@zeruxjs/tags 0.0.0-stage → 0.0.1

package/LICENSE-APACHE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/LICENSE-MIT

@@ -0,0 +1,9 @@
+The MIT License (MIT)
+
+Copyright (c) 2026 ZeruxJS.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,3 +1,111 @@
-# Temporary Holding Version
+# @zeruxjs/tags — server and browser tag manager
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Managed triggers, tags, data-layer variables, browser `ttag()` and server `astag()` APIs. Supports Zerux internal analytics, **server-side GA4 Measurement Protocol**, and preapproved HTTPS webhook destinations. Credentials are only resolved on the server. Does not execute arbitrary browser script tags.
+
+## Zerux runtime configuration
+
+```ts
+export default {
+  analytics: { analytics: 'reporting', enabled: true },
+  tags: {
+    enabled: true,
+    site: 'storefront',
+    prefix: '/_tags', // browser: /_tags/ttag.js, collector: /_tags/collect
+    publicOrigin: 'https://tags.example.com', // optional for tagging subdomain
+    allowedOrigins: ['https://shop.example.com'],
+    dashboardHost: 'tags.example.com', // optional restrict dashboard host
+    authorizeAdmin: async req => await sessionHasRole(req, 'analytics_admin'),
+    credentials: { ga4: {secret: process.env.GA4_MP_SECRET!} },
+    destinations: { crm: { url: 'https://hooks.example.net/events', headers: { Authorization: `Bearer ${process.env.HOOK_TOKEN!}` } } },
+    debug: process.env.NODE_ENV !== 'production',
+  }
+}
+```
+
+The default container includes an **internal analytics tag** fired for all events. `dashboardHost` applies to admin routes only. Session/role authorization must be supplied by the host application; otherwise **no admin routes are registered**. Admin PUT requires a matching Origin and a monotonically increasing version. Credentials and destination URLs never appear in public container JSON. Direct browser-origin POSTs cannot claim `server` events.
+
+For browser collection with cross-origin tags, put the script on the page:
+
+```html
+<script>window.dataLayer=window.dataLayer||[];window.dataLayer.push({event:'preload',properties:{section:'home'}});</script>
+<script async src="https://tags.example.com/_tags/ttag.js"></script>
+```
+
+```js
+const requestId = ttag('event', 'purchase', { value: 49.99, currency: 'USD' });
+ttag('set', 'sessionId', 'opaque-session'); // optional stable client_id for GA4
+const x = ttag('get', 'sessionId');
+// ttag('config', {...}) is intentionally disabled: tenant/debug are server-controlled.
+ttag('consent', 'denied');  // telemetry-only switch, unrelated to email marketing consent
+window.dataLayer.push({event:'cart_add',properties:{quantity:1}});
+```
+
+`ttag('event')` returns the **16-character request ID** immediately; that ID is also attached to the collected event and passed to matching triggers. Events queue asynchronously, attempt `navigator.sendBeacon()` first (CORS-simple text/plain), then `fetch(...,{keepalive:true})` if Beacon cannot queue. Flushing also occurs on `visibilitychange` / `pagehide`. Network delivery is **best-effort**, not an exactly-once guarantee. Browsers that do not provide secure `crypto.getRandomValues()` cannot safely generate IDs and therefore do not send telemetry.
+
+On the server, get a request-scoped function (not a cross-request global singleton):
+
+```ts
+const tagService = runtimeServices.get('tags');
+const astag = tagService.createAstag({site:'storefront',sessionId:'opaque-user-id'});
+await astag('set', 'tier', 'pro');
+const result = await astag('event', 'checkout', {value:125});
+await astag('get', 'tier');
+await astag('config', {pathname:'/checkout'});
+await astag('consent', 'denied'); // telemetry control only
+```
+
+A server request scope can generate **one** request ID, reserved for the UTC day, and reuse it across related events; browser deliveries use **one ID per POST**. The current UTC day is assigned on the server. The event row contains reserved `zRequestId` / `zRequestUtcDay` scalar properties for joining data. Duplicate request ID reservations are rejected (409), invalid ID (422), unavailable reservation storage (503). For guaranteed cross-replica uniqueness, use the analytics-named shared DB reservation adapter or inject an atomic shared `requestIds` store. Memory-only reservation is development-only.
+
+### Editing tags
+
+Navigate to `/_tags/admin` on the selected dashboard host with an authenticated application session. Create/edit triggers, event matches and conditions; variables can read event properties, dataLayer values, or request context; tags can fire internally, to a configured GA4 stream, or to a preapproved webhook. `/_tags/admin/preview` is a protected **dry run** that shows eligible triggers/tags without dispatching to destinations. The full JSON editor can edit uncommon fields; saving a draft and publishing it are separately authorized, version-checked operations. Registered variables can be used as exact parameter bindings such as `parameters:{revenue:'{{cart_total}}'}`; JavaScript expressions are never evaluated.
+
+A GA4 tag needs `measurementId` (e.g., `G-ABC1234`), `credentialRef` referencing the server-side secret, and a **client_id** via explicit sessionId or a variable; Zerux does not silently invent a cookie or fingerprint. GA4 HTTP success means received, **not necessarily processed**. See [Google's Measurement Protocol](https://developers.google.com/analytics/devguides/collection/protocol/ga4/sending-events). Webhooks are referenced by `destinationRef` to a server allowlist (not an attacker-controlled URL). Use egress filtering/DNS rebinding protection in production.
+
+### Deployment prerequisites
+
+Connect `analytics.analytics` to a real named @zeruxjs/db connector. Its facade should implement `createTable`, atomic `insert`, `select`, conditional `update` and reliable `affectedCount`. The default store uses `analytics_tag_containers` with optimistic CAS; `analytics_request_ids` enforces UTC-day ID uniqueness and can optionally prune old IDs if the connector supports `delete`. Multi-server nodes must share the same DB and dashboard store; keep admin APIs protected behind HTTPS session auth, CSRF restrictions, reverse proxy limits and role controls. Supply `store`/`requestIds` adapters if your DB is not compatible. Monitor warnings, 409/429/503 rates and outgoing destination failures. No durable queue/replay is implemented yet.
+
+### Optional automatic web triggers
+
+Published `pageview`, `click`, `form`, and `history` trigger types cause the generated bootstrap to register corresponding browser listeners. They emit `page_view`, `click`, `form_submit`, and `history_change` events respectively. Click/form metadata intentionally excludes element text and form field values. Automatic tracking is not enabled unless a corresponding trigger is published. Set `tags.defaultConsent:'denied'` for a site's privacy policy to suppress telemetry before the application calls `ttag('consent','granted')`; this switch is independent of email marketing subscription state. `history` currently listens to `popstate` rather than monkeypatching routing APIs.
+
+## Section 72: publishable releases and governance
+
+**Important migration:** `PUT /_tags/admin/api` now **saves a draft**, not the live container. A separate privileged `POST /_tags/admin/publish` makes the draft live. Existing plain versioned containers are treated as live **release 1** until their first draft change; the first save persists a governance envelope in the existing CAS document. No new table is required. Two manager replicas must share the same atomic versioned document store and request-ID adapter; an in-memory store is for development only.
+
+Configure **both** independent authorizers on the server; no publish or rollback is allowed when `authorizePublish` is absent:
+
+```ts
+const tagConfig = {
+  site: 'shop',
+  allowedOrigins: ['https://shop.example.com'],
+  siteByOrigin: { 'https://shop.example.com': 'shop' },
+  defaultConsent: 'denied',           // for browser AND astag by default
+  requireBrowserConsent: true,      // drops unknown client-consent claims
+  botPolicy: 'drop-known',
+  dashboardHost: 'tags.example.com',
+  authorizeAdmin: req => checkRole(req, 'analytics_editor'),
+  authorizePublish: req => checkRole(req, 'analytics_publisher'),
+  onWarning: message => logger.warn(message),
+};
+```
+
+An authorizer must verify the user's authenticated session, tenant and role. Both controls are checked for publisher actions; a publisher needs editor/admin access too. All POST/PUT studio writes require same-origin `Origin` checks, in addition to these authorizers. Never expose a dashboard publicly. Add CSRF tokens in the host layer if your deployment accepts unusual state-changing request patterns.
+
+| Route | Method | Permission | Purpose |
+|---|---|---|---|
+| `/_tags/admin` | GET | editor | Visual draft editor, dry-run, publish and rollback controls |
+| `/_tags/admin/api` | GET / PUT | editor | Read full draft / save `{version: prior+1,...}` |
+| `/_tags/admin/status` | GET | editor | Draft revision, live release and bounded release-history metadata |
+| `/_tags/admin/preview` | POST | editor | Pure trigger dry-run `{name,properties,data,mode:'draft'|'published'}` |
+| `/_tags/admin/publish` | POST | editor + publisher | `{expectedVersion}`; atomic CAS live switch and history append |
+| `/_tags/admin/rollback` | POST | editor + publisher | `{expectedVersion,releaseId}`; publish a retained snapshot as a new live release |
+| `/_tags/ttag.js` | GET | public | Bootstrap **from published triggers only**, `Cache-Control: no-store` |
+| `/_tags/collect` | POST | allowed origin or server bearer token | Browser/server telemetry, validated and fail-soft |
+
+The editor shows draft and live revision independently; **saving never fires edited tags**. Preview is pure and does not send to GA4/webhooks or internal storage. Publish rejects missing GA4 credentials or webhook destination references; credentials, actual URL/headers and OAuth tokens are always supplied by trusted server configuration, never dashboard JSON. Rollback preserves the current draft so a publisher may fix/re-publish it later. Revisions are monotonic and concurrent conflicting writers receive HTTP 409. The atomic single-document scheme supports a 12-entry release history, compacted further to keep the complete document below 58,000 bytes for portable SQL `TEXT` implementations. Oversized definitions are rejected until simplified; historical snapshots pruned by the retention policy are not available for rollback. A rollback is a new release, not mutation of old history.
+
+`ttag('config', {site:..., debug:...})` is **no longer accepted**: an untrusted web page may not change the server-issued tenant or debug policy. Arbitrary JavaScript/HTML tags are **not supported**. The studio uses an exact SHA-256 hash for inline script CSP, with scripts otherwise denied; it also denies framing and uses no-store responses. Automatic click/form listeners avoid form field values, text contents and URLs. Browser telemetry uses opaque random request IDs, bounded scalar properties and client-side consent. `ttag('consent','denied')` discards queued events. `defaultConsent:'denied'` gates `astag` until it receives `astag('consent','granted')`, and enables consent checks on browser ingestion by default. The collector drops explicit `denied` claims and, with `requireBrowserConsent:true`, ignores unknown consent. **A browser's `granted` claim cannot prove legal consent**: host consent management and privacy policies remain essential. `siteByOrigin` should be configured for every public origin in multi-tenant deployments; collection-side binding rejects mismatched site assertions. The system never infers identity from IPs or browser fingerprints.
+
+External destinations have independently bounded 1-second timeouts and failures isolate each tag, with sanitized warnings. Webhook destinations must use public HTTPS DNS hostnames and redirects are disallowed; this **does not remove DNS-rebinding risk**. Enforce outbound DNS/IP allowlists and egress firewall rules in your deployment. GA4 HTTP acceptance is not proof of Google-side processing. No arbitrary remote script execution, guaranteed browser delivery, distributed rate limiting, replay queue or unbounded GTM/GA4 feature parity is provided. Large production deployments should migrate release snapshots to a normalized transactional release table rather than depending on the capped JSON envelope.

package/dist/browser.d.ts

@@ -0,0 +1,8 @@
+/** No browser bundles/dependencies required: the generated bootstrap is self-contained. */
+export declare function browserScript(config: {
+    endpoint: string;
+    site: string;
+    debug: boolean;
+    autoEvents?: string[];
+    defaultConsent?: 'granted' | 'denied';
+}): string;

package/dist/browser.js

@@ -0,0 +1,52 @@
+/** No browser bundles/dependencies required: the generated bootstrap is self-contained. */
+export function browserScript(config) {
+    const settings = JSON.stringify(config).replace(/</g, '\\u003c');
+    return `(function(){'use strict';
+if(window.__zeruxTtagLoaded===true)return;window.__zeruxTtagLoaded=true;
+var cfg=${settings}, alphabet='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
+var data=window.dataLayer=Array.isArray(window.dataLayer)?window.dataLayer:[];
+var state=Object.create(null),consent=cfg.defaultConsent||'granted',pending=[],scheduled=false;
+function makeId(){if(!window.crypto||!window.crypto.getRandomValues)throw new Error('Secure random unavailable');var str='';while(str.length<16){var bytes=new Uint8Array(32);window.crypto.getRandomValues(bytes);for(var i=0;i<bytes.length&&str.length<16;i++){if(bytes[i]<248)str+=alphabet.charAt(bytes[i]%62);}}return str;}
+function safe(v){var out=Object.create(null);if(!v||typeof v!=='object'||Array.isArray(v))return out;
+  var keys=Object.keys(v);for(var i=0;i<Math.min(keys.length,40);i++){var k=keys[i],val=v[k];
+    if(!/^[A-Za-z][A-Za-z0-9_.:-]{0,95}$/.test(k)||k==='constructor'||k==='prototype'||k==='__proto__'||k==='zRequestId'||k==='zRequestUtcDay')continue;
+    if(val===null||typeof val==='boolean'||typeof val==='string'&&val.length<=1024||typeof val==='number'&&Number.isFinite(val))out[k]=val;
+  }return out;}
+function log(){if(cfg.debug&&window.console&&console.debug)console.debug.apply(console,['[ttag]'].concat(Array.prototype.slice.call(arguments)));}
+function send(item,attempt){if(consent!=='granted')return;var body=JSON.stringify(item);try{
+  if(navigator.sendBeacon){var blob=new Blob([body],{type:'text/plain;charset=UTF-8'});if(navigator.sendBeacon(cfg.endpoint,blob)){log('beacon queued',item.requestId);return;}}
+  if(window.fetch){fetch(cfg.endpoint,{method:'POST',headers:{'content-type':'text/plain;charset=UTF-8'},body:body,keepalive:true,credentials:'omit',cache:'no-store'}).then(function(res){if(res.status===409&&(attempt||0)<1&&consent==='granted'){item.requestId=makeId();send(item,1);}}).catch(function(){log('delivery unavailable');});}
+}catch(e){log('delivery unavailable');}}
+function flush(){scheduled=false;var batch=pending.splice(0);for(var i=0;i<batch.length;i++)send(batch[i]);}
+function queue(event){if(consent!=='granted')return null;var id=makeId();
+  var item={requestId:id,name:String(event.event),source:'web',site:cfg.site,pathname:location.pathname,consent:'granted',properties:safe(event.properties),data:safe(state)};
+  if(typeof state.sessionId==='string'&&state.sessionId.length<=128)item.sessionId=state.sessionId;
+  pending.push(item);if(!scheduled){scheduled=true;Promise.resolve().then(flush);}return id;
+}
+var originalPush=data.push.bind(data);
+data.push=function(){var result=originalPush.apply(data,arguments);for(var i=0;i<arguments.length;i++){var item=arguments[i];if(item&&typeof item==='object'&&!Array.isArray(item)&&typeof item.event==='string'&&item.event)queue(item);}return result;};
+function ttag(command,a,b){if(command==='event'){
+    var event={event:String(a),properties:safe(b)};originalPush(event);return queue(event);
+  }
+  if(command==='set'){if(typeof a==='string'&&/^[A-Za-z][A-Za-z0-9_.:-]{0,95}$/.test(a)&&a!=='constructor'&&a!=='prototype'&&a!=='__proto__'&&(typeof b==='string'&&b.length<=1024||typeof b==='number'&&Number.isFinite(b)||typeof b==='boolean'||b===null)){state[a]=b;data.push({set:a,value:b});return true;}return false;}
+  if(command==='get')return a==='site'?cfg.site:a==='debug'?cfg.debug:state[a];
+  if(command==='consent'){if(a==='granted'||a==='denied'){consent=a;if(a==='denied')pending.length=0;log('consent',a);return true;}return false;}
+  if(command==='config')return false; // Site and debug flags are controlled by the server.
+  return false;
+}
+window.ttag=ttag;
+for(var i=0,initial=data.slice();i<initial.length;i++)if(initial[i]&&typeof initial[i].event==='string')queue(initial[i]);
+if(document.addEventListener){document.addEventListener('visibilitychange',function(){if(document.visibilityState==='hidden')flush();});window.addEventListener('pagehide',flush);
+ var auto=cfg.autoEvents||[];
+ if(auto.indexOf('pageview')!==-1)ttag('event','page_view',{path:location.pathname});
+ if(auto.indexOf('click')!==-1)document.addEventListener('click',function(e){var el=e.target&&e.target.closest?e.target.closest('a,button,[data-ttag-click]'):null;if(!el)return;
+   ttag('event','click',{element:String(el.tagName||'').toLowerCase().slice(0,30),element_id:String(el.id||'').slice(0,96)});
+ },{capture:true,passive:true});
+ if(auto.indexOf('form')!==-1)document.addEventListener('submit',function(e){var el=e.target;
+   ttag('event','form_submit',{form_id:String(el&&el.id||'').slice(0,96)});
+ },{capture:true,passive:true});
+ if(auto.indexOf('history')!==-1)window.addEventListener('popstate',function(){ttag('event','history_change',{path:location.pathname});});
+ }
+log('initialized');
+})();`;
+}

package/dist/container.d.ts

@@ -0,0 +1,4 @@
+import type { TagContainer, TagContainerStore } from './types.js';
+export declare function validateContainer(data: unknown): TagContainer;
+export declare function createMemoryTagStore(initial: TagContainer): TagContainerStore;
+export declare const emptyTagContainer: (id?: string) => TagContainer;

package/dist/container.js

@@ -0,0 +1,96 @@
+const ident = /^[A-Za-z][A-Za-z0-9_.:-]{0,95}$/;
+const valid = (name) => typeof name === 'string' && ident.test(name);
+// eslint-disable-next-line no-control-regex -- Intentionally matches control characters for validation or output sanitization.
+const label = (s) => typeof s === 'string' && s.length >= 1 && s.length <= 128 && !/[\x00-\x1f]/.test(s);
+const scalar = (v) => v === null || typeof v === 'boolean' || (typeof v === 'string' && v.length <= 1024) || (typeof v === 'number' && Number.isFinite(v));
+export function validateContainer(data) {
+    if (!data || typeof data !== 'object' || Array.isArray(data))
+        throw new TypeError('Invalid tag container');
+    const c = data;
+    if (!valid(c.id) || !Number.isSafeInteger(c.version) || c.version < 1 || typeof c.name !== 'string' || c.name.length > 128)
+        throw new TypeError('Invalid container identity');
+    if (!Array.isArray(c.triggers) || !Array.isArray(c.tags) || !Array.isArray(c.variables) || c.triggers.length > 200 || c.tags.length > 200 || c.variables.length > 200)
+        throw new TypeError('Invalid container limits');
+    const ids = new Set();
+    const register = (id) => { if (!valid(id) || ids.has(id))
+        throw new TypeError('Invalid or duplicate tag ID'); ids.add(id); };
+    for (const t of c.triggers) {
+        register(t.id);
+        if (!label(t.name) || !['event', 'all', 'pageview', 'click', 'form', 'history'].includes(t.type) || t.enabled !== undefined && typeof t.enabled !== 'boolean' || t.type === 'event' && !valid(t.event))
+            throw new TypeError('Invalid trigger');
+        if (t.conditions !== undefined) {
+            if (!Array.isArray(t.conditions) || t.conditions.length > 20)
+                throw new TypeError('Too many trigger conditions');
+            for (const cond of t.conditions)
+                if (!valid(cond.field) || !['eq', 'neq', 'contains', 'exists', 'gte', 'lte'].includes(cond.operator) || cond.value !== undefined && !scalar(cond.value))
+                    throw new TypeError('Invalid trigger condition');
+        }
+    }
+    for (const v of c.variables) {
+        register(v.id);
+        if (!label(v.name) || !['constant', 'event', 'dataLayer', 'context'].includes(v.type) || v.key !== undefined && !valid(v.key) || v.value !== undefined && !scalar(v.value))
+            throw new TypeError('Invalid variable');
+    }
+    for (const t of c.tags) {
+        register(t.id);
+        if (!label(t.name) || !['analytics', 'ga4', 'webhook'].includes(t.type) || !Array.isArray(t.triggerIds) || !t.triggerIds.length || t.triggerIds.length > 40 || t.enabled !== undefined && typeof t.enabled !== 'boolean' || t.triggerIds.some(id => !c.triggers.some(trigger => trigger.id === id)))
+            throw new TypeError('Invalid tag');
+        if (t.eventName !== undefined && !valid(t.eventName))
+            throw new TypeError('Invalid destination event');
+        if (t.type === 'ga4' && (!t.measurementId || !/^G-[A-Z0-9]{5,20}$/.test(t.measurementId) || !valid(t.credentialRef)))
+            throw new TypeError('Invalid GA4 tag');
+        if (t.type === 'webhook' && !valid(t.destinationRef))
+            throw new TypeError('Invalid destination reference');
+        if (t.clientIdVariable !== undefined && !c.variables.some(v => v.id === t.clientIdVariable))
+            throw new TypeError('Unknown client ID variable');
+        if (t.parameters !== undefined) {
+            if (!t.parameters || Array.isArray(t.parameters) || Object.keys(t.parameters).length > 25)
+                throw new TypeError('Invalid parameters');
+            for (const [key, value] of Object.entries(t.parameters)) {
+                if (!valid(key) || ['zRequestId', 'zRequestUtcDay', '__proto__', 'constructor', 'prototype'].includes(key) || !scalar(value))
+                    throw new TypeError('Invalid parameter');
+                if (typeof value === 'string' && (value.includes('{{') || value.includes('}}'))) {
+                    const match = /^\{\{([A-Za-z][A-Za-z0-9_.:-]{0,95})\}\}$/.exec(value);
+                    if (!match || !c.variables.some(variable => variable.id === match[1]))
+                        throw new TypeError('Unknown or malformed parameter variable');
+                }
+            }
+        }
+    }
+    // Strip unrecognized object keys and prototypes, preventing accidental disclosure of secrets.
+    const base = JSON.parse(JSON.stringify({ id: c.id, version: c.version, name: c.name, triggers: c.triggers.map(({ id, name, type, event, conditions, enabled }) => ({ id, name, type, event, conditions, enabled })), variables: c.variables.map(({ id, name, type, key, value }) => ({ id, name, type, key, value })), tags: c.tags.map(({ id, name, type, triggerIds, enabled, eventName, measurementId, credentialRef, destinationRef, clientIdVariable, parameters }) => ({ id, name, type, triggerIds, enabled, eventName, measurementId, credentialRef, destinationRef, clientIdVariable, parameters })) }));
+    if (c.governance !== undefined) {
+        const g = c.governance;
+        if (!g || typeof g !== 'object' || Array.isArray(g) || !Number.isSafeInteger(g.release) || g.release < 1 || !Array.isArray(g.history) || g.history.length < 1 || g.history.length > 12)
+            throw new TypeError('Invalid release metadata');
+        const snapshot = (raw) => {
+            if (!raw || typeof raw !== 'object' || Object.hasOwn(raw, 'governance'))
+                throw new TypeError('Nested releases are forbidden');
+            const value = validateContainer(raw);
+            if (value.id !== base.id)
+                throw new TypeError('Cross-container release rejected');
+            return value;
+        };
+        const published = snapshot(g.published), history = g.history.map(entry => {
+            if (!entry || !Number.isSafeInteger(entry.id) || entry.id < 1 || typeof entry.at !== 'string' || !/^\d{4}-\d{2}-\d{2}T/.test(entry.at) ||
+                !['initial', 'publish', 'rollback'].includes(entry.action))
+                throw new TypeError('Invalid release history');
+            return { id: entry.id, at: entry.at, action: entry.action, container: snapshot(entry.container) };
+        });
+        if (history.some((entry, i) => i > 0 && entry.id <= history[i - 1].id) || history.at(-1)?.id !== g.release ||
+            JSON.stringify(history.at(-1)?.container) !== JSON.stringify(published))
+            throw new TypeError('Incoherent release history');
+        base.governance = { release: g.release, published, history };
+    }
+    return base;
+}
+export function createMemoryTagStore(initial) {
+    let current = validateContainer(initial);
+    return { async load() { return structuredClone(current); }, async save(next, expected) {
+            if (expected !== current.version || next.version !== expected + 1)
+                return false;
+            current = validateContainer(next);
+            return true;
+        } };
+}
+export const emptyTagContainer = (id = 'default') => ({ id, name: 'Default', version: 1, triggers: [{ id: 'all_events', name: 'All Events', type: 'all', enabled: true }], tags: [{ id: 'internal_analytics', name: 'Internal Analytics', type: 'analytics', triggerIds: ['all_events'], enabled: true }], variables: [] });

package/dist/dashboard.d.ts

@@ -0,0 +1 @@
+export declare function dashboard(prefix: string): string;

package/dist/dashboard.js

@@ -0,0 +1,51 @@
+export function dashboard(prefix) {
+    const api = JSON.stringify(prefix + '/admin/api');
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Zerux Tags — Container Manager</title><style>
+:root{color-scheme:light dark;font:15px system-ui,sans-serif}body{max-width:1000px;margin:0 auto;padding:22px}h1{margin-bottom:3px}p{color:#777}
+nav{display:flex;gap:8px;flex-wrap:wrap;margin:22px 0}button{cursor:pointer;border:1px solid #888;border-radius:6px;padding:9px 14px;background:transparent;color:inherit}button:hover{opacity:.8}
+section{border:1px solid #8885;padding:16px;border-radius:10px;margin:12px 0}label{display:block;margin:8px 0}input,select,textarea{padding:10px;box-sizing:border-box;width:100%;border:1px solid #8887;border-radius:6px;background:transparent;color:inherit}textarea{min-height:160px;font:13px monospace}
+.two{display:grid;grid-template-columns:1fr 1fr;gap:12px}.help{font-size:13px}pre{white-space:pre-wrap;overflow-wrap:anywhere}strong{color:inherit}.small{font-size:12px}
+</style></head><body><h1>Zerux Tags</h1><p>Versioned triggers, tags and variables. All destination credentials stay on the server.</p>
+<nav><button id="reload">Reload</button><button id="addTrigger">Add trigger</button><button id="addVariable">Add variable</button><button id="addTag">Add tag</button><button id="save">Save draft</button><button id="publish">Publish draft</button><button id="test">Dry-run trigger</button></nav>
+<main><section><label>Container name<input id="name"></label><div class="small" id="version"></div><div class="small" id="release"></div></section>
+<section><h2>Triggers</h2><div id="triggers"></div></section><section><h2>Variables</h2><div id="variables"></div></section><section><h2>Tags</h2><div id="tags"></div></section>
+<section><h2>Release history and rollback</h2><label>Restore published release<select id="rollbackRelease"></select></label><button id="rollback">Roll back live release</button><p class="help">Rollback changes the live version without deleting the current draft. Publishing requires an independent publisher role.</p></section>
+<section><h2>Dry-run debug</h2><label>Inspect<select id="previewMode"><option value="draft">Draft</option><option value="published">Published</option></select></label><label>Event name<input id="testEvent" value="page_view"></label><label>Properties JSON<textarea id="testProps" spellcheck="false">{}</textarea></label><pre id="testOutput"></pre></section>
+<section><h2>Advanced JSON editor</h2><p class="help">Edit the draft. Save increments its revision; publish is a separate authorized operation. A 409 requires reload and re-apply.</p><textarea id="editor" spellcheck="false"></textarea></section>
+<pre role="status" aria-live="polite" id="status"></pre></main>
+<script>(function(){'use strict';const api=${api},$=id=>document.getElementById(id);let current,latestStatus;
+const say=t=>$('status').textContent=t;
+const input=(label,val,callback)=>{const box=document.createElement('label');box.textContent=label;const el=document.createElement('input');el.value=val==null?'':String(val);el.onchange=()=>callback(el.value);box.append(el);return box;};
+function picker(label,value,options,cb){const box=document.createElement('label');box.textContent=label;const select=document.createElement('select');for(const entry of options){const option=document.createElement('option');option.value=entry;option.textContent=entry;select.append(option);}select.value=value;select.onchange=()=>cb(select.value);box.append(select);return box;}
+function renderList(id,arr,fields){const container=$(id);container.replaceChildren();arr.forEach((obj,i)=>{const section=document.createElement('section');const title=document.createElement('strong');title.textContent=obj.name||obj.id;section.append(title);
+ fields.forEach(([field,name])=>section.append(input(name,obj[field],v=>{obj[field]=v;render();})));
+ if(id==='triggers'){section.append(picker('Trigger type',obj.type,['all','event','pageview','click','form','history'],v=>{obj.type=v;render();}));section.append(input('Conditions (JSON)',JSON.stringify(obj.conditions||[]),v=>{try{obj.conditions=JSON.parse(v);render();}catch{say('Invalid conditions JSON');}}));}
+ if(id==='variables'){section.append(picker('Variable type',obj.type,['constant','event','dataLayer','context'],v=>{obj.type=v;render();}));section.append(input('Constant value',obj.value??'',v=>{obj.value=v;render();}));}
+ if(id==='tags'){section.append(picker('Tag destination',obj.type,['analytics','ga4','webhook'],v=>{obj.type=v;render();}));
+ for(const field of ['measurementId','credentialRef','destinationRef','clientIdVariable'])section.append(input(field,obj[field],v=>{obj[field]=v;render();}));
+ section.append(input('Trigger IDs (comma-separated)',obj.triggerIds.join(','),v=>{obj.triggerIds=v.split(',').map(x=>x.trim()).filter(Boolean);render();}));}
+ const del=document.createElement('button');del.textContent='Delete';del.onclick=()=>{arr.splice(i,1);render();};section.append(del);container.append(section);});}
+function render(){if(!current)return;$('name').value=current.name;$('version').textContent='Draft revision: '+current.version;
+ renderList('triggers',current.triggers,[['id','ID'],['name','Name'],['event','Event (for event trigger)']]);
+ renderList('variables',current.variables,[['id','ID'],['name','Name'],['key','Property key']]);
+ renderList('tags',current.tags,[['id','ID'],['name','Name'],['eventName','Event override']]);
+ $('editor').value=JSON.stringify(current,null,2);}
+async function load(){try{const r=await fetch(api,{credentials:'same-origin',cache:'no-store'});if(!r.ok)throw Error('HTTP '+r.status);current=await r.json();render();await refreshStatus();say('Draft loaded');}catch(e){say('Load failed: '+e.message);}}
+async function refreshStatus(){const r=await fetch(api.slice(0,-3)+'status',{credentials:'same-origin',cache:'no-store'});if(!r.ok)throw Error('Status HTTP '+r.status);latestStatus=await r.json();
+ $('release').textContent='Published release: '+latestStatus.publishedRelease+' (draft unpublished: '+latestStatus.unpublishedChanges+')';
+ const picker=$('rollbackRelease');picker.replaceChildren();for(const entry of latestStatus.history.slice().reverse()){
+  const option=document.createElement('option');option.value=String(entry.id);option.textContent='#'+entry.id+' '+entry.action+' at '+entry.at;picker.append(option);
+ }}
+async function transition(endpoint,body){const r=await fetch(api.slice(0,-3)+endpoint,{method:'POST',credentials:'same-origin',headers:{'content-type':'application/json'},body:JSON.stringify(body)});
+ const payload=await r.json();if(!r.ok)throw Error(payload.error||r.status);await load();return payload;}
+$('reload').onclick=load;$('name').onchange=e=>{current.name=e.target.value;render();};
+$('addTrigger').onclick=()=>{const id='trigger_'+Date.now().toString(36);current.triggers.push({id,name:id,type:'event',event:'page_view'});render();};
+$('addVariable').onclick=()=>{const id='var_'+Date.now().toString(36);current.variables.push({id,name:id,type:'event',key:'value'});render();};
+$('addTag').onclick=()=>{const id='tag_'+Date.now().toString(36);current.tags.push({id,name:id,type:'analytics',triggerIds:[current.triggers[0]?.id||'all_events']});render();};
+$('test').onclick=async()=>{try{const res=await fetch(api.slice(0,-3)+'preview',{method:'POST',credentials:'same-origin',headers:{'content-type':'application/json'},body:JSON.stringify({name:$('testEvent').value,properties:JSON.parse($('testProps').value),mode:$('previewMode').value})});$('testOutput').textContent=JSON.stringify(await res.json(),null,2);}catch(e){say('Preview failed: '+e.message);}};
+$('save').onclick=async()=>{try{const proposal=JSON.parse($('editor').value);delete proposal.governance;proposal.version=current.version+1;const r=await fetch(api,{method:'PUT',credentials:'same-origin',headers:{'content-type':'application/json'},body:JSON.stringify(proposal)});const body=await r.json();if(!r.ok)throw Error(body.error||r.status);current=proposal;await load();say('Saved draft revision '+body.version+'; not live until published');}catch(e){say('Publish failed: '+e.message);}};
+$('publish').onclick=async()=>{try{await transition('publish',{expectedVersion:current.version});say('Draft published successfully');}catch(e){say('Publish failed: '+e.message);}};
+$('rollback').onclick=async()=>{try{const id=Number($('rollbackRelease').value);if(!Number.isSafeInteger(id))throw Error('Select a release');await transition('rollback',{expectedVersion:current.version,releaseId:id});say('Live release rolled back; draft unchanged');}catch(e){say('Rollback failed: '+e.message);}};
+load();})();</script></body></html>`;
+}

package/dist/governance.d.ts

@@ -0,0 +1,20 @@
+/** Durable governance is stored inside the same version-CAS document as the draft.
+ * A worker can never observe a partial draft/publish transition. */
+import type { TagContainer, TagContainerStore } from './types.js';
+/** Existing single-container documents are treated as release #1 until the first edit. */
+export declare function publishedContainer(document: TagContainer): TagContainer;
+export declare function releaseSummary(document: TagContainer): {
+    draftRevision: number;
+    publishedRelease: number;
+    publishedRevision: number;
+    unpublishedChanges: boolean;
+    history: {
+        id: number;
+        at: string;
+        action: "initial" | "publish" | "rollback";
+        revision: number;
+    }[];
+};
+export declare function saveTagDraft(store: TagContainerStore, next: TagContainer, expectedVersion: number): Promise<boolean>;
+export declare function publishTagDraft(store: TagContainerStore, expectedVersion: number): Promise<boolean>;
+export declare function rollbackTagRelease(store: TagContainerStore, expectedVersion: number, releaseId: number): Promise<boolean>;

package/dist/governance.js

@@ -0,0 +1,62 @@
+import { validateContainer } from './container.js';
+function snapshot(input) {
+    const { governance: _unused, ...definition } = input;
+    return validateContainer(definition);
+}
+/** analytics_tag_containers uses a portable SQL TEXT field (MySQL <= 64 KiB).
+ * Prune oldest retained releases before updating the CAS row; never prune live. */
+const MAX_DOCUMENT_BYTES = 58_000;
+function bounded(document) {
+    const checked = validateContainer(document);
+    while (Buffer.byteLength(JSON.stringify(checked), 'utf8') > MAX_DOCUMENT_BYTES && (checked.governance?.history.length ?? 0) > 1) {
+        checked.governance.history.shift();
+    }
+    if (Buffer.byteLength(JSON.stringify(checked), 'utf8') > MAX_DOCUMENT_BYTES)
+        throw new RangeError('Tag release document exceeds portable storage limit');
+    return checked;
+}
+function initial(input) {
+    const base = snapshot(input);
+    return { release: 1, published: base, history: [{ id: 1, at: new Date().toISOString(), action: 'initial', container: base }] };
+}
+function append(g, container, action) {
+    const published = snapshot(container), release = g.release + 1;
+    const record = { id: release, at: new Date().toISOString(), action, container: published };
+    return { release, published, history: [...g.history, record].slice(-12) };
+}
+/** Existing single-container documents are treated as release #1 until the first edit. */
+export function publishedContainer(document) {
+    const parsed = validateContainer(document);
+    return snapshot(parsed.governance?.published ?? parsed);
+}
+export function releaseSummary(document) {
+    const parsed = validateContainer(document), g = parsed.governance ?? initial(parsed);
+    return { draftRevision: parsed.version, publishedRelease: g.release, publishedRevision: g.published.version,
+        unpublishedChanges: JSON.stringify(snapshot(parsed)) !== JSON.stringify(g.published),
+        history: g.history.map(({ id, at, action, container }) => ({ id, at, action, revision: container.version })) };
+}
+export async function saveTagDraft(store, next, expectedVersion) {
+    const current = validateContainer(await store.load());
+    if (current.version !== expectedVersion || next.version !== expectedVersion + 1 || next.id !== current.id)
+        return false;
+    // Governance is server-controlled; ignore any metadata sent by the editor.
+    return store.save(bounded({ ...snapshot(next), governance: current.governance ?? initial(current) }), expectedVersion);
+}
+export async function publishTagDraft(store, expectedVersion) {
+    const current = validateContainer(await store.load());
+    if (current.version !== expectedVersion)
+        return false;
+    const governance = append(current.governance ?? initial(current), current, 'publish');
+    return store.save(bounded({ ...current, version: current.version + 1, governance }), expectedVersion);
+}
+export async function rollbackTagRelease(store, expectedVersion, releaseId) {
+    const current = validateContainer(await store.load());
+    if (current.version !== expectedVersion)
+        return false;
+    const governance = current.governance ?? initial(current);
+    const entry = governance.history.find(item => item.id === releaseId);
+    if (!entry)
+        throw new RangeError('Release not available in retained history');
+    const updated = append(governance, entry.container, 'rollback');
+    return store.save(bounded({ ...current, version: current.version + 1, governance: updated }), expectedVersion);
+}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export * from './types.js';
+export * from './container.js';
+export * from './runtime.js';
+export * from './browser.js';
+export * from './governance.js';

package/dist/index.js

@@ -0,0 +1,5 @@
+export * from './types.js';
+export * from './container.js';
+export * from './runtime.js';
+export * from './browser.js';
+export * from './governance.js';

package/dist/runtime.d.ts

@@ -0,0 +1,24 @@
+import type { TagContainer, TagEvent, TagRuntimeOptions, TagContainerStore } from './types.js';
+export declare function createTagManager(options: TagRuntimeOptions): {
+    createAstag: (context?: {
+        requestId?: string;
+        requestUtcDay?: string;
+        site?: string;
+        pathname?: string;
+        sessionId?: string;
+    }) => (command: "event" | "config" | "set" | "get" | "consent", arg?: string | Record<string, unknown>, value?: unknown) => Promise<unknown>;
+    evaluate: (event: TagEvent) => Promise<{
+        requestId: string;
+        requestUtcDay: string;
+        matchedTriggers: string[];
+        firedTags: string[];
+        failures: string[];
+    }>;
+    container: () => Promise<TagContainer>;
+    published: () => Promise<TagContainer>;
+    store: TagContainerStore;
+    routes(): {
+        pattern: string;
+        handler: (request: Request) => Promise<Response>;
+    }[];
+};

package/dist/runtime.js

@@ -0,0 +1,357 @@
+import { createAnalyticsCollector, requestUtcDay, reserveNewRequestId, validRequestId } from '@zeruxjs/analytics';
+import { createHash } from 'node:crypto';
+import { isIP } from 'node:net';
+import { createMemoryTagStore, emptyTagContainer, validateContainer } from './container.js';
+import { browserScript } from './browser.js';
+import { publishedContainer, releaseSummary, saveTagDraft, publishTagDraft, rollbackTagRelease } from './governance.js';
+import { dashboard } from './dashboard.js';
+const nameRe = /^[A-Za-z][A-Za-z0-9_.:-]{0,95}$/;
+const safeName = (name) => typeof name === 'string' && nameRe.test(name);
+const json = (body, status = 200) => new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json', 'cache-control': 'no-store', 'x-content-type-options': 'nosniff' } });
+const pathOk = (s) => /^\/[A-Za-z0-9/_-]*$/.test(s) && s !== '/' && !s.includes('//') && !s.endsWith('/');
+const scalar = (v) => v === null || typeof v === 'string' && v.length <= 1024 || typeof v === 'number' && Number.isFinite(v) || typeof v === 'boolean';
+const cleanValues = (values) => {
+    if (!values || typeof values !== 'object' || Array.isArray(values) || Object.keys(values).length > 40)
+        throw new TypeError('Invalid tag values');
+    const result = Object.create(null);
+    for (const [k, v] of Object.entries(values)) {
+        if (!safeName(k) || ['__proto__', 'constructor', 'prototype', 'zRequestId', 'zRequestUtcDay'].includes(k) || !scalar(v))
+            throw new TypeError('Invalid tag values');
+        result[k] = v;
+    }
+    return result;
+};
+function resolveVariable(variable, ev) {
+    if (variable.type === 'constant')
+        return variable.value;
+    if (!variable.key)
+        return undefined;
+    if (variable.type === 'event')
+        return ev.properties[variable.key];
+    if (variable.type === 'dataLayer')
+        return ev.data?.[variable.key];
+    if (variable.type === 'context') {
+        const context = { requestId: ev.requestId, requestUtcDay: ev.requestUtcDay, source: ev.source, site: ev.site, pathname: ev.pathname, sessionId: ev.sessionId, name: ev.name };
+        return context[variable.key];
+    }
+}
+/** Template parameters reference only registered variables, with no eval or dynamic code. */
+function tagParameters(tag, event, container) {
+    const params = Object.create(null);
+    for (const [key, value] of Object.entries(tag.parameters ?? {})) {
+        if (typeof value === 'string') {
+            const match = /^\{\{([A-Za-z][A-Za-z0-9_.:-]{0,95})\}\}$/.exec(value);
+            if (match) {
+                const variable = container.variables.find(v => v.id === match[1]);
+                const resolved = variable ? resolveVariable(variable, event) : undefined;
+                if (resolved !== undefined)
+                    params[key] = resolved;
+                continue;
+            }
+        }
+        params[key] = value;
+    }
+    return params;
+}
+function matchesCondition(condition, ev, container) {
+    const v = container.variables.find(x => x.id === condition.field);
+    const actual = v ? resolveVariable(v, ev) : ev.properties[condition.field] ?? ev.data?.[condition.field];
+    const expected = condition.value;
+    switch (condition.operator) {
+        case 'exists': return actual !== undefined && actual !== null;
+        case 'eq': return actual === expected;
+        case 'neq': return actual !== expected;
+        case 'contains': return typeof actual === 'string' && typeof expected === 'string' && actual.includes(expected);
+        case 'gte': return typeof actual === 'number' && typeof expected === 'number' && actual >= expected;
+        case 'lte': return typeof actual === 'number' && typeof expected === 'number' && actual <= expected;
+    }
+}
+export function createTagManager(options) {
+    if (!options?.analytics || !options?.requestIds)
+        throw new TypeError('Analytics and request ID store are required');
+    const prefix = options.prefix ?? '/_tags';
+    if (!pathOk(prefix))
+        throw new TypeError('Invalid tag endpoint path');
+    if (options.dashboardHost && !/^[A-Za-z0-9.-]+(?::\d{2,5})?$/.test(options.dashboardHost))
+        throw new TypeError('Invalid tag dashboard host');
+    if (options.publicOrigin) {
+        const url = new URL(options.publicOrigin);
+        if ((url.protocol !== 'https:' && !(url.protocol === 'http:' && ['localhost', '127.0.0.1'].includes(url.hostname))) || url.pathname !== '/' || url.search || url.hash || url.username || url.password)
+            throw new TypeError('Invalid public tagging origin');
+    }
+    const store = options.store ?? createMemoryTagStore(options.container ?? emptyTagContainer());
+    const http = options.fetch ?? fetch;
+    const warn = (message) => { try {
+        (options.onWarning ?? console.warn)(`[zerux tags] ${message}`);
+    }
+    catch { /* telemetry warnings cannot block traffic */ } };
+    const configuredDestinations = options.destinations ?? {};
+    for (const destination of Object.values(configuredDestinations)) {
+        const url = new URL(destination.url);
+        if (url.protocol !== 'https:' || url.username || url.password || url.hash || !url.hostname || isIP(url.hostname) !== 0 || url.hostname.startsWith('[') || /^(localhost|.+\.(?:localhost|local|internal))\.?$/i.test(url.hostname))
+            throw new TypeError('Webhook destinations must be public HTTPS DNS endpoints');
+    }
+    const triggerMatches = (type, name, eventName) => type === 'all' ||
+        type === 'event' && eventName === name || type === 'pageview' && ['page_view', 'page.view'].includes(name) ||
+        type === 'click' && name === 'click' || type === 'form' && name === 'form_submit' || type === 'history' && name === 'history_change';
+    async function evaluate(event) {
+        let container;
+        try {
+            container = publishedContainer(await store.load());
+        }
+        catch {
+            warn('Published container unavailable');
+            return { requestId: event.requestId, requestUtcDay: event.requestUtcDay, matchedTriggers: [], firedTags: [], failures: ['container_unavailable'] };
+        }
+        const matched = container.triggers.filter(t => t.enabled !== false &&
+            triggerMatches(t.type, event.name, t.event) &&
+            (t.conditions ?? []).every(condition => matchesCondition(condition, event, container)));
+        const ids = new Set(matched.map(t => t.id)), firedTags = [], failures = [];
+        for (const tag of container.tags) {
+            if (tag.enabled === false || !tag.triggerIds.some(id => ids.has(id)))
+                continue;
+            try {
+                const params = tagParameters(tag, event, container);
+                if (tag.type === 'analytics') {
+                    await options.analytics.track({ name: tag.eventName ?? event.name, source: event.source, site: event.site, pathname: event.pathname, sessionId: event.sessionId, requestId: event.requestId, requestUtcDay: event.requestUtcDay, properties: { ...event.properties, ...params } });
+                }
+                else if (tag.type === 'ga4') {
+                    const secret = options.credentials?.[tag.credentialRef ?? '']?.secret;
+                    if (!secret)
+                        throw new Error('Missing GA4 credential');
+                    const variable = container.variables.find(v => v.id === tag.clientIdVariable);
+                    const clientId = variable ? resolveVariable(variable, event) : event.sessionId;
+                    if (typeof clientId !== 'string' || !clientId || clientId.length > 128)
+                        throw new Error('GA4 client_id must be supplied explicitly');
+                    const url = new URL('https://www.google-analytics.com/mp/collect');
+                    url.searchParams.set('measurement_id', tag.measurementId);
+                    url.searchParams.set('api_secret', secret);
+                    const response = await http(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ client_id: clientId, events: [{ name: tag.eventName ?? event.name, params: { ...event.properties, ...params, zerux_request_id: event.requestId } }] }), signal: AbortSignal.timeout(1000) });
+                    if (!response.ok)
+                        throw new Error('GA4 endpoint rejected request');
+                }
+                else {
+                    const destination = configuredDestinations[tag.destinationRef ?? ''];
+                    if (!destination)
+                        throw new Error('Missing allowlisted destination');
+                    const response = await http(destination.url, { method: 'POST', headers: { ...destination.headers, 'content-type': 'application/json' }, body: JSON.stringify({ event: tag.eventName ?? event.name, requestId: event.requestId, utcDay: event.requestUtcDay, site: event.site, properties: event.properties, parameters: params }), signal: AbortSignal.timeout(1000), redirect: 'error' });
+                    if (!response.ok)
+                        throw new Error('Destination rejected request');
+                }
+                firedTags.push(tag.id);
+            }
+            catch {
+                failures.push(tag.id);
+                warn(`Destination failed for tag ${tag.id}`);
+            } // Tags are isolated, never block other tags.
+        }
+        const result = { requestId: event.requestId, requestUtcDay: event.requestUtcDay, matchedTriggers: [...ids], firedTags, failures };
+        if (options.debug)
+            try {
+                options.onDebug?.({ requestId: event.requestId, event: event.name, matchedTriggers: result.matchedTriggers, firedTags, failures });
+            }
+            catch { /* This optional failure is intentionally ignored. */ }
+        return result;
+    }
+    /** Server-side event entry point; request IDs may be shared within a single caller request scope. */
+    function createAstag(context = {}) {
+        const layer = Object.create(null);
+        const conf = { site: context.site ?? options.site, pathname: context.pathname, sessionId: context.sessionId };
+        let consent = options.defaultConsent ?? 'granted';
+        const reservedDay = context.requestUtcDay ?? requestUtcDay();
+        let allocated;
+        async function ensureId() {
+            if (!allocated) {
+                const day = reservedDay;
+                allocated = (async () => {
+                    if (context.requestId) {
+                        if (!validRequestId(context.requestId))
+                            throw new TypeError('Invalid request ID');
+                        if (!await options.requestIds.reserve(day, context.requestId))
+                            throw new Error('Duplicate request ID');
+                        return context.requestId;
+                    }
+                    return reserveNewRequestId(options.requestIds, day);
+                })();
+            }
+            return allocated;
+        }
+        return async function astag(command, arg, value) {
+            if (command === 'set') {
+                if (typeof arg !== 'string' || !safeName(arg) || !scalar(value))
+                    throw new TypeError('Invalid data-layer value');
+                layer[arg] = value;
+                return true;
+            }
+            if (command === 'get')
+                return typeof arg === 'string' ? layer[arg] ?? conf[arg] : undefined;
+            if (command === 'config') {
+                if (typeof arg !== 'object' || arg === null)
+                    throw new TypeError('Config must be an object');
+                for (const [key, item] of Object.entries(arg))
+                    if (['site', 'pathname', 'sessionId'].includes(key) && typeof item === 'string' && item.length <= 200)
+                        conf[key] = item;
+                return true;
+            }
+            if (command === 'consent') {
+                if (arg !== 'granted' && arg !== 'denied')
+                    throw new TypeError('Invalid telemetry consent state');
+                consent = arg;
+                return true;
+            }
+            if (command !== 'event' || typeof arg !== 'string' || !safeName(arg))
+                throw new TypeError('Invalid tag operation');
+            if (consent === 'denied')
+                return undefined;
+            const properties = cleanValues(value ?? {});
+            let id;
+            try {
+                id = await ensureId();
+            }
+            catch {
+                allocated = undefined;
+                warn('Request ID reservation unavailable');
+                return { requestId: '', requestUtcDay: reservedDay, matchedTriggers: [], firedTags: [], failures: ['request_id_unavailable'] };
+            }
+            return evaluate({ name: arg, properties, source: 'server', requestId: id, requestUtcDay: reservedDay, site: conf.site, pathname: conf.pathname, sessionId: conf.sessionId, data: { ...layer } });
+        };
+    }
+    const collector = createAnalyticsCollector({ analytics: options.analytics, prefix, allowedOrigins: options.allowedOrigins, serverToken: options.serverToken, requestIdStore: options.requestIds, requireRequestId: true,
+        siteByOrigin: options.siteByOrigin, requireBrowserConsent: options.requireBrowserConsent ?? options.defaultConsent === 'denied', botPolicy: options.botPolicy,
+        maxBodyBytes: options.maxBodyBytes ?? 16_384, maxEventsPerMinute: options.maxEventsPerMinute ?? 120, allowTextPlainBeacon: true,
+        dispatch: async (input, ctx) => {
+            if (!safeName(input.name))
+                return;
+            const props = cleanValues(input.properties ?? {}), data = cleanValues(input.data ?? {});
+            await evaluate({ name: input.name, properties: props, data, site: input.site ?? options.site, pathname: input.pathname, sessionId: input.sessionId, source: 'web', requestId: ctx.requestId, requestUtcDay: ctx.utcDay });
+        }
+    });
+    const endpoint = options.publicOrigin ? new URL(prefix + '/collect', options.publicOrigin).href : prefix + '/collect';
+    const scriptHandler = async (_request) => {
+        let activeTypes = [];
+        try {
+            const container = publishedContainer(await store.load());
+            activeTypes = [...new Set(container.triggers.filter(t => t.enabled !== false).map(t => t.type))];
+        }
+        catch { /* This optional failure is intentionally ignored. */ }
+        const js = browserScript({ endpoint, site: options.site ?? '', debug: options.debug === true, autoEvents: activeTypes, defaultConsent: options.defaultConsent ?? 'granted' });
+        return new Response(js, { headers: { 'content-type': 'application/javascript; charset=utf-8', 'cache-control': 'no-store', 'x-content-type-options': 'nosniff', 'cross-origin-resource-policy': 'cross-origin' } });
+    };
+    const authorized = async (request) => {
+        if (options.dashboardHost && new URL(request.url).host !== options.dashboardHost)
+            return false;
+        if (!options.authorizeAdmin)
+            return false;
+        try {
+            return await options.authorizeAdmin(request) === true;
+        }
+        catch {
+            return false;
+        }
+    };
+    const canPublish = async (request) => {
+        if (!await authorized(request) || !options.authorizePublish)
+            return false;
+        try {
+            return await options.authorizePublish(request) === true;
+        }
+        catch {
+            return false;
+        }
+    };
+    const sameOrigin = (request) => request.headers.get('origin') === new URL(request.url).origin;
+    const readBody = async (request, limit = 8192) => { const body = await request.text(); if (Buffer.byteLength(body) > limit)
+        throw new RangeError('Body too large'); return JSON.parse(body); };
+    const admin = async (request) => {
+        if (!await authorized(request))
+            return new Response('Not found', { status: 404 });
+        const html = dashboard(prefix), scripts = [...html.matchAll(/<script>([\s\S]*?)<\/script>/g)];
+        const scriptHashes = scripts.map(match => `'sha256-${createHash('sha256').update(match[1]).digest('base64')}'`).join(' ');
+        return new Response(html, { headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', 'content-security-policy': `default-src 'none'; script-src ${scriptHashes}; style-src 'unsafe-inline'; connect-src 'self'; base-uri 'none'; object-src 'none'; form-action 'none'; frame-ancestors 'none'`, 'x-content-type-options': 'nosniff', 'referrer-policy': 'no-referrer', 'x-frame-options': 'DENY' } });
+    };
+    const preview = async (request) => {
+        if (!await authorized(request))
+            return json({ error: 'Forbidden' }, 403);
+        if (request.method !== 'POST')
+            return json({ error: 'Method not allowed' }, 405);
+        if (!sameOrigin(request))
+            return json({ error: 'Origin required' }, 403);
+        try {
+            const input = await readBody(request);
+            if (input.mode !== undefined && !['draft', 'published'].includes(input.mode))
+                return json({ error: 'Invalid mode' }, 422);
+            if (!safeName(input.name))
+                return json({ error: 'Invalid event name' }, 422);
+            const ev = { name: input.name, properties: cleanValues(input.properties ?? {}), data: cleanValues(input.data ?? {}), source: 'web', requestId: 'PREVIEWONLY00000', requestUtcDay: requestUtcDay() };
+            const loaded = validateContainer(await store.load());
+            const container = input.mode === 'published' ? publishedContainer(loaded) : loaded;
+            const matched = container.triggers.filter(t => t.enabled !== false && triggerMatches(t.type, ev.name, t.event) && (t.conditions ?? []).every(c => matchesCondition(c, ev, container)));
+            const ids = new Set(matched.map(t => t.id));
+            return json({ dryRun: true, mode: input.mode ?? 'draft', event: ev.name, matchedTriggers: [...ids], candidateTags: container.tags.filter(t => t.enabled !== false && t.triggerIds.some(id => ids.has(id))).map(t => ({ id: t.id, type: t.type })) });
+        }
+        catch {
+            return json({ error: 'Invalid preview' }, 422);
+        }
+    };
+    const api = async (request) => {
+        if (!await authorized(request))
+            return json({ error: 'Forbidden' }, 403);
+        if (request.method === 'GET')
+            return json(await store.load());
+        if (request.method !== 'PUT')
+            return json({ error: 'Method not allowed' }, 405);
+        if (!sameOrigin(request))
+            return json({ error: 'Origin required' }, 403);
+        try {
+            const parsed = validateContainer(await readBody(request, 128 * 1024));
+            const previous = parsed.version - 1;
+            if (!await saveTagDraft(store, parsed, previous))
+                return json({ error: 'Version conflict' }, 409);
+            return json({ ok: true, version: parsed.version, mode: 'draft' });
+        }
+        catch {
+            return json({ error: 'Invalid container' }, 422);
+        }
+    };
+    const status = async (request) => {
+        if (!await authorized(request))
+            return json({ error: 'Forbidden' }, 403);
+        if (request.method !== 'GET')
+            return json({ error: 'Method not allowed' }, 405);
+        return json(releaseSummary(await store.load()));
+    };
+    const transition = async (request, action) => {
+        if (!await canPublish(request))
+            return json({ error: 'Forbidden' }, 403);
+        if (request.method !== 'POST')
+            return json({ error: 'Method not allowed' }, 405);
+        if (!sameOrigin(request))
+            return json({ error: 'Origin required' }, 403);
+        try {
+            const payload = await readBody(request);
+            if (!payload || !Number.isSafeInteger(payload.expectedVersion) || payload.expectedVersion < 1 ||
+                action === 'rollback' && (!Number.isSafeInteger(payload.releaseId) || payload.releaseId < 1))
+                return json({ error: 'Invalid transition' }, 422);
+            if (action === 'publish') {
+                const candidate = validateContainer(await store.load());
+                if (candidate.version !== payload.expectedVersion)
+                    return json({ error: 'Version conflict' }, 409);
+                if (candidate.tags.some(tag => tag.enabled !== false && (tag.type === 'ga4' && !options.credentials?.[tag.credentialRef ?? '']?.secret ||
+                    tag.type === 'webhook' && !configuredDestinations[tag.destinationRef ?? ''])))
+                    return json({ error: 'Unconfigured destination' }, 422);
+            }
+            const success = action === 'publish' ? await publishTagDraft(store, payload.expectedVersion) :
+                await rollbackTagRelease(store, payload.expectedVersion, payload.releaseId);
+            if (!success)
+                return json({ error: 'Version conflict' }, 409);
+            return json({ ok: true, ...releaseSummary(await store.load()) });
+        }
+        catch (error) {
+            return json({ error: error instanceof RangeError ? 'Release unavailable' : 'Invalid transition' }, 422);
+        }
+    };
+    return {
+        createAstag, evaluate, container: () => store.load(), published: async () => publishedContainer(await store.load()), store,
+        routes() { return [{ pattern: collector.path, handler: collector.handler }, { pattern: `${prefix}/ttag.js`, handler: scriptHandler }, ...(options.authorizeAdmin ? [{ pattern: `${prefix}/admin`, handler: admin }, { pattern: `${prefix}/admin/api`, handler: api }, { pattern: `${prefix}/admin/preview`, handler: preview }, { pattern: `${prefix}/admin/status`, handler: status }, { pattern: `${prefix}/admin/publish`, handler: (request) => transition(request, 'publish') }, { pattern: `${prefix}/admin/rollback`, handler: (request) => transition(request, 'rollback') }] : [])]; }
+    };
+}

package/dist/types.d.ts

@@ -0,0 +1,119 @@
+import type { AnalyticsManager } from '@zeruxjs/analytics';
+import type { RequestIdStore } from '@zeruxjs/analytics';
+export type Scalar = string | number | boolean | null;
+export type Values = Record<string, Scalar>;
+export interface TagEvent {
+    name: string;
+    properties: Values;
+    site?: string;
+    pathname?: string;
+    sessionId?: string;
+    requestId: string;
+    requestUtcDay: string;
+    source: 'web' | 'server';
+    data?: Values;
+}
+export interface Condition {
+    field: string;
+    operator: 'eq' | 'neq' | 'contains' | 'exists' | 'gte' | 'lte';
+    value?: Scalar;
+}
+export interface Trigger {
+    id: string;
+    name: string;
+    type: 'event' | 'all' | 'pageview' | 'click' | 'form' | 'history';
+    event?: string;
+    conditions?: Condition[];
+    enabled?: boolean;
+}
+export interface Variable {
+    id: string;
+    name: string;
+    type: 'constant' | 'event' | 'dataLayer' | 'context';
+    key?: string;
+    value?: Scalar;
+}
+export interface TagDefinition {
+    id: string;
+    name: string;
+    type: 'analytics' | 'ga4' | 'webhook';
+    triggerIds: string[];
+    enabled?: boolean;
+    eventName?: string;
+    measurementId?: string;
+    credentialRef?: string;
+    destinationRef?: string;
+    clientIdVariable?: string;
+    parameters?: Record<string, Scalar | string>;
+}
+/** A historical release is immutable; revisions (container.version) advance on every edit. */
+export interface TagRelease {
+    id: number;
+    at: string;
+    action: 'initial' | 'publish' | 'rollback';
+    container: TagContainer;
+}
+export interface TagGovernance {
+    release: number;
+    published: TagContainer;
+    history: TagRelease[];
+}
+export interface TagContainer {
+    id: string;
+    version: number;
+    name: string;
+    triggers: Trigger[];
+    tags: TagDefinition[];
+    variables: Variable[];
+    governance?: TagGovernance;
+}
+export interface TagContainerStore {
+    load(): Promise<TagContainer>;
+    save(container: TagContainer, expectedVersion: number): Promise<boolean>;
+}
+export interface TagRuntimeOptions {
+    analytics: AnalyticsManager;
+    /** A shared atomic store is REQUIRED for cross-instance request-ID uniqueness. */
+    requestIds: RequestIdStore;
+    store?: TagContainerStore;
+    container?: TagContainer;
+    prefix?: string;
+    /** Absolute public origin for a separate tagging subdomain; browser sends here. */
+    publicOrigin?: string;
+    site?: string;
+    allowedOrigins?: string[];
+    serverToken?: string;
+    /** Secrets resolved server-side; never included in an exposed container. */
+    credentials?: Record<string, {
+        secret: string;
+    }>;
+    destinations?: Record<string, {
+        url: string;
+        headers?: Record<string, string>;
+    }>;
+    fetch?: typeof fetch;
+    /** No admin routes are created unless an application authorizer is supplied. */
+    authorizeAdmin?: (request: Request) => boolean | Promise<boolean>;
+    /** An independent permission check; without this callback no one may publish or roll back. */
+    authorizePublish?: (request: Request) => boolean | Promise<boolean>;
+    /** Browser event consent is a client assertion; still enforce consent at collection ingress. */
+    requireBrowserConsent?: boolean;
+    /** Bind approved origins to fixed site identities; never trust browser-supplied site names. */
+    siteByOrigin?: Record<string, string>;
+    botPolicy?: 'allow' | 'drop-known';
+    dashboardHost?: string;
+    debug?: boolean;
+    /** Initial telemetry setting, independent of email consent. */
+    defaultConsent?: 'granted' | 'denied';
+    onDebug?: (data: {
+        requestId: string;
+        event: string;
+        matchedTriggers: string[];
+        firedTags: string[];
+        failures: string[];
+    }) => void;
+    /** Fail-soft sink, store and ID warnings. Never receives credentials, URLs or event payloads. */
+    onWarning?: (message: string) => void;
+    maxBodyBytes?: number;
+    maxEventsPerMinute?: number;
+}

package/dist/types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,36 @@
 {
   "name": "@zeruxjs/tags",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.0.1",
+  "type": "module",
+  "description": "Server and browser tag manager with versioned containers, triggers and destinations",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "npm run build && node --test test/*.test.mjs",
+    "prepack": "npm run build"
+  },
+  "peerDependencies": {
+    "@zeruxjs/analytics": "0.0.1"
+  },
+  "files": [
+    "dist/",
+    "README.md",
+    "LICENSE-MIT",
+    "LICENSE-APACHE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "license": "(MIT OR Apache-2.0)",
+  "devDependencies": {
+    "typescript": "^5.9.3",
+    "@types/node": "^25.4.0"
+  }
+}