Rebuild v12 bundles after merged compatibility fixes

[simple-analytics-ai]

Summary

Closes #107

Follow-up to #108, which is already merged into v12. The merged source in src/default.js contains the inline-event tracking from #106 and the phone-click fix from #111, but the committed bundles still predate both, so the artifacts that ship to the CDN do not match the source they are built from.

This commit regenerates the 29 affected distribution files and source maps from current v12. No source file, test, or build script changes.

Effect on existing installations once these bundles are deployed:

• latest.js, v12/app.js, and the custom-domain and Cloudflare variants gain inline events: a click or submit on an element carrying data-simple-event now sends an event, with data-simple-event-* attribute values, the element tag, and for forms the submit button's label (button_text, max 200 characters) as metadata. Form field values are not collected.
• Events sent from inline handlers use fetch(url, { keepalive: true, mode: "no-cors", credentials: "omit" }), falling back to the tracking pixel when fetch is unavailable, fails, or throws. Navigation and form submission are left to the browser and the website.
• 404 confirmation is opt-in through data-detect-404="true" or sa_settings.detect404, so existing installs send no extra request.
• light.js stays event-free (verified: no inline-event code in the built output, +12 bytes, header and shared helpers only).
• Only dist/latest/ and dist/v12/ change; dist/v1 through dist/v11 remain byte-identical.

Blast radius is the tracker bundles only, and the change is reversible by reverting the generated files.

Changes:

• Rebuild v12 bundles from the merged compatibility fixes - Requested: rebuild the distributions after PR Preserve distinct manual pageviews in v12 #108 and verify that manual queries override browser parameters, absent manual queries fall back to location.search, and existing fil...

Security implications

Has security impact - described as: deploying these bundles turns on inline-event collection for every existing latest.js and v12/app.js installation, so the script begins reading data-simple-event-* attribute values and submit-button label text from visitor pages and sending them as event metadata, and switches inline-event delivery to a credential-less keepalive fetch. Existing parameter filtering, ignored pages, namespaces, and collection settings continue to apply, and form field values are not collected.

Testing

Run locally on Node 24.21.0 / pnpm 11.17.0:

• pnpm install --frozen-lockfile — succeeded.
• pnpm run build — succeeded; git status --porcelain is empty afterwards, so the committed bundles reproduce exactly from source.
• pnpm run test:unit — 39 passing, 0 failing.
• pnpm run test:deploy — 12 passing, 0 failing.
• Checked HEADER_PATTERN from deploy.mts against the rebuilt headers — fails for every JavaScript artifact, because compile.js emits Privacy-first analytics while the pattern expects Privacy friendly analytics. pnpm run deploy would throw Invalid script header before uploading anything. Reported separately on this pull request.
• Verified sourceMappingURL rewrites in the v12 artifacts and confirmed light.js contains no inline-event, keepalive, or 404 code.

BrowserStack is left to CI; remote results are tracked separately from this local verification.

Checklist

• Linked to an issue
• Tested
• Asked for a review

[github-actions]

Every bundle rebuilt here fails deployment validation: HEADER_PATTERN in deploy.mts:75 requires Privacy friendly analytics, but compile.js:324 emits Privacy-first analytics, so prepareFiles throws Invalid script header in dist/v12/app.js: ... before a single file is uploaded. I ran the pattern against the rebuilt headers and all JavaScript artifacts (dist/v12/app.js, dist/v12/custom/app.js, dist/latest/latest.js, dist/latest/light.js, dist/latest/hello.js) fail; the smallest fix is to change the literal in HEADER_PATTERN to Privacy-first analytics.

Create a separate branch from the current PR head, commit and push only that branch, and return its link so it can be merged into the current PR branch. Do not open a pull request.

[github-actions]

Documentation update

_docs/55_events/00_inline-events.md

Location: Whole page — replaces the current contents, which describe the separate inline-events.js beta helper

Copy and paste this into the documentation repository:

---
title: Inline events
category: events
permalink: /events/inline
hidden: true
last_modified_at: 2026-10-15
---

Inline events are built into our main script. It watches your page for any element with a `data-simple-event`-attribute and automatically sends events to Simple Analytics when a visitor clicks it or submits it. You don't need to write any extra JavaScript calls—just add the right attributes to your HTML.

### Installation

Include the tracker snippet somewhere on your page, just before the closing `</body>` tag. No extra script is needed.

```html
<script async src="https://scripts.simpleanalyticscdn.com/latest.js"></script>
```

If you previously added the separate `inline-events.js` beta helper, remove it. Leaving it in place sends every inline event twice.

Inline events are not available in `light.js`, because that version ships without event support.

### Tracking clicks

Add `data-simple-event="event_name"` to any element. When a visitor clicks it—or clicks anything inside it—we send the event.

```html
<a href="/pricing" data-simple-event="visit_pricing_page">See pricing</a>
```

We never cancel the click. Links, downloads, `target="_blank"`, modified clicks, and your own click handlers keep working exactly as before, and a click that your own code cancels is still tracked. We send the request with `keepalive` so it survives the navigation that follows.

### Tracking form submissions

Put `data-simple-event="form_name"` on your `<form>`-tag. When the form is submitted we send the event and leave the submission itself to the browser or to your own code.

```html
<form action="/signup" data-simple-event="signup_form">
  <input name="email" type="email" />
  <input name="password" type="password" />
  <button type="submit">Sign up</button>
</form>
```

We never read the values of your form fields.

### Adding custom metadata

Any attribute starting with `data-simple-event-` is included as event metadata. Dashes convert to underscores.

```html
<button
  data-simple-event="select_plan"
  data-simple-event-plan="enterprise"
  data-simple-event-referrer="homepage"
>
  Choose Enterprise
</button>
```

We always add `tag` with the lowercased tag name of the element. For forms we also add `button_text` with the label of the button that submitted the form, with whitespace collapsed and limited to 200 characters.

### Manual event tracking

You can also fire events from code using `sa_event("event_name", { key: value })`. This works before or after the inline binding.

```js
// custom event on newsletter popup
sa_event("newsletter_signup", { source: "modal" })
```

### 404 detection

404 detection is off by default, because it adds an extra request to every page. Turn it on with the `data-detect-404`-attribute:

```html
<script
  async
  src="https://scripts.simpleanalyticscdn.com/latest.js"
  data-detect-404="true"
></script>
```

Or with the settings object:

```html
<script>
  window.sa_settings = { detect404: true };
</script>
```

When enabled, we look for `404` in the title and the text of your page. Only when we find it do we send a `HEAD`-request to the current URL, and only when that request returns status `404` do we send a `page_404`-event. Its metadata contains `url` without query parameters or fragment, and `status`.

[github-actions]

Claude review checkpoint

Reviewed commit 0bc6f3083b24ffb85dc7f29e3d2b15326db71014. This is used to keep later automated reviews focused on changes Claude has not checked yet.

[github-actions]

SDLC label: change: needs review because Rebuilding the shipped latest.js and v12/app.js bundles turns on inline-event collection for every existing installation, so the tracker begins reading data-simple-event-* attribute values and submit-button label text from visitor pages and sends inline events over a credential-less keepalive fetch, materially changing how visitor data is collected in production