CDN files

The tracker is served from https://cdn.sublimanalytics.com. You only ever reference loader.js; the other files are loaded for you.

File	Role
`loader.js`	A few lines that inject the current tracker bundle. This is what the snippet loads.
`sublim.<hash>.min.js`	The tracker itself, versioned by its content hash, such as `sublim.50b47f40.min.js`.
`replay.min.js`, `packer.min.js`	The session replay recorder, loaded only when a recording starts.
`console-plugin.min.js`	Optional: console capture for session replay.

Versions and updates

loader.js always points to the latest bundle. When we ship a new tracker version, every site gets it on its next page load, with no change to your snippet.

A given sublim.<hash>.min.js never changes: a new version gets a new file name. The loader also makes sure the bundle is injected only once per page, even if the snippet is included twice.

To pin a version, which we don't recommend, load a hashed bundle directly and initialise it yourself:

HTML

<script>
  window.sublim=window.sublim||function(){(sublim.q=sublim.q||[]).push(arguments)};
  sublim.o={projectId:'YOUR_PROJECT_ID'};
</script>
<script async src="https://cdn.sublimanalytics.com/sublim.50b47f40.min.js"></script>

With npm, the version is the one in your package.json. See Install with npm.

Globals

Global	Description
`window.sublim`	The API: `trackEvent`, `trackPageview`, `trackPurchase`, `init`. Also the queue function defined by the snippet. See Calling before the script loads.
`window.Sublim`	The bundle's namespace, also with `trackEvent`, `trackPageview` and `trackPurchase`. Prefer `window.sublim`.

Content Security Policy

If your site sends a Content-Security-Policy header, allow:

Directive	Origin	Why
`script-src`	`https://cdn.sublimanalytics.com`	Loader, bundle and replay recorder.
`script-src`	`'unsafe-inline'`, a nonce or a hash	The inline snippet. You can avoid it with the npm package.
`connect-src`	`https://tracker.sublimanalytics.com`	Events, project settings and replay data.

HTTP

Content-Security-Policy: script-src 'self' 'nonce-…' https://cdn.sublimanalytics.com; connect-src 'self' https://tracker.sublimanalytics.com

To keep script-src to your own origin, bundle the tracker and its replay recorder with the npm package.