@usequark/quark-create-app 1.27.1 → 1.27.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usequark/quark-create-app",
-  "version": "1.27.1",
+  "version": "1.27.3",
   "description": "CLI to scaffold new Quark projects with Next.js, Prisma, BullMQ, and Railway deployment",
   "keywords": [
     "quark",

package/templates/base-project/apps/web/.env.example

@@ -61,15 +61,21 @@ NEXTAUTH_SECRET=replace_with_a_long_random_secret
 # Staging and preview environments should leave this unset so they are not indexed.
 # ALLOW_INDEXING=true
 
-# --- Optional: Umami Analytics ---
+# --- Optional: Umami Analytics (first-party proxy) ---
 # Leave all three unset to disable analytics cleanly.
-# Set URL + website ID to load Umami script.js in the root layout head.
+# Set URL + website ID to load the tracker from the first-party proxy
+# (GET /s/script.js) in the root layout head. Beacons and replay batches
+# POST same-origin to /s/api/send, /s/api/collect, and /s/api/record, so
+# blocklists never see the upstream host and CSP stays 'self'-only.
 # Replay stays off unless NEXT_PUBLIC_UMAMI_REPLAY_ENABLED=true.
 # Umami Links and Pixels are dashboard-generated URLs, so the scaffold does not add extra env vars for them.
 # Use tracked links in campaigns/emails and pixel URLs only in HTML emails or external pages.
 # NEXT_PUBLIC_UMAMI_URL=https://stats.example.com
 # NEXT_PUBLIC_UMAMI_WEBSITE_ID=00000000-0000-0000-0000-000000000000
 # NEXT_PUBLIC_UMAMI_REPLAY_ENABLED=false
+# Optional server-only override for the proxy destination (takes precedence
+# over NEXT_PUBLIC_UMAMI_URL; never exposed to the browser):
+# UMAMI_UPSTREAM_URL=https://stats.example.com
 
 # --- Web App Configuration ---
 PORT=3005
@@ -112,6 +118,18 @@ ADMIN_PASSWORD=SET_ME
 # cannot earn a fresh bucket. Boolean-like: true/false/1/0/yes/no/on/off.
 # TRUST_PROXY_HEADERS=true
 
+# --- Umami Ingest Proxy & Cloudflare ---
+# The first-party analytics proxy (/s/*) resolves the visitor IP from proxy
+# headers. Unlike x-forwarded-for, CF-Connecting-IP is NOT sanitized by
+# generic proxies (Railway, nginx, Docker pass it through), so trusting it
+# unconditionally would let any client override a legitimate X-Forwarded-For.
+# Default (unset) ignores it. Set to true ONLY when Cloudflare sits in front
+# of the app (it overwrites the header with the true client IP): correct geo
+# and stable Umami sessions behind Cloudflare → Railway. Boolean-like:
+# true/1/yes/on enable; anything else (including unset) disables.
+# Independent of TRUST_PROXY_HEADERS, which still forces "unknown" when false.
+# TRUST_CF_CONNECTING_IP=true
+
 # --- File Storage ---
 # Default: local filesystem (./uploads). No further config needed for development.
 STORAGE_PROVIDER=local

package/templates/base-project/apps/web/next.config.js

@@ -1,5 +1,4 @@
 import { hostname, networkInterfaces } from "node:os";
-
 import { buildContentSecurityPolicy } from "./src/lib/analytics/umami-csp.js";
 
 function getLocalNetworkHosts() {
@@ -127,10 +126,16 @@ const nextConfig = {
 		},
 	},
 
-	// API route configuration
-	async rewrites() {
-		return [];
-	},
+	// First-party Umami proxy: GET /s/script.js and POST
+	// /s/api/send|collect|record are served by Route Handlers under
+	// src/app/s/*, not rewrites(). A handler is required in both cases:
+	// rewrites proxy incoming request headers unchanged, which would forward
+	// app session cookies to the analytics host (script) and cannot strip or
+	// append the ingest headers (cookie strip, X-Forwarded-For for geo,
+	// x-umami-cache for replay).
+	// NOTE: the tracker destination is resolved at request time from
+	// UMAMI_UPSTREAM_URL (preferred) or NEXT_PUBLIC_UMAMI_URL, so unlike
+	// rewrites() it needs no rebuild to take effect — only a restart.
 
 	// Compiler options for production optimization
 	compiler: {

package/templates/base-project/apps/web/src/app/_components/UmamiReplayRecorder.js

@@ -3,7 +3,7 @@
 import { usePathname } from "next/navigation";
 import { useEffect, useEffectEvent, useRef } from "react";
 import { isUmamiStaff } from "../../lib/analytics/umami.js";
-import { getUmamiConfig } from "../../lib/analytics/umami-config.js";
+import { getUmamiClientConfig } from "../../lib/analytics/umami-config.js";
 import {
 	buildReplayEndpoint,
 	createReplayBuffer,
@@ -65,7 +65,7 @@ export default function UmamiReplayRecorder() {
 	);
 
 	useEffect(() => {
-		const umamiConfig = getUmamiConfig();
+		const umamiConfig = getUmamiClientConfig();
 		if (!umamiConfig.replayEnabled || !shouldSampleReplay()) {
 			return undefined;
 		}
@@ -92,7 +92,7 @@ export default function UmamiReplayRecorder() {
 			if (cancelled) return;
 
 			cacheRef.current = cache;
-			endpointRef.current = buildReplayEndpoint(umamiConfig.url);
+			endpointRef.current = umamiConfig.proxyRecordUrl || buildReplayEndpoint();
 			websiteIdRef.current = umamiConfig.websiteId;
 			startedAtRef.current = Date.now();
 

package/templates/base-project/apps/web/src/app/_components/UmamiWebVitals.js

@@ -2,7 +2,7 @@
 
 import { useEffect } from "react";
 import { isUmamiStaff } from "../../lib/analytics/umami.js";
-import { getUmamiConfig } from "../../lib/analytics/umami-config.js";
+import { getUmamiClientConfig } from "../../lib/analytics/umami-config.js";
 import { observeWebVitals } from "../../lib/analytics/umami-web-vitals.js";
 
 /**
@@ -22,7 +22,7 @@ import { observeWebVitals } from "../../lib/analytics/umami-web-vitals.js";
  */
 export default function UmamiWebVitals() {
 	useEffect(() => {
-		const config = getUmamiConfig();
+		const config = getUmamiClientConfig();
 		if (!config.enabled) return;
 
 		// Skip web vitals dispatch for any staff user (identified by the

package/templates/base-project/apps/web/src/app/layout.js

@@ -21,6 +21,9 @@ const themeScript = `(function(){try{var t=localStorage.getItem("${THEME_STORAGE
 const umamiBeforeSendScript = buildUmamiBeforeSendScript();
 
 export default function RootLayout({ children }) {
+	// Server config deliberately: the gate stays upstream-aware so a missing
+	// upstream never emits a 404 script tag, while only websiteId + proxy
+	// paths reach the HTML. Browser code uses getUmamiClientConfig instead.
 	const umamiConfig = getUmamiConfig();
 
 	return (
@@ -31,21 +34,14 @@ export default function RootLayout({ children }) {
 				{/* biome-ignore lint/security/noDangerouslySetInnerHtml: static inline before-send handler */}
 				<script dangerouslySetInnerHTML={{ __html: umamiBeforeSendScript }} />
 				{umamiConfig.enabled ? (
-					<>
-						<link
-							crossOrigin="anonymous"
-							href={umamiConfig.origin}
-							rel="preconnect"
-						/>
-						<link href={umamiConfig.dnsPrefetchHref} rel="dns-prefetch" />
-						<script
-							defer
-							data-performance="true"
-							data-website-id={umamiConfig.websiteId}
-							src={umamiConfig.scriptUrl}
-							data-before-send="__umamiBeforeSend"
-						/>
-					</>
+					<script
+						defer
+						data-performance="true"
+						data-website-id={umamiConfig.websiteId}
+						data-host-url={umamiConfig.proxyHostUrl}
+						src={umamiConfig.proxyScriptUrl}
+						data-before-send="__umamiBeforeSend"
+					/>
 				) : null}
 			</head>
 			<body>

package/templates/base-project/apps/web/src/app/s/api/[endpoint]/route.js

@@ -0,0 +1,328 @@
+/**
+ * Umami First-Party Ingest Proxy
+ *
+ * POST /s/api/send|collect|record → upstream Umami /api/*.
+ *
+ * Why this exists: the tracker, web-vitals beacons, and replay batches would
+ * otherwise POST directly to the upstream analytics host, which blocklists
+ * (EasyPrivacy / uBlock / Brave) match as third-party. Same-origin ingest
+ * survives those lists while keeping geo, browser stats, and CSP tightness.
+ *
+ * Security shape (load-bearing, do not loosen without review):
+ * - Endpoint whitelist — never interpolate the raw route param into the
+ *   upstream URL, or this becomes an open proxy to the analytics host.
+ * - POST-only — every other method answers 405.
+ * - Header hygiene — `cookie`, `authorization`, and `x-metrics-token` are
+ *   never forwarded; only the analytics-relevant headers cross the boundary.
+ * - `X-Forwarded-For` / `X-Real-IP` carry the single resolved visitor IP so
+ *   Umami geolocates the visitor, not the Railway egress IP — unless
+ *   TRUST_PROXY_HEADERS=false, in which case "unknown" crosses instead (same
+ *   rule as proxy.js). Resolution prefers `CF-Connecting-IP`, but only with
+ *   explicit opt-in (`TRUST_CF_CONNECTING_IP=true`, for Cloudflare-fronted
+ *   deployments): the header takes precedence yet generic proxies pass it
+ *   through unsanitized, so unconditional trust would let any client override
+ *   a legitimate X-Forwarded-For. `CF-Connecting-IP` passthrough follows the
+ *   same opt-in — never when untrusted. Tracker metadata (`x-umami-cache`) is forwarded; `cookie`,
+ *   `authorization`, and `x-metrics-token` never are.
+ * - 1 MB body cap enforced while streaming (a missing/lying Content-Length
+ *   cannot force full buffering) + 5s upstream timeout bound abuse cost.
+ * - `Cache-Control: no-store` on every response; upstream `Set-Cookie` is
+ *   stripped and never reaches the browser.
+ * - Fail-open 202 on upstream 5xx/timeout so analytics never fails the
+ *   product flow — and never retry-storms a struggling upstream. The body
+ *   is endpoint-aware: `record` answers `{ ok: false }` so replay batches
+ *   are retained and retried, while `send`/`collect` answer `{ ok: true }`
+ *   because those beacons have no retry path.
+ *
+ * Deliberately NOT rate-limited by proxy.js: that limiter keys on `/api/*`
+ * paths and analytics beacons must never 429. The body cap, content-type
+ * gate, and timeout are the abuse bounds here.
+ */
+
+import { createLogger } from "@usequark/quark-core/core";
+import { NextResponse } from "next/server";
+import { getUmamiUpstreamBase } from "@/lib/analytics/umami-config.js";
+import {
+	shouldTrustCfConnectingIp,
+	shouldTrustProxyHeaders,
+} from "@/lib/proxy-auth.js";
+
+const logger = createLogger("umami-proxy");
+
+const ALLOWED_ENDPOINTS = new Set(["send", "collect", "record"]);
+const MAX_BODY_BYTES = 1_000_000;
+const UPSTREAM_TIMEOUT_MS = 5000;
+
+function noStoreHeaders(extra = {}) {
+	return { "Cache-Control": "no-store", ...extra };
+}
+
+function methodNotAllowed() {
+	return NextResponse.json(
+		{ error: "Method not allowed" },
+		{ status: 405, headers: noStoreHeaders() },
+	);
+}
+
+// Fail-open without losing replay data. Tracker, web-vitals, and legacy
+// `collect` beacons are fire-and-forget with no retry path, so they keep
+// `{ ok: true }` to avoid any client-side retry storm against a struggling
+// upstream. Replay (`record`) has a restore/retry path keyed on
+// `body.ok === false` in postReplayBatch: answering `ok: true` there would
+// discard the batch, so record answers `ok: false` and the events are
+// retained and retried.
+function failOpenResponse(endpoint) {
+	const body =
+		endpoint === "record"
+			? { ok: false, proxied: false, reason: "upstream_unavailable" }
+			: { ok: true, proxied: false };
+	return NextResponse.json(body, {
+		status: 202,
+		headers: noStoreHeaders(),
+	});
+}
+
+function resolveClientIp(request, { trustCfConnectingIp = false } = {}) {
+	// Preference (only when the operator opted in via TRUST_CF_CONNECTING_IP):
+	// Cloudflare overwrites CF-Connecting-IP with the true client IP and
+	// Railway passes it through, while Railway REPLACES X-Forwarded-For with
+	// the Cloudflare edge address. Reading XFF alone therefore misattributes
+	// every visitor behind Cloudflare — wrong geo, and rotating edge IPs
+	// change Umami's hash(IP, UA, site) session identity between requests of
+	// one visit, splitting it into duplicate sessions.
+	//
+	// The opt-in is load-bearing, not bureaucracy: CF-Connecting-IP takes
+	// precedence over X-Forwarded-For, and most proxies pass it through
+	// untouched — so trusting it unconditionally would let any client override
+	// an otherwise-legitimate XFF with an arbitrary IP. Only Cloudflare
+	// itself sanitizes this header, hence explicit opt-in (and
+	// TRUST_PROXY_HEADERS=false still forces "unknown" at the call site).
+	const cloudflareIp = trustCfConnectingIp
+		? request.headers.get("cf-connecting-ip")?.trim()
+		: null;
+	if (cloudflareIp) return cloudflareIp;
+
+	const forwardedFor = request.headers.get("x-forwarded-for");
+	if (forwardedFor) {
+		const client = forwardedFor
+			.split(",")
+			.map((value) => value.trim())
+			.filter(Boolean)[0];
+		if (client) return client;
+	}
+
+	return request.headers.get("x-real-ip")?.trim() || "unknown";
+}
+
+// Streams the request body under a running byte budget. The Content-Length
+// pre-check above is only an early exit: a missing or lying header must not
+// force full buffering of an unbounded body before the 413 fires.
+async function readCappedBody(request) {
+	if (!request.body) return { status: "empty" };
+
+	const reader = request.body.getReader();
+	const chunks = [];
+	let total = 0;
+
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			total += value.byteLength;
+			if (total > MAX_BODY_BYTES) {
+				await reader.cancel().catch(() => {});
+				return { status: "too-large" };
+			}
+			chunks.push(value);
+		}
+	} catch {
+		return { status: "unreadable" };
+	}
+
+	if (!total) return { status: "empty" };
+
+	const bytes = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+
+	return { status: "ok", bytes };
+}
+
+export async function POST(request, { params } = {}) {
+	const resolvedParams = params ? await params : {};
+	const endpoint = resolvedParams?.endpoint;
+
+	if (!ALLOWED_ENDPOINTS.has(endpoint)) {
+		return NextResponse.json(
+			{ error: "Not found" },
+			{ status: 404, headers: noStoreHeaders() },
+		);
+	}
+
+	const contentType =
+		request.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase() ??
+		"";
+	if (contentType !== "application/json") {
+		return NextResponse.json(
+			{ error: "Unsupported media type" },
+			{ status: 415, headers: noStoreHeaders() },
+		);
+	}
+
+	const contentLength = request.headers.get("content-length");
+	if (contentLength && Number(contentLength) > MAX_BODY_BYTES) {
+		return NextResponse.json(
+			{ error: "Payload too large" },
+			{ status: 413, headers: noStoreHeaders() },
+		);
+	}
+
+	let body;
+	try {
+		body = await readCappedBody(request);
+	} catch {
+		return NextResponse.json(
+			{ error: "Unreadable request body" },
+			{ status: 400, headers: noStoreHeaders() },
+		);
+	}
+
+	if (body.status === "too-large") {
+		return NextResponse.json(
+			{ error: "Payload too large" },
+			{ status: 413, headers: noStoreHeaders() },
+		);
+	}
+
+	if (body.status !== "ok") {
+		return NextResponse.json(
+			{
+				error:
+					body.status === "empty" ? "Empty body" : "Unreadable request body",
+			},
+			{ status: 400, headers: noStoreHeaders() },
+		);
+	}
+
+	const upstreamBase = getUmamiUpstreamBase(process.env);
+	if (!upstreamBase) {
+		return failOpenResponse(endpoint);
+	}
+
+	// Honor the same proxy-header trust setting as proxy.js: with
+	// TRUST_PROXY_HEADERS=false the app is directly reachable, the headers
+	// are attacker-controlled, and forwarding them would poison Umami geo.
+	// "unknown" (never client bytes) crosses the boundary instead.
+	// CF-Connecting-IP additionally needs TRUST_CF_CONNECTING_IP=true:
+	// unlike XFF it is not sanitized by generic proxies, so trusting it
+	// unconditionally would let a client override a legitimate XFF.
+	const trustProxyHeaders = shouldTrustProxyHeaders();
+	const trustCfConnectingIp = trustProxyHeaders && shouldTrustCfConnectingIp();
+	const clientIp = trustProxyHeaders
+		? resolveClientIp(request, { trustCfConnectingIp })
+		: "unknown";
+
+	const forwardHeaders = {
+		"Content-Type": "application/json",
+		// Single stable IP, never the incoming chain: Umami hashes
+		// (IP, UA, site) into its session identity, so a rotating edge IP
+		// anywhere in a forwarded chain splits one visit into duplicate
+		// sessions (and geolocates the edge, not the visitor). Chain entries
+		// beyond the client are proxies — no analytics value, only leak.
+		"X-Forwarded-For": clientIp,
+		"X-Real-IP": clientIp,
+	};
+
+	// Umami reads cf-connecting-ip before X-Forwarded-For, and behind
+	// Cloudflare it is the only header carrying the true client IP (Railway
+	// replaces XFF with the edge address). Pass it through — but only under
+	// the same opt-in that allowed it to win resolution above, and never when
+	// untrusted, when it is client-set bytes like every other proxy header.
+	if (trustCfConnectingIp) {
+		const cloudflareIp = request.headers.get("cf-connecting-ip")?.trim();
+		if (cloudflareIp) forwardHeaders["CF-Connecting-IP"] = cloudflareIp;
+	}
+
+	const userAgent = request.headers.get("user-agent");
+	if (userAgent) forwardHeaders["User-Agent"] = userAgent;
+
+	const acceptLanguage = request.headers.get("accept-language");
+	if (acceptLanguage) forwardHeaders["Accept-Language"] = acceptLanguage;
+
+	const umamiCache = request.headers.get("x-umami-cache");
+	if (umamiCache) forwardHeaders["x-umami-cache"] = umamiCache;
+
+	let upstreamResponse;
+	try {
+		upstreamResponse = await fetch(`${upstreamBase}/api/${endpoint}`, {
+			method: "POST",
+			body: body.bytes,
+			headers: forwardHeaders,
+			signal: AbortSignal.timeout(UPSTREAM_TIMEOUT_MS),
+		});
+	} catch (error) {
+		logger.warn("Umami ingest proxy upstream unreachable", {
+			endpoint,
+			message: error?.message ?? String(error),
+		});
+		return failOpenResponse(endpoint);
+	}
+
+	if (upstreamResponse.status >= 500) {
+		logger.warn("Umami ingest proxy upstream error", {
+			endpoint,
+			status: upstreamResponse.status,
+		});
+		return failOpenResponse(endpoint);
+	}
+
+	let responseBody;
+	try {
+		responseBody = await upstreamResponse.arrayBuffer();
+	} catch (error) {
+		logger.warn("Umami ingest proxy upstream body unreadable", {
+			endpoint,
+			message: error?.message ?? String(error),
+		});
+		return failOpenResponse(endpoint);
+	}
+
+	const responseHeaders = noStoreHeaders();
+	const upstreamContentType = upstreamResponse.headers.get("content-type");
+	if (upstreamContentType) {
+		responseHeaders["Content-Type"] = upstreamContentType;
+	}
+
+	// Never pass upstream Set-Cookie through to the browser.
+	return new NextResponse(responseBody, {
+		status: upstreamResponse.status,
+		headers: responseHeaders,
+	});
+}
+
+export function GET() {
+	return methodNotAllowed();
+}
+
+export function PUT() {
+	return methodNotAllowed();
+}
+
+export function PATCH() {
+	return methodNotAllowed();
+}
+
+export function DELETE() {
+	return methodNotAllowed();
+}
+
+export function HEAD() {
+	return methodNotAllowed();
+}
+
+export function OPTIONS() {
+	return methodNotAllowed();
+}

package/templates/base-project/apps/web/src/app/s/script.js/route.js

@@ -0,0 +1,128 @@
+/**
+ * Umami First-Party Tracker Script
+ *
+ * GET /s/script.js → upstream Umami /script.js.
+ *
+ * Why a handler and not a `rewrites()` entry: a browser requesting a
+ * same-origin script URL sends this app's cookies with it, and Next.js
+ * external rewrites proxy incoming request headers unchanged — so a rewrite
+ * would forward session cookies to the analytics host. (The previous
+ * cross-origin `<script src>` never sent same-origin credentials.) This
+ * handler forwards NO client headers at all: the upstream sees an anonymous
+ * server-to-server fetch, and its `Set-Cookie` is stripped before the
+ * response reaches the browser.
+ *
+ * Caching: the tracker is static and versioned by the upstream, so the
+ * response is publicly cacheable (browser + CDN). The upstream fetch is
+ * revalidated hourly so most script loads never touch the analytics host.
+ */
+
+import { createLogger } from "@usequark/quark-core/core";
+import { NextResponse } from "next/server";
+import { getUmamiUpstreamBase } from "@/lib/analytics/umami-config.js";
+
+const logger = createLogger("umami-proxy");
+
+export const dynamic = "force-dynamic";
+
+const UPSTREAM_TIMEOUT_MS = 5000;
+const SCRIPT_CACHE_CONTROL =
+	"public, max-age=3600, stale-while-revalidate=86400";
+
+function noStoreHeaders(extra = {}) {
+	return { "Cache-Control": "no-store", ...extra };
+}
+
+function methodNotAllowed() {
+	return NextResponse.json(
+		{ error: "Method not allowed" },
+		{ status: 405, headers: noStoreHeaders() },
+	);
+}
+
+export async function GET() {
+	const upstreamBase = getUmamiUpstreamBase(process.env);
+	if (!upstreamBase) {
+		return NextResponse.json(
+			{ error: "Not found" },
+			{ status: 404, headers: noStoreHeaders() },
+		);
+	}
+
+	let upstreamResponse;
+	try {
+		// Deliberately no client headers: no Cookie, no Authorization, no
+		// X-Forwarded-For. The tracker script is identical for every visitor.
+		upstreamResponse = await fetch(`${upstreamBase}/script.js`, {
+			signal: AbortSignal.timeout(UPSTREAM_TIMEOUT_MS),
+			next: { revalidate: 3600 },
+		});
+	} catch (error) {
+		logger.warn("Umami script proxy upstream unreachable", {
+			message: error?.message ?? String(error),
+		});
+		return NextResponse.json(
+			{ error: "Bad gateway" },
+			{ status: 502, headers: noStoreHeaders() },
+		);
+	}
+
+	if (!upstreamResponse.ok) {
+		logger.warn("Umami script proxy upstream error", {
+			status: upstreamResponse.status,
+		});
+		return NextResponse.json(
+			{ error: "Bad gateway" },
+			{ status: 502, headers: noStoreHeaders() },
+		);
+	}
+
+	let body;
+	try {
+		body = await upstreamResponse.arrayBuffer();
+	} catch (error) {
+		logger.warn("Umami script proxy upstream body unreadable", {
+			message: error?.message ?? String(error),
+		});
+		return NextResponse.json(
+			{ error: "Bad gateway" },
+			{ status: 502, headers: noStoreHeaders() },
+		);
+	}
+
+	// Fresh headers: upstream Content-Type (or a JS default), public caching,
+	// and never an upstream Set-Cookie.
+	return new NextResponse(body, {
+		status: 200,
+		headers: {
+			"Content-Type":
+				upstreamResponse.headers.get("content-type") ??
+				"application/javascript",
+			"Cache-Control": SCRIPT_CACHE_CONTROL,
+		},
+	});
+}
+
+export function POST() {
+	return methodNotAllowed();
+}
+
+export function PUT() {
+	return methodNotAllowed();
+}
+
+export function PATCH() {
+	return methodNotAllowed();
+}
+
+export function DELETE() {
+	return methodNotAllowed();
+}
+
+export function HEAD() {
+	return methodNotAllowed();
+}
+
+export function OPTIONS() {
+	return methodNotAllowed();
+}

package/templates/base-project/apps/web/src/lib/analytics/umami-before-send.js

@@ -24,6 +24,11 @@ export function shouldBlockUmamiPayload({ url, roleCookie } = {}) {
  * @returns {string}
  */
 export function buildUmamiBeforeSendScript() {
-	// shouldBlockUmamiPayload.toString() already includes the "function name(){...}" form.
-	return `window.__umamiBeforeSend=function(t,p){var r=(document.cookie.match(/umami_user_role=([^;]+)/)||[])[1];if(shouldBlockUmamiPayload({url:p.url,roleCookie:r}))return false;return p};${shouldBlockUmamiPayload.toString()}`;
+	// Assigned via `var`: bundler minification may drop the function name from
+	// shouldBlockUmamiPayload.toString() (observed `function({...})` in the
+	// production bundle), and a bare anonymous `function(...){...}` statement
+	// is a SyntaxError that kills the whole inline tag — including
+	// window.__umamiBeforeSend. `var name=<any function form>;` is valid for
+	// named, anonymous, and arrow shapes alike.
+	return `window.__umamiBeforeSend=function(t,p){var r=(document.cookie.match(/umami_user_role=([^;]+)/)||[])[1];if(shouldBlockUmamiPayload({url:p.url,roleCookie:r}))return false;return p};var shouldBlockUmamiPayload=${shouldBlockUmamiPayload.toString()};`;
 }