[harlan-zw]

❓ Type of change

• 🧹 Chore

📚 Description

Privacy is a skilld.dev tenet, and several paths sent visitor behaviour to third parties or stored it per reader. This PR keeps the data the site needs to grow and drops the part that names a person.

Kept, as anonymous aggregates.

• Command copies and CLI runs go to Cloudflare Analytics Engine. A data point holds surface, grammar (run or install), kind, Skill, and two-letter country. It holds no IP address, no cookie, and no account id. The CLI may still send a userId; the endpoint drops it, so the sampling index is the Skill and an account cannot be followed across runs. Blob order is fixed in shared/analytics.ts, because reordering would rewrite every saved query.
• The copy body is strict. A field the endpoint never asked for is a 400, not a value that reaches the data point by accident.
• Cloudflare Web Analytics (RUM) stays. Its same-origin beacon proxy forwards only a content type, so no visitor IP or cookie leaves the Worker, and page and referrer URLs in the beacon body lose their query strings.
• Sentry stays, hardened. Browser envelopes go through a same-origin Worker route (/api/monitoring) that forwards only to the configured DSN, so sentry.io never sees a visitor IP. The browser SDK sends errors only: no tracing, no session tracking, no replay. Client and server strip query strings, cookies, headers, bodies, and user.ip_address, and drop console and UI click breadcrumbs.
• Traces stay on at 1% for request timing. Invocation logs are off: they record a full request URL and client metadata for every request, which the wide events already cover without the visitor detail.

Dropped.

• install_events in D1. It kept one timestamped row per visitor action. The count it fed now comes from Analytics Engine.
• weekly_click_events. Every row named a reader. feat(identity): count email clicks as daily aggregates #243 brings the digest click number back as a daily counter with no reader id.
• The Iconify API fallback, so a visitor's browser never calls api.iconify.design.
• The Algolia npm-search client, which called Algolia from the browser on a surface the site no longer ships.

flowchart LR
  V["Visitor copies a command"] -->|"POST /api/events/install"| W["Worker"]
  C["skilld CLI run"] -->|"POST /api/events/cli"| W
  W -->|"surface, mode, kind, slug, country"| AE["Analytics Engine<br/>skilld_web_v1 / skilld_cli_v1"]
  W -.->|"userId dropped"| X["✗"]
  AE -->|"SQL API"| K["Daily check-in Pulse<br/>run and install copies"]
  V -->|"beacon"| P["Same-origin RUM proxy<br/>query strings stripped"] --> CWA["Cloudflare Web Analytics"]
  B["Browser error"] --> M["/api/monitoring<br/>PII scrubbed"] --> S["Sentry"]

Loading

📝 Migration

• 0119_drop_click_and_install_events.sql drops weekly_click_events and install_events. It cannot be recovered.
• The skilld_web_v1 Analytics Engine dataset is created on first write. No dashboard step.
• In the Sentry skilld project, enable "Prevent Storing of IP Addresses" and server-side data scrubbing.

Notes:

• sendDefaultPii is deprecated in @sentry/nuxt 10.73 and ignored when dataCollection is set. dataCollection.userInfo: false already makes the browser client send infer_ip: never, so the deprecated flag is not set.
• The admin weekly report no longer shows copy counts, because Analytics Engine is not readable from D1. The daily check-in reads them over the SQL API instead.
• newly_broken_repos_impacted no longer counts an install event as impact, because the table is gone. A star, subscription, collection, or Skill still counts.

[harlan-github-agent]

🤖 MERGED

Harlan Agent Kit posted this automated review. It is not Harlan's personal review or approval. AI open source policy. Last updated: 2026-09-22 08:14 UTC.

GitHub merged this pull request.

• Copy totals silently undercount once more than 50 slug groups exist in a day. Next: Add a second untruncated totals query (GROUP BY mode, no LIMIT) for total/run/install, and keep the LIMIT 50 query only for the ranked top list.
• The 96-byte index cap is enforced in characters, not bytes, so astral-character slugs still get the whole data point rejected. Next: Cut the encoded bytes to 96 (TextEncoder, subarray, TextDecoder) instead of slicing the string by characters.

Opened pull request #274: #274.