@datalyr/web 1.7.6 → 1.7.8

package/dist/datalyr.esm.js

@@ -1,5 +1,5 @@
 /**
- * @datalyr/web v1.7.6
+ * @datalyr/web v1.7.8
  * Datalyr Web SDK - Modern attribution tracking for web applications
  * (c) 2026 Datalyr Inc.
  * Released under the MIT License
@@ -415,8 +415,23 @@ class SafeStorage {
                     // Get value from legacy key
                     const value = this.storage.getItem(legacyKey);
                     if (value) {
-                        // Extract the actual key name (remove '__dl_' prefix, keep 'dl_' part)
-                        const actualKey = legacyKey.slice('__dl_'.length); // e.g., '__dl_dl_anonymous_id' -> 'dl_anonymous_id'
+                        // WEB-29: strip ONLY the leading '__'.
+                        //
+                        // This used to strip '__dl_', producing 'dl_anonymous_id' — but that
+                        // is the LOGICAL key callers pass to get(), not the key it reads.
+                        // get() prepends this.prefix ('dl_'), so the value actually lives at
+                        // 'dl_dl_anonymous_id'. The migration therefore wrote to an address
+                        // nothing reads AND then deleted the legacy key below, destroying
+                        // the visitor's id instead of migrating it: a silent visitor reset
+                        // and attribution loss for anyone still on the old prefix.
+                        //
+                        //   legacy real key : __dl_dl_anonymous_id
+                        //   current real key:   dl_dl_anonymous_id   ← strip '__'
+                        //   logical key     :      dl_anonymous_id   ← what get() is called with
+                        //
+                        // NOTE: the double 'dl_dl_' looks like a typo and is not. Renaming
+                        // the prefix would orphan every stored id across the install base.
+                        const actualKey = legacyKey.slice('__'.length); // '__dl_dl_anonymous_id' -> 'dl_dl_anonymous_id'
                         // Only migrate if new key doesn't already exist (don't overwrite newer data)
                         if (!this.storage.getItem(actualKey)) {
                             this.storage.setItem(actualKey, value);
@@ -1089,6 +1104,9 @@ class IdentityManager {
     constructor(options = {}) {
         this.userId = null;
         this.sessionId = null;
+        /** WEB-26: bumps whenever the persisted identity changes, so an in-flight
+         *  encrypted write can tell it has been superseded. */
+        this.piiGeneration = 0;
         this.persistNewId = options.persistNewId !== false;
         this.anonymousId = this.getOrCreateAnonymousId();
         this.userId = this.getStoredUserId();
@@ -1215,6 +1233,126 @@ class IdentityManager {
         // corrupted by JSON.parse — both would fragment identity from the second page on.
         return storage.getString('dl_user_id');
     }
+    /**
+     * WEB-22 — is this user id personally identifying, and therefore not
+     * something we may write to localStorage in the clear?
+     *
+     * The auto-identify path calls `identify(email, { email })`, so the raw
+     * address became the `user_id` and was written unencrypted to `dl_user_id`.
+     * Measured 2026-07-25: on the four workspaces using auto-identify, **every**
+     * event carrying a `user_id` had an email in that column (20,502 / 20,502 on
+     * `f6260736` over 7 days) — while the surrounding code went to real lengths to
+     * encrypt the *same* address in `dl_auto_identified_email`.
+     *
+     * Deliberately narrow: an email is the case that actually occurs and the one
+     * the SDK itself creates. Opaque application ids — the overwhelming majority —
+     * keep the existing fast, synchronous, plaintext path with no behaviour change.
+     */
+    static looksLikePII(userId) {
+        return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(userId);
+    }
+    /**
+     * Persist the user id, encrypting it when it is PII.
+     *
+     * Three-way, and the ordering matters:
+     *  - not PII        → plaintext `dl_user_id`, exactly as before (sync, always works)
+     *  - PII + crypto   → encrypted `dl_user_id_pii`, and the plaintext key is REMOVED
+     *  - PII, no crypto → memory only, and both keys removed
+     *
+     * That last branch is the deliberate trade. `crypto.subtle` is absent on
+     * http:// and old browsers, and index.ts is explicit that encryption is for
+     * PII-at-rest only and "must NOT gate event delivery". So we never block an
+     * event — `this.userId` is set in memory first and every event still carries
+     * it — we only decline to *persist* an address we cannot protect. The cost is
+     * that a returning visitor on an insecure origin is re-identified by the next
+     * `identify()` call rather than restored from storage; the alternative is
+     * writing their email to disk in the clear, which is what this fixes.
+     */
+    persistUserId(userId) {
+        if (!IdentityManager.looksLikePII(userId)) {
+            storage.set('dl_user_id', userId);
+            // WEB-26: a previous PII user's encrypted id must not linger once an
+            // opaque id takes over. Reachable when identify('opaque') runs before
+            // hydrateEncryptedUserId() has populated this.userId, so index.ts sees no
+            // current user and skips its account-switch reset().
+            this.piiGeneration += 1;
+            storage.remove('dl_user_id_pii');
+            return;
+        }
+        // Never leave a plaintext copy behind — including one written by a previous
+        // SDK version before this fix existed.
+        storage.remove('dl_user_id');
+        // WEB-26: the encrypted write is async, and reset()/optOut()/consent
+        // withdrawal are not. Without a generation guard this sequence resurrects a
+        // logged-out user's email: identify(email) → write pending →
+        // remove('dl_user_id_pii') deletes NOTHING because the write has not landed
+        // → the write lands → next page load hydrates the previous user's address
+        // and every event ships user_id = their email. Stamp the write and discard
+        // it if the identity moved on while it was in flight.
+        const generation = ++this.piiGeneration;
+        storage.setEncrypted('dl_user_id_pii', userId)
+            .then(() => {
+            if (generation !== this.piiGeneration)
+                storage.remove('dl_user_id_pii');
+        })
+            .catch(() => {
+            // No crypto.subtle (http://, legacy browser) or a storage failure. Drop
+            // the at-rest copy rather than falling back to plaintext PII — but only
+            // if this write is still the current one, or we would delete a newer
+            // user's successfully-written value.
+            if (generation === this.piiGeneration)
+                storage.remove('dl_user_id_pii');
+        });
+    }
+    /**
+     * Restore a PII user id that was persisted encrypted. Async by necessity, so
+     * it cannot run in the constructor; index.ts calls it during init, right after
+     * `dataEncryption.initialize()`.
+     *
+     * Never overwrites an id already established this page load — an explicit
+     * `identify()` that has already run is fresher than anything on disk.
+     */
+    hydrateEncryptedUserId() {
+        return __awaiter(this, void 0, void 0, function* () {
+            // WEB-26 (a) — migrate a plaintext address written by <= 1.7.7.
+            //
+            // persistUserId() only removes `dl_user_id` when identify() runs again, and
+            // for the exact population this fix targets it never does:
+            // AutoIdentifyManager.initialize() returns early while
+            // `dl_auto_identified_email` exists (auto-identify.ts:88), so the callback
+            // never fires. Without this the raw email would sit in localStorage forever
+            // on every already-auto-identified browser.
+            const legacy = storage.getString('dl_user_id');
+            if (legacy && IdentityManager.looksLikePII(legacy)) {
+                if (!this.userId)
+                    this.userId = legacy;
+                this.persistUserId(legacy);
+                return;
+            }
+            // WEB-26 (b) — recover a write that was dropped because encryption was not
+            // keyed yet. index.ts sets `initialized = true` before initializeAsync()
+            // finishes, so the documented `init(); identify(email)` pattern can reach
+            // persistUserId() before dataEncryption has a key; that write rejects and
+            // nothing is persisted. By here the key exists, so retry once.
+            if (this.userId && IdentityManager.looksLikePII(this.userId)) {
+                const alreadyStored = yield storage.getEncrypted('dl_user_id_pii', null);
+                if (!alreadyStored)
+                    this.persistUserId(this.userId);
+                return;
+            }
+            if (this.userId)
+                return;
+            try {
+                const stored = yield storage.getEncrypted('dl_user_id_pii', null);
+                if (typeof stored === 'string' && stored && !this.userId) {
+                    this.userId = stored;
+                }
+            }
+            catch (_a) {
+                // Undecryptable (rotated key, corrupt blob) — stay anonymous.
+            }
+        });
+    }
     /**
      * Get the anonymous ID
      */
@@ -1263,8 +1401,9 @@ class IdentityManager {
         }
         const previousUserId = this.userId;
         this.userId = userId;
-        // Persist for future sessions
-        storage.set('dl_user_id', userId);
+        // Persist for future sessions. WEB-22: encrypted when the id is PII (the
+        // auto-identify path makes it the raw email); plaintext otherwise.
+        this.persistUserId(userId);
         // Return identity link data (will be sent as $identify event)
         return {
             anonymous_id: this.anonymousId,
@@ -1287,7 +1426,7 @@ class IdentityManager {
         // Update current user ID if aliasing to current anonymous ID
         if (!previousId || previousId === this.anonymousId) {
             this.userId = userId;
-            storage.set('dl_user_id', userId);
+            this.persistUserId(userId);
         }
         return aliasData;
     }
@@ -1297,7 +1436,12 @@ class IdentityManager {
      */
     reset() {
         this.userId = null;
+        // WEB-26: invalidate any encrypted write still in flight.
+        this.piiGeneration += 1;
         storage.remove('dl_user_id');
+        // WEB-22: the encrypted PII copy must go too, or a logout would leave the
+        // previous user's email at rest.
+        storage.remove('dl_user_id_pii');
         storage.remove('dl_user_traits');
         // Generate new anonymous ID for privacy
         this.anonymousId = `anon_${generateUUID()}`;
@@ -1624,6 +1768,12 @@ class AttributionManager {
             'gbraid', // Google Ads (iOS)
             'wbraid', // Google Ads (web)
             'ttclid', // TikTok
+            // WEB-28: OpenAI Ads. Captured by iOS and React Native since launch but
+            // never by the web SDK, so every OpenAI Ads *web* conversion delivered with
+            // attribution_type: none unless the customer passed the value by hand.
+            // Placed after the Google block to match the mobile SDKs' ordering — the
+            // first click id present wins, and this must not outrank fbclid/gclid.
+            'oppref', // OpenAI Ads
             'msclkid', // Microsoft/Bing
             'twclid', // Twitter/X
             'li_fat_id', // LinkedIn
@@ -1972,8 +2122,21 @@ class AttributionManager {
         // The old `hasCurrentAttribution` (truthy because source is always at least 'direct')
         // made the fallback below dead code AND caused storeLastTouch to overwrite a real
         // paid last-touch with 'direct'/'none' on the next internal navigation. (WEB NEW-1)
+        // `lyr` counts as a real signal. It is the Datalyr tracking-link tag — the one
+        // attribution parameter the product itself tells customers to put on a URL — and
+        // omitting it meant a bare `?lyr=X` landing (no UTMs, no click id) scored FALSE:
+        // the fallback below then replaced `current` wholesale with the stored touch,
+        // discarding the tag that had just been parsed, and neither store* call ran, so it
+        // never persisted either. Measured 2026-07-25 on the one workspace whose links are
+        // bare: 96 landing URLs carried `lyr=`, 93 events kept it — 3 lost (3.1%), all of
+        // them returning visitors (a first-time visitor has no stored touch to be replaced
+        // by, which is the only reason the number is 3 and not 96). The edge worker's own
+        // `buildDestination` emits exactly this URL shape when a link defines no UTMs.
+        // iOS (AttributionManager.swift) and React Native persist `lyr` unconditionally;
+        // this brings web into line.
         const hasRealAttribution = !!(current.clickId ||
             current.campaign ||
+            current.lyr ||
             (current.source && current.source !== 'direct'));
         // Direct / internal navigation: fall back to persisted attribution so the event
         // isn't mis-attributed to 'direct'. FSR-48: prefer the LAST touch (the most recent
@@ -2173,15 +2336,20 @@ class AttributionManager {
 const DEFAULT_CRITICAL_EVENTS = ['purchase', 'signup', 'subscribe', 'lead', 'conversion'];
 // Default high priority events that use faster batching
 const DEFAULT_HIGH_PRIORITY_EVENTS = ['add_to_cart', 'begin_checkout', 'view_item', 'search'];
-// A 429 is a deliberate backpressure signal, not a transient failure — tagged so the
-// send path can route it to the offline queue WITHOUT retrying (which would storm the
-// already-overloaded server). See sendBatch / the rateLimitedUntil gate.
+// WEB-23: how long to stop sending after a 403 (origin not allowed). Long enough not to
+// hammer a rejecting origin, short enough that a server-side config fix is picked up
+// within the same visit. A 403 carries no Retry-After, so this is fixed.
+const ORIGIN_REJECTED_BACKOFF_MS = 5 * 60 * 1000;
+// Backpressure, not failure — routed to the offline queue WITHOUT retrying (which would
+// storm an already-overloaded server) and gated behind rateLimitedUntil. Raised for a 429
+// and, since WEB-23, for a 403: both mean "not now", not "never". See sendBatch.
 class RateLimitError extends Error {
 }
-// A permanent (non-retryable) failure — a 4xx other than 408/429 (invalid event shape,
-// origin not allowed, auth). Retrying or parking it just head-of-line-blocks the offline
-// queue forever and hammers ingest. Tagged so the send paths DROP the batch instead of
-// unshifting it back to the head. (FSR-55)
+// A permanent (non-retryable) failure — a 4xx other than 403/408/429, i.e. an invalid
+// event shape (400) or bad auth (401). Retrying or parking it just head-of-line-blocks
+// the offline queue forever and hammers ingest. Tagged so the send paths DROP the batch
+// instead of unshifting it back to the head. (FSR-55, narrowed by WEB-23 — a 403 is
+// server *configuration* state and does change, so it is no longer in this class.)
 class PermanentError extends Error {
     constructor(status, message) {
         super(message || `HTTP ${status}`);
@@ -2204,6 +2372,11 @@ class EventQueue {
         this.inFlight = []; // FIXED (WEB-3): batch currently in _flight's keepalive fetch — forceFlush must NOT re-beacon it
         this.enabled = true; // FIXED (consent): when false (opt-out / withdrawn analytics consent) all enqueue/flush/drain is a no-op
         this.rateLimitedUntil = 0; // FIXED (429): skip flush/drain until the server's Retry-After window passes
+        // WEB-23: permanent drops used to be invisible — a debug-gated log line and
+        // nothing else, so 11 days of 403s looked identical to a healthy queue. Counted
+        // here and exposed via getStats() so a drop is at least observable.
+        this.droppedEventCount = 0;
+        this.lastDropStatus = null;
         // Coerce numeric config to sane values. The old `config.X || default` both turned a
         // legitimate 0 into the default AND let invalid values through — a NEGATIVE batchSize
         // made processOfflineQueue's `splice(0, -1)` loop forever and FREEZE the host tab.
@@ -2429,7 +2602,12 @@ class EventQueue {
                 // FSR-55: don't park a permanently-rejected batch — it would never succeed and
                 // would block the offline drain. Drop it.
                 if (error instanceof PermanentError) {
-                    this.log(`Dropping ${events.length} events — permanent error ${error.status}`);
+                    this.droppedEventCount += events.length;
+                    this.lastDropStatus = error.status;
+                    // console.warn, not this.log: a silent drop is the failure mode that let the
+                    // 2026-07-13 outage run for 11 days. This must be visible without debug mode.
+                    console.warn(`[Datalyr Queue] Dropped ${events.length} events — permanent error ${error.status}. ` +
+                        `${this.droppedEventCount} dropped this session.`);
                 }
                 else {
                     this.moveToOfflineQueue(events);
@@ -2491,9 +2669,24 @@ class EventQueue {
                         this.log(`Rate limited; backing off ${retryAfter}s`);
                         throw new RateLimitError('Rate limited (429)');
                     }
-                    // FSR-55: a 4xx other than 408 (timeout) is PERMANENT — invalid event shape
-                    // (400), origin not allowed (403), auth (401). Retrying / parking it just blocks
-                    // the queue and hammers ingest forever. Tag it so the caller drops the batch.
+                    // WEB-23: a 403 is NOT permanent — it is server *configuration* state, and it
+                    // changes. On 2026-07-13 an allowed_origins regression made ingest reject three
+                    // workspaces with 403; the config was fixed 11 days later, but every event sent
+                    // in between had already been dropped on the floor by the FSR-55 rule below.
+                    // Eleven days of data, unrecoverable, with only a debug log to show for it.
+                    //
+                    // Treated like 429 instead: park the events offline behind a backoff window, so
+                    // we neither hammer a rejecting origin (FSR-55's real concern) nor discard data
+                    // that would have been accepted an hour later. The window is fixed because a 403
+                    // carries no Retry-After.
+                    if (response.status === 403) {
+                        this.rateLimitedUntil = Date.now() + ORIGIN_REJECTED_BACKOFF_MS;
+                        this.log(`Origin rejected (403); backing off ${ORIGIN_REJECTED_BACKOFF_MS / 1000}s and parking events`);
+                        throw new RateLimitError('Origin rejected (403)');
+                    }
+                    // FSR-55: a 4xx other than 403/408 (timeout) is PERMANENT — invalid event shape
+                    // (400) or auth (401). Retrying / parking it just blocks the queue and hammers
+                    // ingest forever. Tag it so the caller drops the batch.
                     if (response.status >= 400 && response.status < 500 && response.status !== 408) {
                         throw new PermanentError(response.status, `HTTP ${response.status}: ${response.statusText}`);
                     }
@@ -2580,9 +2773,25 @@ class EventQueue {
         // purge. Gating here (a persistence sink, not just the send sinks) closes it.
         if (!this.enabled)
             return;
-        // FIXED (DATA-03): Check if offline queue operation already in progress
+        // WEB-24. This early return used to `return` outright — losing the batch, because
+        // _flush() has ALREADY spliced these events out of the live queue before calling
+        // here, so they would exist in neither queue.
+        //
+        // Verified 2026-07-25 that the loss is NOT currently reachable: this method is the
+        // only user of offlineQueueLock, its critical section is fully synchronous (push,
+        // splice, then a synchronous saveOfflineQueue → storage.set), and JS is
+        // single-threaded — so the flag can never be observed set on entry. The path is
+        // dead code today, and the review's "drops the batch on lock contention" is REFUTED
+        // as a live loss path.
+        //
+        // It is kept and made safe anyway, because it is one `await` away from being live:
+        // the moment saveOfflineQueue becomes async (IndexedDB, encrypted-at-rest storage,
+        // anything), contention becomes real and silent data loss returns instantly.
+        // Enqueue first, then bail — the events are never dropped either way.
         if (this.offlineQueueLock) {
-            console.warn('[Datalyr Queue] Offline queue operation already in progress');
+            console.warn('[Datalyr Queue] Offline queue busy; buffering events without persisting');
+            if (events)
+                this.offlineQueue.push(...events);
             return;
         }
         // Acquire lock
@@ -2601,6 +2810,10 @@ class EventQueue {
             if (this.offlineQueue.length > this.config.maxOfflineQueueSize) {
                 const excess = this.offlineQueue.length - this.config.maxOfflineQueueSize;
                 this.offlineQueue.splice(0, excess); // Remove oldest events
+                // WEB-27: overflow is data loss too, and a sustained 403/park loop is
+                // exactly what produces it. Count it rather than trimming silently.
+                this.droppedEventCount += excess;
+                console.warn(`[Datalyr Queue] Offline queue full — dropped ${excess} oldest event(s).`);
             }
             this.saveOfflineQueue();
         }
@@ -2709,7 +2922,15 @@ class EventQueue {
                         // that would block every event behind it forever and hammer ingest every tick.
                         // Drop it (already spliced off the front) and keep draining the rest.
                         if (error instanceof PermanentError) {
-                            this.log(`Dropping poison offline batch (${batch.length}) — permanent error ${error.status}`);
+                            // WEB-27: count and surface these too. WEB-23's whole effect is to
+                            // PARK more batches offline, so the drain — not the live flush — is
+                            // where drops now predominantly happen. Counting only _flush left the
+                            // dominant loss path invisible, which is the exact failure mode the
+                            // counter was added to end.
+                            this.droppedEventCount += batch.length;
+                            this.lastDropStatus = error.status;
+                            console.warn(`[Datalyr Queue] Dropped ${batch.length} offline events — permanent error ${error.status}. ` +
+                                `${this.droppedEventCount} dropped this session.`);
                             this.saveOfflineQueue();
                             continue;
                         }
@@ -2742,6 +2963,23 @@ class EventQueue {
     getOfflineQueueSize() {
         return this.offlineQueue.length;
     }
+    /**
+     * WEB-23: queue health, including events the SDK gave up on.
+     *
+     * `droppedEvents` is the number this session discarded as permanently rejected
+     * (a 400/401). It exists because a silent drop is precisely the failure mode
+     * that let the 2026-07-13 `allowed_origins` outage run for eleven days looking
+     * exactly like a healthy queue. A non-zero value here means data was lost.
+     */
+    getStats() {
+        return {
+            queued: this.queue.length,
+            offline: this.offlineQueue.length,
+            droppedEvents: this.droppedEventCount,
+            lastDropStatus: this.lastDropStatus,
+            backoffUntil: this.rateLimitedUntil,
+        };
+    }
     /**
      * Get network status
      */
@@ -4370,6 +4608,256 @@ class AutoIdentifyManager {
 // someone else (and feeds that person's email to Meta advanced matching).
 AutoIdentifyManager.THIRD_PARTY_EMAIL_FIELD = /(recipient|friend|gift|refer|invite|colleague|coworker|share|to[-_]?email|email[-_]?to|second(ary)?[-_]?email)/i;
 
+/**
+ * Stripe Checkout Session capture.
+ *
+ * WHY THIS EXISTS
+ * syncStripePaymentLinks stamps `client_reference_id` onto buy.stripe.com
+ * anchors, and deliberately never onto checkout.stripe.com — a Checkout Session
+ * URL ignores the param because the session already exists server-side. That
+ * leaves the single most common SaaS pattern uncovered: the merchant's backend
+ * creates a Session and the browser is sent to checkout.stripe.com/c/pay/cs_...
+ * The payment then reaches our webhook with no visitor at all.
+ *
+ * Measured 2026-07-25, 30d: of payers arriving via Stripe webhooks, 0.5% (one
+ * tenant, 128/28,187) and 13.3% (another, 13/98) had ANY web pageview on the
+ * same visitor. Not a misconfiguration — no tenant is wired, because being
+ * wired currently requires the merchant to hand-write client_reference_id.
+ *
+ * WHAT THIS DOES
+ * The session id must reach the browser for the redirect to happen at all, so
+ * we observe it rather than trying to inject anything:
+ *   1. fetch/XHR response bodies      — `{url}` or `{sessionId}` from the
+ *                                       merchant's own create-session endpoint
+ *   2. anchor clicks + window.open    — direct links to checkout.stripe.com
+ * A server-side 302 straight to Stripe never exposes the id to JS and is NOT
+ * covered here; that case falls back to the email bridge.
+ *
+ * WHY THIS IS SAFE TO DEFAULT ON, WHEN autoIdentifyAPI IS NOT
+ * autoIdentifyAPI scans the same traffic for EMAILS, which is why it defaults
+ * off: an admin viewing a customer record gets identified as that customer, and
+ * a wrong email propagates into Meta advanced matching. A `cs_live_...` token is
+ * unambiguous, belongs to exactly one checkout, and is not PII. There is no
+ * mis-identification failure mode to guard against — only the wrapper itself,
+ * which is why every hook below is transparent and failure-isolated.
+ */
+/** Stripe Checkout Session ids: cs_live_… / cs_test_… */
+const SESSION_ID_RE = /cs_(?:live|test)_[A-Za-z0-9]{8,}/;
+/** Hosts whose URLs carry a session id in the path. Exact match, never substring. */
+const CHECKOUT_HOSTS = new Set(['checkout.stripe.com']);
+/**
+ * Response bodies are scanned in full, so cap what we're willing to read. A
+ * create-session response is a few hundred bytes; anything large is not it, and
+ * reading it would cost the merchant's page real memory and main-thread time.
+ */
+const MAX_SCAN_BYTES = 65536;
+/** Bodies worth scanning. Stripe ids arrive as JSON or text, never as binary. */
+const SCANNABLE_TYPE_RE = /(json|text|javascript)/i;
+function extractSessionId(text) {
+    if (!text)
+        return null;
+    const m = SESSION_ID_RE.exec(text);
+    return m ? m[0] : null;
+}
+/**
+ * True when `href` points at a Stripe-hosted checkout. Uses the URL API and
+ * exact host equality — `a[href*="checkout.stripe.com"]` would match
+ * `evil.com/checkout.stripe.com/x` and `checkout.stripe.com.evil.com`.
+ */
+function isCheckoutUrl(href, base) {
+    try {
+        const host = new URL(href, base !== null && base !== void 0 ? base : (typeof window !== 'undefined' ? window.location.href : undefined)).hostname.toLowerCase();
+        return CHECKOUT_HOSTS.has(host);
+    }
+    catch (_a) {
+        return false;
+    }
+}
+class StripeSessionWatcher {
+    constructor(options = {}) {
+        var _a, _b;
+        this.seen = new Set();
+        this.disposers = [];
+        this.started = false;
+        this.maxSessions = (_a = options.maxSessions) !== null && _a !== void 0 ? _a : 5;
+        this.maxScanBytes = (_b = options.maxScanBytes) !== null && _b !== void 0 ? _b : MAX_SCAN_BYTES;
+    }
+    start(sink) {
+        if (this.started || typeof window === 'undefined')
+            return;
+        this.started = true;
+        this.sink = sink;
+        this.hookFetch();
+        this.hookXhr();
+        this.hookClicks();
+        this.hookWindowOpen();
+    }
+    stop() {
+        // Restore in reverse so a later wrapper never re-installs an earlier one.
+        for (const dispose of this.disposers.reverse()) {
+            try {
+                dispose();
+            }
+            catch (_a) {
+                /* idempotent */
+            }
+        }
+        this.disposers = [];
+        this.started = false;
+        this.sink = undefined;
+    }
+    /** Report a session id at most once, and never more than maxSessions per page. */
+    emit(sessionId) {
+        var _a;
+        if (!sessionId || this.seen.has(sessionId))
+            return;
+        if (this.seen.size >= this.maxSessions)
+            return;
+        this.seen.add(sessionId);
+        try {
+            (_a = this.sink) === null || _a === void 0 ? void 0 : _a.call(this, sessionId);
+        }
+        catch (_b) {
+            // A throwing sink must never surface inside the merchant's fetch chain.
+        }
+    }
+    /**
+     * Scan a Response WITHOUT disturbing the merchant's own read. `clone()` must
+     * happen synchronously, before the caller can consume the body; the read of
+     * the clone is deliberately not awaited by the caller.
+     */
+    scanResponse(response) {
+        var _a, _b, _c, _d, _e, _f;
+        try {
+            const type = (_c = (_b = (_a = response.headers) === null || _a === void 0 ? void 0 : _a.get) === null || _b === void 0 ? void 0 : _b.call(_a, 'content-type')) !== null && _c !== void 0 ? _c : '';
+            if (type && !SCANNABLE_TYPE_RE.test(type))
+                return;
+            const declared = Number((_f = (_e = (_d = response.headers) === null || _d === void 0 ? void 0 : _d.get) === null || _e === void 0 ? void 0 : _e.call(_d, 'content-length')) !== null && _f !== void 0 ? _f : NaN);
+            if (Number.isFinite(declared) && declared > this.maxScanBytes)
+                return;
+            const clone = typeof response.clone === 'function' ? response.clone() : null;
+            if (!clone)
+                return;
+            void clone
+                .text()
+                .then((body) => this.emit(extractSessionId(body.slice(0, this.maxScanBytes))))
+                .catch(() => {
+                /* body already disturbed / opaque response — nothing to do */
+            });
+        }
+        catch (_g) {
+            /* never let observation break the request */
+        }
+    }
+    hookFetch() {
+        if (typeof window.fetch !== 'function')
+            return;
+        const original = window.fetch;
+        const self = this;
+        const patched = function patchedFetch(...args) {
+            const result = original.apply(this !== null && this !== void 0 ? this : window, args);
+            try {
+                // Attach passively: the merchant still gets the original promise, and a
+                // rejection here is theirs to handle, not ours to observe twice.
+                result.then((response) => self.scanResponse(response)).catch(() => { });
+            }
+            catch (_a) {
+                /* ignore */
+            }
+            return result;
+        };
+        window.fetch = patched;
+        this.disposers.push(() => {
+            // Only restore if nobody wrapped us afterwards — clobbering a later
+            // wrapper would silently disable whatever installed it.
+            if (window.fetch === patched)
+                window.fetch = original;
+        });
+    }
+    hookXhr() {
+        if (typeof XMLHttpRequest === 'undefined')
+            return;
+        const proto = XMLHttpRequest.prototype;
+        const originalSend = proto.send;
+        if (typeof originalSend !== 'function')
+            return;
+        const self = this;
+        const patched = function patchedSend(...args) {
+            try {
+                this.addEventListener('load', () => {
+                    try {
+                        // responseText throws for blob/arraybuffer response types.
+                        if (this.responseType !== '' && this.responseType !== 'text')
+                            return;
+                        const body = this.responseText;
+                        if (!body || body.length > self.maxScanBytes)
+                            return;
+                        self.emit(extractSessionId(body));
+                    }
+                    catch (_a) {
+                        /* ignore */
+                    }
+                });
+            }
+            catch (_a) {
+                /* ignore */
+            }
+            return originalSend.apply(this, args);
+        };
+        proto.send = patched;
+        this.disposers.push(() => {
+            if (proto.send === patched)
+                proto.send = originalSend;
+        });
+    }
+    /**
+     * Direct links to checkout.stripe.com. Capture phase so we still see the click
+     * when the merchant's own handler calls stopPropagation().
+     */
+    hookClicks() {
+        if (typeof document === 'undefined')
+            return;
+        const onClick = (e) => {
+            var _a, _b;
+            try {
+                const target = (_b = (_a = e.target) === null || _a === void 0 ? void 0 : _a.closest) === null || _b === void 0 ? void 0 : _b.call(_a, 'a[href]');
+                if (!target || !target.href || !isCheckoutUrl(target.href))
+                    return;
+                this.emit(extractSessionId(target.href));
+            }
+            catch (_c) {
+                /* never block navigation */
+            }
+        };
+        document.addEventListener('click', onClick, true);
+        this.disposers.push(() => document.removeEventListener('click', onClick, true));
+    }
+    hookWindowOpen() {
+        if (typeof window.open !== 'function')
+            return;
+        const original = window.open;
+        const self = this;
+        const patched = function patchedOpen(...args) {
+            var _a;
+            try {
+                const url = args[0];
+                const href = typeof url === 'string' ? url : (_a = url === null || url === void 0 ? void 0 : url.toString) === null || _a === void 0 ? void 0 : _a.call(url);
+                if (href && isCheckoutUrl(href))
+                    self.emit(extractSessionId(href));
+            }
+            catch (_b) {
+                /* ignore */
+            }
+            return original.apply(this !== null && this !== void 0 ? this : window, args);
+        };
+        window.open = patched;
+        this.disposers.push(() => {
+            if (window.open === patched)
+                window.open = original;
+        });
+    }
+}
+
 /** Keys the remote config is allowed to fill on DatalyrConfig. */
 const REMOTE_KEYS = [
     'autoIdentify',
@@ -4377,6 +4865,7 @@ const REMOTE_KEYS = [
     'autoIdentifyAPI',
     'autoIdentifyShopify',
     'shopifyCartAttributes',
+    'stripeCheckoutSessions',
     'checkoutChampDomains',
     'respectGlobalPrivacyControl',
     'respectDoNotTrack',
@@ -4415,6 +4904,16 @@ function applyRemoteConfig(config, remote, explicitKeys) {
  * Datalyr Web SDK
  * Modern attribution tracking for web applications
  */
+/**
+ * WEB-20. Fingerprint of the last identify() that actually emitted, so a host
+ * app calling identify() on every route change does not re-emit an unchanged
+ * identity. Cleared by reset(). Mirrors iOS `datalyr_last_identity_fingerprint`
+ * and RN `@datalyr/last_identity_fingerprint`.
+ *
+ * Not PII: the stored value is a hash, and it is written through the same
+ * `storage` wrapper as every other key (so it inherits the `dl_` prefix).
+ */
+const IDENTIFY_FINGERPRINT_KEY = 'dl_identify_fingerprint';
 class Datalyr {
     constructor() {
         // Keys the caller passed to init() (before built-in defaults were merged).
@@ -4430,10 +4929,26 @@ class Datalyr {
         this.errors = [];
         this.MAX_ERRORS = 50;
         this.lastSpaPath = null; // dedups SPA pageviews (replaceState-on-mount double-fire)
+        // Shopify loads Customer Privacy asynchronously. Keep the initial pageview
+        // pending until initialization is complete and analytics consent is known,
+        // then release it exactly once when consent allows tracking.
+        this.initialPageViewReady = false;
+        this.initialPageViewSent = false;
         // FIXED (ISSUE-01): Async initialization promise to prevent race conditions
         this.initializationPromise = null;
         // Opt-out check moved to init() after cookies configured (Issue #14)
     }
+    /**
+     * Return the workspace configured for this instance, or null before init().
+     *
+     * CDN bootstrap uses this public accessor instead of reaching into the
+     * private runtime config when deciding whether an existing global belongs
+     * to the requested workspace.
+     */
+    getWorkspaceId() {
+        var _a, _b;
+        return (_b = (_a = this.config) === null || _a === void 0 ? void 0 : _a.workspaceId) !== null && _b !== void 0 ? _b : null;
+    }
     /**
      * Initialize the SDK
      */
@@ -4577,6 +5092,11 @@ class Datalyr {
                         const deviceId = this.identity.getAnonymousId();
                         yield dataEncryption.initialize(this.config.workspaceId, deviceId);
                         this.userProperties = yield storage.getEncrypted('dl_user_traits', {});
+                        // WEB-22: restore a PII user id that was persisted encrypted. Must run
+                        // here — it needs dataEncryption to be initialized, so it cannot happen
+                        // in the IdentityManager constructor. It never overwrites an id already
+                        // set by an explicit identify() earlier in this page load.
+                        yield this.identity.hydrateEncryptedUserId();
                         this.log('Encryption initialized, user properties loaded');
                     }
                     catch (encErr) {
@@ -4666,14 +5186,20 @@ class Datalyr {
                         // Setup auto-identify callback
                         this.autoIdentify.initialize((email, source) => {
                             this.log(`Auto-identified user: ${email} from ${source}`);
-                            // Track auto-identify event
-                            this.track('$auto_identify', {
-                                email,
-                                source,
-                                timestamp: Date.now()
-                            });
-                            // Automatically call identify with email
-                            this.identify(email, { email });
+                            // WEB-21: ONE event, not two.
+                            //
+                            // This used to emit `$auto_identify` and then call identify(),
+                            // which emits `$identify` — two events ~1ms apart carrying the same
+                            // email. Production over 7 days on workspace f6260736 showed a
+                            // perfect 379 / 379 / 379 split ($identify / $auto_identify /
+                            // visitors): every auto-identification was booked twice.
+                            //
+                            // Nothing consumed `$auto_identify`: grepped across the whole
+                            // platform (app/, lib/, all Cloudflare workers, all Tinybird pipes)
+                            // — zero readers, while prod carried 6,197 of them in 30 days.
+                            // The only information it added over `$identify` was WHICH detector
+                            // found the email, so that is preserved as a trait instead.
+                            this.identify(email, { email, auto_identify_source: source });
                         });
                     }
                     // Stamp attribution signals into the Shopify cart (OPT-IN, default off).
@@ -4704,10 +5230,22 @@ class Datalyr {
                     if (this.config.stripePaymentLinks !== false && this.shouldTrack()) {
                         this.syncStripePaymentLinks((_b = this.config.stripeLinkDomains) !== null && _b !== void 0 ? _b : []);
                     }
-                    // Track initial page view if enabled (AFTER encryption ready)
-                    if (this.config.trackPageViews) {
-                        this.page();
+                    // Checkout Session capture (DEFAULT ON). The decorator above cannot help
+                    // when the merchant's BACKEND creates the session — checkout.stripe.com
+                    // ignores client_reference_id post-creation — which is how most SaaS
+                    // checkouts work, and why payers arrive at our webhook with no visitor
+                    // (measured 0.5% and 13.3% visitor coverage on the two Stripe tenants).
+                    // The session id still has to reach the browser, so we observe it and
+                    // let the server join on session.id. Same shouldTrack() gate as the
+                    // decorator: an opted-out visitor's id is never paired with a checkout.
+                    if (this.config.stripeCheckoutSessions !== false && this.shouldTrack()) {
+                        this.startStripeSessionCapture();
                     }
+                    // Track the initial page view after encryption is ready. On Shopify the
+                    // Customer Privacy API can still be loading, so retain one pending
+                    // pageview and release it from onShopifyConsentChanged() once allowed.
+                    this.initialPageViewReady = true;
+                    this.trackInitialPageViewOnce();
                     this.log('Async initialization complete');
                 }
                 catch (error) {
@@ -4840,6 +5378,50 @@ class Datalyr {
     /**
      * Identify a user
      */
+    /**
+     * Stable fingerprint of an identity for redundant-emit suppression (WEB-20).
+     *
+     * Keys are sorted and each value is JSON-serialized, so `{a,b}` and `{b,a}`
+     * collapse to one identity while a genuinely changed nested trait does not.
+     * (The mobile SDKs use `String(value)`, which flattens every object to
+     * `[object Object]` and can swallow a real change; web traits are plain JSON,
+     * so it can afford to be exact.)
+     *
+     * Hashed rather than stored raw so the key does not become another copy of the
+     * user's traits at rest. Being honest about the strength: a 32-bit
+     * non-cryptographic digest sitting beside a readable `dl_dl_anonymous_id` is
+     * NOT protection against a determined reader — it defeats casual inspection
+     * and bulk scraping, nothing more. The PII that matters is handled properly
+     * (encrypted `dl_user_id_pii`, encrypted `dl_user_traits`). 32 bits also means
+     * a ~1-in-4.3e9 chance per identity that a genuine change is suppressed;
+     * acceptable for change detection, which is all this is.
+     */
+    identityFingerprint(userId, traits = {}) {
+        const stableTraits = Object.keys(traits || {})
+            .sort()
+            .map((key) => {
+            let value;
+            try {
+                value = JSON.stringify(traits[key]);
+            }
+            catch (_a) {
+                // Circular/unserializable trait — fall back to a coarse marker rather
+                // than throwing inside identify().
+                value = '[unserializable]';
+            }
+            return `${key}=${value}`;
+        })
+            .join('&');
+        const input = `${this.identity.getAnonymousId()}|${userId}|${stableTraits}`;
+        // 32-bit FNV-1a. Not cryptographic — this only needs to detect change, and
+        // it must be synchronous (crypto.subtle is async and identify() is not).
+        let hash = 0x811c9dc5;
+        for (let i = 0; i < input.length; i++) {
+            hash ^= input.charCodeAt(i);
+            hash = Math.imul(hash, 0x01000193);
+        }
+        return (hash >>> 0).toString(16);
+    }
     identify(userId, traits = {}) {
         if (!this.initialized) {
             console.warn('[Datalyr] SDK not initialized. Call init() first.');
@@ -4879,8 +5461,31 @@ class Datalyr {
                 // If encryption fails, user traits are only stored in memory (this.userProperties)
                 // and will be lost on page reload - but PII is NOT exposed in localStorage
             });
-            // Track $identify event
-            this.track('$identify', Object.assign(Object.assign({}, identityLink), { traits }));
+            // WEB-20: redundant-identify suppression, matching iOS 2.1.11 / RN 1.7.16.
+            //
+            // identify() is host-app-driven and SPA routers commonly call it in a
+            // route effect, so an unchanged identity was re-emitted on every
+            // navigation. The mobile SDKs got this in 2.1.10/1.7.15; web did not.
+            //
+            // Fingerprint = anonymousId | userId | sorted traits. The anonymous id is
+            // included so a reset()/rotation always re-emits and identity links are
+            // never lost — only exact repeats are skipped.
+            //
+            // Only the EVENT is suppressed. `this.identity.identify()` above has
+            // already persisted `dl_user_id`, traits are still merged and encrypted,
+            // and the plugin handlers below still run on every call — a plugin's
+            // `identify` hook is a customer extension point whose semantics we cannot
+            // assume, so its contract ("called when identify() is called") is
+            // deliberately left intact.
+            const identityFingerprint = this.identityFingerprint(userId, traits);
+            const isRedundantIdentify = storage.getString(IDENTIFY_FINGERPRINT_KEY, null) === identityFingerprint;
+            if (isRedundantIdentify) {
+                this.log('Skipping redundant identify (unchanged identity):', userId);
+            }
+            else {
+                storage.set(IDENTIFY_FINGERPRINT_KEY, identityFingerprint);
+                this.track('$identify', Object.assign(Object.assign({}, identityLink), { traits }));
+            }
             // Call plugin handlers
             if (this.config.plugins) {
                 for (const plugin of this.config.plugins) {
@@ -4900,6 +5505,18 @@ class Datalyr {
             this.trackError(error, { userId });
         }
     }
+    /**
+     * WEB-27: queue health, including events the SDK gave up on.
+     *
+     * `getStats()` existed on EventQueue but was unreachable — `queue` is private
+     * and nothing exposed it, so the observability fix could not actually be
+     * observed. A non-zero `droppedEvents` means data was lost.
+     */
+    getQueueStats() {
+        if (!this.queue)
+            return null;
+        return this.queue.getStats();
+    }
     /**
      * Track a page view
      */
@@ -5017,6 +5634,9 @@ class Datalyr {
         // values to the next user's events (cross-user contamination on shared devices).
         this.superProperties = {};
         storage.remove('dl_user_traits');
+        // WEB-20: drop the identify fingerprint, so a logout→login (or a different
+        // user on this browser) always re-emits $identify and the link is rebuilt.
+        storage.remove(IDENTIFY_FINGERPRINT_KEY);
         // Clear the auto-identify guard so a different user on the same browser is
         // re-captured (it short-circuits while dl_auto_identified_email is present), and so
         // the prior user's email isn't left at rest after logout.
@@ -5164,16 +5784,21 @@ class Datalyr {
      * (same convention as pixels/auto-identify).
      */
     disposeMarketingLinkDecorators() {
-        var _a, _b;
+        var _a, _b, _c;
         try {
             (_a = this.stripeLinksDisposer) === null || _a === void 0 ? void 0 : _a.call(this);
         }
-        catch ( /* best-effort */_c) { /* best-effort */ }
+        catch ( /* best-effort */_d) { /* best-effort */ }
         this.stripeLinksDisposer = undefined;
         try {
-            (_b = this.outboundDisposer) === null || _b === void 0 ? void 0 : _b.call(this);
+            (_b = this.stripeSessionWatcher) === null || _b === void 0 ? void 0 : _b.stop();
         }
-        catch ( /* best-effort */_d) { /* best-effort */ }
+        catch ( /* best-effort */_e) { /* best-effort */ }
+        this.stripeSessionWatcher = undefined;
+        try {
+            (_c = this.outboundDisposer) === null || _c === void 0 ? void 0 : _c.call(this);
+        }
+        catch ( /* best-effort */_f) { /* best-effort */ }
         this.outboundDisposer = undefined;
     }
     optOut() {
@@ -5202,8 +5827,22 @@ class Datalyr {
         // Purge PII at rest.
         this.userProperties = {};
         storage.remove('dl_user_traits');
+        // WEB-26: remove the PLAINTEXT id as well. optOut() purged only the
+        // encrypted copy, so an opted-out visitor whose email was written by an
+        // older build kept it at rest — the one state where that is least
+        // defensible.
+        storage.remove('dl_user_id');
+        storage.remove('dl_user_id_pii');
+        storage.remove(IDENTIFY_FINGERPRINT_KEY);
         storage.remove('dl_auto_identified_email');
         storage.remove('dl_journey');
+        // WEB-25: first/last touch hold redacted-but-full landing URLs, referrers and
+        // click ids for up to 90 days. reset() has always cleared them; optOut() did
+        // not — so an opted-out visitor kept marketing attribution at rest, which is
+        // the one state where it is least defensible. Same rationale as dl_journey
+        // directly above.
+        storage.remove('dl_first_touch');
+        storage.remove('dl_last_touch');
         this.log('User opted out');
     }
     /**
@@ -5266,8 +5905,16 @@ class Datalyr {
             this.autoIdentify = undefined;
             this.userProperties = {};
             storage.remove('dl_user_traits');
+            // WEB-26: see optOut() — the plaintext id must go too.
+            storage.remove('dl_user_id');
+            storage.remove('dl_user_id_pii');
+            storage.remove(IDENTIFY_FINGERPRINT_KEY);
             storage.remove('dl_auto_identified_email');
             storage.remove('dl_journey');
+            // WEB-25: see optOut() — withdrawn analytics consent must not leave 90-day
+            // marketing attribution at rest either.
+            storage.remove('dl_first_touch');
+            storage.remove('dl_last_touch');
         }
         else {
             // TR-15 (P3): grant → persist the in-memory anon id now (see onShopifyConsentChanged).
@@ -5521,6 +6168,39 @@ class Datalyr {
      * changes. window.open(paymentLink) is not covered (use getVisitorId()
      * manually); iframe/shadow-DOM links are unreachable from document.
      */
+    /**
+     * Observe Stripe Checkout Session ids and report each one once.
+     *
+     * The event is what carries the pairing: the server stores
+     * (stripe_session_id -> visitor_id) and, when checkout.session.completed
+     * arrives without a client_reference_id, joins on session.id and feeds the
+     * SAME cacheCustomerVisitor path the Payment Link flow already uses — so
+     * every later invoice for that customer inherits the visitor too.
+     *
+     * Consent is re-checked at emit time, not just at init: a visitor can
+     * withdraw between page load and checkout, and this pairing is exactly the
+     * kind of identity link that must stop when they do.
+     */
+    startStripeSessionCapture() {
+        if (this.stripeSessionWatcher)
+            return;
+        const watcher = new StripeSessionWatcher();
+        this.stripeSessionWatcher = watcher;
+        watcher.start((stripeSessionId) => {
+            var _a;
+            if (!this.shouldTrack())
+                return;
+            this.track('$stripe_checkout_session', { stripe_session_id: stripeSessionId });
+            // The very next thing this page does is navigate to Stripe, so flush now
+            // rather than let the batch timer lose the pairing to the unload.
+            try {
+                (_a = this.queue) === null || _a === void 0 ? void 0 : _a.flush();
+            }
+            catch (_b) {
+                /* best-effort — never block the checkout */
+            }
+        });
+    }
     syncStripePaymentLinks(extraDomains) {
         if (typeof window === "undefined" || typeof document === "undefined")
             return;
@@ -5747,7 +6427,7 @@ class Datalyr {
             // drift from the package again (it sat at 1.7.4 across the 1.7.5 release). The
             // build guard (scripts/check-bundle.js, run by build:check) still verifies the
             // deployable bundles carry the package.json version. (FSR-103)
-            sdk_version: '1.7.6',
+            sdk_version: '1.7.8',
             sdk_name: 'datalyr-web-sdk',
             // A3-25: versioned-envelope stamp. Every SDK emits schema_version so the ingest/contract
             // layer can key on ONE canonical envelope version (snake_case fields, event_name/event_data
@@ -5940,6 +6620,8 @@ class Datalyr {
         // visitor_id that vanishes on the next page load. Idempotent.
         if (allowed)
             this.identity.enablePersistence();
+        if (allowed)
+            this.trackInitialPageViewOnce();
         if (!allowed) {
             // Mirror setConsent() withdrawal: purge buffered events so events captured
             // before the decline can't drain if consent is later re-granted.
@@ -5971,6 +6653,15 @@ class Datalyr {
         }
         this.log('Shopify consent collected — analytics allowed:', allowed, '— marketing blocked:', marketingBlocked);
     }
+    /** Release the automatic landing pageview once, after init and consent. */
+    trackInitialPageViewOnce() {
+        if (!this.initialPageViewReady || this.initialPageViewSent)
+            return;
+        if (!this.config.trackPageViews || !this.initialized || !this.shouldTrack())
+            return;
+        this.initialPageViewSent = true;
+        this.page();
+    }
     /**
      * Setup SPA tracking
      * Fixed Issue #15: Store original methods for cleanup
@@ -6165,6 +6856,10 @@ class Datalyr {
             this.stripeLinksDisposer();
             this.stripeLinksDisposer = undefined;
         }
+        if (this.stripeSessionWatcher) {
+            this.stripeSessionWatcher.stop();
+            this.stripeSessionWatcher = undefined;
+        }
         // Clean up queue
         if (this.queue) {
             this.queue.destroy();
@@ -6190,6 +6885,8 @@ class Datalyr {
         this.container = undefined;
         this.autoIdentify = undefined;
         this.lastSpaPath = null;
+        this.initialPageViewReady = false;
+        this.initialPageViewSent = false;
         // Clear any remaining data
         this.superProperties = {};
         this.userProperties = {};
@@ -6198,18 +6895,25 @@ class Datalyr {
         this.log('SDK destroyed');
     }
 }
-// Create singleton instance. TR-23: reuse an existing window.datalyr (a prior tag's instance —
-// Shopify App Embed + a manual snippet coexisting, or a double-included bundle) instead of
-// constructing a SECOND one. Two instances each patch history.pushState and fire their own
-// pageviews (distinct event_ids → no server-side dedup). A plain truthy check (NOT instanceof):
-// two <script> tags run two separate IIFEs whose Datalyr classes are structurally identical but
-// distinct objects, so instanceof would fail across them. With one shared instance, the second
-// tag's bootstrap init() hits the instance-level `initialized` guard and no-ops.
-const datalyr = (typeof window !== 'undefined' && window.datalyr) || new Datalyr();
+/**
+ * Create an independent SDK instance without reading or mutating window.
+ *
+ * The CDN bootstrap uses this when an existing global is configured for a
+ * different workspace. Package consumers can also opt into multiple explicit
+ * instances without changing the default singleton contract below.
+ */
+function createDatalyrInstance() {
+    return new Datalyr();
+}
+// Create the default singleton. TR-23: reuse an existing window.datalyr (a
+// prior tag's instance or a package singleton) so npm/ESM/CJS consumers retain
+// the established one-global behavior. Workspace conflict resolution belongs
+// to the CDN bootstrap, which has the authoritative script-tag configuration.
+const datalyr = (typeof window !== 'undefined' && window.datalyr) || createDatalyrInstance();
 // Expose global API
 if (typeof window !== 'undefined') {
     window.datalyr = datalyr;
 }
 
-export { datalyr, datalyr as default };
+export { createDatalyrInstance, datalyr, datalyr as default };
 //# sourceMappingURL=datalyr.esm.js.map