@datalyr/web 1.7.5 → 1.7.8

package/dist/datalyr.js

@@ -1,5 +1,5 @@
 /**
- * @datalyr/web v1.7.5
+ * @datalyr/web v1.7.8
  * Datalyr Web SDK - Modern attribution tracking for web applications
  * (c) 2026 Datalyr Inc.
  * Released under the MIT License
@@ -418,8 +418,23 @@ var Datalyr = (function (exports) {
                         // Get value from legacy key
                         const value = this.storage.getItem(legacyKey);
                         if (value) {
-                            // Extract the actual key name (remove '__dl_' prefix, keep 'dl_' part)
-                            const actualKey = legacyKey.slice('__dl_'.length); // e.g., '__dl_dl_anonymous_id' -> 'dl_anonymous_id'
+                            // WEB-29: strip ONLY the leading '__'.
+                            //
+                            // This used to strip '__dl_', producing 'dl_anonymous_id' — but that
+                            // is the LOGICAL key callers pass to get(), not the key it reads.
+                            // get() prepends this.prefix ('dl_'), so the value actually lives at
+                            // 'dl_dl_anonymous_id'. The migration therefore wrote to an address
+                            // nothing reads AND then deleted the legacy key below, destroying
+                            // the visitor's id instead of migrating it: a silent visitor reset
+                            // and attribution loss for anyone still on the old prefix.
+                            //
+                            //   legacy real key : __dl_dl_anonymous_id
+                            //   current real key:   dl_dl_anonymous_id   ← strip '__'
+                            //   logical key     :      dl_anonymous_id   ← what get() is called with
+                            //
+                            // NOTE: the double 'dl_dl_' looks like a typo and is not. Renaming
+                            // the prefix would orphan every stored id across the install base.
+                            const actualKey = legacyKey.slice('__'.length); // '__dl_dl_anonymous_id' -> 'dl_dl_anonymous_id'
                             // Only migrate if new key doesn't already exist (don't overwrite newer data)
                             if (!this.storage.getItem(actualKey)) {
                                 this.storage.setItem(actualKey, value);
@@ -794,6 +809,125 @@ var Datalyr = (function (exports) {
         }
         return data;
     }
+    // 9.A.4: query-param NAMES whose VALUES are secrets/PII — password-reset tokens,
+    // OAuth codes, magic-link sessions, emails/phones prefilled into URLs. Events ship
+    // `url` / `referrer` / `landingPage` with the FULL query string (sanitizeEventData
+    // only strips property KEYS, not URL param values), so /reset?token=…&email=… leaked
+    // verbatim into events and onward to ad platforms. Matched case-insensitively.
+    const REDACTED_URL_PARAMS = new Set([
+        'token', 'access_token', 'refresh_token', 'id_token', 'auth', 'authorization',
+        'password', 'pass', 'pwd', 'secret', 'api_key', 'apikey', 'key',
+        'session', 'session_id', 'sid', 'email', 'e', 'phone', 'tel',
+        'signature', 'sig', 'otp', 'reset', 'hash'
+    ]);
+    // BATCH-2(e): `code` is CONDITIONAL, not in the always-redact set above. An OAuth
+    // authorization code (account-takeover-grade if it leaks to ad platforms) ALWAYS travels
+    // with an OAuth-flow marker in the same query/fragment — the response carries `code`+`state`
+    // (+`scope`/`session_state`/`iss`), the authorize request carries `client_id`/`redirect_uri`/
+    // `response_type`/`code_challenge`. A coupon/referral/product code (`?code=SUMMER20`) — a real
+    // attribution signal for the DTC/Shopify ICP — never does. So we redact `code` ONLY when a
+    // marker co-occurs in the same k=v string, preserving marketing codes. (A bare `code=` with no
+    // marker is syntactically indistinguishable from a coupon code and is kept; state-less OAuth
+    // flows are rare and CSRF-unsafe.) Markers are deliberately OAuth-specific to avoid redacting
+    // legitimate codes — `prompt`/`authuser` are excluded as too generic.
+    const OAUTH_CODE_CONTEXT_MARKERS = new Set([
+        'state', 'client_id', 'redirect_uri', 'response_type', 'grant_type',
+        'code_challenge', 'session_state', 'scope', 'iss',
+        // Token family: the presence of any bearer/OAuth token means a bare `code` in the same
+        // string is almost certainly an auth code, not a coupon — a marketing URL never carries
+        // these. (These values are independently redacted too; this only governs `code`.)
+        'access_token', 'id_token', 'refresh_token', 'token'
+    ]);
+    const REDACTED_URL_VALUE = '__redacted__';
+    // Redact denylisted keys in one `k=v&k=v` string (query OR fragment). Returns the
+    // re-encoded string and whether anything was rewritten (so the caller can preserve the
+    // exact original bytes when nothing matched).
+    function redactKvPairs(s) {
+        const params = new URLSearchParams(s);
+        let mutated = false;
+        const keysLower = Array.from(new Set(params.keys())).map(k => k.toLowerCase());
+        // `code` co-occurrence check (BATCH-2e) — evaluated per-string, since an OAuth flow puts
+        // `code` and its marker in the SAME query (or the SAME fragment).
+        const hasOAuthMarker = keysLower.some(k => OAUTH_CODE_CONTEXT_MARKERS.has(k));
+        // Snapshot the keys first — set() collapses duplicate keys mid-iteration.
+        for (const key of Array.from(new Set(params.keys()))) {
+            const lower = key.toLowerCase();
+            const sensitive = lower === 'code'
+                ? hasOAuthMarker
+                : REDACTED_URL_PARAMS.has(lower);
+            if (sensitive) {
+                params.set(key, REDACTED_URL_VALUE);
+                mutated = true;
+            }
+        }
+        return { out: params.toString(), mutated };
+    }
+    /**
+     * Redact secret/PII param VALUES in a URL (9.A.4). The param NAME is kept
+     * (value → `__redacted__`) so funnel steps that match on the param's presence still
+     * work; every other param — click IDs (fbclid/gclid/…) and utm_* — survives untouched.
+     * Both the query string AND a k=v fragment are rewritten: TR-04 — OAuth-implicit /
+     * Supabase magic links carry the session in the FRAGMENT (`/welcome#access_token=eyJ…`),
+     * with no query string at all; the old code returned early on a missing `?` and reattached
+     * the fragment verbatim, leaking the full JWT into `url` / `landingPage` / `dl_first_touch`
+     * (90d) and onward to ad platforms. Non-k=v fragments (`#section`, `#/spa-route`) keep their
+     * shape. Returns the input unchanged when nothing sensitive matched or on any parse
+     * failure — redaction must never break tracking.
+     */
+    function redactUrl(url) {
+        if (!url || typeof url !== 'string')
+            return url;
+        const hashStart = url.indexOf('#');
+        const qIdx = url.indexOf('?');
+        // A query string exists only when '?' appears BEFORE the fragment — a '?' after '#' is
+        // part of the fragment per the URL grammar (e.g. a SPA hash-route `#/reset?token=…`).
+        const queryStart = (qIdx !== -1 && (hashStart === -1 || qIdx < hashStart)) ? qIdx : -1;
+        if (queryStart === -1 && hashStart === -1)
+            return url; // nothing to redact
+        try {
+            const base = url.slice(0, queryStart !== -1 ? queryStart : (hashStart !== -1 ? hashStart : url.length));
+            const query = queryStart === -1 ? '' : url.slice(queryStart + 1, hashStart === -1 ? url.length : hashStart);
+            const rawFragment = hashStart === -1 ? '' : url.slice(hashStart + 1);
+            let mutated = false;
+            let queryOut = query;
+            if (query) {
+                const r = redactKvPairs(query);
+                if (r.mutated) {
+                    queryOut = r.out;
+                    mutated = true;
+                }
+            }
+            // TR-04: redact the fragment when it carries k=v pairs. Two shapes: a pure implicit-flow
+            // fragment (`#access_token=…&refresh_token=…`) and a SPA hash-route with its own query
+            // (`#/reset?access_token=…`). Leave non-k=v fragments (`#section`, `#/route`) untouched.
+            let fragmentOut = rawFragment;
+            if (rawFragment) {
+                const fragQ = rawFragment.indexOf('?');
+                if (fragQ !== -1) {
+                    const r = redactKvPairs(rawFragment.slice(fragQ + 1));
+                    if (r.mutated) {
+                        fragmentOut = rawFragment.slice(0, fragQ + 1) + r.out;
+                        mutated = true;
+                    }
+                }
+                else if (/[\w-]+=/.test(rawFragment)) {
+                    const r = redactKvPairs(rawFragment);
+                    if (r.mutated) {
+                        fragmentOut = r.out;
+                        mutated = true;
+                    }
+                }
+            }
+            if (!mutated)
+                return url; // nothing sensitive matched → ship the exact original bytes
+            return base
+                + (queryStart === -1 ? '' : '?' + queryOut)
+                + (hashStart === -1 ? '' : '#' + fragmentOut);
+        }
+        catch (_a) {
+            return url; // malformed URL → ship as-is rather than drop/break the event
+        }
+    }
     /**
      * Deep merge objects
      */
@@ -924,16 +1058,18 @@ var Datalyr = (function (exports) {
             return {};
         try {
             const url = new URL(referrer);
+            // 9.A.4: the referrer can be our own /reset?token=… or an OAuth callback —
+            // redact secret/PII param values before they're stamped onto the event.
             return {
-                referrer,
+                referrer: redactUrl(referrer),
                 referrer_host: url.hostname,
                 referrer_path: url.pathname,
-                referrer_search: url.search,
+                referrer_search: redactUrl(url.search),
                 referrer_source: detectReferrerSource(url.hostname)
             };
         }
         catch (_a) {
-            return { referrer };
+            return { referrer: redactUrl(referrer) };
         }
     }
     /**
@@ -971,6 +1107,9 @@ var Datalyr = (function (exports) {
         constructor(options = {}) {
             this.userId = null;
             this.sessionId = null;
+            /** WEB-26: bumps whenever the persisted identity changes, so an in-flight
+             *  encrypted write can tell it has been superseded. */
+            this.piiGeneration = 0;
             this.persistNewId = options.persistNewId !== false;
             this.anonymousId = this.getOrCreateAnonymousId();
             this.userId = this.getStoredUserId();
@@ -994,17 +1133,13 @@ var Datalyr = (function (exports) {
                 this.setRootDomainCookie('__dl_visitor_id', anonymousId);
                 return anonymousId;
             }
-            // 2. Fresh visitor (no persisted id): accept a cross-domain bridge id from the URL,
-            //    but ONLY a well-formed anon_<uuid> — reject arbitrary / oversized values (a
-            //    multi-KB or attacker-crafted _dl_vid was previously persisted verbatim). Strip
-            //    it from the address bar so a re-shared URL can't merge the next visitor. (FSR-50)
+            // 2. Raw URL visitor IDs are never identity authority. A syntactically
+            // valid ID is still replayable/attacker-chosen and can merge two people.
+            // Strip the legacy parameter and generate a fresh local identity below.
             try {
                 const urlParams = new URLSearchParams(window.location.search);
-                const urlVisitorId = urlParams.get('_dl_vid');
-                if (urlVisitorId && this.isValidAnonymousId(urlVisitorId)) {
+                if (urlParams.has('_dl_vid')) {
                     this.stripUrlParam('_dl_vid');
-                    this.persistAnonymousId(urlVisitorId);
-                    return urlVisitorId;
                 }
             }
             catch (e) {
@@ -1028,12 +1163,17 @@ var Datalyr = (function (exports) {
             storage.set('dl_anonymous_id', id);
         }
         /**
-         * Whether a `_dl_vid` value is a well-formed Datalyr anonymous id (anon_ + UUID).
-         * The length is bounded by the pattern, so an oversized/garbage value is rejected.
-         * (FSR-50)
+         * TR-15 / FSR-107: tracking became allowed mid-session (optIn / consent grant). Start
+         * persisting AND flush the current in-memory anon id to the cookie + localStorage now.
+         * Without this, a visitor declined at init keeps a memory-only id, so that session's
+         * events land under a visitor_id that vanishes on the next page load (attribution
+         * fragmentation). Idempotent — a no-op once already persisting.
          */
-        isValidAnonymousId(id) {
-            return /^anon_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id);
+        enablePersistence() {
+            if (this.persistNewId)
+                return;
+            this.persistNewId = true;
+            this.persistAnonymousId(this.anonymousId);
         }
         /**
          * Remove a query param from the current URL via history.replaceState (best-effort).
@@ -1096,6 +1236,126 @@ var Datalyr = (function (exports) {
             // corrupted by JSON.parse — both would fragment identity from the second page on.
             return storage.getString('dl_user_id');
         }
+        /**
+         * WEB-22 — is this user id personally identifying, and therefore not
+         * something we may write to localStorage in the clear?
+         *
+         * The auto-identify path calls `identify(email, { email })`, so the raw
+         * address became the `user_id` and was written unencrypted to `dl_user_id`.
+         * Measured 2026-07-25: on the four workspaces using auto-identify, **every**
+         * event carrying a `user_id` had an email in that column (20,502 / 20,502 on
+         * `f6260736` over 7 days) — while the surrounding code went to real lengths to
+         * encrypt the *same* address in `dl_auto_identified_email`.
+         *
+         * Deliberately narrow: an email is the case that actually occurs and the one
+         * the SDK itself creates. Opaque application ids — the overwhelming majority —
+         * keep the existing fast, synchronous, plaintext path with no behaviour change.
+         */
+        static looksLikePII(userId) {
+            return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(userId);
+        }
+        /**
+         * Persist the user id, encrypting it when it is PII.
+         *
+         * Three-way, and the ordering matters:
+         *  - not PII        → plaintext `dl_user_id`, exactly as before (sync, always works)
+         *  - PII + crypto   → encrypted `dl_user_id_pii`, and the plaintext key is REMOVED
+         *  - PII, no crypto → memory only, and both keys removed
+         *
+         * That last branch is the deliberate trade. `crypto.subtle` is absent on
+         * http:// and old browsers, and index.ts is explicit that encryption is for
+         * PII-at-rest only and "must NOT gate event delivery". So we never block an
+         * event — `this.userId` is set in memory first and every event still carries
+         * it — we only decline to *persist* an address we cannot protect. The cost is
+         * that a returning visitor on an insecure origin is re-identified by the next
+         * `identify()` call rather than restored from storage; the alternative is
+         * writing their email to disk in the clear, which is what this fixes.
+         */
+        persistUserId(userId) {
+            if (!IdentityManager.looksLikePII(userId)) {
+                storage.set('dl_user_id', userId);
+                // WEB-26: a previous PII user's encrypted id must not linger once an
+                // opaque id takes over. Reachable when identify('opaque') runs before
+                // hydrateEncryptedUserId() has populated this.userId, so index.ts sees no
+                // current user and skips its account-switch reset().
+                this.piiGeneration += 1;
+                storage.remove('dl_user_id_pii');
+                return;
+            }
+            // Never leave a plaintext copy behind — including one written by a previous
+            // SDK version before this fix existed.
+            storage.remove('dl_user_id');
+            // WEB-26: the encrypted write is async, and reset()/optOut()/consent
+            // withdrawal are not. Without a generation guard this sequence resurrects a
+            // logged-out user's email: identify(email) → write pending →
+            // remove('dl_user_id_pii') deletes NOTHING because the write has not landed
+            // → the write lands → next page load hydrates the previous user's address
+            // and every event ships user_id = their email. Stamp the write and discard
+            // it if the identity moved on while it was in flight.
+            const generation = ++this.piiGeneration;
+            storage.setEncrypted('dl_user_id_pii', userId)
+                .then(() => {
+                if (generation !== this.piiGeneration)
+                    storage.remove('dl_user_id_pii');
+            })
+                .catch(() => {
+                // No crypto.subtle (http://, legacy browser) or a storage failure. Drop
+                // the at-rest copy rather than falling back to plaintext PII — but only
+                // if this write is still the current one, or we would delete a newer
+                // user's successfully-written value.
+                if (generation === this.piiGeneration)
+                    storage.remove('dl_user_id_pii');
+            });
+        }
+        /**
+         * Restore a PII user id that was persisted encrypted. Async by necessity, so
+         * it cannot run in the constructor; index.ts calls it during init, right after
+         * `dataEncryption.initialize()`.
+         *
+         * Never overwrites an id already established this page load — an explicit
+         * `identify()` that has already run is fresher than anything on disk.
+         */
+        hydrateEncryptedUserId() {
+            return __awaiter(this, void 0, void 0, function* () {
+                // WEB-26 (a) — migrate a plaintext address written by <= 1.7.7.
+                //
+                // persistUserId() only removes `dl_user_id` when identify() runs again, and
+                // for the exact population this fix targets it never does:
+                // AutoIdentifyManager.initialize() returns early while
+                // `dl_auto_identified_email` exists (auto-identify.ts:88), so the callback
+                // never fires. Without this the raw email would sit in localStorage forever
+                // on every already-auto-identified browser.
+                const legacy = storage.getString('dl_user_id');
+                if (legacy && IdentityManager.looksLikePII(legacy)) {
+                    if (!this.userId)
+                        this.userId = legacy;
+                    this.persistUserId(legacy);
+                    return;
+                }
+                // WEB-26 (b) — recover a write that was dropped because encryption was not
+                // keyed yet. index.ts sets `initialized = true` before initializeAsync()
+                // finishes, so the documented `init(); identify(email)` pattern can reach
+                // persistUserId() before dataEncryption has a key; that write rejects and
+                // nothing is persisted. By here the key exists, so retry once.
+                if (this.userId && IdentityManager.looksLikePII(this.userId)) {
+                    const alreadyStored = yield storage.getEncrypted('dl_user_id_pii', null);
+                    if (!alreadyStored)
+                        this.persistUserId(this.userId);
+                    return;
+                }
+                if (this.userId)
+                    return;
+                try {
+                    const stored = yield storage.getEncrypted('dl_user_id_pii', null);
+                    if (typeof stored === 'string' && stored && !this.userId) {
+                        this.userId = stored;
+                    }
+                }
+                catch (_a) {
+                    // Undecryptable (rotated key, corrupt blob) — stay anonymous.
+                }
+            });
+        }
         /**
          * Get the anonymous ID
          */
@@ -1144,8 +1404,9 @@ var Datalyr = (function (exports) {
             }
             const previousUserId = this.userId;
             this.userId = userId;
-            // Persist for future sessions
-            storage.set('dl_user_id', userId);
+            // Persist for future sessions. WEB-22: encrypted when the id is PII (the
+            // auto-identify path makes it the raw email); plaintext otherwise.
+            this.persistUserId(userId);
             // Return identity link data (will be sent as $identify event)
             return {
                 anonymous_id: this.anonymousId,
@@ -1168,7 +1429,7 @@ var Datalyr = (function (exports) {
             // Update current user ID if aliasing to current anonymous ID
             if (!previousId || previousId === this.anonymousId) {
                 this.userId = userId;
-                storage.set('dl_user_id', userId);
+                this.persistUserId(userId);
             }
             return aliasData;
         }
@@ -1178,7 +1439,12 @@ var Datalyr = (function (exports) {
          */
         reset() {
             this.userId = null;
+            // WEB-26: invalidate any encrypted write still in flight.
+            this.piiGeneration += 1;
             storage.remove('dl_user_id');
+            // WEB-22: the encrypted PII copy must go too, or a logout would leave the
+            // previous user's email at rest.
+            storage.remove('dl_user_id_pii');
             storage.remove('dl_user_traits');
             // Generate new anonymous ID for privacy
             this.anonymousId = `anon_${generateUUID()}`;
@@ -1505,6 +1771,12 @@ var Datalyr = (function (exports) {
                 'gbraid', // Google Ads (iOS)
                 'wbraid', // Google Ads (web)
                 'ttclid', // TikTok
+                // WEB-28: OpenAI Ads. Captured by iOS and React Native since launch but
+                // never by the web SDK, so every OpenAI Ads *web* conversion delivered with
+                // attribution_type: none unless the customer passed the value by hand.
+                // Placed after the Google block to match the mobile SDKs' ordering — the
+                // first click id present wins, and this must not outrank fbclid/gclid.
+                'oppref', // OpenAI Ads
                 'msclkid', // Microsoft/Bing
                 'twclid', // Twitter/X
                 'li_fat_id', // LinkedIn
@@ -1524,6 +1796,10 @@ var Datalyr = (function (exports) {
             this.CLICK_ID_ALIASES = {
                 ScCid: 'sclid',
                 sccid: 'sclid',
+                // Impact's real landing param is `irclickid`; capture it and normalize to the canonical
+                // `irclid` that ingest / the MV / the source map (`irclid→impact`) all key on. Without
+                // this, real Impact affiliate clicks were dark on web (only bare `irclid` was captured).
+                irclickid: 'irclid',
             };
             // Default tracked params matching dl.js
             this.DEFAULT_TRACKED_PARAMS = [
@@ -1534,9 +1810,18 @@ var Datalyr = (function (exports) {
                 'medium', // Generic medium (non-UTM)
                 'gad_source' // Google Ads source parameter
             ];
+            // TR-03: ad-cookie fields (Meta/Google Ads/TikTok/Snap) that are MARKETING-scoped. When
+            // marketing consent is declined these are neither synthesized/written nor shipped. Google
+            // Analytics cookies (_ga/_gid) and utm_* stay — they're analytics-scoped.
+            this.MARKETING_COOKIES = ['_fbp', '_fbc', '_gcl_aw', '_gcl_dc', '_gcl_gb', '_gcl_ha', '_gac', '_ttp', '_ttc', '_scid'];
             this.attributionWindow = options.attributionWindow || 90 * 24 * 60 * 60 * 1000; // 90 days (increased from 30 for B2B sales cycles)
             // Merge default tracked params with user-provided ones
             this.trackedParams = [...this.DEFAULT_TRACKED_PARAMS, ...(options.trackedParams || [])];
+            this.marketingAllowedFn = options.marketingAllowed;
+        }
+        // TR-03: default (no predicate / no signal) = allowed → byte-identical to prior behavior.
+        isMarketingAllowed() {
+            return this.marketingAllowedFn ? this.marketingAllowedFn() !== false : true;
         }
         /**
          * Clear query params cache (called on page navigation)
@@ -1607,13 +1892,15 @@ var Datalyr = (function (exports) {
                     attribution[param] = value;
                 }
             }
-            // Capture referrer
+            // Capture referrer. 9.A.4: redact secret/PII query-param values (reset tokens,
+            // OAuth codes, emails) — this attribution object is stamped onto every event AND
+            // persisted into dl_first_touch/dl_last_touch, so it must be clean at capture.
             if (document.referrer) {
-                attribution.referrer = document.referrer;
+                attribution.referrer = redactUrl(document.referrer);
                 attribution.referrerHost = this.extractHostname(document.referrer);
             }
-            // Capture landing page
-            attribution.landingPage = window.location.href;
+            // Capture landing page (redacted — see referrer note above)
+            attribution.landingPage = redactUrl(window.location.href);
             attribution.landingPath = window.location.pathname;
             // Determine source if not explicitly set
             if (!attribution.source) {
@@ -1709,6 +1996,10 @@ var Datalyr = (function (exports) {
         captureAdCookies() {
             var _a, _b;
             const adCookies = {};
+            // TR-03: when marketing consent is declined, do NOT synthesize/write the Meta/Google ad
+            // cookies below (writing _fbp/_fbc is active marketing use). Existing cookies are still
+            // read here but stripped from the event payload in getAttributionData().
+            const marketingAllowed = this.isMarketingAllowed();
             // Facebook/Meta cookies
             adCookies._fbp = cookies.get('_fbp');
             adCookies._fbc = cookies.get('_fbc');
@@ -1727,8 +2018,8 @@ var Datalyr = (function (exports) {
             // Snapchat first-party cookie (Snap Pixel sets _scid). Flows to the server as
             // cookies._scid and is sent on the Snap CAPI event as sc_cookie1 (raw).
             adCookies._scid = cookies.get('_scid');
-            // Generate _fbp if missing (Facebook browser ID)
-            if (!adCookies._fbp && (this.hasClickId('fbclid') || adCookies._fbc)) {
+            // Generate _fbp if missing (Facebook browser ID). TR-03: only when marketing is allowed.
+            if (marketingAllowed && !adCookies._fbp && (this.hasClickId('fbclid') || adCookies._fbc)) {
                 const timestamp = Date.now();
                 // Meta's _fbp format is fb.1.<creationTimeMs>.<randomNumber> where the last
                 // segment MUST be a decimal integer. The old base36 string was non-conformant —
@@ -1752,7 +2043,8 @@ var Datalyr = (function (exports) {
             // Shopify cart / server-side rebuild forward it as a time, so its format must not
             // change.
             const fbclid = this.getCurrentFbclid();
-            if (fbclid) {
+            // TR-03: skip _fbc synthesis/refresh (cookie write) when marketing is declined.
+            if (marketingAllowed && fbclid) {
                 const existingFbc = adCookies._fbc; // captured above (cookies.get('_fbc'))
                 const embeddedFbclid = this.extractFbclidFromFbc(existingFbc);
                 if (!existingFbc) {
@@ -1782,7 +2074,7 @@ var Datalyr = (function (exports) {
             // (gclid has no synthesized-and-going-stale artifact like _fbc, and Google does not
             // validate a creationTime window the way Meta does, so this stays once-only.)
             const gclid = this.hasClickId('gclid') ? ((_b = (_a = this.queryParamsCache) === null || _a === void 0 ? void 0 : _a.gclid) !== null && _b !== void 0 ? _b : null) : null;
-            if (gclid && !cookies.get('_dl_gclid_at')) {
+            if (marketingAllowed && gclid && !cookies.get('_dl_gclid_at')) {
                 cookies.set('_dl_gclid_at', String(Date.now()), 90);
             }
             // Filter out null values for cleaner data
@@ -1833,8 +2125,21 @@ var Datalyr = (function (exports) {
             // The old `hasCurrentAttribution` (truthy because source is always at least 'direct')
             // made the fallback below dead code AND caused storeLastTouch to overwrite a real
             // paid last-touch with 'direct'/'none' on the next internal navigation. (WEB NEW-1)
+            // `lyr` counts as a real signal. It is the Datalyr tracking-link tag — the one
+            // attribution parameter the product itself tells customers to put on a URL — and
+            // omitting it meant a bare `?lyr=X` landing (no UTMs, no click id) scored FALSE:
+            // the fallback below then replaced `current` wholesale with the stored touch,
+            // discarding the tag that had just been parsed, and neither store* call ran, so it
+            // never persisted either. Measured 2026-07-25 on the one workspace whose links are
+            // bare: 96 landing URLs carried `lyr=`, 93 events kept it — 3 lost (3.1%), all of
+            // them returning visitors (a first-time visitor has no stored touch to be replaced
+            // by, which is the only reason the number is 3 and not 96). The edge worker's own
+            // `buildDestination` emits exactly this URL shape when a link defines no UTMs.
+            // iOS (AttributionManager.swift) and React Native persist `lyr` unconditionally;
+            // this brings web into line.
             const hasRealAttribution = !!(current.clickId ||
                 current.campaign ||
+                current.lyr ||
                 (current.source && current.source !== 'direct'));
             // Direct / internal navigation: fall back to persisted attribution so the event
             // isn't mis-attributed to 'direct'. FSR-48: prefer the LAST touch (the most recent
@@ -1860,7 +2165,7 @@ var Datalyr = (function (exports) {
             if (hasRealAttribution) {
                 this.storeLastTouch(current);
             }
-            return Object.assign(Object.assign(Object.assign({}, current), adCookies), { 
+            const result = Object.assign(Object.assign(Object.assign({}, current), adCookies), { 
                 // First touch (with snake_case aliases)
                 first_touch_source: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.source, first_touch_medium: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.medium, first_touch_campaign: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.campaign, first_touch_timestamp: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.timestamp, firstTouchSource: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.source, firstTouchMedium: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.medium, firstTouchCampaign: firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.campaign, 
                 // Last touch (with snake_case aliases)
@@ -1871,6 +2176,21 @@ var Datalyr = (function (exports) {
                     : 0, daysSinceFirstTouch: (firstTouch === null || firstTouch === void 0 ? void 0 : firstTouch.timestamp)
                     ? Math.floor((Date.now() - firstTouch.timestamp) / 86400000)
                     : 0 });
+            // TR-03: strip MARKETING-scoped signals (click IDs + ad cookies) from the event payload
+            // when marketing consent is declined — analytics-scoped fields (utm_*, source/medium/
+            // campaign, first/last touch, _ga/_gid) stay. Live predicate → a later grant restores
+            // them on the next event. Synthesis of _fbp/_fbc was already skipped in captureAdCookies.
+            if (!this.isMarketingAllowed()) {
+                const marketingKeys = [
+                    ...this.CLICK_IDS,
+                    ...Object.values(this.CLICK_ID_ALIASES),
+                    'clickId', 'clickIdType',
+                    ...this.MARKETING_COOKIES,
+                ];
+                for (const k of marketingKeys)
+                    delete result[k];
+            }
+            return result;
         }
         /**
          * Determine source from attribution data
@@ -1881,13 +2201,19 @@ var Datalyr = (function (exports) {
                 const clickIdSources = {
                     fbclid: 'facebook',
                     gclid: 'google',
+                    gbraid: 'google', // 9.A.6: Google Ads (iOS) — was falling through to 'paid'
+                    wbraid: 'google', // 9.A.6: Google Ads (web)
                     ttclid: 'tiktok',
                     msclkid: 'bing',
                     twclid: 'twitter',
                     li_fat_id: 'linkedin',
                     sclid: 'snapchat',
                     dclid: 'doubleclick',
-                    epik: 'pinterest'
+                    epik: 'pinterest',
+                    rdt_cid: 'reddit', // 9.A.6
+                    obclid: 'outbrain', // 9.A.6
+                    irclid: 'impact', // 9.A.6: Impact Radius
+                    ko_click_id: 'klaviyo' // 9.A.6
                 };
                 return clickIdSources[attribution.clickIdType] || 'paid';
             }
@@ -2013,15 +2339,20 @@ var Datalyr = (function (exports) {
     const DEFAULT_CRITICAL_EVENTS = ['purchase', 'signup', 'subscribe', 'lead', 'conversion'];
     // Default high priority events that use faster batching
     const DEFAULT_HIGH_PRIORITY_EVENTS = ['add_to_cart', 'begin_checkout', 'view_item', 'search'];
-    // A 429 is a deliberate backpressure signal, not a transient failure — tagged so the
-    // send path can route it to the offline queue WITHOUT retrying (which would storm the
-    // already-overloaded server). See sendBatch / the rateLimitedUntil gate.
+    // WEB-23: how long to stop sending after a 403 (origin not allowed). Long enough not to
+    // hammer a rejecting origin, short enough that a server-side config fix is picked up
+    // within the same visit. A 403 carries no Retry-After, so this is fixed.
+    const ORIGIN_REJECTED_BACKOFF_MS = 5 * 60 * 1000;
+    // Backpressure, not failure — routed to the offline queue WITHOUT retrying (which would
+    // storm an already-overloaded server) and gated behind rateLimitedUntil. Raised for a 429
+    // and, since WEB-23, for a 403: both mean "not now", not "never". See sendBatch.
     class RateLimitError extends Error {
     }
-    // A permanent (non-retryable) failure — a 4xx other than 408/429 (invalid event shape,
-    // origin not allowed, auth). Retrying or parking it just head-of-line-blocks the offline
-    // queue forever and hammers ingest. Tagged so the send paths DROP the batch instead of
-    // unshifting it back to the head. (FSR-55)
+    // A permanent (non-retryable) failure — a 4xx other than 403/408/429, i.e. an invalid
+    // event shape (400) or bad auth (401). Retrying or parking it just head-of-line-blocks
+    // the offline queue forever and hammers ingest. Tagged so the send paths DROP the batch
+    // instead of unshifting it back to the head. (FSR-55, narrowed by WEB-23 — a 403 is
+    // server *configuration* state and does change, so it is no longer in this class.)
     class PermanentError extends Error {
         constructor(status, message) {
             super(message || `HTTP ${status}`);
@@ -2044,6 +2375,11 @@ var Datalyr = (function (exports) {
             this.inFlight = []; // FIXED (WEB-3): batch currently in _flight's keepalive fetch — forceFlush must NOT re-beacon it
             this.enabled = true; // FIXED (consent): when false (opt-out / withdrawn analytics consent) all enqueue/flush/drain is a no-op
             this.rateLimitedUntil = 0; // FIXED (429): skip flush/drain until the server's Retry-After window passes
+            // WEB-23: permanent drops used to be invisible — a debug-gated log line and
+            // nothing else, so 11 days of 403s looked identical to a healthy queue. Counted
+            // here and exposed via getStats() so a drop is at least observable.
+            this.droppedEventCount = 0;
+            this.lastDropStatus = null;
             // Coerce numeric config to sane values. The old `config.X || default` both turned a
             // legitimate 0 into the default AND let invalid values through — a NEGATIVE batchSize
             // made processOfflineQueue's `splice(0, -1)` loop forever and FREEZE the host tab.
@@ -2269,7 +2605,12 @@ var Datalyr = (function (exports) {
                     // FSR-55: don't park a permanently-rejected batch — it would never succeed and
                     // would block the offline drain. Drop it.
                     if (error instanceof PermanentError) {
-                        this.log(`Dropping ${events.length} events — permanent error ${error.status}`);
+                        this.droppedEventCount += events.length;
+                        this.lastDropStatus = error.status;
+                        // console.warn, not this.log: a silent drop is the failure mode that let the
+                        // 2026-07-13 outage run for 11 days. This must be visible without debug mode.
+                        console.warn(`[Datalyr Queue] Dropped ${events.length} events — permanent error ${error.status}. ` +
+                            `${this.droppedEventCount} dropped this session.`);
                     }
                     else {
                         this.moveToOfflineQueue(events);
@@ -2331,9 +2672,24 @@ var Datalyr = (function (exports) {
                             this.log(`Rate limited; backing off ${retryAfter}s`);
                             throw new RateLimitError('Rate limited (429)');
                         }
-                        // FSR-55: a 4xx other than 408 (timeout) is PERMANENT — invalid event shape
-                        // (400), origin not allowed (403), auth (401). Retrying / parking it just blocks
-                        // the queue and hammers ingest forever. Tag it so the caller drops the batch.
+                        // WEB-23: a 403 is NOT permanent — it is server *configuration* state, and it
+                        // changes. On 2026-07-13 an allowed_origins regression made ingest reject three
+                        // workspaces with 403; the config was fixed 11 days later, but every event sent
+                        // in between had already been dropped on the floor by the FSR-55 rule below.
+                        // Eleven days of data, unrecoverable, with only a debug log to show for it.
+                        //
+                        // Treated like 429 instead: park the events offline behind a backoff window, so
+                        // we neither hammer a rejecting origin (FSR-55's real concern) nor discard data
+                        // that would have been accepted an hour later. The window is fixed because a 403
+                        // carries no Retry-After.
+                        if (response.status === 403) {
+                            this.rateLimitedUntil = Date.now() + ORIGIN_REJECTED_BACKOFF_MS;
+                            this.log(`Origin rejected (403); backing off ${ORIGIN_REJECTED_BACKOFF_MS / 1000}s and parking events`);
+                            throw new RateLimitError('Origin rejected (403)');
+                        }
+                        // FSR-55: a 4xx other than 403/408 (timeout) is PERMANENT — invalid event shape
+                        // (400) or auth (401). Retrying / parking it just blocks the queue and hammers
+                        // ingest forever. Tag it so the caller drops the batch.
                         if (response.status >= 400 && response.status < 500 && response.status !== 408) {
                             throw new PermanentError(response.status, `HTTP ${response.status}: ${response.statusText}`);
                         }
@@ -2420,9 +2776,25 @@ var Datalyr = (function (exports) {
             // purge. Gating here (a persistence sink, not just the send sinks) closes it.
             if (!this.enabled)
                 return;
-            // FIXED (DATA-03): Check if offline queue operation already in progress
+            // WEB-24. This early return used to `return` outright — losing the batch, because
+            // _flush() has ALREADY spliced these events out of the live queue before calling
+            // here, so they would exist in neither queue.
+            //
+            // Verified 2026-07-25 that the loss is NOT currently reachable: this method is the
+            // only user of offlineQueueLock, its critical section is fully synchronous (push,
+            // splice, then a synchronous saveOfflineQueue → storage.set), and JS is
+            // single-threaded — so the flag can never be observed set on entry. The path is
+            // dead code today, and the review's "drops the batch on lock contention" is REFUTED
+            // as a live loss path.
+            //
+            // It is kept and made safe anyway, because it is one `await` away from being live:
+            // the moment saveOfflineQueue becomes async (IndexedDB, encrypted-at-rest storage,
+            // anything), contention becomes real and silent data loss returns instantly.
+            // Enqueue first, then bail — the events are never dropped either way.
             if (this.offlineQueueLock) {
-                console.warn('[Datalyr Queue] Offline queue operation already in progress');
+                console.warn('[Datalyr Queue] Offline queue busy; buffering events without persisting');
+                if (events)
+                    this.offlineQueue.push(...events);
                 return;
             }
             // Acquire lock
@@ -2441,6 +2813,10 @@ var Datalyr = (function (exports) {
                 if (this.offlineQueue.length > this.config.maxOfflineQueueSize) {
                     const excess = this.offlineQueue.length - this.config.maxOfflineQueueSize;
                     this.offlineQueue.splice(0, excess); // Remove oldest events
+                    // WEB-27: overflow is data loss too, and a sustained 403/park loop is
+                    // exactly what produces it. Count it rather than trimming silently.
+                    this.droppedEventCount += excess;
+                    console.warn(`[Datalyr Queue] Offline queue full — dropped ${excess} oldest event(s).`);
                 }
                 this.saveOfflineQueue();
             }
@@ -2513,6 +2889,16 @@ var Datalyr = (function (exports) {
                 // two of them could splice the same offlineQueue concurrently and double-send.
                 if (!this.enabled)
                     return;
+                // TR-15: re-check consent at DRAIN time. A returning DECLINED visitor whose consent
+                // signal loads asynchronously (Shopify customerPrivacy) fires no visitorConsentCollected
+                // event, so `enabled` stayed at its fail-open init value. If consent now says no, latch
+                // off and PURGE the persisted backlog instead of draining it (a later grant re-enables
+                // via setEnabled). Mirrors the withdrawal purge in optOut()/setConsent().
+                if (this.consentCheck && this.consentCheck() === false) {
+                    this.enabled = false;
+                    this.clearOffline();
+                    return;
+                }
                 if (Date.now() < this.rateLimitedUntil)
                     return; // FIXED (429): honor Retry-After window
                 if (this.offlineProcessing)
@@ -2539,7 +2925,15 @@ var Datalyr = (function (exports) {
                             // that would block every event behind it forever and hammer ingest every tick.
                             // Drop it (already spliced off the front) and keep draining the rest.
                             if (error instanceof PermanentError) {
-                                this.log(`Dropping poison offline batch (${batch.length}) — permanent error ${error.status}`);
+                                // WEB-27: count and surface these too. WEB-23's whole effect is to
+                                // PARK more batches offline, so the drain — not the live flush — is
+                                // where drops now predominantly happen. Counting only _flush left the
+                                // dominant loss path invisible, which is the exact failure mode the
+                                // counter was added to end.
+                                this.droppedEventCount += batch.length;
+                                this.lastDropStatus = error.status;
+                                console.warn(`[Datalyr Queue] Dropped ${batch.length} offline events — permanent error ${error.status}. ` +
+                                    `${this.droppedEventCount} dropped this session.`);
                                 this.saveOfflineQueue();
                                 continue;
                             }
@@ -2572,6 +2966,23 @@ var Datalyr = (function (exports) {
         getOfflineQueueSize() {
             return this.offlineQueue.length;
         }
+        /**
+         * WEB-23: queue health, including events the SDK gave up on.
+         *
+         * `droppedEvents` is the number this session discarded as permanently rejected
+         * (a 400/401). It exists because a silent drop is precisely the failure mode
+         * that let the 2026-07-13 `allowed_origins` outage run for eleven days looking
+         * exactly like a healthy queue. A non-zero value here means data was lost.
+         */
+        getStats() {
+            return {
+                queued: this.queue.length,
+                offline: this.offlineQueue.length,
+                droppedEvents: this.droppedEventCount,
+                lastDropStatus: this.lastDropStatus,
+                backoffUntil: this.rateLimitedUntil,
+            };
+        }
         /**
          * Get network status
          */
@@ -2604,10 +3015,13 @@ var Datalyr = (function (exports) {
          *  - Non-terminal (tab switch): deliver the LIVE queue via a response-checked keepalive
          *    fetch (flush) and response-check-drain the offline backlog (processOfflineQueue) —
          *    neither erases the backlog on failure. The destructive beacon path is not used.
-         *  - Terminal (unload): beacon live+offline best-effort, but PERSIST everything first
-         *    and NEVER storage.remove() on a mere beacon enqueue. The next page load's
-         *    response-checked drain (normal fetch, no 64KB cap) is the source of truth and
-         *    clears the copy; server event_id dedup makes the potential double-send safe.
+         *  - Terminal (unload): PERSIST everything first (live + the already-persisted offline
+         *    backlog) and NEVER storage.remove() on a mere beacon enqueue. Beacon ONLY the LIVE
+         *    queue best-effort — NOT the offline backlog (TR-13): the backlog is already durable and
+         *    the next-load drain delivers it exactly once, so beaconing it here too risked a
+         *    delivered-now-AND-re-drained-next-load double-send that, when >6h apart, outlives
+         *    ingest's dedup window → a duplicate purchase. The next page load's response-checked
+         *    drain (normal fetch, no 64KB cap) is the source of truth and clears the copy.
          *  - Both paths honor rateLimitedUntil (don't beacon/flush into the backoff window).
          *
          * Still excludes the in-flight _flush batch (its keepalive fetch already carries it,
@@ -2649,6 +3063,14 @@ var Datalyr = (function (exports) {
                     }
                     storage.set(this.OFFLINE_QUEUE_KEY, toPersist);
                 }
+                // TR-13: beacon ONLY the LIVE queue (never-persisted events from THIS session). The
+                // offline backlog is already durable and the next-load drain delivers it once, so
+                // beaconing it here would double-send it — and a stale backlog event (e.g. a purchase
+                // parked during an outage) re-drained on a later day lands >6h from the beacon, past
+                // ingest's dedup window. The live queue's beacon + its own next-load drain both land THIS
+                // session (<6h), so dedup absorbs that pair.
+                if (live.length === 0)
+                    return; // only the persisted backlog remained → it drains next load
                 // Within the 429 window, don't beacon into it — the persisted copy drains next load.
                 if (Date.now() < this.rateLimitedUntil)
                     return;
@@ -2659,7 +3081,7 @@ var Datalyr = (function (exports) {
                 const chunks = [];
                 let current = [];
                 let currentBytes = 2; // approx for the JSON array/object wrapper
-                for (const ev of pending) {
+                for (const ev of live) {
                     // Byte length (not UTF-16 .length) so multibyte product names / emoji can't
                     // under-count and overflow the cap.
                     const evBytes = new Blob([JSON.stringify(ev)]).size + 1;
@@ -2685,7 +3107,7 @@ var Datalyr = (function (exports) {
                         break;
                     beaconed += chunk.length;
                 }
-                this.log(`forceFlush(terminal): beaconed ${beaconed}/${pending.length} events; persisted copy retained for next-load drain`);
+                this.log(`forceFlush(terminal): beaconed ${beaconed}/${live.length} live events; backlog (${pending.length - live.length}) persisted for next-load drain`);
             });
         }
         /**
@@ -2706,6 +3128,15 @@ var Datalyr = (function (exports) {
         setEnabled(enabled) {
             this.enabled = enabled;
         }
+        /**
+         * TR-15: register a live consent predicate the offline drain re-evaluates at drain time.
+         * `enabled` is latched at init to a fail-open value (Shopify's customerPrivacy loads
+         * async), and a returning DECLINED visitor fires no visitorConsentCollected event — so
+         * without this, their persisted backlog would drain before the decline is known.
+         */
+        setConsentCheck(fn) {
+            this.consentCheck = fn;
+        }
         /**
          * Clear the offline queue and its persisted copy (used by opt-out to purge any
          * PII-bearing events that were parked before the user opted out).
@@ -4180,6 +4611,256 @@ var Datalyr = (function (exports) {
     // someone else (and feeds that person's email to Meta advanced matching).
     AutoIdentifyManager.THIRD_PARTY_EMAIL_FIELD = /(recipient|friend|gift|refer|invite|colleague|coworker|share|to[-_]?email|email[-_]?to|second(ary)?[-_]?email)/i;
 
+    /**
+     * Stripe Checkout Session capture.
+     *
+     * WHY THIS EXISTS
+     * syncStripePaymentLinks stamps `client_reference_id` onto buy.stripe.com
+     * anchors, and deliberately never onto checkout.stripe.com — a Checkout Session
+     * URL ignores the param because the session already exists server-side. That
+     * leaves the single most common SaaS pattern uncovered: the merchant's backend
+     * creates a Session and the browser is sent to checkout.stripe.com/c/pay/cs_...
+     * The payment then reaches our webhook with no visitor at all.
+     *
+     * Measured 2026-07-25, 30d: of payers arriving via Stripe webhooks, 0.5% (one
+     * tenant, 128/28,187) and 13.3% (another, 13/98) had ANY web pageview on the
+     * same visitor. Not a misconfiguration — no tenant is wired, because being
+     * wired currently requires the merchant to hand-write client_reference_id.
+     *
+     * WHAT THIS DOES
+     * The session id must reach the browser for the redirect to happen at all, so
+     * we observe it rather than trying to inject anything:
+     *   1. fetch/XHR response bodies      — `{url}` or `{sessionId}` from the
+     *                                       merchant's own create-session endpoint
+     *   2. anchor clicks + window.open    — direct links to checkout.stripe.com
+     * A server-side 302 straight to Stripe never exposes the id to JS and is NOT
+     * covered here; that case falls back to the email bridge.
+     *
+     * WHY THIS IS SAFE TO DEFAULT ON, WHEN autoIdentifyAPI IS NOT
+     * autoIdentifyAPI scans the same traffic for EMAILS, which is why it defaults
+     * off: an admin viewing a customer record gets identified as that customer, and
+     * a wrong email propagates into Meta advanced matching. A `cs_live_...` token is
+     * unambiguous, belongs to exactly one checkout, and is not PII. There is no
+     * mis-identification failure mode to guard against — only the wrapper itself,
+     * which is why every hook below is transparent and failure-isolated.
+     */
+    /** Stripe Checkout Session ids: cs_live_… / cs_test_… */
+    const SESSION_ID_RE = /cs_(?:live|test)_[A-Za-z0-9]{8,}/;
+    /** Hosts whose URLs carry a session id in the path. Exact match, never substring. */
+    const CHECKOUT_HOSTS = new Set(['checkout.stripe.com']);
+    /**
+     * Response bodies are scanned in full, so cap what we're willing to read. A
+     * create-session response is a few hundred bytes; anything large is not it, and
+     * reading it would cost the merchant's page real memory and main-thread time.
+     */
+    const MAX_SCAN_BYTES = 65536;
+    /** Bodies worth scanning. Stripe ids arrive as JSON or text, never as binary. */
+    const SCANNABLE_TYPE_RE = /(json|text|javascript)/i;
+    function extractSessionId(text) {
+        if (!text)
+            return null;
+        const m = SESSION_ID_RE.exec(text);
+        return m ? m[0] : null;
+    }
+    /**
+     * True when `href` points at a Stripe-hosted checkout. Uses the URL API and
+     * exact host equality — `a[href*="checkout.stripe.com"]` would match
+     * `evil.com/checkout.stripe.com/x` and `checkout.stripe.com.evil.com`.
+     */
+    function isCheckoutUrl(href, base) {
+        try {
+            const host = new URL(href, base !== null && base !== void 0 ? base : (typeof window !== 'undefined' ? window.location.href : undefined)).hostname.toLowerCase();
+            return CHECKOUT_HOSTS.has(host);
+        }
+        catch (_a) {
+            return false;
+        }
+    }
+    class StripeSessionWatcher {
+        constructor(options = {}) {
+            var _a, _b;
+            this.seen = new Set();
+            this.disposers = [];
+            this.started = false;
+            this.maxSessions = (_a = options.maxSessions) !== null && _a !== void 0 ? _a : 5;
+            this.maxScanBytes = (_b = options.maxScanBytes) !== null && _b !== void 0 ? _b : MAX_SCAN_BYTES;
+        }
+        start(sink) {
+            if (this.started || typeof window === 'undefined')
+                return;
+            this.started = true;
+            this.sink = sink;
+            this.hookFetch();
+            this.hookXhr();
+            this.hookClicks();
+            this.hookWindowOpen();
+        }
+        stop() {
+            // Restore in reverse so a later wrapper never re-installs an earlier one.
+            for (const dispose of this.disposers.reverse()) {
+                try {
+                    dispose();
+                }
+                catch (_a) {
+                    /* idempotent */
+                }
+            }
+            this.disposers = [];
+            this.started = false;
+            this.sink = undefined;
+        }
+        /** Report a session id at most once, and never more than maxSessions per page. */
+        emit(sessionId) {
+            var _a;
+            if (!sessionId || this.seen.has(sessionId))
+                return;
+            if (this.seen.size >= this.maxSessions)
+                return;
+            this.seen.add(sessionId);
+            try {
+                (_a = this.sink) === null || _a === void 0 ? void 0 : _a.call(this, sessionId);
+            }
+            catch (_b) {
+                // A throwing sink must never surface inside the merchant's fetch chain.
+            }
+        }
+        /**
+         * Scan a Response WITHOUT disturbing the merchant's own read. `clone()` must
+         * happen synchronously, before the caller can consume the body; the read of
+         * the clone is deliberately not awaited by the caller.
+         */
+        scanResponse(response) {
+            var _a, _b, _c, _d, _e, _f;
+            try {
+                const type = (_c = (_b = (_a = response.headers) === null || _a === void 0 ? void 0 : _a.get) === null || _b === void 0 ? void 0 : _b.call(_a, 'content-type')) !== null && _c !== void 0 ? _c : '';
+                if (type && !SCANNABLE_TYPE_RE.test(type))
+                    return;
+                const declared = Number((_f = (_e = (_d = response.headers) === null || _d === void 0 ? void 0 : _d.get) === null || _e === void 0 ? void 0 : _e.call(_d, 'content-length')) !== null && _f !== void 0 ? _f : NaN);
+                if (Number.isFinite(declared) && declared > this.maxScanBytes)
+                    return;
+                const clone = typeof response.clone === 'function' ? response.clone() : null;
+                if (!clone)
+                    return;
+                void clone
+                    .text()
+                    .then((body) => this.emit(extractSessionId(body.slice(0, this.maxScanBytes))))
+                    .catch(() => {
+                    /* body already disturbed / opaque response — nothing to do */
+                });
+            }
+            catch (_g) {
+                /* never let observation break the request */
+            }
+        }
+        hookFetch() {
+            if (typeof window.fetch !== 'function')
+                return;
+            const original = window.fetch;
+            const self = this;
+            const patched = function patchedFetch(...args) {
+                const result = original.apply(this !== null && this !== void 0 ? this : window, args);
+                try {
+                    // Attach passively: the merchant still gets the original promise, and a
+                    // rejection here is theirs to handle, not ours to observe twice.
+                    result.then((response) => self.scanResponse(response)).catch(() => { });
+                }
+                catch (_a) {
+                    /* ignore */
+                }
+                return result;
+            };
+            window.fetch = patched;
+            this.disposers.push(() => {
+                // Only restore if nobody wrapped us afterwards — clobbering a later
+                // wrapper would silently disable whatever installed it.
+                if (window.fetch === patched)
+                    window.fetch = original;
+            });
+        }
+        hookXhr() {
+            if (typeof XMLHttpRequest === 'undefined')
+                return;
+            const proto = XMLHttpRequest.prototype;
+            const originalSend = proto.send;
+            if (typeof originalSend !== 'function')
+                return;
+            const self = this;
+            const patched = function patchedSend(...args) {
+                try {
+                    this.addEventListener('load', () => {
+                        try {
+                            // responseText throws for blob/arraybuffer response types.
+                            if (this.responseType !== '' && this.responseType !== 'text')
+                                return;
+                            const body = this.responseText;
+                            if (!body || body.length > self.maxScanBytes)
+                                return;
+                            self.emit(extractSessionId(body));
+                        }
+                        catch (_a) {
+                            /* ignore */
+                        }
+                    });
+                }
+                catch (_a) {
+                    /* ignore */
+                }
+                return originalSend.apply(this, args);
+            };
+            proto.send = patched;
+            this.disposers.push(() => {
+                if (proto.send === patched)
+                    proto.send = originalSend;
+            });
+        }
+        /**
+         * Direct links to checkout.stripe.com. Capture phase so we still see the click
+         * when the merchant's own handler calls stopPropagation().
+         */
+        hookClicks() {
+            if (typeof document === 'undefined')
+                return;
+            const onClick = (e) => {
+                var _a, _b;
+                try {
+                    const target = (_b = (_a = e.target) === null || _a === void 0 ? void 0 : _a.closest) === null || _b === void 0 ? void 0 : _b.call(_a, 'a[href]');
+                    if (!target || !target.href || !isCheckoutUrl(target.href))
+                        return;
+                    this.emit(extractSessionId(target.href));
+                }
+                catch (_c) {
+                    /* never block navigation */
+                }
+            };
+            document.addEventListener('click', onClick, true);
+            this.disposers.push(() => document.removeEventListener('click', onClick, true));
+        }
+        hookWindowOpen() {
+            if (typeof window.open !== 'function')
+                return;
+            const original = window.open;
+            const self = this;
+            const patched = function patchedOpen(...args) {
+                var _a;
+                try {
+                    const url = args[0];
+                    const href = typeof url === 'string' ? url : (_a = url === null || url === void 0 ? void 0 : url.toString) === null || _a === void 0 ? void 0 : _a.call(url);
+                    if (href && isCheckoutUrl(href))
+                        self.emit(extractSessionId(href));
+                }
+                catch (_b) {
+                    /* ignore */
+                }
+                return original.apply(this !== null && this !== void 0 ? this : window, args);
+            };
+            window.open = patched;
+            this.disposers.push(() => {
+                if (window.open === patched)
+                    window.open = original;
+            });
+        }
+    }
+
     /** Keys the remote config is allowed to fill on DatalyrConfig. */
     const REMOTE_KEYS = [
         'autoIdentify',
@@ -4187,6 +4868,7 @@ var Datalyr = (function (exports) {
         'autoIdentifyAPI',
         'autoIdentifyShopify',
         'shopifyCartAttributes',
+        'stripeCheckoutSessions',
         'checkoutChampDomains',
         'respectGlobalPrivacyControl',
         'respectDoNotTrack',
@@ -4225,6 +4907,16 @@ var Datalyr = (function (exports) {
      * Datalyr Web SDK
      * Modern attribution tracking for web applications
      */
+    /**
+     * WEB-20. Fingerprint of the last identify() that actually emitted, so a host
+     * app calling identify() on every route change does not re-emit an unchanged
+     * identity. Cleared by reset(). Mirrors iOS `datalyr_last_identity_fingerprint`
+     * and RN `@datalyr/last_identity_fingerprint`.
+     *
+     * Not PII: the stored value is a hash, and it is written through the same
+     * `storage` wrapper as every other key (so it inherits the `dl_` prefix).
+     */
+    const IDENTIFY_FINGERPRINT_KEY = 'dl_identify_fingerprint';
     class Datalyr {
         constructor() {
             // Keys the caller passed to init() (before built-in defaults were merged).
@@ -4240,10 +4932,26 @@ var Datalyr = (function (exports) {
             this.errors = [];
             this.MAX_ERRORS = 50;
             this.lastSpaPath = null; // dedups SPA pageviews (replaceState-on-mount double-fire)
+            // Shopify loads Customer Privacy asynchronously. Keep the initial pageview
+            // pending until initialization is complete and analytics consent is known,
+            // then release it exactly once when consent allows tracking.
+            this.initialPageViewReady = false;
+            this.initialPageViewSent = false;
             // FIXED (ISSUE-01): Async initialization promise to prevent race conditions
             this.initializationPromise = null;
             // Opt-out check moved to init() after cookies configured (Issue #14)
         }
+        /**
+         * Return the workspace configured for this instance, or null before init().
+         *
+         * CDN bootstrap uses this public accessor instead of reaching into the
+         * private runtime config when deciding whether an existing global belongs
+         * to the requested workspace.
+         */
+        getWorkspaceId() {
+            var _a, _b;
+            return (_b = (_a = this.config) === null || _a === void 0 ? void 0 : _a.workspaceId) !== null && _b !== void 0 ? _b : null;
+        }
         /**
          * Initialize the SDK
          */
@@ -4298,7 +5006,11 @@ var Datalyr = (function (exports) {
             this.session = new SessionManager(this.config.sessionTimeout);
             this.attribution = new AttributionManager({
                 attributionWindow: this.config.attributionWindow,
-                trackedParams: this.config.trackedParams
+                trackedParams: this.config.trackedParams,
+                // TR-03: gate ad-signal synthesis + shipping on LIVE marketing consent. Returns true by
+                // default (no consent signal) so behavior is unchanged for the common case; false only on
+                // an explicit decline (Shopify marketing:false / setConsent marketing|sale=false).
+                marketingAllowed: () => this.consentAllowsMarketing()
             });
             this.queue = new EventQueue(this.config);
             this.fingerprint = new FingerprintCollector({
@@ -4311,11 +5023,18 @@ var Datalyr = (function (exports) {
             // Gate the queue by the FULL tracking policy (opt-out + analytics consent + DNT +
             // GPC) so a returning opted-out / DNT / GPC visitor's persisted events don't drain.
             this.queue.setEnabled(this.shouldTrack());
+            // TR-15: also give the offline drain a LIVE consent gate. setEnabled above is latched to
+            // a fail-open value while Shopify's customerPrivacy loads async; a returning declined
+            // visitor fires no visitorConsentCollected event, so the drain must re-check per run.
+            this.queue.setConsentCheck(() => this.shouldTrack());
             // FIXED (ISSUE-01): Start async initialization immediately but don't block constructor
             // This allows encryption to initialize before any events are tracked
             this.initializeAsync();
             // Setup page unload handler
             this.setupUnloadHandler();
+            // Shopify Customer Privacy (9.A.1): react to the native consent banner's
+            // decision mid-session (grant AND revoke), not just at the next page load.
+            this.setupShopifyConsentListener();
             // Initialize plugins
             if (this.config.plugins) {
                 for (const plugin of this.config.plugins) {
@@ -4347,6 +5066,27 @@ var Datalyr = (function (exports) {
                 this.initializationPromise = (() => __awaiter(this, void 0, void 0, function* () {
                     var _a, _b;
                     try {
+                        // TR-22: capture the LANDING attribution NOW, before any await. The first read used to
+                        // sit inside this.page() AFTER `await container.init()` (up to a ~3s budget), so a
+                        // router / consent tool that strips fbclid via history.replaceState within that window
+                        // — or a fast bounce — lost the click id entirely (nothing persisted to first/last
+                        // touch until the first event). getAttributionData() warms queryParamsCache (freezing
+                        // the landing params) AND persists first/last touch immediately. Wrapped so a failure
+                        // never blocks init.
+                        // CONSENT (Track-3 review P1): gate the eager capture behind shouldTrack(). This call
+                        // synthesizes _fbp/_fbc and persists first/last touch — which must NOT happen at page
+                        // load for an opted-out / DNT / GPC visitor (shouldTrack()=false), or it undoes the
+                        // id-less-at-init privacy invariant. For a TRACKED visitor with marketing declined,
+                        // getAttributionData already strips the click-ids / marketing cookies (TR-03), so TR-22's
+                        // early-capture benefit is preserved for consenting/default visitors.
+                        if (this.shouldTrack()) {
+                            try {
+                                this.attribution.getAttributionData();
+                            }
+                            catch (e) {
+                                this.log('Eager attribution capture failed:', e);
+                            }
+                        }
                         // SEC-03: encryption is for PII-AT-REST only — it must NOT gate event delivery,
                         // pageviews, or pixels. On a non-secure context (http://) or an old browser,
                         // crypto.subtle is absent and initialize() throws; isolate it so the rest of init
@@ -4355,6 +5095,11 @@ var Datalyr = (function (exports) {
                             const deviceId = this.identity.getAnonymousId();
                             yield dataEncryption.initialize(this.config.workspaceId, deviceId);
                             this.userProperties = yield storage.getEncrypted('dl_user_traits', {});
+                            // WEB-22: restore a PII user id that was persisted encrypted. Must run
+                            // here — it needs dataEncryption to be initialized, so it cannot happen
+                            // in the IdentityManager constructor. It never overwrites an id already
+                            // set by an explicit identify() earlier in this page load.
+                            yield this.identity.hydrateEncryptedUserId();
                             this.log('Encryption initialized, user properties loaded');
                         }
                         catch (encErr) {
@@ -4429,7 +5174,10 @@ var Datalyr = (function (exports) {
                         // Initialize auto-identify when enabled (explicit or remote) AND
                         // tracking is allowed. The shouldTrack() gate keeps capture from even
                         // setting up its form/API interceptors for opted-out / DNT / GPC users.
-                        if (this.config.autoIdentify === true && this.shouldTrack()) {
+                        // 9.A.1: the captured email feeds Meta advanced matching / CAPI, so a
+                        // declined Shopify marketing consent also blocks setup (incl. the
+                        // /account.json polling); null = no Shopify signal → unchanged.
+                        if (this.config.autoIdentify === true && this.shouldTrack() && this.shopifyMarketingConsent() !== false) {
                             this.autoIdentify = new AutoIdentifyManager({
                                 enabled: true,
                                 captureFromForms: this.config.autoIdentifyForms,
@@ -4441,21 +5189,29 @@ var Datalyr = (function (exports) {
                             // Setup auto-identify callback
                             this.autoIdentify.initialize((email, source) => {
                                 this.log(`Auto-identified user: ${email} from ${source}`);
-                                // Track auto-identify event
-                                this.track('$auto_identify', {
-                                    email,
-                                    source,
-                                    timestamp: Date.now()
-                                });
-                                // Automatically call identify with email
-                                this.identify(email, { email });
+                                // WEB-21: ONE event, not two.
+                                //
+                                // This used to emit `$auto_identify` and then call identify(),
+                                // which emits `$identify` — two events ~1ms apart carrying the same
+                                // email. Production over 7 days on workspace f6260736 showed a
+                                // perfect 379 / 379 / 379 split ($identify / $auto_identify /
+                                // visitors): every auto-identification was booked twice.
+                                //
+                                // Nothing consumed `$auto_identify`: grepped across the whole
+                                // platform (app/, lib/, all Cloudflare workers, all Tinybird pipes)
+                                // — zero readers, while prod carried 6,197 of them in 30 days.
+                                // The only information it added over `$identify` was WHICH detector
+                                // found the email, so that is preserved as a trait instead.
+                                this.identify(email, { email, auto_identify_source: source });
                             });
                         }
                         // Stamp attribution signals into the Shopify cart (OPT-IN, default off).
                         // Lets server-side order webhooks recover the browser visitor + Meta click
                         // signals (the postback webhook reads these as note_attributes). Inert unless
-                        // enabled; best-effort and never blocks init.
-                        if (this.config.shopifyCartAttributes === true && this.shouldTrack()) {
+                        // enabled; best-effort and never blocks init. 9.A.1: the stamped visitor_id +
+                        // fbc/fbp/fbclid are marketing signals, so a declined Shopify marketing
+                        // consent blocks stamping too (null = no signal → unchanged).
+                        if (this.config.shopifyCartAttributes === true && this.shouldTrack() && this.shopifyMarketingConsent() !== false) {
                             this.syncShopifyCartAttributes().catch((error) => {
                                 this.log('Shopify cart attribute sync failed:', error);
                             });
@@ -4477,10 +5233,22 @@ var Datalyr = (function (exports) {
                         if (this.config.stripePaymentLinks !== false && this.shouldTrack()) {
                             this.syncStripePaymentLinks((_b = this.config.stripeLinkDomains) !== null && _b !== void 0 ? _b : []);
                         }
-                        // Track initial page view if enabled (AFTER encryption ready)
-                        if (this.config.trackPageViews) {
-                            this.page();
+                        // Checkout Session capture (DEFAULT ON). The decorator above cannot help
+                        // when the merchant's BACKEND creates the session — checkout.stripe.com
+                        // ignores client_reference_id post-creation — which is how most SaaS
+                        // checkouts work, and why payers arrive at our webhook with no visitor
+                        // (measured 0.5% and 13.3% visitor coverage on the two Stripe tenants).
+                        // The session id still has to reach the browser, so we observe it and
+                        // let the server join on session.id. Same shouldTrack() gate as the
+                        // decorator: an opted-out visitor's id is never paired with a checkout.
+                        if (this.config.stripeCheckoutSessions !== false && this.shouldTrack()) {
+                            this.startStripeSessionCapture();
                         }
+                        // Track the initial page view after encryption is ready. On Shopify the
+                        // Customer Privacy API can still be loading, so retain one pending
+                        // pageview and release it from onShopifyConsentChanged() once allowed.
+                        this.initialPageViewReady = true;
+                        this.trackInitialPageViewOnce();
                         this.log('Async initialization complete');
                     }
                     catch (error) {
@@ -4613,6 +5381,50 @@ var Datalyr = (function (exports) {
         /**
          * Identify a user
          */
+        /**
+         * Stable fingerprint of an identity for redundant-emit suppression (WEB-20).
+         *
+         * Keys are sorted and each value is JSON-serialized, so `{a,b}` and `{b,a}`
+         * collapse to one identity while a genuinely changed nested trait does not.
+         * (The mobile SDKs use `String(value)`, which flattens every object to
+         * `[object Object]` and can swallow a real change; web traits are plain JSON,
+         * so it can afford to be exact.)
+         *
+         * Hashed rather than stored raw so the key does not become another copy of the
+         * user's traits at rest. Being honest about the strength: a 32-bit
+         * non-cryptographic digest sitting beside a readable `dl_dl_anonymous_id` is
+         * NOT protection against a determined reader — it defeats casual inspection
+         * and bulk scraping, nothing more. The PII that matters is handled properly
+         * (encrypted `dl_user_id_pii`, encrypted `dl_user_traits`). 32 bits also means
+         * a ~1-in-4.3e9 chance per identity that a genuine change is suppressed;
+         * acceptable for change detection, which is all this is.
+         */
+        identityFingerprint(userId, traits = {}) {
+            const stableTraits = Object.keys(traits || {})
+                .sort()
+                .map((key) => {
+                let value;
+                try {
+                    value = JSON.stringify(traits[key]);
+                }
+                catch (_a) {
+                    // Circular/unserializable trait — fall back to a coarse marker rather
+                    // than throwing inside identify().
+                    value = '[unserializable]';
+                }
+                return `${key}=${value}`;
+            })
+                .join('&');
+            const input = `${this.identity.getAnonymousId()}|${userId}|${stableTraits}`;
+            // 32-bit FNV-1a. Not cryptographic — this only needs to detect change, and
+            // it must be synchronous (crypto.subtle is async and identify() is not).
+            let hash = 0x811c9dc5;
+            for (let i = 0; i < input.length; i++) {
+                hash ^= input.charCodeAt(i);
+                hash = Math.imul(hash, 0x01000193);
+            }
+            return (hash >>> 0).toString(16);
+        }
         identify(userId, traits = {}) {
             if (!this.initialized) {
                 console.warn('[Datalyr] SDK not initialized. Call init() first.');
@@ -4625,6 +5437,13 @@ var Datalyr = (function (exports) {
                 return;
             }
             try {
+                // A different authenticated user on the same device is a privacy
+                // boundary. Rotate the anonymous/session identities and clear the prior
+                // user's traits/attribution before creating the new link, even when the
+                // integrator forgot to call reset() on logout.
+                const currentUserId = this.identity.getUserId();
+                if (currentUserId && currentUserId !== userId)
+                    this.reset();
                 // FSR-53: do NOT rotate the session id on identify(). 'Session fixation' is an
                 // auth-credential concept; a client-generated analytics session_id is not one.
                 // Rotating split every identified visit (and every auto-identify form submit) into
@@ -4645,8 +5464,31 @@ var Datalyr = (function (exports) {
                     // If encryption fails, user traits are only stored in memory (this.userProperties)
                     // and will be lost on page reload - but PII is NOT exposed in localStorage
                 });
-                // Track $identify event
-                this.track('$identify', Object.assign(Object.assign({}, identityLink), { traits }));
+                // WEB-20: redundant-identify suppression, matching iOS 2.1.11 / RN 1.7.16.
+                //
+                // identify() is host-app-driven and SPA routers commonly call it in a
+                // route effect, so an unchanged identity was re-emitted on every
+                // navigation. The mobile SDKs got this in 2.1.10/1.7.15; web did not.
+                //
+                // Fingerprint = anonymousId | userId | sorted traits. The anonymous id is
+                // included so a reset()/rotation always re-emits and identity links are
+                // never lost — only exact repeats are skipped.
+                //
+                // Only the EVENT is suppressed. `this.identity.identify()` above has
+                // already persisted `dl_user_id`, traits are still merged and encrypted,
+                // and the plugin handlers below still run on every call — a plugin's
+                // `identify` hook is a customer extension point whose semantics we cannot
+                // assume, so its contract ("called when identify() is called") is
+                // deliberately left intact.
+                const identityFingerprint = this.identityFingerprint(userId, traits);
+                const isRedundantIdentify = storage.getString(IDENTIFY_FINGERPRINT_KEY, null) === identityFingerprint;
+                if (isRedundantIdentify) {
+                    this.log('Skipping redundant identify (unchanged identity):', userId);
+                }
+                else {
+                    storage.set(IDENTIFY_FINGERPRINT_KEY, identityFingerprint);
+                    this.track('$identify', Object.assign(Object.assign({}, identityLink), { traits }));
+                }
                 // Call plugin handlers
                 if (this.config.plugins) {
                     for (const plugin of this.config.plugins) {
@@ -4666,6 +5508,18 @@ var Datalyr = (function (exports) {
                 this.trackError(error, { userId });
             }
         }
+        /**
+         * WEB-27: queue health, including events the SDK gave up on.
+         *
+         * `getStats()` existed on EventQueue but was unreachable — `queue` is private
+         * and nothing exposed it, so the observability fix could not actually be
+         * observed. A non-zero `droppedEvents` means data was lost.
+         */
+        getQueueStats() {
+            if (!this.queue)
+                return null;
+            return this.queue.getStats();
+        }
         /**
          * Track a page view
          */
@@ -4687,7 +5541,9 @@ var Datalyr = (function (exports) {
             if (!lastTouchpoint || lastTouchpoint.sessionId !== sid) {
                 this.attribution.addTouchpoint(sid, this.attribution.captureAttribution());
             }
-            const pageData = Object.assign({ title: document.title, url: window.location.href, path: window.location.pathname, search: window.location.search, referrer: document.referrer }, properties);
+            // 9.A.4: url/search/referrer are redacted (secret/PII query-param values →
+            // __redacted__) before they ever leave the browser — see redactUrl in utils.
+            const pageData = Object.assign({ title: document.title, url: redactUrl(window.location.href), path: window.location.pathname, search: redactUrl(window.location.search), referrer: redactUrl(document.referrer) }, properties);
             // Add referrer data
             const referrerData = getReferrerData();
             Object.assign(pageData, referrerData);
@@ -4757,6 +5613,13 @@ var Datalyr = (function (exports) {
             // Gate before mutating persisted identity (identity.alias writes dl_user_id).
             if (!this.shouldTrack())
                 return;
+            if (previousId && previousId !== this.identity.getAnonymousId()) {
+                console.warn('[Datalyr] alias() only accepts the current anonymous ID as previousId');
+                return;
+            }
+            const currentUserId = this.identity.getUserId();
+            if (currentUserId && currentUserId !== userId)
+                this.reset();
             const aliasData = this.identity.alias(userId, previousId);
             this.track('$alias', aliasData);
         }
@@ -4774,6 +5637,9 @@ var Datalyr = (function (exports) {
             // values to the next user's events (cross-user contamination on shared devices).
             this.superProperties = {};
             storage.remove('dl_user_traits');
+            // WEB-20: drop the identify fingerprint, so a logout→login (or a different
+            // user on this browser) always re-emits $identify and the link is rebuilt.
+            storage.remove(IDENTIFY_FINGERPRINT_KEY);
             // Clear the auto-identify guard so a different user on the same browser is
             // re-captured (it short-circuits while dl_auto_identified_email is present), and so
             // the prior user's email isn't left at rest after logout.
@@ -4912,6 +5778,32 @@ var Datalyr = (function (exports) {
         /**
          * Opt out of tracking
          */
+        /**
+         * X-1 (consent): stop the Stripe Payment Link + CheckoutChamp outbound-link decorators from
+         * stamping `client_reference_id`/`prefilled_email` onto <a> hrefs once consent/marketing is
+         * withdrawn. Their MutationObservers otherwise keep rewriting links after a CMP or Shopify
+         * decline — and the server still reads the stamped `client_reference_id` — so attribution
+         * continues post-withdrawal. Idempotent; decorators re-init on the next load if consent returns
+         * (same convention as pixels/auto-identify).
+         */
+        disposeMarketingLinkDecorators() {
+            var _a, _b, _c;
+            try {
+                (_a = this.stripeLinksDisposer) === null || _a === void 0 ? void 0 : _a.call(this);
+            }
+            catch ( /* best-effort */_d) { /* best-effort */ }
+            this.stripeLinksDisposer = undefined;
+            try {
+                (_b = this.stripeSessionWatcher) === null || _b === void 0 ? void 0 : _b.stop();
+            }
+            catch ( /* best-effort */_e) { /* best-effort */ }
+            this.stripeSessionWatcher = undefined;
+            try {
+                (_c = this.outboundDisposer) === null || _c === void 0 ? void 0 : _c.call(this);
+            }
+            catch ( /* best-effort */_f) { /* best-effort */ }
+            this.outboundDisposer = undefined;
+        }
         optOut() {
             var _a;
             if (!this.initialized) {
@@ -4933,11 +5825,27 @@ var Datalyr = (function (exports) {
                 this.container.cleanupAllIframes();
                 this.container = undefined;
             }
+            // X-1: stop stamping Stripe/CC outbound links with the visitor id / email.
+            this.disposeMarketingLinkDecorators();
             // Purge PII at rest.
             this.userProperties = {};
             storage.remove('dl_user_traits');
+            // WEB-26: remove the PLAINTEXT id as well. optOut() purged only the
+            // encrypted copy, so an opted-out visitor whose email was written by an
+            // older build kept it at rest — the one state where that is least
+            // defensible.
+            storage.remove('dl_user_id');
+            storage.remove('dl_user_id_pii');
+            storage.remove(IDENTIFY_FINGERPRINT_KEY);
             storage.remove('dl_auto_identified_email');
             storage.remove('dl_journey');
+            // WEB-25: first/last touch hold redacted-but-full landing URLs, referrers and
+            // click ids for up to 90 days. reset() has always cleared them; optOut() did
+            // not — so an opted-out visitor kept marketing attribution at rest, which is
+            // the one state where it is least defensible. Same rationale as dl_journey
+            // directly above.
+            storage.remove('dl_first_touch');
+            storage.remove('dl_last_touch');
             this.log('User opted out');
         }
         /**
@@ -4954,6 +5862,9 @@ var Datalyr = (function (exports) {
             // merely because opt-out was lifted — otherwise a GPC/DNT visitor's persisted
             // events would start draining again. (Pixels / auto-identify resume on next load.)
             this.queue.setEnabled(this.shouldTrack());
+            // TR-15 (P3): opt-in → persist the in-memory anon id now (see onShopifyConsentChanged).
+            if (this.shouldTrack())
+                this.identity.enablePersistence();
             this.log('User opted in');
         }
         /**
@@ -4966,6 +5877,7 @@ var Datalyr = (function (exports) {
          * Set consent preferences
          */
         setConsent(consent) {
+            var _a;
             // Always record + persist consent FIRST, even before init(). FSR-51: a consent-
             // management platform commonly calls setConsent() before init() so tracking is gated
             // from the very first event. The old code then dereferenced this.queue/this.config
@@ -4986,6 +5898,30 @@ var Datalyr = (function (exports) {
             if (!allowed) {
                 this.queue.clear();
                 this.queue.clearOffline();
+                // TR-14: mirror optOut() on analytics withdrawal. Previously setConsent tore down the
+                // queue + container but left autoIdentify alive — its form/fetch interceptors and
+                // /account.json polling kept running and triggerIdentify persisted the captured email
+                // to storage AFTER withdrawal (PII newly written at rest → GDPR/consent-audit failure
+                // on non-Shopify CMP installs). Destroy it and purge PII at rest. (Auto-identify
+                // resumes on the next page load if consent is re-granted, matching optOut/optIn.)
+                (_a = this.autoIdentify) === null || _a === void 0 ? void 0 : _a.destroy();
+                this.autoIdentify = undefined;
+                this.userProperties = {};
+                storage.remove('dl_user_traits');
+                // WEB-26: see optOut() — the plaintext id must go too.
+                storage.remove('dl_user_id');
+                storage.remove('dl_user_id_pii');
+                storage.remove(IDENTIFY_FINGERPRINT_KEY);
+                storage.remove('dl_auto_identified_email');
+                storage.remove('dl_journey');
+                // WEB-25: see optOut() — withdrawn analytics consent must not leave 90-day
+                // marketing attribution at rest either.
+                storage.remove('dl_first_touch');
+                storage.remove('dl_last_touch');
+            }
+            else {
+                // TR-15 (P3): grant → persist the in-memory anon id now (see onShopifyConsentChanged).
+                this.identity.enablePersistence();
             }
             // Marketing / "do not sell" withdrawal: stop FEEDING the third-party pixels and
             // prevent them from being initialized on the next page load. NOTE: an
@@ -4995,6 +5931,12 @@ var Datalyr = (function (exports) {
                 this.container.cleanupAllIframes();
                 this.container = undefined;
             }
+            // X-1: on marketing/sale withdrawal, stop the Stripe/CC decorators from stamping the
+            // visitor id / email onto outbound links (the observers otherwise keep rewriting hrefs
+            // after withdrawal, and the server still reads the stamped client_reference_id).
+            if (!this.consentAllowsMarketing()) {
+                this.disposeMarketingLinkDecorators();
+            }
             this.log('Consent updated:', consent);
         }
         /**
@@ -5079,91 +6021,27 @@ var Datalyr = (function (exports) {
                 }
             });
         }
-        /**
-         * Restore _dl_* URL bridge params on a Checkout Champ funnel page.
-         * Runs BEFORE IdentityManager so the storefront's visitor_id wins over a
-         * freshly auto-generated one. Also restores _fbc / _fbp cookies and the
-         * fbclid click time so server-side rebuilds carry the real click moment.
-         *
-         * Strategy: stamp matching cookies (without clobbering pre-existing values),
-         * then rewrite the URL so `_dl_fbclid` becomes `fbclid` — that way the rest
-         * of the SDK's attribution layer (which reads `params.fbclid`) works
-         * unchanged, and any merchant analytics also see the canonical click ID.
-         */
+        /** Strip the retired unsigned Checkout Champ bridge parameters. */
         restoreFromURL() {
             var _a;
             if (typeof window === "undefined" || typeof document === "undefined")
                 return;
             try {
                 const params = new URLSearchParams(window.location.search);
-                const get = (k) => params.get(k);
-                const vid = get("_dl_vid");
-                const fbc = get("_dl_fbc");
-                const fbp = get("_dl_fbp");
-                const fbclid = get("_dl_fbclid");
-                const fbclidAt = get("_dl_fbclid_at");
-                const gclid = get("_dl_gclid");
-                const gclidAt = get("_dl_gclid_at");
-                // visitor_id: bridge wins. The whole point of `_dl_vid` is to unify the
-                // storefront's session with the CC funnel session. A pre-existing local
-                // cookie from a prior direct CC visit would silently sink the integration
-                // (CC events stay on the local id; storefront events use the bridged id;
-                // the two never link). Overwrite — orphaned local events are fine.
-                if (vid)
-                    this.cookies.set("__dl_visitor_id", vid, 365);
-                // Meta cookies + click-time cookies: existing wins. _fbc / _fbp may have
-                // been written by Meta Pixel on the CC funnel page itself (more recent
-                // than the bridged value); _dl_fbclid_at should record first-touch click
-                // time per device, not get reset by a bridge from a new campaign.
-                const setIfMissing = (name, value) => {
-                    if (!value)
-                        return;
-                    if (this.cookies.get(name))
-                        return;
-                    this.cookies.set(name, value, 365);
-                };
-                setIfMissing("_fbc", fbc);
-                setIfMissing("_fbp", fbp);
-                setIfMissing("_dl_fbclid_at", fbclidAt);
-                setIfMissing("_dl_gclid_at", gclidAt);
-                // Rewrite URL: _dl_fbclid → fbclid (etc.) so captureAttribution() picks
-                // them up via its existing `params.fbclid` path. Strip the _dl_* params
-                // either way so they don't leak into downstream analytics URLs.
-                let rewrote = false;
-                const mappings = [
-                    ["fbclid", fbclid],
-                    ["gclid", gclid]
-                ];
-                for (const [canonical, value] of mappings) {
-                    if (value && !params.get(canonical)) {
-                        params.set(canonical, value);
-                        rewrote = true;
-                    }
-                }
+                let changed = false;
                 for (const k of ["_dl_vid", "_dl_fbc", "_dl_fbp", "_dl_fbclid", "_dl_fbclid_at", "_dl_gclid", "_dl_gclid_at"]) {
                     if (params.has(k)) {
                         params.delete(k);
-                        rewrote = true;
+                        changed = true;
                     }
                 }
-                if (rewrote && typeof ((_a = window.history) === null || _a === void 0 ? void 0 : _a.replaceState) === "function") {
+                if (changed && typeof ((_a = window.history) === null || _a === void 0 ? void 0 : _a.replaceState) === "function") {
                     const newSearch = params.toString();
-                    const newUrl = window.location.pathname +
-                        (newSearch ? "?" + newSearch : "") +
-                        window.location.hash;
+                    const newUrl = window.location.pathname + (newSearch ? "?" + newSearch : "") + window.location.hash;
                     window.history.replaceState(window.history.state, "", newUrl);
                 }
-                this.log("Checkout Champ bridge restored:", {
-                    had_vid: !!vid,
-                    had_fbc: !!fbc,
-                    had_fbp: !!fbp,
-                    had_fbclid: !!fbclid,
-                    had_gclid: !!gclid
-                });
             }
             catch (error) {
-                // Don't let bridge restoration block init — fall through to normal SDK
-                // behavior (a fresh visitor_id, no restored click signals).
                 this.log("restoreFromURL failed:", error);
             }
         }
@@ -5264,138 +6142,9 @@ var Datalyr = (function (exports) {
                 this.log("fireCheckoutChampPurchasePixel failed:", error);
             }
         }
-        /**
-         * Storefront → Checkout Champ link stamping. Finds every `<a href>` whose host
-         * matches the configured CC domain list and appends `?_dl_vid=…&_dl_fbc=…&
-         * _dl_fbp=…&_dl_fbclid=…&_dl_fbclid_at=…&_dl_gclid=…` so the user's
-         * visitor_id + Meta click signals cross the domain. MutationObserver watches
-         * for dynamically-injected links. On click, force-flush the event queue so
-         * any pending track() events land before the browser navigates away.
-         */
+        /** Checkout Champ identity bridging remains disabled pending signed tokens. */
         syncOutboundLinkParams(domains) {
-            if (typeof window === "undefined" || typeof document === "undefined")
-                return;
-            const lowerDomains = domains.map((d) => d.toLowerCase());
-            const matchesCcDomain = (href) => {
-                try {
-                    const host = new URL(href, window.location.href).hostname.toLowerCase();
-                    return lowerDomains.some((d) => host === d || host.endsWith("." + d));
-                }
-                catch (_a) {
-                    return false;
-                }
-            };
-            const buildBridgeParams = () => {
-                var _a, _b;
-                const attribution = this.attribution.getAttributionData();
-                const out = {};
-                const vid = this.identity.getAnonymousId();
-                const fbc = this.cookies.get("_fbc") || attribution._fbc;
-                const fbp = this.cookies.get("_fbp") || attribution._fbp;
-                // FSR-104: read the named click-id fields directly (captureAttribution stores every
-                // present click id under its own key) so a landing URL carrying BOTH fbclid and
-                // gclid bridges both — the old `clickIdType === 'fbclid' ? clickId : null` dropped
-                // gclid whenever fbclid was the primary, silently losing Google attribution on the
-                // cross-domain CC path. Fall back to the primary clickId for older stored shapes.
-                const fbclid = (_a = attribution.fbclid) !== null && _a !== void 0 ? _a : (attribution.clickIdType === "fbclid" ? attribution.clickId : null);
-                const fbclidAt = this.cookies.get("_dl_fbclid_at");
-                const gclid = (_b = attribution.gclid) !== null && _b !== void 0 ? _b : (attribution.clickIdType === "gclid" ? attribution.clickId : null);
-                const gclidAt = this.cookies.get("_dl_gclid_at");
-                if (vid)
-                    out._dl_vid = vid;
-                if (fbc)
-                    out._dl_fbc = String(fbc);
-                if (fbp)
-                    out._dl_fbp = String(fbp);
-                if (fbclid)
-                    out._dl_fbclid = String(fbclid);
-                if (fbclidAt)
-                    out._dl_fbclid_at = String(fbclidAt);
-                if (gclid)
-                    out._dl_gclid = String(gclid);
-                if (gclidAt)
-                    out._dl_gclid_at = String(gclidAt);
-                return out;
-            };
-            const stampLink = (anchor) => {
-                if (!anchor.href || !matchesCcDomain(anchor.href))
-                    return;
-                try {
-                    const u = new URL(anchor.href, window.location.href);
-                    const bridge = buildBridgeParams();
-                    let mutated = false;
-                    for (const [k, v] of Object.entries(bridge)) {
-                        if (!u.searchParams.get(k)) {
-                            u.searchParams.set(k, v);
-                            mutated = true;
-                        }
-                    }
-                    if (mutated)
-                        anchor.href = u.toString();
-                }
-                catch (_a) {
-                    // Ignore malformed URLs — don't break the page.
-                }
-            };
-            const stampAll = () => {
-                document.querySelectorAll("a[href]").forEach((el) => stampLink(el));
-            };
-            const onClick = (e) => {
-                var _a, _b;
-                const target = (_a = e.target) === null || _a === void 0 ? void 0 : _a.closest("a[href]");
-                if (!target)
-                    return;
-                const anchor = target;
-                if (!matchesCcDomain(anchor.href))
-                    return;
-                stampLink(anchor); // re-stamp in case attribution changed since DOMReady
-                try {
-                    (_b = this.queue) === null || _b === void 0 ? void 0 : _b.flush();
-                }
-                catch (_c) {
-                    // Best-effort — never block navigation.
-                }
-            };
-            stampAll();
-            document.addEventListener("click", onClick, true);
-            try {
-                // Debounce re-stamping. A busy SPA (infinite scroll, animations,
-                // React/Vue updates) can fire thousands of mutations per second; a naive
-                // re-stamp on every notification would burn CPU pointlessly when
-                // outbound link sets only change occasionally. 150ms is small enough to
-                // catch links before the user can click them, large enough to coalesce
-                // bursts.
-                let restampTimer = null;
-                const scheduleRestamp = () => {
-                    if (restampTimer != null)
-                        return;
-                    restampTimer = setTimeout(() => {
-                        restampTimer = null;
-                        stampAll();
-                    }, 150);
-                };
-                const observer = new MutationObserver(scheduleRestamp);
-                observer.observe(document.documentElement, { childList: true, subtree: true });
-                // Observer + click listener live for the session; pagehide cleans up on full-page
-                // unload, and destroy() can tear them down early via this disposer (H2 — otherwise
-                // a destroy()+re-init() leaks the observer + capturing click listener).
-                this.outboundDisposer = () => {
-                    try {
-                        observer.disconnect();
-                    }
-                    catch ( /* idempotent */_a) { /* idempotent */ }
-                    if (restampTimer != null) {
-                        clearTimeout(restampTimer);
-                        restampTimer = null;
-                    }
-                    document.removeEventListener("click", onClick, true);
-                };
-                window.addEventListener("pagehide", () => { var _a; return (_a = this.outboundDisposer) === null || _a === void 0 ? void 0 : _a.call(this); }, { once: true });
-            }
-            catch (error) {
-                this.log("MutationObserver setup failed (CC link sync):", error);
-            }
-            this.log("Checkout Champ outbound-link sync active for:", lowerDomains);
+            this.log("Checkout Champ outbound identity bridge disabled (signed token required)", domains);
         }
         /**
          * Stripe Payment Link auto-decoration (D1). Structurally mirrors
@@ -5422,6 +6171,39 @@ var Datalyr = (function (exports) {
          * changes. window.open(paymentLink) is not covered (use getVisitorId()
          * manually); iframe/shadow-DOM links are unreachable from document.
          */
+        /**
+         * Observe Stripe Checkout Session ids and report each one once.
+         *
+         * The event is what carries the pairing: the server stores
+         * (stripe_session_id -> visitor_id) and, when checkout.session.completed
+         * arrives without a client_reference_id, joins on session.id and feeds the
+         * SAME cacheCustomerVisitor path the Payment Link flow already uses — so
+         * every later invoice for that customer inherits the visitor too.
+         *
+         * Consent is re-checked at emit time, not just at init: a visitor can
+         * withdraw between page load and checkout, and this pairing is exactly the
+         * kind of identity link that must stop when they do.
+         */
+        startStripeSessionCapture() {
+            if (this.stripeSessionWatcher)
+                return;
+            const watcher = new StripeSessionWatcher();
+            this.stripeSessionWatcher = watcher;
+            watcher.start((stripeSessionId) => {
+                var _a;
+                if (!this.shouldTrack())
+                    return;
+                this.track('$stripe_checkout_session', { stripe_session_id: stripeSessionId });
+                // The very next thing this page does is navigate to Stripe, so flush now
+                // rather than let the batch timer lose the pairing to the unload.
+                try {
+                    (_a = this.queue) === null || _a === void 0 ? void 0 : _a.flush();
+                }
+                catch (_b) {
+                    /* best-effort — never block the checkout */
+                }
+            });
+        }
         syncStripePaymentLinks(extraDomains) {
             if (typeof window === "undefined" || typeof document === "undefined")
                 return;
@@ -5554,6 +6336,7 @@ var Datalyr = (function (exports) {
          * Create event payload
          */
         createEventPayload(eventName, properties, eventIdArg) {
+            var _a;
             // NEW-2: keep the identity's cached session id in lockstep with the LIVE session.
             // The session id changes on session timeout (and previously on identify(), removed in
             // FSR-53), but identity only synced it at init/start — so the top-level
@@ -5590,17 +6373,30 @@ var Datalyr = (function (exports) {
                     device_fingerprint: fingerprintData // Use snake_case only (matches backend)
                 });
             }
-            // Add browser context (caller wins on collisions)
+            // Add browser context (caller wins on collisions). 9.A.4: url/referrer are
+            // redacted — secret/PII query-param values must not ship on events.
             assignMissing(eventData, {
-                url: window.location.href,
+                url: redactUrl(window.location.href),
                 path: window.location.pathname,
-                referrer: document.referrer,
+                referrer: redactUrl(document.referrer),
                 title: document.title,
                 screen_width: screen.width,
                 screen_height: screen.height,
                 viewport_width: window.innerWidth,
                 viewport_height: window.innerHeight
             });
+            // Consent travels with the event so downstream profile enrichment and ad
+            // postbacks enforce the decision that applied at occurrence time. The SDK
+            // snapshot is authoritative over caller properties.
+            const consentSnapshot = Object.assign({}, ((_a = this.consent) !== null && _a !== void 0 ? _a : {}));
+            const shopifyAnalytics = this.shopifyAnalyticsConsent();
+            const shopifyMarketing = this.shopifyMarketingConsent();
+            if (typeof shopifyAnalytics === 'boolean')
+                consentSnapshot.analytics = shopifyAnalytics;
+            if (typeof shopifyMarketing === 'boolean')
+                consentSnapshot.marketing = shopifyMarketing;
+            if (Object.keys(consentSnapshot).length > 0)
+                eventData.consent = consentSnapshot;
             // Create payload using snake_case only (matches backend API and production script)
             const identityFields = this.identity.getIdentityFields();
             // Use the caller-provided event_id (shared with the Meta Pixel co-fire for
@@ -5629,11 +6425,17 @@ var Datalyr = (function (exports) {
                 // Resolution metadata
                 resolution_method: 'browser_sdk',
                 resolution_confidence: 1.0,
-                // SDK metadata. MUST stay in sync with package.json "version" — the build guard
-                // (scripts/check-bundle.js, run by build:check) fails the build if the bundle's
-                // sdk_version doesn't match package.json. (FSR-103)
-                sdk_version: '1.7.4',
-                sdk_name: 'datalyr-web-sdk'
+                // SDK metadata. The placeholder is replaced with package.json "version" at build
+                // time (rollup.config.js injectSdkVersion — 9.A.3), so the literal can never
+                // drift from the package again (it sat at 1.7.4 across the 1.7.5 release). The
+                // build guard (scripts/check-bundle.js, run by build:check) still verifies the
+                // deployable bundles carry the package.json version. (FSR-103)
+                sdk_version: '1.7.8',
+                sdk_name: 'datalyr-web-sdk',
+                // A3-25: versioned-envelope stamp. Every SDK emits schema_version so the ingest/contract
+                // layer can key on ONE canonical envelope version (snake_case fields, event_name/event_data
+                // keys, canonical click-ids, clamped client timestamp — all now converged across SDKs).
+                schema_version: 1
             };
             return payload;
         }
@@ -5649,6 +6451,14 @@ var Datalyr = (function (exports) {
             if (this.consent && this.consent.analytics === false) {
                 return false;
             }
+            // Shopify Customer Privacy (9.A.1 — LEGAL): on a Shopify storefront, a shopper who
+            // declined the native consent banner must not be tracked, even when the merchant
+            // never wired setConsent(). null = API absent (non-Plus store not using it, or
+            // script loaded off-Shopify) → fall through. A detected Shopify storefront
+            // fails closed while the asynchronous Customer Privacy API is unresolved.
+            if (this.shopifyAnalyticsConsent() === false) {
+                return false;
+            }
             // Check Do Not Track
             if (this.config.respectDoNotTrack && isDoNotTrackEnabled()) {
                 return false;
@@ -5665,8 +6475,196 @@ var Datalyr = (function (exports) {
          * pixels (which share data). No consent set = allowed (default).
          */
         consentAllowsMarketing() {
+            // Shopify Customer Privacy (9.A.1): a declined native banner blocks marketing use
+            // (pixel loads, click-id/email forwarding) even with no setConsent() call.
+            // null = no signal → defer to the setConsent-based policy below, unchanged.
+            if (this.shopifyMarketingConsent() === false) {
+                return false;
+            }
             return !this.consent || (this.consent.marketing !== false && this.consent.sale !== false);
         }
+        /**
+         * Shopify Customer Privacy API handle (9.A.1), or null when it doesn't apply.
+         *
+         * X-2 (LEGAL): gated on RUNTIME detection of `window.Shopify.customerPrivacy`, NOT on
+         * `config.platform === 'shopify'`. A Shopify merchant who installs via a plain <script>
+         * snippet or a headless storefront (no `platform:'shopify'`) still exposes customerPrivacy;
+         * gating on config.platform meant a shopper who DECLINED the native banner (with no
+         * setConsent() wired) was fully tracked — nullifying the consent feature for a whole install
+         * class, and unfixable server-side (platform is install-time only). Every access is wrapped —
+         * a Shopify API shape change (or a non-Shopify site) must NEVER break tracking (→ null = fail open).
+         */
+        getShopifyCustomerPrivacy() {
+            var _a, _b;
+            if (typeof window === 'undefined')
+                return null;
+            try {
+                return (_b = (_a = window.Shopify) === null || _a === void 0 ? void 0 : _a.customerPrivacy) !== null && _b !== void 0 ? _b : null;
+            }
+            catch (_c) {
+                return null;
+            }
+        }
+        isShopifyStorefront() {
+            var _a;
+            if (((_a = this.config) === null || _a === void 0 ? void 0 : _a.platform) === 'shopify')
+                return true;
+            if (typeof window === 'undefined')
+                return false;
+            try {
+                return Boolean(window.Shopify) ||
+                    window.location.hostname.toLowerCase().endsWith('.myshopify.com');
+            }
+            catch (_b) {
+                return false;
+            }
+        }
+        /**
+         * Shopify's analytics-consent signal: true/false when the Customer Privacy API is
+         * present and answers, null when there's no signal (API absent / unexpected shape)
+         * — null means "no restriction from Shopify", i.e. today's behavior.
+         */
+        shopifyAnalyticsConsent() {
+            try {
+                const cp = this.getShopifyCustomerPrivacy();
+                if (!cp)
+                    return this.isShopifyStorefront() ? false : null;
+                if (typeof cp.analyticsProcessingAllowed === 'function') {
+                    const allowed = cp.analyticsProcessingAllowed();
+                    return typeof allowed === 'boolean' ? allowed : null;
+                }
+                // Older API surface: the aggregate "can this visitor be tracked" signal.
+                if (typeof cp.userCanBeTracked === 'function') {
+                    const allowed = cp.userCanBeTracked();
+                    return typeof allowed === 'boolean' ? allowed : null;
+                }
+                return this.isShopifyStorefront() ? false : null;
+            }
+            catch (_a) {
+                return this.isShopifyStorefront() ? false : null;
+            }
+        }
+        /**
+         * Shopify's marketing-consent signal (gates pixels, click-id/email → CAPI, cart
+         * attribute stamping, auto-identify email capture). Same null semantics as
+         * shopifyAnalyticsConsent().
+         */
+        shopifyMarketingConsent() {
+            try {
+                const cp = this.getShopifyCustomerPrivacy();
+                if (!cp || typeof cp.marketingAllowed !== 'function') {
+                    return this.isShopifyStorefront() ? false : null;
+                }
+                const allowed = cp.marketingAllowed();
+                return typeof allowed === 'boolean'
+                    ? allowed
+                    : (this.isShopifyStorefront() ? false : null);
+            }
+            catch (_a) {
+                return this.isShopifyStorefront() ? false : null;
+            }
+        }
+        /**
+         * Listen for Shopify's `visitorConsentCollected` document event (9.A.1) so a
+         * consent decision made mid-session takes effect without a reload. Revocation is
+         * enforced immediately, mirroring setConsent(): queue gated + purged, pixels torn
+         * down, auto-identify (email capture + /account.json polling) destroyed. On grant
+         * the queue re-enables (track() re-checks shouldTrack() per event anyway) and cart
+         * attribute stamping runs; pixels / auto-identify resume on the next page load —
+         * the same convention as optIn().
+         */
+        setupShopifyConsentListener() {
+            // X-2: NOT gated on config.platform — a plain-snippet/headless Shopify install must also honor
+            // a mid-session consent decision. The `visitorConsentCollected` event only fires on Shopify
+            // storefronts, and the handler + loadFeatures are fully guarded, so this is a safe no-op
+            // everywhere else.
+            if (typeof document === 'undefined')
+                return;
+            try {
+                this.shopifyConsentHandler = () => {
+                    try {
+                        this.onShopifyConsentChanged();
+                    }
+                    catch (error) {
+                        this.log('Shopify consent change handling failed:', error);
+                    }
+                };
+                document.addEventListener('visitorConsentCollected', this.shopifyConsentHandler);
+                // TR-15: customerPrivacy loads ASYNCHRONOUSLY. Until it's present shopifyAnalyticsConsent()
+                // returns null (fail-open → events send in the pre-load window). Force the feature to load
+                // and re-run the full consent evaluation in the callback so a declined visitor is gated
+                // (queue disabled + purged) as soon as the API answers, without waiting for a reload or a
+                // banner interaction. Guarded — a missing/changed loadFeatures must never break tracking.
+                const shopify = window.Shopify;
+                if (shopify && typeof shopify.loadFeatures === 'function') {
+                    shopify.loadFeatures([{ name: 'consent-tracking-api', version: '0.1' }], (error) => {
+                        if (error) {
+                            this.log('Shopify loadFeatures(consent-tracking-api) failed:', error);
+                            return;
+                        }
+                        try {
+                            this.onShopifyConsentChanged();
+                        }
+                        catch (e) {
+                            this.log('Shopify post-load consent eval failed:', e);
+                        }
+                    });
+                }
+            }
+            catch (error) {
+                this.log('Shopify consent listener setup failed:', error);
+            }
+        }
+        onShopifyConsentChanged() {
+            const allowed = this.shouldTrack();
+            this.queue.setEnabled(allowed);
+            // TR-15 (P3): a mid-session grant must persist the in-memory anon id NOW — otherwise a
+            // visitor declined at init keeps a memory-only id and this session's events land under a
+            // visitor_id that vanishes on the next page load. Idempotent.
+            if (allowed)
+                this.identity.enablePersistence();
+            if (allowed)
+                this.trackInitialPageViewOnce();
+            if (!allowed) {
+                // Mirror setConsent() withdrawal: purge buffered events so events captured
+                // before the decline can't drain if consent is later re-granted.
+                this.queue.clear();
+                this.queue.clearOffline();
+            }
+            const marketingBlocked = this.shopifyMarketingConsent() === false;
+            // Stop email capture (form interceptors + /account.json polling) immediately.
+            if ((!allowed || marketingBlocked) && this.autoIdentify) {
+                this.autoIdentify.destroy();
+                this.autoIdentify = undefined;
+            }
+            // Same caveat as setConsent(): an already-injected pixel global (fbq/gtag/ttq)
+            // keeps running in the page; full removal is on reload.
+            if (!this.consentAllowsMarketing() && this.container) {
+                this.container.cleanupAllIframes();
+                this.container = undefined;
+            }
+            // X-1: marketing withdrawn (Shopify decline) → stop stamping Stripe/CC outbound links.
+            if (!this.consentAllowsMarketing()) {
+                this.disposeMarketingLinkDecorators();
+            }
+            // Grant direction: cart-attribute stamping is cheap and idempotent (merges via
+            // /cart/update.js), so run it now instead of waiting for the next page load.
+            if (allowed && !marketingBlocked && this.config.shopifyCartAttributes === true) {
+                this.syncShopifyCartAttributes().catch((error) => {
+                    this.log('Shopify cart attribute sync failed:', error);
+                });
+            }
+            this.log('Shopify consent collected — analytics allowed:', allowed, '— marketing blocked:', marketingBlocked);
+        }
+        /** Release the automatic landing pageview once, after init and consent. */
+        trackInitialPageViewOnce() {
+            if (!this.initialPageViewReady || this.initialPageViewSent)
+                return;
+            if (!this.config.trackPageViews || !this.initialized || !this.shouldTrack())
+                return;
+            this.initialPageViewSent = true;
+            this.page();
+        }
         /**
          * Setup SPA tracking
          * Fixed Issue #15: Store original methods for cleanup
@@ -5767,7 +6765,7 @@ var Datalyr = (function (exports) {
                 stack: error.stack,
                 context,
                 timestamp: new Date().toISOString(),
-                url: window.location.href
+                url: redactUrl(window.location.href) // 9.A.4: no secret query values in error logs
             };
             this.errors.push(errorInfo);
             // Keep only recent errors
@@ -5849,6 +6847,10 @@ var Datalyr = (function (exports) {
                 window.removeEventListener('visibilitychange', this.visibilityHandler);
                 this.visibilityHandler = undefined;
             }
+            if (this.shopifyConsentHandler) {
+                document.removeEventListener('visitorConsentCollected', this.shopifyConsentHandler);
+                this.shopifyConsentHandler = undefined;
+            }
             if (this.outboundDisposer) {
                 this.outboundDisposer();
                 this.outboundDisposer = undefined;
@@ -5857,6 +6859,10 @@ var Datalyr = (function (exports) {
                 this.stripeLinksDisposer();
                 this.stripeLinksDisposer = undefined;
             }
+            if (this.stripeSessionWatcher) {
+                this.stripeSessionWatcher.stop();
+                this.stripeSessionWatcher = undefined;
+            }
             // Clean up queue
             if (this.queue) {
                 this.queue.destroy();
@@ -5882,6 +6888,8 @@ var Datalyr = (function (exports) {
             this.container = undefined;
             this.autoIdentify = undefined;
             this.lastSpaPath = null;
+            this.initialPageViewReady = false;
+            this.initialPageViewSent = false;
             // Clear any remaining data
             this.superProperties = {};
             this.userProperties = {};
@@ -5890,13 +6898,27 @@ var Datalyr = (function (exports) {
             this.log('SDK destroyed');
         }
     }
-    // Create singleton instance
-    const datalyr = new Datalyr();
+    /**
+     * Create an independent SDK instance without reading or mutating window.
+     *
+     * The CDN bootstrap uses this when an existing global is configured for a
+     * different workspace. Package consumers can also opt into multiple explicit
+     * instances without changing the default singleton contract below.
+     */
+    function createDatalyrInstance() {
+        return new Datalyr();
+    }
+    // Create the default singleton. TR-23: reuse an existing window.datalyr (a
+    // prior tag's instance or a package singleton) so npm/ESM/CJS consumers retain
+    // the established one-global behavior. Workspace conflict resolution belongs
+    // to the CDN bootstrap, which has the authoritative script-tag configuration.
+    const datalyr = (typeof window !== 'undefined' && window.datalyr) || createDatalyrInstance();
     // Expose global API
     if (typeof window !== 'undefined') {
         window.datalyr = datalyr;
     }
 
+    exports.createDatalyrInstance = createDatalyrInstance;
     exports.datalyr = datalyr;
     exports.default = datalyr;