@hanzo/event 0.3.27 → 0.3.29

package/hz.js

@@ -55,7 +55,7 @@
   }
 
   var LIB = 'hz.js'
-  var VERSION = '0.3.27'
+  var VERSION = '0.3.29'
   var host = (s.getAttribute('data-host') || 'https://api.hanzo.ai').replace(/\/+$/, '')
   var product = s.getAttribute('data-product') || location.hostname
   var capture = s.getAttribute('data-capture') !== '0'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanzo/event",
-  "version": "0.3.27",
+  "version": "0.3.29",
   "description": "Hanzo Event — the ONE telemetry client. Emits pageview/event/identify/group to the Hanzo Cloud event stream (POST /v1/event), AND reports errors to Sentry as real Sentry envelopes — the error plane needs a DSN, without one nothing reaches Sentry. First-touch attribution, beacon-on-unload, auto error capture, client-side secret/PII scrubbing, a shared event + goal vocabulary. Subsumes @sentry.",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

package/src/core.test.ts

@@ -552,7 +552,7 @@ describe('Event error capture', () => {
 const TEST_DSN =
   'https://1:' +
   '0'.repeat(64) +
-  '@sentry.hanzo.ai/v1/sentry/019f9b1e-5785-7359-ad0b-f75db8e58c99'
+  '@sentry.hanzo.ai/v1/event/019f9b1e-5785-7359-ad0b-f75db8e58c99'
 
 describe('error plane', () => {
   it('is INERT without a DSN — nothing sent to sentry, event stream unaffected', () => {
@@ -574,7 +574,7 @@ describe('error plane', () => {
     const env = tx.envelopes[0]
     // The exact route the o11y ingest registers, key on the query string.
     expect(env.url).toBe(
-      'https://sentry.hanzo.ai/v1/sentry/019f9b1e-5785-7359-ad0b-f75db8e58c99/envelope/' +
+      'https://sentry.hanzo.ai/v1/event/019f9b1e-5785-7359-ad0b-f75db8e58c99/envelope/' +
         '?sentry_key=1%3A' + '0'.repeat(64),
     )
     expect(env.contentType).toBe('application/x-sentry-envelope')
@@ -600,7 +600,7 @@ describe('error plane', () => {
     // byte length, not the JS string length.
     expect(item.length).toBe(new TextEncoder().encode(payload).length)
     expect(header.dsn).toBe(
-      'https://sentry.hanzo.ai/v1/sentry/019f9b1e-5785-7359-ad0b-f75db8e58c99',
+      'https://sentry.hanzo.ai/v1/event/019f9b1e-5785-7359-ad0b-f75db8e58c99',
     )
     const ev = JSON.parse(payload) as {
       event_id: string

package/src/core.ts

@@ -9,7 +9,7 @@
 //
 //   2. ERROR PLANE — every captured exception is ALSO framed as a real Sentry
 //      envelope and POSTed to the error host named by the DSN:
-//        POST {dsn.origin}/v1/sentry/{projectId}/envelope/?sentry_key=…
+//        POST {dsn.base}/envelope/?sentry_key=…   ({base} = /v1/event/{projectId})
 //      This is what reaches sentry.hanzo.ai (issues, grouping, stack frames).
 //
 // These are NOT the same pipe and one does NOT feed the other. The event stream
@@ -699,7 +699,14 @@ function registry(): Map<string, Analytics> {
  *  This is the ONE way to get a client: `new Analytics` bypasses the registry
  *  and is for tests and for a deliberately separate instance. */
 export function createAnalytics(config: AnalyticsConfig): Analytics {
-  if (!isBrowser()) return new Analytics(config)
+  // A disabled client emits nothing, so it can double nothing and does not take
+  // the stream. Callers reach their answer at different moments — a provider
+  // whose ownership resolves in an effect renders once saying `false` before it
+  // has decided anything — and the client built in that moment must not become
+  // the one the page keeps. Registering it would silence the page, and adopting
+  // `enabled` from a later caller would let one surface overrule another's
+  // reading of consent. Neither: it is simply not the stream's client.
+  if (!isBrowser() || config.enabled === false) return new Analytics(config)
   const key = (config.host ?? DEFAULT_HOST) + '\0' + config.product
   const clients = registry()
   const existing = clients.get(key)

package/src/dsn.test.ts

@@ -5,8 +5,8 @@ import { PRODUCT_PROJECT, dsnForProduct } from './dsn'
 import { parseDsn } from './sentry'
 
 const ENV = 'NEXT_PUBLIC_HANZO_EVENT_DSN'
-const OVERRIDE = 'https://1:aaaa@api.hanzo.ai/v1/sentry/env-project'
-const EXPLICIT = 'https://1:bbbb@api.hanzo.ai/v1/sentry/explicit-project'
+const OVERRIDE = 'https://1:aaaa@api.hanzo.ai/v1/event/env-project'
+const EXPLICIT = 'https://1:bbbb@api.hanzo.ai/v1/event/explicit-project'
 // A stand-in for the surface's own resolved key — the DSN carries whatever key
 // the caller resolved (config or the KMS-sourced env), never a literal.
 const KEY = 'pk-test-resolved-key'
@@ -18,10 +18,10 @@ afterEach(() => {
 describe('the product registry', () => {
   it('builds a product DSN from the CALLER key + the project — nothing baked', () => {
     expect(dsnForProduct('console', KEY)).toBe(
-      `https://${KEY}@api.hanzo.ai/v1/sentry/${PRODUCT_PROJECT.console}`
+      `https://${KEY}@api.hanzo.ai/v1/event/${PRODUCT_PROJECT.console}`
     )
     expect(dsnForProduct('site', KEY)).toBe(
-      `https://${KEY}@api.hanzo.ai/v1/sentry/${PRODUCT_PROJECT.site}`
+      `https://${KEY}@api.hanzo.ai/v1/event/${PRODUCT_PROJECT.site}`
     )
   })
 

package/src/dsn.ts

@@ -52,5 +52,5 @@ export function dsnForProduct(
   if (!product || !key) return undefined
   const projectId = PRODUCT_PROJECT[product]
   if (!projectId) return undefined
-  return `https://${key}@api.hanzo.ai/v1/sentry/${projectId}`
+  return `https://${key}@api.hanzo.ai/v1/event/${projectId}`
 }

package/src/sentry.test.ts

@@ -11,7 +11,7 @@ import {
 import type { SentryEvent, SentryFrame } from './types'
 import { VERSION } from './version'
 
-const DSN = 'https://1:deadbeefcafe@api.hanzo.ai/v1/sentry/00000000-0000-0000-0000-000000000000'
+const DSN = 'https://1:deadbeefcafe@api.hanzo.ai/v1/event/00000000-0000-0000-0000-000000000000'
 
 describe('parseDsn', () => {
   it('keeps the version:hmac key intact (does NOT split on the colon) and derives the ingest url', () => {
@@ -20,14 +20,14 @@ describe('parseDsn', () => {
     expect(dsn.origin).toBe('https://api.hanzo.ai')
     expect(dsn.projectId).toBe('00000000-0000-0000-0000-000000000000')
     expect(dsn.ingestUrl).toBe(
-      'https://api.hanzo.ai/v1/sentry/00000000-0000-0000-0000-000000000000/envelope/?sentry_key=1%3Adeadbeefcafe',
+      'https://api.hanzo.ai/v1/event/00000000-0000-0000-0000-000000000000/envelope/?sentry_key=1%3Adeadbeefcafe',
     )
   })
   it('returns null for malformed input (fail-safe)', () => {
     expect(parseDsn(undefined)).toBeNull()
     expect(parseDsn('')).toBeNull()
     expect(parseDsn('not-a-dsn')).toBeNull()
-    expect(parseDsn('https://api.hanzo.ai/v1/sentry/x')).toBeNull() // no key
+    expect(parseDsn('https://api.hanzo.ai/v1/event/x')).toBeNull() // no key
     expect(parseDsn('https://1:k@api.hanzo.ai')).toBeNull() // no project
   })
 })

package/src/sentry.ts

@@ -3,7 +3,7 @@
 // Analytics client (core.ts) wires these to identity + transport.
 //
 // The wire shapes are a from-scratch model of the PUBLIC, documented Sentry ingest
-// protocol (develop.sentry.dev), verified against the Hanzo /v1/sentry ingest
+// protocol (develop.sentry.dev), verified against the Hanzo /v1/event ingest
 // (o11y pkg/modules/errortracking/implerrortracking: parseEnvelope, SentryEvent,
 // normalizeEvent, computeFingerprint). No upstream (FSL) code is used.
 
@@ -44,7 +44,7 @@ function byteLen(s: string): number {
 }
 
 /**
- * parseDsn parses "https://<version>:<hmac>@<host>/v1/sentry/<projectId>" into its
+ * parseDsn parses "https://<version>:<hmac>@<host>/v1/event/<projectId>" into its
  * public key + the derived envelope ingest URL. The key (which itself contains a
  * ':') is taken verbatim as the userinfo — we do NOT split it as user:pass. The
  * key rides ?sentry_key= (not the DSN in the body) because that is the credential
@@ -64,10 +64,14 @@ export function parseDsn(dsn: string | undefined | null): Dsn | null {
   const projectId = segs.length > 0 ? segs[segs.length - 1] : ''
   if (!projectId) return null
   const origin = `${scheme}://${host}`
-  const ingestUrl =
-    `${origin}/v1/sentry/${encodeURIComponent(projectId)}/envelope/` +
-    `?sentry_key=${encodeURIComponent(publicKey)}`
-  return { publicKey, origin, projectId, ingestUrl }
+  // THE DSN'S OWN PATH IS THE ADDRESS — derived here, never restated. It used to
+  // be rebuilt as a literal, which threw away the path the DSN carried and wrote
+  // the ingest address a second time; buildEnvelope wrote it a third. Three copies
+  // of one fact. dsnForProduct (dsn.ts) is the ONE place it is spelled; this
+  // follows it.
+  const base = `${origin}/${segs.map(encodeURIComponent).join('/')}`
+  const ingestUrl = `${base}/envelope/?sentry_key=${encodeURIComponent(publicKey)}`
+  return { publicKey, origin, projectId, base, ingestUrl }
 }
 
 const V8_FRAME = /^\s*at\s+(?:(.+?)\s+\()?(?:(.+?):(\d+):(\d+)|([^)]+))\)?\s*$/
@@ -295,7 +299,7 @@ export function buildEnvelope(event: SentryEvent, dsn: Dsn, sentAt?: string): st
   const payload = JSON.stringify(event)
   const header = JSON.stringify({
     event_id: event.event_id,
-    dsn: `${dsn.origin}/v1/sentry/${dsn.projectId}`,
+    dsn: dsn.base,
     sent_at: sentAt ?? new Date().toISOString(),
   })
   const itemHeader = JSON.stringify({

package/src/stream.test.ts

@@ -95,6 +95,32 @@ describe('one stream, one client', () => {
     expect(tx.sent[0].ingestKey).toBe(KEY)
   })
 
+  // A provider whose ownership resolves in an effect renders once saying
+  // `enabled: false` and then again saying true. Measured on hanzo.ai: the
+  // library's first render built a disabled client, and a registry that kept it
+  // handed that one to the app too — the page went silent, which is worse than
+  // the double it replaced.
+  it('does not let a disabled client take the stream', () => {
+    const off = createAnalytics({ product: 'site', host: HOST, enabled: false })
+    const on = createAnalytics({ product: 'site', host: HOST, transport: tx, flushIntervalMs: 999999 })
+    expect(on).not.toBe(off)
+    on.pageview('/pricing')
+    on.flush()
+    expect(tx.pageviews).toHaveLength(1)
+    expect(createAnalytics({ product: 'site', host: HOST, getToken: () => KEY })).toBe(on)
+  })
+
+  it('gives every disabled caller its own inert client', () => {
+    const a = createAnalytics({ product: 'site', host: HOST, enabled: false, transport: tx })
+    const b = createAnalytics({ product: 'site', host: HOST, enabled: false, transport: tx })
+    expect(a).not.toBe(b)
+    a.pageview('/pricing')
+    b.pageview('/pricing')
+    a.flush()
+    b.flush()
+    expect(tx.sent).toHaveLength(0)
+  })
+
   it('keeps separate streams separate', () => {
     expect(createAnalytics({ product: 'chat', host: HOST })).not.toBe(
       createAnalytics({ product: 'site', host: HOST }),

package/src/types.ts

@@ -209,7 +209,7 @@ export interface AnalyticsConfig {
 
   // ── error plane (Sentry envelope -> sentry.hanzo.ai) ──────────────────────
 
-  /** Hanzo-minted Sentry DSN: "https://<version>:<hmac>@<host>/v1/sentry/<projectId>".
+  /** Hanzo-minted Sentry DSN: "https://<version>:<hmac>@<host>/v1/event/<projectId>".
    *  Publishable — the key authorizes writes to ONE project and can read nothing,
    *  so it is safe in a browser bundle (same trust class as `ingestKey`). When
    *  absent the client reads NEXT_PUBLIC_HANZO_EVENT_DSN; when neither is set the
@@ -278,6 +278,10 @@ export interface Dsn {
   origin: string
   /** Project id segment. */
   projectId: string
+  /** The DSN's own origin + path, e.g. "https://api.hanzo.ai/v1/event/<projectId>".
+   *  Every URL below is derived from this, so the ingest address is named once —
+   *  in dsnForProduct — and nowhere else. */
+  base: string
   /** Fully-derived envelope ingest URL incl. ?sentry_key=. */
   ingestUrl: string
 }

package/src/version.ts

@@ -1,4 +1,4 @@
 // The library version, stamped on every event (`libraryVersion`) and on the
 // Sentry `sdk` block. It lives alone so `sentry.ts` can read it without importing
 // `core.ts` — core imports sentry, so the reverse would be an import cycle.
-export const VERSION = '0.3.27'
+export const VERSION = '0.3.29'