1.1.0

[yosriady]

Minor bump for #83. Bumps package.json and the generated src/version.ts — nothing else, matching previous releases.

Minor rather than patch: no API breaks, but three changes are observable in the data.

Highlights

Traffic-source sanitization. utm_*/ref/referrer captured from deep links and the Android Play install referrer were stored and replayed onto every event with no validation. Anyone who can get a user to open myapp://x?utm_source=<script>… controlled the value for the whole session. Values are now checked raw and percent-decoded, including doubly-encoded payloads, schemes smuggled inside a query value, multi-byte escapes, and query keys.

Cold-start attribution. The first event of an app session now ships immediately instead of waiting for flushAt or the 30s timer — those were exactly the events lost to a force-quit, an OS memory kill, or a crash, none of which give AppState a chance to report background.

Queue and teardown reliability. Failed flushes re-arm the retry interval instead of stranding events; permanently-rejected batches are dropped rather than re-posted forever; teardown is bounded and idempotent, and can no longer hang the SDK's re-initialization; events cleared during opt-out can no longer be resurrected by an in-flight send.

CI. src/version.ts is now verified against package.json on every PR, so library_version cannot silently report a stale release.

Upgrade notes

Nothing to change — no API, type, export, or dependency changes. Three behaviours are worth knowing about:

1. Attribution values can now be dropped. Anything tripping the rules is absent from event context rather than reported. That includes two known false positives inherited verbatim from the web SDK: values containing an apostrophe (Mother's Day) and campaign text beginning with javascript:/data:. Values already persisted by an older SDK are also scrubbed on first read. Dropped fields come out absent, not "".
2. A permanently-rejected batch is discarded. A 4xx other than 429/408 — an invalid write key, a malformed payload — now drops those events instead of keeping them queued. They were never going to be accepted, but this is a change from retained to gone.
3. Teardown is bounded at 5s and abandons whatever is still queued. On a slow-but-working network, events that would eventually have flushed at unmount may now be dropped. The trade is against teardown hanging indefinitely, which also permanently blocked SDK reconfiguration.

Smaller: one extra request per session (the immediate first flush); a queue outliving an outage keeps retrying rather than stalling; 408 is retried; cleanup() is idempotent; enqueue() after cleanup is ignored; callbacks are not invoked for batches abandoned at teardown, though the returned promise still resolves.

Verification

371 tests (331 before #83); typecheck, lint, build and pnpm audit --prod clean; version-sync passes at 1.1.0.

Verified end-to-end against examples/with-react-native under Metro with events pointed at a local collector: normal delivery intact with the first batch carrying exactly one event, doubly-encoded / scheme-in-value / multi-byte payloads all dropped while clean utm_medium and utm_content came through untouched, and repeated unmount → cleanup → re-init cycles with no hang or unhandled rejection.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}