@hanzo/event 0.3.28 → 0.3.30

package/hz.js

@@ -55,7 +55,7 @@
   }
 
   var LIB = 'hz.js'
-  var VERSION = '0.3.28'
+  var VERSION = '0.3.30'
   var host = (s.getAttribute('data-host') || 'https://api.hanzo.ai').replace(/\/+$/, '')
   var product = s.getAttribute('data-product') || location.hostname
   var capture = s.getAttribute('data-capture') !== '0'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanzo/event",
-  "version": "0.3.28",
+  "version": "0.3.30",
   "description": "Hanzo Event — the ONE telemetry client. Emits pageview/event/identify/group to the Hanzo Cloud event stream (POST /v1/event), AND reports errors to Sentry as real Sentry envelopes — the error plane needs a DSN, without one nothing reaches Sentry. First-touch attribution, beacon-on-unload, auto error capture, client-side secret/PII scrubbing, a shared event + goal vocabulary. Subsumes @sentry.",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

package/src/core.test.ts

@@ -552,7 +552,7 @@ describe('Event error capture', () => {
 const TEST_DSN =
   'https://1:' +
   '0'.repeat(64) +
-  '@sentry.hanzo.ai/v1/sentry/019f9b1e-5785-7359-ad0b-f75db8e58c99'
+  '@sentry.hanzo.ai/v1/event/019f9b1e-5785-7359-ad0b-f75db8e58c99'
 
 describe('error plane', () => {
   it('is INERT without a DSN — nothing sent to sentry, event stream unaffected', () => {
@@ -574,7 +574,7 @@ describe('error plane', () => {
     const env = tx.envelopes[0]
     // The exact route the o11y ingest registers, key on the query string.
     expect(env.url).toBe(
-      'https://sentry.hanzo.ai/v1/sentry/019f9b1e-5785-7359-ad0b-f75db8e58c99/envelope/' +
+      'https://sentry.hanzo.ai/v1/event/019f9b1e-5785-7359-ad0b-f75db8e58c99/envelope/' +
         '?sentry_key=1%3A' + '0'.repeat(64),
     )
     expect(env.contentType).toBe('application/x-sentry-envelope')
@@ -600,7 +600,7 @@ describe('error plane', () => {
     // byte length, not the JS string length.
     expect(item.length).toBe(new TextEncoder().encode(payload).length)
     expect(header.dsn).toBe(
-      'https://sentry.hanzo.ai/v1/sentry/019f9b1e-5785-7359-ad0b-f75db8e58c99',
+      'https://sentry.hanzo.ai/v1/event/019f9b1e-5785-7359-ad0b-f75db8e58c99',
     )
     const ev = JSON.parse(payload) as {
       event_id: string

package/src/core.ts

@@ -9,7 +9,7 @@
 //
 //   2. ERROR PLANE — every captured exception is ALSO framed as a real Sentry
 //      envelope and POSTed to the error host named by the DSN:
-//        POST {dsn.origin}/v1/sentry/{projectId}/envelope/?sentry_key=…
+//        POST {dsn.base}/envelope/?sentry_key=…   ({base} = /v1/event/{projectId})
 //      This is what reaches sentry.hanzo.ai (issues, grouping, stack frames).
 //
 // These are NOT the same pipe and one does NOT feed the other. The event stream

package/src/dsn.test.ts

@@ -5,8 +5,8 @@ import { PRODUCT_PROJECT, dsnForProduct } from './dsn'
 import { parseDsn } from './sentry'
 
 const ENV = 'NEXT_PUBLIC_HANZO_EVENT_DSN'
-const OVERRIDE = 'https://1:aaaa@api.hanzo.ai/v1/sentry/env-project'
-const EXPLICIT = 'https://1:bbbb@api.hanzo.ai/v1/sentry/explicit-project'
+const OVERRIDE = 'https://1:aaaa@api.hanzo.ai/v1/event/env-project'
+const EXPLICIT = 'https://1:bbbb@api.hanzo.ai/v1/event/explicit-project'
 // A stand-in for the surface's own resolved key — the DSN carries whatever key
 // the caller resolved (config or the KMS-sourced env), never a literal.
 const KEY = 'pk-test-resolved-key'
@@ -18,10 +18,10 @@ afterEach(() => {
 describe('the product registry', () => {
   it('builds a product DSN from the CALLER key + the project — nothing baked', () => {
     expect(dsnForProduct('console', KEY)).toBe(
-      `https://${KEY}@api.hanzo.ai/v1/sentry/${PRODUCT_PROJECT.console}`
+      `https://${KEY}@api.hanzo.ai/v1/event/${PRODUCT_PROJECT.console}`
     )
     expect(dsnForProduct('site', KEY)).toBe(
-      `https://${KEY}@api.hanzo.ai/v1/sentry/${PRODUCT_PROJECT.site}`
+      `https://${KEY}@api.hanzo.ai/v1/event/${PRODUCT_PROJECT.site}`
     )
   })
 

package/src/dsn.ts

@@ -1,12 +1,12 @@
 /**
- * The product → Sentry DSN registry.
+ * The product → Sentinel DSN registry.
  *
  * An app declares WHAT it is (`product: 'console'`); this module knows WHERE its
  * errors go. That split is the whole point: no surface has to learn a DSN, carry
  * a build argument, or grow a config file to report errors — declaring the
  * product it already declares is enough.
  *
- * A Sentry DSN is PUBLIC by construction. It ships inside the client bundle and
+ * A Sentinel DSN is PUBLIC by construction. It ships inside the client bundle and
  * is readable in devtools on any deployed page, and it grants exactly one
  * capability: submitting new events. It cannot read issues, projects, or any
  * other data. So committing it is not leaking a secret — it is recording a public
@@ -20,11 +20,11 @@
  * exception table is the same data with a trap in it.
  *
  * Projects are org-scoped and named `<org>-<app>`. To add one: create the project
- * (POST /v1/sentry/projects with X-Org-Id), then add its `dsn` here keyed by the
+ * (POST /v1/sentinel/projects with X-Org-Id), then add its `dsn` here keyed by the
  * product name the app passes to `createAnalytics`.
  */
 
-/** PRODUCT_PROJECT maps a `product` to its Sentry project id. The DSN's KEY is no
+/** PRODUCT_PROJECT maps a `product` to its Sentinel project id. The DSN's KEY is no
  *  longer a per-project secret — it is the ONE org publishable key (below), so a
  *  surface's errors ride the SAME key its events do. The id only names WHICH
  *  project the errors group under, and cloud auto-provisions that project on first
@@ -37,7 +37,7 @@ export const PRODUCT_PROJECT: Readonly<Record<string, string>> = Object.freeze({
   site: '019f9b1e-5785-7359-ad0b-f75db8e58c99', // hanzo.ai (marketing; product `site`)
 })
 
-/** dsnForProduct builds the product's Sentry DSN from the caller's resolved
+/** dsnForProduct builds the product's Sentinel DSN from the caller's resolved
  *  publishable `key` and the product's project — the SAME key the event stream
  *  carries, at the product's envelope endpoint. Returns undefined when there is no
  *  key or no project for the product, leaving the error plane inert rather than
@@ -52,5 +52,5 @@ export function dsnForProduct(
   if (!product || !key) return undefined
   const projectId = PRODUCT_PROJECT[product]
   if (!projectId) return undefined
-  return `https://${key}@api.hanzo.ai/v1/sentry/${projectId}`
+  return `https://${key}@api.hanzo.ai/v1/event/${projectId}`
 }

package/src/sentry.test.ts

@@ -11,7 +11,7 @@ import {
 import type { SentryEvent, SentryFrame } from './types'
 import { VERSION } from './version'
 
-const DSN = 'https://1:deadbeefcafe@api.hanzo.ai/v1/sentry/00000000-0000-0000-0000-000000000000'
+const DSN = 'https://1:deadbeefcafe@api.hanzo.ai/v1/event/00000000-0000-0000-0000-000000000000'
 
 describe('parseDsn', () => {
   it('keeps the version:hmac key intact (does NOT split on the colon) and derives the ingest url', () => {
@@ -20,14 +20,14 @@ describe('parseDsn', () => {
     expect(dsn.origin).toBe('https://api.hanzo.ai')
     expect(dsn.projectId).toBe('00000000-0000-0000-0000-000000000000')
     expect(dsn.ingestUrl).toBe(
-      'https://api.hanzo.ai/v1/sentry/00000000-0000-0000-0000-000000000000/envelope/?sentry_key=1%3Adeadbeefcafe',
+      'https://api.hanzo.ai/v1/event/00000000-0000-0000-0000-000000000000/envelope/?sentry_key=1%3Adeadbeefcafe',
     )
   })
   it('returns null for malformed input (fail-safe)', () => {
     expect(parseDsn(undefined)).toBeNull()
     expect(parseDsn('')).toBeNull()
     expect(parseDsn('not-a-dsn')).toBeNull()
-    expect(parseDsn('https://api.hanzo.ai/v1/sentry/x')).toBeNull() // no key
+    expect(parseDsn('https://api.hanzo.ai/v1/event/x')).toBeNull() // no key
     expect(parseDsn('https://1:k@api.hanzo.ai')).toBeNull() // no project
   })
 })

package/src/sentry.ts

@@ -3,7 +3,7 @@
 // Analytics client (core.ts) wires these to identity + transport.
 //
 // The wire shapes are a from-scratch model of the PUBLIC, documented Sentry ingest
-// protocol (develop.sentry.dev), verified against the Hanzo /v1/sentry ingest
+// protocol (develop.sentry.dev), verified against the Hanzo /v1/event ingest
 // (o11y pkg/modules/errortracking/implerrortracking: parseEnvelope, SentryEvent,
 // normalizeEvent, computeFingerprint). No upstream (FSL) code is used.
 
@@ -44,7 +44,7 @@ function byteLen(s: string): number {
 }
 
 /**
- * parseDsn parses "https://<version>:<hmac>@<host>/v1/sentry/<projectId>" into its
+ * parseDsn parses "https://<version>:<hmac>@<host>/v1/event/<projectId>" into its
  * public key + the derived envelope ingest URL. The key (which itself contains a
  * ':') is taken verbatim as the userinfo — we do NOT split it as user:pass. The
  * key rides ?sentry_key= (not the DSN in the body) because that is the credential
@@ -64,10 +64,14 @@ export function parseDsn(dsn: string | undefined | null): Dsn | null {
   const projectId = segs.length > 0 ? segs[segs.length - 1] : ''
   if (!projectId) return null
   const origin = `${scheme}://${host}`
-  const ingestUrl =
-    `${origin}/v1/sentry/${encodeURIComponent(projectId)}/envelope/` +
-    `?sentry_key=${encodeURIComponent(publicKey)}`
-  return { publicKey, origin, projectId, ingestUrl }
+  // THE DSN'S OWN PATH IS THE ADDRESS — derived here, never restated. It used to
+  // be rebuilt as a literal, which threw away the path the DSN carried and wrote
+  // the ingest address a second time; buildEnvelope wrote it a third. Three copies
+  // of one fact. dsnForProduct (dsn.ts) is the ONE place it is spelled; this
+  // follows it.
+  const base = `${origin}/${segs.map(encodeURIComponent).join('/')}`
+  const ingestUrl = `${base}/envelope/?sentry_key=${encodeURIComponent(publicKey)}`
+  return { publicKey, origin, projectId, base, ingestUrl }
 }
 
 const V8_FRAME = /^\s*at\s+(?:(.+?)\s+\()?(?:(.+?):(\d+):(\d+)|([^)]+))\)?\s*$/
@@ -295,7 +299,7 @@ export function buildEnvelope(event: SentryEvent, dsn: Dsn, sentAt?: string): st
   const payload = JSON.stringify(event)
   const header = JSON.stringify({
     event_id: event.event_id,
-    dsn: `${dsn.origin}/v1/sentry/${dsn.projectId}`,
+    dsn: dsn.base,
     sent_at: sentAt ?? new Date().toISOString(),
   })
   const itemHeader = JSON.stringify({

package/src/types.ts

@@ -209,7 +209,7 @@ export interface AnalyticsConfig {
 
   // ── error plane (Sentry envelope -> sentry.hanzo.ai) ──────────────────────
 
-  /** Hanzo-minted Sentry DSN: "https://<version>:<hmac>@<host>/v1/sentry/<projectId>".
+  /** Hanzo-minted Sentry DSN: "https://<version>:<hmac>@<host>/v1/event/<projectId>".
    *  Publishable — the key authorizes writes to ONE project and can read nothing,
    *  so it is safe in a browser bundle (same trust class as `ingestKey`). When
    *  absent the client reads NEXT_PUBLIC_HANZO_EVENT_DSN; when neither is set the
@@ -278,6 +278,10 @@ export interface Dsn {
   origin: string
   /** Project id segment. */
   projectId: string
+  /** The DSN's own origin + path, e.g. "https://api.hanzo.ai/v1/event/<projectId>".
+   *  Every URL below is derived from this, so the ingest address is named once —
+   *  in dsnForProduct — and nowhere else. */
+  base: string
   /** Fully-derived envelope ingest URL incl. ?sentry_key=. */
   ingestUrl: string
 }

package/src/version.ts

@@ -1,4 +1,4 @@
 // The library version, stamped on every event (`libraryVersion`) and on the
 // Sentry `sdk` block. It lives alone so `sentry.ts` can read it without importing
 // `core.ts` — core imports sentry, so the reverse would be an import cycle.
-export const VERSION = '0.3.28'
+export const VERSION = '0.3.30'