@datalyr/web 1.7.1 → 1.7.3

package/dist/datalyr.cjs.js

@@ -1,5 +1,5 @@
 /**
- * @datalyr/web v1.7.1
+ * @datalyr/web v1.7.3
  * Datalyr Web SDK - Modern attribution tracking for web applications
  * (c) 2026 Datalyr Inc.
  * Released under the MIT License
@@ -295,6 +295,42 @@ class SafeStorage {
             return defaultValue;
         }
     }
+    /**
+     * Get a value as a RAW string, skipping the JSON.parse that get() applies.
+     *
+     * FSR-17: get() blindly JSON.parses, so a stored user_id like '12345' comes back as
+     * the NUMBER 12345 after reload, and a 16+-digit snowflake id ('1234567890123456789')
+     * is silently precision-corrupted (→ 1234567890123456800) — permanent identity
+     * fragmentation. Identifiers (dl_user_id, dl_anonymous_id, dl_auto_identified_email)
+     * must round-trip as the exact string they were stored as; use this for them.
+     */
+    getString(key, defaultValue = null) {
+        const fullKey = this.prefix + key;
+        try {
+            const value = this.storage
+                ? this.storage.getItem(fullKey)
+                : (this.memory.has(fullKey) ? this.memory.get(fullKey) : null);
+            if (value === null || value === undefined)
+                return defaultValue;
+            // Values written by set() with a string are stored raw (unquoted); return as-is.
+            // A value written as JSON (quoted string) is unwrapped so callers always get the
+            // logical string, never a quoted one.
+            if (value.length >= 2 && value[0] === '"' && value[value.length - 1] === '"') {
+                try {
+                    const parsed = JSON.parse(value);
+                    if (typeof parsed === 'string')
+                        return parsed;
+                }
+                catch (_a) {
+                    // fall through to raw
+                }
+            }
+            return value;
+        }
+        catch (_b) {
+            return defaultValue;
+        }
+    }
     set(key, value) {
         const fullKey = this.prefix + key;
         const stringValue = typeof value === 'string' ? value : JSON.stringify(value);
@@ -475,19 +511,32 @@ class CookieStorage {
         this.secure = options.secure || 'auto';
     }
     get(name) {
-        var _a;
-        const value = `; ${document.cookie}`;
-        const parts = value.split(`; ${name}=`);
-        if (parts.length === 2) {
-            const rawValue = ((_a = parts.pop()) === null || _a === void 0 ? void 0 : _a.split(';').shift()) || null;
-            if (rawValue) {
-                try {
-                    return decodeURIComponent(rawValue);
-                }
-                catch (_b) {
-                    // Return raw value if decoding fails (backwards compatibility)
-                    return rawValue;
-                }
+        // FSR-56: parse document.cookie into name=value pairs and return the FIRST match.
+        // The old `split('; ' + name + '=')` returned null whenever the same cookie name
+        // appeared more than once (3+ parts) — extremely common for ad cookies set at both
+        // the registrable domain and a subdomain (_fbp/_fbc/_ga), and producible by this SDK
+        // itself (the __dl_visitor_id host-only fallback). That caused real _fbp/_fbc to be
+        // ignored and re-synthesized, and the CC bridge cookie read to silently fail.
+        // Browsers list the most specific (longer path / host) cookie first, so first wins.
+        const cookieString = typeof document !== 'undefined' ? document.cookie : '';
+        if (!cookieString)
+            return null;
+        for (const pair of cookieString.split(';')) {
+            const trimmed = pair.trim();
+            const eq = trimmed.indexOf('=');
+            if (eq === -1)
+                continue;
+            if (trimmed.slice(0, eq) !== name)
+                continue;
+            const rawValue = trimmed.slice(eq + 1);
+            if (!rawValue)
+                return null;
+            try {
+                return decodeURIComponent(rawValue);
+            }
+            catch (_a) {
+                // Return raw value if decoding fails (backwards compatibility)
+                return rawValue;
             }
         }
         return null;
@@ -664,6 +713,35 @@ function getAllQueryParams(search = window.location.search) {
     }
     return params;
 }
+// FSR-57: credential detection that matches whole TOKENS (after splitting a key on
+// camelCase + separators), not substrings. The old substring regex deleted innocent
+// keys — `author`/`authority` (contains 'auth'), `passenger_count`/`passport_number`
+// (contains 'pass'), `session_type`/`cookie_consent` — silently dropping customer event
+// properties. 'session' and 'cookie' are intentionally absent: they're not credentials.
+// Single words that are unambiguous as whole tokens:
+const SENSITIVE_KEY_WORDS = new Set([
+    'pass', 'password', 'passwd', 'pwd',
+    'secret', 'token', 'auth', 'authorization',
+    'bearer', 'signature', 'cvv', 'cvc', 'ssn'
+]);
+// Compound credentials that tokenize into innocent-looking parts (api_key → api+key)
+// — matched against the separator-stripped key so api_key / apiKey / access_token all hit.
+const SENSITIVE_KEY_COMPOUNDS = [
+    'apikey', 'accesskey', 'secretkey', 'privatekey', 'publickey',
+    'accesstoken', 'refreshtoken', 'idtoken', 'clientsecret',
+    'creditcard', 'cardnumber'
+];
+function isSensitiveKey(key) {
+    const words = key
+        .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+        .split(/[\s._\-]+/)
+        .map(w => w.toLowerCase())
+        .filter(Boolean);
+    if (words.some(w => SENSITIVE_KEY_WORDS.has(w)))
+        return true;
+    const normalized = key.toLowerCase().replace(/[\s._\-]+/g, '');
+    return SENSITIVE_KEY_COMPOUNDS.some(c => normalized.includes(c));
+}
 /**
  * Sanitize event data (remove sensitive keys, DOM elements, functions)
  */
@@ -685,11 +763,10 @@ function sanitizeEventData(data, maxDepth = 5, currentDepth = 0) {
     // Handle objects
     if (typeof data === 'object') {
         const sanitized = {};
-        const sensitiveKeys = /pass|pwd|token|secret|auth|bearer|session|cookie|signature|api[-_]?key|private[-_]?key|access[-_]?token|refresh[-_]?token/i;
         for (const key in data) {
             if (Object.prototype.hasOwnProperty.call(data, key)) {
-                // Skip sensitive keys
-                if (sensitiveKeys.test(key)) {
+                // Skip sensitive keys (whole-token match — see SENSITIVE_KEY_WORDS)
+                if (isSensitiveKey(key)) {
                     continue;
                 }
                 // Sanitize value recursively
@@ -704,9 +781,14 @@ function sanitizeEventData(data, maxDepth = 5, currentDepth = 0) {
         if (data.length > 1000) {
             return data.slice(0, 1000) + '...[truncated]';
         }
-        // Remove potential JWT tokens or API keys
-        if (data.match(/^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+$/) || // JWT
-            data.match(/^[a-f0-9]{32,}$/i)) { // Hex tokens
+        // FSR-57: redact only UNAMBIGUOUS JWTs — base64url '{"...' header always starts with
+        // 'eyJ'. The old rules redacted ANY 3-dot-segment string ('www.google.com' → so every
+        // 3-label referrer_host became '[Redacted]'; '1.7.1' semver too) and ANY 32+-char hex
+        // string (md5/order IDs, pre-hashed emails, and — critically — 32-hex customer user
+        // IDs on the $alias path, which silently wrote user_id='[Redacted]' into
+        // visitor_user_links, collapsing those users). Credential-bearing KEYS are already
+        // dropped above, so the bare-hex value heuristic was net-negative and is removed.
+        if (/^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(data)) { // JWT
             return '[Redacted]';
         }
         return data;
@@ -760,60 +842,79 @@ function isGlobalPrivacyControlEnabled() {
     return navigator.globalPrivacyControl === true ||
         window.globalPrivacyControl === true;
 }
+// Common two-part TLDs (country-specific registries) where the registrable domain is
+// the last THREE labels (e.g. shop.example.co.uk → example.co.uk). Not a full public
+// suffix list, but covers the markets we see; CookieStorage.getAutoDomain() probes
+// dynamically for the rest.
+const TWO_PART_TLDS = new Set([
+    // United Kingdom
+    'co.uk', 'org.uk', 'net.uk', 'ac.uk', 'gov.uk', 'me.uk',
+    // Australia
+    'com.au', 'net.au', 'org.au', 'edu.au', 'gov.au',
+    // New Zealand
+    'co.nz', 'net.nz', 'org.nz', 'govt.nz',
+    // Japan
+    'co.jp', 'ne.jp', 'or.jp', 'ac.jp', 'go.jp',
+    // India
+    'co.in', 'net.in', 'org.in', 'gov.in', 'ac.in',
+    // South Africa
+    'co.za', 'net.za', 'org.za', 'gov.za',
+    // Brazil
+    'com.br', 'net.br', 'org.br', 'gov.br', 'edu.br',
+    // South Korea
+    'co.kr', 'ne.kr', 'or.kr', 'go.kr', 'ac.kr',
+    // China
+    'com.cn', 'net.cn', 'org.cn', 'gov.cn', 'edu.cn',
+    // Other Asia-Pacific
+    'co.id', 'co.th', 'com.sg', 'com.my', 'com.ph', 'com.vn',
+    'com.tw', 'com.hk',
+    // Latin America
+    'com.mx', 'com.ar', 'com.co', 'com.pe', 'com.cl',
+    // Europe
+    'co.il', 'co.at', 'co.hu', 'co.pl'
+]);
+/**
+ * Registrable domain (eTLD+1) for a hostname, honoring two-part ccTLDs.
+ *   shop.example.co.uk → example.co.uk
+ *   www.example.com    → example.com
+ *   localhost / IPs    → returned unchanged
+ * Returns a bare host (no leading dot) — getRootDomain() adds the cookie-domain dot.
+ * (FSR-47: same-site referrer classification must use this, not naive last-two-labels.)
+ */
+function getRegistrableDomain(hostname) {
+    if (!hostname)
+        return hostname;
+    const lower = hostname.toLowerCase();
+    // Handle localhost and IP addresses
+    if (lower === 'localhost' ||
+        /^[0-9]{1,3}(\.[0-9]{1,3}){3}$/.test(lower) || // IPv4
+        /^\[?[0-9a-fA-F:]+\]?$/.test(lower)) { // IPv6
+        return hostname;
+    }
+    const parts = lower.split('.');
+    if (parts.length < 2)
+        return hostname;
+    const lastTwo = parts.slice(-2).join('.');
+    if (TWO_PART_TLDS.has(lastTwo) && parts.length >= 3) {
+        return parts.slice(-3).join('.');
+    }
+    return parts.slice(-2).join('.');
+}
 /**
- * Get root domain for cross-subdomain tracking
+ * Get root domain for cross-subdomain tracking (cookie-domain form, with leading dot).
  */
 function getRootDomain() {
     const hostname = window.location.hostname;
-    // Handle localhost and IP addresses
+    // Handle localhost and IP addresses — never set a cookie domain for these.
     if (hostname === 'localhost' ||
         hostname.match(/^[0-9]{1,3}\./) || // IPv4
         hostname.match(/^\[?[0-9a-fA-F:]+\]?$/)) { // IPv6
         return hostname;
     }
-    // Get root domain (last two parts: example.com)
     const parts = hostname.split('.');
-    if (parts.length >= 2) {
-        // Handle .co.uk, .com.au, etc
-        const tld = parts[parts.length - 1];
-        const sld = parts[parts.length - 2];
-        // Common two-part TLDs (country-specific domains)
-        // Note: The CookieStorage.getAutoDomain() probe method handles unknown TLDs dynamically,
-        // but this list provides faster resolution for known patterns
-        const twoPartTlds = [
-            // United Kingdom
-            'co.uk', 'org.uk', 'net.uk', 'ac.uk', 'gov.uk', 'me.uk',
-            // Australia
-            'com.au', 'net.au', 'org.au', 'edu.au', 'gov.au',
-            // New Zealand
-            'co.nz', 'net.nz', 'org.nz', 'govt.nz',
-            // Japan
-            'co.jp', 'ne.jp', 'or.jp', 'ac.jp', 'go.jp',
-            // India
-            'co.in', 'net.in', 'org.in', 'gov.in', 'ac.in',
-            // South Africa
-            'co.za', 'net.za', 'org.za', 'gov.za',
-            // Brazil
-            'com.br', 'net.br', 'org.br', 'gov.br', 'edu.br',
-            // South Korea
-            'co.kr', 'ne.kr', 'or.kr', 'go.kr', 'ac.kr',
-            // China
-            'com.cn', 'net.cn', 'org.cn', 'gov.cn', 'edu.cn',
-            // Other Asia-Pacific
-            'co.id', 'co.th', 'com.sg', 'com.my', 'com.ph', 'com.vn',
-            'com.tw', 'com.hk',
-            // Latin America
-            'com.mx', 'com.ar', 'com.co', 'com.pe', 'com.cl',
-            // Europe
-            'co.il', 'co.at', 'co.hu', 'co.pl'
-        ];
-        const lastTwo = `${sld}.${tld}`;
-        if (twoPartTlds.includes(lastTwo) && parts.length >= 3) {
-            return '.' + parts.slice(-3).join('.');
-        }
-        return '.' + parts.slice(-2).join('.');
-    }
-    return hostname;
+    if (parts.length < 2)
+        return hostname;
+    return '.' + getRegistrableDomain(hostname);
 }
 /**
  * Get referrer data
@@ -868,9 +969,10 @@ function detectReferrerSource(hostname) {
  * Handles anonymous_id, user_id, and identity resolution
  */
 class IdentityManager {
-    constructor() {
+    constructor(options = {}) {
         this.userId = null;
         this.sessionId = null;
+        this.persistNewId = options.persistNewId !== false;
         this.anonymousId = this.getOrCreateAnonymousId();
         this.userId = this.getStoredUserId();
     }
@@ -878,43 +980,84 @@ class IdentityManager {
      * Get or create anonymous ID (device/browser identifier)
      */
     getOrCreateAnonymousId() {
-        // 0. Check URL parameter first (cross-domain linking via _dl_vid)
-        // This enables tracking continuity when users navigate between different root domains
+        // 1. An EXISTING identity always wins — check the root-domain cookie (works across
+        //    subdomains) then localStorage. FSR-50: a persisted visitor must NEVER be
+        //    silently overwritten by a ?_dl_vid in the URL, or shared links would merge
+        //    unrelated visitors (identity takeover). The CC bridge (restoreFromURL) writes
+        //    this cookie BEFORE us, so the storefront visitor_id still wins there.
+        let anonymousId = cookies.get('__dl_visitor_id');
+        if (anonymousId) {
+            storage.set('dl_anonymous_id', anonymousId); // sync to localStorage
+            return anonymousId;
+        }
+        anonymousId = storage.getString('dl_anonymous_id'); // FSR-17: raw string, no JSON.parse
+        if (anonymousId) {
+            this.setRootDomainCookie('__dl_visitor_id', anonymousId);
+            return anonymousId;
+        }
+        // 2. Fresh visitor (no persisted id): accept a cross-domain bridge id from the URL,
+        //    but ONLY a well-formed anon_<uuid> — reject arbitrary / oversized values (a
+        //    multi-KB or attacker-crafted _dl_vid was previously persisted verbatim). Strip
+        //    it from the address bar so a re-shared URL can't merge the next visitor. (FSR-50)
         try {
             const urlParams = new URLSearchParams(window.location.search);
             const urlVisitorId = urlParams.get('_dl_vid');
-            if (urlVisitorId && urlVisitorId.startsWith('anon_')) {
-                // Valid visitor ID from URL - use it and persist
-                this.setRootDomainCookie('__dl_visitor_id', urlVisitorId);
-                storage.set('dl_anonymous_id', urlVisitorId);
+            if (urlVisitorId && this.isValidAnonymousId(urlVisitorId)) {
+                this.stripUrlParam('_dl_vid');
+                this.persistAnonymousId(urlVisitorId);
                 return urlVisitorId;
             }
         }
         catch (e) {
-            // URL parsing failed - continue with cookie/localStorage checks
+            // URL parsing failed - continue to generate a fresh id
             console.warn('[Datalyr] Failed to parse URL for _dl_vid:', e);
         }
-        // 1. Check root domain cookie first (works across subdomains)
-        let anonymousId = cookies.get('__dl_visitor_id');
-        if (anonymousId) {
-            // Found in cookie - sync to localStorage
-            storage.set('dl_anonymous_id', anonymousId);
-            return anonymousId;
-        }
-        // 2. Check localStorage (fallback for cookie issues)
-        anonymousId = storage.get('dl_anonymous_id');
-        if (anonymousId) {
-            // Found in localStorage - set root domain cookie
-            this.setRootDomainCookie('__dl_visitor_id', anonymousId);
-            return anonymousId;
-        }
-        // 3. Generate new ID
+        // 3. Generate a new ID (persisted unless tracking is disallowed at init — FSR-107).
         anonymousId = `anon_${generateUUID()}`;
-        // 4. Store in both cookie (primary) and localStorage (backup)
-        this.setRootDomainCookie('__dl_visitor_id', anonymousId);
-        storage.set('dl_anonymous_id', anonymousId);
+        this.persistAnonymousId(anonymousId);
         return anonymousId;
     }
+    /**
+     * Persist a freshly-adopted/generated anonymous id to the root-domain cookie +
+     * localStorage. Gated by persistNewId (FSR-107: don't write a tracking identifier for
+     * an opted-out / GPC / DNT visitor at init).
+     */
+    persistAnonymousId(id) {
+        if (!this.persistNewId)
+            return;
+        this.setRootDomainCookie('__dl_visitor_id', id);
+        storage.set('dl_anonymous_id', id);
+    }
+    /**
+     * Whether a `_dl_vid` value is a well-formed Datalyr anonymous id (anon_ + UUID).
+     * The length is bounded by the pattern, so an oversized/garbage value is rejected.
+     * (FSR-50)
+     */
+    isValidAnonymousId(id) {
+        return /^anon_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id);
+    }
+    /**
+     * Remove a query param from the current URL via history.replaceState (best-effort).
+     * Used so a consumed `_dl_vid` doesn't linger in the address bar and get re-shared.
+     * (FSR-50)
+     */
+    stripUrlParam(param) {
+        var _a;
+        try {
+            if (typeof window === 'undefined' || typeof ((_a = window.history) === null || _a === void 0 ? void 0 : _a.replaceState) !== 'function')
+                return;
+            const url = new URL(window.location.href);
+            if (!url.searchParams.has(param))
+                return;
+            url.searchParams.delete(param);
+            const search = url.searchParams.toString();
+            const newUrl = url.pathname + (search ? '?' + search : '') + url.hash;
+            window.history.replaceState(window.history.state, '', newUrl);
+        }
+        catch (_b) {
+            // best-effort — never block init on URL rewrite
+        }
+    }
     /**
      * Set a root domain cookie for cross-subdomain tracking
      */
@@ -949,7 +1092,10 @@ class IdentityManager {
      * Get stored user ID from previous session
      */
     getStoredUserId() {
-        return storage.get('dl_user_id');
+        // FSR-17: getString (not get) so a numeric-looking user_id ('12345') doesn't come
+        // back as a JS number after reload, and a 16+-digit snowflake id isn't precision-
+        // corrupted by JSON.parse — both would fragment identity from the second page on.
+        return storage.getString('dl_user_id');
     }
     /**
      * Get the anonymous ID
@@ -1363,7 +1509,7 @@ class AttributionManager {
             'msclkid', // Microsoft/Bing
             'twclid', // Twitter/X
             'li_fat_id', // LinkedIn
-            'sclid', // Snapchat
+            'sclid', // Snapchat (canonical internal name — see CLICK_ID_ALIASES)
             'dclid', // Google Display/DoubleClick
             'epik', // Pinterest
             'rdt_cid', // Reddit
@@ -1371,6 +1517,15 @@ class AttributionManager {
             'irclid', // Impact Radius
             'ko_click_id' // Klaviyo
         ];
+        // Real ad-platform URL params whose value we store under a canonical internal
+        // name. Snapchat appends &ScCid= (alias `sccid`) to the landing URL — it does
+        // NOT use `sclid`. Query-param lookup is case-sensitive, so capture the real
+        // params and normalize to `sclid`, which ingest / the MV / server-side
+        // attribution all key on. Without this, real Snap ad clicks captured nothing.
+        this.CLICK_ID_ALIASES = {
+            ScCid: 'sclid',
+            sccid: 'sclid',
+        };
         // Default tracked params matching dl.js
         this.DEFAULT_TRACKED_PARAMS = [
             'lyr', // Datalyr partner tracking
@@ -1404,12 +1559,19 @@ class AttributionManager {
         const attribution = {
             timestamp: Date.now()
         };
-        // Capture UTM parameters
+        // Capture UTM parameters.
+        // Emit BOTH the canonical `utm_*` key AND the stripped alias (source/medium/...).
+        // FSR-13: ingest (event_data.utm_source ?? utmSource) and EVERY attribution MV /
+        // lookup pipe key on the prefixed `utm_source`/`utm_campaign` names with no fallback —
+        // stripping the prefix left the UTM leg of the attribution read path dead for all web
+        // events. The stripped alias is still emitted because the dashboard analytics MVs and
+        // determineSource()/determineMedium() read it (and it's the long-standing shape).
         for (const utm of this.UTM_PARAMS) {
             const value = params[utm];
             if (value) {
+                attribution[utm] = value; // canonical: utm_source, utm_campaign, ...
                 const key = utm.replace('utm_', '');
-                attribution[key] = value;
+                attribution[key] = value; // alias: source, campaign, ...
             }
         }
         // Capture click IDs. The first present (by CLICK_IDS priority) is the primary
@@ -1427,6 +1589,18 @@ class AttributionManager {
                 attribution[clickId] = value;
             }
         }
+        // Aliased click IDs (e.g. Snap's ScCid/sccid → canonical sclid). Param lookup
+        // above is case-sensitive and uses canonical names, so check the real params here.
+        for (const [param, canonical] of Object.entries(this.CLICK_ID_ALIASES)) {
+            const value = params[param];
+            if (value && !attribution[canonical]) {
+                if (!attribution.clickId) {
+                    attribution.clickId = value;
+                    attribution.clickIdType = canonical;
+                }
+                attribution[canonical] = value;
+            }
+        }
         // Capture custom tracked parameters
         for (const param of this.trackedParams) {
             const value = params[param];
@@ -1551,6 +1725,9 @@ class AttributionManager {
         // TikTok cookies
         adCookies._ttp = cookies.get('_ttp');
         adCookies._ttc = cookies.get('_ttc');
+        // Snapchat first-party cookie (Snap Pixel sets _scid). Flows to the server as
+        // cookies._scid and is sent on the Snap CAPI event as sc_cookie1 (raw).
+        adCookies._scid = cookies.get('_scid');
         // Generate _fbp if missing (Facebook browser ID)
         if (!adCookies._fbp && (this.hasClickId('fbclid') || adCookies._fbc)) {
             const timestamp = Date.now();
@@ -1562,33 +1739,53 @@ class AttributionManager {
             // Optionally set the cookie for future use
             cookies.set('_fbp', adCookies._fbp, 90);
         }
-        // Persist the click time the FIRST time we see fbclid/gclid in URL so we can
-        // rebuild fbc (and stamp real click time on server-side events) later even
-        // when _fbc/_gclid cookies get evicted. Once-only: never overwrite.
+        // Meta's fbc format is `fb.{subdomainIndex}.{creationTime}.{fbclid}` where
+        // creationTime is UNIX time in MILLISECONDS (matches the _fbp generation above
+        // and the real _fbc cookie the Meta Pixel writes). Do NOT use seconds here.
+        //
+        // FSR-14: a returning visitor who clicks a NEW ad must get a FRESH _fbc. The old
+        // once-only guards (`!_dl_fbclid_at`, `!_fbc`) meant a new fbclid never refreshed
+        // _fbc while a prior 90-day _fbc still existed — Meta then received the OLD
+        // campaign's fbc (and an old creationTime that can push the conversion outside the
+        // click window) even though event_data carried the new fbclid. We detect a new
+        // click by comparing the URL fbclid against the one embedded in the existing _fbc
+        // (its 4th dot-segment). `_dl_fbclid_at` stays a pure ms timestamp — the CC bridge /
+        // Shopify cart / server-side rebuild forward it as a time, so its format must not
+        // change.
         const fbclid = this.getCurrentFbclid();
-        if (fbclid && !cookies.get('_dl_fbclid_at')) {
-            cookies.set('_dl_fbclid_at', String(Date.now()), 90);
-        }
+        if (fbclid) {
+            const existingFbc = adCookies._fbc; // captured above (cookies.get('_fbc'))
+            const embeddedFbclid = this.extractFbclidFromFbc(existingFbc);
+            if (!existingFbc) {
+                // No _fbc to compare against. Rebuild it, preferring the persisted click time
+                // (covers the case where _fbc was evicted but the same click is still in play),
+                // falling back to now if missing/corrupt (Number('abc') = NaN guard).
+                const stored = cookies.get('_dl_fbclid_at');
+                const parsed = stored ? Number(stored) : NaN;
+                const timestamp = Number.isFinite(parsed) && parsed > 0 ? parsed : Date.now();
+                if (!stored)
+                    cookies.set('_dl_fbclid_at', String(timestamp), 90);
+                adCookies._fbc = `fb.1.${timestamp}.${fbclid}`;
+                cookies.set('_fbc', adCookies._fbc, 90);
+            }
+            else if (embeddedFbclid && embeddedFbclid !== fbclid) {
+                // A NEW ad click landed over a stale _fbc — regenerate with the new fbclid and
+                // the CURRENT click time, and overwrite the persisted click time to match.
+                const now = Date.now();
+                adCookies._fbc = `fb.1.${now}.${fbclid}`;
+                cookies.set('_fbc', adCookies._fbc, 90);
+                cookies.set('_dl_fbclid_at', String(now), 90);
+            }
+            // else: same fbclid already embedded in _fbc → leave both cookies untouched.
+        }
+        // Persist the click time the FIRST time we see gclid in the URL so server-side
+        // events can stamp the real click moment even after the _gcl_* cookies evict.
+        // (gclid has no synthesized-and-going-stale artifact like _fbc, and Google does not
+        // validate a creationTime window the way Meta does, so this stays once-only.)
         const gclid = this.hasClickId('gclid') ? ((_b = (_a = this.queryParamsCache) === null || _a === void 0 ? void 0 : _a.gclid) !== null && _b !== void 0 ? _b : null) : null;
         if (gclid && !cookies.get('_dl_gclid_at')) {
             cookies.set('_dl_gclid_at', String(Date.now()), 90);
         }
-        // Generate _fbc if we have fbclid but no _fbc.
-        // Meta's fbc format is `fb.{subdomainIndex}.{creationTime}.{fbclid}` where
-        // creationTime is UNIX time in MILLISECONDS (matches the _fbp generation above
-        // and the real _fbc cookie the Meta Pixel writes). Do NOT use seconds here.
-        if (fbclid && !adCookies._fbc) {
-            // Prefer the persisted click time when valid; fall back to now if the
-            // cookie is missing or corrupted (e.g. user edited it to garbage).
-            // Without this guard, Number("abc") = NaN and Meta would reject
-            // `fb.1.NaN.{fbclid}`.
-            const stored = cookies.get('_dl_fbclid_at');
-            const parsed = stored ? Number(stored) : NaN;
-            const timestamp = Number.isFinite(parsed) && parsed > 0 ? parsed : Date.now();
-            adCookies._fbc = `fb.1.${timestamp}.${fbclid}`;
-            // Optionally set the cookie for future use
-            cookies.set('_fbc', adCookies._fbc, 90);
-        }
         // Filter out null values for cleaner data
         return Object.fromEntries(Object.entries(adCookies).filter(([_, value]) => value !== null));
     }
@@ -1608,6 +1805,21 @@ class AttributionManager {
         const params = this.queryParamsCache || getAllQueryParams();
         return params.fbclid || null;
     }
+    /**
+     * Extract the fbclid embedded in an `_fbc` cookie value
+     * (`fb.{subdomainIndex}.{creationTime}.{fbclid}` → the 4th dot-segment), or null if
+     * the value is missing/malformed. Used to detect whether a NEW fbclid in the URL
+     * differs from the one a prior _fbc was built for. (FSR-14)
+     */
+    extractFbclidFromFbc(fbc) {
+        if (!fbc)
+            return null;
+        const parts = fbc.split('.');
+        // fb . subdomainIndex . creationTime . fbclid (the fbclid itself may contain no dots)
+        if (parts.length < 4 || parts[0] !== 'fb')
+            return null;
+        return parts.slice(3).join('.') || null;
+    }
     /**
      * Get attribution data for event
      */
@@ -1625,11 +1837,18 @@ class AttributionManager {
         const hasRealAttribution = !!(current.clickId ||
             current.campaign ||
             (current.source && current.source !== 'direct'));
-        if (!hasRealAttribution && firstTouch) {
-            // Direct / internal navigation: fall back to persistent attribution (90-day
-            // window) so the event isn't mis-attributed to 'direct', keeping page context.
-            if (!firstTouch.expires_at || Date.now() < firstTouch.expires_at) {
-                current = Object.assign(Object.assign({}, firstTouch), { referrer: current.referrer, referrerHost: current.referrerHost, landingPage: current.landingPage, landingPath: current.landingPath });
+        // Direct / internal navigation: fall back to persisted attribution so the event
+        // isn't mis-attributed to 'direct'. FSR-48: prefer the LAST touch (the most recent
+        // real signal, e.g. a May Meta click) over the FIRST touch (e.g. a January gclid) —
+        // spreading firstTouch carried its stale clickId top-level and credited the older
+        // campaign for last-click. Also fall back to whichever of last/first touch is still
+        // valid, so an expired first-touch with a live last-touch no longer drops to 'direct'.
+        if (!hasRealAttribution) {
+            // getLastTouch()/getFirstTouch() already drop expired records, so either is live or
+            // null. Prefer last-touch; fall back to first-touch if there's no live last-touch.
+            const fallback = lastTouch || firstTouch;
+            if (fallback) {
+                current = Object.assign(Object.assign({}, fallback), { referrer: current.referrer, referrerHost: current.referrerHost, landingPage: current.landingPage, landingPath: current.landingPath });
             }
         }
         // Capture advertising cookies automatically
@@ -1749,8 +1968,10 @@ class AttributionManager {
      * internal navs from being mis-classified as referral.
      */
     isSameRootDomain(a, b) {
-        const root = (h) => h.split('.').slice(-2).join('.');
-        return root(a) === root(b);
+        // FSR-47: use the real eTLD+1 (public-suffix-aware) so a ccTLD merchant
+        // (shop.example.co.uk) doesn't collapse every external referrer that merely shares
+        // the suffix (google.co.uk → root 'co.uk') into 'direct'.
+        return getRegistrableDomain(a) === getRegistrableDomain(b);
     }
     /**
      * Extract hostname from URL
@@ -1798,6 +2019,16 @@ const DEFAULT_HIGH_PRIORITY_EVENTS = ['add_to_cart', 'begin_checkout', 'view_ite
 // already-overloaded server). See sendBatch / the rateLimitedUntil gate.
 class RateLimitError extends Error {
 }
+// A permanent (non-retryable) failure — a 4xx other than 408/429 (invalid event shape,
+// origin not allowed, auth). Retrying or parking it just head-of-line-blocks the offline
+// queue forever and hammers ingest. Tagged so the send paths DROP the batch instead of
+// unshifting it back to the head. (FSR-55)
+class PermanentError extends Error {
+    constructor(status, message) {
+        super(message || `HTTP ${status}`);
+        this.status = status;
+    }
+}
 class EventQueue {
     constructor(config) {
         this.queue = [];
@@ -1864,16 +2095,30 @@ class EventQueue {
             this.log('Duplicate event suppressed:', eventName);
             return;
         }
-        // CRITICAL FIX (CRITICAL-05): Critical events need proper error handling
-        // Instead of calling sendBatch() without await, we add them to queue
-        // with immediate flush AND move to offline queue on failure
+        // Critical events (purchase/signup/lead/…) send immediately, bypassing the batch.
+        // FSR-16: persist the event to the offline queue BEFORE the first send and remove it
+        // on confirmed delivery. Previously the event existed ONLY inside the sendBatch retry
+        // closure during backoff (~31s) — not in any tracked queue — so a tab close mid-retry
+        // (the most plausible moment after checkout) lost the purchase permanently: forceFlush
+        // / destroy never saw it. Server-side event_id dedup makes the at-least-once re-send
+        // safe.
         if (this.config.criticalEvents.includes(eventName)) {
             this.log('Critical event, sending immediately:', eventName);
-            // Send immediately with proper error handling
-            this.sendBatch([event]).catch((error) => {
-                this.log('Critical event send failed, adding to offline queue:', eventName, error);
-                // Move to offline queue to ensure it's not lost
-                this.moveToOfflineQueue([event]);
+            this.persistCriticalEvent(event);
+            this.sendBatch([event])
+                .then(() => {
+                // Delivered — drop the persisted copy so it isn't replayed next load.
+                this.removeFromOfflineQueue(event.event_id);
+            })
+                .catch((error) => {
+                if (error instanceof PermanentError) {
+                    this.log('Critical event permanently rejected, dropping:', eventName, error);
+                    this.removeFromOfflineQueue(event.event_id);
+                    return;
+                }
+                // Leave it persisted: the periodic drain + next-load drain retry it, and an
+                // unload mid-retry can now beacon it (it's in the offline queue). (FSR-16)
+                this.log('Critical event send failed, retained in offline queue:', eventName, error);
             });
             return;
         }
@@ -2022,7 +2267,14 @@ class EventQueue {
                 // Remove the same slice from the live queue; the offline queue now drains on
                 // every periodic tick (WEB-1/WEB-2), so they are still retried, not stranded.
                 this.queue.splice(0, batchSize);
-                this.moveToOfflineQueue(events);
+                // FSR-55: don't park a permanently-rejected batch — it would never succeed and
+                // would block the offline drain. Drop it.
+                if (error instanceof PermanentError) {
+                    this.log(`Dropping ${events.length} events — permanent error ${error.status}`);
+                }
+                else {
+                    this.moveToOfflineQueue(events);
+                }
             }
             finally {
                 this.inFlight = [];
@@ -2042,6 +2294,14 @@ class EventQueue {
             // Get current endpoint (main or fallback)
             const endpoints = [this.config.endpoint, ...this.config.fallbackEndpoints];
             const currentEndpoint = endpoints[endpointIndex] || this.config.endpoint;
+            const body = JSON.stringify(batchPayload);
+            // FSR-54: keepalive requests share a 64KB in-flight quota (Fetch spec) — a larger
+            // body fails INSTANTLY with a network error, then retries through every fallback +
+            // backoff (all failing the same way) and parks in the offline queue, where it
+            // head-of-line-blocks the drain forever. keepalive only matters for unload survival,
+            // so only request it when the body is safely under the cap; oversized batches go via
+            // a normal fetch (no cap) and succeed.
+            const useKeepalive = new Blob([body]).size <= 60000;
             try {
                 const response = yield fetch(currentEndpoint, {
                     method: 'POST',
@@ -2049,8 +2309,8 @@ class EventQueue {
                         'Content-Type': 'application/json',
                         'X-Batch-Size': events.length.toString()
                     },
-                    body: JSON.stringify(batchPayload),
-                    keepalive: true
+                    body,
+                    keepalive: useKeepalive
                 });
                 if (!response.ok) {
                     // Handle rate limiting
@@ -2066,15 +2326,21 @@ class EventQueue {
                         this.log(`Rate limited; backing off ${retryAfter}s`);
                         throw new RateLimitError('Rate limited (429)');
                     }
+                    // FSR-55: a 4xx other than 408 (timeout) is PERMANENT — invalid event shape
+                    // (400), origin not allowed (403), auth (401). Retrying / parking it just blocks
+                    // the queue and hammers ingest forever. Tag it so the caller drops the batch.
+                    if (response.status >= 400 && response.status < 500 && response.status !== 408) {
+                        throw new PermanentError(response.status, `HTTP ${response.status}: ${response.statusText}`);
+                    }
                     throw new Error(`HTTP ${response.status}: ${response.statusText}`);
                 }
                 this.log(`Batch sent successfully to ${currentEndpoint}: ${events.length} events`);
             }
             catch (error) {
-                // A 429 is deliberate backpressure — do NOT retry it here (neither fallback nor
-                // backoff). Propagate so the batch moves to the offline queue; the periodic drain
-                // resumes only after rateLimitedUntil. This is what prevents the retry storm.
-                if (error instanceof RateLimitError) {
+                // A 429 is deliberate backpressure and a 4xx is permanent — do NOT retry either
+                // (neither fallback nor backoff). Propagate so the caller routes them correctly
+                // (offline queue for 429, drop for permanent). This prevents the retry storm.
+                if (error instanceof RateLimitError || error instanceof PermanentError) {
                     throw error;
                 }
                 // Try next fallback endpoint if available
@@ -2178,6 +2444,38 @@ class EventQueue {
             this.offlineQueueLock = false;
         }
     }
+    /**
+     * Persist a critical event to the offline queue BEFORE its immediate send, so it
+     * survives an unload during the send/backoff window. Deduped on event_id so a
+     * re-enqueue can't double-store it. (FSR-16)
+     */
+    persistCriticalEvent(event) {
+        if (!this.enabled)
+            return;
+        if (this.offlineQueue.some(e => e.event_id === event.event_id))
+            return;
+        this.offlineQueue.push(event);
+        if (this.offlineQueue.length > this.config.maxOfflineQueueSize) {
+            this.offlineQueue.splice(0, this.offlineQueue.length - this.config.maxOfflineQueueSize);
+        }
+        this.saveOfflineQueue();
+    }
+    /**
+     * Remove a delivered/dropped event from the offline queue by event_id, and clear the
+     * persisted copy when the queue empties. (FSR-16)
+     */
+    removeFromOfflineQueue(eventId) {
+        const before = this.offlineQueue.length;
+        this.offlineQueue = this.offlineQueue.filter(e => e.event_id !== eventId);
+        if (this.offlineQueue.length === before)
+            return;
+        if (this.offlineQueue.length === 0) {
+            storage.remove(this.OFFLINE_QUEUE_KEY);
+        }
+        else {
+            this.saveOfflineQueue();
+        }
+    }
     /**
      * Load offline queue from storage
      */
@@ -2232,8 +2530,17 @@ class EventQueue {
                         this.saveOfflineQueue();
                     }
                     catch (error) {
+                        // FSR-55: a permanently-rejected (4xx) batch must NOT go back to the head —
+                        // that would block every event behind it forever and hammer ingest every tick.
+                        // Drop it (already spliced off the front) and keep draining the rest.
+                        if (error instanceof PermanentError) {
+                            this.log(`Dropping poison offline batch (${batch.length}) — permanent error ${error.status}`);
+                            this.saveOfflineQueue();
+                            continue;
+                        }
                         this.log('Failed to send offline batch:', error);
-                        // Put back in queue
+                        // Transient/rate-limited: put the batch back at the head and stop this drain;
+                        // the next tick (after any rateLimitedUntil window) retries.
                         this.offlineQueue.unshift(...batch);
                         this.saveOfflineQueue();
                         break;
@@ -2277,42 +2584,71 @@ class EventQueue {
         };
     }
     /**
-     * Force flush (for page unload)
-     * FIXED (WEB-3): include the offline queue, chunk under sendBeacon's ~64KB cap,
-     * and persist any chunk the browser refuses so it survives to the next page load.
-     * Previously this beaconed the live queue as one blob — ignoring the offline queue
-     * entirely and silently failing (returning false) whenever the payload exceeded 64KB.
+     * Force flush. Called on visibilitychange:hidden (NON-terminal — an ordinary tab
+     * switch / mobile background) and on pagehide+beforeunload (terminal unload).
      *
-     * Two follow-up review fixes:
-     *  - HIGH-1: exclude any batch currently in-flight in _flush(). That batch is being
-     *    sent with a keepalive fetch that already survives unload; re-beaconing it would
-     *    double-send. (`inFlight` is the front `inFlight.length` events of this.queue.)
-     *  - HIGH-2: handleUnload is wired to visibilitychange+pagehide+beforeunload, so this
-     *    runs multiple times per lifecycle. Detach what we beacon SYNCHRONOUSLY (clear the
-     *    in-memory queues, persist a refused remainder straight to storage rather than back
-     *    into this.offlineQueue) so a repeat call finds nothing to re-send.
+     * FSR-15: the old single path beaconed BOTH queues on EVERY visibilitychange and then
+     * storage.remove()'d the persisted offline copy on sendBeacon()===true. But sendBeacon
+     * true only means the browser ENQUEUED the request — not that it was delivered. The
+     * offline queue exists precisely because earlier sends failed (ingest down / 5xx / 429);
+     * a single alt-tab during that outage beaconed the whole backlog into the dead endpoint
+     * and ERASED the persisted copy, so nothing replayed when ingest recovered. It also
+     * ignored rateLimitedUntil, firing beacons straight into the Retry-After window.
+     *
+     * Now:
+     *  - Non-terminal (tab switch): deliver the LIVE queue via a response-checked keepalive
+     *    fetch (flush) and response-check-drain the offline backlog (processOfflineQueue) —
+     *    neither erases the backlog on failure. The destructive beacon path is not used.
+     *  - Terminal (unload): beacon live+offline best-effort, but PERSIST everything first
+     *    and NEVER storage.remove() on a mere beacon enqueue. The next page load's
+     *    response-checked drain (normal fetch, no 64KB cap) is the source of truth and
+     *    clears the copy; server event_id dedup makes the potential double-send safe.
+     *  - Both paths honor rateLimitedUntil (don't beacon/flush into the backoff window).
+     *
+     * Still excludes the in-flight _flush batch (its keepalive fetch already carries it,
+     * HIGH-1), and detaches synchronously so a repeat unload event this lifecycle re-enters
+     * with nothing to re-beacon (HIGH-2).
      */
     forceFlush() {
-        return __awaiter(this, void 0, void 0, function* () {
+        return __awaiter(this, arguments, void 0, function* (isTerminal = false) {
             if (!this.enabled)
                 return;
-            if (!navigator.sendBeacon) {
-                // No beacon API — best-effort keepalive-fetch drain of both queues.
+            if (!isTerminal) {
+                // Non-terminal visibilitychange: the page is still alive, so use the
+                // response-checked send paths (keepalive fetch) — they move failures to the
+                // persisted offline queue rather than erasing it. Within the 429 window, leave
+                // everything parked.
+                if (Date.now() < this.rateLimitedUntil)
+                    return;
                 yield this.flush();
                 yield this.processOfflineQueue();
                 return;
             }
+            // Terminal unload.
             // Exclude the in-flight batch (its keepalive fetch already carries it).
             const live = this.queue.slice(this.inFlight.length);
             const pending = [...live, ...this.offlineQueue];
-            // Detach synchronously: keep only the in-flight front (for _flush to settle) and
-            // empty the offline queue, so a second unload event this lifecycle re-enters with
-            // nothing to re-beacon. The refused remainder (if any) is persisted to STORAGE
-            // below, not back into this.offlineQueue, for exactly this reason.
+            // Detach the IN-MEMORY queues synchronously so a second unload event this lifecycle
+            // finds nothing to re-beacon (HIGH-2). The persisted STORAGE copy below is the
+            // durable record and is deliberately NOT removed on a successful beacon. (FSR-15)
             this.queue = this.queue.slice(0, this.inFlight.length);
             this.offlineQueue = [];
             if (pending.length === 0)
                 return;
+            // Persist the full backlog FIRST so it survives no matter what sendBeacon reports.
+            // The next load's response-checked drain delivers + clears it (dedup-safe). (FSR-15)
+            if (this.enabled) {
+                const toPersist = pending.slice(-this.config.maxOfflineQueueSize);
+                if (pending.length > toPersist.length) {
+                    this.log(`Offline cap dropped ${pending.length - toPersist.length} oldest events at unload`);
+                }
+                storage.set(this.OFFLINE_QUEUE_KEY, toPersist);
+            }
+            // Within the 429 window, don't beacon into it — the persisted copy drains next load.
+            if (Date.now() < this.rateLimitedUntil)
+                return;
+            if (!navigator.sendBeacon)
+                return; // no beacon API — next load fetch-drains the copy
             const MAX_BEACON_BYTES = 60000; // headroom under the browser's ~64KB cap
             // Greedily pack events into chunks bounded by BOTH batchSize and byte size.
             const chunks = [];
@@ -2333,36 +2669,18 @@ class EventQueue {
             }
             if (current.length > 0)
                 chunks.push(current);
-            // Send each chunk; the moment the browser refuses to enqueue one, keep it and
-            // everything after it for the next session.
-            let failedFrom = -1;
-            for (let c = 0; c < chunks.length; c++) {
-                const blob = new Blob([JSON.stringify(this.buildBatch(chunks[c]))], {
+            // Best-effort early delivery. We do NOT storage.remove() on success — the persisted
+            // copy is the source of truth for the next load (sendBeacon true ≠ delivered).
+            let beaconed = 0;
+            for (const chunk of chunks) {
+                const blob = new Blob([JSON.stringify(this.buildBatch(chunk))], {
                     type: 'application/json'
                 });
-                if (!navigator.sendBeacon(this.config.endpoint, blob)) {
-                    failedFrom = c;
+                if (!navigator.sendBeacon(this.config.endpoint, blob))
                     break;
-                }
-            }
-            if (failedFrom >= 0) {
-                const remainder = chunks
-                    .slice(failedFrom)
-                    .reduce((acc, c) => acc.concat(c), []);
-                // Persist straight to storage (NOT this.offlineQueue) so a repeat unload event
-                // won't re-beacon it; the next page load's drain (which uses a normal fetch with
-                // no 64KB cap) delivers it. MED-2: log if the maxOfflineQueueSize cap truncates.
-                const toPersist = remainder.slice(-this.config.maxOfflineQueueSize);
-                if (remainder.length > toPersist.length) {
-                    this.log(`Offline cap dropped ${remainder.length - toPersist.length} oldest events at unload`);
-                }
-                storage.set(this.OFFLINE_QUEUE_KEY, toPersist);
-                this.log(`sendBeacon refused ${remainder.length} events; persisted ${toPersist.length} for next load`);
-            }
-            else {
-                this.log('Events sent via sendBeacon');
-                storage.remove(this.OFFLINE_QUEUE_KEY);
+                beaconed += chunk.length;
             }
+            this.log(`forceFlush(terminal): beaconed ${beaconed}/${pending.length} events; persisted copy retained for next-load drain`);
         });
     }
     /**
@@ -2602,17 +2920,33 @@ class ContainerManager {
             if (this.initialized)
                 return;
             try {
-                // Fetch container configuration
-                const response = yield fetch(`${this.endpoint}/container-scripts`, {
-                    method: 'POST',
-                    headers: {
-                        'Content-Type': 'application/json',
-                        'X-Container-Version': '1.0'
-                    },
-                    body: JSON.stringify({
-                        workspaceId: this.workspaceId
-                    })
-                });
+                // FSR-52: time-box the /container-scripts fetch. init() is awaited BEFORE the
+                // initial page() fires, and this fetch had no timeout — a slow/stalled ingest
+                // worker (the fleet has a documented history of worker-side stalls) delayed or lost
+                // the landing pageview indefinitely. Abort after 3s so page() still fires; the catch
+                // below leaves pixels/remoteConfig unset (the SDK proceeds with first-party tracking
+                // and defaults). AbortSignal.timeout isn't on every supported browser, so use a
+                // manual controller.
+                const controller = typeof AbortController !== 'undefined' ? new AbortController() : null;
+                const timeoutId = controller ? setTimeout(() => controller.abort(), 3000) : null;
+                let response;
+                try {
+                    response = yield fetch(`${this.endpoint}/container-scripts`, {
+                        method: 'POST',
+                        headers: {
+                            'Content-Type': 'application/json',
+                            'X-Container-Version': '1.0'
+                        },
+                        body: JSON.stringify({
+                            workspaceId: this.workspaceId
+                        }),
+                        signal: controller ? controller.signal : undefined
+                    });
+                }
+                finally {
+                    if (timeoutId)
+                        clearTimeout(timeoutId);
+                }
                 if (!response.ok) {
                     throw new Error(`Failed to fetch container scripts: ${response.status}`);
                 }
@@ -3083,6 +3417,16 @@ class ContainerManager {
             this.log('Error initializing TikTok Pixel:', error);
         }
     }
+    /**
+     * Whether the Meta Pixel is configured AND loaded (fbq present) — i.e. a Purchase
+     * co-fire via trackToPixels() would actually reach Meta rather than silently no-op.
+     * Used by the CC purchase-pixel dedup so its once-per-order guard isn't burned before
+     * the pixel is live. (FSR-102)
+     */
+    hasMetaPixel() {
+        var _a, _b;
+        return !!(((_b = (_a = this.pixels) === null || _a === void 0 ? void 0 : _a.meta) === null || _b === void 0 ? void 0 : _b.enabled) && window.fbq);
+    }
     /**
      * Track event to all initialized pixels
      */
@@ -3390,28 +3734,59 @@ class AutoIdentifyManager {
     setupFormMonitoring() {
         // Monitor existing forms
         this.scanForEmailForms();
-        // Watch for new forms (SPAs)
-        const observer = new MutationObserver(() => {
+        // Watch for new forms (SPAs). FSR-101: store the observer so destroy() (opt-out / SDK
+        // destroy) can disconnect it — previously it was a local and leaked for the page
+        // lifetime, re-scanning + re-attaching listeners on every DOM mutation after opt-out.
+        this.formObserver = new MutationObserver(() => {
             this.scanForEmailForms();
         });
-        observer.observe(document.body, {
+        this.formObserver.observe(document.body, {
             childList: true,
             subtree: true
         });
         this.log('Form monitoring active');
     }
+    /**
+     * The form's email input that belongs to the VISITOR (not a gift/recipient field), or
+     * null when there's no usable / unambiguous one. (FSR-49)
+     */
+    findVisitorEmailInput(form) {
+        const all = Array.from(form.querySelectorAll('input[type="email"], input[name*="email" i], input[id*="email" i], input[autocomplete="email"]'));
+        // Drop third-party (gift/recipient/refer-a-friend) email fields.
+        const candidates = all.filter(i => !this.isThirdPartyEmailField(i));
+        if (candidates.length === 0)
+            return null;
+        if (candidates.length === 1)
+            return candidates[0];
+        // Multiple remain → prefer an explicit autocomplete="email" (the visitor's own field).
+        const preferred = candidates.filter(i => (i.getAttribute('autocomplete') || '').toLowerCase() === 'email');
+        if (preferred.length === 1)
+            return preferred[0];
+        // Still ambiguous → skip rather than identify as the wrong person.
+        this.log('Multiple email inputs in form; skipping auto-identify (ambiguous)');
+        return null;
+    }
+    isThirdPartyEmailField(input) {
+        const haystack = [
+            input.name, input.id, input.getAttribute('autocomplete'),
+            input.getAttribute('aria-label'), input.placeholder
+        ].filter(Boolean).join(' ');
+        return AutoIdentifyManager.THIRD_PARTY_EMAIL_FIELD.test(haystack);
+    }
     /**
      * Scan DOM for forms with email inputs
      */
     scanForEmailForms() {
+        if (this.destroyed)
+            return; // FSR-101: defense-in-depth after disconnect
         const forms = document.querySelectorAll('form');
         forms.forEach(form => {
             // Skip if already listening
             if (this.formListeners.some(l => l.element === form)) {
                 return;
             }
-            // Check if form has email input
-            const emailInput = form.querySelector('input[type="email"], input[name*="email" i], input[id*="email" i]');
+            // Only monitor forms with a capturable VISITOR email field (FSR-49).
+            const emailInput = this.findVisitorEmailInput(form);
             if (emailInput) {
                 const handler = (e) => this.handleFormSubmit(e, form);
                 form.addEventListener('submit', handler);
@@ -3425,8 +3800,8 @@ class AutoIdentifyManager {
      */
     handleFormSubmit(_event, form) {
         try {
-            // Find email input
-            const emailInput = form.querySelector('input[type="email"], input[name*="email" i], input[id*="email" i]');
+            // Find the visitor's own email input (excludes gift/recipient fields — FSR-49).
+            const emailInput = this.findVisitorEmailInput(form);
             if (!emailInput)
                 return;
             const email = emailInput.value.trim();
@@ -3768,6 +4143,12 @@ class AutoIdentifyManager {
             XMLHttpRequest.prototype.send = this.originalXHRSend;
             this.originalXHRSend = undefined;
         }
+        // Disconnect the form MutationObserver (FSR-101) — otherwise it keeps firing
+        // scanForEmailForms on every DOM mutation after opt-out, re-attaching listeners.
+        if (this.formObserver) {
+            this.formObserver.disconnect();
+            this.formObserver = undefined;
+        }
         // Remove form listeners
         this.formListeners.forEach(({ element, handler }) => {
             element.removeEventListener('submit', handler);
@@ -3789,6 +4170,10 @@ class AutoIdentifyManager {
         }
     }
 }
+// FSR-49: email fields that belong to a THIRD PARTY, not the visitor — gift/recipient/
+// refer-a-friend/"email this to" forms. Capturing these identifies the visitor as
+// someone else (and feeds that person's email to Meta advanced matching).
+AutoIdentifyManager.THIRD_PARTY_EMAIL_FIELD = /(recipient|friend|gift|refer|invite|colleague|coworker|share|to[-_]?email|email[-_]?to|second(ary)?[-_]?email)/i;
 
 /** Keys the remote config is allowed to fill on DatalyrConfig. */
 const REMOTE_KEYS = [
@@ -3900,8 +4285,11 @@ class Datalyr {
         if (this.config.platform === 'checkoutchamp') {
             this.restoreFromURL();
         }
-        // Initialize modules
-        this.identity = new IdentityManager();
+        // Initialize modules.
+        // FSR-107: don't write a persistent tracking cookie/localStorage id for a visitor who
+        // is opted-out / GPC / DNT at init — the id stays in memory only (events don't send
+        // anyway). shouldTrack() is computable here (config/opt-out/consent are all set above).
+        this.identity = new IdentityManager({ persistNewId: this.shouldTrack() });
         this.session = new SessionManager(this.config.sessionTimeout);
         this.attribution = new AttributionManager({
             attributionWindow: this.config.attributionWindow,
@@ -4223,10 +4611,13 @@ class Datalyr {
             return;
         }
         try {
-            // FIXED (DATA-05): Rotate session ID on identify to prevent session fixation
-            if (this.session) {
-                this.session.rotateSessionId();
-            }
+            // FSR-53: do NOT rotate the session id on identify(). 'Session fixation' is an
+            // auth-credential concept; a client-generated analytics session_id is not one.
+            // Rotating split every identified visit (and every auto-identify form submit) into
+            // two session_ids — inflating server-side uniq(session_id) counts by +1 per
+            // identified visitor and landing the post-login conversion in a session with zero
+            // preceding pageviews. Matches iOS/RN (no rotate-on-identify) and every major
+            // analytics SDK; keeps session-scoped attribution joins intact.
             // Update identity
             const identityLink = this.identity.identify(userId, traits);
             // SEC-03 Fix: Store user properties encrypted (contains PII)
@@ -4376,6 +4767,15 @@ class Datalyr {
         // Clear the journey too, or the next user's touchpoints append to the previous
         // user's (cross-user contamination of touchpoint_count / days_since_first_touch).
         storage.remove('dl_journey');
+        // FSR-106: clear first/last-touch attribution as well — same cross-user-contamination
+        // rationale as the journey. Otherwise the next anon visitor's events carry the
+        // PREVIOUS user's first_touch_*/last_touch_* (via getAttributionData's fallback),
+        // crediting user B's conversions to the ad click that brought user A.
+        // (Meta's _fbc/_fbp cookies are deliberately left alone — they're shared with the
+        // merchant's own Meta Pixel and clearing them could break it; the fresh anonymous_id
+        // already de-links the visitor server-side.)
+        storage.remove('dl_first_touch');
+        storage.remove('dl_last_touch');
         this.session.createNewSession();
         this.log('User reset');
     }
@@ -4552,8 +4952,17 @@ class Datalyr {
      * Set consent preferences
      */
     setConsent(consent) {
+        // Always record + persist consent FIRST, even before init(). FSR-51: a consent-
+        // management platform commonly calls setConsent() before init() so tracking is gated
+        // from the very first event. The old code then dereferenced this.queue/this.config
+        // (both undefined pre-init) inside shouldTrack()/setEnabled() and threw an uncaught
+        // TypeError into the CMP's callback chain. init() re-reads dl_consent (and gates the
+        // queue) at startup, so a pre-init call is honored there.
         this.consent = consent;
         storage.set('dl_consent', consent);
+        if (!this.initialized) {
+            return;
+        }
         // Enforce it live (not just persist it). Gate the queue by the full policy
         // (analytics consent + opt-out + DNT/GPC), and on withdrawal purge buffered events
         // too — mirroring optOut — so events captured before withdrawal can't drain if
@@ -4794,6 +5203,16 @@ class Datalyr {
             const orderId = order.orderId;
             if (!orderId)
                 return;
+            // FSR-102: only burn the once-per-order guard once the Meta Pixel is actually live.
+            // trackToPixels no-ops when the container config never arrived (pixels=null after a
+            // transient /container-scripts failure); setting the guard first would permanently
+            // suppress the co-fire for the rest of the funnel session even when the container
+            // loads on a later upsell page. orderData persists across upsell loads, so a later
+            // page retries. Meta's 48h event_id dedup still protects against a double-fire.
+            if (!this.container.hasMetaPixel()) {
+                this.log("CC Purchase Pixel: Meta pixel not ready; will retry on next funnel page");
+                return;
+            }
             // orderData persists across upsell page loads — fire the primary Purchase
             // Pixel once per order. (Meta also dedupes by event_id over 48h, so this is
             // belt-and-suspenders against a per-page re-fire.)
@@ -4853,14 +5272,20 @@ class Datalyr {
             }
         };
         const buildBridgeParams = () => {
+            var _a, _b;
             const attribution = this.attribution.getAttributionData();
             const out = {};
             const vid = this.identity.getAnonymousId();
             const fbc = this.cookies.get("_fbc") || attribution._fbc;
             const fbp = this.cookies.get("_fbp") || attribution._fbp;
-            const fbclid = attribution.clickIdType === "fbclid" ? attribution.clickId : null;
+            // FSR-104: read the named click-id fields directly (captureAttribution stores every
+            // present click id under its own key) so a landing URL carrying BOTH fbclid and
+            // gclid bridges both — the old `clickIdType === 'fbclid' ? clickId : null` dropped
+            // gclid whenever fbclid was the primary, silently losing Google attribution on the
+            // cross-domain CC path. Fall back to the primary clickId for older stored shapes.
+            const fbclid = (_a = attribution.fbclid) !== null && _a !== void 0 ? _a : (attribution.clickIdType === "fbclid" ? attribution.clickId : null);
             const fbclidAt = this.cookies.get("_dl_fbclid_at");
-            const gclid = attribution.clickIdType === "gclid" ? attribution.clickId : null;
+            const gclid = (_b = attribution.gclid) !== null && _b !== void 0 ? _b : (attribution.clickIdType === "gclid" ? attribution.clickId : null);
             const gclidAt = this.cookies.get("_dl_gclid_at");
             if (vid)
                 out._dl_vid = vid;
@@ -4963,18 +5388,32 @@ class Datalyr {
      */
     createEventPayload(eventName, properties, eventIdArg) {
         // NEW-2: keep the identity's cached session id in lockstep with the LIVE session.
-        // The session id changes on identify() (rotateSessionId) and on session timeout, but
-        // identity only synced it at init/start — so the top-level payload.session_id (from
-        // identity) disagreed with event_data.session_id (from session.getMetrics()). Sync
-        // here, before reading either, so every event carries a single consistent session id.
+        // The session id changes on session timeout (and previously on identify(), removed in
+        // FSR-53), but identity only synced it at init/start — so the top-level
+        // payload.session_id (from identity) could disagree with event_data.session_id (from
+        // session.getMetrics()). Sync here, before reading either, so every event carries a
+        // single consistent session id.
         this.identity.setSessionId(this.session.getSessionId());
         // Sanitize and merge properties
         const sanitizedProperties = sanitizeEventData(properties);
         const eventData = deepMerge({}, this.superProperties, sanitizedProperties);
-        // Add attribution data
+        // FSR-105: caller-passed properties take precedence over auto-captured context.
+        // Previously Object.assign clobbered them — e.g. track('purchase', { source: 'pos',
+        // campaign: 'spring-sale' }) shipped with the URL-derived source/campaign instead.
+        // Fill ONLY the attribution/browser-context keys the caller didn't set. (session
+        // metrics + fingerprint stay SDK-authoritative below: session_id is a join key.)
+        const assignMissing = (target, source) => {
+            for (const k in source) {
+                if (Object.prototype.hasOwnProperty.call(source, k) &&
+                    !Object.prototype.hasOwnProperty.call(target, k)) {
+                    target[k] = source[k];
+                }
+            }
+        };
+        // Add attribution data (caller wins on collisions)
         const attributionData = this.attribution.getAttributionData();
-        Object.assign(eventData, attributionData);
-        // Add session metrics
+        assignMissing(eventData, attributionData);
+        // Add session metrics (SDK-authoritative — session_id et al. must not be overridden)
         const sessionMetrics = this.session.getMetrics();
         Object.assign(eventData, sessionMetrics);
         // Add fingerprint data if enabled
@@ -4984,8 +5423,8 @@ class Datalyr {
                 device_fingerprint: fingerprintData // Use snake_case only (matches backend)
             });
         }
-        // Add browser context
-        Object.assign(eventData, {
+        // Add browser context (caller wins on collisions)
+        assignMissing(eventData, {
             url: window.location.href,
             path: window.location.pathname,
             referrer: document.referrer,
@@ -5023,8 +5462,10 @@ class Datalyr {
             // Resolution metadata
             resolution_method: 'browser_sdk',
             resolution_confidence: 1.0,
-            // SDK metadata (keep in sync with package.json version)
-            sdk_version: '1.7.1',
+            // SDK metadata. MUST stay in sync with package.json "version" — the build guard
+            // (scripts/check-bundle.js, run by build:check) fails the build if the bundle's
+            // sdk_version doesn't match package.json. (FSR-103)
+            sdk_version: '1.7.3',
             sdk_name: 'datalyr-web-sdk'
         };
         return payload;
@@ -5109,10 +5550,13 @@ class Datalyr {
     setupUnloadHandler() {
         // Store refs so destroy() can remove these — otherwise a destroy()+re-init() cycle
         // leaks listeners that keep firing forceFlush() on the OLD (destroyed) queue. (H2)
-        this.unloadHandler = () => { this.queue.forceFlush(); };
+        // FSR-15: pagehide/beforeunload are TERMINAL (beacon both queues, keep the persisted
+        // copy); a visibilitychange:hidden is just a tab switch / background, so use the
+        // non-terminal path (response-checked fetch drain that never erases the backlog).
+        this.unloadHandler = () => { this.queue.forceFlush(true); };
         this.visibilityHandler = () => {
             if (document.visibilityState === 'hidden')
-                this.queue.forceFlush();
+                this.queue.forceFlush(false);
         };
         // Use multiple events for maximum compatibility.
         window.addEventListener('beforeunload', this.unloadHandler);
@@ -5200,7 +5644,11 @@ class Datalyr {
      * Debug logging
      */
     log(...args) {
-        if (this.config.debug) {
+        var _a;
+        // FSR-51: optional-chain config — log() is reachable before init() (e.g.
+        // setSuperProperties() called pre-init), where this.config is undefined; the bare
+        // `this.config.debug` threw an uncaught TypeError into the caller.
+        if ((_a = this.config) === null || _a === void 0 ? void 0 : _a.debug) {
             console.log('[Datalyr]', ...args);
         }
     }