feat(analytics): namespaced extension analytics in the dev kit (DUPLOAI-3906)

[aboutte]

Summary

Adds namespaced product analytics (Mixpanel, through the host portal) to extensions built with the dev kit. Every extension now reports which of its pages are opened and which of its actions succeed, as events namespaced under its manifest id (<extension id>.<page>.viewed, <extension id>.<action>). By default these are event names only, with no custom properties.

This is the dev kit side of duplocloud-internal/duplo-ui#5278 (DUPLOAI-3906: namespaced analytics tracker for extensions). The host builds the event, stamps extension_id / extension_version, and sends it through the portal's existing consent-gated pipeline, so nothing is sent without the user's analytics consent.

Changes

ng-common-lib 0.4.1

• Vendor duplocloud-internal-ng-common-lib-0.4.1.tgz (adds REMOTE_ExtensionAnalytics), replacing 0.4.0 in packages/ and the template's vendor/.
• Update package.json and lockfiles in every sample and in the helloworld template. docs/UPGRADING-ng-common-lib.md now lists 0.4.1 as the current line.

Template (helloworld)

• New frontend/src/app/analytics.ts: the one wrapper per extension that injects the host token and holds EXTENSION_ID. It has no properties parameter, on purpose.
• The list, view and add/edit components fire page views and actions, plus the ask-agent / track-provisioning navigation events on the ticket buttons.
• The rename gate also catches HelloAnalytics and the template's event names.

Build checks (scripts/build-extension.sh, new scripts/_extension_id.sh)

• The manifest id must be lowercase reverse-DNS with at least 3 segments, because it is the event namespace.
• Any frontend EXTENSION_ID must match the manifest id, in every declaration form: single, double or backtick quotes, with or without a type annotation. A stale id makes the host drop every event silently.
• New test: tests/test-build-extension-id.sh.

Skill docs

• New reference/21-analytics.md covers wiring, default events, naming rules, the build checks, console verification and the retrofit. It has a hard rule on properties: none by default; secrets are always refused; identifying data is added only after a second confirmation.
• SKILL.md: an index row, the Phase 0 retrofit trigger (which checks Angular and library-version preconditions before creating any file), the Phase 1 default events, the Phase 2 analytics.ts and the Phase 7 [analytics] console check.
• 20-ui-library.md, 02-authoring-guide.md (the optional frontend.analytics block) and the ng22 migration skill (analytics retrofit as step 9).

Privacy

• PRIVACY.md now covers namespaced and extension events, and the name properties that are sent.

Notes for reviewers

• The branch is 2 commits behind dev. Both are dev pipeline: pin … commits that don't touch these files.
• duplo-ui#5278 must ship first, or at the same time. Without REMOTE_ExtensionAnalytics in the host, the token can't be resolved.

🤖 Generated with Claude Code