@hanzo/event 0.3.10 → 0.3.12

package/README.md

@@ -32,9 +32,18 @@ starve the other:
 ```html
 <script async src="https://unpkg.com/@hanzo/event/hz.js"
         data-product="hanzo.ai"
+        data-ingest-key="pk-…"
         data-capture="1"></script>
 ```
 
+> **`data-ingest-key` is required off the door's own origin**, and through
+> 0.3.11 this file could not present one at all — no header, no query. A keyed
+> static surface therefore sent UNATTRIBUTED writes, which the door refuses
+> (`401 ingest_key_required`) silently, because nothing here reads the response.
+> The tag measured fine in the browser and filed nothing. It now rides
+> `Authorization: Bearer pk-…` on fetch and `?ingest_key=pk-…` on a headerless
+> unload beacon — the same pair the npm client uses.
+
 `hz.js` (in this package) is the **script-tag distribution** of this client, for
 surfaces with no build step. It posts the SAME `{ batch: [WireEvent, …] }` to the
 SAME `POST {host}/v1/event`, and adds DOM **autocapture** — `$click` (with an
@@ -42,6 +51,12 @@ element locator), `$outbound`, `$scroll`, `$form`, `$vitals` — which a bundled
 does not need and a plain page cannot get. Manual API: `window.hanzo.track()` /
 `identify()` / `page()`.
 
+It honours the same consent sources the bundled stack does: an explicit stored
+choice (`hz_consent`, the key a Hanzo consent banner writes) outranks the browser
+signal in both directions; otherwise Global Privacy Control and Do Not Track are
+refusals. A React app does not need this file — mount `<Hanzo analytics>` from
+`@hanzo/ui`, which wires this client and the capture engine together.
+
 > The tag used to live in `hanzoai/analytics` and post a **bare JSON array** of
 > `{site, ts, type, path, …}` to `analytics.hanzo.ai/v1/event` — a second protocol
 > behind an identical path spelling, served by a second collector with its own

package/dist/{core-BCEdNp8H.d.cts → core-BZraSvcr.d.cts}

@@ -108,9 +108,12 @@ interface AnalyticsConfig {
      *  a reading principal — so it is safe to ship in a bundle. Mint one per org with
      *  POST /v1/keys {"type":"publishable"}.
      *
-     *  Omit it and the client reads NEXT_PUBLIC_HANZO_EVENT_KEY, then HANZO_EVENT_KEY,
-     *  from the inlined build env — the same resolution `dsn` uses, so a surface
-     *  declares BOTH planes the same way and neither needs code to switch on.
+     *  Omit it and the client reads NEXT_PUBLIC_EVENT_INGEST_KEY from the inlined
+     *  build env, the same way `dsn` falls back — so a surface declares BOTH planes
+     *  in its build and neither needs code to switch on. That is the ONE spelling
+     *  the fleet already carries: KMS holds deploy/EVENT_INGEST_KEY, and each
+     *  Dockerfile takes EVENT_INGEST_KEY as a build-arg and re-exports it with the
+     *  NEXT_PUBLIC_ prefix that makes Next inline it.
      *
      *  A surface with no key at all still reports for whoever is SIGNED IN (the
      *  session credential attributes them), and drops every logged-out visitor: the

package/dist/{core-BCEdNp8H.d.ts → core-BZraSvcr.d.ts}

@@ -108,9 +108,12 @@ interface AnalyticsConfig {
      *  a reading principal — so it is safe to ship in a bundle. Mint one per org with
      *  POST /v1/keys {"type":"publishable"}.
      *
-     *  Omit it and the client reads NEXT_PUBLIC_HANZO_EVENT_KEY, then HANZO_EVENT_KEY,
-     *  from the inlined build env — the same resolution `dsn` uses, so a surface
-     *  declares BOTH planes the same way and neither needs code to switch on.
+     *  Omit it and the client reads NEXT_PUBLIC_EVENT_INGEST_KEY from the inlined
+     *  build env, the same way `dsn` falls back — so a surface declares BOTH planes
+     *  in its build and neither needs code to switch on. That is the ONE spelling
+     *  the fleet already carries: KMS holds deploy/EVENT_INGEST_KEY, and each
+     *  Dockerfile takes EVENT_INGEST_KEY as a build-arg and re-exports it with the
+     *  NEXT_PUBLIC_ prefix that makes Next inline it.
      *
      *  A surface with no key at all still reports for whoever is SIGNED IN (the
      *  session credential attributes them), and drops every logged-out visitor: the

package/dist/index.cjs

@@ -246,7 +246,7 @@ function uuidv7Time(id) {
 }
 
 // src/version.ts
-var VERSION = "0.3.9";
+var VERSION = "0.3.12";
 
 // src/sentry.ts
 var MAX_FRAMES = 50;
@@ -618,13 +618,21 @@ var Analytics = class {
       captureErrors: true,
       ...config,
       // The publishable key resolves the SAME way the DSN below does: an explicit
-      // config wins, else the inlined build-time env. Without this the key was the
-      // one piece of wiring a surface could not declare the way it declares every
-      // other piece, so every surface that shipped without passing it in code sent
-      // its beacons unattributed — and an unattributed write is refused (401
-      // ingest_key_required), which is silent in the page and invisible until you
-      // read the warehouse and find the host missing entirely.
-      ingestKey: config.ingestKey ?? readEnv("NEXT_PUBLIC_HANZO_EVENT_KEY") ?? readEnv("HANZO_EVENT_KEY")
+      // config wins, else the inlined build-time env.
+      //
+      // NEXT_PUBLIC_EVENT_INGEST_KEY is that env, and it is the name the fleet
+      // ALREADY carries end to end — KMS holds deploy/EVENT_INGEST_KEY, each
+      // Dockerfile takes it as the EVENT_INGEST_KEY build-arg and re-exports it
+      // with the NEXT_PUBLIC_ prefix Next needs to inline it. Reading anything
+      // else here would add a fourth spelling of one value.
+      //
+      // Without this the key was the one piece of wiring a surface could not
+      // declare the way it declares every other piece, so a surface that shipped
+      // without passing it in code sent its beacons unattributed — and an
+      // unattributed write is refused (401 ingest_key_required), which is silent
+      // in the page and invisible until you read the warehouse and find the host
+      // missing entirely.
+      ingestKey: config.ingestKey ?? readEnv("NEXT_PUBLIC_EVENT_INGEST_KEY")
     };
     this.transport = config.transport ?? new DefaultTransport();
     this.dsn = parseDsn(config.dsn ?? readEnvDsn() ?? dsnForProduct(this.cfg.product));
@@ -743,8 +751,8 @@ var Analytics = class {
     const batch = this.queue;
     this.queue = [];
     this.clearTimer();
-    const key = this.cfg.ingestKey?.trim() || void 0;
-    const token = key ? void 0 : this.cfg.getToken?.() ?? void 0;
+    const token = this.cfg.getToken?.() ?? void 0;
+    const key = token ? void 0 : this.cfg.ingestKey?.trim() || void 0;
     const useBeacon = beacon && !token;
     const body = serializeBatch(batch);
     if (body === null) {