@hanzo/event 0.3.32 → 0.3.33

package/README.md

@@ -27,29 +27,27 @@ starve the other:
 > plane is **inert**: nothing is sent, nothing throws, analytics is unaffected.
 > Assert `client.errorPlaneEnabled` if you want to know which you have.
 
-### No bundler? Use the `hz.js` tag — same client, same wire
+### No bundler? Use the hosted tag
 
 ```html
-<script async src="https://unpkg.com/@hanzo/event/hz.js"
-        data-product="hanzo.ai"
-        data-ingest-key="pk-…"
-        data-capture="1"></script>
+<script defer src="https://api.hanzo.ai/v1/event.js" data-key="pk-…"></script>
 ```
 
-> **`data-ingest-key` is required off the door's own origin**, and through
-> 0.3.11 this file could not present one at all — no header, no query. A keyed
-> static surface therefore sent UNATTRIBUTED writes, which the door refuses
-> (`401 ingest_key_required`) silently, because nothing here reads the response.
-> The tag measured fine in the browser and filed nothing. It now rides
-> `Authorization: Bearer pk-…` on fetch and `?ingest_key=pk-…` on a headerless
-> unload beacon — the same pair the npm client uses.
-
-`hz.js` (in this package) is the **script-tag distribution** of this client, for
-surfaces with no build step. It posts the SAME `{ batch: [WireEvent, …] }` to the
-SAME `POST {host}/v1/event`, and adds DOM **autocapture** — `$click` (with an
-element locator), `$outbound`, `$scroll`, `$form`, `$vitals` — which a bundled app
-does not need and a plain page cannot get. Manual API: `window.hanzo.track()` /
-`identify()` / `page()`.
+That one line is the whole install, and it is the same line for a published site,
+hanzo.team and a customer's own page. The tag is served by the door that eats the
+events, so a caller allowlists ONE host and the tag can never drift from the wire
+it posts to. It adds DOM **autocapture** — `$click` (with an element locator),
+`$outbound`, `$scroll`, `$form`, `$vitals` — which a bundled app does not need and
+a plain page cannot get, and it carries the site's tag config from `/v1/tags`, so a
+pixel is configured on the project rather than pasted into the page.
+
+> **`data-key` is a publishable `pk-`, and without one the tag is INERT.** A write
+> the door cannot attribute is refused (`401 ingest_key_required`) silently, so a
+> keyless tag measures fine in the browser and files nothing. Mint one with
+> `POST /v1/keys {"type":"publishable"}`.
+
+This package is the client for a surface that **builds**. There is no second
+script-tag distribution here: one wire, one door, one tag.
 
 It honours the same consent sources the bundled stack does: an explicit stored
 choice (`hz_consent`, the key a Hanzo consent banner writes) outranks the browser

package/dist/index.cjs

@@ -319,7 +319,7 @@ function uuidv7Time(id) {
 }
 
 // src/version.ts
-var VERSION = "0.3.32";
+var VERSION = "0.3.33";
 
 // src/sentry.ts
 var MAX_FRAMES = 50;
@@ -1110,26 +1110,26 @@ var COHORTS = {
   channel: { field: "channel", label: "Acquisition channel" },
   refCode: { field: "ref_code", label: "Referral code" }
 };
-/*! anon.js — THE anonymous-identity chain. ONE implementation, three distributions.
+/*! anon.js — THE anonymous-identity chain. ONE implementation, two distributions.
  *
  * One browser is ONE person on every Hanzo surface, whichever client a page
- * happens to have loaded. There were three implementations writing TWO keys —
- * `hz_anon_id` (the npm client, the hosted tag) and `hz_id` (hz.js) — so the same
- * visitor was several people depending on which snippet the surface shipped.
+ * happens to have loaded. There were once three implementations writing TWO keys —
+ * `hz_anon_id` and `hz_id` — so the same visitor was several people depending on
+ * which snippet the surface shipped.
  *
- * The three call sites:
+ * The two call sites:
  *   1. src/storage.ts        — the bundled npm client; IMPORTS this file.
- *   2. hz.js                 — the no-build script tag; INLINES the marked region.
- *   3. hanzoai/cloud apps/analytics/tag.js — the tag the door hosts at
+ *   2. hanzoai/cloud apps/analytics/tag.js — the tag the door hosts at
  *      /v1/event.js; vendors this file and its tag.go serves the marked region
  *      with the tag as one asset, so the door holds no second copy either.
  *
- * (2) and (3) have no bundler and cannot import anything, which is why the chain
- * lives in a file that is plain ES5 rather than in a .ts: the region between the
- * BEGIN and END markers is COPIED VERBATIM, and src/anon.test.ts fails if hz.js's
- * copy is so much as a byte different. Keep the region ES5, dependency-free,
- * `hz`-prefixed (it is spliced into other people's scopes) and unformatted — a
- * reformat of one copy is a diff against the other.
+ * (2) has no bundler and cannot import anything, which is why the chain lives in a
+ * file that is plain ES5 rather than in a .ts: the region between the BEGIN and END
+ * markers is COPIED VERBATIM. Keep it ES5, dependency-free, `hz`-prefixed (it is
+ * spliced into other people's scopes) and unformatted — a reformat here is a diff
+ * against the vendored copy. After editing, resync the door:
+ *
+ *   curl -fsSL https://unpkg.com/@hanzo/event/src/anon.js -o apps/analytics/anon.js
  */
 
 Object.defineProperty(exports, "EVENTS", {