@hanzo/event 0.3.15 → 0.3.17

package/src/core.test.ts

@@ -360,26 +360,26 @@ describe('Analytics capture', () => {
     // The failure this closes is silent: a surface with no key attributes nothing
     // for a logged-out visitor, the door refuses the write, and the page shows no
     // sign of it. The key must resolve from the env exactly as the DSN does.
-    process.env.NEXT_PUBLIC_EVENT_INGEST_KEY = 'pk-live-from-env'
+    process.env.NEXT_PUBLIC_PUBLISHABLE_KEY = 'pk-live-from-env'
     try {
       const a = mk() // no key in config
       a.capture('x')
       a.flush(true)
       expect(tx.sent[0].ingestKey).toBe('pk-live-from-env')
     } finally {
-      delete process.env.NEXT_PUBLIC_EVENT_INGEST_KEY
+      delete process.env.NEXT_PUBLIC_PUBLISHABLE_KEY
     }
   })
 
   it('prefers an explicit ingest key over the build env', () => {
-    process.env.NEXT_PUBLIC_EVENT_INGEST_KEY = 'pk-live-from-env'
+    process.env.NEXT_PUBLIC_PUBLISHABLE_KEY = 'pk-live-from-env'
     try {
       const a = mk({ ingestKey: 'pk-live-explicit' })
       a.capture('x')
       a.flush(true)
       expect(tx.sent[0].ingestKey).toBe('pk-live-explicit')
     } finally {
-      delete process.env.NEXT_PUBLIC_EVENT_INGEST_KEY
+      delete process.env.NEXT_PUBLIC_PUBLISHABLE_KEY
     }
   })
 
@@ -394,7 +394,7 @@ describe('Analytics capture', () => {
     // The leak this closes: one console bundle is served to several brands, and a
     // pk- names ONE org. If an env-sourced key displaced the bearer, every
     // signed-in user's events would re-file under whichever org minted the key.
-    process.env.NEXT_PUBLIC_EVENT_INGEST_KEY = 'pk-live-one-org'
+    process.env.NEXT_PUBLIC_PUBLISHABLE_KEY = 'pk-live-one-org'
     try {
       const a = mk({ getToken: () => 'jwt-of-a-real-person' })
       a.capture('x')
@@ -402,12 +402,12 @@ describe('Analytics capture', () => {
       expect(tx.sent[0].token).toBe('jwt-of-a-real-person')
       expect(tx.sent[0].ingestKey).toBeUndefined()
     } finally {
-      delete process.env.NEXT_PUBLIC_EVENT_INGEST_KEY
+      delete process.env.NEXT_PUBLIC_PUBLISHABLE_KEY
     }
   })
 
   it('an anonymous visitor still rides the key', () => {
-    process.env.NEXT_PUBLIC_EVENT_INGEST_KEY = 'pk-live-one-org'
+    process.env.NEXT_PUBLIC_PUBLISHABLE_KEY = 'pk-live-one-org'
     try {
       const a = mk({ getToken: () => undefined })   // logged out
       a.capture('x')
@@ -415,7 +415,7 @@ describe('Analytics capture', () => {
       expect(tx.sent[0].ingestKey).toBe('pk-live-one-org')
       expect(tx.sent[0].token).toBeUndefined()
     } finally {
-      delete process.env.NEXT_PUBLIC_EVENT_INGEST_KEY
+      delete process.env.NEXT_PUBLIC_PUBLISHABLE_KEY
     }
   })
 

package/src/core.ts

@@ -123,7 +123,14 @@ function normalizeError(err: unknown): Exception {
   return { type: n.name, message: n.message, stack: n.stack }
 }
 
-const isBrowser = () => typeof window !== 'undefined'
+// React Native defines a `window` but no `document` (and no `window.location`),
+// so `typeof window !== 'undefined'` alone took the browser path there and
+// `init()` threw on `window.location.search`. Requiring `document` makes RN read
+// as non-browser: `init()` returns early (skips attribution + the visibility/
+// unload listeners RN doesn't have), while `capture()`/`flush()` — which are NOT
+// gated on this and post through plain `fetch` — still emit. So the client is
+// inert-safe under SSR/Node and live on RN, without a second transport.
+const isBrowser = () => typeof window !== 'undefined' && typeof document !== 'undefined'
 
 /** serializeBatch stringifies a batch, salvaging what it can. `properties` is
  *  arbitrary caller data — a DOM node, a React synthetic event, an axios error are
@@ -234,9 +241,9 @@ export class Analytics {
       // The publishable key resolves the SAME way the DSN below does: an explicit
       // config wins, else the inlined build-time env.
       //
-      // NEXT_PUBLIC_EVENT_INGEST_KEY is that env, and it is the name the fleet
-      // ALREADY carries end to end — KMS holds deploy/EVENT_INGEST_KEY, each
-      // Dockerfile takes it as the EVENT_INGEST_KEY build-arg and re-exports it
+      // NEXT_PUBLIC_PUBLISHABLE_KEY is that env, and it is the name the fleet
+      // ALREADY carries end to end — KMS holds deploy/PUBLISHABLE_KEY, each
+      // Dockerfile takes it as the PUBLISHABLE_KEY build-arg and re-exports it
       // with the NEXT_PUBLIC_ prefix Next needs to inline it. Reading anything
       // else here would add a fourth spelling of one value.
       //
@@ -246,7 +253,7 @@ export class Analytics {
       // unattributed write is refused (401 ingest_key_required), which is silent
       // in the page and invisible until you read the warehouse and find the host
       // missing entirely.
-      ingestKey: config.ingestKey ?? readEnv('NEXT_PUBLIC_EVENT_INGEST_KEY'),
+      ingestKey: config.ingestKey ?? readEnv('NEXT_PUBLIC_PUBLISHABLE_KEY'),
     }
     this.transport = config.transport ?? new DefaultTransport()
     // Error plane, most specific source first: an explicit DSN wins, then the

package/src/hz.test.ts

@@ -230,8 +230,8 @@ describe('hz.js', () => {
   // keyed static surface therefore sent UNATTRIBUTED writes, which the door
   // refuses — silently, because nothing here reads the response.
 
-  it('presents the ingest key as a bearer on fetch', () => {
-    const r = runSnippet({ attrs: { 'data-ingest-key': 'pk-abc123' } })
+  it('presents the publishable key as a bearer on fetch', () => {
+    const r = runSnippet({ attrs: { 'data-publishable-key': 'pk-abc123' } })
     r.api!.flush()
     const post = r.posts.at(-1)!
     expect(post.via).toBe('fetch')
@@ -239,7 +239,7 @@ describe('hz.js', () => {
     expect(post.url).toBe('https://api.hanzo.ai/v1/event')
   })
 
-  it('presents the ingest key in the query on a headerless beacon', () => {
+  it('still reads the retiring data-ingest-key, on a headerless beacon', () => {
     const r = runSnippet({ attrs: { 'data-ingest-key': 'pk-abc123' }, beacon: true })
     r.api!.flush()
     const post = r.posts.at(-1)!

package/src/types.ts

@@ -120,11 +120,11 @@ export interface AnalyticsConfig {
    *  a reading principal — so it is safe to ship in a bundle. Mint one per org with
    *  POST /v1/keys {"type":"publishable"}.
    *
-   *  Omit it and the client reads NEXT_PUBLIC_EVENT_INGEST_KEY from the inlined
+   *  Omit it and the client reads NEXT_PUBLIC_PUBLISHABLE_KEY from the inlined
    *  build env, the same way `dsn` falls back — so a surface declares BOTH planes
    *  in its build and neither needs code to switch on. That is the ONE spelling
-   *  the fleet already carries: KMS holds deploy/EVENT_INGEST_KEY, and each
-   *  Dockerfile takes EVENT_INGEST_KEY as a build-arg and re-exports it with the
+   *  the fleet already carries: KMS holds deploy/PUBLISHABLE_KEY, and each
+   *  Dockerfile takes PUBLISHABLE_KEY as a build-arg and re-exports it with the
    *  NEXT_PUBLIC_ prefix that makes Next inline it.
    *
    *  A surface with no key at all still reports for whoever is SIGNED IN (the

package/src/version.ts

@@ -1,4 +1,4 @@
 // The library version, stamped on every event (`libraryVersion`) and on the
 // Sentry `sdk` block. It lives alone so `sentry.ts` can read it without importing
 // `core.ts` — core imports sentry, so the reverse would be an import cycle.
-export const VERSION = '0.3.15'
+export const VERSION = '0.3.17'