@vibiz/analytics 0.1.0

package/README.md

@@ -0,0 +1,49 @@
+# @vibiz/analytics
+
+Typed client for the Vibiz analytics tag.
+
+```bash
+npm i @vibiz/analytics
+```
+
+```ts
+import { init, track, identify } from '@vibiz/analytics';
+
+init({ key: 'pk_live_xxx' });
+
+identify('cust_8842', { email: 'mario.rossi@example.com' });
+track('purchase', { value: 4200, currency: 'EUR', order_id: '84213' });
+```
+
+Full documentation: <https://www.vibiz.ai/docs/analytics>
+
+## What this package is
+
+A typed façade, ~1.6 KB, containing **no tracking logic**. It loads the same
+`v.js` a pasted `<script>` tag loads and adds types on top.
+
+Shipping a second implementation for bundled apps is the obvious design and the
+wrong one: two copies of cookie handling, consent reading and queue flushing
+drift apart within a release or two, and the drift surfaces as *"it works on the
+Shopify store and is broken in the React app"* — two behaviours under one name,
+with no way to tell from a dashboard which produced a row.
+
+One implementation, two ways to reach it. If you have no bundler, skip this
+package entirely:
+
+```html
+<script async src="https://www.vibiz.ai/sdk/v1/v.js" data-vibiz-key="pk_live_xxx"></script>
+```
+
+## Notes
+
+- **Safe during server rendering.** Every call is a no-op when there is no
+  `window`, so importing this in a Next.js server component does nothing rather
+  than throwing.
+- **Safe before the tag loads.** Calls are queued and replayed once it arrives,
+  so you can track from the first line of your app.
+- **The key is public.** `pk_live_…` ships in the page source either way, like a
+  Meta pixel id. Traffic is bound to your workspace by allowed domains.
+- **Contact details are never hashed here.** They are hashed by the collector,
+  because a digest computed in a browser cannot be re-normalised — and
+  normalisation is exactly where matching fails silently.

package/dist/index.cjs

@@ -0,0 +1,66 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+// src/index.ts
+var DEFAULT_SCRIPT = "https://www.vibiz.ai/sdk/v1/v.js";
+var SCRIPT_ID = "vibiz-analytics";
+function globalTarget() {
+  if (typeof window === "undefined") return null;
+  const w = window;
+  if (!w.vibiz) w.vibiz = { q: [] };
+  if (!w.vibiz.q) w.vibiz.q = [];
+  return w.vibiz;
+}
+function call(method, ...args) {
+  const target = globalTarget();
+  if (!target) return;
+  const fn = target[method];
+  if (typeof fn === "function") {
+    fn(...args);
+    return;
+  }
+  target.q?.push([method, ...args]);
+}
+function init(config) {
+  if (typeof document === "undefined") return;
+  call("init", config);
+  if (document.getElementById(SCRIPT_ID)) return;
+  const script = document.createElement("script");
+  script.id = SCRIPT_ID;
+  script.async = true;
+  script.src = config.scriptUrl ?? DEFAULT_SCRIPT;
+  script.setAttribute("data-vibiz-key", config.key);
+  if (config.endpoint)
+    script.setAttribute("data-vibiz-endpoint", config.endpoint);
+  if (config.autocapture === false)
+    script.setAttribute("data-vibiz-autocapture", "false");
+  if (config.debug) script.setAttribute("data-vibiz-debug", "true");
+  document.head.appendChild(script);
+}
+function track(name, properties) {
+  call("track", name, properties);
+}
+function page(properties) {
+  call("page", properties);
+}
+function identify(userId, contact) {
+  call("identify", userId, contact);
+}
+function setConsent(state) {
+  call("setConsent", state);
+}
+function flush() {
+  call("flush");
+}
+var vibiz = { init, track, page, identify, setConsent, flush };
+var index_default = vibiz;
+
+exports.default = index_default;
+exports.flush = flush;
+exports.identify = identify;
+exports.init = init;
+exports.page = page;
+exports.setConsent = setConsent;
+exports.track = track;
+exports.vibiz = vibiz;

package/dist/index.d.cts

@@ -0,0 +1,103 @@
+/**
+ * Typed client for the Vibiz analytics tag.
+ *
+ * This package deliberately contains NO tracking logic. It loads the same
+ * `v.js` that a pasted `<script>` tag loads, and adds types on top.
+ *
+ * The alternative — shipping a second implementation for bundled apps — is the
+ * obvious design and the wrong one. Two copies of cookie handling, consent
+ * reading and queue flushing drift apart within a release or two, and the drift
+ * surfaces as "it works on the Shopify store and is broken in the React app",
+ * which is the worst possible bug to hold: two behaviours, one name, and no way
+ * to tell from a dashboard which one produced a row.
+ *
+ * One implementation, two ways to reach it.
+ *
+ * Calls made before the tag finishes loading are queued and replayed by the tag
+ * itself — no new mechanism here, just the `window.vibiz.q` stub it already
+ * drains on startup.
+ */
+/** Events the collector maps onto ad-platform standards. Any other string is kept as your own custom event. */
+type StandardEvent = 'page_view' | 'view_content' | 'search' | 'lead' | 'contact' | 'sign_up' | 'login' | 'add_to_cart' | 'remove_from_cart' | 'add_to_wishlist' | 'begin_checkout' | 'add_payment_info' | 'schedule' | 'purchase' | 'subscribe' | 'start_trial' | 'refund';
+/**
+ * `StandardEvent | (string & {})` keeps autocomplete for the known names while
+ * still accepting your own — a bare `string` would silently discard the
+ * suggestions, and a bare union would reject events we have no business
+ * rejecting.
+ */
+type EventName = StandardEvent | (string & {});
+interface EventProperties {
+    /** Revenue, in major units. `4200.5`, never cents. */
+    value?: number;
+    /** ISO 4217, e.g. `EUR`. Meta ignores a value that arrives without one. */
+    currency?: string;
+    /** Your order id. Doubles as the deduplication key against a server-side copy. */
+    order_id?: string;
+    [key: string]: unknown;
+}
+/**
+ * Contact details, sent only with advertising consent and hashed by the
+ * collector before storage. Never hashed here: a digest computed in the browser
+ * cannot be re-normalised, and normalisation is where matching silently fails.
+ */
+interface Contact {
+    email?: string;
+    phone?: string;
+    first_name?: string;
+    last_name?: string;
+    city?: string;
+    region?: string;
+    postal_code?: string;
+    country?: string;
+}
+interface VibizConfig {
+    /** Public write key, `pk_live_…`. Safe in client code: it ships in the page source either way. */
+    key: string;
+    /** Point this at a first-party subdomain to survive ad blockers. */
+    endpoint?: string;
+    /** Page views, clicks, form submits and time on page without any code. Default true. */
+    autocapture?: boolean;
+    /** Log every event to the console as it is sent. */
+    debug?: boolean;
+    /** Override where the tag is loaded from. Only useful when self-hosting it. */
+    scriptUrl?: string;
+}
+/**
+ * Load the tag and start tracking. Safe to call more than once — the tag itself
+ * ignores a second init, because a duplicated install must not double-count
+ * every event.
+ */
+declare function init(config: VibizConfig): void;
+/** Record an event. Unknown names are kept as your own custom event, not renamed. */
+declare function track(name: EventName, properties?: EventProperties): void;
+/** Record a page or route view. Only needed when autocapture is off. */
+declare function page(properties?: EventProperties): void;
+/**
+ * Attach a person to this browser, and to everything it did before.
+ *
+ * The moment someone logs in is usually the only moment they say who they are,
+ * and it is rarely the moment that matters commercially. Details accumulate
+ * across calls rather than replacing each other.
+ */
+declare function identify(userId: string, contact?: Contact): void;
+/**
+ * Report consent as your consent tool determined it.
+ *
+ * Without advertising consent, contact details are never sent and never stored;
+ * traffic analytics keep working.
+ */
+declare function setConsent(state: {
+    advertising?: boolean;
+}): void;
+/** Send anything queued right now. Rarely needed — the tag flushes on its own. */
+declare function flush(): void;
+declare const vibiz: {
+    init: typeof init;
+    track: typeof track;
+    page: typeof page;
+    identify: typeof identify;
+    setConsent: typeof setConsent;
+    flush: typeof flush;
+};
+
+export { type Contact, type EventName, type EventProperties, type StandardEvent, type VibizConfig, vibiz as default, flush, identify, init, page, setConsent, track, vibiz };

package/dist/index.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Typed client for the Vibiz analytics tag.
+ *
+ * This package deliberately contains NO tracking logic. It loads the same
+ * `v.js` that a pasted `<script>` tag loads, and adds types on top.
+ *
+ * The alternative — shipping a second implementation for bundled apps — is the
+ * obvious design and the wrong one. Two copies of cookie handling, consent
+ * reading and queue flushing drift apart within a release or two, and the drift
+ * surfaces as "it works on the Shopify store and is broken in the React app",
+ * which is the worst possible bug to hold: two behaviours, one name, and no way
+ * to tell from a dashboard which one produced a row.
+ *
+ * One implementation, two ways to reach it.
+ *
+ * Calls made before the tag finishes loading are queued and replayed by the tag
+ * itself — no new mechanism here, just the `window.vibiz.q` stub it already
+ * drains on startup.
+ */
+/** Events the collector maps onto ad-platform standards. Any other string is kept as your own custom event. */
+type StandardEvent = 'page_view' | 'view_content' | 'search' | 'lead' | 'contact' | 'sign_up' | 'login' | 'add_to_cart' | 'remove_from_cart' | 'add_to_wishlist' | 'begin_checkout' | 'add_payment_info' | 'schedule' | 'purchase' | 'subscribe' | 'start_trial' | 'refund';
+/**
+ * `StandardEvent | (string & {})` keeps autocomplete for the known names while
+ * still accepting your own — a bare `string` would silently discard the
+ * suggestions, and a bare union would reject events we have no business
+ * rejecting.
+ */
+type EventName = StandardEvent | (string & {});
+interface EventProperties {
+    /** Revenue, in major units. `4200.5`, never cents. */
+    value?: number;
+    /** ISO 4217, e.g. `EUR`. Meta ignores a value that arrives without one. */
+    currency?: string;
+    /** Your order id. Doubles as the deduplication key against a server-side copy. */
+    order_id?: string;
+    [key: string]: unknown;
+}
+/**
+ * Contact details, sent only with advertising consent and hashed by the
+ * collector before storage. Never hashed here: a digest computed in the browser
+ * cannot be re-normalised, and normalisation is where matching silently fails.
+ */
+interface Contact {
+    email?: string;
+    phone?: string;
+    first_name?: string;
+    last_name?: string;
+    city?: string;
+    region?: string;
+    postal_code?: string;
+    country?: string;
+}
+interface VibizConfig {
+    /** Public write key, `pk_live_…`. Safe in client code: it ships in the page source either way. */
+    key: string;
+    /** Point this at a first-party subdomain to survive ad blockers. */
+    endpoint?: string;
+    /** Page views, clicks, form submits and time on page without any code. Default true. */
+    autocapture?: boolean;
+    /** Log every event to the console as it is sent. */
+    debug?: boolean;
+    /** Override where the tag is loaded from. Only useful when self-hosting it. */
+    scriptUrl?: string;
+}
+/**
+ * Load the tag and start tracking. Safe to call more than once — the tag itself
+ * ignores a second init, because a duplicated install must not double-count
+ * every event.
+ */
+declare function init(config: VibizConfig): void;
+/** Record an event. Unknown names are kept as your own custom event, not renamed. */
+declare function track(name: EventName, properties?: EventProperties): void;
+/** Record a page or route view. Only needed when autocapture is off. */
+declare function page(properties?: EventProperties): void;
+/**
+ * Attach a person to this browser, and to everything it did before.
+ *
+ * The moment someone logs in is usually the only moment they say who they are,
+ * and it is rarely the moment that matters commercially. Details accumulate
+ * across calls rather than replacing each other.
+ */
+declare function identify(userId: string, contact?: Contact): void;
+/**
+ * Report consent as your consent tool determined it.
+ *
+ * Without advertising consent, contact details are never sent and never stored;
+ * traffic analytics keep working.
+ */
+declare function setConsent(state: {
+    advertising?: boolean;
+}): void;
+/** Send anything queued right now. Rarely needed — the tag flushes on its own. */
+declare function flush(): void;
+declare const vibiz: {
+    init: typeof init;
+    track: typeof track;
+    page: typeof page;
+    identify: typeof identify;
+    setConsent: typeof setConsent;
+    flush: typeof flush;
+};
+
+export { type Contact, type EventName, type EventProperties, type StandardEvent, type VibizConfig, vibiz as default, flush, identify, init, page, setConsent, track, vibiz };

package/dist/index.js

@@ -0,0 +1,55 @@
+// src/index.ts
+var DEFAULT_SCRIPT = "https://www.vibiz.ai/sdk/v1/v.js";
+var SCRIPT_ID = "vibiz-analytics";
+function globalTarget() {
+  if (typeof window === "undefined") return null;
+  const w = window;
+  if (!w.vibiz) w.vibiz = { q: [] };
+  if (!w.vibiz.q) w.vibiz.q = [];
+  return w.vibiz;
+}
+function call(method, ...args) {
+  const target = globalTarget();
+  if (!target) return;
+  const fn = target[method];
+  if (typeof fn === "function") {
+    fn(...args);
+    return;
+  }
+  target.q?.push([method, ...args]);
+}
+function init(config) {
+  if (typeof document === "undefined") return;
+  call("init", config);
+  if (document.getElementById(SCRIPT_ID)) return;
+  const script = document.createElement("script");
+  script.id = SCRIPT_ID;
+  script.async = true;
+  script.src = config.scriptUrl ?? DEFAULT_SCRIPT;
+  script.setAttribute("data-vibiz-key", config.key);
+  if (config.endpoint)
+    script.setAttribute("data-vibiz-endpoint", config.endpoint);
+  if (config.autocapture === false)
+    script.setAttribute("data-vibiz-autocapture", "false");
+  if (config.debug) script.setAttribute("data-vibiz-debug", "true");
+  document.head.appendChild(script);
+}
+function track(name, properties) {
+  call("track", name, properties);
+}
+function page(properties) {
+  call("page", properties);
+}
+function identify(userId, contact) {
+  call("identify", userId, contact);
+}
+function setConsent(state) {
+  call("setConsent", state);
+}
+function flush() {
+  call("flush");
+}
+var vibiz = { init, track, page, identify, setConsent, flush };
+var index_default = vibiz;
+
+export { index_default as default, flush, identify, init, page, setConsent, track, vibiz };

package/dist/node.cjs

@@ -0,0 +1,55 @@
+'use strict';
+
+// src/node.ts
+var DEFAULT_ENDPOINT = "https://www.vibiz.ai/api/ingest";
+var PROTOCOL_VERSION = 1;
+async function track(input) {
+  if (!input.key) return { ok: false, reason: "missing key" };
+  if (!input.event) return { ok: false, reason: "missing event" };
+  if (!input.visitorId && !input.userId && !input.contact) {
+    return {
+      ok: false,
+      reason: "no visitorId, userId or contact: nothing to attribute to"
+    };
+  }
+  const body = {
+    v: PROTOCOL_VERSION,
+    k: input.key,
+    n: input.event,
+    vid: input.visitorId ?? `srv-${input.userId ?? "anon"}`
+  };
+  if (input.userId) body.uid = input.userId;
+  if (input.properties) body.p = input.properties;
+  if (input.timestamp) body.ts = input.timestamp;
+  if (input.contact && input.advertisingConsent === true) {
+    body.pii = input.contact;
+    body.cad = true;
+  }
+  try {
+    const headers = {
+      // text/plain matches what the tag sends, so both halves hit the same
+      // parsing path on the collector rather than two that can diverge.
+      "Content-Type": "text/plain;charset=UTF-8"
+    };
+    if (input.serverKey) headers["x-vibiz-server-key"] = input.serverKey;
+    const response = await fetch(input.endpoint ?? DEFAULT_ENDPOINT, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(body)
+    });
+    return response.ok ? { ok: true } : { ok: false, reason: `HTTP ${response.status}` };
+  } catch (error) {
+    return {
+      ok: false,
+      reason: error instanceof Error ? error.message : "request failed"
+    };
+  }
+}
+async function trackBatch(events) {
+  const results = [];
+  for (const event of events) results.push(await track(event));
+  return results;
+}
+
+exports.track = track;
+exports.trackBatch = trackBatch;

package/dist/node.d.cts

@@ -0,0 +1,92 @@
+/**
+ * Server side tracking.
+ *
+ * The browser cannot see a webhook, a background job, or a payment confirmed
+ * by a provider three seconds after the customer closed the tab. Those are the
+ * events worth the most, because they carry the revenue that actually settled
+ * rather than the total that was in the cart.
+ *
+ * Deliberately dependency free and built on `fetch`: this runs in whatever
+ * runtime a customer's backend happens to be, and a tracking call is not worth
+ * a dependency anyone has to resolve.
+ */
+interface Contact {
+    email?: string;
+    phone?: string;
+    first_name?: string;
+    last_name?: string;
+    city?: string;
+    region?: string;
+    postal_code?: string;
+    country?: string;
+}
+interface ServerEventProperties {
+    /** Revenue in major units. `4200.5`, never cents. */
+    value?: number;
+    /** ISO 4217. A value without one is discarded by Meta. */
+    currency?: string;
+    /**
+     * Your order id, and the deduplication key.
+     *
+     * Send the SAME id the browser sent. Without it a purchase tracked in both
+     * places counts twice, which is worse than tracking it in neither: the
+     * numbers look better and the optimisation is trained on revenue that does
+     * not exist.
+     */
+    order_id?: string;
+    [key: string]: unknown;
+}
+interface ServerTrackInput {
+    /** Public write key. Says which workspace the event belongs to. */
+    key: string;
+    /**
+     * Server key, from your Vibiz workspace. Unlike `key` this IS a credential:
+     * keep it in your environment and never send it to a browser.
+     *
+     * Required once the site has an origin allowlist, because a server call
+     * carries no `Origin` for that allowlist to check. Without it the allowlist
+     * would be bypassable by anyone willing to use curl instead of a browser.
+     */
+    serverKey?: string;
+    event: string;
+    /**
+     * The visitor id the browser minted, when you have it.
+     *
+     * This is what joins a server side conversion to the visit that produced it,
+     * and therefore to the ad click. Persist it with the order at checkout: it
+     * is readable from the `vbz_vid` cookie, and it is the difference between a
+     * purchase attributed to a campaign and one attributed to nobody.
+     */
+    visitorId?: string;
+    /** Your own user id. Becomes Meta's `external_id`. */
+    userId?: string;
+    properties?: ServerEventProperties;
+    /** Hashed by the collector, never here: a digest computed early cannot be re-normalised. */
+    contact?: Contact;
+    /** Advertising consent. Without `true`, contact details are neither sent nor stored. */
+    advertisingConsent?: boolean;
+    /** When it happened, if not now. Milliseconds. */
+    timestamp?: number;
+    endpoint?: string;
+}
+interface ServerTrackResult {
+    ok: boolean;
+    reason?: string;
+}
+/**
+ * Send one event. NEVER THROWS.
+ *
+ * A tracking call that takes down a checkout handler is a far worse outcome
+ * than a missing event, and this runs inside payment webhooks and order
+ * confirmations. Failures come back as values so a caller can log them and
+ * carry on.
+ *
+ * Not awaited internally either: there is no retry here on purpose. A caller
+ * inside a webhook already has a retry policy imposed by the provider, and a
+ * second one underneath it produces duplicate events on every redelivery.
+ */
+declare function track(input: ServerTrackInput): Promise<ServerTrackResult>;
+/** Send several events. Sequential on purpose: order is preserved and no burst is created. */
+declare function trackBatch(events: ServerTrackInput[]): Promise<ServerTrackResult[]>;
+
+export { type Contact, type ServerEventProperties, type ServerTrackInput, type ServerTrackResult, track, trackBatch };

package/dist/node.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Server side tracking.
+ *
+ * The browser cannot see a webhook, a background job, or a payment confirmed
+ * by a provider three seconds after the customer closed the tab. Those are the
+ * events worth the most, because they carry the revenue that actually settled
+ * rather than the total that was in the cart.
+ *
+ * Deliberately dependency free and built on `fetch`: this runs in whatever
+ * runtime a customer's backend happens to be, and a tracking call is not worth
+ * a dependency anyone has to resolve.
+ */
+interface Contact {
+    email?: string;
+    phone?: string;
+    first_name?: string;
+    last_name?: string;
+    city?: string;
+    region?: string;
+    postal_code?: string;
+    country?: string;
+}
+interface ServerEventProperties {
+    /** Revenue in major units. `4200.5`, never cents. */
+    value?: number;
+    /** ISO 4217. A value without one is discarded by Meta. */
+    currency?: string;
+    /**
+     * Your order id, and the deduplication key.
+     *
+     * Send the SAME id the browser sent. Without it a purchase tracked in both
+     * places counts twice, which is worse than tracking it in neither: the
+     * numbers look better and the optimisation is trained on revenue that does
+     * not exist.
+     */
+    order_id?: string;
+    [key: string]: unknown;
+}
+interface ServerTrackInput {
+    /** Public write key. Says which workspace the event belongs to. */
+    key: string;
+    /**
+     * Server key, from your Vibiz workspace. Unlike `key` this IS a credential:
+     * keep it in your environment and never send it to a browser.
+     *
+     * Required once the site has an origin allowlist, because a server call
+     * carries no `Origin` for that allowlist to check. Without it the allowlist
+     * would be bypassable by anyone willing to use curl instead of a browser.
+     */
+    serverKey?: string;
+    event: string;
+    /**
+     * The visitor id the browser minted, when you have it.
+     *
+     * This is what joins a server side conversion to the visit that produced it,
+     * and therefore to the ad click. Persist it with the order at checkout: it
+     * is readable from the `vbz_vid` cookie, and it is the difference between a
+     * purchase attributed to a campaign and one attributed to nobody.
+     */
+    visitorId?: string;
+    /** Your own user id. Becomes Meta's `external_id`. */
+    userId?: string;
+    properties?: ServerEventProperties;
+    /** Hashed by the collector, never here: a digest computed early cannot be re-normalised. */
+    contact?: Contact;
+    /** Advertising consent. Without `true`, contact details are neither sent nor stored. */
+    advertisingConsent?: boolean;
+    /** When it happened, if not now. Milliseconds. */
+    timestamp?: number;
+    endpoint?: string;
+}
+interface ServerTrackResult {
+    ok: boolean;
+    reason?: string;
+}
+/**
+ * Send one event. NEVER THROWS.
+ *
+ * A tracking call that takes down a checkout handler is a far worse outcome
+ * than a missing event, and this runs inside payment webhooks and order
+ * confirmations. Failures come back as values so a caller can log them and
+ * carry on.
+ *
+ * Not awaited internally either: there is no retry here on purpose. A caller
+ * inside a webhook already has a retry policy imposed by the provider, and a
+ * second one underneath it produces duplicate events on every redelivery.
+ */
+declare function track(input: ServerTrackInput): Promise<ServerTrackResult>;
+/** Send several events. Sequential on purpose: order is preserved and no burst is created. */
+declare function trackBatch(events: ServerTrackInput[]): Promise<ServerTrackResult[]>;
+
+export { type Contact, type ServerEventProperties, type ServerTrackInput, type ServerTrackResult, track, trackBatch };

package/dist/node.js

@@ -0,0 +1,52 @@
+// src/node.ts
+var DEFAULT_ENDPOINT = "https://www.vibiz.ai/api/ingest";
+var PROTOCOL_VERSION = 1;
+async function track(input) {
+  if (!input.key) return { ok: false, reason: "missing key" };
+  if (!input.event) return { ok: false, reason: "missing event" };
+  if (!input.visitorId && !input.userId && !input.contact) {
+    return {
+      ok: false,
+      reason: "no visitorId, userId or contact: nothing to attribute to"
+    };
+  }
+  const body = {
+    v: PROTOCOL_VERSION,
+    k: input.key,
+    n: input.event,
+    vid: input.visitorId ?? `srv-${input.userId ?? "anon"}`
+  };
+  if (input.userId) body.uid = input.userId;
+  if (input.properties) body.p = input.properties;
+  if (input.timestamp) body.ts = input.timestamp;
+  if (input.contact && input.advertisingConsent === true) {
+    body.pii = input.contact;
+    body.cad = true;
+  }
+  try {
+    const headers = {
+      // text/plain matches what the tag sends, so both halves hit the same
+      // parsing path on the collector rather than two that can diverge.
+      "Content-Type": "text/plain;charset=UTF-8"
+    };
+    if (input.serverKey) headers["x-vibiz-server-key"] = input.serverKey;
+    const response = await fetch(input.endpoint ?? DEFAULT_ENDPOINT, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(body)
+    });
+    return response.ok ? { ok: true } : { ok: false, reason: `HTTP ${response.status}` };
+  } catch (error) {
+    return {
+      ok: false,
+      reason: error instanceof Error ? error.message : "request failed"
+    };
+  }
+}
+async function trackBatch(events) {
+  const results = [];
+  for (const event of events) results.push(await track(event));
+  return results;
+}
+
+export { track, trackBatch };

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@vibiz/analytics",
+  "version": "0.1.0",
+  "description": "Typed client for the Vibiz analytics tag.",
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    },
+    "./node": {
+      "import": {
+        "types": "./dist/node.d.ts",
+        "default": "./dist/node.js"
+      },
+      "require": {
+        "types": "./dist/node.d.cts",
+        "default": "./dist/node.cjs"
+      }
+    },
+    "./package.json": "./package.json"
+  },
+  "files": ["dist", "README.md"],
+  "scripts": {
+    "build": "tsup src/index.ts src/node.ts --format esm,cjs --dts --clean --treeshake",
+    "typecheck": "tsc --noEmit"
+  },
+  "devDependencies": {
+    "tsup": "^8.5.0",
+    "typescript": "^5.7.2"
+  },
+  "keywords": ["vibiz", "analytics", "attribution", "conversions"],
+  "homepage": "https://www.vibiz.ai/docs/analytics",
+  "publishConfig": {
+    "access": "public"
+  },
+  "license": "UNLICENSED"
+}