@datalyr/web 1.7.2 → 1.7.3

package/dist/datalyr.js

@@ -1,5 +1,5 @@
 /**
- * @datalyr/web v1.7.2
+ * @datalyr/web v1.7.3
  * Datalyr Web SDK - Modern attribution tracking for web applications
  * (c) 2026 Datalyr Inc.
  * Released under the MIT License
@@ -294,6 +294,42 @@ var Datalyr = (function (exports) {
                 return defaultValue;
             }
         }
+        /**
+         * Get a value as a RAW string, skipping the JSON.parse that get() applies.
+         *
+         * FSR-17: get() blindly JSON.parses, so a stored user_id like '12345' comes back as
+         * the NUMBER 12345 after reload, and a 16+-digit snowflake id ('1234567890123456789')
+         * is silently precision-corrupted (→ 1234567890123456800) — permanent identity
+         * fragmentation. Identifiers (dl_user_id, dl_anonymous_id, dl_auto_identified_email)
+         * must round-trip as the exact string they were stored as; use this for them.
+         */
+        getString(key, defaultValue = null) {
+            const fullKey = this.prefix + key;
+            try {
+                const value = this.storage
+                    ? this.storage.getItem(fullKey)
+                    : (this.memory.has(fullKey) ? this.memory.get(fullKey) : null);
+                if (value === null || value === undefined)
+                    return defaultValue;
+                // Values written by set() with a string are stored raw (unquoted); return as-is.
+                // A value written as JSON (quoted string) is unwrapped so callers always get the
+                // logical string, never a quoted one.
+                if (value.length >= 2 && value[0] === '"' && value[value.length - 1] === '"') {
+                    try {
+                        const parsed = JSON.parse(value);
+                        if (typeof parsed === 'string')
+                            return parsed;
+                    }
+                    catch (_a) {
+                        // fall through to raw
+                    }
+                }
+                return value;
+            }
+            catch (_b) {
+                return defaultValue;
+            }
+        }
         set(key, value) {
             const fullKey = this.prefix + key;
             const stringValue = typeof value === 'string' ? value : JSON.stringify(value);
@@ -474,19 +510,32 @@ var Datalyr = (function (exports) {
             this.secure = options.secure || 'auto';
         }
         get(name) {
-            var _a;
-            const value = `; ${document.cookie}`;
-            const parts = value.split(`; ${name}=`);
-            if (parts.length === 2) {
-                const rawValue = ((_a = parts.pop()) === null || _a === void 0 ? void 0 : _a.split(';').shift()) || null;
-                if (rawValue) {
-                    try {
-                        return decodeURIComponent(rawValue);
-                    }
-                    catch (_b) {
-                        // Return raw value if decoding fails (backwards compatibility)
-                        return rawValue;
-                    }
+            // FSR-56: parse document.cookie into name=value pairs and return the FIRST match.
+            // The old `split('; ' + name + '=')` returned null whenever the same cookie name
+            // appeared more than once (3+ parts) — extremely common for ad cookies set at both
+            // the registrable domain and a subdomain (_fbp/_fbc/_ga), and producible by this SDK
+            // itself (the __dl_visitor_id host-only fallback). That caused real _fbp/_fbc to be
+            // ignored and re-synthesized, and the CC bridge cookie read to silently fail.
+            // Browsers list the most specific (longer path / host) cookie first, so first wins.
+            const cookieString = typeof document !== 'undefined' ? document.cookie : '';
+            if (!cookieString)
+                return null;
+            for (const pair of cookieString.split(';')) {
+                const trimmed = pair.trim();
+                const eq = trimmed.indexOf('=');
+                if (eq === -1)
+                    continue;
+                if (trimmed.slice(0, eq) !== name)
+                    continue;
+                const rawValue = trimmed.slice(eq + 1);
+                if (!rawValue)
+                    return null;
+                try {
+                    return decodeURIComponent(rawValue);
+                }
+                catch (_a) {
+                    // Return raw value if decoding fails (backwards compatibility)
+                    return rawValue;
                 }
             }
             return null;
@@ -663,6 +712,35 @@ var Datalyr = (function (exports) {
         }
         return params;
     }
+    // FSR-57: credential detection that matches whole TOKENS (after splitting a key on
+    // camelCase + separators), not substrings. The old substring regex deleted innocent
+    // keys — `author`/`authority` (contains 'auth'), `passenger_count`/`passport_number`
+    // (contains 'pass'), `session_type`/`cookie_consent` — silently dropping customer event
+    // properties. 'session' and 'cookie' are intentionally absent: they're not credentials.
+    // Single words that are unambiguous as whole tokens:
+    const SENSITIVE_KEY_WORDS = new Set([
+        'pass', 'password', 'passwd', 'pwd',
+        'secret', 'token', 'auth', 'authorization',
+        'bearer', 'signature', 'cvv', 'cvc', 'ssn'
+    ]);
+    // Compound credentials that tokenize into innocent-looking parts (api_key → api+key)
+    // — matched against the separator-stripped key so api_key / apiKey / access_token all hit.
+    const SENSITIVE_KEY_COMPOUNDS = [
+        'apikey', 'accesskey', 'secretkey', 'privatekey', 'publickey',
+        'accesstoken', 'refreshtoken', 'idtoken', 'clientsecret',
+        'creditcard', 'cardnumber'
+    ];
+    function isSensitiveKey(key) {
+        const words = key
+            .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+            .split(/[\s._\-]+/)
+            .map(w => w.toLowerCase())
+            .filter(Boolean);
+        if (words.some(w => SENSITIVE_KEY_WORDS.has(w)))
+            return true;
+        const normalized = key.toLowerCase().replace(/[\s._\-]+/g, '');
+        return SENSITIVE_KEY_COMPOUNDS.some(c => normalized.includes(c));
+    }
     /**
      * Sanitize event data (remove sensitive keys, DOM elements, functions)
      */
@@ -684,11 +762,10 @@ var Datalyr = (function (exports) {
         // Handle objects
         if (typeof data === 'object') {
             const sanitized = {};
-            const sensitiveKeys = /pass|pwd|token|secret|auth|bearer|session|cookie|signature|api[-_]?key|private[-_]?key|access[-_]?token|refresh[-_]?token/i;
             for (const key in data) {
                 if (Object.prototype.hasOwnProperty.call(data, key)) {
-                    // Skip sensitive keys
-                    if (sensitiveKeys.test(key)) {
+                    // Skip sensitive keys (whole-token match — see SENSITIVE_KEY_WORDS)
+                    if (isSensitiveKey(key)) {
                         continue;
                     }
                     // Sanitize value recursively
@@ -703,9 +780,14 @@ var Datalyr = (function (exports) {
             if (data.length > 1000) {
                 return data.slice(0, 1000) + '...[truncated]';
             }
-            // Remove potential JWT tokens or API keys
-            if (data.match(/^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+$/) || // JWT
-                data.match(/^[a-f0-9]{32,}$/i)) { // Hex tokens
+            // FSR-57: redact only UNAMBIGUOUS JWTs — base64url '{"...' header always starts with
+            // 'eyJ'. The old rules redacted ANY 3-dot-segment string ('www.google.com' → so every
+            // 3-label referrer_host became '[Redacted]'; '1.7.1' semver too) and ANY 32+-char hex
+            // string (md5/order IDs, pre-hashed emails, and — critically — 32-hex customer user
+            // IDs on the $alias path, which silently wrote user_id='[Redacted]' into
+            // visitor_user_links, collapsing those users). Credential-bearing KEYS are already
+            // dropped above, so the bare-hex value heuristic was net-negative and is removed.
+            if (/^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(data)) { // JWT
                 return '[Redacted]';
             }
             return data;
@@ -759,60 +841,79 @@ var Datalyr = (function (exports) {
         return navigator.globalPrivacyControl === true ||
             window.globalPrivacyControl === true;
     }
+    // Common two-part TLDs (country-specific registries) where the registrable domain is
+    // the last THREE labels (e.g. shop.example.co.uk → example.co.uk). Not a full public
+    // suffix list, but covers the markets we see; CookieStorage.getAutoDomain() probes
+    // dynamically for the rest.
+    const TWO_PART_TLDS = new Set([
+        // United Kingdom
+        'co.uk', 'org.uk', 'net.uk', 'ac.uk', 'gov.uk', 'me.uk',
+        // Australia
+        'com.au', 'net.au', 'org.au', 'edu.au', 'gov.au',
+        // New Zealand
+        'co.nz', 'net.nz', 'org.nz', 'govt.nz',
+        // Japan
+        'co.jp', 'ne.jp', 'or.jp', 'ac.jp', 'go.jp',
+        // India
+        'co.in', 'net.in', 'org.in', 'gov.in', 'ac.in',
+        // South Africa
+        'co.za', 'net.za', 'org.za', 'gov.za',
+        // Brazil
+        'com.br', 'net.br', 'org.br', 'gov.br', 'edu.br',
+        // South Korea
+        'co.kr', 'ne.kr', 'or.kr', 'go.kr', 'ac.kr',
+        // China
+        'com.cn', 'net.cn', 'org.cn', 'gov.cn', 'edu.cn',
+        // Other Asia-Pacific
+        'co.id', 'co.th', 'com.sg', 'com.my', 'com.ph', 'com.vn',
+        'com.tw', 'com.hk',
+        // Latin America
+        'com.mx', 'com.ar', 'com.co', 'com.pe', 'com.cl',
+        // Europe
+        'co.il', 'co.at', 'co.hu', 'co.pl'
+    ]);
     /**
-     * Get root domain for cross-subdomain tracking
+     * Registrable domain (eTLD+1) for a hostname, honoring two-part ccTLDs.
+     *   shop.example.co.uk → example.co.uk
+     *   www.example.com    → example.com
+     *   localhost / IPs    → returned unchanged
+     * Returns a bare host (no leading dot) — getRootDomain() adds the cookie-domain dot.
+     * (FSR-47: same-site referrer classification must use this, not naive last-two-labels.)
+     */
+    function getRegistrableDomain(hostname) {
+        if (!hostname)
+            return hostname;
+        const lower = hostname.toLowerCase();
+        // Handle localhost and IP addresses
+        if (lower === 'localhost' ||
+            /^[0-9]{1,3}(\.[0-9]{1,3}){3}$/.test(lower) || // IPv4
+            /^\[?[0-9a-fA-F:]+\]?$/.test(lower)) { // IPv6
+            return hostname;
+        }
+        const parts = lower.split('.');
+        if (parts.length < 2)
+            return hostname;
+        const lastTwo = parts.slice(-2).join('.');
+        if (TWO_PART_TLDS.has(lastTwo) && parts.length >= 3) {
+            return parts.slice(-3).join('.');
+        }
+        return parts.slice(-2).join('.');
+    }
+    /**
+     * Get root domain for cross-subdomain tracking (cookie-domain form, with leading dot).
      */
     function getRootDomain() {
         const hostname = window.location.hostname;
-        // Handle localhost and IP addresses
+        // Handle localhost and IP addresses — never set a cookie domain for these.
         if (hostname === 'localhost' ||
             hostname.match(/^[0-9]{1,3}\./) || // IPv4
             hostname.match(/^\[?[0-9a-fA-F:]+\]?$/)) { // IPv6
             return hostname;
         }
-        // Get root domain (last two parts: example.com)
         const parts = hostname.split('.');
-        if (parts.length >= 2) {
-            // Handle .co.uk, .com.au, etc
-            const tld = parts[parts.length - 1];
-            const sld = parts[parts.length - 2];
-            // Common two-part TLDs (country-specific domains)
-            // Note: The CookieStorage.getAutoDomain() probe method handles unknown TLDs dynamically,
-            // but this list provides faster resolution for known patterns
-            const twoPartTlds = [
-                // United Kingdom
-                'co.uk', 'org.uk', 'net.uk', 'ac.uk', 'gov.uk', 'me.uk',
-                // Australia
-                'com.au', 'net.au', 'org.au', 'edu.au', 'gov.au',
-                // New Zealand
-                'co.nz', 'net.nz', 'org.nz', 'govt.nz',
-                // Japan
-                'co.jp', 'ne.jp', 'or.jp', 'ac.jp', 'go.jp',
-                // India
-                'co.in', 'net.in', 'org.in', 'gov.in', 'ac.in',
-                // South Africa
-                'co.za', 'net.za', 'org.za', 'gov.za',
-                // Brazil
-                'com.br', 'net.br', 'org.br', 'gov.br', 'edu.br',
-                // South Korea
-                'co.kr', 'ne.kr', 'or.kr', 'go.kr', 'ac.kr',
-                // China
-                'com.cn', 'net.cn', 'org.cn', 'gov.cn', 'edu.cn',
-                // Other Asia-Pacific
-                'co.id', 'co.th', 'com.sg', 'com.my', 'com.ph', 'com.vn',
-                'com.tw', 'com.hk',
-                // Latin America
-                'com.mx', 'com.ar', 'com.co', 'com.pe', 'com.cl',
-                // Europe
-                'co.il', 'co.at', 'co.hu', 'co.pl'
-            ];
-            const lastTwo = `${sld}.${tld}`;
-            if (twoPartTlds.includes(lastTwo) && parts.length >= 3) {
-                return '.' + parts.slice(-3).join('.');
-            }
-            return '.' + parts.slice(-2).join('.');
-        }
-        return hostname;
+        if (parts.length < 2)
+            return hostname;
+        return '.' + getRegistrableDomain(hostname);
     }
     /**
      * Get referrer data
@@ -867,9 +968,10 @@ var Datalyr = (function (exports) {
      * Handles anonymous_id, user_id, and identity resolution
      */
     class IdentityManager {
-        constructor() {
+        constructor(options = {}) {
             this.userId = null;
             this.sessionId = null;
+            this.persistNewId = options.persistNewId !== false;
             this.anonymousId = this.getOrCreateAnonymousId();
             this.userId = this.getStoredUserId();
         }
@@ -877,43 +979,84 @@ var Datalyr = (function (exports) {
          * Get or create anonymous ID (device/browser identifier)
          */
         getOrCreateAnonymousId() {
-            // 0. Check URL parameter first (cross-domain linking via _dl_vid)
-            // This enables tracking continuity when users navigate between different root domains
+            // 1. An EXISTING identity always wins — check the root-domain cookie (works across
+            //    subdomains) then localStorage. FSR-50: a persisted visitor must NEVER be
+            //    silently overwritten by a ?_dl_vid in the URL, or shared links would merge
+            //    unrelated visitors (identity takeover). The CC bridge (restoreFromURL) writes
+            //    this cookie BEFORE us, so the storefront visitor_id still wins there.
+            let anonymousId = cookies.get('__dl_visitor_id');
+            if (anonymousId) {
+                storage.set('dl_anonymous_id', anonymousId); // sync to localStorage
+                return anonymousId;
+            }
+            anonymousId = storage.getString('dl_anonymous_id'); // FSR-17: raw string, no JSON.parse
+            if (anonymousId) {
+                this.setRootDomainCookie('__dl_visitor_id', anonymousId);
+                return anonymousId;
+            }
+            // 2. Fresh visitor (no persisted id): accept a cross-domain bridge id from the URL,
+            //    but ONLY a well-formed anon_<uuid> — reject arbitrary / oversized values (a
+            //    multi-KB or attacker-crafted _dl_vid was previously persisted verbatim). Strip
+            //    it from the address bar so a re-shared URL can't merge the next visitor. (FSR-50)
             try {
                 const urlParams = new URLSearchParams(window.location.search);
                 const urlVisitorId = urlParams.get('_dl_vid');
-                if (urlVisitorId && urlVisitorId.startsWith('anon_')) {
-                    // Valid visitor ID from URL - use it and persist
-                    this.setRootDomainCookie('__dl_visitor_id', urlVisitorId);
-                    storage.set('dl_anonymous_id', urlVisitorId);
+                if (urlVisitorId && this.isValidAnonymousId(urlVisitorId)) {
+                    this.stripUrlParam('_dl_vid');
+                    this.persistAnonymousId(urlVisitorId);
                     return urlVisitorId;
                 }
             }
             catch (e) {
-                // URL parsing failed - continue with cookie/localStorage checks
+                // URL parsing failed - continue to generate a fresh id
                 console.warn('[Datalyr] Failed to parse URL for _dl_vid:', e);
             }
-            // 1. Check root domain cookie first (works across subdomains)
-            let anonymousId = cookies.get('__dl_visitor_id');
-            if (anonymousId) {
-                // Found in cookie - sync to localStorage
-                storage.set('dl_anonymous_id', anonymousId);
-                return anonymousId;
-            }
-            // 2. Check localStorage (fallback for cookie issues)
-            anonymousId = storage.get('dl_anonymous_id');
-            if (anonymousId) {
-                // Found in localStorage - set root domain cookie
-                this.setRootDomainCookie('__dl_visitor_id', anonymousId);
-                return anonymousId;
-            }
-            // 3. Generate new ID
+            // 3. Generate a new ID (persisted unless tracking is disallowed at init — FSR-107).
             anonymousId = `anon_${generateUUID()}`;
-            // 4. Store in both cookie (primary) and localStorage (backup)
-            this.setRootDomainCookie('__dl_visitor_id', anonymousId);
-            storage.set('dl_anonymous_id', anonymousId);
+            this.persistAnonymousId(anonymousId);
             return anonymousId;
         }
+        /**
+         * Persist a freshly-adopted/generated anonymous id to the root-domain cookie +
+         * localStorage. Gated by persistNewId (FSR-107: don't write a tracking identifier for
+         * an opted-out / GPC / DNT visitor at init).
+         */
+        persistAnonymousId(id) {
+            if (!this.persistNewId)
+                return;
+            this.setRootDomainCookie('__dl_visitor_id', id);
+            storage.set('dl_anonymous_id', id);
+        }
+        /**
+         * Whether a `_dl_vid` value is a well-formed Datalyr anonymous id (anon_ + UUID).
+         * The length is bounded by the pattern, so an oversized/garbage value is rejected.
+         * (FSR-50)
+         */
+        isValidAnonymousId(id) {
+            return /^anon_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id);
+        }
+        /**
+         * Remove a query param from the current URL via history.replaceState (best-effort).
+         * Used so a consumed `_dl_vid` doesn't linger in the address bar and get re-shared.
+         * (FSR-50)
+         */
+        stripUrlParam(param) {
+            var _a;
+            try {
+                if (typeof window === 'undefined' || typeof ((_a = window.history) === null || _a === void 0 ? void 0 : _a.replaceState) !== 'function')
+                    return;
+                const url = new URL(window.location.href);
+                if (!url.searchParams.has(param))
+                    return;
+                url.searchParams.delete(param);
+                const search = url.searchParams.toString();
+                const newUrl = url.pathname + (search ? '?' + search : '') + url.hash;
+                window.history.replaceState(window.history.state, '', newUrl);
+            }
+            catch (_b) {
+                // best-effort — never block init on URL rewrite
+            }
+        }
         /**
          * Set a root domain cookie for cross-subdomain tracking
          */
@@ -948,7 +1091,10 @@ var Datalyr = (function (exports) {
          * Get stored user ID from previous session
          */
         getStoredUserId() {
-            return storage.get('dl_user_id');
+            // FSR-17: getString (not get) so a numeric-looking user_id ('12345') doesn't come
+            // back as a JS number after reload, and a 16+-digit snowflake id isn't precision-
+            // corrupted by JSON.parse — both would fragment identity from the second page on.
+            return storage.getString('dl_user_id');
         }
         /**
          * Get the anonymous ID
@@ -1412,12 +1558,19 @@ var Datalyr = (function (exports) {
             const attribution = {
                 timestamp: Date.now()
             };
-            // Capture UTM parameters
+            // Capture UTM parameters.
+            // Emit BOTH the canonical `utm_*` key AND the stripped alias (source/medium/...).
+            // FSR-13: ingest (event_data.utm_source ?? utmSource) and EVERY attribution MV /
+            // lookup pipe key on the prefixed `utm_source`/`utm_campaign` names with no fallback —
+            // stripping the prefix left the UTM leg of the attribution read path dead for all web
+            // events. The stripped alias is still emitted because the dashboard analytics MVs and
+            // determineSource()/determineMedium() read it (and it's the long-standing shape).
             for (const utm of this.UTM_PARAMS) {
                 const value = params[utm];
                 if (value) {
+                    attribution[utm] = value; // canonical: utm_source, utm_campaign, ...
                     const key = utm.replace('utm_', '');
-                    attribution[key] = value;
+                    attribution[key] = value; // alias: source, campaign, ...
                 }
             }
             // Capture click IDs. The first present (by CLICK_IDS priority) is the primary
@@ -1585,33 +1738,53 @@ var Datalyr = (function (exports) {
                 // Optionally set the cookie for future use
                 cookies.set('_fbp', adCookies._fbp, 90);
             }
-            // Persist the click time the FIRST time we see fbclid/gclid in URL so we can
-            // rebuild fbc (and stamp real click time on server-side events) later even
-            // when _fbc/_gclid cookies get evicted. Once-only: never overwrite.
+            // Meta's fbc format is `fb.{subdomainIndex}.{creationTime}.{fbclid}` where
+            // creationTime is UNIX time in MILLISECONDS (matches the _fbp generation above
+            // and the real _fbc cookie the Meta Pixel writes). Do NOT use seconds here.
+            //
+            // FSR-14: a returning visitor who clicks a NEW ad must get a FRESH _fbc. The old
+            // once-only guards (`!_dl_fbclid_at`, `!_fbc`) meant a new fbclid never refreshed
+            // _fbc while a prior 90-day _fbc still existed — Meta then received the OLD
+            // campaign's fbc (and an old creationTime that can push the conversion outside the
+            // click window) even though event_data carried the new fbclid. We detect a new
+            // click by comparing the URL fbclid against the one embedded in the existing _fbc
+            // (its 4th dot-segment). `_dl_fbclid_at` stays a pure ms timestamp — the CC bridge /
+            // Shopify cart / server-side rebuild forward it as a time, so its format must not
+            // change.
             const fbclid = this.getCurrentFbclid();
-            if (fbclid && !cookies.get('_dl_fbclid_at')) {
-                cookies.set('_dl_fbclid_at', String(Date.now()), 90);
-            }
+            if (fbclid) {
+                const existingFbc = adCookies._fbc; // captured above (cookies.get('_fbc'))
+                const embeddedFbclid = this.extractFbclidFromFbc(existingFbc);
+                if (!existingFbc) {
+                    // No _fbc to compare against. Rebuild it, preferring the persisted click time
+                    // (covers the case where _fbc was evicted but the same click is still in play),
+                    // falling back to now if missing/corrupt (Number('abc') = NaN guard).
+                    const stored = cookies.get('_dl_fbclid_at');
+                    const parsed = stored ? Number(stored) : NaN;
+                    const timestamp = Number.isFinite(parsed) && parsed > 0 ? parsed : Date.now();
+                    if (!stored)
+                        cookies.set('_dl_fbclid_at', String(timestamp), 90);
+                    adCookies._fbc = `fb.1.${timestamp}.${fbclid}`;
+                    cookies.set('_fbc', adCookies._fbc, 90);
+                }
+                else if (embeddedFbclid && embeddedFbclid !== fbclid) {
+                    // A NEW ad click landed over a stale _fbc — regenerate with the new fbclid and
+                    // the CURRENT click time, and overwrite the persisted click time to match.
+                    const now = Date.now();
+                    adCookies._fbc = `fb.1.${now}.${fbclid}`;
+                    cookies.set('_fbc', adCookies._fbc, 90);
+                    cookies.set('_dl_fbclid_at', String(now), 90);
+                }
+                // else: same fbclid already embedded in _fbc → leave both cookies untouched.
+            }
+            // Persist the click time the FIRST time we see gclid in the URL so server-side
+            // events can stamp the real click moment even after the _gcl_* cookies evict.
+            // (gclid has no synthesized-and-going-stale artifact like _fbc, and Google does not
+            // validate a creationTime window the way Meta does, so this stays once-only.)
             const gclid = this.hasClickId('gclid') ? ((_b = (_a = this.queryParamsCache) === null || _a === void 0 ? void 0 : _a.gclid) !== null && _b !== void 0 ? _b : null) : null;
             if (gclid && !cookies.get('_dl_gclid_at')) {
                 cookies.set('_dl_gclid_at', String(Date.now()), 90);
             }
-            // Generate _fbc if we have fbclid but no _fbc.
-            // Meta's fbc format is `fb.{subdomainIndex}.{creationTime}.{fbclid}` where
-            // creationTime is UNIX time in MILLISECONDS (matches the _fbp generation above
-            // and the real _fbc cookie the Meta Pixel writes). Do NOT use seconds here.
-            if (fbclid && !adCookies._fbc) {
-                // Prefer the persisted click time when valid; fall back to now if the
-                // cookie is missing or corrupted (e.g. user edited it to garbage).
-                // Without this guard, Number("abc") = NaN and Meta would reject
-                // `fb.1.NaN.{fbclid}`.
-                const stored = cookies.get('_dl_fbclid_at');
-                const parsed = stored ? Number(stored) : NaN;
-                const timestamp = Number.isFinite(parsed) && parsed > 0 ? parsed : Date.now();
-                adCookies._fbc = `fb.1.${timestamp}.${fbclid}`;
-                // Optionally set the cookie for future use
-                cookies.set('_fbc', adCookies._fbc, 90);
-            }
             // Filter out null values for cleaner data
             return Object.fromEntries(Object.entries(adCookies).filter(([_, value]) => value !== null));
         }
@@ -1631,6 +1804,21 @@ var Datalyr = (function (exports) {
             const params = this.queryParamsCache || getAllQueryParams();
             return params.fbclid || null;
         }
+        /**
+         * Extract the fbclid embedded in an `_fbc` cookie value
+         * (`fb.{subdomainIndex}.{creationTime}.{fbclid}` → the 4th dot-segment), or null if
+         * the value is missing/malformed. Used to detect whether a NEW fbclid in the URL
+         * differs from the one a prior _fbc was built for. (FSR-14)
+         */
+        extractFbclidFromFbc(fbc) {
+            if (!fbc)
+                return null;
+            const parts = fbc.split('.');
+            // fb . subdomainIndex . creationTime . fbclid (the fbclid itself may contain no dots)
+            if (parts.length < 4 || parts[0] !== 'fb')
+                return null;
+            return parts.slice(3).join('.') || null;
+        }
         /**
          * Get attribution data for event
          */
@@ -1648,11 +1836,18 @@ var Datalyr = (function (exports) {
             const hasRealAttribution = !!(current.clickId ||
                 current.campaign ||
                 (current.source && current.source !== 'direct'));
-            if (!hasRealAttribution && firstTouch) {
-                // Direct / internal navigation: fall back to persistent attribution (90-day
-                // window) so the event isn't mis-attributed to 'direct', keeping page context.
-                if (!firstTouch.expires_at || Date.now() < firstTouch.expires_at) {
-                    current = Object.assign(Object.assign({}, firstTouch), { referrer: current.referrer, referrerHost: current.referrerHost, landingPage: current.landingPage, landingPath: current.landingPath });
+            // Direct / internal navigation: fall back to persisted attribution so the event
+            // isn't mis-attributed to 'direct'. FSR-48: prefer the LAST touch (the most recent
+            // real signal, e.g. a May Meta click) over the FIRST touch (e.g. a January gclid) —
+            // spreading firstTouch carried its stale clickId top-level and credited the older
+            // campaign for last-click. Also fall back to whichever of last/first touch is still
+            // valid, so an expired first-touch with a live last-touch no longer drops to 'direct'.
+            if (!hasRealAttribution) {
+                // getLastTouch()/getFirstTouch() already drop expired records, so either is live or
+                // null. Prefer last-touch; fall back to first-touch if there's no live last-touch.
+                const fallback = lastTouch || firstTouch;
+                if (fallback) {
+                    current = Object.assign(Object.assign({}, fallback), { referrer: current.referrer, referrerHost: current.referrerHost, landingPage: current.landingPage, landingPath: current.landingPath });
                 }
             }
             // Capture advertising cookies automatically
@@ -1772,8 +1967,10 @@ var Datalyr = (function (exports) {
          * internal navs from being mis-classified as referral.
          */
         isSameRootDomain(a, b) {
-            const root = (h) => h.split('.').slice(-2).join('.');
-            return root(a) === root(b);
+            // FSR-47: use the real eTLD+1 (public-suffix-aware) so a ccTLD merchant
+            // (shop.example.co.uk) doesn't collapse every external referrer that merely shares
+            // the suffix (google.co.uk → root 'co.uk') into 'direct'.
+            return getRegistrableDomain(a) === getRegistrableDomain(b);
         }
         /**
          * Extract hostname from URL
@@ -1821,6 +2018,16 @@ var Datalyr = (function (exports) {
     // already-overloaded server). See sendBatch / the rateLimitedUntil gate.
     class RateLimitError extends Error {
     }
+    // A permanent (non-retryable) failure — a 4xx other than 408/429 (invalid event shape,
+    // origin not allowed, auth). Retrying or parking it just head-of-line-blocks the offline
+    // queue forever and hammers ingest. Tagged so the send paths DROP the batch instead of
+    // unshifting it back to the head. (FSR-55)
+    class PermanentError extends Error {
+        constructor(status, message) {
+            super(message || `HTTP ${status}`);
+            this.status = status;
+        }
+    }
     class EventQueue {
         constructor(config) {
             this.queue = [];
@@ -1887,16 +2094,30 @@ var Datalyr = (function (exports) {
                 this.log('Duplicate event suppressed:', eventName);
                 return;
             }
-            // CRITICAL FIX (CRITICAL-05): Critical events need proper error handling
-            // Instead of calling sendBatch() without await, we add them to queue
-            // with immediate flush AND move to offline queue on failure
+            // Critical events (purchase/signup/lead/…) send immediately, bypassing the batch.
+            // FSR-16: persist the event to the offline queue BEFORE the first send and remove it
+            // on confirmed delivery. Previously the event existed ONLY inside the sendBatch retry
+            // closure during backoff (~31s) — not in any tracked queue — so a tab close mid-retry
+            // (the most plausible moment after checkout) lost the purchase permanently: forceFlush
+            // / destroy never saw it. Server-side event_id dedup makes the at-least-once re-send
+            // safe.
             if (this.config.criticalEvents.includes(eventName)) {
                 this.log('Critical event, sending immediately:', eventName);
-                // Send immediately with proper error handling
-                this.sendBatch([event]).catch((error) => {
-                    this.log('Critical event send failed, adding to offline queue:', eventName, error);
-                    // Move to offline queue to ensure it's not lost
-                    this.moveToOfflineQueue([event]);
+                this.persistCriticalEvent(event);
+                this.sendBatch([event])
+                    .then(() => {
+                    // Delivered — drop the persisted copy so it isn't replayed next load.
+                    this.removeFromOfflineQueue(event.event_id);
+                })
+                    .catch((error) => {
+                    if (error instanceof PermanentError) {
+                        this.log('Critical event permanently rejected, dropping:', eventName, error);
+                        this.removeFromOfflineQueue(event.event_id);
+                        return;
+                    }
+                    // Leave it persisted: the periodic drain + next-load drain retry it, and an
+                    // unload mid-retry can now beacon it (it's in the offline queue). (FSR-16)
+                    this.log('Critical event send failed, retained in offline queue:', eventName, error);
                 });
                 return;
             }
@@ -2045,7 +2266,14 @@ var Datalyr = (function (exports) {
                     // Remove the same slice from the live queue; the offline queue now drains on
                     // every periodic tick (WEB-1/WEB-2), so they are still retried, not stranded.
                     this.queue.splice(0, batchSize);
-                    this.moveToOfflineQueue(events);
+                    // FSR-55: don't park a permanently-rejected batch — it would never succeed and
+                    // would block the offline drain. Drop it.
+                    if (error instanceof PermanentError) {
+                        this.log(`Dropping ${events.length} events — permanent error ${error.status}`);
+                    }
+                    else {
+                        this.moveToOfflineQueue(events);
+                    }
                 }
                 finally {
                     this.inFlight = [];
@@ -2065,6 +2293,14 @@ var Datalyr = (function (exports) {
                 // Get current endpoint (main or fallback)
                 const endpoints = [this.config.endpoint, ...this.config.fallbackEndpoints];
                 const currentEndpoint = endpoints[endpointIndex] || this.config.endpoint;
+                const body = JSON.stringify(batchPayload);
+                // FSR-54: keepalive requests share a 64KB in-flight quota (Fetch spec) — a larger
+                // body fails INSTANTLY with a network error, then retries through every fallback +
+                // backoff (all failing the same way) and parks in the offline queue, where it
+                // head-of-line-blocks the drain forever. keepalive only matters for unload survival,
+                // so only request it when the body is safely under the cap; oversized batches go via
+                // a normal fetch (no cap) and succeed.
+                const useKeepalive = new Blob([body]).size <= 60000;
                 try {
                     const response = yield fetch(currentEndpoint, {
                         method: 'POST',
@@ -2072,8 +2308,8 @@ var Datalyr = (function (exports) {
                             'Content-Type': 'application/json',
                             'X-Batch-Size': events.length.toString()
                         },
-                        body: JSON.stringify(batchPayload),
-                        keepalive: true
+                        body,
+                        keepalive: useKeepalive
                     });
                     if (!response.ok) {
                         // Handle rate limiting
@@ -2089,15 +2325,21 @@ var Datalyr = (function (exports) {
                             this.log(`Rate limited; backing off ${retryAfter}s`);
                             throw new RateLimitError('Rate limited (429)');
                         }
+                        // FSR-55: a 4xx other than 408 (timeout) is PERMANENT — invalid event shape
+                        // (400), origin not allowed (403), auth (401). Retrying / parking it just blocks
+                        // the queue and hammers ingest forever. Tag it so the caller drops the batch.
+                        if (response.status >= 400 && response.status < 500 && response.status !== 408) {
+                            throw new PermanentError(response.status, `HTTP ${response.status}: ${response.statusText}`);
+                        }
                         throw new Error(`HTTP ${response.status}: ${response.statusText}`);
                     }
                     this.log(`Batch sent successfully to ${currentEndpoint}: ${events.length} events`);
                 }
                 catch (error) {
-                    // A 429 is deliberate backpressure — do NOT retry it here (neither fallback nor
-                    // backoff). Propagate so the batch moves to the offline queue; the periodic drain
-                    // resumes only after rateLimitedUntil. This is what prevents the retry storm.
-                    if (error instanceof RateLimitError) {
+                    // A 429 is deliberate backpressure and a 4xx is permanent — do NOT retry either
+                    // (neither fallback nor backoff). Propagate so the caller routes them correctly
+                    // (offline queue for 429, drop for permanent). This prevents the retry storm.
+                    if (error instanceof RateLimitError || error instanceof PermanentError) {
                         throw error;
                     }
                     // Try next fallback endpoint if available
@@ -2201,6 +2443,38 @@ var Datalyr = (function (exports) {
                 this.offlineQueueLock = false;
             }
         }
+        /**
+         * Persist a critical event to the offline queue BEFORE its immediate send, so it
+         * survives an unload during the send/backoff window. Deduped on event_id so a
+         * re-enqueue can't double-store it. (FSR-16)
+         */
+        persistCriticalEvent(event) {
+            if (!this.enabled)
+                return;
+            if (this.offlineQueue.some(e => e.event_id === event.event_id))
+                return;
+            this.offlineQueue.push(event);
+            if (this.offlineQueue.length > this.config.maxOfflineQueueSize) {
+                this.offlineQueue.splice(0, this.offlineQueue.length - this.config.maxOfflineQueueSize);
+            }
+            this.saveOfflineQueue();
+        }
+        /**
+         * Remove a delivered/dropped event from the offline queue by event_id, and clear the
+         * persisted copy when the queue empties. (FSR-16)
+         */
+        removeFromOfflineQueue(eventId) {
+            const before = this.offlineQueue.length;
+            this.offlineQueue = this.offlineQueue.filter(e => e.event_id !== eventId);
+            if (this.offlineQueue.length === before)
+                return;
+            if (this.offlineQueue.length === 0) {
+                storage.remove(this.OFFLINE_QUEUE_KEY);
+            }
+            else {
+                this.saveOfflineQueue();
+            }
+        }
         /**
          * Load offline queue from storage
          */
@@ -2255,8 +2529,17 @@ var Datalyr = (function (exports) {
                             this.saveOfflineQueue();
                         }
                         catch (error) {
+                            // FSR-55: a permanently-rejected (4xx) batch must NOT go back to the head —
+                            // that would block every event behind it forever and hammer ingest every tick.
+                            // Drop it (already spliced off the front) and keep draining the rest.
+                            if (error instanceof PermanentError) {
+                                this.log(`Dropping poison offline batch (${batch.length}) — permanent error ${error.status}`);
+                                this.saveOfflineQueue();
+                                continue;
+                            }
                             this.log('Failed to send offline batch:', error);
-                            // Put back in queue
+                            // Transient/rate-limited: put the batch back at the head and stop this drain;
+                            // the next tick (after any rateLimitedUntil window) retries.
                             this.offlineQueue.unshift(...batch);
                             this.saveOfflineQueue();
                             break;
@@ -2300,42 +2583,71 @@ var Datalyr = (function (exports) {
             };
         }
         /**
-         * Force flush (for page unload)
-         * FIXED (WEB-3): include the offline queue, chunk under sendBeacon's ~64KB cap,
-         * and persist any chunk the browser refuses so it survives to the next page load.
-         * Previously this beaconed the live queue as one blob — ignoring the offline queue
-         * entirely and silently failing (returning false) whenever the payload exceeded 64KB.
+         * Force flush. Called on visibilitychange:hidden (NON-terminal — an ordinary tab
+         * switch / mobile background) and on pagehide+beforeunload (terminal unload).
+         *
+         * FSR-15: the old single path beaconed BOTH queues on EVERY visibilitychange and then
+         * storage.remove()'d the persisted offline copy on sendBeacon()===true. But sendBeacon
+         * true only means the browser ENQUEUED the request — not that it was delivered. The
+         * offline queue exists precisely because earlier sends failed (ingest down / 5xx / 429);
+         * a single alt-tab during that outage beaconed the whole backlog into the dead endpoint
+         * and ERASED the persisted copy, so nothing replayed when ingest recovered. It also
+         * ignored rateLimitedUntil, firing beacons straight into the Retry-After window.
+         *
+         * Now:
+         *  - Non-terminal (tab switch): deliver the LIVE queue via a response-checked keepalive
+         *    fetch (flush) and response-check-drain the offline backlog (processOfflineQueue) —
+         *    neither erases the backlog on failure. The destructive beacon path is not used.
+         *  - Terminal (unload): beacon live+offline best-effort, but PERSIST everything first
+         *    and NEVER storage.remove() on a mere beacon enqueue. The next page load's
+         *    response-checked drain (normal fetch, no 64KB cap) is the source of truth and
+         *    clears the copy; server event_id dedup makes the potential double-send safe.
+         *  - Both paths honor rateLimitedUntil (don't beacon/flush into the backoff window).
          *
-         * Two follow-up review fixes:
-         *  - HIGH-1: exclude any batch currently in-flight in _flush(). That batch is being
-         *    sent with a keepalive fetch that already survives unload; re-beaconing it would
-         *    double-send. (`inFlight` is the front `inFlight.length` events of this.queue.)
-         *  - HIGH-2: handleUnload is wired to visibilitychange+pagehide+beforeunload, so this
-         *    runs multiple times per lifecycle. Detach what we beacon SYNCHRONOUSLY (clear the
-         *    in-memory queues, persist a refused remainder straight to storage rather than back
-         *    into this.offlineQueue) so a repeat call finds nothing to re-send.
+         * Still excludes the in-flight _flush batch (its keepalive fetch already carries it,
+         * HIGH-1), and detaches synchronously so a repeat unload event this lifecycle re-enters
+         * with nothing to re-beacon (HIGH-2).
          */
         forceFlush() {
-            return __awaiter(this, void 0, void 0, function* () {
+            return __awaiter(this, arguments, void 0, function* (isTerminal = false) {
                 if (!this.enabled)
                     return;
-                if (!navigator.sendBeacon) {
-                    // No beacon API — best-effort keepalive-fetch drain of both queues.
+                if (!isTerminal) {
+                    // Non-terminal visibilitychange: the page is still alive, so use the
+                    // response-checked send paths (keepalive fetch) — they move failures to the
+                    // persisted offline queue rather than erasing it. Within the 429 window, leave
+                    // everything parked.
+                    if (Date.now() < this.rateLimitedUntil)
+                        return;
                     yield this.flush();
                     yield this.processOfflineQueue();
                     return;
                 }
+                // Terminal unload.
                 // Exclude the in-flight batch (its keepalive fetch already carries it).
                 const live = this.queue.slice(this.inFlight.length);
                 const pending = [...live, ...this.offlineQueue];
-                // Detach synchronously: keep only the in-flight front (for _flush to settle) and
-                // empty the offline queue, so a second unload event this lifecycle re-enters with
-                // nothing to re-beacon. The refused remainder (if any) is persisted to STORAGE
-                // below, not back into this.offlineQueue, for exactly this reason.
+                // Detach the IN-MEMORY queues synchronously so a second unload event this lifecycle
+                // finds nothing to re-beacon (HIGH-2). The persisted STORAGE copy below is the
+                // durable record and is deliberately NOT removed on a successful beacon. (FSR-15)
                 this.queue = this.queue.slice(0, this.inFlight.length);
                 this.offlineQueue = [];
                 if (pending.length === 0)
                     return;
+                // Persist the full backlog FIRST so it survives no matter what sendBeacon reports.
+                // The next load's response-checked drain delivers + clears it (dedup-safe). (FSR-15)
+                if (this.enabled) {
+                    const toPersist = pending.slice(-this.config.maxOfflineQueueSize);
+                    if (pending.length > toPersist.length) {
+                        this.log(`Offline cap dropped ${pending.length - toPersist.length} oldest events at unload`);
+                    }
+                    storage.set(this.OFFLINE_QUEUE_KEY, toPersist);
+                }
+                // Within the 429 window, don't beacon into it — the persisted copy drains next load.
+                if (Date.now() < this.rateLimitedUntil)
+                    return;
+                if (!navigator.sendBeacon)
+                    return; // no beacon API — next load fetch-drains the copy
                 const MAX_BEACON_BYTES = 60000; // headroom under the browser's ~64KB cap
                 // Greedily pack events into chunks bounded by BOTH batchSize and byte size.
                 const chunks = [];
@@ -2356,36 +2668,18 @@ var Datalyr = (function (exports) {
                 }
                 if (current.length > 0)
                     chunks.push(current);
-                // Send each chunk; the moment the browser refuses to enqueue one, keep it and
-                // everything after it for the next session.
-                let failedFrom = -1;
-                for (let c = 0; c < chunks.length; c++) {
-                    const blob = new Blob([JSON.stringify(this.buildBatch(chunks[c]))], {
+                // Best-effort early delivery. We do NOT storage.remove() on success — the persisted
+                // copy is the source of truth for the next load (sendBeacon true ≠ delivered).
+                let beaconed = 0;
+                for (const chunk of chunks) {
+                    const blob = new Blob([JSON.stringify(this.buildBatch(chunk))], {
                         type: 'application/json'
                     });
-                    if (!navigator.sendBeacon(this.config.endpoint, blob)) {
-                        failedFrom = c;
+                    if (!navigator.sendBeacon(this.config.endpoint, blob))
                         break;
-                    }
-                }
-                if (failedFrom >= 0) {
-                    const remainder = chunks
-                        .slice(failedFrom)
-                        .reduce((acc, c) => acc.concat(c), []);
-                    // Persist straight to storage (NOT this.offlineQueue) so a repeat unload event
-                    // won't re-beacon it; the next page load's drain (which uses a normal fetch with
-                    // no 64KB cap) delivers it. MED-2: log if the maxOfflineQueueSize cap truncates.
-                    const toPersist = remainder.slice(-this.config.maxOfflineQueueSize);
-                    if (remainder.length > toPersist.length) {
-                        this.log(`Offline cap dropped ${remainder.length - toPersist.length} oldest events at unload`);
-                    }
-                    storage.set(this.OFFLINE_QUEUE_KEY, toPersist);
-                    this.log(`sendBeacon refused ${remainder.length} events; persisted ${toPersist.length} for next load`);
-                }
-                else {
-                    this.log('Events sent via sendBeacon');
-                    storage.remove(this.OFFLINE_QUEUE_KEY);
+                    beaconed += chunk.length;
                 }
+                this.log(`forceFlush(terminal): beaconed ${beaconed}/${pending.length} events; persisted copy retained for next-load drain`);
             });
         }
         /**
@@ -2625,17 +2919,33 @@ var Datalyr = (function (exports) {
                 if (this.initialized)
                     return;
                 try {
-                    // Fetch container configuration
-                    const response = yield fetch(`${this.endpoint}/container-scripts`, {
-                        method: 'POST',
-                        headers: {
-                            'Content-Type': 'application/json',
-                            'X-Container-Version': '1.0'
-                        },
-                        body: JSON.stringify({
-                            workspaceId: this.workspaceId
-                        })
-                    });
+                    // FSR-52: time-box the /container-scripts fetch. init() is awaited BEFORE the
+                    // initial page() fires, and this fetch had no timeout — a slow/stalled ingest
+                    // worker (the fleet has a documented history of worker-side stalls) delayed or lost
+                    // the landing pageview indefinitely. Abort after 3s so page() still fires; the catch
+                    // below leaves pixels/remoteConfig unset (the SDK proceeds with first-party tracking
+                    // and defaults). AbortSignal.timeout isn't on every supported browser, so use a
+                    // manual controller.
+                    const controller = typeof AbortController !== 'undefined' ? new AbortController() : null;
+                    const timeoutId = controller ? setTimeout(() => controller.abort(), 3000) : null;
+                    let response;
+                    try {
+                        response = yield fetch(`${this.endpoint}/container-scripts`, {
+                            method: 'POST',
+                            headers: {
+                                'Content-Type': 'application/json',
+                                'X-Container-Version': '1.0'
+                            },
+                            body: JSON.stringify({
+                                workspaceId: this.workspaceId
+                            }),
+                            signal: controller ? controller.signal : undefined
+                        });
+                    }
+                    finally {
+                        if (timeoutId)
+                            clearTimeout(timeoutId);
+                    }
                     if (!response.ok) {
                         throw new Error(`Failed to fetch container scripts: ${response.status}`);
                     }
@@ -3106,6 +3416,16 @@ var Datalyr = (function (exports) {
                 this.log('Error initializing TikTok Pixel:', error);
             }
         }
+        /**
+         * Whether the Meta Pixel is configured AND loaded (fbq present) — i.e. a Purchase
+         * co-fire via trackToPixels() would actually reach Meta rather than silently no-op.
+         * Used by the CC purchase-pixel dedup so its once-per-order guard isn't burned before
+         * the pixel is live. (FSR-102)
+         */
+        hasMetaPixel() {
+            var _a, _b;
+            return !!(((_b = (_a = this.pixels) === null || _a === void 0 ? void 0 : _a.meta) === null || _b === void 0 ? void 0 : _b.enabled) && window.fbq);
+        }
         /**
          * Track event to all initialized pixels
          */
@@ -3413,28 +3733,59 @@ var Datalyr = (function (exports) {
         setupFormMonitoring() {
             // Monitor existing forms
             this.scanForEmailForms();
-            // Watch for new forms (SPAs)
-            const observer = new MutationObserver(() => {
+            // Watch for new forms (SPAs). FSR-101: store the observer so destroy() (opt-out / SDK
+            // destroy) can disconnect it — previously it was a local and leaked for the page
+            // lifetime, re-scanning + re-attaching listeners on every DOM mutation after opt-out.
+            this.formObserver = new MutationObserver(() => {
                 this.scanForEmailForms();
             });
-            observer.observe(document.body, {
+            this.formObserver.observe(document.body, {
                 childList: true,
                 subtree: true
             });
             this.log('Form monitoring active');
         }
+        /**
+         * The form's email input that belongs to the VISITOR (not a gift/recipient field), or
+         * null when there's no usable / unambiguous one. (FSR-49)
+         */
+        findVisitorEmailInput(form) {
+            const all = Array.from(form.querySelectorAll('input[type="email"], input[name*="email" i], input[id*="email" i], input[autocomplete="email"]'));
+            // Drop third-party (gift/recipient/refer-a-friend) email fields.
+            const candidates = all.filter(i => !this.isThirdPartyEmailField(i));
+            if (candidates.length === 0)
+                return null;
+            if (candidates.length === 1)
+                return candidates[0];
+            // Multiple remain → prefer an explicit autocomplete="email" (the visitor's own field).
+            const preferred = candidates.filter(i => (i.getAttribute('autocomplete') || '').toLowerCase() === 'email');
+            if (preferred.length === 1)
+                return preferred[0];
+            // Still ambiguous → skip rather than identify as the wrong person.
+            this.log('Multiple email inputs in form; skipping auto-identify (ambiguous)');
+            return null;
+        }
+        isThirdPartyEmailField(input) {
+            const haystack = [
+                input.name, input.id, input.getAttribute('autocomplete'),
+                input.getAttribute('aria-label'), input.placeholder
+            ].filter(Boolean).join(' ');
+            return AutoIdentifyManager.THIRD_PARTY_EMAIL_FIELD.test(haystack);
+        }
         /**
          * Scan DOM for forms with email inputs
          */
         scanForEmailForms() {
+            if (this.destroyed)
+                return; // FSR-101: defense-in-depth after disconnect
             const forms = document.querySelectorAll('form');
             forms.forEach(form => {
                 // Skip if already listening
                 if (this.formListeners.some(l => l.element === form)) {
                     return;
                 }
-                // Check if form has email input
-                const emailInput = form.querySelector('input[type="email"], input[name*="email" i], input[id*="email" i]');
+                // Only monitor forms with a capturable VISITOR email field (FSR-49).
+                const emailInput = this.findVisitorEmailInput(form);
                 if (emailInput) {
                     const handler = (e) => this.handleFormSubmit(e, form);
                     form.addEventListener('submit', handler);
@@ -3448,8 +3799,8 @@ var Datalyr = (function (exports) {
          */
         handleFormSubmit(_event, form) {
             try {
-                // Find email input
-                const emailInput = form.querySelector('input[type="email"], input[name*="email" i], input[id*="email" i]');
+                // Find the visitor's own email input (excludes gift/recipient fields — FSR-49).
+                const emailInput = this.findVisitorEmailInput(form);
                 if (!emailInput)
                     return;
                 const email = emailInput.value.trim();
@@ -3791,6 +4142,12 @@ var Datalyr = (function (exports) {
                 XMLHttpRequest.prototype.send = this.originalXHRSend;
                 this.originalXHRSend = undefined;
             }
+            // Disconnect the form MutationObserver (FSR-101) — otherwise it keeps firing
+            // scanForEmailForms on every DOM mutation after opt-out, re-attaching listeners.
+            if (this.formObserver) {
+                this.formObserver.disconnect();
+                this.formObserver = undefined;
+            }
             // Remove form listeners
             this.formListeners.forEach(({ element, handler }) => {
                 element.removeEventListener('submit', handler);
@@ -3812,6 +4169,10 @@ var Datalyr = (function (exports) {
             }
         }
     }
+    // FSR-49: email fields that belong to a THIRD PARTY, not the visitor — gift/recipient/
+    // refer-a-friend/"email this to" forms. Capturing these identifies the visitor as
+    // someone else (and feeds that person's email to Meta advanced matching).
+    AutoIdentifyManager.THIRD_PARTY_EMAIL_FIELD = /(recipient|friend|gift|refer|invite|colleague|coworker|share|to[-_]?email|email[-_]?to|second(ary)?[-_]?email)/i;
 
     /** Keys the remote config is allowed to fill on DatalyrConfig. */
     const REMOTE_KEYS = [
@@ -3923,8 +4284,11 @@ var Datalyr = (function (exports) {
             if (this.config.platform === 'checkoutchamp') {
                 this.restoreFromURL();
             }
-            // Initialize modules
-            this.identity = new IdentityManager();
+            // Initialize modules.
+            // FSR-107: don't write a persistent tracking cookie/localStorage id for a visitor who
+            // is opted-out / GPC / DNT at init — the id stays in memory only (events don't send
+            // anyway). shouldTrack() is computable here (config/opt-out/consent are all set above).
+            this.identity = new IdentityManager({ persistNewId: this.shouldTrack() });
             this.session = new SessionManager(this.config.sessionTimeout);
             this.attribution = new AttributionManager({
                 attributionWindow: this.config.attributionWindow,
@@ -4246,10 +4610,13 @@ var Datalyr = (function (exports) {
                 return;
             }
             try {
-                // FIXED (DATA-05): Rotate session ID on identify to prevent session fixation
-                if (this.session) {
-                    this.session.rotateSessionId();
-                }
+                // FSR-53: do NOT rotate the session id on identify(). 'Session fixation' is an
+                // auth-credential concept; a client-generated analytics session_id is not one.
+                // Rotating split every identified visit (and every auto-identify form submit) into
+                // two session_ids — inflating server-side uniq(session_id) counts by +1 per
+                // identified visitor and landing the post-login conversion in a session with zero
+                // preceding pageviews. Matches iOS/RN (no rotate-on-identify) and every major
+                // analytics SDK; keeps session-scoped attribution joins intact.
                 // Update identity
                 const identityLink = this.identity.identify(userId, traits);
                 // SEC-03 Fix: Store user properties encrypted (contains PII)
@@ -4399,6 +4766,15 @@ var Datalyr = (function (exports) {
             // Clear the journey too, or the next user's touchpoints append to the previous
             // user's (cross-user contamination of touchpoint_count / days_since_first_touch).
             storage.remove('dl_journey');
+            // FSR-106: clear first/last-touch attribution as well — same cross-user-contamination
+            // rationale as the journey. Otherwise the next anon visitor's events carry the
+            // PREVIOUS user's first_touch_*/last_touch_* (via getAttributionData's fallback),
+            // crediting user B's conversions to the ad click that brought user A.
+            // (Meta's _fbc/_fbp cookies are deliberately left alone — they're shared with the
+            // merchant's own Meta Pixel and clearing them could break it; the fresh anonymous_id
+            // already de-links the visitor server-side.)
+            storage.remove('dl_first_touch');
+            storage.remove('dl_last_touch');
             this.session.createNewSession();
             this.log('User reset');
         }
@@ -4575,8 +4951,17 @@ var Datalyr = (function (exports) {
          * Set consent preferences
          */
         setConsent(consent) {
+            // Always record + persist consent FIRST, even before init(). FSR-51: a consent-
+            // management platform commonly calls setConsent() before init() so tracking is gated
+            // from the very first event. The old code then dereferenced this.queue/this.config
+            // (both undefined pre-init) inside shouldTrack()/setEnabled() and threw an uncaught
+            // TypeError into the CMP's callback chain. init() re-reads dl_consent (and gates the
+            // queue) at startup, so a pre-init call is honored there.
             this.consent = consent;
             storage.set('dl_consent', consent);
+            if (!this.initialized) {
+                return;
+            }
             // Enforce it live (not just persist it). Gate the queue by the full policy
             // (analytics consent + opt-out + DNT/GPC), and on withdrawal purge buffered events
             // too — mirroring optOut — so events captured before withdrawal can't drain if
@@ -4817,6 +5202,16 @@ var Datalyr = (function (exports) {
                 const orderId = order.orderId;
                 if (!orderId)
                     return;
+                // FSR-102: only burn the once-per-order guard once the Meta Pixel is actually live.
+                // trackToPixels no-ops when the container config never arrived (pixels=null after a
+                // transient /container-scripts failure); setting the guard first would permanently
+                // suppress the co-fire for the rest of the funnel session even when the container
+                // loads on a later upsell page. orderData persists across upsell loads, so a later
+                // page retries. Meta's 48h event_id dedup still protects against a double-fire.
+                if (!this.container.hasMetaPixel()) {
+                    this.log("CC Purchase Pixel: Meta pixel not ready; will retry on next funnel page");
+                    return;
+                }
                 // orderData persists across upsell page loads — fire the primary Purchase
                 // Pixel once per order. (Meta also dedupes by event_id over 48h, so this is
                 // belt-and-suspenders against a per-page re-fire.)
@@ -4876,14 +5271,20 @@ var Datalyr = (function (exports) {
                 }
             };
             const buildBridgeParams = () => {
+                var _a, _b;
                 const attribution = this.attribution.getAttributionData();
                 const out = {};
                 const vid = this.identity.getAnonymousId();
                 const fbc = this.cookies.get("_fbc") || attribution._fbc;
                 const fbp = this.cookies.get("_fbp") || attribution._fbp;
-                const fbclid = attribution.clickIdType === "fbclid" ? attribution.clickId : null;
+                // FSR-104: read the named click-id fields directly (captureAttribution stores every
+                // present click id under its own key) so a landing URL carrying BOTH fbclid and
+                // gclid bridges both — the old `clickIdType === 'fbclid' ? clickId : null` dropped
+                // gclid whenever fbclid was the primary, silently losing Google attribution on the
+                // cross-domain CC path. Fall back to the primary clickId for older stored shapes.
+                const fbclid = (_a = attribution.fbclid) !== null && _a !== void 0 ? _a : (attribution.clickIdType === "fbclid" ? attribution.clickId : null);
                 const fbclidAt = this.cookies.get("_dl_fbclid_at");
-                const gclid = attribution.clickIdType === "gclid" ? attribution.clickId : null;
+                const gclid = (_b = attribution.gclid) !== null && _b !== void 0 ? _b : (attribution.clickIdType === "gclid" ? attribution.clickId : null);
                 const gclidAt = this.cookies.get("_dl_gclid_at");
                 if (vid)
                     out._dl_vid = vid;
@@ -4986,18 +5387,32 @@ var Datalyr = (function (exports) {
          */
         createEventPayload(eventName, properties, eventIdArg) {
             // NEW-2: keep the identity's cached session id in lockstep with the LIVE session.
-            // The session id changes on identify() (rotateSessionId) and on session timeout, but
-            // identity only synced it at init/start — so the top-level payload.session_id (from
-            // identity) disagreed with event_data.session_id (from session.getMetrics()). Sync
-            // here, before reading either, so every event carries a single consistent session id.
+            // The session id changes on session timeout (and previously on identify(), removed in
+            // FSR-53), but identity only synced it at init/start — so the top-level
+            // payload.session_id (from identity) could disagree with event_data.session_id (from
+            // session.getMetrics()). Sync here, before reading either, so every event carries a
+            // single consistent session id.
             this.identity.setSessionId(this.session.getSessionId());
             // Sanitize and merge properties
             const sanitizedProperties = sanitizeEventData(properties);
             const eventData = deepMerge({}, this.superProperties, sanitizedProperties);
-            // Add attribution data
+            // FSR-105: caller-passed properties take precedence over auto-captured context.
+            // Previously Object.assign clobbered them — e.g. track('purchase', { source: 'pos',
+            // campaign: 'spring-sale' }) shipped with the URL-derived source/campaign instead.
+            // Fill ONLY the attribution/browser-context keys the caller didn't set. (session
+            // metrics + fingerprint stay SDK-authoritative below: session_id is a join key.)
+            const assignMissing = (target, source) => {
+                for (const k in source) {
+                    if (Object.prototype.hasOwnProperty.call(source, k) &&
+                        !Object.prototype.hasOwnProperty.call(target, k)) {
+                        target[k] = source[k];
+                    }
+                }
+            };
+            // Add attribution data (caller wins on collisions)
             const attributionData = this.attribution.getAttributionData();
-            Object.assign(eventData, attributionData);
-            // Add session metrics
+            assignMissing(eventData, attributionData);
+            // Add session metrics (SDK-authoritative — session_id et al. must not be overridden)
             const sessionMetrics = this.session.getMetrics();
             Object.assign(eventData, sessionMetrics);
             // Add fingerprint data if enabled
@@ -5007,8 +5422,8 @@ var Datalyr = (function (exports) {
                     device_fingerprint: fingerprintData // Use snake_case only (matches backend)
                 });
             }
-            // Add browser context
-            Object.assign(eventData, {
+            // Add browser context (caller wins on collisions)
+            assignMissing(eventData, {
                 url: window.location.href,
                 path: window.location.pathname,
                 referrer: document.referrer,
@@ -5046,8 +5461,10 @@ var Datalyr = (function (exports) {
                 // Resolution metadata
                 resolution_method: 'browser_sdk',
                 resolution_confidence: 1.0,
-                // SDK metadata (keep in sync with package.json version)
-                sdk_version: '1.7.1',
+                // SDK metadata. MUST stay in sync with package.json "version" — the build guard
+                // (scripts/check-bundle.js, run by build:check) fails the build if the bundle's
+                // sdk_version doesn't match package.json. (FSR-103)
+                sdk_version: '1.7.3',
                 sdk_name: 'datalyr-web-sdk'
             };
             return payload;
@@ -5132,10 +5549,13 @@ var Datalyr = (function (exports) {
         setupUnloadHandler() {
             // Store refs so destroy() can remove these — otherwise a destroy()+re-init() cycle
             // leaks listeners that keep firing forceFlush() on the OLD (destroyed) queue. (H2)
-            this.unloadHandler = () => { this.queue.forceFlush(); };
+            // FSR-15: pagehide/beforeunload are TERMINAL (beacon both queues, keep the persisted
+            // copy); a visibilitychange:hidden is just a tab switch / background, so use the
+            // non-terminal path (response-checked fetch drain that never erases the backlog).
+            this.unloadHandler = () => { this.queue.forceFlush(true); };
             this.visibilityHandler = () => {
                 if (document.visibilityState === 'hidden')
-                    this.queue.forceFlush();
+                    this.queue.forceFlush(false);
             };
             // Use multiple events for maximum compatibility.
             window.addEventListener('beforeunload', this.unloadHandler);
@@ -5223,7 +5643,11 @@ var Datalyr = (function (exports) {
          * Debug logging
          */
         log(...args) {
-            if (this.config.debug) {
+            var _a;
+            // FSR-51: optional-chain config — log() is reachable before init() (e.g.
+            // setSuperProperties() called pre-init), where this.config is undefined; the bare
+            // `this.config.debug` threw an uncaught TypeError into the caller.
+            if ((_a = this.config) === null || _a === void 0 ? void 0 : _a.debug) {
                 console.log('[Datalyr]', ...args);
             }
         }