@formo/analytics 1.29.0 → 1.30.0

package/dist/cjs/src/constants/config.d.ts

@@ -186,7 +186,7 @@ export declare const COUNTRY_LIST: {
     readonly "America/Panama": "PA";
     readonly "America/Pangnirtung": "CA";
     readonly "America/Paramaribo": "SR";
-    readonly "America/Phoenix": "US,CA";
+    readonly "America/Phoenix": "US";
     readonly "America/Port-au-Prince": "HT";
     readonly "America/Port_of_Spain": "TT";
     readonly "America/Porto_Acre": "BR";
@@ -289,6 +289,7 @@ export declare const COUNTRY_LIST: {
     readonly "Asia/Katmandu": "NP";
     readonly "Asia/Khandyga": "RU";
     readonly "Asia/Kolkata": "IN";
+    readonly "Asia/Kostanay": "KZ";
     readonly "Asia/Krasnoyarsk": "RU";
     readonly "Asia/Kuala_Lumpur": "MY";
     readonly "Asia/Kuching": "MY";
@@ -386,51 +387,11 @@ export declare const COUNTRY_LIST: {
     readonly "Canada/Pacific": "CA";
     readonly "Canada/Saskatchewan": "CA";
     readonly "Canada/Yukon": "CA";
-    readonly CET: "CET";
     readonly "Chile/Continental": "CL";
     readonly "Chile/EasterIsland": "CL";
-    readonly CST6CDT: "CST6CDT";
     readonly Cuba: "CU";
-    readonly EET: "EET";
     readonly Egypt: "EG";
     readonly Eire: "IE";
-    readonly EST: "EST";
-    readonly EST5EDT: "EST5EDT";
-    readonly "Etc/GMT": "Etc/GMT";
-    readonly "Etc/GMT+0": "Etc/GMT+0";
-    readonly "Etc/GMT+1": "Etc/GMT+1";
-    readonly "Etc/GMT+10": "Etc/GMT+10";
-    readonly "Etc/GMT+11": "Etc/GMT+11";
-    readonly "Etc/GMT+12": "Etc/GMT+12";
-    readonly "Etc/GMT+2": "Etc/GMT+2";
-    readonly "Etc/GMT+3": "Etc/GMT+3";
-    readonly "Etc/GMT+4": "Etc/GMT+4";
-    readonly "Etc/GMT+5": "Etc/GMT+5";
-    readonly "Etc/GMT+6": "Etc/GMT+6";
-    readonly "Etc/GMT+7": "Etc/GMT+7";
-    readonly "Etc/GMT+8": "Etc/GMT+8";
-    readonly "Etc/GMT+9": "Etc/GMT+9";
-    readonly "Etc/GMT-0": "Etc/GMT-0";
-    readonly "Etc/GMT-1": "Etc/GMT-1";
-    readonly "Etc/GMT-10": "Etc/GMT-10";
-    readonly "Etc/GMT-11": "Etc/GMT-11";
-    readonly "Etc/GMT-12": "Etc/GMT-12";
-    readonly "Etc/GMT-13": "Etc/GMT-13";
-    readonly "Etc/GMT-14": "Etc/GMT-14";
-    readonly "Etc/GMT-2": "Etc/GMT-2";
-    readonly "Etc/GMT-3": "Etc/GMT-3";
-    readonly "Etc/GMT-4": "Etc/GMT-4";
-    readonly "Etc/GMT-5": "Etc/GMT-5";
-    readonly "Etc/GMT-6": "Etc/GMT-6";
-    readonly "Etc/GMT-7": "Etc/GMT-7";
-    readonly "Etc/GMT-8": "Etc/GMT-8";
-    readonly "Etc/GMT-9": "Etc/GMT-9";
-    readonly "Etc/GMT0": "Etc/GMT0";
-    readonly "Etc/Greenwich": "Etc/Greenwich";
-    readonly "Etc/UCT": "Etc/UCT";
-    readonly "Etc/UTC": "Etc/UTC";
-    readonly "Etc/Universal": "Etc/Universal";
-    readonly "Etc/Zulu": "Etc/Zulu";
     readonly "Europe/Amsterdam": "NL";
     readonly "Europe/Andorra": "AD";
     readonly "Europe/Astrakhan": "RU";
@@ -495,16 +456,9 @@ export declare const COUNTRY_LIST: {
     readonly "Europe/Zagreb": "HR";
     readonly "Europe/Zaporozhye": "UA";
     readonly "Europe/Zurich": "CH";
-    readonly Factory: "Factory";
     readonly GB: "GB";
     readonly "GB-Eire": "GB";
-    readonly GMT: "GMT";
-    readonly "GMT+0": "GMT+0";
-    readonly "GMT-0": "GMT-0";
-    readonly GMT0: "GMT0";
-    readonly Greenwich: "Greenwich";
     readonly Hongkong: "HK";
-    readonly HST: "HST";
     readonly Iceland: "IS";
     readonly "Indian/Antananarivo": "MG";
     readonly "Indian/Chagos": "IO";
@@ -523,12 +477,9 @@ export declare const COUNTRY_LIST: {
     readonly Japan: "JP";
     readonly Kwajalein: "MH";
     readonly Libya: "LY";
-    readonly MET: "MET";
     readonly "Mexico/BajaNorte": "MX";
     readonly "Mexico/BajaSur": "MX";
     readonly "Mexico/General": "MX";
-    readonly MST: "MST";
-    readonly MST7MDT: "MST7MDT";
     readonly Navajo: "US";
     readonly NZ: "NZ";
     readonly "NZ-CHAT": "NZ";
@@ -546,7 +497,7 @@ export declare const COUNTRY_LIST: {
     readonly "Pacific/Galapagos": "EC";
     readonly "Pacific/Gambier": "PF";
     readonly "Pacific/Guadalcanal": "SB";
-    readonly "Pacific/Guam": "GU,MP";
+    readonly "Pacific/Guam": "GU";
     readonly "Pacific/Honolulu": "US";
     readonly "Pacific/Johnston": "UM";
     readonly "Pacific/Kanton": "KI";
@@ -579,13 +530,10 @@ export declare const COUNTRY_LIST: {
     readonly Poland: "PL";
     readonly Portugal: "PT";
     readonly PRC: "CN";
-    readonly PST8PDT: "PST8PDT";
     readonly ROC: "TW";
     readonly ROK: "KR";
     readonly Singapore: "SG";
     readonly Turkey: "TR";
-    readonly UCT: "UCT";
-    readonly Universal: "Universal";
     readonly "US/Alaska": "US";
     readonly "US/Aleutian": "US";
     readonly "US/Arizona": "US";
@@ -598,9 +546,6 @@ export declare const COUNTRY_LIST: {
     readonly "US/Mountain": "US";
     readonly "US/Pacific": "US";
     readonly "US/Samoa": "AS";
-    readonly UTC: "UTC";
     readonly "W-SU": "RU";
-    readonly WET: "WET";
-    readonly Zulu: "Zulu";
 };
 //# sourceMappingURL=config.d.ts.map

package/dist/cjs/src/constants/config.js

@@ -192,7 +192,7 @@ exports.COUNTRY_LIST = {
     "America/Panama": "PA",
     "America/Pangnirtung": "CA",
     "America/Paramaribo": "SR",
-    "America/Phoenix": "US,CA",
+    "America/Phoenix": "US",
     "America/Port-au-Prince": "HT",
     "America/Port_of_Spain": "TT",
     "America/Porto_Acre": "BR",
@@ -298,6 +298,7 @@ exports.COUNTRY_LIST = {
     "Asia/Katmandu": "NP",
     "Asia/Khandyga": "RU",
     "Asia/Kolkata": "IN",
+    "Asia/Kostanay": "KZ",
     "Asia/Krasnoyarsk": "RU",
     "Asia/Kuala_Lumpur": "MY",
     "Asia/Kuching": "MY",
@@ -399,59 +400,15 @@ exports.COUNTRY_LIST = {
     "Canada/Pacific": "CA",
     "Canada/Saskatchewan": "CA",
     "Canada/Yukon": "CA",
-    // CET
-    CET: "CET",
     // Chile
     "Chile/Continental": "CL",
     "Chile/EasterIsland": "CL",
-    // CST6CDT
-    CST6CDT: "CST6CDT",
     // Cuba
     Cuba: "CU",
-    // EET
-    EET: "EET",
     // Egypt
     Egypt: "EG",
     // Eire
     Eire: "IE",
-    // EST
-    EST: "EST",
-    EST5EDT: "EST5EDT",
-    "Etc/GMT": "Etc/GMT",
-    "Etc/GMT+0": "Etc/GMT+0",
-    "Etc/GMT+1": "Etc/GMT+1",
-    "Etc/GMT+10": "Etc/GMT+10",
-    "Etc/GMT+11": "Etc/GMT+11",
-    "Etc/GMT+12": "Etc/GMT+12",
-    "Etc/GMT+2": "Etc/GMT+2",
-    "Etc/GMT+3": "Etc/GMT+3",
-    "Etc/GMT+4": "Etc/GMT+4",
-    "Etc/GMT+5": "Etc/GMT+5",
-    "Etc/GMT+6": "Etc/GMT+6",
-    "Etc/GMT+7": "Etc/GMT+7",
-    "Etc/GMT+8": "Etc/GMT+8",
-    "Etc/GMT+9": "Etc/GMT+9",
-    "Etc/GMT-0": "Etc/GMT-0",
-    "Etc/GMT-1": "Etc/GMT-1",
-    "Etc/GMT-10": "Etc/GMT-10",
-    "Etc/GMT-11": "Etc/GMT-11",
-    "Etc/GMT-12": "Etc/GMT-12",
-    "Etc/GMT-13": "Etc/GMT-13",
-    "Etc/GMT-14": "Etc/GMT-14",
-    "Etc/GMT-2": "Etc/GMT-2",
-    "Etc/GMT-3": "Etc/GMT-3",
-    "Etc/GMT-4": "Etc/GMT-4",
-    "Etc/GMT-5": "Etc/GMT-5",
-    "Etc/GMT-6": "Etc/GMT-6",
-    "Etc/GMT-7": "Etc/GMT-7",
-    "Etc/GMT-8": "Etc/GMT-8",
-    "Etc/GMT-9": "Etc/GMT-9",
-    "Etc/GMT0": "Etc/GMT0",
-    "Etc/Greenwich": "Etc/Greenwich",
-    "Etc/UCT": "Etc/UCT",
-    "Etc/UTC": "Etc/UTC",
-    "Etc/Universal": "Etc/Universal",
-    "Etc/Zulu": "Etc/Zulu",
     // Europe
     "Europe/Amsterdam": "NL",
     "Europe/Andorra": "AD",
@@ -517,21 +474,11 @@ exports.COUNTRY_LIST = {
     "Europe/Zagreb": "HR",
     "Europe/Zaporozhye": "UA",
     "Europe/Zurich": "CH",
-    // Factory
-    Factory: "Factory",
     // GB
     GB: "GB",
     "GB-Eire": "GB",
-    // GMT
-    GMT: "GMT",
-    "GMT+0": "GMT+0",
-    "GMT-0": "GMT-0",
-    GMT0: "GMT0",
-    Greenwich: "Greenwich",
     // HK
     Hongkong: "HK",
-    // HST
-    HST: "HST",
     // Iceland
     Iceland: "IS",
     // Indian
@@ -558,15 +505,10 @@ exports.COUNTRY_LIST = {
     Kwajalein: "MH",
     // Libya
     Libya: "LY",
-    // MET
-    MET: "MET",
     // Mexico
     "Mexico/BajaNorte": "MX",
     "Mexico/BajaSur": "MX",
     "Mexico/General": "MX",
-    // MST
-    MST: "MST",
-    MST7MDT: "MST7MDT",
     // Navajo
     Navajo: "US",
     // NZ
@@ -587,7 +529,7 @@ exports.COUNTRY_LIST = {
     "Pacific/Galapagos": "EC",
     "Pacific/Gambier": "PF",
     "Pacific/Guadalcanal": "SB",
-    "Pacific/Guam": "GU,MP",
+    "Pacific/Guam": "GU",
     "Pacific/Honolulu": "US",
     "Pacific/Johnston": "UM",
     "Pacific/Kanton": "KI",
@@ -623,8 +565,6 @@ exports.COUNTRY_LIST = {
     Portugal: "PT",
     // PRC
     PRC: "CN",
-    // PST8PDT
-    PST8PDT: "PST8PDT",
     // ROC
     ROC: "TW",
     // ROK
@@ -633,10 +573,6 @@ exports.COUNTRY_LIST = {
     Singapore: "SG",
     // Turkey
     Turkey: "TR",
-    // UCT
-    UCT: "UCT",
-    // Universal
-    Universal: "Universal",
     // US
     "US/Alaska": "US",
     "US/Aleutian": "US",
@@ -650,13 +586,7 @@ exports.COUNTRY_LIST = {
     "US/Mountain": "US",
     "US/Pacific": "US",
     "US/Samoa": "AS",
-    // UTC
-    UTC: "UTC",
     // W-SU
     "W-SU": "RU",
-    // WET
-    WET: "WET",
-    // Zulu
-    Zulu: "Zulu",
 };
 //# sourceMappingURL=config.js.map

package/dist/cjs/src/event/EventFactory.d.ts

@@ -35,7 +35,7 @@ declare class EventFactory implements IEventFactory {
     generateConnectEvent(chainId: ChainID, address: Address, properties?: IFormoEventProperties, context?: IFormoEventContext): Promise<IFormoEvent>;
     generateDisconnectEvent(chainId?: ChainID, address?: Address, properties?: IFormoEventProperties, context?: IFormoEventContext): Promise<IFormoEvent>;
     generateChainChangedEvent(chainId: ChainID, address: Address, properties?: IFormoEventProperties, context?: IFormoEventContext): Promise<IFormoEvent>;
-    generateSignatureEvent(status: SignatureStatus, chainId: ChainID, address: Address, message: string, signatureHash?: string, properties?: IFormoEventProperties, context?: IFormoEventContext): Promise<IFormoEvent>;
+    generateSignatureEvent(status: SignatureStatus, chainId: ChainID, address: Address, message: string, properties?: IFormoEventProperties, context?: IFormoEventContext): Promise<IFormoEvent>;
     generateTransactionEvent(status: TransactionStatus, chainId: ChainID, address: Address, data?: string, to?: string, value?: string, transactionHash?: string, function_name?: string, function_args?: Record<string, unknown>, properties?: IFormoEventProperties, context?: IFormoEventContext): Promise<IFormoEvent>;
     generateTrackEvent(event: string, properties?: IFormoEventProperties, context?: IFormoEventContext): Promise<IFormoEvent>;
     create(event: APIEvent, address?: Address, userId?: string): Promise<IFormoEvent>;

package/dist/cjs/src/event/EventFactory.js

@@ -63,6 +63,7 @@ var version_1 = require("../version");
 var constants_2 = require("./constants");
 var utils_2 = require("./utils");
 var browsers_1 = require("../browser/browsers");
+var ISO_3166_ALPHA_2_REGEX = /^[A-Z]{2}$/;
 var EventFactory = /** @class */ (function () {
     function EventFactory(options) {
         var _this = this;
@@ -230,9 +231,14 @@ var EventFactory = /** @class */ (function () {
     EventFactory.prototype.getLocation = function () {
         try {
             var timezone = this.getTimezone();
-            if (timezone in constants_1.COUNTRY_LIST)
-                return constants_1.COUNTRY_LIST[timezone];
-            return timezone;
+            if (!timezone)
+                return "";
+            var mapped = constants_1.COUNTRY_LIST[timezone];
+            // Only emit ISO-3166 alpha-2. Anything else (including the raw
+            // timezone string) is treated as unknown.
+            return typeof mapped === "string" && ISO_3166_ALPHA_2_REGEX.test(mapped)
+                ? mapped
+                : "";
         }
         catch (error) {
             logger_1.logger.error("Error resolving location:", error);
@@ -413,12 +419,12 @@ var EventFactory = /** @class */ (function () {
             });
         });
     };
-    EventFactory.prototype.generateSignatureEvent = function (status, chainId, address, message, signatureHash, properties, context) {
+    EventFactory.prototype.generateSignatureEvent = function (status, chainId, address, message, properties, context) {
         return __awaiter(this, void 0, void 0, function () {
             var signatureEvent;
             return __generator(this, function (_a) {
                 signatureEvent = {
-                    properties: __assign(__assign({ status: status, chainId: chainId, message: message }, (signatureHash && { signatureHash: signatureHash })), properties),
+                    properties: __assign({ status: status, chainId: chainId, message: message }, properties),
                     address: address,
                     type: "signature",
                 };
@@ -506,7 +512,7 @@ var EventFactory = /** @class */ (function () {
                     case 12:
                         formoEvent = _b.sent();
                         return [3 /*break*/, 19];
-                    case 13: return [4 /*yield*/, this.generateSignatureEvent(event.status, event.chainId, event.address, event.message, event.signatureHash, event.properties, event.context)];
+                    case 13: return [4 /*yield*/, this.generateSignatureEvent(event.status, event.chainId, event.address, event.message, event.properties, event.context)];
                     case 14:
                         formoEvent = _b.sent();
                         return [3 /*break*/, 19];

package/dist/cjs/src/event/EventManager.d.ts

@@ -18,6 +18,8 @@ declare class EventManager implements IEventManager {
      * @param event Incoming event data
      */
     addEvent(event: APIEvent, address?: Address, userId?: string): Promise<void>;
+    /** Drop any buffered events (consent withdrawal / teardown). */
+    clear(): void;
 }
 export { EventManager };
 //# sourceMappingURL=EventManager.d.ts.map

package/dist/cjs/src/event/EventManager.js

@@ -96,6 +96,10 @@ var EventManager = /** @class */ (function () {
             });
         });
     };
+    /** Drop any buffered events (consent withdrawal / teardown). */
+    EventManager.prototype.clear = function () {
+        this.eventQueue.clear();
+    };
     return EventManager;
 }());
 exports.EventManager = EventManager;

package/dist/cjs/src/event/type.d.ts

@@ -1,6 +1,7 @@
 import { Address, APIEvent, IFormoEvent } from "../types";
 export interface IEventManager {
     addEvent(event: APIEvent, address?: Address, userId?: string): Promise<void>;
+    clear(): void;
 }
 export interface IEventFactory {
     create(event: APIEvent, address?: Address, userId?: string): Promise<IFormoEvent>;

package/dist/cjs/src/event/utils.js

@@ -26,7 +26,7 @@ var generateAnonymousId = function (key, crossSubdomainCookies) {
     // domain. Note: host-only cookies on other hosts (e.g. a cookie set on
     // example.com is not visible from app.example.com) cannot be migrated
     // until the user revisits that host.
-    (0, storage_1.cookie)().set(key, anonymousId, __assign({ expires: new Date(Date.now() + 1000 * 60 * 60 * 24 * 365).toUTCString(), path: "/" }, (domain ? { domain: domain } : {})));
+    (0, storage_1.cookie)().set(key, anonymousId, __assign(__assign({ expires: new Date(Date.now() + 1000 * 60 * 60 * 24 * 365).toUTCString(), path: "/" }, (0, cookiePolicy_1.getIdentityCookieSecurity)()), (domain ? { domain: domain } : {})));
     return anonymousId;
 };
 exports.generateAnonymousId = generateAnonymousId;

package/dist/cjs/src/queue/EventQueue.d.ts

@@ -11,6 +11,7 @@ type Options = {
     retryCount?: number;
     errorHandler?: any;
     maxQueueSize?: number;
+    canSend?: () => boolean;
 };
 export declare class EventQueue implements IEventQueue {
     private writeKey;
@@ -21,12 +22,19 @@ export declare class EventQueue implements IEventQueue {
     private flushIntervalMs;
     private flushed;
     private maxQueueSize;
+    private queueByteSize;
     private errorHandler;
     private retryCount;
     private pendingFlush;
     private payloadHashes;
+    private canSend?;
     constructor(writeKey: string, options: Options);
     private generateMessageId;
+    /**
+     * Drop all queued data and cancel the flush timer. Called on consent
+     * withdrawal / SDK teardown so nothing buffered can be sent later.
+     */
+    clear(): void;
     enqueue(event: IFormoEvent, callback?: (...args: any) => void): Promise<void>;
     flush(callback?: (...args: any) => void, drainAll?: boolean): Promise<void | IFormoEventFlushPayload[]>;
     /**

package/dist/cjs/src/queue/EventQueue.js

@@ -87,6 +87,7 @@ var EventQueue = /** @class */ (function () {
     function EventQueue(writeKey, options) {
         var _this = this;
         this.queue = [];
+        this.queueByteSize = 0; // running total of queued items' byteSize
         this.payloadHashes = new Set();
         this.onPageLeave = function (callback) {
             // To ensure the callback is only called once even if more than one events
@@ -142,6 +143,7 @@ var EventQueue = /** @class */ (function () {
         this.queue = [];
         this.writeKey = writeKey;
         this.apiHost = options.apiHost;
+        this.canSend = options.canSend;
         this.retryCount = (0, utils_1.clampNumber)(options.retryCount || DEFAULT_RETRY, MAX_RETRY, MIN_RETRY);
         this.flushAt = (0, utils_1.clampNumber)(options.flushAt || DEFAULT_FLUSH_AT, MAX_FLUSH_AT, MIN_FLUSH_AT);
         this.maxQueueSize = (0, utils_1.clampNumber)(options.maxQueueSize || DEFAULT_QUEUE_SIZE, MAX_QUEUE_SIZE, MIN_QUEUE_SIZE);
@@ -175,13 +177,31 @@ var EventQueue = /** @class */ (function () {
             });
         });
     };
+    /**
+     * Drop all queued data and cancel the flush timer. Called on consent
+     * withdrawal / SDK teardown so nothing buffered can be sent later.
+     */
+    EventQueue.prototype.clear = function () {
+        if (this.timer) {
+            clearTimeout(this.timer);
+            this.timer = null;
+        }
+        this.queue = [];
+        this.queueByteSize = 0;
+        this.payloadHashes.clear();
+    };
     EventQueue.prototype.enqueue = function (event, callback) {
         return __awaiter(this, void 0, void 0, function () {
-            var message_id, hasReachedFlushAt, hasReachedQueueSize;
+            var message_id, queueItem, hasReachedFlushAt, hasReachedQueueSize;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
                         callback = callback || noop;
+                        // Refuse to buffer anything once consent is withdrawn.
+                        if (this.canSend && !this.canSend()) {
+                            this.clear();
+                            return [2 /*return*/];
+                        }
                         return [4 /*yield*/, this.generateMessageId(event)];
                     case 1:
                         message_id = _a.sent();
@@ -190,10 +210,18 @@ var EventQueue = /** @class */ (function () {
                             logger_1.logger.warn("Event already enqueued, try again after ".concat((0, utils_1.millisecondsToSecond)(this.flushIntervalMs), " seconds."));
                             return [2 /*return*/];
                         }
-                        this.queue.push({
+                        queueItem = {
                             message: __assign(__assign({}, event), { message_id: message_id }),
                             callback: callback,
-                        });
+                            byteSize: 0,
+                        };
+                        // Measure once here (message only — JSON.stringify drops the
+                        // callback function anyway), then track the total incrementally.
+                        queueItem.byteSize = JSON.stringify({
+                            message: queueItem.message,
+                        }).length;
+                        this.queue.push(queueItem);
+                        this.queueByteSize += queueItem.byteSize;
                         logger_1.logger.log("Event enqueued: ".concat((0, utils_1.getActionDescriptor)(event.type, event.properties)));
                         if (!this.flushed) {
                             this.flushed = true;
@@ -201,8 +229,7 @@ var EventQueue = /** @class */ (function () {
                             return [2 /*return*/];
                         }
                         hasReachedFlushAt = this.queue.length >= this.flushAt;
-                        hasReachedQueueSize = this.queue.reduce(function (acc, item) { return acc + JSON.stringify(item).length; }, 0) >=
-                            this.maxQueueSize;
+                        hasReachedQueueSize = this.queueByteSize >= this.maxQueueSize;
                         if (hasReachedFlushAt || hasReachedQueueSize) {
                             this.flush();
                             return [2 /*return*/];
@@ -228,6 +255,13 @@ var EventQueue = /** @class */ (function () {
                             clearTimeout(this.timer);
                             this.timer = null;
                         }
+                        // Final consent gate: a timer/pagehide flush may have been scheduled
+                        // before opt-out. Drop everything rather than send post-withdrawal.
+                        if (this.canSend && !this.canSend()) {
+                            this.clear();
+                            callback();
+                            return [2 /*return*/, Promise.resolve()];
+                        }
                         if (!this.queue.length) {
                             callback();
                             return [2 /*return*/, Promise.resolve()];
@@ -241,11 +275,17 @@ var EventQueue = /** @class */ (function () {
                     case 2:
                         items = this.queue.splice(0, drainAll ? this.queue.length : this.flushAt);
                         // Only remove hashes for flushed items so duplicate detection remains
-                        // active for events still in the queue.
+                        // active for events still in the queue. Also decrement the running
+                        // byte total by exactly what left the queue.
                         for (_i = 0, items_1 = items; _i < items_1.length; _i++) {
                             item = items_1[_i];
                             this.payloadHashes.delete(item.message.message_id);
+                            this.queueByteSize -= item.byteSize;
                         }
+                        // Re-anchor to the exact invariant when the queue empties, so any
+                        // accumulated drift can never wedge the size gate.
+                        if (this.queue.length === 0)
+                            this.queueByteSize = 0;
                         sentAt = new Date().toISOString();
                         data = items.map(function (item) { return (__assign(__assign({}, item.message), { sent_at: sentAt })); });
                         batches = this.splitIntoBatches(items, data);
@@ -348,6 +388,12 @@ var EventQueue = /** @class */ (function () {
                     case 1:
                         if (!(_i < batches_1.length)) return [3 /*break*/, 6];
                         batch = batches_1[_i];
+                        // Consent can be withdrawn while a flush is already in flight:
+                        // batches were spliced before opt-out, and split batches / retry
+                        // backoff span seconds. Re-check before every send and abandon
+                        // the remaining batches if consent was revoked mid-flush.
+                        if (this.canSend && !this.canSend())
+                            return [3 /*break*/, 6];
                         _a.label = 2;
                     case 2:
                         _a.trys.push([2, 4, , 5]);

package/dist/cjs/src/queue/type.d.ts

@@ -2,5 +2,6 @@ import { IFormoEvent } from "../types";
 export interface IEventQueue {
     enqueue(event: IFormoEvent, callback?: (...args: any) => void): Promise<void>;
     flush(callback?: (...args: any) => void): Promise<any>;
+    clear(): void;
 }
 //# sourceMappingURL=type.d.ts.map

package/dist/cjs/src/session/index.js

@@ -5,9 +5,21 @@
  * Handles tracking of detected wallets and identified wallet-address pairs
  * using cookies to maintain state across page loads within a session.
  */
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FormoAnalyticsSession = exports.SESSION_WALLET_IDENTIFIED_KEY = exports.SESSION_WALLET_DETECTED_KEY = void 0;
 var storage_1 = require("../storage");
+var cookiePolicy_1 = require("../storage/cookiePolicy");
 var logger_1 = require("../logger");
 /**
  * Cookie keys for session tracking
@@ -66,11 +78,9 @@ var FormoAnalyticsSession = /** @class */ (function () {
             if (rdnses.length > MAX_SESSION_ENTRIES) {
                 rdnses.splice(0, rdnses.length - MAX_SESSION_ENTRIES);
             }
-            (0, storage_1.cookie)().set(exports.SESSION_WALLET_DETECTED_KEY, rdnses.join(","), {
+            (0, storage_1.cookie)().set(exports.SESSION_WALLET_DETECTED_KEY, rdnses.join(","), __assign({ 
                 // Expires by the end of the day
-                expires: new Date(Date.now() + 86400 * 1000).toUTCString(),
-                path: "/",
-            });
+                expires: new Date(Date.now() + 86400 * 1000).toUTCString(), path: "/" }, (0, cookiePolicy_1.getIdentityCookieSecurity)()));
         }
     };
     /**
@@ -110,11 +120,9 @@ var FormoAnalyticsSession = /** @class */ (function () {
                 identifiedWallets.splice(0, identifiedWallets.length - MAX_SESSION_ENTRIES);
             }
             var newValue = identifiedWallets.join(",");
-            (0, storage_1.cookie)().set(exports.SESSION_WALLET_IDENTIFIED_KEY, newValue, {
+            (0, storage_1.cookie)().set(exports.SESSION_WALLET_IDENTIFIED_KEY, newValue, __assign({ 
                 // Expires by the end of the day
-                expires: new Date(Date.now() + 86400 * 1000).toUTCString(),
-                path: "/",
-            });
+                expires: new Date(Date.now() + 86400 * 1000).toUTCString(), path: "/" }, (0, cookiePolicy_1.getIdentityCookieSecurity)()));
             logger_1.logger.debug("Session: Marked wallet as identified", {
                 identifiedKey: identifiedKey,
                 hasRdns: !!rdns,

package/dist/cjs/src/storage/cookiePolicy.d.ts

@@ -7,4 +7,20 @@
  * @param crossSubdomain Whether cookies should be shared across subdomains.
  */
 export declare function getIdentityCookieDomain(crossSubdomain?: boolean): string;
+/**
+ * Security attributes for identity/session cookies (user-id,
+ * active-wallet, wallet-detected/identified).
+ *
+ * - `sameSite: "lax"` — first-party analytics identity. Lax keeps the
+ *   cookie on top-level navigations (so attribution survives a click-in
+ *   from another site) while blocking it on cross-site subrequests.
+ *   Strict would silently drop identity on inbound navigation.
+ * - `secure` — only on HTTPS. Setting Secure over plain HTTP (local dev)
+ *   makes the browser reject the cookie outright, so it must be
+ *   conditional.
+ */
+export declare function getIdentityCookieSecurity(): {
+    sameSite: "lax";
+    secure: boolean;
+};
 //# sourceMappingURL=cookiePolicy.d.ts.map

package/dist/cjs/src/storage/cookiePolicy.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getIdentityCookieDomain = getIdentityCookieDomain;
+exports.getIdentityCookieSecurity = getIdentityCookieSecurity;
 /**
  * Cookie domain policy — centralizes the decision of whether identity
  * cookies should be host-scoped or apex-scoped.
@@ -24,4 +25,22 @@ function getIdentityCookieDomain(crossSubdomain) {
     var domain = (0, domain_1.getApexDomain)();
     return domain ? ".".concat(domain) : "";
 }
+/**
+ * Security attributes for identity/session cookies (user-id,
+ * active-wallet, wallet-detected/identified).
+ *
+ * - `sameSite: "lax"` — first-party analytics identity. Lax keeps the
+ *   cookie on top-level navigations (so attribution survives a click-in
+ *   from another site) while blocking it on cross-site subrequests.
+ *   Strict would silently drop identity on inbound navigation.
+ * - `secure` — only on HTTPS. Setting Secure over plain HTTP (local dev)
+ *   makes the browser reject the cookie outright, so it must be
+ *   conditional.
+ */
+function getIdentityCookieSecurity() {
+    var _a;
+    var isHttps = typeof window !== "undefined" &&
+        ((_a = window.location) === null || _a === void 0 ? void 0 : _a.protocol) === "https:";
+    return { sameSite: "lax", secure: isHttps };
+}
 //# sourceMappingURL=cookiePolicy.js.map

package/dist/cjs/src/types/base.d.ts

@@ -40,7 +40,6 @@ export interface IFormoAnalytics {
         chainId?: ChainID;
         address: Address;
         message: string;
-        signatureHash?: string;
     }, properties?: IFormoEventProperties, context?: IFormoEventContext, callback?: (...args: unknown[]) => void): Promise<void>;
     transaction(params: {
         status: TransactionStatus;