@hanzo/event 0.3.25 → 0.3.26

package/hz.js

@@ -55,7 +55,7 @@
   }
 
   var LIB = 'hz.js'
-  var VERSION = '0.3.25'
+  var VERSION = '0.3.26'
   var host = (s.getAttribute('data-host') || 'https://api.hanzo.ai').replace(/\/+$/, '')
   var product = s.getAttribute('data-product') || location.hostname
   var capture = s.getAttribute('data-capture') !== '0'
@@ -284,32 +284,31 @@ function hzAnonId() {
     if (!queue.length) return
     var body = JSON.stringify({ batch: queue.splice(0, queue.length) })
     var url = host + '/v1/event'
-    // The key rides the two channels each transport can actually carry — the
-    // same pair core.ts uses, so the door cannot tell the distributions apart:
-    // a headerless sendBeacon puts it in the query, a fetch puts it in the
-    // Authorization header.
+    // BOTH transports send a SIMPLE request, and for the same reason. The key is
+    // publishable (data-publishable-key, write-only and safe in page source), so
+    // it rides the query — the one carrier neither transport needs a header for —
+    // and the body is text/plain, the CORS-safelisted type. A simple request is
+    // sent whatever origin it is on, because the browser asks permission to READ
+    // a cross-origin response, never to send one, and nothing here reads it.
     //
-    // The beacon body is text/plain because that type is CORS-safelisted, which
-    // makes the POST a SIMPLE request: no preflight, and an unloading document
-    // gets no second round trip. The door reads the raw body and dispatches on
-    // its first non-space byte, so the type names the CORS class and nothing else.
+    // That property is what lets this file run on a customer's own page at all.
+    // Every send from there is cross-origin; an Authorization header or a JSON
+    // content type makes the POST preflighted instead, and an origin that does not
+    // pass the preflight loses the batch, which splice has already emptied.
+    //
+    // The door reads the raw body and dispatches on its first non-space byte, so
+    // the type names the CORS class and nothing else.
+    var wire = key ? url + '?ingest_key=' + encodeURIComponent(key) : url
     try {
-      if (
-        navigator.sendBeacon &&
-        navigator.sendBeacon(
-          key ? url + '?ingest_key=' + encodeURIComponent(key) : url,
-          new Blob([body], { type: 'text/plain' }),
-        )
-      )
+      if (navigator.sendBeacon && navigator.sendBeacon(wire, new Blob([body], { type: 'text/plain' })))
         return
     } catch (e) {}
-    var headers = { 'content-type': 'application/json' }
-    if (key) headers.authorization = 'Bearer ' + key
-    fetch(url, {
+    fetch(wire, {
       method: 'POST',
       body: body,
       keepalive: true,
-      headers: headers,
+      credentials: 'omit',
+      headers: { 'content-type': 'text/plain' },
     }).catch(function () {})
   }
   // ── location redaction ────────────────────────────────────────────────────

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hanzo/event",
-  "version": "0.3.25",
-  "description": "Hanzo Event \u2014 the ONE telemetry client. Emits pageview/event/identify/group to the Hanzo Cloud event stream (POST /v1/event), AND reports errors to Sentry as real Sentry envelopes \u2014 the error plane needs a DSN, without one nothing reaches Sentry. First-touch attribution, beacon-on-unload, auto error capture, client-side secret/PII scrubbing, a shared event + goal vocabulary. Subsumes @sentry.",
+  "version": "0.3.26",
+  "description": "Hanzo Event — the ONE telemetry client. Emits pageview/event/identify/group to the Hanzo Cloud event stream (POST /v1/event), AND reports errors to Sentry as real Sentry envelopes — the error plane needs a DSN, without one nothing reaches Sentry. First-touch attribution, beacon-on-unload, auto error capture, client-side secret/PII scrubbing, a shared event + goal vocabulary. Subsumes @sentry.",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public",
@@ -37,13 +37,6 @@
     "funnel",
     "hanzo"
   ],
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit",
-    "clean": "rm -rf dist"
-  },
   "exports": {
     ".": {
       "import": {
@@ -84,5 +77,12 @@
   },
   "dependencies": {
     "@hanzo/events": "^0.2.1"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist"
   }
-}
+}

package/src/core.ts

@@ -207,17 +207,25 @@ class DefaultTransport implements Transport {
       }
     }
     if (typeof fetch !== 'function') return
+    // A publishable key makes the send a CORS SIMPLE request: the key rides the
+    // query, the body is text/plain, and nothing asks for credentials. That is what
+    // lets a bundled client run on a customer's own page — every send from there is
+    // cross-origin, and an Authorization header or a JSON type preflights the POST
+    // for an origin that cannot pass one. A JWT is first-party by construction, so
+    // it keeps the header and the session it travels with, and so does the error
+    // plane, which names its own envelope type.
+    const simple = opts.ingestKey !== undefined && opts.contentType === undefined
     const headers: Record<string, string> = {
-      'Content-Type': opts.contentType ?? 'application/json',
+      'Content-Type': simple ? BEACON_CONTENT_TYPE : (opts.contentType ?? 'application/json'),
     }
-    const bearer = opts.ingestKey ?? opts.token
+    const bearer = simple ? undefined : (opts.ingestKey ?? opts.token)
     if (bearer) headers.Authorization = `Bearer ${bearer}`
-    void fetch(url, {
+    void fetch(simple ? appendQuery(url, 'ingest_key', opts.ingestKey!) : url, {
       method: 'POST',
       headers,
       body,
       keepalive: true,
-      credentials: 'include',
+      credentials: simple ? 'omit' : 'include',
     })
       .then((res) => {
         // Telemetry loss never throws into the app — but silence is how this

package/src/hz.test.ts

@@ -298,13 +298,24 @@ describe('hz.js', () => {
   // keyed static surface therefore sent UNATTRIBUTED writes, which the door
   // refuses — silently, because nothing here reads the response.
 
-  it('presents the publishable key as a bearer on fetch', () => {
+  // The fetch presents it on the SAME carrier the beacon does, and stays a CORS
+  // simple request doing so. This file's whole job is to run on a customer's own
+  // page, where every send is cross-origin: an Authorization header or a JSON
+  // content type would preflight the POST, and an origin that does not pass the
+  // preflight loses the batch that splice has already emptied. A simple request is
+  // sent from any origin — the browser asks permission to READ a cross-origin
+  // response, never to send one, and nothing here reads it.
+  it('presents the publishable key on the query, as a simple request', () => {
     const r = runSnippet({ attrs: { 'data-publishable-key': 'pk-abc123' } })
     r.api!.flush()
     const post = r.posts.at(-1)!
     expect(post.via).toBe('fetch')
-    expect(post.headers.authorization).toBe('Bearer pk-abc123')
-    expect(post.url).toBe('https://api.hanzo.ai/v1/event')
+    expect(post.url).toBe('https://api.hanzo.ai/v1/event?ingest_key=pk-abc123')
+    expect(post.headers.authorization).toBeUndefined()
+    expect(post.headers['content-type']).toBe('text/plain')
+    // Content-Type is safelisted only for three values; every other header is
+    // outside the safelist by construction, so the count is the check.
+    expect(Object.keys(post.headers)).toEqual(['content-type'])
   })
 
   it('still reads the retiring data-ingest-key, on a headerless beacon', () => {

package/src/transport.test.ts

@@ -129,7 +129,13 @@ describe('the unload beacon', () => {
     expect(fetches).toHaveLength(1)
     const batch = (JSON.parse(fetches[0].body) as { batch: { event?: string }[] }).batch
     expect(batch.map((e) => e.event)).toContain('checkout_started')
-    expect(fetches[0].headers.Authorization).toBe('Bearer pk-abc123')
+
+    // The fallback carries the key the SAME way the beacon it replaces did, and
+    // stays a simple request doing so — a fallback that preflights is no fallback
+    // on the customer origin this client is meant to run on.
+    expect(fetches[0].url).toBe('https://api.hanzo.ai/v1/event?ingest_key=pk-abc123')
+    expect(fetches[0].headers.Authorization).toBeUndefined()
+    expect(fetches[0].headers['Content-Type']).toBe('text/plain')
 
     // The fallback is only a fallback if it survives the teardown that the beacon
     // was there for. Without this the batch is cancelled mid-flight and the

package/src/version.ts

@@ -1,4 +1,4 @@
 // The library version, stamped on every event (`libraryVersion`) and on the
 // Sentry `sdk` block. It lives alone so `sentry.ts` can read it without importing
 // `core.ts` — core imports sentry, so the reverse would be an import cycle.
-export const VERSION = '0.3.25'
+export const VERSION = '0.3.26'

package/src/stack.ts

@@ -1,144 +0,0 @@
-// Pure error parsing: coerce an unknown throwable into {name, message, stack},
-// and parse a browser stack string into structured frames. No I/O, no globals —
-// core.ts wires these to identity and transport.
-//
-// These frames ride the error Event to POST /v1/event so the warehouse stores
-// WHERE a crash happened, not just that one did. Nothing here talks to Sentry:
-// the client has one door and one credential. The frame shape is deliberately the
-// conventional one (function/filename/abs_path/lineno/colno/in_app) because it is
-// what every stack tool already speaks — including a future grouper built over
-// the warehouse.
-
-/** Max frames kept — well under the server's cap, plenty to identify a crash. */
-const MAX_FRAMES = 50
-/** Max stack lines examined, and max length of a line worth examining. Guards the
- *  frame regexes against a hostile `stack` string (see framesFromStack). */
-const MAX_LINES = 500
-const MAX_LINE_LEN = 2048
-
-/** One parsed stack frame. */
-export interface Frame {
-  filename?: string
-  function?: string
-  abs_path?: string
-  lineno?: number
-  colno?: number
-  /** The app's own code, as opposed to vendor/runtime — the useful default filter. */
-  in_app?: boolean
-}
-
-const V8_FRAME = /^\s*at\s+(?:(.+?)\s+\()?(?:(.+?):(\d+):(\d+)|([^)]+))\)?\s*$/
-const MOZ_FRAME = /^\s*(?:(.*?)@)?(.+?):(\d+):(\d+)\s*$/
-
-/** inApp marks a frame as the app's own code (vs vendor/runtime). */
-function inApp(file: string): boolean {
-  if (!file) return false
-  return !(
-    file.includes('node_modules') ||
-    file.startsWith('webpack-internal') ||
-    file.startsWith('webpack://') ||
-    file.startsWith('chrome-extension://') ||
-    file.startsWith('moz-extension://')
-  )
-}
-
-/**
- * framesFromStack parses a browser Error.stack into frames, OLDEST-FIRST (caller
- * → callee, so the crash site is LAST). Handles both V8 ("at fn (file:li:co)")
- * and Firefox/Safari ("fn@file:li:co"). Unparseable lines are skipped.
- */
-export function framesFromStack(stack: string | undefined): Frame[] {
-  if (!stack) return []
-  // Both frame regexes use lazy nested quantifiers, which backtrack badly on a
-  // long line that never matches. A stack is attacker-influenced (a thrown value
-  // can carry any `stack` string), so bound the work: skip absurd lines and stop
-  // after MAX_LINES. Only the innermost MAX_FRAMES are kept anyway.
-  const lines = stack.split('\n', MAX_LINES)
-  const frames: Frame[] = []
-  for (const raw of lines) {
-    if (raw.length > MAX_LINE_LEN) continue
-    const line = raw.trimEnd()
-    if (!line) continue
-    // Header lines like "TypeError: x is not a function" match neither frame
-    // regex (no "at " prefix, no trailing :line:col) and are skipped naturally.
-    let fn: string | undefined
-    let file = ''
-    let lineno = 0
-    let colno = 0
-    const v = V8_FRAME.exec(line)
-    if (v) {
-      fn = v[1]
-      if (v[2]) {
-        file = v[2]
-        lineno = Number(v[3]) || 0
-        colno = Number(v[4]) || 0
-      } else {
-        file = (v[5] || '').trim()
-      }
-    } else {
-      const f = MOZ_FRAME.exec(line)
-      if (!f) continue
-      fn = f[1]
-      file = f[2]
-      lineno = Number(f[3]) || 0
-      colno = Number(f[4]) || 0
-    }
-    if (!file && !fn) continue
-    frames.push({
-      function: fn || '<anonymous>',
-      filename: file,
-      abs_path: file,
-      lineno,
-      colno,
-      in_app: inApp(file),
-    })
-  }
-  // Reverse to oldest-first and cap to the innermost MAX_FRAMES.
-  frames.reverse()
-  if (frames.length > MAX_FRAMES) return frames.slice(frames.length - MAX_FRAMES)
-  return frames
-}
-
-/** read pulls a property off a value that may be hostile — `name`, `message` and
- *  `stack` are ordinary getters that a thrown object is free to define as
- *  throwing. The thrown value is the least trustworthy input this library
- *  handles; losing the whole report to one of them is not acceptable. */
-function read(o: unknown, k: string): unknown {
-  try {
-    return (o as Record<string, unknown>)[k]
-  } catch {
-    return undefined
-  }
-}
-
-/** str coerces to a string without letting a throwing toString/Symbol.toPrimitive
- *  escape. */
-function str(v: unknown): string {
-  try {
-    return String(v)
-  } catch {
-    return '[unstringifiable]'
-  }
-}
-
-/** normalizeError coerces an unknown throwable into {name, message, stack}.
- *  TOTAL: it returns a usable record for ANY input, including an object
- *  engineered to throw on property access. */
-export function normalizeError(err: unknown): { name: string; message: string; stack?: string } {
-  if (err instanceof Error) {
-    const name = read(err, 'name')
-    const message = read(err, 'message')
-    const stack = read(err, 'stack')
-    return {
-      name: typeof name === 'string' && name ? name : 'Error',
-      message: typeof message === 'string' && message ? message : str(err),
-      stack: typeof stack === 'string' ? stack : undefined,
-    }
-  }
-  if (typeof err === 'string') return { name: 'Error', message: err }
-  try {
-    return { name: 'Error', message: JSON.stringify(err) ?? str(err) }
-  } catch {
-    return { name: 'Error', message: str(err) }
-  }
-}