@oharness/server 0.10.0 → 0.11.0

package/dist/analytics.d.ts

@@ -1,47 +1,50 @@
 export interface AnalyticsState {
-    /** True only when this build carries a vendor and the user has opted in. */
+    /** True only when this build carries a key and the user has opted in. */
     enabled: boolean;
     /**
-     * Whether this build carries either vendor at all — the difference between
-     * "off" and "absent". One switch covers both: a person consenting to usage
-     * analytics is not being asked to arbitrate between two vendors they did not
-     * choose, and a build that carries only one is the normal case.
+     * Whether this build carries a key at all — the difference between "off"
+     * and "absent", so Settings can leave out a switch that would do nothing.
      */
     available: boolean;
-    /** PostHog, present only when enabled and this build carries a key. */
-    key?: string;
-    host?: string;
-    options?: Record<string, unknown>;
-    /** DataFast, present only when enabled and this build carries an id. */
-    datafast?: {
-        id: string;
-        domain: string;
-        src: string;
-    };
 }
+/** What `GET /analytics` and `POST /analytics` answer. */
+export declare function analyticsState(): Promise<AnalyticsState>;
+/** Called after Settings writes the pref, so the next event sees it. */
+export declare function setConsent(value: boolean): void;
+/** Once a day the app runs. Safe to call as often as convenient. */
+export declare function heartbeat(): Promise<void>;
+/** Once a day the app is used — a prompt sent, not merely a window left open. */
+export declare function markUsed(): Promise<void>;
+/** Hourly, so a window left open across midnight still counts the new day. */
+export declare function startHeartbeat(): () => void;
 /**
- * What `GET /analytics` answers.
+ * What the page may send, reduced to what it is allowed to send.
  *
- * `available` is reported separately so Settings can say "this build carries
- * no analytics" rather than showing a switch that would do nothing — a control
- * that silently does nothing is worse than no control.
+ * The page's calls already pass only enumerable values, and this is the check
+ * that keeps it so: an event name, at most ten properties, each a boolean, a
+ * number or a short string. Anything that could be text someone typed — a long
+ * string, one carrying the page's token — is dropped here rather than trusted.
  */
-export declare function analyticsState(): Promise<AnalyticsState>;
+export declare function cleanEvent(body: Record<string, unknown>): {
+    event: string;
+    props: Record<string, unknown>;
+} | null;
+/** A usage event. Dropped unless this build has a key and the user opted in. */
+export declare function track(event: string, props?: Record<string, unknown>): Promise<void>;
+/** Send what is queued. Called on a timer, and on close so a quit loses nothing. */
+export declare function flushAnalytics(): Promise<void>;
 /**
  * The queue, for the document head.
  *
  * Boot fires events before anything could have decided whether to send them,
- * so they wait here. Nothing in this stub touches the network: it exists only
- * so that `track()` reads the same whether analytics end up on or off, and so
- * that no caller has to remember which branch it is writing in.
+ * so they wait here. Nothing in this stub touches the network.
  */
-export declare const ANALYTICS_STUB = "<script>\nwindow.__ANALYTICS_QUEUE = [];\nwindow.__TRACK = function (event, props) {\n  // Bounded: a queue nothing will ever drain is a leak in a page left open all\n  // day, and the events worth having are the early ones anyway.\n  if (window.__ANALYTICS_QUEUE.length < 100) window.__ANALYTICS_QUEUE.push([event, props]);\n};\n</script>";
+export declare const ANALYTICS_STUB = "<script>\nwindow.__ANALYTICS_QUEUE = [];\nwindow.__TRACK = function (event, props) {\n  if (window.__ANALYTICS_QUEUE.length < 100) window.__ANALYTICS_QUEUE.push([event, props]);\n};\n</script>";
 /**
- * The loader, appended to the client script where the token already exists.
+ * Hands events to this server, and only once it has said they are wanted.
  *
- * One request to `/analytics` answers for both vendors, and one consent
- * decides both — so a person who has not opted in has neither vendor's key in
- * their page source, which is the property that made the key server-served in
- * the first place.
+ * No vendor code and no vendor address: the page talks to its own origin and
+ * nothing else, which is the rule page.ts states for everything in it. A build
+ * without a key does not even ship the forwarding, only the drain.
  */
 export declare const ANALYTICS_CLIENT: string;

package/dist/analytics.js

@@ -1,323 +1,270 @@
+import { randomUUID } from "node:crypto";
+import { access, mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { userPath } from "@oharness/engine/paths.ts";
+import { parseJson } from "@oharness/engine/util/json.ts";
 import { readPrefs } from "./prefs.js";
 /**
- * Usage analytics for the browser frontend. Off until the person using it says
- * otherwise, and absent entirely from a build nobody published.
+ * Usage analytics, sent from this process rather than from the page.
  *
- * This is not the website. The page this feeds runs on the user's own machine,
- * in front of an agent that has a shell there, and its address carries the
- * token that grants that shell. So it is gated twice, and the two gates answer
- * different questions:
+ * The page is served from `127.0.0.1:<port>` with a token in its address, and
+ * the port is a new one on every launch. Analytics run inside it had two
+ * problems no setting could fix: the vendor's id lived in that origin's
+ * localStorage, so every launch was a new person and nothing about retention
+ * could be read; and the vendor's script read the address, so the token had to
+ * be stripped from every property it might turn up in. Here the page holds no
+ * vendor code at all. It hands an event name and a few enumerable properties to
+ * `POST /track`, and this module decides whether it goes anywhere.
  *
- *   A key, which only an official build carries. It is injected at packaging
- *   time and is not in this repository — deliberately, because a default
- *   compiled into the source would mean every fork and every self-hosted
- *   install reporting into the publisher's dashboard. Someone who builds this
- *   themselves gets a build that cannot report anywhere, and gets it without
- *   having to configure anything.
+ * Gated twice, as before, and the two gates answer different questions:
  *
- *   Consent, which only the user grants. Stored in prefs, absent by default,
- *   and revocable from Settings.
+ *   A key, which only an official build carries. Injected at packaging time
+ *   and not in this repository, because a default compiled into the source
+ *   would be every fork reporting into the publisher's project. A build made
+ *   from a checkout has no key, writes no id, and sends nothing — of either
+ *   kind below.
  *
- * Neither implies the other, and the page loads nothing until both are true —
- * which is why the key is served from `/analytics` rather than inlined into
- * the HTML. A user who never opts in never has it in their page source at all.
+ *   Consent, stored in prefs, off by default and revocable from Settings.
  *
- * What it sends: named events for actions taken — a panel opened, a prompt
- * submitted, a permission answered, a model switched — and nothing about their
- * content. No prompts, no file paths, no diffs, no transcript. Autocapture is
- * off, so a click is never recorded by the text on the button; session replay
- * is off; and URL properties are stripped, because the URL is where the token
- * is. See `track()` in page.ts for the calls themselves.
- */
-/**
- * The published build's key, or nothing.
- *
- * Read from the environment so that the desktop shell can set it from the file
- * packaging injects, and so that `oharness-web` run from a checkout can be
- * pointed at a project of its own for a day without editing anything.
- */
-const KEY = process.env["OHARNESS_POSTHOG_KEY"] ?? "";
-/** US cloud unless told otherwise. EU is https://eu.i.posthog.com. */
-const HOST = process.env["OHARNESS_POSTHOG_HOST"] ?? "https://us.i.posthog.com";
-/**
- * DataFast, alongside PostHog and under the same two gates.
- *
- * The site runs both for the reason written in the website's own
- * `lib/analytics.ts`: PostHog answers product questions, DataFast answers "how
- * many, from where" without anyone learning a query language. Here it answers
- * one question PostHog also answers — how many launches, from which country —
- * and it is here so that the desktop app and the site show up on the same
- * dashboard rather than in two places that have to be added up by hand.
+ * Two kinds of event, and only the first needs consent:
  *
- * Both shells, and gated on the one thing that actually matters: whether this
- * page's address carries the token.
+ *   Usage — a panel opened, a prompt submitted, a model switched. Named events
+ *   with enumerable properties and never their content: no prompts, file
+ *   paths, diffs or transcripts. Sent only after the user turns it on.
  *
- * DataFast's script reads `window.location.href` unconditionally and has no
- * hook to filter what it sends — its entire configuration surface is six
- * `data-*` attributes, none of which redacts anything. PostHog has
- * `property_denylist` and `before_send`; DataFast has nothing, so the URL has
- * to be clean before the script is allowed to exist.
+ *   Counting — `app_installed` once, `daily_ping` once a day the app runs,
+ *   `daily_used` once a day it is used. They carry the install id, the version
+ *   and the platform and nothing else, and they are what makes "how many
+ *   people use this" a number rather than a guess from the few who opted in.
+ *   The privacy policy names them.
  *
- * Today that means the desktop shell and not `oharness-web`, which is where
- * this landed anyway — but by measuring the thing itself rather than by asking
- * which shell it is. `IS_DESKTOP` would be a proxy for the real question and
- * would silently become wrong the day a third shell appears, or the day the
- * desktop window is handed a URL with a query string on it.
- *
- * Taking the token out of the browser's address bar was tried and does not
- * work: the document request on a reload is the one the page cannot influence,
- * so a scrubbed URL means F5 returns 401. The desktop shell gets around that
- * with `onBeforeSendHeaders`; a browser tab has no equivalent. Anyone
- * revisiting this should read that as the constraint it is — browser-mode
- * DataFast needs the credential to stop travelling in the URL, and that is an
- * authentication change, not an analytics one.
+ * Both are filed under one install id: a random UUID in the user directory,
+ * created the first time an official build runs, joined to nothing — not the
+ * account, not the machine. Desktop and `oharness-web` on the same machine
+ * share it, because they share that directory.
  */
-const DATAFAST_ID = process.env["OHARNESS_DATAFAST_ID"] ?? "";
-/**
- * The site this files under. `oharness.ai`, not the page's own hostname —
- * the page's hostname is `127.0.0.1`, which is nobody's site.
- */
-const DATAFAST_DOMAIN = process.env["OHARNESS_DATAFAST_DOMAIN"] ?? "oharness.ai";
-/** Served from DataFast's own origin. There is nothing here to proxy it through. */
-const DATAFAST_SRC = "https://datafa.st/js/script.js";
-/**
- * Every property PostHog would otherwise attach that carries the address of
- * this page.
- *
- * The address is `http://127.0.0.1:<port>/?token=<uuid>`, and that token is
- * the whole of the server's authentication. It must not travel, and "the
- * analytics vendor is trustworthy" is not the argument to rely on — a property
- * that is never collected cannot be leaked by anyone's later mistake.
- *
- * The `$session_entry_` family is easy to miss and was: it is filled in once
- * when a session starts and then rides along on every event afterwards, so
- * denying `$current_url` alone still sent the URL — with the token in it — on
- * all of them. Anything added to this list wants checking against a real
- * payload rather than against the documentation.
- */
-const URL_PROPERTIES = [
-    "$current_url",
-    "$pathname",
-    "$host",
-    "$referrer",
-    "$referring_domain",
-    "$initial_current_url",
-    "$initial_pathname",
-    "$initial_host",
-    "$initial_referrer",
-    "$initial_referring_domain",
-    "$session_entry_url",
-    "$session_entry_host",
-    "$session_entry_pathname",
-    "$session_entry_referrer",
-    "$session_entry_referring_domain",
-];
-const OPTIONS = {
-    api_host: HOST,
-    // Autocapture records clicks by the element they landed on, including the
-    // text of the button. In this page that text is session titles, file names
-    // and model ids the user typed. Named events only.
-    autocapture: false,
-    capture_pageview: false,
-    capture_pageleave: false,
-    rageclick: false,
-    disable_session_recording: true,
-    disable_surveys: true,
-    // Nothing here reads a flag or shows a survey, so PostHog never needs to
-    // fetch a second script — and with this set it cannot. A page that can be
-    // reached with the token is not a page to leave an open script channel in.
-    disable_external_dependency_loading: true,
-    advanced_disable_feature_flags: true,
-    // Counting installs, not people: no profile is created, and the identifier
-    // is a random id in this browser's local storage that is never joined to
-    // anything. Nothing in the app calls `identify`.
-    person_profiles: "never",
-    persistence: "localStorage",
-    property_denylist: URL_PROPERTIES,
-    // Someone who has asked their browser not to be tracked has answered this
-    // question already.
-    respect_dnt: true,
-};
+const KEY = process.env["OHARNESS_POSTHOG_KEY"] ?? "";
+/** US cloud unless told otherwise. EU is https://eu.i.posthog.com. */
+const HOST = (process.env["OHARNESS_POSTHOG_HOST"] ?? "https://us.i.posthog.com").replace(/\/+$/, "");
+/** Set by the desktop shell from the app bundle; a checkout reports "dev". */
+const VERSION = process.env["OHARNESS_APP_VERSION"] ?? "dev";
+/** Which frontend is serving: the desktop shell says so, anything else is the browser one. */
+const SHELL = process.env["OHARNESS_SHELL"] ?? "web";
+/** What `GET /analytics` and `POST /analytics` answer. */
+export async function analyticsState() {
+    const available = KEY !== "";
+    return { enabled: available && (await consented()), available };
+}
+let consent;
+async function consented() {
+    consent ??= (await readPrefs()).analytics === true;
+    return consent;
+}
+/** Called after Settings writes the pref, so the next event sees it. */
+export function setConsent(value) {
+    consent = value;
+}
+const FILE = () => userPath("telemetry.json");
+let identity;
+function loadIdentity() {
+    identity ??= (async () => {
+        try {
+            const parsed = parseJson(await readFile(FILE(), "utf8"));
+            if (parsed.ok && typeof parsed.value?.installId === "string" && parsed.value.installId) {
+                return parsed.value;
+            }
+        }
+        catch {
+            // No file yet: this is the first run of an official build.
+        }
+        const created = { installId: randomUUID() };
+        await save(created);
+        // A user directory that already has prefs in it is a copy that was here
+        // before counting existed, updating into it — not a new install.
+        capture("app_installed", { existing: await exists(userPath("prefs.json")) }, created.installId);
+        return created;
+    })();
+    return identity;
+}
+let writing = Promise.resolve();
+function save(telemetry) {
+    writing = writing.then(async () => {
+        try {
+            await mkdir(path.dirname(FILE()), { recursive: true });
+            await writeFile(FILE(), JSON.stringify(telemetry, null, 2) + "\n");
+        }
+        catch {
+            // A read-only home directory costs the count, never the app.
+        }
+    });
+    return writing;
+}
+async function exists(file) {
+    try {
+        await access(file);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+const today = () => new Date().toISOString().slice(0, 10);
+// --- counting ---------------------------------------------------------------
+/** Once a day the app runs. Safe to call as often as convenient. */
+export async function heartbeat() {
+    if (!KEY)
+        return;
+    const telemetry = await loadIdentity();
+    const day = today();
+    if (telemetry.pinged === day)
+        return;
+    telemetry.pinged = day;
+    await save(telemetry);
+    capture("daily_ping", {}, telemetry.installId);
+}
+/** Once a day the app is used — a prompt sent, not merely a window left open. */
+export async function markUsed() {
+    if (!KEY)
+        return;
+    const telemetry = await loadIdentity();
+    const day = today();
+    if (telemetry.used === day)
+        return;
+    telemetry.used = day;
+    await save(telemetry);
+    capture("daily_used", {}, telemetry.installId);
+}
+/** Hourly, so a window left open across midnight still counts the new day. */
+export function startHeartbeat() {
+    if (!KEY)
+        return () => { };
+    void heartbeat();
+    const timer = setInterval(() => void heartbeat(), 60 * 60 * 1000);
+    timer.unref?.();
+    return () => clearInterval(timer);
+}
+// --- usage ------------------------------------------------------------------
+const EVENT = /^[a-z][a-z_]{0,39}$/;
+const PROPERTY = /^[a-z][a-z_]{0,31}$/;
 /**
- * What `GET /analytics` answers.
+ * What the page may send, reduced to what it is allowed to send.
  *
- * `available` is reported separately so Settings can say "this build carries
- * no analytics" rather than showing a switch that would do nothing — a control
- * that silently does nothing is worse than no control.
+ * The page's calls already pass only enumerable values, and this is the check
+ * that keeps it so: an event name, at most ten properties, each a boolean, a
+ * number or a short string. Anything that could be text someone typed — a long
+ * string, one carrying the page's token — is dropped here rather than trusted.
  */
-export async function analyticsState() {
-    const available = KEY !== "" || DATAFAST_ID !== "";
-    const consented = (await readPrefs()).analytics === true;
-    if (!available || !consented)
-        return { enabled: false, available };
-    // Each vendor is reported only if this build carries it. A build with one
-    // and not the other is not a broken build — it is what a fork gets, and what
-    // an official build gets if only one id made it into the packaging step.
-    const state = { enabled: true, available };
-    if (KEY !== "") {
-        state.key = KEY;
-        state.host = HOST;
-        state.options = OPTIONS;
+export function cleanEvent(body) {
+    const event = body["event"];
+    if (typeof event !== "string" || !EVENT.test(event))
+        return null;
+    const props = {};
+    const raw = body["props"];
+    if (raw && typeof raw === "object" && !Array.isArray(raw)) {
+        for (const [key, value] of Object.entries(raw).slice(0, 10)) {
+            if (!PROPERTY.test(key))
+                continue;
+            if (typeof value === "boolean" || (typeof value === "number" && Number.isFinite(value))) {
+                props[key] = value;
+            }
+            else if (typeof value === "string" && value.length <= 80 && !value.includes("token=")) {
+                props[key] = value;
+            }
+        }
+    }
+    return { event, props };
+}
+/** A usage event. Dropped unless this build has a key and the user opted in. */
+export async function track(event, props = {}) {
+    if (!KEY || !(await consented()))
+        return;
+    const telemetry = await loadIdentity();
+    capture(event, props, telemetry.installId);
+}
+// --- sending ----------------------------------------------------------------
+const queue = [];
+let flushTimer;
+function capture(event, props, distinctId) {
+    // Bounded: a machine that is offline all week must not grow this all week.
+    if (queue.length >= 500)
+        return;
+    queue.push({
+        event,
+        timestamp: new Date().toISOString(),
+        properties: {
+            ...props,
+            distinct_id: distinctId,
+            app_version: VERSION,
+            platform: process.platform,
+            arch: process.arch,
+            shell: SHELL,
+            $lib: "oharness-app",
+            // Counting installs, not people: no profile is ever created.
+            $process_person_profile: false,
+        },
+    });
+    flushTimer ??= setTimeout(() => void flushAnalytics(), 10_000);
+    flushTimer.unref?.();
+}
+/** Send what is queued. Called on a timer, and on close so a quit loses nothing. */
+export async function flushAnalytics() {
+    if (flushTimer)
+        clearTimeout(flushTimer);
+    flushTimer = undefined;
+    if (!KEY || !queue.length)
+        return;
+    const batch = queue.splice(0);
+    try {
+        await fetch(`${HOST}/batch/`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ api_key: KEY, batch }),
+            signal: AbortSignal.timeout(5000),
+        });
     }
-    if (DATAFAST_ID !== "") {
-        state.datafast = { id: DATAFAST_ID, domain: DATAFAST_DOMAIN, src: DATAFAST_SRC };
+    catch {
+        // Offline, blocked, or PostHog is down. Analytics are never something a
+        // person notices while trying to work, so there is no retry and no error.
     }
-    return state;
 }
+// --- the page's half ----------------------------------------------------------
 /**
  * The queue, for the document head.
  *
  * Boot fires events before anything could have decided whether to send them,
- * so they wait here. Nothing in this stub touches the network: it exists only
- * so that `track()` reads the same whether analytics end up on or off, and so
- * that no caller has to remember which branch it is writing in.
+ * so they wait here. Nothing in this stub touches the network.
  */
 export const ANALYTICS_STUB = `<script>
 window.__ANALYTICS_QUEUE = [];
 window.__TRACK = function (event, props) {
-  // Bounded: a queue nothing will ever drain is a leak in a page left open all
-  // day, and the events worth having are the early ones anyway.
   if (window.__ANALYTICS_QUEUE.length < 100) window.__ANALYTICS_QUEUE.push([event, props]);
 };
 </script>`;
 /**
- * What a build carrying neither vendor ships instead of the loader.
+ * Hands events to this server, and only once it has said they are wanted.
  *
- * Not the loader with a disabled flag: a page that cannot report anywhere
- * should not carry the code for reporting, and `PAGE` should not so much as
- * contain either vendor's name. The suite asserts exactly that, which is how a
- * later change that quietly starts shipping the loader to everyone gets
- * caught. It still drains the queue, because `track()` calls are unconditional
- * and a queue nobody empties grows all day.
+ * No vendor code and no vendor address: the page talks to its own origin and
+ * nothing else, which is the rule page.ts states for everything in it. A build
+ * without a key does not even ship the forwarding, only the drain.
  */
-const NO_ANALYTICS_CLIENT = String.raw `
+export const ANALYTICS_CLIENT = KEY === "" ? String.raw `
 function startAnalytics() {
   window.__TRACK = function () {};
   window.__ANALYTICS_QUEUE = [];
 }
-`;
-/**
- * The DataFast tag, or a no-op where this build carries no id.
- *
- * Two conditions, and the second is the load-bearing one. `config.datafast`
- * says this build carries an id and the user has consented; the `href` check
- * says this page's address has no token in it. See the comment on
- * `DATAFAST_ID` for why the second cannot be relaxed — the script reads
- * `location.href` and offers nothing to filter it with.
- *
- * Checked against the live `href` rather than against which shell this is, so
- * that a regression in the token scrub turns this off rather than turning it
- * into a leak. It is the last gate before a third party sees the address, and
- * the only one that cannot be wrong about what the address contains.
- *
- * `data-allow-localhost` because the page is served from 127.0.0.1 and the
- * script drops every event from a loopback host unless told not to. That flag
- * is the only reason this reports at all, and it is also the reason the check
- * above has to hold.
- */
-const DATAFAST_CLIENT = DATAFAST_ID === "" ? String.raw `
-function startDataFast() {}
-` : String.raw `
-function startDataFast(config) {
-  if (!config.datafast) return;
-  if (location.href.indexOf("token=") !== -1) return;
-  try {
-    const script = document.createElement("script");
-    script.src = config.datafast.src;
-    script.defer = true;
-    script.setAttribute("data-website-id", config.datafast.id);
-    script.setAttribute("data-domain", config.datafast.domain);
-    script.setAttribute("data-allow-localhost", "true");
-    document.head.appendChild(script);
-  } catch (err) {
-    // Analytics that fail must never be something a person notices while
-    // trying to work. There is nothing to retry and nothing to report.
-  }
-}
-`;
-/**
- * PostHog, or a no-op where this build carries no key.
- *
- * `array.js` loaded on its own rather than PostHog's inlined snippet: the
- * snippet is a minified blob whose job is to queue calls made before the
- * library arrives, and this does that job in code that can be read — which is
- * the bar for anything that runs in this page.
- *
- * This is the half that drains the queue in every branch, because `track()` is
- * PostHog's alone — DataFast counts launches and has no named events to send.
- *
- * A failure at any point is silence. Analytics that cannot reach their server
- * must never be something a person notices while trying to work.
- */
-const POSTHOG_CLIENT = KEY === "" ? String.raw `
-function startPostHog() {
-  window.__TRACK = function () {};
-  window.__ANALYTICS_QUEUE = [];
-}
 ` : String.raw `
-function startPostHog(config) {
-  if (!config.key) {
-    window.__TRACK = function () {};
-    window.__ANALYTICS_QUEUE = [];
-    return;
-  }
-
-  const script = document.createElement("script");
-  script.src = config.host + "/static/array.js";
-  script.async = true;
-  script.onload = function () {
-    try {
-      window.posthog.init(config.key, Object.assign({}, config.options, {
-        // The denylist names the properties known to carry this page's address
-        // today. This catches the ones a future version of the library adds:
-        // whatever the property is called, if its value contains the token
-        // then it is the URL, and it does not leave.
-        before_send: function (event) {
-          const props = event && event.properties;
-          for (const key in props) {
-            if (typeof props[key] === "string" && props[key].indexOf("token=") !== -1) {
-              delete props[key];
-            }
-          }
-          return event;
-        },
-      }));
-      window.__TRACK = function (event, props) { window.posthog.capture(event, props); };
-      for (const queued of window.__ANALYTICS_QUEUE) window.__TRACK(queued[0], queued[1]);
-    } catch (err) {
-      window.__TRACK = function () {};
-    }
-    window.__ANALYTICS_QUEUE = [];
-  };
-  script.onerror = function () {
-    window.__TRACK = function () {};
-    window.__ANALYTICS_QUEUE = [];
-  };
-  document.head.appendChild(script);
-}
-`;
-/**
- * The loader, appended to the client script where the token already exists.
- *
- * One request to `/analytics` answers for both vendors, and one consent
- * decides both — so a person who has not opted in has neither vendor's key in
- * their page source, which is the property that made the key server-served in
- * the first place.
- */
-export const ANALYTICS_CLIENT = KEY === "" && DATAFAST_ID === "" ? NO_ANALYTICS_CLIENT : String.raw `
-${DATAFAST_CLIENT}
-${POSTHOG_CLIENT}
 async function startAnalytics() {
   const config = await getJson("/analytics");
+  const queued = window.__ANALYTICS_QUEUE || [];
+  window.__ANALYTICS_QUEUE = [];
   if (!config || config.error || !config.enabled) {
-    // Off, or this build carries nothing. Drop the queue rather than hold it:
-    // the answer will not change without a reload.
     window.__TRACK = function () {};
-    window.__ANALYTICS_QUEUE = [];
     return;
   }
-  startDataFast(config);
-  startPostHog(config);
+  window.__TRACK = function (event, props) {
+    void api("/track", { event: event, props: props || {} });
+  };
+  for (const entry of queued) window.__TRACK(entry[0], entry[1]);
 }
 `;
 //# sourceMappingURL=analytics.js.map