@oxvo/browser 7.1.0 → 7.3.4

package/dist/lib/index.js

@@ -1,716 +1,3 @@
-// DEFLATE is a complex format; to read this code, you should probably check the RFC first:
-// https://tools.ietf.org/html/rfc1951
-// You may also wish to take a look at the guide I made about this program:
-// https://gist.github.com/101arrowz/253f31eb5abc3d9275ab943003ffecad
-// Some of the following code is similar to that of UZIP.js:
-// https://github.com/photopea/UZIP.js
-// However, the vast majority of the codebase has diverged from UZIP.js to increase performance and reduce bundle size.
-// Sometimes 0 will appear where -1 would be more appropriate. This is because using a uint
-// is better for memory in most engines (I *think*).
-var ch2 = {};
-var wk = (function (c, id, msg, transfer, cb) {
-    var w = new Worker(ch2[id] || (ch2[id] = URL.createObjectURL(new Blob([
-        c + ';addEventListener("error",function(e){e=e.error;postMessage({$e$:[e.message,e.code,e.stack]})})'
-    ], { type: 'text/javascript' }))));
-    w.onmessage = function (e) {
-        var d = e.data, ed = d.$e$;
-        if (ed) {
-            var err = new Error(ed[0]);
-            err['code'] = ed[1];
-            err.stack = ed[2];
-            cb(err, null);
-        }
-        else
-            cb(null, d);
-    };
-    w.postMessage(msg, transfer);
-    return w;
-});
-
-// aliases for shorter compressed code (most minifers don't do this)
-var u8 = Uint8Array, u16 = Uint16Array, i32 = Int32Array;
-// fixed length extra bits
-var fleb = new u8([0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0, /* unused */ 0, 0, /* impossible */ 0]);
-// fixed distance extra bits
-var fdeb = new u8([0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 12, 12, 13, 13, /* unused */ 0, 0]);
-// code length index map
-var clim = new u8([16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15]);
-// get base, reverse index map from extra bits
-var freb = function (eb, start) {
-    var b = new u16(31);
-    for (var i = 0; i < 31; ++i) {
-        b[i] = start += 1 << eb[i - 1];
-    }
-    // numbers here are at max 18 bits
-    var r = new i32(b[30]);
-    for (var i = 1; i < 30; ++i) {
-        for (var j = b[i]; j < b[i + 1]; ++j) {
-            r[j] = ((j - b[i]) << 5) | i;
-        }
-    }
-    return { b: b, r: r };
-};
-var _a = freb(fleb, 2), fl = _a.b, revfl = _a.r;
-// we can ignore the fact that the other numbers are wrong; they never happen anyway
-fl[28] = 258, revfl[258] = 28;
-var _b = freb(fdeb, 0), revfd = _b.r;
-// map of value to reverse (assuming 16 bits)
-var rev = new u16(32768);
-for (var i$1 = 0; i$1 < 32768; ++i$1) {
-    // reverse table algorithm from SO
-    var x$1 = ((i$1 & 0xAAAA) >> 1) | ((i$1 & 0x5555) << 1);
-    x$1 = ((x$1 & 0xCCCC) >> 2) | ((x$1 & 0x3333) << 2);
-    x$1 = ((x$1 & 0xF0F0) >> 4) | ((x$1 & 0x0F0F) << 4);
-    rev[i$1] = (((x$1 & 0xFF00) >> 8) | ((x$1 & 0x00FF) << 8)) >> 1;
-}
-// create huffman tree from u8 "map": index -> code length for code index
-// mb (max bits) must be at most 15
-// TODO: optimize/split up?
-var hMap = (function (cd, mb, r) {
-    var s = cd.length;
-    // index
-    var i = 0;
-    // u16 "map": index -> # of codes with bit length = index
-    var l = new u16(mb);
-    // length of cd must be 288 (total # of codes)
-    for (; i < s; ++i) {
-        if (cd[i])
-            ++l[cd[i] - 1];
-    }
-    // u16 "map": index -> minimum code for bit length = index
-    var le = new u16(mb);
-    for (i = 1; i < mb; ++i) {
-        le[i] = (le[i - 1] + l[i - 1]) << 1;
-    }
-    var co;
-    if (r) {
-        // u16 "map": index -> number of actual bits, symbol for code
-        co = new u16(1 << mb);
-        // bits to remove for reverser
-        var rvb = 15 - mb;
-        for (i = 0; i < s; ++i) {
-            // ignore 0 lengths
-            if (cd[i]) {
-                // num encoding both symbol and bits read
-                var sv = (i << 4) | cd[i];
-                // free bits
-                var r_1 = mb - cd[i];
-                // start value
-                var v = le[cd[i] - 1]++ << r_1;
-                // m is end value
-                for (var m = v | ((1 << r_1) - 1); v <= m; ++v) {
-                    // every 16 bit value starting with the code yields the same result
-                    co[rev[v] >> rvb] = sv;
-                }
-            }
-        }
-    }
-    else {
-        co = new u16(s);
-        for (i = 0; i < s; ++i) {
-            if (cd[i]) {
-                co[i] = rev[le[cd[i] - 1]++] >> (15 - cd[i]);
-            }
-        }
-    }
-    return co;
-});
-// fixed length tree
-var flt = new u8(288);
-for (var i$1 = 0; i$1 < 144; ++i$1)
-    flt[i$1] = 8;
-for (var i$1 = 144; i$1 < 256; ++i$1)
-    flt[i$1] = 9;
-for (var i$1 = 256; i$1 < 280; ++i$1)
-    flt[i$1] = 7;
-for (var i$1 = 280; i$1 < 288; ++i$1)
-    flt[i$1] = 8;
-// fixed distance tree
-var fdt = new u8(32);
-for (var i$1 = 0; i$1 < 32; ++i$1)
-    fdt[i$1] = 5;
-// fixed length map
-var flm = /*#__PURE__*/ hMap(flt, 9, 0);
-// fixed distance map
-var fdm = /*#__PURE__*/ hMap(fdt, 5, 0);
-// get end of byte
-var shft = function (p) { return ((p + 7) / 8) | 0; };
-// typed array slice - allows garbage collector to free original reference,
-// while being more compatible than .slice
-var slc = function (v, s, e) {
-    if (s == null || s < 0)
-        s = 0;
-    if (e == null || e > v.length)
-        e = v.length;
-    // can't use .constructor in case user-supplied
-    return new u8(v.subarray(s, e));
-};
-// error codes
-var ec = [
-    'unexpected EOF',
-    'invalid block type',
-    'invalid length/literal',
-    'invalid distance',
-    'stream finished',
-    'no stream handler',
-    ,
-    'no callback',
-    'invalid UTF-8 data',
-    'extra field too long',
-    'date not in range 1980-2099',
-    'filename too long',
-    'stream finishing',
-    'invalid zip data'
-    // determined by unknown compression method
-];
-var err = function (ind, msg, nt) {
-    var e = new Error(msg || ec[ind]);
-    e.code = ind;
-    if (Error.captureStackTrace)
-        Error.captureStackTrace(e, err);
-    if (!nt)
-        throw e;
-    return e;
-};
-// starting at p, write the minimum number of bits that can hold v to d
-var wbits = function (d, p, v) {
-    v <<= p & 7;
-    var o = (p / 8) | 0;
-    d[o] |= v;
-    d[o + 1] |= v >> 8;
-};
-// starting at p, write the minimum number of bits (>8) that can hold v to d
-var wbits16 = function (d, p, v) {
-    v <<= p & 7;
-    var o = (p / 8) | 0;
-    d[o] |= v;
-    d[o + 1] |= v >> 8;
-    d[o + 2] |= v >> 16;
-};
-// creates code lengths from a frequency table
-var hTree = function (d, mb) {
-    // Need extra info to make a tree
-    var t = [];
-    for (var i = 0; i < d.length; ++i) {
-        if (d[i])
-            t.push({ s: i, f: d[i] });
-    }
-    var s = t.length;
-    var t2 = t.slice();
-    if (!s)
-        return { t: et, l: 0 };
-    if (s == 1) {
-        var v = new u8(t[0].s + 1);
-        v[t[0].s] = 1;
-        return { t: v, l: 1 };
-    }
-    t.sort(function (a, b) { return a.f - b.f; });
-    // after i2 reaches last ind, will be stopped
-    // freq must be greater than largest possible number of symbols
-    t.push({ s: -1, f: 25001 });
-    var l = t[0], r = t[1], i0 = 0, i1 = 1, i2 = 2;
-    t[0] = { s: -1, f: l.f + r.f, l: l, r: r };
-    // efficient algorithm from UZIP.js
-    // i0 is lookbehind, i2 is lookahead - after processing two low-freq
-    // symbols that combined have high freq, will start processing i2 (high-freq,
-    // non-composite) symbols instead
-    // see https://reddit.com/r/photopea/comments/ikekht/uzipjs_questions/
-    while (i1 != s - 1) {
-        l = t[t[i0].f < t[i2].f ? i0++ : i2++];
-        r = t[i0 != i1 && t[i0].f < t[i2].f ? i0++ : i2++];
-        t[i1++] = { s: -1, f: l.f + r.f, l: l, r: r };
-    }
-    var maxSym = t2[0].s;
-    for (var i = 1; i < s; ++i) {
-        if (t2[i].s > maxSym)
-            maxSym = t2[i].s;
-    }
-    // code lengths
-    var tr = new u16(maxSym + 1);
-    // max bits in tree
-    var mbt = ln(t[i1 - 1], tr, 0);
-    if (mbt > mb) {
-        // more algorithms from UZIP.js
-        // TODO: find out how this code works (debt)
-        //  ind    debt
-        var i = 0, dt = 0;
-        //    left            cost
-        var lft = mbt - mb, cst = 1 << lft;
-        t2.sort(function (a, b) { return tr[b.s] - tr[a.s] || a.f - b.f; });
-        for (; i < s; ++i) {
-            var i2_1 = t2[i].s;
-            if (tr[i2_1] > mb) {
-                dt += cst - (1 << (mbt - tr[i2_1]));
-                tr[i2_1] = mb;
-            }
-            else
-                break;
-        }
-        dt >>= lft;
-        while (dt > 0) {
-            var i2_2 = t2[i].s;
-            if (tr[i2_2] < mb)
-                dt -= 1 << (mb - tr[i2_2]++ - 1);
-            else
-                ++i;
-        }
-        for (; i >= 0 && dt; --i) {
-            var i2_3 = t2[i].s;
-            if (tr[i2_3] == mb) {
-                --tr[i2_3];
-                ++dt;
-            }
-        }
-        mbt = mb;
-    }
-    return { t: new u8(tr), l: mbt };
-};
-// get the max length and assign length codes
-var ln = function (n, l, d) {
-    return n.s == -1
-        ? Math.max(ln(n.l, l, d + 1), ln(n.r, l, d + 1))
-        : (l[n.s] = d);
-};
-// length codes generation
-var lc = function (c) {
-    var s = c.length;
-    // Note that the semicolon was intentional
-    while (s && !c[--s])
-        ;
-    var cl = new u16(++s);
-    //  ind      num         streak
-    var cli = 0, cln = c[0], cls = 1;
-    var w = function (v) { cl[cli++] = v; };
-    for (var i = 1; i <= s; ++i) {
-        if (c[i] == cln && i != s)
-            ++cls;
-        else {
-            if (!cln && cls > 2) {
-                for (; cls > 138; cls -= 138)
-                    w(32754);
-                if (cls > 2) {
-                    w(cls > 10 ? ((cls - 11) << 5) | 28690 : ((cls - 3) << 5) | 12305);
-                    cls = 0;
-                }
-            }
-            else if (cls > 3) {
-                w(cln), --cls;
-                for (; cls > 6; cls -= 6)
-                    w(8304);
-                if (cls > 2)
-                    w(((cls - 3) << 5) | 8208), cls = 0;
-            }
-            while (cls--)
-                w(cln);
-            cls = 1;
-            cln = c[i];
-        }
-    }
-    return { c: cl.subarray(0, cli), n: s };
-};
-// calculate the length of output from tree, code lengths
-var clen = function (cf, cl) {
-    var l = 0;
-    for (var i = 0; i < cl.length; ++i)
-        l += cf[i] * cl[i];
-    return l;
-};
-// writes a fixed block
-// returns the new bit pos
-var wfblk = function (out, pos, dat) {
-    // no need to write 00 as type: TypedArray defaults to 0
-    var s = dat.length;
-    var o = shft(pos + 2);
-    out[o] = s & 255;
-    out[o + 1] = s >> 8;
-    out[o + 2] = out[o] ^ 255;
-    out[o + 3] = out[o + 1] ^ 255;
-    for (var i = 0; i < s; ++i)
-        out[o + i + 4] = dat[i];
-    return (o + 4 + s) * 8;
-};
-// writes a block
-var wblk = function (dat, out, final, syms, lf, df, eb, li, bs, bl, p) {
-    wbits(out, p++, final);
-    ++lf[256];
-    var _a = hTree(lf, 15), dlt = _a.t, mlb = _a.l;
-    var _b = hTree(df, 15), ddt = _b.t, mdb = _b.l;
-    var _c = lc(dlt), lclt = _c.c, nlc = _c.n;
-    var _d = lc(ddt), lcdt = _d.c, ndc = _d.n;
-    var lcfreq = new u16(19);
-    for (var i = 0; i < lclt.length; ++i)
-        ++lcfreq[lclt[i] & 31];
-    for (var i = 0; i < lcdt.length; ++i)
-        ++lcfreq[lcdt[i] & 31];
-    var _e = hTree(lcfreq, 7), lct = _e.t, mlcb = _e.l;
-    var nlcc = 19;
-    for (; nlcc > 4 && !lct[clim[nlcc - 1]]; --nlcc)
-        ;
-    var flen = (bl + 5) << 3;
-    var ftlen = clen(lf, flt) + clen(df, fdt) + eb;
-    var dtlen = clen(lf, dlt) + clen(df, ddt) + eb + 14 + 3 * nlcc + clen(lcfreq, lct) + 2 * lcfreq[16] + 3 * lcfreq[17] + 7 * lcfreq[18];
-    if (bs >= 0 && flen <= ftlen && flen <= dtlen)
-        return wfblk(out, p, dat.subarray(bs, bs + bl));
-    var lm, ll, dm, dl;
-    wbits(out, p, 1 + (dtlen < ftlen)), p += 2;
-    if (dtlen < ftlen) {
-        lm = hMap(dlt, mlb, 0), ll = dlt, dm = hMap(ddt, mdb, 0), dl = ddt;
-        var llm = hMap(lct, mlcb, 0);
-        wbits(out, p, nlc - 257);
-        wbits(out, p + 5, ndc - 1);
-        wbits(out, p + 10, nlcc - 4);
-        p += 14;
-        for (var i = 0; i < nlcc; ++i)
-            wbits(out, p + 3 * i, lct[clim[i]]);
-        p += 3 * nlcc;
-        var lcts = [lclt, lcdt];
-        for (var it = 0; it < 2; ++it) {
-            var clct = lcts[it];
-            for (var i = 0; i < clct.length; ++i) {
-                var len = clct[i] & 31;
-                wbits(out, p, llm[len]), p += lct[len];
-                if (len > 15)
-                    wbits(out, p, (clct[i] >> 5) & 127), p += clct[i] >> 12;
-            }
-        }
-    }
-    else {
-        lm = flm, ll = flt, dm = fdm, dl = fdt;
-    }
-    for (var i = 0; i < li; ++i) {
-        var sym = syms[i];
-        if (sym > 255) {
-            var len = (sym >> 18) & 31;
-            wbits16(out, p, lm[len + 257]), p += ll[len + 257];
-            if (len > 7)
-                wbits(out, p, (sym >> 23) & 31), p += fleb[len];
-            var dst = sym & 31;
-            wbits16(out, p, dm[dst]), p += dl[dst];
-            if (dst > 3)
-                wbits16(out, p, (sym >> 5) & 8191), p += fdeb[dst];
-        }
-        else {
-            wbits16(out, p, lm[sym]), p += ll[sym];
-        }
-    }
-    wbits16(out, p, lm[256]);
-    return p + ll[256];
-};
-// deflate options (nice << 13) | chain
-var deo = /*#__PURE__*/ new i32([65540, 131080, 131088, 131104, 262176, 1048704, 1048832, 2114560, 2117632]);
-// empty
-var et = /*#__PURE__*/ new u8(0);
-// compresses data into a raw DEFLATE buffer
-var dflt = function (dat, lvl, plvl, pre, post, st) {
-    var s = st.z || dat.length;
-    var o = new u8(pre + s + 5 * (1 + Math.ceil(s / 7000)) + post);
-    // writing to this writes to the output buffer
-    var w = o.subarray(pre, o.length - post);
-    var lst = st.l;
-    var pos = (st.r || 0) & 7;
-    if (lvl) {
-        if (pos)
-            w[0] = st.r >> 3;
-        var opt = deo[lvl - 1];
-        var n = opt >> 13, c = opt & 8191;
-        var msk_1 = (1 << plvl) - 1;
-        //    prev 2-byte val map    curr 2-byte val map
-        var prev = st.p || new u16(32768), head = st.h || new u16(msk_1 + 1);
-        var bs1_1 = Math.ceil(plvl / 3), bs2_1 = 2 * bs1_1;
-        var hsh = function (i) { return (dat[i] ^ (dat[i + 1] << bs1_1) ^ (dat[i + 2] << bs2_1)) & msk_1; };
-        // 24576 is an arbitrary number of maximum symbols per block
-        // 424 buffer for last block
-        var syms = new i32(25000);
-        // length/literal freq   distance freq
-        var lf = new u16(288), df = new u16(32);
-        //  l/lcnt  exbits  index          l/lind  waitdx          blkpos
-        var lc_1 = 0, eb = 0, i = st.i || 0, li = 0, wi = st.w || 0, bs = 0;
-        for (; i + 2 < s; ++i) {
-            // hash value
-            var hv = hsh(i);
-            // index mod 32768    previous index mod
-            var imod = i & 32767, pimod = head[hv];
-            prev[imod] = pimod;
-            head[hv] = imod;
-            // We always should modify head and prev, but only add symbols if
-            // this data is not yet processed ("wait" for wait index)
-            if (wi <= i) {
-                // bytes remaining
-                var rem = s - i;
-                if ((lc_1 > 7000 || li > 24576) && (rem > 423 || !lst)) {
-                    pos = wblk(dat, w, 0, syms, lf, df, eb, li, bs, i - bs, pos);
-                    li = lc_1 = eb = 0, bs = i;
-                    for (var j = 0; j < 286; ++j)
-                        lf[j] = 0;
-                    for (var j = 0; j < 30; ++j)
-                        df[j] = 0;
-                }
-                //  len    dist   chain
-                var l = 2, d = 0, ch_1 = c, dif = imod - pimod & 32767;
-                if (rem > 2 && hv == hsh(i - dif)) {
-                    var maxn = Math.min(n, rem) - 1;
-                    var maxd = Math.min(32767, i);
-                    // max possible length
-                    // not capped at dif because decompressors implement "rolling" index population
-                    var ml = Math.min(258, rem);
-                    while (dif <= maxd && --ch_1 && imod != pimod) {
-                        if (dat[i + l] == dat[i + l - dif]) {
-                            var nl = 0;
-                            for (; nl < ml && dat[i + nl] == dat[i + nl - dif]; ++nl)
-                                ;
-                            if (nl > l) {
-                                l = nl, d = dif;
-                                // break out early when we reach "nice" (we are satisfied enough)
-                                if (nl > maxn)
-                                    break;
-                                // now, find the rarest 2-byte sequence within this
-                                // length of literals and search for that instead.
-                                // Much faster than just using the start
-                                var mmd = Math.min(dif, nl - 2);
-                                var md = 0;
-                                for (var j = 0; j < mmd; ++j) {
-                                    var ti = i - dif + j & 32767;
-                                    var pti = prev[ti];
-                                    var cd = ti - pti & 32767;
-                                    if (cd > md)
-                                        md = cd, pimod = ti;
-                                }
-                            }
-                        }
-                        // check the previous match
-                        imod = pimod, pimod = prev[imod];
-                        dif += imod - pimod & 32767;
-                    }
-                }
-                // d will be nonzero only when a match was found
-                if (d) {
-                    // store both dist and len data in one int32
-                    // Make sure this is recognized as a len/dist with 28th bit (2^28)
-                    syms[li++] = 268435456 | (revfl[l] << 18) | revfd[d];
-                    var lin = revfl[l] & 31, din = revfd[d] & 31;
-                    eb += fleb[lin] + fdeb[din];
-                    ++lf[257 + lin];
-                    ++df[din];
-                    wi = i + l;
-                    ++lc_1;
-                }
-                else {
-                    syms[li++] = dat[i];
-                    ++lf[dat[i]];
-                }
-            }
-        }
-        for (i = Math.max(i, wi); i < s; ++i) {
-            syms[li++] = dat[i];
-            ++lf[dat[i]];
-        }
-        pos = wblk(dat, w, lst, syms, lf, df, eb, li, bs, i - bs, pos);
-        if (!lst) {
-            st.r = (pos & 7) | w[(pos / 8) | 0] << 3;
-            // shft(pos) now 1 less if pos & 7 != 0
-            pos -= 7;
-            st.h = head, st.p = prev, st.i = i, st.w = wi;
-        }
-    }
-    else {
-        for (var i = st.w || 0; i < s + lst; i += 65535) {
-            // end
-            var e = i + 65535;
-            if (e >= s) {
-                // write final block
-                w[(pos / 8) | 0] = lst;
-                e = s;
-            }
-            pos = wfblk(w, pos + 1, dat.subarray(i, e));
-        }
-        st.i = s;
-    }
-    return slc(o, 0, pre + shft(pos) + post);
-};
-// CRC32 table
-var crct = /*#__PURE__*/ (function () {
-    var t = new Int32Array(256);
-    for (var i = 0; i < 256; ++i) {
-        var c = i, k = 9;
-        while (--k)
-            c = ((c & 1) && -306674912) ^ (c >>> 1);
-        t[i] = c;
-    }
-    return t;
-})();
-// CRC32
-var crc = function () {
-    var c = -1;
-    return {
-        p: function (d) {
-            // closures have awful performance
-            var cr = c;
-            for (var i = 0; i < d.length; ++i)
-                cr = crct[(cr & 255) ^ d[i]] ^ (cr >>> 8);
-            c = cr;
-        },
-        d: function () { return ~c; }
-    };
-};
-// deflate with opts
-var dopt = function (dat, opt, pre, post, st) {
-    if (!st) {
-        st = { l: 1 };
-        if (opt.dictionary) {
-            var dict = opt.dictionary.subarray(-32768);
-            var newDat = new u8(dict.length + dat.length);
-            newDat.set(dict);
-            newDat.set(dat, dict.length);
-            dat = newDat;
-            st.w = dict.length;
-        }
-    }
-    return dflt(dat, opt.level == null ? 6 : opt.level, opt.mem == null ? (st.l ? Math.ceil(Math.max(8, Math.min(13, Math.log(dat.length))) * 1.5) : 20) : (12 + opt.mem), pre, post, st);
-};
-// Walmart object spread
-var mrg = function (a, b) {
-    var o = {};
-    for (var k in a)
-        o[k] = a[k];
-    for (var k in b)
-        o[k] = b[k];
-    return o;
-};
-// worker clone
-// This is possibly the craziest part of the entire codebase, despite how simple it may seem.
-// The only parameter to this function is a closure that returns an array of variables outside of the function scope.
-// We're going to try to figure out the variable names used in the closure as strings because that is crucial for workerization.
-// We will return an object mapping of true variable name to value (basically, the current scope as a JS object).
-// The reason we can't just use the original variable names is minifiers mangling the toplevel scope.
-// This took me three weeks to figure out how to do.
-var wcln = function (fn, fnStr, td) {
-    var dt = fn();
-    var st = fn.toString();
-    var ks = st.slice(st.indexOf('[') + 1, st.lastIndexOf(']')).replace(/\s+/g, '').split(',');
-    for (var i = 0; i < dt.length; ++i) {
-        var v = dt[i], k = ks[i];
-        if (typeof v == 'function') {
-            fnStr += ';' + k + '=';
-            var st_1 = v.toString();
-            if (v.prototype) {
-                // for global objects
-                if (st_1.indexOf('[native code]') != -1) {
-                    var spInd = st_1.indexOf(' ', 8) + 1;
-                    fnStr += st_1.slice(spInd, st_1.indexOf('(', spInd));
-                }
-                else {
-                    fnStr += st_1;
-                    for (var t in v.prototype)
-                        fnStr += ';' + k + '.prototype.' + t + '=' + v.prototype[t].toString();
-                }
-            }
-            else
-                fnStr += st_1;
-        }
-        else
-            td[k] = v;
-    }
-    return fnStr;
-};
-var ch = [];
-// clone bufs
-var cbfs = function (v) {
-    var tl = [];
-    for (var k in v) {
-        if (v[k].buffer) {
-            tl.push((v[k] = new v[k].constructor(v[k])).buffer);
-        }
-    }
-    return tl;
-};
-// use a worker to execute code
-var wrkr = function (fns, init, id, cb) {
-    if (!ch[id]) {
-        var fnStr = '', td_1 = {}, m = fns.length - 1;
-        for (var i = 0; i < m; ++i)
-            fnStr = wcln(fns[i], fnStr, td_1);
-        ch[id] = { c: wcln(fns[m], fnStr, td_1), e: td_1 };
-    }
-    var td = mrg({}, ch[id].e);
-    return wk(ch[id].c + ';onmessage=function(e){for(var k in e.data)self[k]=e.data[k];onmessage=' + init.toString() + '}', id, td, cbfs(td), cb);
-};
-var bDflt = function () { return [u8, u16, i32, fleb, fdeb, clim, revfl, revfd, flm, flt, fdm, fdt, rev, deo, et, hMap, wbits, wbits16, hTree, ln, lc, clen, wfblk, wblk, shft, slc, dflt, dopt, deflateSync, pbf]; };
-// gzip extra
-var gze = function () { return [gzh, gzhl, wbytes, crc, crct]; };
-// post buf
-var pbf = function (msg) { return postMessage(msg, [msg.buffer]); };
-// async helper
-var cbify = function (dat, opts, fns, init, id, cb) {
-    var w = wrkr(fns, init, id, function (err, dat) {
-        w.terminate();
-        cb(err, dat);
-    });
-    w.postMessage([dat, opts], opts.consume ? [dat.buffer] : []);
-    return function () { w.terminate(); };
-};
-// write bytes
-var wbytes = function (d, b, v) {
-    for (; v; ++b)
-        d[b] = v, v >>>= 8;
-};
-// gzip header
-var gzh = function (c, o) {
-    var fn = o.filename;
-    c[0] = 31, c[1] = 139, c[2] = 8, c[8] = o.level < 2 ? 4 : o.level == 9 ? 2 : 0, c[9] = 3; // assume Unix
-    if (o.mtime != 0)
-        wbytes(c, 4, Math.floor(new Date(o.mtime || Date.now()) / 1000));
-    if (fn) {
-        c[3] = 8;
-        for (var i = 0; i <= fn.length; ++i)
-            c[i + 10] = fn.charCodeAt(i);
-    }
-};
-// gzip header length
-var gzhl = function (o) { return 10 + (o.filename ? o.filename.length + 1 : 0); };
-/**
- * Compresses data with DEFLATE without any wrapper
- * @param data The data to compress
- * @param opts The compression options
- * @returns The deflated version of the data
- */
-function deflateSync(data, opts) {
-    return dopt(data, opts || {}, 0, 0);
-}
-function gzip(data, opts, cb) {
-    if (!cb)
-        cb = opts, opts = {};
-    if (typeof cb != 'function')
-        err(7);
-    return cbify(data, opts, [
-        bDflt,
-        gze,
-        function () { return [gzipSync]; }
-    ], function (ev) { return pbf(gzipSync(ev.data[0], ev.data[1])); }, 2, cb);
-}
-/**
- * Compresses data with GZIP
- * @param data The data to compress
- * @param opts The compression options
- * @returns The gzipped version of the data
- */
-function gzipSync(data, opts) {
-    if (!opts)
-        opts = {};
-    var c = crc(), l = data.length;
-    c.p(data);
-    var d = dopt(data, opts, gzhl(opts), 8), s = d.length;
-    return gzh(d, opts), wbytes(d, s - 8, c.d()), wbytes(d, s - 4, l), d;
-}
-// text decoder
-var td = typeof TextDecoder != 'undefined' && /*#__PURE__*/ new TextDecoder();
-// text decoder stream
-var tds = 0;
-try {
-    td.decode(et, { stream: true });
-    tds = 1;
-}
-catch (e) { }
-
 class StringDictionary {
     constructor() {
         this.lastTs = 0;
@@ -1161,6 +448,23 @@ function deprecationWarn(nameOfFeature, useInstead, docsPath = '/') {
     console.warn(`OxvoSessions: ${nameOfFeature} is deprecated. ${useInstead ? `Please, use ${useInstead} instead.` : ''} Visit ${DOCS_HOST}${docsPath} for more information.`);
     warnedFeatures[nameOfFeature] = true;
 }
+function getCustomAttributeLabel(e, customAttributes) {
+    if (!customAttributes || customAttributes.length === 0)
+        return '';
+    const parts = [];
+    for (const attr of customAttributes) {
+        const value = e.getAttribute(attr);
+        if (value !== null) {
+            parts.push(`[${attr}=${value}]`);
+        }
+    }
+    return parts.join('');
+}
+function getClassSelector(e) {
+    if (!e.classList || e.classList.length === 0)
+        return '';
+    return '.' + Array.from(e.classList).join('.');
+}
 function getLabelAttribute(e) {
     let value = e.getAttribute('data-oxvosessions-label');
     if (value !== null) {
@@ -1226,7 +530,7 @@ function dec2hex(dec) {
     return dec.toString(16).padStart(2, '0');
 }
 function generateRandomId(len) {
-    const arr = new Uint8Array((len) / 2);
+    const arr = new Uint8Array((len || 40) / 2);
     // msCrypto = IE11
     // @ts-ignore
     const safeCrypto = window.crypto || window.msCrypto;
@@ -1235,7 +539,7 @@ function generateRandomId(len) {
         return Array.from(arr, dec2hex).join('');
     }
     else {
-        return Array.from({ length: len }, () => dec2hex(Math.floor(Math.random() * 16))).join('');
+        return Array.from({ length: len || 40 }, () => dec2hex(Math.floor(Math.random() * 16))).join('');
     }
 }
 function inIframe() {
@@ -1432,6 +736,88 @@ function throttleWithTrailing(fn, interval) {
 
 // Auto-generated, do not edit
 /* eslint-disable */
+const MESSAGE_FIELD_TYPES = {
+    0: ['number'],
+    4: ['string', 'string', 'number'],
+    5: ['number', 'number'],
+    6: ['number', 'number'],
+    7: [],
+    8: ['number', 'number', 'number', 'string', 'boolean'],
+    9: ['number', 'number', 'number'],
+    10: ['number', 'number', 'number'],
+    11: ['number'],
+    12: ['number', 'string', 'string'],
+    13: ['number', 'string'],
+    14: ['number', 'string'],
+    16: ['number', 'number', 'number'],
+    17: ['number', 'string'],
+    18: ['number', 'string', 'number'],
+    19: ['number', 'boolean'],
+    20: ['number', 'number'],
+    21: ['string', 'string', 'string', 'string', 'string', 'number', 'number', 'number'],
+    22: ['string', 'string'],
+    23: ['number', 'number', 'number', 'number', 'number', 'number', 'number', 'number', 'number'],
+    24: ['number', 'number', 'number'],
+    27: ['string', 'string'],
+    28: ['string'],
+    29: ['string'],
+    30: ['string', 'string'],
+    34: ['number', 'string'],
+    35: ['number', 'number', 'number'],
+    36: ['number', 'string'],
+    40: ['string', 'number', 'string', 'string'],
+    41: ['string', 'string'],
+    42: ['string'],
+    44: ['string', 'string', 'number'],
+    45: ['string', 'string'],
+    46: ['string', 'string'],
+    47: ['string', 'string', 'number'],
+    48: ['string', 'string', 'string', 'string', 'number'],
+    49: ['number', 'number', 'number', 'number'],
+    50: ['number', 'string'],
+    51: ['number', 'number', 'number'],
+    43: ['string', 'string'],
+    52: ['number', 'string', 'string'],
+    53: ['number', 'number', 'number', 'number', 'number', 'number', 'string', 'string'],
+    54: ['number', 'string'],
+    55: ['boolean'],
+    57: ['number', 'string', 'string', 'string'],
+    58: ['number'],
+    60: ['number', 'string', 'string', 'string'],
+    61: ['number', 'string', 'string'],
+    63: ['string', 'string'],
+    64: ['string', 'string'],
+    65: ['number', 'number'],
+    68: ['number', 'number', 'string', 'string', 'number', 'number'],
+    69: ['number', 'number', 'string', 'string'],
+    70: ['number', 'number'],
+    71: ['number', 'string', 'string'],
+    73: ['number', 'string', 'number', 'string'],
+    75: ['number', 'number'],
+    76: ['number', 'number'],
+    77: ['number', 'number'],
+    78: ['string', 'string', 'string', 'string'],
+    79: ['string', 'string'],
+    81: ['number', 'number', 'number', 'number', 'string'],
+    83: ['string', 'string', 'string', 'string', 'string', 'number', 'number', 'number', 'number'],
+    84: ['string', 'string', 'string', 'number', 'string', 'string'],
+    85: ['number', 'number', 'number', 'number', 'number', 'number', 'string', 'string', 'number', 'boolean', 'number', 'number', 'number', 'number', 'number', 'number', 'number'],
+    87: ['string', 'number', 'number'],
+    89: ['string', 'number', 'number', 'number', 'number', 'string'],
+    112: ['number', 'string', 'boolean', 'string', 'number', 'number'],
+    113: ['number', 'number', 'string'],
+    114: ['number'],
+    115: ['number'],
+    116: ['number', 'number', 'number', 'number', 'number', 'number', 'string', 'string', 'number', 'boolean'],
+    117: ['string'],
+    118: ['string'],
+    119: ['string', 'number'],
+    120: ['number'],
+    121: ['string', 'string', 'number', 'number'],
+    122: ['string', 'string', 'number', 'string'],
+    123: ['string', 'string', 'string', 'string', 'number'],
+    124: ['string', 'string'],
+};
 function Timestamp(timestamp) {
     return [
         0 /* Messages.Type.Timestamp */,
@@ -1917,13 +1303,6 @@ function BatchMetadata(version, pageNo, firstIndex, timestamp, location) {
         location,
     ];
 }
-function PartitionedMessage(partNo, partTotal) {
-    return [
-        82 /* Messages.Type.PartitionedMessage */,
-        partNo,
-        partTotal,
-    ];
-}
 function NetworkRequest(type, method, url, request, response, status, timestamp, duration, transferredBodySize) {
     return [
         83 /* Messages.Type.NetworkRequest */,
@@ -2121,6 +1500,7 @@ var _Messages = /*#__PURE__*/Object.freeze({
     JSException: JSException,
     LoadFontFace: LoadFontFace,
     LongAnimationTask: LongAnimationTask$1,
+    MESSAGE_FIELD_TYPES: MESSAGE_FIELD_TYPES,
     Metadata: Metadata,
     MobX: MobX,
     MouseClick: MouseClick,
@@ -2135,7 +1515,6 @@ var _Messages = /*#__PURE__*/Object.freeze({
     OTable: OTable,
     PageLoadTiming: PageLoadTiming,
     PageRenderTiming: PageRenderTiming,
-    PartitionedMessage: PartitionedMessage,
     PerformanceTrack: PerformanceTrack,
     Profiler: Profiler,
     Redux: Redux,
@@ -2230,11 +1609,157 @@ function Performance (app, opts) {
     }
 }
 
+/**
+ * Two-tier tag matching:
+ * 1. Fast fingerprint lookup by id, data-attr,
+ *    or class from the selector's last segment
+ * 2. Fallback iteration using native element.matches()
+ */
+class TagMatcher {
+    constructor() {
+        this.tags = [];
+        this.byId = new Map();
+        this.byDataAttr = new Map();
+        this.byClass = new Map();
+        this.fallback = [];
+    }
+    setTags(tags) {
+        this.tags = tags;
+        this.byId.clear();
+        this.byDataAttr.clear();
+        this.byClass.clear();
+        this.fallback = [];
+        for (const tag of tags) {
+            const last = lastSegment(tag.selector);
+            if (!last) {
+                this.fallback.push(tag);
+                continue;
+            }
+            if (last.startsWith('#')) {
+                this.byId.set(last.slice(1), tag);
+            }
+            else if (last.startsWith('[data-')) {
+                this.byDataAttr.set(last, tag);
+            }
+            else {
+                const cls = extractClass(last);
+                if (cls) {
+                    this.byClass.set(cls, tag);
+                }
+                else {
+                    this.fallback.push(tag);
+                }
+            }
+        }
+    }
+    getTags() {
+        return this.tags;
+    }
+    /** Match element, its parent, or direct children against known tag selectors */
+    match(el) {
+        const direct = this.matchExact(el);
+        if (direct)
+            return direct;
+        if (el.parentElement) {
+            const parent = this.matchExact(el.parentElement);
+            if (parent)
+                return parent;
+        }
+        const children = el.children;
+        for (let i = 0; i < children.length; i++) {
+            const child = this.matchExact(children[i]);
+            if (child)
+                return child;
+        }
+        return null;
+    }
+    matchExact(el) {
+        if (el.id && this.byId.has(el.id)) {
+            const tag = this.byId.get(el.id);
+            if (safeMatches(el, tag.selector) && matchesLocation(tag))
+                return tag;
+        }
+        if (this.byDataAttr.size > 0) {
+            const attrs = el.attributes;
+            for (let i = 0; i < attrs.length; i++) {
+                const attr = attrs[i];
+                if (attr.name.startsWith('data-')) {
+                    const key = `[${attr.name}="${attr.value}"]`;
+                    if (this.byDataAttr.has(key)) {
+                        const tag = this.byDataAttr.get(key);
+                        if (safeMatches(el, tag.selector) && matchesLocation(tag))
+                            return tag;
+                    }
+                }
+            }
+        }
+        if (this.byClass.size > 0 && el.classList) {
+            for (let i = 0; i < el.classList.length; i++) {
+                const cls = el.classList[i];
+                if (this.byClass.has(cls)) {
+                    const tag = this.byClass.get(cls);
+                    if (safeMatches(el, tag.selector) && matchesLocation(tag))
+                        return tag;
+                }
+            }
+        }
+        for (const tag of this.fallback) {
+            if (safeMatches(el, tag.selector) && matchesLocation(tag))
+                return tag;
+        }
+        return null;
+    }
+    clear() {
+        this.tags = [];
+        this.byId.clear();
+        this.byDataAttr.clear();
+        this.byClass.clear();
+        this.fallback = [];
+    }
+}
+/** Last combinator-separated segment of a CSS selector */
+function lastSegment(selector) {
+    const trimmed = selector.trim();
+    if (!trimmed)
+        return null;
+    const parts = trimmed.split(/\s*[>+~ ]\s*/);
+    const last = parts[parts.length - 1]?.trim();
+    return last || null;
+}
+/** First class name from a selector segment, e.g. "div.my-class" -> "my-class" */
+function extractClass(segment) {
+    const match = segment.match(/\.([a-zA-Z_-][\w-]*)/);
+    return match ? match[1] : null;
+}
+function safeMatches(el, selector) {
+    try {
+        return el.matches(selector);
+    }
+    catch {
+        return false;
+    }
+}
+function matchesLocation(tag) {
+    if (!tag.location)
+        return true;
+    try {
+        const loc = tag.location;
+        if (loc.startsWith('/')) {
+            return window.location.pathname === loc;
+        }
+        return window.location.href === loc;
+    }
+    catch {
+        return true;
+    }
+}
+
 const WATCHED_MARKERS_KEY = '__or__watched_markers__';
 class MarkerWatcher {
     constructor(params) {
         this.interval = null;
         this.tags = [];
+        this.matcher = new TagMatcher();
         this.sessionStorage = params.sessionStorage;
         this.errLog = params.errLog;
         this.onMarkerHit = params.onMarkerHit;
@@ -2277,12 +1802,15 @@ class MarkerWatcher {
     }
     setTags(tags) {
         this.tags = tags;
+        this.matcher.setTags(tags);
         if (this.interval) {
             clearInterval(this.interval);
             this.interval = null;
         }
         this.interval = setInterval(() => {
             this.tags.forEach((tag) => {
+                if (!matchesLocation(tag))
+                    return;
                 const possibleEls = document.querySelectorAll(tag.selector);
                 if (possibleEls.length > 0) {
                     const el = possibleEls[0];
@@ -2294,13 +1822,17 @@ class MarkerWatcher {
         }, 500);
     }
     onMarkerRendered(markerId) {
-        if (this.tags.findIndex(t => t.id === markerId)) {
-            this.tags = this.tags.filter((tag) => tag.id !== markerId);
+        const tag = this.tags.find((t) => t.id === markerId);
+        if (tag) {
+            this.tags = this.tags.filter((t) => t.id !== markerId);
+            if (!matchesLocation(tag))
+                return;
         }
         this.onMarkerHit(markerId);
     }
     clear() {
         this.tags = [];
+        this.matcher.clear();
         if (this.interval) {
             clearInterval(this.interval);
             this.interval = null;
@@ -2349,8 +1881,34 @@ class CanvasRecorder {
         this.uploadQueue = 0;
         this.MAX_CONCURRENT_UPLOADS = 2;
         this.MAX_QUEUE_SIZE = 50; // ~500 images max (50 batches × 10 images)
+        this.MAX_UPLOAD_ATTEMPTS = 5;
+        this.MAX_RETRY_DELAY_MS = 10000;
         this.pendingBatches = [];
         this.isProcessingQueue = false;
+        /**
+         * Reacts to a runtime sanitization change on a canvas: stop capturing if it
+         * just became masked, start if it just became visible. Already-sent frames
+         * cannot be retracted, so escalation only stops future capture.
+         */
+        this.resanitizeCanvas = (node, id) => {
+            if (!hasTag(node, 'canvas')) {
+                return;
+            }
+            const isIgnored = this.app.sanitizer.isObscured(id) || this.app.sanitizer.isHidden(id);
+            if (isIgnored) {
+                if (this.snapshots[id] || this.observers.has(id)) {
+                    const observer = this.observers.get(id);
+                    if (observer) {
+                        observer.disconnect();
+                        this.observers.delete(id);
+                    }
+                    this.cleanupCanvas(id);
+                }
+            }
+            else if (!this.snapshots[id] && !this.observers.has(id)) {
+                this.captureCanvas(node);
+            }
+        };
         this.restartTracking = () => {
             this.clear();
             this.app.nodes.scanTree(this.captureCanvas);
@@ -2447,14 +2005,15 @@ class CanvasRecorder {
             }, this.interval);
             this.intervals.set(id, int);
         };
-        this.fileExt = options.fileExt ?? 'webp';
+        this.fileExt = 'webp';
         this.interval = 1000 / options.fps;
     }
     startTracking() {
         setTimeout(() => {
             this.app.nodes.scanTree(this.captureCanvas);
             this.app.nodes.attachNodeCallback(this.captureCanvas);
-        }, 250);
+            this.app.attachResanitizeCallback(this.resanitizeCanvas);
+        }, 125);
     }
     sendSnaps(images, canvasId, createdAt) {
         if (Object.keys(this.snapshots).length === 0) {
@@ -2464,37 +2023,111 @@ class CanvasRecorder {
             this.app.debug.warn('Upload queue full, dropping canvas batch');
             return;
         }
-        this.pendingBatches.push({ images, canvasId, createdAt });
+        const token = this.app.session.getSessionSecret();
+        if (!token) {
+            this.app.debug.warn('Canvas batch has no session token');
+            return;
+        }
+        this.pendingBatches.push({ images, canvasId, createdAt, token });
         if (!this.isProcessingQueue) {
-            this.processUploadQueue();
+            void this.processUploadQueue();
         }
     }
     async processUploadQueue() {
+        if (this.isProcessingQueue)
+            return;
         this.isProcessingQueue = true;
-        while (this.pendingBatches.length > 0) {
-            if (this.uploadQueue >= this.MAX_CONCURRENT_UPLOADS) {
-                await new Promise((resolve) => setTimeout(resolve, 100));
-                continue;
+        const worker = async () => {
+            while (true) {
+                const batch = this.pendingBatches.shift();
+                if (!batch)
+                    return;
+                await this.uploadBatch(batch.images, batch.canvasId, batch.createdAt, batch.token);
             }
-            const batch = this.pendingBatches.shift();
-            if (!batch)
-                break;
-            this.uploadBatch(batch.images, batch.canvasId, batch.createdAt);
+        };
+        try {
+            await Promise.all(Array.from({ length: this.MAX_CONCURRENT_UPLOADS }, () => worker()));
+        }
+        finally {
+            this.isProcessingQueue = false;
+            // A batch can be appended between the final worker check and the flag
+            // reset. Restart once so that race cannot strand queued frames.
+            if (this.pendingBatches.length > 0) {
+                void this.processUploadQueue();
+            }
+        }
+    }
+    async uploadBatch(images, canvasId, createdAt, token) {
+        if (this.options.isDebug) {
+            const packed = await packFrames(images);
+            if (packed) {
+                const fileName = `${createdAt}_${canvasId}.${this.fileExt}.frames`;
+                const url = URL.createObjectURL(new Blob([packed]));
+                const link = document.createElement('a');
+                link.href = url;
+                link.download = fileName;
+                link.style.display = 'none';
+                document.body.appendChild(link);
+                link.click();
+                document.body.removeChild(link);
+                URL.revokeObjectURL(url);
+            }
+            // fall through to also send to backend
+        }
+        let formData;
+        if (this.options.framesSupport) {
+            // Pack frames into binary format: [uint64 LE timestamp][uint32 LE size][data] per frame
+            const buffers = [];
+            let totalSize = 0;
+            for (const snapshot of images) {
+                if (!snapshot.data)
+                    continue;
+                const ab = await snapshot.data.arrayBuffer();
+                buffers.push(ab);
+                totalSize += 8 + 4 + ab.byteLength; // uint64 ts + uint32 size + data
+            }
+            if (totalSize === 0)
+                return;
+            const packed = new ArrayBuffer(totalSize);
+            const view = new DataView(packed);
+            const bytes = new Uint8Array(packed);
+            let offset = 0;
+            for (let i = 0; i < images.length; i++) {
+                if (!images[i].data)
+                    continue;
+                const ab = buffers.shift();
+                const ts = images[i].id;
+                // uint64 LE as two uint32 LE writes -- timestamp
+                view.setUint32(offset, ts % 0x100000000, true);
+                view.setUint32(offset + 4, Math.floor(ts / 0x100000000), true);
+                offset += 8;
+                // uint32 LE -- size
+                view.setUint32(offset, ab.byteLength, true);
+                offset += 4;
+                // image data
+                bytes.set(new Uint8Array(ab), offset);
+                offset += ab.byteLength;
+            }
+            formData = new FormData();
+            formData.append('type', 'frames');
+            const fileName = `${createdAt}_${canvasId}.${this.fileExt}.frames`;
+            formData.append('frames', new Blob([packed]), fileName);
         }
-        this.isProcessingQueue = false;
-    }
-    uploadBatch(images, canvasId, createdAt) {
-        const formData = new FormData();
-        images.forEach((snapshot) => {
-            const blob = snapshot.data;
-            if (!blob)
+        else {
+            // Legacy: send individual image files
+            formData = new FormData();
+            images.forEach((snapshot) => {
+                const blob = snapshot.data;
+                if (!blob)
+                    return;
+                const name = `${createdAt}_${canvasId}_${snapshot.id}.${this.fileExt}`;
+                formData.append('snapshot', blob, name);
+            });
+        }
+        const initRestart = () => {
+            if (this.app.session.getSessionSecret() !== token) {
                 return;
-            formData.append('snapshot', blob, `${createdAt}_${canvasId}_${snapshot.id}.${this.fileExt}`);
-            if (this.options.isDebug) {
-                saveImageData(blob, `${createdAt}_${canvasId}_${snapshot.id}.${this.fileExt}`);
             }
-        });
-        const initRestart = () => {
             this.app.debug.log('Restarting tracker; token expired');
             this.app.stop(false);
             setTimeout(() => {
@@ -2504,25 +2137,72 @@ class CanvasRecorder {
         this.uploadQueue++;
         const base = this.app.options.endpoint.replace(/\/$/, '');
         const ingestPoint = base.endsWith('/oxvo') ? base : `${base}/oxvo`;
-        fetch(ingestPoint + '/v1/assets', {
-            method: 'POST',
-            headers: {
-                Authorization: `Bearer ${this.app.session.getSessionSecret() ?? ''}`,
-            },
-            body: formData,
-        })
-            .then((r) => {
-            if (r.status === 401) {
-                return initRestart();
+        try {
+            for (let attempt = 1; attempt <= this.MAX_UPLOAD_ATTEMPTS; attempt++) {
+                try {
+                    const response = await fetch(ingestPoint + '/v1/assets', {
+                        method: 'POST',
+                        headers: {
+                            Authorization: `Bearer ${token}`,
+                        },
+                        body: formData,
+                    });
+                    if (response.ok)
+                        return;
+                    if (response.status === 401) {
+                        initRestart();
+                        return;
+                    }
+                    if (response.status === 413) {
+                        this.app.debug.warn('Canvas batch exceeds the upload size limit');
+                        return;
+                    }
+                    if (!this.isRetryableUploadStatus(response.status)) {
+                        this.app.debug.error(`Canvas upload failed with status ${response.status}`);
+                        return;
+                    }
+                    if (attempt === this.MAX_UPLOAD_ATTEMPTS) {
+                        this.app.debug.error(`Canvas upload failed after ${attempt} attempts (status ${response.status})`);
+                        return;
+                    }
+                    await this.waitBeforeUploadRetry(response, attempt);
+                }
+                catch (error) {
+                    if (attempt === this.MAX_UPLOAD_ATTEMPTS) {
+                        this.app.debug.error('Canvas upload failed after retrying', error);
+                        return;
+                    }
+                    await this.waitBeforeUploadRetry(undefined, attempt);
+                }
             }
-            return true;
-        })
-            .catch((e) => {
-            this.app.debug.error('error saving canvas', e);
-        })
-            .finally(() => {
+        }
+        finally {
             this.uploadQueue--;
-        });
+        }
+    }
+    isRetryableUploadStatus(status) {
+        return status === 429 || status === 408 || status >= 500;
+    }
+    async waitBeforeUploadRetry(response, attempt) {
+        const retryAfter = response?.headers.get('Retry-After');
+        let retryDelayMs = 0;
+        if (retryAfter) {
+            const seconds = Number(retryAfter);
+            if (Number.isFinite(seconds) && seconds >= 0) {
+                retryDelayMs = seconds * 1000;
+            }
+            else {
+                const retryAt = Date.parse(retryAfter);
+                if (Number.isFinite(retryAt)) {
+                    retryDelayMs = Math.max(0, retryAt - Date.now());
+                }
+            }
+        }
+        if (retryDelayMs === 0) {
+            retryDelayMs = 250 * 2 ** (attempt - 1);
+        }
+        retryDelayMs = Math.min(retryDelayMs, this.MAX_RETRY_DELAY_MS);
+        await new Promise((resolve) => setTimeout(resolve, retryDelayMs));
     }
     cleanupCanvas(id) {
         if (this.snapshots[id]) {
@@ -2545,8 +2225,7 @@ class CanvasRecorder {
         }
         delete this.snapshots[id];
     }
-    clear() {
-        // Flush remaining images before cleanup
+    flushPendingSnapshots() {
         Object.keys(this.snapshots).forEach((idStr) => {
             const id = parseInt(idStr, 10);
             const snapshot = this.snapshots[id];
@@ -2555,6 +2234,9 @@ class CanvasRecorder {
                 snapshot.images = [];
             }
         });
+    }
+    clear() {
+        this.flushPendingSnapshots();
         Object.keys(this.snapshots).forEach((idStr) => {
             const id = parseInt(idStr, 10);
             this.cleanupCanvas(id);
@@ -2589,40 +2271,346 @@ function captureSnapshot(canvas, quality = 'medium', dummy, fixedScaling = false
         canvas.toBlob(onBlob, imageFormat, qualityInt[quality]);
     }
 }
-function saveImageData(imageDataBlob, name) {
-    const imageDataUrl = URL.createObjectURL(imageDataBlob);
-    const link = document.createElement('a');
-    link.href = imageDataUrl;
-    link.download = name;
-    link.style.display = 'none';
-    document.body.appendChild(link);
-    link.click();
-    document.body.removeChild(link);
+async function packFrames(images) {
+    const buffers = [];
+    let totalSize = 0;
+    for (const snapshot of images) {
+        if (!snapshot.data)
+            continue;
+        const ab = await snapshot.data.arrayBuffer();
+        buffers.push(ab);
+        totalSize += 8 + 4 + ab.byteLength;
+    }
+    if (totalSize === 0)
+        return null;
+    const packed = new ArrayBuffer(totalSize);
+    const view = new DataView(packed);
+    const bytes = new Uint8Array(packed);
+    let offset = 0;
+    for (let i = 0; i < images.length; i++) {
+        if (!images[i].data)
+            continue;
+        const ab = buffers.shift();
+        const ts = images[i].id;
+        view.setUint32(offset, ts % 0x100000000, true);
+        view.setUint32(offset + 4, Math.floor(ts / 0x100000000), true);
+        offset += 8;
+        view.setUint32(offset, ab.byteLength, true);
+        offset += 4;
+        bytes.set(new Uint8Array(ab), offset);
+        offset += ab.byteLength;
+    }
+    return packed;
 }
 
-const LogLevel = {
-    Verbose: 5,
-    Log: 4,
-    Warnings: 3,
-    Errors: 2,
-    Silent: 0,
-};
-class Logger {
-    constructor(debugLevel = LogLevel.Silent) {
-        this.shouldLog = (level) => {
-            return this.level >= level;
-        };
-        this.info = (...args) => {
-            if (this.shouldLog(LogLevel.Verbose)) {
-                // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
-                console.info(...args);
-            }
-        };
-        this.log = (...args) => {
-            if (this.shouldLog(LogLevel.Log)) {
-                // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
-                console.log(...args);
-            }
+const CROSS_DOMAIN_IFRAME_PROTOCOL_VERSION = 1;
+const SECRET_PATTERN = /^[A-Za-z0-9_-]{32,128}$/;
+const CONTEXT_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+const MAX_MESSAGE_FIELDS = 24;
+const MAX_MESSAGE_STRING_LENGTH = 100000;
+const MAX_BATCH_MESSAGES = 25000;
+const MAX_BATCH_BYTES = 2 * 1024 * 1024;
+// Cross-frame batches may contain only recording events. Identity, dictionary,
+// batch-header, and tab/session control opcodes remain owned by the top-level
+// tracker.
+const CROSS_DOMAIN_IFRAME_ALLOWED_MESSAGE_TYPES = new Set([
+    4 /* MType.SetPageLocationDeprecated */,
+    5 /* MType.SetViewportSize */,
+    6 /* MType.SetViewportScroll */,
+    7 /* MType.CreateDocument */,
+    8 /* MType.CreateElementNode */,
+    9 /* MType.CreateTextNode */,
+    10 /* MType.MoveNode */,
+    11 /* MType.RemoveNode */,
+    12 /* MType.SetNodeAttribute */,
+    13 /* MType.RemoveNodeAttribute */,
+    14 /* MType.SetNodeData */,
+    16 /* MType.SetNodeScroll */,
+    17 /* MType.SetInputTarget */,
+    18 /* MType.SetInputValue */,
+    19 /* MType.SetInputChecked */,
+    20 /* MType.MouseMove */,
+    21 /* MType.NetworkRequestDeprecated */,
+    22 /* MType.ConsoleLog */,
+    23 /* MType.PageLoadTiming */,
+    24 /* MType.PageRenderTiming */,
+    27 /* MType.CustomEvent */,
+    36 /* MType.NodeAnimationResult */,
+    40 /* MType.Profiler */,
+    41 /* MType.OTable */,
+    42 /* MType.StateAction */,
+    44 /* MType.ReduxDeprecated */,
+    45 /* MType.Vuex */,
+    46 /* MType.MobX */,
+    47 /* MType.NgRx */,
+    48 /* MType.GraphQLDeprecated */,
+    49 /* MType.PerformanceTrack */,
+    53 /* MType.ResourceTimingDeprecatedDeprecated */,
+    54 /* MType.ConnectionInformation */,
+    55 /* MType.SetPageVisibility */,
+    57 /* MType.LoadFontFace */,
+    58 /* MType.SetNodeFocus */,
+    60 /* MType.SetNodeAttributeURLBased */,
+    61 /* MType.SetCSSDataURLBased */,
+    63 /* MType.TechnicalInfo */,
+    64 /* MType.CustomIssue */,
+    65 /* MType.SetNodeSlot */,
+    68 /* MType.MouseClick */,
+    69 /* MType.MouseClickDeprecated */,
+    70 /* MType.CreateIFrameDocument */,
+    71 /* MType.AdoptedSSReplaceURLBased */,
+    73 /* MType.AdoptedSSInsertRuleURLBased */,
+    75 /* MType.AdoptedSSDeleteRule */,
+    76 /* MType.AdoptedSSAddOwner */,
+    77 /* MType.AdoptedSSRemoveOwner */,
+    78 /* MType.JSException */,
+    79 /* MType.Zustand */,
+    83 /* MType.NetworkRequest */,
+    84 /* MType.WSChannel */,
+    85 /* MType.ResourceTiming */,
+    87 /* MType.Incident */,
+    89 /* MType.LongAnimationTask */,
+    112 /* MType.InputChange */,
+    113 /* MType.SelectionChange */,
+    114 /* MType.MouseThrashing */,
+    115 /* MType.UnbindNodes */,
+    116 /* MType.ResourceTimingDeprecated */,
+    119 /* MType.CanvasNode */,
+    120 /* MType.TagTrigger */,
+    121 /* MType.Redux */,
+    122 /* MType.SetPageLocation */,
+    123 /* MType.GraphQL */,
+    124 /* MType.WebVitals */,
+]);
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const isFiniteNumber = (value) => typeof value === 'number' && Number.isFinite(value);
+const isSafeIntegerAtLeast = (value, minimum) => typeof value === 'number' && Number.isSafeInteger(value) && value >= minimum;
+const isBoundedString = (value, maxLength) => typeof value === 'string' && value.length > 0 && value.length <= maxLength;
+const isCanvasQuality = (value) => value === 'low' || value === 'medium' || value === 'high';
+function normalizeCrossDomainOrigin(value) {
+    if (typeof value !== 'string' || value.trim() === '' || value.trim() === '*') {
+        return null;
+    }
+    try {
+        const url = new URL(value.trim());
+        if (!['http:', 'https:'].includes(url.protocol) ||
+            url.origin === 'null' ||
+            url.username !== '' ||
+            url.password !== '' ||
+            (url.pathname !== '' && url.pathname !== '/') ||
+            url.search !== '' ||
+            url.hash !== '') {
+            return null;
+        }
+        return url.origin;
+    }
+    catch {
+        return null;
+    }
+}
+function normalizeCrossDomainOrigins(values) {
+    if (!Array.isArray(values)) {
+        return new Set();
+    }
+    return new Set(values.map(normalizeCrossDomainOrigin).filter((origin) => origin !== null));
+}
+function createCrossDomainSecret() {
+    if (!globalThis.crypto?.getRandomValues) {
+        return null;
+    }
+    const bytes = new Uint8Array(24);
+    globalThis.crypto.getRandomValues(bytes);
+    return Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join('');
+}
+function parseCrossDomainHandshake(data, expectedLine, expectedProjectKey) {
+    if (!isRecord(data) ||
+        data.line !== expectedLine ||
+        data.protocolVersion !== CROSS_DOMAIN_IFRAME_PROTOCOL_VERSION ||
+        data.projectKey !== expectedProjectKey ||
+        !isBoundedString(data.context, 128) ||
+        !CONTEXT_PATTERN.test(data.context) ||
+        !isBoundedString(data.nonce, 128) ||
+        !SECRET_PATTERN.test(data.nonce)) {
+        return null;
+    }
+    return {
+        protocolVersion: CROSS_DOMAIN_IFRAME_PROTOCOL_VERSION,
+        context: data.context,
+        nonce: data.nonce,
+        projectKey: expectedProjectKey,
+    };
+}
+function matchesCrossDomainEnvelope(data, expectedLine, expected) {
+    return (isRecord(data) &&
+        data.line === expectedLine &&
+        data.protocolVersion === CROSS_DOMAIN_IFRAME_PROTOCOL_VERSION &&
+        data.context === expected.context &&
+        data.nonce === expected.nonce &&
+        data.capability === expected.capability);
+}
+function parseCrossDomainFrameInit(data, expectedLine, expected) {
+    if (!isRecord(data) ||
+        data.line !== expectedLine ||
+        data.protocolVersion !== CROSS_DOMAIN_IFRAME_PROTOCOL_VERSION ||
+        data.context !== expected.context ||
+        data.nonce !== expected.nonce ||
+        !isBoundedString(data.capability, 128) ||
+        !SECRET_PATTERN.test(data.capability) ||
+        !isSafeIntegerAtLeast(data.id, 0) ||
+        !isSafeIntegerAtLeast(data.frameOrderNumber, 1) ||
+        !isSafeIntegerAtLeast(data.frameLevel, 0) ||
+        !isSafeIntegerAtLeast(data.capabilityExpiresAt, 1) ||
+        data.capabilityExpiresAt <= Date.now() ||
+        !isRecord(data.session)) {
+        return null;
+    }
+    const session = data.session;
+    if (!isBoundedString(session.sessionID, 256) ||
+        !isFiniteNumber(session.startedAt) ||
+        !isFiniteNumber(session.delayMs) ||
+        typeof session.userUUID !== 'string' ||
+        session.userUUID.length > 256) {
+        return null;
+    }
+    let projectID;
+    if (session.projectID !== undefined) {
+        if (!isBoundedString(session.projectID, 256)) {
+            return null;
+        }
+        projectID = session.projectID;
+    }
+    const canvas = parseCanvasConfig(data.canvas);
+    if (data.canvas !== undefined && canvas === null) {
+        return null;
+    }
+    return {
+        protocolVersion: CROSS_DOMAIN_IFRAME_PROTOCOL_VERSION,
+        context: data.context,
+        nonce: data.nonce,
+        capability: data.capability,
+        id: data.id,
+        frameOrderNumber: data.frameOrderNumber,
+        frameLevel: data.frameLevel,
+        capabilityExpiresAt: data.capabilityExpiresAt,
+        session: {
+            sessionID: session.sessionID,
+            projectID,
+            startedAt: session.startedAt,
+            delayMs: session.delayMs,
+            userUUID: session.userUUID,
+        },
+        ...(canvas ? { canvas } : {}),
+    };
+}
+function parseCanvasConfig(value) {
+    if (value === undefined) {
+        return null;
+    }
+    if (!isRecord(value) || typeof value.enabled !== 'boolean') {
+        return null;
+    }
+    let quality;
+    if (value.quality !== undefined) {
+        if (!isCanvasQuality(value.quality)) {
+            return null;
+        }
+        quality = value.quality;
+    }
+    let fps;
+    if (value.fps !== undefined) {
+        if (!isFiniteNumber(value.fps)) {
+            return null;
+        }
+        fps = value.fps;
+    }
+    let framesSupport;
+    if (value.framesSupport !== undefined) {
+        if (typeof value.framesSupport !== 'boolean') {
+            return null;
+        }
+        framesSupport = value.framesSupport;
+    }
+    return {
+        enabled: value.enabled,
+        quality,
+        fps,
+        framesSupport,
+    };
+}
+function parseCrossDomainIframeBatch(messages) {
+    if (!Array.isArray(messages) || messages.length > MAX_BATCH_MESSAGES) {
+        return null;
+    }
+    let bytes = 0;
+    for (const message of messages) {
+        if (!Array.isArray(message) || message.length < 1 || message.length > MAX_MESSAGE_FIELDS) {
+            return null;
+        }
+        const messageType = message[0];
+        if (typeof messageType !== 'number' ||
+            !Number.isInteger(messageType) ||
+            !CROSS_DOMAIN_IFRAME_ALLOWED_MESSAGE_TYPES.has(messageType)) {
+            return null;
+        }
+        const expectedFieldTypes = MESSAGE_FIELD_TYPES[messageType];
+        if (expectedFieldTypes === undefined || message.length !== expectedFieldTypes.length + 1) {
+            return null;
+        }
+        bytes += 8;
+        for (let fieldIndex = 0; fieldIndex < expectedFieldTypes.length; fieldIndex++) {
+            const field = message[fieldIndex + 1];
+            if (typeof field !== expectedFieldTypes[fieldIndex]) {
+                return null;
+            }
+            if (typeof field === 'string') {
+                if (field.length > MAX_MESSAGE_STRING_LENGTH) {
+                    return null;
+                }
+                bytes += field.length * 3;
+            }
+            else if (typeof field === 'number') {
+                if (!Number.isFinite(field)) {
+                    return null;
+                }
+                bytes += 8;
+            }
+            else if (typeof field === 'boolean') {
+                bytes += 1;
+            }
+            else {
+                return null;
+            }
+            if (bytes > MAX_BATCH_BYTES) {
+                return null;
+            }
+        }
+    }
+    return { messages: messages, bytes };
+}
+
+const LogLevel = {
+    Verbose: 5,
+    Log: 4,
+    Warnings: 3,
+    Errors: 2,
+    Silent: 0,
+};
+class Logger {
+    constructor(debugLevel = LogLevel.Silent) {
+        this.shouldLog = (level) => {
+            return this.level >= level;
+        };
+        this.info = (...args) => {
+            if (this.shouldLog(LogLevel.Verbose)) {
+                // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
+                console.info(...args);
+            }
+        };
+        this.log = (...args) => {
+            if (this.shouldLog(LogLevel.Log)) {
+                // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
+                console.log(...args);
+            }
         };
         this.warn = (...args) => {
             if (this.shouldLog(LogLevel.Warnings)) {
@@ -2878,8 +2866,44 @@ function inlineRemoteCss(node, id, baseHref, getNextID, insertRule, addOwner, fo
         })
             .catch(error => {
             console.error(`OxvoSessions: Failed to fetch CSS from ${node.href}:`, error);
+            // Fetch failed, likely due to CORS. Retry via load event and sheet access.
+            retryViaLoadEvent();
         });
     }
+    else {
+        retryViaLoadEvent();
+    }
+    function retryViaLoadEvent() {
+        const trySheet = () => {
+            const loadedSheet = node.sheet;
+            if (loadedSheet) {
+                try {
+                    const cssText = stringifyStylesheet(loadedSheet);
+                    if (cssText) {
+                        if (sendPlain && onPlain) {
+                            onPlain(cssText, fakeIdHolder++);
+                        }
+                        else {
+                            processCssText(cssText);
+                        }
+                        return;
+                    }
+                }
+                catch (e) {
+                    // Cross-origin sheet. Nothing more can be read safely here.
+                }
+            }
+        };
+        if (node.sheet) {
+            trySheet();
+        }
+        else {
+            node.addEventListener('load', function onLoad() {
+                node.removeEventListener('load', onLoad);
+                trySheet();
+            });
+        }
+    }
     function processCssText(cssText) {
         // Remove comments
         cssText = cssText.replace(/\/\*[\s\S]*?\*\//g, '');
@@ -3101,7 +3125,6 @@ function ConstructedStyleSheets (app) {
     if (!hasAdoptedSS(document)) {
         return;
     }
-    const styleSheetIDMap = new Map();
     const adoptedStyleSheetsOwnings = new Map();
     const sendAdoptedStyleSheetsUpdate = (root) => setTimeout(() => {
         let nodeID = app.nodes.getID(root);
@@ -3215,6 +3238,119 @@ function ConstructedStyleSheets (app) {
     });
 }
 
+var SanitizeLevel;
+(function (SanitizeLevel) {
+    SanitizeLevel[SanitizeLevel["Plain"] = 0] = "Plain";
+    SanitizeLevel[SanitizeLevel["Obscured"] = 1] = "Obscured";
+    SanitizeLevel[SanitizeLevel["Hidden"] = 2] = "Hidden";
+})(SanitizeLevel || (SanitizeLevel = {}));
+const stringWiper = (input) => input
+    .trim()
+    .replace(/[^\f\n\r\t\v\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff\s]/g, '*');
+class Sanitizer {
+    constructor(params) {
+        // Node id -> level. Plain (0) is never stored; a missing entry means Plain.
+        // A map (not the old grow-only Sets) so levels can be raised and lowered.
+        this.levels = new Map();
+        this.app = params.app;
+        const defaultOptions = {
+            maskTextEmails: true,
+            maskTextNumbers: false,
+            maskAllByDefault: false,
+            domSanitizer: undefined,
+        };
+        this.maskAllByDefault = params.options?.maskAllByDefault ?? false;
+        this.options = Object.assign(defaultOptions, params.options);
+    }
+    // Pure recomputation of a node's level from the live DOM + parent level.
+    // Reading current state on every call lets resanitize() pick up runtime changes.
+    computeLevel(node, parentLevel) {
+        if (this.options.maskAllByDefault) {
+            if (isElementNode(node) && !hasOxvoSessionsAttribute(node, 'unmask')) {
+                return SanitizeLevel.Obscured;
+            }
+            if (isTextNode(node) && !hasOxvoSessionsAttribute(node.parentNode, 'unmask')) {
+                return SanitizeLevel.Obscured;
+            }
+        }
+        let level = SanitizeLevel.Plain;
+        if (parentLevel >= SanitizeLevel.Obscured ||
+            (isElementNode(node) &&
+                (hasOxvoSessionsAttribute(node, 'masked') || hasOxvoSessionsAttribute(node, 'obscured')))) {
+            level = SanitizeLevel.Obscured;
+        }
+        if (parentLevel === SanitizeLevel.Hidden ||
+            (isElementNode(node) &&
+                (hasOxvoSessionsAttribute(node, 'htmlmasked') || hasOxvoSessionsAttribute(node, 'hidden')))) {
+            level = SanitizeLevel.Hidden;
+        }
+        if (this.options.domSanitizer !== undefined && isElementNode(node)) {
+            const sanitizeLevel = this.options.domSanitizer(node);
+            if (sanitizeLevel === SanitizeLevel.Obscured && level < SanitizeLevel.Obscured) {
+                level = SanitizeLevel.Obscured;
+            }
+            if (sanitizeLevel === SanitizeLevel.Hidden) {
+                level = SanitizeLevel.Hidden;
+            }
+        }
+        return level;
+    }
+    getLevel(id) {
+        return this.levels.get(id) ?? SanitizeLevel.Plain;
+    }
+    // Sets a node's level in either direction and returns the previous level.
+    setLevel(id, level) {
+        const prev = this.getLevel(id);
+        if (level === SanitizeLevel.Plain) {
+            this.levels.delete(id);
+        }
+        else {
+            this.levels.set(id, level);
+        }
+        return prev;
+    }
+    handleNode(id, parentID, node) {
+        const level = this.computeLevel(node, this.getLevel(parentID));
+        // Escalate-only: commits never lower a level, only resanitize/setLevel do.
+        if (level > this.getLevel(id)) {
+            this.setLevel(id, level);
+        }
+    }
+    sanitize(id, data) {
+        if (this.getLevel(id) >= SanitizeLevel.Obscured) {
+            // TODO: is it the best place to put trim() ? Might trimmed spaces be considered in layout in certain cases?
+            return stringWiper(data);
+        }
+        if (this.options.maskTextNumbers) {
+            data = data.replace(/\d/g, '0');
+        }
+        if (this.options.maskTextEmails) {
+            data = data.replace(/^\w+([+.-]\w+)*@\w+([.-]\w+)*\.\w{2,3}$/g, (email) => {
+                const [name, domain] = email.split('@');
+                const [domainName, host] = domain.split('.');
+                return `${stars(name)}@${stars(domainName)}.${stars(host)}`;
+            });
+        }
+        return data;
+    }
+    isObscured(id) {
+        return this.getLevel(id) >= SanitizeLevel.Obscured;
+    }
+    isHidden(id) {
+        return this.getLevel(id) === SanitizeLevel.Hidden;
+    }
+    getInnerTextSecure(el) {
+        const id = this.app.nodes.getID(el);
+        if (!id) {
+            return '';
+        }
+        return this.sanitize(id, el.innerText);
+    }
+    clear() {
+        this.levels.clear();
+    }
+}
+
 const iconCache = {};
 const svgUrlCache = {};
 async function parseUseEl(useElement, mode, domParser) {
@@ -3366,6 +3502,12 @@ class Observer {
         this.inlineRemoteCss = false;
         this.inlinerOptions = undefined;
         this.domParser = new DOMParser();
+        /**
+         * Bumped on every disconnect(). Stale async CSS-inlining callbacks from a
+         * previous session (e.g. agent reload → tracker restart) compare against
+         * this and bail instead of sending messages that reference vanished node ids.
+         */
+        this.generation = 0;
         this.throttling = true;
         this.throttledSetNodeData = throttleWithTrailing((id, parentElement, data) => this.sendNodeData(id, parentElement, data), 30);
         this.throttling = !Boolean(options.disableThrottling);
@@ -3512,18 +3654,23 @@ class Observer {
         }
         if (name === 'style' || (name === 'href' && hasTag(node, 'link'))) {
             if ('rel' in node && node.rel === 'stylesheet' && this.inlineRemoteCss) {
+                const gen = this.generation;
                 setTimeout(() => {
                     inlineRemoteCss(
                     // @ts-ignore
                     node, id, this.app.getBaseHref(), nextID, (id, cssText, index, baseHref) => {
+                        if (this.generation !== gen)
+                            return;
                         this.app.send(AdoptedSSInsertRuleURLBased(id, cssText, index, baseHref));
                     }, (sheetId, ownerId) => {
+                        if (this.generation !== gen)
+                            return;
                         this.app.send(AdoptedSSAddOwner(sheetId, ownerId));
                     }, this.inlinerOptions?.forceFetch, this.inlinerOptions?.forcePlain, (cssText, fakeTextId) => {
+                        if (this.generation !== gen)
+                            return;
                         this.app.send(CreateTextNode(fakeTextId, id, 0));
-                        setTimeout(() => {
-                            this.app.send(SetCSSDataURLBased(fakeTextId, cssText, this.app.getBaseHref()));
-                        }, 10);
+                        this.app.send(SetCSSDataURLBased(fakeTextId, cssText, this.app.getBaseHref()));
                     });
                 }, 0);
                 return;
@@ -3783,10 +3930,105 @@ class Observer {
         beforeCommit(this.app.nodes.getID(node));
         this.commitNodes(true);
     }
+    /**
+     * Re-evaluates sanitization for every tracked node in `root`'s subtree against
+     * the current DOM and re-emits whatever changed. Pass the highest node you
+     * changed (or the document root) so inherited levels propagate correctly.
+     */
+    resanitizeSubtree(root) {
+        if (!isObservable(root)) {
+            return;
+        }
+        const parent = root.parentNode;
+        const parentId = parent !== null ? this.app.nodes.getID(parent) : undefined;
+        const parentLevel = parentId !== undefined ? this.app.sanitizer.getLevel(parentId) : SanitizeLevel.Plain;
+        this.resanitizeNode(root, parentLevel);
+    }
+    resanitizeNode(node, parentLevel) {
+        if (isIgnored(node)) {
+            return;
+        }
+        const id = this.app.nodes.getID(node);
+        if (id === undefined) {
+            // Untracked (new, or under a hidden ancestor): the live observer handles it.
+            return;
+        }
+        const newLevel = this.app.sanitizer.computeLevel(node, parentLevel);
+        const prevLevel = this.app.sanitizer.getLevel(id);
+        const wasHidden = prevLevel === SanitizeLevel.Hidden;
+        const willHidden = newLevel === SanitizeLevel.Hidden;
+        // Crossing the hidden boundary changes the rendered structure (placeholder vs
+        // real subtree), so rebuild rather than re-emit.
+        if (wasHidden !== willHidden) {
+            this.recreateSubtree(node);
+            return;
+        }
+        if (willHidden) {
+            return;
+        }
+        // Plain <-> Obscured: same structure, only leaf content changes.
+        if (prevLevel !== newLevel) {
+            this.app.sanitizer.setLevel(id, newLevel);
+            this.reemitNode(id, node);
+        }
+        for (let child = node.firstChild; child !== null; child = child.nextSibling) {
+            this.resanitizeNode(child, newLevel);
+        }
+    }
+    // Destroys the node player-side and re-emits its subtree from scratch (new ids)
+    // so it materializes at the freshly-computed level.
+    recreateSubtree(node) {
+        const id = this.app.nodes.getID(node);
+        if (id === undefined) {
+            return;
+        }
+        this.app.send(RemoveNode(id));
+        this.clearSubtreeRegistration(node);
+        this.bindTree(node);
+        this.commitNodes();
+    }
+    clearSubtreeRegistration(node) {
+        const clearOne = (n) => {
+            const oldId = this.app.nodes.getID(n);
+            if (oldId !== undefined) {
+                this.app.sanitizer.setLevel(oldId, SanitizeLevel.Plain);
+            }
+            this.app.nodes.unregisterNode(n);
+        };
+        const walker = document.createTreeWalker(node, NodeFilter.SHOW_ELEMENT + NodeFilter.SHOW_TEXT, {
+            acceptNode: (n) => isIgnored(n) || this.app.nodes.getID(n) === undefined
+                ? NodeFilter.FILTER_REJECT
+                : NodeFilter.FILTER_ACCEPT,
+        }, 
+        // @ts-ignore
+        false);
+        // Collect first, then clear: unregistering mutates the ids the walker reads.
+        const subtree = [];
+        while (walker.nextNode()) {
+            subtree.push(walker.currentNode);
+        }
+        clearOne(node);
+        subtree.forEach(clearOne);
+    }
+    reemitNode(id, node) {
+        if (isTextNode(node)) {
+            const parent = node.parentNode;
+            if (parent !== null && isElementNode(parent)) {
+                // re-runs sanitize() at the level we just set
+                this.sendNodeData(id, parent, node.data);
+            }
+            return;
+        }
+        if (isElementNode(node)) {
+            // inputs/images/canvas re-emit their own payload via registered callbacks
+            this.app.callResanitizeCallbacks(node, id);
+        }
+    }
     disconnect() {
         this.observer.disconnect();
         this.clear();
         this.throttledSetNodeData.clear();
+        this.generation++;
     }
 }
 
@@ -4021,7 +4263,10 @@ class TopObserver extends Observer {
                 this.app.debug.info('doc already observed for', id);
                 return;
             }
-            const observer = new IFrameObserver(this.app, false, {});
+            const observer = new IFrameObserver(this.app, false, {
+                disableSprites: this.options.disableSprites,
+                ...getInlineOptions(this.options.inlineCss, console.warn),
+            });
             this.iframeObservers.set(iframe, observer);
             this.docObservers.set(currentDoc, observer);
             this.iframeObserversArr.push(observer);
@@ -4043,7 +4288,10 @@ class TopObserver extends Observer {
         handle();
     }
     handleShadowRoot(shRoot) {
-        const observer = new ShadowRootObserver(this.app);
+        const observer = new ShadowRootObserver(this.app, false, {
+            disableSprites: this.options.disableSprites,
+            ...getInlineOptions(this.options.inlineCss, console.warn),
+        });
         this.shadowRootObservers.set(shRoot, observer);
         observer.observe(shRoot.host);
     }
@@ -4079,7 +4327,10 @@ class TopObserver extends Observer {
         };
         this.app.nodes.clear();
         this.app.nodes.crossdomainMode(frameLevel, frameOder);
-        const iframeObserver = new IFrameObserver(this.app);
+        const iframeObserver = new IFrameObserver(this.app, false, {
+            disableSprites: this.options.disableSprites,
+            ...getInlineOptions(this.options.inlineCss, console.warn),
+        });
         this.iframeObservers.set(window.document, iframeObserver);
         iframeObserver.syntheticObserve(rootNodeId, window.document);
     }
@@ -4095,94 +4346,6 @@ class TopObserver extends Observer {
     }
 }
 
-var SanitizeLevel;
-(function (SanitizeLevel) {
-    SanitizeLevel[SanitizeLevel["Plain"] = 0] = "Plain";
-    SanitizeLevel[SanitizeLevel["Obscured"] = 1] = "Obscured";
-    SanitizeLevel[SanitizeLevel["Hidden"] = 2] = "Hidden";
-})(SanitizeLevel || (SanitizeLevel = {}));
-const stringWiper = (input) => input
-    .trim()
-    .replace(/[^\f\n\r\t\v\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff\s]/g, '*');
-class Sanitizer {
-    constructor(params) {
-        this.obscured = new Set();
-        this.hidden = new Set();
-        this.app = params.app;
-        const defaultOptions = {
-            maskTextEmails: true,
-            maskTextNumbers: false,
-            maskAllByDefault: false,
-            domSanitizer: undefined,
-        };
-        this.maskAllByDefault = params.options?.maskAllByDefault ?? false;
-        this.options = Object.assign(defaultOptions, params.options);
-    }
-    handleNode(id, parentID, node) {
-        if (this.options.maskAllByDefault) {
-            if (isElementNode(node) && !hasOxvoSessionsAttribute(node, 'unmask')) {
-                return this.obscured.add(id);
-            }
-            if (isTextNode(node) && !hasOxvoSessionsAttribute(node.parentNode, 'unmask')) {
-                return this.obscured.add(id);
-            }
-        }
-        if (this.obscured.has(parentID) ||
-            (isElementNode(node) &&
-                (hasOxvoSessionsAttribute(node, 'masked') || hasOxvoSessionsAttribute(node, 'obscured')))) {
-            this.obscured.add(id);
-        }
-        if (this.hidden.has(parentID) ||
-            (isElementNode(node) &&
-                (hasOxvoSessionsAttribute(node, 'htmlmasked') || hasOxvoSessionsAttribute(node, 'hidden')))) {
-            this.hidden.add(id);
-        }
-        if (this.options.domSanitizer !== undefined && isElementNode(node)) {
-            const sanitizeLevel = this.options.domSanitizer(node);
-            if (sanitizeLevel === SanitizeLevel.Obscured) {
-                this.obscured.add(id);
-            }
-            if (sanitizeLevel === SanitizeLevel.Hidden) {
-                this.hidden.add(id);
-            }
-        }
-    }
-    sanitize(id, data) {
-        if (this.obscured.has(id)) {
-            // TODO: is it the best place to put trim() ? Might trimmed spaces be considered in layout in certain cases?
-            return stringWiper(data);
-        }
-        if (this.options.maskTextNumbers) {
-            data = data.replace(/\d/g, '0');
-        }
-        if (this.options.maskTextEmails) {
-            data = data.replace(/^\w+([+.-]\w+)*@\w+([.-]\w+)*\.\w{2,3}$/g, (email) => {
-                const [name, domain] = email.split('@');
-                const [domainName, host] = domain.split('.');
-                return `${stars(name)}@${stars(domainName)}.${stars(host)}`;
-            });
-        }
-        return data;
-    }
-    isObscured(id) {
-        return this.obscured.has(id);
-    }
-    isHidden(id) {
-        return this.hidden.has(id);
-    }
-    getInnerTextSecure(el) {
-        const id = this.app.nodes.getID(el);
-        if (!id) {
-            return '';
-        }
-        return this.sanitize(id, el.innerText);
-    }
-    clear() {
-        this.obscured.clear();
-        this.hidden.clear();
-    }
-}
-
 const tokenSeparator = '_$_';
 class Session {
     constructor(params) {
@@ -4228,6 +4391,10 @@ class Session {
             this.token = `${token}${tokenSeparator}${projectKey}`;
             this.app.sessionStorage.setItem(this.options.session_token_key, `${token}${tokenSeparator}${projectKey}`);
         };
+        this.clearSessionSecret = () => {
+            this.token = undefined;
+            this.app.sessionStorage.removeItem(this.options.session_token_key);
+        };
         this.app = params.app;
         this.options = params.options;
         this.createTabId();
@@ -4324,7 +4491,7 @@ class Session {
         };
     }
     reset() {
-        this.app.sessionStorage.removeItem(this.options.session_token_key);
+        this.clearSessionSecret();
         this.metadata = {};
         this.userID = null;
         this.sessionID = undefined;
@@ -4382,9 +4549,12 @@ class Ticker {
  * this value is injected during build time via rollup
  * */
 // @ts-ignore
-const workerBodyFn = "!function(){\"use strict\";class t{constructor(t,s,i,e=10,n=250,h,r){this.onUnauthorised=s,this.onFailure=i,this.MAX_ATTEMPTS_COUNT=e,this.ATTEMPT_TIMEOUT=n,this.onCompress=h,this.pageNo=r,this.attemptsCount=0,this.busy=!1,this.queue=[],this.token=null,this.lastBatchNum=0,this.ingestURL=t+\"/v1/events\",this.isCompressing=void 0!==h}getQueueStatus(){return 0===this.queue.length&&!this.busy}authorise(t){this.token=t,this.busy||this.sendNext()}push(t){if(this.busy||!this.token)this.queue.push(t);else if(this.busy=!0,this.isCompressing&&this.onCompress)this.onCompress(t);else{const s=++this.lastBatchNum;this.sendBatch(t,!1,s)}}sendNext(){const t=this.queue.shift();if(t)if(this.busy=!0,this.isCompressing&&this.onCompress)this.onCompress(t);else{const s=++this.lastBatchNum;this.sendBatch(t,!1,s)}else this.busy=!1}retry(t,s,i){this.attemptsCount>=this.MAX_ATTEMPTS_COUNT?this.onFailure(`Failed to send batch after ${this.attemptsCount} attempts.`):(this.attemptsCount++,setTimeout((()=>this.sendBatch(t,s,i)),this.ATTEMPT_TIMEOUT*this.attemptsCount))}sendBatch(t,s,i){var e;const n=null==i?void 0:i.toString().replace(/^([^_]+)_([^_]+).*/,\"$1_$2_$3\");this.busy=!0;const h={Authorization:`Bearer ${this.token}`};if(s&&(h[\"Content-Encoding\"]=\"gzip\"),null===this.token)return void setTimeout((()=>{this.sendBatch(t,s,`${null!=i?i:\"noBatchNum\"}_newToken`)}),500);const r=`${null!==(e=this.pageNo)&&void 0!==e?e:\"noPageNum\"}_${null!=n?n:\"noBatchNum\"}`;fetch(`${this.ingestURL}?seq=${r}`,{body:t,method:\"POST\",headers:h,keepalive:t.length<65536}).then((e=>{if(401===e.status)return this.busy=!1,void this.onUnauthorised();e.status>=400?this.retry(t,s,`${null!=i?i:\"noBatchNum\"}_network:${e.status}`):(this.attemptsCount=0,this.sendNext())})).catch((e=>{console.warn(\"OxvoSessions:\",e),this.retry(t,s,`${null!=i?i:\"noBatchNum\"}_reject:${e.message}`)}))}sendCompressed(t){const s=++this.lastBatchNum;this.sendBatch(t,!0,s)}sendUncompressed(t){const s=++this.lastBatchNum;this.sendBatch(t,!1,s)}clean(){this.sendNext(),setTimeout((()=>{this.token=null,this.queue.length=0}),10)}}const s=\"function\"==typeof TextEncoder?new TextEncoder:{encode(t){const s=t.length,i=new Uint8Array(3*s);let e=-1;for(let n=0,h=0,r=0;r!==s;){if(n=t.charCodeAt(r),r+=1,n>=55296&&n<=56319){if(r===s){i[e+=1]=239,i[e+=1]=191,i[e+=1]=189;break}if(h=t.charCodeAt(r),!(h>=56320&&h<=57343)){i[e+=1]=239,i[e+=1]=191,i[e+=1]=189;continue}if(n=1024*(n-55296)+h-56320+65536,r+=1,n>65535){i[e+=1]=240|n>>>18,i[e+=1]=128|n>>>12&63,i[e+=1]=128|n>>>6&63,i[e+=1]=128|63&n;continue}}n<=127?i[e+=1]=0|n:n<=2047?(i[e+=1]=192|n>>>6,i[e+=1]=128|63&n):(i[e+=1]=224|n>>>12,i[e+=1]=128|n>>>6&63,i[e+=1]=128|63&n)}return i.subarray(0,e+1)}};class i{constructor(t){this.size=t,this.offset=0,this.checkpointOffset=0,this.data=new Uint8Array(t)}getCurrentOffset(){return this.offset}checkpoint(){this.checkpointOffset=this.offset}get isEmpty(){return 0===this.offset}skip(t){return this.offset+=t,this.offset<=this.size}set(t,s){this.data.set(t,s)}boolean(t){return this.data[this.offset++]=+t,this.offset<=this.size}uint(t){for((t<0||t>Number.MAX_SAFE_INTEGER)&&(t=0);t>=128;)this.data[this.offset++]=t%256|128,t=Math.floor(t/128);return this.data[this.offset++]=t,this.offset<=this.size}int(t){return t=Math.round(t),this.uint(t>=0?2*t:-2*t-1)}string(t){const i=s.encode(t),e=i.byteLength;return!(!this.uint(e)||this.offset+e>this.size)&&(this.data.set(i,this.offset),this.offset+=e,!0)}reset(){this.offset=0,this.checkpointOffset=0}flush(){const t=this.data.slice(0,this.checkpointOffset);return this.reset(),t}}class e extends i{encode(t){switch(t[0]){case 0:case 11:case 114:case 115:return this.uint(t[1]);case 4:case 44:case 47:return this.string(t[1])&&this.string(t[2])&&this.uint(t[3]);case 5:case 20:case 65:case 70:case 75:case 76:case 77:case 82:return this.uint(t[1])&&this.uint(t[2]);case 6:return this.int(t[1])&&this.int(t[2]);case 7:return!0;case 8:return this.uint(t[1])&&this.uint(t[2])&&this.uint(t[3])&&this.string(t[4])&&this.boolean(t[5]);case 9:case 10:case 24:case 35:case 51:return this.uint(t[1])&&this.uint(t[2])&&this.uint(t[3]);case 12:case 52:case 61:case 71:return this.uint(t[1])&&this.string(t[2])&&this.string(t[3]);case 13:case 14:case 17:case 34:case 36:case 50:case 54:return this.uint(t[1])&&this.string(t[2]);case 16:return this.uint(t[1])&&this.int(t[2])&&this.int(t[3]);case 18:return this.uint(t[1])&&this.string(t[2])&&this.int(t[3]);case 19:return this.uint(t[1])&&this.boolean(t[2]);case 21:return this.string(t[1])&&this.string(t[2])&&this.string(t[3])&&this.string(t[4])&&this.string(t[5])&&this.uint(t[6])&&this.uint(t[7])&&this.uint(t[8]);case 22:case 27:case 30:case 41:case 45:case 46:case 43:case 63:case 64:case 79:case 124:return this.string(t[1])&&this.string(t[2]);case 23:return this.uint(t[1])&&this.uint(t[2])&&this.uint(t[3])&&this.uint(t[4])&&this.uint(t[5])&&this.uint(t[6])&&this.uint(t[7])&&this.uint(t[8])&&this.uint(t[9]);case 28:case 29:case 42:case 117:case 118:return this.string(t[1]);case 40:return this.string(t[1])&&this.uint(t[2])&&this.string(t[3])&&this.string(t[4]);case 48:return this.string(t[1])&&this.string(t[2])&&this.string(t[3])&&this.string(t[4])&&this.int(t[5]);case 49:return this.int(t[1])&&this.int(t[2])&&this.uint(t[3])&&this.uint(t[4]);case 53:return this.uint(t[1])&&this.uint(t[2])&&this.uint(t[3])&&this.uint(t[4])&&this.uint(t[5])&&this.uint(t[6])&&this.string(t[7])&&this.string(t[8]);case 55:return this.boolean(t[1]);case 57:case 60:return this.uint(t[1])&&this.string(t[2])&&this.string(t[3])&&this.string(t[4]);case 58:case 120:return this.int(t[1]);case 68:return this.uint(t[1])&&this.uint(t[2])&&this.string(t[3])&&this.string(t[4])&&this.uint(t[5])&&this.uint(t[6]);case 69:return this.uint(t[1])&&this.uint(t[2])&&this.string(t[3])&&this.string(t[4]);case 73:return this.uint(t[1])&&this.string(t[2])&&this.uint(t[3])&&this.string(t[4]);case 78:return this.string(t[1])&&this.string(t[2])&&this.string(t[3])&&this.string(t[4]);case 81:return this.uint(t[1])&&this.uint(t[2])&&this.uint(t[3])&&this.int(t[4])&&this.string(t[5]);case 83:return this.string(t[1])&&this.string(t[2])&&this.string(t[3])&&this.string(t[4])&&this.string(t[5])&&this.uint(t[6])&&this.uint(t[7])&&this.uint(t[8])&&this.uint(t[9]);case 84:return this.string(t[1])&&this.string(t[2])&&this.string(t[3])&&this.uint(t[4])&&this.string(t[5])&&this.string(t[6]);case 85:return this.uint(t[1])&&this.uint(t[2])&&this.uint(t[3])&&this.uint(t[4])&&this.uint(t[5])&&this.uint(t[6])&&this.string(t[7])&&this.string(t[8])&&this.uint(t[9])&&this.boolean(t[10])&&this.uint(t[11])&&this.uint(t[12])&&this.uint(t[13])&&this.uint(t[14])&&this.uint(t[15])&&this.uint(t[16])&&this.uint(t[17]);case 87:return this.string(t[1])&&this.int(t[2])&&this.int(t[3]);case 89:return this.string(t[1])&&this.int(t[2])&&this.int(t[3])&&this.int(t[4])&&this.int(t[5])&&this.string(t[6]);case 112:return this.uint(t[1])&&this.string(t[2])&&this.boolean(t[3])&&this.string(t[4])&&this.int(t[5])&&this.int(t[6]);case 113:return this.uint(t[1])&&this.uint(t[2])&&this.string(t[3]);case 116:return this.uint(t[1])&&this.uint(t[2])&&this.uint(t[3])&&this.uint(t[4])&&this.uint(t[5])&&this.uint(t[6])&&this.string(t[7])&&this.string(t[8])&&this.uint(t[9])&&this.boolean(t[10]);case 119:return this.string(t[1])&&this.uint(t[2]);case 121:return this.string(t[1])&&this.string(t[2])&&this.uint(t[3])&&this.uint(t[4]);case 122:return this.string(t[1])&&this.string(t[2])&&this.uint(t[3])&&this.string(t[4]);case 123:return this.string(t[1])&&this.string(t[2])&&this.string(t[3])&&this.string(t[4])&&this.uint(t[5])}}}class n{constructor(t,s,i,n,h,r){this.pageNo=t,this.timestamp=s,this.url=i,this.onBatch=n,this.tabId=h,this.onOfflineEnd=r,this.nextIndex=0,this.beaconSize=2e5,this.encoder=new e(this.beaconSize),this.sizeBuffer=new Uint8Array(3),this.isEmpty=!0,this.checkpoints=[],this.beaconSizeLimit=1e6,this.prepare()}writeType(t){return this.encoder.uint(t[0])}writeFields(t){return this.encoder.encode(t)}writeSizeAt(t,s){for(let s=0;s<3;s++)this.sizeBuffer[s]=t>>8*s;this.encoder.set(this.sizeBuffer,s)}prepare(){if(!this.encoder.isEmpty)return;this.checkpoints.length=0;const t=[81,1,this.pageNo,this.nextIndex,this.timestamp,this.url],s=[0,this.timestamp],i=[118,this.tabId];this.writeType(t),this.writeFields(t),this.writeWithSize(s),this.writeWithSize(i),this.isEmpty=!0}writeWithSize(t){const s=this.encoder;if(!this.writeType(t)||!s.skip(3))return!1;const i=s.getCurrentOffset(),e=this.writeFields(t);if(e){const e=s.getCurrentOffset()-i;if(e>16777215)return console.warn(\"OxvoSessions: max message size overflow.\"),!1;this.writeSizeAt(e,i-3),s.checkpoint(),this.checkpoints.push(s.getCurrentOffset()),this.isEmpty=this.isEmpty&&0===t[0],this.nextIndex++}return e}setBeaconSizeLimit(t){this.beaconSizeLimit=t}writeMessage(t){if(-1===t[0])return this.finaliseBatch(),this.onOfflineEnd();0===t[0]&&(this.timestamp=t[1]),122===t[0]&&(this.url=t[1]),this.writeWithSize(t)||(this.finaliseBatch(),this.writeWithSize(t)||(this.encoder=new e(this.beaconSizeLimit),this.prepare(),this.writeWithSize(t)?this.finaliseBatch():console.warn(\"OxvoSessions: beacon size overflow. Skipping large message.\",t,this),this.encoder=new e(this.beaconSize),this.prepare()))}finaliseBatch(t=!1){if(this.isEmpty)return;const s=this.encoder.flush();this.onBatch(s,t),this.prepare()}clean(){this.encoder.reset(),this.checkpoints.length=0}}var h;!function(t){t[t.NotActive=0]=\"NotActive\",t[t.Starting=1]=\"Starting\",t[t.Stopping=2]=\"Stopping\",t[t.Active=3]=\"Active\",t[t.Stopped=4]=\"Stopped\"}(h||(h={}));let r=null,u=null,a=h.NotActive;function o(t){u&&u.finaliseBatch(t)}function c(){return new Promise((t=>{a=h.Stopping,null!==p&&(clearInterval(p),p=null),u&&(u.clean(),u=null),r&&(r.clean(),setTimeout((()=>{r=null}),20)),setTimeout((()=>{a=h.NotActive,t(null)}),100)}))}function g(){[h.Stopped,h.Stopping].includes(a)||(postMessage(\"a_stop\"),c().then((()=>{postMessage(\"a_start\")})))}let l,p=null;self.onmessage=({data:s})=>{if(\"stop\"===s)return o(),void c().then((()=>{a=h.Stopped}));if(\"forceFlushBatch\"!==s)if(\"closing\"!==s){if(!Array.isArray(s)){if(\"compressed\"===s.type){if(!r)return console.debug(\"OR WebWorker: sender not initialised. Compressed batch.\"),void g();s.batch&&r.sendCompressed(s.batch)}if(\"uncompressed\"===s.type){if(!r)return console.debug(\"OR WebWorker: sender not initialised. Uncompressed batch.\"),void g();s.batch&&r.sendUncompressed(s.batch)}return\"start\"===s.type?(a=h.Starting,r=new t(s.ingestPoint,(()=>{g()}),(t=>{!function(t){postMessage({type:\"failure\",reason:t}),c()}(t)}),s.connAttemptCount,s.connAttemptGap,(t=>{postMessage({type:\"compress\",batch:t},[t.buffer])}),s.pageNo),u=new n(s.pageNo,s.timestamp,s.url,((t,s)=>{r&&(s?r.sendUncompressed(t):r.push(t))}),s.tabId,(()=>postMessage({type:\"queue_empty\"}))),null===p&&(p=setInterval(o,3e4)),a=h.Active):\"auth\"===s.type?r?u?(r.authorise(s.token),void(s.beaconSizeLimit&&u.setBeaconSizeLimit(s.beaconSizeLimit))):(console.debug(\"OR WebWorker: writer not initialised. Received auth.\"),void g()):(console.debug(\"OR WebWorker: sender not initialised. Received auth.\"),void g()):void 0}if(u){const t=u;s.forEach((s=>{55===s[0]&&(s[1]?l=setTimeout((()=>g()),18e5):clearTimeout(l)),t.writeMessage(s)}))}else postMessage(\"not_init\"),g()}else o(!0);else o()}}();\n";
+const workerBodyFn = "!function(){\"use strict\";class t{constructor(t,s,i,e=10,n=250,h,r){this.onUnauthorised=s,this.onFailure=i,this.MAX_ATTEMPTS_COUNT=e,this.ATTEMPT_TIMEOUT=n,this.onCompress=h,this.pageNo=r,this.attemptsCount=0,this.busy=!1,this.queue=[],this.token=null,this.lastBatchNum=0,this.inflightKeepaliveBytes=0,this.ingestURL=t+\"/v1/events\",this.analyticsIngestURL=t+\"/v1/analytics\",this.isCompressing=void 0!==h}getQueueStatus(){return 0===this.queue.length&&!this.busy}authorise(t){this.token=t,this.busy||this.sendNext()}push(t,s=\"player\"){if(this.busy||!this.token)this.queue.push({batch:t,dataType:s});else if(this.busy=!0,this.isCompressing&&this.onCompress)this.onCompress(t,s);else{const i=++this.lastBatchNum;this.sendBatch(t,!1,i,s)}}sendNext(){const t=this.queue.shift();if(t)if(this.busy=!0,this.isCompressing&&this.onCompress)this.onCompress(t.batch,t.dataType);else{const s=++this.lastBatchNum;this.sendBatch(t.batch,!1,s,t.dataType)}else this.busy=!1}retry(t,s,i,e=\"player\"){if(this.attemptsCount>=this.MAX_ATTEMPTS_COUNT)return void this.onFailure(`Failed to send batch after ${this.attemptsCount} attempts.`);this.attemptsCount++;const n=new Uint8Array(t);setTimeout((()=>this.sendBatch(n,s,i,e)),this.ATTEMPT_TIMEOUT*this.attemptsCount)}sendBatch(t,s,i,e=\"player\"){var n;if(0===t.length)return console.error(\"OxvoSessions: refusing to send 0-byte batch.\",{batchNum:i,dataType:e,isCompressed:s,batch:t}),this.attemptsCount=0,void this.sendNext();const h=null==i?void 0:i.toString().replace(/^([^_]+)_([^_]+).*/,\"$1_$2_$3\");this.busy=!0;const r={Authorization:`Bearer ${this.token}`,DataType:e};if(s&&(r[\"Content-Encoding\"]=\"gzip\"),null===this.token)return void setTimeout((()=>{this.sendBatch(t,s,`${null!=i?i:\"noBatchNum\"}_newToken`,e)}),500);const a=t.length<65536&&this.inflightKeepaliveBytes+t.length<=65536;a&&(this.inflightKeepaliveBytes+=t.length);const o=()=>{a&&(this.inflightKeepaliveBytes-=t.length)},u=`${null!==(n=this.pageNo)&&void 0!==n?n:\"noPageNum\"}_${null!=h?h:\"noBatchNum\"}`,c=\"analytics\"===e?this.analyticsIngestURL:this.ingestURL;fetch(`${c}?seq=${u}&keepalive=${a?\"yes\":\"no\"}`,{body:t,method:\"POST\",headers:r,keepalive:a}).then((n=>{var h;if(o(),null===(h=n.body)||void 0===h||h.cancel().catch((()=>{})),401===n.status)return this.busy=!1,void this.onUnauthorised();n.status>=400?this.retry(t,s,`${null!=i?i:\"noBatchNum\"}_network:${n.status}`,e):(this.attemptsCount=0,this.sendNext())})).catch((n=>{o(),console.warn(\"OxvoSessions:\",n),this.retry(t,s,`${null!=i?i:\"noBatchNum\"}_reject:${n.message}`,e)}))}sendCompressed(t,s=\"player\"){const i=++this.lastBatchNum;this.sendBatch(t,!0,i,s)}sendUncompressed(t,s=\"player\"){const i=++this.lastBatchNum;this.sendBatch(t,!1,i,s)}clean(){this.sendNext(),setTimeout((()=>{this.token=null,this.queue.length=0}),10)}}const s=new Set([60,61,71,73]),i=new Set([21,22,40,41,44,45,46,47,48,79,83,84,85,87,89,116,120,121,123]),e=new Set([17,23,24,27,28,29,30,42,63,64,78,112,115,124]),n=\"function\"==typeof TextEncoder?new TextEncoder:{encode(t){const s=t.length,i=new Uint8Array(3*s);let e=-1;for(let n=0,h=0,r=0;r!==s;){if(n=t.charCodeAt(r),r+=1,n>=55296&&n<=56319){if(r===s){i[e+=1]=239,i[e+=1]=191,i[e+=1]=189;break}if(h=t.charCodeAt(r),!(h>=56320&&h<=57343)){i[e+=1]=239,i[e+=1]=191,i[e+=1]=189;continue}if(n=1024*(n-55296)+h-56320+65536,r+=1,n>65535){i[e+=1]=240|n>>>18,i[e+=1]=128|n>>>12&63,i[e+=1]=128|n>>>6&63,i[e+=1]=128|63&n;continue}}n<=127?i[e+=1]=0|n:n<=2047?(i[e+=1]=192|n>>>6,i[e+=1]=128|63&n):(i[e+=1]=224|n>>>12,i[e+=1]=128|n>>>6&63,i[e+=1]=128|63&n)}return i.subarray(0,e+1)}};class h{constructor(t){this.size=t,this.offset=0,this.checkpointOffset=0,this.data=new Uint8Array(t)}getCurrentOffset(){return this.offset}getCurrentCheckpoint(){return this.checkpointOffset}checkpoint(){this.checkpointOffset=this.offset}get isEmpty(){return 0===this.offset}skip(t){return this.offset+=t,this.offset<=this.size}set(t,s){this.data.set(t,s)}boolean(t){return this.data[this.offset++]=+t,this.offset<=this.size}uint(t){for((t<0||t>Number.MAX_SAFE_INTEGER)&&(t=0);t>=128;)this.data[this.offset++]=t%256|128,t=Math.floor(t/128);return this.data[this.offset++]=t,this.offset<=this.size}int(t){return t=Math.round(t),this.uint(t>=0?2*t:-2*t-1)}string(t){const s=n.encode(t),i=s.byteLength;return!(!this.uint(i)||this.offset+i>this.size)&&(this.data.set(s,this.offset),this.offset+=i,!0)}reset(){this.offset=0,this.checkpointOffset=0}rewind(t,s){t>this.offset||s>this.checkpointOffset||(this.offset=t,this.checkpointOffset=s)}flush(){const t=this.data.slice(0,this.checkpointOffset);return this.reset(),t}}class r extends h{encode(t){switch(t[0]){case 0:case 11:case 114:case 115:return this.uint(t[1]);case 4:case 44:case 47:return this.string(t[1])&&this.string(t[2])&&this.uint(t[3]);case 5:case 20:case 65:case 70:case 75:case 76:case 77:return this.uint(t[1])&&this.uint(t[2]);case 6:return this.int(t[1])&&this.int(t[2]);case 7:return!0;case 8:return this.uint(t[1])&&this.uint(t[2])&&this.uint(t[3])&&this.string(t[4])&&this.boolean(t[5]);case 9:case 10:case 24:case 35:case 51:return this.uint(t[1])&&this.uint(t[2])&&this.uint(t[3]);case 12:case 52:case 61:case 71:return this.uint(t[1])&&this.string(t[2])&&this.string(t[3]);case 13:case 14:case 17:case 34:case 36:case 50:case 54:return this.uint(t[1])&&this.string(t[2]);case 16:return this.uint(t[1])&&this.int(t[2])&&this.int(t[3]);case 18:return this.uint(t[1])&&this.string(t[2])&&this.int(t[3]);case 19:return this.uint(t[1])&&this.boolean(t[2]);case 21:return this.string(t[1])&&this.string(t[2])&&this.string(t[3])&&this.string(t[4])&&this.string(t[5])&&this.uint(t[6])&&this.uint(t[7])&&this.uint(t[8]);case 22:case 27:case 30:case 41:case 45:case 46:case 43:case 63:case 64:case 79:case 124:return this.string(t[1])&&this.string(t[2]);case 23:return this.uint(t[1])&&this.uint(t[2])&&this.uint(t[3])&&this.uint(t[4])&&this.uint(t[5])&&this.uint(t[6])&&this.uint(t[7])&&this.uint(t[8])&&this.uint(t[9]);case 28:case 29:case 42:case 117:case 118:return this.string(t[1]);case 40:return this.string(t[1])&&this.uint(t[2])&&this.string(t[3])&&this.string(t[4]);case 48:return this.string(t[1])&&this.string(t[2])&&this.string(t[3])&&this.string(t[4])&&this.int(t[5]);case 49:return this.int(t[1])&&this.int(t[2])&&this.uint(t[3])&&this.uint(t[4]);case 53:return this.uint(t[1])&&this.uint(t[2])&&this.uint(t[3])&&this.uint(t[4])&&this.uint(t[5])&&this.uint(t[6])&&this.string(t[7])&&this.string(t[8]);case 55:return this.boolean(t[1]);case 57:case 60:return this.uint(t[1])&&this.string(t[2])&&this.string(t[3])&&this.string(t[4]);case 58:case 120:return this.int(t[1]);case 68:return this.uint(t[1])&&this.uint(t[2])&&this.string(t[3])&&this.string(t[4])&&this.uint(t[5])&&this.uint(t[6]);case 69:return this.uint(t[1])&&this.uint(t[2])&&this.string(t[3])&&this.string(t[4]);case 73:return this.uint(t[1])&&this.string(t[2])&&this.uint(t[3])&&this.string(t[4]);case 78:return this.string(t[1])&&this.string(t[2])&&this.string(t[3])&&this.string(t[4]);case 81:return this.uint(t[1])&&this.uint(t[2])&&this.uint(t[3])&&this.int(t[4])&&this.string(t[5]);case 83:return this.string(t[1])&&this.string(t[2])&&this.string(t[3])&&this.string(t[4])&&this.string(t[5])&&this.uint(t[6])&&this.uint(t[7])&&this.uint(t[8])&&this.uint(t[9]);case 84:return this.string(t[1])&&this.string(t[2])&&this.string(t[3])&&this.uint(t[4])&&this.string(t[5])&&this.string(t[6]);case 85:return this.uint(t[1])&&this.uint(t[2])&&this.uint(t[3])&&this.uint(t[4])&&this.uint(t[5])&&this.uint(t[6])&&this.string(t[7])&&this.string(t[8])&&this.uint(t[9])&&this.boolean(t[10])&&this.uint(t[11])&&this.uint(t[12])&&this.uint(t[13])&&this.uint(t[14])&&this.uint(t[15])&&this.uint(t[16])&&this.uint(t[17]);case 87:return this.string(t[1])&&this.int(t[2])&&this.int(t[3]);case 89:return this.string(t[1])&&this.int(t[2])&&this.int(t[3])&&this.int(t[4])&&this.int(t[5])&&this.string(t[6]);case 112:return this.uint(t[1])&&this.string(t[2])&&this.boolean(t[3])&&this.string(t[4])&&this.int(t[5])&&this.int(t[6]);case 113:return this.uint(t[1])&&this.uint(t[2])&&this.string(t[3]);case 116:return this.uint(t[1])&&this.uint(t[2])&&this.uint(t[3])&&this.uint(t[4])&&this.uint(t[5])&&this.uint(t[6])&&this.string(t[7])&&this.string(t[8])&&this.uint(t[9])&&this.boolean(t[10]);case 119:return this.string(t[1])&&this.uint(t[2]);case 121:return this.string(t[1])&&this.string(t[2])&&this.uint(t[3])&&this.uint(t[4]);case 122:return this.string(t[1])&&this.string(t[2])&&this.uint(t[3])&&this.string(t[4]);case 123:return this.string(t[1])&&this.string(t[2])&&this.string(t[3])&&this.string(t[4])&&this.uint(t[5])}}}class a{constructor(t,s,i){this.bufferSize=t,this.version=s,this.dataType=i,this.sizeBuffer=new Uint8Array(3),this.snap=null,this.hasNonTimestamp=!1,this.lastPushedTs=0,this.encoder=new r(t)}push(t,s){const i=this.encoder,e=null===this.snap,n=i.getCurrentOffset(),h=i.getCurrentCheckpoint();if(e){const t={pageNo:s.pageNo,firstIndex:s.index,timestamp:s.timestamp,url:s.url,tabId:s.tabId};if(!this.writeHeader(t))return i.rewind(n,h),!1;this.snap=t,this.lastPushedTs=s.timestamp}return 0===t[0]||s.timestamp===this.lastPushedTs||this.writeMessageWithSize([0,s.timestamp])?this.writeMessageWithSize(t)?(this.lastPushedTs=s.timestamp,0!==t[0]&&(this.hasNonTimestamp=!0),!0):(i.rewind(n,h),e&&(this.snap=null),!1):(i.rewind(n,h),!1)}hasContent(){return null!==this.snap&&this.hasNonTimestamp}flush(){if(!this.hasContent())return this.reset(),null;const t=this.encoder.flush();return this.snap=null,this.hasNonTimestamp=!1,this.lastPushedTs=0,t}reset(){this.encoder.reset(),this.snap=null,this.hasNonTimestamp=!1,this.lastPushedTs=0}writeHeader(t){const s=this.encoder,i=[81,this.version,t.pageNo,t.firstIndex,t.timestamp,t.url];return!!s.uint(i[0])&&(!!s.encode(i)&&(!(s.getCurrentOffset()>this.bufferSize)&&(s.checkpoint(),!!this.writeMessageWithSize([0,t.timestamp])&&!!this.writeMessageWithSize([118,t.tabId]))))}writeMessageWithSize(t){const s=this.encoder;if(!s.uint(t[0])||!s.skip(3))return!1;const i=s.getCurrentOffset();if(!s.encode(t))return!1;const e=s.getCurrentOffset(),n=e-i;return n>16777215?(console.warn(\"OxvoSessions: max message size overflow.\"),!1):!(e>this.bufferSize)&&(this.writeSizeAt(n,i-3),s.checkpoint(),!0)}writeSizeAt(t,s){for(let s=0;s<3;s++)this.sizeBuffer[s]=t>>8*s;this.encoder.set(this.sizeBuffer,s)}}class o{constructor(t,s,i,e,n,h,r=!1,o){this.pageNo=t,this.timestamp=s,this.url=i,this.onBatch=e,this.tabId=n,this.onOfflineEnd=h,this.localDebug=r,this.onLocalSave=o,this.nextIndex=0,this.beaconSize=2e5,this.beaconSizeLimit=1e6,this.protocolVersion=1,this.playerBuilder=new a(this.beaconSize,this.playerVersion(),\"player\"),this.assetBuilder=new a(this.beaconSize,3,\"assets\"),this.devtoolsBuilder=new a(this.beaconSize,4,\"devtools\"),this.analyticsBuilder=new a(this.beaconSize,5,\"analytics\")}playerVersion(){return 2===this.protocolVersion?2:1}currentCtx(){return{pageNo:this.pageNo,index:this.nextIndex,timestamp:this.timestamp,url:this.url,tabId:this.tabId}}setBeaconSizeLimit(t){this.beaconSizeLimit=t}setProtocolVersion(t){this.protocolVersion!==t&&(this.protocolVersion=t,this.playerBuilder.reset(),this.playerBuilder=new a(this.beaconSize,this.playerVersion(),\"player\"))}writeMessage(t){if(-1===t[0])return this.finaliseBatch(),this.onOfflineEnd();0===t[0]&&(this.timestamp=t[1]),122===t[0]&&(this.url=t[1]);const s=this.routeMessage(t);this.pushTo(s,t)}routeMessage(t){if(2===this.protocolVersion){const n=t[0];if(s.has(n))return this.assetBuilder;if(i.has(n))return this.devtoolsBuilder;if(e.has(n))return this.analyticsBuilder}return this.playerBuilder}pushTo(t,s){const i=this.currentCtx();if(t.push(s,i))return void this.nextIndex++;if(this.flushBuilder(t),t.push(s,i))return void this.nextIndex++;const e=new a(this.beaconSizeLimit,t.version,t.dataType);if(!e.push(s,i))return void console.warn(\"OxvoSessions: beacon size overflow. Skipping large message.\",s);this.nextIndex++;const n=e.flush();n&&this.emitBatch(n,t.dataType,!1)}flushBuilder(t,s=!1){const i=t.flush();return!!i&&(this.emitBatch(i,t.dataType,s),!0)}emitBatch(t,s,i){this.localDebug&&this.onLocalSave&&this.onLocalSave(`${s}-${Date.now()}`,t.slice()),this.onBatch(t,i,s)}finaliseBatch(t=!1){this.flushBuilder(this.playerBuilder,t),this.flushBuilder(this.assetBuilder,t),this.flushBuilder(this.devtoolsBuilder,t),this.flushBuilder(this.analyticsBuilder,t)}clean(){this.playerBuilder.reset(),this.assetBuilder.reset(),this.devtoolsBuilder.reset(),this.analyticsBuilder.reset()}}var u;!function(t){t[t.NotActive=0]=\"NotActive\",t[t.Starting=1]=\"Starting\",t[t.Stopping=2]=\"Stopping\",t[t.Active=3]=\"Active\",t[t.Stopped=4]=\"Stopped\"}(u||(u={}));let c=null,l=null,d=u.NotActive;function p(t){l&&l.finaliseBatch(t)}function f(){return new Promise((t=>{d=u.Stopping,null!==y&&(clearInterval(y),y=null),l&&(l.clean(),l=null),c&&(c.clean(),setTimeout((()=>{c=null}),20)),setTimeout((()=>{d=u.NotActive,t(null)}),100)}))}function g(){[u.Stopped,u.Stopping].includes(d)||(postMessage(\"a_stop\"),f().then((()=>{postMessage(\"a_start\")})))}let m,y=null;self.onmessage=({data:s})=>{var i;if(\"stop\"===s)return p(),void f().then((()=>{d=u.Stopped}));if(\"forceFlushBatch\"!==s)if(\"closing\"!==s){if(!Array.isArray(s)){if(\"compressed\"===s.type){if(!c)return console.debug(\"OR WebWorker: sender not initialised. Compressed batch.\"),void g();s.batch&&c.sendCompressed(s.batch,s.dataType)}if(\"uncompressed\"===s.type){if(!c)return console.debug(\"OR WebWorker: sender not initialised. Uncompressed batch.\"),void g();s.batch&&c.sendUncompressed(s.batch,s.dataType)}return\"start\"===s.type?(d=u.Starting,c=new t(s.ingestPoint,(()=>{g()}),(t=>{!function(t){postMessage({type:\"failure\",reason:t}),f()}(t)}),s.connAttemptCount,s.connAttemptGap,((t,s)=>{postMessage({type:\"compress\",batch:t,dataType:s},[t.buffer])}),s.pageNo),l=new o(s.pageNo,s.timestamp,s.url,((t,s,i=\"player\")=>{c&&(s?c.sendUncompressed(t,i):c.push(t,i))}),s.tabId,(()=>postMessage({type:\"queue_empty\"})),null!==(i=s.localDebug)&&void 0!==i&&i,((t,s)=>{postMessage({type:\"local_save\",name:t,batch:s},[s.buffer])})),null===y&&(y=setInterval(p,3e4)),d=u.Active):\"auth\"===s.type?c?l?(c.authorise(s.token),s.beaconSizeLimit&&l.setBeaconSizeLimit(s.beaconSizeLimit),void(s.protocolVersion&&l.setProtocolVersion(s.protocolVersion))):(console.debug(\"OR WebWorker: writer not initialised. Received auth.\"),void g()):(console.debug(\"OR WebWorker: sender not initialised. Received auth.\"),void g()):void 0}if(l){const t=l;s.forEach((s=>{55===s[0]&&(s[1]?m=setTimeout((()=>g()),18e5):clearTimeout(m)),t.writeMessage(s)}))}else postMessage(\"not_init\"),g()}else p(!0);else p()}}();\n";
 const CANCELED = 'canceled';
 const bufferStorageKey = 'or_buffer_1';
+const PROTO_VERSION = '2';
+const BOOTSTRAP_ATTEMPT_TTL_MS = 24 * 60 * 60 * 1000;
+const MAX_BOOTSTRAP_ATTEMPT_STORAGE_LENGTH = 1024 * 1024;
 const UnsuccessfulStart = (reason) => ({ reason, success: false });
 const SuccessfulStart = (body) => ({ ...body, success: true });
 var ActivityState;
@@ -4415,22 +4585,34 @@ const proto = {
     resp: 'never-gonna-let-you-down',
     // regenerating id (copied other tab)
     reg: 'never-gonna-run-around-and-desert-you',
-    iframeSignal: 'tracker inside a child iframe',
-    iframeId: 'getting node id for child iframe',
-    iframeBatch: 'batch of messages from an iframe window',
-    parentAlive: 'signal that parent is live',
-    killIframe: 'stop tracker inside frame',
-    startIframe: 'start tracker inside frame',
+    iframeSignal: 'oxvo:cross-frame:v1:handshake',
+    iframeId: 'oxvo:cross-frame:v1:ready',
+    iframeBatch: 'oxvo:cross-frame:v1:batch',
+    parentAlive: 'oxvo:cross-frame:v1:pong',
+    killIframe: 'oxvo:cross-frame:v1:stop',
+    startIframe: 'oxvo:cross-frame:v1:start',
     // checking updates
-    polling: 'hello-how-are-you-im-under-the-water-please-help-me',
+    polling: 'oxvo:cross-frame:v1:ping',
     // happens if tab is old and has outdated token but
     // not communicating with backend to update it (for whatever reason)
     reset: 'reset-your-session-please',
 };
+const FRAME_RATE_WINDOW_MS = 1000;
+const MAX_FRAME_ENVELOPES_PER_WINDOW = 120;
+const MAX_FRAME_MESSAGES_PER_WINDOW = 50000;
+const MAX_FRAME_BYTES_PER_WINDOW = 4 * 1024 * 1024;
+const FRAME_CAPABILITY_TTL_MS = 5 * 60 * 1000;
+const FRAME_CAPABILITY_REFRESH_LEAD_MS = 60 * 1000;
+const FRAME_PREVIOUS_CAPABILITY_GRACE_MS = 5 * 1000;
 class App {
+    get tagMatcher() {
+        return this.markerWatcher.matcher;
+    }
     constructor(projectKey, sessionToken, options, signalError, insideIframe) {
         this.signalError = signalError;
         this.insideIframe = insideIframe;
+        // Registered by input/img/canvas to re-emit a node when its level changes.
+        this.resanitizeCallbacks = [];
         this.messages = [];
         /**
          * we need 2 buffers, so we don't lose anything
@@ -4442,18 +4624,31 @@ class App {
         this.stopCallbacks = [];
         this.commitCallbacks = [];
         this.activityState = ActivityState.NotActive;
-        this.version = '7.1.0'; // TODO: version compatability check inside each plugin.
+        this.version = '7.3.4'; // TODO: version compatability check inside each plugin.
         this.socketMode = false;
         this.compressionThreshold = 24 * 1000;
         this.bc = null;
         this.canvasRecorder = null;
         this.conditionsManager = null;
+        this.bootstrapAttempts = {};
         this.canStart = false;
         this.rootId = null;
         this.pageFrames = [];
         this.frameOderNumber = 0;
         this.frameLevel = 0;
         this.emptyBatchCounter = 0;
+        this.crossDomainFrameCapability = null;
+        this.crossDomainFrameCapabilityExpiresAt = 0;
+        this.crossDomainFrameSession = null;
+        this.crossDomainFrameCanvas = null;
+        this.crossDomainResumeAfterHandshake = false;
+        this.crossDomainConnectionRequested = false;
+        this.crossDomainFrames = new Map();
+        this.crossDomainEnvelopeBudgets = new WeakMap();
+        this.pendingCrossDomainFrames = new Map();
+        this.crossDomainAuthorizationGeneration = 0;
+        this.nextCrossDomainFrameOrder = 1;
+        this.crossDomainCanvasConfig = null;
         /** used by child iframes for crossdomain only */
         this.parentActive = false;
         this.checkStatus = () => {
@@ -4461,185 +4656,201 @@ class App {
         };
         this.parentCrossDomainFrameListener = (event) => {
             const { data } = event;
-            if (!data || event.source === window)
+            if (!data ||
+                this.crossDomainParentOrigin === null ||
+                this.crossDomainFrameNonce === null ||
+                event.source !== window.parent ||
+                event.origin !== this.crossDomainParentOrigin) {
                 return;
-            if (data.line === proto.startIframe) {
-                if (this.active())
+            }
+            if (data.line === proto.iframeId) {
+                const init = parseCrossDomainFrameInit(data, proto.iframeId, {
+                    context: this.contextId,
+                    nonce: this.crossDomainFrameNonce,
+                });
+                if (init === null)
+                    return;
+                const sessionChanged = this.crossDomainFrameSession !== null &&
+                    this.crossDomainFrameSession.sessionID !== init.session.sessionID;
+                if (sessionChanged && this.activityState === ActivityState.Starting) {
+                    this.postHandshakeToParent();
                     return;
-                try {
-                    this.allowAppStart();
-                    void this.start();
                 }
-                catch (e) {
-                    console.error('children frame restart failed:', e);
+                const shouldResume = this.crossDomainResumeAfterHandshake || (sessionChanged && this.active());
+                if (sessionChanged && this.active()) {
+                    this.stop();
+                }
+                this.applyCrossDomainFrameInit(init);
+                if (shouldResume &&
+                    this.activityState !== ActivityState.Active &&
+                    this.activityState !== ActivityState.Starting) {
+                    this.crossDomainResumeAfterHandshake = false;
+                    this.startCrossDomainFrame(this.prevOpts);
                 }
+                this.debug.log('Starting secure cross-domain iframe tracking');
+                return;
+            }
+            const expectedLine = data.line === proto.parentAlive
+                ? proto.parentAlive
+                : data.line === proto.startIframe
+                    ? proto.startIframe
+                    : data.line === proto.killIframe
+                        ? proto.killIframe
+                        : null;
+            if (this.crossDomainFrameCapability === null ||
+                expectedLine === null ||
+                (expectedLine !== proto.killIframe &&
+                    Date.now() >= this.crossDomainFrameCapabilityExpiresAt) ||
+                !matchesCrossDomainEnvelope(data, expectedLine, {
+                    context: this.contextId,
+                    nonce: this.crossDomainFrameNonce,
+                    capability: this.crossDomainFrameCapability,
+                })) {
+                return;
             }
             if (data.line === proto.parentAlive) {
                 this.parentActive = true;
+                return;
             }
-            if (data.line === proto.iframeId) {
-                this.parentActive = true;
-                this.rootId = data.id;
-                this.session.setSessionSecret(data.token, this.projectKey);
-                this.frameOderNumber = data.frameOrderNumber;
-                this.frameLevel = data.frameLevel;
-                this.debug.log('starting iframe tracking', data);
-                this.allowAppStart();
+            if (data.line === proto.startIframe) {
+                // Avoid corrupting an in-flight start; let it complete.
+                if (this.activityState === ActivityState.Starting)
+                    return;
+                const init = parseCrossDomainFrameInit(data, proto.startIframe, {
+                    context: this.contextId,
+                    nonce: this.crossDomainFrameNonce,
+                });
+                if (init === null)
+                    return;
+                try {
+                    if (this.active()) {
+                        this.stop();
+                    }
+                    this.applyCrossDomainFrameInit(init);
+                    this.startCrossDomainFrame(this.prevOpts);
+                }
+                catch (e) {
+                    console.error('children frame restart failed:', e);
+                }
+                return;
             }
             if (data.line === proto.killIframe) {
-                if (this.active()) {
+                const shouldResume = this.activityState === ActivityState.Active || this.activityState === ActivityState.Starting;
+                if (this.activityState !== ActivityState.NotActive) {
                     this.stop();
                 }
+                this.clearCrossDomainFrameAuthorization();
+                this.crossDomainResumeAfterHandshake = shouldResume;
+                this.crossDomainConnectionRequested = shouldResume;
             }
         };
-        /**
-         * context ids for iframes,
-         * order is not so important as long as its consistent
-         * */
-        this.trackedFrames = [];
         this.crossDomainIframeListener = (event) => {
-            if (!this.active() || event.source === window)
-                return;
             const { data } = event;
-            if (!data)
+            if (!data || event.source === window)
                 return;
             if (data.line === proto.iframeSignal) {
-                // @ts-ignore
-                event.source?.postMessage({ ping: true, line: proto.parentAlive }, '*');
-                const signalId = async () => {
-                    if (event.source === null) {
-                        return console.error('Couldnt connect to event.source for child iframe tracking');
-                    }
-                    const id = await this.checkNodeId(event.source);
-                    if (!id) {
-                        this.debug.log('Couldnt get node id for iframe', event.source);
-                        return;
-                    }
-                    try {
-                        if (this.trackedFrames.includes(data.context)) {
-                            this.debug.log('Trying to observe already added iframe; ignore if its a restart');
-                        }
-                        else {
-                            this.trackedFrames.push(data.context);
-                        }
-                        await this.waitStarted();
-                        const token = this.session.getSessionSecret(this.projectKey);
-                        const order = this.trackedFrames.findIndex((f) => f === data.context) + 1;
-                        if (order === 0) {
-                            this.debug.error('Couldnt get order number for iframe', data.context, this.trackedFrames);
-                        }
-                        const iframeData = {
-                            line: proto.iframeId,
-                            id,
-                            token,
-                            frameOrderNumber: order,
-                            frameLevel: this.frameLevel + 1,
-                        };
-                        this.debug.log('Got child frame signal; nodeId', id, event.source, iframeData);
-                        // @ts-ignore
-                        event.source?.postMessage(iframeData, '*');
-                    }
-                    catch (e) {
-                        console.error(e);
-                    }
-                };
-                void signalId();
+                const handshake = parseCrossDomainHandshake(data, proto.iframeSignal, this.projectKey);
+                if (handshake !== null) {
+                    void this.establishCrossDomainFrame(event, handshake);
+                }
+                return;
+            }
+            if (!this.active())
+                return;
+            if (data.line === proto.polling) {
+                const state = this.validatedCrossDomainFrame(event, proto.polling);
+                if (state !== null && this.consumeCrossDomainEnvelopeBudget(state.source)) {
+                    this.postToCrossDomainFrame(state, proto.parentAlive);
+                }
+                return;
             }
             /**
              * proxying messages from iframe to main body, so they can be in one batch (same indexes, etc)
              * plus we rewrite some of the messages to be relative to the main context/window
              * */
             if (data.line === proto.iframeBatch) {
-                const msgBatch = data.messages;
+                const state = this.validatedCrossDomainFrame(event, proto.iframeBatch);
+                if (state === null || !this.consumeCrossDomainEnvelopeBudget(state.source)) {
+                    return;
+                }
+                const batch = parseCrossDomainIframeBatch(data.messages);
+                if (batch === null ||
+                    !this.consumeCrossDomainFrameBudget(state, batch.messages.length, batch.bytes)) {
+                    return;
+                }
                 const mappedMessages = [];
-                msgBatch.forEach((msg) => {
+                batch.messages.forEach((msg) => {
+                    let fixedMessage = msg;
                     if (msg[0] === 20 /* MType.MouseMove */) {
-                        let fixedMessage = msg;
-                        this.pageFrames.forEach((frame) => {
-                            if (frame.contentWindow === event.source) {
-                                const [type, x, y] = msg;
-                                const { left, top } = frame.getBoundingClientRect();
-                                fixedMessage = [type, x + left, y + top];
-                            }
-                        });
-                        mappedMessages.push(fixedMessage);
+                        const [type, x, y] = msg;
+                        const { left, top } = state.frame.getBoundingClientRect();
+                        fixedMessage = [type, x + left, y + top];
                     }
                     if (msg[0] === 68 /* MType.MouseClick */) {
-                        let fixedMessage = msg;
-                        this.pageFrames.forEach((frame) => {
-                            if (frame.contentWindow === event.source) {
-                                const [type, id, hesitationTime, label, selector, normX, normY] = msg;
-                                const { left, top, width, height } = frame.getBoundingClientRect();
-                                const contentWidth = document.documentElement.scrollWidth;
-                                const contentHeight = document.documentElement.scrollHeight;
-                                // (normalizedX * frameWidth + frameLeftOffset)/docSize
-                                const fullX = (normX / 100) * width + left;
-                                const fullY = (normY / 100) * height + top;
-                                const fixedX = fullX / contentWidth;
-                                const fixedY = fullY / contentHeight;
-                                fixedMessage = [
-                                    type,
-                                    id,
-                                    hesitationTime,
-                                    label,
-                                    selector,
-                                    Math.round(fixedX * 1e3) / 1e1,
-                                    Math.round(fixedY * 1e3) / 1e1,
-                                ];
-                            }
-                        });
-                        mappedMessages.push(fixedMessage);
-                    }
-                    if (![28 /* MType.UserID */, 29 /* MType.UserAnonymousID */, 30 /* MType.Metadata */].includes(msg[0])) {
-                        mappedMessages.push(msg);
+                        const [type, id, hesitationTime, label, selector, normX, normY] = msg;
+                        const { left, top, width, height } = state.frame.getBoundingClientRect();
+                        const contentWidth = document.documentElement.scrollWidth;
+                        const contentHeight = document.documentElement.scrollHeight;
+                        const fullX = (normX / 100) * width + left;
+                        const fullY = (normY / 100) * height + top;
+                        const fixedX = fullX / contentWidth;
+                        const fixedY = fullY / contentHeight;
+                        fixedMessage = [
+                            type,
+                            id,
+                            hesitationTime,
+                            label,
+                            selector,
+                            Math.round(fixedX * 1e3) / 1e1,
+                            Math.round(fixedY * 1e3) / 1e1,
+                        ];
                     }
+                    mappedMessages.push(fixedMessage);
                 });
                 this.messages.push(...mappedMessages);
             }
-            if (data.line === proto.polling) {
-                if (!this.pollingQueue.order.length) {
-                    return;
+        };
+        this.bootChildrenFrames = async () => {
+            await this.waitStarted();
+            this.pruneDetachedCrossDomainFrames();
+            for (const state of this.crossDomainFrames.values()) {
+                const authorizationGeneration = this.crossDomainAuthorizationGeneration;
+                const id = await this.checkNodeId(state.source);
+                const session = this.currentCrossDomainSession();
+                if (id === null ||
+                    session === null ||
+                    authorizationGeneration !== this.crossDomainAuthorizationGeneration ||
+                    this.crossDomainFrames.get(state.source) !== state ||
+                    !this.active()) {
+                    continue;
                 }
-                const nextCommand = this.pollingQueue.order[0];
-                if (nextCommand && this.pollingQueue[nextCommand].length === 0) {
-                    this.pollingQueue.order = this.pollingQueue.order.filter((c) => c !== nextCommand);
-                    return;
+                const rotated = this.crossDomainFrameNeedsRotation(state, session.sessionID);
+                if (rotated && !this.rotateCrossDomainFrameCapability(state, session.sessionID)) {
+                    continue;
                 }
-                if (this.pollingQueue[nextCommand].includes(data.context)) {
-                    this.pollingQueue[nextCommand] = this.pollingQueue[nextCommand].filter((c) => c !== data.context);
-                    // @ts-ignore
-                    event.source?.postMessage({ line: nextCommand }, '*');
-                    if (this.pollingQueue[nextCommand].length === 0) {
-                        this.pollingQueue.order.shift();
-                    }
+                const payload = id === null ? null : this.frameInitPayload(state, id);
+                if (payload) {
+                    this.postToCrossDomainFrame(state, rotated ? proto.iframeId : proto.startIframe, payload);
                 }
             }
         };
-        /**
-         * { command : [remaining iframes] }
-         * + order of commands
-         **/
-        this.pollingQueue = {
-            order: [],
-        };
-        this.addCommand = (cmd) => {
-            this.pollingQueue.order.push(cmd);
-            this.pollingQueue[cmd] = [...this.trackedFrames];
-        };
-        this.bootChildrenFrames = async () => {
-            await this.waitStarted();
-            this.addCommand(proto.startIframe);
-        };
         this.killChildrenFrames = () => {
-            this.addCommand(proto.killIframe);
+            this.pruneDetachedCrossDomainFrames();
+            const states = Array.from(this.crossDomainFrames.values());
+            this.crossDomainAuthorizationGeneration += 1;
+            this.crossDomainFrames.clear();
+            this.pendingCrossDomainFrames.clear();
+            states.forEach((state) => {
+                this.postToCrossDomainFrame(state, proto.killIframe);
+            });
         };
         this.signalIframeTracker = () => {
-            const thisTab = this.session.getTabId();
-            window.parent.postMessage({
-                line: proto.iframeSignal,
-                source: thisTab,
-                context: this.contextId,
-            }, this.options.crossdomain?.parentDomain ?? '*');
+            if (this.crossDomainParentOrigin === null || this.crossDomainFrameNonce === null) {
+                this.debug.error('Cross-domain iframe capture requires an explicit parentDomain and secure random support.');
+                return;
+            }
+            this.crossDomainConnectionRequested = true;
+            this.postHandshakeToParent();
             /**
              * since we need to wait uncertain amount of time
              * and I don't want to have recursion going on,
@@ -4651,20 +4862,16 @@ class App {
             let cumulativeDelay = 0;
             let stopAttempts = false;
             const checkAndSendMessage = () => {
-                if (stopAttempts || this.checkStatus()) {
+                if (stopAttempts || !this.crossDomainConnectionRequested || this.checkStatus()) {
                     stopAttempts = true;
                     return;
                 }
-                window.parent.postMessage({
-                    line: proto.iframeSignal,
-                    source: thisTab,
-                    context: this.contextId,
-                }, this.options.crossdomain?.parentDomain ?? '*');
+                this.postHandshakeToParent();
                 this.debug.info('Trying to signal to parent, attempt:', retries + 1);
                 retries++;
             };
             for (let i = 0; i < maxRetries; i++) {
-                if (this.checkStatus()) {
+                if (!this.crossDomainConnectionRequested || this.checkStatus()) {
                     stopAttempts = true;
                     break;
                 }
@@ -4751,6 +4958,26 @@ class App {
         this.restartCanvasTracking = () => {
             this.canvasRecorder?.restartTracking();
         };
+        this.attachResanitizeCallback = (cb) => {
+            this.resanitizeCallbacks.push(cb);
+        };
+        this.callResanitizeCallbacks = (node, id) => {
+            this.resanitizeCallbacks.forEach((cb) => cb(node, id));
+        };
+        this.resanitize = (el) => {
+            const root = el ?? (IN_BROWSER ? document.documentElement : undefined);
+            if (!root) {
+                return;
+            }
+            this.observer.resanitizeSubtree(root);
+        };
+        this.checkSanitization = (el) => {
+            const id = this.nodes.getID(el);
+            if (id === undefined) {
+                return undefined;
+            }
+            return this.sanitizer.getLevel(id);
+        };
         this.flushBuffer = async (buffer) => {
             return new Promise((res, reject) => {
                 if (buffer.length === 0) {
@@ -4792,6 +5019,7 @@ class App {
             __is_snippet: false,
             __debug_report_edp: null,
             __debug__: LogLevel.Silent,
+            __local_debug: false,
             localStorage: null,
             sessionStorage: null,
             forceSingleTab: false,
@@ -4800,9 +5028,7 @@ class App {
             maskTextEmails: false,
             maskTextNumbers: false,
             disableStringDict: false,
-            crossdomain: {
-                parentDomain: '*',
-            },
+            crossdomain: {},
             canvas: {
                 disableCanvas: false,
                 fixedCanvasScaling: false,
@@ -4815,6 +5041,9 @@ class App {
             disableThrottling: false,
         };
         this.options = simpleMerge(defaultOptions, options);
+        this.crossDomainChildOrigins = normalizeCrossDomainOrigins(this.options.crossdomain?.childOrigins);
+        this.crossDomainParentOrigin = normalizeCrossDomainOrigin(this.options.crossdomain?.parentDomain);
+        this.crossDomainFrameNonce = this.insideIframe ? createCrossDomainSecret() : null;
         if (!this.insideIframe &&
             !this.options.forceSingleTab &&
             globalThis &&
@@ -4850,9 +5079,7 @@ class App {
         });
         this.session.attachUpdateCallback(({ userID, metadata }) => {
             if (userID != null) {
-                if (!userID ||
-                    typeof userID !== 'string' ||
-                    userID.trim().length === 0) {
+                if (!userID || typeof userID !== 'string' || userID.trim().length === 0) {
                     this.debug.warn('Invalid userID (must be type string), ignoring.');
                     return;
                 }
@@ -4863,25 +5090,33 @@ class App {
             }
         });
         // @deprecated (use sessionHash on start instead)
-        if (sessionToken != null) {
+        if (sessionToken != null && !this.insideIframe) {
             this.session.applySessionHash(sessionToken);
         }
+        if (this.insideIframe) {
+            this.session.clearSessionSecret();
+        }
         const thisTab = this.session.getTabId();
         if (this.insideIframe) {
-            /**
-             * listen for messages from parent window, so we can signal that we're alive
-             * */
-            window.addEventListener('message', this.parentCrossDomainFrameListener);
-            window.addEventListener('message', this.crossDomainIframeListener);
-            setInterval(() => {
-                if (document.hidden) {
-                    return;
-                }
-                window.parent.postMessage({
-                    line: proto.polling,
-                    context: this.contextId,
-                }, options.crossdomain?.parentDomain ?? '*');
-            }, 250);
+            if (this.crossDomainParentOrigin !== null && this.crossDomainFrameNonce !== null) {
+                /**
+                 * listen for messages from parent window, so we can signal that we're alive
+                 * */
+                window.addEventListener('message', this.parentCrossDomainFrameListener);
+                setInterval(() => {
+                    if (!this.crossDomainConnectionRequested) {
+                        return;
+                    }
+                    if (this.crossDomainFrameCapability === null ||
+                        Date.now() >=
+                            this.crossDomainFrameCapabilityExpiresAt - FRAME_CAPABILITY_REFRESH_LEAD_MS) {
+                        this.postHandshakeToParent();
+                    }
+                    else {
+                        this.postToParent(proto.polling);
+                    }
+                }, 1000);
+            }
         }
         else {
             this.initWorker();
@@ -4889,7 +5124,9 @@ class App {
              * if we get a signal from child iframes, we check for their node_id and send it back,
              * so they can act as if it was just a same-domain iframe
              * */
-            window.addEventListener('message', this.crossDomainIframeListener);
+            if (this.options.crossdomain?.enabled && this.crossDomainChildOrigins.size > 0) {
+                window.addEventListener('message', this.crossDomainIframeListener);
+            }
         }
         if (this.bc !== null) {
             this.bc.postMessage({
@@ -4939,6 +5176,319 @@ class App {
             };
         }
     }
+    postToParent(line, extra = {}) {
+        if (this.crossDomainParentOrigin === null ||
+            this.crossDomainFrameNonce === null ||
+            this.crossDomainFrameCapability === null ||
+            Date.now() >= this.crossDomainFrameCapabilityExpiresAt) {
+            return;
+        }
+        window.parent.postMessage({
+            line,
+            protocolVersion: CROSS_DOMAIN_IFRAME_PROTOCOL_VERSION,
+            context: this.contextId,
+            nonce: this.crossDomainFrameNonce,
+            capability: this.crossDomainFrameCapability,
+            ...extra,
+        }, this.crossDomainParentOrigin);
+    }
+    postHandshakeToParent() {
+        if (this.crossDomainParentOrigin === null || this.crossDomainFrameNonce === null) {
+            return;
+        }
+        window.parent.postMessage({
+            line: proto.iframeSignal,
+            protocolVersion: CROSS_DOMAIN_IFRAME_PROTOCOL_VERSION,
+            context: this.contextId,
+            nonce: this.crossDomainFrameNonce,
+            projectKey: this.projectKey,
+        }, this.crossDomainParentOrigin);
+    }
+    applyCrossDomainFrameInit(init) {
+        this.parentActive = true;
+        this.crossDomainConnectionRequested = true;
+        this.crossDomainFrameCapability = init.capability;
+        this.crossDomainFrameCapabilityExpiresAt = init.capabilityExpiresAt;
+        this.crossDomainFrameSession = init.session;
+        this.crossDomainFrameCanvas = init.canvas ?? null;
+        this.rootId = init.id;
+        this.frameOderNumber = init.frameOrderNumber;
+        this.frameLevel = init.frameLevel;
+        this.allowAppStart();
+    }
+    clearCrossDomainFrameAuthorization() {
+        this.parentActive = false;
+        this.canStart = false;
+        this.crossDomainFrameCapability = null;
+        this.crossDomainFrameCapabilityExpiresAt = 0;
+        this.crossDomainFrameSession = null;
+        this.crossDomainFrameCanvas = null;
+        this.rootId = null;
+    }
+    findCrossDomainFrame(source) {
+        const frame = this.pageFrames.find((candidate) => candidate.contentWindow === source) ??
+            Array.from(document.querySelectorAll('iframe')).find((candidate) => candidate.contentWindow === source);
+        if (!frame)
+            return null;
+        if (!this.pageFrames.includes(frame)) {
+            this.pageFrames.push(frame);
+        }
+        return frame;
+    }
+    revokeCrossDomainFrame(source, expectedState) {
+        const state = this.crossDomainFrames.get(source);
+        if (!state || (expectedState !== undefined && state !== expectedState)) {
+            return;
+        }
+        this.crossDomainFrames.delete(source);
+    }
+    pruneDetachedCrossDomainFrames() {
+        this.crossDomainFrames.forEach((state, source) => {
+            if (!state.frame.isConnected || state.frame.contentWindow !== source) {
+                this.revokeCrossDomainFrame(source);
+            }
+        });
+    }
+    currentCrossDomainSession() {
+        const session = this.session.getInfo();
+        if (!session.sessionID) {
+            return null;
+        }
+        return {
+            sessionID: session.sessionID,
+            projectID: session.projectID,
+            startedAt: session.timestamp,
+            delayMs: this.delay,
+            userUUID: this.localStorage.getItem(this.options.local_uuid_key) ?? '',
+        };
+    }
+    frameInitPayload(state, id) {
+        const session = this.currentCrossDomainSession();
+        if (session === null ||
+            session.sessionID !== state.sessionID ||
+            Date.now() >= state.capabilityExpiresAt) {
+            return null;
+        }
+        return {
+            id,
+            frameOrderNumber: state.frameOrderNumber,
+            frameLevel: this.frameLevel + 1,
+            capabilityExpiresAt: state.capabilityExpiresAt,
+            session,
+            ...(this.crossDomainCanvasConfig ? { canvas: this.crossDomainCanvasConfig } : {}),
+        };
+    }
+    rotateCrossDomainFrameCapability(state, sessionID, now = Date.now()) {
+        const capability = createCrossDomainSecret();
+        if (capability === null) {
+            return false;
+        }
+        const preservePreviousCapability = state.sessionID === sessionID && now < state.capabilityExpiresAt;
+        state.previousCapability = preservePreviousCapability ? state.capability : null;
+        state.previousCapabilityExpiresAt = preservePreviousCapability
+            ? Math.min(state.capabilityExpiresAt, now + FRAME_PREVIOUS_CAPABILITY_GRACE_MS)
+            : 0;
+        state.capability = capability;
+        state.sessionID = sessionID;
+        state.capabilityExpiresAt = now + FRAME_CAPABILITY_TTL_MS;
+        return true;
+    }
+    crossDomainFrameNeedsRotation(state, sessionID, now = Date.now()) {
+        return (state.sessionID !== sessionID ||
+            now >= state.capabilityExpiresAt - FRAME_CAPABILITY_REFRESH_LEAD_MS);
+    }
+    postToCrossDomainFrame(state, line, extra = {}) {
+        state.source.postMessage({
+            line,
+            protocolVersion: CROSS_DOMAIN_IFRAME_PROTOCOL_VERSION,
+            context: state.context,
+            nonce: state.nonce,
+            capability: state.capability,
+            ...extra,
+        }, state.origin);
+    }
+    consumeCrossDomainEnvelopeBudget(source) {
+        const now = Date.now();
+        let budget = this.crossDomainEnvelopeBudgets.get(source);
+        if (budget === undefined || now - budget.windowStartedAt >= FRAME_RATE_WINDOW_MS) {
+            budget = {
+                windowStartedAt: now,
+                envelopesInWindow: 0,
+            };
+            this.crossDomainEnvelopeBudgets.set(source, budget);
+        }
+        if (budget.envelopesInWindow >= MAX_FRAME_ENVELOPES_PER_WINDOW) {
+            return false;
+        }
+        budget.envelopesInWindow += 1;
+        return true;
+    }
+    async establishCrossDomainFrame(event, handshake) {
+        if (!this.active() ||
+            event.source === null ||
+            !this.crossDomainChildOrigins.has(event.origin)) {
+            return;
+        }
+        const candidateSource = event.source;
+        if (!this.consumeCrossDomainEnvelopeBudget(candidateSource)) {
+            return;
+        }
+        const frame = this.findCrossDomainFrame(candidateSource);
+        if (frame === null || !frame.isConnected || frame.contentWindow === null) {
+            return;
+        }
+        const source = frame.contentWindow;
+        const existing = this.crossDomainFrames.get(source);
+        if (this.pendingCrossDomainFrames.has(source)) {
+            return;
+        }
+        const existingMatches = existing !== undefined &&
+            existing.origin === event.origin &&
+            existing.context === handshake.context &&
+            existing.nonce === handshake.nonce &&
+            existing.frame === frame;
+        if (existing !== undefined && !existingMatches) {
+            return;
+        }
+        const authorizationGeneration = this.crossDomainAuthorizationGeneration;
+        const pendingToken = Symbol();
+        this.pendingCrossDomainFrames.set(source, pendingToken);
+        let navigated = false;
+        const markNavigated = () => {
+            navigated = true;
+        };
+        frame.addEventListener('load', markNavigated, { once: true });
+        try {
+            const id = await this.checkNodeId(source);
+            if (id === null ||
+                navigated ||
+                !this.active() ||
+                authorizationGeneration !== this.crossDomainAuthorizationGeneration ||
+                !frame.isConnected ||
+                frame.contentWindow !== source) {
+                return;
+            }
+            const session = this.currentCrossDomainSession();
+            if (session === null) {
+                return;
+            }
+            const now = Date.now();
+            let state;
+            if (existingMatches) {
+                state = existing;
+                if (this.crossDomainFrameNeedsRotation(state, session.sessionID, now) &&
+                    !this.rotateCrossDomainFrameCapability(state, session.sessionID, now)) {
+                    return;
+                }
+                state.lastSeenAt = now;
+            }
+            else {
+                const capability = createCrossDomainSecret();
+                if (capability === null) {
+                    return;
+                }
+                state = {
+                    source,
+                    frame,
+                    origin: event.origin,
+                    protocolVersion: CROSS_DOMAIN_IFRAME_PROTOCOL_VERSION,
+                    context: handshake.context,
+                    nonce: handshake.nonce,
+                    capability,
+                    frameOrderNumber: this.nextCrossDomainFrameOrder++,
+                    sessionID: session.sessionID,
+                    capabilityExpiresAt: now + FRAME_CAPABILITY_TTL_MS,
+                    previousCapability: null,
+                    previousCapabilityExpiresAt: 0,
+                    lastSeenAt: now,
+                    rateWindowStartedAt: now,
+                    messagesInRateWindow: 0,
+                    bytesInRateWindow: 0,
+                };
+            }
+            const payload = this.frameInitPayload(state, id);
+            if (payload === null) {
+                return;
+            }
+            if (!existingMatches) {
+                if (existing !== undefined) {
+                    this.revokeCrossDomainFrame(source, existing);
+                }
+                this.crossDomainFrames.set(source, state);
+                frame.addEventListener('load', () => {
+                    this.revokeCrossDomainFrame(source, state);
+                }, { once: true });
+            }
+            this.postToCrossDomainFrame(state, proto.iframeId, payload);
+        }
+        finally {
+            frame.removeEventListener('load', markNavigated);
+            if (this.pendingCrossDomainFrames.get(source) === pendingToken) {
+                this.pendingCrossDomainFrames.delete(source);
+            }
+        }
+    }
+    validatedCrossDomainFrame(event, expectedLine) {
+        if (event.source === null ||
+            !this.crossDomainChildOrigins.has(event.origin) ||
+            event.source === window) {
+            return null;
+        }
+        const source = event.source;
+        const state = this.crossDomainFrames.get(source);
+        const now = Date.now();
+        const currentSessionID = this.session.getInfo().sessionID;
+        if (!state ||
+            state.origin !== event.origin ||
+            !state.frame.isConnected ||
+            state.frame.contentWindow !== source) {
+            if (state) {
+                this.revokeCrossDomainFrame(source);
+            }
+            return null;
+        }
+        if (currentSessionID === undefined || state.sessionID !== currentSessionID) {
+            this.revokeCrossDomainFrame(source);
+            return null;
+        }
+        const matchesCurrentCapability = now < state.capabilityExpiresAt && matchesCrossDomainEnvelope(event.data, expectedLine, state);
+        const matchesPreviousCapability = state.previousCapability !== null &&
+            now < state.previousCapabilityExpiresAt &&
+            matchesCrossDomainEnvelope(event.data, expectedLine, {
+                protocolVersion: state.protocolVersion,
+                context: state.context,
+                nonce: state.nonce,
+                capability: state.previousCapability,
+            });
+        if (!matchesCurrentCapability && !matchesPreviousCapability) {
+            if (now >= state.capabilityExpiresAt && now >= state.previousCapabilityExpiresAt) {
+                this.revokeCrossDomainFrame(source);
+            }
+            return null;
+        }
+        if ((matchesCurrentCapability && state.previousCapability !== null) ||
+            now >= state.previousCapabilityExpiresAt) {
+            state.previousCapability = null;
+            state.previousCapabilityExpiresAt = 0;
+        }
+        state.lastSeenAt = now;
+        return state;
+    }
+    consumeCrossDomainFrameBudget(state, messageCount, bytes) {
+        const now = Date.now();
+        if (now - state.rateWindowStartedAt >= FRAME_RATE_WINDOW_MS) {
+            state.rateWindowStartedAt = now;
+            state.messagesInRateWindow = 0;
+            state.bytesInRateWindow = 0;
+        }
+        if (state.messagesInRateWindow + messageCount > MAX_FRAME_MESSAGES_PER_WINDOW ||
+            state.bytesInRateWindow + bytes > MAX_FRAME_BYTES_PER_WINDOW) {
+            return false;
+        }
+        state.messagesInRateWindow += messageCount;
+        state.bytesInRateWindow += bytes;
+        return true;
+    }
     allowAppStart() {
         this.canStart = true;
         if (this.startTimeout) {
@@ -4998,6 +5548,7 @@ class App {
                 setTimeout(() => {
                     closing = false;
                 }, 500);
+                this.canvasRecorder?.flushPendingSnapshots();
                 if (this.worker) {
                     this.worker.postMessage('closing');
                 }
@@ -5038,22 +5589,39 @@ class App {
         }
         else if (data.type === 'compress') {
             const batch = data.batch;
+            const dataType = data.dataType;
             const batchSize = batch.byteLength;
-            if (batchSize > this.compressionThreshold) {
-                gzip(data.batch, { mtime: 0 }, (err, result) => {
-                    if (err) {
-                        this.debug.error('OxvoSessions compression error:', err);
-                        this.worker?.postMessage({ type: 'uncompressed', batch: batch });
-                    }
-                    else {
-                        this.worker?.postMessage({ type: 'compressed', batch: result });
-                    }
+            const hasCompressionAPI = 'CompressionStream' in globalThis;
+            if (batchSize > this.compressionThreshold && hasCompressionAPI) {
+                const blob = new Blob([batch]);
+                const stream = blob.stream().pipeThrough(new CompressionStream('gzip'));
+                new Response(stream)
+                    .arrayBuffer()
+                    .then((compressedBuffer) => {
+                    this.worker?.postMessage({
+                        type: 'compressed',
+                        batch: new Uint8Array(compressedBuffer),
+                        dataType,
+                    });
+                })
+                    .catch((err) => {
+                    this.debug.error('OxvoSessions compression error:', err);
+                    this.worker?.postMessage({ type: 'uncompressed', batch: batch, dataType });
                 });
             }
             else {
-                this.worker?.postMessage({ type: 'uncompressed', batch: batch });
+                this.worker?.postMessage({ type: 'uncompressed', batch: batch, dataType });
             }
         }
+        else if (data.type === 'local_save') {
+            const blob = new Blob([data.batch], { type: 'application/octet-stream' });
+            const url = URL.createObjectURL(blob);
+            const a = document.createElement('a');
+            a.href = url;
+            a.download = data.name;
+            a.click();
+            URL.revokeObjectURL(url);
+        }
         else if (data.type === 'queue_empty') {
             this.onSessionSent();
         }
@@ -5084,27 +5652,36 @@ class App {
             return;
         }
         if (this.insideIframe) {
-            window.parent.postMessage({
-                line: proto.iframeBatch,
-                messages: this.messages,
-            }, this.options.crossdomain?.parentDomain ?? '*');
+            this.postToParent(proto.iframeBatch, { messages: this.messages });
             this.commitCallbacks.forEach((cb) => cb(this.messages));
             this.messages.length = 0;
             return;
         }
-        if (this.worker === undefined || !this.messages.length) {
+        if (this.worker === undefined) {
             return;
         }
         if (!this.messages.length) {
-            // Release empty batches every 30 secs (1000 * 30ms)
+            // Send a keepalive batch every ~30s (1000 * 30ms) to keep the session active
             if (this.emptyBatchCounter < 1000) {
                 this.emptyBatchCounter++;
                 return;
             }
+            // Keepalive: send just Timestamp + TabData so the session stays alive
+            this.emptyBatchCounter = 0;
+            try {
+                this.worker?.postMessage([Timestamp(this.timestamp()), TabData(this.session.getTabId())]);
+            }
+            catch (e) {
+                this._debug('worker_keepalive', e);
+            }
+            return;
         }
         this.emptyBatchCounter = 0;
         try {
             requestIdleCb(() => {
+                if (!this.messages.length) {
+                    return;
+                }
                 this.messages.unshift(Timestamp(this.timestamp()), TabData(this.session.getTabId()));
                 this.worker?.postMessage(this.messages);
                 this.commitCallbacks.forEach((cb) => cb(this.messages));
@@ -5231,6 +5808,159 @@ class App {
             },
         };
     }
+    getBootstrapAttemptStorageKey(kind) {
+        return `${this.options.session_token_key}_bootstrap_idempotency_${kind}`;
+    }
+    isValidBootstrapAttempt(value, kind, currentTime) {
+        if (typeof value !== 'object' || value === null) {
+            return false;
+        }
+        const attempt = value;
+        if (attempt.version !== 1 ||
+            attempt.projectKey !== this.projectKey ||
+            typeof attempt.createdAt !== 'number' ||
+            !Number.isFinite(attempt.createdAt) ||
+            currentTime - attempt.createdAt >= BOOTSTRAP_ATTEMPT_TTL_MS ||
+            typeof attempt.idempotencyKey !== 'string' ||
+            attempt.idempotencyKey.length < 8 ||
+            attempt.idempotencyKey.length > 128 ||
+            !/^[A-Za-z0-9._:-]+$/.test(attempt.idempotencyKey) ||
+            typeof attempt.intentFingerprint !== 'string' ||
+            attempt.intentFingerprint.length === 0 ||
+            attempt.intentFingerprint.length > MAX_BOOTSTRAP_ATTEMPT_STORAGE_LENGTH ||
+            typeof attempt.requestTimestamp !== 'number' ||
+            !Number.isFinite(attempt.requestTimestamp) ||
+            typeof attempt.workerTimestamp !== 'number' ||
+            !Number.isFinite(attempt.workerTimestamp) ||
+            typeof attempt.requestBody !== 'string' ||
+            attempt.requestBody.length > MAX_BOOTSTRAP_ATTEMPT_STORAGE_LENGTH) {
+            return false;
+        }
+        try {
+            const body = JSON.parse(attempt.requestBody);
+            const intent = this.parseBootstrapIntent(attempt.intentFingerprint);
+            return (intent?.projectKey === this.projectKey &&
+                intent.kind === kind &&
+                body.app?.key === this.projectKey &&
+                body.session?.dry === false &&
+                body.session?.offline === (kind === 'offline') &&
+                typeof body.session?.token === 'string' &&
+                body.session.token === intent.token &&
+                body.session?.rule === intent.rule &&
+                (body.user?.id ?? '') === intent.userID &&
+                (body.user?.uuid ?? '') === intent.userUUID &&
+                body.meta?.ts === attempt.requestTimestamp &&
+                attempt.idempotencyKey.startsWith(`bootstrap:${kind}:`));
+        }
+        catch {
+            return false;
+        }
+    }
+    removeStoredBootstrapAttempt(kind) {
+        delete this.bootstrapAttempts[kind];
+        try {
+            this.sessionStorage.removeItem(this.getBootstrapAttemptStorageKey(kind));
+        }
+        catch {
+            // The in-memory copy is still cleared when storage is unavailable.
+        }
+    }
+    loadBootstrapAttempt(kind) {
+        const currentTime = Date.now();
+        const inMemoryAttempt = this.bootstrapAttempts[kind];
+        if (this.isValidBootstrapAttempt(inMemoryAttempt, kind, currentTime)) {
+            return inMemoryAttempt;
+        }
+        delete this.bootstrapAttempts[kind];
+        try {
+            const storedAttempt = this.sessionStorage.getItem(this.getBootstrapAttemptStorageKey(kind));
+            if (storedAttempt === null || storedAttempt.length > MAX_BOOTSTRAP_ATTEMPT_STORAGE_LENGTH) {
+                if (storedAttempt !== null) {
+                    this.removeStoredBootstrapAttempt(kind);
+                }
+                return undefined;
+            }
+            const parsedAttempt = JSON.parse(storedAttempt);
+            if (this.isValidBootstrapAttempt(parsedAttempt, kind, currentTime)) {
+                this.bootstrapAttempts[kind] = parsedAttempt;
+                return parsedAttempt;
+            }
+        }
+        catch {
+            // Treat corrupt or inaccessible storage as an absent pending attempt.
+        }
+        this.removeStoredBootstrapAttempt(kind);
+        return undefined;
+    }
+    getOrCreateBootstrapAttempt(kind, request) {
+        const existingAttempt = this.loadBootstrapAttempt(kind);
+        if (existingAttempt &&
+            this.bootstrapIntentsMatch(existingAttempt.intentFingerprint, request.intentFingerprint)) {
+            return existingAttempt;
+        }
+        if (existingAttempt) {
+            this.removeStoredBootstrapAttempt(kind);
+        }
+        const attempt = {
+            version: 1,
+            projectKey: this.projectKey,
+            createdAt: Date.now(),
+            idempotencyKey: `bootstrap:${kind}:${generateRandomId(40)}`,
+            ...request,
+        };
+        this.bootstrapAttempts[kind] = attempt;
+        try {
+            this.sessionStorage.setItem(this.getBootstrapAttemptStorageKey(kind), JSON.stringify(attempt));
+        }
+        catch {
+            // The in-memory copy still protects retries within this tracker instance.
+        }
+        return attempt;
+    }
+    clearBootstrapAttempt(kind) {
+        this.removeStoredBootstrapAttempt(kind);
+    }
+    buildBootstrapIntentFingerprint(params) {
+        const tracker = this.getTrackerInfo();
+        return JSON.stringify({
+            projectKey: this.projectKey,
+            kind: params.kind,
+            token: params.token ?? '',
+            rule: params.rule ?? '',
+            userID: this.session.getInfo().userID ?? '',
+            userUUID: tracker.userUUID ?? '',
+        });
+    }
+    parseBootstrapIntent(value) {
+        try {
+            const intent = JSON.parse(value);
+            if (intent.projectKey !== this.projectKey ||
+                (intent.kind !== 'recording' && intent.kind !== 'offline') ||
+                typeof intent.token !== 'string' ||
+                typeof intent.rule !== 'string' ||
+                typeof intent.userID !== 'string' ||
+                typeof intent.userUUID !== 'string') {
+                return undefined;
+            }
+            return intent;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    bootstrapIntentsMatch(existingFingerprint, currentFingerprint) {
+        const existing = this.parseBootstrapIntent(existingFingerprint);
+        const current = this.parseBootstrapIntent(currentFingerprint);
+        if (!existing || !current) {
+            return false;
+        }
+        return (existing.projectKey === current.projectKey &&
+            existing.kind === current.kind &&
+            existing.token === current.token &&
+            (current.rule === '' || existing.rule === current.rule) &&
+            (current.userID === '' || existing.userID === current.userID) &&
+            (current.userUUID === '' || existing.userUUID === current.userUUID));
+    }
     getSessionMeta() {
         return {
             ...this.session.getInfo(),
@@ -5298,10 +6028,22 @@ class App {
         }
     }
     checkSessionToken(startNewSession) {
-        const lsReset = this.sessionStorage.getItem(this.options.session_reset_key) !== null;
-        const needNewSessionID = startNewSession || lsReset;
+        const needReset = this.sessionStorage.getItem(this.options.session_reset_key) !== null;
+        let needNewSessionID = startNewSession || needReset;
         const sessionToken = this.session.getSessionSecret(this.projectKey);
-        return needNewSessionID || !sessionToken;
+        if (needReset) {
+            this.sessionStorage.removeItem(this.options.session_reset_key);
+        }
+        const storedVersion = this.sessionStorage.getItem(`${this.options.session_token_key}_version`);
+        if (!storedVersion || storedVersion !== PROTO_VERSION) {
+            needNewSessionID = true;
+            this.sessionStorage.setItem(`${this.options.session_token_key}_version`, PROTO_VERSION);
+        }
+        const isNewSession = needNewSessionID || !sessionToken;
+        if (isNewSession && sessionToken) {
+            this.session.clearSessionSecret();
+        }
+        return isNewSession;
     }
     /**
      * start buffering messages without starting the actual session, which gives
@@ -5373,7 +6115,7 @@ class App {
             })),
         });
         const { session = {}, client = {}, device = {} } = await r.json();
-        const { token, projectId } = session;
+        const { token, projectId, assistToken } = session;
         const { browser: userBrowser, city: userCity, country: userCountry, device: userDevice, os: userOS, state: userState, } = client;
         this.session.assign({ projectID: projectId });
         this.session.setUserInfo({
@@ -5386,6 +6128,7 @@ class App {
         });
         const onStartInfo = {
             sessionToken: token,
+            assistToken: typeof assistToken === 'string' ? assistToken : undefined,
             userUUID: device?.id || '',
             sessionID: session?.id || '',
         };
@@ -5401,7 +6144,6 @@ class App {
     offlineRecording(startOpts = {}, onSessionSent) {
         this.onSessionSent = onSessionSent;
         this.singleBuffer = true;
-        const isNewSession = this.checkSessionToken(startOpts.startNewSession);
         adjustTimeOrigin();
         this.coldStartTs = now();
         const saverBuffer = this.localStorage.getItem(bufferStorageKey);
@@ -5419,6 +6161,10 @@ class App {
         if (startOpts.startNewSession) {
             this.session.reset();
         }
+        const isNewSession = this.checkSessionToken(startOpts.startNewSession);
+        this.offlineRecordingSessionToken = isNewSession
+            ? undefined
+            : this.session.getSessionSecret(this.projectKey);
         this.session.assign({
             userID: startOpts.userID,
             metadata: startOpts.metadata,
@@ -5468,39 +6214,60 @@ class App {
      * */
     async uploadOfflineRecording() {
         this.stop(false);
-        const timestamp = now();
+        const freshTimestamp = now();
+        const bootstrapToken = this.offlineRecordingSessionToken ?? '';
+        const freshRequestBody = () => JSON.stringify(this.buildStartPayload({
+            timestamp: freshTimestamp,
+            dry: false,
+            offline: true,
+            bufferMs: freshTimestamp - this.coldStartTs,
+            token: bootstrapToken,
+        }));
+        const bootstrapAttempt = this.getOrCreateBootstrapAttempt('offline', {
+            intentFingerprint: this.buildBootstrapIntentFingerprint({
+                kind: 'offline',
+                token: bootstrapToken,
+            }),
+            requestTimestamp: freshTimestamp,
+            workerTimestamp: this.coldStartTs,
+            requestBody: freshRequestBody(),
+        });
         this.worker?.postMessage({
             type: 'start',
             pageNo: this.session.incPageNo(),
             ingestPoint: normalizeEndpoint(this.options.endpoint),
-            timestamp: this.coldStartTs,
+            timestamp: bootstrapAttempt.workerTimestamp,
             url: document.URL,
             connAttemptCount: this.options.connAttemptCount,
             connAttemptGap: this.options.connAttemptGap,
             tabId: this.session.getTabId(),
+            localDebug: this.options.__local_debug,
         });
         const ingestPoint = normalizeEndpoint(this.options.endpoint);
+        const headers = {
+            'Content-Type': 'application/json',
+            'Idempotency-Key': bootstrapAttempt.idempotencyKey,
+        };
         const r = await fetch(ingestPoint + '/v1/bootstrap', {
             method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-            },
-            body: JSON.stringify(this.buildStartPayload({
-                timestamp,
-                dry: false,
-                bufferMs: timestamp - this.coldStartTs,
-                token: '',
-            })),
+            headers,
+            body: bootstrapAttempt.requestBody,
         });
-        const { session = {}, client = {}, limits = {} } = await r.json();
+        if (r.status !== 200) {
+            throw new Error(`Server error: ${r.status}. ${await r.text()}`);
+        }
+        const { session = {}, client = {}, limits = {}, protocolVersion: offlineProtocolVersion, } = await r.json();
         const { token, projectId } = session;
         const { browser: userBrowser, city: userCity, country: userCountry, device: userDevice, os: userOS, state: userState, } = client;
         const { beacon: beaconSizeLimit } = limits;
-        this.worker?.postMessage({
-            type: 'auth',
-            token,
-            beaconSizeLimit,
-        });
+        if (typeof token !== 'string' ||
+            token.length === 0 ||
+            (typeof beaconSizeLimit !== 'number' && typeof beaconSizeLimit !== 'undefined')) {
+            throw new Error('Incorrect server response for offline recording bootstrap');
+        }
+        this.session.setSessionSecret(token, this.projectKey);
+        this.clearBootstrapAttempt('offline');
+        this.offlineRecordingSessionToken = token;
         this.session.assign({ projectID: projectId });
         this.session.setUserInfo({
             userBrowser,
@@ -5510,16 +6277,84 @@ class App {
             userOS,
             userState,
         });
+        this.worker?.postMessage({
+            type: 'auth',
+            token,
+            beaconSizeLimit,
+            protocolVersion: offlineProtocolVersion,
+        });
         while (this.bufferedMessages1.length > 0) {
             await this.flushBuffer(this.bufferedMessages1);
         }
         this.postToWorker([[-1]]);
         this.clearBuffers();
     }
+    startCrossDomainFrame(startOpts = {}) {
+        if (this.activityState === ActivityState.Active ||
+            this.activityState === ActivityState.Starting) {
+            const reason = 'OxvoSessions: trying to call `start()` on the instance that has been started already.';
+            return UnsuccessfulStart(reason);
+        }
+        if (this.crossDomainFrameSession === null ||
+            this.crossDomainFrameCapability === null ||
+            this.rootId === null) {
+            return UnsuccessfulStart('Cross-domain iframe handshake was not established.');
+        }
+        if (Object.keys(startOpts).length !== 0) {
+            this.prevOpts = startOpts;
+        }
+        if (startOpts.startCallback) {
+            this.userStartCallback = startOpts.startCallback;
+        }
+        try {
+            adjustTimeOrigin();
+            this.activityState = ActivityState.Starting;
+            this.delay = this.crossDomainFrameSession.delayMs;
+            this.session.clearSessionSecret();
+            this.session.assign({
+                sessionID: this.crossDomainFrameSession.sessionID,
+                projectID: this.crossDomainFrameSession.projectID,
+                timestamp: this.crossDomainFrameSession.startedAt,
+            });
+            const onStartInfo = {
+                sessionToken: '',
+                userUUID: this.crossDomainFrameSession.userUUID,
+                sessionID: this.crossDomainFrameSession.sessionID,
+            };
+            this.startCallbacks.forEach((callback) => callback(onStartInfo));
+            this.userStartCallback?.(SuccessfulStart(onStartInfo));
+            this.activityState = ActivityState.Active;
+            if (this.crossDomainFrameCanvas?.enabled && !this.options.canvas.disableCanvas) {
+                this.canvasRecorder =
+                    this.canvasRecorder ??
+                        new CanvasRecorder(this, {
+                            fps: this.crossDomainFrameCanvas.fps ?? 15,
+                            quality: this.crossDomainFrameCanvas.quality ?? 'medium',
+                            isDebug: this.options.canvas.__save_canvas_locally,
+                            fixedScaling: this.options.canvas.fixedCanvasScaling,
+                            useAnimationFrame: this.options.canvas.useAnimationFrame,
+                            framesSupport: this.crossDomainFrameCanvas.framesSupport,
+                        });
+            }
+            this.observer.crossdomainObserve(this.rootId, this.frameOderNumber, this.frameLevel);
+            this.ticker.start();
+            this.canvasRecorder?.startTracking();
+            return SuccessfulStart(onStartInfo);
+        }
+        catch (reason) {
+            this.stop();
+            const message = reason instanceof Error ? reason.message : String(reason);
+            this.signalError(message, []);
+            return UnsuccessfulStart(message);
+        }
+    }
     async _start(startOpts = {}, resetByWorker = false, conditionName) {
         if (Object.keys(startOpts).length !== 0) {
             this.prevOpts = startOpts;
         }
+        if (startOpts.startCallback) {
+            this.userStartCallback = startOpts.startCallback;
+        }
         const isColdStart = this.activityState === ActivityState.ColdStart;
         if (isColdStart && this.coldInterval) {
             clearInterval(this.coldInterval);
@@ -5551,67 +6386,89 @@ class App {
             userID: userId || undefined,
             metadata: startOpts.metadata,
         });
-        const timestamp = now();
+        const sessionToken = this.session.getSessionSecret(this.projectKey);
+        const isNewSession = this.checkSessionToken(startOpts.startNewSession);
+        const freshTimestamp = now();
+        const freshWorkerTimestamp = isColdStart ? this.coldStartTs : freshTimestamp;
+        const bootstrapToken = isNewSession ? '' : sessionToken;
+        const freshRequestBody = () => JSON.stringify(this.buildStartPayload({
+            timestamp: freshTimestamp,
+            dry: false,
+            bufferMs: this.coldStartTs ? freshTimestamp - this.coldStartTs : 0,
+            token: bootstrapToken,
+            rule: conditionName,
+            width: window.screen.width,
+            height: window.screen.height,
+        }));
+        const bootstrapAttempt = this.getOrCreateBootstrapAttempt('recording', {
+            intentFingerprint: this.buildBootstrapIntentFingerprint({
+                kind: 'recording',
+                token: bootstrapToken,
+                rule: conditionName,
+            }),
+            requestTimestamp: freshTimestamp,
+            workerTimestamp: freshWorkerTimestamp,
+            requestBody: freshRequestBody(),
+        });
+        const timestamp = bootstrapAttempt.requestTimestamp;
         this.worker?.postMessage({
             type: 'start',
             pageNo: this.session.incPageNo(),
             ingestPoint: normalizeEndpoint(this.options.endpoint),
-            timestamp: isColdStart ? this.coldStartTs : timestamp,
+            timestamp: bootstrapAttempt.workerTimestamp,
             url: document.URL,
             connAttemptCount: this.options.connAttemptCount,
             connAttemptGap: this.options.connAttemptGap,
             tabId: this.session.getTabId(),
+            localDebug: this.options.__local_debug,
         });
-        const sessionToken = this.session.getSessionSecret(this.projectKey);
-        const isNewSession = this.checkSessionToken(startOpts.startNewSession);
-        this.sessionStorage.removeItem(this.options.session_reset_key);
         this.debug.log('OxvoSessions: starting session; need new session id?', isNewSession, 'session token: ', sessionToken);
         try {
             const ingestPoint = normalizeEndpoint(this.options.endpoint);
+            const headers = {
+                'Content-Type': 'application/json',
+                'Idempotency-Key': bootstrapAttempt.idempotencyKey,
+            };
             const r = await window.fetch(ingestPoint + '/v1/bootstrap', {
                 method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                },
-                body: JSON.stringify(this.buildStartPayload({
-                    timestamp,
-                    dry: false,
-                    bufferMs: timestamp - this.coldStartTs,
-                    token: isNewSession ? '' : sessionToken,
-                    rule: conditionName,
-                    width: window.screen.width,
-                    height: window.screen.height,
-                })),
+                headers,
+                body: bootstrapAttempt.requestBody,
             });
             if (r.status !== 200) {
                 const error = await r.text();
                 const reason = error === CANCELED ? CANCELED : `Server error: ${r.status}. ${error}`;
-                return UnsuccessfulStart(reason);
+                throw reason;
             }
             if (!this.worker && !this.insideIframe) {
                 const reason = 'no worker found after start request (this should not happen in real world)';
-                this.signalError(reason, []);
-                return UnsuccessfulStart(reason);
+                throw new Error(reason);
             }
-            const { session = {}, device = {}, client = {}, limits = {}, canvas = {}, flags = {} } = await r.json();
-            const { token, id: sessionID, projectId: projectID, delayMs: delay, startedAt: startTimestamp, } = session;
+            const { session = {}, device = {}, client = {}, limits = {}, canvas = {}, flags = {}, protocolVersion, } = await r.json();
+            const { token, assistToken, id: sessionID, projectId: projectID, delayMs: delay, startedAt: startTimestamp, } = session;
             const { id: userUUID } = device;
             const { browser: userBrowser, city: userCity, country: userCountry, device: userDevice, os: userOS, state: userState, } = client;
             const { beacon: beaconSizeLimit, compressAt: compressionThreshold } = limits;
-            const { enabled: canvasEnabled, quality: canvasQuality, fps: canvasFPS } = canvas;
+            const { enabled: canvasEnabled, quality: canvasQuality, fps: canvasFPS, framesSupport, } = canvas;
             const socketOnly = flags?.socketOnly;
             if (typeof token !== 'string' ||
+                (typeof assistToken !== 'string' && typeof assistToken !== 'undefined') ||
                 typeof userUUID !== 'string' ||
                 (typeof startTimestamp !== 'number' && typeof startTimestamp !== 'undefined') ||
                 typeof sessionID !== 'string' ||
                 typeof delay !== 'number' ||
                 (typeof beaconSizeLimit !== 'number' && typeof beaconSizeLimit !== 'undefined')) {
                 const reason = `Incorrect server response: ${JSON.stringify(r)}`;
-                this.signalError(reason, []);
-                return UnsuccessfulStart(reason);
+                throw new Error(reason);
             }
+            this.crossDomainCanvasConfig = {
+                enabled: canvasEnabled === true,
+                ...(['low', 'medium', 'high'].includes(canvasQuality) ? { quality: canvasQuality } : {}),
+                ...(typeof canvasFPS === 'number' ? { fps: canvasFPS } : {}),
+                ...(typeof framesSupport === 'boolean' ? { framesSupport } : {}),
+            };
             this.delay = delay;
             this.session.setSessionSecret(token, this.projectKey);
+            this.clearBootstrapAttempt('recording');
             if (sessionToken && sessionToken !== token) {
                 this.bc?.postMessage({
                     type: proto.reset,
@@ -5640,6 +6497,7 @@ class App {
                     type: 'auth',
                     token,
                     beaconSizeLimit,
+                    protocolVersion,
                 });
             }
             if (!isNewSession && token === sessionToken) {
@@ -5651,14 +6509,13 @@ class App {
             Object.entries(this.session.getInfo().metadata).forEach(([key, value]) => this.send(Metadata(key, value)));
             this.localStorage.setItem(this.options.local_uuid_key, userUUID);
             this.compressionThreshold = compressionThreshold;
-            const onStartInfo = { sessionToken: token, userUUID, sessionID };
+            const onStartInfo = { sessionToken: token, assistToken, userUUID, sessionID };
             // TODO: start as early as possible (before receiving the token)
             /** after start */
             this.startCallbacks.forEach((cb) => cb(onStartInfo)); // MBTODO: callbacks after DOM "mounted" (observed)
-            if (startOpts.startCallback) {
-                startOpts.startCallback(SuccessfulStart(onStartInfo));
+            if (this.userStartCallback) {
+                this.userStartCallback(SuccessfulStart(onStartInfo));
             }
-            await this.markerWatcher.fetchTags(normalizeEndpoint(this.options.endpoint), token);
             this.activityState = ActivityState.Active;
             if (this.options.crossdomain?.enabled) {
                 void this.bootChildrenFrames();
@@ -5672,6 +6529,7 @@ class App {
                             isDebug: this.options.canvas.__save_canvas_locally,
                             fixedScaling: this.options.canvas.fixedCanvasScaling,
                             useAnimationFrame: this.options.canvas.useAnimationFrame,
+                            framesSupport: !!framesSupport,
                         });
             }
             /** --------------- COLD START BUFFER ------------------*/
@@ -5694,11 +6552,11 @@ class App {
             }
             this.ticker.start();
             this.canvasRecorder?.startTracking();
+            void this.markerWatcher.fetchTags(normalizeEndpoint(this.options.endpoint), token);
             return SuccessfulStart(onStartInfo);
         }
         catch (reason) {
             this.stop();
-            this.session.reset();
             if (!reason) {
                 console.error('Unknown error during start');
                 this.signalError('Unknown error', []);
@@ -5724,6 +6582,23 @@ class App {
             }, 100);
         });
     }
+    async waitCrossDomainStart(timeoutMs = 15000) {
+        if (this.canStart)
+            return true;
+        return new Promise((resolve) => {
+            const interval = setInterval(() => {
+                if (!this.canStart)
+                    return;
+                clearInterval(interval);
+                clearTimeout(timeout);
+                resolve(true);
+            }, 100);
+            const timeout = setTimeout(() => {
+                clearInterval(interval);
+                resolve(false);
+            }, timeoutMs);
+        });
+    }
     async waitStarted() {
         return this.waitStatus(ActivityState.Active);
     }
@@ -5751,20 +6626,35 @@ class App {
             return Promise.resolve(UnsuccessfulStart(reason));
         }
         if (this.insideIframe) {
+            if (this.crossDomainParentOrigin === null || this.crossDomainFrameNonce === null) {
+                return UnsuccessfulStart('Cross-domain iframe capture requires an explicit parentDomain and secure random support.');
+            }
             this.signalIframeTracker();
         }
-        if (!document.hidden) {
+        const startWhenReady = async () => {
+            if (this.insideIframe) {
+                const ready = await this.waitCrossDomainStart();
+                if (!ready) {
+                    this.crossDomainConnectionRequested = false;
+                    this.crossDomainResumeAfterHandshake = false;
+                    this.clearCrossDomainFrameAuthorization();
+                    return UnsuccessfulStart('Cross-domain iframe handshake timed out.');
+                }
+                return this.startCrossDomainFrame(args[0]);
+            }
             await this.waitStart();
             return this._start(...args);
+        };
+        if (!document.hidden) {
+            return startWhenReady();
         }
         else {
             return new Promise((resolve) => {
                 const onVisibilityChange = async () => {
                     if (!document.hidden) {
-                        await this.waitStart();
                         // eslint-disable-next-line
                         document.removeEventListener('visibilitychange', onVisibilityChange);
-                        resolve(this._start(...args));
+                        resolve(startWhenReady());
                     }
                 };
                 // eslint-disable-next-line
@@ -5818,12 +6708,18 @@ class App {
                 this.canvasRecorder?.clear();
                 this.messages.length = 0;
                 this.parentActive = false;
+                this.pageFrames = [];
             }
             finally {
                 this.activityState = ActivityState.NotActive;
                 this.debug.log('OxvoSessions tracking stopped.');
             }
         }
+        if (this.insideIframe) {
+            this.crossDomainConnectionRequested = false;
+            this.crossDomainResumeAfterHandshake = false;
+            this.clearCrossDomainFrameAuthorization();
+        }
     }
 }
 
@@ -6315,6 +7211,12 @@ function Img (app) {
         sendImgAttrs(node);
         observer.observe(node, { attributes: true, attributeFilter: ['src', 'srcset'] });
     });
+    // On a runtime level change, re-evaluate placeholder vs real src for this image.
+    app.attachResanitizeCallback((node) => {
+        if (hasTag(node, 'img')) {
+            sendImgAttrs(node);
+        }
+    });
 }
 
 const INPUT_TYPES = [
@@ -6372,19 +7274,24 @@ const labelElementFor = IN_BROWSER && 'labels' in HTMLInputElement.prototype
             }
         }
     };
-function getInputLabel(node) {
-    let label = getLabelAttribute(node);
-    if (label === null) {
-        const labelElement = labelElementFor(node);
-        label =
-            (labelElement && labelElement.innerText) ||
-                node.placeholder ||
-                node.name ||
-                node.id ||
-                node.className ||
-                node.type;
-    }
-    return normSpaces(label).slice(0, 100);
+function getInputLabel(node, customAttributes) {
+    const oxvosessionsLabel = getLabelAttribute(node);
+    if (oxvosessionsLabel !== null)
+        return normSpaces(oxvosessionsLabel).slice(0, 100);
+    const customAttributeLabel = getCustomAttributeLabel(node, customAttributes);
+    if (customAttributeLabel)
+        return customAttributeLabel;
+    if (node.id)
+        return `#${node.id}`;
+    const classLabel = getClassSelector(node);
+    if (classLabel)
+        return classLabel;
+    const labelElement = labelElementFor(node);
+    const label = node.name ||
+        node.placeholder ||
+        (labelElement && labelElement.innerText) ||
+        node.type;
+    return normSpaces(label || '').slice(0, 100);
 }
 const InputMode = {
     Plain: 0,
@@ -6406,9 +7313,12 @@ function Input (app, opts) {
         }
         else if (app.sanitizer.isObscured(id) ||
             (inputMode === InputMode.Plain &&
-                ((options.maskInputNumbers && node.type !== 'date' && /\d\d\d\d/.test(value)) ||
+                ((options.maskInputNumbers &&
+                    node.type !== 'date' &&
+                    /\d\d\d\d/.test(value)) ||
                     (options.maskInputDates && node.type === 'date') ||
-                    (options.maskInputEmails && (node.type === 'email' || !!~value.indexOf('@')))))) {
+                    (options.maskInputEmails &&
+                        (node.type === 'email' || !!~value.indexOf('@')))))) {
             inputMode = InputMode.Obscured;
         }
         let mask = 0;
@@ -6428,11 +7338,24 @@ function Input (app, opts) {
         const { value, mask } = getInputValue(id, node);
         app.send(SetInputValue(id, value, mask));
     }
+    const tagSelectorMap = new Map();
     const inputValues = new Map();
     const checkboxValues = new Map();
+    function getTagSelector(id, node) {
+        const cached = tagSelectorMap.get(id);
+        if (cached !== undefined)
+            return cached;
+        const tagMatch = app.tagMatcher.match(node);
+        if (tagMatch) {
+            tagSelectorMap.set(id, tagMatch.selector);
+            return tagMatch.selector;
+        }
+        return null;
+    }
     app.attachStopCallback(() => {
         inputValues.clear();
         checkboxValues.clear();
+        tagSelectorMap.clear();
     });
     function trackInputValue(id, node) {
         if (inputValues.get(id) === node.value) {
@@ -6465,12 +7388,19 @@ function Input (app, opts) {
     }, 3);
     function sendInputChange(id, node, hesitationTime, inputTime) {
         const { value, mask } = getInputValue(id, node);
-        let label = getInputLabel(node);
+        let label = getTagSelector(id, node) || getInputLabel(node, options.customAttributes);
         if (app.sanitizer.maskAllByDefault) {
             label = label.replaceAll(/./g, '*');
         }
         app.send(InputChange(id, value, mask !== 0, label, hesitationTime, inputTime));
     }
+    // Re-emit a field's value when its sanitization level changes at runtime.
+    // getInputValue() reads the current level, so re-sending applies the new mask.
+    app.attachResanitizeCallback((node, id) => {
+        if (isTextFieldElement(node) || hasTag(node, 'select')) {
+            sendInputValue(id, node);
+        }
+    });
     app.nodes.attachNodeCallback(app.safe((node) => {
         const id = app.nodes.getID(node);
         if (id === undefined) {
@@ -6574,21 +7504,28 @@ function _getTarget(target, document) {
     return target === document.documentElement ? null : target;
 }
 function Mouse (app, options) {
-    const { disableClickmaps = false } = options || {};
+    const { disableClickmaps = false, customAttributes } = options || {};
     function getTargetLabel(target) {
         const dl = getLabelAttribute(target);
         if (dl !== null) {
             return dl;
         }
         if (hasTag(target, 'input')) {
-            return getInputLabel(target);
-        }
+            return getInputLabel(target, customAttributes);
+        }
+        const customAttributeLabel = getCustomAttributeLabel(target, customAttributes);
+        if (customAttributeLabel)
+            return customAttributeLabel;
+        if (target.id)
+            return `#${target.id}`;
+        const classLabel = getClassSelector(target);
+        if (classLabel)
+            return classLabel;
         if (isClickable(target)) {
             let label = '';
             if (target instanceof HTMLElement) {
                 label = app.sanitizer.getInnerTextSecure(target);
             }
-            label = label || target.id || target.className;
             return normSpaces(label).slice(0, 100);
         }
         return '';
@@ -6641,7 +7578,13 @@ function Mouse (app, options) {
     };
     const patchDocument = (document, topframe = false) => {
         function getSelector(id, target) {
-            return (selectorMap[id] = selectorMap[id] || _getSelector(target));
+            if (selectorMap[id])
+                return selectorMap[id];
+            const tagMatch = app.tagMatcher.match(target);
+            if (tagMatch) {
+                return (selectorMap[id] = tagMatch.selector);
+            }
+            return (selectorMap[id] = _getSelector(target));
         }
         const attachListener = topframe
             ? app.attachEventListener.bind(app) // attached/removed on start/stop
@@ -6732,6 +7675,11 @@ function getCSSPath(el) {
         return false;
     if (el.id)
         return `#${cssEscape(el.id)}`;
+    // if has data attributes - use them as they are more likely to be stable and unique
+    const dataAttr = Array.from(el.attributes).find(attr => attr.name.startsWith('data-'));
+    if (dataAttr) {
+        return `[${dataAttr.name}="${cssEscape(dataAttr.value)}"]`;
+    }
     const parts = [];
     while (el && el.nodeType === 1 && el !== el.ownerDocument) {
         if (el.id) {
@@ -7072,11 +8020,27 @@ function Scroll (app, insideIframe) {
     }, 5, false);
 }
 
+const NativeURL = URL;
+const defaultUrlSanitizer = (url) => {
+    const hiddenQueryParams = ['jwt', 'password', 'reset-password', 'invitation', 'secret', 'token'];
+    try {
+        const u = new NativeURL(url);
+        u.searchParams.forEach((value, key) => {
+            if (hiddenQueryParams.includes(key.toLowerCase())) {
+                u.searchParams.set(key, '*'.repeat(value.length));
+            }
+        });
+        return u.toString();
+    }
+    catch {
+        return url;
+    }
+};
 function Viewport (app, options) {
     let url, width, height;
     let navigationStart;
     let referrer = document.referrer;
-    const urlSanitizer = options?.urlSanitizer || ((u) => u);
+    const urlSanitizer = options?.urlSanitizer || defaultUrlSanitizer;
     const titleSanitizer = options?.titleSanitizer || ((t) => t);
     const sendSetPageLocation = app.safe(() => {
         const currURL = document.URL;
@@ -8902,6 +9866,8 @@ function webAnimations(app, options = {}) {
             const lastKF = anim.effect.getKeyframes().at(-1);
             if (!lastKF)
                 return;
+            if (!el || !(el instanceof Element) || !el.isConnected)
+                return;
             const computedStyle = getComputedStyle(el);
             const keys = Object.keys(lastKF).filter((p) => !toIgnore.includes(p));
             // @ts-ignore
@@ -9313,7 +10279,7 @@ class ConstantProperties {
             user_id: this.user_id,
             distinct_id: this.deviceId,
             sdk_edition: 'web',
-            sdk_version: '7.1.0',
+            sdk_version: '7.3.4',
             timezone: getUTCOffsetString(),
             search_engine: this.searchEngine,
         };
@@ -9701,10 +10667,11 @@ class People {
  * Creates batches of events, then sends them at intervals.
  */
 class Batcher {
-    constructor(backendUrl, getToken, init) {
+    constructor(backendUrl, getToken, init, standalone) {
         this.backendUrl = backendUrl;
         this.getToken = getToken;
         this.init = init;
+        this.standalone = standalone;
         this.autosendInterval = 5 * 1000;
         this.retryTimeout = 3 * 1000;
         this.retryLimit = 3;
@@ -9714,10 +10681,20 @@ class Batcher {
             [categories.events]: [],
         };
         this.intervalId = null;
+        this.stopped = false;
+        this.paused = false;
+        this.onVisibilityChange = () => {
+            this.paused = document.hidden;
+        };
     }
     getBatches() {
         this.batch[categories.people] = this.dedupePeopleEvents();
-        const finalData = { data: this.batch };
+        const finalData = {
+            data: {
+                [categories.people]: [...this.batch[categories.people]],
+                [categories.events]: [...this.batch[categories.events]],
+            },
+        };
         return finalData;
     }
     addEvent(event) {
@@ -9793,6 +10770,9 @@ class Batcher {
         return Array.from(uniqueEventsByType.values());
     }
     sendBatch(batch) {
+        if (this.stopped) {
+            return;
+        }
         const sentBatch = batch;
         let attempts = 0;
         const send = () => {
@@ -9809,11 +10789,27 @@ class Batcher {
                 },
                 body: JSON.stringify(sentBatch),
             })
-                .then((response) => {
+                .then(async (response) => {
+                if (response.status === 401) {
+                    const body = await response.json().catch(() => null);
+                    if (!this.standalone && body?.error === 'token expired') {
+                        this.stop();
+                        return;
+                    }
+                    if (attempts < this.retryLimit) {
+                        return this.init().then(() => {
+                            send();
+                        });
+                    }
+                    return;
+                }
                 if (response.status === 403) {
-                    this.init().then(() => {
-                        send();
-                    });
+                    if (attempts < this.retryLimit) {
+                        return this.init().then(() => {
+                            send();
+                        });
+                    }
+                    return;
                 }
                 if (!response.ok) {
                     throw new Error(`HTTP error! status: ${response.status}`);
@@ -9828,8 +10824,15 @@ class Batcher {
         void send();
     }
     startAutosend() {
+        if (this.intervalId) {
+            clearInterval(this.intervalId);
+        }
+        this.paused = document.hidden;
+        document.addEventListener('visibilitychange', this.onVisibilityChange);
         this.intervalId = setInterval(() => {
-            this.flush();
+            if (!this.paused) {
+                this.flush();
+            }
         }, this.autosendInterval);
     }
     flush() {
@@ -9849,10 +10852,18 @@ class Batcher {
             clearInterval(this.intervalId);
             this.intervalId = null;
         }
+        document.removeEventListener('visibilitychange', this.onVisibilityChange);
+        this.stopped = true;
+    }
+    restart() {
+        this.stopped = false;
+        this.startAutosend();
     }
 }
 
 const STORAGEKEY = '__or_sdk_analytics_token';
+const START_ATTEMPT_STORAGE_KEY = '__or_sdk_analytics_start_attempt';
+const START_ATTEMPT_TTL_MS = 24 * 60 * 60 * 1000;
 const normalizeIngestPoint = (ingest) => {
     const base = ingest.replace(/\/$/, '');
     return base.endsWith('/oxvo') ? base : `${base}/oxvo`;
@@ -9876,11 +10887,14 @@ class Analytics {
     constructor(options) {
         this.token = null;
         this.standalone = false;
+        this.pendingStartAttempt = null;
         this._getToken = () => {
             if (this.standalone) {
                 return this.token;
             }
-            return this.getToken();
+            else {
+                return this.getToken();
+            }
         };
         this._getTimestamp = () => {
             if (this.standalone) {
@@ -9917,9 +10931,14 @@ class Analytics {
                     timezone: defaultFields.timezone,
                     search_engine: defaultFields.search_engine,
                 };
+                const attempt = this.startAttempt(JSON.stringify(data));
                 const resp = await fetch(apiEdp, {
                     method: 'POST',
-                    body: JSON.stringify(data),
+                    headers: {
+                        'Content-Type': 'application/json',
+                        'Idempotency-Key': attempt.idempotencyKey,
+                    },
+                    body: attempt.requestBody,
                 });
                 if (!resp.ok) {
                     throw new Error(`HTTP error! status: ${resp.status}`);
@@ -9928,12 +10947,26 @@ class Analytics {
                 if (result.token) {
                     this.token = result.token;
                     this.sessionStorage.setItem(STORAGEKEY, result.token);
+                    this.clearStartAttempt();
                 }
                 else {
                     throw new Error('No token received from server');
                 }
             }
         };
+        /**
+         * Used by tracker when running in blundled mode
+         */
+        this.onStart = () => {
+            if (!this.standalone) {
+                this.batcher.restart();
+            }
+        };
+        this.onStop = () => {
+            if (!this.standalone) {
+                this.batcher.stop();
+            }
+        };
         this.reset = () => {
             this.people.reset(true);
             this.events.reset();
@@ -9941,6 +10974,7 @@ class Analytics {
             if (this.standalone) {
                 this.token = null;
                 this.sessionStorage.setItem(STORAGEKEY, '');
+                this.clearStartAttempt();
             }
         };
         /**
@@ -9972,13 +11006,98 @@ class Analytics {
         this.standalone = !options.notStandalone;
         this.token = this.sessionStorage.getItem(STORAGEKEY);
         this.constantProperties = new ConstantProperties(this.localStorage, this.sessionStorage);
-        this.batcher = new Batcher(this.backendUrl, this._getToken, this.init);
+        this.batcher = new Batcher(this.backendUrl, this._getToken, this.init, this.standalone);
         this.events = new Events(this.constantProperties, this._getTimestamp, this.batcher);
         this.people = new People(this.constantProperties, this._getTimestamp, this.setUserId, this.batcher);
         if (options.notStandalone) {
             this.init();
         }
     }
+    loadStartAttempt() {
+        if (this.isValidStartAttempt(this.pendingStartAttempt)) {
+            return this.pendingStartAttempt;
+        }
+        this.pendingStartAttempt = null;
+        let serialized;
+        try {
+            serialized = this.sessionStorage.getItem(START_ATTEMPT_STORAGE_KEY);
+        }
+        catch {
+            return null;
+        }
+        if (!serialized || serialized.length > 1024 * 1024) {
+            return null;
+        }
+        try {
+            const attempt = JSON.parse(serialized);
+            if (this.isValidStartAttempt(attempt)) {
+                this.pendingStartAttempt = attempt;
+                return attempt;
+            }
+        }
+        catch {
+            // Treat corrupt storage as an absent pending attempt.
+        }
+        return null;
+    }
+    isValidStartAttempt(value) {
+        if (typeof value !== 'object' || value === null) {
+            return false;
+        }
+        const attempt = value;
+        const currentTime = Date.now();
+        if (attempt.version !== 1 ||
+            attempt.projectKey !== this.projectKey ||
+            typeof attempt.createdAt !== 'number' ||
+            !Number.isFinite(attempt.createdAt) ||
+            attempt.createdAt > currentTime ||
+            currentTime - attempt.createdAt >= START_ATTEMPT_TTL_MS ||
+            typeof attempt.idempotencyKey !== 'string' ||
+            attempt.idempotencyKey.length < 8 ||
+            attempt.idempotencyKey.length > 128 ||
+            !/^[A-Za-z0-9._:-]+$/.test(attempt.idempotencyKey) ||
+            typeof attempt.requestBody !== 'string' ||
+            attempt.requestBody.length > 1024 * 1024) {
+            return false;
+        }
+        try {
+            const request = JSON.parse(attempt.requestBody);
+            return request.projectKey === this.projectKey;
+        }
+        catch {
+            return false;
+        }
+    }
+    startAttempt(requestBody) {
+        const existing = this.loadStartAttempt();
+        if (existing) {
+            return existing;
+        }
+        const attempt = {
+            version: 1,
+            projectKey: this.projectKey,
+            createdAt: Date.now(),
+            idempotencyKey: `insights:start:${generateRandomId(40)}`,
+            requestBody,
+        };
+        this.pendingStartAttempt = attempt;
+        try {
+            this.sessionStorage.setItem(START_ATTEMPT_STORAGE_KEY, JSON.stringify(attempt));
+        }
+        catch {
+            // The in-memory copy still protects retries within this Analytics instance.
+        }
+        return attempt;
+    }
+    clearStartAttempt() {
+        this.pendingStartAttempt = null;
+        try {
+            this.sessionStorage.setItem(START_ATTEMPT_STORAGE_KEY, '');
+        }
+        catch {
+            // The in-memory copy is still cleared when storage is unavailable.
+        }
+    }
 }
 
 const Messages = _Messages;
@@ -10025,7 +11144,7 @@ class API {
         this.signalStartIssue = (reason, missingApi) => {
             const doNotTrack = this.checkDoNotTrack();
             console.log("Tracker couldn't start due to:", JSON.stringify({
-                trackerVersion: '7.1.0',
+                trackerVersion: '7.3.4',
                 siteKey: this.options.siteKey,
                 doNotTrack,
                 reason: missingApi.length ? `missing api: ${missingApi.join(',')}` : reason,
@@ -10037,6 +11156,31 @@ class API {
             }
             this.app.restartCanvasTracking();
         };
+        /**
+         * Re-evaluates sanitization against the current DOM and re-emits whatever
+         * changed, updating already-recorded nodes mid-session. Call after toggling
+         * `data-oxvosessions-*` attributes or after changing whatever your `domSanitizer`
+         * keys on (class/id/etc).
+         *
+         * @param el - the highest node you changed; omit to re-scan the whole document;
+         * scanning the entire doc is O(dom size)
+         * */
+        this.resanitize = (el) => {
+            if (this.app === null) {
+                return;
+            }
+            this.app.resanitize(el);
+        };
+        /**
+         * Returns the sanitization level the tracker currently has for a node
+         * (0 = Plain, 1 = Obscured, 2 = Hidden), or undefined if it isn't tracked.
+         * */
+        this.checkSanitization = (el) => {
+            if (this.app === null) {
+                return undefined;
+            }
+            return this.app.checkSanitization(el);
+        };
         this.getSessionLink = (options) => {
             if (this.app === null) {
                 return undefined;
@@ -10179,6 +11323,12 @@ class API {
                     : (options.analytics?.endpoint ?? options.endpoint ?? defaultEdp),
                 projectKey: options.siteKey,
             });
+            app.attachStartCallback(() => {
+                this.analytics?.onStart();
+            });
+            app.attachStopCallback(() => {
+                this.analytics?.onStop();
+            });
         }
         if (!this.crossdomainMode) {
             // no need to send iframe viewport data since its a node for us
@@ -10190,7 +11340,7 @@ class API {
             // no tabs in iframes yet
             Tabs(app);
         }
-        Mouse(app, options.mouse);
+        Mouse(app, { ...options.mouse, customAttributes: options.customAttributes });
         // inside iframe, we ignore viewport scroll
         Scroll(app, this.crossdomainMode);
         CSSRules(app, options.css);