@hanzo/event 0.3.16 → 0.3.18

package/hz.js

@@ -9,7 +9,7 @@
  *
  *   <script async src="https://unpkg.com/@hanzo/event/hz.js"
  *           data-product="hanzo.ai"          // required: which surface this is
- *           data-ingest-key="pk-…"           // required off api.hanzo.ai's own origin
+ *           data-publishable-key="pk-…"      // required off api.hanzo.ai's own origin
  *           data-host="https://api.hanzo.ai" // optional: API host override
  *           data-ga="G-XXXX" data-fb="123"   // optional: also fan out to GA4 / Meta
  *           data-capture="1"></script>       // optional: autocapture off with "0"
@@ -55,7 +55,7 @@
   }
 
   var LIB = 'hz.js'
-  var VERSION = '0.3.16'
+  var VERSION = '0.3.18'
   var host = (s.getAttribute('data-host') || 'https://api.hanzo.ai').replace(/\/+$/, '')
   var product = s.getAttribute('data-product') || location.hostname
   var capture = s.getAttribute('data-capture') !== '0'
@@ -67,7 +67,13 @@
   // nothing here reads the response. Through 0.3.11 this file had no way to
   // present a key at all, so every keyed static surface looked wired, measured
   // fine in the browser, and filed nothing.
-  var key = s.getAttribute('data-ingest-key') || ''
+  // data-publishable-key is the name; a static tag has no lockstep build to
+  // migrate it, so data-ingest-key stays readable as the retiring spelling. With
+  // neither, a tag on the hanzo cloud falls to the baked hanzo org key (the same
+  // default the npm client bakes in dsn.ts), so a bare tag still emits attributed
+  // rather than dropping to $public. A custom data-host gets no default.
+  var key = s.getAttribute('data-publishable-key') || s.getAttribute('data-ingest-key') ||
+    (host === 'https://api.hanzo.ai' ? 'pk-live-c88649f1085fb6ad441d8a0072933a9b' : '')
 
   // ── the shared anonymous-identity chain ───────────────────────────────────
   // COPIED VERBATIM from @hanzo/event's src/anon.js, markers and all, for the same

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanzo/event",
-  "version": "0.3.16",
+  "version": "0.3.18",
   "description": "Hanzo Event — the ONE telemetry client. Emits pageview/event/identify/group to the Hanzo Cloud event stream (POST /v1/event), AND reports errors to Sentry as real Sentry envelopes — the error plane needs a DSN, without one nothing reaches Sentry. First-touch attribution, beacon-on-unload, auto error capture, client-side secret/PII scrubbing, a shared event + goal vocabulary. Subsumes @sentry.",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

package/src/core.test.ts

@@ -1,5 +1,6 @@
 import { describe, it, expect, beforeEach } from 'vitest'
 import { Analytics, VERSION } from './core'
+import { HANZO_PUBLISHABLE_KEY } from './dsn'
 import { EVENTS, PAGEVIEW } from './events'
 import type { Transport, WireEvent } from './types'
 import pkg from '../package.json' with { type: 'json' }
@@ -360,41 +361,76 @@ describe('Analytics capture', () => {
     // The failure this closes is silent: a surface with no key attributes nothing
     // for a logged-out visitor, the door refuses the write, and the page shows no
     // sign of it. The key must resolve from the env exactly as the DSN does.
-    process.env.NEXT_PUBLIC_EVENT_INGEST_KEY = 'pk-live-from-env'
+    process.env.NEXT_PUBLIC_PUBLISHABLE_KEY = 'pk-live-from-env'
     try {
       const a = mk() // no key in config
       a.capture('x')
       a.flush(true)
       expect(tx.sent[0].ingestKey).toBe('pk-live-from-env')
     } finally {
-      delete process.env.NEXT_PUBLIC_EVENT_INGEST_KEY
+      delete process.env.NEXT_PUBLIC_PUBLISHABLE_KEY
     }
   })
 
   it('prefers an explicit ingest key over the build env', () => {
-    process.env.NEXT_PUBLIC_EVENT_INGEST_KEY = 'pk-live-from-env'
+    process.env.NEXT_PUBLIC_PUBLISHABLE_KEY = 'pk-live-from-env'
     try {
       const a = mk({ ingestKey: 'pk-live-explicit' })
       a.capture('x')
       a.flush(true)
       expect(tx.sent[0].ingestKey).toBe('pk-live-explicit')
     } finally {
-      delete process.env.NEXT_PUBLIC_EVENT_INGEST_KEY
+      delete process.env.NEXT_PUBLIC_PUBLISHABLE_KEY
     }
   })
 
-  it('stays keyless when neither config nor env names a key', () => {
+  it('stays keyless when neither config nor env names a key, off the hanzo cloud', () => {
+    // mk() uses host:'' — a same-origin app, deliberately NOT defaulted.
     const a = mk()
     a.capture('x')
     a.flush(true)
     expect(tx.sent[0].ingestKey).toBeUndefined()
   })
 
+  it('bakes the hanzo publishable key as the default ON the hanzo cloud', () => {
+    // publishable_key for all: a hanzo surface that passes no key and inlines no
+    // env still emits attributed, the same way declaring `product` is enough for
+    // the DSN. No wiring, no $public, no silent drop of track/identify/group.
+    const a = mk({ host: 'https://api.hanzo.ai' })
+    a.capture('x')
+    a.flush(true)
+    expect(tx.sent[0].ingestKey).toBe(HANZO_PUBLISHABLE_KEY)
+  })
+
+  it('does NOT bake the default for a white-label (non-hanzo) host', () => {
+    const a = mk({ host: 'https://api.zoo.ngo' })
+    a.capture('x')
+    a.flush(true)
+    expect(tx.sent[0].ingestKey).toBeUndefined()
+  })
+
+  it('lets an explicit key and the build env each override the baked default', () => {
+    const explicit = mk({ host: 'https://api.hanzo.ai', ingestKey: 'pk-explicit' })
+    explicit.capture('x')
+    explicit.flush(true)
+    expect(tx.sent[0].ingestKey).toBe('pk-explicit')
+
+    process.env.NEXT_PUBLIC_PUBLISHABLE_KEY = 'pk-from-env'
+    try {
+      const env = mk({ host: 'https://api.hanzo.ai' }) // mk() reassigns `tx`
+      env.capture('y')
+      env.flush(true)
+      expect(tx.sent[0].ingestKey).toBe('pk-from-env')
+    } finally {
+      delete process.env.NEXT_PUBLIC_PUBLISHABLE_KEY
+    }
+  })
+
   it('a signed-in bearer WINS over a key from the build env', () => {
     // The leak this closes: one console bundle is served to several brands, and a
     // pk- names ONE org. If an env-sourced key displaced the bearer, every
     // signed-in user's events would re-file under whichever org minted the key.
-    process.env.NEXT_PUBLIC_EVENT_INGEST_KEY = 'pk-live-one-org'
+    process.env.NEXT_PUBLIC_PUBLISHABLE_KEY = 'pk-live-one-org'
     try {
       const a = mk({ getToken: () => 'jwt-of-a-real-person' })
       a.capture('x')
@@ -402,12 +438,12 @@ describe('Analytics capture', () => {
       expect(tx.sent[0].token).toBe('jwt-of-a-real-person')
       expect(tx.sent[0].ingestKey).toBeUndefined()
     } finally {
-      delete process.env.NEXT_PUBLIC_EVENT_INGEST_KEY
+      delete process.env.NEXT_PUBLIC_PUBLISHABLE_KEY
     }
   })
 
   it('an anonymous visitor still rides the key', () => {
-    process.env.NEXT_PUBLIC_EVENT_INGEST_KEY = 'pk-live-one-org'
+    process.env.NEXT_PUBLIC_PUBLISHABLE_KEY = 'pk-live-one-org'
     try {
       const a = mk({ getToken: () => undefined })   // logged out
       a.capture('x')
@@ -415,7 +451,7 @@ describe('Analytics capture', () => {
       expect(tx.sent[0].ingestKey).toBe('pk-live-one-org')
       expect(tx.sent[0].token).toBeUndefined()
     } finally {
-      delete process.env.NEXT_PUBLIC_EVENT_INGEST_KEY
+      delete process.env.NEXT_PUBLIC_PUBLISHABLE_KEY
     }
   })
 

package/src/core.ts

@@ -43,7 +43,7 @@ import {
   hasAttribution,
   deriveChannel,
 } from './attribution'
-import { dsnForProduct } from './dsn'
+import { dsnForProduct, defaultPublishableKey } from './dsn'
 import { PAGEVIEW } from './events'
 import { scrubText } from './scrub'
 import {
@@ -238,22 +238,27 @@ export class Analytics {
       enabled: true,
       captureErrors: true,
       ...config,
-      // The publishable key resolves the SAME way the DSN below does: an explicit
-      // config wins, else the inlined build-time env.
+      // The publishable key resolves the SAME way the DSN below does, and now
+      // ends the SAME way too — in a baked default, so declaring nothing is
+      // enough. Most specific first:
+      //   1. an explicit `ingestKey` in config;
+      //   2. NEXT_PUBLIC_PUBLISHABLE_KEY, the inlined build-time env the fleet
+      //      carries end to end (KMS `deploy/PUBLISHABLE_KEY` -> the PUBLISHABLE_KEY
+      //      build-arg -> the NEXT_PUBLIC_ prefix Next inlines);
+      //   3. the hanzo org key baked in `dsn.ts`, on the hanzo cloud only.
       //
-      // NEXT_PUBLIC_EVENT_INGEST_KEY is that env, and it is the name the fleet
-      // ALREADY carries end to end — KMS holds deploy/EVENT_INGEST_KEY, each
-      // Dockerfile takes it as the EVENT_INGEST_KEY build-arg and re-exports it
-      // with the NEXT_PUBLIC_ prefix Next needs to inline it. Reading anything
-      // else here would add a fourth spelling of one value.
-      //
-      // Without this the key was the one piece of wiring a surface could not
-      // declare the way it declares every other piece, so a surface that shipped
-      // without passing it in code sent its beacons unattributed — and an
-      // unattributed write is refused (401 ingest_key_required), which is silent
-      // in the page and invisible until you read the warehouse and find the host
-      // missing entirely.
-      ingestKey: config.ingestKey ?? readEnv('NEXT_PUBLIC_EVENT_INGEST_KEY'),
+      // (3) is why this is `publishable_key for all`: a hanzo surface that passes
+      // no key in code and inlines no env still emits attributed, exactly as
+      // declaring `product` is enough for the DSN. Without it that surface sent
+      // its beacons to `$public` — which drops every track/identify/group and
+      // still answers 200 — silent in the page and invisible until you read the
+      // warehouse and find the host missing entirely. A white-label surface on
+      // its own cloud (a non-default host) gets no default, so the org this
+      // attributes to is never the wrong one.
+      ingestKey:
+        config.ingestKey ??
+        readEnv('NEXT_PUBLIC_PUBLISHABLE_KEY') ??
+        defaultPublishableKey(config.host ?? DEFAULT_HOST),
     }
     this.transport = config.transport ?? new DefaultTransport()
     // Error plane, most specific source first: an explicit DSN wins, then the

package/src/dsn.ts

@@ -43,3 +43,29 @@ export function dsnForProduct(product: string | undefined): string | undefined {
   if (!product) return undefined
   return PRODUCT_DSN[product]
 }
+
+/** The hanzo org's publishable ingest key. Like the DSNs above it is PUBLIC by
+ *  construction: write-only — it attributes a write and mints no reading
+ *  principal — so it ships in the bundle and is readable in devtools, exactly as
+ *  hanzo.id already inlines it. It is the value KMS holds at `deploy/PUBLISHABLE_KEY`
+ *  and every fleet Dockerfile passes as the `PUBLISHABLE_KEY` build-arg; baking it
+ *  as the default is the SAME move `dsnForProduct` makes for errors — a hanzo
+ *  surface on the hanzo cloud emits attributed with zero wiring, and no build can
+ *  ship unkeyed (the failure that files anonymous traffic under `$public`, which
+ *  drops every track/identify/group and answers 200). */
+export const HANZO_PUBLISHABLE_KEY =
+  'pk-live-c88649f1085fb6ad441d8a0072933a9b'
+
+/** defaultPublishableKey resolves the baked hanzo key, but ONLY for the explicit
+ *  hanzo cloud host (api.hanzo.ai) — the host the public, anonymous-traffic
+ *  surfaces use. It is deliberately NOT applied to a same-origin `''` host: that
+ *  is the shape a cookie/session app uses (it attributes signed-in users through
+ *  the session, so it needs no anonymous key), AND it is the one host a
+ *  white-label surface shares with hanzo, so defaulting it could attribute the
+ *  wrong org. A custom host gets undefined. An explicit `ingestKey`, or an
+ *  inlined NEXT_PUBLIC_PUBLISHABLE_KEY, still wins over this. */
+export function defaultPublishableKey(host: string | undefined): string | undefined {
+  return host === undefined || host === 'https://api.hanzo.ai'
+    ? HANZO_PUBLISHABLE_KEY
+    : undefined
+}

package/src/hz.test.ts

@@ -230,8 +230,8 @@ describe('hz.js', () => {
   // keyed static surface therefore sent UNATTRIBUTED writes, which the door
   // refuses — silently, because nothing here reads the response.
 
-  it('presents the ingest key as a bearer on fetch', () => {
-    const r = runSnippet({ attrs: { 'data-ingest-key': 'pk-abc123' } })
+  it('presents the publishable key as a bearer on fetch', () => {
+    const r = runSnippet({ attrs: { 'data-publishable-key': 'pk-abc123' } })
     r.api!.flush()
     const post = r.posts.at(-1)!
     expect(post.via).toBe('fetch')
@@ -239,7 +239,7 @@ describe('hz.js', () => {
     expect(post.url).toBe('https://api.hanzo.ai/v1/event')
   })
 
-  it('presents the ingest key in the query on a headerless beacon', () => {
+  it('still reads the retiring data-ingest-key, on a headerless beacon', () => {
     const r = runSnippet({ attrs: { 'data-ingest-key': 'pk-abc123' }, beacon: true })
     r.api!.flush()
     const post = r.posts.at(-1)!
@@ -247,9 +247,18 @@ describe('hz.js', () => {
     expect(post.url).toBe('https://api.hanzo.ai/v1/event?ingest_key=pk-abc123')
   })
 
-  it('sends no credential when no key is declared', () => {
+  it('falls to the baked hanzo key when no key is declared on the hanzo cloud', () => {
+    // publishable_key for all: a bare tag on the hanzo cloud still emits
+    // attributed, rather than dropping unkeyed to $public.
     run.api!.flush()
     const post = run.posts.at(-1)!
+    expect(post.headers.authorization).toBe('Bearer pk-live-c88649f1085fb6ad441d8a0072933a9b')
+  })
+
+  it('sends no credential when no key is declared and the host is not the hanzo cloud', () => {
+    const r = runSnippet({ attrs: { 'data-host': 'https://api.zoo.ngo' } })
+    r.api!.flush()
+    const post = r.posts.at(-1)!
     expect(post.headers.authorization).toBeUndefined()
     expect(post.url).not.toContain('ingest_key')
   })

package/src/types.ts

@@ -120,11 +120,11 @@ export interface AnalyticsConfig {
    *  a reading principal — so it is safe to ship in a bundle. Mint one per org with
    *  POST /v1/keys {"type":"publishable"}.
    *
-   *  Omit it and the client reads NEXT_PUBLIC_EVENT_INGEST_KEY from the inlined
+   *  Omit it and the client reads NEXT_PUBLIC_PUBLISHABLE_KEY from the inlined
    *  build env, the same way `dsn` falls back — so a surface declares BOTH planes
    *  in its build and neither needs code to switch on. That is the ONE spelling
-   *  the fleet already carries: KMS holds deploy/EVENT_INGEST_KEY, and each
-   *  Dockerfile takes EVENT_INGEST_KEY as a build-arg and re-exports it with the
+   *  the fleet already carries: KMS holds deploy/PUBLISHABLE_KEY, and each
+   *  Dockerfile takes PUBLISHABLE_KEY as a build-arg and re-exports it with the
    *  NEXT_PUBLIC_ prefix that makes Next inline it.
    *
    *  A surface with no key at all still reports for whoever is SIGNED IN (the

package/src/version.ts

@@ -1,4 +1,4 @@
 // The library version, stamped on every event (`libraryVersion`) and on the
 // Sentry `sdk` block. It lives alone so `sentry.ts` can read it without importing
 // `core.ts` — core imports sentry, so the reverse would be an import cycle.
-export const VERSION = '0.3.16'
+export const VERSION = '0.3.18'