@tagadapay/headless-sdk 1.14.1 → 1.17.0

package/dist/pixels/pixelTracker.js

@@ -0,0 +1,797 @@
+/**
+ * Framework-agnostic pixel tracker.
+ *
+ * Init / fire logic for Meta, TikTok, Snapchat, Pinterest, GTM/GA4 and
+ * Microsoft Clarity pixels —
+ * extracted from `react/hooks/usePixelTracking.tsx` so non-React entry points
+ * (Studio islands hydrator, full-SPA runtime) can fire pixel events from
+ * `window.__TGD_STEP_CONFIG__.pixels`.
+ *
+ * The React provider is a thin adapter on top of this module.
+ */
+import { resolvePixelEvents, pixelIdKeyOf, GA4_PARAM_KEY, } from './pixelMapping.js';
+import { buildHashedIdentity, canHashIdentity, } from './pixelIdentity.js';
+// ---------------------------------------------------------------------------
+// Duplicate guard (time-window based)
+// ---------------------------------------------------------------------------
+function createDuplicateGuard(windowMs) {
+    const lastEvents = new Map();
+    return (eventName, parameters, eventId) => {
+        try {
+            // Include eventId in the dedup key so two distinct logical events with the
+            // same name+params (e.g. two Purchases) are not collapsed by the guard.
+            const key = JSON.stringify({ eventName, parameters, eventId });
+            const now = Date.now();
+            const last = lastEvents.get(key);
+            if (last && now - last < windowMs)
+                return false;
+            lastEvents.set(key, now);
+            return true;
+        }
+        catch {
+            return true;
+        }
+    };
+}
+// ---------------------------------------------------------------------------
+// Browser-specific: fire an event to the correct global pixel function
+// ---------------------------------------------------------------------------
+/* eslint-disable @typescript-eslint/no-explicit-any */
+/**
+ * The entry's own identifier, read at whichever key its provider uses —
+ * `pixelId`, or `containerId` / `projectId` for GTM and Clarity.
+ */
+function pixelIdOf(pixel) {
+    if (!pixel)
+        return null;
+    const value = pixel[pixelIdKeyOf(pixel)];
+    return typeof value === 'string' && value ? value : null;
+}
+function fire(provider, name, params, pixel, options = {}) {
+    if (typeof window === 'undefined')
+        return;
+    const w = window;
+    const eventId = options.eventId;
+    switch (provider) {
+        case 'facebook': {
+            // Target this pixel by id rather than calling the global `fbq('track')`,
+            // which Meta broadcasts to EVERY pixel registered on the page — including
+            // ones a merchant initialised from a pasted script we don't manage. That
+            // broadcast made our Purchase land on foreign pixels, undeduplicated.
+            // Mirrors the per-pixel targeting already used for TikTok below.
+            //
+            // Meta dedup: pass eventID as the trailing `eventID` option so this
+            // browser-pixel event matches a server-side CAPI event with the same id.
+            // See https://developers.facebook.com/docs/marketing-api/conversions-api/deduplicate-pixel-and-server-events
+            // No id means no addressable pixel: stay silent rather than fall back to
+            // the broadcast this change exists to remove. `sanitizePixels` drops every
+            // entry without a usable id, so this is unreachable today.
+            const pixelId = pixelIdOf(pixel);
+            if (!pixelId)
+                break;
+            if (eventId)
+                w.fbq?.('trackSingle', pixelId, name, params, { eventID: eventId });
+            else
+                w.fbq?.('trackSingle', pixelId, name, params);
+            break;
+        }
+        case 'tiktok': {
+            // Use ttq.instance(pixelId) to target each pixel individually,
+            // since the global ttq.track() only fires for the sdkid pixel.
+            const pixelId = pixelIdOf(pixel);
+            const target = pixelId && w.ttq?.instance ? w.ttq.instance(pixelId) : w.ttq;
+            if (name === 'Pageview') {
+                target?.page?.();
+            }
+            else if (eventId) {
+                target?.track?.(name, params, { event_id: eventId });
+            }
+            else {
+                target?.track?.(name, params);
+            }
+            break;
+        }
+        case 'snapchat':
+            // Snap dedup: the browser event carries client_dedup_id = the event id that the
+            // server CAPI event sends as event_id (destinations.md §9.3).
+            w.snaptr?.('track', name, eventId ? { ...params, client_dedup_id: eventId } : params);
+            break;
+        case 'pinterest':
+            // Pinterest handles page views via pintrk('page'), not pintrk('track', 'pagevisit')
+            if (name === 'pagevisit') {
+                w.pintrk?.('page');
+            }
+            else {
+                w.pintrk?.('track', name, eventId ? { ...params, event_id: eventId } : params);
+            }
+            break;
+        case 'gtm':
+            fireGTM(name, params);
+            break;
+        // Clarity's custom-event API takes a name and nothing else; params stay
+        // out rather than being stringified into the event name.
+        case 'clarity':
+            w.clarity?.('event', name);
+            break;
+    }
+}
+/**
+ * Apply advanced matching to a single Snapchat pixel. Snap reads user info set
+ * at init and attaches it to every event fired afterwards; re-calling init with
+ * the (now-known) hashed identifiers updates it. We pass pre-hashed values via
+ * the `user_hashed_*` keys.
+ */
+function applySnapchatIdentity(w, pixelId, h) {
+    if (!w?.snaptr)
+        return;
+    const userInfo = {};
+    if (h.email)
+        userInfo.user_hashed_email = h.email;
+    if (h.phone)
+        userInfo.user_hashed_phone_number = h.phone;
+    if (Object.keys(userInfo).length === 0)
+        return;
+    w.snaptr('init', pixelId, userInfo);
+}
+/**
+ * Apply advanced matching to a single TikTok pixel via `ttq.identify`. TikTok
+ * applies identified data to subsequent events and accepts pre-hashed SHA-256
+ * values (it detects 64-char hex and won't double-hash). Target the specific
+ * pixel instance, mirroring the per-pixel track() targeting.
+ */
+function applyTikTokIdentity(w, pixelId, h) {
+    const target = w?.ttq?.instance ? w.ttq.instance(pixelId) : w?.ttq;
+    if (!target?.identify)
+        return;
+    const info = {};
+    if (h.email)
+        info.email = h.email;
+    if (h.phone)
+        info.phone_number = h.phone;
+    if (h.externalId)
+        info.external_id = h.externalId;
+    if (Object.keys(info).length === 0)
+        return;
+    target.identify(info);
+}
+/**
+ * Apply advanced matching to a single Meta pixel. Meta reads advanced-matching
+ * data passed to `fbq('init', pixelId, userData)` and attaches it to every
+ * event fired afterwards; re-calling init with the (now-known) identifiers
+ * updates it (init is idempotent and never auto-fires PageView). We pass RAW
+ * values — `fbevents.js` normalizes + SHA-256-hashes them in-browser before
+ * they leave the page — because Meta's phone normalization (digits-only) differs
+ * from Snap/TikTok's E.164, so letting Meta hash avoids a mismatch.
+ */
+function applyMetaIdentity(w, pixelId, raw) {
+    if (!w?.fbq)
+        return;
+    const ud = {};
+    if (raw.email)
+        ud.em = raw.email.trim().toLowerCase();
+    if (raw.phone) {
+        const d = raw.phone.replace(/[^0-9]/g, '');
+        if (d)
+            ud.ph = d;
+    }
+    if (raw.externalId)
+        ud.external_id = raw.externalId.trim();
+    if (Object.keys(ud).length === 0)
+        return;
+    w.fbq('init', pixelId, ud);
+}
+/**
+ * Google Ads enhanced conversions / GA4 user-provided data.
+ *
+ * Google's documented mechanism is `gtag('set', 'user_data', {...})` BEFORE the
+ * conversion event fires (support.google.com/google-ads/answer/13258081) —
+ * `user_data` as an event parameter is not read for enhanced conversions. We
+ * pass RAW values; the Google tag normalizes + SHA-256 hashes in-browser.
+ * Field names per spec: `email`, `phone_number` (strict E.164 — dropped when
+ * not in that shape, email is the preferred key anyway), and
+ * `address.{first_name,last_name,street,city,region,postal_code,country}`.
+ * Exported for unit tests.
+ */
+export function applyGoogleIdentity(w, ud) {
+    if (typeof w?.gtag !== 'function')
+        return;
+    const userData = {};
+    if (ud.email_address)
+        userData.email = ud.email_address.trim().toLowerCase();
+    if (ud.phone_number) {
+        const phone = ud.phone_number.replace(/[^0-9+]/g, '');
+        if (/^\+[0-9]{10,14}$/.test(phone))
+            userData.phone_number = phone;
+    }
+    if (ud.address) {
+        const a = ud.address;
+        const address = {};
+        if (a.first_name)
+            address.first_name = a.first_name;
+        if (a.last_name)
+            address.last_name = a.last_name;
+        if (a.street)
+            address.street = a.street;
+        if (a.city)
+            address.city = a.city;
+        if (a.region)
+            address.region = a.region;
+        if (a.postal_code)
+            address.postal_code = a.postal_code;
+        if (a.country)
+            address.country = a.country;
+        if (Object.keys(address).length > 0)
+            userData.address = address;
+    }
+    if (Object.keys(userData).length === 0)
+        return;
+    w.gtag('set', 'user_data', userData);
+}
+function fireGTM(event, params) {
+    try {
+        const w = window;
+        const hasEcommerce = params && typeof params === 'object' && 'ecommerce' in params;
+        if (w.gtag) {
+            // gtag.js (GA4 config tag) reads ecommerce fields at the top level of the
+            // event, not under a nested `ecommerce` key — flatten it back out.
+            if (hasEcommerce) {
+                const { ecommerce, ...rest } = params;
+                w.gtag('event', event, { ...rest, ...ecommerce });
+            }
+            else {
+                w.gtag('event', event, params);
+            }
+        }
+        else if (w.dataLayer) {
+            // GA4 best practice: clear the previous ecommerce object before pushing a
+            // new one so item arrays from earlier events don't bleed through.
+            if (hasEcommerce)
+                w.dataLayer.push({ ecommerce: null });
+            w.dataLayer.push({ event, ...params });
+        }
+    }
+    catch (error) {
+        console.error('[SDK GTM] Error:', error);
+    }
+}
+/* eslint-enable @typescript-eslint/no-explicit-any */
+// ===========================================================================
+// Pixel initialization (browser-only)
+// All pixel globals are accessed via `win` typed as `any` to avoid
+// `declare global` augmentation issues across tsconfig scopes.
+// ===========================================================================
+/* eslint-disable @typescript-eslint/no-explicit-any */
+const win = (typeof window !== 'undefined' ? window : undefined);
+const SCRIPT_LOAD_TIMEOUT_MS = 5000;
+function waitForScriptLoad(script) {
+    // If the script has already loaded, resolve immediately
+    if (script.dataset.loaded)
+        return Promise.resolve();
+    return new Promise((resolve) => {
+        const done = () => { script.dataset.loaded = '1'; clearTimeout(timer); resolve(); };
+        const timer = setTimeout(done, SCRIPT_LOAD_TIMEOUT_MS);
+        script.addEventListener('load', done, { once: true });
+        script.addEventListener('error', done, { once: true });
+    });
+}
+let _metaScriptEl = null;
+function initMetaPixel(pixelId) {
+    if (!win)
+        return Promise.resolve();
+    // Initialize Meta base code once
+    if (!win.fbq) {
+        const n = function (...args) {
+            if (n.callMethod)
+                n.callMethod(...args);
+            else
+                n.queue.push(args);
+        };
+        n.queue = [];
+        n.loaded = true;
+        n.version = '2.0';
+        win.fbq = n;
+        if (!win._fbq)
+            win._fbq = n;
+        const t = document.createElement('script');
+        t.async = true;
+        t.src = 'https://connect.facebook.net/en_US/fbevents.js';
+        const s = document.getElementsByTagName('script')[0];
+        s?.parentNode?.insertBefore(t, s);
+        _metaScriptEl = t;
+    }
+    // Register each pixel ID (fbq supports multiple pixels via multiple init calls)
+    win.fbq('init', pixelId);
+    return _metaScriptEl ? waitForScriptLoad(_metaScriptEl) : Promise.resolve();
+}
+let _tiktokBaseInitialized = false;
+function initTikTokPixel(pixelId) {
+    if (!win)
+        return Promise.resolve();
+    // Initialize TikTok base code once
+    if (!_tiktokBaseInitialized) {
+        _tiktokBaseInitialized = true;
+        win.TiktokAnalyticsObject = 'ttq';
+        const ttq = (win.ttq = win.ttq || []);
+        ttq.methods = [
+            'page', 'track', 'identify', 'instances', 'debug', 'on', 'off',
+            'once', 'ready', 'alias', 'group', 'enableCookie', 'disableCookie',
+            'holdConsent', 'revokeConsent', 'grantConsent',
+        ];
+        ttq.setAndDefer = function (t, e) {
+            t[e] = function (...args) { t.push([e, ...args]); };
+        };
+        for (const method of ttq.methods) {
+            ttq.setAndDefer(ttq, method);
+        }
+        ttq.instance = function (t) {
+            const e = ttq._i[t] || [];
+            for (const method of ttq.methods) {
+                ttq.setAndDefer(e, method);
+            }
+            return e;
+        };
+        ttq.load = function (e, n) {
+            const r = 'https://analytics.tiktok.com/i18n/pixel/events.js';
+            ttq._i = ttq._i || {};
+            ttq._i[e] = [];
+            ttq._i[e]._u = r;
+            ttq._t = ttq._t || {};
+            ttq._t[e] = +new Date();
+            ttq._o = ttq._o || {};
+            ttq._o[e] = n || {};
+            const s = document.createElement('script');
+            s.type = 'text/javascript';
+            s.async = true;
+            s.src = r + '?sdkid=' + e + '&lib=ttq';
+            const p = document.getElementsByTagName('script')[0];
+            p?.parentNode?.insertBefore(s, p);
+        };
+    }
+    // Skip if this specific pixel ID is already registered
+    if (win.ttq._i?.[pixelId])
+        return Promise.resolve();
+    // Register pixel and load its script
+    win.ttq.load(pixelId);
+    // Find the script we just created and wait for it
+    const scripts = document.querySelectorAll('script[src*="analytics.tiktok.com/i18n/pixel/events.js"]');
+    const lastScript = scripts[scripts.length - 1];
+    return lastScript ? waitForScriptLoad(lastScript) : Promise.resolve();
+}
+let _snapchatScriptEl = null;
+function initSnapchatPixel(pixelId) {
+    if (!win)
+        return Promise.resolve();
+    // Initialize Snapchat base code once
+    if (!win.snaptr) {
+        const a = function (...args) {
+            if (a.handleRequest)
+                a.handleRequest(...args);
+            else
+                a.queue.push(args);
+        };
+        a.queue = [];
+        win.snaptr = a;
+        const r = document.createElement('script');
+        r.async = true;
+        r.src = 'https://sc-static.net/scevent.min.js';
+        const u = document.getElementsByTagName('script')[0];
+        u?.parentNode?.insertBefore(r, u);
+        _snapchatScriptEl = r;
+    }
+    // Register each pixel ID (snaptr supports multiple pixels via multiple init calls)
+    win.snaptr('init', pixelId);
+    return _snapchatScriptEl ? waitForScriptLoad(_snapchatScriptEl) : Promise.resolve();
+}
+let _pinterestScriptEl = null;
+function initPinterestPixel(pixelId) {
+    if (!win)
+        return Promise.resolve();
+    // Initialize Pinterest base code once
+    if (!win.pintrk) {
+        const a = function (...args) { a.queue.push(args); };
+        a.queue = [];
+        win.pintrk = a;
+        const s = document.createElement('script');
+        s.async = true;
+        s.src = 'https://s.pinimg.com/ct/core.js';
+        const u = document.getElementsByTagName('script')[0];
+        u?.parentNode?.insertBefore(s, u);
+        _pinterestScriptEl = s;
+    }
+    // Register each pixel ID (pintrk supports multiple pixels via multiple load calls)
+    win.pintrk('load', pixelId);
+    // Note: pintrk('page') is NOT called here — the auto page-view fires via fire().
+    return _pinterestScriptEl ? waitForScriptLoad(_pinterestScriptEl) : Promise.resolve();
+}
+/**
+ * Load the Microsoft Clarity tag for one project.
+ *
+ * Mirrors the vendor snippet: a queueing stub so `clarity(...)` calls made
+ * before the script lands are replayed, then the tag itself. Clarity ignores a
+ * second project on the same page, so a project already present is a no-op.
+ */
+function initClarity(projectId) {
+    if (!win || !projectId)
+        return Promise.resolve();
+    if (document.querySelector(`script[src*="clarity.ms/tag/${projectId}"]`))
+        return Promise.resolve();
+    if (!win.clarity) {
+        const q = function (...args) { q.q.push(args); };
+        q.q = [];
+        win.clarity = q;
+    }
+    const s = document.createElement('script');
+    s.async = true;
+    s.src = `https://www.clarity.ms/tag/${projectId}`;
+    const first = document.getElementsByTagName('script')[0];
+    if (first?.parentNode)
+        first.parentNode.insertBefore(s, first);
+    else
+        (document.head || document.getElementsByTagName('head')[0])?.appendChild(s);
+    return waitForScriptLoad(s);
+}
+function initGTM(containerId) {
+    if (!win || !containerId)
+        return Promise.resolve();
+    const isGtmContainer = containerId.startsWith('GTM-');
+    const scriptUrlPart = isGtmContainer
+        ? `googletagmanager.com/gtm.js?id=${containerId}`
+        : `googletagmanager.com/gtag/js?id=${containerId}`;
+    if (document.querySelector(`script[src*="${scriptUrlPart}"]`))
+        return Promise.resolve();
+    win.dataLayer = win.dataLayer || [];
+    // Push referrer domain context into dataLayer before GTM loads, so tags
+    // inside the container can use it for cross-domain tracking configuration.
+    try {
+        const ref = document.referrer && new URL(document.referrer).hostname;
+        if (ref && ref !== window.location.hostname) {
+            win.dataLayer.push({ tagada_referrer_domain: ref });
+        }
+    }
+    catch { /* ignore invalid referrer */ }
+    if (isGtmContainer) {
+        win.dataLayer.push({ 'gtm.start': new Date().getTime(), event: 'gtm.js' });
+        const f = document.getElementsByTagName('script')[0];
+        const j = document.createElement('script');
+        j.async = true;
+        j.src = 'https://www.googletagmanager.com/gtm.js?id=' + containerId;
+        if (f?.parentNode)
+            f.parentNode.insertBefore(j, f);
+        else
+            (document.head || document.getElementsByTagName('head')[0])?.appendChild(j);
+        const noscript = document.createElement('noscript');
+        const iframe = document.createElement('iframe');
+        iframe.src = `https://www.googletagmanager.com/ns.html?id=${containerId}`;
+        iframe.height = '0';
+        iframe.width = '0';
+        iframe.style.display = 'none';
+        iframe.style.visibility = 'hidden';
+        noscript.appendChild(iframe);
+        (document.body || document.getElementsByTagName('body')[0])?.insertBefore(noscript, document.body?.firstChild ?? null);
+        return waitForScriptLoad(j);
+    }
+    else {
+        if (!win.gtag) {
+            win.gtag = function (..._args) { win.dataLayer.push(arguments); };
+        }
+        win.gtag('js', new Date());
+        // Enable cross-domain tracking: accept incoming _gl parameter from referring
+        // domains (e.g. Shopify store → TagadaPay checkout) so Google preserves the
+        // client-id/session across the redirect.
+        const linkerConfig = { accept_incoming: true };
+        try {
+            const ref = document.referrer && new URL(document.referrer).hostname;
+            if (ref && ref !== window.location.hostname) {
+                linkerConfig.domains = [ref, window.location.hostname];
+            }
+        }
+        catch { /* ignore invalid referrer */ }
+        win.gtag('config', containerId, { linker: linkerConfig });
+        const script = document.createElement('script');
+        script.async = true;
+        script.src = 'https://www.googletagmanager.com/gtag/js?id=' + containerId;
+        const firstScript = document.getElementsByTagName('script')[0];
+        if (firstScript?.parentNode)
+            firstScript.parentNode.insertBefore(script, firstScript);
+        else
+            (document.head || document.getElementsByTagName('head')[0])?.appendChild(script);
+        return waitForScriptLoad(script);
+    }
+}
+/* eslint-enable @typescript-eslint/no-explicit-any */
+// ---------------------------------------------------------------------------
+// Tracker factory
+// ---------------------------------------------------------------------------
+// ---------------------------------------------------------------------------
+// Config sanitisation (TAG-1871)
+// ---------------------------------------------------------------------------
+/** Longest ID we accept — real IDs top out around 20 chars. */
+const MAX_PIXEL_ID_LENGTH = 64;
+/**
+ * The only shape any supported pixel / container / project ID takes: Meta
+ * digits, TikTok alphanumerics, Snapchat alphanumerics + dashes, Pinterest
+ * digits, Clarity project ids and `GTM-`/`AW-`/`G-` containers are all drawn
+ * from `[A-Za-z0-9_-]`.
+ */
+const SAFE_PIXEL_ID_PATTERN = new RegExp(`^[A-Za-z0-9_-]{1,${MAX_PIXEL_ID_LENGTH}}$`);
+/** True when `value` is a single, well-formed pixel / container ID. */
+export function isSafePixelId(value) {
+    return typeof value === 'string' && SAFE_PIXEL_ID_PATTERN.test(value.trim());
+}
+/**
+ * Trim every pixel/container ID and DROP the ones that aren't plausibly IDs.
+ *
+ * The trim keeps per-pixel event targeting (TikTok `ttq.instance`) working when
+ * the CRM stored stray whitespace. The drop is the load-bearing part: a
+ * merchant once pasted a whole TikTok `<script>` snippet into the Pixel ID
+ * field, the CRM split it on every comma into 56 "pixels", and handing those
+ * fragments to `ttq.load()` sent TikTok's SDK into a hot loop that pinned the
+ * renderer at 100% CPU *before first paint* — a blank checkout for days.
+ *
+ * The CRM now rejects such values at input, but this guard is deliberately
+ * independent: it neutralises configs that are ALREADY polluted, on pages that
+ * were baked before the fix, with no data migration and no re-publish.
+ */
+function sanitizePixels(pixels) {
+    const out = {};
+    const dropped = [];
+    for (const [provider, list] of Object.entries(pixels)) {
+        if (!Array.isArray(list))
+            continue;
+        const kept = [];
+        for (const px of list) {
+            // GTM keys off containerId, Clarity off projectId, everyone else pixelId.
+            const key = pixelIdKeyOf(px);
+            const raw = px?.[key];
+            if (!isSafePixelId(raw)) {
+                dropped.push(raw);
+                continue;
+            }
+            kept.push({ ...px, [key]: raw.trim() });
+        }
+        out[provider] = kept;
+    }
+    if (dropped.length > 0) {
+        console.warn(`[SDK Pixels] Ignored ${dropped.length} malformed pixel ID(s) — tracking for those entries is disabled.`, dropped);
+    }
+    return out;
+}
+/**
+ * Resolve once the browser has had a chance to paint.
+ *
+ * Third-party pixel SDKs run arbitrary vendor code on the main thread and can
+ * stall it (TikTok's did, indefinitely — TAG-1871). Injecting them before first
+ * paint turns any such stall into a blank page. Deferring past the first frame
+ * means the worst case degrades to "no tracking" instead of "no checkout".
+ *
+ * Double-rAF is the standard "after paint" signal. The timer is a fallback for
+ * backgrounded tabs (where rAF may never fire) and for non-browser environments
+ * that expose a `window` without `requestAnimationFrame`.
+ */
+const PAINT_FALLBACK_MS = 1500;
+function afterFirstPaint() {
+    if (typeof window === 'undefined')
+        return Promise.resolve();
+    return new Promise((resolve) => {
+        let settled = false;
+        const finish = () => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(fallback);
+            resolve();
+        };
+        const raf = typeof win?.requestAnimationFrame === 'function'
+            ? win.requestAnimationFrame.bind(win)
+            : undefined;
+        const fallback = setTimeout(finish, raf ? PAINT_FALLBACK_MS : 0);
+        if (raf)
+            raf(() => raf(finish));
+    });
+}
+/**
+ * Create a pixel tracker for a given pixels config.
+ * Kicks off pixel script init once the first frame has painted, fires PageView
+ * when init resolves, and returns a `track()` function that no-ops until then.
+ */
+export function createPixelTracker(rawPixels, opts) {
+    const pixels = rawPixels ? sanitizePixels(rawPixels) : rawPixels;
+    const shouldTrackEvent = createDuplicateGuard(5000);
+    let pixelsInitialized = false;
+    const initPromise = (async () => {
+        if (!pixels || typeof window === 'undefined')
+            return;
+        // Never inject a third-party tag before the page has painted (TAG-1871).
+        await afterFirstPaint();
+        const loadPromises = [];
+        try {
+            pixels.facebook?.forEach((px) => { if (px.enabled && px.pixelId)
+                loadPromises.push(initMetaPixel(px.pixelId)); });
+            pixels.tiktok?.forEach((px) => { if (px.enabled && px.pixelId)
+                loadPromises.push(initTikTokPixel(px.pixelId)); });
+            pixels.snapchat?.forEach((px) => { if (px.enabled && px.pixelId)
+                loadPromises.push(initSnapchatPixel(px.pixelId)); });
+            pixels.pinterest?.forEach((px) => { if (px.enabled && px.pixelId)
+                loadPromises.push(initPinterestPixel(px.pixelId)); });
+            pixels.gtm?.forEach((px) => { if (px.enabled && px.containerId)
+                loadPromises.push(initGTM(px.containerId)); });
+            pixels.clarity?.forEach((px) => { if (px.enabled && px.projectId)
+                loadPromises.push(initClarity(px.projectId)); });
+            await Promise.all(loadPromises);
+        }
+        catch (error) {
+            console.error('[SDK Pixels] Initialization error:', error);
+        }
+        pixelsInitialized = true;
+    })();
+    // Advanced matching: feed customer identity to Meta (fbq init, raw — Meta
+    // hashes), Snapchat (re-init, hashed) + TikTok (identify, hashed). Applied
+    // once per identity and cached, so repeated track()/identify() calls don't
+    // re-apply. Each provider persists the match keys onto every subsequent
+    // event it fires, so calling this as soon as the email is known lifts match
+    // quality on InitiateCheckout + Purchase alike. `_identityReady` is awaited
+    // before Snap/TikTok events fire so the hashed keys are attached in time.
+    let _identityKey = null;
+    let _identityReady = null;
+    const applyIdentity = (id) => {
+        if (!pixels)
+            return null;
+        if (!id.email && !id.phone && !id.externalId)
+            return null;
+        const key = `${id.email ?? ''}|${id.phone ?? ''}|${id.externalId ?? ''}`;
+        if (_identityKey === key && _identityReady)
+            return _identityReady;
+        _identityKey = key;
+        // Meta takes raw values and hashes in-browser — apply immediately, no need
+        // to await our own hashing (and it works even without SubtleCrypto).
+        pixels.facebook?.forEach((px) => {
+            if (px.enabled && px.pixelId)
+                applyMetaIdentity(win, px.pixelId, id);
+        });
+        // Google Ads enhanced conversions: gtag('set','user_data') persists onto
+        // every subsequent gtag event, including the send_to conversion. Raw values,
+        // Google hashes in-browser (same rationale as Meta).
+        if (pixels.gtm?.some((px) => px.enabled)) {
+            applyGoogleIdentity(win, { email_address: id.email, phone_number: id.phone });
+        }
+        // Snapchat + TikTok want pre-hashed SHA-256 values, which we compute
+        // ourselves so raw PII never leaves the page. Skips when no secure context.
+        if (!canHashIdentity())
+            return (_identityReady = Promise.resolve());
+        // Always resolves (errors are swallowed) so deferred event fires never hang.
+        _identityReady = (async () => {
+            try {
+                const hashed = await buildHashedIdentity(id);
+                pixels.snapchat?.forEach((px) => {
+                    if (px.enabled && px.pixelId)
+                        applySnapchatIdentity(win, px.pixelId, hashed);
+                });
+                pixels.tiktok?.forEach((px) => {
+                    if (px.enabled && px.pixelId)
+                        applyTikTokIdentity(win, px.pixelId, hashed);
+                });
+            }
+            catch (error) {
+                console.error('[SDK Pixels] identify error:', error);
+            }
+        })();
+        return _identityReady;
+    };
+    // Derive identity from the GA4 enrichment the thank-you page already attaches
+    // (`_ga4.user_data`), so Purchase events get advanced matching with no
+    // call-site changes. Returns the readiness promise, or null when absent.
+    const applyIdentityFromParams = (parameters) => {
+        const ga4 = parameters[GA4_PARAM_KEY];
+        const ud = ga4?.user_data;
+        if (!ud)
+            return null;
+        // Google enhanced conversions get the FULL user_data (incl. address) here,
+        // richer than the email/phone identity below — and this runs synchronously
+        // before the gtag('event') fires in track(), which is what Google requires.
+        // Bypasses the identity dedup on purpose: gtag('set') is idempotent and the
+        // address may not have been known at identify() time.
+        if (pixels?.gtm?.some((px) => px.enabled))
+            applyGoogleIdentity(win, ud);
+        return applyIdentity({
+            email: ud.email_address,
+            phone: ud.phone_number,
+            externalId: ga4?.user_id,
+        });
+    };
+    const track = (eventName, parameters = {}, options = {}) => {
+        if (!pixels || !pixelsInitialized)
+            return;
+        if (!shouldTrackEvent(eventName, parameters, options.eventId))
+            return;
+        try {
+            // Apply advanced matching before firing so Snap/TikTok carry the match
+            // keys on this event. Other providers fire immediately (unaffected).
+            const identityReady = applyIdentityFromParams(parameters);
+            const events = resolvePixelEvents(pixels, eventName, parameters);
+            // Deduplicate by provider: the Snapchat/Pinterest SDKs broadcast to all
+            // registered pixel IDs internally, so we only need to fire once per
+            // provider. GTM, TikTok and Meta need per-pixel firing (GTM for Google Ads
+            // send_to targeting, TikTok because ttq.instance() targets a specific
+            // pixel, Meta because fbq('trackSingle') does — relying on Meta's
+            // broadcast instead leaked our events onto pixels a pasted script had
+            // initialised).
+            const firedProviders = new Set();
+            // Per-pixel providers still need per-pixel dedup: a merchant field of
+            // "123;123" expands into two entries with the same id (splitPixelConfig),
+            // which would otherwise fire the same event twice at the same pixel.
+            const firedPixels = new Set();
+            for (const { provider, mapped, pixel } of events) {
+                // Gate Snap/TikTok on identity application (when present) so the match
+                // keys are set first; a few ms of deferral, only for those providers.
+                const emit = identityReady && (provider === 'snapchat' || provider === 'tiktok')
+                    ? (fn) => { identityReady.then(fn); }
+                    : (fn) => { fn(); };
+                if (provider === 'gtm' || provider === 'tiktok' || provider === 'facebook') {
+                    const pixelKey = `${provider}:${pixelIdOf(pixel) ?? ''}`;
+                    if (firedPixels.has(pixelKey))
+                        continue;
+                    firedPixels.add(pixelKey);
+                    emit(() => fire(provider, mapped.name, mapped.params, pixel, options));
+                }
+                else {
+                    if (!firedProviders.has(provider)) {
+                        emit(() => fire(provider, mapped.name, mapped.params, undefined, options));
+                        firedProviders.add(provider);
+                    }
+                }
+            }
+        }
+        catch (error) {
+            console.error('[SDK Pixels] Tracking error:', error);
+        }
+    };
+    // Auto page-view: fire once after init resolves.
+    if (opts?.autoPageView !== false)
+        initPromise.then(() => {
+            if (typeof window === 'undefined')
+                return;
+            track('PageView', { path: window.location.pathname });
+        });
+    return {
+        initPromise,
+        get pixelsInitialized() { return pixelsInitialized; },
+        track,
+        identify: (identity) => { applyIdentity(identity); },
+    };
+}
+function readPixelsFromStepConfig() {
+    if (typeof window === 'undefined')
+        return undefined;
+    const raw = window.__TGD_STEP_CONFIG__;
+    if (!raw)
+        return undefined;
+    try {
+        const parsed = typeof raw === 'string' ? JSON.parse(raw) : raw;
+        const pixels = parsed?.pixels;
+        return pixels && typeof pixels === 'object' ? pixels : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * One-shot bootstrap: reads `window.__TGD_STEP_CONFIG__.pixels`, creates a
+ * tracker, kicks off init, and stashes it on `window.__TGD_PIXEL_TRACKER__`.
+ *
+ * Idempotent — both the islands SDK and the full-SPA runtime may call this,
+ * but only the first call creates a tracker. Returns the active tracker
+ * (existing or newly created), or null if there's no window or no pixels.
+ */
+export function bootstrapPixelTrackerFromWindow() {
+    if (typeof window === 'undefined')
+        return null;
+    if (window.__TGD_PIXEL_TRACKER__)
+        return window.__TGD_PIXEL_TRACKER__;
+    const pixels = readPixelsFromStepConfig();
+    if (!pixels)
+        return null;
+    const tracker = createPixelTracker(pixels);
+    window.__TGD_PIXEL_TRACKER__ = tracker;
+    return tracker;
+}
+//# sourceMappingURL=pixelTracker.js.map