@funnel10x/tracking 1.4.0 → 2.1.0

package/dist/gtm.html

@@ -1,9 +1,45 @@
-<!-- @funnel10x/tracking@1.4.0: a tag do GTM (Custom HTML, em All Pages). Só se mudam a chave e, se a account tiver o proxy gerido do PostHog, o apiHost; uma versão nova é um ficheiro novo. -->
+<!--
+  @funnel10x/tracking@2.1.0: a tag do GTM (Custom HTML, em All Pages, com a condição de consentimento do site, se ele tiver banner).
+  Num site com esta tag, a tag oficial do PostHog só existe como reserva (decisão 1 da A2c): outra tag Custom HTML, com a mesma chave, que dispara
+  só no evento personalizado f10x_tracking_failed, que esta empurra para o dataLayer, uma vez, quando o tag.js não carrega (o jsDelivr em baixo ou
+  bloqueado, um integrity que não bate) ou carrega e não arranca (o window.f10xTracking sem version). A receita está no README do pacote.
+  Só se mudam a chave, o apiHost (o proxy gerido da account, se o tiver), os checkoutHosts, os linkedDomains (o cross-domain, desligado com a
+  lista vazia) e, numa emergência, o sdkVersion (uma versão exacta do posthog-js); uma versão nova do pacote é um ficheiro novo.
+  O script do jsDelivr cria-se por código, com o onload e o onerror como propriedades: um atributo onload no HTML é um handler inline, que o GTM
+  copia ao recriar o script e que uma CSP com nonce não deixa correr. Um pedido pendurado conta como falhado ao fim de 10 s.
+  O evento vai para o window.dataLayer: num GTM com a data layer renomeada (o l= do snippet do GTM) a reserva não dispara, e o ponto 8 do
+  checklist do README apanha-o.
+-->
 <script>
   window.f10xTracking = {
     key: '{{PostHog project key}}',
     apiHost: '',
-    checkoutHosts: []
+    sdkVersion: '',
+    checkoutHosts: [],
+    linkedDomains: []
   }
+  ;(function () {
+    var timer
+    function failed() {
+      clearTimeout(timer)
+      if (window.__f10xTracking && window.__f10xTracking.version) {
+        window.f10xTracking = window.__f10xTracking
+        return
+      }
+      if (window.__f10xTrackingFailed) return
+      window.__f10xTrackingFailed = true
+      ;(window.dataLayer = window.dataLayer || []).push({ event: 'f10x_tracking_failed' })
+    }
+    var script = document.createElement('script')
+    script.src = 'https://cdn.jsdelivr.net/npm/@funnel10x/tracking@2.1.0/dist/tag.js'
+    script.integrity = 'sha384-rAsc1JEueGFQjq9sTrZc5NnKX006TA+0GdHVDRpZVdOHLtWH28a8fZV2HbwqEtRI'
+    script.crossOrigin = 'anonymous'
+    script.onload = function () {
+      clearTimeout(timer)
+      if (!(window.f10xTracking && window.f10xTracking.version)) failed()
+    }
+    script.onerror = failed
+    timer = setTimeout(failed, 10000)
+    document.head.appendChild(script)
+  })()
 </script>
-<script src="https://cdn.jsdelivr.net/npm/@funnel10x/tracking@1.4.0/dist/tag.js" integrity="sha384-UTBEFP06SUs6EqWR2bkYb7Rq6QEj2SWvMGpf1/3g4uhyNGYMzyucjjeHtYYoW/xD" crossorigin="anonymous"></script>

package/dist/index.d.ts

@@ -3,8 +3,10 @@ import type { PostHog } from 'posthog-js'
 export interface TrackingOptions {
   /** The PostHog project key of the account (`phc_…`). */
   key: string
-  /** Where events go: the proxy on the site's own domain (`/_t`) in a direct repo; PostHog US by default. */
+  /** Where events go: the proxy on the site's own domain (`/_t`) in a direct repo, the account's managed proxy in a tag; PostHog US by default. The SDK (`array.js`) loads from the same host's assets. */
   apiHost?: string
+  /** An exact posthog-js version (`1.438.9`), for an emergency only: without it the 1.x channel of the PostHog CDN loads, and updates itself like the official tag. */
+  sdkVersion?: string
   /** The `consent` of a direct site's `site.json`; without it there is no switch and the snippet runs. */
   consent?: boolean
   /** The version of the page being served (direct site). */
@@ -15,7 +17,15 @@ export interface TrackingOptions {
   checkoutHosts?: string[]
   /** Add the missing hidden fields to lead forms (default true). */
   addFields?: boolean
-  /** posthog-js options on top of this package's. */
+  /**
+   * Linked domains for cross-domain tracking (off by default): hosts, or registrable domains that also cover their
+   * subdomains, as a list or a string separated by commas or spaces (an entry that is not a hostname, like
+   * `*.example.com`, is ignored with a console warning). Links and forms to them carry `_f10x` on click or submit, and
+   * an `_f10x` that arrives within 2 minutes links the visitor: the origin's person and session when the page has no
+   * PostHog identity yet, or `linked_distinct_id` on every event when it has one.
+   */
+  linkedDomains?: string[] | string
+  /** posthog-js options on top of this package's (turning a feature off on one site, tests). */
   posthog?: Record<string, unknown>
 }
 
@@ -28,12 +38,11 @@ export interface Tracking {
   onReady(fn: (ready: true) => void): void
   fields(): Record<string, string>
   capture(event: string, properties?: Record<string, unknown>): void
+  /** The PostHog instance once the SDK has loaded; the stub (which queues calls) until then. */
   posthog: PostHog | null
 }
 
 export const VERSION: string
 export const CONSENT_KEY: string
 export const ALLOWED_PARAMS: string[]
-export function cleanUrl(value: string, base?: string): string
-export function cleanEvent<T>(event: T, base?: string): T
 export function init(options: TrackingOptions): Tracking