@mparticle/web-sdk 3.23.0 → 3.24.0

package/dist/mparticle.js

@@ -204,7 +204,7 @@ var mParticle = (function () {
       Base64: Base64$1
     };
 
-    var version = "3.23.0";
+    var version = "3.24.0";
 
     var Constants = {
       sdkVersion: version,
@@ -315,7 +315,6 @@ var mParticle = (function () {
         aliasMaxWindow: 90,
         uploadInterval: 0 // Maximum milliseconds in between batch uploads, below 500 will mean immediate upload.  The server returns this as a string, but we are using it as a number internally
       },
-
       DefaultBaseUrls: {
         v1SecureServiceUrl: 'jssdks.mparticle.com/v1/JS/',
         v2SecureServiceUrl: 'jssdks.mparticle.com/v2/JS/',
@@ -601,14 +600,13 @@ var mParticle = (function () {
         // @ts-ignore
         randomValue = window.crypto.getRandomValues(new Uint8Array(1)); // eslint-disable-line no-undef
       }
-
       if (randomValue) {
         // @ts-ignore
         return (a ^ randomValue[0] % 16 >> a / 4).toString(16);
       }
       return (a ^ Math.random() * 16 >> a / 4).toString(16);
     };
-    var generateUniqueId = function generateUniqueId(a) {
+    var _generateUniqueId = function generateUniqueId(a) {
       // https://gist.github.com/jed/982883
       // Added support for crypto for better random
       if (a === void 0) {
@@ -624,7 +622,7 @@ var mParticle = (function () {
       // -1e11 -> //-100000000000,
       "".concat(1e7, "-").concat(1e3, "-").concat(4e3, "-").concat(8e3, "-").concat(1e11).replace(/[018]/g,
       // zeroes, ones, and eights with
-      generateUniqueId // random hex digits
+      _generateUniqueId // random hex digits
       );
     };
     /**
@@ -930,7 +928,7 @@ var mParticle = (function () {
      * obfuscateData({ tags: ['premium', 'verified'] })
      * // Returns: { tags: ['string', 'string'] }
      */
-    var obfuscateData = function obfuscateData(value) {
+    var _obfuscateData = function obfuscateData(value) {
       // Preserve null and undefined
       if (value === null || value === undefined) {
         return value;
@@ -938,7 +936,7 @@ var mParticle = (function () {
       // Handle arrays - recursively obfuscate each element
       if (Array.isArray(value)) {
         return value.map(function (item) {
-          return obfuscateData(item);
+          return _obfuscateData(item);
         });
       }
       // Handle objects - recursively obfuscate each property
@@ -946,7 +944,7 @@ var mParticle = (function () {
         var obfuscated = {};
         for (var key in value) {
           if (value.hasOwnProperty(key)) {
-            obfuscated[key] = obfuscateData(value[key]);
+            obfuscated[key] = _obfuscateData(value[key]);
           }
         }
         return obfuscated;
@@ -970,7 +968,7 @@ var mParticle = (function () {
      * // Returns: { email: 'string' }
      */
     var obfuscateDevData = function obfuscateDevData(data, isDevelopmentMode) {
-      return isDevelopmentMode ? data : obfuscateData(data);
+      return isDevelopmentMode ? data : _obfuscateData(data);
     };
     // Standalone version of jQuery.extend, from https://github.com/dansdom/extend
     // https://go.mparticle.com/work/SQDSDKS-6047
@@ -2183,7 +2181,7 @@ var mParticle = (function () {
         application_info: {
           application_version: lastEvent.AppVersion,
           application_name: lastEvent.AppName,
-          "package": lastEvent.Package,
+          package: lastEvent.Package,
           sideloaded_kits_count: mpInstance._Store.sideloadedKitsCount
         },
         device_info: {
@@ -2523,7 +2521,6 @@ var mParticle = (function () {
         //note: External Events DTO does not support the session mpids array as of this time.
         //spanning_mpids: sdkEvent.SessionMpids
       };
-
       sessionEndEventData = Object.assign(sessionEndEventData, commonEventData);
       return {
         event_type: dist.EventTypeEnum.sessionEnd,
@@ -2652,7 +2649,7 @@ var mParticle = (function () {
       var commonEventData = convertBaseEventData(sdkEvent);
       var userAttributeChangeEvent = {
         user_attribute_name: sdkEvent.UserAttributeChanges.UserAttributeName,
-        "new": sdkEvent.UserAttributeChanges.New,
+        new: sdkEvent.UserAttributeChanges.New,
         old: sdkEvent.UserAttributeChanges.Old,
         deleted: sdkEvent.UserAttributeChanges.Deleted,
         is_new_attribute: sdkEvent.UserAttributeChanges.IsNewAttribute
@@ -2666,7 +2663,7 @@ var mParticle = (function () {
     function convertUserIdentityChangeEvent(sdkEvent) {
       var commonEventData = convertBaseEventData(sdkEvent);
       var userIdentityChangeEvent = {
-        "new": {
+        new: {
           identity_type: convertUserIdentityTypeToServerIdentityType(sdkEvent.UserIdentityChanges.New.IdentityType),
           identity: sdkEvent.UserIdentityChanges.New.Identity || null,
           timestamp_unixtime_ms: sdkEvent.Timestamp,
@@ -2886,23 +2883,9 @@ var mParticle = (function () {
     // Nothing has to be deleted, and there is no ordering in which half the state
     // survives the reset.
     var WIN_APV_KEY = '__mpApv__';
-    // The query params an auto page view may carry. An allowlist, not a denylist:
-    // partner URLs routinely hold order ids, email addresses and session tokens, and
-    // none of those should reach the event stream because someone forgot to exclude
-    // them. Anything absent from this list is dropped.
-    //
-    // SECURITY: `code`, `state` and `nonce` are the OAuth 2.0 / OIDC authorization
-    // code and the CSRF/replay tokens. They are credentials until redeemed, and
-    // attaching them here persists them in the event store and forwards them to
-    // every configured kit. They are on the list by explicit product decision \u2014
-    // deleting that line is the whole of the fix if that decision is revisited.
+    // Parameters that identify which page a view is of. Authorization-flow and campaign
+    // attribution parameters are deliberately absent; an input can add them explicitly.
     var ALLOWED_QUERY_PARAMS = [
-    // Campaign attribution
-    'utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'utm_id', 'utm_source_platform', 'utm_creative_format', 'utm_marketing_tactic', 'gad_source', 'gad_campaignid', 'mc_cid',
-    // Ad-network click ids
-    'gclid', 'gbraid', 'wbraid', 'fbclid', 'msclkid', 'ttclid', 'twclid', 'li_fat_id', 'dclid', 'srsltid', 'epik', 'ScCid', 'irclickid', 'rtid', 'rclid',
-    // OAuth / OIDC \u2014 see the SECURITY note above
-    'client_id', 'redirect_uri', 'response_type', 'scope', 'state', 'code', 'nonce',
     // Pagination
     'page', 'limit', 'offset', 'cursor', 'per_page',
     // Site search term, as the common platforms spell it. Matching is
@@ -2916,6 +2899,22 @@ var mParticle = (function () {
     'category',
     // Referral
     'ref', 'referrer'];
+    var AUTO_PAGE_VIEW_ATTRIBUTE = 'is_auto_page_view';
+    var CORE_EVENT_FIELDS = ['hostname', 'title', 'path', AUTO_PAGE_VIEW_ATTRIBUTE];
+    var PROTOTYPE_MEMBER_NAMES = ['constructor', '__proto__', 'prototype'];
+    // Server flag values are the strings 'True' and 'False', so these get typed here by habit.
+    var FLAG_VALUE_NAMES = ['true', 'false'];
+    var RESERVED_QUERY_PARAMS = CORE_EVENT_FIELDS.concat(PROTOTYPE_MEMBER_NAMES, FLAG_VALUE_NAMES);
+    var BUILT_IN_NAMES = ALLOWED_QUERY_PARAMS.map(function (name) {
+      return name.toLowerCase();
+    });
+    var isBuiltIn = function isBuiltIn(name) {
+      return BUILT_IN_NAMES.indexOf(name.toLowerCase()) !== -1;
+    };
+    // Excludes `&`, `=`, `%` and whitespace, which would distort the dedup key.
+    var QUERY_PARAM_NAME = /^[a-z0-9_][a-z0-9_.-]{0,63}$/;
+    var MAX_CUSTOM_QUERY_PARAMS = 25;
+    var MAX_CUSTOM_QUERY_PARAM_VALUE_LENGTH = 512;
     // Params matched by name prefix, for platforms that put a per-product id in the
     // name. Salesforce Commerce Cloud spells a variant choice
     // `dwvar_<productId>_<attribute>`, e.g. `dwvar_12345_color=navy`.
@@ -2925,34 +2924,113 @@ var mParticle = (function () {
         return name.indexOf(prefix) === 0;
       });
     };
-    var ALLOWED_QUERY_PARAMS_LOWER = ALLOWED_QUERY_PARAMS.map(function (name) {
-      return name.toLowerCase();
-    });
-    // Whether a query param name, in any case, is one an auto page view captures.
+    // Whether a query param name, in any case, is one an auto page view captures by default.
     var isAllowedQueryParam = function isAllowedQueryParam(name) {
-      var lower = name.toLowerCase();
-      return ALLOWED_QUERY_PARAMS_LOWER.indexOf(lower) !== -1 || hasAllowedPrefix(lower);
+      return isBuiltIn(name) || hasAllowedPrefix(name.toLowerCase());
     };
     // ---------------------------------------------------------------------------
     // Pure helpers. No `this`, no globals, no side effects \u2014 callable and assertable
     // on their own, which is where the interesting rules live.
     // ---------------------------------------------------------------------------
-    // Pulls the allowlisted query params off a URL. Delegates to the SDK's own
-    // parser, which lowercases keys (so `?UTM_Source=` and `?utm_source=` land on one
-    // attribute), drops empty values, and carries the fallback for browsers without
-    // URLSearchParams. Tolerates an empty href, so SSR yields no params rather than
-    // throwing.
-    var allowedQueryParams = function allowedQueryParams(href) {
-      var params = queryStringParser(href, ALLOWED_QUERY_PARAMS);
+    // Validated here as well as in the dashboard, because remote config is untrusted input.
+    var parseQueryParamAllowlist = function parseQueryParamAllowlist(configured) {
+      var allowed = [];
+      var rejectedPositions = [];
+      var overLimit = 0;
+      if (!configured) {
+        return {
+          allowed: allowed,
+          rejectedPositions: rejectedPositions,
+          overLimit: overLimit
+        };
+      }
+      var entries = Array.isArray(configured) ? configured : String(configured).split(',');
+      entries.forEach(function (entry, index) {
+        var position = index + 1;
+        var name = String(entry).trim().toLowerCase();
+        if (!name) {
+          return;
+        }
+        if (!QUERY_PARAM_NAME.test(name) || RESERVED_QUERY_PARAMS.indexOf(name) !== -1) {
+          rejectedPositions.push(position);
+          return;
+        }
+        if (isBuiltIn(name) || allowed.indexOf(name) !== -1) {
+          return;
+        }
+        if (allowed.length >= MAX_CUSTOM_QUERY_PARAMS) {
+          overLimit++;
+          return;
+        }
+        allowed.push(name);
+      });
+      return {
+        allowed: allowed,
+        rejectedPositions: rejectedPositions,
+        overLimit: overLimit
+      };
+    };
+    // Not localeCompare: this order feeds the dedup key, so it must be identical in every
+    // browser, and localeCompare is locale-dependent.
+    var byName = function byName(a, b) {
+      return a < b ? -1 : a > b ? 1 : 0;
+    };
+    // Built-ins keep their positions and additions sort after them, so a dedup key depends on
+    // which params are configured, not the order they were typed.
+    var effectiveAllowlist = function effectiveAllowlist(extras) {
+      if (extras === void 0) {
+        extras = [];
+      }
+      return ALLOWED_QUERY_PARAMS.concat(extras.filter(function (name) {
+        return !isBuiltIn(name);
+      }).sort(byName));
+    };
+    // Over-long custom values are dropped rather than truncated: two truncated values could
+    // share a dedup key and swallow a real page view.
+    var isWithinValueLimit = function isWithinValueLimit(name, value) {
+      return isBuiltIn(name) || value.length <= MAX_CUSTOM_QUERY_PARAM_VALUE_LENGTH;
+    };
+    // A prefix match is a platform name, not a configured extra, so the custom
+    // value limit does not apply. A name already on the allowlist keeps that
+    // position instead of being appended again.
+    var prefixMatchedParams = function prefixMatchedParams(href, allowlist) {
       var allParams = queryStringParser(href);
-      Object.keys(allParams).filter(function (name) {
-        return hasAllowedPrefix(name) && allParams[name];
-      }).forEach(function (name) {
-        params[name] = allParams[name];
+      return Object.keys(allParams).filter(function (name) {
+        return hasAllowedPrefix(name) && allParams[name] && allowlist.indexOf(name) === -1;
+      }).sort(byName).map(function (name) {
+        return {
+          name: name,
+          value: allParams[name]
+        };
       });
-      return params;
     };
-    var AUTO_PAGE_VIEW_ATTRIBUTE = 'is_auto_page_view';
+    var allowedQueryParams = function allowedQueryParams(href, extras) {
+      if (extras === void 0) {
+        extras = [];
+      }
+      var allowlist = effectiveAllowlist(extras);
+      var found = queryStringParser(href, allowlist);
+      var listed = allowlist.filter(function (name) {
+        return hasOwnProp(found, name);
+      }).filter(function (name) {
+        return isWithinValueLimit(name, found[name]);
+      }).map(function (name) {
+        return {
+          name: name,
+          value: found[name]
+        };
+      });
+      return listed.concat(prefixMatchedParams(href, allowlist));
+    };
+    var paramsToAttributes = function paramsToAttributes(params) {
+      var attributes = {};
+      params.forEach(function (_a) {
+        var name = _a.name,
+          value = _a.value;
+        attributes[name] = value;
+      });
+      return attributes;
+    };
     // Absent rather than false on a manual page view, so the attribute is only ever
     // added by the automatic emitters. Shared by both of them so the key and that
     // rule have one definition instead of two that can drift.
@@ -2960,33 +3038,13 @@ var mParticle = (function () {
       var _a;
       return isAutoPageView ? (_a = {}, _a[AUTO_PAGE_VIEW_ATTRIBUTE] = true, _a) : {};
     };
-    // The captured params, in allowlist order, then prefix-matched names sorted.
-    // Neither depends on the object's insertion order, so reordering the query
-    // string cannot produce a different key.
-    //
-    // Membership is an own-property check, not `in`. `in` walks the prototype
-    // chain, so a name matching an Object.prototype member reports as present on
-    // any plain object. ALLOWED_QUERY_PARAMS contains no such name, which was the
-    // only thing making `in` safe here \u2014 and it stops being a safe assumption the
-    // moment this list can be extended from configuration.
-    var capturedNames = function capturedNames(params) {
-      return ALLOWED_QUERY_PARAMS.filter(function (name) {
-        return hasOwnProp(params, name);
-      }).concat(Object.keys(params).filter(hasAllowedPrefix).sort());
-    };
-    // The dedup key: pathname plus the allowlisted params in a fixed order, so that
-    // reordering the query string is not a new page. Params outside the allowlist
-    // never make it into `page.params` and so cannot key a view \u2014 nor can the hash.
-    //
-    // Values are re-encoded because queryStringParser hands them back DECODED. A
-    // value holding the pair delimiters would otherwise serialize exactly like two
-    // separate params \u2014 `{q: 'a&search=b'}` and `{q: 'a', search: 'b'}` both becoming
-    // `q=a&search=b` \u2014 and dedup would treat a real navigation between them as the
-    // same page and drop the view. `q`, `search` and `redirect_uri` carry `&` and `=`
-    // routinely, so this is reachable rather than theoretical.
+    // Values are re-encoded because they arrive decoded: `{q: 'a&search=b'}` would otherwise
+    // key the same as `{q: 'a', search: 'b'}` and dedup a real navigation away.
     var pageKey = function pageKey(page) {
-      var query = capturedNames(page.params).map(function (name) {
-        return "".concat(name, "=").concat(encodeURIComponent(page.params[name]));
+      var query = page.params.map(function (_a) {
+        var name = _a.name,
+          value = _a.value;
+        return "".concat(name, "=").concat(encodeURIComponent(value));
       }).join('&');
       return query ? "".concat(page.path, "?").concat(query) : page.path;
     };
@@ -3011,7 +3069,7 @@ var mParticle = (function () {
         // Params spread first, then the core fields by name, so a core field always
         // wins. No allowlist entry collides with hostname/title/path today; naming
         // them here is what keeps a later addition from silently overwriting one.
-        data: __assign(__assign(__assign({}, params), {
+        data: __assign(__assign(__assign({}, paramsToAttributes(params)), {
           hostname: hostname,
           title: title,
           path: path
@@ -3090,10 +3148,10 @@ var mParticle = (function () {
         state.tracker = undefined;
       }
     };
-    var currentPage = function currentPage() {
+    var currentPage = function currentPage(extras) {
       return {
         path: window.location.pathname,
-        params: allowedQueryParams(getHref())
+        params: allowedQueryParams(getHref(), extras)
       };
     };
     // Log-safe description of a page: the path, plus the NAMES of the captured
@@ -3106,7 +3164,10 @@ var mParticle = (function () {
       if (!page) {
         return '';
       }
-      var names = capturedNames(page.params);
+      var names = page.params.map(function (_a) {
+        var name = _a.name;
+        return name;
+      });
       return names.length ? "".concat(page.path, " (params: ").concat(names.join(), ")") : page.path;
     };
     // ---------------------------------------------------------------------------
@@ -3119,6 +3180,7 @@ var mParticle = (function () {
       function PageViewTracker(mpInstance, options) {
         this.lastPage = null;
         this.active = false;
+        this.customQueryParams = [];
         this.pendingNavigations = [];
         this.undoHistoryPatch = null;
         this.mpInstance = mpInstance;
@@ -3153,7 +3215,8 @@ var mParticle = (function () {
           inheritedPages = inheritedPages.concat(this.retire(this));
         }
         this.active = true;
-        this.lastPage = currentPage();
+        this.customQueryParams = this.readCustomQueryParams();
+        this.lastPage = currentPage(this.customQueryParams);
         this.log("[init] seeded lastPage: ".concat(describePage(this.lastPage)));
         this.undoHistoryPatch = subscribeToRouteChange('pageView', function (source) {
           return _this.safeHandleNavigation(source);
@@ -3178,6 +3241,25 @@ var mParticle = (function () {
         this.active = false;
         clearActiveTracker(this);
       };
+      PageViewTracker.prototype.readCustomQueryParams = function () {
+        var _a = this.mpInstance._Store.SDKConfig.autoLogPageViewQueryParams || {},
+          _b = _a.allowed,
+          allowed = _b === void 0 ? [] : _b,
+          _c = _a.rejectedPositions,
+          rejectedPositions = _c === void 0 ? [] : _c,
+          _d = _a.overLimit,
+          overLimit = _d === void 0 ? 0 : _d;
+        if (rejectedPositions.length) {
+          this.mpInstance.Logger.warning('mParticle APV: ignoring invalid additional page view query ' + "parameters at positions ".concat(rejectedPositions.join(', ')));
+        }
+        if (overLimit) {
+          this.mpInstance.Logger.warning("mParticle APV: ignoring ".concat(overLimit, " additional page view ") + "query parameters beyond the limit of " + "".concat(MAX_CUSTOM_QUERY_PARAMS));
+        }
+        if (allowed.length) {
+          this.log("[init] additional query params: ".concat(allowed.join()));
+        }
+        return allowed;
+      };
       // Stops the outgoing tracker and returns the pages it had queued so this
       // tracker can re-schedule them once it is active. Private, but reachable
       // across instances: the handoff protocol stays internal to the class.
@@ -3219,7 +3301,7 @@ var mParticle = (function () {
         }
       };
       PageViewTracker.prototype.handleNavigation = function (source) {
-        var candidate = currentPage();
+        var candidate = currentPage(this.customQueryParams);
         var lastKey = this.lastPage ? pageKey(this.lastPage) : null;
         this.log("[detect] navigation signal (source: ".concat(source, ", candidate: ").concat(describePage(candidate), ", last: ").concat(describePage(this.lastPage), ")"));
         if (!isNewPage(lastKey, pageKey(candidate))) {
@@ -3271,11 +3353,21 @@ var mParticle = (function () {
 
     // The one rule for a URL that leaves the SDK, shared with kits through
     // `mParticle._cleanUrl`. `path` keeps scheme, host and path. `full` adds the
-    // query params an auto page view may capture, then the fragment.
+    // query params an auto page view captures by default and the campaign
+    // attribution params, then the fragment.
     var UrlMode = {
       Path: 'path',
       Full: 'full'
     };
+    // Campaign attribution and ad-network click ids. URLs keep them; an auto page view
+    // carries one as an attribute only when an input configures it.
+    var URL_ATTRIBUTION_QUERY_PARAMS = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'utm_id', 'utm_source_platform', 'utm_creative_format', 'utm_marketing_tactic', 'gad_source', 'gad_campaignid', 'mc_cid', 'gclid', 'gbraid', 'wbraid', 'fbclid', 'msclkid', 'ttclid', 'twclid', 'li_fat_id', 'dclid', 'srsltid', 'epik', 'ScCid', 'irclickid', 'rtid', 'rclid'];
+    var URL_ATTRIBUTION_QUERY_PARAMS_LOWER = URL_ATTRIBUTION_QUERY_PARAMS.map(function (name) {
+      return name.toLowerCase();
+    });
+    var isUrlQueryParam = function isUrlQueryParam(name) {
+      return isAllowedQueryParam(name) || URL_ATTRIBUTION_QUERY_PARAMS_LOWER.indexOf(name.toLowerCase()) !== -1;
+    };
     // OAuth 2.0 / OIDC authorization-flow params. They stay off URLs even where the
     // page view allowlist admits them, because a URL travels on every event.
     var EXCLUDED_URL_QUERY_PARAMS = ['client_id', 'redirect_uri', 'response_type', 'scope', 'state', 'code', 'nonce'];
@@ -3297,7 +3389,7 @@ var mParticle = (function () {
         return null;
       }
       var lowerName = name.toLowerCase();
-      if (!name || !isAllowedQueryParam(name) || EXCLUDED_URL_QUERY_PARAMS.indexOf(lowerName) !== -1) {
+      if (!name || !isUrlQueryParam(name) || EXCLUDED_URL_QUERY_PARAMS.indexOf(lowerName) !== -1) {
         return null;
       }
       if (separator === -1 || URL_VALUED_QUERY_PARAMS.indexOf(lowerName) === -1) {
@@ -3745,7 +3837,7 @@ var mParticle = (function () {
         var event = {
           AppName: SDKConfig.appName,
           AppVersion: SDKConfig.appVersion,
-          Package: SDKConfig["package"],
+          Package: SDKConfig.package,
           EventDataType: MessageType$1.AppStateTransition,
           Timestamp: now,
           SessionId: sessionId,
@@ -3976,7 +4068,7 @@ var mParticle = (function () {
                 });
                 batchesToUpload.forEach(function (batch) {
                   if (retriedIds.indexOf(batch.source_request_id) === -1) {
-                    _this_1.batchOrder["delete"](batch.source_request_id);
+                    _this_1.batchOrder.delete(batch.source_request_id);
                   }
                 });
                 // Batches that do not successfully upload are added back to the process queue
@@ -4003,7 +4095,6 @@ var mParticle = (function () {
           });
         });
       };
-
       BatchUploader.prototype.storeBatchesQueuedForProcessing = function () {
         var _this_1 = this;
         var _a;
@@ -4271,7 +4362,6 @@ var mParticle = (function () {
                 logger.error('search called without a callback function; skipping request.');
                 return [2 /*return*/];
               }
-
               safeInvoke = function safeInvoke(result) {
                 try {
                   callback(result);
@@ -4301,7 +4391,6 @@ var mParticle = (function () {
                 });
                 return [2 /*return*/];
               }
-
               _a.label = 1;
             case 1:
               _a.trys.push([1, 9,, 10]);
@@ -4604,7 +4693,7 @@ var mParticle = (function () {
           sdk_version: Constants.sdkVersion
         },
         environment: environment,
-        request_id: generateUniqueId(),
+        request_id: _generateUniqueId(),
         request_timestamp_ms: Date.now()
       };
     };
@@ -5058,7 +5147,7 @@ var mParticle = (function () {
       this.decoded = decoded;
       this.parseStringOrNumber = parseStringOrNumber;
       this.generateHash = generateHash;
-      this.generateUniqueId = generateUniqueId;
+      this.generateUniqueId = _generateUniqueId;
       // Imported Validators
       this.Validators = Validators;
     }
@@ -6144,6 +6233,7 @@ var mParticle = (function () {
           this.SDKConfig.flags = {};
         }
         this.SDKConfig.flags = processFlags(config);
+        this.SDKConfig.autoLogPageViewQueryParams = parseQueryParamAllowlist(config.autoLogPageViewQueryParams);
         if (config.deviceId) {
           this.deviceId = config.deviceId;
         }
@@ -6178,7 +6268,7 @@ var mParticle = (function () {
           this.SDKConfig.appName = config.appName;
         }
         if (config.hasOwnProperty('package')) {
-          this.SDKConfig["package"] = config["package"];
+          this.SDKConfig.package = config.package;
         }
         if (config.hasOwnProperty('integrationDelayTimeout')) {
           this.SDKConfig.integrationDelayTimeout = config.integrationDelayTimeout;
@@ -6420,6 +6510,9 @@ var mParticle = (function () {
         if (config.flags) {
           _this.SDKConfig.flags = processFlags(config);
         }
+        // Stored whole: the tracker reports the rejections, and cannot recover them by
+        // re-parsing a list that has already had them removed.
+        _this.SDKConfig.autoLogPageViewQueryParams = parseQueryParamAllowlist(config.autoLogPageViewQueryParams);
         var baseUrls = processBaseUrls(config, _this.SDKConfig.flags, apiKey);
         for (var baseUrlKeys in baseUrls) {
           _this.SDKConfig[baseUrlKeys] = baseUrls[baseUrlKeys];
@@ -7438,13 +7531,13 @@ var mParticle = (function () {
       };
       // The auto page view for the landing page. The SPA navigations that follow it
       // come from PageViewTracker instead, so both emitters attach the same
-      // allowlisted query params \u2014 and this is the one that matters for campaign
-      // attribution, since utm_*/gclid live on the entry URL.
+      // allowlisted query params.
       this.logPageView = function (options) {
+        var _a;
         self.logEvent({
           messageType: Types.MessageType.PageView,
           name: 'PageView',
-          data: __assign(__assign(__assign({}, allowedQueryParams(getHref())), {
+          data: __assign(__assign(__assign({}, paramsToAttributes(allowedQueryParams(getHref(), (_a = mpInstance._Store.SDKConfig.autoLogPageViewQueryParams) === null || _a === void 0 ? void 0 : _a.allowed))), {
             hostname: window.location.hostname,
             title: window.document.title
           }), autoPageViewAttribute(options && options.isAutoPageView)),
@@ -7738,6 +7831,19 @@ var mParticle = (function () {
       }
       return false;
     }
+    // sendEventToForwarders passes no kitBlocker: apiClient has already applied
+    // the data plan by then.
+    function isEventForwarded(event, forwarder, kitBlocker) {
+      var plannedEvent = kitBlocker && kitBlocker.kitBlockingEnabled ? kitBlocker.createBlockedEvent(event) : event;
+      if (!plannedEvent) {
+        return false;
+      }
+      if (isBlockedByForwardingRule(plannedEvent.EventDataType, plannedEvent.EventAttributes, forwarder)) {
+        return false;
+      }
+      var eventCategory = plannedEvent.EventCategory;
+      return !isBlockedByEventFilter(plannedEvent.EventDataType, KitFilterHelper.hashEventName(plannedEvent.EventName, eventCategory), KitFilterHelper.hashEventType(eventCategory), forwarder);
+    }
     function filterEventAttributes(messageType, eventCategory, eventName, attributes, forwarder) {
       if (!attributes) {
         return attributes;
@@ -7888,17 +7994,12 @@ var mParticle = (function () {
         if (mpInstance._Store.webviewBridgeEnabled || !mpInstance._Store.activeForwarders) {
           return;
         }
-        var hashedEventName = KitFilterHelper.hashEventName(event.EventName, event.EventCategory);
-        var hashedEventType = KitFilterHelper.hashEventType(event.EventCategory);
         var forwardEvent = function forwardEvent(forwarder) {
-          if (isBlockedByForwardingRule(event.EventDataType, event.EventAttributes, forwarder)) {
+          if (!isEventForwarded(event, forwarder)) {
             return;
           }
           // Clone the event object, as we could be sending different attributes to each forwarder
           var clonedEvent = extend(true, {}, event);
-          if (isBlockedByEventFilter(event.EventDataType, hashedEventName, hashedEventType, forwarder)) {
-            return;
-          }
           clonedEvent.EventAttributes = filterEventAttributes(event.EventDataType, event.EventCategory, event.EventName, clonedEvent.EventAttributes, forwarder);
           // Check user identity filtering rules
           clonedEvent.UserIdentities = filterUserIdentities(clonedEvent.UserIdentities, forwarder.userIdentityFilters);
@@ -8346,7 +8447,7 @@ var mParticle = (function () {
             ExpandedEventCount: 0,
             AppVersion: mpInstance.getAppVersion(),
             AppName: mpInstance.getAppName(),
-            Package: mpInstance._Store.SDKConfig["package"],
+            Package: mpInstance._Store.SDKConfig.package,
             ClientGeneratedId: mpInstance._Store.clientId,
             DeviceId: mpInstance._Store.deviceId,
             IntegrationAttributes: integrationAttributes,
@@ -8575,7 +8676,6 @@ var mParticle = (function () {
           });
         });
       };
-
       return AudienceManager;
     }();
 
@@ -10614,7 +10714,6 @@ var mParticle = (function () {
           });
         });
       };
-
       this.sendIdentityRequest = function (identityApiRequest, method, callback, originalIdentityApiData, parseIdentityResponse, mpid, knownIdentities) {
         var _a, _b, _c, _d;
         return __awaiter(this, void 0, void 0, function () {
@@ -10634,13 +10733,11 @@ var mParticle = (function () {
                   Logger.error(Messages$1.ErrorMessages.APIRequestEmpty);
                   return [2 /*return*/];
                 }
-
                 Logger.verbose(Messages$1.InformationMessages.SendIdentityHttp);
                 if (mpInstance._Store.identityCallInFlight) {
                   invokeCallback(callback, HTTPCodes$1.activeIdentityRequest, 'There is currently an Identity request processing. Please wait for this to return before requesting again');
                   return [2 /*return*/];
                 }
-
                 previousMPID = mpid || null;
                 uploadUrl = this.getUploadUrl(method, mpid);
                 uploader = window.fetch ? new FetchUploader(uploadUrl) : new XHRUploader(uploadUrl);
@@ -10698,7 +10795,7 @@ var mParticle = (function () {
                   responseToLog = responseText;
                   if (!isDevelopmentMode && (responseText === null || responseText === void 0 ? void 0 : responseText.matched_identities)) {
                     responseToLog = __assign(__assign({}, responseText), {
-                      matched_identities: obfuscateData(responseText.matched_identities)
+                      matched_identities: _obfuscateData(responseText.matched_identities)
                     });
                   }
                   message = 'Received Identity Response from server: ' + JSON.stringify(responseToLog);
@@ -10753,7 +10850,6 @@ var mParticle = (function () {
           });
         });
       };
-
       this.getUploadUrl = function (method, mpid) {
         var uploadServiceUrl = mpInstance._Helpers.createServiceUrl(mpInstance._Store.SDKConfig.identityUrl);
         var uploadUrl = method === Modify ? uploadServiceUrl + mpid + '/' + method : uploadServiceUrl + method;
@@ -10778,7 +10874,8 @@ var mParticle = (function () {
     }
 
     var PASSBACK_CONVERSION_TRACKING_ID = 'passbackconversiontrackingid';
-    var CHECKOUT_INTENT_BUFFER_LIMIT = 4;
+    // One signal per kind (commit, wallet, checkout_step, frame and cart), so a new kind never evicts another.
+    var CHECKOUT_INTENT_BUFFER_LIMIT = 5;
     var CHECKOUT_INTENT_MAX_AGE_MS = 30000;
     var ON_SHOPPABLE_ADS_READY_METHOD = 'onShoppableAdsReady';
     // The purpose of this class is to create a link between the Core mParticle SDK and the
@@ -10807,6 +10904,8 @@ var mParticle = (function () {
         this.stopRouteChangeWatch = null;
         // Checkout intent raised before the kit attached: latest per kind.
         this.pendingCheckoutIntents = [];
+        // Off until SDK init finds the Rokt connection receives auto button clicks.
+        this.autoButtonClicksForwarded = false;
       }
       /**
        * Sets a callback to be invoked when RoktManager becomes ready
@@ -10933,12 +11032,16 @@ var mParticle = (function () {
           (_c = this.logger) === null || _c === void 0 ? void 0 : _c.error("RoktManager: Error in onRouteChange: ".concat(getErrorMessage(e)));
         }
       };
+      RoktManager.prototype.setAutoButtonClicksForwarded = function (forwarded) {
+        this.autoButtonClicksForwarded = forwarded;
+      };
       // Checkout intent is off unless the flag is on, and under opt-out, any Rokt
-      // privacy launcher option, or Global Privacy Control.
+      // privacy launcher option, Global Privacy Control, or a Rokt connection that
+      // does not receive auto button clicks.
       RoktManager.prototype.isCheckoutIntentSuppressed = function () {
         var _a, _b;
         var flags = (_b = (_a = this.store) === null || _a === void 0 ? void 0 : _a.SDKConfig) === null || _b === void 0 ? void 0 : _b.flags;
-        if (!flags || flags[Constants.FeatureFlags.AutoButtonTracking] !== true || !this.store.isEnabled) {
+        if (!flags || flags[Constants.FeatureFlags.AutoButtonTracking] !== true || !this.store.isEnabled || !this.autoButtonClicksForwarded) {
           return true;
         }
         var options = this.launcherOptions || {};
@@ -11006,6 +11109,8 @@ var mParticle = (function () {
           return _this.notifyCheckoutIntent(signal);
         });
       };
+      // The Rokt kit reads this to tell core's page views, whose title and utm
+      // attributes a filter may have removed, from ones logged by hand.
       RoktManager.prototype.isAutoLogPageViewEnabled = function () {
         var _a, _b, _c;
         return ((_c = (_b = (_a = this.store) === null || _a === void 0 ? void 0 : _a.SDKConfig) === null || _b === void 0 ? void 0 : _b.flags) === null || _c === void 0 ? void 0 : _c[Constants.FeatureFlags.AutoLogPageView]) === true;
@@ -11153,7 +11258,6 @@ var mParticle = (function () {
           });
         });
       };
-
       RoktManager.prototype.logFilteredIdentity = function (identityType) {
         var _a;
         (_a = this.logger) === null || _a === void 0 ? void 0 : _a.verbose("mParticle.Rokt selectPlacements did not add the ".concat(identityType, " user identity to the attributes because the Rokt connection does not allow it"));
@@ -11223,7 +11327,6 @@ var mParticle = (function () {
           });
         });
       };
-
       RoktManager.prototype.setExtensionData = function (extensionData) {
         if (!this.isReady()) {
           this.deferredCall('setExtensionData', extensionData);
@@ -11272,12 +11375,10 @@ var mParticle = (function () {
                   (_a = this.logger) === null || _a === void 0 ? void 0 : _a.verbose('mParticle.Rokt.terminate called before the Rokt kit was ready. Nothing to terminate.');
                   return [2 /*return*/];
                 }
-
                 if (!isFunction(this.kit.terminate)) {
                   (_b = this.logger) === null || _b === void 0 ? void 0 : _b.error('mParticle.Rokt.terminate is not supported by the attached Rokt Kit version.');
                   return [2 /*return*/];
                 }
-
                 _d.label = 1;
               case 1:
                 _d.trys.push([1, 3,, 4]);
@@ -11295,7 +11396,6 @@ var mParticle = (function () {
           });
         });
       };
-
       RoktManager.prototype.onShoppableAdsReady = function (callback) {
         if (!this.kit || !this.isShoppableAdsLoaded) {
           this.deferredCall('onShoppableAdsReady', callback);
@@ -11318,7 +11418,7 @@ var mParticle = (function () {
             } catch (e) {
               (_a = _this.logger) === null || _a === void 0 ? void 0 : _a.error('RoktManager: Error flushing onShoppableAdsReady: ' + e);
             }
-            _this.messageQueue["delete"](key);
+            _this.messageQueue.delete(key);
           }
         });
         this.isShoppableAdsLoaded = true;
@@ -11357,7 +11457,6 @@ var mParticle = (function () {
           });
         });
       };
-
       RoktManager.prototype.getLocalSessionAttributes = function () {
         return this.store.getLocalSessionAttributes();
       };
@@ -11463,7 +11562,7 @@ var mParticle = (function () {
               if (resolve) {
                 resolve(resolvedResult);
               }
-            })["catch"](handleError);
+            }).catch(handleError);
           } catch (error) {
             handleError(error);
           }
@@ -11475,7 +11574,7 @@ var mParticle = (function () {
       RoktManager.prototype.deferredCall = function (methodName, payload) {
         var _this = this;
         return new Promise(function (resolve, reject) {
-          var messageId = "".concat(methodName, "_").concat(generateUniqueId());
+          var messageId = "".concat(methodName, "_").concat(_generateUniqueId());
           _this.queueMessage({
             messageId: messageId,
             methodName: methodName,
@@ -11538,14 +11637,11 @@ var mParticle = (function () {
         if (!currentValue) {
           return true; // New value exists but no current value
         }
-
         if (currentValue !== newValue) {
           return true; // Values are different
         }
-
         return false; // Values are the same
       };
-
       return RoktManager;
     }();
 
@@ -11679,23 +11775,71 @@ var mParticle = (function () {
         eventType: EventType.Other
       };
     };
+    // Every attribute buildButtonClickEvent can set apart from the marker and the
+    // hostname, which is the same on every click on this page. A spec checks the
+    // two stay in step.
+    var CLICK_ATTRIBUTES = ['label_source', 'element', 'type', 'path', 'label', 'aria_label', 'icon', 'element_id', 'element_name', 'test_id', 'controls', 'form', 'link_type', 'link_domain', 'file_extension', 'checked'];
+    // Which check keeps some or all auto button clicks from a kit, or undefined
+    // when the kit receives every one. A forwarding rule on an attribute whose
+    // value differs between clicks lets some through and not others. Each other
+    // check goes through isEventForwarded on its own, so together they decide as
+    // it does for each click.
+    var getButtonClickBlocker = function getButtonClickBlocker(forwarder, kitBlocker) {
+      var _a;
+      var rule = forwarder.filteringEventAttributeValue;
+      if (rule && rule.eventAttributeValue && CLICK_ATTRIBUTES.some(function (name) {
+        return KitFilterHelper.hashAttributeConditionalForwarding(name) === rule.eventAttributeName;
+      })) {
+        return 'forwarding rule';
+      }
+      var click = {
+        EventName: BUTTON_CLICK_EVENT_NAME,
+        EventCategory: EventType.Other,
+        EventDataType: MessageType$1.PageEvent,
+        EventAttributes: (_a = {}, _a[AUTO_BUTTON_ATTRIBUTE] = true, _a.hostname = window.location.hostname, _a)
+      };
+      var checks = [['data plan', {}], ['forwarding rule', {
+        filteringEventAttributeValue: rule
+      }], ['event name filter', {
+        eventNameFilters: forwarder.eventNameFilters
+      }], ['event type filter', {
+        eventTypeFilters: forwarder.eventTypeFilters
+      }]];
+      var failed = checks.find(function (_a) {
+        var filters = _a[1];
+        return !isEventForwarded(click, filters, kitBlocker);
+      });
+      return failed ? failed[0] : undefined;
+    };
 
     // Finds the control a click landed on, for both checkout intent and button
     // descriptions. Rokt's own elements, disabled controls and anything under
     // data-mp-no-track are never returned.
     var CONTROL_SELECTOR = 'button, input[type="submit"], input[type="button"], input[type="image"], [role="button"]';
-    // closest() over the composed tree: slots, parents, then shadow hosts.
-    function hasComposedAncestor(element, selector) {
+    var EDITABLE = '[contenteditable]:not([contenteditable="false"])';
+    // One step up the composed tree: the slot, the parent, then the shadow host.
+    function composedParent(node) {
+      var root = isFunction(node.getRootNode) ? node.getRootNode() : null;
+      return node.assignedSlot || node.parentElement || root && root.host || null;
+    }
+    // Tests the element and its ancestors over the composed tree: slots, parents,
+    // then shadow hosts. With `until`, stops before reaching that ancestor.
+    function someComposedAncestor(element, test, until) {
       var node = element;
-      while (node) {
-        if (node.matches(selector)) {
+      while (node && node !== until) {
+        if (test(node)) {
           return true;
         }
-        var root = isFunction(node.getRootNode) ? node.getRootNode() : null;
-        node = node.assignedSlot || node.parentElement || root && root.host || null;
+        node = composedParent(node);
       }
       return false;
     }
+    // closest() over the composed tree, starting at the element itself.
+    function hasComposedAncestor(element, selector) {
+      return someComposedAncestor(element, function (node) {
+        return node.matches(selector);
+      });
+    }
     var ROKT_SELECTOR = '[data-core-type], #rokt-controller-frame';
     // A Rokt frame or script is served from a /wsdk/ path.
     function hasRoktSrc(element) {
@@ -11741,8 +11885,27 @@ var mParticle = (function () {
       }
       return host.matches(CARD_FORM_BUTTON) ? 'checkout_step' : 'wallet';
     }
+    // A merchant-built wallet button that names its wallet in an id or test id, such
+    // as `venmo-pay-btn` or `applePayButton`. The name must also say button and not
+    // name a part or a wrapper of one, so a wallet's logo, label or container never
+    // counts, nor a button that only chooses a wallet. Affirm is also an English
+    // verb, so it counts only beside a payment word. Only the element's own
+    // attributes are read.
+    var WALLET_IN_NAME = /(?:^| )(?:apple ?pay|google ?pay|g ?pay|amazon ?pay|cash ?app|venmo|pay ?pal|shop ?pay|klarna|after ?pay|clear ?pay|sezzle|samsung ?pay)(?= |$)/;
+    var AFFIRM_IN_NAME = /(?:^| )affirm(?= |$)/;
+    var PAYMENT_IN_NAME = /(?:^| )(?:pay|payment|checkout)(?= |$)/;
+    var BUTTON_IN_NAME = /(?:^| )(?:btn|button)(?= |$)/;
+    var PART_IN_NAME = /(?:^| )(?:logo|icon|image|img|label|text|caption|message|messaging|info|tooltip|help|learn|terms|promo|banner|container|wrapper|wrap|placeholder|form|section|panel|modal|list|group|select|option|tab|toggle|radio|choice|method)(?= |$)/;
+    function nameWords(value) {
+      return (value || '').slice(0, 64).replace(/([a-z0-9])([A-Z])/g, '$1 $2').replace(/[^A-Za-z0-9]+/g, ' ').trim().toLowerCase();
+    }
+    function isWalletNamed(element) {
+      return [element.getAttribute('id'), element.getAttribute('data-testid')].map(nameWords).some(function (words) {
+        return (WALLET_IN_NAME.test(words) || AFFIRM_IN_NAME.test(words) && PAYMENT_IN_NAME.test(words)) && BUTTON_IN_NAME.test(words) && !PART_IN_NAME.test(words);
+      });
+    }
     function isWalletElement(element) {
-      return vendorButtonKind(element) === 'wallet';
+      return vendorButtonKind(element) === 'wallet' || isWalletNamedControl(element);
     }
     // Pickers and toggles choose a payment method or open a panel; they never pay.
     var PICKER = 'input[type="radio"], input[type="checkbox"], label, [role="radio"], [role="tab"], [role="option"], ' + '[role="checkbox"], [role="switch"], [role="menuitemradio"], [role="menuitemcheckbox"], [aria-checked], [aria-selected]';
@@ -11750,25 +11913,53 @@ var mParticle = (function () {
     // Pay-later and financing messages link to details rather than pay.
     var MESSAGING = 'klarna-placement, afterpay-placement, square-placement, .affirm-as-low-as, .affirm-site-modal, ' + '.affirm-product-modal, [data-pp-message]';
     // A control that is still logged as a click but never counts as checkout intent.
-    function isQuietIntentControl(control, isVendorWallet) {
+    // A cart button can open a flyout, so aria-expanded alone never quiets one.
+    function isQuietIntentControl(control, isVendorWallet, isCart) {
+      if (isCart === void 0) {
+        isCart = false;
+      }
       if (control.matches(PICKER)) {
         return true;
       }
       if (hasComposedAncestor(control, PICKER_GROUP)) {
         return true;
       }
-      if (!isVendorWallet && (control.hasAttribute('aria-expanded') || control.hasAttribute('aria-pressed'))) {
+      if (!isVendorWallet && (!isCart && control.hasAttribute('aria-expanded') || control.hasAttribute('aria-pressed'))) {
         return true;
       }
       return hasComposedAncestor(control, MESSAGING);
     }
     // A checkbox or radio is a control of its own only when no button or link
-    // around it takes the click, so a tappable row keeps its own name.
+    // around it takes the click, so a tappable row stays the control.
     var OPTION_INPUT = 'input[type="checkbox"], input[type="radio"]';
-    // Walks at most 12 entries of an event's composed path for the nearest control.
-    // One composed walk from the target rules out Rokt elements and anything under
-    // data-mp-no-track; disabled controls are skipped.
-    function findControl(path) {
+    // Anything that chooses, toggles or takes typing. One between a click's target
+    // and a wallet-named element, or inside that element, keeps it from becoming
+    // the tap. Hidden inputs and button-like inputs are not fields.
+    var NAME_BARRIER = PICKER + ', ' + PICKER_GROUP + ', input:not([type="hidden"]):not([type="submit"]):not([type="button"]):not([type="image"]), ' + 'select, textarea, option, optgroup, datalist, [aria-expanded], [aria-pressed], ' + EDITABLE;
+    // What owns a click on anything inside it: a picker, a real control or link,
+    // a toggle, or an editable region.
+    var NAME_HOLDER = PICKER + ', ' + CONTROL_SELECTOR + ', a[href], ' + VENDOR_BUTTON + ', [aria-expanded], [aria-pressed], ' + EDITABLE;
+    // A wallet-named element that may stand as a control by its name alone: not
+    // itself a picker, toggle or form field; not inside a picker, a real button or
+    // link, a toggle, an editable region or another wallet-named element, which own
+    // the click with their own state; and holding no picker or field, in its open
+    // shadow root either, so a payment-method row with its own radio or select
+    // never becomes a wallet tap.
+    function isWalletNamedControl(element) {
+      if (!isWalletNamed(element) || element.matches(NAME_BARRIER)) {
+        return false;
+      }
+      for (var node = composedParent(element); node; node = composedParent(node)) {
+        if (node.matches(NAME_HOLDER) || isWalletNamed(node)) {
+          return false;
+        }
+      }
+      var shadow = element.shadowRoot;
+      return !element.querySelector(NAME_BARRIER) && !(shadow && shadow.querySelector(NAME_BARRIER));
+    }
+    // Whether a click is never tracked: it has no element, or lands on a Rokt
+    // element or under data-mp-no-track. Reads at most 12 entries of the path.
+    function isExcludedPath(path) {
       var entries = path.slice(0, 12);
       var first;
       for (var _i = 0, entries_1 = entries; _i < entries_1.length; _i++) {
@@ -11779,41 +11970,60 @@ var mParticle = (function () {
         }
       }
       if (!first || hasComposedAncestor(first, ROKT_SELECTOR + ', [data-mp-no-track]')) {
+        return true;
+      }
+      for (var _a = 0, entries_2 = entries; _a < entries_2.length; _a++) {
+        var target = entries_2[_a];
+        if (target instanceof Element && hasRoktSrc(target)) {
+          return true;
+        }
+      }
+      return false;
+    }
+    // Walks at most 12 entries of an event's composed path for the nearest control.
+    // A wallet-named element counts as one unless a picker, toggle or form field
+    // lies between it and the target or a picker holds it, so choosing an option in
+    // or around it never becomes its tap. Excluded clicks give nothing; disabled controls are skipped, a
+    // wallet-named one also by its `disabled` class. A caller that has already
+    // found the path not excluded passes `included` so the walk runs once.
+    function findControl(path, included) {
+      if (included === void 0) {
+        included = false;
+      }
+      if (!included && isExcludedPath(path)) {
         return undefined;
       }
       var control;
       var option;
-      for (var _a = 0, entries_2 = entries; _a < entries_2.length; _a++) {
-        var target = entries_2[_a];
+      var picked = false;
+      for (var _i = 0, _a = path.slice(0, 12); _i < _a.length; _i++) {
+        var target = _a[_i];
+        if (control) {
+          break;
+        }
         if (!(target instanceof Element)) {
           continue;
         }
-        if (hasRoktSrc(target)) {
-          return undefined;
-        }
-        if (!control && target.matches(CONTROL_SELECTOR + ', a[href], ' + VENDOR_BUTTON)) {
+        if (target.matches(CONTROL_SELECTOR + ', a[href], ' + VENDOR_BUTTON) || !picked && isWalletNamedControl(target)) {
           control = target;
-        } else if (!control && !option && target.matches(OPTION_INPUT)) {
-          option = target;
+        } else {
+          if (!option && target.matches(OPTION_INPUT)) {
+            option = target;
+          }
+          picked = picked || target.matches(NAME_BARRIER);
         }
       }
       control = control || option;
-      if (!control || control.matches(':disabled, [aria-disabled="true"]')) {
+      if (!control || control.matches(':disabled, [aria-disabled="true"]') || control.classList.contains('disabled') && isWalletNamed(control)) {
         return undefined;
       }
       return control;
     }
-    var EDITABLE = '[contenteditable]:not([contenteditable="false"])';
     // Text that may hold what a shopper typed or what the page opted out: form
     // fields, editable regions, and anything under data-mp-no-track.
     function isUnsafeTextSource(element) {
       return element.matches('input, select, textarea, option, optgroup, datalist, ' + EDITABLE) || !!element.querySelector('input, select, textarea, [data-mp-no-track], ' + EDITABLE) || hasComposedAncestor(element, 'select, datalist, textarea, [data-mp-no-track], ' + EDITABLE);
     }
-    // A label around a checkbox or radio holds no typed text, so only the other
-    // fields rule its text out.
-    function isUnsafeLabelSource(label) {
-      return !!label.querySelector('input:not([type="checkbox"]):not([type="radio"]), select, textarea, [data-mp-no-track], ' + EDITABLE) || hasComposedAncestor(label, 'select, datalist, textarea, [data-mp-no-track], ' + EDITABLE);
-    }
 
     // Masks a button label before it is logged. Button text can carry personal data,
     // so this is the privacy boundary for every label and aria-label.
@@ -11830,10 +12040,12 @@ var mParticle = (function () {
       }
     }
     var digitPatterns = createDigitPatterns();
+    // Longer raw labels are dropped, not cut short.
+    var MAX_RAW_LABEL_LENGTH = 128;
     // The label as logged: lower case, at most 64 characters, digits and amounts
     // masked. Dropped when it looks like an email, phone or card number.
     function maskLabel(raw) {
-      if (!raw || raw.length > 128 || !digitPatterns) {
+      if (!raw || raw.length > MAX_RAW_LABEL_LENGTH || !digitPatterns) {
         return undefined;
       }
       var text = raw.replace(/\s+/g, ' ').trim().toLowerCase();
@@ -11855,24 +12067,139 @@ var mParticle = (function () {
       }
       return control.matches('a[href]:not([role="button"])') ? 'link' : 'role';
     }
+    var NOT_RENDERED = 'script, style, template, [hidden], [aria-hidden="true"], [inert]';
+    // The most nodes read for one label source, and images looked at for one
+    // button. Each costs a style lookup in the click handler.
+    var MAX_READS = 64;
+    function assignedNodes(element) {
+      var slot = element;
+      return isFunction(slot.assignedNodes) ? slot.assignedNodes() : [];
+    }
+    // Left out of what is drawn by its parent: a light child of an open shadow host
+    // that no slot takes, or a slot's own child while nodes are assigned to the
+    // slot. A closed shadow root can't be seen, so its host's children count.
+    function isUnslotted(node) {
+      var parent = node.parentElement;
+      if (!parent) {
+        return false;
+      }
+      return parent.shadowRoot ? !node.assignedSlot : assignedNodes(parent).length > 0;
+    }
+    // Hides the element and all it holds, whatever their own style says.
+    // Screen-reader-only text is clipped rather than hidden, so it is not. An SVG
+    // title is never drawn but names its icon, so it is not either.
+    function hidesSubtree(element) {
+      if (element.matches(NOT_RENDERED) || isUnslotted(element)) {
+        return true;
+      }
+      return !(element instanceof SVGTitleElement) && window.getComputedStyle(element).display === 'none';
+    }
+    // Visibility is inherited and a child can set it back to visible, so only the
+    // element's own counts.
+    function isVisible(element) {
+      var visibility = window.getComputedStyle(element).visibility;
+      return visibility !== 'hidden' && visibility !== 'collapse';
+    }
+    function isShown(element, until) {
+      return !someComposedAncestor(element, hidesSubtree, until);
+    }
+    // A shadow host shows a light child only through a slot, and only while
+    // nothing from that slot up to the host hides it.
+    function isShownThroughSlot(node, host) {
+      var slot = node.assignedSlot;
+      return !!slot && isShown(slot, host);
+    }
+    // Whitespace hides nothing, so a node holding only whitespace is taken as it
+    // is, without a style lookup: an icon's paths cost nothing. A slot's text can
+    // sit in the nodes assigned to it, so a slot is never blank.
+    function isBlank(node) {
+      return !/\S/.test(node.textContent || '') && !(node instanceof Element && (node.matches('slot') || !!node.querySelector('slot')));
+    }
+    // The text a sighted user or a screen reader gets from an element, whitespace
+    // collapsed. Undefined when that runs past what maskLabel keeps, takes more
+    // than MAX_READS nodes to read, or takes in a form field through a slot, so a
+    // label is never cut short at a node boundary.
+    function renderedText(root) {
+      var text = '';
+      var reads = 0;
+      var append = function append(value) {
+        text = (text + value).replace(/\s+/g, ' ');
+      };
+      var _read = function read(element) {
+        if (hidesSubtree(element)) {
+          return true;
+        }
+        var assigned = assignedNodes(element);
+        var nodes = assigned.length ? assigned : element.childNodes;
+        for (var i = 0; i < nodes.length; i++) {
+          var node = nodes[i];
+          var isText = node.nodeType === Node.TEXT_NODE;
+          if (!isText && !(node instanceof Element)) {
+            continue;
+          }
+          if (isBlank(node)) {
+            append(node.textContent);
+            continue;
+          }
+          if (++reads > MAX_READS) {
+            return false;
+          }
+          if (element.shadowRoot && !isShownThroughSlot(node, element)) {
+            continue;
+          }
+          if (isText) {
+            if (isVisible(node.assignedSlot || element)) {
+              append(node.nodeValue);
+            }
+          } else if (
+          // Assigned nodes sit outside the label source, where its own
+          // form field check never looked.
+          assigned.length && isUnsafeTextSource(node) || !_read(node)) {
+            return false;
+          }
+          if (text.trim().length > MAX_RAW_LABEL_LENGTH) {
+            return false;
+          }
+        }
+        return true;
+      };
+      return _read(root) ? text.trim() : undefined;
+    }
+    // '' when the element can't name the button, undefined when its text can't be
+    // read in full.
     function textOf(element) {
-      return element && !isUnsafeTextSource(element) && element.textContent ? element.textContent.trim() : '';
+      return element && !isUnsafeTextSource(element) && isShown(element) ? renderedText(element) : '';
+    }
+    // The control itself is already known to be shown.
+    function shownImageAlt(control) {
+      var images = control.querySelectorAll('img[alt]');
+      for (var i = 0; i < images.length && i < MAX_READS; i++) {
+        if (isShown(images[i], control) && isVisible(images[i])) {
+          return nonBlank(images[i].getAttribute('alt'));
+        }
+      }
+      return undefined;
     }
     function nonBlank(value) {
       return value && value.trim() ? value : undefined;
     }
     // The button's name as a screen reader would read it, simplified: the first of
-    // aria-labelledby, aria-label, own text (or an inner image's alt), title, for
-    // inputs their value, and for checkboxes and radios their label's text. The text
-    // sources are skipped for controls that hold form fields or more than four
-    // children, so a typed value is never read.
+    // aria-labelledby, aria-label, own text (or an inner image's alt), title, and
+    // for inputs their value. The text sources are skipped for controls that hold
+    // form fields or more than four children, so a typed value is never read.
     function accessibleName(control) {
       var labelledBy = control.getAttribute('aria-labelledby');
       if (labelledBy) {
         var root_1 = isFunction(control.getRootNode) ? control.getRootNode() : document;
-        var text = labelledBy.split(/\s+/).map(function (id) {
+        var parts = labelledBy.split(/\s+/).map(function (id) {
           return textOf(root_1.getElementById ? root_1.getElementById(id) : null);
-        }).filter(function (part) {
+        });
+        if (parts.indexOf(undefined) !== -1) {
+          return {
+            source: 'none'
+          };
+        }
+        var text = parts.filter(function (part) {
           return !!part;
         }).join(' ');
         if (text) {
@@ -11916,27 +12243,21 @@ var mParticle = (function () {
               source: 'value'
             };
           }
-        } else if (type === 'checkbox' || type === 'radio') {
-          // The label the browser ties to the box, never the box's value.
-          var label = control.labels ? control.labels[0] : undefined;
-          var text = label && !isUnsafeLabelSource(label) && label.textContent ? label.textContent.trim() : '';
-          if (text) {
-            return {
-              raw: text,
-              source: 'label'
-            };
-          }
         }
-      } else if (readable) {
-        var text = textOf(control);
+      } else if (readable && isShown(control)) {
+        var text = renderedText(control);
+        if (text === undefined) {
+          return {
+            source: 'none'
+          };
+        }
         if (text) {
           return {
             raw: text,
             source: 'text'
           };
         }
-        var image = control.querySelector('img[alt]');
-        var alt = image ? nonBlank(image.getAttribute('alt')) : undefined;
+        var alt = shownImageAlt(control);
         if (alt) {
           return {
             raw: alt,
@@ -12034,9 +12355,12 @@ var mParticle = (function () {
       return form ? stableIdentifier(form.getAttribute('id')) : undefined;
     }
     // The browser's normalised type: a button defaults to 'submit' and an unknown
-    // input type reads as 'text'. Wallet and role buttons are just 'button'.
-    function controlType(control, element) {
-      return element === 'button' || element === 'input' ? control.type : 'button';
+    // input type reads as 'text'. A native button or input reports its own type, a
+    // wallet-named one included; any other control, such as a role button or a
+    // vendor's wallet element, reads as 'button'.
+    function controlType(control) {
+      var tag = control.tagName.toLowerCase();
+      return tag === 'button' || tag === 'input' ? control.type : 'button';
     }
     // Reads the link's own resolved URL parts, never its full href: only the hostname of
     // a link that leaves the site and the extension of a file it downloads travel. Navigation
@@ -12079,9 +12403,38 @@ var mParticle = (function () {
         type: 'same_page'
       } : undefined;
     }
+    // Checkboxes and radios, and the roles that act as them. A role can list
+    // fallbacks, so any of its tokens counts.
+    var CHOICE = 'input[type="checkbox"], input[type="radio"], [role~="checkbox"], [role~="radio"], ' + '[role~="switch"], [role~="menuitemcheckbox"], [role~="menuitemradio"]';
+    var RADIO_ROLE = '[role~="radio"], [role~="menuitemradio"]';
+    function boxOf(element) {
+      var box = element instanceof HTMLLabelElement ? element.control : element;
+      return box && box.matches(CHOICE) ? box : null;
+    }
+    // The box a click on this control picks. One the click passed through below
+    // the control comes first: querySelector can't reach a slotted box, a box in a
+    // shadow root or the box of a label inside the control, and a row can hold
+    // more than one box. Else the control itself, the box it labels, or the first
+    // one it wraps, as on an option row whose name repeats the option's text.
+    function choiceOf(control, path) {
+      for (var _i = 0, path_1 = path; _i < path_1.length; _i++) {
+        var target = path_1[_i];
+        if (target === control) {
+          break;
+        }
+        var box = target instanceof Element ? boxOf(target) : null;
+        if (box) {
+          return box;
+        }
+      }
+      return boxOf(control) || control.querySelector(CHOICE);
+    }
     // Describes a clicked control for auto button tracking. A link counts only when page
     // views can't see the click, and carries its link type.
-    function describeButtonClick(control) {
+    function describeButtonClick(control, path) {
+      if (path === void 0) {
+        path = [];
+      }
       var link;
       if (control.matches('a[href]:not([role="button"])')) {
         link = describeLink(control);
@@ -12090,28 +12443,41 @@ var mParticle = (function () {
         }
       }
       var element = elementKind(control);
-      var name = accessibleName(control);
-      var label = maskLabel(name.raw);
+      var box = control instanceof HTMLInputElement && (control.type === 'checkbox' || control.type === 'radio') ? control : undefined;
+      // A box's text sent with its state is the shopper's answer, and the text
+      // can be a name, an address or a sensitive choice, so a box goes by its
+      // hand-written identifiers alone. So does a control acting as one or
+      // wrapping one, and a label, whose click the browser passes on to its box
+      // as a second event.
+      var choice = box || choiceOf(control, path);
+      // A checkbox's identifiers name its question, which its state answers. A
+      // radio's id, test id and the panel it opens name the option picked, so
+      // only the name of its input, the question, goes with it. A wrapper's own
+      // name, or a role radio's, can name the option instead.
+      var radio = choice instanceof HTMLInputElement ? choice.type === 'radio' : !!choice && choice.matches(RADIO_ROLE);
+      var named = !radio ? control : choice instanceof HTMLInputElement ? choice : null;
+      var name = choice ? undefined : accessibleName(control);
+      var label = name ? maskLabel(name.raw) : undefined;
       return {
         label: label,
         labelSource: label ? name.source : 'none',
         // Kept on its own as well: it often says more than the visible text,
         // such as which item a remove button removes.
-        ariaLabel: maskLabel(control.getAttribute('aria-label')),
-        icon: iconHint(control),
-        elementId: stableIdentifier(control.getAttribute('id')),
-        elementName: stableIdentifier(control.getAttribute('name')),
-        testId: firstIdentifier(control, TEST_ID_ATTRIBUTES),
-        controls: controlsIdentifier(control),
+        ariaLabel: choice ? undefined : maskLabel(control.getAttribute('aria-label')),
+        icon: choice ? undefined : iconHint(control),
+        elementId: radio ? undefined : stableIdentifier(control.getAttribute('id')),
+        elementName: stableIdentifier(named && named.getAttribute('name')),
+        testId: radio ? undefined : firstIdentifier(control, TEST_ID_ATTRIBUTES),
+        controls: radio ? undefined : controlsIdentifier(control),
         form: formIdentifier(control),
         element: element,
-        type: controlType(control, element),
+        type: controlType(control),
         linkType: link ? link.type : undefined,
         linkDomain: link ? link.domain : undefined,
         fileExtension: link ? link.fileExtension : undefined,
         // The box as the click left it: the browser toggles it before the click
         // reaches listeners, and puts it back if the click is cancelled.
-        checked: control instanceof HTMLInputElement && (control.type === 'checkbox' || control.type === 'radio') ? control.checked : undefined
+        checked: box ? box.checked : undefined
       };
     }
 
@@ -12128,6 +12494,10 @@ var mParticle = (function () {
     var linkCommits = new RegExp('^(?:(?:place|submit|complete)(?!(?: [^ ]+){0,2} (?:another|new|next)(?: |$))(?: [^ ]+){0,2} (?:order|purchase)|' + otherCommits + ')$');
     var routeGatedCommits = new RegExp('^(?:buy now|purchase|jetzt kaufen|kaufen|commander|(?:passer|valider) (?:la |ma )?commande|finalizar (?:la |mi )?compra|' + 'comprar ahora|acquista ora|nu kopen|\u4ECA\u3059\u3050\u8CFC\u5165|\u8CFC\u5165\u3059\u308B|\u3053\u306E\u5185\u5BB9\u3067\u7533\u3057\u8FBC\u3080)$');
     var steps = new RegExp('^(?:' + ["(?:let's |lets |go to |proceed to |secure )?(?:check ?out|checkout)(?: now| securely| as guest)?", '(?:continue|proceed) to (?:payment|review|billing|shipping|delivery|order review)|review (?:my |your )?order', 'guest checkout|(?:pay|continue|check ?out) (?:with|by) (?:card|credit card|debit card|credit or debit card)', 'zur kasse|zur kasse gehen|auschecken|weiter zur zahlung', 'passer \u00E0 la caisse|continuer vers le paiement|proc\u00E9der au paiement', 'ir a caja|continuar al pago|tramitar pedido', "procedi al checkout|procedi all'acquisto|procedi al pagamento|vai alla cassa", 'afrekenen|verder naar betalen|doorgaan naar betalen', '\u30EC\u30B8\u306B\u9032\u3080|\u3054?(?:\u8CFC\u5165|\u6CE8\u6587)\u624B\u7D9A\u304D(?:\u3078|\u306B)(?:\u9032\u3080)?|\u304A?\u652F\u6255\u3044(?:\u3078|\u306B)\u9032\u3080|(?:\u3054\u6CE8\u6587\u5185\u5BB9\u306E)?\u78BA\u8A8D\u753B\u9762\u3078(?:\u9032\u3080)?'].join('|') + ')$');
+    var CART_NOUN = '(?:(?:my|your|the) )?(?:shopping )?(?:cart|bag|basket)';
+    // "Add to bag", "View cart", "Shopping bag", "Bag", and a count badge such as
+    // "1 item in bag", which reads "item in bag" once digits are stripped.
+    var cartLabels = new RegExp('^(?:add(?: [^ ]+){0,5} to ' + CART_NOUN + '|(?:(?:view|open|go to) )?' + CART_NOUN + '(?: items?)?' + '|items? in ' + CART_NOUN + ')$');
     var WALLET_NAMES = 'apple pay|google pay|paypal|venmo|amazon pay|shop pay|klarna|afterpay|clearpay|cash app(?: pay)?|affirm|sezzle|samsung pay';
     var WALLET_VERBS = 'pay|buy|purchase|order|book|donate|subscribe|check ?out|checkout|express checkout|continue|proceed|' + 'complete purchase|place (?:my |your )?order';
     // "Pay with Klarna", "Buy with GPay", "Continue to PayPal".
@@ -12203,6 +12573,14 @@ var mParticle = (function () {
         return !!label;
       });
     }
+    // A cart button is often a bare icon, so its title names it when nothing else
+    // does. Only the cart rule reads the title.
+    function isCartControl(control, cores) {
+      var title = cores.length ? undefined : normalize(control.getAttribute('title'));
+      return (title ? [coreLabel(title)] : cores).some(function (text) {
+        return cartLabels.test(text);
+      });
+    }
     // "Buy now" and "Purchase" count only on a checkout route, and never on a plain
     // link, which is navigation.
     function isCommitLabel(text, isLink, pathname) {
@@ -12214,20 +12592,33 @@ var mParticle = (function () {
     // Classifies a clicked or submitting control found by findControl, in order:
     // pickers, toggles and pay-later messages never count; a vendor's own wallet
     // button counts before any label rule; a confirm label on any source counts
-    // before the look-alike exclusions veto; then wallet phrases and steps.
+    // before the look-alike exclusions veto; then a wallet-named control, wallet
+    // phrases and steps. A cart label, links included, counts only where none of
+    // those do.
     function classifyIntent(control, pathname) {
       var vendor = vendorButtonKind(control);
-      if (isQuietIntentControl(control, vendor === 'wallet') || vendor === 'none') {
+      if (vendor === 'none') {
         return undefined;
       }
       if (vendor) {
-        return {
+        return isQuietIntentControl(control, vendor === 'wallet') ? undefined : {
           kind: vendor,
           source: 'vendor'
         };
       }
       var texts = labels(control);
       var cores = texts.map(coreLabel);
+      var cart = isCartControl(control, cores) ? {
+        kind: 'cart',
+        source: 'label'
+      } : undefined;
+      if (isQuietIntentControl(control, false, !!cart)) {
+        return undefined;
+      }
+      // A bag button that opens a flyout counts only as a cart click.
+      if (cart && control.hasAttribute('aria-expanded')) {
+        return cart;
+      }
       var isLink = control.matches('a[href]:not([role="button"])');
       if (cores.some(function (text) {
         return isCommitLabel(text, isLink, pathname);
@@ -12240,7 +12631,13 @@ var mParticle = (function () {
       if (texts.concat(cores).some(function (text) {
         return englishExclusions.test(text) || otherExclusions.test(text);
       })) {
-        return undefined;
+        return cart;
+      }
+      if (isWalletNamedControl(control)) {
+        return {
+          kind: 'wallet',
+          source: 'name'
+        };
       }
       var isButton = !isLink && control.matches(CONTROL_SELECTOR);
       for (var _i = 0, cores_1 = cores; _i < cores_1.length; _i++) {
@@ -12264,7 +12661,7 @@ var mParticle = (function () {
           };
         }
       }
-      return undefined;
+      return cart;
     }
     // The host is the domain or one of its subdomains, never a look-alike suffix.
     function isOnDomain(host, domain) {
@@ -12307,6 +12704,8 @@ var mParticle = (function () {
     var WIN_BTN_KEY = '__mpBtn__';
     var THROTTLE_MS = 2000;
     var SUBMIT_AFTER_COMMIT_CLICK_MS = 1000;
+    // Apple Pay must begin inside the tap's own handler, so the tap is this recent.
+    var APPLE_PAY_AFTER_CLICK_MS = 1000;
     var PATH_LIMIT = 12;
     // A ceiling, not a dedupe: a held Enter key or browser automation fires a
     // trusted click per repeat, and each one is forwarded to every kit.
@@ -12345,6 +12744,63 @@ var mParticle = (function () {
         setTimeout(fn, 0);
       }
     };
+    // Apple Pay's session opens only from a shopper's tap, whatever button the page
+    // draws for it, so its opening is a wallet tap no label or name rule can miss.
+    // The wrapper keeps the page's own begin under this key, to put it back.
+    var APPLE_PAY_HOOK = '__mpApplePayHook__';
+    var applePayPrototype = function applePayPrototype(win) {
+      var session = win['ApplePaySession'];
+      return session && session.prototype;
+    };
+    // Wraps ApplePaySession.prototype.begin once per window, so the active tracker
+    // hears that a session began. The wrapper reads no arguments and no payment
+    // data, and returns or throws exactly what the original does. Nothing here can
+    // throw into SDK init: a throwing getter or a frozen prototype leaves Apple Pay
+    // as it was.
+    var hookApplePay = function hookApplePay(win) {
+      try {
+        var prototype = applePayPrototype(win);
+        var begin_1 = prototype && prototype.begin;
+        if (!isFunction(begin_1) || begin_1[APPLE_PAY_HOOK]) {
+          return;
+        }
+        var opened = function opened() {
+          var args = [];
+          for (var _i = 0; _i < arguments.length; _i++) {
+            args[_i] = arguments[_i];
+          }
+          var result = begin_1.apply(this, args);
+          try {
+            var tracker = getActiveButtonTracker();
+            if (tracker) {
+              tracker.onApplePayBegin();
+            }
+          } catch (e) {
+            // A session the page began is never disturbed by tracking.
+          }
+          return result;
+        };
+        // Not enumerable, so the marker doesn't show among the method's own keys.
+        Object.defineProperty(opened, APPLE_PAY_HOOK, {
+          value: begin_1
+        });
+        prototype.begin = opened;
+      } catch (e) {
+        // Apple Pay stays as the page set it up.
+      }
+    };
+    // Puts the page's own begin back, unless another script has wrapped it since.
+    var unhookApplePay = function unhookApplePay(win) {
+      try {
+        var prototype = applePayPrototype(win);
+        var begin = prototype && prototype.begin;
+        if (isFunction(begin) && isFunction(begin[APPLE_PAY_HOOK])) {
+          prototype.begin = begin[APPLE_PAY_HOOK];
+        }
+      } catch (e) {
+        // Apple Pay stays as it is.
+      }
+    };
     var CAPTURE_PASSIVE = {
       capture: true,
       passive: true
@@ -12362,6 +12818,9 @@ var mParticle = (function () {
         // Bumped on reset so classification queued before it is dropped.
         this.generation = 0;
         this.lastCommitClick = -Infinity;
+        // The latest trusted click: whether the page excluded it, and the intent it
+        // already carries to the kit, with its source, if any.
+        this.lastClick = null;
         this.lastSent = {};
         this.pagePath = null;
         this.pageEvents = 0;
@@ -12445,8 +12904,40 @@ var mParticle = (function () {
           win[WIN_BTN_KEY] = {};
         }
         win[WIN_BTN_KEY].tracker = this;
+        // Only where checkout intent can reach the kit; a shopper who opts back in mid-page gets no session
+        // signal until the next page load.
+        if (!this.isKitSuppressed()) {
+          hookApplePay(win);
+        }
         this.log('listening');
       };
+      // An Apple Pay session begun right after a tracked tap counts as a wallet
+      // tap for the kit; one begun with no such tap, or from a tap the page
+      // excluded, does not. A tap that reads as a confirm tap reaches the kit as
+      // one. It is delivered on a timer, not after the next paint, since the
+      // payment sheet may hold painting back: a tap that already reads as a
+      // wallet goes now under its own rule, and the throttle drops the copy
+      // queued for the paint.
+      ButtonTracker.prototype.onApplePayBegin = function () {
+        var _this = this;
+        var t = Date.now();
+        var click = this.lastClick;
+        if (!this.active || !click || click.excluded || click.kind === 'commit' || t - click.t > APPLE_PAY_AFTER_CLICK_MS || this.isKitSuppressed()) {
+          return;
+        }
+        var pathname = window.location.pathname;
+        var generation = this.generation;
+        setTimeout(function () {
+          if (generation !== _this.generation) {
+            return;
+          }
+          try {
+            _this.emit('wallet', click.kind === 'wallet' ? click.source : 'api', 'apple_pay', t, pathname);
+          } catch (e) {
+            _this.log('[error] Apple Pay delivery threw: ' + e);
+          }
+        }, 0);
+      };
       ButtonTracker.prototype.teardown = function () {
         var win = btnWindow();
         if (win) {
@@ -12460,6 +12951,7 @@ var mParticle = (function () {
           var state = win[WIN_BTN_KEY];
           if (state && state.tracker === this) {
             state.tracker = undefined;
+            unhookApplePay(win);
           }
         }
         this.active = false;
@@ -12479,6 +12971,7 @@ var mParticle = (function () {
         this.generation++;
         this.pending = [];
         this.lastCommitClick = -Infinity;
+        this.lastClick = null;
         this.lastSent = {};
         this.pagePath = null;
         this.pageEvents = 0;
@@ -12514,9 +13007,11 @@ var mParticle = (function () {
         var unconfirmedCommit = false;
         if (layer === 'click') {
           // The composed path is only populated during dispatch.
-          var control = findControl(isFunction(event.composedPath) ? event.composedPath().slice(0, PATH_LIMIT) : []);
+          var path = isFunction(event.composedPath) ? event.composedPath().slice(0, PATH_LIMIT) : [];
+          var excluded = isExcludedPath(path);
+          var control = excluded ? undefined : findControl(path, true);
           if (control) {
-            click = logsEvents ? describeButtonClick(control) : undefined;
+            click = logsEvents ? describeButtonClick(control, path) : undefined;
             if (click && click.checked !== undefined) {
               box = control;
             }
@@ -12525,6 +13020,12 @@ var mParticle = (function () {
             kind = intent ? intent.kind : undefined;
             source = intent ? intent.source : undefined;
           }
+          this.lastClick = {
+            t: t,
+            excluded: excluded,
+            kind: kind,
+            source: source
+          };
         } else if (layer === 'submit') {
           var submitter = event.submitter;
           var control = submitter ? findControl([submitter]) : undefined;
@@ -13618,6 +14119,7 @@ var mParticle = (function () {
         mpInstance._NativeSdkHelpers.initializeSessionAttributes(apiKey);
         // Button tracking never runs as a native passthrough.
         resetButtonTracking();
+        mpInstance._RoktManager.setAutoButtonClicksForwarded(false);
       } else {
         // Main SDK initialization flow
         // Load any settings/identities/attributes from cookie or localStorage
@@ -13662,6 +14164,15 @@ var mParticle = (function () {
           // https://go.mparticle.com/work/SQDSDKS-7339
           mpInstance._RoktManager.init(roktConfig_1, createRoktFilteredUser(currentUserMPID), mpInstance.Identity, mpInstance._Store, mpInstance.Logger, roktOptions, mpInstance.captureTiming, mpInstance._ErrorReportingDispatcher, mpInstance._LoggingDispatcher, mpInstance._IntegrationCapture, createRoktFilteredUser);
         }
+        // Checkout intent comes from the shopper's clicks, so it goes to the
+        // Rokt kit only when that kit receives them. Set before
+        // processForwarders: the kit can read it during this init, from its own
+        // init or from a returning shopper's landing page view.
+        var buttonClickBlocker = roktConfig_1 ? getButtonClickBlocker(roktConfig_1, kitBlocker) : undefined;
+        if (buttonClickBlocker && getFeatureFlag(AutoButtonTracking)) {
+          mpInstance.Logger.warning("Checkout intent is off: the ".concat(buttonClickBlocker, " keeps some or all Auto Button Click events from the Rokt kit."));
+        }
+        mpInstance._RoktManager.setAutoButtonClicksForwarded(!!roktConfig_1 && !buttonClickBlocker);
         mpInstance._Forwarders.processForwarders(config, mpInstance._APIClient.prepareForwardingStats);
         mpInstance._Forwarders.processPixelConfigs(config);
         // Checks if session is created, resumed, or needs to be ended
@@ -13696,8 +14207,6 @@ var mParticle = (function () {
           // so it stops listening. Re-created if the flag is re-enabled later.
           mpInstance._PageViewTracker.teardown();
         }
-        // Button clicks are logged for any workspace that opts in. Checkout
-        // intent also goes to the Rokt kit when this init configures one.
         if (getFeatureFlag(AutoButtonTracking)) {
           if (!mpInstance._ButtonTracker) {
             mpInstance._ButtonTracker = new ButtonTracker(mpInstance);
@@ -14308,8 +14817,8 @@ var mParticle = (function () {
       this.configurePixel = function (settings) {
         self.getInstance().configurePixel(settings);
       };
-      this._setIntegrationDelay = function (moduleId, _boolean) {
-        self.getInstance()._setIntegrationDelay(moduleId, _boolean);
+      this._setIntegrationDelay = function (moduleId, boolean) {
+        self.getInstance()._setIntegrationDelay(moduleId, boolean);
       };
       this._getIntegrationDelays = function () {
         return self.getInstance()._getIntegrationDelays();