@datalyr/web 1.6.5 → 1.7.1

package/dist/datalyr.cjs.js

@@ -1,5 +1,5 @@
 /**
- * @datalyr/web v1.6.5
+ * @datalyr/web v1.7.1
  * Datalyr Web SDK - Modern attribution tracking for web applications
  * (c) 2026 Datalyr Inc.
  * Released under the MIT License
@@ -1412,13 +1412,19 @@ class AttributionManager {
                 attribution[key] = value;
             }
         }
-        // Capture click IDs
+        // Capture click IDs. The first present (by CLICK_IDS priority) is the primary
+        // clickId/clickIdType, but ALSO capture every present click ID as its own named
+        // field — a single URL can carry both fbclid and gclid (redirect chains, forwarded
+        // / re-shared links), and keeping only the first dropped the others' platform
+        // attribution entirely. (WEB NEW-3)
         for (const clickId of this.CLICK_IDS) {
             const value = params[clickId];
             if (value) {
-                attribution.clickId = value;
-                attribution.clickIdType = clickId;
-                break; // Use first found click ID
+                if (!attribution.clickId) {
+                    attribution.clickId = value;
+                    attribution.clickIdType = clickId;
+                }
+                attribution[clickId] = value;
             }
         }
         // Capture custom tracked parameters
@@ -1548,7 +1554,10 @@ class AttributionManager {
         // Generate _fbp if missing (Facebook browser ID)
         if (!adCookies._fbp && (this.hasClickId('fbclid') || adCookies._fbc)) {
             const timestamp = Date.now();
-            const randomId = Math.random().toString(36).substring(2, 15);
+            // Meta's _fbp format is fb.1.<creationTimeMs>.<randomNumber> where the last
+            // segment MUST be a decimal integer. The old base36 string was non-conformant —
+            // Meta ignores it (and it can shadow a real _fbp), degrading EMQ. (WEB-17)
+            const randomId = Math.floor(Math.random() * 1e10).toString();
             adCookies._fbp = `fb.1.${timestamp}.${randomId}`;
             // Optionally set the cookie for future use
             cookies.set('_fbp', adCookies._fbp, 90);
@@ -1607,23 +1616,30 @@ class AttributionManager {
         const lastTouch = this.getLastTouch();
         const journey = this.getJourney();
         let current = this.captureAttribution();
-        // CRITICAL FIX: If current session has no attribution (direct/organic),
-        // fallback to persistent attribution from localStorage (90-day window)
-        const hasCurrentAttribution = !!(current.source || current.medium || current.clickId || current.campaign);
-        if (!hasCurrentAttribution && firstTouch) {
-            // Check if persistent attribution is still valid
+        // A "real" attribution signal on THIS pageview = a click ID, a UTM/campaign, or a
+        // referrer/UTM-derived source. determineSource()/determineMedium() FLOOR to
+        // 'direct'/'none', so the mere presence of current.source/medium is NOT a signal.
+        // The old `hasCurrentAttribution` (truthy because source is always at least 'direct')
+        // made the fallback below dead code AND caused storeLastTouch to overwrite a real
+        // paid last-touch with 'direct'/'none' on the next internal navigation. (WEB NEW-1)
+        const hasRealAttribution = !!(current.clickId ||
+            current.campaign ||
+            (current.source && current.source !== 'direct'));
+        if (!hasRealAttribution && firstTouch) {
+            // Direct / internal navigation: fall back to persistent attribution (90-day
+            // window) so the event isn't mis-attributed to 'direct', keeping page context.
             if (!firstTouch.expires_at || Date.now() < firstTouch.expires_at) {
-                // Use persistent attribution but keep current page context
                 current = Object.assign(Object.assign({}, firstTouch), { referrer: current.referrer, referrerHost: current.referrerHost, landingPage: current.landingPage, landingPath: current.landingPath });
             }
         }
         // Capture advertising cookies automatically
         const adCookies = this.captureAdCookies();
-        // Update first/last touch if needed
-        if (!firstTouch && Object.keys(current).length > 1) {
+        // Only (re)write first/last touch when this pageview carried a REAL signal — never
+        // overwrite stored attribution with the 'direct'/'none' floor of an internal nav.
+        if (!firstTouch && hasRealAttribution) {
             this.storeFirstTouch(current);
         }
-        if (Object.keys(current).length > 1) {
+        if (hasRealAttribution) {
             this.storeLastTouch(current);
         }
         return Object.assign(Object.assign(Object.assign({}, current), adCookies), { 
@@ -1660,6 +1676,15 @@ class AttributionManager {
         // Check referrer
         if (attribution.referrerHost) {
             const host = attribution.referrerHost.toLowerCase();
+            // Same-site referrer = internal navigation, NOT a new acquisition source.
+            // Without this, a full-page internal nav (referrer = our own domain, common on
+            // classic multi-page stores) classifies as 'referral', which makes
+            // hasRealAttribution true and overwrites the real paid last-touch. Treat it as
+            // direct so the last-touch guard preserves the genuine source.
+            const currentHost = (typeof window !== 'undefined' ? window.location.hostname : '').toLowerCase();
+            if (currentHost && (host === currentHost || this.isSameRootDomain(host, currentHost))) {
+                return 'direct';
+            }
             // Social sources
             if (host.includes('facebook.com') || host.includes('fb.com'))
                 return 'facebook';
@@ -1717,6 +1742,16 @@ class AttributionManager {
         }
         return 'referral';
     }
+    /**
+     * Whether two hosts share the same root domain (eTLD+1 approximation), so that
+     * cross-subdomain internal navigation (e.g. shop.example.com → checkout.example.com)
+     * is also treated as same-site. Not a full public-suffix parse — good enough to keep
+     * internal navs from being mis-classified as referral.
+     */
+    isSameRootDomain(a, b) {
+        const root = (h) => h.split('.').slice(-2).join('.');
+        return root(a) === root(b);
+    }
     /**
      * Extract hostname from URL
      */
@@ -1758,6 +1793,11 @@ class AttributionManager {
 const DEFAULT_CRITICAL_EVENTS = ['purchase', 'signup', 'subscribe', 'lead', 'conversion'];
 // Default high priority events that use faster batching
 const DEFAULT_HIGH_PRIORITY_EVENTS = ['add_to_cart', 'begin_checkout', 'view_item', 'search'];
+// A 429 is a deliberate backpressure signal, not a transient failure — tagged so the
+// send path can route it to the offline queue WITHOUT retrying (which would storm the
+// already-overloaded server). See sendBatch / the rateLimitedUntil gate.
+class RateLimitError extends Error {
+}
 class EventQueue {
     constructor(config) {
         this.queue = [];
@@ -1770,18 +1810,29 @@ class EventQueue {
         this.OFFLINE_QUEUE_KEY = 'dl_offline_queue';
         this.flushLock = false; // FIXED (DATA-03): Mutex to prevent race conditions
         this.offlineQueueLock = false; // FIXED (DATA-03): Separate lock for offline queue operations
+        this.offlineProcessing = false; // FIXED (WEB-1): re-entrancy guard for processOfflineQueue
+        this.inFlight = []; // FIXED (WEB-3): batch currently in _flight's keepalive fetch — forceFlush must NOT re-beacon it
+        this.enabled = true; // FIXED (consent): when false (opt-out / withdrawn analytics consent) all enqueue/flush/drain is a no-op
+        this.rateLimitedUntil = 0; // FIXED (429): skip flush/drain until the server's Retry-After window passes
+        // Coerce numeric config to sane values. The old `config.X || default` both turned a
+        // legitimate 0 into the default AND let invalid values through — a NEGATIVE batchSize
+        // made processOfflineQueue's `splice(0, -1)` loop forever and FREEZE the host tab.
+        const clampInt = (v, def, min, max) => {
+            const n = Number(v);
+            return Number.isFinite(n) ? Math.min(Math.max(Math.floor(n), min), max) : def;
+        };
         this.config = {
-            batchSize: config.batchSize || 10,
-            flushInterval: config.flushInterval || 5000,
-            maxRetries: config.maxRetries || 5,
-            retryDelay: config.retryDelay || 1000,
+            batchSize: clampInt(config.batchSize, 10, 1, 1000),
+            flushInterval: clampInt(config.flushInterval, 5000, 250, 3600000),
+            maxRetries: clampInt(config.maxRetries, 5, 0, 20),
+            retryDelay: clampInt(config.retryDelay, 1000, 0, 60000),
             endpoint: config.endpoint || 'https://ingest.datalyr.com',
-            fallbackEndpoints: config.fallbackEndpoints || [],
+            fallbackEndpoints: Array.isArray(config.fallbackEndpoints) ? config.fallbackEndpoints : [],
             workspaceId: config.workspaceId,
             debug: config.debug || false,
             criticalEvents: config.criticalEvents || DEFAULT_CRITICAL_EVENTS,
             highPriorityEvents: config.highPriorityEvents || DEFAULT_HIGH_PRIORITY_EVENTS,
-            maxOfflineQueueSize: config.maxOfflineQueueSize || 100
+            maxOfflineQueueSize: clampInt(config.maxOfflineQueueSize, 100, 1, 100000)
         };
         this.networkStatus = {
             isOnline: navigator.onLine !== false,
@@ -1791,11 +1842,22 @@ class EventQueue {
         this.loadOfflineQueue();
         this.setupNetworkListeners();
         this.startPeriodicFlush();
+        // WEB-1: a previous session may have left events in the persisted offline queue.
+        // The 'online' listener only fires on an offline→online TRANSITION, which never
+        // happens for a visitor who returns already-online — so drain on startup too,
+        // otherwise those events (incl. failed revenue conversions) just age out.
+        if (this.networkStatus.isOnline && this.offlineQueue.length > 0) {
+            setTimeout(() => this.processOfflineQueue(), 1000);
+        }
     }
     /**
      * Add event to queue
      */
     enqueue(event) {
+        // Consent gate: opt-out / withdrawn analytics consent stops all sending. (The SDK
+        // also gates at track(), but this is the backstop for anything that reaches here.)
+        if (!this.enabled)
+            return;
         const eventName = event.event_name; // Use snake_case
         // Check for duplicates (within 500ms window)
         if (this.isDuplicateEvent(event)) {
@@ -1894,6 +1956,11 @@ class EventQueue {
      */
     flush() {
         return __awaiter(this, void 0, void 0, function* () {
+            if (!this.enabled)
+                return;
+            // FIXED (429): respect the server's Retry-After window instead of hammering it.
+            if (Date.now() < this.rateLimitedUntil)
+                return;
             // FIXED (DATA-03): Check both promise and lock for concurrent flush protection
             if (this.flushPromise || this.flushLock) {
                 return this.flushPromise || Promise.resolve();
@@ -1935,6 +2002,12 @@ class EventQueue {
             // Only remove after successful send to prevent data loss
             const batchSize = Math.min(this.config.batchSize, this.queue.length);
             const events = this.queue.slice(0, batchSize);
+            // WEB-3 (HIGH-1): mark this batch as in-flight. sendBatch's fetch uses
+            // keepalive:true, so it survives an unload that fires mid-flush — forceFlush
+            // reads `inFlight` to avoid re-beaconing the very events this fetch is sending.
+            // `inFlight` is always the FRONT `batchSize` of this.queue while flushLock holds
+            // (enqueue only pushes to the back; flushLock serializes _flush bodies).
+            this.inFlight = events;
             try {
                 yield this.sendBatch(events);
                 // SUCCESS: Now it's safe to remove events from queue
@@ -1943,10 +2016,17 @@ class EventQueue {
             }
             catch (error) {
                 this.log('Failed to send batch:', error);
-                // Don't remove from queue - events stay for retry
-                // Move to offline queue for persistent storage
+                // WEB-8: make the offline queue the SINGLE owner of these events. Previously
+                // they stayed in the live queue AND were copied to the offline queue, so a
+                // later success on both paths double-sent (relying on server-side dedup).
+                // Remove the same slice from the live queue; the offline queue now drains on
+                // every periodic tick (WEB-1/WEB-2), so they are still retried, not stranded.
+                this.queue.splice(0, batchSize);
                 this.moveToOfflineQueue(events);
             }
+            finally {
+                this.inFlight = [];
+            }
         });
     }
     /**
@@ -1976,21 +2056,27 @@ class EventQueue {
                     // Handle rate limiting
                     if (response.status === 429) {
                         const retryAfter = parseInt(response.headers.get('Retry-After') || '60');
-                        this.log(`Rate limited, retrying after ${retryAfter}s`);
-                        // FIXED (CRITICAL-06): Don't unshift() - events are still in queue!
-                        // With the new fix, events aren't removed until success, so they're
-                        // already in the queue. Just schedule a retry flush.
-                        setTimeout(() => {
-                            this.flush();
-                        }, retryAfter * 1000);
-                        // Throw to trigger catch block which moves events to offline queue
-                        throw new Error(`Rate limited (429), retry after ${retryAfter}s`);
+                        // FIXED (429 retry-storm): honor Retry-After as a SINGLE backoff window. The
+                        // old code scheduled a flush AND let the throw fall into the generic
+                        // exponential-backoff retry below — firing ~6 requests inside the window the
+                        // server asked us to wait, amplifying an ingest overload. Now: record the
+                        // window and throw a RateLimitError (which the catch does NOT retry). The
+                        // events move to the offline queue and drain once the window passes.
+                        this.rateLimitedUntil = Date.now() + Math.max(retryAfter, 1) * 1000;
+                        this.log(`Rate limited; backing off ${retryAfter}s`);
+                        throw new RateLimitError('Rate limited (429)');
                     }
                     throw new Error(`HTTP ${response.status}: ${response.statusText}`);
                 }
                 this.log(`Batch sent successfully to ${currentEndpoint}: ${events.length} events`);
             }
             catch (error) {
+                // A 429 is deliberate backpressure — do NOT retry it here (neither fallback nor
+                // backoff). Propagate so the batch moves to the offline queue; the periodic drain
+                // resumes only after rateLimitedUntil. This is what prevents the retry storm.
+                if (error instanceof RateLimitError) {
+                    throw error;
+                }
                 // Try next fallback endpoint if available
                 if (endpointIndex < endpoints.length - 1) {
                     this.log(`Failed on ${currentEndpoint}, trying fallback ${endpointIndex + 1}`);
@@ -2032,6 +2118,13 @@ class EventQueue {
             if (this.queue.length > 0) {
                 this.flush();
             }
+            // WEB-1/WEB-2: also drain persisted offline events (including failed critical
+            // events that enqueue() parked here) on every tick — not only on an 'online'
+            // transition that may never fire. This is what gives parked purchase/lead
+            // events a retry path while the user stays online.
+            if (this.networkStatus.isOnline && this.offlineQueue.length > 0) {
+                this.processOfflineQueue();
+            }
         }, this.config.flushInterval);
     }
     /**
@@ -2050,6 +2143,12 @@ class EventQueue {
      * FIXED (CRITICAL-06): Can now accept specific events or move entire queue
      */
     moveToOfflineQueue(events) {
+        // Consent leak fix: do NOT persist for a disabled queue. Without this, an
+        // in-flight _flush (or critical-event send) that FAILS after optOut() has purged
+        // the offline queue would re-write the PII-bearing event to storage AFTER the
+        // purge. Gating here (a persistence sink, not just the send sinks) closes it.
+        if (!this.enabled)
+            return;
         // FIXED (DATA-03): Check if offline queue operation already in progress
         if (this.offlineQueueLock) {
             console.warn('[Datalyr Queue] Offline queue operation already in progress');
@@ -2093,6 +2192,10 @@ class EventQueue {
      * Save offline queue to storage
      */
     saveOfflineQueue() {
+        // Defense-in-depth twin of the moveToOfflineQueue gate: never write PII to disk
+        // for a disabled (opted-out) queue.
+        if (!this.enabled)
+            return;
         // Keep max events based on config
         const toSave = this.offlineQueue.slice(-this.config.maxOfflineQueueSize);
         storage.set(this.OFFLINE_QUEUE_KEY, toSave);
@@ -2102,25 +2205,46 @@ class EventQueue {
      */
     processOfflineQueue() {
         return __awaiter(this, void 0, void 0, function* () {
+            // WEB-1: guard against re-entrancy. This is now driven from three places (the
+            // 'online' listener, the periodic flush, and the on-load kick); without a guard
+            // two of them could splice the same offlineQueue concurrently and double-send.
+            if (!this.enabled)
+                return;
+            if (Date.now() < this.rateLimitedUntil)
+                return; // FIXED (429): honor Retry-After window
+            if (this.offlineProcessing)
+                return;
             if (this.offlineQueue.length === 0)
                 return;
-            this.log(`Processing ${this.offlineQueue.length} offline events`);
-            while (this.offlineQueue.length > 0) {
-                const batch = this.offlineQueue.splice(0, this.config.batchSize);
-                try {
-                    yield this.sendBatch(batch);
-                    this.saveOfflineQueue();
+            if (!this.networkStatus.isOnline)
+                return;
+            this.offlineProcessing = true;
+            try {
+                this.log(`Processing ${this.offlineQueue.length} offline events`);
+                while (this.offlineQueue.length > 0) {
+                    // Stop mid-drain if disabled (opt-out during an active drain) — otherwise the
+                    // unshift-on-failure below would re-persist a batch after optOut's purge.
+                    if (!this.enabled)
+                        break;
+                    const batch = this.offlineQueue.splice(0, this.config.batchSize);
+                    try {
+                        yield this.sendBatch(batch);
+                        this.saveOfflineQueue();
+                    }
+                    catch (error) {
+                        this.log('Failed to send offline batch:', error);
+                        // Put back in queue
+                        this.offlineQueue.unshift(...batch);
+                        this.saveOfflineQueue();
+                        break;
+                    }
                 }
-                catch (error) {
-                    this.log('Failed to send offline batch:', error);
-                    // Put back in queue
-                    this.offlineQueue.unshift(...batch);
-                    this.saveOfflineQueue();
-                    break;
+                if (this.offlineQueue.length === 0) {
+                    storage.remove(this.OFFLINE_QUEUE_KEY);
                 }
             }
-            if (this.offlineQueue.length === 0) {
-                storage.remove(this.OFFLINE_QUEUE_KEY);
+            finally {
+                this.offlineProcessing = false;
             }
         });
     }
@@ -2142,30 +2266,103 @@ class EventQueue {
     getNetworkStatus() {
         return Object.assign({}, this.networkStatus);
     }
+    /**
+     * Build a batch payload from a set of events.
+     */
+    buildBatch(events) {
+        return {
+            events,
+            batchId: generateUUID(),
+            timestamp: new Date().toISOString()
+        };
+    }
     /**
      * Force flush (for page unload)
+     * FIXED (WEB-3): include the offline queue, chunk under sendBeacon's ~64KB cap,
+     * and persist any chunk the browser refuses so it survives to the next page load.
+     * Previously this beaconed the live queue as one blob — ignoring the offline queue
+     * entirely and silently failing (returning false) whenever the payload exceeded 64KB.
+     *
+     * Two follow-up review fixes:
+     *  - HIGH-1: exclude any batch currently in-flight in _flush(). That batch is being
+     *    sent with a keepalive fetch that already survives unload; re-beaconing it would
+     *    double-send. (`inFlight` is the front `inFlight.length` events of this.queue.)
+     *  - HIGH-2: handleUnload is wired to visibilitychange+pagehide+beforeunload, so this
+     *    runs multiple times per lifecycle. Detach what we beacon SYNCHRONOUSLY (clear the
+     *    in-memory queues, persist a refused remainder straight to storage rather than back
+     *    into this.offlineQueue) so a repeat call finds nothing to re-send.
      */
     forceFlush() {
         return __awaiter(this, void 0, void 0, function* () {
-            // Try sendBeacon first for reliability
-            if (navigator.sendBeacon && this.queue.length > 0) {
-                const batchPayload = {
-                    events: this.queue,
-                    batchId: generateUUID(),
-                    timestamp: new Date().toISOString()
-                };
-                const blob = new Blob([JSON.stringify(batchPayload)], {
+            if (!this.enabled)
+                return;
+            if (!navigator.sendBeacon) {
+                // No beacon API — best-effort keepalive-fetch drain of both queues.
+                yield this.flush();
+                yield this.processOfflineQueue();
+                return;
+            }
+            // Exclude the in-flight batch (its keepalive fetch already carries it).
+            const live = this.queue.slice(this.inFlight.length);
+            const pending = [...live, ...this.offlineQueue];
+            // Detach synchronously: keep only the in-flight front (for _flush to settle) and
+            // empty the offline queue, so a second unload event this lifecycle re-enters with
+            // nothing to re-beacon. The refused remainder (if any) is persisted to STORAGE
+            // below, not back into this.offlineQueue, for exactly this reason.
+            this.queue = this.queue.slice(0, this.inFlight.length);
+            this.offlineQueue = [];
+            if (pending.length === 0)
+                return;
+            const MAX_BEACON_BYTES = 60000; // headroom under the browser's ~64KB cap
+            // Greedily pack events into chunks bounded by BOTH batchSize and byte size.
+            const chunks = [];
+            let current = [];
+            let currentBytes = 2; // approx for the JSON array/object wrapper
+            for (const ev of pending) {
+                // Byte length (not UTF-16 .length) so multibyte product names / emoji can't
+                // under-count and overflow the cap.
+                const evBytes = new Blob([JSON.stringify(ev)]).size + 1;
+                if (current.length > 0 &&
+                    (current.length >= this.config.batchSize || currentBytes + evBytes > MAX_BEACON_BYTES)) {
+                    chunks.push(current);
+                    current = [];
+                    currentBytes = 2;
+                }
+                current.push(ev);
+                currentBytes += evBytes;
+            }
+            if (current.length > 0)
+                chunks.push(current);
+            // Send each chunk; the moment the browser refuses to enqueue one, keep it and
+            // everything after it for the next session.
+            let failedFrom = -1;
+            for (let c = 0; c < chunks.length; c++) {
+                const blob = new Blob([JSON.stringify(this.buildBatch(chunks[c]))], {
                     type: 'application/json'
                 });
-                const success = navigator.sendBeacon(this.config.endpoint, blob);
-                if (success) {
-                    this.log('Events sent via sendBeacon');
-                    this.queue = [];
-                    return;
+                if (!navigator.sendBeacon(this.config.endpoint, blob)) {
+                    failedFrom = c;
+                    break;
                 }
             }
-            // Fallback to regular flush
-            yield this.flush();
+            if (failedFrom >= 0) {
+                const remainder = chunks
+                    .slice(failedFrom)
+                    .reduce((acc, c) => acc.concat(c), []);
+                // Persist straight to storage (NOT this.offlineQueue) so a repeat unload event
+                // won't re-beacon it; the next page load's drain (which uses a normal fetch with
+                // no 64KB cap) delivers it. MED-2: log if the maxOfflineQueueSize cap truncates.
+                const toPersist = remainder.slice(-this.config.maxOfflineQueueSize);
+                if (remainder.length > toPersist.length) {
+                    this.log(`Offline cap dropped ${remainder.length - toPersist.length} oldest events at unload`);
+                }
+                storage.set(this.OFFLINE_QUEUE_KEY, toPersist);
+                this.log(`sendBeacon refused ${remainder.length} events; persisted ${toPersist.length} for next load`);
+            }
+            else {
+                this.log('Events sent via sendBeacon');
+                storage.remove(this.OFFLINE_QUEUE_KEY);
+            }
         });
     }
     /**
@@ -2178,6 +2375,22 @@ class EventQueue {
             this.batchTimer = null;
         }
     }
+    /**
+     * Enable/disable all sending. Used by opt-out / withdrawn analytics consent so that
+     * events persisted BEFORE opt-out aren't drained afterwards (the periodic drain and
+     * the on-load drain both honor this).
+     */
+    setEnabled(enabled) {
+        this.enabled = enabled;
+    }
+    /**
+     * Clear the offline queue and its persisted copy (used by opt-out to purge any
+     * PII-bearing events that were parked before the user opted out).
+     */
+    clearOffline() {
+        this.offlineQueue = [];
+        storage.remove(this.OFFLINE_QUEUE_KEY);
+    }
     /**
      * Debug logging
      */
@@ -2404,9 +2617,10 @@ class ContainerManager {
                     throw new Error(`Failed to fetch container scripts: ${response.status}`);
                 }
                 const data = yield response.json();
-                // Store scripts and pixels
+                // Store scripts, pixels, and the SDK runtime config envelope.
                 this.scripts = data.scripts || [];
                 this.pixels = data.pixels || null;
+                this.remoteConfig = (data.config && typeof data.config === 'object') ? data.config : undefined;
                 // Initialize pixels if configured. Awaited so advanced-matching hashes
                 // are resolved before the first dl.track() flushes through trackToPixels
                 // (otherwise fbq('init') would lag fbq('track') in fast-path tracks).
@@ -2436,6 +2650,13 @@ class ContainerManager {
             }
         });
     }
+    /**
+     * The SDK runtime config delivered by /container-scripts, or undefined if the
+     * response omitted it. The SDK merges this under explicit init() options.
+     */
+    getRemoteConfig() {
+        return this.remoteConfig;
+    }
     /**
      * Load scripts by trigger type
      */
@@ -2866,7 +3087,7 @@ class ContainerManager {
      * Track event to all initialized pixels
      */
     trackToPixels(eventName, properties = {}, eventId) {
-        var _a, _b, _c, _e, _f, _g, _h, _j;
+        var _a, _b, _c, _e, _f, _g, _h, _j, _k, _l;
         // Datalyr-internal events ($identify, $group, $alias, $auto_identify,
         // $app_download_click, …) are not conversions — never forward them to ad
         // pixels. (Previously they fired as noise custom events with the $ stripped.)
@@ -2932,16 +3153,31 @@ class ContainerManager {
         // Track to TikTok Pixel
         if (((_j = (_h = this.pixels) === null || _h === void 0 ? void 0 : _h.tiktok) === null || _j === void 0 ? void 0 : _j.enabled) && window.ttq) {
             try {
-                // Map common events to TikTok names
+                // Map our event names to TikTok's standard vocabulary. BUG FIX (TikTok-dead):
+                // this map was keyed on Meta-standard names ('Purchase') but looked up with the
+                // sanitized RAW event ('purchase'), so EVERY standard event missed and fired as
+                // a literal custom event (e.g. "purchase" instead of "CompletePayment") — all
+                // TikTok conversions were mis-categorized. Now keyed on the lowercased raw name
+                // and looked up the same way the Meta block does, with a workspace rule map first.
                 const tiktokEventMap = {
-                    'Purchase': 'CompletePayment',
-                    'AddToCart': 'AddToCart',
-                    'InitiateCheckout': 'InitiateCheckout',
-                    'ViewContent': 'ViewContent',
-                    'Search': 'Search',
-                    'Lead': 'SubmitForm'
+                    view_content: 'ViewContent', product_viewed: 'ViewContent', view_item: 'ViewContent',
+                    search: 'Search',
+                    add_to_wishlist: 'AddToWishlist',
+                    add_to_cart: 'AddToCart', product_added: 'AddToCart',
+                    initiate_checkout: 'InitiateCheckout', begin_checkout: 'InitiateCheckout', checkout_started: 'InitiateCheckout',
+                    add_payment_info: 'AddPaymentInfo',
+                    purchase: 'CompletePayment', order_completed: 'CompletePayment', order_paid: 'CompletePayment',
+                    place_an_order: 'PlaceAnOrder',
+                    contact: 'Contact',
+                    download: 'Download',
+                    lead: 'SubmitForm', submit_form: 'SubmitForm',
+                    complete_registration: 'CompleteRegistration', sign_up: 'CompleteRegistration', signup: 'CompleteRegistration',
+                    subscribe: 'Subscribe', subscription_created: 'Subscribe',
                 };
-                const tiktokEvent = tiktokEventMap[sanitizedEventName] || sanitizedEventName;
+                const tiktokRuleMap = (_l = (_k = this.pixels) === null || _k === void 0 ? void 0 : _k.tiktok) === null || _l === void 0 ? void 0 : _l.event_mappings;
+                const tiktokEvent = (tiktokRuleMap === null || tiktokRuleMap === void 0 ? void 0 : tiktokRuleMap[eventName])
+                    || tiktokEventMap[String(eventName).toLowerCase()]
+                    || sanitizedEventName;
                 window.ttq.track(tiktokEvent, sanitizedProperties);
             }
             catch (error) {
@@ -3090,10 +3326,11 @@ class AutoIdentifyManager {
         this.formListeners = [];
         this.lastIdentifyTime = 0;
         this.RATE_LIMIT_MS = 5000; // Don't auto-identify more than once per 5 seconds
+        this.destroyed = false; // set by destroy() (e.g. on opt-out) — stops any in-flight capture from re-persisting email
         this.config = {
             enabled: config.enabled !== false,
             captureFromForms: config.captureFromForms !== false,
-            captureFromAPI: config.captureFromAPI !== false,
+            captureFromAPI: config.captureFromAPI === true, // default OFF: same-origin response-scan can mis-identify (e.g. admin views)
             captureFromShopify: config.captureFromShopify !== false,
             trustedDomains: config.trustedDomains || [],
             debug: config.debug || false
@@ -3103,29 +3340,49 @@ class AutoIdentifyManager {
      * Initialize auto-identify system
      */
     initialize(identifyCallback) {
-        if (!this.config.enabled) {
-            this.log('Auto-identify disabled');
-            return;
-        }
-        this.identifyCallback = identifyCallback;
-        // Check if already identified
-        const existingEmail = storage.get('dl_auto_identified_email');
-        if (existingEmail) {
-            this.log('User already auto-identified:', existingEmail);
-            return;
-        }
-        // Setup monitoring
-        if (this.config.captureFromForms) {
-            this.setupFormMonitoring();
-        }
-        if (this.config.captureFromAPI) {
-            this.setupFetchInterception();
-            this.setupXHRInterception();
-        }
-        if (this.config.captureFromShopify) {
-            this.setupShopifyMonitoring();
-        }
-        this.log('Auto-identify initialized');
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!this.config.enabled) {
+                this.log('Auto-identify disabled');
+                return;
+            }
+            this.identifyCallback = identifyCallback;
+            // Check if already identified.
+            // WEB-5: the captured email is PII — store it AES-GCM-encrypted (consistent with
+            // dl_user_traits), not plaintext localStorage.
+            const existingEmail = yield storage.getEncrypted('dl_auto_identified_email');
+            if (existingEmail) {
+                // Migration: a value written by a pre-1.7.1 build is PLAINTEXT. getEncrypted
+                // returns it anyway — decrypt() has a backwards-compat fallback that hands back
+                // the raw string when AES decryption fails — so without this step the PII would
+                // stay in plaintext localStorage forever. Detect a legacy plaintext email by
+                // inspecting the RAW stored bytes (ciphertext is base64, so an '@' means it was
+                // never encrypted) and re-write it encrypted in place.
+                const raw = storage.get('dl_auto_identified_email');
+                if (typeof raw === 'string' && raw.includes('@')) {
+                    try {
+                        yield storage.setEncrypted('dl_auto_identified_email', existingEmail);
+                        this.log('Migrated legacy plaintext auto-identified email to encrypted storage');
+                    }
+                    catch (error) {
+                        this.log('Failed to migrate legacy auto-identified email:', error);
+                    }
+                }
+                this.log('User already auto-identified');
+                return;
+            }
+            // Setup monitoring
+            if (this.config.captureFromForms) {
+                this.setupFormMonitoring();
+            }
+            if (this.config.captureFromAPI) {
+                this.setupFetchInterception();
+                this.setupXHRInterception();
+            }
+            if (this.config.captureFromShopify) {
+                this.setupShopifyMonitoring();
+            }
+            this.log('Auto-identify initialized');
+        });
     }
     /**
      * Setup form monitoring for email capture
@@ -3281,10 +3538,21 @@ class AutoIdentifyManager {
         this.log('Shopify detected, setting up monitoring');
         // Try to fetch customer data immediately
         this.checkShopifyCustomer();
-        // Check periodically (in case customer logs in later)
+        // Check periodically (in case the customer logs in later), but CAP the attempts so a
+        // visitor who never logs in — the vast majority of storefront traffic — doesn't poll
+        // /account.json forever (it used to run every 10s for the whole session). A logged-in
+        // customer surfaces well within ~2 minutes. (WEB-10)
+        let checks = 0;
+        const MAX_CHECKS = 12; // ~2 minutes at 10s
         this.shopifyCheckInterval = setInterval(() => {
+            checks++;
             this.checkShopifyCustomer();
-        }, 10000); // Check every 10 seconds
+            if (checks >= MAX_CHECKS && this.shopifyCheckInterval) {
+                clearInterval(this.shopifyCheckInterval);
+                this.shopifyCheckInterval = undefined;
+                this.log('Shopify monitoring stopped after max checks (no login detected)');
+            }
+        }, 10000);
         this.log('Shopify monitoring active');
     }
     /**
@@ -3441,31 +3709,51 @@ class AutoIdentifyManager {
      * Trigger identify with rate limiting
      */
     triggerIdentify(email, source) {
-        // Rate limiting
-        const now = Date.now();
-        if (now - this.lastIdentifyTime < this.RATE_LIMIT_MS) {
-            this.log('Rate limited, skipping identify');
-            return;
-        }
-        // Check if already identified
-        const existingEmail = storage.get('dl_auto_identified_email');
-        if (existingEmail === email) {
-            this.log('Already identified with this email');
-            return;
-        }
-        // Store email to prevent duplicate identification
-        storage.set('dl_auto_identified_email', email);
-        this.lastIdentifyTime = now;
-        // Trigger callback
-        if (this.identifyCallback) {
-            this.log(`Auto-identifying user: ${email} (source: ${source})`);
-            this.identifyCallback(email, source);
-        }
+        return __awaiter(this, void 0, void 0, function* () {
+            if (this.destroyed)
+                return;
+            // Rate limiting
+            const now = Date.now();
+            if (now - this.lastIdentifyTime < this.RATE_LIMIT_MS) {
+                this.log('Rate limited, skipping identify');
+                return;
+            }
+            // Stamp the rate-limit timer synchronously, BEFORE the async storage calls below,
+            // so two near-simultaneous triggers can't both slip past into a double-identify
+            // (the storage read/write is now async — a window the old sync code didn't have).
+            this.lastIdentifyTime = now;
+            // Check if already identified.
+            // WEB-5: encrypted store (the email is PII at rest).
+            const existingEmail = yield storage.getEncrypted('dl_auto_identified_email');
+            if (existingEmail === email) {
+                this.log('Already identified with this email');
+                return;
+            }
+            // If we were destroyed (e.g. user opted out) during the async read above, do NOT
+            // re-persist the email or fire the callback.
+            if (this.destroyed)
+                return;
+            // Store email (encrypted) to prevent duplicate identification. Best-effort: a
+            // storage/encryption failure must not block the identify, since the identify
+            // event carries the email to the backend regardless.
+            try {
+                yield storage.setEncrypted('dl_auto_identified_email', email);
+            }
+            catch (error) {
+                this.log('Failed to persist auto-identified email:', error);
+            }
+            // Trigger callback
+            if (this.identifyCallback) {
+                this.log(`Auto-identifying user: ${email} (source: ${source})`);
+                this.identifyCallback(email, source);
+            }
+        });
     }
     /**
      * Destroy and cleanup
      */
     destroy() {
+        this.destroyed = true;
         // Restore original fetch
         if (this.originalFetch) {
             window.fetch = this.originalFetch;
@@ -3502,18 +3790,66 @@ class AutoIdentifyManager {
     }
 }
 
+/** Keys the remote config is allowed to fill on DatalyrConfig. */
+const REMOTE_KEYS = [
+    'autoIdentify',
+    'autoIdentifyForms',
+    'autoIdentifyAPI',
+    'autoIdentifyShopify',
+    'shopifyCartAttributes',
+    'checkoutChampDomains',
+    'respectGlobalPrivacyControl',
+    'respectDoNotTrack',
+    'privacyMode',
+];
+/**
+ * Fold `remote` into `config` IN PLACE. Precedence per key:
+ *   explicit init() value  >  remote (dashboard)  >  built-in default
+ *
+ * `explicitKeys` = the keys the CALLER passed to init() (before built-in
+ * defaults were merged in). For any remote key NOT in that set, remote
+ * OVERRIDES the built-in default. This is essential because some keys
+ * (respectDoNotTrack, respectGlobalPrivacyControl, privacyMode) get a built-in
+ * default at init() and are therefore never `undefined` — a naive
+ * "fill-if-undefined" would silently ignore the dashboard for them.
+ *
+ * No-op when there's no remote config (older worker / container disabled /
+ * failed fetch) — built-in defaults then stand.
+ */
+function applyRemoteConfig(config, remote, explicitKeys) {
+    if (!remote)
+        return;
+    const target = config;
+    for (const key of REMOTE_KEYS) {
+        const remoteVal = remote[key];
+        if (remoteVal === undefined || remoteVal === null)
+            continue;
+        // Explicit init() always wins; otherwise remote overrides the built-in default.
+        if (explicitKeys === null || explicitKeys === void 0 ? void 0 : explicitKeys.has(key))
+            continue;
+        target[key] = remoteVal;
+    }
+}
+
 /**
  * Datalyr Web SDK
  * Modern attribution tracking for web applications
  */
 class Datalyr {
     constructor() {
+        // Keys the caller passed to init() (before built-in defaults were merged).
+        // Lets the remote-config merge override built-in defaults while always
+        // deferring to an explicit init() value. See applyRemoteConfig.
+        this.explicitConfigKeys = new Set();
         this.superProperties = {};
         this.userProperties = {};
         this.optedOut = false;
+        // Consent preferences (setConsent). null = not set → no consent-based restriction.
+        this.consent = null;
         this.initialized = false;
         this.errors = [];
         this.MAX_ERRORS = 50;
+        this.lastSpaPath = null; // dedups SPA pageviews (replaceState-on-mount double-fire)
         // FIXED (ISSUE-01): Async initialization promise to prevent race conditions
         this.initializationPromise = null;
         // Opt-out check moved to init() after cookies configured (Issue #14)
@@ -3530,6 +3866,10 @@ class Datalyr {
         if (!config.workspaceId) {
             throw new Error('[Datalyr] workspaceId is required');
         }
+        // Snapshot the keys the caller explicitly set, BEFORE built-in defaults are
+        // merged in — so the remote-config merge can override built-in defaults
+        // while still deferring to anything the caller passed explicitly.
+        this.explicitConfigKeys = new Set(Object.keys(config));
         // Set default config values
         this.config = Object.assign({ endpoint: 'https://ingest.datalyr.com', debug: false, batchSize: 10, flushInterval: 5000, flushAt: 10, criticalEvents: undefined, highPriorityEvents: undefined, sessionTimeout: 60 * 60 * 1000, trackSessions: true, attributionWindow: 90 * 24 * 60 * 60 * 1000, trackedParams: [], respectDoNotTrack: false, respectGlobalPrivacyControl: true, privacyMode: 'standard', cookieDomain: 'auto', cookieExpires: 365, secureCookie: 'auto', sameSite: 'Lax', cookiePrefix: '__dl_', enablePerformanceTracking: true, enableFingerprinting: true, maxRetries: 5, retryDelay: 1000, maxOfflineQueueSize: 100, trackSPA: true, trackPageViews: true, fallbackEndpoints: [], plugins: [] }, config);
         // platform:'shopify' implies cart-attribute sync: stamp visitor_id + Meta
@@ -3551,6 +3891,9 @@ class Datalyr {
         storage.migrateFromLegacyPrefix();
         // Check opt-out AFTER cookies configured (Issue #14)
         this.optedOut = this.cookies.get('__dl_opt_out') === 'true';
+        // Load persisted consent so shouldTrack()/container gating honor it from the
+        // first event (setConsent persists it; see optOut for the enforcement on opt-out).
+        this.consent = storage.get('dl_consent', null);
         // CC funnel page entry: restore the _dl_* URL bridge BEFORE IdentityManager
         // initializes so the storefront's visitor_id is the one used here (instead
         // of auto-generating a fresh one on this domain).
@@ -3572,6 +3915,9 @@ class Datalyr {
         // Set session ID in identity manager
         const sessionId = this.session.getSessionId();
         this.identity.setSessionId(sessionId);
+        // Gate the queue by the FULL tracking policy (opt-out + analytics consent + DNT +
+        // GPC) so a returning opted-out / DNT / GPC visitor's persisted events don't drain.
+        this.queue.setEnabled(this.shouldTrack());
         // FIXED (ISSUE-01): Start async initialization immediately but don't block constructor
         // This allows encryption to initialize before any events are tracked
         this.initializeAsync();
@@ -3606,19 +3952,35 @@ class Datalyr {
                 return this.initializationPromise;
             }
             this.initializationPromise = (() => __awaiter(this, void 0, void 0, function* () {
+                var _a;
                 try {
-                    // SEC-03 Fix: Initialize encryption for PII data
-                    const deviceId = this.identity.getAnonymousId();
-                    yield dataEncryption.initialize(this.config.workspaceId, deviceId);
-                    // Load encrypted user properties
-                    this.userProperties = yield storage.getEncrypted('dl_user_traits', {});
-                    this.log('Encryption initialized, user properties loaded');
+                    // SEC-03: encryption is for PII-AT-REST only — it must NOT gate event delivery,
+                    // pageviews, or pixels. On a non-secure context (http://) or an old browser,
+                    // crypto.subtle is absent and initialize() throws; isolate it so the rest of init
+                    // (SPA tracking, container/pixels, initial pageview) still runs. (http:// fix)
+                    try {
+                        const deviceId = this.identity.getAnonymousId();
+                        yield dataEncryption.initialize(this.config.workspaceId, deviceId);
+                        this.userProperties = yield storage.getEncrypted('dl_user_traits', {});
+                        this.log('Encryption initialized, user properties loaded');
+                    }
+                    catch (encErr) {
+                        console.warn('[Datalyr] Encryption unavailable (non-secure context?); continuing WITHOUT PII-at-rest encryption:', encErr);
+                        this.userProperties = storage.get('dl_user_traits', {});
+                    }
                     // Setup SPA tracking if enabled
                     if (this.config.trackSPA) {
                         this.setupSPATracking();
                     }
-                    // Initialize container manager if enabled
-                    if (this.config.enableContainer !== false) {
+                    // Initialize container manager if enabled.
+                    // WEB-4 (privacy gate): the container loads third-party pixels (Meta/Google/
+                    // TikTok) and calls fbq('init', …, advancedMatching) with the visitor's
+                    // SHA-256 email/id — so it must NOT initialize for opted-out / DNT / GPC
+                    // visitors, nor when privacyMode is explicitly 'strict'. (Remote config can't
+                    // gate this: the container fetch is what delivers the remote config, so only
+                    // local consent signals + an explicit strict init() are knowable here.)
+                    const privacyStrict = this.config.privacyMode === 'strict';
+                    if (this.config.enableContainer !== false && this.shouldTrack() && !privacyStrict && this.consentAllowsMarketing()) {
                         this.container = new ContainerManager({
                             workspaceId: this.config.workspaceId,
                             endpoint: this.config.endpoint,
@@ -3651,6 +4013,16 @@ class Datalyr {
                             this.fireCheckoutChampPurchasePixel();
                         }
                     }
+                    // Fold the remote /container-scripts config UNDER explicit init()
+                    // overrides (precedence: defaults <- remote <- explicit). No-op if the
+                    // container is disabled or the worker didn't send `config`. This is what
+                    // makes the dashboard toggles take effect with no snippet edits.
+                    applyRemoteConfig(this.config, (_a = this.container) === null || _a === void 0 ? void 0 : _a.getRemoteConfig(), this.explicitConfigKeys);
+                    // Privacy-strict turns auto-identify (email capture) OFF regardless of
+                    // the dashboard/remote value — privacy wins over the bridge.
+                    if (this.config.privacyMode === 'strict') {
+                        this.config.autoIdentify = false;
+                    }
                     // autoIdentify default for the CC bridge:
                     // - platform === 'checkoutchamp' (CC funnel pages) OR
                     // - checkoutChampDomains set (Shopify storefronts feeding a CC funnel)
@@ -3661,8 +4033,10 @@ class Datalyr {
                     if (ccBridgeActive && this.config.autoIdentify === undefined) {
                         this.config.autoIdentify = true;
                     }
-                    // Initialize auto-identify if explicitly enabled (opt-in)
-                    if (this.config.autoIdentify === true) {
+                    // Initialize auto-identify when enabled (explicit or remote) AND
+                    // tracking is allowed. The shouldTrack() gate keeps capture from even
+                    // setting up its form/API interceptors for opted-out / DNT / GPC users.
+                    if (this.config.autoIdentify === true && this.shouldTrack()) {
                         this.autoIdentify = new AutoIdentifyManager({
                             enabled: true,
                             captureFromForms: this.config.autoIdentifyForms,
@@ -3688,7 +4062,7 @@ class Datalyr {
                     // Lets server-side order webhooks recover the browser visitor + Meta click
                     // signals (the postback webhook reads these as note_attributes). Inert unless
                     // enabled; best-effort and never blocks init.
-                    if (this.config.shopifyCartAttributes === true) {
+                    if (this.config.shopifyCartAttributes === true && this.shouldTrack()) {
                         this.syncShopifyCartAttributes().catch((error) => {
                             this.log('Shopify cart attribute sync failed:', error);
                         });
@@ -3696,7 +4070,9 @@ class Datalyr {
                     // Storefront → CC bridge: stamp _dl_* params on outbound links to the
                     // configured CC domains so visitor_id + click signals cross the domain
                     // boundary. Inert unless checkoutChampDomains is set.
-                    if (Array.isArray(this.config.checkoutChampDomains) && this.config.checkoutChampDomains.length > 0) {
+                    if (Array.isArray(this.config.checkoutChampDomains) && this.config.checkoutChampDomains.length > 0 && this.shouldTrack()) {
+                        // MED-4: gated on shouldTrack() (like syncShopifyCartAttributes) so an
+                        // opted-out / DNT / GPC visitor's id + click-ids aren't stamped on outbound links.
                         this.syncOutboundLinkParams(this.config.checkoutChampDomains);
                     }
                     // Track initial page view if enabled (AFTER encryption ready)
@@ -3781,51 +4157,56 @@ class Datalyr {
      * so the mobile SDK can retrieve them deterministically after install.
      */
     trackAppDownloadClick(options) {
-        if (!this.initialized) {
-            console.warn('[Datalyr] SDK not initialized. Call init() first.');
-            return;
-        }
-        if (!this.shouldTrack())
-            return;
-        // Fire the event with target platform info — attribution data is
-        // automatically merged by createEventPayload via getAttributionData()
-        this.track('$app_download_click', {
-            target_platform: options.targetPlatform,
-            app_store_url: options.appStoreUrl,
-        });
-        // Flush immediately via sendBeacon before page navigates away
-        this.queue.forceFlush();
-        // For Android: append referrer param to Play Store URL with click attribution
-        if (options.targetPlatform === 'android' && options.appStoreUrl.includes('play.google.com')) {
-            const lastTouch = this.attribution.getLastTouch();
-            const referrerParams = new URLSearchParams();
-            if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.clickId)
-                referrerParams.set('dl_click_id', lastTouch.clickId);
-            if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.clickIdType)
-                referrerParams.set('dl_click_id_type', lastTouch.clickIdType);
-            if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.source)
-                referrerParams.set('utm_source', lastTouch.source);
-            if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.medium)
-                referrerParams.set('utm_medium', lastTouch.medium);
-            if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.campaign)
-                referrerParams.set('utm_campaign', lastTouch.campaign);
-            if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.content)
-                referrerParams.set('utm_content', lastTouch.content);
-            if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.term)
-                referrerParams.set('utm_term', lastTouch.term);
-            try {
-                const url = new URL(options.appStoreUrl);
-                url.searchParams.set('referrer', referrerParams.toString());
-                window.location.href = url.toString();
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!this.initialized) {
+                console.warn('[Datalyr] SDK not initialized. Call init() first.');
+                return;
             }
-            catch (_a) {
-                // If URL parsing fails, redirect without referrer
+            if (!this.shouldTrack())
+                return;
+            // Fire the event with target platform info — attribution data is
+            // automatically merged by createEventPayload via getAttributionData()
+            this.track('$app_download_click', {
+                target_platform: options.targetPlatform,
+                app_store_url: options.appStoreUrl,
+            });
+            // AWAIT the flush before navigating away (M5). sendBeacon dispatches synchronously,
+            // but on browsers WITHOUT sendBeacon forceFlush falls back to a keepalive fetch —
+            // and the synchronous window.location assignment below would tear the page down
+            // before that fetch dispatched, losing the click event.
+            yield this.queue.forceFlush();
+            // For Android: append referrer param to Play Store URL with click attribution
+            if (options.targetPlatform === 'android' && options.appStoreUrl.includes('play.google.com')) {
+                const lastTouch = this.attribution.getLastTouch();
+                const referrerParams = new URLSearchParams();
+                if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.clickId)
+                    referrerParams.set('dl_click_id', lastTouch.clickId);
+                if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.clickIdType)
+                    referrerParams.set('dl_click_id_type', lastTouch.clickIdType);
+                if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.source)
+                    referrerParams.set('utm_source', lastTouch.source);
+                if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.medium)
+                    referrerParams.set('utm_medium', lastTouch.medium);
+                if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.campaign)
+                    referrerParams.set('utm_campaign', lastTouch.campaign);
+                if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.content)
+                    referrerParams.set('utm_content', lastTouch.content);
+                if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.term)
+                    referrerParams.set('utm_term', lastTouch.term);
+                try {
+                    const url = new URL(options.appStoreUrl);
+                    url.searchParams.set('referrer', referrerParams.toString());
+                    window.location.href = url.toString();
+                }
+                catch (_a) {
+                    // If URL parsing fails, redirect without referrer
+                    window.location.href = options.appStoreUrl;
+                }
+            }
+            else {
                 window.location.href = options.appStoreUrl;
             }
-        }
-        else {
-            window.location.href = options.appStoreUrl;
-        }
+        });
     }
     /**
      * Identify a user
@@ -3890,6 +4271,17 @@ class Datalyr {
         }
         if (!this.shouldTrack())
             return;
+        // WEB-6: record one customer-journey touchpoint per session so touchpoint_count /
+        // days_since_first_touch become real multi-touch signals (addTouchpoint had no
+        // callers before, so the journey was always empty). Dedup against the PERSISTED
+        // journey (not an in-memory field) so a hard page reload within the same session
+        // doesn't append a duplicate touchpoint on a classic multi-page site.
+        const sid = this.session.getSessionId();
+        const journey = this.attribution.getJourney();
+        const lastTouchpoint = journey.length ? journey[journey.length - 1] : null;
+        if (!lastTouchpoint || lastTouchpoint.sessionId !== sid) {
+            this.attribution.addTouchpoint(sid, this.attribution.captureAttribution());
+        }
         const pageData = Object.assign({ title: document.title, url: window.location.href, path: window.location.pathname, search: window.location.search, referrer: document.referrer }, properties);
         // Add referrer data
         const referrerData = getReferrerData();
@@ -3938,6 +4330,8 @@ class Datalyr {
             console.warn('[Datalyr] SDK not initialized. Call init() first.');
             return;
         }
+        if (!this.shouldTrack())
+            return;
         this.track('$group', {
             group_id: groupId,
             traits
@@ -3951,6 +4345,13 @@ class Datalyr {
             console.warn('[Datalyr] SDK not initialized. Call init() first.');
             return;
         }
+        if (!userId) {
+            console.warn('[Datalyr] alias() requires a non-empty userId');
+            return;
+        }
+        // Gate before mutating persisted identity (identity.alias writes dl_user_id).
+        if (!this.shouldTrack())
+            return;
         const aliasData = this.identity.alias(userId, previousId);
         this.track('$alias', aliasData);
     }
@@ -3964,7 +4365,17 @@ class Datalyr {
         }
         this.identity.reset();
         this.userProperties = {};
+        // Clear super properties too — they'd otherwise keep attaching the previous user's
+        // values to the next user's events (cross-user contamination on shared devices).
+        this.superProperties = {};
         storage.remove('dl_user_traits');
+        // Clear the auto-identify guard so a different user on the same browser is
+        // re-captured (it short-circuits while dl_auto_identified_email is present), and so
+        // the prior user's email isn't left at rest after logout.
+        storage.remove('dl_auto_identified_email');
+        // Clear the journey too, or the next user's touchpoints append to the previous
+        // user's (cross-user contamination of touchpoint_count / days_since_first_touch).
+        storage.remove('dl_journey');
         this.session.createNewSession();
         this.log('User reset');
     }
@@ -4075,19 +4486,44 @@ class Datalyr {
     setAttribution(attribution) {
         const current = this.attribution.captureAttribution();
         const merged = Object.assign(Object.assign({}, current), attribution);
+        // M6: actually make this affect events. Previously it only wrote a session key that
+        // NOTHING in the event path reads, so setAttribution() was a silent no-op. Route it
+        // through the AttributionManager so last_touch_* reflects it (and first_touch_* when
+        // none is set yet — storeFirstTouch is immutable-unless-expired, so it won't clobber
+        // an existing first touch).
+        this.attribution.storeLastTouch(merged);
+        this.attribution.storeFirstTouch(merged);
         this.session.storeAttribution(merged);
     }
     /**
      * Opt out of tracking
      */
     optOut() {
+        var _a;
         if (!this.initialized) {
             console.warn('[Datalyr] SDK not initialized. Call init() first.');
             return;
         }
         this.optedOut = true;
         this.cookies.set('__dl_opt_out', 'true', this.config.cookieExpires);
+        // Stop the queue from sending OR draining anything persisted before opt-out, and
+        // purge what's already buffered (the periodic/on-load drain has no other gate).
+        this.queue.setEnabled(false);
         this.queue.clear();
+        this.queue.clearOffline();
+        // Tear down auto-identify so it stops capturing email into storage post-opt-out.
+        (_a = this.autoIdentify) === null || _a === void 0 ? void 0 : _a.destroy();
+        this.autoIdentify = undefined;
+        // Stop forwarding to (and drop) third-party pixels for this visitor.
+        if (this.container) {
+            this.container.cleanupAllIframes();
+            this.container = undefined;
+        }
+        // Purge PII at rest.
+        this.userProperties = {};
+        storage.remove('dl_user_traits');
+        storage.remove('dl_auto_identified_email');
+        storage.remove('dl_journey');
         this.log('User opted out');
     }
     /**
@@ -4100,6 +4536,10 @@ class Datalyr {
         }
         this.optedOut = false;
         this.cookies.set('__dl_opt_out', 'false', this.config.cookieExpires);
+        // Re-enable only if the full policy now allows (analytics consent + DNT/GPC), not
+        // merely because opt-out was lifted — otherwise a GPC/DNT visitor's persisted
+        // events would start draining again. (Pixels / auto-identify resume on next load.)
+        this.queue.setEnabled(this.shouldTrack());
         this.log('User opted in');
     }
     /**
@@ -4112,7 +4552,26 @@ class Datalyr {
      * Set consent preferences
      */
     setConsent(consent) {
+        this.consent = consent;
         storage.set('dl_consent', consent);
+        // Enforce it live (not just persist it). Gate the queue by the full policy
+        // (analytics consent + opt-out + DNT/GPC), and on withdrawal purge buffered events
+        // too — mirroring optOut — so events captured before withdrawal can't drain if
+        // consent is later re-granted.
+        const allowed = this.shouldTrack();
+        this.queue.setEnabled(allowed);
+        if (!allowed) {
+            this.queue.clear();
+            this.queue.clearOffline();
+        }
+        // Marketing / "do not sell" withdrawal: stop FEEDING the third-party pixels and
+        // prevent them from being initialized on the next page load. NOTE: an
+        // already-injected pixel global (fbq/gtag/ttq) keeps running in the page — we
+        // can't fully unload a third-party script mid-session; full removal is on reload.
+        if (!this.consentAllowsMarketing() && this.container) {
+            this.container.cleanupAllIframes();
+            this.container = undefined;
+        }
         this.log('Consent updated:', consent);
     }
     /**
@@ -4478,18 +4937,21 @@ class Datalyr {
             };
             const observer = new MutationObserver(scheduleRestamp);
             observer.observe(document.documentElement, { childList: true, subtree: true });
-            // Observer + click listener live for the session; pagehide cleans up on
-            // full-page unload. SPA route changes are fine — we WANT stamping to keep
-            // working across virtual navigations.
-            window.addEventListener("pagehide", () => {
+            // Observer + click listener live for the session; pagehide cleans up on full-page
+            // unload, and destroy() can tear them down early via this disposer (H2 — otherwise
+            // a destroy()+re-init() leaks the observer + capturing click listener).
+            this.outboundDisposer = () => {
                 try {
                     observer.disconnect();
                 }
                 catch ( /* idempotent */_a) { /* idempotent */ }
-                if (restampTimer != null)
+                if (restampTimer != null) {
                     clearTimeout(restampTimer);
+                    restampTimer = null;
+                }
                 document.removeEventListener("click", onClick, true);
-            }, { once: true });
+            };
+            window.addEventListener("pagehide", () => { var _a; return (_a = this.outboundDisposer) === null || _a === void 0 ? void 0 : _a.call(this); }, { once: true });
         }
         catch (error) {
             this.log("MutationObserver setup failed (CC link sync):", error);
@@ -4500,6 +4962,12 @@ class Datalyr {
      * Create event payload
      */
     createEventPayload(eventName, properties, eventIdArg) {
+        // NEW-2: keep the identity's cached session id in lockstep with the LIVE session.
+        // The session id changes on identify() (rotateSessionId) and on session timeout, but
+        // identity only synced it at init/start — so the top-level payload.session_id (from
+        // identity) disagreed with event_data.session_id (from session.getMetrics()). Sync
+        // here, before reading either, so every event carries a single consistent session id.
+        this.identity.setSessionId(this.session.getSessionId());
         // Sanitize and merge properties
         const sanitizedProperties = sanitizeEventData(properties);
         const eventData = deepMerge({}, this.superProperties, sanitizedProperties);
@@ -4556,7 +5024,7 @@ class Datalyr {
             resolution_method: 'browser_sdk',
             resolution_confidence: 1.0,
             // SDK metadata (keep in sync with package.json version)
-            sdk_version: '1.6.5',
+            sdk_version: '1.7.1',
             sdk_name: 'datalyr-web-sdk'
         };
         return payload;
@@ -4569,6 +5037,10 @@ class Datalyr {
         if (this.optedOut) {
             return false;
         }
+        // Explicit analytics-consent withdrawal (setConsent) blocks first-party tracking.
+        if (this.consent && this.consent.analytics === false) {
+            return false;
+        }
         // Check Do Not Track
         if (this.config.respectDoNotTrack && isDoNotTrackEnabled()) {
             return false;
@@ -4579,6 +5051,14 @@ class Datalyr {
         }
         return true;
     }
+    /**
+     * Whether marketing/third-party pixels are allowed. Withdrawing `marketing` or `sale`
+     * (CCPA "do not sell") consent via setConsent() blocks loading the Meta/Google/TikTok
+     * pixels (which share data). No consent set = allowed (default).
+     */
+    consentAllowsMarketing() {
+        return !this.consent || (this.consent.marketing !== false && this.consent.sale !== false);
+    }
     /**
      * Setup SPA tracking
      * Fixed Issue #15: Store original methods for cleanup
@@ -4589,56 +5069,55 @@ class Datalyr {
         this.originalPushState = history.pushState;
         this.originalReplaceState = history.replaceState;
         const self = this;
+        // Seed with the current URL so a router's replaceState-on-mount (same URL) doesn't
+        // fire a duplicate pageview on top of the initial page() call. (M2/M3)
+        this.lastSpaPath = window.location.pathname + window.location.search + window.location.hash;
         // Override pushState
         history.pushState = function (...args) {
             self.originalPushState.apply(history, args);
-            setTimeout(() => {
-                // Clear attribution cache to capture fresh URL params
-                self.attribution.clearCache();
-                self.page();
-            }, 0);
+            setTimeout(() => self.handleSpaNavigation(), 0);
         };
         // Override replaceState
         history.replaceState = function (...args) {
             self.originalReplaceState.apply(history, args);
-            setTimeout(() => {
-                // Clear attribution cache to capture fresh URL params
-                self.attribution.clearCache();
-                self.page();
-            }, 0);
+            setTimeout(() => self.handleSpaNavigation(), 0);
         };
         // Listen for popstate
-        this.popstateHandler = () => {
-            setTimeout(() => {
-                // Clear attribution cache to capture fresh URL params
-                self.attribution.clearCache();
-                self.page();
-            }, 0);
-        };
+        this.popstateHandler = () => { setTimeout(() => self.handleSpaNavigation(), 0); };
         window.addEventListener('popstate', this.popstateHandler);
         // Listen for hashchange
-        this.hashchangeHandler = () => {
-            // Clear attribution cache to capture fresh URL params
-            self.attribution.clearCache();
-            self.page();
-        };
+        this.hashchangeHandler = () => { self.handleSpaNavigation(); };
         window.addEventListener('hashchange', this.hashchangeHandler);
     }
+    /**
+     * Handle an SPA virtual navigation. Dedups consecutive same-URL fires (M2/M3): many
+     * routers call history.replaceState on mount/hydration, which previously fired a
+     * SECOND `pageview` on top of the initial `page()`. Only fires when the full URL
+     * (path+search+hash) actually changed.
+     */
+    handleSpaNavigation() {
+        const path = window.location.pathname + window.location.search + window.location.hash;
+        if (path === this.lastSpaPath)
+            return;
+        this.lastSpaPath = path;
+        this.attribution.clearCache();
+        this.page();
+    }
     /**
      * Setup page unload handler
      */
     setupUnloadHandler() {
-        // Use both events for maximum compatibility
-        const handleUnload = () => {
-            this.queue.forceFlush();
+        // Store refs so destroy() can remove these — otherwise a destroy()+re-init() cycle
+        // leaks listeners that keep firing forceFlush() on the OLD (destroyed) queue. (H2)
+        this.unloadHandler = () => { this.queue.forceFlush(); };
+        this.visibilityHandler = () => {
+            if (document.visibilityState === 'hidden')
+                this.queue.forceFlush();
         };
-        window.addEventListener('beforeunload', handleUnload);
-        window.addEventListener('pagehide', handleUnload);
-        window.addEventListener('visibilitychange', () => {
-            if (document.visibilityState === 'hidden') {
-                handleUnload();
-            }
-        });
+        // Use multiple events for maximum compatibility.
+        window.addEventListener('beforeunload', this.unloadHandler);
+        window.addEventListener('pagehide', this.unloadHandler);
+        window.addEventListener('visibilitychange', this.visibilityHandler);
     }
     /**
      * Get performance metrics
@@ -4743,6 +5222,22 @@ class Datalyr {
         if (this.hashchangeHandler) {
             window.removeEventListener('hashchange', this.hashchangeHandler);
         }
+        // H2: also remove the unload/visibility listeners and tear down the CC outbound-link
+        // observer/listener — these were leaking across destroy()+re-init(), keeping the OLD
+        // queue alive and firing on every navigation.
+        if (this.unloadHandler) {
+            window.removeEventListener('beforeunload', this.unloadHandler);
+            window.removeEventListener('pagehide', this.unloadHandler);
+            this.unloadHandler = undefined;
+        }
+        if (this.visibilityHandler) {
+            window.removeEventListener('visibilitychange', this.visibilityHandler);
+            this.visibilityHandler = undefined;
+        }
+        if (this.outboundDisposer) {
+            this.outboundDisposer();
+            this.outboundDisposer = undefined;
+        }
         // Clean up queue
         if (this.queue) {
             this.queue.destroy();
@@ -4761,6 +5256,13 @@ class Datalyr {
         }
         // SEC-03 Fix: Clean up encryption keys
         dataEncryption.destroy();
+        // H3: reset init state so a subsequent init() fully re-runs. Without nulling the
+        // initializationPromise, initializeAsync() early-returns the stale (resolved)
+        // promise and the SDK comes back half-initialized (no container/pixels/SPA/pageview).
+        this.initializationPromise = null;
+        this.container = undefined;
+        this.autoIdentify = undefined;
+        this.lastSpaPath = null;
         // Clear any remaining data
         this.superProperties = {};
         this.userProperties = {};