@datalyr/web 1.7.5 → 1.7.6

package/dist/datalyr.js

@@ -1,5 +1,5 @@
 /**
- * @datalyr/web v1.7.5
+ * @datalyr/web v1.7.6
  * Datalyr Web SDK - Modern attribution tracking for web applications
  * (c) 2026 Datalyr Inc.
  * Released under the MIT License
@@ -794,6 +794,125 @@ var Datalyr = (function (exports) {
         }
         return data;
     }
+    // 9.A.4: query-param NAMES whose VALUES are secrets/PII — password-reset tokens,
+    // OAuth codes, magic-link sessions, emails/phones prefilled into URLs. Events ship
+    // `url` / `referrer` / `landingPage` with the FULL query string (sanitizeEventData
+    // only strips property KEYS, not URL param values), so /reset?token=…&email=… leaked
+    // verbatim into events and onward to ad platforms. Matched case-insensitively.
+    const REDACTED_URL_PARAMS = new Set([
+        'token', 'access_token', 'refresh_token', 'id_token', 'auth', 'authorization',
+        'password', 'pass', 'pwd', 'secret', 'api_key', 'apikey', 'key',
+        'session', 'session_id', 'sid', 'email', 'e', 'phone', 'tel',
+        'signature', 'sig', 'otp', 'reset', 'hash'
+    ]);
+    // BATCH-2(e): `code` is CONDITIONAL, not in the always-redact set above. An OAuth
+    // authorization code (account-takeover-grade if it leaks to ad platforms) ALWAYS travels
+    // with an OAuth-flow marker in the same query/fragment — the response carries `code`+`state`
+    // (+`scope`/`session_state`/`iss`), the authorize request carries `client_id`/`redirect_uri`/
+    // `response_type`/`code_challenge`. A coupon/referral/product code (`?code=SUMMER20`) — a real
+    // attribution signal for the DTC/Shopify ICP — never does. So we redact `code` ONLY when a
+    // marker co-occurs in the same k=v string, preserving marketing codes. (A bare `code=` with no
+    // marker is syntactically indistinguishable from a coupon code and is kept; state-less OAuth
+    // flows are rare and CSRF-unsafe.) Markers are deliberately OAuth-specific to avoid redacting
+    // legitimate codes — `prompt`/`authuser` are excluded as too generic.
+    const OAUTH_CODE_CONTEXT_MARKERS = new Set([
+        'state', 'client_id', 'redirect_uri', 'response_type', 'grant_type',
+        'code_challenge', 'session_state', 'scope', 'iss',
+        // Token family: the presence of any bearer/OAuth token means a bare `code` in the same
+        // string is almost certainly an auth code, not a coupon — a marketing URL never carries
+        // these. (These values are independently redacted too; this only governs `code`.)
+        'access_token', 'id_token', 'refresh_token', 'token'
+    ]);
+    const REDACTED_URL_VALUE = '__redacted__';
+    // Redact denylisted keys in one `k=v&k=v` string (query OR fragment). Returns the
+    // re-encoded string and whether anything was rewritten (so the caller can preserve the
+    // exact original bytes when nothing matched).
+    function redactKvPairs(s) {
+        const params = new URLSearchParams(s);
+        let mutated = false;
+        const keysLower = Array.from(new Set(params.keys())).map(k => k.toLowerCase());
+        // `code` co-occurrence check (BATCH-2e) — evaluated per-string, since an OAuth flow puts
+        // `code` and its marker in the SAME query (or the SAME fragment).
+        const hasOAuthMarker = keysLower.some(k => OAUTH_CODE_CONTEXT_MARKERS.has(k));
+        // Snapshot the keys first — set() collapses duplicate keys mid-iteration.
+        for (const key of Array.from(new Set(params.keys()))) {
+            const lower = key.toLowerCase();
+            const sensitive = lower === 'code'
+                ? hasOAuthMarker
+                : REDACTED_URL_PARAMS.has(lower);
+            if (sensitive) {
+                params.set(key, REDACTED_URL_VALUE);
+                mutated = true;
+            }
+        }
+        return { out: params.toString(), mutated };
+    }
+    /**
+     * Redact secret/PII param VALUES in a URL (9.A.4). The param NAME is kept
+     * (value → `__redacted__`) so funnel steps that match on the param's presence still
+     * work; every other param — click IDs (fbclid/gclid/…) and utm_* — survives untouched.
+     * Both the query string AND a k=v fragment are rewritten: TR-04 — OAuth-implicit /
+     * Supabase magic links carry the session in the FRAGMENT (`/welcome#access_token=eyJ…`),
+     * with no query string at all; the old code returned early on a missing `?` and reattached
+     * the fragment verbatim, leaking the full JWT into `url` / `landingPage` / `dl_first_touch`
+     * (90d) and onward to ad platforms. Non-k=v fragments (`#section`, `#/spa-route`) keep their
+     * shape. Returns the input unchanged when nothing sensitive matched or on any parse
+     * failure — redaction must never break tracking.
+     */
+    function redactUrl(url) {
+        if (!url || typeof url !== 'string')
+            return url;
+        const hashStart = url.indexOf('#');
+        const qIdx = url.indexOf('?');
+        // A query string exists only when '?' appears BEFORE the fragment — a '?' after '#' is
+        // part of the fragment per the URL grammar (e.g. a SPA hash-route `#/reset?token=…`).
+        const queryStart = (qIdx !== -1 && (hashStart === -1 || qIdx < hashStart)) ? qIdx : -1;
+        if (queryStart === -1 && hashStart === -1)
+            return url; // nothing to redact
+        try {
+            const base = url.slice(0, queryStart !== -1 ? queryStart : (hashStart !== -1 ? hashStart : url.length));
+            const query = queryStart === -1 ? '' : url.slice(queryStart + 1, hashStart === -1 ? url.length : hashStart);
+            const rawFragment = hashStart === -1 ? '' : url.slice(hashStart + 1);
+            let mutated = false;
+            let queryOut = query;
+            if (query) {
+                const r = redactKvPairs(query);
+                if (r.mutated) {
+                    queryOut = r.out;
+                    mutated = true;
+                }
+            }
+            // TR-04: redact the fragment when it carries k=v pairs. Two shapes: a pure implicit-flow
+            // fragment (`#access_token=…&refresh_token=…`) and a SPA hash-route with its own query
+            // (`#/reset?access_token=…`). Leave non-k=v fragments (`#section`, `#/route`) untouched.
+            let fragmentOut = rawFragment;
+            if (rawFragment) {
+                const fragQ = rawFragment.indexOf('?');
+                if (fragQ !== -1) {
+                    const r = redactKvPairs(rawFragment.slice(fragQ + 1));
+                    if (r.mutated) {
+                        fragmentOut = rawFragment.slice(0, fragQ + 1) + r.out;
+                        mutated = true;
+                    }
+                }
+                else if (/[\w-]+=/.test(rawFragment)) {
+                    const r = redactKvPairs(rawFragment);
+                    if (r.mutated) {
+                        fragmentOut = r.out;
+                        mutated = true;
+                    }
+                }
+            }
+            if (!mutated)
+                return url; // nothing sensitive matched → ship the exact original bytes
+            return base
+                + (queryStart === -1 ? '' : '?' + queryOut)
+                + (hashStart === -1 ? '' : '#' + fragmentOut);
+        }
+        catch (_a) {
+            return url; // malformed URL → ship as-is rather than drop/break the event
+        }
+    }
     /**
      * Deep merge objects
      */
@@ -924,16 +1043,18 @@ var Datalyr = (function (exports) {
             return {};
         try {
             const url = new URL(referrer);
+            // 9.A.4: the referrer can be our own /reset?token=… or an OAuth callback —
+            // redact secret/PII param values before they're stamped onto the event.
             return {
-                referrer,
+                referrer: redactUrl(referrer),
                 referrer_host: url.hostname,
                 referrer_path: url.pathname,
-                referrer_search: url.search,
+                referrer_search: redactUrl(url.search),
                 referrer_source: detectReferrerSource(url.hostname)
             };
         }
         catch (_a) {
-            return { referrer };
+            return { referrer: redactUrl(referrer) };
         }
     }
     /**
@@ -994,17 +1115,13 @@ var Datalyr = (function (exports) {
                 this.setRootDomainCookie('__dl_visitor_id', anonymousId);
                 return anonymousId;
             }
-            // 2. Fresh visitor (no persisted id): accept a cross-domain bridge id from the URL,
-            //    but ONLY a well-formed anon_<uuid> — reject arbitrary / oversized values (a
-            //    multi-KB or attacker-crafted _dl_vid was previously persisted verbatim). Strip
-            //    it from the address bar so a re-shared URL can't merge the next visitor. (FSR-50)
+            // 2. Raw URL visitor IDs are never identity authority. A syntactically
+            // valid ID is still replayable/attacker-chosen and can merge two people.
+            // Strip the legacy parameter and generate a fresh local identity below.
             try {
                 const urlParams = new URLSearchParams(window.location.search);
-                const urlVisitorId = urlParams.get('_dl_vid');
-                if (urlVisitorId && this.isValidAnonymousId(urlVisitorId)) {
+                if (urlParams.has('_dl_vid')) {
                     this.stripUrlParam('_dl_vid');
-                    this.persistAnonymousId(urlVisitorId);
-                    return urlVisitorId;
                 }
             }
             catch (e) {
@@ -1028,12 +1145,17 @@ var Datalyr = (function (exports) {
             storage.set('dl_anonymous_id', id);
         }
         /**
-         * Whether a `_dl_vid` value is a well-formed Datalyr anonymous id (anon_ + UUID).
-         * The length is bounded by the pattern, so an oversized/garbage value is rejected.
-         * (FSR-50)
+         * TR-15 / FSR-107: tracking became allowed mid-session (optIn / consent grant). Start
+         * persisting AND flush the current in-memory anon id to the cookie + localStorage now.
+         * Without this, a visitor declined at init keeps a memory-only id, so that session's
+         * events land under a visitor_id that vanishes on the next page load (attribution
+         * fragmentation). Idempotent — a no-op once already persisting.
          */
-        isValidAnonymousId(id) {
-            return /^anon_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id);
+        enablePersistence() {
+            if (this.persistNewId)
+                return;
+            this.persistNewId = true;
+            this.persistAnonymousId(this.anonymousId);
         }
         /**
          * Remove a query param from the current URL via history.replaceState (best-effort).
@@ -1524,6 +1646,10 @@ var Datalyr = (function (exports) {
             this.CLICK_ID_ALIASES = {
                 ScCid: 'sclid',
                 sccid: 'sclid',
+                // Impact's real landing param is `irclickid`; capture it and normalize to the canonical
+                // `irclid` that ingest / the MV / the source map (`irclid→impact`) all key on. Without
+                // this, real Impact affiliate clicks were dark on web (only bare `irclid` was captured).
+                irclickid: 'irclid',
             };
             // Default tracked params matching dl.js
             this.DEFAULT_TRACKED_PARAMS = [
@@ -1534,9 +1660,18 @@ var Datalyr = (function (exports) {
                 'medium', // Generic medium (non-UTM)
                 'gad_source' // Google Ads source parameter
             ];
+            // TR-03: ad-cookie fields (Meta/Google Ads/TikTok/Snap) that are MARKETING-scoped. When
+            // marketing consent is declined these are neither synthesized/written nor shipped. Google
+            // Analytics cookies (_ga/_gid) and utm_* stay — they're analytics-scoped.
+            this.MARKETING_COOKIES = ['_fbp', '_fbc', '_gcl_aw', '_gcl_dc', '_gcl_gb', '_gcl_ha', '_gac', '_ttp', '_ttc', '_scid'];
             this.attributionWindow = options.attributionWindow || 90 * 24 * 60 * 60 * 1000; // 90 days (increased from 30 for B2B sales cycles)
             // Merge default tracked params with user-provided ones
             this.trackedParams = [...this.DEFAULT_TRACKED_PARAMS, ...(options.trackedParams || [])];
+            this.marketingAllowedFn = options.marketingAllowed;
+        }
+        // TR-03: default (no predicate / no signal) = allowed → byte-identical to prior behavior.
+        isMarketingAllowed() {
+            return this.marketingAllowedFn ? this.marketingAllowedFn() !== false : true;
         }
         /**
          * Clear query params cache (called on page navigation)
@@ -1607,13 +1742,15 @@ var Datalyr = (function (exports) {
                     attribution[param] = value;
                 }
             }
-            // Capture referrer
+            // Capture referrer. 9.A.4: redact secret/PII query-param values (reset tokens,
+            // OAuth codes, emails) — this attribution object is stamped onto every event AND
+            // persisted into dl_first_touch/dl_last_touch, so it must be clean at capture.
             if (document.referrer) {
-                attribution.referrer = document.referrer;
+                attribution.referrer = redactUrl(document.referrer);
                 attribution.referrerHost = this.extractHostname(document.referrer);
             }
-            // Capture landing page
-            attribution.landingPage = window.location.href;
+            // Capture landing page (redacted — see referrer note above)
+            attribution.landingPage = redactUrl(window.location.href);
             attribution.landingPath = window.location.pathname;
             // Determine source if not explicitly set
             if (!attribution.source) {
@@ -1709,6 +1846,10 @@ var Datalyr = (function (exports) {
         captureAdCookies() {
             var _a, _b;
             const adCookies = {};
+            // TR-03: when marketing consent is declined, do NOT synthesize/write the Meta/Google ad
+            // cookies below (writing _fbp/_fbc is active marketing use). Existing cookies are still
+            // read here but stripped from the event payload in getAttributionData().
+            const marketingAllowed = this.isMarketingAllowed();
             // Facebook/Meta cookies
             adCookies._fbp = cookies.get('_fbp');
             adCookies._fbc = cookies.get('_fbc');
@@ -1727,8 +1868,8 @@ var Datalyr = (function (exports) {
             // Snapchat first-party cookie (Snap Pixel sets _scid). Flows to the server as
             // cookies._scid and is sent on the Snap CAPI event as sc_cookie1 (raw).
             adCookies._scid = cookies.get('_scid');
-            // Generate _fbp if missing (Facebook browser ID)
-            if (!adCookies._fbp && (this.hasClickId('fbclid') || adCookies._fbc)) {
+            // Generate _fbp if missing (Facebook browser ID). TR-03: only when marketing is allowed.
+            if (marketingAllowed && !adCookies._fbp && (this.hasClickId('fbclid') || adCookies._fbc)) {
                 const timestamp = Date.now();
                 // Meta's _fbp format is fb.1.<creationTimeMs>.<randomNumber> where the last
                 // segment MUST be a decimal integer. The old base36 string was non-conformant —
@@ -1752,7 +1893,8 @@ var Datalyr = (function (exports) {
             // Shopify cart / server-side rebuild forward it as a time, so its format must not
             // change.
             const fbclid = this.getCurrentFbclid();
-            if (fbclid) {
+            // TR-03: skip _fbc synthesis/refresh (cookie write) when marketing is declined.
+            if (marketingAllowed && fbclid) {
                 const existingFbc = adCookies._fbc; // captured above (cookies.get('_fbc'))
                 const embeddedFbclid = this.extractFbclidFromFbc(existingFbc);
                 if (!existingFbc) {
@@ -1782,7 +1924,7 @@ var Datalyr = (function (exports) {
             // (gclid has no synthesized-and-going-stale artifact like _fbc, and Google does not
             // validate a creationTime window the way Meta does, so this stays once-only.)
             const gclid = this.hasClickId('gclid') ? ((_b = (_a = this.queryParamsCache) === null || _a === void 0 ? void 0 : _a.gclid) !== null && _b !== void 0 ? _b : null) : null;
-            if (gclid && !cookies.get('_dl_gclid_at')) {
+            if (marketingAllowed && gclid && !cookies.get('_dl_gclid_at')) {
                 cookies.set('_dl_gclid_at', String(Date.now()), 90);
             }
             // Filter out null values for cleaner data
@@ -1860,7 +2002,7 @@ var Datalyr = (function (exports) {
             if (hasRealAttribution) {
                 this.storeLastTouch(current);
             }
-            return Object.assign(Object.assign(Object.assign({}, current), adCookies), { 
+            const result = Object.assign(Object.assign(Object.assign({}, current), adCookies), { 
                 // First touch (with snake_case aliases)
                 first_touch_source: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.source, first_touch_medium: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.medium, first_touch_campaign: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.campaign, first_touch_timestamp: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.timestamp, firstTouchSource: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.source, firstTouchMedium: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.medium, firstTouchCampaign: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.campaign, 
                 // Last touch (with snake_case aliases)
@@ -1871,6 +2013,21 @@ var Datalyr = (function (exports) {
                     : 0, daysSinceFirstTouch: (firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.timestamp)
                     ? Math.floor((Date.now() - firstTouch.timestamp) / 86400000)
                     : 0 });
+            // TR-03: strip MARKETING-scoped signals (click IDs + ad cookies) from the event payload
+            // when marketing consent is declined — analytics-scoped fields (utm_*, source/medium/
+            // campaign, first/last touch, _ga/_gid) stay. Live predicate → a later grant restores
+            // them on the next event. Synthesis of _fbp/_fbc was already skipped in captureAdCookies.
+            if (!this.isMarketingAllowed()) {
+                const marketingKeys = [
+                    ...this.CLICK_IDS,
+                    ...Object.values(this.CLICK_ID_ALIASES),
+                    'clickId', 'clickIdType',
+                    ...this.MARKETING_COOKIES,
+                ];
+                for (const k of marketingKeys)
+                    delete result[k];
+            }
+            return result;
         }
         /**
          * Determine source from attribution data
@@ -1881,13 +2038,19 @@ var Datalyr = (function (exports) {
                 const clickIdSources = {
                     fbclid: 'facebook',
                     gclid: 'google',
+                    gbraid: 'google', // 9.A.6: Google Ads (iOS) — was falling through to 'paid'
+                    wbraid: 'google', // 9.A.6: Google Ads (web)
                     ttclid: 'tiktok',
                     msclkid: 'bing',
                     twclid: 'twitter',
                     li_fat_id: 'linkedin',
                     sclid: 'snapchat',
                     dclid: 'doubleclick',
-                    epik: 'pinterest'
+                    epik: 'pinterest',
+                    rdt_cid: 'reddit', // 9.A.6
+                    obclid: 'outbrain', // 9.A.6
+                    irclid: 'impact', // 9.A.6: Impact Radius
+                    ko_click_id: 'klaviyo' // 9.A.6
                 };
                 return clickIdSources[attribution.clickIdType] || 'paid';
             }
@@ -2513,6 +2676,16 @@ var Datalyr = (function (exports) {
                 // two of them could splice the same offlineQueue concurrently and double-send.
                 if (!this.enabled)
                     return;
+                // TR-15: re-check consent at DRAIN time. A returning DECLINED visitor whose consent
+                // signal loads asynchronously (Shopify customerPrivacy) fires no visitorConsentCollected
+                // event, so `enabled` stayed at its fail-open init value. If consent now says no, latch
+                // off and PURGE the persisted backlog instead of draining it (a later grant re-enables
+                // via setEnabled). Mirrors the withdrawal purge in optOut()/setConsent().
+                if (this.consentCheck && this.consentCheck() === false) {
+                    this.enabled = false;
+                    this.clearOffline();
+                    return;
+                }
                 if (Date.now() < this.rateLimitedUntil)
                     return; // FIXED (429): honor Retry-After window
                 if (this.offlineProcessing)
@@ -2604,10 +2777,13 @@ var Datalyr = (function (exports) {
          *  - Non-terminal (tab switch): deliver the LIVE queue via a response-checked keepalive
          *    fetch (flush) and response-check-drain the offline backlog (processOfflineQueue) —
          *    neither erases the backlog on failure. The destructive beacon path is not used.
-         *  - Terminal (unload): beacon live+offline best-effort, but PERSIST everything first
-         *    and NEVER storage.remove() on a mere beacon enqueue. The next page load's
-         *    response-checked drain (normal fetch, no 64KB cap) is the source of truth and
-         *    clears the copy; server event_id dedup makes the potential double-send safe.
+         *  - Terminal (unload): PERSIST everything first (live + the already-persisted offline
+         *    backlog) and NEVER storage.remove() on a mere beacon enqueue. Beacon ONLY the LIVE
+         *    queue best-effort — NOT the offline backlog (TR-13): the backlog is already durable and
+         *    the next-load drain delivers it exactly once, so beaconing it here too risked a
+         *    delivered-now-AND-re-drained-next-load double-send that, when >6h apart, outlives
+         *    ingest's dedup window → a duplicate purchase. The next page load's response-checked
+         *    drain (normal fetch, no 64KB cap) is the source of truth and clears the copy.
          *  - Both paths honor rateLimitedUntil (don't beacon/flush into the backoff window).
          *
          * Still excludes the in-flight _flush batch (its keepalive fetch already carries it,
@@ -2649,6 +2825,14 @@ var Datalyr = (function (exports) {
                     }
                     storage.set(this.OFFLINE_QUEUE_KEY, toPersist);
                 }
+                // TR-13: beacon ONLY the LIVE queue (never-persisted events from THIS session). The
+                // offline backlog is already durable and the next-load drain delivers it once, so
+                // beaconing it here would double-send it — and a stale backlog event (e.g. a purchase
+                // parked during an outage) re-drained on a later day lands >6h from the beacon, past
+                // ingest's dedup window. The live queue's beacon + its own next-load drain both land THIS
+                // session (<6h), so dedup absorbs that pair.
+                if (live.length === 0)
+                    return; // only the persisted backlog remained → it drains next load
                 // Within the 429 window, don't beacon into it — the persisted copy drains next load.
                 if (Date.now() < this.rateLimitedUntil)
                     return;
@@ -2659,7 +2843,7 @@ var Datalyr = (function (exports) {
                 const chunks = [];
                 let current = [];
                 let currentBytes = 2; // approx for the JSON array/object wrapper
-                for (const ev of pending) {
+                for (const ev of live) {
                     // Byte length (not UTF-16 .length) so multibyte product names / emoji can't
                     // under-count and overflow the cap.
                     const evBytes = new Blob([JSON.stringify(ev)]).size + 1;
@@ -2685,7 +2869,7 @@ var Datalyr = (function (exports) {
                         break;
                     beaconed += chunk.length;
                 }
-                this.log(`forceFlush(terminal): beaconed ${beaconed}/${pending.length} events; persisted copy retained for next-load drain`);
+                this.log(`forceFlush(terminal): beaconed ${beaconed}/${live.length} live events; backlog (${pending.length - live.length}) persisted for next-load drain`);
             });
         }
         /**
@@ -2706,6 +2890,15 @@ var Datalyr = (function (exports) {
         setEnabled(enabled) {
             this.enabled = enabled;
         }
+        /**
+         * TR-15: register a live consent predicate the offline drain re-evaluates at drain time.
+         * `enabled` is latched at init to a fail-open value (Shopify's customerPrivacy loads
+         * async), and a returning DECLINED visitor fires no visitorConsentCollected event — so
+         * without this, their persisted backlog would drain before the decline is known.
+         */
+        setConsentCheck(fn) {
+            this.consentCheck = fn;
+        }
         /**
          * Clear the offline queue and its persisted copy (used by opt-out to purge any
          * PII-bearing events that were parked before the user opted out).
@@ -4298,7 +4491,11 @@ var Datalyr = (function (exports) {
             this.session = new SessionManager(this.config.sessionTimeout);
             this.attribution = new AttributionManager({
                 attributionWindow: this.config.attributionWindow,
-                trackedParams: this.config.trackedParams
+                trackedParams: this.config.trackedParams,
+                // TR-03: gate ad-signal synthesis + shipping on LIVE marketing consent. Returns true by
+                // default (no consent signal) so behavior is unchanged for the common case; false only on
+                // an explicit decline (Shopify marketing:false / setConsent marketing|sale=false).
+                marketingAllowed: () => this.consentAllowsMarketing()
             });
             this.queue = new EventQueue(this.config);
             this.fingerprint = new FingerprintCollector({
@@ -4311,11 +4508,18 @@ var Datalyr = (function (exports) {
             // Gate the queue by the FULL tracking policy (opt-out + analytics consent + DNT +
             // GPC) so a returning opted-out / DNT / GPC visitor's persisted events don't drain.
             this.queue.setEnabled(this.shouldTrack());
+            // TR-15: also give the offline drain a LIVE consent gate. setEnabled above is latched to
+            // a fail-open value while Shopify's customerPrivacy loads async; a returning declined
+            // visitor fires no visitorConsentCollected event, so the drain must re-check per run.
+            this.queue.setConsentCheck(() => this.shouldTrack());
             // FIXED (ISSUE-01): Start async initialization immediately but don't block constructor
             // This allows encryption to initialize before any events are tracked
             this.initializeAsync();
             // Setup page unload handler
             this.setupUnloadHandler();
+            // Shopify Customer Privacy (9.A.1): react to the native consent banner's
+            // decision mid-session (grant AND revoke), not just at the next page load.
+            this.setupShopifyConsentListener();
             // Initialize plugins
             if (this.config.plugins) {
                 for (const plugin of this.config.plugins) {
@@ -4347,6 +4551,27 @@ var Datalyr = (function (exports) {
                 this.initializationPromise = (() => __awaiter(this, void 0, void 0, function* () {
                     var _a, _b;
                     try {
+                        // TR-22: capture the LANDING attribution NOW, before any await. The first read used to
+                        // sit inside this.page() AFTER `await container.init()` (up to a ~3s budget), so a
+                        // router / consent tool that strips fbclid via history.replaceState within that window
+                        // — or a fast bounce — lost the click id entirely (nothing persisted to first/last
+                        // touch until the first event). getAttributionData() warms queryParamsCache (freezing
+                        // the landing params) AND persists first/last touch immediately. Wrapped so a failure
+                        // never blocks init.
+                        // CONSENT (Track-3 review P1): gate the eager capture behind shouldTrack(). This call
+                        // synthesizes _fbp/_fbc and persists first/last touch — which must NOT happen at page
+                        // load for an opted-out / DNT / GPC visitor (shouldTrack()=false), or it undoes the
+                        // id-less-at-init privacy invariant. For a TRACKED visitor with marketing declined,
+                        // getAttributionData already strips the click-ids / marketing cookies (TR-03), so TR-22's
+                        // early-capture benefit is preserved for consenting/default visitors.
+                        if (this.shouldTrack()) {
+                            try {
+                                this.attribution.getAttributionData();
+                            }
+                            catch (e) {
+                                this.log('Eager attribution capture failed:', e);
+                            }
+                        }
                         // SEC-03: encryption is for PII-AT-REST only — it must NOT gate event delivery,
                         // pageviews, or pixels. On a non-secure context (http://) or an old browser,
                         // crypto.subtle is absent and initialize() throws; isolate it so the rest of init
@@ -4429,7 +4654,10 @@ var Datalyr = (function (exports) {
                         // Initialize auto-identify when enabled (explicit or remote) AND
                         // tracking is allowed. The shouldTrack() gate keeps capture from even
                         // setting up its form/API interceptors for opted-out / DNT / GPC users.
-                        if (this.config.autoIdentify === true && this.shouldTrack()) {
+                        // 9.A.1: the captured email feeds Meta advanced matching / CAPI, so a
+                        // declined Shopify marketing consent also blocks setup (incl. the
+                        // /account.json polling); null = no Shopify signal → unchanged.
+                        if (this.config.autoIdentify === true && this.shouldTrack() && this.shopifyMarketingConsent() !== false) {
                             this.autoIdentify = new AutoIdentifyManager({
                                 enabled: true,
                                 captureFromForms: this.config.autoIdentifyForms,
@@ -4454,8 +4682,10 @@ var Datalyr = (function (exports) {
                         // Stamp attribution signals into the Shopify cart (OPT-IN, default off).
                         // Lets server-side order webhooks recover the browser visitor + Meta click
                         // signals (the postback webhook reads these as note_attributes). Inert unless
-                        // enabled; best-effort and never blocks init.
-                        if (this.config.shopifyCartAttributes === true && this.shouldTrack()) {
+                        // enabled; best-effort and never blocks init. 9.A.1: the stamped visitor_id +
+                        // fbc/fbp/fbclid are marketing signals, so a declined Shopify marketing
+                        // consent blocks stamping too (null = no signal → unchanged).
+                        if (this.config.shopifyCartAttributes === true && this.shouldTrack() && this.shopifyMarketingConsent() !== false) {
                             this.syncShopifyCartAttributes().catch((error) => {
                                 this.log('Shopify cart attribute sync failed:', error);
                             });
@@ -4625,6 +4855,13 @@ var Datalyr = (function (exports) {
                 return;
             }
             try {
+                // A different authenticated user on the same device is a privacy
+                // boundary. Rotate the anonymous/session identities and clear the prior
+                // user's traits/attribution before creating the new link, even when the
+                // integrator forgot to call reset() on logout.
+                const currentUserId = this.identity.getUserId();
+                if (currentUserId && currentUserId !== userId)
+                    this.reset();
                 // FSR-53: do NOT rotate the session id on identify(). 'Session fixation' is an
                 // auth-credential concept; a client-generated analytics session_id is not one.
                 // Rotating split every identified visit (and every auto-identify form submit) into
@@ -4687,7 +4924,9 @@ var Datalyr = (function (exports) {
             if (!lastTouchpoint || lastTouchpoint.sessionId !== sid) {
                 this.attribution.addTouchpoint(sid, this.attribution.captureAttribution());
             }
-            const pageData = Object.assign({ title: document.title, url: window.location.href, path: window.location.pathname, search: window.location.search, referrer: document.referrer }, properties);
+            // 9.A.4: url/search/referrer are redacted (secret/PII query-param values →
+            // __redacted__) before they ever leave the browser — see redactUrl in utils.
+            const pageData = Object.assign({ title: document.title, url: redactUrl(window.location.href), path: window.location.pathname, search: redactUrl(window.location.search), referrer: redactUrl(document.referrer) }, properties);
             // Add referrer data
             const referrerData = getReferrerData();
             Object.assign(pageData, referrerData);
@@ -4757,6 +4996,13 @@ var Datalyr = (function (exports) {
             // Gate before mutating persisted identity (identity.alias writes dl_user_id).
             if (!this.shouldTrack())
                 return;
+            if (previousId && previousId !== this.identity.getAnonymousId()) {
+                console.warn('[Datalyr] alias() only accepts the current anonymous ID as previousId');
+                return;
+            }
+            const currentUserId = this.identity.getUserId();
+            if (currentUserId && currentUserId !== userId)
+                this.reset();
             const aliasData = this.identity.alias(userId, previousId);
             this.track('$alias', aliasData);
         }
@@ -4912,6 +5158,27 @@ var Datalyr = (function (exports) {
         /**
          * Opt out of tracking
          */
+        /**
+         * X-1 (consent): stop the Stripe Payment Link + CheckoutChamp outbound-link decorators from
+         * stamping `client_reference_id`/`prefilled_email` onto <a> hrefs once consent/marketing is
+         * withdrawn. Their MutationObservers otherwise keep rewriting links after a CMP or Shopify
+         * decline — and the server still reads the stamped `client_reference_id` — so attribution
+         * continues post-withdrawal. Idempotent; decorators re-init on the next load if consent returns
+         * (same convention as pixels/auto-identify).
+         */
+        disposeMarketingLinkDecorators() {
+            var _a, _b;
+            try {
+                (_a = this.stripeLinksDisposer) === null || _a === void 0 ? void 0 : _a.call(this);
+            }
+            catch ( /* best-effort */_c) { /* best-effort */ }
+            this.stripeLinksDisposer = undefined;
+            try {
+                (_b = this.outboundDisposer) === null || _b === void 0 ? void 0 : _b.call(this);
+            }
+            catch ( /* best-effort */_d) { /* best-effort */ }
+            this.outboundDisposer = undefined;
+        }
         optOut() {
             var _a;
             if (!this.initialized) {
@@ -4933,6 +5200,8 @@ var Datalyr = (function (exports) {
                 this.container.cleanupAllIframes();
                 this.container = undefined;
             }
+            // X-1: stop stamping Stripe/CC outbound links with the visitor id / email.
+            this.disposeMarketingLinkDecorators();
             // Purge PII at rest.
             this.userProperties = {};
             storage.remove('dl_user_traits');
@@ -4954,6 +5223,9 @@ var Datalyr = (function (exports) {
             // merely because opt-out was lifted — otherwise a GPC/DNT visitor's persisted
             // events would start draining again. (Pixels / auto-identify resume on next load.)
             this.queue.setEnabled(this.shouldTrack());
+            // TR-15 (P3): opt-in → persist the in-memory anon id now (see onShopifyConsentChanged).
+            if (this.shouldTrack())
+                this.identity.enablePersistence();
             this.log('User opted in');
         }
         /**
@@ -4966,6 +5238,7 @@ var Datalyr = (function (exports) {
          * Set consent preferences
          */
         setConsent(consent) {
+            var _a;
             // Always record + persist consent FIRST, even before init(). FSR-51: a consent-
             // management platform commonly calls setConsent() before init() so tracking is gated
             // from the very first event. The old code then dereferenced this.queue/this.config
@@ -4986,6 +5259,22 @@ var Datalyr = (function (exports) {
             if (!allowed) {
                 this.queue.clear();
                 this.queue.clearOffline();
+                // TR-14: mirror optOut() on analytics withdrawal. Previously setConsent tore down the
+                // queue + container but left autoIdentify alive — its form/fetch interceptors and
+                // /account.json polling kept running and triggerIdentify persisted the captured email
+                // to storage AFTER withdrawal (PII newly written at rest → GDPR/consent-audit failure
+                // on non-Shopify CMP installs). Destroy it and purge PII at rest. (Auto-identify
+                // resumes on the next page load if consent is re-granted, matching optOut/optIn.)
+                (_a = this.autoIdentify) === null || _a === void 0 ? void 0 : _a.destroy();
+                this.autoIdentify = undefined;
+                this.userProperties = {};
+                storage.remove('dl_user_traits');
+                storage.remove('dl_auto_identified_email');
+                storage.remove('dl_journey');
+            }
+            else {
+                // TR-15 (P3): grant → persist the in-memory anon id now (see onShopifyConsentChanged).
+                this.identity.enablePersistence();
             }
             // Marketing / "do not sell" withdrawal: stop FEEDING the third-party pixels and
             // prevent them from being initialized on the next page load. NOTE: an
@@ -4995,6 +5284,12 @@ var Datalyr = (function (exports) {
                 this.container.cleanupAllIframes();
                 this.container = undefined;
             }
+            // X-1: on marketing/sale withdrawal, stop the Stripe/CC decorators from stamping the
+            // visitor id / email onto outbound links (the observers otherwise keep rewriting hrefs
+            // after withdrawal, and the server still reads the stamped client_reference_id).
+            if (!this.consentAllowsMarketing()) {
+                this.disposeMarketingLinkDecorators();
+            }
             this.log('Consent updated:', consent);
         }
         /**
@@ -5079,91 +5374,27 @@ var Datalyr = (function (exports) {
                 }
             });
         }
-        /**
-         * Restore _dl_* URL bridge params on a Checkout Champ funnel page.
-         * Runs BEFORE IdentityManager so the storefront's visitor_id wins over a
-         * freshly auto-generated one. Also restores _fbc / _fbp cookies and the
-         * fbclid click time so server-side rebuilds carry the real click moment.
-         *
-         * Strategy: stamp matching cookies (without clobbering pre-existing values),
-         * then rewrite the URL so `_dl_fbclid` becomes `fbclid` — that way the rest
-         * of the SDK's attribution layer (which reads `params.fbclid`) works
-         * unchanged, and any merchant analytics also see the canonical click ID.
-         */
+        /** Strip the retired unsigned Checkout Champ bridge parameters. */
         restoreFromURL() {
             var _a;
             if (typeof window === "undefined" || typeof document === "undefined")
                 return;
             try {
                 const params = new URLSearchParams(window.location.search);
-                const get = (k) => params.get(k);
-                const vid = get("_dl_vid");
-                const fbc = get("_dl_fbc");
-                const fbp = get("_dl_fbp");
-                const fbclid = get("_dl_fbclid");
-                const fbclidAt = get("_dl_fbclid_at");
-                const gclid = get("_dl_gclid");
-                const gclidAt = get("_dl_gclid_at");
-                // visitor_id: bridge wins. The whole point of `_dl_vid` is to unify the
-                // storefront's session with the CC funnel session. A pre-existing local
-                // cookie from a prior direct CC visit would silently sink the integration
-                // (CC events stay on the local id; storefront events use the bridged id;
-                // the two never link). Overwrite — orphaned local events are fine.
-                if (vid)
-                    this.cookies.set("__dl_visitor_id", vid, 365);
-                // Meta cookies + click-time cookies: existing wins. _fbc / _fbp may have
-                // been written by Meta Pixel on the CC funnel page itself (more recent
-                // than the bridged value); _dl_fbclid_at should record first-touch click
-                // time per device, not get reset by a bridge from a new campaign.
-                const setIfMissing = (name, value) => {
-                    if (!value)
-                        return;
-                    if (this.cookies.get(name))
-                        return;
-                    this.cookies.set(name, value, 365);
-                };
-                setIfMissing("_fbc", fbc);
-                setIfMissing("_fbp", fbp);
-                setIfMissing("_dl_fbclid_at", fbclidAt);
-                setIfMissing("_dl_gclid_at", gclidAt);
-                // Rewrite URL: _dl_fbclid → fbclid (etc.) so captureAttribution() picks
-                // them up via its existing `params.fbclid` path. Strip the _dl_* params
-                // either way so they don't leak into downstream analytics URLs.
-                let rewrote = false;
-                const mappings = [
-                    ["fbclid", fbclid],
-                    ["gclid", gclid]
-                ];
-                for (const [canonical, value] of mappings) {
-                    if (value && !params.get(canonical)) {
-                        params.set(canonical, value);
-                        rewrote = true;
-                    }
-                }
+                let changed = false;
                 for (const k of ["_dl_vid", "_dl_fbc", "_dl_fbp", "_dl_fbclid", "_dl_fbclid_at", "_dl_gclid", "_dl_gclid_at"]) {
                     if (params.has(k)) {
                         params.delete(k);
-                        rewrote = true;
+                        changed = true;
                     }
                 }
-                if (rewrote && typeof ((_a = window.history) === null || _a === void 0 ? void 0 : _a.replaceState) === "function") {
+                if (changed && typeof ((_a = window.history) === null || _a === void 0 ? void 0 : _a.replaceState) === "function") {
                     const newSearch = params.toString();
-                    const newUrl = window.location.pathname +
-                        (newSearch ? "?" + newSearch : "") +
-                        window.location.hash;
+                    const newUrl = window.location.pathname + (newSearch ? "?" + newSearch : "") + window.location.hash;
                     window.history.replaceState(window.history.state, "", newUrl);
                 }
-                this.log("Checkout Champ bridge restored:", {
-                    had_vid: !!vid,
-                    had_fbc: !!fbc,
-                    had_fbp: !!fbp,
-                    had_fbclid: !!fbclid,
-                    had_gclid: !!gclid
-                });
             }
             catch (error) {
-                // Don't let bridge restoration block init — fall through to normal SDK
-                // behavior (a fresh visitor_id, no restored click signals).
                 this.log("restoreFromURL failed:", error);
             }
         }
@@ -5264,138 +5495,9 @@ var Datalyr = (function (exports) {
                 this.log("fireCheckoutChampPurchasePixel failed:", error);
             }
         }
-        /**
-         * Storefront → Checkout Champ link stamping. Finds every `<a href>` whose host
-         * matches the configured CC domain list and appends `?_dl_vid=…&_dl_fbc=…&
-         * _dl_fbp=…&_dl_fbclid=…&_dl_fbclid_at=…&_dl_gclid=…` so the user's
-         * visitor_id + Meta click signals cross the domain. MutationObserver watches
-         * for dynamically-injected links. On click, force-flush the event queue so
-         * any pending track() events land before the browser navigates away.
-         */
+        /** Checkout Champ identity bridging remains disabled pending signed tokens. */
         syncOutboundLinkParams(domains) {
-            if (typeof window === "undefined" || typeof document === "undefined")
-                return;
-            const lowerDomains = domains.map((d) => d.toLowerCase());
-            const matchesCcDomain = (href) => {
-                try {
-                    const host = new URL(href, window.location.href).hostname.toLowerCase();
-                    return lowerDomains.some((d) => host === d || host.endsWith("." + d));
-                }
-                catch (_a) {
-                    return false;
-                }
-            };
-            const buildBridgeParams = () => {
-                var _a, _b;
-                const attribution = this.attribution.getAttributionData();
-                const out = {};
-                const vid = this.identity.getAnonymousId();
-                const fbc = this.cookies.get("_fbc") || attribution._fbc;
-                const fbp = this.cookies.get("_fbp") || attribution._fbp;
-                // FSR-104: read the named click-id fields directly (captureAttribution stores every
-                // present click id under its own key) so a landing URL carrying BOTH fbclid and
-                // gclid bridges both — the old `clickIdType === 'fbclid' ? clickId : null` dropped
-                // gclid whenever fbclid was the primary, silently losing Google attribution on the
-                // cross-domain CC path. Fall back to the primary clickId for older stored shapes.
-                const fbclid = (_a = attribution.fbclid) !== null && _a !== void 0 ? _a : (attribution.clickIdType === "fbclid" ? attribution.clickId : null);
-                const fbclidAt = this.cookies.get("_dl_fbclid_at");
-                const gclid = (_b = attribution.gclid) !== null && _b !== void 0 ? _b : (attribution.clickIdType === "gclid" ? attribution.clickId : null);
-                const gclidAt = this.cookies.get("_dl_gclid_at");
-                if (vid)
-                    out._dl_vid = vid;
-                if (fbc)
-                    out._dl_fbc = String(fbc);
-                if (fbp)
-                    out._dl_fbp = String(fbp);
-                if (fbclid)
-                    out._dl_fbclid = String(fbclid);
-                if (fbclidAt)
-                    out._dl_fbclid_at = String(fbclidAt);
-                if (gclid)
-                    out._dl_gclid = String(gclid);
-                if (gclidAt)
-                    out._dl_gclid_at = String(gclidAt);
-                return out;
-            };
-            const stampLink = (anchor) => {
-                if (!anchor.href || !matchesCcDomain(anchor.href))
-                    return;
-                try {
-                    const u = new URL(anchor.href, window.location.href);
-                    const bridge = buildBridgeParams();
-                    let mutated = false;
-                    for (const [k, v] of Object.entries(bridge)) {
-                        if (!u.searchParams.get(k)) {
-                            u.searchParams.set(k, v);
-                            mutated = true;
-                        }
-                    }
-                    if (mutated)
-                        anchor.href = u.toString();
-                }
-                catch (_a) {
-                    // Ignore malformed URLs — don't break the page.
-                }
-            };
-            const stampAll = () => {
-                document.querySelectorAll("a[href]").forEach((el) => stampLink(el));
-            };
-            const onClick = (e) => {
-                var _a, _b;
-                const target = (_a = e.target) === null || _a === void 0 ? void 0 : _a.closest("a[href]");
-                if (!target)
-                    return;
-                const anchor = target;
-                if (!matchesCcDomain(anchor.href))
-                    return;
-                stampLink(anchor); // re-stamp in case attribution changed since DOMReady
-                try {
-                    (_b = this.queue) === null || _b === void 0 ? void 0 : _b.flush();
-                }
-                catch (_c) {
-                    // Best-effort — never block navigation.
-                }
-            };
-            stampAll();
-            document.addEventListener("click", onClick, true);
-            try {
-                // Debounce re-stamping. A busy SPA (infinite scroll, animations,
-                // React/Vue updates) can fire thousands of mutations per second; a naive
-                // re-stamp on every notification would burn CPU pointlessly when
-                // outbound link sets only change occasionally. 150ms is small enough to
-                // catch links before the user can click them, large enough to coalesce
-                // bursts.
-                let restampTimer = null;
-                const scheduleRestamp = () => {
-                    if (restampTimer != null)
-                        return;
-                    restampTimer = setTimeout(() => {
-                        restampTimer = null;
-                        stampAll();
-                    }, 150);
-                };
-                const observer = new MutationObserver(scheduleRestamp);
-                observer.observe(document.documentElement, { childList: true, subtree: true });
-                // Observer + click listener live for the session; pagehide cleans up on full-page
-                // unload, and destroy() can tear them down early via this disposer (H2 — otherwise
-                // a destroy()+re-init() leaks the observer + capturing click listener).
-                this.outboundDisposer = () => {
-                    try {
-                        observer.disconnect();
-                    }
-                    catch ( /* idempotent */_a) { /* idempotent */ }
-                    if (restampTimer != null) {
-                        clearTimeout(restampTimer);
-                        restampTimer = null;
-                    }
-                    document.removeEventListener("click", onClick, true);
-                };
-                window.addEventListener("pagehide", () => { var _a; return (_a = this.outboundDisposer) === null || _a === void 0 ? void 0 : _a.call(this); }, { once: true });
-            }
-            catch (error) {
-                this.log("MutationObserver setup failed (CC link sync):", error);
-            }
-            this.log("Checkout Champ outbound-link sync active for:", lowerDomains);
+            this.log("Checkout Champ outbound identity bridge disabled (signed token required)", domains);
         }
         /**
          * Stripe Payment Link auto-decoration (D1). Structurally mirrors
@@ -5554,6 +5656,7 @@ var Datalyr = (function (exports) {
          * Create event payload
          */
         createEventPayload(eventName, properties, eventIdArg) {
+            var _a;
             // NEW-2: keep the identity's cached session id in lockstep with the LIVE session.
             // The session id changes on session timeout (and previously on identify(), removed in
             // FSR-53), but identity only synced it at init/start — so the top-level
@@ -5590,17 +5693,30 @@ var Datalyr = (function (exports) {
                     device_fingerprint: fingerprintData // Use snake_case only (matches backend)
                 });
             }
-            // Add browser context (caller wins on collisions)
+            // Add browser context (caller wins on collisions). 9.A.4: url/referrer are
+            // redacted — secret/PII query-param values must not ship on events.
             assignMissing(eventData, {
-                url: window.location.href,
+                url: redactUrl(window.location.href),
                 path: window.location.pathname,
-                referrer: document.referrer,
+                referrer: redactUrl(document.referrer),
                 title: document.title,
                 screen_width: screen.width,
                 screen_height: screen.height,
                 viewport_width: window.innerWidth,
                 viewport_height: window.innerHeight
             });
+            // Consent travels with the event so downstream profile enrichment and ad
+            // postbacks enforce the decision that applied at occurrence time. The SDK
+            // snapshot is authoritative over caller properties.
+            const consentSnapshot = Object.assign({}, ((_a = this.consent) !== null && _a !== void 0 ? _a : {}));
+            const shopifyAnalytics = this.shopifyAnalyticsConsent();
+            const shopifyMarketing = this.shopifyMarketingConsent();
+            if (typeof shopifyAnalytics === 'boolean')
+                consentSnapshot.analytics = shopifyAnalytics;
+            if (typeof shopifyMarketing === 'boolean')
+                consentSnapshot.marketing = shopifyMarketing;
+            if (Object.keys(consentSnapshot).length > 0)
+                eventData.consent = consentSnapshot;
             // Create payload using snake_case only (matches backend API and production script)
             const identityFields = this.identity.getIdentityFields();
             // Use the caller-provided event_id (shared with the Meta Pixel co-fire for
@@ -5629,11 +5745,17 @@ var Datalyr = (function (exports) {
                 // Resolution metadata
                 resolution_method: 'browser_sdk',
                 resolution_confidence: 1.0,
-                // SDK metadata. MUST stay in sync with package.json "version" — the build guard
-                // (scripts/check-bundle.js, run by build:check) fails the build if the bundle's
-                // sdk_version doesn't match package.json. (FSR-103)
-                sdk_version: '1.7.4',
-                sdk_name: 'datalyr-web-sdk'
+                // SDK metadata. The placeholder is replaced with package.json "version" at build
+                // time (rollup.config.js injectSdkVersion — 9.A.3), so the literal can never
+                // drift from the package again (it sat at 1.7.4 across the 1.7.5 release). The
+                // build guard (scripts/check-bundle.js, run by build:check) still verifies the
+                // deployable bundles carry the package.json version. (FSR-103)
+                sdk_version: '1.7.6',
+                sdk_name: 'datalyr-web-sdk',
+                // A3-25: versioned-envelope stamp. Every SDK emits schema_version so the ingest/contract
+                // layer can key on ONE canonical envelope version (snake_case fields, event_name/event_data
+                // keys, canonical click-ids, clamped client timestamp — all now converged across SDKs).
+                schema_version: 1
             };
             return payload;
         }
@@ -5649,6 +5771,14 @@ var Datalyr = (function (exports) {
             if (this.consent && this.consent.analytics === false) {
                 return false;
             }
+            // Shopify Customer Privacy (9.A.1 — LEGAL): on a Shopify storefront, a shopper who
+            // declined the native consent banner must not be tracked, even when the merchant
+            // never wired setConsent(). null = API absent (non-Plus store not using it, or
+            // script loaded off-Shopify) → fall through. A detected Shopify storefront
+            // fails closed while the asynchronous Customer Privacy API is unresolved.
+            if (this.shopifyAnalyticsConsent() === false) {
+                return false;
+            }
             // Check Do Not Track
             if (this.config.respectDoNotTrack && isDoNotTrackEnabled()) {
                 return false;
@@ -5665,8 +5795,185 @@ var Datalyr = (function (exports) {
          * pixels (which share data). No consent set = allowed (default).
          */
         consentAllowsMarketing() {
+            // Shopify Customer Privacy (9.A.1): a declined native banner blocks marketing use
+            // (pixel loads, click-id/email forwarding) even with no setConsent() call.
+            // null = no signal → defer to the setConsent-based policy below, unchanged.
+            if (this.shopifyMarketingConsent() === false) {
+                return false;
+            }
             return !this.consent || (this.consent.marketing !== false && this.consent.sale !== false);
         }
+        /**
+         * Shopify Customer Privacy API handle (9.A.1), or null when it doesn't apply.
+         *
+         * X-2 (LEGAL): gated on RUNTIME detection of `window.Shopify.customerPrivacy`, NOT on
+         * `config.platform === 'shopify'`. A Shopify merchant who installs via a plain <script>
+         * snippet or a headless storefront (no `platform:'shopify'`) still exposes customerPrivacy;
+         * gating on config.platform meant a shopper who DECLINED the native banner (with no
+         * setConsent() wired) was fully tracked — nullifying the consent feature for a whole install
+         * class, and unfixable server-side (platform is install-time only). Every access is wrapped —
+         * a Shopify API shape change (or a non-Shopify site) must NEVER break tracking (→ null = fail open).
+         */
+        getShopifyCustomerPrivacy() {
+            var _a, _b;
+            if (typeof window === 'undefined')
+                return null;
+            try {
+                return (_b = (_a = window.Shopify) === null || _a === void 0 ? void 0 : _a.customerPrivacy) !== null && _b !== void 0 ? _b : null;
+            }
+            catch (_c) {
+                return null;
+            }
+        }
+        isShopifyStorefront() {
+            var _a;
+            if (((_a = this.config) === null || _a === void 0 ? void 0 : _a.platform) === 'shopify')
+                return true;
+            if (typeof window === 'undefined')
+                return false;
+            try {
+                return Boolean(window.Shopify) ||
+                    window.location.hostname.toLowerCase().endsWith('.myshopify.com');
+            }
+            catch (_b) {
+                return false;
+            }
+        }
+        /**
+         * Shopify's analytics-consent signal: true/false when the Customer Privacy API is
+         * present and answers, null when there's no signal (API absent / unexpected shape)
+         * — null means "no restriction from Shopify", i.e. today's behavior.
+         */
+        shopifyAnalyticsConsent() {
+            try {
+                const cp = this.getShopifyCustomerPrivacy();
+                if (!cp)
+                    return this.isShopifyStorefront() ? false : null;
+                if (typeof cp.analyticsProcessingAllowed === 'function') {
+                    const allowed = cp.analyticsProcessingAllowed();
+                    return typeof allowed === 'boolean' ? allowed : null;
+                }
+                // Older API surface: the aggregate "can this visitor be tracked" signal.
+                if (typeof cp.userCanBeTracked === 'function') {
+                    const allowed = cp.userCanBeTracked();
+                    return typeof allowed === 'boolean' ? allowed : null;
+                }
+                return this.isShopifyStorefront() ? false : null;
+            }
+            catch (_a) {
+                return this.isShopifyStorefront() ? false : null;
+            }
+        }
+        /**
+         * Shopify's marketing-consent signal (gates pixels, click-id/email → CAPI, cart
+         * attribute stamping, auto-identify email capture). Same null semantics as
+         * shopifyAnalyticsConsent().
+         */
+        shopifyMarketingConsent() {
+            try {
+                const cp = this.getShopifyCustomerPrivacy();
+                if (!cp || typeof cp.marketingAllowed !== 'function') {
+                    return this.isShopifyStorefront() ? false : null;
+                }
+                const allowed = cp.marketingAllowed();
+                return typeof allowed === 'boolean'
+                    ? allowed
+                    : (this.isShopifyStorefront() ? false : null);
+            }
+            catch (_a) {
+                return this.isShopifyStorefront() ? false : null;
+            }
+        }
+        /**
+         * Listen for Shopify's `visitorConsentCollected` document event (9.A.1) so a
+         * consent decision made mid-session takes effect without a reload. Revocation is
+         * enforced immediately, mirroring setConsent(): queue gated + purged, pixels torn
+         * down, auto-identify (email capture + /account.json polling) destroyed. On grant
+         * the queue re-enables (track() re-checks shouldTrack() per event anyway) and cart
+         * attribute stamping runs; pixels / auto-identify resume on the next page load —
+         * the same convention as optIn().
+         */
+        setupShopifyConsentListener() {
+            // X-2: NOT gated on config.platform — a plain-snippet/headless Shopify install must also honor
+            // a mid-session consent decision. The `visitorConsentCollected` event only fires on Shopify
+            // storefronts, and the handler + loadFeatures are fully guarded, so this is a safe no-op
+            // everywhere else.
+            if (typeof document === 'undefined')
+                return;
+            try {
+                this.shopifyConsentHandler = () => {
+                    try {
+                        this.onShopifyConsentChanged();
+                    }
+                    catch (error) {
+                        this.log('Shopify consent change handling failed:', error);
+                    }
+                };
+                document.addEventListener('visitorConsentCollected', this.shopifyConsentHandler);
+                // TR-15: customerPrivacy loads ASYNCHRONOUSLY. Until it's present shopifyAnalyticsConsent()
+                // returns null (fail-open → events send in the pre-load window). Force the feature to load
+                // and re-run the full consent evaluation in the callback so a declined visitor is gated
+                // (queue disabled + purged) as soon as the API answers, without waiting for a reload or a
+                // banner interaction. Guarded — a missing/changed loadFeatures must never break tracking.
+                const shopify = window.Shopify;
+                if (shopify && typeof shopify.loadFeatures === 'function') {
+                    shopify.loadFeatures([{ name: 'consent-tracking-api', version: '0.1' }], (error) => {
+                        if (error) {
+                            this.log('Shopify loadFeatures(consent-tracking-api) failed:', error);
+                            return;
+                        }
+                        try {
+                            this.onShopifyConsentChanged();
+                        }
+                        catch (e) {
+                            this.log('Shopify post-load consent eval failed:', e);
+                        }
+                    });
+                }
+            }
+            catch (error) {
+                this.log('Shopify consent listener setup failed:', error);
+            }
+        }
+        onShopifyConsentChanged() {
+            const allowed = this.shouldTrack();
+            this.queue.setEnabled(allowed);
+            // TR-15 (P3): a mid-session grant must persist the in-memory anon id NOW — otherwise a
+            // visitor declined at init keeps a memory-only id and this session's events land under a
+            // visitor_id that vanishes on the next page load. Idempotent.
+            if (allowed)
+                this.identity.enablePersistence();
+            if (!allowed) {
+                // Mirror setConsent() withdrawal: purge buffered events so events captured
+                // before the decline can't drain if consent is later re-granted.
+                this.queue.clear();
+                this.queue.clearOffline();
+            }
+            const marketingBlocked = this.shopifyMarketingConsent() === false;
+            // Stop email capture (form interceptors + /account.json polling) immediately.
+            if ((!allowed || marketingBlocked) && this.autoIdentify) {
+                this.autoIdentify.destroy();
+                this.autoIdentify = undefined;
+            }
+            // Same caveat as setConsent(): an already-injected pixel global (fbq/gtag/ttq)
+            // keeps running in the page; full removal is on reload.
+            if (!this.consentAllowsMarketing() && this.container) {
+                this.container.cleanupAllIframes();
+                this.container = undefined;
+            }
+            // X-1: marketing withdrawn (Shopify decline) → stop stamping Stripe/CC outbound links.
+            if (!this.consentAllowsMarketing()) {
+                this.disposeMarketingLinkDecorators();
+            }
+            // Grant direction: cart-attribute stamping is cheap and idempotent (merges via
+            // /cart/update.js), so run it now instead of waiting for the next page load.
+            if (allowed && !marketingBlocked && this.config.shopifyCartAttributes === true) {
+                this.syncShopifyCartAttributes().catch((error) => {
+                    this.log('Shopify cart attribute sync failed:', error);
+                });
+            }
+            this.log('Shopify consent collected — analytics allowed:', allowed, '— marketing blocked:', marketingBlocked);
+        }
         /**
          * Setup SPA tracking
          * Fixed Issue #15: Store original methods for cleanup
@@ -5767,7 +6074,7 @@ var Datalyr = (function (exports) {
                 stack: error.stack,
                 context,
                 timestamp: new Date().toISOString(),
-                url: window.location.href
+                url: redactUrl(window.location.href) // 9.A.4: no secret query values in error logs
             };
             this.errors.push(errorInfo);
             // Keep only recent errors
@@ -5849,6 +6156,10 @@ var Datalyr = (function (exports) {
                 window.removeEventListener('visibilitychange', this.visibilityHandler);
                 this.visibilityHandler = undefined;
             }
+            if (this.shopifyConsentHandler) {
+                document.removeEventListener('visitorConsentCollected', this.shopifyConsentHandler);
+                this.shopifyConsentHandler = undefined;
+            }
             if (this.outboundDisposer) {
                 this.outboundDisposer();
                 this.outboundDisposer = undefined;
@@ -5890,8 +6201,14 @@ var Datalyr = (function (exports) {
             this.log('SDK destroyed');
         }
     }
-    // Create singleton instance
-    const datalyr = new Datalyr();
+    // Create singleton instance. TR-23: reuse an existing window.datalyr (a prior tag's instance —
+    // Shopify App Embed + a manual snippet coexisting, or a double-included bundle) instead of
+    // constructing a SECOND one. Two instances each patch history.pushState and fire their own
+    // pageviews (distinct event_ids → no server-side dedup). A plain truthy check (NOT instanceof):
+    // two <script> tags run two separate IIFEs whose Datalyr classes are structurally identical but
+    // distinct objects, so instanceof would fail across them. With one shared instance, the second
+    // tag's bootstrap init() hits the instance-level `initialized` guard and no-ops.
+    const datalyr = (typeof window !== 'undefined' && window.datalyr) || new Datalyr();
     // Expose global API
     if (typeof window !== 'undefined') {
         window.datalyr = datalyr;