mcp-scraper 0.72.7 → 0.73.1

package/dist/{chunk-SR7GSLEA.js → chunk-M6XDENOO.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-PJEEKOUM.js";
 
 // src/api/analytics-repository.ts
-import { createHash, createHmac, randomBytes, randomUUID } from "crypto";
+import { createHash as createHash2, createHmac as createHmac2, randomBytes as randomBytes2, randomUUID as randomUUID2 } from "crypto";
 import { Pool } from "pg";
 
 // src/api/analytics-attribution.ts
@@ -82,6 +82,261 @@ function resolveAnalyticsAttribution(input) {
   };
 }
 
+// src/api/analytics-identity-profile.ts
+import { createHash, randomUUID } from "crypto";
+
+// src/api/analytics-crypto.ts
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHmac,
+  randomBytes,
+  scryptSync,
+  timingSafeEqual
+} from "crypto";
+var VERSION = "xray1";
+function rootSecret() {
+  return process.env.ANALYTICS_RESTRICTED_DATA_SECRET?.trim() || getSessionSecret();
+}
+function keyFor(purpose) {
+  return scryptSync(rootSecret(), `xray-restricted:${purpose}:v1`, 32);
+}
+function encryptAnalyticsRestricted(plaintext, purpose) {
+  const normalizedPurpose = purpose.trim().slice(0, 80);
+  if (!normalizedPurpose) throw new Error("analytics encryption purpose required");
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", keyFor(normalizedPurpose), iv);
+  cipher.setAAD(Buffer.from(`${VERSION}:${normalizedPurpose}`, "utf8"));
+  const ciphertext = Buffer.concat([
+    cipher.update(plaintext, "utf8"),
+    cipher.final()
+  ]);
+  const tag = cipher.getAuthTag();
+  return [
+    VERSION,
+    Buffer.from(normalizedPurpose, "utf8").toString("base64url"),
+    iv.toString("base64url"),
+    tag.toString("base64url"),
+    ciphertext.toString("base64url")
+  ].join(".");
+}
+function decryptAnalyticsRestricted(stored, expectedPurpose) {
+  try {
+    const [version, encodedPurpose, iv, tag, ciphertext] = stored.split(".");
+    if (version !== VERSION || !encodedPurpose || !iv || !tag || !ciphertext)
+      return null;
+    const purpose = Buffer.from(encodedPurpose, "base64url").toString("utf8");
+    if (purpose !== expectedPurpose) return null;
+    const decipher = createDecipheriv(
+      "aes-256-gcm",
+      keyFor(purpose),
+      Buffer.from(iv, "base64url")
+    );
+    decipher.setAAD(Buffer.from(`${VERSION}:${purpose}`, "utf8"));
+    decipher.setAuthTag(Buffer.from(tag, "base64url"));
+    return Buffer.concat([
+      decipher.update(Buffer.from(ciphertext, "base64url")),
+      decipher.final()
+    ]).toString("utf8");
+  } catch {
+    return null;
+  }
+}
+function analyticsIdentityHmac(kind, value) {
+  return createHmac("sha256", keyFor(`identity:${kind}`)).update(value.trim().toLowerCase()).digest("hex");
+}
+function signAnalyticsWebhook(provider, timestamp, rawBody, secret) {
+  return createHmac("sha256", secret).update(`${provider}.${timestamp}.${rawBody}`).digest("hex");
+}
+function verifyAnalyticsWebhookSignature(actual, expected) {
+  if (!actual || actual.length !== expected.length) return false;
+  try {
+    return timingSafeEqual(Buffer.from(actual), Buffer.from(expected));
+  } catch {
+    return false;
+  }
+}
+
+// src/api/analytics-identity-profile.ts
+var ANALYTICS_IDENTITY_PROFILE_PURPOSE = "enhanced_matching";
+var ANALYTICS_IDENTITY_PROFILE_RETENTION_DAYS = 90;
+var ANALYTICS_IDENTITY_PROFILE_RATE_LIMIT = 10;
+var AnalyticsIdentityProfileError = class extends Error {
+  constructor(code, message, status) {
+    super(message);
+    this.code = code;
+    this.status = status;
+    this.name = "AnalyticsIdentityProfileError";
+  }
+  code;
+  status;
+};
+function normalizedText(value, max) {
+  const normalized = value?.trim().replace(/\s+/g, " ").slice(0, max);
+  return normalized || null;
+}
+function maskedEmail(value) {
+  if (!value) return null;
+  const [local, domain] = value.split("@");
+  if (!local || !domain) return null;
+  return `${local.slice(0, 1)}${"*".repeat(Math.min(6, Math.max(2, local.length - 1)))}@${domain}`;
+}
+function maskedPhone(value) {
+  if (!value) return null;
+  const digits = value.replace(/\D/g, "");
+  if (digits.length < 4) return null;
+  return `***-***-${digits.slice(-4)}`;
+}
+function auditSubject(reference) {
+  return createHash("sha256").update(reference).digest("hex");
+}
+async function assertAnalyticsIdentitySignalsNotTombstoned(db, input) {
+  if (!input.signals.length) return;
+  const kinds = input.signals.map((signal) => signal.kind);
+  const hashes = input.signals.map((signal) => signal.valueHmac);
+  const result = await db.query(
+    `SELECT 1 FROM analytics_identity_tombstones
+      WHERE site_id=$1 AND (kind,value_hmac) IN (
+        SELECT * FROM unnest($2::text[],$3::text[])
+      ) LIMIT 1`,
+    [input.siteId, kinds, hashes]
+  );
+  if (result.rowCount) {
+    throw new AnalyticsIdentityProfileError(
+      "analytics_identity_deleted",
+      "This identity cannot be automatically recreated.",
+      410
+    );
+  }
+}
+async function writeAnalyticsConfirmedIdentityProfile(db, input) {
+  const displayName = normalizedText(input.displayName, 160);
+  const email = normalizedText(input.email, 320)?.toLowerCase() ?? null;
+  const phone = normalizedText(input.phone, 40);
+  if (!displayName && !email && !phone) return false;
+  const person = await db.query(
+    `SELECT p.public_ref FROM analytics_people p
+      JOIN analytics_identity_namespaces n ON n.id=p.namespace_id AND n.site_id=p.site_id AND n.status='approved'
+      WHERE p.id=$1 AND p.site_id=$2`,
+    [input.personId, input.siteId]
+  );
+  const publicRef = person.rows[0]?.public_ref;
+  if (!publicRef) return false;
+  const refs = [...new Set([publicRef, ...input.consentSubjectRefs].filter(Boolean))];
+  const consent = await db.query(
+    `SELECT s.latest_receipt_id::text FROM analytics_consent_current_state s
+      JOIN analytics_consent_receipts r ON r.id=s.latest_receipt_id AND r.site_id=s.site_id
+      WHERE s.site_id=$1 AND s.subject_ref=ANY($2::text[])
+        AND s.site_analytics=true AND s.enhanced_matching=true AND s.gpc=false
+        AND r.action NOT IN ('withdraw','gpc')
+        AND (s.expires_at IS NULL OR s.expires_at > now())
+      ORDER BY s.effective_at DESC LIMIT 1`,
+    [input.siteId, refs]
+  );
+  const consentReceiptId = consent.rows[0]?.latest_receipt_id;
+  if (!consentReceiptId) return false;
+  const verifiedAt = input.verifiedAt && Number.isFinite(Date.parse(input.verifiedAt)) ? new Date(input.verifiedAt).toISOString() : (/* @__PURE__ */ new Date()).toISOString();
+  const ciphertext = encryptAnalyticsRestricted(JSON.stringify({
+    schemaVersion: 1,
+    displayName,
+    email,
+    phone,
+    evidenceType: input.evidenceType,
+    verifiedAt
+  }), "identity-profile");
+  await db.query(
+    `INSERT INTO analytics_restricted_data(id,site_id,person_id,purpose,subject_ref,payload_ciphertext,expires_at,consent_receipt_id)
+      VALUES($1,$2,$3,$4,$5,$6,now()+($7::int * interval '1 day'),$8)
+      ON CONFLICT(site_id,purpose,subject_ref) DO UPDATE SET
+        person_id=EXCLUDED.person_id,payload_ciphertext=EXCLUDED.payload_ciphertext,
+        expires_at=EXCLUDED.expires_at,consent_receipt_id=EXCLUDED.consent_receipt_id,created_at=now()`,
+    [
+      randomUUID(),
+      input.siteId,
+      input.personId,
+      ANALYTICS_IDENTITY_PROFILE_PURPOSE,
+      publicRef,
+      ciphertext,
+      ANALYTICS_IDENTITY_PROFILE_RETENTION_DAYS,
+      consentReceiptId
+    ]
+  );
+  return true;
+}
+async function resolveAnalyticsMaskedIdentityProfile(db, input) {
+  const now = input.now ?? /* @__PURE__ */ new Date();
+  const role = await db.query(
+    "SELECT role FROM analytics_site_grants WHERE site_id=$1 AND user_id=$2",
+    [input.siteId, input.actorUserId]
+  );
+  if (!role.rowCount) throw new AnalyticsIdentityProfileError("analytics_site_not_found", "Site not found.", 404);
+  if (!["owner", "editor"].includes(role.rows[0].role))
+    throw new AnalyticsIdentityProfileError("analytics_forbidden", "Editor access is required.", 403);
+  const recent = await db.query(
+    `SELECT count(*)::text AS count FROM analytics_identity_profile_access_audits
+      WHERE site_id=$1 AND actor_user_id=$2 AND created_at > $3::timestamptz - interval '1 minute'`,
+    [input.siteId, input.actorUserId, now.toISOString()]
+  );
+  if (Number(recent.rows[0]?.count ?? 0) >= ANALYTICS_IDENTITY_PROFILE_RATE_LIMIT) {
+    await db.query(
+      `INSERT INTO analytics_identity_profile_access_audits(id,site_id,actor_user_id,subject_ref_hmac,purpose,result,created_at)
+       VALUES($1,$2,$3,$4,'journey_identity_display','rate_limited',$5)`,
+      [randomUUID(), input.siteId, input.actorUserId, auditSubject(input.requestedPersonRef), now.toISOString()]
+    );
+    throw new AnalyticsIdentityProfileError("analytics_identity_profile_rate_limited", "Identity profile rate limit exceeded.", 429);
+  }
+  const unavailable = async (result) => {
+    await db.query(
+      `INSERT INTO analytics_identity_profile_access_audits(id,site_id,actor_user_id,subject_ref_hmac,purpose,result,created_at)
+       VALUES($1,$2,$3,$4,'journey_identity_display',$5,$6)`,
+      [randomUUID(), input.siteId, input.actorUserId, auditSubject(input.requestedPersonRef), result, now.toISOString()]
+    );
+    throw new AnalyticsIdentityProfileError("analytics_identity_profile_not_found", "Identity profile not found.", 404);
+  };
+  if (!input.personId) return unavailable("not_found");
+  const row = await db.query(
+    `SELECT p.public_ref,r.payload_ciphertext,r.expires_at
+       FROM analytics_people p
+       JOIN analytics_restricted_data r ON r.person_id=p.id AND r.site_id=p.site_id
+        AND r.purpose=$3 AND r.subject_ref=p.public_ref AND r.expires_at>$4
+       JOIN analytics_consent_current_state s ON s.site_id=p.site_id AND s.latest_receipt_id=r.consent_receipt_id
+        AND s.site_analytics=true AND s.enhanced_matching=true AND s.gpc=false
+        AND (s.expires_at IS NULL OR s.expires_at>$4)
+       JOIN analytics_consent_receipts c ON c.id=s.latest_receipt_id AND c.site_id=s.site_id
+        AND c.action NOT IN ('withdraw','gpc')
+      WHERE p.id=$1 AND p.site_id=$2
+        AND NOT EXISTS (SELECT 1 FROM analytics_identity_tombstones t WHERE t.site_id=p.site_id AND t.person_id=p.id)
+      LIMIT 1`,
+    [input.personId, input.siteId, ANALYTICS_IDENTITY_PROFILE_PURPOSE, now.toISOString()]
+  );
+  if (!row.rowCount) return unavailable("not_found");
+  const plaintext = decryptAnalyticsRestricted(row.rows[0].payload_ciphertext, "identity-profile");
+  if (!plaintext) return unavailable("unavailable");
+  let parsed;
+  try {
+    parsed = JSON.parse(plaintext);
+  } catch {
+    return unavailable("unavailable");
+  }
+  const evidenceType = parsed.evidenceType;
+  if (!["first_party_form", "authenticated_user", "crm_contact"].includes(String(evidenceType)))
+    return unavailable("unavailable");
+  const profile = {
+    personRef: input.requestedPersonRef,
+    displayName: normalizedText(typeof parsed.displayName === "string" ? parsed.displayName : void 0, 160),
+    maskedEmail: maskedEmail(typeof parsed.email === "string" ? parsed.email : null),
+    maskedPhone: maskedPhone(typeof parsed.phone === "string" ? parsed.phone : null),
+    evidenceType,
+    verifiedAt: typeof parsed.verifiedAt === "string" && Number.isFinite(Date.parse(parsed.verifiedAt)) ? new Date(parsed.verifiedAt).toISOString() : now.toISOString()
+  };
+  await db.query(
+    `INSERT INTO analytics_identity_profile_access_audits(id,site_id,person_id,actor_user_id,subject_ref_hmac,purpose,result,created_at)
+     VALUES($1,$2,$3,$4,$5,'journey_identity_display','returned_masked',$6)`,
+    [randomUUID(), input.siteId, input.personId, input.actorUserId, auditSubject(input.requestedPersonRef), now.toISOString()]
+  );
+  return profile;
+}
+
 // src/api/analytics-provider-registry.ts
 var META_ACTION_SOURCES = /* @__PURE__ */ new Set([
   "email",
@@ -605,7 +860,6 @@ async function closeAnalyticsPool() {
 async function migrateAnalytics() {
   const db = getAnalyticsPool();
   const client = await db.connect();
-  await client.query("BEGIN");
   try {
     await client.query(`
       CREATE TABLE IF NOT EXISTS analytics_schema_migrations (
@@ -1289,6 +1543,33 @@ async function migrateAnalytics() {
         UNIQUE(site_id, purpose, subject_ref)
       )
     `);
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS analytics_identity_tombstones (
+        id uuid PRIMARY KEY,
+        site_id uuid NOT NULL REFERENCES analytics_sites(id) ON DELETE CASCADE,
+        person_id uuid,
+        kind text NOT NULL,
+        value_hmac text NOT NULL,
+        reason text NOT NULL CHECK (reason IN ('subject_deletion')),
+        created_at timestamptz NOT NULL DEFAULT now(),
+        UNIQUE(site_id,kind,value_hmac)
+      )
+    `);
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS analytics_identity_profile_access_audits (
+        id uuid PRIMARY KEY,
+        site_id uuid NOT NULL REFERENCES analytics_sites(id) ON DELETE CASCADE,
+        person_id uuid,
+        actor_user_id bigint NOT NULL,
+        subject_ref_hmac text NOT NULL,
+        purpose text NOT NULL CHECK (purpose IN ('journey_identity_display')),
+        result text NOT NULL CHECK (result IN ('returned_masked','not_found','unavailable','rate_limited')),
+        created_at timestamptz NOT NULL DEFAULT now()
+      )
+    `);
+    await client.query(
+      "CREATE INDEX IF NOT EXISTS analytics_identity_profile_access_rate ON analytics_identity_profile_access_audits(site_id,actor_user_id,created_at DESC)"
+    );
     await client.query(
       `ALTER TABLE analytics_activation_destinations ADD COLUMN IF NOT EXISTS readiness text NOT NULL DEFAULT 'configured_unverified' CHECK (readiness IN ('not_configured','configured_unverified','verified','live','degraded','disabled'))`
     );
@@ -1390,6 +1671,11 @@ async function migrateAnalytics() {
     await client.query(
       `ALTER TABLE analytics_people ADD COLUMN IF NOT EXISTS public_ref text`
     );
+    await client.query(
+      `UPDATE analytics_people
+          SET public_ref = 'xrp_' || substr(md5(random()::text || clock_timestamp()::text || id::text || site_id::text), 1, 24)
+        WHERE public_ref IS NULL`
+    );
     await client.query(
       `ALTER TABLE analytics_events ADD COLUMN IF NOT EXISTS event_definition_id uuid REFERENCES analytics_event_definitions(id) ON DELETE SET NULL`
     );
@@ -1554,6 +1840,9 @@ async function migrateAnalytics() {
         PRIMARY KEY(site_id, subject_ref)
       )
     `);
+    await client.query(
+      "ALTER TABLE analytics_restricted_data ADD COLUMN IF NOT EXISTS consent_receipt_id uuid REFERENCES analytics_consent_receipts(id) ON DELETE CASCADE"
+    );
     await client.query(`
       CREATE TABLE IF NOT EXISTS analytics_identity_namespaces (
         id uuid PRIMARY KEY,
@@ -1586,13 +1875,19 @@ async function migrateAnalytics() {
       )
     `);
     await client.query(
-      `ALTER TABLE analytics_people ADD COLUMN IF NOT EXISTS namespace_id uuid REFERENCES analytics_identity_namespaces(id) ON DELETE RESTRICT`
+      `ALTER TABLE analytics_people ADD COLUMN IF NOT EXISTS namespace_id uuid`
+    );
+    await client.query(
+      `ALTER TABLE analytics_identity_nodes ADD COLUMN IF NOT EXISTS namespace_id uuid`
     );
     await client.query(
-      `ALTER TABLE analytics_identity_nodes ADD COLUMN IF NOT EXISTS namespace_id uuid REFERENCES analytics_identity_namespaces(id) ON DELETE RESTRICT`
+      `ALTER TABLE analytics_identity_edges ADD COLUMN IF NOT EXISTS namespace_id uuid`
     );
     await client.query(
-      `ALTER TABLE analytics_identity_edges ADD COLUMN IF NOT EXISTS namespace_id uuid REFERENCES analytics_identity_namespaces(id) ON DELETE RESTRICT`
+      "CREATE UNIQUE INDEX IF NOT EXISTS analytics_people_site_ref ON analytics_people(id, site_id)"
+    );
+    await client.query(
+      "CREATE UNIQUE INDEX IF NOT EXISTS analytics_identity_nodes_site_ref ON analytics_identity_nodes(id, site_id)"
     );
     await client.query(
       "CREATE UNIQUE INDEX IF NOT EXISTS analytics_identity_nodes_namespace_ref ON analytics_identity_nodes(id, site_id, namespace_id)"
@@ -1600,6 +1895,62 @@ async function migrateAnalytics() {
     await client.query(
       "CREATE UNIQUE INDEX IF NOT EXISTS analytics_people_namespace_ref ON analytics_people(id, site_id, namespace_id)"
     );
+    await client.query(`
+      DO $$
+      BEGIN
+        IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname='analytics_people_namespace_site_fkey') THEN
+          ALTER TABLE analytics_people ADD CONSTRAINT analytics_people_namespace_site_fkey
+            FOREIGN KEY(namespace_id, site_id) REFERENCES analytics_identity_namespaces(id, site_id)
+            ON DELETE RESTRICT NOT VALID;
+        END IF;
+        IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname='analytics_identity_nodes_namespace_site_fkey') THEN
+          ALTER TABLE analytics_identity_nodes ADD CONSTRAINT analytics_identity_nodes_namespace_site_fkey
+            FOREIGN KEY(namespace_id, site_id) REFERENCES analytics_identity_namespaces(id, site_id)
+            ON DELETE RESTRICT NOT VALID;
+        END IF;
+        IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname='analytics_identity_edges_person_site_fkey') THEN
+          ALTER TABLE analytics_identity_edges ADD CONSTRAINT analytics_identity_edges_person_site_fkey
+            FOREIGN KEY(person_id, site_id) REFERENCES analytics_people(id, site_id)
+            ON DELETE CASCADE NOT VALID;
+        END IF;
+        IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname='analytics_identity_edges_node_site_fkey') THEN
+          ALTER TABLE analytics_identity_edges ADD CONSTRAINT analytics_identity_edges_node_site_fkey
+            FOREIGN KEY(identity_node_id, site_id) REFERENCES analytics_identity_nodes(id, site_id)
+            ON DELETE CASCADE NOT VALID;
+        END IF;
+        IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname='analytics_identity_edges_namespace_site_fkey') THEN
+          ALTER TABLE analytics_identity_edges ADD CONSTRAINT analytics_identity_edges_namespace_site_fkey
+            FOREIGN KEY(namespace_id, site_id) REFERENCES analytics_identity_namespaces(id, site_id)
+            ON DELETE RESTRICT NOT VALID;
+        END IF;
+        IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname='analytics_identity_edges_person_namespace_fkey') THEN
+          ALTER TABLE analytics_identity_edges ADD CONSTRAINT analytics_identity_edges_person_namespace_fkey
+            FOREIGN KEY(person_id, site_id, namespace_id) REFERENCES analytics_people(id, site_id, namespace_id)
+            ON DELETE CASCADE NOT VALID;
+        END IF;
+        IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname='analytics_identity_edges_node_namespace_fkey') THEN
+          ALTER TABLE analytics_identity_edges ADD CONSTRAINT analytics_identity_edges_node_namespace_fkey
+            FOREIGN KEY(identity_node_id, site_id, namespace_id) REFERENCES analytics_identity_nodes(id, site_id, namespace_id)
+            ON DELETE CASCADE NOT VALID;
+        END IF;
+      END $$
+    `);
+    for (const constraint of [
+      ["analytics_people", "analytics_people_namespace_site_fkey"],
+      ["analytics_identity_nodes", "analytics_identity_nodes_namespace_site_fkey"],
+      ["analytics_identity_edges", "analytics_identity_edges_person_site_fkey"],
+      ["analytics_identity_edges", "analytics_identity_edges_node_site_fkey"],
+      ["analytics_identity_edges", "analytics_identity_edges_namespace_site_fkey"],
+      ["analytics_identity_edges", "analytics_identity_edges_person_namespace_fkey"],
+      ["analytics_identity_edges", "analytics_identity_edges_node_namespace_fkey"]
+    ]) {
+      await client.query(`ALTER TABLE ${constraint[0]} VALIDATE CONSTRAINT ${constraint[1]}`);
+    }
+    await client.query("ALTER TABLE analytics_people DROP CONSTRAINT IF EXISTS analytics_people_namespace_id_fkey");
+    await client.query("ALTER TABLE analytics_identity_nodes DROP CONSTRAINT IF EXISTS analytics_identity_nodes_namespace_id_fkey");
+    await client.query("ALTER TABLE analytics_identity_edges DROP CONSTRAINT IF EXISTS analytics_identity_edges_namespace_id_fkey");
+    await client.query("ALTER TABLE analytics_identity_edges DROP CONSTRAINT IF EXISTS analytics_identity_edges_person_id_fkey");
+    await client.query("ALTER TABLE analytics_identity_edges DROP CONSTRAINT IF EXISTS analytics_identity_edges_identity_node_id_fkey");
     await client.query(`
       CREATE TABLE IF NOT EXISTS analytics_candidate_associations (
         id uuid PRIMARY KEY,
@@ -2255,9 +2606,7 @@ async function migrateAnalytics() {
       VALUES ('2026-08-05.1'), ('2026-08-05.2'), ('2026-08-05.3'), ('2026-08-05.4'), ('2026-08-05.5'), ('2026-08-05.6'), ('2026-08-05.7'), ('2026-08-05.8'), ('2026-08-05.9'), ('2026-08-05.10'), ('2026-08-05.11'), ('2026-08-05.12'), ('2026-08-05.13'), ('2026-08-05.14'), ('2026-08-26.1'), ('2026-08-26.2'), ('2026-08-26.3'), ('2026-08-26.4'), ('2026-08-27.1')
       ON CONFLICT (version) DO NOTHING
     `);
-    await client.query("COMMIT");
   } catch (error) {
-    await client.query("ROLLBACK");
     throw error;
   } finally {
     client.release();
@@ -2265,7 +2614,7 @@ async function migrateAnalytics() {
 }
 function normalizeSlug(value) {
   const slug = value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80);
-  return slug || `site-${randomBytes(4).toString("hex")}`;
+  return slug || `site-${randomBytes2(4).toString("hex")}`;
 }
 function normalizeObservedHostname(origin) {
   if (!origin || origin === "null") return null;
@@ -2278,7 +2627,7 @@ function normalizeObservedHostname(origin) {
   }
 }
 function publicPixelId() {
-  return `px_${randomBytes(18).toString("base64url")}`;
+  return `px_${randomBytes2(18).toString("base64url")}`;
 }
 function mapRows(rows) {
   return rows;
@@ -2316,7 +2665,7 @@ async function requireAnalyticsEditor(client, siteId, userId) {
 async function createAnalyticsSite(input) {
   const db = getAnalyticsPool();
   const client = await db.connect();
-  const id = randomUUID();
+  const id = randomUUID2();
   const baseSlug = normalizeSlug(input.slug || input.name);
   try {
     await client.query("BEGIN");
@@ -2332,7 +2681,7 @@ async function createAnalyticsSite(input) {
       } catch (error) {
         const code = error.code;
         if (code !== "23505" || attempt === 2) throw error;
-        slug = `${baseSlug}-${randomBytes(2).toString("hex")}`;
+        slug = `${baseSlug}-${randomBytes2(2).toString("hex")}`;
       }
     }
     await client.query(
@@ -2547,7 +2896,7 @@ async function createAnalyticsPixel(input) {
      VALUES ($1, $2, $3, $4, $5)
      RETURNING id, site_id, public_id, name, environment, status, created_at::text, NULL::text AS last_event_at`,
     [
-      randomUUID(),
+      randomUUID2(),
       input.siteId,
       publicPixelId(),
       input.name.trim(),
@@ -2624,7 +2973,7 @@ async function setAnalyticsPixelDomainState(input) {
      SELECT $1, p.id, $4, $5 FROM analytics_pixels p WHERE p.id = $2 AND p.site_id = $3
      ON CONFLICT(pixel_id, hostname) DO UPDATE SET state = EXCLUDED.state, updated_at = now()
      RETURNING id`,
-    [randomUUID(), input.pixelId, input.siteId, hostname, input.state]
+    [randomUUID2(), input.pixelId, input.siteId, hostname, input.state]
   );
   if (!result.rowCount)
     throw new AnalyticsRepositoryError(
@@ -2666,7 +3015,7 @@ async function upsertAnalyticsHostGroup(input) {
        ON CONFLICT(pixel_id, name) DO UPDATE SET
          auto_decorate=EXCLUDED.auto_decorate, updated_at=now()
        RETURNING id`,
-      [randomUUID(), input.siteId, input.pixelId, input.name.trim().slice(0, 120), Boolean(input.autoDecorate)]
+      [randomUUID2(), input.siteId, input.pixelId, input.name.trim().slice(0, 120), Boolean(input.autoDecorate)]
     );
     await client.query("DELETE FROM analytics_host_group_members WHERE group_id=$1", [group.rows[0].id]);
     for (const hostname of hostnames)
@@ -2749,7 +3098,7 @@ async function prepareAnalyticsLinkerIssue(input) {
        VALUES ($1,$2,'visitor_id',$3)
        ON CONFLICT(site_id, kind, value_hmac) DO UPDATE SET last_seen_at=now()
        RETURNING id`,
-      [randomUUID(), siteId, identityHmac("visitor_id", input.visitorId)]
+      [randomUUID2(), siteId, identityHmac("visitor_id", input.visitorId)]
     );
     const existingPerson = await client.query(
       `SELECT person_id FROM analytics_identity_edges
@@ -2760,19 +3109,20 @@ async function prepareAnalyticsLinkerIssue(input) {
     let personId = existingPerson.rows[0]?.person_id;
     if (!personId) {
       const person = await client.query(
-        `INSERT INTO analytics_people(id, site_id, crm_person_ref) VALUES ($1,$2,$3)
-         ON CONFLICT(site_id, crm_person_ref) DO UPDATE SET last_seen_at=now() RETURNING id`,
-        [randomUUID(), siteId, `XRay::anonymous::${identityHmac("visitor_id", input.visitorId).slice(0, 24)}`]
+        `INSERT INTO analytics_people(id, site_id, crm_person_ref, public_ref) VALUES ($1,$2,$3,$4)
+         ON CONFLICT(site_id, crm_person_ref) DO UPDATE SET last_seen_at=now(),
+           public_ref=COALESCE(analytics_people.public_ref,EXCLUDED.public_ref) RETURNING id`,
+        [randomUUID2(), siteId, `XRay::anonymous::${identityHmac("visitor_id", input.visitorId).slice(0, 24)}`, newAnalyticsPersonPublicRef()]
       );
       personId = person.rows[0].id;
       await client.query(
         `INSERT INTO analytics_identity_edges(id, site_id, person_id, identity_node_id, evidence_kind, confidence)
          VALUES ($1,$2,$3,$4,'first_party_linker',0.980)
          ON CONFLICT(person_id, identity_node_id, evidence_kind) DO UPDATE SET last_seen_at=now()`,
-        [randomUUID(), siteId, personId, node.rows[0].id]
+        [randomUUID2(), siteId, personId, node.rows[0].id]
       );
     }
-    const tokenId = randomUUID();
+    const tokenId = randomUUID2();
     await client.query(
       `INSERT INTO analytics_linker_tokens(
          id, site_id, pixel_id, host_group_id, identity_node_id,
@@ -2828,13 +3178,13 @@ async function redeemAnalyticsLinkerRecord(input) {
        VALUES ($1,$2,'visitor_id',$3)
        ON CONFLICT(site_id, kind, value_hmac) DO UPDATE SET last_seen_at=now()
        RETURNING id`,
-      [randomUUID(), input.siteId, identityHmac("visitor_id", input.visitorId)]
+      [randomUUID2(), input.siteId, identityHmac("visitor_id", input.visitorId)]
     );
     await client.query(
       `INSERT INTO analytics_identity_edges(id, site_id, person_id, identity_node_id, evidence_kind, confidence)
        VALUES ($1,$2,$3,$4,'cross_domain_linker',0.980)
        ON CONFLICT(person_id, identity_node_id, evidence_kind) DO UPDATE SET last_seen_at=now()`,
-      [randomUUID(), input.siteId, personId, targetNode.rows[0].id]
+      [randomUUID2(), input.siteId, personId, targetNode.rows[0].id]
     );
     await client.query(
       "UPDATE analytics_events SET person_id=$1 WHERE site_id=$2 AND visitor_id=$3 AND person_id IS NULL",
@@ -2858,6 +3208,133 @@ async function redeemAnalyticsLinkerRecord(input) {
     client.release();
   }
 }
+function analyticsIdentityResolutionAllowed(event) {
+  return Boolean(
+    event.consent?.analytics === "granted" && (event.consent.purposes?.enhanced_matching === "granted" || event.consent.adUserData === "granted") && event.consent.globalPrivacyControl !== true
+  );
+}
+function analyticsIdentityPromotionAllowed(event) {
+  return Boolean(event.identity && analyticsIdentityResolutionAllowed(event));
+}
+async function projectAnalyticsPixelEventConsent(client, input) {
+  const visitorId = input.event.visitorId?.trim().slice(0, 240);
+  const consent = input.event.consent;
+  if (!visitorId || !consent) return null;
+  const occurredAtMs = Date.parse(input.event.occurredAt);
+  const serverNow = Date.now();
+  if (!Number.isFinite(occurredAtMs) || occurredAtMs > serverNow + 5 * 6e4 || occurredAtMs < serverNow - 24 * 60 * 6e4)
+    return null;
+  const explicit = consent.purposes;
+  const purposes = {
+    siteAnalytics: explicit ? explicit.site_analytics === "granted" : consent.analytics === "granted",
+    enhancedMatching: explicit ? explicit.enhanced_matching === "granted" : consent.adUserData === "granted",
+    advertisingMeasurement: explicit ? explicit.advertising_measurement === "granted" : consent.adPersonalization === "granted"
+  };
+  const gpc = consent.globalPrivacyControl === true;
+  if (gpc) {
+    purposes.siteAnalytics = false;
+    purposes.enhancedMatching = false;
+    purposes.advertisingMeasurement = false;
+  }
+  const action = gpc ? "gpc" : Object.values(purposes).every(Boolean) ? "accept_all" : Object.values(purposes).every((value) => !value) ? "reject_all" : "save_choices";
+  const occurredAt = new Date(occurredAtMs).toISOString();
+  const previous = await client.query(
+    `SELECT s.latest_receipt_id::text,s.site_analytics,s.enhanced_matching,s.advertising_measurement,s.gpc,r.action
+       FROM analytics_consent_current_state s JOIN analytics_consent_receipts r ON r.id=s.latest_receipt_id
+      WHERE s.site_id=$1 AND s.subject_ref=$2 FOR UPDATE`,
+    [input.siteId, visitorId]
+  );
+  const prior = previous.rows[0];
+  if (prior && prior.site_analytics === purposes.siteAnalytics && prior.enhanced_matching === purposes.enhancedMatching && prior.advertising_measurement === purposes.advertisingMeasurement && prior.gpc === gpc && prior.action === action) return prior.latest_receipt_id;
+  const receiptId = randomUUID2();
+  await client.query(
+    `INSERT INTO analytics_consent_receipts(id,site_id,pixel_id,subject_ref,policy_version,jurisdiction_profile,
+      necessary,site_analytics,enhanced_matching,advertising_measurement,gpc,action,source,presented_at,occurred_at,supersedes_id)
+     VALUES($1,$2,$3,$4,1,'pixel',true,$5,$6,$7,$8,$9,'gateway',$10,$10,$11)`,
+    [
+      receiptId,
+      input.siteId,
+      input.pixelId,
+      visitorId,
+      purposes.siteAnalytics,
+      purposes.enhancedMatching,
+      purposes.advertisingMeasurement,
+      gpc,
+      action,
+      occurredAt,
+      prior?.latest_receipt_id ?? null
+    ]
+  );
+  await client.query(
+    `INSERT INTO analytics_consent_current_state(site_id,subject_ref,latest_receipt_id,policy_version,jurisdiction_profile,
+      necessary,site_analytics,enhanced_matching,advertising_measurement,gpc,effective_at)
+     VALUES($1,$2,$3,1,'pixel',true,$4,$5,$6,$7,$8)
+     ON CONFLICT(site_id,subject_ref) DO UPDATE SET latest_receipt_id=EXCLUDED.latest_receipt_id,
+      policy_version=EXCLUDED.policy_version,jurisdiction_profile=EXCLUDED.jurisdiction_profile,
+      site_analytics=EXCLUDED.site_analytics,enhanced_matching=EXCLUDED.enhanced_matching,
+      advertising_measurement=EXCLUDED.advertising_measurement,gpc=EXCLUDED.gpc,
+      effective_at=EXCLUDED.effective_at,updated_at=now()
+     WHERE EXCLUDED.effective_at>=analytics_consent_current_state.effective_at`,
+    [
+      input.siteId,
+      visitorId,
+      receiptId,
+      purposes.siteAnalytics,
+      purposes.enhancedMatching,
+      purposes.advertisingMeasurement,
+      gpc,
+      occurredAt
+    ]
+  );
+  return receiptId;
+}
+async function resolveAnalyticsConfirmedActivationIdentity(db, input) {
+  if (!input.subjectRef) return { personId: null, activationEligible: false };
+  const result = await db.query(
+    `SELECT p.id::text AS person_id,s.advertising_measurement
+       FROM analytics_people p
+       JOIN analytics_consent_current_state s ON s.site_id=p.site_id AND s.subject_ref=$2
+       JOIN analytics_consent_receipts r ON r.id=s.latest_receipt_id AND r.site_id=s.site_id
+      WHERE p.site_id=$1
+        AND (($3::uuid IS NOT NULL AND p.id=$3) OR ($4::text IS NOT NULL AND EXISTS (
+          SELECT 1 FROM analytics_events e WHERE e.site_id=p.site_id AND e.event_id=$4
+            AND e.person_id=p.id AND e.visitor_id=$2
+        )))
+        AND s.site_analytics=true AND s.gpc=false AND r.action NOT IN ('withdraw','gpc')
+        AND (s.expires_at IS NULL OR s.expires_at>now()) LIMIT 1`,
+    [input.siteId, input.subjectRef, input.personId ?? null, input.eventId ?? null]
+  );
+  const row = result.rows[0];
+  return row ? { personId: row.person_id, activationEligible: row.advertising_measurement === true } : { personId: null, activationEligible: false };
+}
+async function hasCurrentAnalyticsIdentityConsent(client, siteId, visitorId, sessionId) {
+  if (!visitorId?.trim() || !sessionId?.trim()) return false;
+  const result = await client.query(
+    `SELECT 1 FROM analytics_consent_current_state s
+      JOIN analytics_consent_receipts r ON r.id=s.latest_receipt_id AND r.site_id=s.site_id
+      WHERE s.site_id=$1 AND s.subject_ref=$2
+        AND s.site_analytics=true AND s.enhanced_matching=true AND s.gpc=false
+        AND r.action NOT IN ('withdraw','gpc')
+        AND (s.expires_at IS NULL OR s.expires_at>now())
+        AND EXISTS (SELECT 1 FROM analytics_sessions x
+          WHERE x.site_id=s.site_id AND x.visitor_hmac=$3 AND x.session_hmac=$4)
+      ORDER BY s.effective_at DESC LIMIT 1`,
+    [siteId, visitorId, identityHmac("visitor_id", visitorId), identityHmac("session_id", sessionId)]
+  );
+  return Boolean(result.rowCount);
+}
+async function hasCurrentPersonIdentityConsent(client, siteId, personPublicRef) {
+  const result = await client.query(
+    `SELECT 1 FROM analytics_consent_current_state s
+      JOIN analytics_consent_receipts r ON r.id=s.latest_receipt_id AND r.site_id=s.site_id
+      WHERE s.site_id=$1 AND s.subject_ref=$2
+        AND s.site_analytics=true AND s.enhanced_matching=true AND s.gpc=false
+        AND r.action NOT IN ('withdraw','gpc')
+        AND (s.expires_at IS NULL OR s.expires_at>now()) LIMIT 1`,
+    [siteId, personPublicRef]
+  );
+  return Boolean(result.rowCount);
+}
 var MAX_ENGAGED_MS = 30 * 60 * 1e3;
 var ENGAGED_SESSION_MS = 1e4;
 function boundedEngagedMs(value) {
@@ -2926,7 +3403,7 @@ async function materializeAnalyticsSessionAndTouch(input) {
        updated_at = now()
      RETURNING id`,
     [
-      randomUUID(),
+      randomUUID2(),
       input.siteId,
       input.pixelId,
       visitorHmac,
@@ -2942,7 +3419,7 @@ async function materializeAnalyticsSessionAndTouch(input) {
     input.event.source || input.event.medium || input.event.campaign || input.event.referrer || Object.keys(clickIds).length
   );
   if (!hasTouch) return;
-  const touchHash = createHash("sha256").update(
+  const touchHash = createHash2("sha256").update(
     JSON.stringify({
       siteId: input.siteId,
       sessionHmac,
@@ -2963,7 +3440,7 @@ async function materializeAnalyticsSessionAndTouch(input) {
        person_id = COALESCE(analytics_attribution_touches.person_id, EXCLUDED.person_id)
      RETURNING id`,
     [
-      randomUUID(),
+      randomUUID2(),
       input.siteId,
       session.rows[0].id,
       input.personId ?? null,
@@ -2987,7 +3464,7 @@ async function materializeAnalyticsSessionAndTouch(input) {
 }
 async function ingestAnalyticsEvents(input) {
   const db = getAnalyticsPool();
-  const requestId = `air_${randomUUID()}`;
+  const requestId = `air_${randomUUID2()}`;
   const hostname = normalizeObservedHostname(input.origin);
   const pixelResult = await db.query(
     `SELECT p.id, p.site_id, p.status,
@@ -3008,7 +3485,7 @@ async function ingestAnalyticsEvents(input) {
       `INSERT INTO analytics_ingestion_receipts(id, request_id, site_id, pixel_id, hostname, rejected_count, reason_codes)
        VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb)`,
       [
-        randomUUID(),
+        randomUUID2(),
         requestId,
         pixel?.site_id ?? null,
         pixel?.id ?? null,
@@ -3033,7 +3510,7 @@ async function ingestAnalyticsEvents(input) {
       `INSERT INTO analytics_ingestion_receipts(id, request_id, site_id, pixel_id, hostname, rejected_count, reason_codes)
        VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb)`,
       [
-        randomUUID(),
+        randomUUID2(),
         requestId,
         pixel.site_id,
         pixel.id,
@@ -3058,7 +3535,7 @@ async function ingestAnalyticsEvents(input) {
       `INSERT INTO analytics_ingestion_receipts(id, request_id, site_id, pixel_id, rejected_count, reason_codes)
        VALUES ($1, $2, $3, $4, $5, $6::jsonb)`,
       [
-        randomUUID(),
+        randomUUID2(),
         requestId,
         pixel.site_id,
         pixel.id,
@@ -3082,7 +3559,7 @@ async function ingestAnalyticsEvents(input) {
      ON CONFLICT(pixel_id, hostname) DO UPDATE
        SET last_seen_at = now(), updated_at = now()
      RETURNING state`,
-    [randomUUID(), pixel.id, hostname]
+    [randomUUID2(), pixel.id, hostname]
   );
   if (domainResult.rows[0]?.state !== "approved") {
     await db.query(
@@ -3096,7 +3573,7 @@ async function ingestAnalyticsEvents(input) {
       `INSERT INTO analytics_ingestion_receipts(id, request_id, site_id, pixel_id, hostname, rejected_count, reason_codes)
        VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb)`,
       [
-        randomUUID(),
+        randomUUID2(),
         requestId,
         pixel.site_id,
         pixel.id,
@@ -3123,18 +3600,14 @@ async function ingestAnalyticsEvents(input) {
     await client.query("BEGIN");
     for (const event of input.events) {
       try {
-        const attribution = resolveAnalyticsAttribution(event);
-        const identifiedPersonId = event.identity && event.consent?.analytics === "granted" ? await linkAnalyticsIdentityInTransaction(client, {
+        await projectAnalyticsPixelEventConsent(client, {
           siteId: pixel.site_id,
-          visitorId: event.visitorId,
-          sessionId: event.sessionId,
-          email: event.identity.email,
-          phone: event.identity.phone,
-          customerId: event.identity.customerId,
-          orderId: event.identity.orderId,
-          clickIds: event.clickIds
-        }) : null;
-        const resolvedPerson = identifiedPersonId ? { rows: [{ person_id: identifiedPersonId }] } : event.visitorId || event.sessionId ? await client.query(
+          pixelId: pixel.id,
+          event
+        });
+        const attribution = resolveAnalyticsAttribution(event);
+        const eventIdentity = event.identity;
+        const resolvedPerson = analyticsIdentityResolutionAllowed(event) && (event.visitorId || event.sessionId) ? await client.query(
           `SELECT e.person_id FROM analytics_identity_nodes n JOIN analytics_identity_edges e ON e.identity_node_id = n.id
               WHERE n.site_id = $1 AND ((n.kind = 'visitor_id' AND n.value_hmac = $2) OR (n.kind = 'session_id' AND n.value_hmac = $3))
               ORDER BY e.confidence DESC, e.last_seen_at DESC LIMIT 1`,
@@ -3156,7 +3629,7 @@ async function ingestAnalyticsEvents(input) {
              $23, $24, $25, $26, $27, $28, $29, $30, $31, $32, $33
            ) ON CONFLICT(site_id, event_id) DO NOTHING`,
           [
-            randomUUID(),
+            randomUUID2(),
             event.eventId,
             pixel.site_id,
             pixel.id,
@@ -3193,13 +3666,34 @@ async function ingestAnalyticsEvents(input) {
         );
         if (inserted.rowCount) {
           accepted += 1;
+          const resolvedPersonId = resolvedPerson.rows[0]?.person_id;
           await materializeAnalyticsSessionAndTouch({
             client,
             siteId: pixel.site_id,
             pixelId: pixel.id,
-            personId: resolvedPerson.rows[0]?.person_id,
+            personId: resolvedPersonId,
             event
           });
+          if (resolvedPersonId && event.eventName === "identify") {
+            await backfillAnalyticsConfirmedHistory(client, {
+              siteId: pixel.site_id,
+              personId: resolvedPersonId,
+              visitorId: event.visitorId,
+              sessionId: event.sessionId
+            });
+          }
+          if (eventIdentity && analyticsIdentityPromotionAllowed(event)) {
+            await linkAnalyticsIdentityInTransaction(client, {
+              siteId: pixel.site_id,
+              visitorId: event.visitorId,
+              sessionId: event.sessionId,
+              email: eventIdentity.email,
+              phone: eventIdentity.phone,
+              customerId: eventIdentity.customerId,
+              orderId: eventIdentity.orderId,
+              clickIds: event.clickIds
+            });
+          }
         } else {
           rejected += 1;
           reasonCodes.add("duplicate_event");
@@ -3222,7 +3716,7 @@ async function ingestAnalyticsEvents(input) {
          id, request_id, site_id, pixel_id, hostname, accepted_count, rejected_count, reason_codes
        ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8::jsonb)`,
       [
-        randomUUID(),
+        randomUUID2(),
         requestId,
         pixel.site_id,
         pixel.id,
@@ -3254,7 +3748,7 @@ function normalizeGeographyCode(value, max) {
   return normalized && /^[A-Z0-9-]+$/.test(normalized) ? normalized.slice(0, max) : null;
 }
 function pageFingerprint(scope, siteId, filters) {
-  return createHash("sha256").update(JSON.stringify({ scope, siteId, filters })).digest("base64url").slice(0, 18);
+  return createHash2("sha256").update(JSON.stringify({ scope, siteId, filters })).digest("base64url").slice(0, 18);
 }
 function decodePageOffset(cursor, fingerprint) {
   if (!cursor) return 0;
@@ -3313,7 +3807,7 @@ async function createAnalyticsConversion(input) {
              ORDER BY e.confidence DESC LIMIT 1`,
       [input.siteId, identityHmac("session_id", input.sessionId)]
     ) : { rows: [] };
-    const proposedId = randomUUID();
+    const proposedId = randomUUID2();
     const inserted = await client.query(
       `INSERT INTO analytics_conversions(
          id, source_event_id, site_id, pixel_id, session_id, conversion_kind,
@@ -3353,7 +3847,7 @@ async function createAnalyticsConversion(input) {
            ) VALUES ($1,$2,$3,$4,$5)
            ON CONFLICT(destination_id, conversion_id) DO NOTHING`,
           [
-            randomUUID(),
+            randomUUID2(),
             destination.id,
             conversionId,
             resolvedPerson.rows[0]?.person_id ?? null,
@@ -4117,7 +4611,7 @@ async function createAnalyticsCampaignLink(input) {
         404
       );
   }
-  const shortCode = (input.shortCode?.trim().toLowerCase().replace(/[^a-z0-9_-]/g, "-") || randomBytes(5).toString("base64url").toLowerCase()).slice(0, 48);
+  const shortCode = (input.shortCode?.trim().toLowerCase().replace(/[^a-z0-9_-]/g, "-") || randomBytes2(5).toString("base64url").toLowerCase()).slice(0, 48);
   try {
     const result = await db.query(
       `INSERT INTO analytics_campaign_links(
@@ -4126,7 +4620,7 @@ async function createAnalyticsCampaignLink(input) {
        ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15)
        RETURNING *, 0::int AS click_count`,
       [
-        randomUUID(),
+        randomUUID2(),
         input.siteId,
         input.pixelId ?? null,
         input.name.trim(),
@@ -4197,7 +4691,7 @@ async function resolveAnalyticsCampaignLink(shortCode, referrer) {
   if (!row) return null;
   await db.query(
     `INSERT INTO analytics_campaign_clicks(id, link_id, referrer) VALUES ($1, $2, $3)`,
-    [randomUUID(), row.id, normalizeAnalyticsUrl(referrer || void 0)]
+    [randomUUID2(), row.id, normalizeAnalyticsUrl(referrer || void 0)]
   );
   return buildTaggedCampaignUrl(row);
 }
@@ -4215,14 +4709,14 @@ async function createAnalyticsForm(input) {
       404
     );
   const baseSlug = normalizeSlug(input.name);
-  const slug = `${baseSlug}-${randomBytes(3).toString("hex")}`;
-  const publicId = `form_${randomBytes(18).toString("base64url")}`;
+  const slug = `${baseSlug}-${randomBytes2(3).toString("hex")}`;
+  const publicId = `form_${randomBytes2(18).toString("base64url")}`;
   const result = await db.query(
     `INSERT INTO analytics_forms(id, public_id, site_id, pixel_id, name, slug, fields, brand, submit_label, success_message, redirect_url, consent_text, status, created_by_user_id)
      VALUES ($1,$2,$3,$4,$5,$6,$7::jsonb,$8::jsonb,$9,$10,$11,$12,$13,$14)
      RETURNING *, 0::int AS submission_count`,
     [
-      randomUUID(),
+      randomUUID2(),
       publicId,
       input.siteId,
       input.pixelId,
@@ -4267,7 +4761,7 @@ async function getPublicAnalyticsForm(publicId) {
   return result.rows[0] ?? null;
 }
 async function recordAnalyticsFormSubmission(input) {
-  const id = randomUUID();
+  const id = randomUUID2();
   await getAnalyticsPool().query(
     `INSERT INTO analytics_form_submissions(id, form_id, site_id, pixel_id, visitor_id, session_id, crm_person_ref, source, medium, campaign, crm_delivery_status, click_ids)
      VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12::jsonb)`,
@@ -4311,18 +4805,262 @@ function sanitizeClickIds(value) {
   return output;
 }
 function identityHmac(kind, value) {
-  return createHmac("sha256", getSessionSecret()).update(`${kind}:${value.trim().toLowerCase()}`).digest("hex");
+  return createHmac2("sha256", getSessionSecret()).update(`${kind}:${value.trim().toLowerCase()}`).digest("hex");
+}
+function newAnalyticsPersonPublicRef() {
+  return `xrp_${randomBytes2(18).toString("base64url")}`;
+}
+async function ensurePrimaryAnalyticsIdentityNamespace(client, siteId, source) {
+  let namespace = await client.query(
+    "SELECT id FROM analytics_identity_namespaces WHERE site_id=$1 AND status='approved' ORDER BY version DESC LIMIT 1",
+    [siteId]
+  );
+  if (!namespace.rows[0]) {
+    await client.query(
+      `INSERT INTO analytics_identity_namespaces(
+         id,site_id,name,status,approved_hosts,approved_sources,version,approved_by_user_id,approved_at
+       )
+       SELECT $1,s.id,'X-Ray primary','approved',
+         COALESCE((SELECT jsonb_agg(d.hostname ORDER BY d.hostname)
+                     FROM analytics_pixels p
+                     JOIN analytics_pixel_domains d ON d.pixel_id=p.id AND d.state='approved'
+                    WHERE p.site_id=s.id),'[]'::jsonb),
+         $3::jsonb,1,s.owner_user_id,now()
+         FROM analytics_sites s WHERE s.id=$2
+       ON CONFLICT(site_id,name,version) DO NOTHING`,
+      [randomUUID2(), siteId, JSON.stringify([source])]
+    );
+    namespace = await client.query(
+      "SELECT id FROM analytics_identity_namespaces WHERE site_id=$1 AND status='approved' ORDER BY version DESC LIMIT 1",
+      [siteId]
+    );
+  }
+  const namespaceId = namespace.rows[0]?.id;
+  if (!namespaceId)
+    throw new AnalyticsRepositoryError(
+      "identity_namespace_unavailable",
+      "The Site identity graph could not be initialized.",
+      409
+    );
+  await client.query(
+    `UPDATE analytics_identity_namespaces
+        SET approved_sources=(SELECT jsonb_agg(value ORDER BY value)
+                                FROM (SELECT DISTINCT value
+                                        FROM jsonb_array_elements_text(approved_sources || $3::jsonb)) merged_sources),
+            approved_hosts=(SELECT COALESCE(jsonb_agg(hostname ORDER BY hostname),'[]'::jsonb)
+                              FROM (SELECT DISTINCT hostname
+                                      FROM (SELECT jsonb_array_elements_text(approved_hosts) AS hostname
+                                            UNION ALL
+                                            SELECT d.hostname
+                                              FROM analytics_pixels p
+                                              JOIN analytics_pixel_domains d ON d.pixel_id=p.id AND d.state='approved'
+                                             WHERE p.site_id=$2) hosts) distinct_hosts),
+            updated_at=now()
+      WHERE id=$1 AND site_id=$2`,
+    [namespaceId, siteId, JSON.stringify([source])]
+  );
+  return namespaceId;
+}
+async function backfillAnalyticsConfirmedHistory(client, input) {
+  if (!input.visitorId && !input.sessionId)
+    return { events: 0, sessions: 0, touches: 0, conversions: 0 };
+  const visitorHmac = input.visitorId ? identityHmac("visitor_id", input.visitorId) : null;
+  const sessionHmac = input.sessionId ? identityHmac("session_id", input.sessionId) : null;
+  const events = await client.query(
+    `UPDATE analytics_events SET person_id = $1 WHERE site_id = $2 AND person_id IS NULL
+      AND (($3::text IS NOT NULL AND visitor_id = $3) OR ($4::text IS NOT NULL AND session_id = $4))`,
+    [input.personId, input.siteId, input.visitorId ?? null, input.sessionId ?? null]
+  );
+  const conversions = await client.query(
+    `UPDATE analytics_conversions SET person_id = $1 WHERE site_id = $2 AND person_id IS NULL
+      AND $3::text IS NOT NULL AND session_id = $3`,
+    [input.personId, input.siteId, input.sessionId ?? null]
+  );
+  const sessions = await client.query(
+    `UPDATE analytics_sessions SET person_id = $1
+      WHERE site_id = $2 AND person_id IS NULL
+        AND (($3::text IS NOT NULL AND visitor_hmac = $3)
+          OR ($4::text IS NOT NULL AND session_hmac = $4))`,
+    [input.personId, input.siteId, visitorHmac, sessionHmac]
+  );
+  const touches = await client.query(
+    `UPDATE analytics_attribution_touches SET person_id = $1
+      WHERE site_id = $2 AND person_id IS NULL
+        AND (($3::text IS NOT NULL AND visitor_hmac = $3)
+          OR ($4::text IS NOT NULL AND session_id IN (
+            SELECT id FROM analytics_sessions
+             WHERE site_id = $2 AND session_hmac = $4
+          )))`,
+    [input.personId, input.siteId, visitorHmac, sessionHmac]
+  );
+  return {
+    events: events.rowCount ?? 0,
+    sessions: sessions.rowCount ?? 0,
+    touches: touches.rowCount ?? 0,
+    conversions: conversions.rowCount ?? 0
+  };
+}
+async function resolveAndMergeConfirmedAnalyticsPerson(client, input) {
+  const matches = await client.query(
+    `SELECT p.id
+       FROM analytics_people p
+       JOIN (
+         SELECT DISTINCT e.person_id
+           FROM analytics_identity_nodes n
+           JOIN analytics_identity_edges e ON e.identity_node_id=n.id AND e.site_id=n.site_id
+          WHERE n.site_id=$1 AND EXISTS (
+            SELECT 1 FROM jsonb_to_recordset($2::jsonb) signal(kind text,value_hmac text)
+             WHERE signal.kind=n.kind AND signal.value_hmac=n.value_hmac
+          )
+       ) matched ON matched.person_id=p.id
+      WHERE p.site_id=$1 AND (p.namespace_id=$3 OR p.namespace_id IS NULL)
+      ORDER BY p.first_seen_at ASC,p.id ASC
+      FOR UPDATE OF p`,
+    [
+      input.siteId,
+      JSON.stringify(input.signals.map((signal) => ({ kind: signal.kind, value_hmac: signal.valueHmac }))),
+      input.namespaceId
+    ]
+  );
+  const canonicalId = matches.rows[0]?.id;
+  if (!canonicalId) {
+    const inserted = await client.query(
+      `INSERT INTO analytics_people(id, site_id, namespace_id, crm_person_ref, public_ref) VALUES ($1,$2,$3,$4,$5)
+       ON CONFLICT(site_id, crm_person_ref) DO UPDATE SET last_seen_at = now(),
+         namespace_id=COALESCE(analytics_people.namespace_id,EXCLUDED.namespace_id),
+         public_ref=COALESCE(analytics_people.public_ref,EXCLUDED.public_ref) RETURNING id`,
+      [randomUUID2(), input.siteId, input.namespaceId, input.crmPersonRef, newAnalyticsPersonPublicRef()]
+    );
+    return inserted.rows[0].id;
+  }
+  await client.query(
+    `UPDATE analytics_people SET last_seen_at=now(),
+       namespace_id=COALESCE(namespace_id,$2),public_ref=COALESCE(public_ref,$3)
+      WHERE id=$1 AND site_id=$4`,
+    [canonicalId, input.namespaceId, newAnalyticsPersonPublicRef(), input.siteId]
+  );
+  const duplicateIds = matches.rows.slice(1).map((row) => row.id);
+  if (duplicateIds.length === 0) return canonicalId;
+  await client.query(
+    `DELETE FROM analytics_identity_edges duplicate
+      USING analytics_identity_edges canonical
+      WHERE duplicate.site_id=$1 AND duplicate.person_id=ANY($2::uuid[])
+        AND canonical.site_id=duplicate.site_id AND canonical.person_id=$3
+        AND canonical.identity_node_id=duplicate.identity_node_id
+        AND canonical.evidence_kind=duplicate.evidence_kind`,
+    [input.siteId, duplicateIds, canonicalId]
+  );
+  await client.query(
+    `UPDATE analytics_identity_edges SET person_id=$3,namespace_id=$4
+      WHERE site_id=$1 AND person_id=ANY($2::uuid[])`,
+    [input.siteId, duplicateIds, canonicalId, input.namespaceId]
+  );
+  for (const table of [
+    "analytics_form_submissions",
+    "analytics_events",
+    "analytics_conversions",
+    "analytics_sessions",
+    "analytics_attribution_touches",
+    "analytics_external_events",
+    "analytics_restricted_data",
+    "analytics_crm_outbound_jobs"
+  ]) {
+    await client.query(
+      `UPDATE ${table} SET person_id=$3 WHERE site_id=$1 AND person_id=ANY($2::uuid[])`,
+      [input.siteId, duplicateIds, canonicalId]
+    );
+  }
+  await client.query(
+    "UPDATE analytics_activation_jobs SET person_id=$2 WHERE person_id=ANY($1::uuid[])",
+    [duplicateIds, canonicalId]
+  );
+  await client.query(
+    `UPDATE analytics_candidate_associations SET promoted_person_id=$3,namespace_id=$4
+      WHERE site_id=$1 AND promoted_person_id=ANY($2::uuid[])`,
+    [input.siteId, duplicateIds, canonicalId, input.namespaceId]
+  );
+  await client.query(
+    `DELETE FROM analytics_candidate_promotions duplicate
+      USING analytics_candidate_promotions canonical
+      WHERE duplicate.site_id=$1 AND duplicate.person_id=ANY($2::uuid[])
+        AND canonical.site_id=duplicate.site_id AND canonical.person_id=$3
+        AND canonical.association_id=duplicate.association_id`,
+    [input.siteId, duplicateIds, canonicalId]
+  );
+  await client.query(
+    `UPDATE analytics_candidate_promotions SET person_id=$3,namespace_id=$4
+      WHERE site_id=$1 AND person_id=ANY($2::uuid[])`,
+    [input.siteId, duplicateIds, canonicalId, input.namespaceId]
+  );
+  await client.query(
+    `DELETE FROM analytics_crm_person_mappings duplicate
+      USING analytics_crm_person_mappings canonical
+      WHERE duplicate.site_id=$1 AND duplicate.person_id=ANY($2::uuid[])
+        AND canonical.site_id=duplicate.site_id AND canonical.person_id=$3
+        AND canonical.connection_id=duplicate.connection_id`,
+    [input.siteId, duplicateIds, canonicalId]
+  );
+  await client.query(
+    `UPDATE analytics_crm_person_mappings SET person_id=$3,namespace_id=$4
+      WHERE site_id=$1 AND person_id=ANY($2::uuid[])`,
+    [input.siteId, duplicateIds, canonicalId, input.namespaceId]
+  );
+  await client.query(
+    `DELETE FROM analytics_prediction_results duplicate
+      USING analytics_prediction_results canonical
+      WHERE duplicate.site_id=$1 AND duplicate.person_id=ANY($2::uuid[])
+        AND canonical.site_id=duplicate.site_id AND canonical.person_id=$3
+        AND canonical.manifest_id=duplicate.manifest_id`,
+    [input.siteId, duplicateIds, canonicalId]
+  );
+  for (const table of ["analytics_score_evaluations", "analytics_prediction_results"]) {
+    await client.query(
+      `UPDATE ${table} SET person_id=$3,namespace_id=$4
+        WHERE site_id=$1 AND person_id=ANY($2::uuid[])`,
+      [input.siteId, duplicateIds, canonicalId, input.namespaceId]
+    );
+  }
+  await client.query(
+    "UPDATE analytics_identity_profile_access_audits SET person_id=$3 WHERE site_id=$1 AND person_id=ANY($2::uuid[])",
+    [input.siteId, duplicateIds, canonicalId]
+  );
+  await client.query(
+    "UPDATE analytics_identity_tombstones SET person_id=$3 WHERE site_id=$1 AND person_id=ANY($2::uuid[])",
+    [input.siteId, duplicateIds, canonicalId]
+  );
+  await client.query(
+    "DELETE FROM analytics_people WHERE site_id=$1 AND id=ANY($2::uuid[])",
+    [input.siteId, duplicateIds]
+  );
+  return canonicalId;
 }
 async function linkAnalyticsIdentityInTransaction(client, input) {
   const stable = input.customerId || input.orderId || input.email || input.phone;
   if (!stable) return null;
+  if (!await hasCurrentAnalyticsIdentityConsent(
+    client,
+    input.siteId,
+    input.visitorId,
+    input.sessionId
+  )) return null;
+  const namespaceId = await ensurePrimaryAnalyticsIdentityNamespace(client, input.siteId, "pixel");
+  const tombstoneSignals = [
+    ...input.email ? [{ kind: "email", valueHmac: identityHmac("email", input.email) }] : [],
+    ...input.phone ? [{ kind: "phone", valueHmac: identityHmac("phone", input.phone) }] : [],
+    ...input.customerId ? [{ kind: "customer_id", valueHmac: identityHmac("customer_id", input.customerId) }] : [],
+    ...input.orderId ? [{ kind: "customer_id", valueHmac: identityHmac("customer_id", `order:${input.orderId}`) }] : []
+  ];
+  await assertAnalyticsIdentitySignalsNotTombstoned(client, {
+    siteId: input.siteId,
+    signals: tombstoneSignals
+  });
   const crmPersonRef = `XRay::${identityHmac("person_ref", stable).slice(0, 24)}`;
-  const person = await client.query(
-    `INSERT INTO analytics_people(id, site_id, crm_person_ref) VALUES ($1,$2,$3)
-     ON CONFLICT(site_id, crm_person_ref) DO UPDATE SET last_seen_at = now() RETURNING id`,
-    [randomUUID(), input.siteId, crmPersonRef]
-  );
-  const personId = person.rows[0].id;
+  const personId = await resolveAndMergeConfirmedAnalyticsPerson(client, {
+    siteId: input.siteId,
+    namespaceId,
+    crmPersonRef,
+    signals: tombstoneSignals
+  });
   const signals = [];
   if (input.visitorId)
     signals.push({ kind: "visitor_id", value: input.visitorId, evidence: "pixel_identify", confidence: 0.98 });
@@ -4340,30 +5078,66 @@ async function linkAnalyticsIdentityInTransaction(client, input) {
     signals.push({ kind: "click_id", value: `${platform}:${clickId}`, evidence: platform, confidence: 0.9 });
   for (const signal of signals) {
     const node = await client.query(
-      `INSERT INTO analytics_identity_nodes(id, site_id, kind, value_hmac) VALUES ($1,$2,$3,$4)
-       ON CONFLICT(site_id, kind, value_hmac) DO UPDATE SET last_seen_at = now() RETURNING id`,
-      [randomUUID(), input.siteId, signal.kind, identityHmac(signal.kind, signal.value)]
+      `INSERT INTO analytics_identity_nodes(id, site_id, namespace_id, kind, value_hmac) VALUES ($1,$2,$3,$4,$5)
+       ON CONFLICT(site_id, kind, value_hmac) DO UPDATE SET last_seen_at = now(),
+         namespace_id=COALESCE(analytics_identity_nodes.namespace_id,EXCLUDED.namespace_id) RETURNING id`,
+      [randomUUID2(), input.siteId, namespaceId, signal.kind, identityHmac(signal.kind, signal.value)]
     );
     await client.query(
-      `INSERT INTO analytics_identity_edges(id, site_id, person_id, identity_node_id, evidence_kind, confidence)
-       VALUES ($1,$2,$3,$4,$5,$6)
+      `INSERT INTO analytics_identity_edges(id, site_id, namespace_id, person_id, identity_node_id, evidence_kind, confidence)
+       VALUES ($1,$2,$3,$4,$5,$6,$7)
        ON CONFLICT(person_id, identity_node_id, evidence_kind) DO UPDATE
-       SET last_seen_at = now(), confidence = greatest(analytics_identity_edges.confidence, EXCLUDED.confidence)`,
-      [randomUUID(), input.siteId, personId, node.rows[0].id, signal.evidence, signal.confidence]
+       SET last_seen_at = now(), confidence = greatest(analytics_identity_edges.confidence, EXCLUDED.confidence),
+         namespace_id=COALESCE(analytics_identity_edges.namespace_id,EXCLUDED.namespace_id)`,
+      [randomUUID2(), input.siteId, namespaceId, personId, node.rows[0].id, signal.evidence, signal.confidence]
     );
   }
+  await backfillAnalyticsConfirmedHistory(client, {
+    siteId: input.siteId,
+    personId,
+    visitorId: input.visitorId,
+    sessionId: input.sessionId
+  });
+  if (input.customerId) {
+    await writeAnalyticsConfirmedIdentityProfile(client, {
+      siteId: input.siteId,
+      personId,
+      consentSubjectRefs: [input.visitorId ?? "", input.sessionId ?? ""],
+      evidenceType: "authenticated_user",
+      email: input.email,
+      phone: input.phone
+    });
+  }
   return personId;
 }
 async function linkAnalyticsFormIdentity(input) {
   const client = await getAnalyticsPool().connect();
   try {
     await client.query("BEGIN");
-    const person = await client.query(
-      `INSERT INTO analytics_people(id, site_id, crm_person_ref) VALUES ($1,$2,$3)
-       ON CONFLICT(site_id, crm_person_ref) DO UPDATE SET last_seen_at = now() RETURNING id`,
-      [randomUUID(), input.siteId, input.crmPersonRef]
-    );
-    const personId = person.rows[0].id;
+    if (!await hasCurrentAnalyticsIdentityConsent(
+      client,
+      input.siteId,
+      input.visitorId,
+      input.sessionId
+    )) {
+      await client.query("COMMIT");
+      return { personId: null, linkedSignals: 0 };
+    }
+    const namespaceId = await ensurePrimaryAnalyticsIdentityNamespace(client, input.siteId, "form");
+    const deterministicSignals = [
+      ...input.email ? [{ kind: "email", valueHmac: identityHmac("email", input.email) }] : [],
+      ...input.phone ? [{ kind: "phone", valueHmac: identityHmac("phone", input.phone) }] : []
+    ];
+    await assertAnalyticsIdentitySignalsNotTombstoned(client, {
+      siteId: input.siteId,
+      signals: deterministicSignals
+    });
+    const personId = await resolveAndMergeConfirmedAnalyticsPerson(client, {
+      siteId: input.siteId,
+      namespaceId,
+      crmPersonRef: input.crmPersonRef,
+      signals: deterministicSignals
+    });
     const signals = [];
     if (input.visitorId)
       signals.push({
@@ -4405,22 +5179,27 @@ async function linkAnalyticsFormIdentity(input) {
     }
     for (const signal of signals) {
       const node = await client.query(
-        `INSERT INTO analytics_identity_nodes(id, site_id, kind, value_hmac) VALUES ($1,$2,$3,$4)
-         ON CONFLICT(site_id, kind, value_hmac) DO UPDATE SET last_seen_at = now() RETURNING id`,
+        `INSERT INTO analytics_identity_nodes(id, site_id, namespace_id, kind, value_hmac) VALUES ($1,$2,$3,$4,$5)
+         ON CONFLICT(site_id, kind, value_hmac) DO UPDATE SET last_seen_at = now(),
+           namespace_id=COALESCE(analytics_identity_nodes.namespace_id,EXCLUDED.namespace_id) RETURNING id`,
         [
-          randomUUID(),
+          randomUUID2(),
           input.siteId,
+          namespaceId,
           signal.kind,
           identityHmac(signal.kind, signal.value)
         ]
       );
       await client.query(
-        `INSERT INTO analytics_identity_edges(id, site_id, person_id, identity_node_id, evidence_kind, confidence)
-         VALUES ($1,$2,$3,$4,$5,$6)
-         ON CONFLICT(person_id, identity_node_id, evidence_kind) DO UPDATE SET last_seen_at = now(), confidence = greatest(analytics_identity_edges.confidence, EXCLUDED.confidence)`,
+        `INSERT INTO analytics_identity_edges(id, site_id, namespace_id, person_id, identity_node_id, evidence_kind, confidence)
+         VALUES ($1,$2,$3,$4,$5,$6,$7)
+         ON CONFLICT(person_id, identity_node_id, evidence_kind) DO UPDATE SET last_seen_at = now(),
+           confidence = greatest(analytics_identity_edges.confidence, EXCLUDED.confidence),
+           namespace_id=COALESCE(analytics_identity_edges.namespace_id,EXCLUDED.namespace_id)`,
         [
-          randomUUID(),
+          randomUUID2(),
           input.siteId,
+          namespaceId,
           personId,
           node.rows[0].id,
           signal.evidence,
@@ -4434,42 +5213,80 @@ async function linkAnalyticsFormIdentity(input) {
         [personId, input.submissionId, input.siteId]
       );
     if (input.visitorId || input.sessionId) {
-      const visitorHmac = input.visitorId ? identityHmac("visitor_id", input.visitorId) : null;
-      const sessionHmac = input.sessionId ? identityHmac("session_id", input.sessionId) : null;
-      await client.query(
-        `UPDATE analytics_events SET person_id = $1 WHERE site_id = $2 AND person_id IS NULL
-          AND (($3::text IS NOT NULL AND visitor_id = $3) OR ($4::text IS NOT NULL AND session_id = $4))`,
-        [
-          personId,
-          input.siteId,
-          input.visitorId ?? null,
-          input.sessionId ?? null
-        ]
-      );
-      await client.query(
-        `UPDATE analytics_conversions SET person_id = $1 WHERE site_id = $2 AND person_id IS NULL AND $3::text IS NOT NULL AND session_id = $3`,
-        [personId, input.siteId, input.sessionId ?? null]
-      );
-      await client.query(
-        `UPDATE analytics_sessions SET person_id = $1
-          WHERE site_id = $2 AND person_id IS NULL
-            AND (($3::text IS NOT NULL AND visitor_hmac = $3)
-              OR ($4::text IS NOT NULL AND session_hmac = $4))`,
-        [personId, input.siteId, visitorHmac, sessionHmac]
+      await backfillAnalyticsConfirmedHistory(client, {
+        siteId: input.siteId,
+        personId,
+        visitorId: input.visitorId,
+        sessionId: input.sessionId
+      });
+    }
+    await writeAnalyticsConfirmedIdentityProfile(client, {
+      siteId: input.siteId,
+      personId,
+      consentSubjectRefs: [input.visitorId ?? ""],
+      evidenceType: input.evidenceType ?? "first_party_form",
+      displayName: input.displayName,
+      email: input.email,
+      phone: input.phone
+    });
+    await client.query("COMMIT");
+    return { personId, linkedSignals: signals.length };
+  } catch (error) {
+    await client.query("ROLLBACK");
+    throw error;
+  } finally {
+    client.release();
+  }
+}
+async function enrichAnalyticsExistingCrmIdentity(input) {
+  const client = await getAnalyticsPool().connect();
+  try {
+    await client.query("BEGIN");
+    const existing = await client.query(
+      `SELECT p.id,p.public_ref,p.namespace_id FROM analytics_people p
+        JOIN analytics_identity_namespaces n ON n.id=p.namespace_id AND n.site_id=p.site_id AND n.status='approved'
+        WHERE p.site_id=$1 AND p.crm_person_ref=$2 LIMIT 1 FOR UPDATE OF p`,
+      [input.siteId, input.crmPersonRef]
+    );
+    const person = existing.rows[0];
+    if (!person || !await hasCurrentPersonIdentityConsent(client, input.siteId, person.public_ref)) {
+      await client.query("COMMIT");
+      return { personId: null, linkedSignals: 0 };
+    }
+    const signals = [
+      ...input.email ? [{ kind: "email", value: input.email, confidence: 1 }] : [],
+      ...input.phone ? [{ kind: "phone", value: input.phone, confidence: 0.99 }] : []
+    ];
+    await assertAnalyticsIdentitySignalsNotTombstoned(client, {
+      siteId: input.siteId,
+      signals: signals.map((signal) => ({ kind: signal.kind, valueHmac: identityHmac(signal.kind, signal.value) }))
+    });
+    for (const signal of signals) {
+      const node = await client.query(
+        `INSERT INTO analytics_identity_nodes(id,site_id,namespace_id,kind,value_hmac) VALUES($1,$2,$3,$4,$5)
+         ON CONFLICT(site_id,kind,value_hmac) DO UPDATE SET last_seen_at=now(),
+           namespace_id=COALESCE(analytics_identity_nodes.namespace_id,EXCLUDED.namespace_id) RETURNING id`,
+        [randomUUID2(), input.siteId, person.namespace_id, signal.kind, identityHmac(signal.kind, signal.value)]
       );
       await client.query(
-        `UPDATE analytics_attribution_touches SET person_id = $1
-          WHERE site_id = $2 AND person_id IS NULL
-            AND (($3::text IS NOT NULL AND visitor_hmac = $3)
-              OR ($4::text IS NOT NULL AND session_id IN (
-                SELECT id FROM analytics_sessions
-                 WHERE site_id = $2 AND session_hmac = $4
-              )))`,
-        [personId, input.siteId, visitorHmac, sessionHmac]
+        `INSERT INTO analytics_identity_edges(id,site_id,namespace_id,person_id,identity_node_id,evidence_kind,confidence)
+         VALUES($1,$2,$3,$4,$5,'crm_contact',$6)
+         ON CONFLICT(person_id,identity_node_id,evidence_kind) DO UPDATE SET last_seen_at=now(),
+           confidence=greatest(analytics_identity_edges.confidence,EXCLUDED.confidence)`,
+        [randomUUID2(), input.siteId, person.namespace_id, person.id, node.rows[0].id, signal.confidence]
       );
     }
+    await writeAnalyticsConfirmedIdentityProfile(client, {
+      siteId: input.siteId,
+      personId: person.id,
+      consentSubjectRefs: [person.public_ref],
+      evidenceType: "crm_contact",
+      displayName: input.displayName,
+      email: input.email,
+      phone: input.phone
+    });
     await client.query("COMMIT");
-    return { personId, linkedSignals: signals.length };
+    return { personId: person.id, linkedSignals: signals.length };
   } catch (error) {
     await client.query("ROLLBACK");
     throw error;
@@ -4536,7 +5353,7 @@ async function createAnalyticsCrmImport(input) {
   const db = getAnalyticsPool();
   await requireEditor(db, input.siteId, input.userId);
   const client = await db.connect();
-  const id = randomUUID();
+  const id = randomUUID2();
   try {
     await client.query("BEGIN");
     await client.query(
@@ -4556,7 +5373,7 @@ async function createAnalyticsCrmImport(input) {
       await client.query(
         `INSERT INTO analytics_crm_import_rows(id, import_id, crm_person_ref, payload_ciphertext)
          VALUES ($1,$2,$3,$4) ON CONFLICT(import_id, crm_person_ref) DO NOTHING`,
-        [randomUUID(), id, row.crmPersonRef, row.payloadCiphertext]
+        [randomUUID2(), id, row.crmPersonRef, row.payloadCiphertext]
       );
     }
     await client.query("COMMIT");
@@ -4679,7 +5496,7 @@ async function createAnalyticsActivationDestination(input) {
     `INSERT INTO analytics_activation_destinations(id, site_id, platform, name, connection_ref, external_dataset_id, event_mapping, provider_config, created_by_user_id)
      VALUES ($1,$2,$3,$4,$5,$6,$7::jsonb,$8::jsonb,$9) RETURNING *`,
     [
-      randomUUID(),
+      randomUUID2(),
       input.siteId,
       input.platform,
       input.name.trim(),
@@ -4826,8 +5643,8 @@ async function testAnalyticsActivationDestination(input) {
       400
     );
   }
-  const testId = randomUUID();
-  const syntheticHash = createHash("sha256").update(`xray-provider-test:${testId}`).digest("hex");
+  const testId = randomUUID2();
+  const syntheticHash = createHash2("sha256").update(`xray-provider-test:${testId}`).digest("hex");
   const providerConfig = destination.provider_config ?? {};
   const payload = {
     eventId: `xray-test:${testId}`,
@@ -5064,7 +5881,7 @@ async function queueAnalyticsActivation(input) {
       `INSERT INTO analytics_activation_jobs(id, destination_id, conversion_id, person_id, payload_ciphertext)
        VALUES ($1,$2,$3,$4,$5) ON CONFLICT(destination_id, conversion_id) DO NOTHING`,
       [
-        randomUUID(),
+        randomUUID2(),
         destination.id,
         input.conversionId,
         input.personId ?? null,
@@ -5076,7 +5893,7 @@ async function queueAnalyticsActivation(input) {
   return queued;
 }
 async function queueAnalyticsFormDelivery(input) {
-  const id = randomUUID();
+  const id = randomUUID2();
   await getAnalyticsPool().query(
     `INSERT INTO analytics_form_delivery_jobs(id, submission_id, owner_user_id, payload_ciphertext, last_error_code)
      VALUES ($1,$2,$3,$4,$5)`,
@@ -5233,7 +6050,7 @@ async function analyticsHealth(siteId, userId) {
 }
 async function refreshAnalyticsDailyRollups(input) {
   const db = getAnalyticsPool();
-  const runId = randomUUID();
+  const runId = randomUUID2();
   await db.query(
     `INSERT INTO analytics_rollup_runs(id, window_start, window_end, status) VALUES ($1, $2, $3, 'running')`,
     [runId, input.start, input.end]
@@ -5430,7 +6247,7 @@ async function createAnalyticsExport(input) {
       `Generated ${(/* @__PURE__ */ new Date()).toISOString()} from the governed ${input.report} report contract.`
     ].join("\n");
   }
-  const id = randomUUID();
+  const id = randomUUID2();
   const inserted = await getAnalyticsPool().query(
     `INSERT INTO analytics_exports(id, site_id, requested_by_user_id, idempotency_key, report, format, filters, content)
      VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb, $8)
@@ -5465,6 +6282,13 @@ async function createAnalyticsExport(input) {
 }
 
 export {
+  encryptAnalyticsRestricted,
+  decryptAnalyticsRestricted,
+  analyticsIdentityHmac,
+  signAnalyticsWebhook,
+  verifyAnalyticsWebhookSignature,
+  AnalyticsIdentityProfileError,
+  resolveAnalyticsMaskedIdentityProfile,
   AnalyticsProviderRegistryError,
   getAnalyticsProviderDefinition,
   assertConnectionSupportsProvider,
@@ -5492,6 +6316,10 @@ export {
   listAnalyticsHostGroups,
   prepareAnalyticsLinkerIssue,
   redeemAnalyticsLinkerRecord,
+  analyticsIdentityResolutionAllowed,
+  analyticsIdentityPromotionAllowed,
+  projectAnalyticsPixelEventConsent,
+  resolveAnalyticsConfirmedActivationIdentity,
   MAX_ENGAGED_MS,
   ENGAGED_SESSION_MS,
   normalizeAnalyticsPath,
@@ -5520,7 +6348,10 @@ export {
   recordAnalyticsFormSubmission,
   sanitizeClickIds,
   identityHmac,
+  backfillAnalyticsConfirmedHistory,
+  linkAnalyticsIdentityInTransaction,
   linkAnalyticsFormIdentity,
+  enrichAnalyticsExistingCrmIdentity,
   listAnalyticsPeople,
   getAnalyticsPersonJourney,
   createAnalyticsCrmImport,