feat: Statsig provider with event allowlist and isolated staging opt-in (PLAT-1203)

[devin-ai-integration]

Description

Adds a Statsig provider so events already flowing through blu-lytics can also feed Statsig (rollout/observability layer). Bluff remains the feature-flag source; this PR only adds an event sink.

• src/providers/setups/statsig/statsig.ts: new provider built on @statsig/js-client (3.33.5).
  • Allowlist, fail-closed: only events listed in statsigOptions.events are forwarded; anything else is dropped. No client key → provider never initializes.
  • Identity: userID = client_uuid from the default properties (business unit for the funnel); customIDs.userID = the id passed to sendUserIdentification (numeric user.id). No PII is sent.
  • environment.tier follows the blu-lytics environment (staging/production).
  • No setTimeout delay (unlike Mixpanel) and every SDK call is wrapped in try/catch.
• src/initializers: accepts statsigOptions: { events: string[]; sendInStaging?: boolean } and wires the provider.
• src/dispatchers: in non-production the dispatcher still only console.logs for all existing providers; when sendInStaging === true only the Statsig provider additionally receives the event. Mixpanel/Clarity/FullStory/Sentry behaviour is unchanged.
• package.json: semantic-release moved to its sorted position; version stays managed by semantic-release.

Jira: https://useblu.atlassian.net/browse/PLAT-1203
Feature doc: https://github.com/Pagnet/product-bluprints/tree/main/prd-tracking/PLAT-1203-rollout-observabilidade-statsig

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as before)

Checklist

• Perform a code self-review
• Comment the code, particularly in hard-to-understand areas
• Add documentation
• Cover changes with tests
• Ensure the test suite passes (yarn test)
• Make sure code lints (yarn lint). Fix it with yarn lint:fix in case of failure.
• Make sure types are fine (tsc --noEmit; the repo has no lint:types script)

Link to Devin session: https://app.devin.ai/sessions/f002eb1668b74839a451504f515e85de
Open in Devin Desktop: https://app.devin.ai/desktop/session/f002eb1668b74839a451504f515e85de?variant=devin

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

---

Original prompt from Italo.matos

Criei uma conta no serviço do Statsig , e queria conseguir plugar ele na nossa plataforma. Tendo em vista tudo que vc conhece sobre a plataforma da BLU .. acha que o StatsIg consegue agregar em algo ? enumere os principais pontos de contribuição , e o quão dificil seria instalar em nossa plataforma. faça um roteiro de passo a passo para dizer o que preciso fazer .. não muda nada em codigo até entào

[devin-ai-integration]

Test status (local): yarn test → 7 suites / 52 tests passing; tsc --noEmit clean. yarn lint reports 1 pre-existing max-len error in src/utils/index.ts (untouched by this PR).

Attention points:

• No client key is committed; the consumer (mfe-core) provides STATSIG_CLIENT_KEY. Without it the provider stays off.
• sendInStaging only affects the Statsig provider — other providers keep the console-only behaviour outside production.
• Needs a semantic-release (1.5.0) before mfe-core can bump.

[devin-ai-integration]

@claude faça o code review deste PR.

[SvcGitHarness]

🎉 This PR is included in version 1.5.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀