@datalyr/web 1.7.4 → 1.7.6

package/dist/datalyr.cjs.js

@@ -1,5 +1,5 @@
 /**
- * @datalyr/web v1.7.4
+ * @datalyr/web v1.7.6
  * Datalyr Web SDK - Modern attribution tracking for web applications
  * (c) 2026 Datalyr Inc.
  * Released under the MIT License
@@ -795,6 +795,125 @@ function sanitizeEventData(data, maxDepth = 5, currentDepth = 0) {
     }
     return data;
 }
+// 9.A.4: query-param NAMES whose VALUES are secrets/PII — password-reset tokens,
+// OAuth codes, magic-link sessions, emails/phones prefilled into URLs. Events ship
+// `url` / `referrer` / `landingPage` with the FULL query string (sanitizeEventData
+// only strips property KEYS, not URL param values), so /reset?token=…&email=… leaked
+// verbatim into events and onward to ad platforms. Matched case-insensitively.
+const REDACTED_URL_PARAMS = new Set([
+    'token', 'access_token', 'refresh_token', 'id_token', 'auth', 'authorization',
+    'password', 'pass', 'pwd', 'secret', 'api_key', 'apikey', 'key',
+    'session', 'session_id', 'sid', 'email', 'e', 'phone', 'tel',
+    'signature', 'sig', 'otp', 'reset', 'hash'
+]);
+// BATCH-2(e): `code` is CONDITIONAL, not in the always-redact set above. An OAuth
+// authorization code (account-takeover-grade if it leaks to ad platforms) ALWAYS travels
+// with an OAuth-flow marker in the same query/fragment — the response carries `code`+`state`
+// (+`scope`/`session_state`/`iss`), the authorize request carries `client_id`/`redirect_uri`/
+// `response_type`/`code_challenge`. A coupon/referral/product code (`?code=SUMMER20`) — a real
+// attribution signal for the DTC/Shopify ICP — never does. So we redact `code` ONLY when a
+// marker co-occurs in the same k=v string, preserving marketing codes. (A bare `code=` with no
+// marker is syntactically indistinguishable from a coupon code and is kept; state-less OAuth
+// flows are rare and CSRF-unsafe.) Markers are deliberately OAuth-specific to avoid redacting
+// legitimate codes — `prompt`/`authuser` are excluded as too generic.
+const OAUTH_CODE_CONTEXT_MARKERS = new Set([
+    'state', 'client_id', 'redirect_uri', 'response_type', 'grant_type',
+    'code_challenge', 'session_state', 'scope', 'iss',
+    // Token family: the presence of any bearer/OAuth token means a bare `code` in the same
+    // string is almost certainly an auth code, not a coupon — a marketing URL never carries
+    // these. (These values are independently redacted too; this only governs `code`.)
+    'access_token', 'id_token', 'refresh_token', 'token'
+]);
+const REDACTED_URL_VALUE = '__redacted__';
+// Redact denylisted keys in one `k=v&k=v` string (query OR fragment). Returns the
+// re-encoded string and whether anything was rewritten (so the caller can preserve the
+// exact original bytes when nothing matched).
+function redactKvPairs(s) {
+    const params = new URLSearchParams(s);
+    let mutated = false;
+    const keysLower = Array.from(new Set(params.keys())).map(k => k.toLowerCase());
+    // `code` co-occurrence check (BATCH-2e) — evaluated per-string, since an OAuth flow puts
+    // `code` and its marker in the SAME query (or the SAME fragment).
+    const hasOAuthMarker = keysLower.some(k => OAUTH_CODE_CONTEXT_MARKERS.has(k));
+    // Snapshot the keys first — set() collapses duplicate keys mid-iteration.
+    for (const key of Array.from(new Set(params.keys()))) {
+        const lower = key.toLowerCase();
+        const sensitive = lower === 'code'
+            ? hasOAuthMarker
+            : REDACTED_URL_PARAMS.has(lower);
+        if (sensitive) {
+            params.set(key, REDACTED_URL_VALUE);
+            mutated = true;
+        }
+    }
+    return { out: params.toString(), mutated };
+}
+/**
+ * Redact secret/PII param VALUES in a URL (9.A.4). The param NAME is kept
+ * (value → `__redacted__`) so funnel steps that match on the param's presence still
+ * work; every other param — click IDs (fbclid/gclid/…) and utm_* — survives untouched.
+ * Both the query string AND a k=v fragment are rewritten: TR-04 — OAuth-implicit /
+ * Supabase magic links carry the session in the FRAGMENT (`/welcome#access_token=eyJ…`),
+ * with no query string at all; the old code returned early on a missing `?` and reattached
+ * the fragment verbatim, leaking the full JWT into `url` / `landingPage` / `dl_first_touch`
+ * (90d) and onward to ad platforms. Non-k=v fragments (`#section`, `#/spa-route`) keep their
+ * shape. Returns the input unchanged when nothing sensitive matched or on any parse
+ * failure — redaction must never break tracking.
+ */
+function redactUrl(url) {
+    if (!url || typeof url !== 'string')
+        return url;
+    const hashStart = url.indexOf('#');
+    const qIdx = url.indexOf('?');
+    // A query string exists only when '?' appears BEFORE the fragment — a '?' after '#' is
+    // part of the fragment per the URL grammar (e.g. a SPA hash-route `#/reset?token=…`).
+    const queryStart = (qIdx !== -1 && (hashStart === -1 || qIdx < hashStart)) ? qIdx : -1;
+    if (queryStart === -1 && hashStart === -1)
+        return url; // nothing to redact
+    try {
+        const base = url.slice(0, queryStart !== -1 ? queryStart : (hashStart !== -1 ? hashStart : url.length));
+        const query = queryStart === -1 ? '' : url.slice(queryStart + 1, hashStart === -1 ? url.length : hashStart);
+        const rawFragment = hashStart === -1 ? '' : url.slice(hashStart + 1);
+        let mutated = false;
+        let queryOut = query;
+        if (query) {
+            const r = redactKvPairs(query);
+            if (r.mutated) {
+                queryOut = r.out;
+                mutated = true;
+            }
+        }
+        // TR-04: redact the fragment when it carries k=v pairs. Two shapes: a pure implicit-flow
+        // fragment (`#access_token=…&refresh_token=…`) and a SPA hash-route with its own query
+        // (`#/reset?access_token=…`). Leave non-k=v fragments (`#section`, `#/route`) untouched.
+        let fragmentOut = rawFragment;
+        if (rawFragment) {
+            const fragQ = rawFragment.indexOf('?');
+            if (fragQ !== -1) {
+                const r = redactKvPairs(rawFragment.slice(fragQ + 1));
+                if (r.mutated) {
+                    fragmentOut = rawFragment.slice(0, fragQ + 1) + r.out;
+                    mutated = true;
+                }
+            }
+            else if (/[\w-]+=/.test(rawFragment)) {
+                const r = redactKvPairs(rawFragment);
+                if (r.mutated) {
+                    fragmentOut = r.out;
+                    mutated = true;
+                }
+            }
+        }
+        if (!mutated)
+            return url; // nothing sensitive matched → ship the exact original bytes
+        return base
+            + (queryStart === -1 ? '' : '?' + queryOut)
+            + (hashStart === -1 ? '' : '#' + fragmentOut);
+    }
+    catch (_a) {
+        return url; // malformed URL → ship as-is rather than drop/break the event
+    }
+}
 /**
  * Deep merge objects
  */
@@ -925,16 +1044,18 @@ function getReferrerData() {
         return {};
     try {
         const url = new URL(referrer);
+        // 9.A.4: the referrer can be our own /reset?token=… or an OAuth callback —
+        // redact secret/PII param values before they're stamped onto the event.
         return {
-            referrer,
+            referrer: redactUrl(referrer),
             referrer_host: url.hostname,
             referrer_path: url.pathname,
-            referrer_search: url.search,
+            referrer_search: redactUrl(url.search),
             referrer_source: detectReferrerSource(url.hostname)
         };
     }
     catch (_a) {
-        return { referrer };
+        return { referrer: redactUrl(referrer) };
     }
 }
 /**
@@ -995,17 +1116,13 @@ class IdentityManager {
             this.setRootDomainCookie('__dl_visitor_id', anonymousId);
             return anonymousId;
         }
-        // 2. Fresh visitor (no persisted id): accept a cross-domain bridge id from the URL,
-        //    but ONLY a well-formed anon_<uuid> — reject arbitrary / oversized values (a
-        //    multi-KB or attacker-crafted _dl_vid was previously persisted verbatim). Strip
-        //    it from the address bar so a re-shared URL can't merge the next visitor. (FSR-50)
+        // 2. Raw URL visitor IDs are never identity authority. A syntactically
+        // valid ID is still replayable/attacker-chosen and can merge two people.
+        // Strip the legacy parameter and generate a fresh local identity below.
         try {
             const urlParams = new URLSearchParams(window.location.search);
-            const urlVisitorId = urlParams.get('_dl_vid');
-            if (urlVisitorId && this.isValidAnonymousId(urlVisitorId)) {
+            if (urlParams.has('_dl_vid')) {
                 this.stripUrlParam('_dl_vid');
-                this.persistAnonymousId(urlVisitorId);
-                return urlVisitorId;
             }
         }
         catch (e) {
@@ -1029,12 +1146,17 @@ class IdentityManager {
         storage.set('dl_anonymous_id', id);
     }
     /**
-     * Whether a `_dl_vid` value is a well-formed Datalyr anonymous id (anon_ + UUID).
-     * The length is bounded by the pattern, so an oversized/garbage value is rejected.
-     * (FSR-50)
+     * TR-15 / FSR-107: tracking became allowed mid-session (optIn / consent grant). Start
+     * persisting AND flush the current in-memory anon id to the cookie + localStorage now.
+     * Without this, a visitor declined at init keeps a memory-only id, so that session's
+     * events land under a visitor_id that vanishes on the next page load (attribution
+     * fragmentation). Idempotent — a no-op once already persisting.
      */
-    isValidAnonymousId(id) {
-        return /^anon_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id);
+    enablePersistence() {
+        if (this.persistNewId)
+            return;
+        this.persistNewId = true;
+        this.persistAnonymousId(this.anonymousId);
     }
     /**
      * Remove a query param from the current URL via history.replaceState (best-effort).
@@ -1525,6 +1647,10 @@ class AttributionManager {
         this.CLICK_ID_ALIASES = {
             ScCid: 'sclid',
             sccid: 'sclid',
+            // Impact's real landing param is `irclickid`; capture it and normalize to the canonical
+            // `irclid` that ingest / the MV / the source map (`irclid→impact`) all key on. Without
+            // this, real Impact affiliate clicks were dark on web (only bare `irclid` was captured).
+            irclickid: 'irclid',
         };
         // Default tracked params matching dl.js
         this.DEFAULT_TRACKED_PARAMS = [
@@ -1535,9 +1661,18 @@ class AttributionManager {
             'medium', // Generic medium (non-UTM)
             'gad_source' // Google Ads source parameter
         ];
+        // TR-03: ad-cookie fields (Meta/Google Ads/TikTok/Snap) that are MARKETING-scoped. When
+        // marketing consent is declined these are neither synthesized/written nor shipped. Google
+        // Analytics cookies (_ga/_gid) and utm_* stay — they're analytics-scoped.
+        this.MARKETING_COOKIES = ['_fbp', '_fbc', '_gcl_aw', '_gcl_dc', '_gcl_gb', '_gcl_ha', '_gac', '_ttp', '_ttc', '_scid'];
         this.attributionWindow = options.attributionWindow || 90 * 24 * 60 * 60 * 1000; // 90 days (increased from 30 for B2B sales cycles)
         // Merge default tracked params with user-provided ones
         this.trackedParams = [...this.DEFAULT_TRACKED_PARAMS, ...(options.trackedParams || [])];
+        this.marketingAllowedFn = options.marketingAllowed;
+    }
+    // TR-03: default (no predicate / no signal) = allowed → byte-identical to prior behavior.
+    isMarketingAllowed() {
+        return this.marketingAllowedFn ? this.marketingAllowedFn() !== false : true;
     }
     /**
      * Clear query params cache (called on page navigation)
@@ -1608,13 +1743,15 @@ class AttributionManager {
                 attribution[param] = value;
             }
         }
-        // Capture referrer
+        // Capture referrer. 9.A.4: redact secret/PII query-param values (reset tokens,
+        // OAuth codes, emails) — this attribution object is stamped onto every event AND
+        // persisted into dl_first_touch/dl_last_touch, so it must be clean at capture.
         if (document.referrer) {
-            attribution.referrer = document.referrer;
+            attribution.referrer = redactUrl(document.referrer);
             attribution.referrerHost = this.extractHostname(document.referrer);
         }
-        // Capture landing page
-        attribution.landingPage = window.location.href;
+        // Capture landing page (redacted — see referrer note above)
+        attribution.landingPage = redactUrl(window.location.href);
         attribution.landingPath = window.location.pathname;
         // Determine source if not explicitly set
         if (!attribution.source) {
@@ -1710,6 +1847,10 @@ class AttributionManager {
     captureAdCookies() {
         var _a, _b;
         const adCookies = {};
+        // TR-03: when marketing consent is declined, do NOT synthesize/write the Meta/Google ad
+        // cookies below (writing _fbp/_fbc is active marketing use). Existing cookies are still
+        // read here but stripped from the event payload in getAttributionData().
+        const marketingAllowed = this.isMarketingAllowed();
         // Facebook/Meta cookies
         adCookies._fbp = cookies.get('_fbp');
         adCookies._fbc = cookies.get('_fbc');
@@ -1728,8 +1869,8 @@ class AttributionManager {
         // Snapchat first-party cookie (Snap Pixel sets _scid). Flows to the server as
         // cookies._scid and is sent on the Snap CAPI event as sc_cookie1 (raw).
         adCookies._scid = cookies.get('_scid');
-        // Generate _fbp if missing (Facebook browser ID)
-        if (!adCookies._fbp && (this.hasClickId('fbclid') || adCookies._fbc)) {
+        // Generate _fbp if missing (Facebook browser ID). TR-03: only when marketing is allowed.
+        if (marketingAllowed && !adCookies._fbp && (this.hasClickId('fbclid') || adCookies._fbc)) {
             const timestamp = Date.now();
             // Meta's _fbp format is fb.1.<creationTimeMs>.<randomNumber> where the last
             // segment MUST be a decimal integer. The old base36 string was non-conformant —
@@ -1753,7 +1894,8 @@ class AttributionManager {
         // Shopify cart / server-side rebuild forward it as a time, so its format must not
         // change.
         const fbclid = this.getCurrentFbclid();
-        if (fbclid) {
+        // TR-03: skip _fbc synthesis/refresh (cookie write) when marketing is declined.
+        if (marketingAllowed && fbclid) {
             const existingFbc = adCookies._fbc; // captured above (cookies.get('_fbc'))
             const embeddedFbclid = this.extractFbclidFromFbc(existingFbc);
             if (!existingFbc) {
@@ -1783,7 +1925,7 @@ class AttributionManager {
         // (gclid has no synthesized-and-going-stale artifact like _fbc, and Google does not
         // validate a creationTime window the way Meta does, so this stays once-only.)
         const gclid = this.hasClickId('gclid') ? ((_b = (_a = this.queryParamsCache) === null || _a === void 0 ? void 0 : _a.gclid) !== null && _b !== void 0 ? _b : null) : null;
-        if (gclid && !cookies.get('_dl_gclid_at')) {
+        if (marketingAllowed && gclid && !cookies.get('_dl_gclid_at')) {
             cookies.set('_dl_gclid_at', String(Date.now()), 90);
         }
         // Filter out null values for cleaner data
@@ -1861,7 +2003,7 @@ class AttributionManager {
         if (hasRealAttribution) {
             this.storeLastTouch(current);
         }
-        return Object.assign(Object.assign(Object.assign({}, current), adCookies), { 
+        const result = Object.assign(Object.assign(Object.assign({}, current), adCookies), { 
             // First touch (with snake_case aliases)
             first_touch_source: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.source, first_touch_medium: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.medium, first_touch_campaign: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.campaign, first_touch_timestamp: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.timestamp, firstTouchSource: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.source, firstTouchMedium: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.medium, firstTouchCampaign: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.campaign, 
             // Last touch (with snake_case aliases)
@@ -1872,6 +2014,21 @@ class AttributionManager {
                 : 0, daysSinceFirstTouch: (firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.timestamp)
                 ? Math.floor((Date.now() - firstTouch.timestamp) / 86400000)
                 : 0 });
+        // TR-03: strip MARKETING-scoped signals (click IDs + ad cookies) from the event payload
+        // when marketing consent is declined — analytics-scoped fields (utm_*, source/medium/
+        // campaign, first/last touch, _ga/_gid) stay. Live predicate → a later grant restores
+        // them on the next event. Synthesis of _fbp/_fbc was already skipped in captureAdCookies.
+        if (!this.isMarketingAllowed()) {
+            const marketingKeys = [
+                ...this.CLICK_IDS,
+                ...Object.values(this.CLICK_ID_ALIASES),
+                'clickId', 'clickIdType',
+                ...this.MARKETING_COOKIES,
+            ];
+            for (const k of marketingKeys)
+                delete result[k];
+        }
+        return result;
     }
     /**
      * Determine source from attribution data
@@ -1882,13 +2039,19 @@ class AttributionManager {
             const clickIdSources = {
                 fbclid: 'facebook',
                 gclid: 'google',
+                gbraid: 'google', // 9.A.6: Google Ads (iOS) — was falling through to 'paid'
+                wbraid: 'google', // 9.A.6: Google Ads (web)
                 ttclid: 'tiktok',
                 msclkid: 'bing',
                 twclid: 'twitter',
                 li_fat_id: 'linkedin',
                 sclid: 'snapchat',
                 dclid: 'doubleclick',
-                epik: 'pinterest'
+                epik: 'pinterest',
+                rdt_cid: 'reddit', // 9.A.6
+                obclid: 'outbrain', // 9.A.6
+                irclid: 'impact', // 9.A.6: Impact Radius
+                ko_click_id: 'klaviyo' // 9.A.6
             };
             return clickIdSources[attribution.clickIdType] || 'paid';
         }
@@ -2302,16 +2465,22 @@ class EventQueue {
             // so only request it when the body is safely under the cap; oversized batches go via
             // a normal fetch (no cap) and succeed.
             const useKeepalive = new Blob([body]).size <= 60000;
+            // First-party endpoint (the customer's own tracking host, never *.datalyr.com — set
+            // by the script-origin auto-derive): send the cookie cross-subdomain so the edge can
+            // read/refresh the server-set, ITP-durable visitor_id. Legacy datalyr.com endpoints
+            // stay credential-less — unchanged behavior for every existing install.
+            let firstPartyEndpoint = false;
             try {
-                const response = yield fetch(currentEndpoint, {
-                    method: 'POST',
-                    headers: {
+                firstPartyEndpoint = !/(^|\.)datalyr\.com$/i.test(new URL(currentEndpoint).hostname);
+            }
+            catch (_a) {
+                /* malformed endpoint — leave false */
+            }
+            try {
+                const response = yield fetch(currentEndpoint, Object.assign({ method: 'POST', headers: {
                         'Content-Type': 'application/json',
                         'X-Batch-Size': events.length.toString()
-                    },
-                    body,
-                    keepalive: useKeepalive
-                });
+                    }, body, keepalive: useKeepalive }, (firstPartyEndpoint ? { credentials: 'include' } : {})));
                 if (!response.ok) {
                     // Handle rate limiting
                     if (response.status === 429) {
@@ -2508,6 +2677,16 @@ class EventQueue {
             // two of them could splice the same offlineQueue concurrently and double-send.
             if (!this.enabled)
                 return;
+            // TR-15: re-check consent at DRAIN time. A returning DECLINED visitor whose consent
+            // signal loads asynchronously (Shopify customerPrivacy) fires no visitorConsentCollected
+            // event, so `enabled` stayed at its fail-open init value. If consent now says no, latch
+            // off and PURGE the persisted backlog instead of draining it (a later grant re-enables
+            // via setEnabled). Mirrors the withdrawal purge in optOut()/setConsent().
+            if (this.consentCheck && this.consentCheck() === false) {
+                this.enabled = false;
+                this.clearOffline();
+                return;
+            }
             if (Date.now() < this.rateLimitedUntil)
                 return; // FIXED (429): honor Retry-After window
             if (this.offlineProcessing)
@@ -2599,10 +2778,13 @@ class EventQueue {
      *  - Non-terminal (tab switch): deliver the LIVE queue via a response-checked keepalive
      *    fetch (flush) and response-check-drain the offline backlog (processOfflineQueue) —
      *    neither erases the backlog on failure. The destructive beacon path is not used.
-     *  - Terminal (unload): beacon live+offline best-effort, but PERSIST everything first
-     *    and NEVER storage.remove() on a mere beacon enqueue. The next page load's
-     *    response-checked drain (normal fetch, no 64KB cap) is the source of truth and
-     *    clears the copy; server event_id dedup makes the potential double-send safe.
+     *  - Terminal (unload): PERSIST everything first (live + the already-persisted offline
+     *    backlog) and NEVER storage.remove() on a mere beacon enqueue. Beacon ONLY the LIVE
+     *    queue best-effort — NOT the offline backlog (TR-13): the backlog is already durable and
+     *    the next-load drain delivers it exactly once, so beaconing it here too risked a
+     *    delivered-now-AND-re-drained-next-load double-send that, when >6h apart, outlives
+     *    ingest's dedup window → a duplicate purchase. The next page load's response-checked
+     *    drain (normal fetch, no 64KB cap) is the source of truth and clears the copy.
      *  - Both paths honor rateLimitedUntil (don't beacon/flush into the backoff window).
      *
      * Still excludes the in-flight _flush batch (its keepalive fetch already carries it,
@@ -2644,6 +2826,14 @@ class EventQueue {
                 }
                 storage.set(this.OFFLINE_QUEUE_KEY, toPersist);
             }
+            // TR-13: beacon ONLY the LIVE queue (never-persisted events from THIS session). The
+            // offline backlog is already durable and the next-load drain delivers it once, so
+            // beaconing it here would double-send it — and a stale backlog event (e.g. a purchase
+            // parked during an outage) re-drained on a later day lands >6h from the beacon, past
+            // ingest's dedup window. The live queue's beacon + its own next-load drain both land THIS
+            // session (<6h), so dedup absorbs that pair.
+            if (live.length === 0)
+                return; // only the persisted backlog remained → it drains next load
             // Within the 429 window, don't beacon into it — the persisted copy drains next load.
             if (Date.now() < this.rateLimitedUntil)
                 return;
@@ -2654,7 +2844,7 @@ class EventQueue {
             const chunks = [];
             let current = [];
             let currentBytes = 2; // approx for the JSON array/object wrapper
-            for (const ev of pending) {
+            for (const ev of live) {
                 // Byte length (not UTF-16 .length) so multibyte product names / emoji can't
                 // under-count and overflow the cap.
                 const evBytes = new Blob([JSON.stringify(ev)]).size + 1;
@@ -2680,7 +2870,7 @@ class EventQueue {
                     break;
                 beaconed += chunk.length;
             }
-            this.log(`forceFlush(terminal): beaconed ${beaconed}/${pending.length} events; persisted copy retained for next-load drain`);
+            this.log(`forceFlush(terminal): beaconed ${beaconed}/${live.length} live events; backlog (${pending.length - live.length}) persisted for next-load drain`);
         });
     }
     /**
@@ -2701,6 +2891,15 @@ class EventQueue {
     setEnabled(enabled) {
         this.enabled = enabled;
     }
+    /**
+     * TR-15: register a live consent predicate the offline drain re-evaluates at drain time.
+     * `enabled` is latched at init to a fail-open value (Shopify's customerPrivacy loads
+     * async), and a returning DECLINED visitor fires no visitorConsentCollected event — so
+     * without this, their persisted backlog would drain before the decline is known.
+     */
+    setConsentCheck(fn) {
+        this.consentCheck = fn;
+    }
     /**
      * Clear the offline queue and its persisted copy (used by opt-out to purge any
      * PII-bearing events that were parked before the user opted out).
@@ -4293,7 +4492,11 @@ class Datalyr {
         this.session = new SessionManager(this.config.sessionTimeout);
         this.attribution = new AttributionManager({
             attributionWindow: this.config.attributionWindow,
-            trackedParams: this.config.trackedParams
+            trackedParams: this.config.trackedParams,
+            // TR-03: gate ad-signal synthesis + shipping on LIVE marketing consent. Returns true by
+            // default (no consent signal) so behavior is unchanged for the common case; false only on
+            // an explicit decline (Shopify marketing:false / setConsent marketing|sale=false).
+            marketingAllowed: () => this.consentAllowsMarketing()
         });
         this.queue = new EventQueue(this.config);
         this.fingerprint = new FingerprintCollector({
@@ -4306,11 +4509,18 @@ class Datalyr {
         // Gate the queue by the FULL tracking policy (opt-out + analytics consent + DNT +
         // GPC) so a returning opted-out / DNT / GPC visitor's persisted events don't drain.
         this.queue.setEnabled(this.shouldTrack());
+        // TR-15: also give the offline drain a LIVE consent gate. setEnabled above is latched to
+        // a fail-open value while Shopify's customerPrivacy loads async; a returning declined
+        // visitor fires no visitorConsentCollected event, so the drain must re-check per run.
+        this.queue.setConsentCheck(() => this.shouldTrack());
         // FIXED (ISSUE-01): Start async initialization immediately but don't block constructor
         // This allows encryption to initialize before any events are tracked
         this.initializeAsync();
         // Setup page unload handler
         this.setupUnloadHandler();
+        // Shopify Customer Privacy (9.A.1): react to the native consent banner's
+        // decision mid-session (grant AND revoke), not just at the next page load.
+        this.setupShopifyConsentListener();
         // Initialize plugins
         if (this.config.plugins) {
             for (const plugin of this.config.plugins) {
@@ -4342,6 +4552,27 @@ class Datalyr {
             this.initializationPromise = (() => __awaiter(this, void 0, void 0, function* () {
                 var _a, _b;
                 try {
+                    // TR-22: capture the LANDING attribution NOW, before any await. The first read used to
+                    // sit inside this.page() AFTER `await container.init()` (up to a ~3s budget), so a
+                    // router / consent tool that strips fbclid via history.replaceState within that window
+                    // — or a fast bounce — lost the click id entirely (nothing persisted to first/last
+                    // touch until the first event). getAttributionData() warms queryParamsCache (freezing
+                    // the landing params) AND persists first/last touch immediately. Wrapped so a failure
+                    // never blocks init.
+                    // CONSENT (Track-3 review P1): gate the eager capture behind shouldTrack(). This call
+                    // synthesizes _fbp/_fbc and persists first/last touch — which must NOT happen at page
+                    // load for an opted-out / DNT / GPC visitor (shouldTrack()=false), or it undoes the
+                    // id-less-at-init privacy invariant. For a TRACKED visitor with marketing declined,
+                    // getAttributionData already strips the click-ids / marketing cookies (TR-03), so TR-22's
+                    // early-capture benefit is preserved for consenting/default visitors.
+                    if (this.shouldTrack()) {
+                        try {
+                            this.attribution.getAttributionData();
+                        }
+                        catch (e) {
+                            this.log('Eager attribution capture failed:', e);
+                        }
+                    }
                     // SEC-03: encryption is for PII-AT-REST only — it must NOT gate event delivery,
                     // pageviews, or pixels. On a non-secure context (http://) or an old browser,
                     // crypto.subtle is absent and initialize() throws; isolate it so the rest of init
@@ -4424,7 +4655,10 @@ class Datalyr {
                     // Initialize auto-identify when enabled (explicit or remote) AND
                     // tracking is allowed. The shouldTrack() gate keeps capture from even
                     // setting up its form/API interceptors for opted-out / DNT / GPC users.
-                    if (this.config.autoIdentify === true && this.shouldTrack()) {
+                    // 9.A.1: the captured email feeds Meta advanced matching / CAPI, so a
+                    // declined Shopify marketing consent also blocks setup (incl. the
+                    // /account.json polling); null = no Shopify signal → unchanged.
+                    if (this.config.autoIdentify === true && this.shouldTrack() && this.shopifyMarketingConsent() !== false) {
                         this.autoIdentify = new AutoIdentifyManager({
                             enabled: true,
                             captureFromForms: this.config.autoIdentifyForms,
@@ -4449,8 +4683,10 @@ class Datalyr {
                     // Stamp attribution signals into the Shopify cart (OPT-IN, default off).
                     // Lets server-side order webhooks recover the browser visitor + Meta click
                     // signals (the postback webhook reads these as note_attributes). Inert unless
-                    // enabled; best-effort and never blocks init.
-                    if (this.config.shopifyCartAttributes === true && this.shouldTrack()) {
+                    // enabled; best-effort and never blocks init. 9.A.1: the stamped visitor_id +
+                    // fbc/fbp/fbclid are marketing signals, so a declined Shopify marketing
+                    // consent blocks stamping too (null = no signal → unchanged).
+                    if (this.config.shopifyCartAttributes === true && this.shouldTrack() && this.shopifyMarketingConsent() !== false) {
                         this.syncShopifyCartAttributes().catch((error) => {
                             this.log('Shopify cart attribute sync failed:', error);
                         });
@@ -4620,6 +4856,13 @@ class Datalyr {
             return;
         }
         try {
+            // A different authenticated user on the same device is a privacy
+            // boundary. Rotate the anonymous/session identities and clear the prior
+            // user's traits/attribution before creating the new link, even when the
+            // integrator forgot to call reset() on logout.
+            const currentUserId = this.identity.getUserId();
+            if (currentUserId && currentUserId !== userId)
+                this.reset();
             // FSR-53: do NOT rotate the session id on identify(). 'Session fixation' is an
             // auth-credential concept; a client-generated analytics session_id is not one.
             // Rotating split every identified visit (and every auto-identify form submit) into
@@ -4682,7 +4925,9 @@ class Datalyr {
         if (!lastTouchpoint || lastTouchpoint.sessionId !== sid) {
             this.attribution.addTouchpoint(sid, this.attribution.captureAttribution());
         }
-        const pageData = Object.assign({ title: document.title, url: window.location.href, path: window.location.pathname, search: window.location.search, referrer: document.referrer }, properties);
+        // 9.A.4: url/search/referrer are redacted (secret/PII query-param values →
+        // __redacted__) before they ever leave the browser — see redactUrl in utils.
+        const pageData = Object.assign({ title: document.title, url: redactUrl(window.location.href), path: window.location.pathname, search: redactUrl(window.location.search), referrer: redactUrl(document.referrer) }, properties);
         // Add referrer data
         const referrerData = getReferrerData();
         Object.assign(pageData, referrerData);
@@ -4752,6 +4997,13 @@ class Datalyr {
         // Gate before mutating persisted identity (identity.alias writes dl_user_id).
         if (!this.shouldTrack())
             return;
+        if (previousId && previousId !== this.identity.getAnonymousId()) {
+            console.warn('[Datalyr] alias() only accepts the current anonymous ID as previousId');
+            return;
+        }
+        const currentUserId = this.identity.getUserId();
+        if (currentUserId && currentUserId !== userId)
+            this.reset();
         const aliasData = this.identity.alias(userId, previousId);
         this.track('$alias', aliasData);
     }
@@ -4907,6 +5159,27 @@ class Datalyr {
     /**
      * Opt out of tracking
      */
+    /**
+     * X-1 (consent): stop the Stripe Payment Link + CheckoutChamp outbound-link decorators from
+     * stamping `client_reference_id`/`prefilled_email` onto <a> hrefs once consent/marketing is
+     * withdrawn. Their MutationObservers otherwise keep rewriting links after a CMP or Shopify
+     * decline — and the server still reads the stamped `client_reference_id` — so attribution
+     * continues post-withdrawal. Idempotent; decorators re-init on the next load if consent returns
+     * (same convention as pixels/auto-identify).
+     */
+    disposeMarketingLinkDecorators() {
+        var _a, _b;
+        try {
+            (_a = this.stripeLinksDisposer) === null || _a === void 0 ? void 0 : _a.call(this);
+        }
+        catch ( /* best-effort */_c) { /* best-effort */ }
+        this.stripeLinksDisposer = undefined;
+        try {
+            (_b = this.outboundDisposer) === null || _b === void 0 ? void 0 : _b.call(this);
+        }
+        catch ( /* best-effort */_d) { /* best-effort */ }
+        this.outboundDisposer = undefined;
+    }
     optOut() {
         var _a;
         if (!this.initialized) {
@@ -4928,6 +5201,8 @@ class Datalyr {
             this.container.cleanupAllIframes();
             this.container = undefined;
         }
+        // X-1: stop stamping Stripe/CC outbound links with the visitor id / email.
+        this.disposeMarketingLinkDecorators();
         // Purge PII at rest.
         this.userProperties = {};
         storage.remove('dl_user_traits');
@@ -4949,6 +5224,9 @@ class Datalyr {
         // merely because opt-out was lifted — otherwise a GPC/DNT visitor's persisted
         // events would start draining again. (Pixels / auto-identify resume on next load.)
         this.queue.setEnabled(this.shouldTrack());
+        // TR-15 (P3): opt-in → persist the in-memory anon id now (see onShopifyConsentChanged).
+        if (this.shouldTrack())
+            this.identity.enablePersistence();
         this.log('User opted in');
     }
     /**
@@ -4961,6 +5239,7 @@ class Datalyr {
      * Set consent preferences
      */
     setConsent(consent) {
+        var _a;
         // Always record + persist consent FIRST, even before init(). FSR-51: a consent-
         // management platform commonly calls setConsent() before init() so tracking is gated
         // from the very first event. The old code then dereferenced this.queue/this.config
@@ -4981,6 +5260,22 @@ class Datalyr {
         if (!allowed) {
             this.queue.clear();
             this.queue.clearOffline();
+            // TR-14: mirror optOut() on analytics withdrawal. Previously setConsent tore down the
+            // queue + container but left autoIdentify alive — its form/fetch interceptors and
+            // /account.json polling kept running and triggerIdentify persisted the captured email
+            // to storage AFTER withdrawal (PII newly written at rest → GDPR/consent-audit failure
+            // on non-Shopify CMP installs). Destroy it and purge PII at rest. (Auto-identify
+            // resumes on the next page load if consent is re-granted, matching optOut/optIn.)
+            (_a = this.autoIdentify) === null || _a === void 0 ? void 0 : _a.destroy();
+            this.autoIdentify = undefined;
+            this.userProperties = {};
+            storage.remove('dl_user_traits');
+            storage.remove('dl_auto_identified_email');
+            storage.remove('dl_journey');
+        }
+        else {
+            // TR-15 (P3): grant → persist the in-memory anon id now (see onShopifyConsentChanged).
+            this.identity.enablePersistence();
         }
         // Marketing / "do not sell" withdrawal: stop FEEDING the third-party pixels and
         // prevent them from being initialized on the next page load. NOTE: an
@@ -4990,6 +5285,12 @@ class Datalyr {
             this.container.cleanupAllIframes();
             this.container = undefined;
         }
+        // X-1: on marketing/sale withdrawal, stop the Stripe/CC decorators from stamping the
+        // visitor id / email onto outbound links (the observers otherwise keep rewriting hrefs
+        // after withdrawal, and the server still reads the stamped client_reference_id).
+        if (!this.consentAllowsMarketing()) {
+            this.disposeMarketingLinkDecorators();
+        }
         this.log('Consent updated:', consent);
     }
     /**
@@ -5074,91 +5375,27 @@ class Datalyr {
             }
         });
     }
-    /**
-     * Restore _dl_* URL bridge params on a Checkout Champ funnel page.
-     * Runs BEFORE IdentityManager so the storefront's visitor_id wins over a
-     * freshly auto-generated one. Also restores _fbc / _fbp cookies and the
-     * fbclid click time so server-side rebuilds carry the real click moment.
-     *
-     * Strategy: stamp matching cookies (without clobbering pre-existing values),
-     * then rewrite the URL so `_dl_fbclid` becomes `fbclid` — that way the rest
-     * of the SDK's attribution layer (which reads `params.fbclid`) works
-     * unchanged, and any merchant analytics also see the canonical click ID.
-     */
+    /** Strip the retired unsigned Checkout Champ bridge parameters. */
     restoreFromURL() {
         var _a;
         if (typeof window === "undefined" || typeof document === "undefined")
             return;
         try {
             const params = new URLSearchParams(window.location.search);
-            const get = (k) => params.get(k);
-            const vid = get("_dl_vid");
-            const fbc = get("_dl_fbc");
-            const fbp = get("_dl_fbp");
-            const fbclid = get("_dl_fbclid");
-            const fbclidAt = get("_dl_fbclid_at");
-            const gclid = get("_dl_gclid");
-            const gclidAt = get("_dl_gclid_at");
-            // visitor_id: bridge wins. The whole point of `_dl_vid` is to unify the
-            // storefront's session with the CC funnel session. A pre-existing local
-            // cookie from a prior direct CC visit would silently sink the integration
-            // (CC events stay on the local id; storefront events use the bridged id;
-            // the two never link). Overwrite — orphaned local events are fine.
-            if (vid)
-                this.cookies.set("__dl_visitor_id", vid, 365);
-            // Meta cookies + click-time cookies: existing wins. _fbc / _fbp may have
-            // been written by Meta Pixel on the CC funnel page itself (more recent
-            // than the bridged value); _dl_fbclid_at should record first-touch click
-            // time per device, not get reset by a bridge from a new campaign.
-            const setIfMissing = (name, value) => {
-                if (!value)
-                    return;
-                if (this.cookies.get(name))
-                    return;
-                this.cookies.set(name, value, 365);
-            };
-            setIfMissing("_fbc", fbc);
-            setIfMissing("_fbp", fbp);
-            setIfMissing("_dl_fbclid_at", fbclidAt);
-            setIfMissing("_dl_gclid_at", gclidAt);
-            // Rewrite URL: _dl_fbclid → fbclid (etc.) so captureAttribution() picks
-            // them up via its existing `params.fbclid` path. Strip the _dl_* params
-            // either way so they don't leak into downstream analytics URLs.
-            let rewrote = false;
-            const mappings = [
-                ["fbclid", fbclid],
-                ["gclid", gclid]
-            ];
-            for (const [canonical, value] of mappings) {
-                if (value && !params.get(canonical)) {
-                    params.set(canonical, value);
-                    rewrote = true;
-                }
-            }
+            let changed = false;
             for (const k of ["_dl_vid", "_dl_fbc", "_dl_fbp", "_dl_fbclid", "_dl_fbclid_at", "_dl_gclid", "_dl_gclid_at"]) {
                 if (params.has(k)) {
                     params.delete(k);
-                    rewrote = true;
+                    changed = true;
                 }
             }
-            if (rewrote && typeof ((_a = window.history) === null || _a === void 0 ? void 0 : _a.replaceState) === "function") {
+            if (changed && typeof ((_a = window.history) === null || _a === void 0 ? void 0 : _a.replaceState) === "function") {
                 const newSearch = params.toString();
-                const newUrl = window.location.pathname +
-                    (newSearch ? "?" + newSearch : "") +
-                    window.location.hash;
+                const newUrl = window.location.pathname + (newSearch ? "?" + newSearch : "") + window.location.hash;
                 window.history.replaceState(window.history.state, "", newUrl);
             }
-            this.log("Checkout Champ bridge restored:", {
-                had_vid: !!vid,
-                had_fbc: !!fbc,
-                had_fbp: !!fbp,
-                had_fbclid: !!fbclid,
-                had_gclid: !!gclid
-            });
         }
         catch (error) {
-            // Don't let bridge restoration block init — fall through to normal SDK
-            // behavior (a fresh visitor_id, no restored click signals).
             this.log("restoreFromURL failed:", error);
         }
     }
@@ -5259,138 +5496,9 @@ class Datalyr {
             this.log("fireCheckoutChampPurchasePixel failed:", error);
         }
     }
-    /**
-     * Storefront → Checkout Champ link stamping. Finds every `<a href>` whose host
-     * matches the configured CC domain list and appends `?_dl_vid=…&_dl_fbc=…&
-     * _dl_fbp=…&_dl_fbclid=…&_dl_fbclid_at=…&_dl_gclid=…` so the user's
-     * visitor_id + Meta click signals cross the domain. MutationObserver watches
-     * for dynamically-injected links. On click, force-flush the event queue so
-     * any pending track() events land before the browser navigates away.
-     */
+    /** Checkout Champ identity bridging remains disabled pending signed tokens. */
     syncOutboundLinkParams(domains) {
-        if (typeof window === "undefined" || typeof document === "undefined")
-            return;
-        const lowerDomains = domains.map((d) => d.toLowerCase());
-        const matchesCcDomain = (href) => {
-            try {
-                const host = new URL(href, window.location.href).hostname.toLowerCase();
-                return lowerDomains.some((d) => host === d || host.endsWith("." + d));
-            }
-            catch (_a) {
-                return false;
-            }
-        };
-        const buildBridgeParams = () => {
-            var _a, _b;
-            const attribution = this.attribution.getAttributionData();
-            const out = {};
-            const vid = this.identity.getAnonymousId();
-            const fbc = this.cookies.get("_fbc") || attribution._fbc;
-            const fbp = this.cookies.get("_fbp") || attribution._fbp;
-            // FSR-104: read the named click-id fields directly (captureAttribution stores every
-            // present click id under its own key) so a landing URL carrying BOTH fbclid and
-            // gclid bridges both — the old `clickIdType === 'fbclid' ? clickId : null` dropped
-            // gclid whenever fbclid was the primary, silently losing Google attribution on the
-            // cross-domain CC path. Fall back to the primary clickId for older stored shapes.
-            const fbclid = (_a = attribution.fbclid) !== null && _a !== void 0 ? _a : (attribution.clickIdType === "fbclid" ? attribution.clickId : null);
-            const fbclidAt = this.cookies.get("_dl_fbclid_at");
-            const gclid = (_b = attribution.gclid) !== null && _b !== void 0 ? _b : (attribution.clickIdType === "gclid" ? attribution.clickId : null);
-            const gclidAt = this.cookies.get("_dl_gclid_at");
-            if (vid)
-                out._dl_vid = vid;
-            if (fbc)
-                out._dl_fbc = String(fbc);
-            if (fbp)
-                out._dl_fbp = String(fbp);
-            if (fbclid)
-                out._dl_fbclid = String(fbclid);
-            if (fbclidAt)
-                out._dl_fbclid_at = String(fbclidAt);
-            if (gclid)
-                out._dl_gclid = String(gclid);
-            if (gclidAt)
-                out._dl_gclid_at = String(gclidAt);
-            return out;
-        };
-        const stampLink = (anchor) => {
-            if (!anchor.href || !matchesCcDomain(anchor.href))
-                return;
-            try {
-                const u = new URL(anchor.href, window.location.href);
-                const bridge = buildBridgeParams();
-                let mutated = false;
-                for (const [k, v] of Object.entries(bridge)) {
-                    if (!u.searchParams.get(k)) {
-                        u.searchParams.set(k, v);
-                        mutated = true;
-                    }
-                }
-                if (mutated)
-                    anchor.href = u.toString();
-            }
-            catch (_a) {
-                // Ignore malformed URLs — don't break the page.
-            }
-        };
-        const stampAll = () => {
-            document.querySelectorAll("a[href]").forEach((el) => stampLink(el));
-        };
-        const onClick = (e) => {
-            var _a, _b;
-            const target = (_a = e.target) === null || _a === void 0 ? void 0 : _a.closest("a[href]");
-            if (!target)
-                return;
-            const anchor = target;
-            if (!matchesCcDomain(anchor.href))
-                return;
-            stampLink(anchor); // re-stamp in case attribution changed since DOMReady
-            try {
-                (_b = this.queue) === null || _b === void 0 ? void 0 : _b.flush();
-            }
-            catch (_c) {
-                // Best-effort — never block navigation.
-            }
-        };
-        stampAll();
-        document.addEventListener("click", onClick, true);
-        try {
-            // Debounce re-stamping. A busy SPA (infinite scroll, animations,
-            // React/Vue updates) can fire thousands of mutations per second; a naive
-            // re-stamp on every notification would burn CPU pointlessly when
-            // outbound link sets only change occasionally. 150ms is small enough to
-            // catch links before the user can click them, large enough to coalesce
-            // bursts.
-            let restampTimer = null;
-            const scheduleRestamp = () => {
-                if (restampTimer != null)
-                    return;
-                restampTimer = setTimeout(() => {
-                    restampTimer = null;
-                    stampAll();
-                }, 150);
-            };
-            const observer = new MutationObserver(scheduleRestamp);
-            observer.observe(document.documentElement, { childList: true, subtree: true });
-            // Observer + click listener live for the session; pagehide cleans up on full-page
-            // unload, and destroy() can tear them down early via this disposer (H2 — otherwise
-            // a destroy()+re-init() leaks the observer + capturing click listener).
-            this.outboundDisposer = () => {
-                try {
-                    observer.disconnect();
-                }
-                catch ( /* idempotent */_a) { /* idempotent */ }
-                if (restampTimer != null) {
-                    clearTimeout(restampTimer);
-                    restampTimer = null;
-                }
-                document.removeEventListener("click", onClick, true);
-            };
-            window.addEventListener("pagehide", () => { var _a; return (_a = this.outboundDisposer) === null || _a === void 0 ? void 0 : _a.call(this); }, { once: true });
-        }
-        catch (error) {
-            this.log("MutationObserver setup failed (CC link sync):", error);
-        }
-        this.log("Checkout Champ outbound-link sync active for:", lowerDomains);
+        this.log("Checkout Champ outbound identity bridge disabled (signed token required)", domains);
     }
     /**
      * Stripe Payment Link auto-decoration (D1). Structurally mirrors
@@ -5549,6 +5657,7 @@ class Datalyr {
      * Create event payload
      */
     createEventPayload(eventName, properties, eventIdArg) {
+        var _a;
         // NEW-2: keep the identity's cached session id in lockstep with the LIVE session.
         // The session id changes on session timeout (and previously on identify(), removed in
         // FSR-53), but identity only synced it at init/start — so the top-level
@@ -5585,17 +5694,30 @@ class Datalyr {
                 device_fingerprint: fingerprintData // Use snake_case only (matches backend)
             });
         }
-        // Add browser context (caller wins on collisions)
+        // Add browser context (caller wins on collisions). 9.A.4: url/referrer are
+        // redacted — secret/PII query-param values must not ship on events.
         assignMissing(eventData, {
-            url: window.location.href,
+            url: redactUrl(window.location.href),
             path: window.location.pathname,
-            referrer: document.referrer,
+            referrer: redactUrl(document.referrer),
             title: document.title,
             screen_width: screen.width,
             screen_height: screen.height,
             viewport_width: window.innerWidth,
             viewport_height: window.innerHeight
         });
+        // Consent travels with the event so downstream profile enrichment and ad
+        // postbacks enforce the decision that applied at occurrence time. The SDK
+        // snapshot is authoritative over caller properties.
+        const consentSnapshot = Object.assign({}, ((_a = this.consent) !== null && _a !== void 0 ? _a : {}));
+        const shopifyAnalytics = this.shopifyAnalyticsConsent();
+        const shopifyMarketing = this.shopifyMarketingConsent();
+        if (typeof shopifyAnalytics === 'boolean')
+            consentSnapshot.analytics = shopifyAnalytics;
+        if (typeof shopifyMarketing === 'boolean')
+            consentSnapshot.marketing = shopifyMarketing;
+        if (Object.keys(consentSnapshot).length > 0)
+            eventData.consent = consentSnapshot;
         // Create payload using snake_case only (matches backend API and production script)
         const identityFields = this.identity.getIdentityFields();
         // Use the caller-provided event_id (shared with the Meta Pixel co-fire for
@@ -5624,11 +5746,17 @@ class Datalyr {
             // Resolution metadata
             resolution_method: 'browser_sdk',
             resolution_confidence: 1.0,
-            // SDK metadata. MUST stay in sync with package.json "version" — the build guard
-            // (scripts/check-bundle.js, run by build:check) fails the build if the bundle's
-            // sdk_version doesn't match package.json. (FSR-103)
-            sdk_version: '1.7.4',
-            sdk_name: 'datalyr-web-sdk'
+            // SDK metadata. The placeholder is replaced with package.json "version" at build
+            // time (rollup.config.js injectSdkVersion — 9.A.3), so the literal can never
+            // drift from the package again (it sat at 1.7.4 across the 1.7.5 release). The
+            // build guard (scripts/check-bundle.js, run by build:check) still verifies the
+            // deployable bundles carry the package.json version. (FSR-103)
+            sdk_version: '1.7.6',
+            sdk_name: 'datalyr-web-sdk',
+            // A3-25: versioned-envelope stamp. Every SDK emits schema_version so the ingest/contract
+            // layer can key on ONE canonical envelope version (snake_case fields, event_name/event_data
+            // keys, canonical click-ids, clamped client timestamp — all now converged across SDKs).
+            schema_version: 1
         };
         return payload;
     }
@@ -5644,6 +5772,14 @@ class Datalyr {
         if (this.consent && this.consent.analytics === false) {
             return false;
         }
+        // Shopify Customer Privacy (9.A.1 — LEGAL): on a Shopify storefront, a shopper who
+        // declined the native consent banner must not be tracked, even when the merchant
+        // never wired setConsent(). null = API absent (non-Plus store not using it, or
+        // script loaded off-Shopify) → fall through. A detected Shopify storefront
+        // fails closed while the asynchronous Customer Privacy API is unresolved.
+        if (this.shopifyAnalyticsConsent() === false) {
+            return false;
+        }
         // Check Do Not Track
         if (this.config.respectDoNotTrack && isDoNotTrackEnabled()) {
             return false;
@@ -5660,8 +5796,185 @@ class Datalyr {
      * pixels (which share data). No consent set = allowed (default).
      */
     consentAllowsMarketing() {
+        // Shopify Customer Privacy (9.A.1): a declined native banner blocks marketing use
+        // (pixel loads, click-id/email forwarding) even with no setConsent() call.
+        // null = no signal → defer to the setConsent-based policy below, unchanged.
+        if (this.shopifyMarketingConsent() === false) {
+            return false;
+        }
         return !this.consent || (this.consent.marketing !== false && this.consent.sale !== false);
     }
+    /**
+     * Shopify Customer Privacy API handle (9.A.1), or null when it doesn't apply.
+     *
+     * X-2 (LEGAL): gated on RUNTIME detection of `window.Shopify.customerPrivacy`, NOT on
+     * `config.platform === 'shopify'`. A Shopify merchant who installs via a plain <script>
+     * snippet or a headless storefront (no `platform:'shopify'`) still exposes customerPrivacy;
+     * gating on config.platform meant a shopper who DECLINED the native banner (with no
+     * setConsent() wired) was fully tracked — nullifying the consent feature for a whole install
+     * class, and unfixable server-side (platform is install-time only). Every access is wrapped —
+     * a Shopify API shape change (or a non-Shopify site) must NEVER break tracking (→ null = fail open).
+     */
+    getShopifyCustomerPrivacy() {
+        var _a, _b;
+        if (typeof window === 'undefined')
+            return null;
+        try {
+            return (_b = (_a = window.Shopify) === null || _a === void 0 ? void 0 : _a.customerPrivacy) !== null && _b !== void 0 ? _b : null;
+        }
+        catch (_c) {
+            return null;
+        }
+    }
+    isShopifyStorefront() {
+        var _a;
+        if (((_a = this.config) === null || _a === void 0 ? void 0 : _a.platform) === 'shopify')
+            return true;
+        if (typeof window === 'undefined')
+            return false;
+        try {
+            return Boolean(window.Shopify) ||
+                window.location.hostname.toLowerCase().endsWith('.myshopify.com');
+        }
+        catch (_b) {
+            return false;
+        }
+    }
+    /**
+     * Shopify's analytics-consent signal: true/false when the Customer Privacy API is
+     * present and answers, null when there's no signal (API absent / unexpected shape)
+     * — null means "no restriction from Shopify", i.e. today's behavior.
+     */
+    shopifyAnalyticsConsent() {
+        try {
+            const cp = this.getShopifyCustomerPrivacy();
+            if (!cp)
+                return this.isShopifyStorefront() ? false : null;
+            if (typeof cp.analyticsProcessingAllowed === 'function') {
+                const allowed = cp.analyticsProcessingAllowed();
+                return typeof allowed === 'boolean' ? allowed : null;
+            }
+            // Older API surface: the aggregate "can this visitor be tracked" signal.
+            if (typeof cp.userCanBeTracked === 'function') {
+                const allowed = cp.userCanBeTracked();
+                return typeof allowed === 'boolean' ? allowed : null;
+            }
+            return this.isShopifyStorefront() ? false : null;
+        }
+        catch (_a) {
+            return this.isShopifyStorefront() ? false : null;
+        }
+    }
+    /**
+     * Shopify's marketing-consent signal (gates pixels, click-id/email → CAPI, cart
+     * attribute stamping, auto-identify email capture). Same null semantics as
+     * shopifyAnalyticsConsent().
+     */
+    shopifyMarketingConsent() {
+        try {
+            const cp = this.getShopifyCustomerPrivacy();
+            if (!cp || typeof cp.marketingAllowed !== 'function') {
+                return this.isShopifyStorefront() ? false : null;
+            }
+            const allowed = cp.marketingAllowed();
+            return typeof allowed === 'boolean'
+                ? allowed
+                : (this.isShopifyStorefront() ? false : null);
+        }
+        catch (_a) {
+            return this.isShopifyStorefront() ? false : null;
+        }
+    }
+    /**
+     * Listen for Shopify's `visitorConsentCollected` document event (9.A.1) so a
+     * consent decision made mid-session takes effect without a reload. Revocation is
+     * enforced immediately, mirroring setConsent(): queue gated + purged, pixels torn
+     * down, auto-identify (email capture + /account.json polling) destroyed. On grant
+     * the queue re-enables (track() re-checks shouldTrack() per event anyway) and cart
+     * attribute stamping runs; pixels / auto-identify resume on the next page load —
+     * the same convention as optIn().
+     */
+    setupShopifyConsentListener() {
+        // X-2: NOT gated on config.platform — a plain-snippet/headless Shopify install must also honor
+        // a mid-session consent decision. The `visitorConsentCollected` event only fires on Shopify
+        // storefronts, and the handler + loadFeatures are fully guarded, so this is a safe no-op
+        // everywhere else.
+        if (typeof document === 'undefined')
+            return;
+        try {
+            this.shopifyConsentHandler = () => {
+                try {
+                    this.onShopifyConsentChanged();
+                }
+                catch (error) {
+                    this.log('Shopify consent change handling failed:', error);
+                }
+            };
+            document.addEventListener('visitorConsentCollected', this.shopifyConsentHandler);
+            // TR-15: customerPrivacy loads ASYNCHRONOUSLY. Until it's present shopifyAnalyticsConsent()
+            // returns null (fail-open → events send in the pre-load window). Force the feature to load
+            // and re-run the full consent evaluation in the callback so a declined visitor is gated
+            // (queue disabled + purged) as soon as the API answers, without waiting for a reload or a
+            // banner interaction. Guarded — a missing/changed loadFeatures must never break tracking.
+            const shopify = window.Shopify;
+            if (shopify && typeof shopify.loadFeatures === 'function') {
+                shopify.loadFeatures([{ name: 'consent-tracking-api', version: '0.1' }], (error) => {
+                    if (error) {
+                        this.log('Shopify loadFeatures(consent-tracking-api) failed:', error);
+                        return;
+                    }
+                    try {
+                        this.onShopifyConsentChanged();
+                    }
+                    catch (e) {
+                        this.log('Shopify post-load consent eval failed:', e);
+                    }
+                });
+            }
+        }
+        catch (error) {
+            this.log('Shopify consent listener setup failed:', error);
+        }
+    }
+    onShopifyConsentChanged() {
+        const allowed = this.shouldTrack();
+        this.queue.setEnabled(allowed);
+        // TR-15 (P3): a mid-session grant must persist the in-memory anon id NOW — otherwise a
+        // visitor declined at init keeps a memory-only id and this session's events land under a
+        // visitor_id that vanishes on the next page load. Idempotent.
+        if (allowed)
+            this.identity.enablePersistence();
+        if (!allowed) {
+            // Mirror setConsent() withdrawal: purge buffered events so events captured
+            // before the decline can't drain if consent is later re-granted.
+            this.queue.clear();
+            this.queue.clearOffline();
+        }
+        const marketingBlocked = this.shopifyMarketingConsent() === false;
+        // Stop email capture (form interceptors + /account.json polling) immediately.
+        if ((!allowed || marketingBlocked) && this.autoIdentify) {
+            this.autoIdentify.destroy();
+            this.autoIdentify = undefined;
+        }
+        // Same caveat as setConsent(): an already-injected pixel global (fbq/gtag/ttq)
+        // keeps running in the page; full removal is on reload.
+        if (!this.consentAllowsMarketing() && this.container) {
+            this.container.cleanupAllIframes();
+            this.container = undefined;
+        }
+        // X-1: marketing withdrawn (Shopify decline) → stop stamping Stripe/CC outbound links.
+        if (!this.consentAllowsMarketing()) {
+            this.disposeMarketingLinkDecorators();
+        }
+        // Grant direction: cart-attribute stamping is cheap and idempotent (merges via
+        // /cart/update.js), so run it now instead of waiting for the next page load.
+        if (allowed && !marketingBlocked && this.config.shopifyCartAttributes === true) {
+            this.syncShopifyCartAttributes().catch((error) => {
+                this.log('Shopify cart attribute sync failed:', error);
+            });
+        }
+        this.log('Shopify consent collected — analytics allowed:', allowed, '— marketing blocked:', marketingBlocked);
+    }
     /**
      * Setup SPA tracking
      * Fixed Issue #15: Store original methods for cleanup
@@ -5762,7 +6075,7 @@ class Datalyr {
             stack: error.stack,
             context,
             timestamp: new Date().toISOString(),
-            url: window.location.href
+            url: redactUrl(window.location.href) // 9.A.4: no secret query values in error logs
         };
         this.errors.push(errorInfo);
         // Keep only recent errors
@@ -5844,6 +6157,10 @@ class Datalyr {
             window.removeEventListener('visibilitychange', this.visibilityHandler);
             this.visibilityHandler = undefined;
         }
+        if (this.shopifyConsentHandler) {
+            document.removeEventListener('visitorConsentCollected', this.shopifyConsentHandler);
+            this.shopifyConsentHandler = undefined;
+        }
         if (this.outboundDisposer) {
             this.outboundDisposer();
             this.outboundDisposer = undefined;
@@ -5885,8 +6202,14 @@ class Datalyr {
         this.log('SDK destroyed');
     }
 }
-// Create singleton instance
-const datalyr = new Datalyr();
+// Create singleton instance. TR-23: reuse an existing window.datalyr (a prior tag's instance —
+// Shopify App Embed + a manual snippet coexisting, or a double-included bundle) instead of
+// constructing a SECOND one. Two instances each patch history.pushState and fire their own
+// pageviews (distinct event_ids → no server-side dedup). A plain truthy check (NOT instanceof):
+// two <script> tags run two separate IIFEs whose Datalyr classes are structurally identical but
+// distinct objects, so instanceof would fail across them. With one shared instance, the second
+// tag's bootstrap init() hits the instance-level `initialized` guard and no-ops.
+const datalyr = (typeof window !== 'undefined' && window.datalyr) || new Datalyr();
 // Expose global API
 if (typeof window !== 'undefined') {
     window.datalyr = datalyr;