@pixelmatters/markup 1.17.0 → 1.18.0

package/README.md

@@ -37,9 +37,9 @@ CDN drop-in (no build step) — paste this just before `</body>`:
 ```html
 <script type="module">
   // Pin the exact version — esm.sh resolves it from npm
-  import { init } from 'https://esm.sh/@pixelmatters/markup@1.17.0'
+  import { init } from 'https://esm.sh/@pixelmatters/markup@1.18.0'
   // or
-  // import { init } from 'https://esm.run/@pixelmatters/markup@1.17.0'
+  // import { init } from 'https://esm.run/@pixelmatters/markup@1.18.0'
 
   init({
     apiUrl: 'https://your-deployment.convex.site',
@@ -50,14 +50,14 @@ CDN drop-in (no build step) — paste this just before `</body>`:
 </script>
 ```
 
-> **Why pin the version?** CDN URLs without a version (`@pixelmatters/markup`) resolve to whatever's `latest` on npm — a future major release will break your page silently. Always pin (`@pixelmatters/markup@1.17.0`).
+> **Why pin the version?** CDN URLs without a version (`@pixelmatters/markup`) resolve to whatever's `latest` on npm — a future major release will break your page silently. Always pin (`@pixelmatters/markup@1.18.0`).
 
 If your platform doesn't allow inline JS (some CMS / page-builder editors), use the auto-init form instead — point a `<script src=…>` at the bundle and pass config via `data-*` attributes:
 
 ```html
 <script
   type="module"
-  src="https://esm.sh/@pixelmatters/markup@1.17.0"
+  src="https://esm.sh/@pixelmatters/markup@1.18.0"
   data-markup-widget="true"
   data-api-url="https://your-deployment.convex.site"
   data-api-key="markup_..."
@@ -159,6 +159,7 @@ Mounts the widget. Always tears down any existing instance before mounting, so c
 | `apiKey`       | `string`                                             | required         | Project API key — mint one in the dashboard                                                                                                                                                                                                                                      |
 | `position`     | `'bottom-right' \| 'bottom-left' \| 'bottom-center'` | `'bottom-right'` | Initial placement for the toolbar — users can move it with the Position picker in the toolbar's overflow menu                                                                                                                                                                    |
 | `theme`        | `'light' \| 'dark' \| 'auto'`                        | `'auto'`         | Initial theme — `'light'` or `'dark'`, or `'auto'` (default) to follow the host's `prefers-color-scheme`. Users can change this from the overflow menu; their choice persists and wins over this option from then on                                                             |
+| `analytics`    | `boolean`                                            | `true`           | Product telemetry — counts of widget interactions, sent to Markup. Adds no third-party script, sets no cookie, writes nothing to storage, and carries no identifier for your users. See [Product telemetry](#product-telemetry)                                                  |
 | `screenshots`  | `ScreenshotsConfig`                                  | capture enabled  | Capture and PII-scrub options — see [Screenshots & privacy](#screenshots--privacy)                                                                                                                                                                                               |
 | `dashboardUrl` | `string`                                             | —                | Dashboard URL the identity menu links to as **Account →** for signed-in users; it also retargets the overflow menu's "Powered by Markup" line. Omit it and the Account entry is hidden — mostly useful for self-hosters, whose dashboard origin the widget can't know statically |
 
@@ -177,6 +178,27 @@ The floating action button was replaced by the toolbar pill in 1.15.0, and a pil
 
 </details>
 
+### Product telemetry
+
+The widget reports counts of its own interactions — a comment started, a
+comment submitted, a screenshot captured — so we can tell which parts of
+it earn their place. Turn it off with `analytics: false`, or
+`data-analytics="false"` on the script tag.
+
+What it is not, concretely:
+
+- **No third-party script.** Events post to your `apiUrl` on
+  `convex.site`, the same origin the widget already talks to. Nothing new
+  for your CSP, and no vendor SDK on your page.
+- **No identifier for your users.** Events are keyed on the Markup
+  project, not the person. The session id is generated per page load, held
+  in memory, and gone when the tab closes.
+- **No cookie, no `localStorage`.** Telemetry adds nothing to your page's
+  storage.
+- **No content and no IP.** Comment text, page URLs, names, and email are
+  never sent. Events reach our analytics provider from our backend, so
+  your visitors' IP addresses never leave your site.
+
 ### `destroy()`
 
 Unmounts the widget and removes the host element. Safe to call when nothing is mounted.
@@ -336,7 +358,7 @@ For a `<script>` tag drop-in (no bundler), use the inline ESM form and **pin the
 
 ```html
 <script type="module">
-  import { init } from 'https://esm.sh/@pixelmatters/markup@1.17.0'
+  import { init } from 'https://esm.sh/@pixelmatters/markup@1.18.0'
 
   init({
     apiUrl: '...',
@@ -352,7 +374,7 @@ If inline JS is disallowed (some CMS / page-builder editors), use the auto-init
 ```html
 <script
   type="module"
-  src="https://esm.sh/@pixelmatters/markup@1.17.0"
+  src="https://esm.sh/@pixelmatters/markup@1.18.0"
   data-markup-widget="true"
   data-api-url="..."
   data-api-key="..."

package/dist/widget.d.ts

@@ -48,6 +48,20 @@ export interface WidgetConfig {
      * isn't statically known to the widget.
      */
     dashboardUrl?: string;
+    /**
+     * Product telemetry — counts of widget interactions, sent to Markup.
+     * Default: enabled.
+     *
+     * What it is not: it adds no third-party script, sets no cookie and
+     * writes nothing to storage, and carries no identifier for the person
+     * using your site — events are keyed on the *project*, and the
+     * session id is generated per page load and discarded with the tab.
+     * No comment text, URLs, or names are ever sent.
+     *
+     * Set `false` if your privacy policy or DPA is easier to write
+     * without it.
+     */
+    analytics?: boolean;
 }
 /**
  * Mounts the feedback widget on the page. Idempotent — calling init again