@hanzo/event 0.3.22 → 0.3.24

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hanzo/event",
-  "version": "0.3.22",
-  "description": "Hanzo Event \u2014 the ONE telemetry client. Emits pageview/event/identify/group to the Hanzo Cloud event stream (POST /v1/event), AND reports errors to Sentry as real Sentry envelopes \u2014 the error plane needs a DSN, without one nothing reaches Sentry. First-touch attribution, beacon-on-unload, auto error capture, client-side secret/PII scrubbing, a shared event + goal vocabulary. Subsumes @sentry.",
+  "version": "0.3.24",
+  "description": "Hanzo Event — the ONE telemetry client. Emits pageview/event/identify/group to the Hanzo Cloud event stream (POST /v1/event), AND reports errors to Sentry as real Sentry envelopes — the error plane needs a DSN, without one nothing reaches Sentry. First-touch attribution, beacon-on-unload, auto error capture, client-side secret/PII scrubbing, a shared event + goal vocabulary. Subsumes @sentry.",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public",
@@ -37,13 +37,6 @@
     "funnel",
     "hanzo"
   ],
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit",
-    "clean": "rm -rf dist"
-  },
   "exports": {
     ".": {
       "import": {
@@ -83,6 +76,13 @@
     "vitest": "^4.1.0"
   },
   "dependencies": {
-    "@hanzo/events": "^0.2.0"
+    "@hanzo/events": "^0.2.1"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist"
   }
-}
+}

package/src/core.ts

@@ -81,6 +81,13 @@ export { VERSION }
 const EVENT_PATH = '/v1/event' // the ONE canonical ingestion front door
 const DEFAULT_HOST = 'https://api.hanzo.ai' // the one edge; cookie apps pass host:''
 const ENVELOPE_CONTENT_TYPE = 'application/x-sentry-envelope'
+// The beacon body's type. text/plain is CORS-SAFELISTED, which is the whole
+// property: a safelisted type makes the POST a SIMPLE request, and a simple
+// request needs no preflight. An unloading document does not get a second round
+// trip, so cross-origin a preflighted beacon is never sent at all. The door reads
+// the raw body and dispatches on its first non-space byte, so the type names the
+// CORS class and nothing else.
+const BEACON_CONTENT_TYPE = 'text/plain'
 
 /** readEnvDsn resolves a DSN from the public env when config omits one, so an app
  *  gets the error plane by setting ONE build-time variable and nothing else.
@@ -165,7 +172,12 @@ function serializeBatch(batch: WireEvent[]): string | null {
 /** DefaultTransport: fetch(keepalive) for authenticated/normal sends;
  *  navigator.sendBeacon for headerless page-unload beacons. A bearer (a JWT or a
  *  publishable pk_ key) rides Authorization on fetch; on a beacon — which cannot
- *  set headers — a publishable key rides the ?ingest_key query instead. */
+ *  set headers — a publishable key rides the ?ingest_key query instead.
+ *
+ *  `contentType` names the FETCH request's Content-Type (the error plane sets the
+ *  envelope type there). The beacon body is always BEACON_CONTENT_TYPE: its type
+ *  is a CORS class, not a payload description, and a beacon that is not a simple
+ *  request is a beacon that is never sent. */
 class DefaultTransport implements Transport {
   send(
     url: string,
@@ -178,18 +190,26 @@ class DefaultTransport implements Transport {
       debug?: boolean
     },
   ): void {
-    const contentType = opts.contentType ?? 'application/json'
     if (opts.beacon && isBrowser() && typeof navigator.sendBeacon === 'function') {
       const beaconUrl = opts.ingestKey ? appendQuery(url, 'ingest_key', opts.ingestKey) : url
       try {
-        navigator.sendBeacon(beaconUrl, new Blob([body], { type: contentType }))
-        return
+        // The answer is whether the agent QUEUED the batch — false for a body past
+        // the beacon size limit, or a full queue. Only a queued batch ends the
+        // send; a refused one falls through to the keepalive fetch below.
+        const queued = navigator.sendBeacon(
+          beaconUrl,
+          new Blob([body], { type: BEACON_CONTENT_TYPE }),
+        )
+        if (queued) return
+        if (opts.debug) console.warn('[event] beacon refused, falling back to fetch')
       } catch {
         /* fall through to fetch */
       }
     }
     if (typeof fetch !== 'function') return
-    const headers: Record<string, string> = { 'Content-Type': contentType }
+    const headers: Record<string, string> = {
+      'Content-Type': opts.contentType ?? 'application/json',
+    }
     const bearer = opts.ingestKey ?? opts.token
     if (bearer) headers.Authorization = `Bearer ${bearer}`
     void fetch(url, {

package/src/funnels.ts

@@ -1,154 +1,14 @@
-// The ONE funnel registry. A funnel is DATA — an ordered list of event names —
-// so the products, the Insights UI, and the docs can never drift: every step is
-// a name from EVENTS (funnels.test.ts fails the build otherwise), and a GOAL that
-// has a funnel points AT one of these rather than restating the steps.
-//
-// Why here and not in Insights: the taxonomy is code that all three surfaces
-// already import (`@hanzo/event`). A funnel defined in the read lens could name
-// an event no surface emits; a funnel defined next to EVENTS cannot.
-
-import { EVENTS, PAGEVIEW } from './events'
-
-/** The emitting surfaces — the closed set of `AnalyticsConfig.product` values.
- *  `product` is on every event, so a funnel scopes by product instead of every
- *  surface prefixing its event names. */
-export const PRODUCTS = ['site', 'app', 'chat', 'console', 'admin', 'cloud'] as const
-export type ProductId = (typeof PRODUCTS)[number]
-
-export interface FunnelStep {
-  /** An EVENTS value (or PAGEVIEW). */
-  event: string
-  /** Human label for the Insights step. */
-  label: string
-  /** Property equality that qualifies the step, e.g. first_action{action:'api_call'}. */
-  where?: { property: string; equals: string }
-}
-
-export interface FunnelDef {
-  label: string
-  /** Surface(s) the steps are emitted from — matched against the `product` field. */
-  products: ProductId[]
-  /**
-   * How steps are joined:
-   *  • 'person'    — steps join on distinctId (one browser, or one logged-in
-   *                  person across surfaces). The normal case.
-   *  • 'aggregate' — steps are emitted on DIFFERENT origins by a LOGGED-OUT
-   *                  visitor, so there is no shared id: hanzo.ai, hanzo.app and
-   *                  hanzo.chat each mint their own anonymousId in their own
-   *                  storage. Read these as step-over-step COUNTS, never as a
-   *                  per-person conversion. Honest by construction.
-   */
-  join: 'person' | 'aggregate'
-  steps: FunnelStep[]
-}
-
-const s = (event: string, label: string, where?: FunnelStep['where']): FunnelStep => ({
-  event,
-  label,
-  ...(where ? { where } : {}),
-})
-
-export const FUNNELS = {
-  /** hanzo.ai: land → sign up. IAM hosts the form, so `signup_submitted` is the
-   *  redirect INTO IAM and `signup_completed` is the return at /auth/callback. */
-  signup: {
-    label: 'Signup',
-    products: ['site'],
-    join: 'person',
-    steps: [
-      s(PAGEVIEW, 'Landed'),
-      s(EVENTS.SIGNUP_VIEWED, 'Opened signup'),
-      s(EVENTS.SIGNUP_SUBMITTED, 'Redirected to Hanzo ID'),
-      s(EVENTS.SIGNUP_COMPLETED, 'Account created'),
-      s(EVENTS.FIRST_ACTION, 'First action'),
-    ],
-  },
-
-  /** The developer activation path: an account is worth nothing until a key has
-   *  made a call. `first_action{action:'api_call'}` is emitted SERVER-SIDE by
-   *  Cloud on an org's first successful /v1 request — a browser cannot see it. */
-  apiActivation: {
-    label: 'API activation',
-    products: ['site', 'cloud'],
-    join: 'person',
-    steps: [
-      s(EVENTS.SIGNUP_COMPLETED, 'Account created'),
-      s(EVENTS.API_KEY_CREATED, 'Key minted'),
-      s(EVENTS.FIRST_ACTION, 'First successful API call', {
-        property: 'action',
-        equals: 'api_call',
-      }),
-    ],
-  },
-
-  /** Upgrade intent → revenue. `order_completed{kind:'plan'}` is the Sale goal. */
-  upgrade: {
-    label: 'Upgrade',
-    products: ['site', 'app', 'console'],
-    join: 'person',
-    steps: [
-      s(EVENTS.PRICING_VIEWED, 'Viewed pricing'),
-      s(EVENTS.PLAN_CLICKED, 'Chose a plan'),
-      s(EVENTS.CHECKOUT_STARTED, 'Started checkout'),
-      s(EVENTS.ORDER_COMPLETED, 'Paid'),
-    ],
-  },
-
-  /** hanzo.app: describe → build → deploy → live URL. The whole product thesis
-   *  in five steps; `deploy_succeeded` is the moment a live URL exists. */
-  appShip: {
-    label: 'Describe → ship',
-    products: ['app'],
-    join: 'person',
-    steps: [
-      s(PAGEVIEW, 'Landed'),
-      s(EVENTS.BUILD_STARTED, 'Described an app'),
-      s(EVENTS.GENERATION_COMPLETED, 'Got a working build'),
-      s(EVENTS.DEPLOY_STARTED, 'Hit publish'),
-      s(EVENTS.DEPLOY_SUCCEEDED, 'Live URL'),
-    ],
-  },
-
-  /** hanzo.chat: visit → first message → answer. `generation_completed` is what
-   *  separates "typed something" from "got value". */
-  chatEngage: {
-    label: 'Chat engagement',
-    products: ['chat'],
-    join: 'person',
-    steps: [
-      s(PAGEVIEW, 'Landed'),
-      s(EVENTS.CHAT_STARTED, 'Started a conversation'),
-      s(EVENTS.CHAT_MESSAGE_SENT, 'Sent a message'),
-      s(EVENTS.GENERATION_COMPLETED, 'Got an answer'),
-    ],
-  },
-
-  /** The cross-surface handoff: the hanzo.ai composer forwards its prompt to
-   *  hanzo.chat. Two origins, two anonymousIds — so this is an AGGREGATE funnel.
-   *  The join is the `referrerProduct` property hanzo.chat reads off `?hz_ref=`,
-   *  which makes the drop-off measurable without any cross-domain identity. */
-  siteToChat: {
-    label: 'Site → Chat handoff',
-    products: ['site', 'chat'],
-    join: 'aggregate',
-    steps: [
-      s(EVENTS.CHAT_STARTED, 'Submitted the hanzo.ai composer', {
-        property: 'source',
-        equals: 'composer',
-      }),
-      s(EVENTS.CHAT_STARTED, 'Landed in hanzo.chat', {
-        property: 'referrerProduct',
-        equals: 'site',
-      }),
-      s(EVENTS.GENERATION_COMPLETED, 'Got an answer'),
-    ],
-  },
-} as const satisfies Record<string, FunnelDef>
-
-export type FunnelId = keyof typeof FUNNELS
-
-/** eventsOf flattens a funnel to its ordered event names — what a goal's `funnel`
- *  field carries, so the steps are defined exactly once (here). */
-export function eventsOf(id: FunnelId): string[] {
-  return FUNNELS[id].steps.map((step) => step.event)
-}
+/**
+ * The funnel registry, re-exported from where it is now defined.
+ *
+ * The funnels moved to @hanzo/events for the reason the names did: the read lens
+ * is Go and cannot import TypeScript, and that package already writes its data
+ * out as JSON. Defining a funnel beside the vocabulary also makes the anti-drift
+ * check local — a step naming an event that does not exist is caught where both
+ * are declared.
+ *
+ * Nothing about the API moved. Every existing import keeps working.
+ */
+
+export { FUNNELS, PRODUCTS, eventsOf } from '@hanzo/events'
+export type { FunnelDef, FunnelStep, FunnelId, ProductId } from '@hanzo/events'

package/src/goals.test.ts

@@ -0,0 +1,33 @@
+/**
+ * A goal points AT a funnel and never restates its steps.
+ *
+ * The steps are defined once, in @hanzo/events. A goal that spelled its own copy
+ * would be right on the day it was written and wrong the day a step moved — and
+ * the way that surfaces is a conversion rate quietly measuring the wrong thing.
+ */
+
+import { describe, expect, it } from 'vitest'
+import { EVENTS } from './events'
+import { eventsOf } from './funnels'
+import { GOALS } from './goals'
+
+describe('goals', () => {
+  it('derive their funnel from the registry — one definition, never restated', () => {
+    for (const goal of Object.values(GOALS)) {
+      if (!goal.funnelId) continue
+      expect(goal.funnel).toEqual(eventsOf(goal.funnelId))
+    }
+  })
+
+  it('convert on an event the funnel actually contains', () => {
+    expect(GOALS.signup.funnel).toContain(EVENTS.SIGNUP_COMPLETED)
+    expect(GOALS.sale.funnel).toContain(EVENTS.ORDER_COMPLETED)
+    expect(GOALS.activation.funnel).toContain(EVENTS.FIRST_ACTION)
+  })
+
+  it('does not gate signup on an event nothing emits', () => {
+    // signup_verified is IAM-internal: no surface emits it, so its presence in
+    // the signup funnel would pin the conversion rate at 0.
+    expect(GOALS.signup.funnel).not.toContain(EVENTS.SIGNUP_VERIFIED)
+  })
+})

package/src/hz.test.ts

@@ -27,14 +27,27 @@ interface WireEvent {
   libraryVersion: string
 }
 
-/** One recorded transmission: which transport carried it, where, under what headers. */
+/** One recorded transmission: which transport carried it, where, under what headers
+ *  and — the fact that decides whether a cross-origin unload beacon is sent at all
+ *  — the content type its body was labelled with. */
 interface Post {
   via: 'beacon' | 'fetch'
   url: string
   headers: Record<string, string>
+  contentType: string
   batch: WireEvent[]
 }
 
+// The three CORS-safelisted request content types. A POST whose body carries one
+// is a SIMPLE request and goes immediately; anything else is PREFLIGHTED, and an
+// unloading document never gets the preflight's second round trip. This tag runs
+// on a customer's own domain, so its beacon is always cross-origin.
+const CORS_SAFELISTED = new Set([
+  'text/plain',
+  'application/x-www-form-urlencoded',
+  'multipart/form-data',
+])
+
 interface StubOptions {
   /** data-* attributes on the <script> tag. */
   attrs?: Record<string, string>
@@ -106,8 +119,14 @@ function runSnippet(opts: StubOptions = {}): {
     doNotTrack: '0',
     ...opts.navigator,
     sendBeacon: opts.beacon
-      ? (url: string, blob: { body: string }) => {
-          posts.push({ via: 'beacon', url, headers: {}, batch: JSON.parse(blob.body).batch })
+      ? (url: string, blob: { body: string; type: string }) => {
+          posts.push({
+            via: 'beacon',
+            url,
+            headers: {},
+            contentType: blob.type,
+            batch: JSON.parse(blob.body).batch,
+          })
           return true
         }
       : undefined,
@@ -116,8 +135,10 @@ function runSnippet(opts: StubOptions = {}): {
     'Blob',
     class {
       body: string
-      constructor(parts: string[]) {
+      type: string
+      constructor(parts: string[], opts?: { type?: string }) {
         this.body = parts.join('')
+        this.type = opts?.type ?? ''
       }
     },
   )
@@ -133,7 +154,13 @@ function runSnippet(opts: StubOptions = {}): {
   // "the previous run's API answered".
   define('hanzo', undefined)
   define('fetch', (url: string, init: { body: string; headers: Record<string, string> }) => {
-    posts.push({ via: 'fetch', url, headers: init.headers, batch: JSON.parse(init.body).batch })
+    posts.push({
+      via: 'fetch',
+      url,
+      headers: init.headers,
+      contentType: init.headers['content-type'] ?? '',
+      batch: JSON.parse(init.body).batch,
+    })
     return Promise.resolve()
   })
   define('window', g)
@@ -247,6 +274,19 @@ describe('hz.js', () => {
     expect(post.url).toBe('https://api.hanzo.ai/v1/event?ingest_key=pk-abc123')
   })
 
+  it('labels the beacon body a CORS-simple type, so the unload POST is sent', () => {
+    // The tag is installed on a customer's own domain, so every send here is
+    // cross-origin. A non-safelisted body type preflights, and an unloading
+    // document gets no second round trip — the batch would simply never leave.
+    // The credential is in the query for the same reason: a beacon sets no
+    // headers, and an Authorization header preflights whatever the type is.
+    const r = runSnippet({ attrs: { 'data-ingest-key': 'pk-abc123' }, beacon: true })
+    r.api!.flush()
+    const post = r.posts.at(-1)!
+    expect(post.via).toBe('beacon')
+    expect(CORS_SAFELISTED.has(post.contentType)).toBe(true)
+  })
+
   it('sends no credential when no key is declared — no baked literal', () => {
     // The key is the surface's own, stamped into the tag by its deploy from KMS;
     // a bare tag carries nothing, so it is honestly keyless rather than borrowing

package/src/transport.test.ts

@@ -0,0 +1,125 @@
+// The DEFAULT transport — what every surface that does not supply its own gets,
+// exercised through the real `Analytics` rather than a stub, because the two
+// properties below are properties of the shipped object and nothing else.
+//
+// Both are invisible to a test that reads the batch: the body is identical either
+// way. What decides whether the batch ARRIVES is the beacon's content type (which
+// decides whether the browser sends it at all) and what the code does with
+// sendBeacon's answer (which decides whether a refusal is retried or dropped).
+
+import { describe, it, expect } from 'vitest'
+import { Analytics } from './core'
+
+/** One thing navigator.sendBeacon was handed. */
+interface Beaconed {
+  url: string
+  type: string
+  body: string
+}
+
+/** One thing fetch was handed. */
+interface Fetched {
+  url: string
+  headers: Record<string, string>
+  body: string
+}
+
+// The three CORS-safelisted request content types. A POST whose body carries one
+// of these is a SIMPLE request and is sent immediately; anything else is
+// PREFLIGHTED, and an unloading document never gets the preflight's second round
+// trip — so cross-origin, a non-safelisted beacon is not delayed, it is lost.
+const CORS_SAFELISTED = new Set([
+  'text/plain',
+  'application/x-www-form-urlencoded',
+  'multipart/form-data',
+])
+
+/** Runs ONE unload flush of the real DefaultTransport against a stub browser.
+ *  `queued` is what navigator.sendBeacon answers — true when the agent accepts the
+ *  batch, false when it refuses (a body past the beacon size limit, or a full
+ *  queue). Globals are DEFINED and restored: Node ships a real `navigator` whose
+ *  descriptor has no setter, so a plain assignment throws. */
+function unloadFlush(queued: boolean): { beacons: Beaconed[]; fetches: Fetched[] } {
+  const beacons: Beaconed[] = []
+  const fetches: Fetched[] = []
+  const g = globalThis as Record<string, unknown>
+  const names = ['window', 'document', 'navigator', 'Blob', 'fetch']
+  const saved = names.map((n) => [n, Object.getOwnPropertyDescriptor(g, n)] as const)
+  const define = (name: string, value: unknown) =>
+    Object.defineProperty(g, name, { value, configurable: true, writable: true })
+
+  define('window', {
+    location: { href: 'https://acme.test/checkout', pathname: '/checkout', search: '' },
+    addEventListener: () => {},
+  })
+  define('document', { referrer: '', visibilityState: 'visible' })
+  define('navigator', {
+    sendBeacon: (url: string, blob: { type: string; body: string }) => {
+      beacons.push({ url, type: blob.type, body: blob.body })
+      return queued
+    },
+  })
+  define(
+    'Blob',
+    class {
+      type: string
+      body: string
+      constructor(parts: string[], opts?: { type?: string }) {
+        this.body = parts.join('')
+        this.type = opts?.type ?? ''
+      }
+    },
+  )
+  define('fetch', (url: string, init: { headers: Record<string, string>; body: string }) => {
+    fetches.push({ url, headers: init.headers, body: init.body })
+    return Promise.resolve({ ok: true, status: 200 })
+  })
+
+  try {
+    // No `transport`, so the client builds the real DefaultTransport. The key is
+    // explicit rather than inherited from the build env, so the assertions below
+    // are about this batch and not about the machine running them.
+    const a = new Analytics({ product: 'test', ingestKey: 'pk-abc123', captureErrors: false })
+    a.capture('checkout_started')
+    a.flush(true)
+  } finally {
+    for (const [n, d] of saved) {
+      if (d) Object.defineProperty(g, n, d)
+      else delete g[n]
+    }
+  }
+  return { beacons, fetches }
+}
+
+describe('the unload beacon', () => {
+  it('is a CORS-simple request, so an unloading document actually sends it', () => {
+    const { beacons, fetches } = unloadFlush(true)
+    expect(beacons).toHaveLength(1)
+
+    // The load-bearing assertion. A non-safelisted type preflights, and there is
+    // no second round trip during unload.
+    expect(CORS_SAFELISTED.has(beacons[0].type)).toBe(true)
+
+    // The other half of what makes it simple: a beacon can set no headers, so the
+    // credential rides the query. An Authorization header would preflight whatever
+    // the body's type is.
+    expect(beacons[0].url).toBe('https://api.hanzo.ai/v1/event?ingest_key=pk-abc123')
+
+    // A queued batch is sent ONCE. Falling through here would double-count every
+    // unload event in the warehouse.
+    expect(fetches).toHaveLength(0)
+  })
+
+  it('falls through to the keepalive fetch when the agent refuses to queue it', () => {
+    const { beacons, fetches } = unloadFlush(false)
+
+    // Offered to the beacon first...
+    expect(beacons).toHaveLength(1)
+
+    // ...and, refused, carried by the fetch sitting behind it rather than dropped.
+    expect(fetches).toHaveLength(1)
+    const batch = (JSON.parse(fetches[0].body) as { batch: { event?: string }[] }).batch
+    expect(batch.map((e) => e.event)).toContain('checkout_started')
+    expect(fetches[0].headers.Authorization).toBe('Bearer pk-abc123')
+  })
+})

package/src/types.ts

@@ -139,8 +139,10 @@ export interface WireEvent {
  *  ?ingest_key query. */
 export interface Transport {
   /** Durable POST usable during page unload (fetch keepalive / sendBeacon).
-   *  `contentType` defaults to application/json; the error plane overrides it with
-   *  application/x-sentry-envelope. */
+   *  `contentType` names the FETCH request's Content-Type — it defaults to
+   *  application/json, and the error plane sets application/x-sentry-envelope. A
+   *  beacon body carries a CORS-safelisted type so the POST stays a simple request;
+   *  that is a property of the transport, not a caller's choice. */
   send(
     url: string,
     body: string,

package/src/version.ts

@@ -1,4 +1,4 @@
 // The library version, stamped on every event (`libraryVersion`) and on the
 // Sentry `sdk` block. It lives alone so `sentry.ts` can read it without importing
 // `core.ts` — core imports sentry, so the reverse would be an import cycle.
-export const VERSION = '0.3.21'
+export const VERSION = '0.3.24'

package/src/funnels.test.ts

@@ -1,92 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { EVENTS, PAGEVIEW } from './events'
-import { FUNNELS, PRODUCTS, eventsOf, type FunnelId } from './funnels'
-import { GOALS } from './goals'
-
-const NAMES = new Set<string>([...Object.values(EVENTS), PAGEVIEW])
-const ids = Object.keys(FUNNELS) as FunnelId[]
-
-describe('event vocabulary', () => {
-  it('is snake_case with no product prefix or interpolation', () => {
-    for (const name of Object.values(EVENTS)) {
-      expect(name, name).toMatch(/^[a-z][a-z0-9]*(_[a-z0-9]+)+$/)
-    }
-  })
-
-  it('has no duplicate values (two constants must never share a name)', () => {
-    const values = Object.values(EVENTS)
-    expect(new Set(values).size).toBe(values.length)
-  })
-
-  it('reserves the $ prefix for the client (only $pageview)', () => {
-    expect(Object.values(EVENTS).some((n) => n.startsWith('$'))).toBe(false)
-    expect(PAGEVIEW).toBe('$pageview')
-  })
-})
-
-describe('funnels', () => {
-  it('only reference events that exist — the anti-drift guard', () => {
-    for (const id of ids) {
-      for (const step of FUNNELS[id].steps) {
-        expect(NAMES.has(step.event), `${id}: unknown event "${step.event}"`).toBe(true)
-      }
-    }
-  })
-
-  it('name only known products', () => {
-    for (const id of ids) {
-      for (const p of FUNNELS[id].products) {
-        expect(PRODUCTS, `${id}: unknown product "${p}"`).toContain(p)
-      }
-    }
-  })
-
-  it('are ordered lists of at least two steps', () => {
-    for (const id of ids) expect(FUNNELS[id].steps.length, id).toBeGreaterThanOrEqual(2)
-  })
-
-  it('mark a cross-origin funnel as aggregate (no shared anonymousId)', () => {
-    // Two surfaces + a logged-out visitor = two anonymousIds. Anything spanning
-    // origins must say so, or the read lens silently reports a false conversion.
-    for (const id of ids) {
-      if (FUNNELS[id].products.length > 1 && FUNNELS[id].join === 'person') {
-        // person-joined multi-product funnels are only legitimate post-login
-        // (site+cloud share the OIDC subject) — flag anything anonymous.
-        expect(FUNNELS[id].steps[0].event, id).not.toBe(PAGEVIEW)
-      }
-    }
-    expect(FUNNELS.siteToChat.join).toBe('aggregate')
-  })
-
-  it('the three product journeys are covered', () => {
-    expect(FUNNELS.signup.products).toContain('site')
-    expect(FUNNELS.appShip.products).toContain('app')
-    expect(FUNNELS.chatEngage.products).toContain('chat')
-  })
-
-  it('appShip ends at a live URL, not at a click', () => {
-    const last = FUNNELS.appShip.steps[FUNNELS.appShip.steps.length - 1]
-    expect(last.event).toBe(EVENTS.DEPLOY_SUCCEEDED)
-  })
-})
-
-describe('goals', () => {
-  it('derive their funnel from the registry — one definition, never restated', () => {
-    for (const goal of Object.values(GOALS)) {
-      if (!goal.funnelId) continue
-      expect(goal.funnel).toEqual(eventsOf(goal.funnelId))
-    }
-  })
-
-  it('convert on an event the funnel actually contains (or its head)', () => {
-    expect(GOALS.signup.funnel).toContain(EVENTS.SIGNUP_COMPLETED)
-    expect(GOALS.sale.funnel).toContain(EVENTS.ORDER_COMPLETED)
-    expect(GOALS.activation.funnel).toContain(EVENTS.FIRST_ACTION)
-  })
-
-  it('no longer gates signup on an event nothing emits', () => {
-    // signup_verified is IAM-internal: no surface emits it, so its presence in
-    // the signup funnel pinned the conversion rate at 0.
-    expect(GOALS.signup.funnel).not.toContain(EVENTS.SIGNUP_VERIFIED)
-  })
-})