@valbuild/shared 0.150.16 → 0.150.17

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @valbuild/shared
 
+## 0.150.17
+
+### Patch Changes
+
+- [#992](https://github.com/valbuild/val/pull/992) [`ea3bf9b`](https://github.com/valbuild/val/commit/ea3bf9bbacd22bbb5485fd798d6b3a2d5916be81) Thanks [@freekh](https://github.com/freekh)! - Content analytics now counts on self-hosted sites (Custom hosting), not only on sites Val hosts.
+
+  A self-hosted app's own Val server now hands each analytics beacon on to Val's ingest, which counts it. To turn it on:
+
+  - Run the app with Val's content service: `VAL_API_KEY`, `VAL_SECRET` and `VAL_PROJECT` set. Most deployed apps already do.
+  - Set `VAL_ANALYTICS=true`. In TanStack Start, read it in your layout's loader (`{ enabled: process.env.VAL_ANALYTICS === "true" }`) and pass the result to `<ValProvider analytics>`. A self-hosted site has no platform to pass it for you.
+  - Switch analytics on for the project in Val's admin. While it is off there, the script on your pages is told so and stops sending.
+
+  The server forwards only same-origin beacons from a browser. It passes on the visitor's User-Agent and, where your host provides one (Vercel, Cloudflare or CloudFront), their country. It never passes on their IP address. If the api key is not accepted, the server logs one warning naming `VAL_API_KEY` and `VAL_PROJECT`. Local development (fs mode) works as before and counts nothing.
+
+  `VAL_ANALYTICS_INGEST_URL` overrides where beacons are sent. You will normally not need it.
+
 ## 0.150.16
 
 ### Patch Changes

package/dist/declarations/src/internal/ApiRoutes.d.ts

@@ -176,6 +176,13 @@ export declare const Api: {
         POST: {
             req: {
                 body: z.ZodUnknown;
+                headers: {
+                    "sec-fetch-site": z.ZodOptional<z.ZodString>;
+                    "user-agent": z.ZodOptional<z.ZodString>;
+                    "x-vercel-ip-country": z.ZodOptional<z.ZodString>;
+                    "cf-ipcountry": z.ZodOptional<z.ZodString>;
+                    "cloudfront-viewer-country": z.ZodOptional<z.ZodString>;
+                };
             };
             res: z.ZodUnion<readonly [z.ZodObject<{
                 status: z.ZodLiteral<200>;
@@ -187,6 +194,11 @@ export declare const Api: {
                 json: z.ZodObject<{
                     message: z.ZodString;
                 }, z.core.$strip>;
+            }, z.core.$strip>, z.ZodObject<{
+                status: z.ZodLiteral<410>;
+                json: z.ZodObject<{
+                    message: z.ZodString;
+                }, z.core.$strip>;
             }, z.core.$strip>]>;
         };
     };

package/internal/dist/valbuild-shared-internal.cjs.dev.js

@@ -1754,11 +1754,22 @@ var Api = {
       // Parsed by the handler rather than here, so a beacon of a version this
       // server does not know is ignored instead of refused.
       req: {
-        body: zod.z.unknown()
+        body: zod.z.unknown(),
+        // What a server that forwards beacons to Val's ingest has to check
+        // and pass on itself: a forward loses the browser's own headers. The
+        // visitor's IP is deliberately not one of them.
+        headers: {
+          "sec-fetch-site": zod.z.string().optional(),
+          "user-agent": zod.z.string().optional(),
+          "x-vercel-ip-country": zod.z.string().optional(),
+          "cf-ipcountry": zod.z.string().optional(),
+          "cloudfront-viewer-country": zod.z.string().optional()
+        }
       },
       res: zod.z.union([
-      // `counted` is false wherever nothing stores the counts -- every
-      // server but the hosted platform's, for now.
+      // `counted` is true only where the beacon was handed to Val's ingest
+      // and it counted it: the hosted platform, or a self-hosted server in
+      // http mode. False everywhere else, local dev included.
       zod.z.object({
         status: zod.z.literal(200),
         json: zod.z.object({
@@ -1767,6 +1778,12 @@ var Api = {
       }), zod.z.object({
         status: zod.z.literal(400),
         json: GenericError
+      }),
+      // Analytics is switched off for this project in Val's admin. The
+      // browser script stops sending when it sees this.
+      zod.z.object({
+        status: zod.z.literal(410),
+        json: GenericError
       })])
     }
   },

package/internal/dist/valbuild-shared-internal.cjs.prod.js

@@ -1754,11 +1754,22 @@ var Api = {
       // Parsed by the handler rather than here, so a beacon of a version this
       // server does not know is ignored instead of refused.
       req: {
-        body: zod.z.unknown()
+        body: zod.z.unknown(),
+        // What a server that forwards beacons to Val's ingest has to check
+        // and pass on itself: a forward loses the browser's own headers. The
+        // visitor's IP is deliberately not one of them.
+        headers: {
+          "sec-fetch-site": zod.z.string().optional(),
+          "user-agent": zod.z.string().optional(),
+          "x-vercel-ip-country": zod.z.string().optional(),
+          "cf-ipcountry": zod.z.string().optional(),
+          "cloudfront-viewer-country": zod.z.string().optional()
+        }
       },
       res: zod.z.union([
-      // `counted` is false wherever nothing stores the counts -- every
-      // server but the hosted platform's, for now.
+      // `counted` is true only where the beacon was handed to Val's ingest
+      // and it counted it: the hosted platform, or a self-hosted server in
+      // http mode. False everywhere else, local dev included.
       zod.z.object({
         status: zod.z.literal(200),
         json: zod.z.object({
@@ -1767,6 +1778,12 @@ var Api = {
       }), zod.z.object({
         status: zod.z.literal(400),
         json: GenericError
+      }),
+      // Analytics is switched off for this project in Val's admin. The
+      // browser script stops sending when it sees this.
+      zod.z.object({
+        status: zod.z.literal(410),
+        json: GenericError
       })])
     }
   },

package/internal/dist/valbuild-shared-internal.esm.js

@@ -1747,11 +1747,22 @@ var Api = {
       // Parsed by the handler rather than here, so a beacon of a version this
       // server does not know is ignored instead of refused.
       req: {
-        body: z.unknown()
+        body: z.unknown(),
+        // What a server that forwards beacons to Val's ingest has to check
+        // and pass on itself: a forward loses the browser's own headers. The
+        // visitor's IP is deliberately not one of them.
+        headers: {
+          "sec-fetch-site": z.string().optional(),
+          "user-agent": z.string().optional(),
+          "x-vercel-ip-country": z.string().optional(),
+          "cf-ipcountry": z.string().optional(),
+          "cloudfront-viewer-country": z.string().optional()
+        }
       },
       res: z.union([
-      // `counted` is false wherever nothing stores the counts -- every
-      // server but the hosted platform's, for now.
+      // `counted` is true only where the beacon was handed to Val's ingest
+      // and it counted it: the hosted platform, or a self-hosted server in
+      // http mode. False everywhere else, local dev included.
       z.object({
         status: z.literal(200),
         json: z.object({
@@ -1760,6 +1771,12 @@ var Api = {
       }), z.object({
         status: z.literal(400),
         json: GenericError
+      }),
+      // Analytics is switched off for this project in Val's admin. The
+      // browser script stops sending when it sees this.
+      z.object({
+        status: z.literal(410),
+        json: GenericError
       })])
     }
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@valbuild/shared",
-  "version": "0.150.16",
+  "version": "0.150.17",
   "private": false,
   "description": "Val shared types and utilities",
   "repository": {