diff --git a/netlify.toml b/netlify.toml
index ffa4c5f..294bb12 100644
--- a/netlify.toml
+++ b/netlify.toml
@@ -7,3 +7,26 @@
SITE_URL = "https://www.javascriptin30words.com"
# Static directory routes resolve without a client-side router or fallback.
+
+# First-party proxy for PostHog, so tracking-protection lists that match the
+# vendor hostname cannot silently drop analytics traffic. Paths and upstream
+# hosts are checked against src/analytics-config.js at build time.
+# The absolute URL in `to` sets the upstream host; Netlify drops a `host` key.
+# The asset rules must stay above the catch-all: order decides the match.
+[[redirects]]
+ from = "/e30/static/*"
+ to = "https://eu-assets.i.posthog.com/static/:splat"
+ status = 200
+ force = true
+
+[[redirects]]
+ from = "/e30/array/*"
+ to = "https://eu-assets.i.posthog.com/array/:splat"
+ status = 200
+ force = true
+
+[[redirects]]
+ from = "/e30/*"
+ to = "https://eu.i.posthog.com/:splat"
+ status = 200
+ force = true
diff --git a/scripts/build.mjs b/scripts/build.mjs
index bdef799..e215d7e 100644
--- a/scripts/build.mjs
+++ b/scripts/build.mjs
@@ -1,5 +1,6 @@
import { mkdir, rm, writeFile, readFile } from 'node:fs/promises';
import { createHash } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
import CleanCSS from 'clean-css';
import { minify } from 'terser';
import hljs from 'highlight.js/lib/core';
@@ -12,6 +13,15 @@ import { indexNowKey } from '../src/search-config.js';
hljs.registerLanguage('javascript', javascript);
const output = new URL('../build/', import.meta.url);
+// Crawlers only trust lastmod when it tracks real content changes, so it comes
+// from the last commit touching the copy rather than from the build clock.
+const lastModified = (() => {
+ try {
+ const committed = execFileSync('git', ['log', '-1', '--format=%cI', '--', 'src/data.js'], {cwd:new URL('../', import.meta.url), encoding:'utf8', stdio:['ignore','pipe','ignore']}).trim();
+ if (committed) return committed.slice(0,10);
+ } catch { /* Not a git checkout; fall back to today. */ }
+ return new Date().toISOString().slice(0,10);
+})();
const requestedOrigin = new URL(process.env.SITE_URL || 'https://www.javascriptin30words.com');
if (!['http:', 'https:'].includes(requestedOrigin.protocol)) throw new Error('SITE_URL must be an HTTP(S) URL.');
const origin = requestedOrigin.origin;
@@ -41,6 +51,16 @@ const aiPanelPath = `/assets/ai-panel.${createHash('sha256').update(aiPanel).dig
if (analyticsConfig.googleMeasurementId && !/^G-[A-Z0-9]+$/.test(analyticsConfig.googleMeasurementId)) throw new Error('Invalid public Google measurement ID.');
if (analyticsConfig.posthogProjectToken && !/^phc_[A-Za-z0-9]+$/.test(analyticsConfig.posthogProjectToken)) throw new Error('Use a public PostHog project token, never a personal API key.');
if (!['https://eu.i.posthog.com','https://us.i.posthog.com'].includes(analyticsConfig.posthogHost)) throw new Error('Invalid PostHog ingestion host.');
+if (!/^\/[a-z0-9-]{2,20}$/.test(analyticsConfig.posthogProxyPath)) throw new Error('PostHog proxy path must be a single lowercase path segment.');
+// The browser talks only to posthogProxyPath, so a missing or stale redirect
+// would silently 404 every event. Fail the build instead of the analytics.
+const netlifyConfig = await readFile(new URL('../netlify.toml', import.meta.url), 'utf8');
+const assetsHost = analyticsConfig.posthogHost.replace('.i.posthog.com','-assets.i.posthog.com');
+for (const [from, to] of [[`${analyticsConfig.posthogProxyPath}/static/*`, `${assetsHost}/static/:splat`],
+ [`${analyticsConfig.posthogProxyPath}/array/*`, `${assetsHost}/array/:splat`],
+ [`${analyticsConfig.posthogProxyPath}/*`, `${analyticsConfig.posthogHost}/:splat`]]) {
+ if (!netlifyConfig.includes(`from = "${from}"`) || !netlifyConfig.includes(`to = "${to}"`)) throw new Error(`netlify.toml is missing the PostHog proxy rule ${from} -> ${to}`);
+}
const analyticsSource = (await readFile(new URL('../src/analytics.js', import.meta.url), 'utf8')).replace("import {analyticsConfig as config} from './analytics-config.js';", `const config = ${JSON.stringify(analyticsConfig)};`);
const analytics = (await minify(analyticsSource, {module:true})).code;
const analyticsPath = `/assets/analytics.${createHash('sha256').update(analytics).digest('hex').slice(0,12)}.js`;
@@ -236,7 +256,7 @@ for (const [index, concept] of definitions.entries()) {
await writeFile(new URL('index.html', directory), conceptPage(concept,index));
}
await writeFile(new URL('404.html', output), document({title:'Page Not Found', description:'Find a JavaScript concept in our quick reference.', path:'/404.html', noindex:true, content:'
404
That page isn’t here.
Find the explanation you need in the concept library.