@hanzo/event 0.3.16 → 0.3.18

package/TAXONOMY.md

@@ -239,7 +239,7 @@ Verified against the trees at the time of writing. ✅ = emitting, ❌ = not emi
    no org today; chat funnels are person-scoped only.
 5. **Logged-out reach depends on a publishable key.** Anonymous events need
    `ingestKey` (`pk_…`, write-only) or they fail closed at the door.
-   `NEXT_PUBLIC_HANZO_INGEST_KEY` (hanzo.ai), `NEXT_PUBLIC_EVENT_INGEST_KEY`
+   `NEXT_PUBLIC_HANZO_INGEST_KEY` (hanzo.ai), `NEXT_PUBLIC_PUBLISHABLE_KEY`
    (hanzo.app), `VITE_HANZO_INGEST_KEY` (hanzo.chat) are read but must be
    provisioned per org via `POST /v1/ingest/keys`. Config, not code.
 

package/dist/{core-BZraSvcr.d.cts → core-D4PaPlOB.d.cts}

@@ -108,11 +108,11 @@ interface AnalyticsConfig {
      *  a reading principal — so it is safe to ship in a bundle. Mint one per org with
      *  POST /v1/keys {"type":"publishable"}.
      *
-     *  Omit it and the client reads NEXT_PUBLIC_EVENT_INGEST_KEY from the inlined
+     *  Omit it and the client reads NEXT_PUBLIC_PUBLISHABLE_KEY from the inlined
      *  build env, the same way `dsn` falls back — so a surface declares BOTH planes
      *  in its build and neither needs code to switch on. That is the ONE spelling
-     *  the fleet already carries: KMS holds deploy/EVENT_INGEST_KEY, and each
-     *  Dockerfile takes EVENT_INGEST_KEY as a build-arg and re-exports it with the
+     *  the fleet already carries: KMS holds deploy/PUBLISHABLE_KEY, and each
+     *  Dockerfile takes PUBLISHABLE_KEY as a build-arg and re-exports it with the
      *  NEXT_PUBLIC_ prefix that makes Next inline it.
      *
      *  A surface with no key at all still reports for whoever is SIGNED IN (the

package/dist/{core-BZraSvcr.d.ts → core-D4PaPlOB.d.ts}

@@ -108,11 +108,11 @@ interface AnalyticsConfig {
      *  a reading principal — so it is safe to ship in a bundle. Mint one per org with
      *  POST /v1/keys {"type":"publishable"}.
      *
-     *  Omit it and the client reads NEXT_PUBLIC_EVENT_INGEST_KEY from the inlined
+     *  Omit it and the client reads NEXT_PUBLIC_PUBLISHABLE_KEY from the inlined
      *  build env, the same way `dsn` falls back — so a surface declares BOTH planes
      *  in its build and neither needs code to switch on. That is the ONE spelling
-     *  the fleet already carries: KMS holds deploy/EVENT_INGEST_KEY, and each
-     *  Dockerfile takes EVENT_INGEST_KEY as a build-arg and re-exports it with the
+     *  the fleet already carries: KMS holds deploy/PUBLISHABLE_KEY, and each
+     *  Dockerfile takes PUBLISHABLE_KEY as a build-arg and re-exports it with the
      *  NEXT_PUBLIC_ prefix that makes Next inline it.
      *
      *  A surface with no key at all still reports for whoever is SIGNED IN (the

package/dist/index.cjs

@@ -86,6 +86,10 @@ function dsnForProduct(product) {
   if (!product) return void 0;
   return PRODUCT_DSN[product];
 }
+var HANZO_PUBLISHABLE_KEY = "pk-live-c88649f1085fb6ad441d8a0072933a9b";
+function defaultPublishableKey(host) {
+  return host === void 0 || host === "https://api.hanzo.ai" ? HANZO_PUBLISHABLE_KEY : void 0;
+}
 
 // src/events.ts
 var EVENTS = {
@@ -367,7 +371,7 @@ function uuidv7Time(id) {
 }
 
 // src/version.ts
-var VERSION = "0.3.16";
+var VERSION = "0.3.18";
 
 // src/sentry.ts
 var MAX_FRAMES = 50;
@@ -730,22 +734,24 @@ var Analytics = class {
       enabled: true,
       captureErrors: true,
       ...config,
-      // The publishable key resolves the SAME way the DSN below does: an explicit
-      // config wins, else the inlined build-time env.
-      //
-      // NEXT_PUBLIC_EVENT_INGEST_KEY is that env, and it is the name the fleet
-      // ALREADY carries end to end — KMS holds deploy/EVENT_INGEST_KEY, each
-      // Dockerfile takes it as the EVENT_INGEST_KEY build-arg and re-exports it
-      // with the NEXT_PUBLIC_ prefix Next needs to inline it. Reading anything
-      // else here would add a fourth spelling of one value.
+      // The publishable key resolves the SAME way the DSN below does, and now
+      // ends the SAME way too — in a baked default, so declaring nothing is
+      // enough. Most specific first:
+      //   1. an explicit `ingestKey` in config;
+      //   2. NEXT_PUBLIC_PUBLISHABLE_KEY, the inlined build-time env the fleet
+      //      carries end to end (KMS `deploy/PUBLISHABLE_KEY` -> the PUBLISHABLE_KEY
+      //      build-arg -> the NEXT_PUBLIC_ prefix Next inlines);
+      //   3. the hanzo org key baked in `dsn.ts`, on the hanzo cloud only.
       //
-      // Without this the key was the one piece of wiring a surface could not
-      // declare the way it declares every other piece, so a surface that shipped
-      // without passing it in code sent its beacons unattributed — and an
-      // unattributed write is refused (401 ingest_key_required), which is silent
-      // in the page and invisible until you read the warehouse and find the host
-      // missing entirely.
-      ingestKey: config.ingestKey ?? readEnv("NEXT_PUBLIC_EVENT_INGEST_KEY")
+      // (3) is why this is `publishable_key for all`: a hanzo surface that passes
+      // no key in code and inlines no env still emits attributed, exactly as
+      // declaring `product` is enough for the DSN. Without it that surface sent
+      // its beacons to `$public` — which drops every track/identify/group and
+      // still answers 200 — silent in the page and invisible until you read the
+      // warehouse and find the host missing entirely. A white-label surface on
+      // its own cloud (a non-default host) gets no default, so the org this
+      // attributes to is never the wrong one.
+      ingestKey: config.ingestKey ?? readEnv("NEXT_PUBLIC_PUBLISHABLE_KEY") ?? defaultPublishableKey(config.host ?? DEFAULT_HOST)
     };
     this.transport = config.transport ?? new DefaultTransport();
     this.dsn = parseDsn(config.dsn ?? readEnvDsn() ?? dsnForProduct(this.cfg.product));