@optiqstudio/track 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DaveLabs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,84 @@
-# Temporary Holding Version
+# @optiqstudio/track
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Join every lead, sale and deposit to the video, post or advert that brought it, for
+[Optiq Studio Enterprise](https://enterprise.optiq.studio). For browsers and servers, with types.
+
+```sh
+npm install @optiqstudio/track
+```
+
+Your keys are on the Developer page in Enterprise. Full docs: https://enterprise.optiq.studio/developers
+
+## In the browser
+
+```ts
+import { init, track, identify, consent } from "@optiqstudio/track";
+
+init({ key: "pk_your_publishable_key" }); // page views, form starts and contacts by itself
+
+track("purchase", { value: 1500, currency: "GMD" });
+identify({ email: "ama@example.gm" });    // hashed in the browser; never sent as written
+consent("denied");                         // nothing that tells one person from another is kept
+```
+
+The publishable key works only from your own domains. `init` does nothing during a server render.
+
+Sent by itself:
+
+- page views, including single-page moves;
+- form starts;
+- leads from forms marked `data-optiq="lead"`;
+- presses on WhatsApp, call and email links.
+
+`init({ key, auto: false })` turns these off. Call `page()` yourself when they are off.
+
+### React and Next.js
+
+```tsx
+"use client";
+import { useEffect } from "react";
+import { init } from "@optiqstudio/track";
+
+export default function Optiq() {
+  useEffect(() => {
+    init({ key: process.env.NEXT_PUBLIC_OPTIQ_KEY! });
+  }, []);
+  return null;
+}
+```
+
+## From your server
+
+```ts
+import { Optiq } from "@optiqstudio/track/server";
+
+const optiq = new Optiq({ secretKey: process.env.OPTIQ_SECRET_KEY! });
+
+await optiq.track({ name: "first_deposit", event_id: "dep_1042", email: "ama@example.gm", value: 500, currency: "GMD" });
+await optiq.forget({ email: "ama@example.gm" });
+```
+
+This runs on Node 20 or later, Deno, Bun and edge runtimes.
+
+- **Hashing:** emails and phones are hashed with SHA-256 before they leave your server.
+- **Repeats:** each `event_id` counts once, so a retry is safe.
+- **Batching:** any number of events go 500 at a time.
+- **Retries:** busy answers are tried again.
+
+## The script tag
+
+The same code serves sites without a build step:
+
+```html
+<script async src="https://enterprise.optiq.studio/t.js" data-key="pk_your_publishable_key"></script>
+<script>optiq("track", "purchase", { value: 1500, currency: "GMD" });</script>
+```
+
+## What is kept
+
+- **No IP addresses.**
+- **People only as hashes:** a person is kept only as a SHA-256 hash of their email or phone.
+- **No pooling:** a company's events are its own, never pooled with another company's and never sold.
+- **Consent denied:** there is no visitor id, person or click id. Pages are still counted.
+
+MIT © DaveLabs

package/dist/browser.d.ts

@@ -0,0 +1,74 @@
+import { hashPerson } from "./hash";
+export { hashPerson };
+export type Consent = "granted" | "denied" | "unknown";
+export interface InitOptions {
+    /** The source's publishable key (Developer page). It works only from the source's own domains. */
+    key: string;
+    /** Page views on load and on every move of a single-page site, form starts, leads and contacts. Default true. */
+    auto?: boolean;
+    /** Where events go. Default: the Optiq Studio Enterprise collector. */
+    endpoint?: string;
+    /** The visitor's choice, if the site already knows it. */
+    consent?: Consent;
+}
+export interface Properties {
+    /** A sale's or deposit's amount. */
+    value?: number;
+    /** Three letters: GMD, USD, EUR, ... */
+    currency?: string;
+    /** Hashed in the browser before anything is sent. */
+    email?: string;
+    /** Hashed in the browser before anything is sent (digits only). */
+    phone?: string | number;
+    [property: string]: string | number | boolean | undefined;
+}
+export declare const COLLECTOR = "https://optiq-collect-951694748196.europe-west2.run.app/e";
+/** One tracker on one page. Most sites use the module functions below, which share one. */
+export declare class Tracker {
+    private key;
+    private endpoint;
+    private consentState;
+    private touch;
+    private utm;
+    private clicks;
+    private visit;
+    private person;
+    private queue;
+    private timer;
+    private lastPath;
+    private wired;
+    constructor(o: InitOptions);
+    private visitor;
+    private context;
+    /** Sends what waits now (it also goes by itself within half a second, and when the page is hidden). */
+    flush(): void;
+    /** Something a visitor did: a standard name (lead, sign_up, purchase, first_deposit, ...) or one of your own. */
+    track(name: string, props?: Properties): void;
+    /** Who the visitor is, from now on: their email or phone, hashed here. */
+    identify(p: {
+        email?: string;
+        phone?: string | number;
+    }): void;
+    /** The visitor's choice. Denied: no visitor id, person, click ids or stored visit; pages are still counted. */
+    consent(state: Consent): void;
+    /** A page view (called by itself in auto mode, on load and on every move of a single-page site). */
+    page(): void;
+    private wire;
+}
+/** Which kind of contact a link begins, or null: tel: is a call, mailto: with an address an email, wa.me with a number WhatsApp. */
+export declare function contactChannel(href: string): "call" | "email" | "whatsapp" | null;
+/** Starts tracking on this page (once; later calls are ignored). In a server render it does nothing. */
+export declare function init(o: InitOptions): Tracker | null;
+/** Something a visitor did. Calls made before init() wait for it. */
+export declare const track: (name: string, props?: Properties) => void;
+/** Who the visitor is: their email or phone, hashed in the browser. */
+export declare const identify: (p: {
+    email?: string;
+    phone?: string | number;
+}) => void;
+/** The visitor's choice: "granted", "denied" or "unknown". */
+export declare const consent: (state: Consent) => void;
+/** A page view by hand (auto mode sends them by itself). */
+export declare const page: () => void;
+/** Sends what waits now. */
+export declare const flush: () => void;

package/dist/hash.d.ts

@@ -0,0 +1,7 @@
+/** SHA-256 in hex, by Web Crypto (browsers, Node 20+, Deno, Bun, edge runtimes); null where it is missing. */
+export declare function sha256(s: string): Promise<string | null>;
+/** An email (trimmed, lower-case) or a phone (digits only), as a SHA-256: the only way a person is ever sent. */
+export declare function hashPerson(p: {
+    email?: unknown;
+    phone?: unknown;
+} | null | undefined): Promise<string | null>;

package/dist/index.cjs

@@ -0,0 +1,328 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  COLLECTOR: () => COLLECTOR,
+  Tracker: () => Tracker,
+  consent: () => consent,
+  contactChannel: () => contactChannel,
+  flush: () => flush,
+  hashPerson: () => hashPerson,
+  identify: () => identify,
+  init: () => init,
+  page: () => page,
+  track: () => track
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/hash.ts
+function sha256(s) {
+  const c = typeof globalThis !== "undefined" ? globalThis.crypto : void 0;
+  if (!c || !c.subtle || typeof TextEncoder === "undefined") return Promise.resolve(null);
+  return c.subtle.digest("SHA-256", new TextEncoder().encode(s)).then(
+    (buf) => Array.from(new Uint8Array(buf), (b) => b.toString(16).padStart(2, "0")).join(""),
+    () => null
+  );
+}
+function hashPerson(p) {
+  if (p && typeof p.email === "string" && p.email.indexOf("@") > 0) return sha256(p.email.trim().toLowerCase());
+  if (p && (typeof p.phone === "string" || typeof p.phone === "number")) {
+    const digits = String(p.phone).replace(/[^0-9]/g, "");
+    if (digits.length >= 7) return sha256(digits);
+  }
+  return Promise.resolve(null);
+}
+
+// src/browser.ts
+var COLLECTOR = "https://optiq-collect-951694748196.europe-west2.run.app/e";
+var DAY = 864e5;
+var IDLE = 30 * 6e4;
+var hasWindow = () => typeof window !== "undefined" && typeof document !== "undefined";
+function get(k) {
+  try {
+    return window.localStorage.getItem(`optiq_${k}`);
+  } catch {
+    return null;
+  }
+}
+function put(k, v) {
+  try {
+    if (v === null) window.localStorage.removeItem(`optiq_${k}`);
+    else window.localStorage.setItem(`optiq_${k}`, v);
+  } catch {
+  }
+}
+function json(k) {
+  try {
+    return JSON.parse(get(k) || "{}") || {};
+  } catch {
+    return {};
+  }
+}
+function rid(n) {
+  const abc = "abcdefghijklmnopqrstuvwxyz0123456789";
+  const a = new Uint8Array(n);
+  if (typeof crypto !== "undefined" && crypto.getRandomValues) crypto.getRandomValues(a);
+  let out = "";
+  for (let i = 0; i < n; i++) out += abc.charAt((a[i] || Math.floor(Math.random() * 256)) % 36);
+  return out;
+}
+var Tracker = class {
+  constructor(o) {
+    this.queue = [];
+    this.timer = null;
+    this.lastPath = null;
+    this.wired = false;
+    this.key = o.key;
+    this.endpoint = o.endpoint || COLLECTOR;
+    this.consentState = o.consent || get("consent") || "unknown";
+    const q = new URLSearchParams(window.location.search);
+    const now = Date.now();
+    this.touch = json("touch");
+    const osr = q.get("osr");
+    if (osr && /^[A-Za-z0-9]{4,16}$/.test(osr)) {
+      const at = new Date(now).toISOString();
+      if (!this.touch.first || now - Date.parse(this.touch.first.at) > 90 * DAY) this.touch.first = { ref: osr, at };
+      this.touch.last = { ref: osr, at };
+      put("touch", JSON.stringify(this.touch));
+    }
+    const urlUtm = {};
+    for (const k of ["source", "medium", "campaign", "content", "term"]) {
+      const v = q.get(`utm_${k}`);
+      if (v) urlUtm[k] = v.slice(0, 200);
+    }
+    if (Object.keys(urlUtm).length) put("utm", JSON.stringify(urlUtm));
+    this.utm = Object.keys(urlUtm).length ? urlUtm : json("utm");
+    const urlClicks = {};
+    for (const k of ["gclid", "fbclid", "ttclid", "wbraid", "gbraid"]) {
+      const v = q.get(k);
+      if (v) urlClicks[k] = v.slice(0, 500);
+    }
+    if (Object.keys(urlClicks).length) put("clicks", JSON.stringify(urlClicks));
+    this.clicks = Object.keys(urlClicks).length ? urlClicks : json("clicks");
+    const kept = this.consentState === "denied" ? {} : json("visit");
+    const arrivedWith = `${q.get("utm_campaign") || ""}|${osr || ""}`;
+    this.visit = kept.id && now - (kept.last || 0) <= IDLE && (arrivedWith === "|" || arrivedWith === kept.from) ? kept : {
+      id: rid(20),
+      started: new Date(now).toISOString(),
+      from: arrivedWith,
+      landing: window.location.pathname,
+      referrer: document.referrer ? document.referrer.split("?")[0].slice(0, 300) : null,
+      utm: urlUtm,
+      click: q.get("gclid") ? "gclid" : q.get("fbclid") ? "fbclid" : q.get("ttclid") ? "ttclid" : null,
+      ref: osr && /^[A-Za-z0-9]{4,16}$/.test(osr) ? osr : null
+    };
+    this.person = get("ph");
+    if (o.auto !== false) this.wire();
+  }
+  visitor() {
+    if (this.consentState === "denied") return null;
+    let v = get("vid");
+    if (!v) {
+      v = rid(20);
+      put("vid", v);
+    }
+    return v;
+  }
+  context() {
+    let tz = null;
+    try {
+      tz = Intl.DateTimeFormat().resolvedOptions().timeZone || null;
+    } catch {
+      tz = null;
+    }
+    const v = this.visit;
+    return {
+      id: v.id,
+      started_at: v.started,
+      landing: v.landing,
+      referrer: v.referrer,
+      utm: v.utm,
+      click: v.click,
+      ref: v.ref,
+      lang: (navigator.language || "").slice(0, 20) || null,
+      tz,
+      screen: window.screen ? `${window.screen.width}x${window.screen.height}` : null
+    };
+  }
+  /** Sends what waits now (it also goes by itself within half a second, and when the page is hidden). */
+  flush() {
+    if (this.timer) clearTimeout(this.timer);
+    this.timer = null;
+    while (this.queue.length) {
+      const body = JSON.stringify({ key: this.key, visit: this.context(), events: this.queue.splice(0, 50) });
+      let sent = false;
+      try {
+        sent = !!(navigator.sendBeacon && navigator.sendBeacon(this.endpoint, new Blob([body], { type: "text/plain" })));
+      } catch {
+        sent = false;
+      }
+      if (!sent) {
+        try {
+          void fetch(this.endpoint, { method: "POST", body, keepalive: true, mode: "cors", headers: { "Content-Type": "text/plain" } }).catch(() => void 0);
+        } catch {
+        }
+      }
+    }
+  }
+  /** Something a visitor did: a standard name (lead, sign_up, purchase, first_deposit, ...) or one of your own. */
+  track(name, props = {}) {
+    const rest = {};
+    for (const [k, v] of Object.entries(props)) if (!["value", "currency", "email", "phone"].includes(k) && v !== void 0) rest[k] = v;
+    const fresh = Date.now();
+    this.visit.last = fresh;
+    if (this.consentState !== "denied") put("visit", JSON.stringify(this.visit));
+    const last = this.touch.last && fresh - Date.parse(this.touch.last.at) <= 7 * DAY ? this.touch.last : null;
+    const denied = this.consentState === "denied";
+    const ev = {
+      event_id: rid(18),
+      name: String(name || "").toLowerCase(),
+      occurred_at: new Date(fresh).toISOString(),
+      visitor_id: this.visitor(),
+      page_url: window.location.origin + window.location.pathname,
+      referrer: document.referrer ? document.referrer.split("?")[0].slice(0, 300) : null,
+      utm: this.utm,
+      click_ids: denied ? {} : this.clicks,
+      first_ref: this.touch.first ? this.touch.first.ref : null,
+      first_ref_at: this.touch.first ? this.touch.first.at : null,
+      last_ref: last ? last.ref : null,
+      last_ref_at: last ? last.at : null,
+      value: props.value === void 0 ? null : Number(props.value),
+      currency: props.currency || null,
+      properties: rest,
+      consent: this.consentState
+    };
+    void hashPerson(denied ? null : props).then((h) => {
+      if (h) {
+        this.person = h;
+        put("ph", h);
+      }
+      ev.person_hash = denied ? null : this.person;
+      this.queue.push(ev);
+      if (!this.timer) this.timer = setTimeout(() => this.flush(), 400);
+    });
+  }
+  /** Who the visitor is, from now on: their email or phone, hashed here. */
+  identify(p) {
+    void hashPerson(p).then((h) => {
+      if (h && this.consentState !== "denied") {
+        this.person = h;
+        put("ph", h);
+      }
+    });
+  }
+  /** The visitor's choice. Denied: no visitor id, person, click ids or stored visit; pages are still counted. */
+  consent(state) {
+    this.consentState = state === "granted" || state === "denied" ? state : "unknown";
+    put("consent", this.consentState);
+    if (this.consentState === "denied") {
+      for (const k of ["vid", "ph", "clicks", "visit"]) put(k, null);
+      this.person = null;
+      this.clicks = {};
+    }
+  }
+  /** A page view (called by itself in auto mode, on load and on every move of a single-page site). */
+  page() {
+    const path = window.location.pathname + window.location.search;
+    if (path === this.lastPath) return;
+    this.lastPath = path;
+    this.track("page_view");
+  }
+  wire() {
+    if (this.wired) return;
+    this.wired = true;
+    this.page();
+    for (const m of ["pushState", "replaceState"]) {
+      const orig = history[m];
+      if (typeof orig !== "function") continue;
+      history[m] = function(...args) {
+        const r = orig.apply(this, args);
+        setTimeout(() => tracker?.page(), 0);
+        return r;
+      };
+    }
+    window.addEventListener("popstate", () => this.page());
+    const begun = typeof WeakSet === "function" ? /* @__PURE__ */ new WeakSet() : null;
+    document.addEventListener("focusin", (e) => {
+      const form = e.target?.closest?.("form");
+      if (!form || !begun || begun.has(form)) return;
+      begun.add(form);
+      this.track("form_start", { form: (form.getAttribute("name") || form.id || "").slice(0, 60) || void 0 });
+    });
+    document.addEventListener("submit", (e) => {
+      const form = e.target;
+      if (!form || !form.getAttribute || form.getAttribute("data-optiq") !== "lead") return;
+      const email = form.querySelector('input[type="email"]');
+      const phone = form.querySelector('input[type="tel"]');
+      this.track("lead", {
+        form: (form.getAttribute("name") || form.id || "").slice(0, 60) || void 0,
+        email: email ? email.value : void 0,
+        phone: phone ? phone.value : void 0
+      });
+      this.flush();
+    });
+    document.addEventListener(
+      "click",
+      (e) => {
+        const a = e.target?.closest?.("a[href]");
+        if (!a) return;
+        const channel = contactChannel(a.getAttribute("href") || "");
+        if (!channel) return;
+        this.track("contact", { channel });
+        this.flush();
+      },
+      true
+    );
+    document.addEventListener("visibilitychange", () => {
+      if (document.visibilityState === "hidden") this.flush();
+    });
+    window.addEventListener("pagehide", () => this.flush());
+  }
+};
+function contactChannel(href) {
+  if (/^tel:/i.test(href)) return "call";
+  if (/^mailto:[^?]/i.test(href)) return "email";
+  if (/^https?:\/\/(wa\.me\/\+?[0-9]|api\.whatsapp\.com\/send\/?\?(.*&)?phone=)/i.test(href)) return "whatsapp";
+  return null;
+}
+var tracker = null;
+var waiting = [];
+function init(o) {
+  if (!hasWindow()) return null;
+  if (tracker) return tracker;
+  if (!o || typeof o.key !== "string" || !/^pk_[A-Za-z0-9]{20,40}$/.test(o.key)) {
+    console.warn("[optiq] init needs the source's publishable key (pk_...), from the Developer page.");
+    return null;
+  }
+  tracker = new Tracker(o);
+  waiting.splice(0).forEach((run) => run());
+  return tracker;
+}
+var later = (run) => {
+  if (!hasWindow()) return;
+  if (tracker) run(tracker);
+  else waiting.push(() => tracker && run(tracker));
+};
+var track = (name, props) => later((t) => t.track(name, props));
+var identify = (p) => later((t) => t.identify(p));
+var consent = (state) => later((t) => t.consent(state));
+var page = () => later((t) => t.page());
+var flush = () => later((t) => t.flush());

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export { COLLECTOR, Tracker, consent, contactChannel, flush, hashPerson, identify, init, page, track } from "./browser";
+export type { Consent, InitOptions, Properties } from "./browser";

package/dist/index.js

@@ -0,0 +1,305 @@
+// src/hash.ts
+function sha256(s) {
+  const c = typeof globalThis !== "undefined" ? globalThis.crypto : void 0;
+  if (!c || !c.subtle || typeof TextEncoder === "undefined") return Promise.resolve(null);
+  return c.subtle.digest("SHA-256", new TextEncoder().encode(s)).then(
+    (buf) => Array.from(new Uint8Array(buf), (b) => b.toString(16).padStart(2, "0")).join(""),
+    () => null
+  );
+}
+function hashPerson(p) {
+  if (p && typeof p.email === "string" && p.email.indexOf("@") > 0) return sha256(p.email.trim().toLowerCase());
+  if (p && (typeof p.phone === "string" || typeof p.phone === "number")) {
+    const digits = String(p.phone).replace(/[^0-9]/g, "");
+    if (digits.length >= 7) return sha256(digits);
+  }
+  return Promise.resolve(null);
+}
+
+// src/browser.ts
+var COLLECTOR = "https://optiq-collect-951694748196.europe-west2.run.app/e";
+var DAY = 864e5;
+var IDLE = 30 * 6e4;
+var hasWindow = () => typeof window !== "undefined" && typeof document !== "undefined";
+function get(k) {
+  try {
+    return window.localStorage.getItem(`optiq_${k}`);
+  } catch {
+    return null;
+  }
+}
+function put(k, v) {
+  try {
+    if (v === null) window.localStorage.removeItem(`optiq_${k}`);
+    else window.localStorage.setItem(`optiq_${k}`, v);
+  } catch {
+  }
+}
+function json(k) {
+  try {
+    return JSON.parse(get(k) || "{}") || {};
+  } catch {
+    return {};
+  }
+}
+function rid(n) {
+  const abc = "abcdefghijklmnopqrstuvwxyz0123456789";
+  const a = new Uint8Array(n);
+  if (typeof crypto !== "undefined" && crypto.getRandomValues) crypto.getRandomValues(a);
+  let out = "";
+  for (let i = 0; i < n; i++) out += abc.charAt((a[i] || Math.floor(Math.random() * 256)) % 36);
+  return out;
+}
+var Tracker = class {
+  constructor(o) {
+    this.queue = [];
+    this.timer = null;
+    this.lastPath = null;
+    this.wired = false;
+    this.key = o.key;
+    this.endpoint = o.endpoint || COLLECTOR;
+    this.consentState = o.consent || get("consent") || "unknown";
+    const q = new URLSearchParams(window.location.search);
+    const now = Date.now();
+    this.touch = json("touch");
+    const osr = q.get("osr");
+    if (osr && /^[A-Za-z0-9]{4,16}$/.test(osr)) {
+      const at = new Date(now).toISOString();
+      if (!this.touch.first || now - Date.parse(this.touch.first.at) > 90 * DAY) this.touch.first = { ref: osr, at };
+      this.touch.last = { ref: osr, at };
+      put("touch", JSON.stringify(this.touch));
+    }
+    const urlUtm = {};
+    for (const k of ["source", "medium", "campaign", "content", "term"]) {
+      const v = q.get(`utm_${k}`);
+      if (v) urlUtm[k] = v.slice(0, 200);
+    }
+    if (Object.keys(urlUtm).length) put("utm", JSON.stringify(urlUtm));
+    this.utm = Object.keys(urlUtm).length ? urlUtm : json("utm");
+    const urlClicks = {};
+    for (const k of ["gclid", "fbclid", "ttclid", "wbraid", "gbraid"]) {
+      const v = q.get(k);
+      if (v) urlClicks[k] = v.slice(0, 500);
+    }
+    if (Object.keys(urlClicks).length) put("clicks", JSON.stringify(urlClicks));
+    this.clicks = Object.keys(urlClicks).length ? urlClicks : json("clicks");
+    const kept = this.consentState === "denied" ? {} : json("visit");
+    const arrivedWith = `${q.get("utm_campaign") || ""}|${osr || ""}`;
+    this.visit = kept.id && now - (kept.last || 0) <= IDLE && (arrivedWith === "|" || arrivedWith === kept.from) ? kept : {
+      id: rid(20),
+      started: new Date(now).toISOString(),
+      from: arrivedWith,
+      landing: window.location.pathname,
+      referrer: document.referrer ? document.referrer.split("?")[0].slice(0, 300) : null,
+      utm: urlUtm,
+      click: q.get("gclid") ? "gclid" : q.get("fbclid") ? "fbclid" : q.get("ttclid") ? "ttclid" : null,
+      ref: osr && /^[A-Za-z0-9]{4,16}$/.test(osr) ? osr : null
+    };
+    this.person = get("ph");
+    if (o.auto !== false) this.wire();
+  }
+  visitor() {
+    if (this.consentState === "denied") return null;
+    let v = get("vid");
+    if (!v) {
+      v = rid(20);
+      put("vid", v);
+    }
+    return v;
+  }
+  context() {
+    let tz = null;
+    try {
+      tz = Intl.DateTimeFormat().resolvedOptions().timeZone || null;
+    } catch {
+      tz = null;
+    }
+    const v = this.visit;
+    return {
+      id: v.id,
+      started_at: v.started,
+      landing: v.landing,
+      referrer: v.referrer,
+      utm: v.utm,
+      click: v.click,
+      ref: v.ref,
+      lang: (navigator.language || "").slice(0, 20) || null,
+      tz,
+      screen: window.screen ? `${window.screen.width}x${window.screen.height}` : null
+    };
+  }
+  /** Sends what waits now (it also goes by itself within half a second, and when the page is hidden). */
+  flush() {
+    if (this.timer) clearTimeout(this.timer);
+    this.timer = null;
+    while (this.queue.length) {
+      const body = JSON.stringify({ key: this.key, visit: this.context(), events: this.queue.splice(0, 50) });
+      let sent = false;
+      try {
+        sent = !!(navigator.sendBeacon && navigator.sendBeacon(this.endpoint, new Blob([body], { type: "text/plain" })));
+      } catch {
+        sent = false;
+      }
+      if (!sent) {
+        try {
+          void fetch(this.endpoint, { method: "POST", body, keepalive: true, mode: "cors", headers: { "Content-Type": "text/plain" } }).catch(() => void 0);
+        } catch {
+        }
+      }
+    }
+  }
+  /** Something a visitor did: a standard name (lead, sign_up, purchase, first_deposit, ...) or one of your own. */
+  track(name, props = {}) {
+    const rest = {};
+    for (const [k, v] of Object.entries(props)) if (!["value", "currency", "email", "phone"].includes(k) && v !== void 0) rest[k] = v;
+    const fresh = Date.now();
+    this.visit.last = fresh;
+    if (this.consentState !== "denied") put("visit", JSON.stringify(this.visit));
+    const last = this.touch.last && fresh - Date.parse(this.touch.last.at) <= 7 * DAY ? this.touch.last : null;
+    const denied = this.consentState === "denied";
+    const ev = {
+      event_id: rid(18),
+      name: String(name || "").toLowerCase(),
+      occurred_at: new Date(fresh).toISOString(),
+      visitor_id: this.visitor(),
+      page_url: window.location.origin + window.location.pathname,
+      referrer: document.referrer ? document.referrer.split("?")[0].slice(0, 300) : null,
+      utm: this.utm,
+      click_ids: denied ? {} : this.clicks,
+      first_ref: this.touch.first ? this.touch.first.ref : null,
+      first_ref_at: this.touch.first ? this.touch.first.at : null,
+      last_ref: last ? last.ref : null,
+      last_ref_at: last ? last.at : null,
+      value: props.value === void 0 ? null : Number(props.value),
+      currency: props.currency || null,
+      properties: rest,
+      consent: this.consentState
+    };
+    void hashPerson(denied ? null : props).then((h) => {
+      if (h) {
+        this.person = h;
+        put("ph", h);
+      }
+      ev.person_hash = denied ? null : this.person;
+      this.queue.push(ev);
+      if (!this.timer) this.timer = setTimeout(() => this.flush(), 400);
+    });
+  }
+  /** Who the visitor is, from now on: their email or phone, hashed here. */
+  identify(p) {
+    void hashPerson(p).then((h) => {
+      if (h && this.consentState !== "denied") {
+        this.person = h;
+        put("ph", h);
+      }
+    });
+  }
+  /** The visitor's choice. Denied: no visitor id, person, click ids or stored visit; pages are still counted. */
+  consent(state) {
+    this.consentState = state === "granted" || state === "denied" ? state : "unknown";
+    put("consent", this.consentState);
+    if (this.consentState === "denied") {
+      for (const k of ["vid", "ph", "clicks", "visit"]) put(k, null);
+      this.person = null;
+      this.clicks = {};
+    }
+  }
+  /** A page view (called by itself in auto mode, on load and on every move of a single-page site). */
+  page() {
+    const path = window.location.pathname + window.location.search;
+    if (path === this.lastPath) return;
+    this.lastPath = path;
+    this.track("page_view");
+  }
+  wire() {
+    if (this.wired) return;
+    this.wired = true;
+    this.page();
+    for (const m of ["pushState", "replaceState"]) {
+      const orig = history[m];
+      if (typeof orig !== "function") continue;
+      history[m] = function(...args) {
+        const r = orig.apply(this, args);
+        setTimeout(() => tracker?.page(), 0);
+        return r;
+      };
+    }
+    window.addEventListener("popstate", () => this.page());
+    const begun = typeof WeakSet === "function" ? /* @__PURE__ */ new WeakSet() : null;
+    document.addEventListener("focusin", (e) => {
+      const form = e.target?.closest?.("form");
+      if (!form || !begun || begun.has(form)) return;
+      begun.add(form);
+      this.track("form_start", { form: (form.getAttribute("name") || form.id || "").slice(0, 60) || void 0 });
+    });
+    document.addEventListener("submit", (e) => {
+      const form = e.target;
+      if (!form || !form.getAttribute || form.getAttribute("data-optiq") !== "lead") return;
+      const email = form.querySelector('input[type="email"]');
+      const phone = form.querySelector('input[type="tel"]');
+      this.track("lead", {
+        form: (form.getAttribute("name") || form.id || "").slice(0, 60) || void 0,
+        email: email ? email.value : void 0,
+        phone: phone ? phone.value : void 0
+      });
+      this.flush();
+    });
+    document.addEventListener(
+      "click",
+      (e) => {
+        const a = e.target?.closest?.("a[href]");
+        if (!a) return;
+        const channel = contactChannel(a.getAttribute("href") || "");
+        if (!channel) return;
+        this.track("contact", { channel });
+        this.flush();
+      },
+      true
+    );
+    document.addEventListener("visibilitychange", () => {
+      if (document.visibilityState === "hidden") this.flush();
+    });
+    window.addEventListener("pagehide", () => this.flush());
+  }
+};
+function contactChannel(href) {
+  if (/^tel:/i.test(href)) return "call";
+  if (/^mailto:[^?]/i.test(href)) return "email";
+  if (/^https?:\/\/(wa\.me\/\+?[0-9]|api\.whatsapp\.com\/send\/?\?(.*&)?phone=)/i.test(href)) return "whatsapp";
+  return null;
+}
+var tracker = null;
+var waiting = [];
+function init(o) {
+  if (!hasWindow()) return null;
+  if (tracker) return tracker;
+  if (!o || typeof o.key !== "string" || !/^pk_[A-Za-z0-9]{20,40}$/.test(o.key)) {
+    console.warn("[optiq] init needs the source's publishable key (pk_...), from the Developer page.");
+    return null;
+  }
+  tracker = new Tracker(o);
+  waiting.splice(0).forEach((run) => run());
+  return tracker;
+}
+var later = (run) => {
+  if (!hasWindow()) return;
+  if (tracker) run(tracker);
+  else waiting.push(() => tracker && run(tracker));
+};
+var track = (name, props) => later((t) => t.track(name, props));
+var identify = (p) => later((t) => t.identify(p));
+var consent = (state) => later((t) => t.consent(state));
+var page = () => later((t) => t.page());
+var flush = () => later((t) => t.flush());
+export {
+  COLLECTOR,
+  Tracker,
+  consent,
+  contactChannel,
+  flush,
+  hashPerson,
+  identify,
+  init,
+  page,
+  track
+};

package/dist/server.cjs

@@ -0,0 +1,123 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/server.ts
+var server_exports = {};
+__export(server_exports, {
+  Optiq: () => Optiq,
+  OptiqError: () => OptiqError
+});
+module.exports = __toCommonJS(server_exports);
+
+// src/hash.ts
+function sha256(s) {
+  const c = typeof globalThis !== "undefined" ? globalThis.crypto : void 0;
+  if (!c || !c.subtle || typeof TextEncoder === "undefined") return Promise.resolve(null);
+  return c.subtle.digest("SHA-256", new TextEncoder().encode(s)).then(
+    (buf) => Array.from(new Uint8Array(buf), (b) => b.toString(16).padStart(2, "0")).join(""),
+    () => null
+  );
+}
+function hashPerson(p) {
+  if (p && typeof p.email === "string" && p.email.indexOf("@") > 0) return sha256(p.email.trim().toLowerCase());
+  if (p && (typeof p.phone === "string" || typeof p.phone === "number")) {
+    const digits = String(p.phone).replace(/[^0-9]/g, "");
+    if (digits.length >= 7) return sha256(digits);
+  }
+  return Promise.resolve(null);
+}
+
+// src/server.ts
+var BATCH = 500;
+function newId() {
+  const abc = "abcdefghijklmnopqrstuvwxyz0123456789";
+  const a = new Uint8Array(20);
+  crypto.getRandomValues(a);
+  return Array.from(a, (b) => abc[b % 36]).join("");
+}
+var OptiqError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "OptiqError";
+  }
+};
+var Optiq = class {
+  constructor(o) {
+    if (!o || typeof o.secretKey !== "string" || !/^sk_[A-Za-z0-9]{30,60}$/.test(o.secretKey)) {
+      throw new Error("Optiq needs the source's secret key (sk_...), from the Developer page.");
+    }
+    this.secretKey = o.secretKey;
+    this.baseUrl = (o.baseUrl || "https://enterprise.optiq.studio").replace(/\/+$/, "");
+    this.retries = Math.max(1, o.retries ?? 3);
+  }
+  async call(method, path, body) {
+    let last = null;
+    for (let attempt = 0; attempt < this.retries; attempt++) {
+      if (attempt) await new Promise((r) => setTimeout(r, 500 * 2 ** (attempt - 1)));
+      try {
+        const r = await fetch(`${this.baseUrl}${path}`, {
+          method,
+          headers: { Authorization: `Bearer ${this.secretKey}`, "Content-Type": "application/json" },
+          body: JSON.stringify(body)
+        });
+        const data = await r.json().catch(() => ({}));
+        if (r.ok) return data;
+        const message = typeof data.error === "string" ? data.error : `Optiq answered ${r.status}.`;
+        if (r.status !== 429 && r.status < 500) throw new OptiqError(message, r.status);
+        last = new OptiqError(message, r.status);
+      } catch (e) {
+        if (e instanceof OptiqError && e.status !== 429 && e.status < 500) throw e;
+        last = e;
+      }
+    }
+    throw last instanceof Error ? last : new Error("Optiq did not answer.");
+  }
+  async prepare(e) {
+    const { email, phone, ...rest } = e;
+    const hash = e.person_hash || await hashPerson({ email, phone });
+    const iso = (v) => v instanceof Date ? v.toISOString() : v;
+    return {
+      ...rest,
+      event_id: e.event_id || newId(),
+      occurred_at: iso(e.occurred_at),
+      last_ref_at: iso(e.last_ref_at),
+      person_hash: hash || void 0
+    };
+  }
+  /** Sends one event or many (any number: they go 500 at a time). Answers what was kept, repeated or refused. */
+  async track(events) {
+    const list = Array.isArray(events) ? events : [events];
+    const out = { accepted: 0, duplicates: 0, rejected: [] };
+    for (let i = 0; i < list.length; i += BATCH) {
+      const part = await Promise.all(list.slice(i, i + BATCH).map((e) => this.prepare(e)));
+      const r = await this.call("POST", "/api/v1/events", { events: part });
+      out.accepted += r.accepted || 0;
+      out.duplicates += r.duplicates || 0;
+      for (const x of r.rejected || []) out.rejected.push({ index: x.index + i, reason: x.reason });
+    }
+    return out;
+  }
+  /** Forgets a customer in your company: every event and visit of theirs. Answers how many events went. */
+  async forget(who) {
+    const hash = who.person_hash || await hashPerson(who);
+    if (!hash && !who.visitor_id) throw new Error("Say who: an email, a phone, a person_hash or a visitor_id.");
+    return await this.call("DELETE", "/api/v1/people", { person_hash: hash || void 0, visitor_id: who.visitor_id });
+  }
+};

package/dist/server.d.ts

@@ -0,0 +1,70 @@
+import type { Consent } from "./browser";
+export interface ServerEvent {
+    /** A standard name (lead, sign_up, purchase, first_deposit, subscribe, app_install, ...) or your own. */
+    name: string;
+    /** Your own id for it (an order or deposit number): a repeat with the same id counts once. */
+    event_id?: string;
+    /** When it happened; up to 90 days ago. Default: now. */
+    occurred_at?: string | Date;
+    /** Who: hashed here before it is sent. */
+    email?: string;
+    /** Who: digits only, hashed here before it is sent. */
+    phone?: string | number;
+    /** Who, if you already hash: SHA-256 of the trimmed, lower-case email, or of the phone's digits. */
+    person_hash?: string;
+    /** The browser's visitor id, if your site passes it to your server (localStorage optiq_vid). */
+    visitor_id?: string;
+    value?: number;
+    currency?: string;
+    properties?: Record<string, string | number | boolean>;
+    consent?: Consent;
+    /** The tracked link that brought them, when you know it better than the browser did. */
+    last_ref?: string;
+    last_ref_at?: string | Date;
+    click_ids?: {
+        gclid?: string;
+        fbclid?: string;
+        ttclid?: string;
+        wbraid?: string;
+        gbraid?: string;
+    };
+}
+export interface TrackResult {
+    accepted: number;
+    duplicates: number;
+    rejected: {
+        index: number;
+        reason: string;
+    }[];
+}
+export interface OptiqOptions {
+    /** The source's secret key (sk_...), from the Developer page. */
+    secretKey: string;
+    /** Default https://enterprise.optiq.studio */
+    baseUrl?: string;
+    /** Tries for a busy or failing answer (429, 5xx, no answer). Default 3. */
+    retries?: number;
+}
+export declare class OptiqError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
+export declare class Optiq {
+    private secretKey;
+    private baseUrl;
+    private retries;
+    constructor(o: OptiqOptions);
+    private call;
+    private prepare;
+    /** Sends one event or many (any number: they go 500 at a time). Answers what was kept, repeated or refused. */
+    track(events: ServerEvent | ServerEvent[]): Promise<TrackResult>;
+    /** Forgets a customer in your company: every event and visit of theirs. Answers how many events went. */
+    forget(who: {
+        email?: string;
+        phone?: string | number;
+        person_hash?: string;
+        visitor_id?: string;
+    }): Promise<{
+        deleted: number;
+    }>;
+}

package/dist/server.js

@@ -0,0 +1,100 @@
+// src/hash.ts
+function sha256(s) {
+  const c = typeof globalThis !== "undefined" ? globalThis.crypto : void 0;
+  if (!c || !c.subtle || typeof TextEncoder === "undefined") return Promise.resolve(null);
+  return c.subtle.digest("SHA-256", new TextEncoder().encode(s)).then(
+    (buf) => Array.from(new Uint8Array(buf), (b) => b.toString(16).padStart(2, "0")).join(""),
+    () => null
+  );
+}
+function hashPerson(p) {
+  if (p && typeof p.email === "string" && p.email.indexOf("@") > 0) return sha256(p.email.trim().toLowerCase());
+  if (p && (typeof p.phone === "string" || typeof p.phone === "number")) {
+    const digits = String(p.phone).replace(/[^0-9]/g, "");
+    if (digits.length >= 7) return sha256(digits);
+  }
+  return Promise.resolve(null);
+}
+
+// src/server.ts
+var BATCH = 500;
+function newId() {
+  const abc = "abcdefghijklmnopqrstuvwxyz0123456789";
+  const a = new Uint8Array(20);
+  crypto.getRandomValues(a);
+  return Array.from(a, (b) => abc[b % 36]).join("");
+}
+var OptiqError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "OptiqError";
+  }
+};
+var Optiq = class {
+  constructor(o) {
+    if (!o || typeof o.secretKey !== "string" || !/^sk_[A-Za-z0-9]{30,60}$/.test(o.secretKey)) {
+      throw new Error("Optiq needs the source's secret key (sk_...), from the Developer page.");
+    }
+    this.secretKey = o.secretKey;
+    this.baseUrl = (o.baseUrl || "https://enterprise.optiq.studio").replace(/\/+$/, "");
+    this.retries = Math.max(1, o.retries ?? 3);
+  }
+  async call(method, path, body) {
+    let last = null;
+    for (let attempt = 0; attempt < this.retries; attempt++) {
+      if (attempt) await new Promise((r) => setTimeout(r, 500 * 2 ** (attempt - 1)));
+      try {
+        const r = await fetch(`${this.baseUrl}${path}`, {
+          method,
+          headers: { Authorization: `Bearer ${this.secretKey}`, "Content-Type": "application/json" },
+          body: JSON.stringify(body)
+        });
+        const data = await r.json().catch(() => ({}));
+        if (r.ok) return data;
+        const message = typeof data.error === "string" ? data.error : `Optiq answered ${r.status}.`;
+        if (r.status !== 429 && r.status < 500) throw new OptiqError(message, r.status);
+        last = new OptiqError(message, r.status);
+      } catch (e) {
+        if (e instanceof OptiqError && e.status !== 429 && e.status < 500) throw e;
+        last = e;
+      }
+    }
+    throw last instanceof Error ? last : new Error("Optiq did not answer.");
+  }
+  async prepare(e) {
+    const { email, phone, ...rest } = e;
+    const hash = e.person_hash || await hashPerson({ email, phone });
+    const iso = (v) => v instanceof Date ? v.toISOString() : v;
+    return {
+      ...rest,
+      event_id: e.event_id || newId(),
+      occurred_at: iso(e.occurred_at),
+      last_ref_at: iso(e.last_ref_at),
+      person_hash: hash || void 0
+    };
+  }
+  /** Sends one event or many (any number: they go 500 at a time). Answers what was kept, repeated or refused. */
+  async track(events) {
+    const list = Array.isArray(events) ? events : [events];
+    const out = { accepted: 0, duplicates: 0, rejected: [] };
+    for (let i = 0; i < list.length; i += BATCH) {
+      const part = await Promise.all(list.slice(i, i + BATCH).map((e) => this.prepare(e)));
+      const r = await this.call("POST", "/api/v1/events", { events: part });
+      out.accepted += r.accepted || 0;
+      out.duplicates += r.duplicates || 0;
+      for (const x of r.rejected || []) out.rejected.push({ index: x.index + i, reason: x.reason });
+    }
+    return out;
+  }
+  /** Forgets a customer in your company: every event and visit of theirs. Answers how many events went. */
+  async forget(who) {
+    const hash = who.person_hash || await hashPerson(who);
+    if (!hash && !who.visitor_id) throw new Error("Say who: an email, a phone, a person_hash or a visitor_id.");
+    return await this.call("DELETE", "/api/v1/people", { person_hash: hash || void 0, visitor_id: who.visitor_id });
+  }
+};
+export {
+  Optiq,
+  OptiqError
+};

package/dist/t.js

@@ -0,0 +1,2 @@
+/* Optiq Studio Enterprise tracking 0.1.0: <script async src="https://enterprise.optiq.studio/t.js" data-key="pk_..."></script>. Built from @optiqstudio/track (packages/track); docs: https://enterprise.optiq.studio/developers */
+"use strict";(()=>{function k(n){let t=typeof globalThis!="undefined"?globalThis.crypto:void 0;return!t||!t.subtle||typeof TextEncoder=="undefined"?Promise.resolve(null):t.subtle.digest("SHA-256",new TextEncoder().encode(n)).then(e=>Array.from(new Uint8Array(e),r=>r.toString(16).padStart(2,"0")).join(""),()=>null)}function m(n){if(n&&typeof n.email=="string"&&n.email.indexOf("@")>0)return k(n.email.trim().toLowerCase());if(n&&(typeof n.phone=="string"||typeof n.phone=="number")){let t=String(n.phone).replace(/[^0-9]/g,"");if(t.length>=7)return k(t)}return Promise.resolve(null)}var A="https://optiq-collect-951694748196.europe-west2.run.app/e",b=864e5,P=30*6e4,S=()=>typeof window!="undefined"&&typeof document!="undefined";function p(n){try{return window.localStorage.getItem(`optiq_${n}`)}catch(t){return null}}function d(n,t){try{t===null?window.localStorage.removeItem(`optiq_${n}`):window.localStorage.setItem(`optiq_${n}`,t)}catch(e){}}function h(n){try{return JSON.parse(p(n)||"{}")||{}}catch(t){return{}}}function w(n){let t="abcdefghijklmnopqrstuvwxyz0123456789",e=new Uint8Array(n);typeof crypto!="undefined"&&crypto.getRandomValues&&crypto.getRandomValues(e);let r="";for(let s=0;s<n;s++)r+=t.charAt((e[s]||Math.floor(Math.random()*256))%36);return r}var y=class{constructor(t){this.queue=[];this.timer=null;this.lastPath=null;this.wired=!1;this.key=t.key,this.endpoint=t.endpoint||A,this.consentState=t.consent||p("consent")||"unknown";let e=new URLSearchParams(window.location.search),r=Date.now();this.touch=h("touch");let s=e.get("osr");if(s&&/^[A-Za-z0-9]{4,16}$/.test(s)){let l=new Date(r).toISOString();(!this.touch.first||r-Date.parse(this.touch.first.at)>90*b)&&(this.touch.first={ref:s,at:l}),this.touch.last={ref:s,at:l},d("touch",JSON.stringify(this.touch))}let i={};for(let l of["source","medium","campaign","content","term"]){let f=e.get(`utm_${l}`);f&&(i[l]=f.slice(0,200))}Object.keys(i).length&&d("utm",JSON.stringify(i)),this.utm=Object.keys(i).length?i:h("utm");let o={};for(let l of["gclid","fbclid","ttclid","wbraid","gbraid"]){let f=e.get(l);f&&(o[l]=f.slice(0,500))}Object.keys(o).length&&d("clicks",JSON.stringify(o)),this.clicks=Object.keys(o).length?o:h("clicks");let u=this.consentState==="denied"?{}:h("visit"),c=`${e.get("utm_campaign")||""}|${s||""}`;this.visit=u.id&&r-(u.last||0)<=P&&(c==="|"||c===u.from)?u:{id:w(20),started:new Date(r).toISOString(),from:c,landing:window.location.pathname,referrer:document.referrer?document.referrer.split("?")[0].slice(0,300):null,utm:i,click:e.get("gclid")?"gclid":e.get("fbclid")?"fbclid":e.get("ttclid")?"ttclid":null,ref:s&&/^[A-Za-z0-9]{4,16}$/.test(s)?s:null},this.person=p("ph"),t.auto!==!1&&this.wire()}visitor(){if(this.consentState==="denied")return null;let t=p("vid");return t||(t=w(20),d("vid",t)),t}context(){let t=null;try{t=Intl.DateTimeFormat().resolvedOptions().timeZone||null}catch(r){t=null}let e=this.visit;return{id:e.id,started_at:e.started,landing:e.landing,referrer:e.referrer,utm:e.utm,click:e.click,ref:e.ref,lang:(navigator.language||"").slice(0,20)||null,tz:t,screen:window.screen?`${window.screen.width}x${window.screen.height}`:null}}flush(){for(this.timer&&clearTimeout(this.timer),this.timer=null;this.queue.length;){let t=JSON.stringify({key:this.key,visit:this.context(),events:this.queue.splice(0,50)}),e=!1;try{e=!!(navigator.sendBeacon&&navigator.sendBeacon(this.endpoint,new Blob([t],{type:"text/plain"})))}catch(r){e=!1}if(!e)try{fetch(this.endpoint,{method:"POST",body:t,keepalive:!0,mode:"cors",headers:{"Content-Type":"text/plain"}}).catch(()=>{})}catch(r){}}}track(t,e={}){let r={};for(let[c,l]of Object.entries(e))!["value","currency","email","phone"].includes(c)&&l!==void 0&&(r[c]=l);let s=Date.now();this.visit.last=s,this.consentState!=="denied"&&d("visit",JSON.stringify(this.visit));let i=this.touch.last&&s-Date.parse(this.touch.last.at)<=7*b?this.touch.last:null,o=this.consentState==="denied",u={event_id:w(18),name:String(t||"").toLowerCase(),occurred_at:new Date(s).toISOString(),visitor_id:this.visitor(),page_url:window.location.origin+window.location.pathname,referrer:document.referrer?document.referrer.split("?")[0].slice(0,300):null,utm:this.utm,click_ids:o?{}:this.clicks,first_ref:this.touch.first?this.touch.first.ref:null,first_ref_at:this.touch.first?this.touch.first.at:null,last_ref:i?i.ref:null,last_ref_at:i?i.at:null,value:e.value===void 0?null:Number(e.value),currency:e.currency||null,properties:r,consent:this.consentState};m(o?null:e).then(c=>{c&&(this.person=c,d("ph",c)),u.person_hash=o?null:this.person,this.queue.push(u),this.timer||(this.timer=setTimeout(()=>this.flush(),400))})}identify(t){m(t).then(e=>{e&&this.consentState!=="denied"&&(this.person=e,d("ph",e))})}consent(t){if(this.consentState=t==="granted"||t==="denied"?t:"unknown",d("consent",this.consentState),this.consentState==="denied"){for(let e of["vid","ph","clicks","visit"])d(e,null);this.person=null,this.clicks={}}}page(){let t=window.location.pathname+window.location.search;t!==this.lastPath&&(this.lastPath=t,this.track("page_view"))}wire(){if(this.wired)return;this.wired=!0,this.page();for(let e of["pushState","replaceState"]){let r=history[e];typeof r=="function"&&(history[e]=function(...s){let i=r.apply(this,s);return setTimeout(()=>a==null?void 0:a.page(),0),i})}window.addEventListener("popstate",()=>this.page());let t=typeof WeakSet=="function"?new WeakSet:null;document.addEventListener("focusin",e=>{var s,i;let r=(i=(s=e.target)==null?void 0:s.closest)==null?void 0:i.call(s,"form");!r||!t||t.has(r)||(t.add(r),this.track("form_start",{form:(r.getAttribute("name")||r.id||"").slice(0,60)||void 0}))}),document.addEventListener("submit",e=>{let r=e.target;if(!r||!r.getAttribute||r.getAttribute("data-optiq")!=="lead")return;let s=r.querySelector('input[type="email"]'),i=r.querySelector('input[type="tel"]');this.track("lead",{form:(r.getAttribute("name")||r.id||"").slice(0,60)||void 0,email:s?s.value:void 0,phone:i?i.value:void 0}),this.flush()}),document.addEventListener("click",e=>{var i,o;let r=(o=(i=e.target)==null?void 0:i.closest)==null?void 0:o.call(i,"a[href]");if(!r)return;let s=L(r.getAttribute("href")||"");s&&(this.track("contact",{channel:s}),this.flush())},!0),document.addEventListener("visibilitychange",()=>{document.visibilityState==="hidden"&&this.flush()}),window.addEventListener("pagehide",()=>this.flush())}};function L(n){return/^tel:/i.test(n)?"call":/^mailto:[^?]/i.test(n)?"email":/^https?:\/\/(wa\.me\/\+?[0-9]|api\.whatsapp\.com\/send\/?\?(.*&)?phone=)/i.test(n)?"whatsapp":null}var a=null,_=[];function q(n){return S()?a||(!n||typeof n.key!="string"||!/^pk_[A-Za-z0-9]{20,40}$/.test(n.key)?(console.warn("[optiq] init needs the source's publishable key (pk_...), from the Developer page."),null):(a=new y(n),_.splice(0).forEach(t=>t()),a)):null}var g=n=>{S()&&(a?n(a):_.push(()=>a&&n(a)))},v=(n,t)=>g(e=>e.track(n,t)),T=n=>g(t=>t.identify(n)),O=n=>g(t=>t.consent(n)),x=()=>g(n=>n.page());(function(){if(window.__optiqLoaded)return;window.__optiqLoaded=!0;let n=document.currentScript||document.querySelector('script[src*="/t.js"][data-key]');if(!n)return;let t=(window.optiq&&window.optiq.q||[]).map(i=>Array.prototype.slice.call(i));function e(i,o,u){i==="track"?v(String(o),u||{}):i==="identify"?T(o||{}):i==="consent"?O(o):i==="page"&&x()}let r=(...i)=>e(...i);r.track=(i,o)=>v(i,o),window.optiq=r;let s=t.filter(i=>i[0]==="consent").pop();q({key:n.getAttribute("data-key")||"",endpoint:n.getAttribute("data-endpoint")||void 0,consent:s&&(s[1]==="granted"||s[1]==="denied")?s[1]:void 0}),t.forEach(i=>e(...i))})();})();

package/package.json

@@ -1,6 +1,38 @@
 {
   "name": "@optiqstudio/track",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Optiq Studio Enterprise tracking: join every lead, sale and deposit to the video, post or advert that brought it. Browser and server.",
+  "keywords": ["optiq", "optiq studio", "attribution", "tracking", "conversions", "analytics", "marketing", "whatsapp"],
+  "homepage": "https://enterprise.optiq.studio/developers",
+  "license": "MIT",
+  "author": "DaveLabs <info@davelabs.co> (https://davelabs.co)",
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js",
+      "require": "./dist/server.cjs"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": ["dist", "README.md", "LICENSE"],
+  "engines": { "node": ">=20" },
+  "scripts": {
+    "build": "node build.mjs",
+    "test": "node --test test/*.test.mjs",
+    "prepublishOnly": "npm run build && npm test"
+  },
+  "devDependencies": {
+    "esbuild": "0.25.12",
+    "typescript": "5.9.3"
+  }
+}