@hanzo/event 0.3.14 → 0.3.15

package/hz.js

@@ -55,7 +55,7 @@
   }
 
   var LIB = 'hz.js'
-  var VERSION = '0.3.14'
+  var VERSION = '0.3.15'
   var host = (s.getAttribute('data-host') || 'https://api.hanzo.ai').replace(/\/+$/, '')
   var product = s.getAttribute('data-product') || location.hostname
   var capture = s.getAttribute('data-capture') !== '0'
@@ -69,42 +69,203 @@
   // fine in the browser, and filed nothing.
   var key = s.getAttribute('data-ingest-key') || ''
 
-  // uuidv7 (RFC 9562 §5.7) — the same minter as src/uid.ts, restated here for the
-  // same reason `clean` restates scrub.ts: this file has no bundler and cannot
-  // import it. It has to be v7. The session rollups on the plane derive a session's
-  // start instant from the 48-bit millisecond timestamp the id carries and admit
-  // only ids whose version nibble is 7, so a crypto.randomUUID() (v4) session id —
-  // and equally the old base36 fallback, which does not even parse as a UUID — is
-  // dropped there silently and the session never appears.
-  function uid(now) {
-    var b = new Uint8Array(16),
-      i
-    if (typeof crypto !== 'undefined' && crypto.getRandomValues) crypto.getRandomValues(b)
-    else for (i = 0; i < 16; i++) b[i] = (Math.random() * 256) | 0
-    var t = Math.floor(now || Date.now())
-    for (i = 5; i >= 0; i--) {
-      b[i] = t % 256
-      t = Math.floor(t / 256)
+  // ── the shared anonymous-identity chain ───────────────────────────────────
+  // COPIED VERBATIM from @hanzo/event's src/anon.js, markers and all, for the same
+  // reason `clean` restates scrub.ts: this file has no bundler and cannot import
+  // anything. It is the ONE chain and the ONE key, so a page carrying this tag and
+  // the npm client resolves to one person; src/anon.test.ts fails on a byte of
+  // drift between the two copies. EDIT src/anon.js, never this copy, and do not
+  // reformat it — the indentation is part of the byte comparison.
+
+/* ── BEGIN hz anon chain — copied VERBATIM into hz.js and hanzoai/cloud ────── */
+
+/** The ONE anonymous-id key, on every surface and in every distribution. */
+var HZ_ANON_KEY = 'hz_anon_id'
+
+/** hz.js used to write `hz_id` — a SECOND identity space, so the one-paste tag
+ *  and the npm client were two different people on one page. It is READ and never
+ *  written: an id already in the wild is ADOPTED into the shared identity, because
+ *  minting over one detaches a returning visitor from their own history. */
+var HZ_ANON_LEGACY_KEY = 'hz_id'
+
+/** The registrable domain the cookie is scoped to, so docs, cloud, console,
+ *  studio, pay, id and www all read the ONE id. localStorage cannot do this: it is
+ *  ORIGIN-scoped, which is what made one journey arrive as several strangers. */
+var HZ_ANON_DOMAIN = 'hanzo.ai'
+
+/** Two years, rewritten on every read, so the cookie rolls forward with the
+ *  visitor instead of expiring two years after first touch. Safari caps a
+ *  SCRIPT-written cookie at 7 days no matter what this says, so the rewrite is
+ *  what keeps a returning Safari visitor: each read re-arms the 7-day window. */
+var HZ_ANON_MAX_AGE = 2 * 365 * 24 * 60 * 60
+
+/** Last resort for a browser that refuses cookies AND localStorage: without it
+ *  every event in a page load would mint an id of its own. */
+var hzAnonMemo
+
+/**
+ * hzUuidv7 mints a time-ordered UUIDv7 (RFC 9562 §5.7) for `now` in epoch ms.
+ *
+ * It has to be v7, and this is the only minter any distribution may use. The
+ * session rollups on the event plane derive a session's start instant FROM THE ID
+ * and admit only ids whose version nibble is 7, so a crypto.randomUUID() (v4) id
+ * is not merely unordered there — it is DISCARDED, silently, and the rollup stays
+ * empty. Without crypto only the ENTROPY degrades; the shape is always a valid v7.
+ */
+function hzUuidv7(now) {
+  var b = new Uint8Array(16)
+  var i
+  var c = typeof crypto !== 'undefined' ? crypto : undefined
+  if (c && typeof c.getRandomValues === 'function') c.getRandomValues(b)
+  else for (i = 0; i < 16; i++) b[i] = (Math.random() * 256) | 0
+  var t = Math.floor(now === undefined ? Date.now() : now)
+  for (i = 5; i >= 0; i--) {
+    b[i] = t % 256
+    t = Math.floor(t / 256)
+  }
+  b[6] = 0x70 | (b[6] & 0x0f) // version 7
+  b[8] = 0x80 | (b[8] & 0x3f) // variant 0b10
+  var h = ''
+  for (i = 0; i < 16; i++) {
+    h += (b[i] + 0x100).toString(16).slice(1)
+    if (i === 3 || i === 5 || i === 7 || i === 9) h += '-'
+  }
+  return h
+}
+
+/** The cookie jar, or null wherever there is no document to read one from. */
+function hzAnonJar() {
+  try {
+    if (typeof document === 'undefined' || typeof document.cookie !== 'string') return null
+    return document
+  } catch (e) {
+    return null // sandboxed frame with an opaque origin
+  }
+}
+
+/** localStorage, or null when the browser refuses it (Safari private mode). */
+function hzAnonStore() {
+  try {
+    if (typeof window === 'undefined' || !window.localStorage) return null
+    return window.localStorage
+  } catch (e) {
+    return null
+  }
+}
+
+/** One stored value, or '' — a jar can read as well as refuse to. */
+function hzAnonItem(store, name) {
+  try {
+    return (store && store.getItem(name)) || ''
+  } catch (e) {
+    return ''
+  }
+}
+
+/** The value of cookie `name`, or ''. */
+function hzAnonCookie(name) {
+  var d = hzAnonJar()
+  if (!d) return ''
+  var parts = d.cookie.split(';')
+  for (var i = 0; i < parts.length; i++) {
+    var eq = parts[i].indexOf('=')
+    if (eq < 0 || parts[i].slice(0, eq).trim() !== name) continue
+    var v = parts[i].slice(eq + 1).trim()
+    if (!v) continue
+    try {
+      return decodeURIComponent(v)
+    } catch (e) {
+      return v // not percent-encoded — take it as written
     }
-    b[6] = 0x70 | (b[6] & 0x0f) // version 7
-    b[8] = 0x80 | (b[8] & 0x3f) // variant 0b10
-    var h = ''
-    for (i = 0; i < 16; i++) {
-      h += (b[i] + 0x100).toString(16).slice(1)
-      if (i === 3 || i === 5 || i === 7 || i === 9) h += '-'
+  }
+  return ''
+}
+
+/** Writes `name` on the registrable domain, for as long as the browser allows. */
+function hzAnonWrite(name, value) {
+  var d = hzAnonJar()
+  if (!d) return
+  var host = ''
+  var secure = false
+  try {
+    if (typeof window !== 'undefined' && window.location) {
+      host = window.location.hostname || ''
+      // A Secure cookie is refused outright by a non-secure origin, which would
+      // strand http://localhost dev on the localStorage path.
+      secure = window.location.protocol === 'https:'
     }
-    return h
+  } catch (e) {
+    /* location unreachable — write a host-only, non-secure cookie */
+  }
+  // encodeURIComponent leaves a UUID byte-identical while making any value that is
+  // not one unable to forge a `;` and inject an attribute.
+  var c = name + '=' + encodeURIComponent(value)
+  c += '; Path=/; Max-Age=' + HZ_ANON_MAX_AGE + '; SameSite=Lax'
+  // Off hanzo.ai (localhost, previews, other registrable domains) the attribute
+  // would be rejected and the whole cookie dropped, so it stays host-only there.
+  // Prefixing both sides with '.' matches the domain itself and its subdomains
+  // while refusing a suffix that merely ends in the same letters (evilhanzo.ai).
+  if (('.' + host).slice(-(HZ_ANON_DOMAIN.length + 1)) === '.' + HZ_ANON_DOMAIN) {
+    c += '; Domain=' + HZ_ANON_DOMAIN
   }
+  if (secure) c += '; Secure'
+  try {
+    d.cookie = c
+  } catch (e) {
+    /* cookies refused — localStorage still carries the id */
+  }
+}
+
+/**
+ * hzAnonId returns the stable anonymous id for this browser, '' during SSR.
+ *
+ * Resolution is strictly ADDITIVE — every id that already exists is ADOPTED, and
+ * only a browser holding none of them is given a new one:
+ *
+ *   cookie · localStorage hz_anon_id · localStorage hz_id · in-memory · mint
+ *
+ * Minting over an id resets a returning visitor and detaches them from their own
+ * history, so the order is the migration: the cookie is the shared home, the two
+ * localStorage keys are what the three implementations wrote before it existed,
+ * and each is read until nothing is left to adopt.
+ *
+ * localStorage keeps being written, so a rollback finds everyone where it left
+ * them, and a browser that refuses cookies still holds one id per origin.
+ */
+function hzAnonId() {
+  if (typeof window === 'undefined') return '' // SSR / prerender: no browser to identify
+  var s = hzAnonStore()
+  var id =
+    hzAnonCookie(HZ_ANON_KEY) ||
+    hzAnonItem(s, HZ_ANON_KEY) ||
+    hzAnonItem(s, HZ_ANON_LEGACY_KEY) ||
+    hzAnonMemo ||
+    hzUuidv7()
+  hzAnonMemo = id
+  hzAnonWrite(HZ_ANON_KEY, id)
+  try {
+    if (s && s.getItem(HZ_ANON_KEY) !== id) s.setItem(HZ_ANON_KEY, id)
+  } catch (e) {
+    /* quota exhausted, or a private-mode jar that reads but refuses writes */
+  }
+  return id
+}
+
+/* ── END hz anon chain ─────────────────────────────────────────────────────── */
+
   function stored(store, key) {
     try {
       var v = store.getItem(key)
-      if (!v) store.setItem(key, (v = uid()))
+      if (!v) store.setItem(key, (v = hzUuidv7()))
       return v
     } catch (e) {
       return 'anon'
     }
   }
-  var anon = stored(localStorage, 'hz_id')
+  // This used to mint into a localStorage key of its own, so the tag and
+  // @hanzo/event counted one visitor as two people. The chain adopts that old id
+  // where it exists rather than orphaning it.
+  var anon = hzAnonId()
   var sid = stored(sessionStorage, 'hz_sid')
   var person = null
   try {
@@ -177,7 +338,7 @@
   // server cannot tell which distribution emitted it.
   function send(kind, event, props) {
     queue.push({
-      messageId: uid(),
+      messageId: hzUuidv7(),
       type: kind,
       event: event,
       timestamp: new Date().toISOString(),

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hanzo/event",
-  "version": "0.3.14",
-  "description": "Hanzo Event \u2014 the ONE telemetry client. Emits pageview/event/identify/group to the Hanzo Cloud event stream (POST /v1/event), AND reports errors to Sentry as real Sentry envelopes \u2014 the error plane needs a DSN, without one nothing reaches Sentry. First-touch attribution, beacon-on-unload, auto error capture, client-side secret/PII scrubbing, a shared event + goal vocabulary. Subsumes @sentry.",
+  "version": "0.3.15",
+  "description": "Hanzo Event — the ONE telemetry client. Emits pageview/event/identify/group to the Hanzo Cloud event stream (POST /v1/event), AND reports errors to Sentry as real Sentry envelopes — the error plane needs a DSN, without one nothing reaches Sentry. First-touch attribution, beacon-on-unload, auto error capture, client-side secret/PII scrubbing, a shared event + goal vocabulary. Subsumes @sentry.",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public",
@@ -37,13 +37,6 @@
     "funnel",
     "hanzo"
   ],
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit",
-    "clean": "rm -rf dist"
-  },
   "exports": {
     ".": {
       "import": {
@@ -81,5 +74,12 @@
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
     "vitest": "^4.1.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist"
   }
-}
+}

package/src/anon.d.ts

@@ -0,0 +1,14 @@
+// Types for anon.js, which is hand-written ES5 rather than TypeScript because
+// hz.js and the door's hosted tag inline it VERBATIM and neither has a compiler.
+// The declarations are here so the bundled client still imports it typed.
+
+/** Mints a time-ordered UUIDv7 (RFC 9562 §5.7) for `now` in epoch milliseconds. */
+export declare function hzUuidv7(now?: number): string
+
+/**
+ * The stable anonymous id for this browser, or '' during SSR.
+ *
+ * cookie · localStorage `hz_anon_id` · localStorage `hz_id` · in-memory · mint —
+ * every existing id is adopted, and only a browser holding none is given a new one.
+ */
+export declare function hzAnonId(): string

package/src/anon.js

@@ -0,0 +1,199 @@
+/*! anon.js — THE anonymous-identity chain. ONE implementation, three distributions.
+ *
+ * One browser is ONE person on every Hanzo surface, whichever client a page
+ * happens to have loaded. There were three implementations writing TWO keys —
+ * `hz_anon_id` (the npm client, the hosted tag) and `hz_id` (hz.js) — so the same
+ * visitor was several people depending on which snippet the surface shipped.
+ *
+ * The three call sites:
+ *   1. src/storage.ts        — the bundled npm client; IMPORTS this file.
+ *   2. hz.js                 — the no-build script tag; INLINES the marked region.
+ *   3. hanzoai/cloud apps/analytics/tag.js — the tag the door hosts at
+ *      /v1/event.js; vendors this file and its tag.go serves the marked region
+ *      with the tag as one asset, so the door holds no second copy either.
+ *
+ * (2) and (3) have no bundler and cannot import anything, which is why the chain
+ * lives in a file that is plain ES5 rather than in a .ts: the region between the
+ * BEGIN and END markers is COPIED VERBATIM, and src/anon.test.ts fails if hz.js's
+ * copy is so much as a byte different. Keep the region ES5, dependency-free,
+ * `hz`-prefixed (it is spliced into other people's scopes) and unformatted — a
+ * reformat of one copy is a diff against the other.
+ */
+
+/* ── BEGIN hz anon chain — copied VERBATIM into hz.js and hanzoai/cloud ────── */
+
+/** The ONE anonymous-id key, on every surface and in every distribution. */
+var HZ_ANON_KEY = 'hz_anon_id'
+
+/** hz.js used to write `hz_id` — a SECOND identity space, so the one-paste tag
+ *  and the npm client were two different people on one page. It is READ and never
+ *  written: an id already in the wild is ADOPTED into the shared identity, because
+ *  minting over one detaches a returning visitor from their own history. */
+var HZ_ANON_LEGACY_KEY = 'hz_id'
+
+/** The registrable domain the cookie is scoped to, so docs, cloud, console,
+ *  studio, pay, id and www all read the ONE id. localStorage cannot do this: it is
+ *  ORIGIN-scoped, which is what made one journey arrive as several strangers. */
+var HZ_ANON_DOMAIN = 'hanzo.ai'
+
+/** Two years, rewritten on every read, so the cookie rolls forward with the
+ *  visitor instead of expiring two years after first touch. Safari caps a
+ *  SCRIPT-written cookie at 7 days no matter what this says, so the rewrite is
+ *  what keeps a returning Safari visitor: each read re-arms the 7-day window. */
+var HZ_ANON_MAX_AGE = 2 * 365 * 24 * 60 * 60
+
+/** Last resort for a browser that refuses cookies AND localStorage: without it
+ *  every event in a page load would mint an id of its own. */
+var hzAnonMemo
+
+/**
+ * hzUuidv7 mints a time-ordered UUIDv7 (RFC 9562 §5.7) for `now` in epoch ms.
+ *
+ * It has to be v7, and this is the only minter any distribution may use. The
+ * session rollups on the event plane derive a session's start instant FROM THE ID
+ * and admit only ids whose version nibble is 7, so a crypto.randomUUID() (v4) id
+ * is not merely unordered there — it is DISCARDED, silently, and the rollup stays
+ * empty. Without crypto only the ENTROPY degrades; the shape is always a valid v7.
+ */
+function hzUuidv7(now) {
+  var b = new Uint8Array(16)
+  var i
+  var c = typeof crypto !== 'undefined' ? crypto : undefined
+  if (c && typeof c.getRandomValues === 'function') c.getRandomValues(b)
+  else for (i = 0; i < 16; i++) b[i] = (Math.random() * 256) | 0
+  var t = Math.floor(now === undefined ? Date.now() : now)
+  for (i = 5; i >= 0; i--) {
+    b[i] = t % 256
+    t = Math.floor(t / 256)
+  }
+  b[6] = 0x70 | (b[6] & 0x0f) // version 7
+  b[8] = 0x80 | (b[8] & 0x3f) // variant 0b10
+  var h = ''
+  for (i = 0; i < 16; i++) {
+    h += (b[i] + 0x100).toString(16).slice(1)
+    if (i === 3 || i === 5 || i === 7 || i === 9) h += '-'
+  }
+  return h
+}
+
+/** The cookie jar, or null wherever there is no document to read one from. */
+function hzAnonJar() {
+  try {
+    if (typeof document === 'undefined' || typeof document.cookie !== 'string') return null
+    return document
+  } catch (e) {
+    return null // sandboxed frame with an opaque origin
+  }
+}
+
+/** localStorage, or null when the browser refuses it (Safari private mode). */
+function hzAnonStore() {
+  try {
+    if (typeof window === 'undefined' || !window.localStorage) return null
+    return window.localStorage
+  } catch (e) {
+    return null
+  }
+}
+
+/** One stored value, or '' — a jar can read as well as refuse to. */
+function hzAnonItem(store, name) {
+  try {
+    return (store && store.getItem(name)) || ''
+  } catch (e) {
+    return ''
+  }
+}
+
+/** The value of cookie `name`, or ''. */
+function hzAnonCookie(name) {
+  var d = hzAnonJar()
+  if (!d) return ''
+  var parts = d.cookie.split(';')
+  for (var i = 0; i < parts.length; i++) {
+    var eq = parts[i].indexOf('=')
+    if (eq < 0 || parts[i].slice(0, eq).trim() !== name) continue
+    var v = parts[i].slice(eq + 1).trim()
+    if (!v) continue
+    try {
+      return decodeURIComponent(v)
+    } catch (e) {
+      return v // not percent-encoded — take it as written
+    }
+  }
+  return ''
+}
+
+/** Writes `name` on the registrable domain, for as long as the browser allows. */
+function hzAnonWrite(name, value) {
+  var d = hzAnonJar()
+  if (!d) return
+  var host = ''
+  var secure = false
+  try {
+    if (typeof window !== 'undefined' && window.location) {
+      host = window.location.hostname || ''
+      // A Secure cookie is refused outright by a non-secure origin, which would
+      // strand http://localhost dev on the localStorage path.
+      secure = window.location.protocol === 'https:'
+    }
+  } catch (e) {
+    /* location unreachable — write a host-only, non-secure cookie */
+  }
+  // encodeURIComponent leaves a UUID byte-identical while making any value that is
+  // not one unable to forge a `;` and inject an attribute.
+  var c = name + '=' + encodeURIComponent(value)
+  c += '; Path=/; Max-Age=' + HZ_ANON_MAX_AGE + '; SameSite=Lax'
+  // Off hanzo.ai (localhost, previews, other registrable domains) the attribute
+  // would be rejected and the whole cookie dropped, so it stays host-only there.
+  // Prefixing both sides with '.' matches the domain itself and its subdomains
+  // while refusing a suffix that merely ends in the same letters (evilhanzo.ai).
+  if (('.' + host).slice(-(HZ_ANON_DOMAIN.length + 1)) === '.' + HZ_ANON_DOMAIN) {
+    c += '; Domain=' + HZ_ANON_DOMAIN
+  }
+  if (secure) c += '; Secure'
+  try {
+    d.cookie = c
+  } catch (e) {
+    /* cookies refused — localStorage still carries the id */
+  }
+}
+
+/**
+ * hzAnonId returns the stable anonymous id for this browser, '' during SSR.
+ *
+ * Resolution is strictly ADDITIVE — every id that already exists is ADOPTED, and
+ * only a browser holding none of them is given a new one:
+ *
+ *   cookie · localStorage hz_anon_id · localStorage hz_id · in-memory · mint
+ *
+ * Minting over an id resets a returning visitor and detaches them from their own
+ * history, so the order is the migration: the cookie is the shared home, the two
+ * localStorage keys are what the three implementations wrote before it existed,
+ * and each is read until nothing is left to adopt.
+ *
+ * localStorage keeps being written, so a rollback finds everyone where it left
+ * them, and a browser that refuses cookies still holds one id per origin.
+ */
+function hzAnonId() {
+  if (typeof window === 'undefined') return '' // SSR / prerender: no browser to identify
+  var s = hzAnonStore()
+  var id =
+    hzAnonCookie(HZ_ANON_KEY) ||
+    hzAnonItem(s, HZ_ANON_KEY) ||
+    hzAnonItem(s, HZ_ANON_LEGACY_KEY) ||
+    hzAnonMemo ||
+    hzUuidv7()
+  hzAnonMemo = id
+  hzAnonWrite(HZ_ANON_KEY, id)
+  try {
+    if (s && s.getItem(HZ_ANON_KEY) !== id) s.setItem(HZ_ANON_KEY, id)
+  } catch (e) {
+    /* quota exhausted, or a private-mode jar that reads but refuses writes */
+  }
+  return id
+}
+
+/* ── END hz anon chain ─────────────────────────────────────────────────────── */
+
+export { hzAnonId, hzUuidv7 }

package/src/anon.test.ts

@@ -0,0 +1,80 @@
+// The anonymous-identity chain is ONE implementation with three call sites, and
+// two of them cannot import it: hz.js and the tag hanzoai/cloud hosts at
+// /v1/event.js have no bundler, so they carry the marked region of anon.js
+// VERBATIM. That is the drift risk this file exists to remove — three snippets
+// that agree the day they are written and disagree a quarter later, which is
+// exactly how the same browser came to hold two different anonymous ids under two
+// different key names.
+//
+// The behavioural contract is proven where each distribution runs it:
+// storage.test.ts (the npm client) and hz.test.ts (the script tag). This file
+// proves the copies are the SAME TEXT, which is the only thing that keeps those
+// two suites testing one implementation instead of two.
+
+import { describe, expect, it } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+
+const read = (rel: string) => readFileSync(fileURLToPath(new URL(rel, import.meta.url)), 'utf8')
+
+const BEGIN = '/* ── BEGIN hz anon chain'
+const END = '/* ── END hz anon chain'
+
+/** Where the shared region starts and ends in a file that carries it. */
+function span(src: string, what: string): [number, number] {
+  const b = src.indexOf(BEGIN)
+  const e = src.indexOf(END)
+  expect(b, `${what} has no BEGIN marker`).toBeGreaterThanOrEqual(0)
+  expect(e, `${what} has no END marker`).toBeGreaterThan(b)
+  return [b, src.indexOf('\n', e) + 1]
+}
+
+/** The shared region, markers included. */
+const region = (src: string, what: string): string => src.slice(...span(src, what))
+
+/** Everything that is NOT the shared region. */
+function outside(src: string, what: string): string {
+  const [b, e] = span(src, what)
+  return src.slice(0, b) + src.slice(e)
+}
+
+const ANON = read('./anon.js')
+const HZ = read('../hz.js')
+
+describe('the shared anon chain', () => {
+  it('is in hz.js as the same text, byte for byte', () => {
+    // Not "equivalent" — IDENTICAL. Anything weaker (normalising whitespace,
+    // comparing behaviour) permits the copies to say different things about which
+    // key they read, which is the bug. To change the chain, edit src/anon.js and
+    // re-splice; never patch a copy.
+    expect(region(HZ, 'hz.js')).toBe(region(ANON, 'anon.js'))
+  })
+
+  it('names one key, and hz.js holds no identity code of its own', () => {
+    // hz.js used to mint into hz_id — a second identity space, so the one-paste
+    // tag and the npm client were two people on one page. Neither key may be
+    // NAMED outside the shared region: a snippet that spells a key is a snippet
+    // that has an opinion about identity, and there is one opinion now.
+    const rest = outside(HZ, 'hz.js')
+    expect(rest).not.toContain("'hz_anon_id'")
+    expect(rest).not.toContain("'hz_id'")
+  })
+
+  it('is inlineable: the region imports nothing and declares no ES6', () => {
+    // It is spliced into two files that have no bundler and into pages the client
+    // does not control, so it must be ES5, self-contained and hz-prefixed.
+    const r = region(ANON, 'anon.js')
+    expect(r).not.toMatch(/\b(?:import|export|const|let|class|=>)\b|=>/)
+    for (const [, name] of r.matchAll(/^(?:function|var) ([A-Za-z_$][\w$]*)/gm)) {
+      expect(name, `${name} would collide in a host page's scope`).toMatch(/^(?:hz|HZ_)/)
+    }
+  })
+
+  it('ships in the published package, for the door to vendor', () => {
+    // hanzoai/cloud vendors this file whole and its tag.go serves the region with
+    // the tag as one asset, so the third call site holds no second copy either.
+    const pkg = JSON.parse(read('../package.json')) as { files: string[] }
+    expect(pkg.files).toContain('src')
+    expect(pkg.files).toContain('hz.js')
+  })
+})