@datalyr/web 1.7.5 → 1.7.8

package/dist/datalyr.esm.js

@@ -1,5 +1,5 @@
 /**
- * @datalyr/web v1.7.5
+ * @datalyr/web v1.7.8
  * Datalyr Web SDK - Modern attribution tracking for web applications
  * (c) 2026 Datalyr Inc.
  * Released under the MIT License
@@ -415,8 +415,23 @@ class SafeStorage {
                     // Get value from legacy key
                     const value = this.storage.getItem(legacyKey);
                     if (value) {
-                        // Extract the actual key name (remove '__dl_' prefix, keep 'dl_' part)
-                        const actualKey = legacyKey.slice('__dl_'.length); // e.g., '__dl_dl_anonymous_id' -> 'dl_anonymous_id'
+                        // WEB-29: strip ONLY the leading '__'.
+                        //
+                        // This used to strip '__dl_', producing 'dl_anonymous_id' — but that
+                        // is the LOGICAL key callers pass to get(), not the key it reads.
+                        // get() prepends this.prefix ('dl_'), so the value actually lives at
+                        // 'dl_dl_anonymous_id'. The migration therefore wrote to an address
+                        // nothing reads AND then deleted the legacy key below, destroying
+                        // the visitor's id instead of migrating it: a silent visitor reset
+                        // and attribution loss for anyone still on the old prefix.
+                        //
+                        //   legacy real key : __dl_dl_anonymous_id
+                        //   current real key:   dl_dl_anonymous_id   ← strip '__'
+                        //   logical key     :      dl_anonymous_id   ← what get() is called with
+                        //
+                        // NOTE: the double 'dl_dl_' looks like a typo and is not. Renaming
+                        // the prefix would orphan every stored id across the install base.
+                        const actualKey = legacyKey.slice('__'.length); // '__dl_dl_anonymous_id' -> 'dl_dl_anonymous_id'
                         // Only migrate if new key doesn't already exist (don't overwrite newer data)
                         if (!this.storage.getItem(actualKey)) {
                             this.storage.setItem(actualKey, value);
@@ -791,6 +806,125 @@ function sanitizeEventData(data, maxDepth = 5, currentDepth = 0) {
     }
     return data;
 }
+// 9.A.4: query-param NAMES whose VALUES are secrets/PII — password-reset tokens,
+// OAuth codes, magic-link sessions, emails/phones prefilled into URLs. Events ship
+// `url` / `referrer` / `landingPage` with the FULL query string (sanitizeEventData
+// only strips property KEYS, not URL param values), so /reset?token=…&email=… leaked
+// verbatim into events and onward to ad platforms. Matched case-insensitively.
+const REDACTED_URL_PARAMS = new Set([
+    'token', 'access_token', 'refresh_token', 'id_token', 'auth', 'authorization',
+    'password', 'pass', 'pwd', 'secret', 'api_key', 'apikey', 'key',
+    'session', 'session_id', 'sid', 'email', 'e', 'phone', 'tel',
+    'signature', 'sig', 'otp', 'reset', 'hash'
+]);
+// BATCH-2(e): `code` is CONDITIONAL, not in the always-redact set above. An OAuth
+// authorization code (account-takeover-grade if it leaks to ad platforms) ALWAYS travels
+// with an OAuth-flow marker in the same query/fragment — the response carries `code`+`state`
+// (+`scope`/`session_state`/`iss`), the authorize request carries `client_id`/`redirect_uri`/
+// `response_type`/`code_challenge`. A coupon/referral/product code (`?code=SUMMER20`) — a real
+// attribution signal for the DTC/Shopify ICP — never does. So we redact `code` ONLY when a
+// marker co-occurs in the same k=v string, preserving marketing codes. (A bare `code=` with no
+// marker is syntactically indistinguishable from a coupon code and is kept; state-less OAuth
+// flows are rare and CSRF-unsafe.) Markers are deliberately OAuth-specific to avoid redacting
+// legitimate codes — `prompt`/`authuser` are excluded as too generic.
+const OAUTH_CODE_CONTEXT_MARKERS = new Set([
+    'state', 'client_id', 'redirect_uri', 'response_type', 'grant_type',
+    'code_challenge', 'session_state', 'scope', 'iss',
+    // Token family: the presence of any bearer/OAuth token means a bare `code` in the same
+    // string is almost certainly an auth code, not a coupon — a marketing URL never carries
+    // these. (These values are independently redacted too; this only governs `code`.)
+    'access_token', 'id_token', 'refresh_token', 'token'
+]);
+const REDACTED_URL_VALUE = '__redacted__';
+// Redact denylisted keys in one `k=v&k=v` string (query OR fragment). Returns the
+// re-encoded string and whether anything was rewritten (so the caller can preserve the
+// exact original bytes when nothing matched).
+function redactKvPairs(s) {
+    const params = new URLSearchParams(s);
+    let mutated = false;
+    const keysLower = Array.from(new Set(params.keys())).map(k => k.toLowerCase());
+    // `code` co-occurrence check (BATCH-2e) — evaluated per-string, since an OAuth flow puts
+    // `code` and its marker in the SAME query (or the SAME fragment).
+    const hasOAuthMarker = keysLower.some(k => OAUTH_CODE_CONTEXT_MARKERS.has(k));
+    // Snapshot the keys first — set() collapses duplicate keys mid-iteration.
+    for (const key of Array.from(new Set(params.keys()))) {
+        const lower = key.toLowerCase();
+        const sensitive = lower === 'code'
+            ? hasOAuthMarker
+            : REDACTED_URL_PARAMS.has(lower);
+        if (sensitive) {
+            params.set(key, REDACTED_URL_VALUE);
+            mutated = true;
+        }
+    }
+    return { out: params.toString(), mutated };
+}
+/**
+ * Redact secret/PII param VALUES in a URL (9.A.4). The param NAME is kept
+ * (value → `__redacted__`) so funnel steps that match on the param's presence still
+ * work; every other param — click IDs (fbclid/gclid/…) and utm_* — survives untouched.
+ * Both the query string AND a k=v fragment are rewritten: TR-04 — OAuth-implicit /
+ * Supabase magic links carry the session in the FRAGMENT (`/welcome#access_token=eyJ…`),
+ * with no query string at all; the old code returned early on a missing `?` and reattached
+ * the fragment verbatim, leaking the full JWT into `url` / `landingPage` / `dl_first_touch`
+ * (90d) and onward to ad platforms. Non-k=v fragments (`#section`, `#/spa-route`) keep their
+ * shape. Returns the input unchanged when nothing sensitive matched or on any parse
+ * failure — redaction must never break tracking.
+ */
+function redactUrl(url) {
+    if (!url || typeof url !== 'string')
+        return url;
+    const hashStart = url.indexOf('#');
+    const qIdx = url.indexOf('?');
+    // A query string exists only when '?' appears BEFORE the fragment — a '?' after '#' is
+    // part of the fragment per the URL grammar (e.g. a SPA hash-route `#/reset?token=…`).
+    const queryStart = (qIdx !== -1 && (hashStart === -1 || qIdx < hashStart)) ? qIdx : -1;
+    if (queryStart === -1 && hashStart === -1)
+        return url; // nothing to redact
+    try {
+        const base = url.slice(0, queryStart !== -1 ? queryStart : (hashStart !== -1 ? hashStart : url.length));
+        const query = queryStart === -1 ? '' : url.slice(queryStart + 1, hashStart === -1 ? url.length : hashStart);
+        const rawFragment = hashStart === -1 ? '' : url.slice(hashStart + 1);
+        let mutated = false;
+        let queryOut = query;
+        if (query) {
+            const r = redactKvPairs(query);
+            if (r.mutated) {
+                queryOut = r.out;
+                mutated = true;
+            }
+        }
+        // TR-04: redact the fragment when it carries k=v pairs. Two shapes: a pure implicit-flow
+        // fragment (`#access_token=…&refresh_token=…`) and a SPA hash-route with its own query
+        // (`#/reset?access_token=…`). Leave non-k=v fragments (`#section`, `#/route`) untouched.
+        let fragmentOut = rawFragment;
+        if (rawFragment) {
+            const fragQ = rawFragment.indexOf('?');
+            if (fragQ !== -1) {
+                const r = redactKvPairs(rawFragment.slice(fragQ + 1));
+                if (r.mutated) {
+                    fragmentOut = rawFragment.slice(0, fragQ + 1) + r.out;
+                    mutated = true;
+                }
+            }
+            else if (/[\w-]+=/.test(rawFragment)) {
+                const r = redactKvPairs(rawFragment);
+                if (r.mutated) {
+                    fragmentOut = r.out;
+                    mutated = true;
+                }
+            }
+        }
+        if (!mutated)
+            return url; // nothing sensitive matched → ship the exact original bytes
+        return base
+            + (queryStart === -1 ? '' : '?' + queryOut)
+            + (hashStart === -1 ? '' : '#' + fragmentOut);
+    }
+    catch (_a) {
+        return url; // malformed URL → ship as-is rather than drop/break the event
+    }
+}
 /**
  * Deep merge objects
  */
@@ -921,16 +1055,18 @@ function getReferrerData() {
         return {};
     try {
         const url = new URL(referrer);
+        // 9.A.4: the referrer can be our own /reset?token=… or an OAuth callback —
+        // redact secret/PII param values before they're stamped onto the event.
         return {
-            referrer,
+            referrer: redactUrl(referrer),
             referrer_host: url.hostname,
             referrer_path: url.pathname,
-            referrer_search: url.search,
+            referrer_search: redactUrl(url.search),
             referrer_source: detectReferrerSource(url.hostname)
         };
     }
     catch (_a) {
-        return { referrer };
+        return { referrer: redactUrl(referrer) };
     }
 }
 /**
@@ -968,6 +1104,9 @@ class IdentityManager {
     constructor(options = {}) {
         this.userId = null;
         this.sessionId = null;
+        /** WEB-26: bumps whenever the persisted identity changes, so an in-flight
+         *  encrypted write can tell it has been superseded. */
+        this.piiGeneration = 0;
         this.persistNewId = options.persistNewId !== false;
         this.anonymousId = this.getOrCreateAnonymousId();
         this.userId = this.getStoredUserId();
@@ -991,17 +1130,13 @@ class IdentityManager {
             this.setRootDomainCookie('__dl_visitor_id', anonymousId);
             return anonymousId;
         }
-        // 2. Fresh visitor (no persisted id): accept a cross-domain bridge id from the URL,
-        //    but ONLY a well-formed anon_<uuid> — reject arbitrary / oversized values (a
-        //    multi-KB or attacker-crafted _dl_vid was previously persisted verbatim). Strip
-        //    it from the address bar so a re-shared URL can't merge the next visitor. (FSR-50)
+        // 2. Raw URL visitor IDs are never identity authority. A syntactically
+        // valid ID is still replayable/attacker-chosen and can merge two people.
+        // Strip the legacy parameter and generate a fresh local identity below.
         try {
             const urlParams = new URLSearchParams(window.location.search);
-            const urlVisitorId = urlParams.get('_dl_vid');
-            if (urlVisitorId && this.isValidAnonymousId(urlVisitorId)) {
+            if (urlParams.has('_dl_vid')) {
                 this.stripUrlParam('_dl_vid');
-                this.persistAnonymousId(urlVisitorId);
-                return urlVisitorId;
             }
         }
         catch (e) {
@@ -1025,12 +1160,17 @@ class IdentityManager {
         storage.set('dl_anonymous_id', id);
     }
     /**
-     * Whether a `_dl_vid` value is a well-formed Datalyr anonymous id (anon_ + UUID).
-     * The length is bounded by the pattern, so an oversized/garbage value is rejected.
-     * (FSR-50)
+     * TR-15 / FSR-107: tracking became allowed mid-session (optIn / consent grant). Start
+     * persisting AND flush the current in-memory anon id to the cookie + localStorage now.
+     * Without this, a visitor declined at init keeps a memory-only id, so that session's
+     * events land under a visitor_id that vanishes on the next page load (attribution
+     * fragmentation). Idempotent — a no-op once already persisting.
      */
-    isValidAnonymousId(id) {
-        return /^anon_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id);
+    enablePersistence() {
+        if (this.persistNewId)
+            return;
+        this.persistNewId = true;
+        this.persistAnonymousId(this.anonymousId);
     }
     /**
      * Remove a query param from the current URL via history.replaceState (best-effort).
@@ -1093,6 +1233,126 @@ class IdentityManager {
         // corrupted by JSON.parse — both would fragment identity from the second page on.
         return storage.getString('dl_user_id');
     }
+    /**
+     * WEB-22 — is this user id personally identifying, and therefore not
+     * something we may write to localStorage in the clear?
+     *
+     * The auto-identify path calls `identify(email, { email })`, so the raw
+     * address became the `user_id` and was written unencrypted to `dl_user_id`.
+     * Measured 2026-07-25: on the four workspaces using auto-identify, **every**
+     * event carrying a `user_id` had an email in that column (20,502 / 20,502 on
+     * `f6260736` over 7 days) — while the surrounding code went to real lengths to
+     * encrypt the *same* address in `dl_auto_identified_email`.
+     *
+     * Deliberately narrow: an email is the case that actually occurs and the one
+     * the SDK itself creates. Opaque application ids — the overwhelming majority —
+     * keep the existing fast, synchronous, plaintext path with no behaviour change.
+     */
+    static looksLikePII(userId) {
+        return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(userId);
+    }
+    /**
+     * Persist the user id, encrypting it when it is PII.
+     *
+     * Three-way, and the ordering matters:
+     *  - not PII        → plaintext `dl_user_id`, exactly as before (sync, always works)
+     *  - PII + crypto   → encrypted `dl_user_id_pii`, and the plaintext key is REMOVED
+     *  - PII, no crypto → memory only, and both keys removed
+     *
+     * That last branch is the deliberate trade. `crypto.subtle` is absent on
+     * http:// and old browsers, and index.ts is explicit that encryption is for
+     * PII-at-rest only and "must NOT gate event delivery". So we never block an
+     * event — `this.userId` is set in memory first and every event still carries
+     * it — we only decline to *persist* an address we cannot protect. The cost is
+     * that a returning visitor on an insecure origin is re-identified by the next
+     * `identify()` call rather than restored from storage; the alternative is
+     * writing their email to disk in the clear, which is what this fixes.
+     */
+    persistUserId(userId) {
+        if (!IdentityManager.looksLikePII(userId)) {
+            storage.set('dl_user_id', userId);
+            // WEB-26: a previous PII user's encrypted id must not linger once an
+            // opaque id takes over. Reachable when identify('opaque') runs before
+            // hydrateEncryptedUserId() has populated this.userId, so index.ts sees no
+            // current user and skips its account-switch reset().
+            this.piiGeneration += 1;
+            storage.remove('dl_user_id_pii');
+            return;
+        }
+        // Never leave a plaintext copy behind — including one written by a previous
+        // SDK version before this fix existed.
+        storage.remove('dl_user_id');
+        // WEB-26: the encrypted write is async, and reset()/optOut()/consent
+        // withdrawal are not. Without a generation guard this sequence resurrects a
+        // logged-out user's email: identify(email) → write pending →
+        // remove('dl_user_id_pii') deletes NOTHING because the write has not landed
+        // → the write lands → next page load hydrates the previous user's address
+        // and every event ships user_id = their email. Stamp the write and discard
+        // it if the identity moved on while it was in flight.
+        const generation = ++this.piiGeneration;
+        storage.setEncrypted('dl_user_id_pii', userId)
+            .then(() => {
+            if (generation !== this.piiGeneration)
+                storage.remove('dl_user_id_pii');
+        })
+            .catch(() => {
+            // No crypto.subtle (http://, legacy browser) or a storage failure. Drop
+            // the at-rest copy rather than falling back to plaintext PII — but only
+            // if this write is still the current one, or we would delete a newer
+            // user's successfully-written value.
+            if (generation === this.piiGeneration)
+                storage.remove('dl_user_id_pii');
+        });
+    }
+    /**
+     * Restore a PII user id that was persisted encrypted. Async by necessity, so
+     * it cannot run in the constructor; index.ts calls it during init, right after
+     * `dataEncryption.initialize()`.
+     *
+     * Never overwrites an id already established this page load — an explicit
+     * `identify()` that has already run is fresher than anything on disk.
+     */
+    hydrateEncryptedUserId() {
+        return __awaiter(this, void 0, void 0, function* () {
+            // WEB-26 (a) — migrate a plaintext address written by <= 1.7.7.
+            //
+            // persistUserId() only removes `dl_user_id` when identify() runs again, and
+            // for the exact population this fix targets it never does:
+            // AutoIdentifyManager.initialize() returns early while
+            // `dl_auto_identified_email` exists (auto-identify.ts:88), so the callback
+            // never fires. Without this the raw email would sit in localStorage forever
+            // on every already-auto-identified browser.
+            const legacy = storage.getString('dl_user_id');
+            if (legacy && IdentityManager.looksLikePII(legacy)) {
+                if (!this.userId)
+                    this.userId = legacy;
+                this.persistUserId(legacy);
+                return;
+            }
+            // WEB-26 (b) — recover a write that was dropped because encryption was not
+            // keyed yet. index.ts sets `initialized = true` before initializeAsync()
+            // finishes, so the documented `init(); identify(email)` pattern can reach
+            // persistUserId() before dataEncryption has a key; that write rejects and
+            // nothing is persisted. By here the key exists, so retry once.
+            if (this.userId && IdentityManager.looksLikePII(this.userId)) {
+                const alreadyStored = yield storage.getEncrypted('dl_user_id_pii', null);
+                if (!alreadyStored)
+                    this.persistUserId(this.userId);
+                return;
+            }
+            if (this.userId)
+                return;
+            try {
+                const stored = yield storage.getEncrypted('dl_user_id_pii', null);
+                if (typeof stored === 'string' && stored && !this.userId) {
+                    this.userId = stored;
+                }
+            }
+            catch (_a) {
+                // Undecryptable (rotated key, corrupt blob) — stay anonymous.
+            }
+        });
+    }
     /**
      * Get the anonymous ID
      */
@@ -1141,8 +1401,9 @@ class IdentityManager {
         }
         const previousUserId = this.userId;
         this.userId = userId;
-        // Persist for future sessions
-        storage.set('dl_user_id', userId);
+        // Persist for future sessions. WEB-22: encrypted when the id is PII (the
+        // auto-identify path makes it the raw email); plaintext otherwise.
+        this.persistUserId(userId);
         // Return identity link data (will be sent as $identify event)
         return {
             anonymous_id: this.anonymousId,
@@ -1165,7 +1426,7 @@ class IdentityManager {
         // Update current user ID if aliasing to current anonymous ID
         if (!previousId || previousId === this.anonymousId) {
             this.userId = userId;
-            storage.set('dl_user_id', userId);
+            this.persistUserId(userId);
         }
         return aliasData;
     }
@@ -1175,7 +1436,12 @@ class IdentityManager {
      */
     reset() {
         this.userId = null;
+        // WEB-26: invalidate any encrypted write still in flight.
+        this.piiGeneration += 1;
         storage.remove('dl_user_id');
+        // WEB-22: the encrypted PII copy must go too, or a logout would leave the
+        // previous user's email at rest.
+        storage.remove('dl_user_id_pii');
         storage.remove('dl_user_traits');
         // Generate new anonymous ID for privacy
         this.anonymousId = `anon_${generateUUID()}`;
@@ -1502,6 +1768,12 @@ class AttributionManager {
             'gbraid', // Google Ads (iOS)
             'wbraid', // Google Ads (web)
             'ttclid', // TikTok
+            // WEB-28: OpenAI Ads. Captured by iOS and React Native since launch but
+            // never by the web SDK, so every OpenAI Ads *web* conversion delivered with
+            // attribution_type: none unless the customer passed the value by hand.
+            // Placed after the Google block to match the mobile SDKs' ordering — the
+            // first click id present wins, and this must not outrank fbclid/gclid.
+            'oppref', // OpenAI Ads
             'msclkid', // Microsoft/Bing
             'twclid', // Twitter/X
             'li_fat_id', // LinkedIn
@@ -1521,6 +1793,10 @@ class AttributionManager {
         this.CLICK_ID_ALIASES = {
             ScCid: 'sclid',
             sccid: 'sclid',
+            // Impact's real landing param is `irclickid`; capture it and normalize to the canonical
+            // `irclid` that ingest / the MV / the source map (`irclid→impact`) all key on. Without
+            // this, real Impact affiliate clicks were dark on web (only bare `irclid` was captured).
+            irclickid: 'irclid',
         };
         // Default tracked params matching dl.js
         this.DEFAULT_TRACKED_PARAMS = [
@@ -1531,9 +1807,18 @@ class AttributionManager {
             'medium', // Generic medium (non-UTM)
             'gad_source' // Google Ads source parameter
         ];
+        // TR-03: ad-cookie fields (Meta/Google Ads/TikTok/Snap) that are MARKETING-scoped. When
+        // marketing consent is declined these are neither synthesized/written nor shipped. Google
+        // Analytics cookies (_ga/_gid) and utm_* stay — they're analytics-scoped.
+        this.MARKETING_COOKIES = ['_fbp', '_fbc', '_gcl_aw', '_gcl_dc', '_gcl_gb', '_gcl_ha', '_gac', '_ttp', '_ttc', '_scid'];
         this.attributionWindow = options.attributionWindow || 90 * 24 * 60 * 60 * 1000; // 90 days (increased from 30 for B2B sales cycles)
         // Merge default tracked params with user-provided ones
         this.trackedParams = [...this.DEFAULT_TRACKED_PARAMS, ...(options.trackedParams || [])];
+        this.marketingAllowedFn = options.marketingAllowed;
+    }
+    // TR-03: default (no predicate / no signal) = allowed → byte-identical to prior behavior.
+    isMarketingAllowed() {
+        return this.marketingAllowedFn ? this.marketingAllowedFn() !== false : true;
     }
     /**
      * Clear query params cache (called on page navigation)
@@ -1604,13 +1889,15 @@ class AttributionManager {
                 attribution[param] = value;
             }
         }
-        // Capture referrer
+        // Capture referrer. 9.A.4: redact secret/PII query-param values (reset tokens,
+        // OAuth codes, emails) — this attribution object is stamped onto every event AND
+        // persisted into dl_first_touch/dl_last_touch, so it must be clean at capture.
         if (document.referrer) {
-            attribution.referrer = document.referrer;
+            attribution.referrer = redactUrl(document.referrer);
             attribution.referrerHost = this.extractHostname(document.referrer);
         }
-        // Capture landing page
-        attribution.landingPage = window.location.href;
+        // Capture landing page (redacted — see referrer note above)
+        attribution.landingPage = redactUrl(window.location.href);
         attribution.landingPath = window.location.pathname;
         // Determine source if not explicitly set
         if (!attribution.source) {
@@ -1706,6 +1993,10 @@ class AttributionManager {
     captureAdCookies() {
         var _a, _b;
         const adCookies = {};
+        // TR-03: when marketing consent is declined, do NOT synthesize/write the Meta/Google ad
+        // cookies below (writing _fbp/_fbc is active marketing use). Existing cookies are still
+        // read here but stripped from the event payload in getAttributionData().
+        const marketingAllowed = this.isMarketingAllowed();
         // Facebook/Meta cookies
         adCookies._fbp = cookies.get('_fbp');
         adCookies._fbc = cookies.get('_fbc');
@@ -1724,8 +2015,8 @@ class AttributionManager {
         // Snapchat first-party cookie (Snap Pixel sets _scid). Flows to the server as
         // cookies._scid and is sent on the Snap CAPI event as sc_cookie1 (raw).
         adCookies._scid = cookies.get('_scid');
-        // Generate _fbp if missing (Facebook browser ID)
-        if (!adCookies._fbp && (this.hasClickId('fbclid') || adCookies._fbc)) {
+        // Generate _fbp if missing (Facebook browser ID). TR-03: only when marketing is allowed.
+        if (marketingAllowed && !adCookies._fbp && (this.hasClickId('fbclid') || adCookies._fbc)) {
             const timestamp = Date.now();
             // Meta's _fbp format is fb.1.<creationTimeMs>.<randomNumber> where the last
             // segment MUST be a decimal integer. The old base36 string was non-conformant —
@@ -1749,7 +2040,8 @@ class AttributionManager {
         // Shopify cart / server-side rebuild forward it as a time, so its format must not
         // change.
         const fbclid = this.getCurrentFbclid();
-        if (fbclid) {
+        // TR-03: skip _fbc synthesis/refresh (cookie write) when marketing is declined.
+        if (marketingAllowed && fbclid) {
             const existingFbc = adCookies._fbc; // captured above (cookies.get('_fbc'))
             const embeddedFbclid = this.extractFbclidFromFbc(existingFbc);
             if (!existingFbc) {
@@ -1779,7 +2071,7 @@ class AttributionManager {
         // (gclid has no synthesized-and-going-stale artifact like _fbc, and Google does not
         // validate a creationTime window the way Meta does, so this stays once-only.)
         const gclid = this.hasClickId('gclid') ? ((_b = (_a = this.queryParamsCache) === null || _a === void 0 ? void 0 : _a.gclid) !== null && _b !== void 0 ? _b : null) : null;
-        if (gclid && !cookies.get('_dl_gclid_at')) {
+        if (marketingAllowed && gclid && !cookies.get('_dl_gclid_at')) {
             cookies.set('_dl_gclid_at', String(Date.now()), 90);
         }
         // Filter out null values for cleaner data
@@ -1830,8 +2122,21 @@ class AttributionManager {
         // The old `hasCurrentAttribution` (truthy because source is always at least 'direct')
         // made the fallback below dead code AND caused storeLastTouch to overwrite a real
         // paid last-touch with 'direct'/'none' on the next internal navigation. (WEB NEW-1)
+        // `lyr` counts as a real signal. It is the Datalyr tracking-link tag — the one
+        // attribution parameter the product itself tells customers to put on a URL — and
+        // omitting it meant a bare `?lyr=X` landing (no UTMs, no click id) scored FALSE:
+        // the fallback below then replaced `current` wholesale with the stored touch,
+        // discarding the tag that had just been parsed, and neither store* call ran, so it
+        // never persisted either. Measured 2026-07-25 on the one workspace whose links are
+        // bare: 96 landing URLs carried `lyr=`, 93 events kept it — 3 lost (3.1%), all of
+        // them returning visitors (a first-time visitor has no stored touch to be replaced
+        // by, which is the only reason the number is 3 and not 96). The edge worker's own
+        // `buildDestination` emits exactly this URL shape when a link defines no UTMs.
+        // iOS (AttributionManager.swift) and React Native persist `lyr` unconditionally;
+        // this brings web into line.
         const hasRealAttribution = !!(current.clickId ||
             current.campaign ||
+            current.lyr ||
             (current.source && current.source !== 'direct'));
         // Direct / internal navigation: fall back to persisted attribution so the event
         // isn't mis-attributed to 'direct'. FSR-48: prefer the LAST touch (the most recent
@@ -1857,7 +2162,7 @@ class AttributionManager {
         if (hasRealAttribution) {
             this.storeLastTouch(current);
         }
-        return Object.assign(Object.assign(Object.assign({}, current), adCookies), { 
+        const result = Object.assign(Object.assign(Object.assign({}, current), adCookies), { 
             // First touch (with snake_case aliases)
             first_touch_source: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.source, first_touch_medium: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.medium, first_touch_campaign: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.campaign, first_touch_timestamp: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.timestamp, firstTouchSource: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.source, firstTouchMedium: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.medium, firstTouchCampaign: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.campaign, 
             // Last touch (with snake_case aliases)
@@ -1868,6 +2173,21 @@ class AttributionManager {
                 : 0, daysSinceFirstTouch: (firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.timestamp)
                 ? Math.floor((Date.now() - firstTouch.timestamp) / 86400000)
                 : 0 });
+        // TR-03: strip MARKETING-scoped signals (click IDs + ad cookies) from the event payload
+        // when marketing consent is declined — analytics-scoped fields (utm_*, source/medium/
+        // campaign, first/last touch, _ga/_gid) stay. Live predicate → a later grant restores
+        // them on the next event. Synthesis of _fbp/_fbc was already skipped in captureAdCookies.
+        if (!this.isMarketingAllowed()) {
+            const marketingKeys = [
+                ...this.CLICK_IDS,
+                ...Object.values(this.CLICK_ID_ALIASES),
+                'clickId', 'clickIdType',
+                ...this.MARKETING_COOKIES,
+            ];
+            for (const k of marketingKeys)
+                delete result[k];
+        }
+        return result;
     }
     /**
      * Determine source from attribution data
@@ -1878,13 +2198,19 @@ class AttributionManager {
             const clickIdSources = {
                 fbclid: 'facebook',
                 gclid: 'google',
+                gbraid: 'google', // 9.A.6: Google Ads (iOS) — was falling through to 'paid'
+                wbraid: 'google', // 9.A.6: Google Ads (web)
                 ttclid: 'tiktok',
                 msclkid: 'bing',
                 twclid: 'twitter',
                 li_fat_id: 'linkedin',
                 sclid: 'snapchat',
                 dclid: 'doubleclick',
-                epik: 'pinterest'
+                epik: 'pinterest',
+                rdt_cid: 'reddit', // 9.A.6
+                obclid: 'outbrain', // 9.A.6
+                irclid: 'impact', // 9.A.6: Impact Radius
+                ko_click_id: 'klaviyo' // 9.A.6
             };
             return clickIdSources[attribution.clickIdType] || 'paid';
         }
@@ -2010,15 +2336,20 @@ class AttributionManager {
 const DEFAULT_CRITICAL_EVENTS = ['purchase', 'signup', 'subscribe', 'lead', 'conversion'];
 // Default high priority events that use faster batching
 const DEFAULT_HIGH_PRIORITY_EVENTS = ['add_to_cart', 'begin_checkout', 'view_item', 'search'];
-// A 429 is a deliberate backpressure signal, not a transient failure — tagged so the
-// send path can route it to the offline queue WITHOUT retrying (which would storm the
-// already-overloaded server). See sendBatch / the rateLimitedUntil gate.
+// WEB-23: how long to stop sending after a 403 (origin not allowed). Long enough not to
+// hammer a rejecting origin, short enough that a server-side config fix is picked up
+// within the same visit. A 403 carries no Retry-After, so this is fixed.
+const ORIGIN_REJECTED_BACKOFF_MS = 5 * 60 * 1000;
+// Backpressure, not failure — routed to the offline queue WITHOUT retrying (which would
+// storm an already-overloaded server) and gated behind rateLimitedUntil. Raised for a 429
+// and, since WEB-23, for a 403: both mean "not now", not "never". See sendBatch.
 class RateLimitError extends Error {
 }
-// A permanent (non-retryable) failure — a 4xx other than 408/429 (invalid event shape,
-// origin not allowed, auth). Retrying or parking it just head-of-line-blocks the offline
-// queue forever and hammers ingest. Tagged so the send paths DROP the batch instead of
-// unshifting it back to the head. (FSR-55)
+// A permanent (non-retryable) failure — a 4xx other than 403/408/429, i.e. an invalid
+// event shape (400) or bad auth (401). Retrying or parking it just head-of-line-blocks
+// the offline queue forever and hammers ingest. Tagged so the send paths DROP the batch
+// instead of unshifting it back to the head. (FSR-55, narrowed by WEB-23 — a 403 is
+// server *configuration* state and does change, so it is no longer in this class.)
 class PermanentError extends Error {
     constructor(status, message) {
         super(message || `HTTP ${status}`);
@@ -2041,6 +2372,11 @@ class EventQueue {
         this.inFlight = []; // FIXED (WEB-3): batch currently in _flight's keepalive fetch — forceFlush must NOT re-beacon it
         this.enabled = true; // FIXED (consent): when false (opt-out / withdrawn analytics consent) all enqueue/flush/drain is a no-op
         this.rateLimitedUntil = 0; // FIXED (429): skip flush/drain until the server's Retry-After window passes
+        // WEB-23: permanent drops used to be invisible — a debug-gated log line and
+        // nothing else, so 11 days of 403s looked identical to a healthy queue. Counted
+        // here and exposed via getStats() so a drop is at least observable.
+        this.droppedEventCount = 0;
+        this.lastDropStatus = null;
         // Coerce numeric config to sane values. The old `config.X || default` both turned a
         // legitimate 0 into the default AND let invalid values through — a NEGATIVE batchSize
         // made processOfflineQueue's `splice(0, -1)` loop forever and FREEZE the host tab.
@@ -2266,7 +2602,12 @@ class EventQueue {
                 // FSR-55: don't park a permanently-rejected batch — it would never succeed and
                 // would block the offline drain. Drop it.
                 if (error instanceof PermanentError) {
-                    this.log(`Dropping ${events.length} events — permanent error ${error.status}`);
+                    this.droppedEventCount += events.length;
+                    this.lastDropStatus = error.status;
+                    // console.warn, not this.log: a silent drop is the failure mode that let the
+                    // 2026-07-13 outage run for 11 days. This must be visible without debug mode.
+                    console.warn(`[Datalyr Queue] Dropped ${events.length} events — permanent error ${error.status}. ` +
+                        `${this.droppedEventCount} dropped this session.`);
                 }
                 else {
                     this.moveToOfflineQueue(events);
@@ -2328,9 +2669,24 @@ class EventQueue {
                         this.log(`Rate limited; backing off ${retryAfter}s`);
                         throw new RateLimitError('Rate limited (429)');
                     }
-                    // FSR-55: a 4xx other than 408 (timeout) is PERMANENT — invalid event shape
-                    // (400), origin not allowed (403), auth (401). Retrying / parking it just blocks
-                    // the queue and hammers ingest forever. Tag it so the caller drops the batch.
+                    // WEB-23: a 403 is NOT permanent — it is server *configuration* state, and it
+                    // changes. On 2026-07-13 an allowed_origins regression made ingest reject three
+                    // workspaces with 403; the config was fixed 11 days later, but every event sent
+                    // in between had already been dropped on the floor by the FSR-55 rule below.
+                    // Eleven days of data, unrecoverable, with only a debug log to show for it.
+                    //
+                    // Treated like 429 instead: park the events offline behind a backoff window, so
+                    // we neither hammer a rejecting origin (FSR-55's real concern) nor discard data
+                    // that would have been accepted an hour later. The window is fixed because a 403
+                    // carries no Retry-After.
+                    if (response.status === 403) {
+                        this.rateLimitedUntil = Date.now() + ORIGIN_REJECTED_BACKOFF_MS;
+                        this.log(`Origin rejected (403); backing off ${ORIGIN_REJECTED_BACKOFF_MS / 1000}s and parking events`);
+                        throw new RateLimitError('Origin rejected (403)');
+                    }
+                    // FSR-55: a 4xx other than 403/408 (timeout) is PERMANENT — invalid event shape
+                    // (400) or auth (401). Retrying / parking it just blocks the queue and hammers
+                    // ingest forever. Tag it so the caller drops the batch.
                     if (response.status >= 400 && response.status < 500 && response.status !== 408) {
                         throw new PermanentError(response.status, `HTTP ${response.status}: ${response.statusText}`);
                     }
@@ -2417,9 +2773,25 @@ class EventQueue {
         // purge. Gating here (a persistence sink, not just the send sinks) closes it.
         if (!this.enabled)
             return;
-        // FIXED (DATA-03): Check if offline queue operation already in progress
+        // WEB-24. This early return used to `return` outright — losing the batch, because
+        // _flush() has ALREADY spliced these events out of the live queue before calling
+        // here, so they would exist in neither queue.
+        //
+        // Verified 2026-07-25 that the loss is NOT currently reachable: this method is the
+        // only user of offlineQueueLock, its critical section is fully synchronous (push,
+        // splice, then a synchronous saveOfflineQueue → storage.set), and JS is
+        // single-threaded — so the flag can never be observed set on entry. The path is
+        // dead code today, and the review's "drops the batch on lock contention" is REFUTED
+        // as a live loss path.
+        //
+        // It is kept and made safe anyway, because it is one `await` away from being live:
+        // the moment saveOfflineQueue becomes async (IndexedDB, encrypted-at-rest storage,
+        // anything), contention becomes real and silent data loss returns instantly.
+        // Enqueue first, then bail — the events are never dropped either way.
         if (this.offlineQueueLock) {
-            console.warn('[Datalyr Queue] Offline queue operation already in progress');
+            console.warn('[Datalyr Queue] Offline queue busy; buffering events without persisting');
+            if (events)
+                this.offlineQueue.push(...events);
             return;
         }
         // Acquire lock
@@ -2438,6 +2810,10 @@ class EventQueue {
             if (this.offlineQueue.length > this.config.maxOfflineQueueSize) {
                 const excess = this.offlineQueue.length - this.config.maxOfflineQueueSize;
                 this.offlineQueue.splice(0, excess); // Remove oldest events
+                // WEB-27: overflow is data loss too, and a sustained 403/park loop is
+                // exactly what produces it. Count it rather than trimming silently.
+                this.droppedEventCount += excess;
+                console.warn(`[Datalyr Queue] Offline queue full — dropped ${excess} oldest event(s).`);
             }
             this.saveOfflineQueue();
         }
@@ -2510,6 +2886,16 @@ class EventQueue {
             // two of them could splice the same offlineQueue concurrently and double-send.
             if (!this.enabled)
                 return;
+            // TR-15: re-check consent at DRAIN time. A returning DECLINED visitor whose consent
+            // signal loads asynchronously (Shopify customerPrivacy) fires no visitorConsentCollected
+            // event, so `enabled` stayed at its fail-open init value. If consent now says no, latch
+            // off and PURGE the persisted backlog instead of draining it (a later grant re-enables
+            // via setEnabled). Mirrors the withdrawal purge in optOut()/setConsent().
+            if (this.consentCheck && this.consentCheck() === false) {
+                this.enabled = false;
+                this.clearOffline();
+                return;
+            }
             if (Date.now() < this.rateLimitedUntil)
                 return; // FIXED (429): honor Retry-After window
             if (this.offlineProcessing)
@@ -2536,7 +2922,15 @@ class EventQueue {
                         // that would block every event behind it forever and hammer ingest every tick.
                         // Drop it (already spliced off the front) and keep draining the rest.
                         if (error instanceof PermanentError) {
-                            this.log(`Dropping poison offline batch (${batch.length}) — permanent error ${error.status}`);
+                            // WEB-27: count and surface these too. WEB-23's whole effect is to
+                            // PARK more batches offline, so the drain — not the live flush — is
+                            // where drops now predominantly happen. Counting only _flush left the
+                            // dominant loss path invisible, which is the exact failure mode the
+                            // counter was added to end.
+                            this.droppedEventCount += batch.length;
+                            this.lastDropStatus = error.status;
+                            console.warn(`[Datalyr Queue] Dropped ${batch.length} offline events — permanent error ${error.status}. ` +
+                                `${this.droppedEventCount} dropped this session.`);
                             this.saveOfflineQueue();
                             continue;
                         }
@@ -2569,6 +2963,23 @@ class EventQueue {
     getOfflineQueueSize() {
         return this.offlineQueue.length;
     }
+    /**
+     * WEB-23: queue health, including events the SDK gave up on.
+     *
+     * `droppedEvents` is the number this session discarded as permanently rejected
+     * (a 400/401). It exists because a silent drop is precisely the failure mode
+     * that let the 2026-07-13 `allowed_origins` outage run for eleven days looking
+     * exactly like a healthy queue. A non-zero value here means data was lost.
+     */
+    getStats() {
+        return {
+            queued: this.queue.length,
+            offline: this.offlineQueue.length,
+            droppedEvents: this.droppedEventCount,
+            lastDropStatus: this.lastDropStatus,
+            backoffUntil: this.rateLimitedUntil,
+        };
+    }
     /**
      * Get network status
      */
@@ -2601,10 +3012,13 @@ class EventQueue {
      *  - Non-terminal (tab switch): deliver the LIVE queue via a response-checked keepalive
      *    fetch (flush) and response-check-drain the offline backlog (processOfflineQueue) —
      *    neither erases the backlog on failure. The destructive beacon path is not used.
-     *  - Terminal (unload): beacon live+offline best-effort, but PERSIST everything first
-     *    and NEVER storage.remove() on a mere beacon enqueue. The next page load's
-     *    response-checked drain (normal fetch, no 64KB cap) is the source of truth and
-     *    clears the copy; server event_id dedup makes the potential double-send safe.
+     *  - Terminal (unload): PERSIST everything first (live + the already-persisted offline
+     *    backlog) and NEVER storage.remove() on a mere beacon enqueue. Beacon ONLY the LIVE
+     *    queue best-effort — NOT the offline backlog (TR-13): the backlog is already durable and
+     *    the next-load drain delivers it exactly once, so beaconing it here too risked a
+     *    delivered-now-AND-re-drained-next-load double-send that, when >6h apart, outlives
+     *    ingest's dedup window → a duplicate purchase. The next page load's response-checked
+     *    drain (normal fetch, no 64KB cap) is the source of truth and clears the copy.
      *  - Both paths honor rateLimitedUntil (don't beacon/flush into the backoff window).
      *
      * Still excludes the in-flight _flush batch (its keepalive fetch already carries it,
@@ -2646,6 +3060,14 @@ class EventQueue {
                 }
                 storage.set(this.OFFLINE_QUEUE_KEY, toPersist);
             }
+            // TR-13: beacon ONLY the LIVE queue (never-persisted events from THIS session). The
+            // offline backlog is already durable and the next-load drain delivers it once, so
+            // beaconing it here would double-send it — and a stale backlog event (e.g. a purchase
+            // parked during an outage) re-drained on a later day lands >6h from the beacon, past
+            // ingest's dedup window. The live queue's beacon + its own next-load drain both land THIS
+            // session (<6h), so dedup absorbs that pair.
+            if (live.length === 0)
+                return; // only the persisted backlog remained → it drains next load
             // Within the 429 window, don't beacon into it — the persisted copy drains next load.
             if (Date.now() < this.rateLimitedUntil)
                 return;
@@ -2656,7 +3078,7 @@ class EventQueue {
             const chunks = [];
             let current = [];
             let currentBytes = 2; // approx for the JSON array/object wrapper
-            for (const ev of pending) {
+            for (const ev of live) {
                 // Byte length (not UTF-16 .length) so multibyte product names / emoji can't
                 // under-count and overflow the cap.
                 const evBytes = new Blob([JSON.stringify(ev)]).size + 1;
@@ -2682,7 +3104,7 @@ class EventQueue {
                     break;
                 beaconed += chunk.length;
             }
-            this.log(`forceFlush(terminal): beaconed ${beaconed}/${pending.length} events; persisted copy retained for next-load drain`);
+            this.log(`forceFlush(terminal): beaconed ${beaconed}/${live.length} live events; backlog (${pending.length - live.length}) persisted for next-load drain`);
         });
     }
     /**
@@ -2703,6 +3125,15 @@ class EventQueue {
     setEnabled(enabled) {
         this.enabled = enabled;
     }
+    /**
+     * TR-15: register a live consent predicate the offline drain re-evaluates at drain time.
+     * `enabled` is latched at init to a fail-open value (Shopify's customerPrivacy loads
+     * async), and a returning DECLINED visitor fires no visitorConsentCollected event — so
+     * without this, their persisted backlog would drain before the decline is known.
+     */
+    setConsentCheck(fn) {
+        this.consentCheck = fn;
+    }
     /**
      * Clear the offline queue and its persisted copy (used by opt-out to purge any
      * PII-bearing events that were parked before the user opted out).
@@ -4177,6 +4608,256 @@ class AutoIdentifyManager {
 // someone else (and feeds that person's email to Meta advanced matching).
 AutoIdentifyManager.THIRD_PARTY_EMAIL_FIELD = /(recipient|friend|gift|refer|invite|colleague|coworker|share|to[-_]?email|email[-_]?to|second(ary)?[-_]?email)/i;
 
+/**
+ * Stripe Checkout Session capture.
+ *
+ * WHY THIS EXISTS
+ * syncStripePaymentLinks stamps `client_reference_id` onto buy.stripe.com
+ * anchors, and deliberately never onto checkout.stripe.com — a Checkout Session
+ * URL ignores the param because the session already exists server-side. That
+ * leaves the single most common SaaS pattern uncovered: the merchant's backend
+ * creates a Session and the browser is sent to checkout.stripe.com/c/pay/cs_...
+ * The payment then reaches our webhook with no visitor at all.
+ *
+ * Measured 2026-07-25, 30d: of payers arriving via Stripe webhooks, 0.5% (one
+ * tenant, 128/28,187) and 13.3% (another, 13/98) had ANY web pageview on the
+ * same visitor. Not a misconfiguration — no tenant is wired, because being
+ * wired currently requires the merchant to hand-write client_reference_id.
+ *
+ * WHAT THIS DOES
+ * The session id must reach the browser for the redirect to happen at all, so
+ * we observe it rather than trying to inject anything:
+ *   1. fetch/XHR response bodies      — `{url}` or `{sessionId}` from the
+ *                                       merchant's own create-session endpoint
+ *   2. anchor clicks + window.open    — direct links to checkout.stripe.com
+ * A server-side 302 straight to Stripe never exposes the id to JS and is NOT
+ * covered here; that case falls back to the email bridge.
+ *
+ * WHY THIS IS SAFE TO DEFAULT ON, WHEN autoIdentifyAPI IS NOT
+ * autoIdentifyAPI scans the same traffic for EMAILS, which is why it defaults
+ * off: an admin viewing a customer record gets identified as that customer, and
+ * a wrong email propagates into Meta advanced matching. A `cs_live_...` token is
+ * unambiguous, belongs to exactly one checkout, and is not PII. There is no
+ * mis-identification failure mode to guard against — only the wrapper itself,
+ * which is why every hook below is transparent and failure-isolated.
+ */
+/** Stripe Checkout Session ids: cs_live_… / cs_test_… */
+const SESSION_ID_RE = /cs_(?:live|test)_[A-Za-z0-9]{8,}/;
+/** Hosts whose URLs carry a session id in the path. Exact match, never substring. */
+const CHECKOUT_HOSTS = new Set(['checkout.stripe.com']);
+/**
+ * Response bodies are scanned in full, so cap what we're willing to read. A
+ * create-session response is a few hundred bytes; anything large is not it, and
+ * reading it would cost the merchant's page real memory and main-thread time.
+ */
+const MAX_SCAN_BYTES = 65536;
+/** Bodies worth scanning. Stripe ids arrive as JSON or text, never as binary. */
+const SCANNABLE_TYPE_RE = /(json|text|javascript)/i;
+function extractSessionId(text) {
+    if (!text)
+        return null;
+    const m = SESSION_ID_RE.exec(text);
+    return m ? m[0] : null;
+}
+/**
+ * True when `href` points at a Stripe-hosted checkout. Uses the URL API and
+ * exact host equality — `a[href*="checkout.stripe.com"]` would match
+ * `evil.com/checkout.stripe.com/x` and `checkout.stripe.com.evil.com`.
+ */
+function isCheckoutUrl(href, base) {
+    try {
+        const host = new URL(href, base !== null && base !== void 0 ? base : (typeof window !== 'undefined' ? window.location.href : undefined)).hostname.toLowerCase();
+        return CHECKOUT_HOSTS.has(host);
+    }
+    catch (_a) {
+        return false;
+    }
+}
+class StripeSessionWatcher {
+    constructor(options = {}) {
+        var _a, _b;
+        this.seen = new Set();
+        this.disposers = [];
+        this.started = false;
+        this.maxSessions = (_a = options.maxSessions) !== null && _a !== void 0 ? _a : 5;
+        this.maxScanBytes = (_b = options.maxScanBytes) !== null && _b !== void 0 ? _b : MAX_SCAN_BYTES;
+    }
+    start(sink) {
+        if (this.started || typeof window === 'undefined')
+            return;
+        this.started = true;
+        this.sink = sink;
+        this.hookFetch();
+        this.hookXhr();
+        this.hookClicks();
+        this.hookWindowOpen();
+    }
+    stop() {
+        // Restore in reverse so a later wrapper never re-installs an earlier one.
+        for (const dispose of this.disposers.reverse()) {
+            try {
+                dispose();
+            }
+            catch (_a) {
+                /* idempotent */
+            }
+        }
+        this.disposers = [];
+        this.started = false;
+        this.sink = undefined;
+    }
+    /** Report a session id at most once, and never more than maxSessions per page. */
+    emit(sessionId) {
+        var _a;
+        if (!sessionId || this.seen.has(sessionId))
+            return;
+        if (this.seen.size >= this.maxSessions)
+            return;
+        this.seen.add(sessionId);
+        try {
+            (_a = this.sink) === null || _a === void 0 ? void 0 : _a.call(this, sessionId);
+        }
+        catch (_b) {
+            // A throwing sink must never surface inside the merchant's fetch chain.
+        }
+    }
+    /**
+     * Scan a Response WITHOUT disturbing the merchant's own read. `clone()` must
+     * happen synchronously, before the caller can consume the body; the read of
+     * the clone is deliberately not awaited by the caller.
+     */
+    scanResponse(response) {
+        var _a, _b, _c, _d, _e, _f;
+        try {
+            const type = (_c = (_b = (_a = response.headers) === null || _a === void 0 ? void 0 : _a.get) === null || _b === void 0 ? void 0 : _b.call(_a, 'content-type')) !== null && _c !== void 0 ? _c : '';
+            if (type && !SCANNABLE_TYPE_RE.test(type))
+                return;
+            const declared = Number((_f = (_e = (_d = response.headers) === null || _d === void 0 ? void 0 : _d.get) === null || _e === void 0 ? void 0 : _e.call(_d, 'content-length')) !== null && _f !== void 0 ? _f : NaN);
+            if (Number.isFinite(declared) && declared > this.maxScanBytes)
+                return;
+            const clone = typeof response.clone === 'function' ? response.clone() : null;
+            if (!clone)
+                return;
+            void clone
+                .text()
+                .then((body) => this.emit(extractSessionId(body.slice(0, this.maxScanBytes))))
+                .catch(() => {
+                /* body already disturbed / opaque response — nothing to do */
+            });
+        }
+        catch (_g) {
+            /* never let observation break the request */
+        }
+    }
+    hookFetch() {
+        if (typeof window.fetch !== 'function')
+            return;
+        const original = window.fetch;
+        const self = this;
+        const patched = function patchedFetch(...args) {
+            const result = original.apply(this !== null && this !== void 0 ? this : window, args);
+            try {
+                // Attach passively: the merchant still gets the original promise, and a
+                // rejection here is theirs to handle, not ours to observe twice.
+                result.then((response) => self.scanResponse(response)).catch(() => { });
+            }
+            catch (_a) {
+                /* ignore */
+            }
+            return result;
+        };
+        window.fetch = patched;
+        this.disposers.push(() => {
+            // Only restore if nobody wrapped us afterwards — clobbering a later
+            // wrapper would silently disable whatever installed it.
+            if (window.fetch === patched)
+                window.fetch = original;
+        });
+    }
+    hookXhr() {
+        if (typeof XMLHttpRequest === 'undefined')
+            return;
+        const proto = XMLHttpRequest.prototype;
+        const originalSend = proto.send;
+        if (typeof originalSend !== 'function')
+            return;
+        const self = this;
+        const patched = function patchedSend(...args) {
+            try {
+                this.addEventListener('load', () => {
+                    try {
+                        // responseText throws for blob/arraybuffer response types.
+                        if (this.responseType !== '' && this.responseType !== 'text')
+                            return;
+                        const body = this.responseText;
+                        if (!body || body.length > self.maxScanBytes)
+                            return;
+                        self.emit(extractSessionId(body));
+                    }
+                    catch (_a) {
+                        /* ignore */
+                    }
+                });
+            }
+            catch (_a) {
+                /* ignore */
+            }
+            return originalSend.apply(this, args);
+        };
+        proto.send = patched;
+        this.disposers.push(() => {
+            if (proto.send === patched)
+                proto.send = originalSend;
+        });
+    }
+    /**
+     * Direct links to checkout.stripe.com. Capture phase so we still see the click
+     * when the merchant's own handler calls stopPropagation().
+     */
+    hookClicks() {
+        if (typeof document === 'undefined')
+            return;
+        const onClick = (e) => {
+            var _a, _b;
+            try {
+                const target = (_b = (_a = e.target) === null || _a === void 0 ? void 0 : _a.closest) === null || _b === void 0 ? void 0 : _b.call(_a, 'a[href]');
+                if (!target || !target.href || !isCheckoutUrl(target.href))
+                    return;
+                this.emit(extractSessionId(target.href));
+            }
+            catch (_c) {
+                /* never block navigation */
+            }
+        };
+        document.addEventListener('click', onClick, true);
+        this.disposers.push(() => document.removeEventListener('click', onClick, true));
+    }
+    hookWindowOpen() {
+        if (typeof window.open !== 'function')
+            return;
+        const original = window.open;
+        const self = this;
+        const patched = function patchedOpen(...args) {
+            var _a;
+            try {
+                const url = args[0];
+                const href = typeof url === 'string' ? url : (_a = url === null || url === void 0 ? void 0 : url.toString) === null || _a === void 0 ? void 0 : _a.call(url);
+                if (href && isCheckoutUrl(href))
+                    self.emit(extractSessionId(href));
+            }
+            catch (_b) {
+                /* ignore */
+            }
+            return original.apply(this !== null && this !== void 0 ? this : window, args);
+        };
+        window.open = patched;
+        this.disposers.push(() => {
+            if (window.open === patched)
+                window.open = original;
+        });
+    }
+}
+
 /** Keys the remote config is allowed to fill on DatalyrConfig. */
 const REMOTE_KEYS = [
     'autoIdentify',
@@ -4184,6 +4865,7 @@ const REMOTE_KEYS = [
     'autoIdentifyAPI',
     'autoIdentifyShopify',
     'shopifyCartAttributes',
+    'stripeCheckoutSessions',
     'checkoutChampDomains',
     'respectGlobalPrivacyControl',
     'respectDoNotTrack',
@@ -4222,6 +4904,16 @@ function applyRemoteConfig(config, remote, explicitKeys) {
  * Datalyr Web SDK
  * Modern attribution tracking for web applications
  */
+/**
+ * WEB-20. Fingerprint of the last identify() that actually emitted, so a host
+ * app calling identify() on every route change does not re-emit an unchanged
+ * identity. Cleared by reset(). Mirrors iOS `datalyr_last_identity_fingerprint`
+ * and RN `@datalyr/last_identity_fingerprint`.
+ *
+ * Not PII: the stored value is a hash, and it is written through the same
+ * `storage` wrapper as every other key (so it inherits the `dl_` prefix).
+ */
+const IDENTIFY_FINGERPRINT_KEY = 'dl_identify_fingerprint';
 class Datalyr {
     constructor() {
         // Keys the caller passed to init() (before built-in defaults were merged).
@@ -4237,10 +4929,26 @@ class Datalyr {
         this.errors = [];
         this.MAX_ERRORS = 50;
         this.lastSpaPath = null; // dedups SPA pageviews (replaceState-on-mount double-fire)
+        // Shopify loads Customer Privacy asynchronously. Keep the initial pageview
+        // pending until initialization is complete and analytics consent is known,
+        // then release it exactly once when consent allows tracking.
+        this.initialPageViewReady = false;
+        this.initialPageViewSent = false;
         // FIXED (ISSUE-01): Async initialization promise to prevent race conditions
         this.initializationPromise = null;
         // Opt-out check moved to init() after cookies configured (Issue #14)
     }
+    /**
+     * Return the workspace configured for this instance, or null before init().
+     *
+     * CDN bootstrap uses this public accessor instead of reaching into the
+     * private runtime config when deciding whether an existing global belongs
+     * to the requested workspace.
+     */
+    getWorkspaceId() {
+        var _a, _b;
+        return (_b = (_a = this.config) === null || _a === void 0 ? void 0 : _a.workspaceId) !== null && _b !== void 0 ? _b : null;
+    }
     /**
      * Initialize the SDK
      */
@@ -4295,7 +5003,11 @@ class Datalyr {
         this.session = new SessionManager(this.config.sessionTimeout);
         this.attribution = new AttributionManager({
             attributionWindow: this.config.attributionWindow,
-            trackedParams: this.config.trackedParams
+            trackedParams: this.config.trackedParams,
+            // TR-03: gate ad-signal synthesis + shipping on LIVE marketing consent. Returns true by
+            // default (no consent signal) so behavior is unchanged for the common case; false only on
+            // an explicit decline (Shopify marketing:false / setConsent marketing|sale=false).
+            marketingAllowed: () => this.consentAllowsMarketing()
         });
         this.queue = new EventQueue(this.config);
         this.fingerprint = new FingerprintCollector({
@@ -4308,11 +5020,18 @@ class Datalyr {
         // Gate the queue by the FULL tracking policy (opt-out + analytics consent + DNT +
         // GPC) so a returning opted-out / DNT / GPC visitor's persisted events don't drain.
         this.queue.setEnabled(this.shouldTrack());
+        // TR-15: also give the offline drain a LIVE consent gate. setEnabled above is latched to
+        // a fail-open value while Shopify's customerPrivacy loads async; a returning declined
+        // visitor fires no visitorConsentCollected event, so the drain must re-check per run.
+        this.queue.setConsentCheck(() => this.shouldTrack());
         // FIXED (ISSUE-01): Start async initialization immediately but don't block constructor
         // This allows encryption to initialize before any events are tracked
         this.initializeAsync();
         // Setup page unload handler
         this.setupUnloadHandler();
+        // Shopify Customer Privacy (9.A.1): react to the native consent banner's
+        // decision mid-session (grant AND revoke), not just at the next page load.
+        this.setupShopifyConsentListener();
         // Initialize plugins
         if (this.config.plugins) {
             for (const plugin of this.config.plugins) {
@@ -4344,6 +5063,27 @@ class Datalyr {
             this.initializationPromise = (() => __awaiter(this, void 0, void 0, function* () {
                 var _a, _b;
                 try {
+                    // TR-22: capture the LANDING attribution NOW, before any await. The first read used to
+                    // sit inside this.page() AFTER `await container.init()` (up to a ~3s budget), so a
+                    // router / consent tool that strips fbclid via history.replaceState within that window
+                    // — or a fast bounce — lost the click id entirely (nothing persisted to first/last
+                    // touch until the first event). getAttributionData() warms queryParamsCache (freezing
+                    // the landing params) AND persists first/last touch immediately. Wrapped so a failure
+                    // never blocks init.
+                    // CONSENT (Track-3 review P1): gate the eager capture behind shouldTrack(). This call
+                    // synthesizes _fbp/_fbc and persists first/last touch — which must NOT happen at page
+                    // load for an opted-out / DNT / GPC visitor (shouldTrack()=false), or it undoes the
+                    // id-less-at-init privacy invariant. For a TRACKED visitor with marketing declined,
+                    // getAttributionData already strips the click-ids / marketing cookies (TR-03), so TR-22's
+                    // early-capture benefit is preserved for consenting/default visitors.
+                    if (this.shouldTrack()) {
+                        try {
+                            this.attribution.getAttributionData();
+                        }
+                        catch (e) {
+                            this.log('Eager attribution capture failed:', e);
+                        }
+                    }
                     // SEC-03: encryption is for PII-AT-REST only — it must NOT gate event delivery,
                     // pageviews, or pixels. On a non-secure context (http://) or an old browser,
                     // crypto.subtle is absent and initialize() throws; isolate it so the rest of init
@@ -4352,6 +5092,11 @@ class Datalyr {
                         const deviceId = this.identity.getAnonymousId();
                         yield dataEncryption.initialize(this.config.workspaceId, deviceId);
                         this.userProperties = yield storage.getEncrypted('dl_user_traits', {});
+                        // WEB-22: restore a PII user id that was persisted encrypted. Must run
+                        // here — it needs dataEncryption to be initialized, so it cannot happen
+                        // in the IdentityManager constructor. It never overwrites an id already
+                        // set by an explicit identify() earlier in this page load.
+                        yield this.identity.hydrateEncryptedUserId();
                         this.log('Encryption initialized, user properties loaded');
                     }
                     catch (encErr) {
@@ -4426,7 +5171,10 @@ class Datalyr {
                     // Initialize auto-identify when enabled (explicit or remote) AND
                     // tracking is allowed. The shouldTrack() gate keeps capture from even
                     // setting up its form/API interceptors for opted-out / DNT / GPC users.
-                    if (this.config.autoIdentify === true && this.shouldTrack()) {
+                    // 9.A.1: the captured email feeds Meta advanced matching / CAPI, so a
+                    // declined Shopify marketing consent also blocks setup (incl. the
+                    // /account.json polling); null = no Shopify signal → unchanged.
+                    if (this.config.autoIdentify === true && this.shouldTrack() && this.shopifyMarketingConsent() !== false) {
                         this.autoIdentify = new AutoIdentifyManager({
                             enabled: true,
                             captureFromForms: this.config.autoIdentifyForms,
@@ -4438,21 +5186,29 @@ class Datalyr {
                         // Setup auto-identify callback
                         this.autoIdentify.initialize((email, source) => {
                             this.log(`Auto-identified user: ${email} from ${source}`);
-                            // Track auto-identify event
-                            this.track('$auto_identify', {
-                                email,
-                                source,
-                                timestamp: Date.now()
-                            });
-                            // Automatically call identify with email
-                            this.identify(email, { email });
+                            // WEB-21: ONE event, not two.
+                            //
+                            // This used to emit `$auto_identify` and then call identify(),
+                            // which emits `$identify` — two events ~1ms apart carrying the same
+                            // email. Production over 7 days on workspace f6260736 showed a
+                            // perfect 379 / 379 / 379 split ($identify / $auto_identify /
+                            // visitors): every auto-identification was booked twice.
+                            //
+                            // Nothing consumed `$auto_identify`: grepped across the whole
+                            // platform (app/, lib/, all Cloudflare workers, all Tinybird pipes)
+                            // — zero readers, while prod carried 6,197 of them in 30 days.
+                            // The only information it added over `$identify` was WHICH detector
+                            // found the email, so that is preserved as a trait instead.
+                            this.identify(email, { email, auto_identify_source: source });
                         });
                     }
                     // Stamp attribution signals into the Shopify cart (OPT-IN, default off).
                     // Lets server-side order webhooks recover the browser visitor + Meta click
                     // signals (the postback webhook reads these as note_attributes). Inert unless
-                    // enabled; best-effort and never blocks init.
-                    if (this.config.shopifyCartAttributes === true && this.shouldTrack()) {
+                    // enabled; best-effort and never blocks init. 9.A.1: the stamped visitor_id +
+                    // fbc/fbp/fbclid are marketing signals, so a declined Shopify marketing
+                    // consent blocks stamping too (null = no signal → unchanged).
+                    if (this.config.shopifyCartAttributes === true && this.shouldTrack() && this.shopifyMarketingConsent() !== false) {
                         this.syncShopifyCartAttributes().catch((error) => {
                             this.log('Shopify cart attribute sync failed:', error);
                         });
@@ -4474,10 +5230,22 @@ class Datalyr {
                     if (this.config.stripePaymentLinks !== false && this.shouldTrack()) {
                         this.syncStripePaymentLinks((_b = this.config.stripeLinkDomains) !== null && _b !== void 0 ? _b : []);
                     }
-                    // Track initial page view if enabled (AFTER encryption ready)
-                    if (this.config.trackPageViews) {
-                        this.page();
+                    // Checkout Session capture (DEFAULT ON). The decorator above cannot help
+                    // when the merchant's BACKEND creates the session — checkout.stripe.com
+                    // ignores client_reference_id post-creation — which is how most SaaS
+                    // checkouts work, and why payers arrive at our webhook with no visitor
+                    // (measured 0.5% and 13.3% visitor coverage on the two Stripe tenants).
+                    // The session id still has to reach the browser, so we observe it and
+                    // let the server join on session.id. Same shouldTrack() gate as the
+                    // decorator: an opted-out visitor's id is never paired with a checkout.
+                    if (this.config.stripeCheckoutSessions !== false && this.shouldTrack()) {
+                        this.startStripeSessionCapture();
                     }
+                    // Track the initial page view after encryption is ready. On Shopify the
+                    // Customer Privacy API can still be loading, so retain one pending
+                    // pageview and release it from onShopifyConsentChanged() once allowed.
+                    this.initialPageViewReady = true;
+                    this.trackInitialPageViewOnce();
                     this.log('Async initialization complete');
                 }
                 catch (error) {
@@ -4610,6 +5378,50 @@ class Datalyr {
     /**
      * Identify a user
      */
+    /**
+     * Stable fingerprint of an identity for redundant-emit suppression (WEB-20).
+     *
+     * Keys are sorted and each value is JSON-serialized, so `{a,b}` and `{b,a}`
+     * collapse to one identity while a genuinely changed nested trait does not.
+     * (The mobile SDKs use `String(value)`, which flattens every object to
+     * `[object Object]` and can swallow a real change; web traits are plain JSON,
+     * so it can afford to be exact.)
+     *
+     * Hashed rather than stored raw so the key does not become another copy of the
+     * user's traits at rest. Being honest about the strength: a 32-bit
+     * non-cryptographic digest sitting beside a readable `dl_dl_anonymous_id` is
+     * NOT protection against a determined reader — it defeats casual inspection
+     * and bulk scraping, nothing more. The PII that matters is handled properly
+     * (encrypted `dl_user_id_pii`, encrypted `dl_user_traits`). 32 bits also means
+     * a ~1-in-4.3e9 chance per identity that a genuine change is suppressed;
+     * acceptable for change detection, which is all this is.
+     */
+    identityFingerprint(userId, traits = {}) {
+        const stableTraits = Object.keys(traits || {})
+            .sort()
+            .map((key) => {
+            let value;
+            try {
+                value = JSON.stringify(traits[key]);
+            }
+            catch (_a) {
+                // Circular/unserializable trait — fall back to a coarse marker rather
+                // than throwing inside identify().
+                value = '[unserializable]';
+            }
+            return `${key}=${value}`;
+        })
+            .join('&');
+        const input = `${this.identity.getAnonymousId()}|${userId}|${stableTraits}`;
+        // 32-bit FNV-1a. Not cryptographic — this only needs to detect change, and
+        // it must be synchronous (crypto.subtle is async and identify() is not).
+        let hash = 0x811c9dc5;
+        for (let i = 0; i < input.length; i++) {
+            hash ^= input.charCodeAt(i);
+            hash = Math.imul(hash, 0x01000193);
+        }
+        return (hash >>> 0).toString(16);
+    }
     identify(userId, traits = {}) {
         if (!this.initialized) {
             console.warn('[Datalyr] SDK not initialized. Call init() first.');
@@ -4622,6 +5434,13 @@ class Datalyr {
             return;
         }
         try {
+            // A different authenticated user on the same device is a privacy
+            // boundary. Rotate the anonymous/session identities and clear the prior
+            // user's traits/attribution before creating the new link, even when the
+            // integrator forgot to call reset() on logout.
+            const currentUserId = this.identity.getUserId();
+            if (currentUserId && currentUserId !== userId)
+                this.reset();
             // FSR-53: do NOT rotate the session id on identify(). 'Session fixation' is an
             // auth-credential concept; a client-generated analytics session_id is not one.
             // Rotating split every identified visit (and every auto-identify form submit) into
@@ -4642,8 +5461,31 @@ class Datalyr {
                 // If encryption fails, user traits are only stored in memory (this.userProperties)
                 // and will be lost on page reload - but PII is NOT exposed in localStorage
             });
-            // Track $identify event
-            this.track('$identify', Object.assign(Object.assign({}, identityLink), { traits }));
+            // WEB-20: redundant-identify suppression, matching iOS 2.1.11 / RN 1.7.16.
+            //
+            // identify() is host-app-driven and SPA routers commonly call it in a
+            // route effect, so an unchanged identity was re-emitted on every
+            // navigation. The mobile SDKs got this in 2.1.10/1.7.15; web did not.
+            //
+            // Fingerprint = anonymousId | userId | sorted traits. The anonymous id is
+            // included so a reset()/rotation always re-emits and identity links are
+            // never lost — only exact repeats are skipped.
+            //
+            // Only the EVENT is suppressed. `this.identity.identify()` above has
+            // already persisted `dl_user_id`, traits are still merged and encrypted,
+            // and the plugin handlers below still run on every call — a plugin's
+            // `identify` hook is a customer extension point whose semantics we cannot
+            // assume, so its contract ("called when identify() is called") is
+            // deliberately left intact.
+            const identityFingerprint = this.identityFingerprint(userId, traits);
+            const isRedundantIdentify = storage.getString(IDENTIFY_FINGERPRINT_KEY, null) === identityFingerprint;
+            if (isRedundantIdentify) {
+                this.log('Skipping redundant identify (unchanged identity):', userId);
+            }
+            else {
+                storage.set(IDENTIFY_FINGERPRINT_KEY, identityFingerprint);
+                this.track('$identify', Object.assign(Object.assign({}, identityLink), { traits }));
+            }
             // Call plugin handlers
             if (this.config.plugins) {
                 for (const plugin of this.config.plugins) {
@@ -4663,6 +5505,18 @@ class Datalyr {
             this.trackError(error, { userId });
         }
     }
+    /**
+     * WEB-27: queue health, including events the SDK gave up on.
+     *
+     * `getStats()` existed on EventQueue but was unreachable — `queue` is private
+     * and nothing exposed it, so the observability fix could not actually be
+     * observed. A non-zero `droppedEvents` means data was lost.
+     */
+    getQueueStats() {
+        if (!this.queue)
+            return null;
+        return this.queue.getStats();
+    }
     /**
      * Track a page view
      */
@@ -4684,7 +5538,9 @@ class Datalyr {
         if (!lastTouchpoint || lastTouchpoint.sessionId !== sid) {
             this.attribution.addTouchpoint(sid, this.attribution.captureAttribution());
         }
-        const pageData = Object.assign({ title: document.title, url: window.location.href, path: window.location.pathname, search: window.location.search, referrer: document.referrer }, properties);
+        // 9.A.4: url/search/referrer are redacted (secret/PII query-param values →
+        // __redacted__) before they ever leave the browser — see redactUrl in utils.
+        const pageData = Object.assign({ title: document.title, url: redactUrl(window.location.href), path: window.location.pathname, search: redactUrl(window.location.search), referrer: redactUrl(document.referrer) }, properties);
         // Add referrer data
         const referrerData = getReferrerData();
         Object.assign(pageData, referrerData);
@@ -4754,6 +5610,13 @@ class Datalyr {
         // Gate before mutating persisted identity (identity.alias writes dl_user_id).
         if (!this.shouldTrack())
             return;
+        if (previousId && previousId !== this.identity.getAnonymousId()) {
+            console.warn('[Datalyr] alias() only accepts the current anonymous ID as previousId');
+            return;
+        }
+        const currentUserId = this.identity.getUserId();
+        if (currentUserId && currentUserId !== userId)
+            this.reset();
         const aliasData = this.identity.alias(userId, previousId);
         this.track('$alias', aliasData);
     }
@@ -4771,6 +5634,9 @@ class Datalyr {
         // values to the next user's events (cross-user contamination on shared devices).
         this.superProperties = {};
         storage.remove('dl_user_traits');
+        // WEB-20: drop the identify fingerprint, so a logout→login (or a different
+        // user on this browser) always re-emits $identify and the link is rebuilt.
+        storage.remove(IDENTIFY_FINGERPRINT_KEY);
         // Clear the auto-identify guard so a different user on the same browser is
         // re-captured (it short-circuits while dl_auto_identified_email is present), and so
         // the prior user's email isn't left at rest after logout.
@@ -4909,6 +5775,32 @@ class Datalyr {
     /**
      * Opt out of tracking
      */
+    /**
+     * X-1 (consent): stop the Stripe Payment Link + CheckoutChamp outbound-link decorators from
+     * stamping `client_reference_id`/`prefilled_email` onto <a> hrefs once consent/marketing is
+     * withdrawn. Their MutationObservers otherwise keep rewriting links after a CMP or Shopify
+     * decline — and the server still reads the stamped `client_reference_id` — so attribution
+     * continues post-withdrawal. Idempotent; decorators re-init on the next load if consent returns
+     * (same convention as pixels/auto-identify).
+     */
+    disposeMarketingLinkDecorators() {
+        var _a, _b, _c;
+        try {
+            (_a = this.stripeLinksDisposer) === null || _a === void 0 ? void 0 : _a.call(this);
+        }
+        catch ( /* best-effort */_d) { /* best-effort */ }
+        this.stripeLinksDisposer = undefined;
+        try {
+            (_b = this.stripeSessionWatcher) === null || _b === void 0 ? void 0 : _b.stop();
+        }
+        catch ( /* best-effort */_e) { /* best-effort */ }
+        this.stripeSessionWatcher = undefined;
+        try {
+            (_c = this.outboundDisposer) === null || _c === void 0 ? void 0 : _c.call(this);
+        }
+        catch ( /* best-effort */_f) { /* best-effort */ }
+        this.outboundDisposer = undefined;
+    }
     optOut() {
         var _a;
         if (!this.initialized) {
@@ -4930,11 +5822,27 @@ class Datalyr {
             this.container.cleanupAllIframes();
             this.container = undefined;
         }
+        // X-1: stop stamping Stripe/CC outbound links with the visitor id / email.
+        this.disposeMarketingLinkDecorators();
         // Purge PII at rest.
         this.userProperties = {};
         storage.remove('dl_user_traits');
+        // WEB-26: remove the PLAINTEXT id as well. optOut() purged only the
+        // encrypted copy, so an opted-out visitor whose email was written by an
+        // older build kept it at rest — the one state where that is least
+        // defensible.
+        storage.remove('dl_user_id');
+        storage.remove('dl_user_id_pii');
+        storage.remove(IDENTIFY_FINGERPRINT_KEY);
         storage.remove('dl_auto_identified_email');
         storage.remove('dl_journey');
+        // WEB-25: first/last touch hold redacted-but-full landing URLs, referrers and
+        // click ids for up to 90 days. reset() has always cleared them; optOut() did
+        // not — so an opted-out visitor kept marketing attribution at rest, which is
+        // the one state where it is least defensible. Same rationale as dl_journey
+        // directly above.
+        storage.remove('dl_first_touch');
+        storage.remove('dl_last_touch');
         this.log('User opted out');
     }
     /**
@@ -4951,6 +5859,9 @@ class Datalyr {
         // merely because opt-out was lifted — otherwise a GPC/DNT visitor's persisted
         // events would start draining again. (Pixels / auto-identify resume on next load.)
         this.queue.setEnabled(this.shouldTrack());
+        // TR-15 (P3): opt-in → persist the in-memory anon id now (see onShopifyConsentChanged).
+        if (this.shouldTrack())
+            this.identity.enablePersistence();
         this.log('User opted in');
     }
     /**
@@ -4963,6 +5874,7 @@ class Datalyr {
      * Set consent preferences
      */
     setConsent(consent) {
+        var _a;
         // Always record + persist consent FIRST, even before init(). FSR-51: a consent-
         // management platform commonly calls setConsent() before init() so tracking is gated
         // from the very first event. The old code then dereferenced this.queue/this.config
@@ -4983,6 +5895,30 @@ class Datalyr {
         if (!allowed) {
             this.queue.clear();
             this.queue.clearOffline();
+            // TR-14: mirror optOut() on analytics withdrawal. Previously setConsent tore down the
+            // queue + container but left autoIdentify alive — its form/fetch interceptors and
+            // /account.json polling kept running and triggerIdentify persisted the captured email
+            // to storage AFTER withdrawal (PII newly written at rest → GDPR/consent-audit failure
+            // on non-Shopify CMP installs). Destroy it and purge PII at rest. (Auto-identify
+            // resumes on the next page load if consent is re-granted, matching optOut/optIn.)
+            (_a = this.autoIdentify) === null || _a === void 0 ? void 0 : _a.destroy();
+            this.autoIdentify = undefined;
+            this.userProperties = {};
+            storage.remove('dl_user_traits');
+            // WEB-26: see optOut() — the plaintext id must go too.
+            storage.remove('dl_user_id');
+            storage.remove('dl_user_id_pii');
+            storage.remove(IDENTIFY_FINGERPRINT_KEY);
+            storage.remove('dl_auto_identified_email');
+            storage.remove('dl_journey');
+            // WEB-25: see optOut() — withdrawn analytics consent must not leave 90-day
+            // marketing attribution at rest either.
+            storage.remove('dl_first_touch');
+            storage.remove('dl_last_touch');
+        }
+        else {
+            // TR-15 (P3): grant → persist the in-memory anon id now (see onShopifyConsentChanged).
+            this.identity.enablePersistence();
         }
         // Marketing / "do not sell" withdrawal: stop FEEDING the third-party pixels and
         // prevent them from being initialized on the next page load. NOTE: an
@@ -4992,6 +5928,12 @@ class Datalyr {
             this.container.cleanupAllIframes();
             this.container = undefined;
         }
+        // X-1: on marketing/sale withdrawal, stop the Stripe/CC decorators from stamping the
+        // visitor id / email onto outbound links (the observers otherwise keep rewriting hrefs
+        // after withdrawal, and the server still reads the stamped client_reference_id).
+        if (!this.consentAllowsMarketing()) {
+            this.disposeMarketingLinkDecorators();
+        }
         this.log('Consent updated:', consent);
     }
     /**
@@ -5076,91 +6018,27 @@ class Datalyr {
             }
         });
     }
-    /**
-     * Restore _dl_* URL bridge params on a Checkout Champ funnel page.
-     * Runs BEFORE IdentityManager so the storefront's visitor_id wins over a
-     * freshly auto-generated one. Also restores _fbc / _fbp cookies and the
-     * fbclid click time so server-side rebuilds carry the real click moment.
-     *
-     * Strategy: stamp matching cookies (without clobbering pre-existing values),
-     * then rewrite the URL so `_dl_fbclid` becomes `fbclid` — that way the rest
-     * of the SDK's attribution layer (which reads `params.fbclid`) works
-     * unchanged, and any merchant analytics also see the canonical click ID.
-     */
+    /** Strip the retired unsigned Checkout Champ bridge parameters. */
     restoreFromURL() {
         var _a;
         if (typeof window === "undefined" || typeof document === "undefined")
             return;
         try {
             const params = new URLSearchParams(window.location.search);
-            const get = (k) => params.get(k);
-            const vid = get("_dl_vid");
-            const fbc = get("_dl_fbc");
-            const fbp = get("_dl_fbp");
-            const fbclid = get("_dl_fbclid");
-            const fbclidAt = get("_dl_fbclid_at");
-            const gclid = get("_dl_gclid");
-            const gclidAt = get("_dl_gclid_at");
-            // visitor_id: bridge wins. The whole point of `_dl_vid` is to unify the
-            // storefront's session with the CC funnel session. A pre-existing local
-            // cookie from a prior direct CC visit would silently sink the integration
-            // (CC events stay on the local id; storefront events use the bridged id;
-            // the two never link). Overwrite — orphaned local events are fine.
-            if (vid)
-                this.cookies.set("__dl_visitor_id", vid, 365);
-            // Meta cookies + click-time cookies: existing wins. _fbc / _fbp may have
-            // been written by Meta Pixel on the CC funnel page itself (more recent
-            // than the bridged value); _dl_fbclid_at should record first-touch click
-            // time per device, not get reset by a bridge from a new campaign.
-            const setIfMissing = (name, value) => {
-                if (!value)
-                    return;
-                if (this.cookies.get(name))
-                    return;
-                this.cookies.set(name, value, 365);
-            };
-            setIfMissing("_fbc", fbc);
-            setIfMissing("_fbp", fbp);
-            setIfMissing("_dl_fbclid_at", fbclidAt);
-            setIfMissing("_dl_gclid_at", gclidAt);
-            // Rewrite URL: _dl_fbclid → fbclid (etc.) so captureAttribution() picks
-            // them up via its existing `params.fbclid` path. Strip the _dl_* params
-            // either way so they don't leak into downstream analytics URLs.
-            let rewrote = false;
-            const mappings = [
-                ["fbclid", fbclid],
-                ["gclid", gclid]
-            ];
-            for (const [canonical, value] of mappings) {
-                if (value && !params.get(canonical)) {
-                    params.set(canonical, value);
-                    rewrote = true;
-                }
-            }
+            let changed = false;
             for (const k of ["_dl_vid", "_dl_fbc", "_dl_fbp", "_dl_fbclid", "_dl_fbclid_at", "_dl_gclid", "_dl_gclid_at"]) {
                 if (params.has(k)) {
                     params.delete(k);
-                    rewrote = true;
+                    changed = true;
                 }
             }
-            if (rewrote && typeof ((_a = window.history) === null || _a === void 0 ? void 0 : _a.replaceState) === "function") {
+            if (changed && typeof ((_a = window.history) === null || _a === void 0 ? void 0 : _a.replaceState) === "function") {
                 const newSearch = params.toString();
-                const newUrl = window.location.pathname +
-                    (newSearch ? "?" + newSearch : "") +
-                    window.location.hash;
+                const newUrl = window.location.pathname + (newSearch ? "?" + newSearch : "") + window.location.hash;
                 window.history.replaceState(window.history.state, "", newUrl);
             }
-            this.log("Checkout Champ bridge restored:", {
-                had_vid: !!vid,
-                had_fbc: !!fbc,
-                had_fbp: !!fbp,
-                had_fbclid: !!fbclid,
-                had_gclid: !!gclid
-            });
         }
         catch (error) {
-            // Don't let bridge restoration block init — fall through to normal SDK
-            // behavior (a fresh visitor_id, no restored click signals).
             this.log("restoreFromURL failed:", error);
         }
     }
@@ -5261,138 +6139,9 @@ class Datalyr {
             this.log("fireCheckoutChampPurchasePixel failed:", error);
         }
     }
-    /**
-     * Storefront → Checkout Champ link stamping. Finds every `<a href>` whose host
-     * matches the configured CC domain list and appends `?_dl_vid=…&_dl_fbc=…&
-     * _dl_fbp=…&_dl_fbclid=…&_dl_fbclid_at=…&_dl_gclid=…` so the user's
-     * visitor_id + Meta click signals cross the domain. MutationObserver watches
-     * for dynamically-injected links. On click, force-flush the event queue so
-     * any pending track() events land before the browser navigates away.
-     */
+    /** Checkout Champ identity bridging remains disabled pending signed tokens. */
     syncOutboundLinkParams(domains) {
-        if (typeof window === "undefined" || typeof document === "undefined")
-            return;
-        const lowerDomains = domains.map((d) => d.toLowerCase());
-        const matchesCcDomain = (href) => {
-            try {
-                const host = new URL(href, window.location.href).hostname.toLowerCase();
-                return lowerDomains.some((d) => host === d || host.endsWith("." + d));
-            }
-            catch (_a) {
-                return false;
-            }
-        };
-        const buildBridgeParams = () => {
-            var _a, _b;
-            const attribution = this.attribution.getAttributionData();
-            const out = {};
-            const vid = this.identity.getAnonymousId();
-            const fbc = this.cookies.get("_fbc") || attribution._fbc;
-            const fbp = this.cookies.get("_fbp") || attribution._fbp;
-            // FSR-104: read the named click-id fields directly (captureAttribution stores every
-            // present click id under its own key) so a landing URL carrying BOTH fbclid and
-            // gclid bridges both — the old `clickIdType === 'fbclid' ? clickId : null` dropped
-            // gclid whenever fbclid was the primary, silently losing Google attribution on the
-            // cross-domain CC path. Fall back to the primary clickId for older stored shapes.
-            const fbclid = (_a = attribution.fbclid) !== null && _a !== void 0 ? _a : (attribution.clickIdType === "fbclid" ? attribution.clickId : null);
-            const fbclidAt = this.cookies.get("_dl_fbclid_at");
-            const gclid = (_b = attribution.gclid) !== null && _b !== void 0 ? _b : (attribution.clickIdType === "gclid" ? attribution.clickId : null);
-            const gclidAt = this.cookies.get("_dl_gclid_at");
-            if (vid)
-                out._dl_vid = vid;
-            if (fbc)
-                out._dl_fbc = String(fbc);
-            if (fbp)
-                out._dl_fbp = String(fbp);
-            if (fbclid)
-                out._dl_fbclid = String(fbclid);
-            if (fbclidAt)
-                out._dl_fbclid_at = String(fbclidAt);
-            if (gclid)
-                out._dl_gclid = String(gclid);
-            if (gclidAt)
-                out._dl_gclid_at = String(gclidAt);
-            return out;
-        };
-        const stampLink = (anchor) => {
-            if (!anchor.href || !matchesCcDomain(anchor.href))
-                return;
-            try {
-                const u = new URL(anchor.href, window.location.href);
-                const bridge = buildBridgeParams();
-                let mutated = false;
-                for (const [k, v] of Object.entries(bridge)) {
-                    if (!u.searchParams.get(k)) {
-                        u.searchParams.set(k, v);
-                        mutated = true;
-                    }
-                }
-                if (mutated)
-                    anchor.href = u.toString();
-            }
-            catch (_a) {
-                // Ignore malformed URLs — don't break the page.
-            }
-        };
-        const stampAll = () => {
-            document.querySelectorAll("a[href]").forEach((el) => stampLink(el));
-        };
-        const onClick = (e) => {
-            var _a, _b;
-            const target = (_a = e.target) === null || _a === void 0 ? void 0 : _a.closest("a[href]");
-            if (!target)
-                return;
-            const anchor = target;
-            if (!matchesCcDomain(anchor.href))
-                return;
-            stampLink(anchor); // re-stamp in case attribution changed since DOMReady
-            try {
-                (_b = this.queue) === null || _b === void 0 ? void 0 : _b.flush();
-            }
-            catch (_c) {
-                // Best-effort — never block navigation.
-            }
-        };
-        stampAll();
-        document.addEventListener("click", onClick, true);
-        try {
-            // Debounce re-stamping. A busy SPA (infinite scroll, animations,
-            // React/Vue updates) can fire thousands of mutations per second; a naive
-            // re-stamp on every notification would burn CPU pointlessly when
-            // outbound link sets only change occasionally. 150ms is small enough to
-            // catch links before the user can click them, large enough to coalesce
-            // bursts.
-            let restampTimer = null;
-            const scheduleRestamp = () => {
-                if (restampTimer != null)
-                    return;
-                restampTimer = setTimeout(() => {
-                    restampTimer = null;
-                    stampAll();
-                }, 150);
-            };
-            const observer = new MutationObserver(scheduleRestamp);
-            observer.observe(document.documentElement, { childList: true, subtree: true });
-            // Observer + click listener live for the session; pagehide cleans up on full-page
-            // unload, and destroy() can tear them down early via this disposer (H2 — otherwise
-            // a destroy()+re-init() leaks the observer + capturing click listener).
-            this.outboundDisposer = () => {
-                try {
-                    observer.disconnect();
-                }
-                catch ( /* idempotent */_a) { /* idempotent */ }
-                if (restampTimer != null) {
-                    clearTimeout(restampTimer);
-                    restampTimer = null;
-                }
-                document.removeEventListener("click", onClick, true);
-            };
-            window.addEventListener("pagehide", () => { var _a; return (_a = this.outboundDisposer) === null || _a === void 0 ? void 0 : _a.call(this); }, { once: true });
-        }
-        catch (error) {
-            this.log("MutationObserver setup failed (CC link sync):", error);
-        }
-        this.log("Checkout Champ outbound-link sync active for:", lowerDomains);
+        this.log("Checkout Champ outbound identity bridge disabled (signed token required)", domains);
     }
     /**
      * Stripe Payment Link auto-decoration (D1). Structurally mirrors
@@ -5419,6 +6168,39 @@ class Datalyr {
      * changes. window.open(paymentLink) is not covered (use getVisitorId()
      * manually); iframe/shadow-DOM links are unreachable from document.
      */
+    /**
+     * Observe Stripe Checkout Session ids and report each one once.
+     *
+     * The event is what carries the pairing: the server stores
+     * (stripe_session_id -> visitor_id) and, when checkout.session.completed
+     * arrives without a client_reference_id, joins on session.id and feeds the
+     * SAME cacheCustomerVisitor path the Payment Link flow already uses — so
+     * every later invoice for that customer inherits the visitor too.
+     *
+     * Consent is re-checked at emit time, not just at init: a visitor can
+     * withdraw between page load and checkout, and this pairing is exactly the
+     * kind of identity link that must stop when they do.
+     */
+    startStripeSessionCapture() {
+        if (this.stripeSessionWatcher)
+            return;
+        const watcher = new StripeSessionWatcher();
+        this.stripeSessionWatcher = watcher;
+        watcher.start((stripeSessionId) => {
+            var _a;
+            if (!this.shouldTrack())
+                return;
+            this.track('$stripe_checkout_session', { stripe_session_id: stripeSessionId });
+            // The very next thing this page does is navigate to Stripe, so flush now
+            // rather than let the batch timer lose the pairing to the unload.
+            try {
+                (_a = this.queue) === null || _a === void 0 ? void 0 : _a.flush();
+            }
+            catch (_b) {
+                /* best-effort — never block the checkout */
+            }
+        });
+    }
     syncStripePaymentLinks(extraDomains) {
         if (typeof window === "undefined" || typeof document === "undefined")
             return;
@@ -5551,6 +6333,7 @@ class Datalyr {
      * Create event payload
      */
     createEventPayload(eventName, properties, eventIdArg) {
+        var _a;
         // NEW-2: keep the identity's cached session id in lockstep with the LIVE session.
         // The session id changes on session timeout (and previously on identify(), removed in
         // FSR-53), but identity only synced it at init/start — so the top-level
@@ -5587,17 +6370,30 @@ class Datalyr {
                 device_fingerprint: fingerprintData // Use snake_case only (matches backend)
             });
         }
-        // Add browser context (caller wins on collisions)
+        // Add browser context (caller wins on collisions). 9.A.4: url/referrer are
+        // redacted — secret/PII query-param values must not ship on events.
         assignMissing(eventData, {
-            url: window.location.href,
+            url: redactUrl(window.location.href),
             path: window.location.pathname,
-            referrer: document.referrer,
+            referrer: redactUrl(document.referrer),
             title: document.title,
             screen_width: screen.width,
             screen_height: screen.height,
             viewport_width: window.innerWidth,
             viewport_height: window.innerHeight
         });
+        // Consent travels with the event so downstream profile enrichment and ad
+        // postbacks enforce the decision that applied at occurrence time. The SDK
+        // snapshot is authoritative over caller properties.
+        const consentSnapshot = Object.assign({}, ((_a = this.consent) !== null && _a !== void 0 ? _a : {}));
+        const shopifyAnalytics = this.shopifyAnalyticsConsent();
+        const shopifyMarketing = this.shopifyMarketingConsent();
+        if (typeof shopifyAnalytics === 'boolean')
+            consentSnapshot.analytics = shopifyAnalytics;
+        if (typeof shopifyMarketing === 'boolean')
+            consentSnapshot.marketing = shopifyMarketing;
+        if (Object.keys(consentSnapshot).length > 0)
+            eventData.consent = consentSnapshot;
         // Create payload using snake_case only (matches backend API and production script)
         const identityFields = this.identity.getIdentityFields();
         // Use the caller-provided event_id (shared with the Meta Pixel co-fire for
@@ -5626,11 +6422,17 @@ class Datalyr {
             // Resolution metadata
             resolution_method: 'browser_sdk',
             resolution_confidence: 1.0,
-            // SDK metadata. MUST stay in sync with package.json "version" — the build guard
-            // (scripts/check-bundle.js, run by build:check) fails the build if the bundle's
-            // sdk_version doesn't match package.json. (FSR-103)
-            sdk_version: '1.7.4',
-            sdk_name: 'datalyr-web-sdk'
+            // SDK metadata. The placeholder is replaced with package.json "version" at build
+            // time (rollup.config.js injectSdkVersion — 9.A.3), so the literal can never
+            // drift from the package again (it sat at 1.7.4 across the 1.7.5 release). The
+            // build guard (scripts/check-bundle.js, run by build:check) still verifies the
+            // deployable bundles carry the package.json version. (FSR-103)
+            sdk_version: '1.7.8',
+            sdk_name: 'datalyr-web-sdk',
+            // A3-25: versioned-envelope stamp. Every SDK emits schema_version so the ingest/contract
+            // layer can key on ONE canonical envelope version (snake_case fields, event_name/event_data
+            // keys, canonical click-ids, clamped client timestamp — all now converged across SDKs).
+            schema_version: 1
         };
         return payload;
     }
@@ -5646,6 +6448,14 @@ class Datalyr {
         if (this.consent && this.consent.analytics === false) {
             return false;
         }
+        // Shopify Customer Privacy (9.A.1 — LEGAL): on a Shopify storefront, a shopper who
+        // declined the native consent banner must not be tracked, even when the merchant
+        // never wired setConsent(). null = API absent (non-Plus store not using it, or
+        // script loaded off-Shopify) → fall through. A detected Shopify storefront
+        // fails closed while the asynchronous Customer Privacy API is unresolved.
+        if (this.shopifyAnalyticsConsent() === false) {
+            return false;
+        }
         // Check Do Not Track
         if (this.config.respectDoNotTrack && isDoNotTrackEnabled()) {
             return false;
@@ -5662,8 +6472,196 @@ class Datalyr {
      * pixels (which share data). No consent set = allowed (default).
      */
     consentAllowsMarketing() {
+        // Shopify Customer Privacy (9.A.1): a declined native banner blocks marketing use
+        // (pixel loads, click-id/email forwarding) even with no setConsent() call.
+        // null = no signal → defer to the setConsent-based policy below, unchanged.
+        if (this.shopifyMarketingConsent() === false) {
+            return false;
+        }
         return !this.consent || (this.consent.marketing !== false && this.consent.sale !== false);
     }
+    /**
+     * Shopify Customer Privacy API handle (9.A.1), or null when it doesn't apply.
+     *
+     * X-2 (LEGAL): gated on RUNTIME detection of `window.Shopify.customerPrivacy`, NOT on
+     * `config.platform === 'shopify'`. A Shopify merchant who installs via a plain <script>
+     * snippet or a headless storefront (no `platform:'shopify'`) still exposes customerPrivacy;
+     * gating on config.platform meant a shopper who DECLINED the native banner (with no
+     * setConsent() wired) was fully tracked — nullifying the consent feature for a whole install
+     * class, and unfixable server-side (platform is install-time only). Every access is wrapped —
+     * a Shopify API shape change (or a non-Shopify site) must NEVER break tracking (→ null = fail open).
+     */
+    getShopifyCustomerPrivacy() {
+        var _a, _b;
+        if (typeof window === 'undefined')
+            return null;
+        try {
+            return (_b = (_a = window.Shopify) === null || _a === void 0 ? void 0 : _a.customerPrivacy) !== null && _b !== void 0 ? _b : null;
+        }
+        catch (_c) {
+            return null;
+        }
+    }
+    isShopifyStorefront() {
+        var _a;
+        if (((_a = this.config) === null || _a === void 0 ? void 0 : _a.platform) === 'shopify')
+            return true;
+        if (typeof window === 'undefined')
+            return false;
+        try {
+            return Boolean(window.Shopify) ||
+                window.location.hostname.toLowerCase().endsWith('.myshopify.com');
+        }
+        catch (_b) {
+            return false;
+        }
+    }
+    /**
+     * Shopify's analytics-consent signal: true/false when the Customer Privacy API is
+     * present and answers, null when there's no signal (API absent / unexpected shape)
+     * — null means "no restriction from Shopify", i.e. today's behavior.
+     */
+    shopifyAnalyticsConsent() {
+        try {
+            const cp = this.getShopifyCustomerPrivacy();
+            if (!cp)
+                return this.isShopifyStorefront() ? false : null;
+            if (typeof cp.analyticsProcessingAllowed === 'function') {
+                const allowed = cp.analyticsProcessingAllowed();
+                return typeof allowed === 'boolean' ? allowed : null;
+            }
+            // Older API surface: the aggregate "can this visitor be tracked" signal.
+            if (typeof cp.userCanBeTracked === 'function') {
+                const allowed = cp.userCanBeTracked();
+                return typeof allowed === 'boolean' ? allowed : null;
+            }
+            return this.isShopifyStorefront() ? false : null;
+        }
+        catch (_a) {
+            return this.isShopifyStorefront() ? false : null;
+        }
+    }
+    /**
+     * Shopify's marketing-consent signal (gates pixels, click-id/email → CAPI, cart
+     * attribute stamping, auto-identify email capture). Same null semantics as
+     * shopifyAnalyticsConsent().
+     */
+    shopifyMarketingConsent() {
+        try {
+            const cp = this.getShopifyCustomerPrivacy();
+            if (!cp || typeof cp.marketingAllowed !== 'function') {
+                return this.isShopifyStorefront() ? false : null;
+            }
+            const allowed = cp.marketingAllowed();
+            return typeof allowed === 'boolean'
+                ? allowed
+                : (this.isShopifyStorefront() ? false : null);
+        }
+        catch (_a) {
+            return this.isShopifyStorefront() ? false : null;
+        }
+    }
+    /**
+     * Listen for Shopify's `visitorConsentCollected` document event (9.A.1) so a
+     * consent decision made mid-session takes effect without a reload. Revocation is
+     * enforced immediately, mirroring setConsent(): queue gated + purged, pixels torn
+     * down, auto-identify (email capture + /account.json polling) destroyed. On grant
+     * the queue re-enables (track() re-checks shouldTrack() per event anyway) and cart
+     * attribute stamping runs; pixels / auto-identify resume on the next page load —
+     * the same convention as optIn().
+     */
+    setupShopifyConsentListener() {
+        // X-2: NOT gated on config.platform — a plain-snippet/headless Shopify install must also honor
+        // a mid-session consent decision. The `visitorConsentCollected` event only fires on Shopify
+        // storefronts, and the handler + loadFeatures are fully guarded, so this is a safe no-op
+        // everywhere else.
+        if (typeof document === 'undefined')
+            return;
+        try {
+            this.shopifyConsentHandler = () => {
+                try {
+                    this.onShopifyConsentChanged();
+                }
+                catch (error) {
+                    this.log('Shopify consent change handling failed:', error);
+                }
+            };
+            document.addEventListener('visitorConsentCollected', this.shopifyConsentHandler);
+            // TR-15: customerPrivacy loads ASYNCHRONOUSLY. Until it's present shopifyAnalyticsConsent()
+            // returns null (fail-open → events send in the pre-load window). Force the feature to load
+            // and re-run the full consent evaluation in the callback so a declined visitor is gated
+            // (queue disabled + purged) as soon as the API answers, without waiting for a reload or a
+            // banner interaction. Guarded — a missing/changed loadFeatures must never break tracking.
+            const shopify = window.Shopify;
+            if (shopify && typeof shopify.loadFeatures === 'function') {
+                shopify.loadFeatures([{ name: 'consent-tracking-api', version: '0.1' }], (error) => {
+                    if (error) {
+                        this.log('Shopify loadFeatures(consent-tracking-api) failed:', error);
+                        return;
+                    }
+                    try {
+                        this.onShopifyConsentChanged();
+                    }
+                    catch (e) {
+                        this.log('Shopify post-load consent eval failed:', e);
+                    }
+                });
+            }
+        }
+        catch (error) {
+            this.log('Shopify consent listener setup failed:', error);
+        }
+    }
+    onShopifyConsentChanged() {
+        const allowed = this.shouldTrack();
+        this.queue.setEnabled(allowed);
+        // TR-15 (P3): a mid-session grant must persist the in-memory anon id NOW — otherwise a
+        // visitor declined at init keeps a memory-only id and this session's events land under a
+        // visitor_id that vanishes on the next page load. Idempotent.
+        if (allowed)
+            this.identity.enablePersistence();
+        if (allowed)
+            this.trackInitialPageViewOnce();
+        if (!allowed) {
+            // Mirror setConsent() withdrawal: purge buffered events so events captured
+            // before the decline can't drain if consent is later re-granted.
+            this.queue.clear();
+            this.queue.clearOffline();
+        }
+        const marketingBlocked = this.shopifyMarketingConsent() === false;
+        // Stop email capture (form interceptors + /account.json polling) immediately.
+        if ((!allowed || marketingBlocked) && this.autoIdentify) {
+            this.autoIdentify.destroy();
+            this.autoIdentify = undefined;
+        }
+        // Same caveat as setConsent(): an already-injected pixel global (fbq/gtag/ttq)
+        // keeps running in the page; full removal is on reload.
+        if (!this.consentAllowsMarketing() && this.container) {
+            this.container.cleanupAllIframes();
+            this.container = undefined;
+        }
+        // X-1: marketing withdrawn (Shopify decline) → stop stamping Stripe/CC outbound links.
+        if (!this.consentAllowsMarketing()) {
+            this.disposeMarketingLinkDecorators();
+        }
+        // Grant direction: cart-attribute stamping is cheap and idempotent (merges via
+        // /cart/update.js), so run it now instead of waiting for the next page load.
+        if (allowed && !marketingBlocked && this.config.shopifyCartAttributes === true) {
+            this.syncShopifyCartAttributes().catch((error) => {
+                this.log('Shopify cart attribute sync failed:', error);
+            });
+        }
+        this.log('Shopify consent collected — analytics allowed:', allowed, '— marketing blocked:', marketingBlocked);
+    }
+    /** Release the automatic landing pageview once, after init and consent. */
+    trackInitialPageViewOnce() {
+        if (!this.initialPageViewReady || this.initialPageViewSent)
+            return;
+        if (!this.config.trackPageViews || !this.initialized || !this.shouldTrack())
+            return;
+        this.initialPageViewSent = true;
+        this.page();
+    }
     /**
      * Setup SPA tracking
      * Fixed Issue #15: Store original methods for cleanup
@@ -5764,7 +6762,7 @@ class Datalyr {
             stack: error.stack,
             context,
             timestamp: new Date().toISOString(),
-            url: window.location.href
+            url: redactUrl(window.location.href) // 9.A.4: no secret query values in error logs
         };
         this.errors.push(errorInfo);
         // Keep only recent errors
@@ -5846,6 +6844,10 @@ class Datalyr {
             window.removeEventListener('visibilitychange', this.visibilityHandler);
             this.visibilityHandler = undefined;
         }
+        if (this.shopifyConsentHandler) {
+            document.removeEventListener('visitorConsentCollected', this.shopifyConsentHandler);
+            this.shopifyConsentHandler = undefined;
+        }
         if (this.outboundDisposer) {
             this.outboundDisposer();
             this.outboundDisposer = undefined;
@@ -5854,6 +6856,10 @@ class Datalyr {
             this.stripeLinksDisposer();
             this.stripeLinksDisposer = undefined;
         }
+        if (this.stripeSessionWatcher) {
+            this.stripeSessionWatcher.stop();
+            this.stripeSessionWatcher = undefined;
+        }
         // Clean up queue
         if (this.queue) {
             this.queue.destroy();
@@ -5879,6 +6885,8 @@ class Datalyr {
         this.container = undefined;
         this.autoIdentify = undefined;
         this.lastSpaPath = null;
+        this.initialPageViewReady = false;
+        this.initialPageViewSent = false;
         // Clear any remaining data
         this.superProperties = {};
         this.userProperties = {};
@@ -5887,12 +6895,25 @@ class Datalyr {
         this.log('SDK destroyed');
     }
 }
-// Create singleton instance
-const datalyr = new Datalyr();
+/**
+ * Create an independent SDK instance without reading or mutating window.
+ *
+ * The CDN bootstrap uses this when an existing global is configured for a
+ * different workspace. Package consumers can also opt into multiple explicit
+ * instances without changing the default singleton contract below.
+ */
+function createDatalyrInstance() {
+    return new Datalyr();
+}
+// Create the default singleton. TR-23: reuse an existing window.datalyr (a
+// prior tag's instance or a package singleton) so npm/ESM/CJS consumers retain
+// the established one-global behavior. Workspace conflict resolution belongs
+// to the CDN bootstrap, which has the authoritative script-tag configuration.
+const datalyr = (typeof window !== 'undefined' && window.datalyr) || createDatalyrInstance();
 // Expose global API
 if (typeof window !== 'undefined') {
     window.datalyr = datalyr;
 }
 
-export { datalyr, datalyr as default };
+export { createDatalyrInstance, datalyr, datalyr as default };
 //# sourceMappingURL=datalyr.esm.js.map