From 6f53b02601c79d9e8a7bb9c97da289d1b9b11561 Mon Sep 17 00:00:00 2001
From: storagebits <48120561+storagebits@users.noreply.github.com>
Date: Tue, 3 Nov 2026 14:31:46 -0500
Subject: [PATCH] Cloudflare Web Analytics on every page (cookieless beacon),
 its hosts allowed in the CSP

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BzxZC3wWSF335hrEAezaC2
---
 scripts/build.mjs | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/scripts/build.mjs b/scripts/build.mjs
index f4cefc6..0e186a3 100644
--- a/scripts/build.mjs
+++ b/scripts/build.mjs
@@ -107,6 +107,10 @@ const write = (rel, html) => {
   console.log(`dist/${rel}  ${(html.length / 1024).toFixed(0)} KB`);
 };
 
+// Cloudflare Web Analytics (no cookie): the beacon on every page but the 404; its host is allowed in the CSP below.
+// The token is public by design, it ends up in the HTML.
+const BEACON = `<script defer src="https://static.cloudflareinsights.com/beacon.min.js" data-cf-beacon='{"token": "d40db2e4c8384583b627ead20dd0c055"}'></script>`;
+
 fs.rmSync(DIST, {recursive: true, force: true});
 fs.mkdirSync(DIST, {recursive: true});
 
@@ -120,6 +124,7 @@ for (const m of machines) {
 <body>
 <div id="app"></div>
 <script type="module">${js}</script>
+${BEACON}
 </body>
 </html>
 `;
@@ -169,6 +174,7 @@ ${cards}
 </main>
 <footer class="site-foot">${footerHTML('', '', lang)}</footer>
 <script>${LANG_JS}</script>
+${BEACON}
 </body>
 </html>
 `;
@@ -183,11 +189,11 @@ fs.writeFileSync(
 );
 const csp = [
   "default-src 'self'",
-  `script-src 'self' ${[...hashes].map((h) => `'sha256-${h}'`).join(' ')}`,
+  `script-src 'self' https://static.cloudflareinsights.com ${[...hashes].map((h) => `'sha256-${h}'`).join(' ')}`,
   "style-src 'self' 'unsafe-inline'",
   "img-src 'self' data: blob:",
   "font-src 'self' data:",
-  "connect-src 'self'",
+  "connect-src 'self' https://cloudflareinsights.com",
   "object-src 'none'",
   "base-uri 'self'",
   "form-action 'self'",