The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
worldmonitor	Ready	Preview, Comment	Jul 6, 2026 11:19am

Greptile Summary

This PR resolves a silent analytics outage on the canonical www.worldmonitor.app host (where Umami's exact-hostname check was silently self-disabling because only the apex domain was listed) and instruments an end-to-end checkout funnel: checkout-start / checkout-success / checkout-failed events now flow from the dashboard and the /pro SPA into the same Umami workspace so the pageview → upgrade conversion path is fully joinable.

• Domain fix: www.worldmonitor.app added to UMAMI_DOMAINS in the dashboard analytics facade and to data-domains in both /pro and welcome static HTML tags; a new policy test pins this invariant to prevent silent regression.
• Funnel wiring: trackCheckoutStart fires from startCheckout on the dashboard (covering all upgrade CTAs in one call site) and from startCheckout/tryResumeCheckoutFromUrl on /pro (via a local trackFunnelEvent wrapper); trackCheckoutSuccess/trackCheckoutFailed fire from panel-layout.ts's checkout-return reconciliation where both the URL-return and legacy overlay-flag paths are distinguished.
• Static pages instrumented: pro-test/index.html and pro-test/welcome.html now load the Umami script with nonce=\"wm-static-bootstrap\" (satisfying strict-dynamic CSP) and the welcome CTAs carry data-umami-event attributes; built artifacts in public/pro/ are updated correspondingly.

Confidence Score: 4/5

Safe to merge — purely additive analytics instrumentation with no impact on checkout logic, auth flows, or data persistence.

All checkout flows are guarded with try/catch so analytics failures can never break a purchase. The one gap is that the policy test for the /pro checkout paths checks surface labels but not the event name string itself — if 'checkout-start' were later renamed the test would still pass but the funnel join would break silently. This is the only finding and it does not affect current production behavior.

tests/funnel-analytics-policy.test.mjs — the /pro checkout-start assertion should also pin the event name string, not just the surface labels.

Important Files Changed

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant U as User
    participant W as Welcome Page
    participant P as /pro Page
    participant D as Dashboard
    participant A as Analytics (Umami)

    Note over W: Umami tracker now active (www + nonce)
    U->>W: Clicks CTA
    W->>A: "welcome-cta {target}"

    U->>P: Navigates to /pro
    Note over P: Umami tracker now active (www + nonce)

    U->>P: Clicks pricing CTA (signed-out)
    P->>A: "checkout-start {surface:'pro-page', authed:false}"
    P->>P: openSignIn(afterSignInUrl with intent)

    U->>P: "Signs in, redirected back with ?checkoutProduct="
    P->>A: "checkout-start {surface:'pro-resume', authed:true}"
    P->>P: window.location.assign(hostedCheckoutUrl)

    U->>D: "Returns to /dashboard?wm_checkout=return"
    Note over D: handleCheckoutReturn reconciles
    D->>A: "checkout-success {source:'url-return'}"
    Note over A: Full funnel joinable in one tool

    alt Dashboard upgrade CTA (signed-in)
        U->>D: Clicks upgrade CTA
        D->>A: "checkout-start {surface:'dashboard', authed:true}"
        D->>D: window.location.assign(hostedCheckoutUrl)
        U->>D: "Returns to /dashboard?wm_checkout=return"
        D->>A: checkout-success / checkout-failed
    end

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant U as User
    participant W as Welcome Page
    participant P as /pro Page
    participant D as Dashboard
    participant A as Analytics (Umami)

    Note over W: Umami tracker now active (www + nonce)
    U->>W: Clicks CTA
    W->>A: "welcome-cta {target}"

    U->>P: Navigates to /pro
    Note over P: Umami tracker now active (www + nonce)

    U->>P: Clicks pricing CTA (signed-out)
    P->>A: "checkout-start {surface:'pro-page', authed:false}"
    P->>P: openSignIn(afterSignInUrl with intent)

    U->>P: "Signs in, redirected back with ?checkoutProduct="
    P->>A: "checkout-start {surface:'pro-resume', authed:true}"
    P->>P: window.location.assign(hostedCheckoutUrl)

    U->>D: "Returns to /dashboard?wm_checkout=return"
    Note over D: handleCheckoutReturn reconciles
    D->>A: "checkout-success {source:'url-return'}"
    Note over A: Full funnel joinable in one tool

    alt Dashboard upgrade CTA (signed-in)
        U->>D: Clicks upgrade CTA
        D->>A: "checkout-start {surface:'dashboard', authed:true}"
        D->>D: window.location.assign(hostedCheckoutUrl)
        U->>D: "Returns to /dashboard?wm_checkout=return"
        D->>A: checkout-success / checkout-failed
    end

_{Reviews (1): Last reviewed commit: "feat(analytics): restore Umami on canoni..." | Re-trigger Greptile}

Adversarial review + fix round (reviewed at 51a3f1d, fixes in e96c228)

An independent adversarial pass returned verdict: nothing merge-blocking. It verified the 8 risk areas directly: no import cycle or bundle-eagerness regression (analytics was already in the eager graph via panel-layout); trackCheckoutStart cannot throw into the checkout path (window/umami guards + bounded queue; /pro helper is try/catch); the strict-dynamic CSP + static nonce admits the tracker on / and /pro (deploy-config CSP subtests pass); committed public/pro is a faithful rebuild (prerender + critical-css tests pass); no double/missed-fire in the checkout-return branch; no PII in event props (return params are stripped before anything fires); prerender.mjs never touches the tracker tag. It also confirmed the mid-review test-harness commit (51a3f1d) was the complete sweep — no other harness bundles checkout.ts or panel-layout.ts.

Two LOW findings, both fixed in e96c228:

• happy-host blind spot — / on happy.worldmonitor.app rewrites to the welcome landing, but the pro pages' data-domains omitted happy, so the landing funnel was silently disabled there. Added (dashboard already listed it).
• checkout-start cardinality — the post-sign-in auto-resume re-entered startCheckout and fired a second checkout-start with the same dashboard surface. Now tagged surface:'dashboard-resume', mirroring /pro's pro-page/pro-resume split, so signed-out conversions dedupe cleanly in funnel queries.

Accepted as informational: /pro events before the deferred tracker loads are dropped (correct trade against blocking checkout); checkout-failed.status is a URL-derived low-trust string (own-session analytics only); the static-nonce pattern is the established codebase convention, not a regression.

For whoever builds the funnel query: attempts = checkout-start where authed:true (surfaces dashboard, dashboard-resume, pro-page, pro-resume); intent clicks = authed:false. A signed-out conversion emits one of each by design.

Post-fix: funnel policy + secondary-startup + both checkout harnesses 28/28, typecheck clean, pro bundle rebuilt.

Review round 2 → all four P2 findings fixed in 5c1e499

F1 — tracker boot/param hygiene: FIXED. Both tracker tags are now async defer (a plain defer external script joins the in-order queue and delays DOMContentLoaded behind the analytics host — same reason the Turnstile tag is async). The /pro SPA tag additionally sets data-exclude-search="true" so the checkout-intent resume URL (wm_checkout_product/ref/discount) and Clerk handshake params never reach analytics. Deliberate trade: the welcome landing keeps query tracking — that's where utm_*/?lang= campaign segmentation lives and no sensitive params are ever routed to /; say the word if you'd rather exclude there too. The dashboard is safe by ordering (checkout-return strips its params synchronously at boot, the facade's tracker loads after first paint + 3s).

F2 — dropped terminal event: FIXED. trackCheckoutSuccess now writes a per-tab sessionStorage marker that is cleared only when the event actually reaches the tracker (sendUmamiCall); on any non-checkout-return boot, panel-layout replays a surviving marker as checkout-success{replayed:true}. So the entitlement-watcher reload can no longer eat the purchase signal, and a delivered event can't double-count. Covered by a behavioral test (tests/checkout-success-durable.test.mts): deliver-clears, reload-replays, no-double-count.

F3 — unbounded status cardinality: FIXED. trackCheckoutFailed normalizes the URL-derived status to the closed failed/declined/cancelled/canceled/other vocabulary (checkout-return deliberately forwards unknown statuses when Dodo ID params are present, so the open path was real).

F4 (Greptile) — weak /pro assertion: FIXED. The policy test now extracts the actual trackFunnelEvent('checkout-start', …) emissions and asserts each surface (pro-page, pro-resume) is wired to one — deleting a call now fails the test even if the labels linger. Added policy guards for async/exclude-search, the durable-marker wiring, and the closed failure vocabulary.

Post-fix: 33/33 across durable + policy + secondary-startup + both checkout harnesses, typecheck clean, public/pro rebuilt (built tag verified to carry async + data-exclude-search).

Review round 4 (Elie's cross-PR pass) → all three #4934 findings fixed in 4e58a38

F2 — product-id cardinality: FIXED. Both surfaces now bucket unknown product ids to 'unknown' before tracking, against generated allowlists (dashboard: DODO_PRODUCTS from products.generated.ts; /pro: tiers.json ids — exactly the purchasable set for that build). The raw id still flows to checkout, where the backend validates. Behavioral test covers crafted-id collapse + known-id passthrough. This also exposed a latent bug in the round-2 policy test: its emission regex stopped at the first ) — now the inner bucket call — so it truncated before the surface label; fixed to span to the closing }).

F3 — dropped pro-resume event: FIXED. /pro funnel events now queue (bounded at 20) when window.umami isn't there yet, flushing via a 500ms poll for up to 30s — the mount-time tryResumeCheckoutFromUrl event survives the async tracker load. Blocked-tracker case gives up cleanly.

F4 — checkout-start double-fire: FIXED. A synchronous whole-start re-entrancy guard (startCheckoutEntryInFlight, set before any await, cleared on settle) closes the window between the entry check and doCheckout setting checkoutInFlight. Checkout was never double-created; the analytics event was.

Policy guards added for all three. public/pro rebuilt; policy + durable + secondary-startup + both checkout harnesses green; main and pro tsc clean.

Review round 5 → fixed in d25fe94

P2 — queued /pro checkout-start dies with the Dodo redirect: FIXED. The round-4 queue was memory-only and the fast signed-in/resume path top-level-redirects before the flush poll runs. Undelivered checkout-start events are now mirrored into sessionStorage (per-tab, survives the Dodo round-trip, bounded at 10, cleared on local delivery), and the dashboard replays them at boot on the same-origin return — with every field re-validated against closed vocabularies (event-name allowlist, productId re-bucketed, surface coerced, authed coerced) since sessionStorage is client-writable; replays carry replayed:true so they're distinguishable in queries.

Behavioral tests cover: sanitized replay, crafted-field collapse, unknown-event drop, malformed-storage clear, ordinary-boot no-op. Policy test pins the handoff key in both builds plus the persist/clear/replay wiring. All suites green, both tsc clean, pro rebuilt.

Review round 6 → fixed in 0318e62

P2 — replay marker cleared before delivery: FIXED. replayPendingProFunnelEvents no longer removes the handoff key at read time. It now mirrors the checkout-success contract exactly: the key is rewritten with the sanitized survivors (closed vocabularies, bounded — junk can't loop) and removed only in sendUmamiCall once a replayed event (data.replayed === true) actually reaches the tracker. Live dashboard checkout-starts never clear it, and since all replays flush in one synchronous loop, first-delivery-clears is race-free. Unreplayable payloads (malformed JSON, all-invalid entries) still clear immediately.

The reviewer was also right that the old test encoded the wrong contract — it asserted clear-on-read. Replaced with tests that pin the delivery contract: marker persists (sanitized) through a pre-delivery reload → the retry delivers → then clears; plus delivery-clears and unreplayable-clears cases. Policy test pins the delivery hook and the sanitized rewrite.

All suites green, tsc clean. No /pro sources changed this round (dashboard-side only).