@datalyr/web 1.7.6 → 1.7.9

package/dist/datalyr.js

@@ -1,5 +1,5 @@
 /**
- * @datalyr/web v1.7.6
+ * @datalyr/web v1.7.9
  * Datalyr Web SDK - Modern attribution tracking for web applications
  * (c) 2026 Datalyr Inc.
  * Released under the MIT License
@@ -418,8 +418,23 @@ var Datalyr = (function (exports) {
                         // Get value from legacy key
                         const value = this.storage.getItem(legacyKey);
                         if (value) {
-                            // Extract the actual key name (remove '__dl_' prefix, keep 'dl_' part)
-                            const actualKey = legacyKey.slice('__dl_'.length); // e.g., '__dl_dl_anonymous_id' -> 'dl_anonymous_id'
+                            // WEB-29: strip ONLY the leading '__'.
+                            //
+                            // This used to strip '__dl_', producing 'dl_anonymous_id' — but that
+                            // is the LOGICAL key callers pass to get(), not the key it reads.
+                            // get() prepends this.prefix ('dl_'), so the value actually lives at
+                            // 'dl_dl_anonymous_id'. The migration therefore wrote to an address
+                            // nothing reads AND then deleted the legacy key below, destroying
+                            // the visitor's id instead of migrating it: a silent visitor reset
+                            // and attribution loss for anyone still on the old prefix.
+                            //
+                            //   legacy real key : __dl_dl_anonymous_id
+                            //   current real key:   dl_dl_anonymous_id   ← strip '__'
+                            //   logical key     :      dl_anonymous_id   ← what get() is called with
+                            //
+                            // NOTE: the double 'dl_dl_' looks like a typo and is not. Renaming
+                            // the prefix would orphan every stored id across the install base.
+                            const actualKey = legacyKey.slice('__'.length); // '__dl_dl_anonymous_id' -> 'dl_dl_anonymous_id'
                             // Only migrate if new key doesn't already exist (don't overwrite newer data)
                             if (!this.storage.getItem(actualKey)) {
                                 this.storage.setItem(actualKey, value);
@@ -1092,6 +1107,9 @@ var Datalyr = (function (exports) {
         constructor(options = {}) {
             this.userId = null;
             this.sessionId = null;
+            /** WEB-26: bumps whenever the persisted identity changes, so an in-flight
+             *  encrypted write can tell it has been superseded. */
+            this.piiGeneration = 0;
             this.persistNewId = options.persistNewId !== false;
             this.anonymousId = this.getOrCreateAnonymousId();
             this.userId = this.getStoredUserId();
@@ -1218,6 +1236,126 @@ var Datalyr = (function (exports) {
             // corrupted by JSON.parse — both would fragment identity from the second page on.
             return storage.getString('dl_user_id');
         }
+        /**
+         * WEB-22 — is this user id personally identifying, and therefore not
+         * something we may write to localStorage in the clear?
+         *
+         * The auto-identify path calls `identify(email, { email })`, so the raw
+         * address became the `user_id` and was written unencrypted to `dl_user_id`.
+         * Measured 2026-07-25: on the four workspaces using auto-identify, **every**
+         * event carrying a `user_id` had an email in that column (20,502 / 20,502 on
+         * `f6260736` over 7 days) — while the surrounding code went to real lengths to
+         * encrypt the *same* address in `dl_auto_identified_email`.
+         *
+         * Deliberately narrow: an email is the case that actually occurs and the one
+         * the SDK itself creates. Opaque application ids — the overwhelming majority —
+         * keep the existing fast, synchronous, plaintext path with no behaviour change.
+         */
+        static looksLikePII(userId) {
+            return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(userId);
+        }
+        /**
+         * Persist the user id, encrypting it when it is PII.
+         *
+         * Three-way, and the ordering matters:
+         *  - not PII        → plaintext `dl_user_id`, exactly as before (sync, always works)
+         *  - PII + crypto   → encrypted `dl_user_id_pii`, and the plaintext key is REMOVED
+         *  - PII, no crypto → memory only, and both keys removed
+         *
+         * That last branch is the deliberate trade. `crypto.subtle` is absent on
+         * http:// and old browsers, and index.ts is explicit that encryption is for
+         * PII-at-rest only and "must NOT gate event delivery". So we never block an
+         * event — `this.userId` is set in memory first and every event still carries
+         * it — we only decline to *persist* an address we cannot protect. The cost is
+         * that a returning visitor on an insecure origin is re-identified by the next
+         * `identify()` call rather than restored from storage; the alternative is
+         * writing their email to disk in the clear, which is what this fixes.
+         */
+        persistUserId(userId) {
+            if (!IdentityManager.looksLikePII(userId)) {
+                storage.set('dl_user_id', userId);
+                // WEB-26: a previous PII user's encrypted id must not linger once an
+                // opaque id takes over. Reachable when identify('opaque') runs before
+                // hydrateEncryptedUserId() has populated this.userId, so index.ts sees no
+                // current user and skips its account-switch reset().
+                this.piiGeneration += 1;
+                storage.remove('dl_user_id_pii');
+                return;
+            }
+            // Never leave a plaintext copy behind — including one written by a previous
+            // SDK version before this fix existed.
+            storage.remove('dl_user_id');
+            // WEB-26: the encrypted write is async, and reset()/optOut()/consent
+            // withdrawal are not. Without a generation guard this sequence resurrects a
+            // logged-out user's email: identify(email) → write pending →
+            // remove('dl_user_id_pii') deletes NOTHING because the write has not landed
+            // → the write lands → next page load hydrates the previous user's address
+            // and every event ships user_id = their email. Stamp the write and discard
+            // it if the identity moved on while it was in flight.
+            const generation = ++this.piiGeneration;
+            storage.setEncrypted('dl_user_id_pii', userId)
+                .then(() => {
+                if (generation !== this.piiGeneration)
+                    storage.remove('dl_user_id_pii');
+            })
+                .catch(() => {
+                // No crypto.subtle (http://, legacy browser) or a storage failure. Drop
+                // the at-rest copy rather than falling back to plaintext PII — but only
+                // if this write is still the current one, or we would delete a newer
+                // user's successfully-written value.
+                if (generation === this.piiGeneration)
+                    storage.remove('dl_user_id_pii');
+            });
+        }
+        /**
+         * Restore a PII user id that was persisted encrypted. Async by necessity, so
+         * it cannot run in the constructor; index.ts calls it during init, right after
+         * `dataEncryption.initialize()`.
+         *
+         * Never overwrites an id already established this page load — an explicit
+         * `identify()` that has already run is fresher than anything on disk.
+         */
+        hydrateEncryptedUserId() {
+            return __awaiter(this, void 0, void 0, function* () {
+                // WEB-26 (a) — migrate a plaintext address written by <= 1.7.7.
+                //
+                // persistUserId() only removes `dl_user_id` when identify() runs again, and
+                // for the exact population this fix targets it never does:
+                // AutoIdentifyManager.initialize() returns early while
+                // `dl_auto_identified_email` exists (auto-identify.ts:88), so the callback
+                // never fires. Without this the raw email would sit in localStorage forever
+                // on every already-auto-identified browser.
+                const legacy = storage.getString('dl_user_id');
+                if (legacy && IdentityManager.looksLikePII(legacy)) {
+                    if (!this.userId)
+                        this.userId = legacy;
+                    this.persistUserId(legacy);
+                    return;
+                }
+                // WEB-26 (b) — recover a write that was dropped because encryption was not
+                // keyed yet. index.ts sets `initialized = true` before initializeAsync()
+                // finishes, so the documented `init(); identify(email)` pattern can reach
+                // persistUserId() before dataEncryption has a key; that write rejects and
+                // nothing is persisted. By here the key exists, so retry once.
+                if (this.userId && IdentityManager.looksLikePII(this.userId)) {
+                    const alreadyStored = yield storage.getEncrypted('dl_user_id_pii', null);
+                    if (!alreadyStored)
+                        this.persistUserId(this.userId);
+                    return;
+                }
+                if (this.userId)
+                    return;
+                try {
+                    const stored = yield storage.getEncrypted('dl_user_id_pii', null);
+                    if (typeof stored === 'string' && stored && !this.userId) {
+                        this.userId = stored;
+                    }
+                }
+                catch (_a) {
+                    // Undecryptable (rotated key, corrupt blob) — stay anonymous.
+                }
+            });
+        }
         /**
          * Get the anonymous ID
          */
@@ -1266,8 +1404,9 @@ var Datalyr = (function (exports) {
             }
             const previousUserId = this.userId;
             this.userId = userId;
-            // Persist for future sessions
-            storage.set('dl_user_id', userId);
+            // Persist for future sessions. WEB-22: encrypted when the id is PII (the
+            // auto-identify path makes it the raw email); plaintext otherwise.
+            this.persistUserId(userId);
             // Return identity link data (will be sent as $identify event)
             return {
                 anonymous_id: this.anonymousId,
@@ -1290,7 +1429,7 @@ var Datalyr = (function (exports) {
             // Update current user ID if aliasing to current anonymous ID
             if (!previousId || previousId === this.anonymousId) {
                 this.userId = userId;
-                storage.set('dl_user_id', userId);
+                this.persistUserId(userId);
             }
             return aliasData;
         }
@@ -1300,7 +1439,12 @@ var Datalyr = (function (exports) {
          */
         reset() {
             this.userId = null;
+            // WEB-26: invalidate any encrypted write still in flight.
+            this.piiGeneration += 1;
             storage.remove('dl_user_id');
+            // WEB-22: the encrypted PII copy must go too, or a logout would leave the
+            // previous user's email at rest.
+            storage.remove('dl_user_id_pii');
             storage.remove('dl_user_traits');
             // Generate new anonymous ID for privacy
             this.anonymousId = `anon_${generateUUID()}`;
@@ -1627,6 +1771,12 @@ var Datalyr = (function (exports) {
                 'gbraid', // Google Ads (iOS)
                 'wbraid', // Google Ads (web)
                 'ttclid', // TikTok
+                // WEB-28: OpenAI Ads. Captured by iOS and React Native since launch but
+                // never by the web SDK, so every OpenAI Ads *web* conversion delivered with
+                // attribution_type: none unless the customer passed the value by hand.
+                // Placed after the Google block to match the mobile SDKs' ordering — the
+                // first click id present wins, and this must not outrank fbclid/gclid.
+                'oppref', // OpenAI Ads
                 'msclkid', // Microsoft/Bing
                 'twclid', // Twitter/X
                 'li_fat_id', // LinkedIn
@@ -1975,8 +2125,21 @@ var Datalyr = (function (exports) {
             // The old `hasCurrentAttribution` (truthy because source is always at least 'direct')
             // made the fallback below dead code AND caused storeLastTouch to overwrite a real
             // paid last-touch with 'direct'/'none' on the next internal navigation. (WEB NEW-1)
+            // `lyr` counts as a real signal. It is the Datalyr tracking-link tag — the one
+            // attribution parameter the product itself tells customers to put on a URL — and
+            // omitting it meant a bare `?lyr=X` landing (no UTMs, no click id) scored FALSE:
+            // the fallback below then replaced `current` wholesale with the stored touch,
+            // discarding the tag that had just been parsed, and neither store* call ran, so it
+            // never persisted either. Measured 2026-07-25 on the one workspace whose links are
+            // bare: 96 landing URLs carried `lyr=`, 93 events kept it — 3 lost (3.1%), all of
+            // them returning visitors (a first-time visitor has no stored touch to be replaced
+            // by, which is the only reason the number is 3 and not 96). The edge worker's own
+            // `buildDestination` emits exactly this URL shape when a link defines no UTMs.
+            // iOS (AttributionManager.swift) and React Native persist `lyr` unconditionally;
+            // this brings web into line.
             const hasRealAttribution = !!(current.clickId ||
                 current.campaign ||
+                current.lyr ||
                 (current.source && current.source !== 'direct'));
             // Direct / internal navigation: fall back to persisted attribution so the event
             // isn't mis-attributed to 'direct'. FSR-48: prefer the LAST touch (the most recent
@@ -2176,15 +2339,20 @@ var Datalyr = (function (exports) {
     const DEFAULT_CRITICAL_EVENTS = ['purchase', 'signup', 'subscribe', 'lead', 'conversion'];
     // Default high priority events that use faster batching
     const DEFAULT_HIGH_PRIORITY_EVENTS = ['add_to_cart', 'begin_checkout', 'view_item', 'search'];
-    // A 429 is a deliberate backpressure signal, not a transient failure — tagged so the
-    // send path can route it to the offline queue WITHOUT retrying (which would storm the
-    // already-overloaded server). See sendBatch / the rateLimitedUntil gate.
+    // WEB-23: how long to stop sending after a 403 (origin not allowed). Long enough not to
+    // hammer a rejecting origin, short enough that a server-side config fix is picked up
+    // within the same visit. A 403 carries no Retry-After, so this is fixed.
+    const ORIGIN_REJECTED_BACKOFF_MS = 5 * 60 * 1000;
+    // Backpressure, not failure — routed to the offline queue WITHOUT retrying (which would
+    // storm an already-overloaded server) and gated behind rateLimitedUntil. Raised for a 429
+    // and, since WEB-23, for a 403: both mean "not now", not "never". See sendBatch.
     class RateLimitError extends Error {
     }
-    // A permanent (non-retryable) failure — a 4xx other than 408/429 (invalid event shape,
-    // origin not allowed, auth). Retrying or parking it just head-of-line-blocks the offline
-    // queue forever and hammers ingest. Tagged so the send paths DROP the batch instead of
-    // unshifting it back to the head. (FSR-55)
+    // A permanent (non-retryable) failure — a 4xx other than 403/408/429, i.e. an invalid
+    // event shape (400) or bad auth (401). Retrying or parking it just head-of-line-blocks
+    // the offline queue forever and hammers ingest. Tagged so the send paths DROP the batch
+    // instead of unshifting it back to the head. (FSR-55, narrowed by WEB-23 — a 403 is
+    // server *configuration* state and does change, so it is no longer in this class.)
     class PermanentError extends Error {
         constructor(status, message) {
             super(message || `HTTP ${status}`);
@@ -2207,6 +2375,11 @@ var Datalyr = (function (exports) {
             this.inFlight = []; // FIXED (WEB-3): batch currently in _flight's keepalive fetch — forceFlush must NOT re-beacon it
             this.enabled = true; // FIXED (consent): when false (opt-out / withdrawn analytics consent) all enqueue/flush/drain is a no-op
             this.rateLimitedUntil = 0; // FIXED (429): skip flush/drain until the server's Retry-After window passes
+            // WEB-23: permanent drops used to be invisible — a debug-gated log line and
+            // nothing else, so 11 days of 403s looked identical to a healthy queue. Counted
+            // here and exposed via getStats() so a drop is at least observable.
+            this.droppedEventCount = 0;
+            this.lastDropStatus = null;
             // Coerce numeric config to sane values. The old `config.X || default` both turned a
             // legitimate 0 into the default AND let invalid values through — a NEGATIVE batchSize
             // made processOfflineQueue's `splice(0, -1)` loop forever and FREEZE the host tab.
@@ -2432,7 +2605,12 @@ var Datalyr = (function (exports) {
                     // FSR-55: don't park a permanently-rejected batch — it would never succeed and
                     // would block the offline drain. Drop it.
                     if (error instanceof PermanentError) {
-                        this.log(`Dropping ${events.length} events — permanent error ${error.status}`);
+                        this.droppedEventCount += events.length;
+                        this.lastDropStatus = error.status;
+                        // console.warn, not this.log: a silent drop is the failure mode that let the
+                        // 2026-07-13 outage run for 11 days. This must be visible without debug mode.
+                        console.warn(`[Datalyr Queue] Dropped ${events.length} events — permanent error ${error.status}. ` +
+                            `${this.droppedEventCount} dropped this session.`);
                     }
                     else {
                         this.moveToOfflineQueue(events);
@@ -2494,9 +2672,24 @@ var Datalyr = (function (exports) {
                             this.log(`Rate limited; backing off ${retryAfter}s`);
                             throw new RateLimitError('Rate limited (429)');
                         }
-                        // FSR-55: a 4xx other than 408 (timeout) is PERMANENT — invalid event shape
-                        // (400), origin not allowed (403), auth (401). Retrying / parking it just blocks
-                        // the queue and hammers ingest forever. Tag it so the caller drops the batch.
+                        // WEB-23: a 403 is NOT permanent — it is server *configuration* state, and it
+                        // changes. On 2026-07-13 an allowed_origins regression made ingest reject three
+                        // workspaces with 403; the config was fixed 11 days later, but every event sent
+                        // in between had already been dropped on the floor by the FSR-55 rule below.
+                        // Eleven days of data, unrecoverable, with only a debug log to show for it.
+                        //
+                        // Treated like 429 instead: park the events offline behind a backoff window, so
+                        // we neither hammer a rejecting origin (FSR-55's real concern) nor discard data
+                        // that would have been accepted an hour later. The window is fixed because a 403
+                        // carries no Retry-After.
+                        if (response.status === 403) {
+                            this.rateLimitedUntil = Date.now() + ORIGIN_REJECTED_BACKOFF_MS;
+                            this.log(`Origin rejected (403); backing off ${ORIGIN_REJECTED_BACKOFF_MS / 1000}s and parking events`);
+                            throw new RateLimitError('Origin rejected (403)');
+                        }
+                        // FSR-55: a 4xx other than 403/408 (timeout) is PERMANENT — invalid event shape
+                        // (400) or auth (401). Retrying / parking it just blocks the queue and hammers
+                        // ingest forever. Tag it so the caller drops the batch.
                         if (response.status >= 400 && response.status < 500 && response.status !== 408) {
                             throw new PermanentError(response.status, `HTTP ${response.status}: ${response.statusText}`);
                         }
@@ -2583,9 +2776,25 @@ var Datalyr = (function (exports) {
             // purge. Gating here (a persistence sink, not just the send sinks) closes it.
             if (!this.enabled)
                 return;
-            // FIXED (DATA-03): Check if offline queue operation already in progress
+            // WEB-24. This early return used to `return` outright — losing the batch, because
+            // _flush() has ALREADY spliced these events out of the live queue before calling
+            // here, so they would exist in neither queue.
+            //
+            // Verified 2026-07-25 that the loss is NOT currently reachable: this method is the
+            // only user of offlineQueueLock, its critical section is fully synchronous (push,
+            // splice, then a synchronous saveOfflineQueue → storage.set), and JS is
+            // single-threaded — so the flag can never be observed set on entry. The path is
+            // dead code today, and the review's "drops the batch on lock contention" is REFUTED
+            // as a live loss path.
+            //
+            // It is kept and made safe anyway, because it is one `await` away from being live:
+            // the moment saveOfflineQueue becomes async (IndexedDB, encrypted-at-rest storage,
+            // anything), contention becomes real and silent data loss returns instantly.
+            // Enqueue first, then bail — the events are never dropped either way.
             if (this.offlineQueueLock) {
-                console.warn('[Datalyr Queue] Offline queue operation already in progress');
+                console.warn('[Datalyr Queue] Offline queue busy; buffering events without persisting');
+                if (events)
+                    this.offlineQueue.push(...events);
                 return;
             }
             // Acquire lock
@@ -2604,6 +2813,10 @@ var Datalyr = (function (exports) {
                 if (this.offlineQueue.length > this.config.maxOfflineQueueSize) {
                     const excess = this.offlineQueue.length - this.config.maxOfflineQueueSize;
                     this.offlineQueue.splice(0, excess); // Remove oldest events
+                    // WEB-27: overflow is data loss too, and a sustained 403/park loop is
+                    // exactly what produces it. Count it rather than trimming silently.
+                    this.droppedEventCount += excess;
+                    console.warn(`[Datalyr Queue] Offline queue full — dropped ${excess} oldest event(s).`);
                 }
                 this.saveOfflineQueue();
             }
@@ -2712,7 +2925,15 @@ var Datalyr = (function (exports) {
                             // that would block every event behind it forever and hammer ingest every tick.
                             // Drop it (already spliced off the front) and keep draining the rest.
                             if (error instanceof PermanentError) {
-                                this.log(`Dropping poison offline batch (${batch.length}) — permanent error ${error.status}`);
+                                // WEB-27: count and surface these too. WEB-23's whole effect is to
+                                // PARK more batches offline, so the drain — not the live flush — is
+                                // where drops now predominantly happen. Counting only _flush left the
+                                // dominant loss path invisible, which is the exact failure mode the
+                                // counter was added to end.
+                                this.droppedEventCount += batch.length;
+                                this.lastDropStatus = error.status;
+                                console.warn(`[Datalyr Queue] Dropped ${batch.length} offline events — permanent error ${error.status}. ` +
+                                    `${this.droppedEventCount} dropped this session.`);
                                 this.saveOfflineQueue();
                                 continue;
                             }
@@ -2745,6 +2966,23 @@ var Datalyr = (function (exports) {
         getOfflineQueueSize() {
             return this.offlineQueue.length;
         }
+        /**
+         * WEB-23: queue health, including events the SDK gave up on.
+         *
+         * `droppedEvents` is the number this session discarded as permanently rejected
+         * (a 400/401). It exists because a silent drop is precisely the failure mode
+         * that let the 2026-07-13 `allowed_origins` outage run for eleven days looking
+         * exactly like a healthy queue. A non-zero value here means data was lost.
+         */
+        getStats() {
+            return {
+                queued: this.queue.length,
+                offline: this.offlineQueue.length,
+                droppedEvents: this.droppedEventCount,
+                lastDropStatus: this.lastDropStatus,
+                backoffUntil: this.rateLimitedUntil,
+            };
+        }
         /**
          * Get network status
          */
@@ -3452,12 +3690,10 @@ var Datalyr = (function (exports) {
             img.dataset.datalyrPixel = script.id;
             document.body.appendChild(img);
         }
-        /**
-         * Initialize third-party pixels (Meta, Google, TikTok)
-         */
+        /** Initialize configured third-party pixels in the merchant's page context. */
         initializePixels() {
             return __awaiter(this, void 0, void 0, function* () {
-                var _a, _b, _c;
+                var _a, _b, _c, _e;
                 if (!this.pixels)
                     return;
                 // Initialize Meta Pixel
@@ -3472,8 +3708,58 @@ var Datalyr = (function (exports) {
                 if (((_c = this.pixels.tiktok) === null || _c === void 0 ? void 0 : _c.enabled) && this.pixels.tiktok.pixel_id) {
                     this.initializeTikTokPixel(this.pixels.tiktok);
                 }
+                // The Whop Pixel needs only the merchant's public company ID. Loading it
+                // here lets Whop link this external-site visitor to a later hosted or
+                // embedded Whop checkout without a Datalyr visitor_id in checkout metadata.
+                if (((_e = this.pixels.whop) === null || _e === void 0 ? void 0 : _e.enabled) && this.pixels.whop.company_id) {
+                    this.initializeWhopPixel(this.pixels.whop);
+                }
             });
         }
+        /** Initialize Whop's official first-party attribution pixel. */
+        initializeWhopPixel(config) {
+            var _a, _b;
+            try {
+                const host = window;
+                if (!host.whop) {
+                    const queue = host.whop = {
+                        q: [],
+                        t: Date.now(),
+                        s: [],
+                        o: 'https://t.whop.tw',
+                        track: function (...args) {
+                            queue.q.push([Date.now(), ...args]);
+                        },
+                        setScope: function (...args) {
+                            queue.s = args.filter((value) => typeof value === 'string');
+                            queue.q.push([Date.now(), 'setScope', ...queue.s]);
+                        },
+                        scope: function (...scope) {
+                            return {
+                                track: function (...args) {
+                                    queue.q.push([Date.now(), ...args, { __scope: scope }]);
+                                },
+                            };
+                        },
+                    };
+                    const script = document.createElement('script');
+                    script.async = true;
+                    script.src = 'https://t.whop.tw/s.js';
+                    const firstScript = document.getElementsByTagName('script')[0];
+                    (_a = firstScript === null || firstScript === void 0 ? void 0 : firstScript.parentNode) === null || _a === void 0 ? void 0 : _a.insertBefore(script, firstScript);
+                    if (!firstScript)
+                        document.head.appendChild(script);
+                }
+                if (typeof ((_b = host.whop) === null || _b === void 0 ? void 0 : _b.setScope) !== 'function') {
+                    throw new Error('Existing window.whop does not expose setScope');
+                }
+                host.whop.setScope(config.company_id);
+                this.log('Whop Pixel initialized:', config.company_id);
+            }
+            catch (error) {
+                this.log('Error initializing Whop Pixel:', error);
+            }
+        }
         /**
          * Initialize Meta (Facebook) Pixel
          *
@@ -3629,7 +3915,7 @@ var Datalyr = (function (exports) {
          * Track event to all initialized pixels
          */
         trackToPixels(eventName, properties = {}, eventId) {
-            var _a, _b, _c, _e, _f, _g, _h, _j, _k, _l;
+            var _a, _b, _c, _e, _f, _g, _h, _j, _k, _l, _m, _p;
             // Datalyr-internal events ($identify, $group, $alias, $auto_identify,
             // $app_download_click, …) are not conversions — never forward them to ad
             // pixels. (Previously they fired as noise custom events with the $ stripped.)
@@ -3726,6 +4012,18 @@ var Datalyr = (function (exports) {
                     this.log('Error tracking TikTok Pixel event:', error);
                 }
             }
+            // Whop records checkout and payment events server-side. Datalyr only sends
+            // page views here, including SPA navigations, so purchases are never doubled.
+            if (((_p = (_m = this.pixels) === null || _m === void 0 ? void 0 : _m.whop) === null || _p === void 0 ? void 0 : _p.enabled) &&
+                window.whop &&
+                (eventName === 'pageview' || eventName === 'page_view')) {
+                try {
+                    window.whop.track('page');
+                }
+                catch (error) {
+                    this.log('Error tracking Whop Pixel page:', error);
+                }
+            }
         }
         /**
          * Manually trigger a custom script
@@ -4373,6 +4671,256 @@ var Datalyr = (function (exports) {
     // someone else (and feeds that person's email to Meta advanced matching).
     AutoIdentifyManager.THIRD_PARTY_EMAIL_FIELD = /(recipient|friend|gift|refer|invite|colleague|coworker|share|to[-_]?email|email[-_]?to|second(ary)?[-_]?email)/i;
 
+    /**
+     * Stripe Checkout Session capture.
+     *
+     * WHY THIS EXISTS
+     * syncStripePaymentLinks stamps `client_reference_id` onto buy.stripe.com
+     * anchors, and deliberately never onto checkout.stripe.com — a Checkout Session
+     * URL ignores the param because the session already exists server-side. That
+     * leaves the single most common SaaS pattern uncovered: the merchant's backend
+     * creates a Session and the browser is sent to checkout.stripe.com/c/pay/cs_...
+     * The payment then reaches our webhook with no visitor at all.
+     *
+     * Measured 2026-07-25, 30d: of payers arriving via Stripe webhooks, 0.5% (one
+     * tenant, 128/28,187) and 13.3% (another, 13/98) had ANY web pageview on the
+     * same visitor. Not a misconfiguration — no tenant is wired, because being
+     * wired currently requires the merchant to hand-write client_reference_id.
+     *
+     * WHAT THIS DOES
+     * The session id must reach the browser for the redirect to happen at all, so
+     * we observe it rather than trying to inject anything:
+     *   1. fetch/XHR response bodies      — `{url}` or `{sessionId}` from the
+     *                                       merchant's own create-session endpoint
+     *   2. anchor clicks + window.open    — direct links to checkout.stripe.com
+     * A server-side 302 straight to Stripe never exposes the id to JS and is NOT
+     * covered here; that case falls back to the email bridge.
+     *
+     * WHY THIS IS SAFE TO DEFAULT ON, WHEN autoIdentifyAPI IS NOT
+     * autoIdentifyAPI scans the same traffic for EMAILS, which is why it defaults
+     * off: an admin viewing a customer record gets identified as that customer, and
+     * a wrong email propagates into Meta advanced matching. A `cs_live_...` token is
+     * unambiguous, belongs to exactly one checkout, and is not PII. There is no
+     * mis-identification failure mode to guard against — only the wrapper itself,
+     * which is why every hook below is transparent and failure-isolated.
+     */
+    /** Stripe Checkout Session ids: cs_live_… / cs_test_… */
+    const SESSION_ID_RE = /cs_(?:live|test)_[A-Za-z0-9]{8,}/;
+    /** Hosts whose URLs carry a session id in the path. Exact match, never substring. */
+    const CHECKOUT_HOSTS = new Set(['checkout.stripe.com']);
+    /**
+     * Response bodies are scanned in full, so cap what we're willing to read. A
+     * create-session response is a few hundred bytes; anything large is not it, and
+     * reading it would cost the merchant's page real memory and main-thread time.
+     */
+    const MAX_SCAN_BYTES = 65536;
+    /** Bodies worth scanning. Stripe ids arrive as JSON or text, never as binary. */
+    const SCANNABLE_TYPE_RE = /(json|text|javascript)/i;
+    function extractSessionId(text) {
+        if (!text)
+            return null;
+        const m = SESSION_ID_RE.exec(text);
+        return m ? m[0] : null;
+    }
+    /**
+     * True when `href` points at a Stripe-hosted checkout. Uses the URL API and
+     * exact host equality — `a[href*="checkout.stripe.com"]` would match
+     * `evil.com/checkout.stripe.com/x` and `checkout.stripe.com.evil.com`.
+     */
+    function isCheckoutUrl(href, base) {
+        try {
+            const host = new URL(href, base !== null && base !== void 0 ? base : (typeof window !== 'undefined' ? window.location.href : undefined)).hostname.toLowerCase();
+            return CHECKOUT_HOSTS.has(host);
+        }
+        catch (_a) {
+            return false;
+        }
+    }
+    class StripeSessionWatcher {
+        constructor(options = {}) {
+            var _a, _b;
+            this.seen = new Set();
+            this.disposers = [];
+            this.started = false;
+            this.maxSessions = (_a = options.maxSessions) !== null && _a !== void 0 ? _a : 5;
+            this.maxScanBytes = (_b = options.maxScanBytes) !== null && _b !== void 0 ? _b : MAX_SCAN_BYTES;
+        }
+        start(sink) {
+            if (this.started || typeof window === 'undefined')
+                return;
+            this.started = true;
+            this.sink = sink;
+            this.hookFetch();
+            this.hookXhr();
+            this.hookClicks();
+            this.hookWindowOpen();
+        }
+        stop() {
+            // Restore in reverse so a later wrapper never re-installs an earlier one.
+            for (const dispose of this.disposers.reverse()) {
+                try {
+                    dispose();
+                }
+                catch (_a) {
+                    /* idempotent */
+                }
+            }
+            this.disposers = [];
+            this.started = false;
+            this.sink = undefined;
+        }
+        /** Report a session id at most once, and never more than maxSessions per page. */
+        emit(sessionId) {
+            var _a;
+            if (!sessionId || this.seen.has(sessionId))
+                return;
+            if (this.seen.size >= this.maxSessions)
+                return;
+            this.seen.add(sessionId);
+            try {
+                (_a = this.sink) === null || _a === void 0 ? void 0 : _a.call(this, sessionId);
+            }
+            catch (_b) {
+                // A throwing sink must never surface inside the merchant's fetch chain.
+            }
+        }
+        /**
+         * Scan a Response WITHOUT disturbing the merchant's own read. `clone()` must
+         * happen synchronously, before the caller can consume the body; the read of
+         * the clone is deliberately not awaited by the caller.
+         */
+        scanResponse(response) {
+            var _a, _b, _c, _d, _e, _f;
+            try {
+                const type = (_c = (_b = (_a = response.headers) === null || _a === void 0 ? void 0 : _a.get) === null || _b === void 0 ? void 0 : _b.call(_a, 'content-type')) !== null && _c !== void 0 ? _c : '';
+                if (type && !SCANNABLE_TYPE_RE.test(type))
+                    return;
+                const declared = Number((_f = (_e = (_d = response.headers) === null || _d === void 0 ? void 0 : _d.get) === null || _e === void 0 ? void 0 : _e.call(_d, 'content-length')) !== null && _f !== void 0 ? _f : NaN);
+                if (Number.isFinite(declared) && declared > this.maxScanBytes)
+                    return;
+                const clone = typeof response.clone === 'function' ? response.clone() : null;
+                if (!clone)
+                    return;
+                void clone
+                    .text()
+                    .then((body) => this.emit(extractSessionId(body.slice(0, this.maxScanBytes))))
+                    .catch(() => {
+                    /* body already disturbed / opaque response — nothing to do */
+                });
+            }
+            catch (_g) {
+                /* never let observation break the request */
+            }
+        }
+        hookFetch() {
+            if (typeof window.fetch !== 'function')
+                return;
+            const original = window.fetch;
+            const self = this;
+            const patched = function patchedFetch(...args) {
+                const result = original.apply(this !== null && this !== void 0 ? this : window, args);
+                try {
+                    // Attach passively: the merchant still gets the original promise, and a
+                    // rejection here is theirs to handle, not ours to observe twice.
+                    result.then((response) => self.scanResponse(response)).catch(() => { });
+                }
+                catch (_a) {
+                    /* ignore */
+                }
+                return result;
+            };
+            window.fetch = patched;
+            this.disposers.push(() => {
+                // Only restore if nobody wrapped us afterwards — clobbering a later
+                // wrapper would silently disable whatever installed it.
+                if (window.fetch === patched)
+                    window.fetch = original;
+            });
+        }
+        hookXhr() {
+            if (typeof XMLHttpRequest === 'undefined')
+                return;
+            const proto = XMLHttpRequest.prototype;
+            const originalSend = proto.send;
+            if (typeof originalSend !== 'function')
+                return;
+            const self = this;
+            const patched = function patchedSend(...args) {
+                try {
+                    this.addEventListener('load', () => {
+                        try {
+                            // responseText throws for blob/arraybuffer response types.
+                            if (this.responseType !== '' && this.responseType !== 'text')
+                                return;
+                            const body = this.responseText;
+                            if (!body || body.length > self.maxScanBytes)
+                                return;
+                            self.emit(extractSessionId(body));
+                        }
+                        catch (_a) {
+                            /* ignore */
+                        }
+                    });
+                }
+                catch (_a) {
+                    /* ignore */
+                }
+                return originalSend.apply(this, args);
+            };
+            proto.send = patched;
+            this.disposers.push(() => {
+                if (proto.send === patched)
+                    proto.send = originalSend;
+            });
+        }
+        /**
+         * Direct links to checkout.stripe.com. Capture phase so we still see the click
+         * when the merchant's own handler calls stopPropagation().
+         */
+        hookClicks() {
+            if (typeof document === 'undefined')
+                return;
+            const onClick = (e) => {
+                var _a, _b;
+                try {
+                    const target = (_b = (_a = e.target) === null || _a === void 0 ? void 0 : _a.closest) === null || _b === void 0 ? void 0 : _b.call(_a, 'a[href]');
+                    if (!target || !target.href || !isCheckoutUrl(target.href))
+                        return;
+                    this.emit(extractSessionId(target.href));
+                }
+                catch (_c) {
+                    /* never block navigation */
+                }
+            };
+            document.addEventListener('click', onClick, true);
+            this.disposers.push(() => document.removeEventListener('click', onClick, true));
+        }
+        hookWindowOpen() {
+            if (typeof window.open !== 'function')
+                return;
+            const original = window.open;
+            const self = this;
+            const patched = function patchedOpen(...args) {
+                var _a;
+                try {
+                    const url = args[0];
+                    const href = typeof url === 'string' ? url : (_a = url === null || url === void 0 ? void 0 : url.toString) === null || _a === void 0 ? void 0 : _a.call(url);
+                    if (href && isCheckoutUrl(href))
+                        self.emit(extractSessionId(href));
+                }
+                catch (_b) {
+                    /* ignore */
+                }
+                return original.apply(this !== null && this !== void 0 ? this : window, args);
+            };
+            window.open = patched;
+            this.disposers.push(() => {
+                if (window.open === patched)
+                    window.open = original;
+            });
+        }
+    }
+
     /** Keys the remote config is allowed to fill on DatalyrConfig. */
     const REMOTE_KEYS = [
         'autoIdentify',
@@ -4380,6 +4928,7 @@ var Datalyr = (function (exports) {
         'autoIdentifyAPI',
         'autoIdentifyShopify',
         'shopifyCartAttributes',
+        'stripeCheckoutSessions',
         'checkoutChampDomains',
         'respectGlobalPrivacyControl',
         'respectDoNotTrack',
@@ -4418,6 +4967,16 @@ var Datalyr = (function (exports) {
      * Datalyr Web SDK
      * Modern attribution tracking for web applications
      */
+    /**
+     * WEB-20. Fingerprint of the last identify() that actually emitted, so a host
+     * app calling identify() on every route change does not re-emit an unchanged
+     * identity. Cleared by reset(). Mirrors iOS `datalyr_last_identity_fingerprint`
+     * and RN `@datalyr/last_identity_fingerprint`.
+     *
+     * Not PII: the stored value is a hash, and it is written through the same
+     * `storage` wrapper as every other key (so it inherits the `dl_` prefix).
+     */
+    const IDENTIFY_FINGERPRINT_KEY = 'dl_identify_fingerprint';
     class Datalyr {
         constructor() {
             // Keys the caller passed to init() (before built-in defaults were merged).
@@ -4433,10 +4992,26 @@ var Datalyr = (function (exports) {
             this.errors = [];
             this.MAX_ERRORS = 50;
             this.lastSpaPath = null; // dedups SPA pageviews (replaceState-on-mount double-fire)
+            // Shopify loads Customer Privacy asynchronously. Keep the initial pageview
+            // pending until initialization is complete and analytics consent is known,
+            // then release it exactly once when consent allows tracking.
+            this.initialPageViewReady = false;
+            this.initialPageViewSent = false;
             // FIXED (ISSUE-01): Async initialization promise to prevent race conditions
             this.initializationPromise = null;
             // Opt-out check moved to init() after cookies configured (Issue #14)
         }
+        /**
+         * Return the workspace configured for this instance, or null before init().
+         *
+         * CDN bootstrap uses this public accessor instead of reaching into the
+         * private runtime config when deciding whether an existing global belongs
+         * to the requested workspace.
+         */
+        getWorkspaceId() {
+            var _a, _b;
+            return (_b = (_a = this.config) === null || _a === void 0 ? void 0 : _a.workspaceId) !== null && _b !== void 0 ? _b : null;
+        }
         /**
          * Initialize the SDK
          */
@@ -4580,6 +5155,11 @@ var Datalyr = (function (exports) {
                             const deviceId = this.identity.getAnonymousId();
                             yield dataEncryption.initialize(this.config.workspaceId, deviceId);
                             this.userProperties = yield storage.getEncrypted('dl_user_traits', {});
+                            // WEB-22: restore a PII user id that was persisted encrypted. Must run
+                            // here — it needs dataEncryption to be initialized, so it cannot happen
+                            // in the IdentityManager constructor. It never overwrites an id already
+                            // set by an explicit identify() earlier in this page load.
+                            yield this.identity.hydrateEncryptedUserId();
                             this.log('Encryption initialized, user properties loaded');
                         }
                         catch (encErr) {
@@ -4669,14 +5249,20 @@ var Datalyr = (function (exports) {
                             // Setup auto-identify callback
                             this.autoIdentify.initialize((email, source) => {
                                 this.log(`Auto-identified user: ${email} from ${source}`);
-                                // Track auto-identify event
-                                this.track('$auto_identify', {
-                                    email,
-                                    source,
-                                    timestamp: Date.now()
-                                });
-                                // Automatically call identify with email
-                                this.identify(email, { email });
+                                // WEB-21: ONE event, not two.
+                                //
+                                // This used to emit `$auto_identify` and then call identify(),
+                                // which emits `$identify` — two events ~1ms apart carrying the same
+                                // email. Production over 7 days on workspace f6260736 showed a
+                                // perfect 379 / 379 / 379 split ($identify / $auto_identify /
+                                // visitors): every auto-identification was booked twice.
+                                //
+                                // Nothing consumed `$auto_identify`: grepped across the whole
+                                // platform (app/, lib/, all Cloudflare workers, all Tinybird pipes)
+                                // — zero readers, while prod carried 6,197 of them in 30 days.
+                                // The only information it added over `$identify` was WHICH detector
+                                // found the email, so that is preserved as a trait instead.
+                                this.identify(email, { email, auto_identify_source: source });
                             });
                         }
                         // Stamp attribution signals into the Shopify cart (OPT-IN, default off).
@@ -4707,10 +5293,22 @@ var Datalyr = (function (exports) {
                         if (this.config.stripePaymentLinks !== false && this.shouldTrack()) {
                             this.syncStripePaymentLinks((_b = this.config.stripeLinkDomains) !== null && _b !== void 0 ? _b : []);
                         }
-                        // Track initial page view if enabled (AFTER encryption ready)
-                        if (this.config.trackPageViews) {
-                            this.page();
+                        // Checkout Session capture (DEFAULT ON). The decorator above cannot help
+                        // when the merchant's BACKEND creates the session — checkout.stripe.com
+                        // ignores client_reference_id post-creation — which is how most SaaS
+                        // checkouts work, and why payers arrive at our webhook with no visitor
+                        // (measured 0.5% and 13.3% visitor coverage on the two Stripe tenants).
+                        // The session id still has to reach the browser, so we observe it and
+                        // let the server join on session.id. Same shouldTrack() gate as the
+                        // decorator: an opted-out visitor's id is never paired with a checkout.
+                        if (this.config.stripeCheckoutSessions !== false && this.shouldTrack()) {
+                            this.startStripeSessionCapture();
                         }
+                        // Track the initial page view after encryption is ready. On Shopify the
+                        // Customer Privacy API can still be loading, so retain one pending
+                        // pageview and release it from onShopifyConsentChanged() once allowed.
+                        this.initialPageViewReady = true;
+                        this.trackInitialPageViewOnce();
                         this.log('Async initialization complete');
                     }
                     catch (error) {
@@ -4843,6 +5441,50 @@ var Datalyr = (function (exports) {
         /**
          * Identify a user
          */
+        /**
+         * Stable fingerprint of an identity for redundant-emit suppression (WEB-20).
+         *
+         * Keys are sorted and each value is JSON-serialized, so `{a,b}` and `{b,a}`
+         * collapse to one identity while a genuinely changed nested trait does not.
+         * (The mobile SDKs use `String(value)`, which flattens every object to
+         * `[object Object]` and can swallow a real change; web traits are plain JSON,
+         * so it can afford to be exact.)
+         *
+         * Hashed rather than stored raw so the key does not become another copy of the
+         * user's traits at rest. Being honest about the strength: a 32-bit
+         * non-cryptographic digest sitting beside a readable `dl_dl_anonymous_id` is
+         * NOT protection against a determined reader — it defeats casual inspection
+         * and bulk scraping, nothing more. The PII that matters is handled properly
+         * (encrypted `dl_user_id_pii`, encrypted `dl_user_traits`). 32 bits also means
+         * a ~1-in-4.3e9 chance per identity that a genuine change is suppressed;
+         * acceptable for change detection, which is all this is.
+         */
+        identityFingerprint(userId, traits = {}) {
+            const stableTraits = Object.keys(traits || {})
+                .sort()
+                .map((key) => {
+                let value;
+                try {
+                    value = JSON.stringify(traits[key]);
+                }
+                catch (_a) {
+                    // Circular/unserializable trait — fall back to a coarse marker rather
+                    // than throwing inside identify().
+                    value = '[unserializable]';
+                }
+                return `${key}=${value}`;
+            })
+                .join('&');
+            const input = `${this.identity.getAnonymousId()}|${userId}|${stableTraits}`;
+            // 32-bit FNV-1a. Not cryptographic — this only needs to detect change, and
+            // it must be synchronous (crypto.subtle is async and identify() is not).
+            let hash = 0x811c9dc5;
+            for (let i = 0; i < input.length; i++) {
+                hash ^= input.charCodeAt(i);
+                hash = Math.imul(hash, 0x01000193);
+            }
+            return (hash >>> 0).toString(16);
+        }
         identify(userId, traits = {}) {
             if (!this.initialized) {
                 console.warn('[Datalyr] SDK not initialized. Call init() first.');
@@ -4882,8 +5524,31 @@ var Datalyr = (function (exports) {
                     // If encryption fails, user traits are only stored in memory (this.userProperties)
                     // and will be lost on page reload - but PII is NOT exposed in localStorage
                 });
-                // Track $identify event
-                this.track('$identify', Object.assign(Object.assign({}, identityLink), { traits }));
+                // WEB-20: redundant-identify suppression, matching iOS 2.1.11 / RN 1.7.16.
+                //
+                // identify() is host-app-driven and SPA routers commonly call it in a
+                // route effect, so an unchanged identity was re-emitted on every
+                // navigation. The mobile SDKs got this in 2.1.10/1.7.15; web did not.
+                //
+                // Fingerprint = anonymousId | userId | sorted traits. The anonymous id is
+                // included so a reset()/rotation always re-emits and identity links are
+                // never lost — only exact repeats are skipped.
+                //
+                // Only the EVENT is suppressed. `this.identity.identify()` above has
+                // already persisted `dl_user_id`, traits are still merged and encrypted,
+                // and the plugin handlers below still run on every call — a plugin's
+                // `identify` hook is a customer extension point whose semantics we cannot
+                // assume, so its contract ("called when identify() is called") is
+                // deliberately left intact.
+                const identityFingerprint = this.identityFingerprint(userId, traits);
+                const isRedundantIdentify = storage.getString(IDENTIFY_FINGERPRINT_KEY, null) === identityFingerprint;
+                if (isRedundantIdentify) {
+                    this.log('Skipping redundant identify (unchanged identity):', userId);
+                }
+                else {
+                    storage.set(IDENTIFY_FINGERPRINT_KEY, identityFingerprint);
+                    this.track('$identify', Object.assign(Object.assign({}, identityLink), { traits }));
+                }
                 // Call plugin handlers
                 if (this.config.plugins) {
                     for (const plugin of this.config.plugins) {
@@ -4903,6 +5568,18 @@ var Datalyr = (function (exports) {
                 this.trackError(error, { userId });
             }
         }
+        /**
+         * WEB-27: queue health, including events the SDK gave up on.
+         *
+         * `getStats()` existed on EventQueue but was unreachable — `queue` is private
+         * and nothing exposed it, so the observability fix could not actually be
+         * observed. A non-zero `droppedEvents` means data was lost.
+         */
+        getQueueStats() {
+            if (!this.queue)
+                return null;
+            return this.queue.getStats();
+        }
         /**
          * Track a page view
          */
@@ -5020,6 +5697,9 @@ var Datalyr = (function (exports) {
             // values to the next user's events (cross-user contamination on shared devices).
             this.superProperties = {};
             storage.remove('dl_user_traits');
+            // WEB-20: drop the identify fingerprint, so a logout→login (or a different
+            // user on this browser) always re-emits $identify and the link is rebuilt.
+            storage.remove(IDENTIFY_FINGERPRINT_KEY);
             // Clear the auto-identify guard so a different user on the same browser is
             // re-captured (it short-circuits while dl_auto_identified_email is present), and so
             // the prior user's email isn't left at rest after logout.
@@ -5167,16 +5847,21 @@ var Datalyr = (function (exports) {
          * (same convention as pixels/auto-identify).
          */
         disposeMarketingLinkDecorators() {
-            var _a, _b;
+            var _a, _b, _c;
             try {
                 (_a = this.stripeLinksDisposer) === null || _a === void 0 ? void 0 : _a.call(this);
             }
-            catch ( /* best-effort */_c) { /* best-effort */ }
+            catch ( /* best-effort */_d) { /* best-effort */ }
             this.stripeLinksDisposer = undefined;
             try {
-                (_b = this.outboundDisposer) === null || _b === void 0 ? void 0 : _b.call(this);
+                (_b = this.stripeSessionWatcher) === null || _b === void 0 ? void 0 : _b.stop();
             }
-            catch ( /* best-effort */_d) { /* best-effort */ }
+            catch ( /* best-effort */_e) { /* best-effort */ }
+            this.stripeSessionWatcher = undefined;
+            try {
+                (_c = this.outboundDisposer) === null || _c === void 0 ? void 0 : _c.call(this);
+            }
+            catch ( /* best-effort */_f) { /* best-effort */ }
             this.outboundDisposer = undefined;
         }
         optOut() {
@@ -5205,8 +5890,22 @@ var Datalyr = (function (exports) {
             // Purge PII at rest.
             this.userProperties = {};
             storage.remove('dl_user_traits');
+            // WEB-26: remove the PLAINTEXT id as well. optOut() purged only the
+            // encrypted copy, so an opted-out visitor whose email was written by an
+            // older build kept it at rest — the one state where that is least
+            // defensible.
+            storage.remove('dl_user_id');
+            storage.remove('dl_user_id_pii');
+            storage.remove(IDENTIFY_FINGERPRINT_KEY);
             storage.remove('dl_auto_identified_email');
             storage.remove('dl_journey');
+            // WEB-25: first/last touch hold redacted-but-full landing URLs, referrers and
+            // click ids for up to 90 days. reset() has always cleared them; optOut() did
+            // not — so an opted-out visitor kept marketing attribution at rest, which is
+            // the one state where it is least defensible. Same rationale as dl_journey
+            // directly above.
+            storage.remove('dl_first_touch');
+            storage.remove('dl_last_touch');
             this.log('User opted out');
         }
         /**
@@ -5269,8 +5968,16 @@ var Datalyr = (function (exports) {
                 this.autoIdentify = undefined;
                 this.userProperties = {};
                 storage.remove('dl_user_traits');
+                // WEB-26: see optOut() — the plaintext id must go too.
+                storage.remove('dl_user_id');
+                storage.remove('dl_user_id_pii');
+                storage.remove(IDENTIFY_FINGERPRINT_KEY);
                 storage.remove('dl_auto_identified_email');
                 storage.remove('dl_journey');
+                // WEB-25: see optOut() — withdrawn analytics consent must not leave 90-day
+                // marketing attribution at rest either.
+                storage.remove('dl_first_touch');
+                storage.remove('dl_last_touch');
             }
             else {
                 // TR-15 (P3): grant → persist the in-memory anon id now (see onShopifyConsentChanged).
@@ -5524,6 +6231,39 @@ var Datalyr = (function (exports) {
          * changes. window.open(paymentLink) is not covered (use getVisitorId()
          * manually); iframe/shadow-DOM links are unreachable from document.
          */
+        /**
+         * Observe Stripe Checkout Session ids and report each one once.
+         *
+         * The event is what carries the pairing: the server stores
+         * (stripe_session_id -> visitor_id) and, when checkout.session.completed
+         * arrives without a client_reference_id, joins on session.id and feeds the
+         * SAME cacheCustomerVisitor path the Payment Link flow already uses — so
+         * every later invoice for that customer inherits the visitor too.
+         *
+         * Consent is re-checked at emit time, not just at init: a visitor can
+         * withdraw between page load and checkout, and this pairing is exactly the
+         * kind of identity link that must stop when they do.
+         */
+        startStripeSessionCapture() {
+            if (this.stripeSessionWatcher)
+                return;
+            const watcher = new StripeSessionWatcher();
+            this.stripeSessionWatcher = watcher;
+            watcher.start((stripeSessionId) => {
+                var _a;
+                if (!this.shouldTrack())
+                    return;
+                this.track('$stripe_checkout_session', { stripe_session_id: stripeSessionId });
+                // The very next thing this page does is navigate to Stripe, so flush now
+                // rather than let the batch timer lose the pairing to the unload.
+                try {
+                    (_a = this.queue) === null || _a === void 0 ? void 0 : _a.flush();
+                }
+                catch (_b) {
+                    /* best-effort — never block the checkout */
+                }
+            });
+        }
         syncStripePaymentLinks(extraDomains) {
             if (typeof window === "undefined" || typeof document === "undefined")
                 return;
@@ -5750,7 +6490,7 @@ var Datalyr = (function (exports) {
                 // drift from the package again (it sat at 1.7.4 across the 1.7.5 release). The
                 // build guard (scripts/check-bundle.js, run by build:check) still verifies the
                 // deployable bundles carry the package.json version. (FSR-103)
-                sdk_version: '1.7.6',
+                sdk_version: '1.7.9',
                 sdk_name: 'datalyr-web-sdk',
                 // A3-25: versioned-envelope stamp. Every SDK emits schema_version so the ingest/contract
                 // layer can key on ONE canonical envelope version (snake_case fields, event_name/event_data
@@ -5943,6 +6683,8 @@ var Datalyr = (function (exports) {
             // visitor_id that vanishes on the next page load. Idempotent.
             if (allowed)
                 this.identity.enablePersistence();
+            if (allowed)
+                this.trackInitialPageViewOnce();
             if (!allowed) {
                 // Mirror setConsent() withdrawal: purge buffered events so events captured
                 // before the decline can't drain if consent is later re-granted.
@@ -5974,6 +6716,15 @@ var Datalyr = (function (exports) {
             }
             this.log('Shopify consent collected — analytics allowed:', allowed, '— marketing blocked:', marketingBlocked);
         }
+        /** Release the automatic landing pageview once, after init and consent. */
+        trackInitialPageViewOnce() {
+            if (!this.initialPageViewReady || this.initialPageViewSent)
+                return;
+            if (!this.config.trackPageViews || !this.initialized || !this.shouldTrack())
+                return;
+            this.initialPageViewSent = true;
+            this.page();
+        }
         /**
          * Setup SPA tracking
          * Fixed Issue #15: Store original methods for cleanup
@@ -6168,6 +6919,10 @@ var Datalyr = (function (exports) {
                 this.stripeLinksDisposer();
                 this.stripeLinksDisposer = undefined;
             }
+            if (this.stripeSessionWatcher) {
+                this.stripeSessionWatcher.stop();
+                this.stripeSessionWatcher = undefined;
+            }
             // Clean up queue
             if (this.queue) {
                 this.queue.destroy();
@@ -6193,6 +6948,8 @@ var Datalyr = (function (exports) {
             this.container = undefined;
             this.autoIdentify = undefined;
             this.lastSpaPath = null;
+            this.initialPageViewReady = false;
+            this.initialPageViewSent = false;
             // Clear any remaining data
             this.superProperties = {};
             this.userProperties = {};
@@ -6201,19 +6958,27 @@ var Datalyr = (function (exports) {
             this.log('SDK destroyed');
         }
     }
-    // Create singleton instance. TR-23: reuse an existing window.datalyr (a prior tag's instance —
-    // Shopify App Embed + a manual snippet coexisting, or a double-included bundle) instead of
-    // constructing a SECOND one. Two instances each patch history.pushState and fire their own
-    // pageviews (distinct event_ids → no server-side dedup). A plain truthy check (NOT instanceof):
-    // two <script> tags run two separate IIFEs whose Datalyr classes are structurally identical but
-    // distinct objects, so instanceof would fail across them. With one shared instance, the second
-    // tag's bootstrap init() hits the instance-level `initialized` guard and no-ops.
-    const datalyr = (typeof window !== 'undefined' && window.datalyr) || new Datalyr();
+    /**
+     * Create an independent SDK instance without reading or mutating window.
+     *
+     * The CDN bootstrap uses this when an existing global is configured for a
+     * different workspace. Package consumers can also opt into multiple explicit
+     * instances without changing the default singleton contract below.
+     */
+    function createDatalyrInstance() {
+        return new Datalyr();
+    }
+    // Create the default singleton. TR-23: reuse an existing window.datalyr (a
+    // prior tag's instance or a package singleton) so npm/ESM/CJS consumers retain
+    // the established one-global behavior. Workspace conflict resolution belongs
+    // to the CDN bootstrap, which has the authoritative script-tag configuration.
+    const datalyr = (typeof window !== 'undefined' && window.datalyr) || createDatalyrInstance();
     // Expose global API
     if (typeof window !== 'undefined') {
         window.datalyr = datalyr;
     }
 
+    exports.createDatalyrInstance = createDatalyrInstance;
     exports.datalyr = datalyr;
     exports.default = datalyr;