@datalyr/web 1.6.5 → 1.7.1

package/dist/datalyr.js

@@ -1,5 +1,5 @@
 /**
- * @datalyr/web v1.6.5
+ * @datalyr/web v1.7.1
  * Datalyr Web SDK - Modern attribution tracking for web applications
  * (c) 2026 Datalyr Inc.
  * Released under the MIT License
@@ -1411,13 +1411,19 @@ var Datalyr = (function (exports) {
                     attribution[key] = value;
                 }
             }
-            // Capture click IDs
+            // Capture click IDs. The first present (by CLICK_IDS priority) is the primary
+            // clickId/clickIdType, but ALSO capture every present click ID as its own named
+            // field — a single URL can carry both fbclid and gclid (redirect chains, forwarded
+            // / re-shared links), and keeping only the first dropped the others' platform
+            // attribution entirely. (WEB NEW-3)
             for (const clickId of this.CLICK_IDS) {
                 const value = params[clickId];
                 if (value) {
-                    attribution.clickId = value;
-                    attribution.clickIdType = clickId;
-                    break; // Use first found click ID
+                    if (!attribution.clickId) {
+                        attribution.clickId = value;
+                        attribution.clickIdType = clickId;
+                    }
+                    attribution[clickId] = value;
                 }
             }
             // Capture custom tracked parameters
@@ -1547,7 +1553,10 @@ var Datalyr = (function (exports) {
             // Generate _fbp if missing (Facebook browser ID)
             if (!adCookies._fbp && (this.hasClickId('fbclid') || adCookies._fbc)) {
                 const timestamp = Date.now();
-                const randomId = Math.random().toString(36).substring(2, 15);
+                // Meta's _fbp format is fb.1.<creationTimeMs>.<randomNumber> where the last
+                // segment MUST be a decimal integer. The old base36 string was non-conformant —
+                // Meta ignores it (and it can shadow a real _fbp), degrading EMQ. (WEB-17)
+                const randomId = Math.floor(Math.random() * 1e10).toString();
                 adCookies._fbp = `fb.1.${timestamp}.${randomId}`;
                 // Optionally set the cookie for future use
                 cookies.set('_fbp', adCookies._fbp, 90);
@@ -1606,23 +1615,30 @@ var Datalyr = (function (exports) {
             const lastTouch = this.getLastTouch();
             const journey = this.getJourney();
             let current = this.captureAttribution();
-            // CRITICAL FIX: If current session has no attribution (direct/organic),
-            // fallback to persistent attribution from localStorage (90-day window)
-            const hasCurrentAttribution = !!(current.source || current.medium || current.clickId || current.campaign);
-            if (!hasCurrentAttribution && firstTouch) {
-                // Check if persistent attribution is still valid
+            // A "real" attribution signal on THIS pageview = a click ID, a UTM/campaign, or a
+            // referrer/UTM-derived source. determineSource()/determineMedium() FLOOR to
+            // 'direct'/'none', so the mere presence of current.source/medium is NOT a signal.
+            // The old `hasCurrentAttribution` (truthy because source is always at least 'direct')
+            // made the fallback below dead code AND caused storeLastTouch to overwrite a real
+            // paid last-touch with 'direct'/'none' on the next internal navigation. (WEB NEW-1)
+            const hasRealAttribution = !!(current.clickId ||
+                current.campaign ||
+                (current.source && current.source !== 'direct'));
+            if (!hasRealAttribution && firstTouch) {
+                // Direct / internal navigation: fall back to persistent attribution (90-day
+                // window) so the event isn't mis-attributed to 'direct', keeping page context.
                 if (!firstTouch.expires_at || Date.now() < firstTouch.expires_at) {
-                    // Use persistent attribution but keep current page context
                     current = Object.assign(Object.assign({}, firstTouch), { referrer: current.referrer, referrerHost: current.referrerHost, landingPage: current.landingPage, landingPath: current.landingPath });
                 }
             }
             // Capture advertising cookies automatically
             const adCookies = this.captureAdCookies();
-            // Update first/last touch if needed
-            if (!firstTouch && Object.keys(current).length > 1) {
+            // Only (re)write first/last touch when this pageview carried a REAL signal — never
+            // overwrite stored attribution with the 'direct'/'none' floor of an internal nav.
+            if (!firstTouch && hasRealAttribution) {
                 this.storeFirstTouch(current);
             }
-            if (Object.keys(current).length > 1) {
+            if (hasRealAttribution) {
                 this.storeLastTouch(current);
             }
             return Object.assign(Object.assign(Object.assign({}, current), adCookies), { 
@@ -1659,6 +1675,15 @@ var Datalyr = (function (exports) {
             // Check referrer
             if (attribution.referrerHost) {
                 const host = attribution.referrerHost.toLowerCase();
+                // Same-site referrer = internal navigation, NOT a new acquisition source.
+                // Without this, a full-page internal nav (referrer = our own domain, common on
+                // classic multi-page stores) classifies as 'referral', which makes
+                // hasRealAttribution true and overwrites the real paid last-touch. Treat it as
+                // direct so the last-touch guard preserves the genuine source.
+                const currentHost = (typeof window !== 'undefined' ? window.location.hostname : '').toLowerCase();
+                if (currentHost && (host === currentHost || this.isSameRootDomain(host, currentHost))) {
+                    return 'direct';
+                }
                 // Social sources
                 if (host.includes('facebook.com') || host.includes('fb.com'))
                     return 'facebook';
@@ -1716,6 +1741,16 @@ var Datalyr = (function (exports) {
             }
             return 'referral';
         }
+        /**
+         * Whether two hosts share the same root domain (eTLD+1 approximation), so that
+         * cross-subdomain internal navigation (e.g. shop.example.com → checkout.example.com)
+         * is also treated as same-site. Not a full public-suffix parse — good enough to keep
+         * internal navs from being mis-classified as referral.
+         */
+        isSameRootDomain(a, b) {
+            const root = (h) => h.split('.').slice(-2).join('.');
+            return root(a) === root(b);
+        }
         /**
          * Extract hostname from URL
          */
@@ -1757,6 +1792,11 @@ var Datalyr = (function (exports) {
     const DEFAULT_CRITICAL_EVENTS = ['purchase', 'signup', 'subscribe', 'lead', 'conversion'];
     // Default high priority events that use faster batching
     const DEFAULT_HIGH_PRIORITY_EVENTS = ['add_to_cart', 'begin_checkout', 'view_item', 'search'];
+    // A 429 is a deliberate backpressure signal, not a transient failure — tagged so the
+    // send path can route it to the offline queue WITHOUT retrying (which would storm the
+    // already-overloaded server). See sendBatch / the rateLimitedUntil gate.
+    class RateLimitError extends Error {
+    }
     class EventQueue {
         constructor(config) {
             this.queue = [];
@@ -1769,18 +1809,29 @@ var Datalyr = (function (exports) {
             this.OFFLINE_QUEUE_KEY = 'dl_offline_queue';
             this.flushLock = false; // FIXED (DATA-03): Mutex to prevent race conditions
             this.offlineQueueLock = false; // FIXED (DATA-03): Separate lock for offline queue operations
+            this.offlineProcessing = false; // FIXED (WEB-1): re-entrancy guard for processOfflineQueue
+            this.inFlight = []; // FIXED (WEB-3): batch currently in _flight's keepalive fetch — forceFlush must NOT re-beacon it
+            this.enabled = true; // FIXED (consent): when false (opt-out / withdrawn analytics consent) all enqueue/flush/drain is a no-op
+            this.rateLimitedUntil = 0; // FIXED (429): skip flush/drain until the server's Retry-After window passes
+            // Coerce numeric config to sane values. The old `config.X || default` both turned a
+            // legitimate 0 into the default AND let invalid values through — a NEGATIVE batchSize
+            // made processOfflineQueue's `splice(0, -1)` loop forever and FREEZE the host tab.
+            const clampInt = (v, def, min, max) => {
+                const n = Number(v);
+                return Number.isFinite(n) ? Math.min(Math.max(Math.floor(n), min), max) : def;
+            };
             this.config = {
-                batchSize: config.batchSize || 10,
-                flushInterval: config.flushInterval || 5000,
-                maxRetries: config.maxRetries || 5,
-                retryDelay: config.retryDelay || 1000,
+                batchSize: clampInt(config.batchSize, 10, 1, 1000),
+                flushInterval: clampInt(config.flushInterval, 5000, 250, 3600000),
+                maxRetries: clampInt(config.maxRetries, 5, 0, 20),
+                retryDelay: clampInt(config.retryDelay, 1000, 0, 60000),
                 endpoint: config.endpoint || 'https://ingest.datalyr.com',
-                fallbackEndpoints: config.fallbackEndpoints || [],
+                fallbackEndpoints: Array.isArray(config.fallbackEndpoints) ? config.fallbackEndpoints : [],
                 workspaceId: config.workspaceId,
                 debug: config.debug || false,
                 criticalEvents: config.criticalEvents || DEFAULT_CRITICAL_EVENTS,
                 highPriorityEvents: config.highPriorityEvents || DEFAULT_HIGH_PRIORITY_EVENTS,
-                maxOfflineQueueSize: config.maxOfflineQueueSize || 100
+                maxOfflineQueueSize: clampInt(config.maxOfflineQueueSize, 100, 1, 100000)
             };
             this.networkStatus = {
                 isOnline: navigator.onLine !== false,
@@ -1790,11 +1841,22 @@ var Datalyr = (function (exports) {
             this.loadOfflineQueue();
             this.setupNetworkListeners();
             this.startPeriodicFlush();
+            // WEB-1: a previous session may have left events in the persisted offline queue.
+            // The 'online' listener only fires on an offline→online TRANSITION, which never
+            // happens for a visitor who returns already-online — so drain on startup too,
+            // otherwise those events (incl. failed revenue conversions) just age out.
+            if (this.networkStatus.isOnline && this.offlineQueue.length > 0) {
+                setTimeout(() => this.processOfflineQueue(), 1000);
+            }
         }
         /**
          * Add event to queue
          */
         enqueue(event) {
+            // Consent gate: opt-out / withdrawn analytics consent stops all sending. (The SDK
+            // also gates at track(), but this is the backstop for anything that reaches here.)
+            if (!this.enabled)
+                return;
             const eventName = event.event_name; // Use snake_case
             // Check for duplicates (within 500ms window)
             if (this.isDuplicateEvent(event)) {
@@ -1893,6 +1955,11 @@ var Datalyr = (function (exports) {
          */
         flush() {
             return __awaiter(this, void 0, void 0, function* () {
+                if (!this.enabled)
+                    return;
+                // FIXED (429): respect the server's Retry-After window instead of hammering it.
+                if (Date.now() < this.rateLimitedUntil)
+                    return;
                 // FIXED (DATA-03): Check both promise and lock for concurrent flush protection
                 if (this.flushPromise || this.flushLock) {
                     return this.flushPromise || Promise.resolve();
@@ -1934,6 +2001,12 @@ var Datalyr = (function (exports) {
                 // Only remove after successful send to prevent data loss
                 const batchSize = Math.min(this.config.batchSize, this.queue.length);
                 const events = this.queue.slice(0, batchSize);
+                // WEB-3 (HIGH-1): mark this batch as in-flight. sendBatch's fetch uses
+                // keepalive:true, so it survives an unload that fires mid-flush — forceFlush
+                // reads `inFlight` to avoid re-beaconing the very events this fetch is sending.
+                // `inFlight` is always the FRONT `batchSize` of this.queue while flushLock holds
+                // (enqueue only pushes to the back; flushLock serializes _flush bodies).
+                this.inFlight = events;
                 try {
                     yield this.sendBatch(events);
                     // SUCCESS: Now it's safe to remove events from queue
@@ -1942,10 +2015,17 @@ var Datalyr = (function (exports) {
                 }
                 catch (error) {
                     this.log('Failed to send batch:', error);
-                    // Don't remove from queue - events stay for retry
-                    // Move to offline queue for persistent storage
+                    // WEB-8: make the offline queue the SINGLE owner of these events. Previously
+                    // they stayed in the live queue AND were copied to the offline queue, so a
+                    // later success on both paths double-sent (relying on server-side dedup).
+                    // Remove the same slice from the live queue; the offline queue now drains on
+                    // every periodic tick (WEB-1/WEB-2), so they are still retried, not stranded.
+                    this.queue.splice(0, batchSize);
                     this.moveToOfflineQueue(events);
                 }
+                finally {
+                    this.inFlight = [];
+                }
             });
         }
         /**
@@ -1975,21 +2055,27 @@ var Datalyr = (function (exports) {
                         // Handle rate limiting
                         if (response.status === 429) {
                             const retryAfter = parseInt(response.headers.get('Retry-After') || '60');
-                            this.log(`Rate limited, retrying after ${retryAfter}s`);
-                            // FIXED (CRITICAL-06): Don't unshift() - events are still in queue!
-                            // With the new fix, events aren't removed until success, so they're
-                            // already in the queue. Just schedule a retry flush.
-                            setTimeout(() => {
-                                this.flush();
-                            }, retryAfter * 1000);
-                            // Throw to trigger catch block which moves events to offline queue
-                            throw new Error(`Rate limited (429), retry after ${retryAfter}s`);
+                            // FIXED (429 retry-storm): honor Retry-After as a SINGLE backoff window. The
+                            // old code scheduled a flush AND let the throw fall into the generic
+                            // exponential-backoff retry below — firing ~6 requests inside the window the
+                            // server asked us to wait, amplifying an ingest overload. Now: record the
+                            // window and throw a RateLimitError (which the catch does NOT retry). The
+                            // events move to the offline queue and drain once the window passes.
+                            this.rateLimitedUntil = Date.now() + Math.max(retryAfter, 1) * 1000;
+                            this.log(`Rate limited; backing off ${retryAfter}s`);
+                            throw new RateLimitError('Rate limited (429)');
                         }
                         throw new Error(`HTTP ${response.status}: ${response.statusText}`);
                     }
                     this.log(`Batch sent successfully to ${currentEndpoint}: ${events.length} events`);
                 }
                 catch (error) {
+                    // A 429 is deliberate backpressure — do NOT retry it here (neither fallback nor
+                    // backoff). Propagate so the batch moves to the offline queue; the periodic drain
+                    // resumes only after rateLimitedUntil. This is what prevents the retry storm.
+                    if (error instanceof RateLimitError) {
+                        throw error;
+                    }
                     // Try next fallback endpoint if available
                     if (endpointIndex < endpoints.length - 1) {
                         this.log(`Failed on ${currentEndpoint}, trying fallback ${endpointIndex + 1}`);
@@ -2031,6 +2117,13 @@ var Datalyr = (function (exports) {
                 if (this.queue.length > 0) {
                     this.flush();
                 }
+                // WEB-1/WEB-2: also drain persisted offline events (including failed critical
+                // events that enqueue() parked here) on every tick — not only on an 'online'
+                // transition that may never fire. This is what gives parked purchase/lead
+                // events a retry path while the user stays online.
+                if (this.networkStatus.isOnline && this.offlineQueue.length > 0) {
+                    this.processOfflineQueue();
+                }
             }, this.config.flushInterval);
         }
         /**
@@ -2049,6 +2142,12 @@ var Datalyr = (function (exports) {
          * FIXED (CRITICAL-06): Can now accept specific events or move entire queue
          */
         moveToOfflineQueue(events) {
+            // Consent leak fix: do NOT persist for a disabled queue. Without this, an
+            // in-flight _flush (or critical-event send) that FAILS after optOut() has purged
+            // the offline queue would re-write the PII-bearing event to storage AFTER the
+            // purge. Gating here (a persistence sink, not just the send sinks) closes it.
+            if (!this.enabled)
+                return;
             // FIXED (DATA-03): Check if offline queue operation already in progress
             if (this.offlineQueueLock) {
                 console.warn('[Datalyr Queue] Offline queue operation already in progress');
@@ -2092,6 +2191,10 @@ var Datalyr = (function (exports) {
          * Save offline queue to storage
          */
         saveOfflineQueue() {
+            // Defense-in-depth twin of the moveToOfflineQueue gate: never write PII to disk
+            // for a disabled (opted-out) queue.
+            if (!this.enabled)
+                return;
             // Keep max events based on config
             const toSave = this.offlineQueue.slice(-this.config.maxOfflineQueueSize);
             storage.set(this.OFFLINE_QUEUE_KEY, toSave);
@@ -2101,25 +2204,46 @@ var Datalyr = (function (exports) {
          */
         processOfflineQueue() {
             return __awaiter(this, void 0, void 0, function* () {
+                // WEB-1: guard against re-entrancy. This is now driven from three places (the
+                // 'online' listener, the periodic flush, and the on-load kick); without a guard
+                // two of them could splice the same offlineQueue concurrently and double-send.
+                if (!this.enabled)
+                    return;
+                if (Date.now() < this.rateLimitedUntil)
+                    return; // FIXED (429): honor Retry-After window
+                if (this.offlineProcessing)
+                    return;
                 if (this.offlineQueue.length === 0)
                     return;
-                this.log(`Processing ${this.offlineQueue.length} offline events`);
-                while (this.offlineQueue.length > 0) {
-                    const batch = this.offlineQueue.splice(0, this.config.batchSize);
-                    try {
-                        yield this.sendBatch(batch);
-                        this.saveOfflineQueue();
+                if (!this.networkStatus.isOnline)
+                    return;
+                this.offlineProcessing = true;
+                try {
+                    this.log(`Processing ${this.offlineQueue.length} offline events`);
+                    while (this.offlineQueue.length > 0) {
+                        // Stop mid-drain if disabled (opt-out during an active drain) — otherwise the
+                        // unshift-on-failure below would re-persist a batch after optOut's purge.
+                        if (!this.enabled)
+                            break;
+                        const batch = this.offlineQueue.splice(0, this.config.batchSize);
+                        try {
+                            yield this.sendBatch(batch);
+                            this.saveOfflineQueue();
+                        }
+                        catch (error) {
+                            this.log('Failed to send offline batch:', error);
+                            // Put back in queue
+                            this.offlineQueue.unshift(...batch);
+                            this.saveOfflineQueue();
+                            break;
+                        }
                     }
-                    catch (error) {
-                        this.log('Failed to send offline batch:', error);
-                        // Put back in queue
-                        this.offlineQueue.unshift(...batch);
-                        this.saveOfflineQueue();
-                        break;
+                    if (this.offlineQueue.length === 0) {
+                        storage.remove(this.OFFLINE_QUEUE_KEY);
                     }
                 }
-                if (this.offlineQueue.length === 0) {
-                    storage.remove(this.OFFLINE_QUEUE_KEY);
+                finally {
+                    this.offlineProcessing = false;
                 }
             });
         }
@@ -2141,30 +2265,103 @@ var Datalyr = (function (exports) {
         getNetworkStatus() {
             return Object.assign({}, this.networkStatus);
         }
+        /**
+         * Build a batch payload from a set of events.
+         */
+        buildBatch(events) {
+            return {
+                events,
+                batchId: generateUUID(),
+                timestamp: new Date().toISOString()
+            };
+        }
         /**
          * Force flush (for page unload)
+         * FIXED (WEB-3): include the offline queue, chunk under sendBeacon's ~64KB cap,
+         * and persist any chunk the browser refuses so it survives to the next page load.
+         * Previously this beaconed the live queue as one blob — ignoring the offline queue
+         * entirely and silently failing (returning false) whenever the payload exceeded 64KB.
+         *
+         * Two follow-up review fixes:
+         *  - HIGH-1: exclude any batch currently in-flight in _flush(). That batch is being
+         *    sent with a keepalive fetch that already survives unload; re-beaconing it would
+         *    double-send. (`inFlight` is the front `inFlight.length` events of this.queue.)
+         *  - HIGH-2: handleUnload is wired to visibilitychange+pagehide+beforeunload, so this
+         *    runs multiple times per lifecycle. Detach what we beacon SYNCHRONOUSLY (clear the
+         *    in-memory queues, persist a refused remainder straight to storage rather than back
+         *    into this.offlineQueue) so a repeat call finds nothing to re-send.
          */
         forceFlush() {
             return __awaiter(this, void 0, void 0, function* () {
-                // Try sendBeacon first for reliability
-                if (navigator.sendBeacon && this.queue.length > 0) {
-                    const batchPayload = {
-                        events: this.queue,
-                        batchId: generateUUID(),
-                        timestamp: new Date().toISOString()
-                    };
-                    const blob = new Blob([JSON.stringify(batchPayload)], {
+                if (!this.enabled)
+                    return;
+                if (!navigator.sendBeacon) {
+                    // No beacon API — best-effort keepalive-fetch drain of both queues.
+                    yield this.flush();
+                    yield this.processOfflineQueue();
+                    return;
+                }
+                // Exclude the in-flight batch (its keepalive fetch already carries it).
+                const live = this.queue.slice(this.inFlight.length);
+                const pending = [...live, ...this.offlineQueue];
+                // Detach synchronously: keep only the in-flight front (for _flush to settle) and
+                // empty the offline queue, so a second unload event this lifecycle re-enters with
+                // nothing to re-beacon. The refused remainder (if any) is persisted to STORAGE
+                // below, not back into this.offlineQueue, for exactly this reason.
+                this.queue = this.queue.slice(0, this.inFlight.length);
+                this.offlineQueue = [];
+                if (pending.length === 0)
+                    return;
+                const MAX_BEACON_BYTES = 60000; // headroom under the browser's ~64KB cap
+                // Greedily pack events into chunks bounded by BOTH batchSize and byte size.
+                const chunks = [];
+                let current = [];
+                let currentBytes = 2; // approx for the JSON array/object wrapper
+                for (const ev of pending) {
+                    // Byte length (not UTF-16 .length) so multibyte product names / emoji can't
+                    // under-count and overflow the cap.
+                    const evBytes = new Blob([JSON.stringify(ev)]).size + 1;
+                    if (current.length > 0 &&
+                        (current.length >= this.config.batchSize || currentBytes + evBytes > MAX_BEACON_BYTES)) {
+                        chunks.push(current);
+                        current = [];
+                        currentBytes = 2;
+                    }
+                    current.push(ev);
+                    currentBytes += evBytes;
+                }
+                if (current.length > 0)
+                    chunks.push(current);
+                // Send each chunk; the moment the browser refuses to enqueue one, keep it and
+                // everything after it for the next session.
+                let failedFrom = -1;
+                for (let c = 0; c < chunks.length; c++) {
+                    const blob = new Blob([JSON.stringify(this.buildBatch(chunks[c]))], {
                         type: 'application/json'
                     });
-                    const success = navigator.sendBeacon(this.config.endpoint, blob);
-                    if (success) {
-                        this.log('Events sent via sendBeacon');
-                        this.queue = [];
-                        return;
+                    if (!navigator.sendBeacon(this.config.endpoint, blob)) {
+                        failedFrom = c;
+                        break;
                     }
                 }
-                // Fallback to regular flush
-                yield this.flush();
+                if (failedFrom >= 0) {
+                    const remainder = chunks
+                        .slice(failedFrom)
+                        .reduce((acc, c) => acc.concat(c), []);
+                    // Persist straight to storage (NOT this.offlineQueue) so a repeat unload event
+                    // won't re-beacon it; the next page load's drain (which uses a normal fetch with
+                    // no 64KB cap) delivers it. MED-2: log if the maxOfflineQueueSize cap truncates.
+                    const toPersist = remainder.slice(-this.config.maxOfflineQueueSize);
+                    if (remainder.length > toPersist.length) {
+                        this.log(`Offline cap dropped ${remainder.length - toPersist.length} oldest events at unload`);
+                    }
+                    storage.set(this.OFFLINE_QUEUE_KEY, toPersist);
+                    this.log(`sendBeacon refused ${remainder.length} events; persisted ${toPersist.length} for next load`);
+                }
+                else {
+                    this.log('Events sent via sendBeacon');
+                    storage.remove(this.OFFLINE_QUEUE_KEY);
+                }
             });
         }
         /**
@@ -2177,6 +2374,22 @@ var Datalyr = (function (exports) {
                 this.batchTimer = null;
             }
         }
+        /**
+         * Enable/disable all sending. Used by opt-out / withdrawn analytics consent so that
+         * events persisted BEFORE opt-out aren't drained afterwards (the periodic drain and
+         * the on-load drain both honor this).
+         */
+        setEnabled(enabled) {
+            this.enabled = enabled;
+        }
+        /**
+         * Clear the offline queue and its persisted copy (used by opt-out to purge any
+         * PII-bearing events that were parked before the user opted out).
+         */
+        clearOffline() {
+            this.offlineQueue = [];
+            storage.remove(this.OFFLINE_QUEUE_KEY);
+        }
         /**
          * Debug logging
          */
@@ -2403,9 +2616,10 @@ var Datalyr = (function (exports) {
                         throw new Error(`Failed to fetch container scripts: ${response.status}`);
                     }
                     const data = yield response.json();
-                    // Store scripts and pixels
+                    // Store scripts, pixels, and the SDK runtime config envelope.
                     this.scripts = data.scripts || [];
                     this.pixels = data.pixels || null;
+                    this.remoteConfig = (data.config && typeof data.config === 'object') ? data.config : undefined;
                     // Initialize pixels if configured. Awaited so advanced-matching hashes
                     // are resolved before the first dl.track() flushes through trackToPixels
                     // (otherwise fbq('init') would lag fbq('track') in fast-path tracks).
@@ -2435,6 +2649,13 @@ var Datalyr = (function (exports) {
                 }
             });
         }
+        /**
+         * The SDK runtime config delivered by /container-scripts, or undefined if the
+         * response omitted it. The SDK merges this under explicit init() options.
+         */
+        getRemoteConfig() {
+            return this.remoteConfig;
+        }
         /**
          * Load scripts by trigger type
          */
@@ -2865,7 +3086,7 @@ var Datalyr = (function (exports) {
          * Track event to all initialized pixels
          */
         trackToPixels(eventName, properties = {}, eventId) {
-            var _a, _b, _c, _e, _f, _g, _h, _j;
+            var _a, _b, _c, _e, _f, _g, _h, _j, _k, _l;
             // Datalyr-internal events ($identify, $group, $alias, $auto_identify,
             // $app_download_click, …) are not conversions — never forward them to ad
             // pixels. (Previously they fired as noise custom events with the $ stripped.)
@@ -2931,16 +3152,31 @@ var Datalyr = (function (exports) {
             // Track to TikTok Pixel
             if (((_j = (_h = this.pixels) === null || _h === void 0 ? void 0 : _h.tiktok) === null || _j === void 0 ? void 0 : _j.enabled) && window.ttq) {
                 try {
-                    // Map common events to TikTok names
+                    // Map our event names to TikTok's standard vocabulary. BUG FIX (TikTok-dead):
+                    // this map was keyed on Meta-standard names ('Purchase') but looked up with the
+                    // sanitized RAW event ('purchase'), so EVERY standard event missed and fired as
+                    // a literal custom event (e.g. "purchase" instead of "CompletePayment") — all
+                    // TikTok conversions were mis-categorized. Now keyed on the lowercased raw name
+                    // and looked up the same way the Meta block does, with a workspace rule map first.
                     const tiktokEventMap = {
-                        'Purchase': 'CompletePayment',
-                        'AddToCart': 'AddToCart',
-                        'InitiateCheckout': 'InitiateCheckout',
-                        'ViewContent': 'ViewContent',
-                        'Search': 'Search',
-                        'Lead': 'SubmitForm'
+                        view_content: 'ViewContent', product_viewed: 'ViewContent', view_item: 'ViewContent',
+                        search: 'Search',
+                        add_to_wishlist: 'AddToWishlist',
+                        add_to_cart: 'AddToCart', product_added: 'AddToCart',
+                        initiate_checkout: 'InitiateCheckout', begin_checkout: 'InitiateCheckout', checkout_started: 'InitiateCheckout',
+                        add_payment_info: 'AddPaymentInfo',
+                        purchase: 'CompletePayment', order_completed: 'CompletePayment', order_paid: 'CompletePayment',
+                        place_an_order: 'PlaceAnOrder',
+                        contact: 'Contact',
+                        download: 'Download',
+                        lead: 'SubmitForm', submit_form: 'SubmitForm',
+                        complete_registration: 'CompleteRegistration', sign_up: 'CompleteRegistration', signup: 'CompleteRegistration',
+                        subscribe: 'Subscribe', subscription_created: 'Subscribe',
                     };
-                    const tiktokEvent = tiktokEventMap[sanitizedEventName] || sanitizedEventName;
+                    const tiktokRuleMap = (_l = (_k = this.pixels) === null || _k === void 0 ? void 0 : _k.tiktok) === null || _l === void 0 ? void 0 : _l.event_mappings;
+                    const tiktokEvent = (tiktokRuleMap === null || tiktokRuleMap === void 0 ? void 0 : tiktokRuleMap[eventName])
+                        || tiktokEventMap[String(eventName).toLowerCase()]
+                        || sanitizedEventName;
                     window.ttq.track(tiktokEvent, sanitizedProperties);
                 }
                 catch (error) {
@@ -3089,10 +3325,11 @@ var Datalyr = (function (exports) {
             this.formListeners = [];
             this.lastIdentifyTime = 0;
             this.RATE_LIMIT_MS = 5000; // Don't auto-identify more than once per 5 seconds
+            this.destroyed = false; // set by destroy() (e.g. on opt-out) — stops any in-flight capture from re-persisting email
             this.config = {
                 enabled: config.enabled !== false,
                 captureFromForms: config.captureFromForms !== false,
-                captureFromAPI: config.captureFromAPI !== false,
+                captureFromAPI: config.captureFromAPI === true, // default OFF: same-origin response-scan can mis-identify (e.g. admin views)
                 captureFromShopify: config.captureFromShopify !== false,
                 trustedDomains: config.trustedDomains || [],
                 debug: config.debug || false
@@ -3102,29 +3339,49 @@ var Datalyr = (function (exports) {
          * Initialize auto-identify system
          */
         initialize(identifyCallback) {
-            if (!this.config.enabled) {
-                this.log('Auto-identify disabled');
-                return;
-            }
-            this.identifyCallback = identifyCallback;
-            // Check if already identified
-            const existingEmail = storage.get('dl_auto_identified_email');
-            if (existingEmail) {
-                this.log('User already auto-identified:', existingEmail);
-                return;
-            }
-            // Setup monitoring
-            if (this.config.captureFromForms) {
-                this.setupFormMonitoring();
-            }
-            if (this.config.captureFromAPI) {
-                this.setupFetchInterception();
-                this.setupXHRInterception();
-            }
-            if (this.config.captureFromShopify) {
-                this.setupShopifyMonitoring();
-            }
-            this.log('Auto-identify initialized');
+            return __awaiter(this, void 0, void 0, function* () {
+                if (!this.config.enabled) {
+                    this.log('Auto-identify disabled');
+                    return;
+                }
+                this.identifyCallback = identifyCallback;
+                // Check if already identified.
+                // WEB-5: the captured email is PII — store it AES-GCM-encrypted (consistent with
+                // dl_user_traits), not plaintext localStorage.
+                const existingEmail = yield storage.getEncrypted('dl_auto_identified_email');
+                if (existingEmail) {
+                    // Migration: a value written by a pre-1.7.1 build is PLAINTEXT. getEncrypted
+                    // returns it anyway — decrypt() has a backwards-compat fallback that hands back
+                    // the raw string when AES decryption fails — so without this step the PII would
+                    // stay in plaintext localStorage forever. Detect a legacy plaintext email by
+                    // inspecting the RAW stored bytes (ciphertext is base64, so an '@' means it was
+                    // never encrypted) and re-write it encrypted in place.
+                    const raw = storage.get('dl_auto_identified_email');
+                    if (typeof raw === 'string' && raw.includes('@')) {
+                        try {
+                            yield storage.setEncrypted('dl_auto_identified_email', existingEmail);
+                            this.log('Migrated legacy plaintext auto-identified email to encrypted storage');
+                        }
+                        catch (error) {
+                            this.log('Failed to migrate legacy auto-identified email:', error);
+                        }
+                    }
+                    this.log('User already auto-identified');
+                    return;
+                }
+                // Setup monitoring
+                if (this.config.captureFromForms) {
+                    this.setupFormMonitoring();
+                }
+                if (this.config.captureFromAPI) {
+                    this.setupFetchInterception();
+                    this.setupXHRInterception();
+                }
+                if (this.config.captureFromShopify) {
+                    this.setupShopifyMonitoring();
+                }
+                this.log('Auto-identify initialized');
+            });
         }
         /**
          * Setup form monitoring for email capture
@@ -3280,10 +3537,21 @@ var Datalyr = (function (exports) {
             this.log('Shopify detected, setting up monitoring');
             // Try to fetch customer data immediately
             this.checkShopifyCustomer();
-            // Check periodically (in case customer logs in later)
+            // Check periodically (in case the customer logs in later), but CAP the attempts so a
+            // visitor who never logs in — the vast majority of storefront traffic — doesn't poll
+            // /account.json forever (it used to run every 10s for the whole session). A logged-in
+            // customer surfaces well within ~2 minutes. (WEB-10)
+            let checks = 0;
+            const MAX_CHECKS = 12; // ~2 minutes at 10s
             this.shopifyCheckInterval = setInterval(() => {
+                checks++;
                 this.checkShopifyCustomer();
-            }, 10000); // Check every 10 seconds
+                if (checks >= MAX_CHECKS && this.shopifyCheckInterval) {
+                    clearInterval(this.shopifyCheckInterval);
+                    this.shopifyCheckInterval = undefined;
+                    this.log('Shopify monitoring stopped after max checks (no login detected)');
+                }
+            }, 10000);
             this.log('Shopify monitoring active');
         }
         /**
@@ -3440,31 +3708,51 @@ var Datalyr = (function (exports) {
          * Trigger identify with rate limiting
          */
         triggerIdentify(email, source) {
-            // Rate limiting
-            const now = Date.now();
-            if (now - this.lastIdentifyTime < this.RATE_LIMIT_MS) {
-                this.log('Rate limited, skipping identify');
-                return;
-            }
-            // Check if already identified
-            const existingEmail = storage.get('dl_auto_identified_email');
-            if (existingEmail === email) {
-                this.log('Already identified with this email');
-                return;
-            }
-            // Store email to prevent duplicate identification
-            storage.set('dl_auto_identified_email', email);
-            this.lastIdentifyTime = now;
-            // Trigger callback
-            if (this.identifyCallback) {
-                this.log(`Auto-identifying user: ${email} (source: ${source})`);
-                this.identifyCallback(email, source);
-            }
+            return __awaiter(this, void 0, void 0, function* () {
+                if (this.destroyed)
+                    return;
+                // Rate limiting
+                const now = Date.now();
+                if (now - this.lastIdentifyTime < this.RATE_LIMIT_MS) {
+                    this.log('Rate limited, skipping identify');
+                    return;
+                }
+                // Stamp the rate-limit timer synchronously, BEFORE the async storage calls below,
+                // so two near-simultaneous triggers can't both slip past into a double-identify
+                // (the storage read/write is now async — a window the old sync code didn't have).
+                this.lastIdentifyTime = now;
+                // Check if already identified.
+                // WEB-5: encrypted store (the email is PII at rest).
+                const existingEmail = yield storage.getEncrypted('dl_auto_identified_email');
+                if (existingEmail === email) {
+                    this.log('Already identified with this email');
+                    return;
+                }
+                // If we were destroyed (e.g. user opted out) during the async read above, do NOT
+                // re-persist the email or fire the callback.
+                if (this.destroyed)
+                    return;
+                // Store email (encrypted) to prevent duplicate identification. Best-effort: a
+                // storage/encryption failure must not block the identify, since the identify
+                // event carries the email to the backend regardless.
+                try {
+                    yield storage.setEncrypted('dl_auto_identified_email', email);
+                }
+                catch (error) {
+                    this.log('Failed to persist auto-identified email:', error);
+                }
+                // Trigger callback
+                if (this.identifyCallback) {
+                    this.log(`Auto-identifying user: ${email} (source: ${source})`);
+                    this.identifyCallback(email, source);
+                }
+            });
         }
         /**
          * Destroy and cleanup
          */
         destroy() {
+            this.destroyed = true;
             // Restore original fetch
             if (this.originalFetch) {
                 window.fetch = this.originalFetch;
@@ -3501,18 +3789,66 @@ var Datalyr = (function (exports) {
         }
     }
 
+    /** Keys the remote config is allowed to fill on DatalyrConfig. */
+    const REMOTE_KEYS = [
+        'autoIdentify',
+        'autoIdentifyForms',
+        'autoIdentifyAPI',
+        'autoIdentifyShopify',
+        'shopifyCartAttributes',
+        'checkoutChampDomains',
+        'respectGlobalPrivacyControl',
+        'respectDoNotTrack',
+        'privacyMode',
+    ];
+    /**
+     * Fold `remote` into `config` IN PLACE. Precedence per key:
+     *   explicit init() value  >  remote (dashboard)  >  built-in default
+     *
+     * `explicitKeys` = the keys the CALLER passed to init() (before built-in
+     * defaults were merged in). For any remote key NOT in that set, remote
+     * OVERRIDES the built-in default. This is essential because some keys
+     * (respectDoNotTrack, respectGlobalPrivacyControl, privacyMode) get a built-in
+     * default at init() and are therefore never `undefined` — a naive
+     * "fill-if-undefined" would silently ignore the dashboard for them.
+     *
+     * No-op when there's no remote config (older worker / container disabled /
+     * failed fetch) — built-in defaults then stand.
+     */
+    function applyRemoteConfig(config, remote, explicitKeys) {
+        if (!remote)
+            return;
+        const target = config;
+        for (const key of REMOTE_KEYS) {
+            const remoteVal = remote[key];
+            if (remoteVal === undefined || remoteVal === null)
+                continue;
+            // Explicit init() always wins; otherwise remote overrides the built-in default.
+            if (explicitKeys === null || explicitKeys === void 0 ? void 0 : explicitKeys.has(key))
+                continue;
+            target[key] = remoteVal;
+        }
+    }
+
     /**
      * Datalyr Web SDK
      * Modern attribution tracking for web applications
      */
     class Datalyr {
         constructor() {
+            // Keys the caller passed to init() (before built-in defaults were merged).
+            // Lets the remote-config merge override built-in defaults while always
+            // deferring to an explicit init() value. See applyRemoteConfig.
+            this.explicitConfigKeys = new Set();
             this.superProperties = {};
             this.userProperties = {};
             this.optedOut = false;
+            // Consent preferences (setConsent). null = not set → no consent-based restriction.
+            this.consent = null;
             this.initialized = false;
             this.errors = [];
             this.MAX_ERRORS = 50;
+            this.lastSpaPath = null; // dedups SPA pageviews (replaceState-on-mount double-fire)
             // FIXED (ISSUE-01): Async initialization promise to prevent race conditions
             this.initializationPromise = null;
             // Opt-out check moved to init() after cookies configured (Issue #14)
@@ -3529,6 +3865,10 @@ var Datalyr = (function (exports) {
             if (!config.workspaceId) {
                 throw new Error('[Datalyr] workspaceId is required');
             }
+            // Snapshot the keys the caller explicitly set, BEFORE built-in defaults are
+            // merged in — so the remote-config merge can override built-in defaults
+            // while still deferring to anything the caller passed explicitly.
+            this.explicitConfigKeys = new Set(Object.keys(config));
             // Set default config values
             this.config = Object.assign({ endpoint: 'https://ingest.datalyr.com', debug: false, batchSize: 10, flushInterval: 5000, flushAt: 10, criticalEvents: undefined, highPriorityEvents: undefined, sessionTimeout: 60 * 60 * 1000, trackSessions: true, attributionWindow: 90 * 24 * 60 * 60 * 1000, trackedParams: [], respectDoNotTrack: false, respectGlobalPrivacyControl: true, privacyMode: 'standard', cookieDomain: 'auto', cookieExpires: 365, secureCookie: 'auto', sameSite: 'Lax', cookiePrefix: '__dl_', enablePerformanceTracking: true, enableFingerprinting: true, maxRetries: 5, retryDelay: 1000, maxOfflineQueueSize: 100, trackSPA: true, trackPageViews: true, fallbackEndpoints: [], plugins: [] }, config);
             // platform:'shopify' implies cart-attribute sync: stamp visitor_id + Meta
@@ -3550,6 +3890,9 @@ var Datalyr = (function (exports) {
             storage.migrateFromLegacyPrefix();
             // Check opt-out AFTER cookies configured (Issue #14)
             this.optedOut = this.cookies.get('__dl_opt_out') === 'true';
+            // Load persisted consent so shouldTrack()/container gating honor it from the
+            // first event (setConsent persists it; see optOut for the enforcement on opt-out).
+            this.consent = storage.get('dl_consent', null);
             // CC funnel page entry: restore the _dl_* URL bridge BEFORE IdentityManager
             // initializes so the storefront's visitor_id is the one used here (instead
             // of auto-generating a fresh one on this domain).
@@ -3571,6 +3914,9 @@ var Datalyr = (function (exports) {
             // Set session ID in identity manager
             const sessionId = this.session.getSessionId();
             this.identity.setSessionId(sessionId);
+            // Gate the queue by the FULL tracking policy (opt-out + analytics consent + DNT +
+            // GPC) so a returning opted-out / DNT / GPC visitor's persisted events don't drain.
+            this.queue.setEnabled(this.shouldTrack());
             // FIXED (ISSUE-01): Start async initialization immediately but don't block constructor
             // This allows encryption to initialize before any events are tracked
             this.initializeAsync();
@@ -3605,19 +3951,35 @@ var Datalyr = (function (exports) {
                     return this.initializationPromise;
                 }
                 this.initializationPromise = (() => __awaiter(this, void 0, void 0, function* () {
+                    var _a;
                     try {
-                        // SEC-03 Fix: Initialize encryption for PII data
-                        const deviceId = this.identity.getAnonymousId();
-                        yield dataEncryption.initialize(this.config.workspaceId, deviceId);
-                        // Load encrypted user properties
-                        this.userProperties = yield storage.getEncrypted('dl_user_traits', {});
-                        this.log('Encryption initialized, user properties loaded');
+                        // SEC-03: encryption is for PII-AT-REST only — it must NOT gate event delivery,
+                        // pageviews, or pixels. On a non-secure context (http://) or an old browser,
+                        // crypto.subtle is absent and initialize() throws; isolate it so the rest of init
+                        // (SPA tracking, container/pixels, initial pageview) still runs. (http:// fix)
+                        try {
+                            const deviceId = this.identity.getAnonymousId();
+                            yield dataEncryption.initialize(this.config.workspaceId, deviceId);
+                            this.userProperties = yield storage.getEncrypted('dl_user_traits', {});
+                            this.log('Encryption initialized, user properties loaded');
+                        }
+                        catch (encErr) {
+                            console.warn('[Datalyr] Encryption unavailable (non-secure context?); continuing WITHOUT PII-at-rest encryption:', encErr);
+                            this.userProperties = storage.get('dl_user_traits', {});
+                        }
                         // Setup SPA tracking if enabled
                         if (this.config.trackSPA) {
                             this.setupSPATracking();
                         }
-                        // Initialize container manager if enabled
-                        if (this.config.enableContainer !== false) {
+                        // Initialize container manager if enabled.
+                        // WEB-4 (privacy gate): the container loads third-party pixels (Meta/Google/
+                        // TikTok) and calls fbq('init', …, advancedMatching) with the visitor's
+                        // SHA-256 email/id — so it must NOT initialize for opted-out / DNT / GPC
+                        // visitors, nor when privacyMode is explicitly 'strict'. (Remote config can't
+                        // gate this: the container fetch is what delivers the remote config, so only
+                        // local consent signals + an explicit strict init() are knowable here.)
+                        const privacyStrict = this.config.privacyMode === 'strict';
+                        if (this.config.enableContainer !== false && this.shouldTrack() && !privacyStrict && this.consentAllowsMarketing()) {
                             this.container = new ContainerManager({
                                 workspaceId: this.config.workspaceId,
                                 endpoint: this.config.endpoint,
@@ -3650,6 +4012,16 @@ var Datalyr = (function (exports) {
                                 this.fireCheckoutChampPurchasePixel();
                             }
                         }
+                        // Fold the remote /container-scripts config UNDER explicit init()
+                        // overrides (precedence: defaults <- remote <- explicit). No-op if the
+                        // container is disabled or the worker didn't send `config`. This is what
+                        // makes the dashboard toggles take effect with no snippet edits.
+                        applyRemoteConfig(this.config, (_a = this.container) === null || _a === void 0 ? void 0 : _a.getRemoteConfig(), this.explicitConfigKeys);
+                        // Privacy-strict turns auto-identify (email capture) OFF regardless of
+                        // the dashboard/remote value — privacy wins over the bridge.
+                        if (this.config.privacyMode === 'strict') {
+                            this.config.autoIdentify = false;
+                        }
                         // autoIdentify default for the CC bridge:
                         // - platform === 'checkoutchamp' (CC funnel pages) OR
                         // - checkoutChampDomains set (Shopify storefronts feeding a CC funnel)
@@ -3660,8 +4032,10 @@ var Datalyr = (function (exports) {
                         if (ccBridgeActive && this.config.autoIdentify === undefined) {
                             this.config.autoIdentify = true;
                         }
-                        // Initialize auto-identify if explicitly enabled (opt-in)
-                        if (this.config.autoIdentify === true) {
+                        // Initialize auto-identify when enabled (explicit or remote) AND
+                        // tracking is allowed. The shouldTrack() gate keeps capture from even
+                        // setting up its form/API interceptors for opted-out / DNT / GPC users.
+                        if (this.config.autoIdentify === true && this.shouldTrack()) {
                             this.autoIdentify = new AutoIdentifyManager({
                                 enabled: true,
                                 captureFromForms: this.config.autoIdentifyForms,
@@ -3687,7 +4061,7 @@ var Datalyr = (function (exports) {
                         // Lets server-side order webhooks recover the browser visitor + Meta click
                         // signals (the postback webhook reads these as note_attributes). Inert unless
                         // enabled; best-effort and never blocks init.
-                        if (this.config.shopifyCartAttributes === true) {
+                        if (this.config.shopifyCartAttributes === true && this.shouldTrack()) {
                             this.syncShopifyCartAttributes().catch((error) => {
                                 this.log('Shopify cart attribute sync failed:', error);
                             });
@@ -3695,7 +4069,9 @@ var Datalyr = (function (exports) {
                         // Storefront → CC bridge: stamp _dl_* params on outbound links to the
                         // configured CC domains so visitor_id + click signals cross the domain
                         // boundary. Inert unless checkoutChampDomains is set.
-                        if (Array.isArray(this.config.checkoutChampDomains) && this.config.checkoutChampDomains.length > 0) {
+                        if (Array.isArray(this.config.checkoutChampDomains) && this.config.checkoutChampDomains.length > 0 && this.shouldTrack()) {
+                            // MED-4: gated on shouldTrack() (like syncShopifyCartAttributes) so an
+                            // opted-out / DNT / GPC visitor's id + click-ids aren't stamped on outbound links.
                             this.syncOutboundLinkParams(this.config.checkoutChampDomains);
                         }
                         // Track initial page view if enabled (AFTER encryption ready)
@@ -3780,51 +4156,56 @@ var Datalyr = (function (exports) {
          * so the mobile SDK can retrieve them deterministically after install.
          */
         trackAppDownloadClick(options) {
-            if (!this.initialized) {
-                console.warn('[Datalyr] SDK not initialized. Call init() first.');
-                return;
-            }
-            if (!this.shouldTrack())
-                return;
-            // Fire the event with target platform info — attribution data is
-            // automatically merged by createEventPayload via getAttributionData()
-            this.track('$app_download_click', {
-                target_platform: options.targetPlatform,
-                app_store_url: options.appStoreUrl,
-            });
-            // Flush immediately via sendBeacon before page navigates away
-            this.queue.forceFlush();
-            // For Android: append referrer param to Play Store URL with click attribution
-            if (options.targetPlatform === 'android' && options.appStoreUrl.includes('play.google.com')) {
-                const lastTouch = this.attribution.getLastTouch();
-                const referrerParams = new URLSearchParams();
-                if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.clickId)
-                    referrerParams.set('dl_click_id', lastTouch.clickId);
-                if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.clickIdType)
-                    referrerParams.set('dl_click_id_type', lastTouch.clickIdType);
-                if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.source)
-                    referrerParams.set('utm_source', lastTouch.source);
-                if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.medium)
-                    referrerParams.set('utm_medium', lastTouch.medium);
-                if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.campaign)
-                    referrerParams.set('utm_campaign', lastTouch.campaign);
-                if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.content)
-                    referrerParams.set('utm_content', lastTouch.content);
-                if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.term)
-                    referrerParams.set('utm_term', lastTouch.term);
-                try {
-                    const url = new URL(options.appStoreUrl);
-                    url.searchParams.set('referrer', referrerParams.toString());
-                    window.location.href = url.toString();
+            return __awaiter(this, void 0, void 0, function* () {
+                if (!this.initialized) {
+                    console.warn('[Datalyr] SDK not initialized. Call init() first.');
+                    return;
                 }
-                catch (_a) {
-                    // If URL parsing fails, redirect without referrer
+                if (!this.shouldTrack())
+                    return;
+                // Fire the event with target platform info — attribution data is
+                // automatically merged by createEventPayload via getAttributionData()
+                this.track('$app_download_click', {
+                    target_platform: options.targetPlatform,
+                    app_store_url: options.appStoreUrl,
+                });
+                // AWAIT the flush before navigating away (M5). sendBeacon dispatches synchronously,
+                // but on browsers WITHOUT sendBeacon forceFlush falls back to a keepalive fetch —
+                // and the synchronous window.location assignment below would tear the page down
+                // before that fetch dispatched, losing the click event.
+                yield this.queue.forceFlush();
+                // For Android: append referrer param to Play Store URL with click attribution
+                if (options.targetPlatform === 'android' && options.appStoreUrl.includes('play.google.com')) {
+                    const lastTouch = this.attribution.getLastTouch();
+                    const referrerParams = new URLSearchParams();
+                    if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.clickId)
+                        referrerParams.set('dl_click_id', lastTouch.clickId);
+                    if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.clickIdType)
+                        referrerParams.set('dl_click_id_type', lastTouch.clickIdType);
+                    if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.source)
+                        referrerParams.set('utm_source', lastTouch.source);
+                    if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.medium)
+                        referrerParams.set('utm_medium', lastTouch.medium);
+                    if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.campaign)
+                        referrerParams.set('utm_campaign', lastTouch.campaign);
+                    if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.content)
+                        referrerParams.set('utm_content', lastTouch.content);
+                    if (lastTouch === null || lastTouch === void 0 ? void 0 : lastTouch.term)
+                        referrerParams.set('utm_term', lastTouch.term);
+                    try {
+                        const url = new URL(options.appStoreUrl);
+                        url.searchParams.set('referrer', referrerParams.toString());
+                        window.location.href = url.toString();
+                    }
+                    catch (_a) {
+                        // If URL parsing fails, redirect without referrer
+                        window.location.href = options.appStoreUrl;
+                    }
+                }
+                else {
                     window.location.href = options.appStoreUrl;
                 }
-            }
-            else {
-                window.location.href = options.appStoreUrl;
-            }
+            });
         }
         /**
          * Identify a user
@@ -3889,6 +4270,17 @@ var Datalyr = (function (exports) {
             }
             if (!this.shouldTrack())
                 return;
+            // WEB-6: record one customer-journey touchpoint per session so touchpoint_count /
+            // days_since_first_touch become real multi-touch signals (addTouchpoint had no
+            // callers before, so the journey was always empty). Dedup against the PERSISTED
+            // journey (not an in-memory field) so a hard page reload within the same session
+            // doesn't append a duplicate touchpoint on a classic multi-page site.
+            const sid = this.session.getSessionId();
+            const journey = this.attribution.getJourney();
+            const lastTouchpoint = journey.length ? journey[journey.length - 1] : null;
+            if (!lastTouchpoint || lastTouchpoint.sessionId !== sid) {
+                this.attribution.addTouchpoint(sid, this.attribution.captureAttribution());
+            }
             const pageData = Object.assign({ title: document.title, url: window.location.href, path: window.location.pathname, search: window.location.search, referrer: document.referrer }, properties);
             // Add referrer data
             const referrerData = getReferrerData();
@@ -3937,6 +4329,8 @@ var Datalyr = (function (exports) {
                 console.warn('[Datalyr] SDK not initialized. Call init() first.');
                 return;
             }
+            if (!this.shouldTrack())
+                return;
             this.track('$group', {
                 group_id: groupId,
                 traits
@@ -3950,6 +4344,13 @@ var Datalyr = (function (exports) {
                 console.warn('[Datalyr] SDK not initialized. Call init() first.');
                 return;
             }
+            if (!userId) {
+                console.warn('[Datalyr] alias() requires a non-empty userId');
+                return;
+            }
+            // Gate before mutating persisted identity (identity.alias writes dl_user_id).
+            if (!this.shouldTrack())
+                return;
             const aliasData = this.identity.alias(userId, previousId);
             this.track('$alias', aliasData);
         }
@@ -3963,7 +4364,17 @@ var Datalyr = (function (exports) {
             }
             this.identity.reset();
             this.userProperties = {};
+            // Clear super properties too — they'd otherwise keep attaching the previous user's
+            // values to the next user's events (cross-user contamination on shared devices).
+            this.superProperties = {};
             storage.remove('dl_user_traits');
+            // Clear the auto-identify guard so a different user on the same browser is
+            // re-captured (it short-circuits while dl_auto_identified_email is present), and so
+            // the prior user's email isn't left at rest after logout.
+            storage.remove('dl_auto_identified_email');
+            // Clear the journey too, or the next user's touchpoints append to the previous
+            // user's (cross-user contamination of touchpoint_count / days_since_first_touch).
+            storage.remove('dl_journey');
             this.session.createNewSession();
             this.log('User reset');
         }
@@ -4074,19 +4485,44 @@ var Datalyr = (function (exports) {
         setAttribution(attribution) {
             const current = this.attribution.captureAttribution();
             const merged = Object.assign(Object.assign({}, current), attribution);
+            // M6: actually make this affect events. Previously it only wrote a session key that
+            // NOTHING in the event path reads, so setAttribution() was a silent no-op. Route it
+            // through the AttributionManager so last_touch_* reflects it (and first_touch_* when
+            // none is set yet — storeFirstTouch is immutable-unless-expired, so it won't clobber
+            // an existing first touch).
+            this.attribution.storeLastTouch(merged);
+            this.attribution.storeFirstTouch(merged);
             this.session.storeAttribution(merged);
         }
         /**
          * Opt out of tracking
          */
         optOut() {
+            var _a;
             if (!this.initialized) {
                 console.warn('[Datalyr] SDK not initialized. Call init() first.');
                 return;
             }
             this.optedOut = true;
             this.cookies.set('__dl_opt_out', 'true', this.config.cookieExpires);
+            // Stop the queue from sending OR draining anything persisted before opt-out, and
+            // purge what's already buffered (the periodic/on-load drain has no other gate).
+            this.queue.setEnabled(false);
             this.queue.clear();
+            this.queue.clearOffline();
+            // Tear down auto-identify so it stops capturing email into storage post-opt-out.
+            (_a = this.autoIdentify) === null || _a === void 0 ? void 0 : _a.destroy();
+            this.autoIdentify = undefined;
+            // Stop forwarding to (and drop) third-party pixels for this visitor.
+            if (this.container) {
+                this.container.cleanupAllIframes();
+                this.container = undefined;
+            }
+            // Purge PII at rest.
+            this.userProperties = {};
+            storage.remove('dl_user_traits');
+            storage.remove('dl_auto_identified_email');
+            storage.remove('dl_journey');
             this.log('User opted out');
         }
         /**
@@ -4099,6 +4535,10 @@ var Datalyr = (function (exports) {
             }
             this.optedOut = false;
             this.cookies.set('__dl_opt_out', 'false', this.config.cookieExpires);
+            // Re-enable only if the full policy now allows (analytics consent + DNT/GPC), not
+            // merely because opt-out was lifted — otherwise a GPC/DNT visitor's persisted
+            // events would start draining again. (Pixels / auto-identify resume on next load.)
+            this.queue.setEnabled(this.shouldTrack());
             this.log('User opted in');
         }
         /**
@@ -4111,7 +4551,26 @@ var Datalyr = (function (exports) {
          * Set consent preferences
          */
         setConsent(consent) {
+            this.consent = consent;
             storage.set('dl_consent', consent);
+            // Enforce it live (not just persist it). Gate the queue by the full policy
+            // (analytics consent + opt-out + DNT/GPC), and on withdrawal purge buffered events
+            // too — mirroring optOut — so events captured before withdrawal can't drain if
+            // consent is later re-granted.
+            const allowed = this.shouldTrack();
+            this.queue.setEnabled(allowed);
+            if (!allowed) {
+                this.queue.clear();
+                this.queue.clearOffline();
+            }
+            // Marketing / "do not sell" withdrawal: stop FEEDING the third-party pixels and
+            // prevent them from being initialized on the next page load. NOTE: an
+            // already-injected pixel global (fbq/gtag/ttq) keeps running in the page — we
+            // can't fully unload a third-party script mid-session; full removal is on reload.
+            if (!this.consentAllowsMarketing() && this.container) {
+                this.container.cleanupAllIframes();
+                this.container = undefined;
+            }
             this.log('Consent updated:', consent);
         }
         /**
@@ -4477,18 +4936,21 @@ var Datalyr = (function (exports) {
                 };
                 const observer = new MutationObserver(scheduleRestamp);
                 observer.observe(document.documentElement, { childList: true, subtree: true });
-                // Observer + click listener live for the session; pagehide cleans up on
-                // full-page unload. SPA route changes are fine — we WANT stamping to keep
-                // working across virtual navigations.
-                window.addEventListener("pagehide", () => {
+                // Observer + click listener live for the session; pagehide cleans up on full-page
+                // unload, and destroy() can tear them down early via this disposer (H2 — otherwise
+                // a destroy()+re-init() leaks the observer + capturing click listener).
+                this.outboundDisposer = () => {
                     try {
                         observer.disconnect();
                     }
                     catch ( /* idempotent */_a) { /* idempotent */ }
-                    if (restampTimer != null)
+                    if (restampTimer != null) {
                         clearTimeout(restampTimer);
+                        restampTimer = null;
+                    }
                     document.removeEventListener("click", onClick, true);
-                }, { once: true });
+                };
+                window.addEventListener("pagehide", () => { var _a; return (_a = this.outboundDisposer) === null || _a === void 0 ? void 0 : _a.call(this); }, { once: true });
             }
             catch (error) {
                 this.log("MutationObserver setup failed (CC link sync):", error);
@@ -4499,6 +4961,12 @@ var Datalyr = (function (exports) {
          * Create event payload
          */
         createEventPayload(eventName, properties, eventIdArg) {
+            // NEW-2: keep the identity's cached session id in lockstep with the LIVE session.
+            // The session id changes on identify() (rotateSessionId) and on session timeout, but
+            // identity only synced it at init/start — so the top-level payload.session_id (from
+            // identity) disagreed with event_data.session_id (from session.getMetrics()). Sync
+            // here, before reading either, so every event carries a single consistent session id.
+            this.identity.setSessionId(this.session.getSessionId());
             // Sanitize and merge properties
             const sanitizedProperties = sanitizeEventData(properties);
             const eventData = deepMerge({}, this.superProperties, sanitizedProperties);
@@ -4555,7 +5023,7 @@ var Datalyr = (function (exports) {
                 resolution_method: 'browser_sdk',
                 resolution_confidence: 1.0,
                 // SDK metadata (keep in sync with package.json version)
-                sdk_version: '1.6.5',
+                sdk_version: '1.7.1',
                 sdk_name: 'datalyr-web-sdk'
             };
             return payload;
@@ -4568,6 +5036,10 @@ var Datalyr = (function (exports) {
             if (this.optedOut) {
                 return false;
             }
+            // Explicit analytics-consent withdrawal (setConsent) blocks first-party tracking.
+            if (this.consent && this.consent.analytics === false) {
+                return false;
+            }
             // Check Do Not Track
             if (this.config.respectDoNotTrack && isDoNotTrackEnabled()) {
                 return false;
@@ -4578,6 +5050,14 @@ var Datalyr = (function (exports) {
             }
             return true;
         }
+        /**
+         * Whether marketing/third-party pixels are allowed. Withdrawing `marketing` or `sale`
+         * (CCPA "do not sell") consent via setConsent() blocks loading the Meta/Google/TikTok
+         * pixels (which share data). No consent set = allowed (default).
+         */
+        consentAllowsMarketing() {
+            return !this.consent || (this.consent.marketing !== false && this.consent.sale !== false);
+        }
         /**
          * Setup SPA tracking
          * Fixed Issue #15: Store original methods for cleanup
@@ -4588,56 +5068,55 @@ var Datalyr = (function (exports) {
             this.originalPushState = history.pushState;
             this.originalReplaceState = history.replaceState;
             const self = this;
+            // Seed with the current URL so a router's replaceState-on-mount (same URL) doesn't
+            // fire a duplicate pageview on top of the initial page() call. (M2/M3)
+            this.lastSpaPath = window.location.pathname + window.location.search + window.location.hash;
             // Override pushState
             history.pushState = function (...args) {
                 self.originalPushState.apply(history, args);
-                setTimeout(() => {
-                    // Clear attribution cache to capture fresh URL params
-                    self.attribution.clearCache();
-                    self.page();
-                }, 0);
+                setTimeout(() => self.handleSpaNavigation(), 0);
             };
             // Override replaceState
             history.replaceState = function (...args) {
                 self.originalReplaceState.apply(history, args);
-                setTimeout(() => {
-                    // Clear attribution cache to capture fresh URL params
-                    self.attribution.clearCache();
-                    self.page();
-                }, 0);
+                setTimeout(() => self.handleSpaNavigation(), 0);
             };
             // Listen for popstate
-            this.popstateHandler = () => {
-                setTimeout(() => {
-                    // Clear attribution cache to capture fresh URL params
-                    self.attribution.clearCache();
-                    self.page();
-                }, 0);
-            };
+            this.popstateHandler = () => { setTimeout(() => self.handleSpaNavigation(), 0); };
             window.addEventListener('popstate', this.popstateHandler);
             // Listen for hashchange
-            this.hashchangeHandler = () => {
-                // Clear attribution cache to capture fresh URL params
-                self.attribution.clearCache();
-                self.page();
-            };
+            this.hashchangeHandler = () => { self.handleSpaNavigation(); };
             window.addEventListener('hashchange', this.hashchangeHandler);
         }
+        /**
+         * Handle an SPA virtual navigation. Dedups consecutive same-URL fires (M2/M3): many
+         * routers call history.replaceState on mount/hydration, which previously fired a
+         * SECOND `pageview` on top of the initial `page()`. Only fires when the full URL
+         * (path+search+hash) actually changed.
+         */
+        handleSpaNavigation() {
+            const path = window.location.pathname + window.location.search + window.location.hash;
+            if (path === this.lastSpaPath)
+                return;
+            this.lastSpaPath = path;
+            this.attribution.clearCache();
+            this.page();
+        }
         /**
          * Setup page unload handler
          */
         setupUnloadHandler() {
-            // Use both events for maximum compatibility
-            const handleUnload = () => {
-                this.queue.forceFlush();
+            // Store refs so destroy() can remove these — otherwise a destroy()+re-init() cycle
+            // leaks listeners that keep firing forceFlush() on the OLD (destroyed) queue. (H2)
+            this.unloadHandler = () => { this.queue.forceFlush(); };
+            this.visibilityHandler = () => {
+                if (document.visibilityState === 'hidden')
+                    this.queue.forceFlush();
             };
-            window.addEventListener('beforeunload', handleUnload);
-            window.addEventListener('pagehide', handleUnload);
-            window.addEventListener('visibilitychange', () => {
-                if (document.visibilityState === 'hidden') {
-                    handleUnload();
-                }
-            });
+            // Use multiple events for maximum compatibility.
+            window.addEventListener('beforeunload', this.unloadHandler);
+            window.addEventListener('pagehide', this.unloadHandler);
+            window.addEventListener('visibilitychange', this.visibilityHandler);
         }
         /**
          * Get performance metrics
@@ -4742,6 +5221,22 @@ var Datalyr = (function (exports) {
             if (this.hashchangeHandler) {
                 window.removeEventListener('hashchange', this.hashchangeHandler);
             }
+            // H2: also remove the unload/visibility listeners and tear down the CC outbound-link
+            // observer/listener — these were leaking across destroy()+re-init(), keeping the OLD
+            // queue alive and firing on every navigation.
+            if (this.unloadHandler) {
+                window.removeEventListener('beforeunload', this.unloadHandler);
+                window.removeEventListener('pagehide', this.unloadHandler);
+                this.unloadHandler = undefined;
+            }
+            if (this.visibilityHandler) {
+                window.removeEventListener('visibilitychange', this.visibilityHandler);
+                this.visibilityHandler = undefined;
+            }
+            if (this.outboundDisposer) {
+                this.outboundDisposer();
+                this.outboundDisposer = undefined;
+            }
             // Clean up queue
             if (this.queue) {
                 this.queue.destroy();
@@ -4760,6 +5255,13 @@ var Datalyr = (function (exports) {
             }
             // SEC-03 Fix: Clean up encryption keys
             dataEncryption.destroy();
+            // H3: reset init state so a subsequent init() fully re-runs. Without nulling the
+            // initializationPromise, initializeAsync() early-returns the stale (resolved)
+            // promise and the SDK comes back half-initialized (no container/pixels/SPA/pageview).
+            this.initializationPromise = null;
+            this.container = undefined;
+            this.autoIdentify = undefined;
+            this.lastSpaPath = null;
             // Clear any remaining data
             this.superProperties = {};
             this.userProperties = {};