@burdenoff/fe-libs 2026.1021.10 → 2026.1021.12

package/dist/shared/events/sinks/RybbitSink.js

@@ -1,17 +1,18 @@
 "use client";
 import { useShellLabel as e } from "../../providers/shell/useShellLabel.js";
-import { useEventBus as t } from "../../../shared-events.js";
-import { useEffect as n, useRef as r, useState as i } from "react";
-import { jsx as a, jsxs as o } from "react/jsx-runtime";
+import { isRybbitSkippedRoute as t } from "./rybbitRoutes.js";
+import { useEventBus as n } from "../../../shared-events.js";
+import { useEffect as r, useRef as i, useState as a } from "react";
+import { jsx as o, jsxs as s } from "react/jsx-runtime";
 //#region src/shared/events/sinks/RybbitSink.tsx
-var s = /* @__PURE__ */ "nav.route.changed,auth.signed_in,auth.signed_out,support.ticket.created,support.ticket.closed,support.ticket.reopened,support.kb.article_rated,notification.item.opened,notification.preference.updated,notification.admin.sent,notification.template.saved,notification.schedule.updated,bigconsole.dashboard.import_clicked,bigconsole.dashboard.imported,bigconsole.dashboard.share_clicked,bigconsole.dashboard.shared,bigconsole.data_sink.import_clicked,bigconsole.data_sink.imported,bigconsole.widget.create_clicked,bigconsole.widget.created,bigconsole.widget.duplicate_clicked,bigconsole.widget.duplicated,bigconsole.ai.generate_clicked,bigconsole.ai.dashboard_generated,bigconsole.ai.create_dashboard_clicked,bigconsole.ai.dashboard_created".split(","), c = /(token|password|secret|authorization|cookie|session|email|name|stack|message|subject|description|query|search|prompt|formula|reason|body|content)/i, l = /(^id$|Id$|_id$|_ID$)/, u = [
+var c = /* @__PURE__ */ "nav.route.changed,auth.signed_in,auth.signed_out,support.ticket.created,support.ticket.closed,support.ticket.reopened,support.kb.article_rated,notification.item.opened,notification.preference.updated,notification.admin.sent,notification.template.saved,notification.schedule.updated,bigconsole.dashboard.import_clicked,bigconsole.dashboard.imported,bigconsole.dashboard.share_clicked,bigconsole.dashboard.shared,bigconsole.data_sink.import_clicked,bigconsole.data_sink.imported,bigconsole.widget.create_clicked,bigconsole.widget.created,bigconsole.widget.duplicate_clicked,bigconsole.widget.duplicated,bigconsole.ai.generate_clicked,bigconsole.ai.dashboard_generated,bigconsole.ai.create_dashboard_clicked,bigconsole.ai.dashboard_created".split(","), l = /(token|password|secret|authorization|cookie|session|email|name|stack|message|subject|description|query|search|prompt|formula|reason|body|content)/i, u = /(^id$|Id$|_id$|_ID$)/, d = [
 	"ticketId",
 	"categoryId",
 	"workspaceId"
-], d = ["workspaceId"], f = {
-	"support.ticket.created": u,
-	"support.ticket.closed": u,
-	"support.ticket.reopened": u,
+], f = ["workspaceId"], p = {
+	"support.ticket.created": d,
+	"support.ticket.closed": d,
+	"support.ticket.reopened": d,
 	"support.kb.article_rated": ["articleId"],
 	"bigconsole.dashboard.imported": ["dashboardId"],
 	"bigconsole.dashboard.share_clicked": ["dashboardId"],
@@ -37,54 +38,54 @@ var s = /* @__PURE__ */ "nav.route.changed,auth.signed_in,auth.signed_out,suppor
 	"bigconsole.ai.dashboard_generated": ["generationId"],
 	"bigconsole.ai.create_dashboard_clicked": ["generationId"],
 	"bigconsole.ai.dashboard_created": ["dashboardId", "generationId"],
-	"healthybowl.farm.created": d,
-	"healthybowl.crop.created": d,
-	"healthybowl.crop.updated": d,
-	"healthybowl.harvest.recorded": d
-}, p = {
+	"healthybowl.farm.created": f,
+	"healthybowl.crop.created": f,
+	"healthybowl.crop.updated": f,
+	"healthybowl.harvest.recorded": f
+}, m = {
 	"auth.signed_out": ["reason"],
 	"psw.search.performed": ["queryLength"]
-}, m = {}, h = "bf-analytics-consent", g = "burdenoff:analytics-consent";
-function _() {
+}, h = {}, g = [], _ = "bf-analytics-consent", v = "burdenoff:analytics-consent";
+function y() {
 	return navigator.globalPrivacyControl === !0;
 }
-function v() {
+function b() {
 	if (typeof window > "u") return null;
-	let e = window.localStorage.getItem(h);
+	let e = window.localStorage.getItem(_);
 	return e === "granted" || e === "denied" ? e : null;
 }
-function y() {
-	return typeof window > "u" || _() ? !1 : v() === "granted";
+function x() {
+	return typeof window > "u" || y() ? !1 : b() === "granted";
 }
-function b(e) {
-	typeof window > "u" || (window.localStorage.setItem(h, e ? "granted" : "denied"), window.dispatchEvent(new CustomEvent(g, { detail: { granted: e } })));
+function S(e) {
+	typeof window > "u" || (window.localStorage.setItem(_, e ? "granted" : "denied"), window.dispatchEvent(new CustomEvent(v, { detail: { granted: e } })));
 }
-function x() {
+function C() {
 	let e = window;
 	return navigator.doNotTrack === "1" || e.doNotTrack === "1";
 }
-function S(e) {
+function w(e) {
 	let t = 2166136261;
 	for (let n = 0; n < e.length; n += 1) t ^= e.charCodeAt(n), t = Math.imul(t, 16777619);
 	return `u_${(t >>> 0).toString(16).padStart(8, "0")}`;
 }
-async function C(e) {
+async function T(e) {
 	if (crypto.subtle) {
 		let t = new TextEncoder().encode(e), n = await crypto.subtle.digest("SHA-256", t);
 		return Array.from(new Uint8Array(n), (e) => e.toString(16).padStart(2, "0")).join("");
 	}
-	return S(e);
+	return w(e);
 }
-function w(e, t) {
-	return c.test(e) ? !(p[t] ?? []).includes(e) : l.test(e) ? !(f[t] ?? []).includes(e) : !1;
+function E(e, t) {
+	return l.test(e) ? !(m[t] ?? []).includes(e) : u.test(e) ? !(p[t] ?? []).includes(e) : !1;
 }
-function T(e, t) {
+function D(e, t) {
 	if (!e || typeof e != "object" || Array.isArray(e)) return {};
 	let n = {};
-	for (let [r, i] of Object.entries(e)) w(r, t) || (typeof i == "string" || typeof i == "number" || typeof i == "boolean") && (n[r] = i);
+	for (let [r, i] of Object.entries(e)) E(r, t) || (typeof i == "string" || typeof i == "number" || typeof i == "boolean") && (n[r] = i);
 	return n;
 }
-function E(e) {
+function O(e) {
 	let t = {};
 	for (let [n, r] of Object.entries(e)) {
 		let e = {
@@ -96,86 +97,89 @@ function E(e) {
 	}
 	return t;
 }
-function D({ siteId: e, scriptUrl: a = "https://app.rybbit.io/api/script.js", rename: o = m, allowlist: c = s, identifyOn: l = "auth.signed_in" }) {
-	let u = t(), d = r(!1), [f, p] = i(y);
-	return n(() => {
-		let e = () => p(y()), t = (t) => {
-			t.key === h && e();
+function k({ siteId: e, scriptUrl: o = "https://app.rybbit.io/api/script.js", rename: s = h, allowlist: l = c, identifyOn: u = "auth.signed_in", skipRoutes: d = g, pathname: f }) {
+	let p = n(), m = i(!1), b = i(null), [S, w] = a(x), E = t(f ?? (typeof window > "u" ? void 0 : window.location.pathname), d);
+	return r(() => {
+		let e = () => w(x()), t = (t) => {
+			t.key === _ && e();
 		};
-		return window.addEventListener(g, e), window.addEventListener("storage", t), () => {
-			window.removeEventListener(g, e), window.removeEventListener("storage", t);
+		return window.addEventListener(v, e), window.addEventListener("storage", t), () => {
+			window.removeEventListener(v, e), window.removeEventListener("storage", t);
 		};
-	}, []), n(() => {
-		if (!e || !f || _() || d.current) return;
-		d.current = !0;
+	}, []), r(() => {
+		if (!e || !S || E || y() || m.current) return;
+		m.current = !0;
 		let t = document.createElement("script");
-		return t.src = a, t.defer = !0, t.dataset.siteId = e, document.head.appendChild(t), () => {
-			document.head.removeChild(t);
-		};
+		t.src = o, t.defer = !0, t.dataset.siteId = e, d.length > 0 && (t.dataset.skipPatterns = JSON.stringify(d)), document.head.appendChild(t), b.current = t;
 	}, [
 		e,
-		a,
-		f
-	]), n(() => {
-		if (!(!e || !f || _())) return u.onAny((e) => {
-			if (x()) return;
-			let t = window;
-			if (!t.rybbit || !c.includes(e.name)) return;
-			let n = E({
+		o,
+		S,
+		E,
+		d
+	]), r(() => () => {
+		b.current?.remove(), b.current = null;
+	}, []), r(() => {
+		if (!(!e || !S || y())) return p.onAny((e) => {
+			if (C()) return;
+			let n = window;
+			if (!n.rybbit || !l.includes(e.name) || t(e.metadata.route.pathname, d)) return;
+			let r = O({
 				route: e.metadata.route.pathname,
 				env: e.metadata.app.env,
-				...T(e.payload, e.name)
+				...D(e.payload, e.name)
 			});
-			if (e.name === l) {
-				let r = e.payload, i = r?.userId ?? r?.actorId ?? r?.id;
-				i && C(i).then((e) => {
-					t.rybbit?.identify(e, n);
+			if (e.name === u) {
+				let t = e.payload, i = t?.userId ?? t?.actorId ?? t?.id;
+				i && T(i).then((e) => {
+					n.rybbit?.identify(e, r);
 				});
 			}
 			if (e.name === "nav.route.changed") {
-				t.rybbit.pageview();
+				n.rybbit.pageview();
 				return;
 			}
-			let r = o[e.name] ?? e.name;
-			t.rybbit.event(r, n);
+			let i = s[e.name] ?? e.name;
+			n.rybbit.event(i, r);
 		});
 	}, [
-		u,
+		p,
 		e,
-		c,
 		l,
-		o,
-		f
+		u,
+		s,
+		S,
+		d
 	]), null;
 }
-function O({ productName: t }) {
-	let [n, r] = i(() => v() === null), s = e();
-	return !n || _() ? null : /* @__PURE__ */ o("aside", {
+function A({ productName: t }) {
+	let [n, r] = a(() => b() === null), i = e();
+	return !n || y() ? null : /* @__PURE__ */ s("aside", {
 		className: "fixed bottom-4 left-4 z-[100] w-[calc(100%-2rem)] max-w-sm rounded-xl border border-border-seam bg-bg-surface p-4 text-text-primary shadow-pop",
-		"aria-label": s("privacyConsent.ariaLabel", "Privacy choices"),
+		"aria-label": i("privacyConsent.ariaLabel", "Privacy choices"),
 		"data-testid": "analytics-consent-banner",
-		children: [/* @__PURE__ */ a("p", {
+		children: [/* @__PURE__ */ o("p", {
 			className: "text-sm",
-			children: s("privacyConsent.message", "Allow optional analytics to help improve {{productName}}? Essential product operation works either way.", { productName: t ?? s("privacyConsent.productFallback", "this product") })
-		}), /* @__PURE__ */ o("div", {
+			children: i("privacyConsent.message", "Allow optional analytics to help improve {{productName}}? Essential product operation works either way.", { productName: t ?? i("privacyConsent.productFallback", "this product") })
+		}), /* @__PURE__ */ s("div", {
 			className: "mt-3 flex gap-2",
-			children: [/* @__PURE__ */ a("button", {
+			children: [/* @__PURE__ */ o("button", {
 				type: "button",
 				className: "rounded-md border border-border-seam px-3 py-2 text-sm",
 				onClick: () => {
-					b(!1), r(!1);
+					S(!1), r(!1);
 				},
-				children: s("privacyConsent.reject", "Reject optional")
-			}), /* @__PURE__ */ a("button", {
+				children: i("privacyConsent.reject", "Reject optional")
+			}), /* @__PURE__ */ o("button", {
 				type: "button",
 				className: "rounded-md bg-action-primary-bg px-3 py-2 text-sm text-action-primary-text",
 				onClick: () => {
-					b(!0), r(!1);
+					S(!0), r(!1);
 				},
-				children: s("privacyConsent.allow", "Allow analytics")
+				children: i("privacyConsent.allow", "Allow analytics")
 			})]
 		})]
 	});
 }
 //#endregion
-export { O as AnalyticsConsentBanner, D as RybbitSink, y as readAnalyticsConsent, v as readAnalyticsConsentChoice, b as setAnalyticsConsent };
+export { A as AnalyticsConsentBanner, c as DEFAULT_RYBBIT_ALLOWLIST, k as RybbitSink, x as readAnalyticsConsent, b as readAnalyticsConsentChoice, S as setAnalyticsConsent };

package/dist/shared/events/sinks/index.d.ts

@@ -3,4 +3,5 @@ export { BroadcastChannelSink } from './BroadcastChannelSink';
 export { BackendAuditSink } from './BackendAuditSink';
 export { RybbitSink, AnalyticsConsentBanner, readAnalyticsConsent, readAnalyticsConsentChoice, setAnalyticsConsent, } from './RybbitSink';
 export type { AnalyticsConsentChoice } from './RybbitSink';
+export { compileRybbitRoutePattern, isRybbitSkippedRoute } from './rybbitRoutes';
 export { OtelBrowserSink } from './OtelBrowserSink';

package/dist/shared/events/sinks/index.js

@@ -1,5 +1,6 @@
 import "./DevtoolsSink.js";
 import "./BroadcastChannelSink.js";
 import "./BackendAuditSink.js";
+import "./rybbitRoutes.js";
 import "./RybbitSink.js";
 import "./OtelBrowserSink.js";

package/dist/shared/events/sinks/rybbitRoutes.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Route patterns on which Rybbit must send nothing (G27).
+ *
+ * The syntax is Rybbit's own `data-skip-patterns` syntax, so one list drives
+ * both halves of the gate: RybbitSink hands it to the Rybbit script (which then
+ * sends no pageview or event while the URL matches) and applies it itself
+ * before injecting the script and before forwarding a bus event.
+ *
+ * - `*` matches one path segment: `/shared/*` matches `/shared/abc`, not `/shared/a/b`.
+ * - `**` matches any number of segments: `/share/**` matches `/share/a/b`.
+ * - `re:<regex>` is a raw regular expression tested against the pathname.
+ *
+ * Patterns are anchored at both ends, the same as Rybbit's matcher.
+ */
+/** Compile one skip pattern exactly as the Rybbit script does. */
+export declare function compileRybbitRoutePattern(pattern: string): RegExp;
+/**
+ * True when `pathname` matches any pattern. An invalid pattern never matches
+ * (Rybbit logs and skips it too), so one typo cannot silence a whole shell.
+ */
+export declare function isRybbitSkippedRoute(pathname: string | undefined, patterns: readonly string[] | undefined): boolean;

package/dist/shared/events/sinks/rybbitRoutes.js

@@ -0,0 +1,20 @@
+//#region src/shared/events/sinks/rybbitRoutes.ts
+var e = "\0DS\0", t = "\0SS\0";
+function n(n) {
+	if (n.startsWith("re:")) {
+		let e = n.slice(3);
+		if (!e) throw Error("Empty regex pattern");
+		return new RegExp(e);
+	}
+	let r = n.replace(/\*\*/g, e).replace(/\*/g, t).replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+	return r = r.split(`/${e}/`).join("/(?:.+/)?"), r = r.split(e).join(".*"), r = r.split(t).join("[^/]+"), RegExp(`^${r}$`);
+}
+function r(e, t) {
+	if (!e || !t || t.length === 0) return !1;
+	for (let r of t) try {
+		if (n(r).test(e)) return !0;
+	} catch {}
+	return !1;
+}
+//#endregion
+export { n as compileRybbitRoutePattern, r as isRybbitSkippedRoute };

package/dist/shared/providers/AppShellProvider.d.ts

@@ -85,6 +85,24 @@ export interface AppShellConfig {
      * purpose is that a stranger can read it.
      */
     consentRouteDenylist?: (pathname: string) => boolean;
+    /**
+     * Extra event names this shell forwards to Rybbit (G27), ADDED to the
+     * platform allowlist (or to `observability.rybbit.allowlist` when the shell
+     * overrides it) instead of replacing it. Lets a shell ship a new product
+     * event without waiting for, or forking, the platform list. Adding a name is
+     * still the deliberate privacy act described in RYBBIT_FRONTEND_ANALYTICS.md;
+     * RybbitSink keeps stripping identifier and sensitive keys either way. Pass a
+     * module-level constant: a new array identity re-subscribes the sink.
+     */
+    rybbitEvents?: readonly BurdenoffEventName[];
+    /**
+     * Routes on which NOTHING is sent to Rybbit (G27): no script load, no
+     * pageview, no event. In Rybbit's skip-pattern syntax (`*` = one segment,
+     * `**` = any depth, `re:` = regex), e.g. `['/shared/*']` for FluidGrids'
+     * public workflow viewer. Independent of `consentRouteDenylist`, which only
+     * hides the consent prompt. Pass a module-level constant.
+     */
+    rybbitSkipRoutes?: readonly string[];
     /**
      * Maps a pathname to the tour `pageId` used when looking up tours.
      *
@@ -159,6 +177,14 @@ export interface AppShellObservabilityEnv {
  * element, they override sonner's stylesheet defaults.
  */
 export declare const RICH_TOAST_TOKEN_STYLE: CSSProperties;
+/**
+ * Adds a shell's own Rybbit event names (`AppShellConfig.rybbitEvents`, G27) to
+ * the allowlist that resolved for it, keeping the base order and dropping
+ * duplicates. With no base allowlist RybbitSink would fall back to
+ * DEFAULT_RYBBIT_ALLOWLIST, so that fallback is the base the extras extend.
+ * Returns the input unchanged when there is nothing to add.
+ */
+export declare function withShellRybbitEvents(config: AppShellObservabilityConfig, extraEvents: readonly BurdenoffEventName[] | undefined): AppShellObservabilityConfig;
 export declare function resolveAppShellObservabilityConfig(productSlug: string, env: AppShellObservabilityEnv): AppShellObservabilityConfig;
 export interface AppShellProviderProps {
     config: AppShellConfig;