cursedbelt-server 4.5.0 → 4.6.0

package/dist/server/analytics/index.d.ts

@@ -15,4 +15,4 @@
  * and drags no peer.
  */
 export { type InjectedScript, foreignScriptSources, scriptsRefusedByCsp, } from "./injectedScripts";
-export { WEB_ANALYTICS_BEACON_ORIGIN, WEB_ANALYTICS_BEACON_SRC, WEB_ANALYTICS_SITE_TAG, WEB_ANALYTICS_SITE_TOKEN, WEB_ANALYTICS_TAG, htmlCarriesWebAnalytics, webAnalyticsTag, } from "./webAnalytics";
+export { WEB_ANALYTICS_BEACON_ORIGIN, WEB_ANALYTICS_BEACON_SRC, WEB_ANALYTICS_PUBLIC_HOST, WEB_ANALYTICS_SITE_TAG, WEB_ANALYTICS_SITE_TOKEN, WEB_ANALYTICS_TAG, htmlCarriesWebAnalytics, webAnalyticsBootstrap, webAnalyticsTag, } from "./webAnalytics";

package/dist/server/analytics/index.js

@@ -15,4 +15,4 @@
  * and drags no peer.
  */
 export { foreignScriptSources, scriptsRefusedByCsp, } from "./injectedScripts";
-export { WEB_ANALYTICS_BEACON_ORIGIN, WEB_ANALYTICS_BEACON_SRC, WEB_ANALYTICS_SITE_TAG, WEB_ANALYTICS_SITE_TOKEN, WEB_ANALYTICS_TAG, htmlCarriesWebAnalytics, webAnalyticsTag, } from "./webAnalytics";
+export { WEB_ANALYTICS_BEACON_ORIGIN, WEB_ANALYTICS_BEACON_SRC, WEB_ANALYTICS_PUBLIC_HOST, WEB_ANALYTICS_SITE_TAG, WEB_ANALYTICS_SITE_TOKEN, WEB_ANALYTICS_TAG, htmlCarriesWebAnalytics, webAnalyticsBootstrap, webAnalyticsTag, } from "./webAnalytics";

package/dist/server/analytics/webAnalytics.d.ts

@@ -62,6 +62,43 @@ export declare const WEB_ANALYTICS_SITE_TOKEN = "bd88d63678b64bc89f9702f48846bc8
 export declare function webAnalyticsTag(token?: string): string;
 /** The fleet's tag, for the one site this generation serves. */
 export declare const WEB_ANALYTICS_TAG: string;
+/** The zone. A page served from anywhere else must not load the beacon — see below. */
+export declare const WEB_ANALYTICS_PUBLIC_HOST = "cursedalchemy.com";
+/**
+ * What a static shell actually pastes: the tag, behind a HOSTNAME GUARD.
+ *
+ * ## 🔴 Why the bare snippet cannot go in an `index.html`
+ *
+ * Measured 2026-09-18, the first time the eight shells carried it. The beacon posts its
+ * pageview to `https://cloudflareinsights.com/cdn-cgi/rum`, and Cloudflare answers that
+ * preflight with `Access-Control-Allow-Origin: http://127.0.0.1` — no port. So on every LOCAL
+ * page load the browser prints:
+ *
+ * > Access to XMLHttpRequest at 'https://cloudflareinsights.com/cdn-cgi/rum' from origin
+ * > 'http://127.0.0.1:57845' has been blocked by CORS policy … Failed to load resource
+ *
+ * Under Automatic Setup this never happened: the injection is done by the EDGE, so it existed
+ * only on the zone and a developer never saw it. Pasting the raw snippet into the source moves
+ * it to every `bun run dev` and every browser test — `apps/music` lost 5 route-render checks and
+ * `apps/desk` lost 24, both asserting the console is empty, and the owner's own local console
+ * would have gained a red line on every page.
+ *
+ * That is the exact cost he asked to be rid of, one environment over. So the guard: the beacon
+ * is appended only when the page is being served from {@link WEB_ANALYTICS_PUBLIC_HOST}, which
+ * is the only place it can report anyway.
+ *
+ * ## Why an inline script rather than a build-time injection
+ *
+ * A Vite plugin would mean ten `vite.config.ts` edits and a frontend build depending on a
+ * server package — and it would not even work: `apps/desk`'s browser suite runs against a
+ * production `dist` served from `127.0.0.1`, so a production-only injection is still a console
+ * error there. The hostname is the honest discriminator, not the build mode.
+ *
+ * 🔴 It needs inline script to be permitted on the page. Every shell that carries it already
+ * ships one; `apps/vault` does not, serves `script-src 'self'`, and is exempt from the beacon
+ * for that reason — see `tools/check-web-analytics.ts`.
+ */
+export declare function webAnalyticsBootstrap(token?: string): string;
 /**
  * Does `html` carry the beacon for this site?
  *

package/dist/server/analytics/webAnalytics.js

@@ -67,6 +67,56 @@ export function webAnalyticsTag(token = WEB_ANALYTICS_SITE_TOKEN) {
 }
 /** The fleet's tag, for the one site this generation serves. */
 export const WEB_ANALYTICS_TAG = webAnalyticsTag();
+/** The zone. A page served from anywhere else must not load the beacon — see below. */
+export const WEB_ANALYTICS_PUBLIC_HOST = "cursedalchemy.com";
+/**
+ * What a static shell actually pastes: the tag, behind a HOSTNAME GUARD.
+ *
+ * ## 🔴 Why the bare snippet cannot go in an `index.html`
+ *
+ * Measured 2026-09-18, the first time the eight shells carried it. The beacon posts its
+ * pageview to `https://cloudflareinsights.com/cdn-cgi/rum`, and Cloudflare answers that
+ * preflight with `Access-Control-Allow-Origin: http://127.0.0.1` — no port. So on every LOCAL
+ * page load the browser prints:
+ *
+ * > Access to XMLHttpRequest at 'https://cloudflareinsights.com/cdn-cgi/rum' from origin
+ * > 'http://127.0.0.1:57845' has been blocked by CORS policy … Failed to load resource
+ *
+ * Under Automatic Setup this never happened: the injection is done by the EDGE, so it existed
+ * only on the zone and a developer never saw it. Pasting the raw snippet into the source moves
+ * it to every `bun run dev` and every browser test — `apps/music` lost 5 route-render checks and
+ * `apps/desk` lost 24, both asserting the console is empty, and the owner's own local console
+ * would have gained a red line on every page.
+ *
+ * That is the exact cost he asked to be rid of, one environment over. So the guard: the beacon
+ * is appended only when the page is being served from {@link WEB_ANALYTICS_PUBLIC_HOST}, which
+ * is the only place it can report anyway.
+ *
+ * ## Why an inline script rather than a build-time injection
+ *
+ * A Vite plugin would mean ten `vite.config.ts` edits and a frontend build depending on a
+ * server package — and it would not even work: `apps/desk`'s browser suite runs against a
+ * production `dist` served from `127.0.0.1`, so a production-only injection is still a console
+ * error there. The hostname is the honest discriminator, not the build mode.
+ *
+ * 🔴 It needs inline script to be permitted on the page. Every shell that carries it already
+ * ships one; `apps/vault` does not, serves `script-src 'self'`, and is exempt from the beacon
+ * for that reason — see `tools/check-web-analytics.ts`.
+ */
+export function webAnalyticsBootstrap(token = WEB_ANALYTICS_SITE_TOKEN) {
+    return [
+        "<script>",
+        `\tvar host = location.hostname;`,
+        `\tif (host === "${WEB_ANALYTICS_PUBLIC_HOST}" || host.endsWith(".${WEB_ANALYTICS_PUBLIC_HOST}")) {`,
+        `\t\tvar beacon = document.createElement("script");`,
+        `\t\tbeacon.type = "module";`,
+        `\t\tbeacon.src = "${WEB_ANALYTICS_BEACON_SRC}";`,
+        `\t\tbeacon.setAttribute("data-cf-beacon", '{"token": "${token}"}');`,
+        `\t\tdocument.head.appendChild(beacon);`,
+        "\t}",
+        "</script>",
+    ].join("\n");
+}
 /**
  * Does `html` carry the beacon for this site?
  *

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.5.0",
+	"version": "4.6.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split \u2014 storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",

package/src/server/analytics/index.ts

@@ -22,9 +22,11 @@ export {
 export {
 	WEB_ANALYTICS_BEACON_ORIGIN,
 	WEB_ANALYTICS_BEACON_SRC,
+	WEB_ANALYTICS_PUBLIC_HOST,
 	WEB_ANALYTICS_SITE_TAG,
 	WEB_ANALYTICS_SITE_TOKEN,
 	WEB_ANALYTICS_TAG,
 	htmlCarriesWebAnalytics,
+	webAnalyticsBootstrap,
 	webAnalyticsTag,
 } from "./webAnalytics";

package/src/server/analytics/webAnalytics.spec.ts

@@ -6,6 +6,7 @@ import {
 	WEB_ANALYTICS_SITE_TOKEN,
 	WEB_ANALYTICS_TAG,
 	htmlCarriesWebAnalytics,
+	webAnalyticsBootstrap,
 	webAnalyticsTag,
 } from "./webAnalytics";
 
@@ -44,7 +45,69 @@ describe("the fleet's beacon", () => {
 	});
 });
 
+/**
+ * 🔴 The guard is EXECUTED, not read. It is eight lines of hand-written browser JavaScript
+ * that nothing else runs before production, and the whole reason it exists is a failure that
+ * only shows up at a particular hostname — so a test that merely asserted the string contains
+ * "cursedalchemy.com" would pass on a guard with the condition inverted.
+ */
+function runBootstrap(hostname: string): { appended: string[]; attrs: Record<string, string> } {
+	const body = /<script>([\s\S]*)<\/script>/.exec(webAnalyticsBootstrap())?.[1] ?? "";
+	expect(body.trim().length).toBeGreaterThan(0);
+	const appended: string[] = [];
+	const attrs: Record<string, string> = {};
+	const fakeDocument = {
+		createElement: () => ({
+			type: "",
+			src: "",
+			setAttribute(name: string, value: string) {
+				attrs[name] = value;
+			},
+		}),
+		head: {
+			appendChild(el: { src: string }) {
+				appended.push(el.src);
+			},
+		},
+	};
+	new Function("location", "document", body)({ hostname }, fakeDocument);
+	return { appended, attrs };
+}
+
+describe("the hostname guard", () => {
+	test("appends the beacon on the zone, and on every satellite of it", () => {
+		for (const host of ["cursedalchemy.com", "collections.cursedalchemy.com", "vault.cursedalchemy.com"]) {
+			const { appended, attrs } = runBootstrap(host);
+			expect(appended, `${host} should load the beacon`).toEqual([WEB_ANALYTICS_BEACON_SRC]);
+			expect(attrs["data-cf-beacon"]).toBe(`{"token": "${WEB_ANALYTICS_SITE_TOKEN}"}`);
+		}
+	});
+
+	/**
+	 * 🔴 The failure this guard was added for, 2026-09-18. The beacon POSTs to
+	 * `cloudflareinsights.com/cdn-cgi/rum`, which answers the preflight with
+	 * `Access-Control-Allow-Origin: http://127.0.0.1` — no port — so a local page load prints a
+	 * CORS error. `apps/music` lost 5 route-render checks to it and `apps/desk` lost 24, both
+	 * asserting an empty console, and the owner's own `bun run dev` would have shown it too.
+	 */
+	test("loads NOTHING on localhost, 127.0.0.1 or a bare host", () => {
+		for (const host of ["localhost", "127.0.0.1", "::1", "app.test", ""]) {
+			expect(runBootstrap(host).appended, `${host} must not load the beacon`).toEqual([]);
+		}
+	});
+
+	test("a lookalike domain does not get the beacon either", () => {
+		// `endsWith` alone would admit this, which is why the guard tests for the dot.
+		expect(runBootstrap("evilcursedalchemy.com").appended).toEqual([]);
+	});
+});
+
 describe("htmlCarriesWebAnalytics", () => {
+	test("true for the bootstrap block a shell actually pastes", () => {
+		expect(htmlCarriesWebAnalytics(webAnalyticsBootstrap())).toBe(true);
+		expect(htmlCarriesWebAnalytics(webAnalyticsBootstrap("0".repeat(32)))).toBe(false);
+	});
+
 	test("true for the tag as authored, and for a re-wrapped copy of it", () => {
 		expect(htmlCarriesWebAnalytics(`<head>${WEB_ANALYTICS_TAG}</head>`)).toBe(true);
 		// A formatter is allowed to break the attributes across lines; the check must survive it.

package/src/server/analytics/webAnalytics.ts

@@ -76,6 +76,58 @@ export function webAnalyticsTag(token: string = WEB_ANALYTICS_SITE_TOKEN): strin
 /** The fleet's tag, for the one site this generation serves. */
 export const WEB_ANALYTICS_TAG = webAnalyticsTag();
 
+/** The zone. A page served from anywhere else must not load the beacon — see below. */
+export const WEB_ANALYTICS_PUBLIC_HOST = "cursedalchemy.com";
+
+/**
+ * What a static shell actually pastes: the tag, behind a HOSTNAME GUARD.
+ *
+ * ## 🔴 Why the bare snippet cannot go in an `index.html`
+ *
+ * Measured 2026-09-18, the first time the eight shells carried it. The beacon posts its
+ * pageview to `https://cloudflareinsights.com/cdn-cgi/rum`, and Cloudflare answers that
+ * preflight with `Access-Control-Allow-Origin: http://127.0.0.1` — no port. So on every LOCAL
+ * page load the browser prints:
+ *
+ * > Access to XMLHttpRequest at 'https://cloudflareinsights.com/cdn-cgi/rum' from origin
+ * > 'http://127.0.0.1:57845' has been blocked by CORS policy … Failed to load resource
+ *
+ * Under Automatic Setup this never happened: the injection is done by the EDGE, so it existed
+ * only on the zone and a developer never saw it. Pasting the raw snippet into the source moves
+ * it to every `bun run dev` and every browser test — `apps/music` lost 5 route-render checks and
+ * `apps/desk` lost 24, both asserting the console is empty, and the owner's own local console
+ * would have gained a red line on every page.
+ *
+ * That is the exact cost he asked to be rid of, one environment over. So the guard: the beacon
+ * is appended only when the page is being served from {@link WEB_ANALYTICS_PUBLIC_HOST}, which
+ * is the only place it can report anyway.
+ *
+ * ## Why an inline script rather than a build-time injection
+ *
+ * A Vite plugin would mean ten `vite.config.ts` edits and a frontend build depending on a
+ * server package — and it would not even work: `apps/desk`'s browser suite runs against a
+ * production `dist` served from `127.0.0.1`, so a production-only injection is still a console
+ * error there. The hostname is the honest discriminator, not the build mode.
+ *
+ * 🔴 It needs inline script to be permitted on the page. Every shell that carries it already
+ * ships one; `apps/vault` does not, serves `script-src 'self'`, and is exempt from the beacon
+ * for that reason — see `tools/check-web-analytics.ts`.
+ */
+export function webAnalyticsBootstrap(token: string = WEB_ANALYTICS_SITE_TOKEN): string {
+	return [
+		"<script>",
+		`\tvar host = location.hostname;`,
+		`\tif (host === "${WEB_ANALYTICS_PUBLIC_HOST}" || host.endsWith(".${WEB_ANALYTICS_PUBLIC_HOST}")) {`,
+		`\t\tvar beacon = document.createElement("script");`,
+		`\t\tbeacon.type = "module";`,
+		`\t\tbeacon.src = "${WEB_ANALYTICS_BEACON_SRC}";`,
+		`\t\tbeacon.setAttribute("data-cf-beacon", '{"token": "${token}"}');`,
+		`\t\tdocument.head.appendChild(beacon);`,
+		"\t}",
+		"</script>",
+	].join("\n");
+}
+
 /**
  * Does `html` carry the beacon for this site?
  *