## Canonical PinAppAI widget snippet

Place this `<script>` tag once in the customer's site, in a shared location that
emits on every public page (base layout, root template, footer partial). The
widget injects floating buttons after first paint — reviewers see them on every
page where the snippet loads.

```html
<script src="https://api.pinappai.com/widget.js"
        data-project="<the project_key — a pk_… value>"
        defer></script>
```

The `data-project` value is the project's `project_key` (a `pk_…`
string) returned by the `get_project` tool. It's public-by-design
(ships in every customer page's HTML, CORS-gated by the project's
`allowed_origins`) — distinct from the `ppk_…` MCP credential which is
a privileged workspace key and must NEVER appear in any client-visible
file. Don't wrap the script in an env conditional (no
`{import.meta.env.PROD && …}`) — the widget should load in both dev
and prod by default.

**URL:** `https://api.pinappai.com/widget.js` — served by the API worker with
edge caching. Don't substitute a CDN subdomain (no `cdn.pinappai.com` exists);
customers should use this exact URL.

**The `defer` attribute is required.** Without it the ~106KB widget bundle blocks
HTML parsing, adding 50–200ms to first paint on slow connections. Defer
downloads in parallel with parsing and executes after — no functional regression
(the widget doesn't need to run mid-parse).

**Skip non-public pages:** admin, login, signup, 404, API routes — only
user-facing pages need the widget. If you can't determine a single shared
place to put the snippet, ask which page set should carry the widget rather
than scattering it across pages individually.