@hanzo/event 0.3.20 → 0.3.21

package/dist/index.d.cts

@@ -6,7 +6,7 @@ declare function getFirstTouch(): Attribution | undefined;
 /** Read persisted cohort dimensions. */
 declare function getCohort(): Cohort | undefined;
 
-declare const VERSION = "0.3.20";
+declare const VERSION = "0.3.21";
 
 /**
  * parseDsn parses "https://<version>:<hmac>@<host>/v1/sentry/<projectId>" into its
@@ -110,12 +110,15 @@ declare function uuidv7Time(id: string): number;
  *  project — an explicit map, because the projects predate this and do not derive
  *  cleanly from the product name. */
 declare const PRODUCT_PROJECT: Readonly<Record<string, string>>;
-/** dsnForProduct builds the product's Sentry DSN — the ONE org publishable key at
- *  its project's envelope endpoint — or undefined when the product has no project
- *  yet, which leaves the error plane inert rather than posting into the wrong one.
- *  Same key as the event stream: cloud resolves it to the org and attributes the
- *  errors there. */
-declare function dsnForProduct(product: string | undefined): string | undefined;
+/** dsnForProduct builds the product's Sentry DSN from the caller's resolved
+ *  publishable `key` and the product's project — the SAME key the event stream
+ *  carries, at the product's envelope endpoint. Returns undefined when there is no
+ *  key or no project for the product, leaving the error plane inert rather than
+ *  posting into the wrong one. The key is NOT baked here: it is the value the
+ *  surface resolved (an explicit `ingestKey`, or the KMS-sourced
+ *  NEXT_PUBLIC_PUBLISHABLE_KEY the build inlines) — the ONE live source, never a
+ *  literal committed beside the code. */
+declare function dsnForProduct(product: string | undefined, key: string | undefined): string | undefined;
 
 /** redactSecrets removes known secret shapes. Always applied. */
 declare function redactSecrets(s: string): string;

package/dist/index.d.ts

@@ -6,7 +6,7 @@ declare function getFirstTouch(): Attribution | undefined;
 /** Read persisted cohort dimensions. */
 declare function getCohort(): Cohort | undefined;
 
-declare const VERSION = "0.3.20";
+declare const VERSION = "0.3.21";
 
 /**
  * parseDsn parses "https://<version>:<hmac>@<host>/v1/sentry/<projectId>" into its
@@ -110,12 +110,15 @@ declare function uuidv7Time(id: string): number;
  *  project — an explicit map, because the projects predate this and do not derive
  *  cleanly from the product name. */
 declare const PRODUCT_PROJECT: Readonly<Record<string, string>>;
-/** dsnForProduct builds the product's Sentry DSN — the ONE org publishable key at
- *  its project's envelope endpoint — or undefined when the product has no project
- *  yet, which leaves the error plane inert rather than posting into the wrong one.
- *  Same key as the event stream: cloud resolves it to the org and attributes the
- *  errors there. */
-declare function dsnForProduct(product: string | undefined): string | undefined;
+/** dsnForProduct builds the product's Sentry DSN from the caller's resolved
+ *  publishable `key` and the product's project — the SAME key the event stream
+ *  carries, at the product's envelope endpoint. Returns undefined when there is no
+ *  key or no project for the product, leaving the error plane inert rather than
+ *  posting into the wrong one. The key is NOT baked here: it is the value the
+ *  surface resolved (an explicit `ingestKey`, or the KMS-sourced
+ *  NEXT_PUBLIC_PUBLISHABLE_KEY the build inlines) — the ONE live source, never a
+ *  literal committed beside the code. */
+declare function dsnForProduct(product: string | undefined, key: string | undefined): string | undefined;
 
 /** redactSecrets removes known secret shapes. Always applied. */
 declare function redactSecrets(s: string): string;

package/dist/index.mjs

@@ -80,15 +80,11 @@ var PRODUCT_PROJECT = Object.freeze({
   site: "019f9b1e-5785-7359-ad0b-f75db8e58c99"
   // hanzo.ai (marketing; product `site`)
 });
-function dsnForProduct(product) {
-  if (!product) return void 0;
+function dsnForProduct(product, key) {
+  if (!product || !key) return void 0;
   const projectId = PRODUCT_PROJECT[product];
   if (!projectId) return void 0;
-  return `https://${HANZO_PUBLISHABLE_KEY}@api.hanzo.ai/v1/sentry/${projectId}`;
-}
-var HANZO_PUBLISHABLE_KEY = "pk-live-c88649f1085fb6ad441d8a0072933a9b";
-function defaultPublishableKey(host) {
-  return host === void 0 || host === "https://api.hanzo.ai" ? HANZO_PUBLISHABLE_KEY : void 0;
+  return `https://${key}@api.hanzo.ai/v1/sentry/${projectId}`;
 }
 
 // src/events.ts
@@ -372,7 +368,7 @@ function uuidv7Time(id) {
 }
 
 // src/version.ts
-var VERSION = "0.3.20";
+var VERSION = "0.3.21";
 
 // src/sentry.ts
 var MAX_FRAMES = 50;
@@ -823,27 +819,24 @@ var Analytics = class {
       enabled: true,
       captureErrors: true,
       ...config,
-      // The publishable key resolves the SAME way the DSN below does, and now
-      // ends the SAME way too — in a baked default, so declaring nothing is
-      // enough. Most specific first:
+      // The publishable key resolves from ONE live source, never a literal baked
+      // beside the code. Most specific first:
       //   1. an explicit `ingestKey` in config;
       //   2. NEXT_PUBLIC_PUBLISHABLE_KEY, the inlined build-time env the fleet
-      //      carries end to end (KMS `deploy/PUBLISHABLE_KEY` -> the PUBLISHABLE_KEY
-      //      build-arg -> the NEXT_PUBLIC_ prefix Next inlines);
-      //   3. the hanzo org key baked in `dsn.ts`, on the hanzo cloud only.
+      //      carries end to end — KMS `deploy/PUBLISHABLE_KEY` -> the PUBLISHABLE_KEY
+      //      build-arg -> the NEXT_PUBLIC_ prefix Next inlines.
       //
-      // (3) is why this is `publishable_key for all`: a hanzo surface that passes
-      // no key in code and inlines no env still emits attributed, exactly as
-      // declaring `product` is enough for the DSN. Without it that surface sent
-      // its beacons to `$public` — which drops every track/identify/group and
-      // still answers 200 — silent in the page and invisible until you read the
-      // warehouse and find the host missing entirely. A white-label surface on
-      // its own cloud (a non-default host) gets no default, so the org this
-      // attributes to is never the wrong one.
-      ingestKey: config.ingestKey ?? readEnv("NEXT_PUBLIC_PUBLISHABLE_KEY") ?? defaultPublishableKey(config.host ?? DEFAULT_HOST)
+      // A surface that provides neither has no key, and its anonymous traffic
+      // files under `$public` (which drops track/identify/group and answers 200);
+      // the fix is to give it the KMS-sourced env, not to hardcode the org key
+      // here. The key is a credential-class value: its home is KMS, and the ONE
+      // build reads it from there.
+      ingestKey: config.ingestKey ?? readEnv("NEXT_PUBLIC_PUBLISHABLE_KEY")
     };
     this.transport = config.transport ?? new DefaultTransport();
-    this.dsn = parseDsn(config.dsn ?? readEnvDsn() ?? dsnForProduct(this.cfg.product));
+    this.dsn = parseDsn(
+      config.dsn ?? readEnvDsn() ?? dsnForProduct(this.cfg.product, this.cfg.ingestKey)
+    );
   }
   /** errorPlaneEnabled reports whether captured exceptions can actually reach the
    *  error host. False means a DSN was never configured — the documented