Remove retired Cloudflare app plumbing from v12

[simple-analytics-ai]

Summary

Fixes #120

Requested: remove the retired Cloudflare app integration from v12 while keeping Google Tag Manager configuration and an effective client-side guard.

GTM -> window.sa_settings -> copied local settings -> tracker
No window -> return before browser access

Remove the Cloudflare build target, INSTALL_OPTIONS injection, overwriteOptions argument and placeholders, latest Cloudflare artifact, and obsolete README link. Preserve settings precedence, script-attribute fallbacks, and the newly merged Cloudflare challenge attribution behavior. Rebuild the current tracker distributions; published v1-v11 and automatic-event artifacts remain unchanged.

The old optional window check ran after browser-property access, and its function call evaluated a bare window. The replacement safely passes the browser window and returns before any browser access in every tracker build.

Security implications

• No security impact
• Has security impact - described as:

Testing

• Frozen pnpm install and pnpm run build passed with Node 24.18.0 / pnpm 11.17.0.
• pnpm run test:unit: 53 passing.
• 36 before/after jsdom comparisons using the actual published GTM template (73efbbb0e3cfbe50b44b28b99df0d2ee86cc7283) across development, minified, SRI, and custom-domain trackers. Covered GTM defaults, hostname precedence, parameters, ignored pages/metrics, hash mode, DNT, metadata, custom domains, and direct JavaScript settings/callbacks. Payloads and settings matched after normalizing generated IDs/timestamps.
• All 15 current tracker variants passed ES5 parsing and evaluation with absent or undefined window; custom-domain SSI placeholders were rendered before evaluation.
• Prettier and git diff --check passed. ESLint reports the same three existing v12 errors (no-empty twice and no-redeclare once).
• BrowserStack is left to remote CI; it was not run locally.

Evidence

Before: GTM used the merged Cloudflare options object; tracker evaluation without window threw a ReferenceError.

After: GTM produces matching requests through local settings; all 15 trackers safely skip non-browser execution. The build no longer creates cloudflare.js.

Same-build code size excluding generated headers: latest.js +14 minified bytes / +2 gzip; light.js +1 / +1. The small increase enables the browser guard for every tracker.

Merge Danger

Door: two-way; revert the commit to restore the old build.

Blast Radius: tracker. Browser configuration and payload behavior are preserved; the retired Cloudflare app build is deliberately removed.

Checklist

• Linked to an issue
• Tested
• Asked for a review

[github-actions]

Documentation update

_docs/31_integrations/30_cloudflare.md

Location: Replace the whole file, front matter and body

Copy and paste this into the documentation repository:

---
title: Install Simple Analytics on Cloudflare
menu: Cloudflare
category: integrations
permalink: /install-simple-analytics-on-cloudflare
last_modified_at: 2026-10-15
---

The Simple Analytics Cloudflare App is retired. We no longer build or publish a Cloudflare-specific version of our script, and the app can no longer be installed.

To measure a website that is served through Cloudflare, install our regular script instead:

1. Follow [our standard install instructions](/script) and add the snippet to your HTML.
1. If you want to [bypass ad blockers](/bypass-ad-blockers), add the custom domain yourself. Set the CNAME record to **DNS only** (the gray cloud), because proxied records hide the CNAME target and our check cannot verify it.
1. Configure optional settings such as [recording DNT visitors](/dnt), [events](/events), or [hash navigation](/hash-mode) with the usual `data-` attributes on the script tag.

Websites that still have the Cloudflare App installed keep loading the script version that was published before the app was retired. Nothing is removed from your website automatically, but we recommend switching to the standard install so you receive future script updates.

If you encounter issues, don't hesitate to contact us via [our support channels](https://simpleanalytics.com/contact).

_docs/20_install-script/04_install.md

Location: ## Platform guides, the CloudFlare list item

Copy and paste this into the documentation repository:

- [CloudFlare](/install-simple-analytics-on-cloudflare) <small>(retired, install the standard script instead)</small>

[github-actions]

Claude review checkpoint

Reviewed commit 62f17aef471c86cfadcb42fb29bfb01fe281f46d. This is used to keep later automated reviews focused on changes Claude has not checked yet.

[github-actions]

SDLC label: change: routine because Removes a retired build target and refactors how tracker settings are read, with no change to what is collected, who can access data, authentication, billing, schemas, or deployment safety