Upgrade to the Meta Conversions API bundle 1.0 and SDK 2.0

[loevgaard]

Closes #88.

Moves the plugin to setono/meta-conversions-api-bundle ^1.0@alpha (was ~0.1.5) and setono/meta-conversions-api-php-sdk ^2.0@alpha (was ~0.2.4). Events are sent to Graph API v26.0 instead of v14.0. Meta retires everything up to and including v20.0 on 24 September 2026.

Why this is more than a version bump

With only the constraints changed, lint:container passed and all unit tests were green, while every event was dropped. Nothing in the chain fails loudly when the plugin is wired wrongly.

• The pixel provider alias. The bundle's service ids are FQCNs now. OverrideDefaultPixelProviderPass aliased setono_meta_conversions_api.pixel_provider.default, which no longer exists, so PixelProviderInterface kept pointing at the bundle's configuration based provider, i.e. at no pixels. It aliases PixelProviderInterface::class now.
• The provider is also called without a request. The bundle strips the access tokens before the event is queued and asks the provider for them again when the event is sent, which may be in a Messenger worker. DoctrineBasedPixelProvider asked Sylius for the channel there and got a ChannelNotFoundException in a shop with more than one channel. It now takes the RequestStack: with a request it returns the enabled pixels of the current channel, as before, and without one it returns every enabled pixel, through the new PixelRepositoryInterface::findEnabled(). The tokens are matched by pixel id against the pixels the event was raised for, so this never adds a pixel to an event.

Tests

• PixelProviderTest (functional): the container resolves PixelProviderInterface to the plugin's provider, and the provider returns the right pixels with and without a request.
• ServerSideTrackingTest (functional): the whole way from ConversionsApiEventRaised to the request, with a recording mock response factory on the test application's http client. It asserts the pixel, the restored access token and that the Graph API version is at least 21, for an event raised during a request and for one sent outside of one. No test can send anything to Meta anymore.
• Both were checked against the broken state: with the old alias, or without the no-request branch, they fail with exactly the symptoms above.

Docs

• README: how to allow the pre-releases (a stability flag on a dependency's requirement is not inherited) and the php-http/discovery plugin, sending the events asynchronously instead of the http client step (a Sylius application already ships with symfony/http-client and nyholm/psr7), and the test event code, which only works when kernel.debug is true now.
• UPGRADE.md: what a shop has to do. The important one: let the Messenger transport drain before deploying, because SendEvent changed shape.

Worth knowing when reviewing

• The Backwards Compatibility Check will fail, on purpose: DoctrineBasedPixelProvider::__construct() got a third argument and PixelRepositoryInterface got findEnabled(). Both are needed for the worker case and are described in UPGRADE.md.
• The bundle no longer registers a bus of its own and dispatches SendEvent on the default bus, which is sylius.command_bus in a Sylius application, with the validation and doctrine_transaction middleware. Every event the plugin raises comes from a shop controller, never from inside another handler or an open transaction, so this is safe, and the plugin keeps the bundle's default. setono_meta_conversions_api.server_side.message_bus is documented for those who want another bus.
• An event an application raises outside of a request, in a console command for instance, goes to every enabled pixel, because there is no channel to narrow it down by.

Verified locally (PHP 8.3)

composer validate --strict, composer normalize --dry-run, ECS, PHPStan, Rector, lint:container, lint:yaml, 76 unit and 15 functional tests, Infection at 87% (threshold 87; 164 of 188 killed, single threaded). Smoke test on the dev server: the pages return 200, only the enabled pixel of the channel is initialised, ViewContent is rendered client side, and server side the request reached Meta, which rejected the dummy access token of the dev database. That was logged on the setono_meta_conversions_api channel and did not break the page.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (343617c) to head (dc393d3).

Additional details and impacted files

@@             Coverage Diff             @@
##                 3.x       #89   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
- Complexity       110       113    +3     
===========================================
  Files             25        25           
  Lines            400       410   +10     
===========================================
+ Hits             400       410   +10     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.