@riebeckite/plugin-analytics 0.0.1

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright Rerurate_514
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,136 @@
+# @riebeckite/plugin-analytics
+
+Provider analytics injection for Riebeckite sites: a static bootstrap endpoint
+plus a browser entry that loads it.
+
+[日本語](./README_ja.md)
+
+## Overview
+
+`analytics()` registers:
+
+- one GET endpoint (default `/_analytics.js`) that serves a small provider
+  bootstrap written in JavaScript, and
+- one client entry, `initAnalytics`, that appends
+  `<script defer src="/_analytics.js">` to `document.head` exactly once.
+
+The plugin is build-time only. It never executes provider code during the static
+build.
+
+## Usage
+
+```ts
+import { defineConfig } from "@riebeckite/core";
+import { analytics } from "@riebeckite/plugin-analytics";
+
+export default defineConfig({
+  // ...
+  plugins: [
+    analytics({ provider: "plausible", domain: "example.com" }),
+  ],
+});
+```
+
+Provider examples:
+
+```ts
+analytics({ provider: "plausible", domain: "example.com" });
+analytics({ provider: "umami", siteId: "xxxxxxxx-xxxx-xxxx" });
+analytics({ provider: "umami", siteId: "…", domain: "example.com" });
+analytics({ provider: "google-analytics", measurementId: "G-XXXXXXXXXX" });
+analytics({ provider: "custom", scriptUrl: "https://cdn.example.com/a.js" });
+analytics({ provider: "custom", snippet: "window.__analytics = true;" });
+```
+
+## Options
+
+| Option | Type | Required | Description |
+| ------ | ---- | -------- | ----------- |
+| `provider` | `"plausible" \| "umami" \| "google-analytics" \| "custom"` | yes | Provider whose bootstrap is served |
+| `domain` | `string` | Plausible; optional for Umami | Plausible `data-domain`, or Umami `data-domains` |
+| `siteId` | `string` | Umami | Umami `data-website-id` |
+| `measurementId` | `string` | google-analytics | GA measurement id (`G-…`) |
+| `scriptUrl` | `string` | Provider default | Overrides the provider script URL; the custom script URL when no `snippet` is given |
+| `snippet` | `string` | custom (with no `scriptUrl`) | Raw bootstrap JavaScript, served verbatim |
+| `scriptPath` | `string` | `/_analytics.js` | Endpoint and client script path |
+
+`validateOptions` reports missing or mistyped fields through the standard
+Riebeckite config validation, so `riebeckite check` fails fast on a bad setup.
+
+Provider script URL defaults:
+
+| Provider | Default URL |
+| -------- | ----------- |
+| `plausible` | `https://plausible.io/js/script.js` |
+| `umami` | `https://cloud.umami.is/script.js` |
+| `google-analytics` | `https://www.googletagmanager.com/gtag/js` |
+
+## Endpoint contract
+
+- `GET /_analytics.js`
+- `200 OK`
+- `Content-Type: application/javascript; charset=utf-8`
+- `Cache-Control: public, max-age=3600`
+- Body: a self-executing snippet that creates the provider `<script>` tag
+  (`async`/`defer` as appropriate). All configured values are JSON-encoded, so
+  they cannot break out of their string literals.
+
+`google-analytics` also defines `window.dataLayer` and `window.gtag` before
+configuring the measurement id. `custom` returns the `snippet` verbatim, or a
+generic loader for `scriptUrl`.
+
+## Client behavior (`initAnalytics`)
+
+- Runs on page load through `initRiebeckiteClient()`; no component or layout
+  change is required.
+- Appends one `<script defer src="/_analytics.js" data-riebeckite-analytics>`
+  to `document.head`, and is a no-op if that tag already exists.
+
+## Privacy and trust boundary
+
+- No analytics data is collected at build time; the endpoint only serves code.
+- The `custom` provider's `snippet` (or any `scriptUrl`) is injected as-is into
+  visitors' pages. Treat it as trusted configuration, never as user input.
+- Nothing is sanitized or proxied: whatever provider you configure receives the
+  requests directly from the browser, under the site's own origin and privacy
+  policy.
+
+## Verifiability
+
+Static builds do not execute client JavaScript. To keep analytics verifiable in
+built HTML, `onManifestCreated` appends functional tags to every entry:
+
+```html
+<link rel="preload" as="script" href="/_analytics.js" />
+<script defer src="/_analytics.js" data-riebeckite-analytics></script>
+```
+
+These are the real tags the browser would load, so no fabricated marker is
+inserted. The injection is idempotent (guarded by `data-riebeckite-analytics`)
+and does not alter the surrounding document structure.
+
+## Limitations
+
+- **Static client path.** The client entry receives no options, so it always
+  loads `/_analytics.js`. If you override `scriptPath`, mount the endpoint and
+  load it yourself with a custom client entry.
+- **No SPA route tracking.** Client-side routed SPA navigations are not
+  reported automatically; configure the provider or send events manually.
+- **Document lifecycle only.** The bootstrap runs once on initial load. Provide
+  your own `snippet` if you need a more involved lifecycle.
+- **No consent management.** The plugin does not gate loading on user consent;
+  add that in a client entry if your jurisdiction requires it.
+
+## Exports
+
+- `analytics(options)` / `analyticsPlugin(options)` — plugin factory
+- `initAnalytics` — browser initializer (also via
+  `@riebeckite/plugin-analytics/client`)
+- `buildAnalyticsScript(options)` — pure bootstrap builder
+- `validateAnalyticsOptions(options)` — options validator
+- Constants: `ANALYTICS_SCRIPT_PATH`, `ANALYTICS_SCRIPT_ATTRIBUTE`
+- Types: `AnalyticsOptions`, `AnalyticsProvider`
+
+## See also
+
+- [Plugin guide](../../docs/plugins_en.md)

package/README_ja.md

@@ -0,0 +1,113 @@
+# @riebeckite/plugin-analytics
+
+サイトに外部プロバイダの解析タグを挿入するプラグインです。静的なブートストラップ用エンドポイントと、それを読み込むクライアントエントリを提供します。
+
+[English](./README.md)
+
+## 概要
+
+`analytics()` は次の2つを登録します。
+
+- プロバイダのブートストラップ JavaScript を返す GET エンドポイント（既定は `/_analytics.js`）
+- `document.head` に `<script defer src="/_analytics.js">` を一度だけ追加するクライアントエントリ `initAnalytics`
+
+このプラグインはビルド時に完結します。静的ビルド中にプロバイダのコードを実行することはありません。
+
+## 使い方
+
+```ts
+import { defineConfig } from "@riebeckite/core";
+import { analytics } from "@riebeckite/plugin-analytics";
+
+export default defineConfig({
+  // ...
+  plugins: [
+    analytics({ provider: "plausible", domain: "example.com" }),
+  ],
+});
+```
+
+プロバイダごとの例:
+
+```ts
+analytics({ provider: "plausible", domain: "example.com" });
+analytics({ provider: "umami", siteId: "xxxxxxxx-xxxx-xxxx" });
+analytics({ provider: "umami", siteId: "…", domain: "example.com" });
+analytics({ provider: "google-analytics", measurementId: "G-XXXXXXXXXX" });
+analytics({ provider: "custom", scriptUrl: "https://cdn.example.com/a.js" });
+analytics({ provider: "custom", snippet: "window.__analytics = true;" });
+```
+
+## オプション
+
+| 項目 | 型 | 必須 | 説明 |
+| --- | --- | --- | --- |
+| `provider` | `"plausible" \| "umami" \| "google-analytics" \| "custom"` | はい | 使用するプロバイダ |
+| `domain` | `string` | Plausible では必須、Umami では任意 | Plausible の `data-domain`、または Umami の `data-domains` |
+| `siteId` | `string` | Umami | Umami の `data-website-id` |
+| `measurementId` | `string` | google-analytics | GA の測定 ID（`G-…`） |
+| `scriptUrl` | `string` | プロバイダの既定値 | プロバイダのスクリプト URL を上書きします。`snippet` がない custom では読み込む URL |
+| `snippet` | `string` | custom（`scriptUrl` がない場合） | そのまま配信される生のブートストラップ JavaScript |
+| `scriptPath` | `string` | `/_analytics.js` | エンドポイント兼クライアントスクリプトのパス |
+
+`validateOptions` は不足・型違いのフィールドを標準の設定検証として報告するため、設定ミスは `riebeckite check` で早い段階に失敗します。
+
+プロバイダの既定スクリプト URL:
+
+| プロバイダ | 既定 URL |
+| --- | --- |
+| `plausible` | `https://plausible.io/js/script.js` |
+| `umami` | `https://cloud.umami.is/script.js` |
+| `google-analytics` | `https://www.googletagmanager.com/gtag/js` |
+
+## エンドポイントの契約
+
+- `GET /_analytics.js`
+- `200 OK`
+- `Content-Type: application/javascript; charset=utf-8`
+- `Cache-Control: public, max-age=3600`
+- 本文: プロバイダの `<script>` タグ（必要に応じて `async` / `defer`）を生成する即時実行スニペット。設定値はすべて JSON エンコードされるため、文字列リテラルを壊すことはできません。
+
+`google-analytics` は測定 ID を設定する前に `window.dataLayer` と `window.gtag` を定義します。`custom` は `snippet` をそのまま返すか、`scriptUrl` 用の汎用ローダーを返します。
+
+## クライアントの挙動（`initAnalytics`）
+
+- `initRiebeckiteClient()` 経由でページ読み込み時に実行されます。コンポーネントやレイアウトの変更は不要です。
+- `<script defer src="/_analytics.js" data-riebeckite-analytics>` を `document.head` に1つ追加します。すでに存在する場合は何もしません。
+
+## プライバシーと信頼境界
+
+- ビルド時に解析データを収集することはありません。エンドポイントはコードを返すだけです。
+- `custom` の `snippet`（および任意の `scriptUrl`）は訪問者のページにそのまま挿入されます。信頼できる設定として扱い、ユーザー入力から組み立てないでください。
+- 内容のサニタイズやプロキシは行いません。設定したプロバイダは、サイト自身のオリジンとプライバシー方針のもとでブラウザから直接リクエストを受け取ります。
+
+## 検証しやすさ
+
+静的ビルドではクライアント JavaScript を実行しません。そのため、`onManifestCreated` が全エントリの HTML に実際に機能するタグを付与します。
+
+```html
+<link rel="preload" as="script" href="/_analytics.js" />
+<script defer src="/_analytics.js" data-riebeckite-analytics></script>
+```
+
+これはブラウザが実際に読み込むタグそのもので、検証用のダミーマーカーは挿入しません。付与は冪等（`data-riebeckite-analytics` で判定）で、周囲の HTML 構造を変えません。
+
+## 制限事項
+
+- **クライアント側のパスは固定です。** クライアントエントリはオプションを受け取らないため、常に `/_analytics.js` を読み込みます。`scriptPath` を変更する場合は、エンドポイントのマウントと読み込みを独自のクライアントエントリで行ってください。
+- **SPA のルート遷移には対応しません。** クライアントサイドのルーティングによる画面遷移は自動では計測されません。プロバイダ側で設定するか、手動でイベントを送信してください。
+- **ドキュメントのライフサイクルは初回読み込みのみです。** より複雑なライフサイクルが必要な場合は独自の `snippet` を用意してください。
+- **同意管理は行いません。** 法令上必要な場合は、クライアントエントリ側で同意を得るまで読み込みを止めてください。
+
+## 主なエクスポート
+
+- `analytics(options)` / `analyticsPlugin(options)`: プラグインを作成する
+- `initAnalytics`: クライアント側の初期化（`@riebeckite/plugin-analytics/client` からも利用可）
+- `buildAnalyticsScript(options)`: ブートストラップを生成する純粋関数
+- `validateAnalyticsOptions(options)`: オプションの検証
+- 定数: `ANALYTICS_SCRIPT_PATH`、`ANALYTICS_SCRIPT_ATTRIBUTE`
+- 型: `AnalyticsOptions`、`AnalyticsProvider`
+
+## 関連資料
+
+- [プラグインガイド](../../../docs/ja/plugin-system.md)

package/dist/client.d.ts

@@ -0,0 +1,3 @@
+export { ANALYTICS_SCRIPT_PATH } from "./src/constants.js";
+export { initAnalytics } from "./src/init.js";
+export type { AnalyticsProvider } from "./src/options.js";

package/dist/client.js

@@ -0,0 +1,18 @@
+// src/constants.ts
+var ANALYTICS_SCRIPT_PATH = "/_analytics.js";
+var ANALYTICS_SCRIPT_ATTRIBUTE = "data-riebeckite-analytics";
+
+// src/init.ts
+function initAnalytics() {
+  if (typeof document === "undefined") return;
+  if (document.querySelector(`script[${ANALYTICS_SCRIPT_ATTRIBUTE}]`)) return;
+  const script = document.createElement("script");
+  script.defer = true;
+  script.src = ANALYTICS_SCRIPT_PATH;
+  script.setAttribute(ANALYTICS_SCRIPT_ATTRIBUTE, "");
+  document.head.appendChild(script);
+}
+export {
+  ANALYTICS_SCRIPT_PATH,
+  initAnalytics
+};

package/dist/index.d.ts

@@ -0,0 +1,18 @@
+import { type AnalyticsOptions } from "./src/options.js";
+export { ANALYTICS_SCRIPT_ATTRIBUTE, ANALYTICS_SCRIPT_PATH, } from "./src/constants.js";
+export { initAnalytics } from "./src/init.js";
+export type { AnalyticsOptions, AnalyticsProvider } from "./src/options.js";
+export { ANALYTICS_PROVIDERS, validateAnalyticsOptions } from "./src/options.js";
+export { buildAnalyticsScript } from "./src/script.js";
+/**
+ * Injects a provider analytics bootstrap into every page.
+ *
+ * The provider snippet is served from a static endpoint (`/_analytics.js` by
+ * default) and loaded by the `initAnalytics` client entry. Because client
+ * entries are static and receive no plugin options, the endpoint path is a
+ * compile-time constant; overriding `scriptPath` requires a custom client
+ * entry (see the README).
+ */
+export declare function analytics(options: AnalyticsOptions): import("@riebeckite/core").RiebeckitePlugin<AnalyticsOptions>;
+/** Alias kept for symmetry with the other `*Plugin` factories. */
+export declare const analyticsPlugin: typeof analytics;

package/dist/index.js

@@ -0,0 +1,246 @@
+// index.ts
+import {
+  createClientEntry,
+  defineEndpoint,
+  definePlugin,
+  escapeHtmlAttribute
+} from "@riebeckite/core";
+
+// src/constants.ts
+var ANALYTICS_SCRIPT_PATH = "/_analytics.js";
+var ANALYTICS_SCRIPT_ATTRIBUTE = "data-riebeckite-analytics";
+
+// src/options.ts
+var ANALYTICS_PROVIDERS = [
+  "plausible",
+  "umami",
+  "google-analytics",
+  "custom"
+];
+function validateAnalyticsOptions(options) {
+  const issues = [];
+  if (!options) {
+    issues.push({ path: "provider", message: providerMessage() });
+    return issues;
+  }
+  if (!isProvider(options.provider)) {
+    issues.push({ path: "provider", message: providerMessage() });
+  }
+  validateOptionalString(options.domain, "domain", issues);
+  validateOptionalString(options.siteId, "siteId", issues);
+  validateOptionalString(options.measurementId, "measurementId", issues);
+  validateOptionalString(options.scriptUrl, "scriptUrl", issues);
+  validateOptionalString(options.snippet, "snippet", issues);
+  if (options.provider === "plausible" && !hasText(options.domain)) {
+    issues.push({ path: "domain", message: "Plausible requires a domain." });
+  }
+  if (options.provider === "umami" && !hasText(options.siteId)) {
+    issues.push({ path: "siteId", message: "Umami requires a site id." });
+  }
+  if (options.provider === "google-analytics" && !hasText(options.measurementId)) {
+    issues.push({
+      path: "measurementId",
+      message: "google-analytics requires a measurement id."
+    });
+  }
+  if (options.provider === "custom" && !hasText(options.snippet) && !hasText(options.scriptUrl)) {
+    issues.push({
+      path: "snippet",
+      message: "custom requires a snippet or a scriptUrl."
+    });
+  }
+  if (options.scriptPath !== void 0 && !isStaticPath(options.scriptPath)) {
+    issues.push({
+      path: "scriptPath",
+      message: 'Expected a static path starting with "/".'
+    });
+  }
+  return issues;
+}
+function isProvider(value) {
+  return typeof value === "string" && ANALYTICS_PROVIDERS.includes(value);
+}
+function providerMessage() {
+  return `Expected one of: ${ANALYTICS_PROVIDERS.join(", ")}.`;
+}
+function hasText(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+function validateOptionalString(value, path, issues) {
+  if (value !== void 0 && typeof value !== "string") {
+    issues.push({ path, message: "Expected a string." });
+  }
+}
+function isStaticPath(value) {
+  return value.startsWith("/") && value.length > 1 && !/[\s?#:]/.test(value) && !value.includes("//") && value !== "/assets" && !value.startsWith("/assets/");
+}
+
+// src/script.ts
+var PLAUSIBLE_SCRIPT_URL = "https://plausible.io/js/script.js";
+var UMAMI_SCRIPT_URL = "https://cloud.umami.is/script.js";
+var GOOGLE_ANALYTICS_SCRIPT_URL = "https://www.googletagmanager.com/gtag/js";
+function buildAnalyticsScript(options) {
+  switch (options.provider) {
+    case "plausible":
+      return buildPlausibleScript(options);
+    case "umami":
+      return buildUmamiScript(options);
+    case "google-analytics":
+      return buildGoogleAnalyticsScript(options);
+    case "custom":
+      return buildCustomScript(options);
+    default:
+      return "/* @riebeckite/plugin-analytics: unsupported provider */\n";
+  }
+}
+function buildPlausibleScript(options) {
+  const domain = options.domain ?? "";
+  const url = options.scriptUrl ?? PLAUSIBLE_SCRIPT_URL;
+  return [
+    "/* @riebeckite/plugin-analytics: plausible */",
+    "(function () {",
+    '  var script = document.createElement("script");',
+    "  script.defer = true;",
+    `  script.setAttribute("data-domain", ${jsString(domain)});`,
+    `  script.src = ${jsString(url)};`,
+    "  document.head.appendChild(script);",
+    "})();",
+    ""
+  ].join("\n");
+}
+function buildUmamiScript(options) {
+  const siteId = options.siteId ?? "";
+  const domain = options.domain;
+  const url = options.scriptUrl ?? UMAMI_SCRIPT_URL;
+  const lines = [
+    "/* @riebeckite/plugin-analytics: umami */",
+    "(function () {",
+    '  var script = document.createElement("script");',
+    "  script.defer = true;",
+    `  script.setAttribute("data-website-id", ${jsString(siteId)});`
+  ];
+  if (domain) {
+    lines.push(`  script.setAttribute("data-domains", ${jsString(domain)});`);
+  }
+  lines.push(
+    `  script.src = ${jsString(url)};`,
+    "  document.head.appendChild(script);",
+    "})();",
+    ""
+  );
+  return lines.join("\n");
+}
+function buildGoogleAnalyticsScript(options) {
+  const measurementId = options.measurementId ?? "";
+  const base = options.scriptUrl ?? GOOGLE_ANALYTICS_SCRIPT_URL;
+  const source = `${base}?id=${encodeURIComponent(measurementId)}`;
+  return [
+    "/* @riebeckite/plugin-analytics: google-analytics */",
+    "(function () {",
+    `  var id = ${jsString(measurementId)};`,
+    '  var script = document.createElement("script");',
+    "  script.async = true;",
+    `  script.src = ${jsString(source)};`,
+    "  document.head.appendChild(script);",
+    "  window.dataLayer = window.dataLayer || [];",
+    "  function gtag() { window.dataLayer.push(arguments); }",
+    "  window.gtag = gtag;",
+    '  gtag("js", new Date());',
+    '  gtag("config", id);',
+    "})();",
+    ""
+  ].join("\n");
+}
+function buildCustomScript(options) {
+  if (options.snippet?.trim()) {
+    return `${options.snippet.trimEnd()}
+`;
+  }
+  const url = options.scriptUrl ?? "";
+  return [
+    "/* @riebeckite/plugin-analytics: custom */",
+    "(function () {",
+    '  var script = document.createElement("script");',
+    "  script.defer = true;",
+    `  script.src = ${jsString(url)};`,
+    "  document.head.appendChild(script);",
+    "})();",
+    ""
+  ].join("\n");
+}
+function jsString(value) {
+  const encoded = JSON.stringify(value);
+  return encoded === void 0 ? '""' : encoded;
+}
+
+// src/init.ts
+function initAnalytics() {
+  if (typeof document === "undefined") return;
+  if (document.querySelector(`script[${ANALYTICS_SCRIPT_ATTRIBUTE}]`)) return;
+  const script = document.createElement("script");
+  script.defer = true;
+  script.src = ANALYTICS_SCRIPT_PATH;
+  script.setAttribute(ANALYTICS_SCRIPT_ATTRIBUTE, "");
+  document.head.appendChild(script);
+}
+
+// index.ts
+function analytics(options) {
+  const scriptPath = options.scriptPath ?? ANALYTICS_SCRIPT_PATH;
+  const tracked = /* @__PURE__ */ new Map();
+  return definePlugin({
+    name: "analytics",
+    options,
+    validateOptions: validateAnalyticsOptions,
+    endpoints: [
+      defineEndpoint(
+        scriptPath,
+        () => ({
+          headers: {
+            "content-type": "application/javascript; charset=utf-8"
+          },
+          body: buildAnalyticsScript(options)
+        }),
+        { cacheControl: "public, max-age=3600" }
+      )
+    ],
+    clientEntries: [createClientEntry("analytics", "initAnalytics")],
+    onPostProcessed: (context) => {
+      tracked.set(context.slug, context.content);
+    },
+    onManifestCreated: (context) => {
+      const tags = buildAnalyticsTags(scriptPath);
+      for (const entry of context.manifest.entries) {
+        appendAnalyticsTags(entry, tracked.get(entry.slug), tags);
+      }
+    }
+  });
+}
+var analyticsPlugin = analytics;
+function buildAnalyticsTags(scriptPath) {
+  const href = escapeHtmlAttribute(scriptPath);
+  return [
+    `<link rel="preload" as="script" href="${href}" />`,
+    `<script defer src="${href}" ${ANALYTICS_SCRIPT_ATTRIBUTE}></script>`
+  ].join("\n");
+}
+function appendAnalyticsTags(entry, content, tags) {
+  if (!entry.html.includes(ANALYTICS_SCRIPT_ATTRIBUTE)) {
+    entry.html = `${entry.html}
+${tags}`;
+  }
+  if (content && !content.html.includes(ANALYTICS_SCRIPT_ATTRIBUTE)) {
+    content.html = `${content.html}
+${tags}`;
+  }
+}
+export {
+  ANALYTICS_PROVIDERS,
+  ANALYTICS_SCRIPT_ATTRIBUTE,
+  ANALYTICS_SCRIPT_PATH,
+  analytics,
+  analyticsPlugin,
+  buildAnalyticsScript,
+  initAnalytics,
+  validateAnalyticsOptions
+};

package/dist/src/constants.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Default path of the analytics bootstrap endpoint and of the `<script>` tag
+ * the client entry injects.
+ *
+ * Client entries are static — they receive no plugin options — so the built-in
+ * `initAnalytics` always loads this exact path. Overriding `scriptPath` mounts
+ * the endpoint elsewhere and requires a custom client entry; the default is
+ * kept here so both sides share one compile-time constant.
+ */
+export declare const ANALYTICS_SCRIPT_PATH = "/_analytics.js";
+/**
+ * `data-*` attribute that marks the analytics `<script>` tag.
+ *
+ * The server-side injection (`onManifestCreated`) and the browser initializer
+ * (`initAnalytics`) both carry this attribute, so a built page can be verified
+ * from its real output and the initializer stays idempotent.
+ */
+export declare const ANALYTICS_SCRIPT_ATTRIBUTE = "data-riebeckite-analytics";

package/dist/src/init.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Injects the analytics bootstrap `<script>` into `document.head` exactly once.
+ * The bootstrap endpoint then loads the configured provider script.
+ *
+ * This initializer is static: it always loads `ANALYTICS_SCRIPT_PATH`. It has
+ * no SPA route awareness — see the README for the documented limitations.
+ */
+export declare function initAnalytics(): void;

package/dist/src/options.d.ts

@@ -0,0 +1,32 @@
+import type { ConfigValidationIssue } from "@riebeckite/core";
+/** Analytics providers supported by the built-in bootstrap. */
+export declare const ANALYTICS_PROVIDERS: readonly ["plausible", "umami", "google-analytics", "custom"];
+export type AnalyticsProvider = (typeof ANALYTICS_PROVIDERS)[number];
+export type AnalyticsOptions = {
+    /** Provider whose bootstrap is served. */
+    provider: AnalyticsProvider;
+    /** Plausible domain, or optional Umami `data-domains` value. */
+    domain?: string;
+    /** Umami website id (`data-website-id`). */
+    siteId?: string;
+    /** Google Analytics measurement id (`G-XXXXXXX`). */
+    measurementId?: string;
+    /**
+     * Overrides the provider's default script URL. For `provider: "custom"` this
+     * is the script URL loaded when no `snippet` is given.
+     */
+    scriptUrl?: string;
+    /**
+     * Raw bootstrap JavaScript for `provider: "custom"`. This value is trusted:
+     * it is served verbatim from the endpoint. Do not build it from untrusted
+     * input.
+     */
+    snippet?: string;
+    /**
+     * Endpoint and client script path. Defaults to `ANALYTICS_SCRIPT_PATH`
+     * (`/_analytics.js`). The built-in client entry always uses the default, so
+     * changing this requires a matching custom client entry.
+     */
+    scriptPath?: string;
+};
+export declare function validateAnalyticsOptions(options: AnalyticsOptions | undefined): readonly ConfigValidationIssue[];

package/dist/src/script.d.ts

@@ -0,0 +1,10 @@
+import type { AnalyticsOptions } from "./options.js";
+/**
+ * Builds the JavaScript served from the analytics endpoint.
+ *
+ * Every configured value is JSON-encoded before it is embedded, so a value can
+ * never break out of the string literal that holds it. The one exception is
+ * `provider: "custom"` with a `snippet`, which is intentionally trusted and
+ * returned verbatim.
+ */
+export declare function buildAnalyticsScript(options: AnalyticsOptions): string;

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@riebeckite/plugin-analytics",
+  "version": "0.0.1",
+  "license": "Apache-2.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "source": "./index.ts",
+      "default": "./dist/index.js"
+    },
+    "./client": {
+      "types": "./dist/client.d.ts",
+      "import": "./dist/client.js",
+      "source": "./client.ts",
+      "default": "./dist/client.js"
+    }
+  },
+  "dependencies": {
+    "@riebeckite/core": "0.0.1"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "LICENSE",
+    "README.md",
+    "README_ja.md",
+    "dist"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Rerurate514/riebeckite.git",
+    "directory": "packages/plugins/analytics"
+  },
+  "homepage": "https://github.com/Rerurate514/riebeckite#readme",
+  "bugs": {
+    "url": "https://github.com/Rerurate514/riebeckite/issues"
+  },
+  "description": "Analytics provider integration for Riebeckite sites.",
+  "keywords": [
+    "riebeckite",
+    "plugin",
+    "analytics",
+    "web-analytics"
+  ],
+  "engines": {
+    "node": "^20.19.0 || >=22.12.0"
+  },
+  "sideEffects": false,
+  "scripts": {
+    "build": "node ../../../scripts/build_package.mjs"
+  }
+}