@web-my-money/studio-consumer 2.1.0 → 2.2.0

package/README.md

@@ -68,3 +68,21 @@ import { focalObjectPosition } from "@web-my-money/studio-consumer/image";
 <img src={value.url} alt={value.alt.en} style={{ objectFit: "cover", objectPosition: focalObjectPosition(value) }} />
 ```
 
+## Analytics collector (2.2.0)
+
+`createCollectHandler` only accepts posts from the site's own pages (`Sec-Fetch-Site`,
+falling back to `Origin`), and it decides each event's A/B arm on the server from the
+`wmm_vid` cookie. The browser's own `variant` is always discarded. Pass the content
+client's `getRunningExperiments` so the arm can be resolved:
+
+```ts
+export const POST = createCollectHandler({
+  siteKey: SITE_KEY,
+  ingestUrl: process.env.FUNNEL_INGEST_URL ?? "",
+  ingestKey: process.env.FUNNEL_INGEST_TOKEN ?? "",
+  getRunningExperiments: () => content.getRunningExperiments(),
+});
+```
+
+Without it, events carry no arm and the site stays out of any A/B comparison.
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@web-my-money/studio-consumer",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "description": "Consumer-side integration for WMM Studio: content, analytics, attribution.",
   "license": "UNLICENSED",
   "repository": {

package/src/analytics/collect-handler.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+import { resolveVariant, VISITOR_COOKIE, type RunningExperiment } from "./bucketing";
 
 /**
  * First-party analytics collector (wmm-studio docs/analytics/01-pipeline.md §5.1).
@@ -13,6 +14,9 @@ import { NextResponse } from "next/server";
  * surface an error on a marketing page or interfere with a form — so failures
  * are logged here and are invisible to the visitor.
  *
+ * Same-origin only, and the A/B arm is resolved HERE from the visitor cookie,
+ * never taken from the payload (parity with WMM Website's own route, 2026-10-09).
+ *
  * Inert with no `FUNNEL_INGEST_URL`: nothing is forwarded and the site behaves
  * exactly as it did before this route existed. That is the correct state before
  * rollout, which is what lets this merge ahead of being switched on.
@@ -61,6 +65,34 @@ function warnOnceAboutKeyShape(key: string): void {
   );
 }
 
+/**
+ * Only the site's own pages post here. Browsers send `Sec-Fetch-Site` (or at least
+ * an `Origin`) on a same-origin beacon; a bare script or a third-party page does
+ * not. Headers can be forged by hand, so this is a speed bump, not a lock; what
+ * actually protects the A/B numbers is the server-side arm below.
+ */
+function isSameOrigin(req: Request): boolean {
+  const fetchSite = req.headers.get("sec-fetch-site");
+  if (fetchSite) return fetchSite === "same-origin";
+  const origin = req.headers.get("origin");
+  if (!origin) return false;
+  try {
+    return new URL(origin).host === new URL(req.url).host;
+  } catch {
+    return false;
+  }
+}
+
+function readCookie(req: Request, name: string): string | null {
+  const header = req.headers.get("cookie");
+  if (!header) return null;
+  for (const part of header.split(";")) {
+    const [k, ...v] = part.trim().split("=");
+    if (k === name) return decodeURIComponent(v.join("="));
+  }
+  return null;
+}
+
 /** Test-only: forget that the one-time warning has already been printed. */
 export function resetIngestKeyShapeWarning(): void {
   warnedAboutKeyShape = false;
@@ -70,6 +102,13 @@ export function createCollectHandler(config: {
   siteKey: string;
   ingestUrl: string;
   ingestKey: string;
+  /**
+   * The site's running experiments (pass the content client's
+   * `getRunningExperiments`). With it, each event's A/B arm is resolved here
+   * from the `wmm_vid` cookie; without it, events carry no arm. The browser's
+   * own `variant` is discarded either way.
+   */
+  getRunningExperiments?: () => Promise<RunningExperiment[]>;
 }): (request: Request) => Promise<Response> {
   return async function POST(request: Request): Promise<Response> {
     const url = config.ingestUrl || DEFAULT_INGEST_URL;
@@ -77,6 +116,7 @@ export function createCollectHandler(config: {
     // The token is the only thing that genuinely has to be configured per site.
     if (!token) return noContent();
     warnOnceAboutKeyShape(token);
+    if (!isSameOrigin(request)) return noContent();
 
     let events: unknown[];
     try {
@@ -93,13 +133,39 @@ export function createCollectHandler(config: {
       return noContent();
     }
 
+    // The A/B arm is decided here, from the visitor cookie and the experiment list
+    // the page render used — never taken from the payload. A posted `variant` could
+    // otherwise put any visitor into any arm and move an experiment's result. No
+    // cookie means the arm is unknowable, so none is sent.
+    const visitorId = readCookie(request, VISITOR_COOKIE);
+    const experiments: RunningExperiment[] =
+      visitorId && config.getRunningExperiments
+        ? await config.getRunningExperiments().catch(() => [])
+        : [];
+
     // The site key is stamped here, never trusted from the client: a browser must
     // not be able to write events into another site's namespace by editing a
     // payload. Anything the client sent under that key is overwritten.
-    const stamped = events.map((e) => ({
-      ...(e && typeof e === "object" ? e : {}),
-      siteKey: config.siteKey,
-    }));
+    const stamped = events
+      .filter(
+        (e): e is Record<string, unknown> =>
+          !!e &&
+          typeof e === "object" &&
+          typeof (e as { path?: unknown }).path === "string" &&
+          (e as { path: string }).path.startsWith("/"),
+      )
+      .map((e) => {
+        const { variant: _clientVariant, ...rest } = e;
+        const path = (rest.path as string).split("?")[0];
+        const arm = visitorId ? resolveVariant(path, visitorId, experiments) : null;
+        return {
+          ...rest,
+          ...(visitorId ? { visitorId } : {}),
+          ...(arm?.experimentKey ? { variant: arm.variant } : {}),
+          siteKey: config.siteKey,
+        };
+      });
+    if (stamped.length === 0) return noContent();
 
     try {
       const res = await fetch(url, {

package/src/analytics/index.ts

@@ -1,5 +1,5 @@
 /** Proves at runtime which build a consumer is actually running. */
-export const PACKAGE_VERSION = "2.1.0";
+export const PACKAGE_VERSION = "2.2.0";
 
 export {
   resolveVariant,

package/src/attribution/index.ts

@@ -1,5 +1,5 @@
 /** Proves at runtime which build a consumer is actually running. */
-export const PACKAGE_VERSION = "2.1.0";
+export const PACKAGE_VERSION = "2.2.0";
 
 export {
   getAttribution,

package/src/brand/index.ts

@@ -16,7 +16,7 @@
  * Pure on purpose: no `server-only`, no Next imports, safe in any component.
  */
 
-export const PACKAGE_VERSION = "2.1.0";
+export const PACKAGE_VERSION = "2.2.0";
 
 /** Theme ids owned by WMM in the tokens package (themes.json `owner: "wmm"`). */
 export const WMM_THEMES = ["wmm", "site", "light", "dark"] as const;

package/src/content/index.ts

@@ -1,5 +1,5 @@
 /** Proves at runtime which build a consumer is actually running. */
-export const PACKAGE_VERSION = "2.1.0";
+export const PACKAGE_VERSION = "2.2.0";
 
 export {
   createContentClient,

package/src/content/manifest-handler.ts

@@ -31,6 +31,14 @@ export function createManifestHandler(
    */
   brand: SiteBrand,
 ): () => Promise<Response> {
+  // TypeScript requires the brand; a JS caller or a cast can still skip it. Fail
+  // where the mistake is (the site's build), not at Studio's sync. Frozen is the
+  // mark of defineSiteBrand, which validated it.
+  if (!brand || !Object.isFrozen(brand)) {
+    throw new Error(
+      "createManifestHandler: pass the site's brand from defineSiteBrand(...) as the second argument.",
+    );
+  }
   return async function GET() {
     const manifest = await getManifest();
     return NextResponse.json(

package/src/image/index.ts

@@ -1,5 +1,5 @@
 /** Pure; safe in client components. */
-export const PACKAGE_VERSION = "2.1.0";
+export const PACKAGE_VERSION = "2.2.0";
 
 /**
  * CSS `object-position` for a Studio image value's focal point (spec §6.2).