feat: Count lvwwd.org campaign events

[WillieCubed]

TL;DR

The shared analytics package can now count lvwwd.org's Week Without Driving campaign: sign-ups, "Open my week" link requests, trip entries by day, trip pictures, bingo progress, Find a bus, installs, printed materials and views of the mail-in instructions. Astro sites also keep their small stylesheets inline again. This PR prepares release 0.2.0.

Overview of Changes

Why this exists

lvwwd.org is the Week Without Driving Las Vegas campaign site, running October 1 to 8. It needs to know whether the campaign works, but version 0.1.0 of the package only knew the events of LVBT's other sites. Any lvwwd.org event threw in the browser, and the collector would have refused lvwwd.org as an origin, so the site could not use the package at all.

The campaign events

lvwwd.org is now a site in the event allowlist, with ten browser events of its own. Each one answers a campaign question: campaign_signup, week_link_requested, trip_entry_submitted, trip_picture_shared, bingo_square_marked, bingo_completed, bus_finder_used, app_installed, material_printed and mail_in_viewed. The event allowlist reference now explains when each one is sent.

The properties follow the privacy contract. Every value is a campaign day (1 to 8), a running count, or a fixed label such as screenshot or partner_flyer. A trip entry records its day and whether it came as a post link, a screenshot or both, but never the link. Find a bus records whether the person used their location or picked a place, but never the location. Bingo events carry how many squares or lines are done, which makes a progress funnel instead of per-square detail. A new test keeps every property value a short lowercase label, so free text cannot slip into the allowlist later.

The collector needed no code change. It derives the permitted origins and each event's sites from the allowlist, so it accepts https://lvwwd.org and still refuses LVBT events from lvwwd.org and campaign events from LVBT sites.

One allowlist in the browser

Until now the browser code kept its own short copies of the join_click placements and tool_feature_used features. That kept it small but meant every new event needed edits in three places. The browser now validates against the same allowlist as the collector. As a result, delegated data-lvbt-* attributes work for any declared event: each property is read from the attribute of the same name, such as data-lvbt-item, and an event without properties needs only data-lvbt-event. The API reference shows how classic scripts, like lvwwd.org's, call window.lvbt.track safely.

Astro sites keep their small stylesheets inline

The Astro integration set Vite's assetsInlineLimit to 0 so that Astro would never inline the analytics page script, which a script-src 'self' policy would block. Astro uses the same limit to decide whether to inline small stylesheets, so every page's small styles also turned into separate files. On lvwwd.org that meant six extra stylesheet requests. The integration now keeps only script chunks external and leaves every other asset to the site's own limit, or to Astro's default when the site sets none. The design record always asked for scripts alone; this brings the code in line with it.

Decisions worth knowing

The classic-script client now carries the allowlist, so it grows from about 1.0 KB to 1.7 KB gzipped, and its size budget rises from 1024 to 1792 bytes. The ES module that Astro and Vite sites bundle grows by a similar amount, about half a kilobyte. Keeping one allowlist was worth that cost, because two copies of a privacy boundary drift apart.

lvwwd.org is not a subdomain of lasvegasfortransit.org, so the organization's Web Analytics site does not cover it. The configuration reference now says that lvwwd.org has its own Web Analytics site, with its token in the week-without-driving repository's production environment.

The weekly check now verifies https://lvwwd.org too. It will report lvwwd.org as missing until that site ships with its Web Analytics token.

What must happen before it works live

The collector at events.lasvegasfortransit.org has never deployed. The Deploy collector workflow fails because the analytics repository's production environment has no CLOUDFLARE_API_TOKEN or CLOUDFLARE_ACCOUNT_ID secret, and the hostname does not resolve today. Until a maintainer adds both and reruns the workflow, no site's events are recorded.

Follow-ups

• Deploy the analytics collector to events.lasvegasfortransit.org
• Publish lvwwd.org's analytics with its own Web Analytics site

🤖 Generated with Claude Code