fix: add versioning to umami script to enable manual CF cache invalidation

Know-Code-Verified: 23a3c5e5d43133a9bb8d391011ece2ace4273ae904c97bf83fcc2b5599a7b478

Author: chtnnh

infra/umami-proxy/README.md

@@ -6,7 +6,7 @@ so the browser never talks to a third-party analytics host (ad-blocker bypass).
 
 | Public (docs domain) | Upstream |
 |----------------------|----------|
-| `GET /s/x.js` | `{UMAMI_ORIGIN}/script.js` |
+| `GET /s/x.js` | `{UMAMI_ORIGIN}/script.js` (collector rewritten to `/s/e`) |
 | `POST /s/e` | `{UMAMI_ORIGIN}/api/send` |
 
 Neutral path names (`/s/x.js`, `/s/e`) avoid EasyPrivacy hits on `umami`,

infra/umami-proxy/src/index.ts

@@ -2,7 +2,7 @@
  * Same-origin proxy for self-hosted Umami.
  *
  * Public paths on kc.chtnnhfoundation.org (neutral names — not on blocklists):
- *   GET  /s/x.js  →  {UMAMI_ORIGIN}/script.js   (rewrites /api/send → /s/e)
+ *   GET  /s/x.js  →  {UMAMI_ORIGIN}/script.js   (rewrites its collector to /s/e)
  *   POST /s/e     →  {UMAMI_ORIGIN}/api/send
  *
  * Dashboard and other Umami routes are not exposed. Deploy the Worker first,

infra/umami-proxy/src/paths.test.ts

@@ -3,6 +3,8 @@ import { describe, it } from "node:test";
 import {
   COLLECT_PATH,
   ORIGIN_COLLECT,
+  SCRIPT_PATH,
+  TRACKER_COLLECT_SUFFIX,
   matchProxyPath,
   originBase,
   rewriteTrackerScript,
@@ -21,14 +23,29 @@ describe("originBase", () => {
 });
 
 describe("rewriteTrackerScript", () => {
-  it("points collect calls at the same-origin path", () => {
+  it("points collect calls at the same-origin collector suffix", () => {
     const src = `fetch("${ORIGIN_COLLECT}",{method:"POST"})`;
-    assert.equal(rewriteTrackerScript(src), `fetch("${COLLECT_PATH}",{method:"POST"})`);
+    assert.equal(
+      rewriteTrackerScript(src),
+      `fetch("${TRACKER_COLLECT_SUFFIX}",{method:"POST"})`,
+    );
   });
 
   it("rewrites every occurrence", () => {
     const src = `${ORIGIN_COLLECT} ${ORIGIN_COLLECT}`;
-    assert.equal(rewriteTrackerScript(src), `${COLLECT_PATH} ${COLLECT_PATH}`);
+    assert.equal(
+      rewriteTrackerScript(src),
+      `${TRACKER_COLLECT_SUFFIX} ${TRACKER_COLLECT_SUFFIX}`,
+    );
+  });
+
+  it("makes the tracker's script-relative collector resolve to the public endpoint", () => {
+    const trackerBase = new URL(SCRIPT_PATH, "https://kc.chtnnhfoundation.org").href
+      .split("/")
+      .slice(0, -1)
+      .join("/");
+    assert.equal(`${trackerBase}${TRACKER_COLLECT_SUFFIX}`, "https://kc.chtnnhfoundation.org/s/e");
+    assert.equal(`${trackerBase}${COLLECT_PATH}`, "https://kc.chtnnhfoundation.org/s/s/e");
   });
 
   it("does not rewrite other Umami routes", () => {

infra/umami-proxy/src/paths.ts

@@ -4,11 +4,14 @@ export const SCRIPT_PATH = "/s/x.js";
 export const COLLECT_PATH = "/s/e";
 export const ORIGIN_SCRIPT = "/script.js";
 export const ORIGIN_COLLECT = "/api/send";
+// Umami appends this suffix to the directory containing its tracker script.
+// With /s/x.js, /e produces the public collector endpoint /s/e.
+export const TRACKER_COLLECT_SUFFIX = "/e";
 
 // Bump this whenever the Worker changes the transformed tracker response.
 // Cache API entries outlive Worker deployments, so this avoids serving a
 // response produced by an older transform.
-export const TRACKER_CACHE_VERSION = "v1";
+export const TRACKER_CACHE_VERSION = "v2";
 
 export type ProxyRoute = "script" | "collect";
 
@@ -17,7 +20,7 @@ export function originBase(origin: string): string {
 }
 
 export function rewriteTrackerScript(body: string): string {
-  return body.replaceAll(ORIGIN_COLLECT, COLLECT_PATH);
+  return body.replaceAll(ORIGIN_COLLECT, TRACKER_COLLECT_SUFFIX);
 }
 
 /** Versioned Cache API key; never use this URL for the upstream fetch. */