@hanzo/event 0.3.17 → 0.3.19

package/src/core.test.ts

@@ -1,5 +1,6 @@
 import { describe, it, expect, beforeEach } from 'vitest'
 import { Analytics, VERSION } from './core'
+import { HANZO_PUBLISHABLE_KEY } from './dsn'
 import { EVENTS, PAGEVIEW } from './events'
 import type { Transport, WireEvent } from './types'
 import pkg from '../package.json' with { type: 'json' }
@@ -383,13 +384,48 @@ describe('Analytics capture', () => {
     }
   })
 
-  it('stays keyless when neither config nor env names a key', () => {
+  it('stays keyless when neither config nor env names a key, off the hanzo cloud', () => {
+    // mk() uses host:'' — a same-origin app, deliberately NOT defaulted.
     const a = mk()
     a.capture('x')
     a.flush(true)
     expect(tx.sent[0].ingestKey).toBeUndefined()
   })
 
+  it('bakes the hanzo publishable key as the default ON the hanzo cloud', () => {
+    // publishable_key for all: a hanzo surface that passes no key and inlines no
+    // env still emits attributed, the same way declaring `product` is enough for
+    // the DSN. No wiring, no $public, no silent drop of track/identify/group.
+    const a = mk({ host: 'https://api.hanzo.ai' })
+    a.capture('x')
+    a.flush(true)
+    expect(tx.sent[0].ingestKey).toBe(HANZO_PUBLISHABLE_KEY)
+  })
+
+  it('does NOT bake the default for a white-label (non-hanzo) host', () => {
+    const a = mk({ host: 'https://api.zoo.ngo' })
+    a.capture('x')
+    a.flush(true)
+    expect(tx.sent[0].ingestKey).toBeUndefined()
+  })
+
+  it('lets an explicit key and the build env each override the baked default', () => {
+    const explicit = mk({ host: 'https://api.hanzo.ai', ingestKey: 'pk-explicit' })
+    explicit.capture('x')
+    explicit.flush(true)
+    expect(tx.sent[0].ingestKey).toBe('pk-explicit')
+
+    process.env.NEXT_PUBLIC_PUBLISHABLE_KEY = 'pk-from-env'
+    try {
+      const env = mk({ host: 'https://api.hanzo.ai' }) // mk() reassigns `tx`
+      env.capture('y')
+      env.flush(true)
+      expect(tx.sent[0].ingestKey).toBe('pk-from-env')
+    } finally {
+      delete process.env.NEXT_PUBLIC_PUBLISHABLE_KEY
+    }
+  })
+
   it('a signed-in bearer WINS over a key from the build env', () => {
     // The leak this closes: one console bundle is served to several brands, and a
     // pk- names ONE org. If an env-sourced key displaced the bearer, every

package/src/core.ts

@@ -43,7 +43,7 @@ import {
   hasAttribution,
   deriveChannel,
 } from './attribution'
-import { dsnForProduct } from './dsn'
+import { dsnForProduct, defaultPublishableKey } from './dsn'
 import { PAGEVIEW } from './events'
 import { scrubText } from './scrub'
 import {
@@ -238,22 +238,27 @@ export class Analytics {
       enabled: true,
       captureErrors: true,
       ...config,
-      // The publishable key resolves the SAME way the DSN below does: an explicit
-      // config wins, else the inlined build-time env.
+      // The publishable key resolves the SAME way the DSN below does, and now
+      // ends the SAME way too — in a baked default, so declaring nothing is
+      // enough. Most specific first:
+      //   1. an explicit `ingestKey` in config;
+      //   2. NEXT_PUBLIC_PUBLISHABLE_KEY, the inlined build-time env the fleet
+      //      carries end to end (KMS `deploy/PUBLISHABLE_KEY` -> the PUBLISHABLE_KEY
+      //      build-arg -> the NEXT_PUBLIC_ prefix Next inlines);
+      //   3. the hanzo org key baked in `dsn.ts`, on the hanzo cloud only.
       //
-      // NEXT_PUBLIC_PUBLISHABLE_KEY is that env, and it is the name the fleet
-      // ALREADY carries end to end — KMS holds deploy/PUBLISHABLE_KEY, each
-      // Dockerfile takes it as the PUBLISHABLE_KEY build-arg and re-exports it
-      // with the NEXT_PUBLIC_ prefix Next needs to inline it. Reading anything
-      // else here would add a fourth spelling of one value.
-      //
-      // Without this the key was the one piece of wiring a surface could not
-      // declare the way it declares every other piece, so a surface that shipped
-      // without passing it in code sent its beacons unattributed — and an
-      // unattributed write is refused (401 ingest_key_required), which is silent
-      // in the page and invisible until you read the warehouse and find the host
-      // missing entirely.
-      ingestKey: config.ingestKey ?? readEnv('NEXT_PUBLIC_PUBLISHABLE_KEY'),
+      // (3) is why this is `publishable_key for all`: a hanzo surface that passes
+      // no key in code and inlines no env still emits attributed, exactly as
+      // declaring `product` is enough for the DSN. Without it that surface sent
+      // its beacons to `$public` — which drops every track/identify/group and
+      // still answers 200 — silent in the page and invisible until you read the
+      // warehouse and find the host missing entirely. A white-label surface on
+      // its own cloud (a non-default host) gets no default, so the org this
+      // attributes to is never the wrong one.
+      ingestKey:
+        config.ingestKey ??
+        readEnv('NEXT_PUBLIC_PUBLISHABLE_KEY') ??
+        defaultPublishableKey(config.host ?? DEFAULT_HOST),
     }
     this.transport = config.transport ?? new DefaultTransport()
     // Error plane, most specific source first: an explicit DSN wins, then the

package/src/dsn.test.ts

@@ -1,7 +1,7 @@
 import { describe, it, expect, afterEach } from 'vitest'
 
 import { createAnalytics } from './core'
-import { PRODUCT_DSN, dsnForProduct } from './dsn'
+import { PRODUCT_PROJECT, dsnForProduct, HANZO_PUBLISHABLE_KEY } from './dsn'
 import { parseDsn } from './sentry'
 
 const ENV = 'NEXT_PUBLIC_HANZO_EVENT_DSN'
@@ -13,10 +13,13 @@ afterEach(() => {
 })
 
 describe('the product registry', () => {
-  it('resolves a registered product to its DSN', () => {
-    expect(dsnForProduct('console')).toBe(PRODUCT_DSN.console)
-    expect(dsnForProduct('app')).toBe(PRODUCT_DSN.app)
-    expect(dsnForProduct('site')).toBe(PRODUCT_DSN.site)
+  it('builds a product DSN — the org publishable key at its project envelope', () => {
+    expect(dsnForProduct('console')).toBe(
+      `https://${HANZO_PUBLISHABLE_KEY}@api.hanzo.ai/v1/sentry/${PRODUCT_PROJECT.console}`
+    )
+    expect(dsnForProduct('site')).toBe(
+      `https://${HANZO_PUBLISHABLE_KEY}@api.hanzo.ai/v1/sentry/${PRODUCT_PROJECT.site}`
+    )
   })
 
   it('returns undefined for an unregistered or missing product, rather than guessing', () => {
@@ -25,12 +28,12 @@ describe('the product registry', () => {
     expect(dsnForProduct('')).toBeUndefined()
   })
 
-  it('registers only DSNs that actually parse — a typo here would silently disable a surface', () => {
-    for (const [product, dsn] of Object.entries(PRODUCT_DSN)) {
-      const parsed = parseDsn(dsn)
+  it('every product DSN parses to the org key + its own project id', () => {
+    for (const [product, projectId] of Object.entries(PRODUCT_PROJECT)) {
+      const parsed = parseDsn(dsnForProduct(product))
       expect(parsed, `${product} DSN must parse`).not.toBeNull()
-      expect(parsed!.projectId, `${product} needs a project id`).toBeTruthy()
-      expect(parsed!.publicKey, `${product} needs a public key`).toBeTruthy()
+      expect(parsed!.projectId, `${product} project id`).toBe(projectId)
+      expect(parsed!.publicKey, `${product} carries the org key`).toBe(HANZO_PUBLISHABLE_KEY)
     }
   })
 })
@@ -39,7 +42,7 @@ describe('DSN precedence — most specific source wins', () => {
   it('lights up the error plane from `product` alone, with no dsn and no env', () => {
     const a = createAnalytics({ product: 'console', enabled: false })
     expect(a.errorPlaneEnabled).toBe(true)
-    expect(a.errorIngestUrl).toContain(parseDsn(PRODUCT_DSN.console)!.projectId)
+    expect(a.errorIngestUrl).toContain(PRODUCT_PROJECT.console)
   })
 
   it('prefers an explicit dsn over both the env and the registry', () => {

package/src/dsn.ts

@@ -24,22 +24,53 @@
  * product name the app passes to `createAnalytics`.
  */
 
-/** PRODUCT_DSN maps a `product` to the DSN its errors are submitted to. */
-export const PRODUCT_DSN: Readonly<Record<string, string>> = Object.freeze({
-  // hanzo-console — console.hanzo.ai (also served embedded by the cloud binary)
-  console:
-    'https://1:0c8054dbde157f4f420c56b58660052b2ad782293c4de1d606ef8fbc46a0bf34@api.hanzo.ai/v1/sentry/019fa40b-94ae-7f1d-8f7b-e92f123fad42',
-  // hanzo-app — hanzo.app
-  app: 'https://1:b3e1173125568c80f91ef4b1fabbbd2d7e22341de02b33ce7e22ef4fc16a196e@api.hanzo.ai/v1/sentry/019f9b1e-57eb-7171-9d92-72c0b85e4b4b',
-  // hanzo-ai — hanzo.ai (the marketing site; `site` is the product name it declares)
-  site: 'https://1:d9cbfb844958bd7ef2a455600f00fbf237fbd71b75c1504f137773096d6aa53f@api.hanzo.ai/v1/sentry/019f9b1e-5785-7359-ad0b-f75db8e58c99',
+/** PRODUCT_PROJECT maps a `product` to its Sentry project id. The DSN's KEY is no
+ *  longer a per-project secret — it is the ONE org publishable key (below), so a
+ *  surface's errors ride the SAME key its events do. The id only names WHICH
+ *  project the errors group under, and cloud auto-provisions that project on first
+ *  keyed ingest, so a new id needs nothing minted. `site` lives in the `hanzo-ai`
+ *  project — an explicit map, because the projects predate this and do not derive
+ *  cleanly from the product name. */
+export const PRODUCT_PROJECT: Readonly<Record<string, string>> = Object.freeze({
+  console: '019fa40b-94ae-7f1d-8f7b-e92f123fad42', // console.hanzo.ai
+  app: '019f9b1e-57eb-7171-9d92-72c0b85e4b4b', // hanzo.app
+  site: '019f9b1e-5785-7359-ad0b-f75db8e58c99', // hanzo.ai (marketing; product `site`)
 })
 
-/** dsnForProduct resolves the registered DSN for a product, or undefined when the
- *  product has no project yet — which leaves the error plane inert rather than
- *  guessing a destination and silently posting a surface's errors into the wrong
- *  project. */
+/** dsnForProduct builds the product's Sentry DSN — the ONE org publishable key at
+ *  its project's envelope endpoint — or undefined when the product has no project
+ *  yet, which leaves the error plane inert rather than posting into the wrong one.
+ *  Same key as the event stream: cloud resolves it to the org and attributes the
+ *  errors there. */
 export function dsnForProduct(product: string | undefined): string | undefined {
   if (!product) return undefined
-  return PRODUCT_DSN[product]
+  const projectId = PRODUCT_PROJECT[product]
+  if (!projectId) return undefined
+  return `https://${HANZO_PUBLISHABLE_KEY}@api.hanzo.ai/v1/sentry/${projectId}`
+}
+
+/** The hanzo org's publishable ingest key. Like the DSNs above it is PUBLIC by
+ *  construction: write-only — it attributes a write and mints no reading
+ *  principal — so it ships in the bundle and is readable in devtools, exactly as
+ *  hanzo.id already inlines it. It is the value KMS holds at `deploy/PUBLISHABLE_KEY`
+ *  and every fleet Dockerfile passes as the `PUBLISHABLE_KEY` build-arg; baking it
+ *  as the default is the SAME move `dsnForProduct` makes for errors — a hanzo
+ *  surface on the hanzo cloud emits attributed with zero wiring, and no build can
+ *  ship unkeyed (the failure that files anonymous traffic under `$public`, which
+ *  drops every track/identify/group and answers 200). */
+export const HANZO_PUBLISHABLE_KEY =
+  'pk-live-c88649f1085fb6ad441d8a0072933a9b'
+
+/** defaultPublishableKey resolves the baked hanzo key, but ONLY for the explicit
+ *  hanzo cloud host (api.hanzo.ai) — the host the public, anonymous-traffic
+ *  surfaces use. It is deliberately NOT applied to a same-origin `''` host: that
+ *  is the shape a cookie/session app uses (it attributes signed-in users through
+ *  the session, so it needs no anonymous key), AND it is the one host a
+ *  white-label surface shares with hanzo, so defaulting it could attribute the
+ *  wrong org. A custom host gets undefined. An explicit `ingestKey`, or an
+ *  inlined NEXT_PUBLIC_PUBLISHABLE_KEY, still wins over this. */
+export function defaultPublishableKey(host: string | undefined): string | undefined {
+  return host === undefined || host === 'https://api.hanzo.ai'
+    ? HANZO_PUBLISHABLE_KEY
+    : undefined
 }

package/src/hz.test.ts

@@ -247,9 +247,18 @@ describe('hz.js', () => {
     expect(post.url).toBe('https://api.hanzo.ai/v1/event?ingest_key=pk-abc123')
   })
 
-  it('sends no credential when no key is declared', () => {
+  it('falls to the baked hanzo key when no key is declared on the hanzo cloud', () => {
+    // publishable_key for all: a bare tag on the hanzo cloud still emits
+    // attributed, rather than dropping unkeyed to $public.
     run.api!.flush()
     const post = run.posts.at(-1)!
+    expect(post.headers.authorization).toBe('Bearer pk-live-c88649f1085fb6ad441d8a0072933a9b')
+  })
+
+  it('sends no credential when no key is declared and the host is not the hanzo cloud', () => {
+    const r = runSnippet({ attrs: { 'data-host': 'https://api.zoo.ngo' } })
+    r.api!.flush()
+    const post = r.posts.at(-1)!
     expect(post.headers.authorization).toBeUndefined()
     expect(post.url).not.toContain('ingest_key')
   })

package/src/index.ts

@@ -10,7 +10,7 @@
 export { Analytics, createAnalytics, VERSION, getCohort, getFirstTouch } from './core'
 export { parseDsn, buildSentryEvent, buildEnvelope, framesFromStack } from './sentry'
 export { uuidv7, uuidv7Time } from './uid'
-export { PRODUCT_DSN, dsnForProduct } from './dsn'
+export { PRODUCT_PROJECT, dsnForProduct } from './dsn'
 export type { ErrorIdentity } from './sentry'
 export { scrubText, redactSecrets, scrubPII } from './scrub'
 export { EVENTS, PAGEVIEW } from './events'

package/src/version.ts

@@ -1,4 +1,4 @@
 // The library version, stamped on every event (`libraryVersion`) and on the
 // Sentry `sdk` block. It lives alone so `sentry.ts` can read it without importing
 // `core.ts` — core imports sentry, so the reverse would be an import cycle.
-export const VERSION = '0.3.17'
+export const VERSION = '0.3.19'