v0.14.1

Vizoalica v0.14.1: pixel path slots free themselves

Deployment support: one additive database migration (0010_pixel_path_expiry.sql, schema 10). Update each
backend with vizoalica deploy <name> --update. Until then a Worker keeps working and the pixel path limit behaves
as in v0.14.0 (slots are not freed).

On top of v0.14.0:

• Pixel path slots expire (#86). A path not seen for 32 days is
  removed by the daily cleanup and its slot is free again, so made-up or renamed paths cannot fill a website's
  limit for good. See Count views of a README.
• Privacy review (#87) for goals, grouping rules and pixel
  paths, with a retention statement for each:
  Goals, grouping and pixel paths review.
• Goals polish (#88). The 20-goal limit holds when requests
  arrive together. Page goals and grouping patterns that could never match are refused with a clear error. The goals
  panel shows a retryable error when loading fails instead of claiming the backend is old.
• VIZOALICA_PIXEL_MAX_PATHS with an invalid value is ignored instead of stopping the Worker.

Install or update

npm install -g vizoalica      # or: npm update -g vizoalica
vizoalica --version           # 0.14.1
vizoalica deploy <name> --update   # for each backend

v0.14.0

Vizoalica v0.14.0: goals and cleaner page reports

Deployment support: one additive database migration (0009_goals_grouping_pixel_cap.sql, schema 9). Update each
backend with vizoalica deploy <name> --update. Until then the new pages say the backend needs an update; nothing
else changes.

On top of v0.13.1:

• Goals (#63). Define what counts as a conversion for a website:
  a page view of a path, a click on a named control, or a custom event. The new Goals page shows conversions,
  distinct visitors, and the rate per goal; goals are added on the website's page, through the admin API, and read
  with the new get_goals assistant tool. A page goal counts page views and has no visitor figure. Counts only.
  See Goals.
• Group pages with rules (#62). Count many pages as one with
  path patterns such as /blog/* => /blog/:post, per website (website → Edit → Group pages). Wildcards only, no
  regular expressions. Applied as events arrive, so earlier data keeps its old keys. See
  Group pages with rules.
• Pixel path limit (#82). A website counts at most 100 different
  pixel paths (VIZOALICA_PIXEL_MAX_PATHS changes it); new paths past the limit are ignored, known paths keep
  counting, and the website page shows when the limit is reached.
• Assistant fixes (#83). get_website_status now checks a
  website that needs no token through its script tag instead of a configuration endpoint it does not have.
  compare_periods with only previous_start compares a period as long as the current one. The assistant is told
  once for every tool that page paths, referrers, and event names are untrusted text.
• Add key button (#69). The access keys page button reads
  "+ Add key" and stays on one line.
• Security (#84). minimatch 11.0.1 (development tooling;
  one moderate advisory). pnpm audit is clean.

Install or update

npm install -g vizoalica      # or: npm update -g vizoalica
vizoalica --version           # 0.14.0
vizoalica deploy <name> --update   # for each backend

v0.13.1

Vizoalica v0.13.1: README pixel settings

Deployment support: no database migration and no change to the backend. Nothing to update on a running backend.

On top of v0.13.0:

• One website key for the README pixel. The pipeline fills the pixel in the README from the repository variables
  VIZOALICA_INGEST_ENDPOINT and VIZOALICA_WEBSITE_KEY, the same ones the docs site uses.
  VIZOALICA_README_WEBSITE_KEY is no longer read; delete it if you set it.
• Two pages you can tell apart. The repository README counts under /readme, the npm README under
  /npm/readme. See Count views of a README.
• The filled block keeps the blank lines Prettier writes, so the README stays formatted after the workflow commits it.
• Dependency updates (reviewdog/action-actionlint, minor and patch group).

Install or update

npm install -g vizoalica      # or: npm update -g vizoalica
vizoalica --version           # 0.13.1

v0.13.0

Vizoalica v0.13.0: no-script pixel

Deployment support: D1 migration 0008_pixel_page_views.sql (one column with a default, additive). The backend
(Worker) and the console changed. Update a running backend with vizoalica deploy <name> --update, or all of
them with vizoalica deploy --update --all. The browser SDK is unchanged.

On top of v0.12.1:

• Count views of a README. A new image route, GET /v1/pixel.gif?website=<website-key>&path=/npm/vizoalica,
  records one page view and returns a 1x1 GIF with Cache-Control: no-store. Put it in a GitHub or npm README as
  a Markdown image. See Count views of a README.
• Off by default, per website. An image request carries no origin, so hits can be forged. Switch it on in the
  console (website → Edit) or with pixelEnabled on the admin API. Pixel views are marked pixel in the raw
  event archive. Excluded addresses and quotas apply as for any event.
• Same counting as the script. Unique visitors use the daily salted digest; nothing is stored in the browser.
• READMEs fill the pixel from the pipeline. A block between <!-- readme-pixel:start --> and
  <!-- readme-pixel:end --> is filled from the public variables VIZOALICA_INGEST_ENDPOINT and
  VIZOALICA_README_WEBSITE_KEY (or VIZOALICA_WEBSITE_KEY): by a workflow for the repository README, and at build
  time for the npm README. Empty when unset.
• Known limits. GitHub and npm proxy images, so counts there are rough and unique visitors cannot be told
  apart; referrers are generic (use a distinct path per README); blockers may drop the image. See the
  privacy review.

Install or update

npm install -g vizoalica      # or: npm update -g vizoalica
vizoalica --version           # 0.13.0
vizoalica deploy --update --all

v0.12.2

What's Changed

• Move the website deploy workflow to a documented template

Full Changelog: v0.12.1...v0.12.2

v0.12.1

What's Changed

• feat: rage clicks report (v0.12.0) by @ehud-am in #71
• chore: release 0.12.1 (security updates, docs site website key) by @ehud-am in #74

Full Changelog: v0.11.1...v0.12.1

v0.11.1

Deployment support: no database migration. The backend (Worker) is rebuilt with updated dependencies but its
behavior is unchanged. Updating is optional; if you want the rebuilt Worker, use
vizoalica deploy <name> --update, or all of them with vizoalica deploy --update --all.

On top of v0.11.0:

• Dependencies: wrangler 4.150.0, vite 8.3.4, zod 4.6.7, prettier 3.9.10, @typescript-eslint 8.71.2,
  @testing-library/user-event 14.6.8, @playwright/test 1.64.0, and the CI action reviewdog/action-actionlint
  1.80.2.
• No change to the console, the SDK, the reports, or the data collected.
• Known issues carried over from 0.11.0 are listed in specs/022-utm-campaign-report/tasks.md. One moderate
  advisory in fast-uri (through ajv) remains; no update clears it yet.

Install or update

npm install -g vizoalica      # or: npm update -g vizoalica
vizoalica --version           # 0.11.1

v0.11.0

Deployment support: D1 migrations 0005_campaign_reports.sql (three tables) and
0006_internal_traffic_exclusion.sql (one column with a default, one table). Both are additive. The backend
(Worker) changed. Update a running backend with vizoalica deploy <name> --update, or all of them with
vizoalica deploy --update --all. Update the backend before bundling the new @vizoalica/browser-sdk: a backend
older than this release rejects page views that carry campaign labels. Websites that load the SDK from their own
backend are unaffected.

On top of v0.10.0:

• Campaigns report. The console has a Campaigns page and the MCP server a get_campaigns tool: page
  views and visitors by utm_source, utm_medium and utm_campaign, the share of all page views that came from
  a tagged link, a trend, and the top combinations. Choose a source, medium or campaign to narrow it. Only the
  three labels are read from the landing address, cleaned in the browser and again by the backend, and only on the
  first page view of a page load. Nothing else in the query is read, and nothing is stored in the browser. See
  Campaigns.
• Exclude your own visits. List the IP addresses or ranges you visit from on a website's Edit page and those
  visits are dropped on arrival and never stored. The website page shows how many events were dropped, per day,
  with no address kept. For a person on a changing connection, open the site once with ?vizoalica_ignore=1 and
  that browser sends nothing. See Exclude your own visits.
• Only page views received after the update are counted in the Campaigns report; the report says so when the
  chosen range starts earlier. Address exclusion is not retroactive.
• Privacy reviews: campaign labels and
  internal traffic.

Install or update

npm install -g vizoalica      # or: npm update -g vizoalica
vizoalica --version           # 0.11.0
vizoalica deploy --update --all

v0.10.0

Vizoalica v0.10.0: custom events report

Deployment support: D1 migration 0004_custom_event_reports.sql (additive: four tables). The backend
(Worker) changed. Update a running backend with vizoalica deploy <name> --update, or all of them with
vizoalica deploy --update --all. Update the backend before bundling the new @vizoalica/browser-sdk: a backend
older than this release rejects custom events that carry the new page field. Websites that load the SDK from
their own backend are unaffected.

On top of v0.9.1:

• Custom events report. The console has an Events page and the MCP server a get_custom_events tool:
  each event with its count, distinct visitors, and pages, a trend, the top pages of one event, and its most
  common property values (text and true/false only, redacted, 64 characters). Filter by event or page. Only
  events received after the backend update are counted; the report says so for an earlier range. See
  Custom events.
• Custom events carry their page. The SDK adds the page key to track() events, so the report can show the
  top pages of an event.
• Fixed: a website with no token is no longer reported as misconfigured on the website page, in Health, or
  by the MCP website_status tool.
• Fixed: the console started from a source checkout accepts backends at the current schema; a leftover
  apps/cli/package/dist from an older build no longer sets the expected schema.

Install or update

npm install -g vizoalica      # or: npm update -g vizoalica
vizoalica --version           # 0.10.0
vizoalica deploy --update --all

Vizoalica v0.9.0

Vizoalica v0.9.0: one script tag, no cookies, nothing to copy

Deployment support: D1 migration 0003_static_sites_daily_visitors.sql (additive: sources.token_required
and the daily_visitor_salts table). The backend (Worker) changed. Update a running backend with
vizoalica deploy <name> --update. Existing websites keep requiring signed tokens until you turn that off.

On top of v0.8.0:

• One script tag for any website. New websites need only a script tag, served by your backend at
  /vizoalica.js, on any host (GitHub Pages, Netlify, WordPress, plain HTML). Events from such a website are
  accepted only from its allowed addresses. Signed tokens are now an opt-in per website (Require a signed
  token). The Install page shows the tag and checks your home page for it. See
  Add a website.
• Unique visitors without cookies or browser storage. The SDK stores nothing in the browser. The Worker
  counts visitors with a keyed digest of a random per-day salt, the website, the IP address and the user agent;
  each day's salt is deleted after the day ends. A person counts once per website per day. Counts from before
  the update are not comparable day to day. See Privacy defaults.
• Nothing to copy at setup. vizoalica env add and vizoalica deploy show no secret. The administrator
  secret is saved on your computer; the token secret is needed only by signed-token websites and is fetched the
  first time with vizoalica rotate <name> token. --secrets-file is an optional backup.
• OneCLI is opt-in. vizoalica env add asks nothing about OneCLI; it is used only with its options.
• Plainer words. "Website key" and "website ID" in the console and docs; Share access (was Access
  keys), with a new Share with someone page; the header control is "Backend". The docs
  put multiple backends, OneCLI and the manual source-checkout guides under Advanced.
• Homepage leads with the AI assistant, with a recorded Claude Code demo on fictional data.
• Security: the fast-uri override is raised to 3.1.7 (GHSA-qw65-cvwx-89v3, GHSA-58mr-gqgx-xq4g).

Install or update

npm install -g vizoalica      # or: npm update -g vizoalica
vizoalica --version           # 0.9.0
vizoalica deploy prod --update

Then, for a static website, open it in the console, turn off Require a signed token, and paste the script
tag from its Install page.