@hanzo/event 0.3.13 → 0.3.15

package/dist/react.cjs

@@ -206,31 +206,110 @@ function scrubText(s, capturePII = false) {
   return s;
 }
 
-// src/uid.ts
-var HEX = Array.from({ length: 256 }, (_, i) => (i + 256).toString(16).slice(1));
-function fill(b) {
-  const c = typeof crypto !== "undefined" ? crypto : void 0;
-  if (c && typeof c.getRandomValues === "function") {
-    c.getRandomValues(b);
-    return b;
-  }
-  for (let i = 0; i < b.length; i++) b[i] = Math.random() * 256 | 0;
-  return b;
-}
-function uuidv7(now = Date.now()) {
-  const b = fill(new Uint8Array(16));
-  let t = Math.floor(now);
-  for (let i = 5; i >= 0; i--) {
+// src/anon.js
+var HZ_ANON_KEY = "hz_anon_id";
+var HZ_ANON_LEGACY_KEY = "hz_id";
+var HZ_ANON_DOMAIN = "hanzo.ai";
+var HZ_ANON_MAX_AGE = 2 * 365 * 24 * 60 * 60;
+var hzAnonMemo;
+function hzUuidv7(now) {
+  var b = new Uint8Array(16);
+  var i;
+  var c = typeof crypto !== "undefined" ? crypto : void 0;
+  if (c && typeof c.getRandomValues === "function") c.getRandomValues(b);
+  else for (i = 0; i < 16; i++) b[i] = Math.random() * 256 | 0;
+  var t = Math.floor(now === void 0 ? Date.now() : now);
+  for (i = 5; i >= 0; i--) {
     b[i] = t % 256;
     t = Math.floor(t / 256);
   }
   b[6] = 112 | b[6] & 15;
   b[8] = 128 | b[8] & 63;
-  return HEX[b[0]] + HEX[b[1]] + HEX[b[2]] + HEX[b[3]] + "-" + HEX[b[4]] + HEX[b[5]] + "-" + HEX[b[6]] + HEX[b[7]] + "-" + HEX[b[8]] + HEX[b[9]] + "-" + HEX[b[10]] + HEX[b[11]] + HEX[b[12]] + HEX[b[13]] + HEX[b[14]] + HEX[b[15]];
+  var h = "";
+  for (i = 0; i < 16; i++) {
+    h += (b[i] + 256).toString(16).slice(1);
+    if (i === 3 || i === 5 || i === 7 || i === 9) h += "-";
+  }
+  return h;
+}
+function hzAnonJar() {
+  try {
+    if (typeof document === "undefined" || typeof document.cookie !== "string") return null;
+    return document;
+  } catch (e) {
+    return null;
+  }
+}
+function hzAnonStore() {
+  try {
+    if (typeof window === "undefined" || !window.localStorage) return null;
+    return window.localStorage;
+  } catch (e) {
+    return null;
+  }
+}
+function hzAnonItem(store, name) {
+  try {
+    return store && store.getItem(name) || "";
+  } catch (e) {
+    return "";
+  }
+}
+function hzAnonCookie(name) {
+  var d = hzAnonJar();
+  if (!d) return "";
+  var parts = d.cookie.split(";");
+  for (var i = 0; i < parts.length; i++) {
+    var eq = parts[i].indexOf("=");
+    if (eq < 0 || parts[i].slice(0, eq).trim() !== name) continue;
+    var v = parts[i].slice(eq + 1).trim();
+    if (!v) continue;
+    try {
+      return decodeURIComponent(v);
+    } catch (e) {
+      return v;
+    }
+  }
+  return "";
+}
+function hzAnonWrite(name, value) {
+  var d = hzAnonJar();
+  if (!d) return;
+  var host = "";
+  var secure = false;
+  try {
+    if (typeof window !== "undefined" && window.location) {
+      host = window.location.hostname || "";
+      secure = window.location.protocol === "https:";
+    }
+  } catch (e) {
+  }
+  var c = name + "=" + encodeURIComponent(value);
+  c += "; Path=/; Max-Age=" + HZ_ANON_MAX_AGE + "; SameSite=Lax";
+  if (("." + host).slice(-(HZ_ANON_DOMAIN.length + 1)) === "." + HZ_ANON_DOMAIN) {
+    c += "; Domain=" + HZ_ANON_DOMAIN;
+  }
+  if (secure) c += "; Secure";
+  try {
+    d.cookie = c;
+  } catch (e) {
+  }
+}
+function hzAnonId() {
+  if (typeof window === "undefined") return "";
+  var s = hzAnonStore();
+  var id = hzAnonCookie(HZ_ANON_KEY) || hzAnonItem(s, HZ_ANON_KEY) || hzAnonItem(s, HZ_ANON_LEGACY_KEY) || hzAnonMemo || hzUuidv7();
+  hzAnonMemo = id;
+  hzAnonWrite(HZ_ANON_KEY, id);
+  try {
+    if (s && s.getItem(HZ_ANON_KEY) !== id) s.setItem(HZ_ANON_KEY, id);
+  } catch (e) {
+  }
+  return id;
 }
 
 // src/version.ts
-var VERSION = "0.3.13";
+var VERSION = "0.3.15";
 
 // src/sentry.ts
 var MAX_FRAMES = 50;
@@ -239,7 +318,7 @@ var MAX_LINE_LEN = 2048;
 var MAX_TAG_LEN = 1024;
 var MAX_TAGS = 50;
 function eventId() {
-  return uuidv7().replace(/-/g, "");
+  return hzUuidv7().replace(/-/g, "");
 }
 function byteLen(s) {
   if (typeof TextEncoder !== "undefined") return new TextEncoder().encode(s).length;
@@ -425,7 +504,6 @@ ${payload}
 
 // src/storage.ts
 var KEY = {
-  anon: "hz_anon_id",
   session: "hz_session",
   firstTouch: "hz_first_touch",
   cohort: "hz_cohort"
@@ -440,14 +518,7 @@ function ls() {
   }
 }
 function anonId() {
-  const s = ls();
-  if (!s) return void 0;
-  let v = s.getItem(KEY.anon);
-  if (!v) {
-    v = uuidv7();
-    s.setItem(KEY.anon, v);
-  }
-  return v;
+  return hzAnonId() || void 0;
 }
 function sessionId(now = Date.now()) {
   const s = ls();
@@ -459,7 +530,7 @@ function sessionId(now = Date.now()) {
     state = null;
   }
   if (!state || now - state.last > SESSION_TTL_MS) {
-    state = { id: uuidv7(now), last: now };
+    state = { id: hzUuidv7(now), last: now };
   } else {
     state.last = now;
   }
@@ -795,7 +866,7 @@ var Analytics = class {
   build(kind, event, extra) {
     const anon = anonId();
     const wire = {
-      messageId: uuidv7(),
+      messageId: hzUuidv7(),
       type: kind,
       event,
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -908,6 +979,27 @@ var ErrorBoundary = class extends react.Component {
   }
 };
 ErrorBoundary.contextType = Ctx;
+/*! anon.js — THE anonymous-identity chain. ONE implementation, three distributions.
+ *
+ * One browser is ONE person on every Hanzo surface, whichever client a page
+ * happens to have loaded. There were three implementations writing TWO keys —
+ * `hz_anon_id` (the npm client, the hosted tag) and `hz_id` (hz.js) — so the same
+ * visitor was several people depending on which snippet the surface shipped.
+ *
+ * The three call sites:
+ *   1. src/storage.ts        — the bundled npm client; IMPORTS this file.
+ *   2. hz.js                 — the no-build script tag; INLINES the marked region.
+ *   3. hanzoai/cloud apps/analytics/tag.js — the tag the door hosts at
+ *      /v1/event.js; vendors this file and its tag.go serves the marked region
+ *      with the tag as one asset, so the door holds no second copy either.
+ *
+ * (2) and (3) have no bundler and cannot import anything, which is why the chain
+ * lives in a file that is plain ES5 rather than in a .ts: the region between the
+ * BEGIN and END markers is COPIED VERBATIM, and src/anon.test.ts fails if hz.js's
+ * copy is so much as a byte different. Keep the region ES5, dependency-free,
+ * `hz`-prefixed (it is spliced into other people's scopes) and unformatted — a
+ * reformat of one copy is a diff against the other.
+ */
 
 exports.AnalyticsProvider = AnalyticsProvider;
 exports.ErrorBoundary = ErrorBoundary;