3005,6 +4003,20 @@ var Datalyr = (function () {
          * Destroy the SDK instance and cleanup resources
          */
         destroy() {
+            // Restore original history methods (Issue #15)
+            if (this.originalPushState) {
+                history.pushState = this.originalPushState;
+            }
+            if (this.originalReplaceState) {
+                history.replaceState = this.originalReplaceState;
+            }
+            // Remove event listeners (Issue #15)
+            if (this.popstateHandler) {
+                window.removeEventListener('popstate', this.popstateHandler);
+            }
+            if (this.hashchangeHandler) {
+                window.removeEventListener('hashchange', this.hashchangeHandler);
+            }
             // Clean up queue
             if (this.queue) {
                 this.queue.destroy();
@@ -3013,6 +4025,16 @@ var Datalyr = (function () {
             if (this.session) {
                 this.session.destroy();
             }
+            // FIXED (ISSUE-02): Clean up sandboxed iframes to prevent memory leaks
+            if (this.container) {
+                this.container.cleanupAllIframes();
+            }
+            // Clean up auto-identify
+            if (this.autoIdentify) {
+                this.autoIdentify.destroy();
+            }
+            // SEC-03 Fix: Clean up encryption keys
+            dataEncryption.destroy();
             // Clear any remaining data
             this.superProperties = {};
             this.userProperties = {};