feat: load dynamic configuration

[feugy]

🖖 What's in there?

This PR introduce loads a stringified configuration when injecting the script, which acts as defaults for unspecified properties.
This mechanism is a generic way for Vercel to configure at build time @vercel/analytics and other "client side" packages, while allowing users to override the configuration when needed.

This server-side track() function will not use this configuration for now: instead, I've fixed it so we could leverage the exiting (unused) VERCEL_WEB_ANALYTICS_ENDPOINT env var to fully configure where the data is sent.

This PR also introduce dedicated data attribute for the injected script: data-event-endpoint and data-view-endpoint.

Finally, it replaces eslint+prettier with biome, and husky+lint-staged with lefthook, and restore unit tests in CI.

🤺 How to test?

It's not tested on CI, because I need to define configuration strings at build time when deploying the test applications on Vercel. At least the exiting tests are checking that it's fully backward compatible.

As for manual tests:

1. go to any test application inside the apps/ folder

2. build the app using the appropriate env var: NEXT_PUBLIC_VERCEL_OBSERVABILITY_CLIENT_CONFIG (Next), PUBLIC_VERCEL_OBSERVABILITY_CLIENT_CONFIG (Astro), VITE_VERCEL_OBSERVABILITY_CLIENT_CONFIG (all others) and give it these values

   1. custom injected script URL '{"analytics":{"scriptSrc":"https://acme.com/foo.js"}}'.
   2. production injected script + custom ingestion intake URL '{"analytics":{"endpoint":"/foo/bar","scriptSrc":"https://vercel-scripts.com/v1/script.js"}}'

3. run the application locally (pnpm preview or pnpm start) and browse to it with dev tools open on the network tab.

   1. attempt to inject the script from the provided (fake) url
   2. attempt to send the page view to the provided (fake) url

for example:

cd apps/nextjs
NEXT_PUBLIC_VERCEL_OBSERVABILITY_CLIENT_CONFIG='{"analytics":{"scriptSrc":"https://acme.com/foo.js"}}' pnpm build
pnpm start

🔬Notes to reviewers

While adding tests to src/server/index.ts(server side tracking), I've fixed a bug where the provided flags would not be sent unless the request context is populated.

All changes on test apps are due to biome's linter and formatter.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
analytics-astro	Ready	Preview, Comment	Jan 8, 2026 2:47pm
analytics-next15	Ready	Preview, Comment	Jan 8, 2026 2:47pm
analytics-nextjs	Ready	Preview, Comment	Jan 8, 2026 2:47pm
analytics-nuxt	Ready	Preview, Comment	Jan 8, 2026 2:47pm
analytics-remix	Ready	Preview, Comment	Jan 8, 2026 2:47pm
analytics-sveltekit	Ready	Preview, Comment	Jan 8, 2026 2:47pm
analytics-vue	Ready	Preview, Comment	Jan 8, 2026 2:47pm

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vitest@​2.1.5 ⏵ 4.0.16	-1	+75		-1
	@​testing-library/​jest-dom@​6.6.3 ⏵ 6.9.1	+2
	@​testing-library/​react@​16.0.1 ⏵ 16.3.1
	@​biomejs/​biome@​2.3.10

View full report