@hanzo/event 0.3.17 → 0.3.18

package/hz.js

@@ -55,7 +55,7 @@
   }
 
   var LIB = 'hz.js'
-  var VERSION = '0.3.17'
+  var VERSION = '0.3.18'
   var host = (s.getAttribute('data-host') || 'https://api.hanzo.ai').replace(/\/+$/, '')
   var product = s.getAttribute('data-product') || location.hostname
   var capture = s.getAttribute('data-capture') !== '0'
@@ -68,8 +68,12 @@
   // present a key at all, so every keyed static surface looked wired, measured
   // fine in the browser, and filed nothing.
   // data-publishable-key is the name; a static tag has no lockstep build to
-  // migrate it, so data-ingest-key stays readable as the retiring spelling.
-  var key = s.getAttribute('data-publishable-key') || s.getAttribute('data-ingest-key') || ''
+  // migrate it, so data-ingest-key stays readable as the retiring spelling. With
+  // neither, a tag on the hanzo cloud falls to the baked hanzo org key (the same
+  // default the npm client bakes in dsn.ts), so a bare tag still emits attributed
+  // rather than dropping to $public. A custom data-host gets no default.
+  var key = s.getAttribute('data-publishable-key') || s.getAttribute('data-ingest-key') ||
+    (host === 'https://api.hanzo.ai' ? 'pk-live-c88649f1085fb6ad441d8a0072933a9b' : '')
 
   // ── the shared anonymous-identity chain ───────────────────────────────────
   // COPIED VERBATIM from @hanzo/event's src/anon.js, markers and all, for the same

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanzo/event",
-  "version": "0.3.17",
+  "version": "0.3.18",
   "description": "Hanzo Event — the ONE telemetry client. Emits pageview/event/identify/group to the Hanzo Cloud event stream (POST /v1/event), AND reports errors to Sentry as real Sentry envelopes — the error plane needs a DSN, without one nothing reaches Sentry. First-touch attribution, beacon-on-unload, auto error capture, client-side secret/PII scrubbing, a shared event + goal vocabulary. Subsumes @sentry.",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

package/src/core.test.ts

@@ -1,5 +1,6 @@
 import { describe, it, expect, beforeEach } from 'vitest'
 import { Analytics, VERSION } from './core'
+import { HANZO_PUBLISHABLE_KEY } from './dsn'
 import { EVENTS, PAGEVIEW } from './events'
 import type { Transport, WireEvent } from './types'
 import pkg from '../package.json' with { type: 'json' }
@@ -383,13 +384,48 @@ describe('Analytics capture', () => {
     }
   })
 
-  it('stays keyless when neither config nor env names a key', () => {
+  it('stays keyless when neither config nor env names a key, off the hanzo cloud', () => {
+    // mk() uses host:'' — a same-origin app, deliberately NOT defaulted.
     const a = mk()
     a.capture('x')
     a.flush(true)
     expect(tx.sent[0].ingestKey).toBeUndefined()
   })
 
+  it('bakes the hanzo publishable key as the default ON the hanzo cloud', () => {
+    // publishable_key for all: a hanzo surface that passes no key and inlines no
+    // env still emits attributed, the same way declaring `product` is enough for
+    // the DSN. No wiring, no $public, no silent drop of track/identify/group.
+    const a = mk({ host: 'https://api.hanzo.ai' })
+    a.capture('x')
+    a.flush(true)
+    expect(tx.sent[0].ingestKey).toBe(HANZO_PUBLISHABLE_KEY)
+  })
+
+  it('does NOT bake the default for a white-label (non-hanzo) host', () => {
+    const a = mk({ host: 'https://api.zoo.ngo' })
+    a.capture('x')
+    a.flush(true)
+    expect(tx.sent[0].ingestKey).toBeUndefined()
+  })
+
+  it('lets an explicit key and the build env each override the baked default', () => {
+    const explicit = mk({ host: 'https://api.hanzo.ai', ingestKey: 'pk-explicit' })
+    explicit.capture('x')
+    explicit.flush(true)
+    expect(tx.sent[0].ingestKey).toBe('pk-explicit')
+
+    process.env.NEXT_PUBLIC_PUBLISHABLE_KEY = 'pk-from-env'
+    try {
+      const env = mk({ host: 'https://api.hanzo.ai' }) // mk() reassigns `tx`
+      env.capture('y')
+      env.flush(true)
+      expect(tx.sent[0].ingestKey).toBe('pk-from-env')
+    } finally {
+      delete process.env.NEXT_PUBLIC_PUBLISHABLE_KEY
+    }
+  })
+
   it('a signed-in bearer WINS over a key from the build env', () => {
     // The leak this closes: one console bundle is served to several brands, and a
     // pk- names ONE org. If an env-sourced key displaced the bearer, every

package/src/core.ts

@@ -43,7 +43,7 @@ import {
   hasAttribution,
   deriveChannel,
 } from './attribution'
-import { dsnForProduct } from './dsn'
+import { dsnForProduct, defaultPublishableKey } from './dsn'
 import { PAGEVIEW } from './events'
 import { scrubText } from './scrub'
 import {
@@ -238,22 +238,27 @@ export class Analytics {
       enabled: true,
       captureErrors: true,
       ...config,
-      // The publishable key resolves the SAME way the DSN below does: an explicit
-      // config wins, else the inlined build-time env.
+      // The publishable key resolves the SAME way the DSN below does, and now
+      // ends the SAME way too — in a baked default, so declaring nothing is
+      // enough. Most specific first:
+      //   1. an explicit `ingestKey` in config;
+      //   2. NEXT_PUBLIC_PUBLISHABLE_KEY, the inlined build-time env the fleet
+      //      carries end to end (KMS `deploy/PUBLISHABLE_KEY` -> the PUBLISHABLE_KEY
+      //      build-arg -> the NEXT_PUBLIC_ prefix Next inlines);
+      //   3. the hanzo org key baked in `dsn.ts`, on the hanzo cloud only.
       //
-      // NEXT_PUBLIC_PUBLISHABLE_KEY is that env, and it is the name the fleet
-      // ALREADY carries end to end — KMS holds deploy/PUBLISHABLE_KEY, each
-      // Dockerfile takes it as the PUBLISHABLE_KEY build-arg and re-exports it
-      // with the NEXT_PUBLIC_ prefix Next needs to inline it. Reading anything
-      // else here would add a fourth spelling of one value.
-      //
-      // Without this the key was the one piece of wiring a surface could not
-      // declare the way it declares every other piece, so a surface that shipped
-      // without passing it in code sent its beacons unattributed — and an
-      // unattributed write is refused (401 ingest_key_required), which is silent
-      // in the page and invisible until you read the warehouse and find the host
-      // missing entirely.
-      ingestKey: config.ingestKey ?? readEnv('NEXT_PUBLIC_PUBLISHABLE_KEY'),
+      // (3) is why this is `publishable_key for all`: a hanzo surface that passes
+      // no key in code and inlines no env still emits attributed, exactly as
+      // declaring `product` is enough for the DSN. Without it that surface sent
+      // its beacons to `$public` — which drops every track/identify/group and
+      // still answers 200 — silent in the page and invisible until you read the
+      // warehouse and find the host missing entirely. A white-label surface on
+      // its own cloud (a non-default host) gets no default, so the org this
+      // attributes to is never the wrong one.
+      ingestKey:
+        config.ingestKey ??
+        readEnv('NEXT_PUBLIC_PUBLISHABLE_KEY') ??
+        defaultPublishableKey(config.host ?? DEFAULT_HOST),
     }
     this.transport = config.transport ?? new DefaultTransport()
     // Error plane, most specific source first: an explicit DSN wins, then the

package/src/dsn.ts

@@ -43,3 +43,29 @@ export function dsnForProduct(product: string | undefined): string | undefined {
   if (!product) return undefined
   return PRODUCT_DSN[product]
 }
+
+/** The hanzo org's publishable ingest key. Like the DSNs above it is PUBLIC by
+ *  construction: write-only — it attributes a write and mints no reading
+ *  principal — so it ships in the bundle and is readable in devtools, exactly as
+ *  hanzo.id already inlines it. It is the value KMS holds at `deploy/PUBLISHABLE_KEY`
+ *  and every fleet Dockerfile passes as the `PUBLISHABLE_KEY` build-arg; baking it
+ *  as the default is the SAME move `dsnForProduct` makes for errors — a hanzo
+ *  surface on the hanzo cloud emits attributed with zero wiring, and no build can
+ *  ship unkeyed (the failure that files anonymous traffic under `$public`, which
+ *  drops every track/identify/group and answers 200). */
+export const HANZO_PUBLISHABLE_KEY =
+  'pk-live-c88649f1085fb6ad441d8a0072933a9b'
+
+/** defaultPublishableKey resolves the baked hanzo key, but ONLY for the explicit
+ *  hanzo cloud host (api.hanzo.ai) — the host the public, anonymous-traffic
+ *  surfaces use. It is deliberately NOT applied to a same-origin `''` host: that
+ *  is the shape a cookie/session app uses (it attributes signed-in users through
+ *  the session, so it needs no anonymous key), AND it is the one host a
+ *  white-label surface shares with hanzo, so defaulting it could attribute the
+ *  wrong org. A custom host gets undefined. An explicit `ingestKey`, or an
+ *  inlined NEXT_PUBLIC_PUBLISHABLE_KEY, still wins over this. */
+export function defaultPublishableKey(host: string | undefined): string | undefined {
+  return host === undefined || host === 'https://api.hanzo.ai'
+    ? HANZO_PUBLISHABLE_KEY
+    : undefined
+}

package/src/hz.test.ts

@@ -247,9 +247,18 @@ describe('hz.js', () => {
     expect(post.url).toBe('https://api.hanzo.ai/v1/event?ingest_key=pk-abc123')
   })
 
-  it('sends no credential when no key is declared', () => {
+  it('falls to the baked hanzo key when no key is declared on the hanzo cloud', () => {
+    // publishable_key for all: a bare tag on the hanzo cloud still emits
+    // attributed, rather than dropping unkeyed to $public.
     run.api!.flush()
     const post = run.posts.at(-1)!
+    expect(post.headers.authorization).toBe('Bearer pk-live-c88649f1085fb6ad441d8a0072933a9b')
+  })
+
+  it('sends no credential when no key is declared and the host is not the hanzo cloud', () => {
+    const r = runSnippet({ attrs: { 'data-host': 'https://api.zoo.ngo' } })
+    r.api!.flush()
+    const post = r.posts.at(-1)!
     expect(post.headers.authorization).toBeUndefined()
     expect(post.url).not.toContain('ingest_key')
   })

package/src/version.ts

@@ -1,4 +1,4 @@
 // The library version, stamped on every event (`libraryVersion`) and on the
 // Sentry `sdk` block. It lives alone so `sentry.ts` can read it without importing
 // `core.ts` — core imports sentry, so the reverse would be an import cycle.
-export const VERSION = '0.3.17'
+export const VERSION = '0.3.18'