featurely-site-manager 1.1.18 → 1.1.19

package/CHANGELOG.md

@@ -69,11 +69,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **CRITICAL FIX**: Replaced Math.random() with crypto.getRandomValues() for CSPRNG session IDs and anonymous IDs
 - **CRITICAL FIX**: Added RegExp pattern escaping to prevent ReDoS (Regular Expression Denial of Service) attacks
 - Added error handling for invalid targetPages patterns
+
 ## [1.0.5] - 2026-03-15
 
 ### Security
 
-- **CRITICAL FIXAdded DOMPurify sanitization for customHtml maintenance pages to prevent XSS attacks
+- \*\*CRITICAL FIXAdded DOMPurify sanitization for customHtml maintenance pages to prevent XSS attacks
 - Blocks dangerous tags (script, iframe, embed, object, etc.)
 - Removes event handlers (onerror, onload, onclick, etc.)
 - Prevents javascript: URIs and other malicious protocols

package/README.md

@@ -179,8 +179,12 @@ const manager = new SiteManager({
   onUpdateRequired: (versionInfo) => {
     console.log("Update required:", versionInfo.latestVersion);
     // Force user to update (breaking changes)
-    if (confirm(`Update required: ${versionInfo.latestVersion.title}\n\n${versionInfo.latestVersion.releaseNotes}`)) {
-      window.location.href = versionInfo.latestVersion.downloadUrl || '/update';
+    if (
+      confirm(
+        `Update required: ${versionInfo.latestVersion.title}\n\n${versionInfo.latestVersion.releaseNotes}`
+      )
+    ) {
+      window.location.href = versionInfo.latestVersion.downloadUrl || "/update";
     }
   },
 });
@@ -255,12 +259,12 @@ manager.trackEvent("purchase_completed", {
 
 When `enableAnalytics` is `true` (default), the SDK automatically tracks:
 
-| Event | When | Properties |
-| --- | --- | --- |
-| `session_start` | On first page load | `path`, `title`, `referrer` |
-| `page_view` | On every page navigation | `path`, `title`, `referrer`, `isLoggedIn`, `userId?`, `userEmail?` |
-| `page_exit` | When navigating away from a page | `path`, `durationSeconds` |
-| `user_login` | First time `setUser()` is called with a userId | `userId`, `userEmail?`, `userName?` |
+| Event           | When                                           | Properties                                                         |
+| --------------- | ---------------------------------------------- | ------------------------------------------------------------------ |
+| `session_start` | On first page load                             | `path`, `title`, `referrer`                                        |
+| `page_view`     | On every page navigation                       | `path`, `title`, `referrer`, `isLoggedIn`, `userId?`, `userEmail?` |
+| `page_exit`     | When navigating away from a page               | `path`, `durationSeconds`                                          |
+| `user_login`    | First time `setUser()` is called with a userId | `userId`, `userEmail?`, `userName?`                                |
 
 Page tracking is SPA-compatible — it patches `history.pushState` and `history.replaceState` and listens to `popstate` so navigations in React, Next.js, Vue, and similar frameworks are captured automatically.
 
@@ -282,13 +286,13 @@ manager.init();
 
 The overlay panel has five tabs:
 
-| Tab | Contents |
-| --- | --- |
-| **SDK** | Environment, maintenance status, active messages, feature flag count |
-| **Logs** | Real-time log stream (info / warn / error); error badge on tab; Clear button |
-| **Network** | Config fetch log with status codes and timestamps |
-| **Events** | Analytics events queued/sent |
-| **Test** | Buttons to test analytics, errors, bugs, feature flags, flush, and refresh |
+| Tab         | Contents                                                                     |
+| ----------- | ---------------------------------------------------------------------------- |
+| **SDK**     | Environment, maintenance status, active messages, feature flag count         |
+| **Logs**    | Real-time log stream (info / warn / error); error badge on tab; Clear button |
+| **Network** | Config fetch log with status codes and timestamps                            |
+| **Events**  | Analytics events queued/sent                                                 |
+| **Test**    | Buttons to test analytics, errors, bugs, feature flags, flush, and refresh   |
 
 #### Test Tab Actions
 
@@ -332,29 +336,29 @@ manager.init();
 
 ### SiteManagerConfig
 
-| Option                   | Type            | Required | Default                   | Description                               |
-| ------------------------ | --------------- | -------- | ------------------------- | ----------------------------------------- |
-| `apiKey`                 | `string`        | ✅       | -                         | Your Featurely API key                    |
-| `projectId`              | `string`        | ✅       | -                         | Your Featurely project ID                 |
+| Option                   | Type            | Required | Default                  | Description                               |
+| ------------------------ | --------------- | -------- | ------------------------ | ----------------------------------------- |
+| `apiKey`                 | `string`        | ✅       | -                        | Your Featurely API key                    |
+| `projectId`              | `string`        | ✅       | -                        | Your Featurely project ID                 |
 | `apiUrl`                 | `string`        | ❌       | `'https://featurely.no'` | Custom API endpoint                       |
-| `pollInterval`           | `number`        | ❌       | `60000`                   | Config polling interval in ms             |
-| `userEmail`              | `string`        | ❌       | -                         | User email for whitelist & targeting      |
-| `userId`                 | `string`        | ❌       | -                         | User ID for analytics & feature flags     |
-| `bypassCheck`            | `() => boolean` | ❌       | -                         | Custom maintenance bypass function        |
-| `onMaintenanceEnabled`   | `function`      | ❌       | -                         | Maintenance enabled callback              |
-| `onMaintenanceDisabled`  | `function`      | ❌       | -                         | Maintenance disabled callback             |
-| `onMessageReceived`      | `function`      | ❌       | -                         | Message received callback                 |
-| `onMessageDismissed`     | `function`      | ❌       | -                         | Message dismissed callback                |
-| `onFeatureFlagsUpdated`  | `function`      | ❌       | -                         | Feature flags updated callback            |
-| `enableAnalytics`        | `boolean`       | ❌       | `true`                    | Enable analytics tracking                 |
-| `analyticsFlushInterval` | `number`        | ❌       | `60000`                   | Analytics flush interval in ms            |
-| `appVersion`             | `string`        | ❌       | -                         | Current app version for version checking  |
-| `enableVersionCheck`     | `boolean`       | ❌       | `false`                   | Enable automatic version checking         |
-| `versionCheckInterval`   | `number`        | ❌       | `3600000`                 | Version check interval in ms (1 hour)     |
-| `onUpdateAvailable`      | `function`      | ❌       | -                         | Callback when update is available         |
-| `onUpdateRequired`       | `function`      | ❌       | -                         | Callback when update is required (forced) |
-| `onError`                | `function`      | ❌       | -                         | Error callback                            |
-| `debugMode`              | `boolean`       | ❌       | `false`                   | Force-enable debug overlay locally        |
+| `pollInterval`           | `number`        | ❌       | `60000`                  | Config polling interval in ms             |
+| `userEmail`              | `string`        | ❌       | -                        | User email for whitelist & targeting      |
+| `userId`                 | `string`        | ❌       | -                        | User ID for analytics & feature flags     |
+| `bypassCheck`            | `() => boolean` | ❌       | -                        | Custom maintenance bypass function        |
+| `onMaintenanceEnabled`   | `function`      | ❌       | -                        | Maintenance enabled callback              |
+| `onMaintenanceDisabled`  | `function`      | ❌       | -                        | Maintenance disabled callback             |
+| `onMessageReceived`      | `function`      | ❌       | -                        | Message received callback                 |
+| `onMessageDismissed`     | `function`      | ❌       | -                        | Message dismissed callback                |
+| `onFeatureFlagsUpdated`  | `function`      | ❌       | -                        | Feature flags updated callback            |
+| `enableAnalytics`        | `boolean`       | ❌       | `true`                   | Enable analytics tracking                 |
+| `analyticsFlushInterval` | `number`        | ❌       | `60000`                  | Analytics flush interval in ms            |
+| `appVersion`             | `string`        | ❌       | -                        | Current app version for version checking  |
+| `enableVersionCheck`     | `boolean`       | ❌       | `false`                  | Enable automatic version checking         |
+| `versionCheckInterval`   | `number`        | ❌       | `3600000`                | Version check interval in ms (1 hour)     |
+| `onUpdateAvailable`      | `function`      | ❌       | -                        | Callback when update is available         |
+| `onUpdateRequired`       | `function`      | ❌       | -                        | Callback when update is required (forced) |
+| `onError`                | `function`      | ❌       | -                        | Error callback                            |
+| `debugMode`              | `boolean`       | ❌       | `false`                  | Force-enable debug overlay locally        |
 
 ## 🎯 API Methods
 

package/dist/index.js

@@ -115,8 +115,14 @@ var _SiteManager = class _SiteManager {
     if (this.config.debugMode) {
       this.setupDebugOverlay();
     }
-    this.debugLog("info", `[init] v1.1.16 | project: ${this.config.projectId} | hostname: ${typeof window !== "undefined" ? window.location.hostname : "\u2014"}`);
-    this.debugLog("info", `[init] analytics: ${this.config.enableAnalytics ? "on" : "off"} | poll: ${this.config.pollInterval}ms | debug: ${this.config.debugMode ? "on" : "off"}`);
+    this.debugLog(
+      "info",
+      `[init] v1.1.19 | project: ${this.config.projectId} | hostname: ${typeof window !== "undefined" ? window.location.hostname : "\u2014"}`
+    );
+    this.debugLog(
+      "info",
+      `[init] analytics: ${this.config.enableAnalytics ? "on" : "off"} | poll: ${this.config.pollInterval}ms | debug: ${this.config.debugMode ? "on" : "off"}`
+    );
     if (this.config.enableAnalytics) {
       this.debugLog("info", "[init] starting analytics + page tracking");
       this.startAnalyticsFlushing();
@@ -127,7 +133,10 @@ var _SiteManager = class _SiteManager {
     this.startPolling();
     this.debugLog("info", `[init] polling every ${this.config.pollInterval / 1e3}s`);
     if (this.config.enableVersionCheck && this.config.appVersion) {
-      this.debugLog("info", `[init] checking version (current: ${this.config.appVersion})`);
+      this.debugLog(
+        "info",
+        `[init] checking version (current: ${this.config.appVersion})`
+      );
       await this.checkVersion();
       this.startVersionChecking();
     }
@@ -302,7 +311,10 @@ var _SiteManager = class _SiteManager {
       properties,
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     });
-    this.recentAnalyticsEvents.unshift({ name: eventName, ts: (/* @__PURE__ */ new Date()).toLocaleTimeString() });
+    this.recentAnalyticsEvents.unshift({
+      name: eventName,
+      ts: (/* @__PURE__ */ new Date()).toLocaleTimeString()
+    });
     if (this.recentAnalyticsEvents.length > 50) this.recentAnalyticsEvents.length = 50;
     this.debugLog("info", `trackEvent: ${eventName}`);
     if (this.analyticsQueue.length >= 10) {
@@ -324,7 +336,11 @@ var _SiteManager = class _SiteManager {
           }
         }
       );
-      this.debugNetwork(`/api/public/v1/site-config`, response.status, Date.now() - fetchStartMs);
+      this.debugNetwork(
+        `/api/public/v1/site-config`,
+        response.status,
+        Date.now() - fetchStartMs
+      );
       if (!response.ok) {
         const errorData = await response.json().catch(() => ({}));
         const message = errorData.error || response.statusText;
@@ -357,20 +373,48 @@ var _SiteManager = class _SiteManager {
           delta.push(`flags: ${prevFlagCount}\u2192${newConfig.featureFlags.length}`);
         if (newConfig.messages.length !== prevMsgCount)
           delta.push(`messages: ${prevMsgCount}\u2192${newConfig.messages.length}`);
-        this.debugLog("info", `[config] updated${delta.length ? ": " + delta.join(", ") : " (structure changed)"}`);
+        this.debugLog(
+          "info",
+          `[config] updated${delta.length ? ": " + delta.join(", ") : " (structure changed)"}`
+        );
         const wasMaintenanceEnabled = (_g = this.siteConfig) == null ? void 0 : _g.maintenance.enabled;
         const oldFeatureFlags = ((_h = this.siteConfig) == null ? void 0 : _h.featureFlags) || [];
         this.siteConfig = newConfig;
-        if (newConfig.debugMode === true && !this.debugOverlayEl) {
+        const isGlobalDebug = newConfig.debugMode === true;
+        const hostname = typeof window !== "undefined" ? window.location.hostname : "";
+        const envs = newConfig.environments;
+        const matchedEnv = hostname ? envs == null ? void 0 : envs.find(
+          (e) => typeof e.url === "string" && e.url !== "" && e.url === hostname
+        ) : void 0;
+        const isEnvDebug = (matchedEnv == null ? void 0 : matchedEnv.debugEnabled) === true;
+        const shouldDebug = isGlobalDebug || isEnvDebug;
+        if (shouldDebug && !this.debugOverlayEl) {
+          if (isEnvDebug && !isGlobalDebug) {
+            this.debugLog(
+              "info",
+              `[env] matched environment "${matchedEnv.name}" (${hostname}) \u2014 enabling debug overlay`
+            );
+          }
           this.setupDebugOverlay();
+        } else if (!shouldDebug && this.debugOverlayEl) {
+          this.debugLog("info", "[debug] debug disabled by config \u2014 removing overlay");
+          this.stopDebugOverlay();
         }
-        if (!this.debugOverlayEl) {
-          const hostname = typeof window !== "undefined" ? window.location.hostname : "";
-          const envs = newConfig.environments;
-          const matchedEnv = hostname ? envs == null ? void 0 : envs.find((e) => typeof e.url === "string" && e.url !== "" && e.url === hostname) : void 0;
-          if ((matchedEnv == null ? void 0 : matchedEnv.debugEnabled) === true) {
-            this.debugLog("info", `[env] matched environment "${matchedEnv.name}" (${hostname})`);
-            this.setupDebugOverlay();
+        if (matchedEnv && matchedEnv.analyticsEnabled === false) {
+          if (this.config.enableAnalytics) {
+            this.debugLog(
+              "info",
+              `[env] analytics disabled for environment "${matchedEnv.name}" (${hostname}) \u2014 stopping analytics`
+            );
+            this.stopAnalyticsFlushing();
+          }
+        } else if (matchedEnv && matchedEnv.analyticsEnabled !== false && this.config.enableAnalytics) {
+          if (!this.analyticsFlushIntervalId) {
+            this.debugLog(
+              "info",
+              `[env] analytics re-enabled for environment "${matchedEnv.name}" (${hostname})`
+            );
+            this.startAnalyticsFlushing();
           }
         }
         if (newConfig.maintenance.enabled && !wasMaintenanceEnabled) {
@@ -392,7 +436,10 @@ var _SiteManager = class _SiteManager {
     } catch (error) {
       this.consecutiveFetchFailures++;
       const errMsg = error instanceof Error ? error.message : String(error);
-      this.debugLog("error", `[config] fetch failed (attempt ${this.consecutiveFetchFailures}): ${errMsg}`);
+      this.debugLog(
+        "error",
+        `[config] fetch failed (attempt ${this.consecutiveFetchFailures}): ${errMsg}`
+      );
       this.errorCount++;
       if (this.consecutiveFetchFailures <= _SiteManager.MAX_CONSECUTIVE_FAILURES) {
         const isNetworkError = error instanceof TypeError && (error.message.includes("NetworkError") || error.message.includes("Failed to fetch") || error.message.includes("fetch"));
@@ -411,7 +458,10 @@ var _SiteManager = class _SiteManager {
       } else if (this.consecutiveFetchFailures === _SiteManager.MAX_CONSECUTIVE_FAILURES + 1) {
         const silenceMsg = `Featurely Site Manager: Silencing repeated fetch errors after ${_SiteManager.MAX_CONSECUTIVE_FAILURES} failures. Check your apiUrl and Content-Security-Policy configuration.`;
         console.error(silenceMsg);
-        this.debugLog("error", `[config] silencing errors after ${_SiteManager.MAX_CONSECUTIVE_FAILURES} consecutive failures`);
+        this.debugLog(
+          "error",
+          `[config] silencing errors after ${_SiteManager.MAX_CONSECUTIVE_FAILURES} consecutive failures`
+        );
       }
     }
   }
@@ -450,7 +500,10 @@ var _SiteManager = class _SiteManager {
     const eventsToSend = [...this.analyticsQueue];
     this.analyticsQueue = [];
     this.analyticsEventsSent += eventsToSend.length;
-    this.debugLog("info", `[analytics] flushing ${eventsToSend.length} event(s) (total sent: ${this.analyticsEventsSent})`);
+    this.debugLog(
+      "info",
+      `[analytics] flushing ${eventsToSend.length} event(s) (total sent: ${this.analyticsEventsSent})`
+    );
     for (const event of eventsToSend) {
       const payload = JSON.stringify({
         eventName: event.eventName,
@@ -474,7 +527,11 @@ var _SiteManager = class _SiteManager {
             body: payload,
             keepalive: true
           });
-          this.debugNetwork(`/api/projects/${this.config.projectId}/analytics/events`, res.status, Date.now() - t0);
+          this.debugNetwork(
+            `/api/projects/${this.config.projectId}/analytics/events`,
+            res.status,
+            Date.now() - t0
+          );
           if (!res.ok) {
             const body = await res.text().catch(() => "(unreadable)");
             const errDetail = `[analytics] event "${event.eventName}" rejected: ${res.status} ${res.statusText} \u2014 ${body}`;
@@ -486,11 +543,20 @@ var _SiteManager = class _SiteManager {
           const sentViaBeacon = typeof navigator !== "undefined" && typeof navigator.sendBeacon === "function" && navigator.sendBeacon(url, payload);
           const errMsg = fetchError instanceof Error ? fetchError.message : String(fetchError);
           if (!sentViaBeacon) {
-            console.error(`[Featurely] Failed to send analytics event "${event.eventName}":`, fetchError);
-            this.debugLog("error", `[analytics] send failed for "${event.eventName}": ${errMsg}`);
+            console.error(
+              `[Featurely] Failed to send analytics event "${event.eventName}":`,
+              fetchError
+            );
+            this.debugLog(
+              "error",
+              `[analytics] send failed for "${event.eventName}": ${errMsg}`
+            );
             this.errorCount++;
           } else {
-            this.debugLog("warn", `[analytics] fetch failed for "${event.eventName}" (${errMsg}), delivered via sendBeacon`);
+            this.debugLog(
+              "warn",
+              `[analytics] fetch failed for "${event.eventName}" (${errMsg}), delivered via sendBeacon`
+            );
           }
         }
       }
@@ -537,14 +603,18 @@ var _SiteManager = class _SiteManager {
     this.originalConsoleError = console.error.bind(console);
     console.error = (...args) => {
       this.originalConsoleError(...args);
-      const msg = args.map((a) => typeof a === "string" ? a : a instanceof Error ? `${a.message}` : JSON.stringify(a)).join(" ");
+      const msg = args.map(
+        (a) => typeof a === "string" ? a : a instanceof Error ? `${a.message}` : JSON.stringify(a)
+      ).join(" ");
       this.errorCount++;
       this.debugLog("error", `[console.error] ${msg.slice(0, 300)}`);
     };
     this.originalConsoleWarn = console.warn.bind(console);
     console.warn = (...args) => {
       this.originalConsoleWarn(...args);
-      const msg = args.map((a) => typeof a === "string" ? a : a instanceof Error ? `${a.message}` : JSON.stringify(a)).join(" ");
+      const msg = args.map(
+        (a) => typeof a === "string" ? a : a instanceof Error ? `${a.message}` : JSON.stringify(a)
+      ).join(" ");
       this.debugLog("warn", `[console.warn] ${msg.slice(0, 300)}`);
     };
     window.addEventListener("error", (e) => {
@@ -597,7 +667,7 @@ var _SiteManager = class _SiteManager {
     this.debugOverlayEl = el;
     this.setupGlobalErrorCapture();
     this.debugLog("info", `[site-manager] debug overlay initialized`);
-    this.debugLog("info", `[site-manager] v1.1.14 | project: ${this.config.projectId}`);
+    this.debugLog("info", `[site-manager] v1.1.19 | project: ${this.config.projectId}`);
     this.renderDebugOverlay();
     this.debugRefreshId = setInterval(() => this.renderDebugOverlay(), 1500);
   }
@@ -779,7 +849,10 @@ var _SiteManager = class _SiteManager {
     };
     switch (action) {
       case "test-event":
-        this.trackEvent("debug_test_event", { source: "debug_panel", ts: (/* @__PURE__ */ new Date()).toISOString() });
+        this.trackEvent("debug_test_event", {
+          source: "debug_panel",
+          ts: (/* @__PURE__ */ new Date()).toISOString()
+        });
         feedback("debug_test_event queued", true);
         break;
       case "flush": {
@@ -821,7 +894,10 @@ var _SiteManager = class _SiteManager {
       case "copy-logs": {
         const text = this.debugLogs.slice().reverse().map((l) => `[${l.ts}] [${l.level.toUpperCase()}] ${l.msg}`).join("\n");
         void navigator.clipboard.writeText(text).then(() => {
-          feedback(`Copied ${this.debugLogs.length} log line${this.debugLogs.length !== 1 ? "s" : ""}`, true);
+          feedback(
+            `Copied ${this.debugLogs.length} log line${this.debugLogs.length !== 1 ? "s" : ""}`,
+            true
+          );
         }).catch(() => {
           feedback("Copy failed \u2014 clipboard not available", false);
         });
@@ -939,9 +1015,7 @@ var _SiteManager = class _SiteManager {
   async checkVersion(currentVersion) {
     const versionToCheck = currentVersion || this.config.appVersion;
     if (!versionToCheck) {
-      console.warn(
-        "Featurely Site Manager: appVersion not provided for version check"
-      );
+      console.warn("Featurely Site Manager: appVersion not provided for version check");
       return null;
     }
     try {
@@ -1085,7 +1159,10 @@ var _SiteManager = class _SiteManager {
       this.debugLog("info", "[maintenance] ENABLED \u2014 user bypassed (whitelist match)");
       return;
     }
-    this.debugLog("warn", `[maintenance] ENABLED (type: ${this.siteConfig.maintenance.type})`);
+    this.debugLog(
+      "warn",
+      `[maintenance] ENABLED (type: ${this.siteConfig.maintenance.type})`
+    );
     this.showMaintenancePage();
     this.trackEvent("maintenance_enabled", {
       maintenanceType: this.siteConfig.maintenance.type
@@ -1157,7 +1234,17 @@ var _SiteManager = class _SiteManager {
           "button"
         ],
         ALLOWED_ATTR: ["class", "id", "href", "src", "alt", "title", "style"],
-        FORBID_TAGS: ["script", "iframe", "embed", "object", "applet", "meta", "link", "form", "input"],
+        FORBID_TAGS: [
+          "script",
+          "iframe",
+          "embed",
+          "object",
+          "applet",
+          "meta",
+          "link",
+          "form",
+          "input"
+        ],
         FORBID_ATTR: ["onerror", "onload", "onclick", "onmouseover"],
         ALLOW_DATA_ATTR: false
       });
@@ -1225,10 +1312,16 @@ var _SiteManager = class _SiteManager {
         this.messageContainers.delete(id);
       }
     });
-    this.debugLog("info", `[messages] ${activeMessages.length} active (${(_b = (_a = this.siteConfig) == null ? void 0 : _a.messages.length) != null ? _b : 0} total)`);
+    this.debugLog(
+      "info",
+      `[messages] ${activeMessages.length} active (${(_b = (_a = this.siteConfig) == null ? void 0 : _a.messages.length) != null ? _b : 0} total)`
+    );
     activeMessages.forEach((message) => {
       if (!this.messageContainers.has(message.id)) {
-        this.debugLog("info", `[messages] showing "${message.title}" (${message.type}, ${message.style})`);
+        this.debugLog(
+          "info",
+          `[messages] showing "${message.title}" (${message.type}, ${message.style})`
+        );
         this.showMessage(message);
         if (this.config.onMessageReceived) {
           this.config.onMessageReceived(message);

package/dist/index.mjs

@@ -80,8 +80,14 @@ var _SiteManager = class _SiteManager {
     if (this.config.debugMode) {
       this.setupDebugOverlay();
     }
-    this.debugLog("info", `[init] v1.1.16 | project: ${this.config.projectId} | hostname: ${typeof window !== "undefined" ? window.location.hostname : "\u2014"}`);
-    this.debugLog("info", `[init] analytics: ${this.config.enableAnalytics ? "on" : "off"} | poll: ${this.config.pollInterval}ms | debug: ${this.config.debugMode ? "on" : "off"}`);
+    this.debugLog(
+      "info",
+      `[init] v1.1.19 | project: ${this.config.projectId} | hostname: ${typeof window !== "undefined" ? window.location.hostname : "\u2014"}`
+    );
+    this.debugLog(
+      "info",
+      `[init] analytics: ${this.config.enableAnalytics ? "on" : "off"} | poll: ${this.config.pollInterval}ms | debug: ${this.config.debugMode ? "on" : "off"}`
+    );
     if (this.config.enableAnalytics) {
       this.debugLog("info", "[init] starting analytics + page tracking");
       this.startAnalyticsFlushing();
@@ -92,7 +98,10 @@ var _SiteManager = class _SiteManager {
     this.startPolling();
     this.debugLog("info", `[init] polling every ${this.config.pollInterval / 1e3}s`);
     if (this.config.enableVersionCheck && this.config.appVersion) {
-      this.debugLog("info", `[init] checking version (current: ${this.config.appVersion})`);
+      this.debugLog(
+        "info",
+        `[init] checking version (current: ${this.config.appVersion})`
+      );
       await this.checkVersion();
       this.startVersionChecking();
     }
@@ -267,7 +276,10 @@ var _SiteManager = class _SiteManager {
       properties,
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     });
-    this.recentAnalyticsEvents.unshift({ name: eventName, ts: (/* @__PURE__ */ new Date()).toLocaleTimeString() });
+    this.recentAnalyticsEvents.unshift({
+      name: eventName,
+      ts: (/* @__PURE__ */ new Date()).toLocaleTimeString()
+    });
     if (this.recentAnalyticsEvents.length > 50) this.recentAnalyticsEvents.length = 50;
     this.debugLog("info", `trackEvent: ${eventName}`);
     if (this.analyticsQueue.length >= 10) {
@@ -289,7 +301,11 @@ var _SiteManager = class _SiteManager {
           }
         }
       );
-      this.debugNetwork(`/api/public/v1/site-config`, response.status, Date.now() - fetchStartMs);
+      this.debugNetwork(
+        `/api/public/v1/site-config`,
+        response.status,
+        Date.now() - fetchStartMs
+      );
       if (!response.ok) {
         const errorData = await response.json().catch(() => ({}));
         const message = errorData.error || response.statusText;
@@ -322,20 +338,48 @@ var _SiteManager = class _SiteManager {
           delta.push(`flags: ${prevFlagCount}\u2192${newConfig.featureFlags.length}`);
         if (newConfig.messages.length !== prevMsgCount)
           delta.push(`messages: ${prevMsgCount}\u2192${newConfig.messages.length}`);
-        this.debugLog("info", `[config] updated${delta.length ? ": " + delta.join(", ") : " (structure changed)"}`);
+        this.debugLog(
+          "info",
+          `[config] updated${delta.length ? ": " + delta.join(", ") : " (structure changed)"}`
+        );
         const wasMaintenanceEnabled = (_g = this.siteConfig) == null ? void 0 : _g.maintenance.enabled;
         const oldFeatureFlags = ((_h = this.siteConfig) == null ? void 0 : _h.featureFlags) || [];
         this.siteConfig = newConfig;
-        if (newConfig.debugMode === true && !this.debugOverlayEl) {
+        const isGlobalDebug = newConfig.debugMode === true;
+        const hostname = typeof window !== "undefined" ? window.location.hostname : "";
+        const envs = newConfig.environments;
+        const matchedEnv = hostname ? envs == null ? void 0 : envs.find(
+          (e) => typeof e.url === "string" && e.url !== "" && e.url === hostname
+        ) : void 0;
+        const isEnvDebug = (matchedEnv == null ? void 0 : matchedEnv.debugEnabled) === true;
+        const shouldDebug = isGlobalDebug || isEnvDebug;
+        if (shouldDebug && !this.debugOverlayEl) {
+          if (isEnvDebug && !isGlobalDebug) {
+            this.debugLog(
+              "info",
+              `[env] matched environment "${matchedEnv.name}" (${hostname}) \u2014 enabling debug overlay`
+            );
+          }
           this.setupDebugOverlay();
+        } else if (!shouldDebug && this.debugOverlayEl) {
+          this.debugLog("info", "[debug] debug disabled by config \u2014 removing overlay");
+          this.stopDebugOverlay();
         }
-        if (!this.debugOverlayEl) {
-          const hostname = typeof window !== "undefined" ? window.location.hostname : "";
-          const envs = newConfig.environments;
-          const matchedEnv = hostname ? envs == null ? void 0 : envs.find((e) => typeof e.url === "string" && e.url !== "" && e.url === hostname) : void 0;
-          if ((matchedEnv == null ? void 0 : matchedEnv.debugEnabled) === true) {
-            this.debugLog("info", `[env] matched environment "${matchedEnv.name}" (${hostname})`);
-            this.setupDebugOverlay();
+        if (matchedEnv && matchedEnv.analyticsEnabled === false) {
+          if (this.config.enableAnalytics) {
+            this.debugLog(
+              "info",
+              `[env] analytics disabled for environment "${matchedEnv.name}" (${hostname}) \u2014 stopping analytics`
+            );
+            this.stopAnalyticsFlushing();
+          }
+        } else if (matchedEnv && matchedEnv.analyticsEnabled !== false && this.config.enableAnalytics) {
+          if (!this.analyticsFlushIntervalId) {
+            this.debugLog(
+              "info",
+              `[env] analytics re-enabled for environment "${matchedEnv.name}" (${hostname})`
+            );
+            this.startAnalyticsFlushing();
           }
         }
         if (newConfig.maintenance.enabled && !wasMaintenanceEnabled) {
@@ -357,7 +401,10 @@ var _SiteManager = class _SiteManager {
     } catch (error) {
       this.consecutiveFetchFailures++;
       const errMsg = error instanceof Error ? error.message : String(error);
-      this.debugLog("error", `[config] fetch failed (attempt ${this.consecutiveFetchFailures}): ${errMsg}`);
+      this.debugLog(
+        "error",
+        `[config] fetch failed (attempt ${this.consecutiveFetchFailures}): ${errMsg}`
+      );
       this.errorCount++;
       if (this.consecutiveFetchFailures <= _SiteManager.MAX_CONSECUTIVE_FAILURES) {
         const isNetworkError = error instanceof TypeError && (error.message.includes("NetworkError") || error.message.includes("Failed to fetch") || error.message.includes("fetch"));
@@ -376,7 +423,10 @@ var _SiteManager = class _SiteManager {
       } else if (this.consecutiveFetchFailures === _SiteManager.MAX_CONSECUTIVE_FAILURES + 1) {
         const silenceMsg = `Featurely Site Manager: Silencing repeated fetch errors after ${_SiteManager.MAX_CONSECUTIVE_FAILURES} failures. Check your apiUrl and Content-Security-Policy configuration.`;
         console.error(silenceMsg);
-        this.debugLog("error", `[config] silencing errors after ${_SiteManager.MAX_CONSECUTIVE_FAILURES} consecutive failures`);
+        this.debugLog(
+          "error",
+          `[config] silencing errors after ${_SiteManager.MAX_CONSECUTIVE_FAILURES} consecutive failures`
+        );
       }
     }
   }
@@ -415,7 +465,10 @@ var _SiteManager = class _SiteManager {
     const eventsToSend = [...this.analyticsQueue];
     this.analyticsQueue = [];
     this.analyticsEventsSent += eventsToSend.length;
-    this.debugLog("info", `[analytics] flushing ${eventsToSend.length} event(s) (total sent: ${this.analyticsEventsSent})`);
+    this.debugLog(
+      "info",
+      `[analytics] flushing ${eventsToSend.length} event(s) (total sent: ${this.analyticsEventsSent})`
+    );
     for (const event of eventsToSend) {
       const payload = JSON.stringify({
         eventName: event.eventName,
@@ -439,7 +492,11 @@ var _SiteManager = class _SiteManager {
             body: payload,
             keepalive: true
           });
-          this.debugNetwork(`/api/projects/${this.config.projectId}/analytics/events`, res.status, Date.now() - t0);
+          this.debugNetwork(
+            `/api/projects/${this.config.projectId}/analytics/events`,
+            res.status,
+            Date.now() - t0
+          );
           if (!res.ok) {
             const body = await res.text().catch(() => "(unreadable)");
             const errDetail = `[analytics] event "${event.eventName}" rejected: ${res.status} ${res.statusText} \u2014 ${body}`;
@@ -451,11 +508,20 @@ var _SiteManager = class _SiteManager {
           const sentViaBeacon = typeof navigator !== "undefined" && typeof navigator.sendBeacon === "function" && navigator.sendBeacon(url, payload);
           const errMsg = fetchError instanceof Error ? fetchError.message : String(fetchError);
           if (!sentViaBeacon) {
-            console.error(`[Featurely] Failed to send analytics event "${event.eventName}":`, fetchError);
-            this.debugLog("error", `[analytics] send failed for "${event.eventName}": ${errMsg}`);
+            console.error(
+              `[Featurely] Failed to send analytics event "${event.eventName}":`,
+              fetchError
+            );
+            this.debugLog(
+              "error",
+              `[analytics] send failed for "${event.eventName}": ${errMsg}`
+            );
             this.errorCount++;
           } else {
-            this.debugLog("warn", `[analytics] fetch failed for "${event.eventName}" (${errMsg}), delivered via sendBeacon`);
+            this.debugLog(
+              "warn",
+              `[analytics] fetch failed for "${event.eventName}" (${errMsg}), delivered via sendBeacon`
+            );
           }
         }
       }
@@ -502,14 +568,18 @@ var _SiteManager = class _SiteManager {
     this.originalConsoleError = console.error.bind(console);
     console.error = (...args) => {
       this.originalConsoleError(...args);
-      const msg = args.map((a) => typeof a === "string" ? a : a instanceof Error ? `${a.message}` : JSON.stringify(a)).join(" ");
+      const msg = args.map(
+        (a) => typeof a === "string" ? a : a instanceof Error ? `${a.message}` : JSON.stringify(a)
+      ).join(" ");
       this.errorCount++;
       this.debugLog("error", `[console.error] ${msg.slice(0, 300)}`);
     };
     this.originalConsoleWarn = console.warn.bind(console);
     console.warn = (...args) => {
       this.originalConsoleWarn(...args);
-      const msg = args.map((a) => typeof a === "string" ? a : a instanceof Error ? `${a.message}` : JSON.stringify(a)).join(" ");
+      const msg = args.map(
+        (a) => typeof a === "string" ? a : a instanceof Error ? `${a.message}` : JSON.stringify(a)
+      ).join(" ");
       this.debugLog("warn", `[console.warn] ${msg.slice(0, 300)}`);
     };
     window.addEventListener("error", (e) => {
@@ -562,7 +632,7 @@ var _SiteManager = class _SiteManager {
     this.debugOverlayEl = el;
     this.setupGlobalErrorCapture();
     this.debugLog("info", `[site-manager] debug overlay initialized`);
-    this.debugLog("info", `[site-manager] v1.1.14 | project: ${this.config.projectId}`);
+    this.debugLog("info", `[site-manager] v1.1.19 | project: ${this.config.projectId}`);
     this.renderDebugOverlay();
     this.debugRefreshId = setInterval(() => this.renderDebugOverlay(), 1500);
   }
@@ -744,7 +814,10 @@ var _SiteManager = class _SiteManager {
     };
     switch (action) {
       case "test-event":
-        this.trackEvent("debug_test_event", { source: "debug_panel", ts: (/* @__PURE__ */ new Date()).toISOString() });
+        this.trackEvent("debug_test_event", {
+          source: "debug_panel",
+          ts: (/* @__PURE__ */ new Date()).toISOString()
+        });
         feedback("debug_test_event queued", true);
         break;
       case "flush": {
@@ -786,7 +859,10 @@ var _SiteManager = class _SiteManager {
       case "copy-logs": {
         const text = this.debugLogs.slice().reverse().map((l) => `[${l.ts}] [${l.level.toUpperCase()}] ${l.msg}`).join("\n");
         void navigator.clipboard.writeText(text).then(() => {
-          feedback(`Copied ${this.debugLogs.length} log line${this.debugLogs.length !== 1 ? "s" : ""}`, true);
+          feedback(
+            `Copied ${this.debugLogs.length} log line${this.debugLogs.length !== 1 ? "s" : ""}`,
+            true
+          );
         }).catch(() => {
           feedback("Copy failed \u2014 clipboard not available", false);
         });
@@ -904,9 +980,7 @@ var _SiteManager = class _SiteManager {
   async checkVersion(currentVersion) {
     const versionToCheck = currentVersion || this.config.appVersion;
     if (!versionToCheck) {
-      console.warn(
-        "Featurely Site Manager: appVersion not provided for version check"
-      );
+      console.warn("Featurely Site Manager: appVersion not provided for version check");
       return null;
     }
     try {
@@ -1050,7 +1124,10 @@ var _SiteManager = class _SiteManager {
       this.debugLog("info", "[maintenance] ENABLED \u2014 user bypassed (whitelist match)");
       return;
     }
-    this.debugLog("warn", `[maintenance] ENABLED (type: ${this.siteConfig.maintenance.type})`);
+    this.debugLog(
+      "warn",
+      `[maintenance] ENABLED (type: ${this.siteConfig.maintenance.type})`
+    );
     this.showMaintenancePage();
     this.trackEvent("maintenance_enabled", {
       maintenanceType: this.siteConfig.maintenance.type
@@ -1122,7 +1199,17 @@ var _SiteManager = class _SiteManager {
           "button"
         ],
         ALLOWED_ATTR: ["class", "id", "href", "src", "alt", "title", "style"],
-        FORBID_TAGS: ["script", "iframe", "embed", "object", "applet", "meta", "link", "form", "input"],
+        FORBID_TAGS: [
+          "script",
+          "iframe",
+          "embed",
+          "object",
+          "applet",
+          "meta",
+          "link",
+          "form",
+          "input"
+        ],
         FORBID_ATTR: ["onerror", "onload", "onclick", "onmouseover"],
         ALLOW_DATA_ATTR: false
       });
@@ -1190,10 +1277,16 @@ var _SiteManager = class _SiteManager {
         this.messageContainers.delete(id);
       }
     });
-    this.debugLog("info", `[messages] ${activeMessages.length} active (${(_b = (_a = this.siteConfig) == null ? void 0 : _a.messages.length) != null ? _b : 0} total)`);
+    this.debugLog(
+      "info",
+      `[messages] ${activeMessages.length} active (${(_b = (_a = this.siteConfig) == null ? void 0 : _a.messages.length) != null ? _b : 0} total)`
+    );
     activeMessages.forEach((message) => {
       if (!this.messageContainers.has(message.id)) {
-        this.debugLog("info", `[messages] showing "${message.title}" (${message.type}, ${message.style})`);
+        this.debugLog(
+          "info",
+          `[messages] showing "${message.title}" (${message.type}, ${message.style})`
+        );
         this.showMessage(message);
         if (this.config.onMessageReceived) {
           this.config.onMessageReceived(message);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "featurely-site-manager",
-  "version": "1.1.18",
+  "version": "1.1.19",
   "description": "Complete site management SDK for maintenance mode, status messages, feature flags, version checking, and analytics",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -50,10 +50,13 @@
   "homepage": "https://featurely.no",
   "devDependencies": {
     "@types/dompurify": "^3.0.5",
+    "drizzle-kit": "^0.31.10",
     "tsup": "^8.5.1",
     "typescript": "^5.0.0"
   },
   "dependencies": {
-    "dompurify": "^3.3.3"
+    "@neondatabase/serverless": "^1.0.2",
+    "dompurify": "^3.3.3",
+    "drizzle-orm": "^0.45.2"
   }
 }