feat: Establish the LVBT analytics platform - #3
Merged
Merged
Conversation
Add the privacy-focused client, collector Worker, and reporting tools. Include browser verification, documentation, and release workflows for the first usable analytics release. Co-authored-by: Codex <noreply@openai.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TL;DR
Adds the shared, privacy-focused analytics package, collector Worker, reporting tools, and production verification used across LVBT web properties.
Overview of Changes
The new
@lvbt/analyticspackage combines Cloudflare Web Analytics with a strictly allowlisted first-party event client. It records no visitor identifiers, cookies, URLs, coordinates, or free-form event values; Global Privacy Control, Do Not Track, framed contexts, previews, local development, and excluded paths fail closed. Astro, React, plain HTML, CSP, Node, and Playwright entry points keep the same policy across different application profiles.The collector validates origin, site, event source, body size, authentication, privacy signals, and rate limits before writing coarse data to Workers Analytics Engine. Fixed reporting queries, Diataxis documentation, a stable weekly report issue, browser-observed deployment checks, npm trusted-publishing configuration, package provenance, size budgets, and a Wrangler dry run make the platform operable by volunteers. Route-sensitive applications deliberately disable Cloudflare's automatic soft-navigation pageviews because Cloudflare does not expose a per-route SPA exclusion filter.
Follow-ups
Configure npm trusted publishing and the production Cloudflare credentials, then publish the single initial
0.1.0release after merge. SetLVBT_ANALYTICS_LIVE=1only after all four declared production sites pass their consumer cutovers.