feat(analytics): add first-party events and Vitals dashboard v2

[Adedoyinjr]

Summary

• add privacy-safe, typed first-party analytics events
• ensure analytics respects DNT/GPC and no-ops when Plausible is unavailable
• add exact-once event instrumentation for CTA, newsletter, blog reads, calculator sharing, chain sorting, and outbound links
• upgrade /vitals with page and locale filters, conversion tiles, and 30-day incident status
• document analytics events, payloads, retention, endpoint, and privacy behavior
• harden analytics SSR behavior
• restore the /ecosystem route and fix related test regressions

Validation

• pnpm install --frozen-lockfile ✅
• pnpm format:check ✅
• pnpm test ✅ — 18 files, 134 tests
• pnpm build ✅
• Analytics Playwright ✅ — 5/5
• Lighthouse Performance ✅ — 100
• Lighthouse SEO ✅ — 100
• /vitals page filter ✅
• /vitals locale filter ✅
• conversion tiles ✅
• 30-day incident overlay / empty state ✅
• /blog/wave-7-kickoff 80% exact-once tracking ✅

Fixes #133

[vercel]

@github-actions[bot] is attempting to deploy a commit to the truthixify's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Adedoyinjr Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[truthixify]

Thanks @Adedoyinjr. The analytics work itself looks reasonable, but I cannot merge this while it adds .github/workflows/format-analytics-133.yml.

That workflow triggers on pushes to format/analytics-vitals-133, runs prettier over a hardcoded file list, then commits and pushes back to the branch under permissions: contents: write. It reads as scaffolding you used to fix formatting on your own branch, which is fine as a local trick, but merged into develop it would:

• sit in the repo permanently, triggering on a branch that will not exist after this merges
• keep a standing contents: write auto-committing workflow in the repo for no ongoing purpose

Please delete that file from the PR and run prettier locally instead:

pnpm exec prettier --write .
git commit -am "style: format"

Two smaller notes while you are in there. index.html is modified at +22/-15, worth a look that nothing unrelated to analytics crept in. And no build check has reported on this PR at all, so once the workflow file is gone please confirm CI actually runs.

[Adedoyinjr]

Thanks @truthixify. I’ve removed ".github/workflows/format-analytics-133.yml" from the PR.

I also reviewed "index.html"; the remaining changes there are directly related to the analytics/privacy work, specifically gating Plausible behind DNT/GPC.

The normal repository CI is configured for PRs into "develop", but no GitHub Actions run has started yet for the latest commit. Please let me know if the workflow needs maintainer approval for this fork PR.

[truthixify]

Thanks @Adedoyinjr, the workflow file is gone and that was the blocker, so I have dismissed the change request.

It is conflicted now. Part of that is mine: I removed package-lock.json from develop since this repo standardises on pnpm, so if the rebase stops on that file accept the deletion (git rm package-lock.json) rather than regenerating it.

git fetch origin
git rebase origin/develop

Also still worth confirming once CI runs again: no build check has ever reported on this PR, so I have not actually seen it pass.

Resolved: verified against the branch merge base and the concern no longer applies.

[truthixify]

I tried to rebase this for you and stopped partway, because it needs a decision that is yours rather than mine. Nothing was pushed, your branch is untouched.

Most of it resolved cleanly. The blocker is src/pages/Security.tsx, which is an add/add conflict between two completely different implementations:

• develop has code3ks's version from feat(security): add security commitments page and security.txt #143, roughly 420 lines, data-driven from src/data/security.json
• your branch has its own Security page, presumably written because First-party analytics events + Vitals dashboard v2 #133 asks you to document every analytics event on /privacy and /security and the page did not exist when you started

Both are legitimate. Which survives, and how your event documentation gets folded into code3ks's version, is a content call I did not want to make on your behalf.

Suggested route: rebase, take develop's Security.tsx wholesale, then add your event table into it as a new section. Your Blog.tsx and App.tsx conflicts are trivial by comparison and I can talk you through those if they bite. The generated public/feed.xml and public/sitemap.xml conflicts you can ignore entirely, just regenerate with pnpm build after resolving.

[truthixify]

Merged @Adedoyinjr. I rebased this onto develop and pushed, since after your latest push only one conflict was left (Privacy.tsx, where develop had added a threat-model link and you added the analytics section, so I kept both).

Worth calling out that you resolved the hard part yourself. When I stopped on this last time, your branch and code3ks's #143 each had a different ~420-line Security.tsx. You kept theirs intact and appended your event documentation as a new section, so the rebase shows zero deleted lines from their version. That was the right resolution and it was yours to make, not mine.

Verified locally before pushing: format:check clean and a full pnpm build. The rogue auto-commit workflow is gone, DNT is enforced at the track.ts boundary rather than per-caller, and every event name is documented on both /privacy and /security.