@hanzo/event 0.3.20 → 0.3.22

package/hz.js

@@ -55,7 +55,7 @@
   }
 
   var LIB = 'hz.js'
-  var VERSION = '0.3.20'
+  var VERSION = '0.3.21'
   var host = (s.getAttribute('data-host') || 'https://api.hanzo.ai').replace(/\/+$/, '')
   var product = s.getAttribute('data-product') || location.hostname
   var capture = s.getAttribute('data-capture') !== '0'
@@ -67,13 +67,12 @@
   // nothing here reads the response. Through 0.3.11 this file had no way to
   // present a key at all, so every keyed static surface looked wired, measured
   // fine in the browser, and filed nothing.
-  // data-publishable-key is the name; a static tag has no lockstep build to
-  // migrate it, so data-ingest-key stays readable as the retiring spelling. With
-  // neither, a tag on the hanzo cloud falls to the baked hanzo org key (the same
-  // default the npm client bakes in dsn.ts), so a bare tag still emits attributed
-  // rather than dropping to $public. A custom data-host gets no default.
-  var key = s.getAttribute('data-publishable-key') || s.getAttribute('data-ingest-key') ||
-    (host === 'https://api.hanzo.ai' ? 'pk-live-c88649f1085fb6ad441d8a0072933a9b' : '')
+  // data-publishable-key is the name; data-ingest-key is the retiring spelling.
+  // The value is the surface's own KMS-sourced key, stamped into the tag by the
+  // deploy — never a literal baked in here. With neither attribute the tag is
+  // keyless and its writes file under $public; the fix is to stamp the key, not
+  // to hardcode the org's credential into this file.
+  var key = s.getAttribute('data-publishable-key') || s.getAttribute('data-ingest-key') || ''
 
   // ── the shared anonymous-identity chain ───────────────────────────────────
   // COPIED VERBATIM from @hanzo/event's src/anon.js, markers and all, for the same

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanzo/event",
-  "version": "0.3.20",
+  "version": "0.3.22",
   "description": "Hanzo Event \u2014 the ONE telemetry client. Emits pageview/event/identify/group to the Hanzo Cloud event stream (POST /v1/event), AND reports errors to Sentry as real Sentry envelopes \u2014 the error plane needs a DSN, without one nothing reaches Sentry. First-touch attribution, beacon-on-unload, auto error capture, client-side secret/PII scrubbing, a shared event + goal vocabulary. Subsumes @sentry.",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
@@ -81,5 +81,8 @@
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
     "vitest": "^4.1.0"
+  },
+  "dependencies": {
+    "@hanzo/events": "^0.2.0"
   }
 }

package/src/core.test.ts

@@ -1,6 +1,5 @@
 import { describe, it, expect, beforeEach } from 'vitest'
 import { Analytics, VERSION } from './core'
-import { HANZO_PUBLISHABLE_KEY } from './dsn'
 import { EVENTS, PAGEVIEW } from './events'
 import type { Transport, WireEvent } from './types'
 import pkg from '../package.json' with { type: 'json' }
@@ -384,48 +383,15 @@ describe('Analytics capture', () => {
     }
   })
 
-  it('stays keyless when neither config nor env names a key, off the hanzo cloud', () => {
-    // mk() uses host:'' — a same-origin app, deliberately NOT defaulted.
-    const a = mk()
-    a.capture('x')
-    a.flush(true)
-    expect(tx.sent[0].ingestKey).toBeUndefined()
-  })
-
-  it('bakes the hanzo publishable key as the default ON the hanzo cloud', () => {
-    // publishable_key for all: a hanzo surface that passes no key and inlines no
-    // env still emits attributed, the same way declaring `product` is enough for
-    // the DSN. No wiring, no $public, no silent drop of track/identify/group.
+  it('stays keyless when neither config nor env names a key — no baked literal', () => {
+    // The key comes from ONE live source (config or the KMS-sourced env); nothing
+    // is hardcoded, so a surface that provides neither is honestly keyless.
     const a = mk({ host: 'https://api.hanzo.ai' })
     a.capture('x')
     a.flush(true)
-    expect(tx.sent[0].ingestKey).toBe(HANZO_PUBLISHABLE_KEY)
-  })
-
-  it('does NOT bake the default for a white-label (non-hanzo) host', () => {
-    const a = mk({ host: 'https://api.zoo.ngo' })
-    a.capture('x')
-    a.flush(true)
     expect(tx.sent[0].ingestKey).toBeUndefined()
   })
 
-  it('lets an explicit key and the build env each override the baked default', () => {
-    const explicit = mk({ host: 'https://api.hanzo.ai', ingestKey: 'pk-explicit' })
-    explicit.capture('x')
-    explicit.flush(true)
-    expect(tx.sent[0].ingestKey).toBe('pk-explicit')
-
-    process.env.NEXT_PUBLIC_PUBLISHABLE_KEY = 'pk-from-env'
-    try {
-      const env = mk({ host: 'https://api.hanzo.ai' }) // mk() reassigns `tx`
-      env.capture('y')
-      env.flush(true)
-      expect(tx.sent[0].ingestKey).toBe('pk-from-env')
-    } finally {
-      delete process.env.NEXT_PUBLIC_PUBLISHABLE_KEY
-    }
-  })
-
   it('a signed-in bearer WINS over a key from the build env', () => {
     // The leak this closes: one console bundle is served to several brands, and a
     // pk- names ONE org. If an env-sourced key displaced the bearer, every

package/src/core.ts

@@ -43,7 +43,7 @@ import {
   hasAttribution,
   deriveChannel,
 } from './attribution'
-import { dsnForProduct, defaultPublishableKey } from './dsn'
+import { dsnForProduct } from './dsn'
 import { EXCEPTION, PAGEVIEW } from './events'
 import { exceptionProperties } from './exception'
 import { scrubText } from './scrub'
@@ -239,35 +239,29 @@ export class Analytics {
       enabled: true,
       captureErrors: true,
       ...config,
-      // The publishable key resolves the SAME way the DSN below does, and now
-      // ends the SAME way too — in a baked default, so declaring nothing is
-      // enough. Most specific first:
+      // The publishable key resolves from ONE live source, never a literal baked
+      // beside the code. Most specific first:
       //   1. an explicit `ingestKey` in config;
       //   2. NEXT_PUBLIC_PUBLISHABLE_KEY, the inlined build-time env the fleet
-      //      carries end to end (KMS `deploy/PUBLISHABLE_KEY` -> the PUBLISHABLE_KEY
-      //      build-arg -> the NEXT_PUBLIC_ prefix Next inlines);
-      //   3. the hanzo org key baked in `dsn.ts`, on the hanzo cloud only.
+      //      carries end to end — KMS `deploy/PUBLISHABLE_KEY` -> the PUBLISHABLE_KEY
+      //      build-arg -> the NEXT_PUBLIC_ prefix Next inlines.
       //
-      // (3) is why this is `publishable_key for all`: a hanzo surface that passes
-      // no key in code and inlines no env still emits attributed, exactly as
-      // declaring `product` is enough for the DSN. Without it that surface sent
-      // its beacons to `$public` — which drops every track/identify/group and
-      // still answers 200 — silent in the page and invisible until you read the
-      // warehouse and find the host missing entirely. A white-label surface on
-      // its own cloud (a non-default host) gets no default, so the org this
-      // attributes to is never the wrong one.
-      ingestKey:
-        config.ingestKey ??
-        readEnv('NEXT_PUBLIC_PUBLISHABLE_KEY') ??
-        defaultPublishableKey(config.host ?? DEFAULT_HOST),
+      // A surface that provides neither has no key, and its anonymous traffic
+      // files under `$public` (which drops track/identify/group and answers 200);
+      // the fix is to give it the KMS-sourced env, not to hardcode the org key
+      // here. The key is a credential-class value: its home is KMS, and the ONE
+      // build reads it from there.
+      ingestKey: config.ingestKey ?? readEnv('NEXT_PUBLIC_PUBLISHABLE_KEY'),
     }
     this.transport = config.transport ?? new DefaultTransport()
     // Error plane, most specific source first: an explicit DSN wins, then the
-    // inlined build-time env (a per-deploy override), then the product registry
-    // — so declaring `product` is enough to report errors and no surface needs
-    // build-argument plumbing. Malformed or absent => null => inert, never
-    // throwing into the host app.
-    this.dsn = parseDsn(config.dsn ?? readEnvDsn() ?? dsnForProduct(this.cfg.product))
+    // inlined build-time env (a per-deploy override), then the product registry —
+    // whose DSN carries the SAME resolved key (not a baked one), so declaring
+    // `product` + providing the key is enough to report errors. Malformed or
+    // absent => null => inert, never throwing into the host app.
+    this.dsn = parseDsn(
+      config.dsn ?? readEnvDsn() ?? dsnForProduct(this.cfg.product, this.cfg.ingestKey)
+    )
   }
 
   /** errorPlaneEnabled reports whether captured exceptions can actually reach the

package/src/dsn.test.ts

@@ -1,64 +1,74 @@
 import { describe, it, expect, afterEach } from 'vitest'
 
 import { createAnalytics } from './core'
-import { PRODUCT_PROJECT, dsnForProduct, HANZO_PUBLISHABLE_KEY } from './dsn'
+import { PRODUCT_PROJECT, dsnForProduct } from './dsn'
 import { parseDsn } from './sentry'
 
 const ENV = 'NEXT_PUBLIC_HANZO_EVENT_DSN'
 const OVERRIDE = 'https://1:aaaa@api.hanzo.ai/v1/sentry/env-project'
 const EXPLICIT = 'https://1:bbbb@api.hanzo.ai/v1/sentry/explicit-project'
+// A stand-in for the surface's own resolved key — the DSN carries whatever key
+// the caller resolved (config or the KMS-sourced env), never a literal.
+const KEY = 'pk-test-resolved-key'
 
 afterEach(() => {
   delete process.env[ENV]
 })
 
 describe('the product registry', () => {
-  it('builds a product DSN — the org publishable key at its project envelope', () => {
-    expect(dsnForProduct('console')).toBe(
-      `https://${HANZO_PUBLISHABLE_KEY}@api.hanzo.ai/v1/sentry/${PRODUCT_PROJECT.console}`
+  it('builds a product DSN from the CALLER key + the project — nothing baked', () => {
+    expect(dsnForProduct('console', KEY)).toBe(
+      `https://${KEY}@api.hanzo.ai/v1/sentry/${PRODUCT_PROJECT.console}`
     )
-    expect(dsnForProduct('site')).toBe(
-      `https://${HANZO_PUBLISHABLE_KEY}@api.hanzo.ai/v1/sentry/${PRODUCT_PROJECT.site}`
+    expect(dsnForProduct('site', KEY)).toBe(
+      `https://${KEY}@api.hanzo.ai/v1/sentry/${PRODUCT_PROJECT.site}`
     )
   })
 
-  it('returns undefined for an unregistered or missing product, rather than guessing', () => {
-    expect(dsnForProduct('not-a-product')).toBeUndefined()
-    expect(dsnForProduct(undefined)).toBeUndefined()
-    expect(dsnForProduct('')).toBeUndefined()
+  it('returns undefined without a key or without a project, rather than guessing', () => {
+    expect(dsnForProduct('console', undefined)).toBeUndefined() // no key -> inert
+    expect(dsnForProduct('not-a-product', KEY)).toBeUndefined()
+    expect(dsnForProduct(undefined, KEY)).toBeUndefined()
+    expect(dsnForProduct('', KEY)).toBeUndefined()
   })
 
-  it('every product DSN parses to the org key + its own project id', () => {
+  it('every product DSN parses to the caller key + its own project id', () => {
     for (const [product, projectId] of Object.entries(PRODUCT_PROJECT)) {
-      const parsed = parseDsn(dsnForProduct(product))
+      const parsed = parseDsn(dsnForProduct(product, KEY))
       expect(parsed, `${product} DSN must parse`).not.toBeNull()
       expect(parsed!.projectId, `${product} project id`).toBe(projectId)
-      expect(parsed!.publicKey, `${product} carries the org key`).toBe(HANZO_PUBLISHABLE_KEY)
+      expect(parsed!.publicKey, `${product} carries the resolved key`).toBe(KEY)
     }
   })
 })
 
 describe('DSN precedence — most specific source wins', () => {
-  it('lights up the error plane from `product` alone, with no dsn and no env', () => {
-    const a = createAnalytics({ product: 'console', enabled: false })
+  it('lights up the error plane from `product` + a resolved key, with no explicit dsn', () => {
+    const a = createAnalytics({ product: 'console', ingestKey: KEY, enabled: false })
     expect(a.errorPlaneEnabled).toBe(true)
     expect(a.errorIngestUrl).toContain(PRODUCT_PROJECT.console)
   })
 
   it('prefers an explicit dsn over both the env and the registry', () => {
     process.env[ENV] = OVERRIDE
-    const a = createAnalytics({ product: 'console', dsn: EXPLICIT, enabled: false })
+    const a = createAnalytics({ product: 'console', ingestKey: KEY, dsn: EXPLICIT, enabled: false })
     expect(a.errorIngestUrl).toContain('explicit-project')
   })
 
   it('prefers the env override over the registry, so a deploy can repoint a surface', () => {
     process.env[ENV] = OVERRIDE
-    const a = createAnalytics({ product: 'console', enabled: false })
+    const a = createAnalytics({ product: 'console', ingestKey: KEY, enabled: false })
     expect(a.errorIngestUrl).toContain('env-project')
   })
 
   it('stays inert for an unregistered product — never posts one surface into another project', () => {
-    const a = createAnalytics({ product: 'not-a-product', enabled: false })
+    const a = createAnalytics({ product: 'not-a-product', ingestKey: KEY, enabled: false })
+    expect(a.errorPlaneEnabled).toBe(false)
+    expect(a.errorIngestUrl).toBeUndefined()
+  })
+
+  it('stays inert with a product but no key — the error plane needs the live key', () => {
+    const a = createAnalytics({ product: 'console', enabled: false })
     expect(a.errorPlaneEnabled).toBe(false)
     expect(a.errorIngestUrl).toBeUndefined()
   })

package/src/dsn.ts

@@ -37,40 +37,20 @@ export const PRODUCT_PROJECT: Readonly<Record<string, string>> = Object.freeze({
   site: '019f9b1e-5785-7359-ad0b-f75db8e58c99', // hanzo.ai (marketing; product `site`)
 })
 
-/** dsnForProduct builds the product's Sentry DSN — the ONE org publishable key at
- *  its project's envelope endpoint — or undefined when the product has no project
- *  yet, which leaves the error plane inert rather than posting into the wrong one.
- *  Same key as the event stream: cloud resolves it to the org and attributes the
- *  errors there. */
-export function dsnForProduct(product: string | undefined): string | undefined {
-  if (!product) return undefined
+/** dsnForProduct builds the product's Sentry DSN from the caller's resolved
+ *  publishable `key` and the product's project — the SAME key the event stream
+ *  carries, at the product's envelope endpoint. Returns undefined when there is no
+ *  key or no project for the product, leaving the error plane inert rather than
+ *  posting into the wrong one. The key is NOT baked here: it is the value the
+ *  surface resolved (an explicit `ingestKey`, or the KMS-sourced
+ *  NEXT_PUBLIC_PUBLISHABLE_KEY the build inlines) — the ONE live source, never a
+ *  literal committed beside the code. */
+export function dsnForProduct(
+  product: string | undefined,
+  key: string | undefined
+): string | undefined {
+  if (!product || !key) return undefined
   const projectId = PRODUCT_PROJECT[product]
   if (!projectId) return undefined
-  return `https://${HANZO_PUBLISHABLE_KEY}@api.hanzo.ai/v1/sentry/${projectId}`
-}
-
-/** The hanzo org's publishable ingest key. Like the DSNs above it is PUBLIC by
- *  construction: write-only — it attributes a write and mints no reading
- *  principal — so it ships in the bundle and is readable in devtools, exactly as
- *  hanzo.id already inlines it. It is the value KMS holds at `deploy/PUBLISHABLE_KEY`
- *  and every fleet Dockerfile passes as the `PUBLISHABLE_KEY` build-arg; baking it
- *  as the default is the SAME move `dsnForProduct` makes for errors — a hanzo
- *  surface on the hanzo cloud emits attributed with zero wiring, and no build can
- *  ship unkeyed (the failure that files anonymous traffic under `$public`, which
- *  drops every track/identify/group and answers 200). */
-export const HANZO_PUBLISHABLE_KEY =
-  'pk-live-c88649f1085fb6ad441d8a0072933a9b'
-
-/** defaultPublishableKey resolves the baked hanzo key, but ONLY for the explicit
- *  hanzo cloud host (api.hanzo.ai) — the host the public, anonymous-traffic
- *  surfaces use. It is deliberately NOT applied to a same-origin `''` host: that
- *  is the shape a cookie/session app uses (it attributes signed-in users through
- *  the session, so it needs no anonymous key), AND it is the one host a
- *  white-label surface shares with hanzo, so defaulting it could attribute the
- *  wrong org. A custom host gets undefined. An explicit `ingestKey`, or an
- *  inlined NEXT_PUBLIC_PUBLISHABLE_KEY, still wins over this. */
-export function defaultPublishableKey(host: string | undefined): string | undefined {
-  return host === undefined || host === 'https://api.hanzo.ai'
-    ? HANZO_PUBLISHABLE_KEY
-    : undefined
+  return `https://${key}@api.hanzo.ai/v1/sentry/${projectId}`
 }

package/src/events.ts

@@ -1,76 +1,21 @@
-// The ONE product-analytics vocabulary. Every Hanzo surface emits these exact
-// names so funnels, goals, and cohorts line up across console/chat/app/site/admin.
-// Pageviews use the reserved "$pageview" name (emitted by analytics.pageview()),
-// matching the server read lens.
-//
-// Naming is a closed convention, not a style preference (see TAXONOMY.md):
-//   • snake_case, `<object>_<verb-in-past-tense>` — signup_completed, plan_clicked.
-//   • Names are CONSTANTS, never interpolated. A dimension (framework, model,
-//     plan, source) is a PROPERTY, never part of the name. `deploy_succeeded`
-//     with {framework:'static'} — never `deploy_static_succeeded`.
-//   • One name per user-visible moment, shared by every surface. The surface is
-//     already on the wire as `product`, so a name is never product-prefixed.
-
-export const EVENTS = {
-  // Signup funnel: view -> submit -> verify -> completed -> first action.
-  SIGNUP_VIEWED: 'signup_viewed',
-  SIGNUP_SUBMITTED: 'signup_submitted',
-  SIGNUP_VERIFIED: 'signup_verified',
-  SIGNUP_COMPLETED: 'signup_completed',
-  /** A RETURNING user authenticated — the non-signup half of the IAM callback.
-   *  Keeping it distinct is what stops returning logins from inflating signups. */
-  LOGIN_COMPLETED: 'login_completed',
-  /** Activation: the first moment of real value. ONE event for every product —
-   *  the product-specific moment is the `action` property (api_call, app_live,
-   *  chat_reply), never a new event name. */
-  FIRST_ACTION: 'first_action',
-
-  // Waitlist + referral.
-  WAITLIST_JOINED: 'waitlist_joined',
-  WAITLIST_SHARED: 'waitlist_shared',
-  REFERRAL_USED: 'referral_used',
-  REFERRAL_CLAIMED: 'referral_claimed',
-
-  // Upgrade-intent + purchase.
-  PRICING_VIEWED: 'pricing_viewed',
-  PLAN_CLICKED: 'plan_clicked',
-  CHECKOUT_STARTED: 'checkout_started',
-  ORDER_COMPLETED: 'order_completed',
-
-  // Feature usage — generic + the common key surfaces across products.
-  FEATURE_USED: 'feature_used',
-  API_KEY_CREATED: 'api_key_created',
-  APP_CREATED: 'app_created',
-  PROJECT_CREATED: 'project_created',
-  AGENT_CREATED: 'agent_created',
-  CHAT_STARTED: 'chat_started',
-  CHAT_MESSAGE_SENT: 'chat_message_sent',
-  /** The user switched model/endpoint — the single strongest quality signal a
-   *  chat surface emits (a switch usually follows a bad answer). */
-  MODEL_SWITCHED: 'model_switched',
-  TASK_STARTED: 'task_started',
-  TASK_COMPLETED: 'task_completed',
-
-  // Build → ship. `build_*` is a MODEL producing an artifact; `deploy_*` is that
-  // artifact going live. Intent (build_started) is never the same event as the
-  // artifact existing (app_created) — conflating them makes the funnel lie.
-  BUILD_STARTED: 'build_started',
-  /** A model finished producing an artifact (an app build, a chat reply, an agent
-   *  run). Carries `durationMs` — the outcome event owns its own duration, so no
-   *  paired start event is needed. */
-  GENERATION_COMPLETED: 'generation_completed',
-  GENERATION_FAILED: 'generation_failed',
-  DEPLOY_STARTED: 'deploy_started',
-  DEPLOY_SUCCEEDED: 'deploy_succeeded',
-  DEPLOY_FAILED: 'deploy_failed',
-} as const
-
-export type EventName = (typeof EVENTS)[keyof typeof EVENTS]
-
-/** The reserved event name a pageview is stored under (server + read lens). */
-export const PAGEVIEW = '$pageview'
-
-/** The reserved name every captured exception is emitted under. Error Tracking
- *  reads exactly this name; an exception emitted under its own message instead
- *  makes every distinct message a permanent entry in the event taxonomy. */
-export const EXCEPTION = '$exception'
+/**
+ * The vocabulary, re-exported from where it is now defined.
+ *
+ * These names used to be declared here. They moved to @hanzo/events — the
+ * plural package is the catalog (many events, what each means, what each
+ * carries), this one is the client (one call sends one event). Splitting them
+ * that way is what lets the ingest door read the same catalog: the door is Go
+ * and cannot import TypeScript, so @hanzo/events also ships the data as JSON,
+ * and there is still exactly one definition.
+ *
+ * Nothing about the API moved. Every existing import keeps working, the names
+ * and their values are unchanged, and `pkgs/events/test/catalog.mjs` fails the
+ * build if a name and its meaning ever disagree.
+ *
+ * The naming convention lives with the names, in @hanzo/events and TAXONOMY.md:
+ * snake_case `<object>_<verb-past>`, a dimension is a PROPERTY and never part
+ * of the name, one name per user-visible moment shared by every surface.
+ */
+
+export { EVENTS, PAGEVIEW, EXCEPTION } from '@hanzo/events'
+export type { EventName } from '@hanzo/events'

package/src/hz.test.ts

@@ -247,18 +247,12 @@ describe('hz.js', () => {
     expect(post.url).toBe('https://api.hanzo.ai/v1/event?ingest_key=pk-abc123')
   })
 
-  it('falls to the baked hanzo key when no key is declared on the hanzo cloud', () => {
-    // publishable_key for all: a bare tag on the hanzo cloud still emits
-    // attributed, rather than dropping unkeyed to $public.
+  it('sends no credential when no key is declared — no baked literal', () => {
+    // The key is the surface's own, stamped into the tag by its deploy from KMS;
+    // a bare tag carries nothing, so it is honestly keyless rather than borrowing
+    // a hardcoded org credential.
     run.api!.flush()
     const post = run.posts.at(-1)!
-    expect(post.headers.authorization).toBe('Bearer pk-live-c88649f1085fb6ad441d8a0072933a9b')
-  })
-
-  it('sends no credential when no key is declared and the host is not the hanzo cloud', () => {
-    const r = runSnippet({ attrs: { 'data-host': 'https://api.zoo.ngo' } })
-    r.api!.flush()
-    const post = r.posts.at(-1)!
     expect(post.headers.authorization).toBeUndefined()
     expect(post.url).not.toContain('ingest_key')
   })

package/src/version.ts

@@ -1,4 +1,4 @@
 // The library version, stamped on every event (`libraryVersion`) and on the
 // Sentry `sdk` block. It lives alone so `sentry.ts` can read it without importing
 // `core.ts` — core imports sentry, so the reverse would be an import cycle.
-export const VERSION = '0.3.20'
+export const VERSION = '0.3.21'