@hanzo/event 0.3.32 → 0.3.34

package/dist/index.d.cts

@@ -8,7 +8,7 @@ declare function getFirstTouch(): Attribution | undefined;
 /** Read persisted cohort dimensions. */
 declare function getCohort(): Cohort | undefined;
 
-declare const VERSION = "0.3.32";
+declare const VERSION = "0.3.34";
 
 /**
  * parseDsn parses "https://<version>:<hmac>@<host>/v1/event/<projectId>" into its
@@ -63,7 +63,7 @@ declare function buildSentryEvent(input: BuildEventInput): SentryEvent;
 declare function buildEnvelope(event: SentryEvent, dsn: Dsn, sentAt?: string): string;
 
 // Types for anon.js, which is hand-written ES5 rather than TypeScript because
-// hz.js and the door's hosted tag inline it VERBATIM and neither has a compiler.
+// The door's hosted tag inlines it VERBATIM and has no compiler.
 // The declarations are here so the bundled client still imports it typed.
 
 /** Mints a time-ordered UUIDv7 (RFC 9562 §5.7) for `now` in epoch milliseconds. */
@@ -215,4 +215,78 @@ declare function hasAttribution(a: Attribution): boolean;
 /** isoWeek returns the ISO-8601 week label, e.g. "2026-W28". */
 declare function isoWeek(d: Date): string;
 
-export { Attribution, COHORTS, CaptureErrorOptions, Cohort, type CohortDef, Dsn, type ErrorIdentity, ExceptionEntry, ExceptionProperties, GOALS, type GoalDef, PRODUCT_PROJECT, SentryEvent, SentryFrame, SentryLevel, VERSION, buildEnvelope, buildSentryEvent, deriveChannel, digest, dsnForProduct, exceptionEntry, exceptionProperties, fingerprint, framesFromStack, getCohort, getFirstTouch, hasAttribution, hostOf, isoWeek, parseAttribution, parseDsn, redactSecrets, scrubPII, scrubText, hzUuidv7 as uuidv7, uuidv7Time };
+/**
+ * Which org owns a host's telemetry.
+ *
+ * A surface should not have to LEARN its key. It already knows the domain it is
+ * served from, and a domain belongs to exactly one brand, so the key is derivable
+ * and asking a surface to carry one is asking it to restate something already
+ * true. This module answers `orgOf(location.hostname)` and hands back that org's
+ * publishable key, which is what lets a static export report correctly while
+ * configuring nothing.
+ *
+ * This is the SAME question `hanzo.id` answers at runtime for the identity hosts
+ * (`pkgs/shared/src/ingest.ts`): one image serves every brand, so the key cannot
+ * be a property of the build. It was, and the bill is on record — Lux's, Zoo's,
+ * Osage's and Pars' visitors were all filed in HANZO's project, because one
+ * build-time key was inlined for every brand. That is the white-label boundary
+ * crossed in the direction that shows up latest. The marketing sites carry the
+ * identical defect in its other form: each commits its OWN key literal, so the
+ * fleet holds N copies of a value with one source, and a site added tomorrow
+ * reports nothing until somebody remembers to paste one in.
+ *
+ * A `pk-` is PUBLISHABLE: it authorizes a write into one org and mints no reading
+ * principal. It is readable in devtools on every deployed page that sends an
+ * event, so stating it here exposes nothing that serving the page did not. What
+ * it does buy is that correct attribution becomes the DEFAULT rather than
+ * something each surface opts into.
+ *
+ * Keyed by ORG, never by host: a brand's facts repeat on every alias it owns
+ * (`lux.id`, `id.lux.network`), and a key stated per host would have to be
+ * repeated too — so the day someone adds an alias and forgets the key, that host
+ * silently stops reporting. Stated once per org, a new alias inherits its brand's
+ * key by naming its brand's domain, which is all an alias ever says.
+ */
+/** One publishable key per org. */
+type Keyring = Readonly<Record<string, string>>;
+/**
+ * Each org's registrable domains. A host matches a domain when it IS that domain
+ * or a subdomain of it, so `explore.lux.network` needs no entry of its own.
+ *
+ * An org absent from this table resolves to undefined, and that is deliberate:
+ * `osage`, `pars` and `bootnode` have no project of their own yet, and reporting
+ * NOTHING is the honest answer. Filing them under a brand that is not theirs is
+ * the defect this module exists to prevent — it is silent, it reads as working,
+ * and it is only visible later in someone else's warehouse.
+ */
+declare const ORG_DOMAIN: Readonly<Record<string, readonly string[]>>;
+/**
+ * Each org's publishable key — the same values `universe`'s `SPA_INGEST_KEYRING`
+ * serves to the identity hosts, which are each brand's own insights team token.
+ * Add an org here the day its project exists, never before.
+ */
+declare const ORG_KEY: Keyring;
+/**
+ * The org that owns a host, or undefined when no brand claims it.
+ *
+ * Longest match wins, so a brand owning both a domain and a subdomain of another
+ * brand's cannot be decided by table order. Pure and total.
+ */
+declare function orgOf(host: string): string | undefined;
+/**
+ * The publishable key for a host, or undefined when there is not exactly one to
+ * give.
+ *
+ * Deliberately WITHOUT a fallback: returning Hanzo's key for an unrecognised host
+ * is precisely the defect described above. Undefined is the honest answer and the
+ * caller reports nothing.
+ *
+ * `keyring` is a parameter so the identity runtime — which receives its keyring
+ * from `/config.json` because one image serves every brand — resolves through
+ * this SAME function rather than a second copy of it.
+ */
+declare function keyFor(host: string, keyring?: Keyring): string | undefined;
+/** The key for the page this code is running on; undefined off a browser. */
+declare function keyForPage(keyring?: Keyring): string | undefined;
+
+export { Attribution, COHORTS, CaptureErrorOptions, Cohort, type CohortDef, Dsn, type ErrorIdentity, ExceptionEntry, ExceptionProperties, GOALS, type GoalDef, type Keyring, ORG_DOMAIN, ORG_KEY, PRODUCT_PROJECT, SentryEvent, SentryFrame, SentryLevel, VERSION, buildEnvelope, buildSentryEvent, deriveChannel, digest, dsnForProduct, exceptionEntry, exceptionProperties, fingerprint, framesFromStack, getCohort, getFirstTouch, hasAttribution, hostOf, isoWeek, keyFor, keyForPage, orgOf, parseAttribution, parseDsn, redactSecrets, scrubPII, scrubText, hzUuidv7 as uuidv7, uuidv7Time };

package/dist/index.d.ts

@@ -8,7 +8,7 @@ declare function getFirstTouch(): Attribution | undefined;
 /** Read persisted cohort dimensions. */
 declare function getCohort(): Cohort | undefined;
 
-declare const VERSION = "0.3.32";
+declare const VERSION = "0.3.34";
 
 /**
  * parseDsn parses "https://<version>:<hmac>@<host>/v1/event/<projectId>" into its
@@ -63,7 +63,7 @@ declare function buildSentryEvent(input: BuildEventInput): SentryEvent;
 declare function buildEnvelope(event: SentryEvent, dsn: Dsn, sentAt?: string): string;
 
 // Types for anon.js, which is hand-written ES5 rather than TypeScript because
-// hz.js and the door's hosted tag inline it VERBATIM and neither has a compiler.
+// The door's hosted tag inlines it VERBATIM and has no compiler.
 // The declarations are here so the bundled client still imports it typed.
 
 /** Mints a time-ordered UUIDv7 (RFC 9562 §5.7) for `now` in epoch milliseconds. */
@@ -215,4 +215,78 @@ declare function hasAttribution(a: Attribution): boolean;
 /** isoWeek returns the ISO-8601 week label, e.g. "2026-W28". */
 declare function isoWeek(d: Date): string;
 
-export { Attribution, COHORTS, CaptureErrorOptions, Cohort, type CohortDef, Dsn, type ErrorIdentity, ExceptionEntry, ExceptionProperties, GOALS, type GoalDef, PRODUCT_PROJECT, SentryEvent, SentryFrame, SentryLevel, VERSION, buildEnvelope, buildSentryEvent, deriveChannel, digest, dsnForProduct, exceptionEntry, exceptionProperties, fingerprint, framesFromStack, getCohort, getFirstTouch, hasAttribution, hostOf, isoWeek, parseAttribution, parseDsn, redactSecrets, scrubPII, scrubText, hzUuidv7 as uuidv7, uuidv7Time };
+/**
+ * Which org owns a host's telemetry.
+ *
+ * A surface should not have to LEARN its key. It already knows the domain it is
+ * served from, and a domain belongs to exactly one brand, so the key is derivable
+ * and asking a surface to carry one is asking it to restate something already
+ * true. This module answers `orgOf(location.hostname)` and hands back that org's
+ * publishable key, which is what lets a static export report correctly while
+ * configuring nothing.
+ *
+ * This is the SAME question `hanzo.id` answers at runtime for the identity hosts
+ * (`pkgs/shared/src/ingest.ts`): one image serves every brand, so the key cannot
+ * be a property of the build. It was, and the bill is on record — Lux's, Zoo's,
+ * Osage's and Pars' visitors were all filed in HANZO's project, because one
+ * build-time key was inlined for every brand. That is the white-label boundary
+ * crossed in the direction that shows up latest. The marketing sites carry the
+ * identical defect in its other form: each commits its OWN key literal, so the
+ * fleet holds N copies of a value with one source, and a site added tomorrow
+ * reports nothing until somebody remembers to paste one in.
+ *
+ * A `pk-` is PUBLISHABLE: it authorizes a write into one org and mints no reading
+ * principal. It is readable in devtools on every deployed page that sends an
+ * event, so stating it here exposes nothing that serving the page did not. What
+ * it does buy is that correct attribution becomes the DEFAULT rather than
+ * something each surface opts into.
+ *
+ * Keyed by ORG, never by host: a brand's facts repeat on every alias it owns
+ * (`lux.id`, `id.lux.network`), and a key stated per host would have to be
+ * repeated too — so the day someone adds an alias and forgets the key, that host
+ * silently stops reporting. Stated once per org, a new alias inherits its brand's
+ * key by naming its brand's domain, which is all an alias ever says.
+ */
+/** One publishable key per org. */
+type Keyring = Readonly<Record<string, string>>;
+/**
+ * Each org's registrable domains. A host matches a domain when it IS that domain
+ * or a subdomain of it, so `explore.lux.network` needs no entry of its own.
+ *
+ * An org absent from this table resolves to undefined, and that is deliberate:
+ * `osage`, `pars` and `bootnode` have no project of their own yet, and reporting
+ * NOTHING is the honest answer. Filing them under a brand that is not theirs is
+ * the defect this module exists to prevent — it is silent, it reads as working,
+ * and it is only visible later in someone else's warehouse.
+ */
+declare const ORG_DOMAIN: Readonly<Record<string, readonly string[]>>;
+/**
+ * Each org's publishable key — the same values `universe`'s `SPA_INGEST_KEYRING`
+ * serves to the identity hosts, which are each brand's own insights team token.
+ * Add an org here the day its project exists, never before.
+ */
+declare const ORG_KEY: Keyring;
+/**
+ * The org that owns a host, or undefined when no brand claims it.
+ *
+ * Longest match wins, so a brand owning both a domain and a subdomain of another
+ * brand's cannot be decided by table order. Pure and total.
+ */
+declare function orgOf(host: string): string | undefined;
+/**
+ * The publishable key for a host, or undefined when there is not exactly one to
+ * give.
+ *
+ * Deliberately WITHOUT a fallback: returning Hanzo's key for an unrecognised host
+ * is precisely the defect described above. Undefined is the honest answer and the
+ * caller reports nothing.
+ *
+ * `keyring` is a parameter so the identity runtime — which receives its keyring
+ * from `/config.json` because one image serves every brand — resolves through
+ * this SAME function rather than a second copy of it.
+ */
+declare function keyFor(host: string, keyring?: Keyring): string | undefined;
+/** The key for the page this code is running on; undefined off a browser. */
+declare function keyForPage(keyring?: Keyring): string | undefined;
+
+export { Attribution, COHORTS, CaptureErrorOptions, Cohort, type CohortDef, Dsn, type ErrorIdentity, ExceptionEntry, ExceptionProperties, GOALS, type GoalDef, type Keyring, ORG_DOMAIN, ORG_KEY, PRODUCT_PROJECT, SentryEvent, SentryFrame, SentryLevel, VERSION, buildEnvelope, buildSentryEvent, deriveChannel, digest, dsnForProduct, exceptionEntry, exceptionProperties, fingerprint, framesFromStack, getCohort, getFirstTouch, hasAttribution, hostOf, isoWeek, keyFor, keyForPage, orgOf, parseAttribution, parseDsn, redactSecrets, scrubPII, scrubText, hzUuidv7 as uuidv7, uuidv7Time };

package/dist/index.mjs

@@ -90,6 +90,56 @@ function dsnForProduct(product, key) {
   return `https://${key}@api.hanzo.ai/v1/event/${projectId}`;
 }
 
+// src/org.ts
+var ORG_DOMAIN = Object.freeze({
+  hanzo: Object.freeze(["hanzo.ai", "hanzo.app", "hanzo.chat", "hanzo.id", "hanzo.bot", "hanzo.sh"]),
+  lux: Object.freeze([
+    "lux.network",
+    "lux.exchange",
+    "lux.market",
+    "lux.finance",
+    "lux.financial",
+    "lux.credit",
+    "lux.fund",
+    "lux.id"
+  ]),
+  zoo: Object.freeze(["zoo.ngo", "zoo.network", "zoolabs.id"])
+});
+var ORG_KEY = Object.freeze({
+  hanzo: "pk-rM_CdaF2MQckGCrla113SrR1oH4zvqN8xh2I95Z9tY8",
+  lux: "pk-gUZp6ZVfhJzSwK-rb4oLbVkpCnMBx5uSCpxf_5yEhQk",
+  zoo: "pk-3TKpKnERV9AQSsBUERWkZejC1O1mUxc1jRzsP3MPbs4"
+});
+var PUBLISHABLE = "pk-";
+var normalize = (host) => host.trim().toLowerCase().replace(/\.$/, "").split(":")[0] ?? "";
+function orgOf(host) {
+  const h = normalize(host);
+  if (!h) return void 0;
+  let best;
+  let bestLen = 0;
+  for (const [org, domains] of Object.entries(ORG_DOMAIN)) {
+    for (const d of domains) {
+      if ((h === d || h.endsWith(`.${d}`)) && d.length > bestLen) {
+        best = org;
+        bestLen = d.length;
+      }
+    }
+  }
+  return best;
+}
+function keyFor(host, keyring = ORG_KEY) {
+  const org = orgOf(host);
+  if (!org) return void 0;
+  const key = keyring[org];
+  if (typeof key !== "string") return void 0;
+  const trimmed = key.trim();
+  return trimmed.startsWith(PUBLISHABLE) ? trimmed : void 0;
+}
+function keyForPage(keyring = ORG_KEY) {
+  if (typeof location === "undefined") return void 0;
+  return keyFor(location.hostname, keyring);
+}
+
 // src/scrub.ts
 var REDACTED = "[redacted]";
 var EMAIL_MARK = "[email]";
@@ -211,8 +261,8 @@ function scrubText(s, capturePII = false) {
 }
 
 // src/anon.js
-var HZ_ANON_KEY = "hz_anon_id";
-var HZ_ANON_LEGACY_KEY = "hz_id";
+var HZ_ANON_KEY = "iam-anon-id";
+var HZ_ANON_ADOPT = ["hz_anon_id", "hz_id"];
 var HZ_ANON_DOMAIN = "hanzo.ai";
 var HZ_ANON_MAX_AGE = 2 * 365 * 24 * 60 * 60;
 var hzAnonMemo;
@@ -299,10 +349,17 @@ function hzAnonWrite(name, value) {
   } catch (e) {
   }
 }
+function hzAnonAdopted(s) {
+  for (var i = 0; i < HZ_ANON_ADOPT.length; i++) {
+    var id = hzAnonCookie(HZ_ANON_ADOPT[i]) || hzAnonItem(s, HZ_ANON_ADOPT[i]);
+    if (id) return id;
+  }
+  return "";
+}
 function hzAnonId() {
   if (typeof window === "undefined") return "";
   var s = hzAnonStore();
-  var id = hzAnonCookie(HZ_ANON_KEY) || hzAnonItem(s, HZ_ANON_KEY) || hzAnonItem(s, HZ_ANON_LEGACY_KEY) || hzAnonMemo || hzUuidv7();
+  var id = hzAnonCookie(HZ_ANON_KEY) || hzAnonItem(s, HZ_ANON_KEY) || hzAnonAdopted(s) || hzAnonMemo || hzUuidv7();
   hzAnonMemo = id;
   hzAnonWrite(HZ_ANON_KEY, id);
   try {
@@ -318,7 +375,7 @@ function uuidv7Time(id) {
 }
 
 // src/version.ts
-var VERSION = "0.3.32";
+var VERSION = "0.3.34";
 
 // src/sentry.ts
 var MAX_FRAMES = 50;
@@ -780,12 +837,20 @@ var Analytics = class {
       //      carries end to end — KMS `deploy/PUBLISHABLE_KEY` -> the PUBLISHABLE_KEY
       //      build-arg -> the NEXT_PUBLIC_ prefix Next inlines.
       //
-      // A surface that provides neither has no key, and its anonymous traffic
-      // files under `$public` (which drops track/identify/group and answers 200);
-      // the fix is to give it the KMS-sourced env, not to hardcode the org key
-      // here. The key is a credential-class value: its home is KMS, and the ONE
-      // build reads it from there.
-      ingestKey: config.ingestKey ?? readEnv("NEXT_PUBLIC_PUBLISHABLE_KEY")
+      //   3. the org that owns the HOST this page is served from (`org.ts`).
+      //
+      // Step 3 fires only when a surface configured NOTHING, so it never overrides
+      // the KMS chain above — it replaces going dark with reporting to the right
+      // brand. That is what a static export needs: `output: export` inlines no env,
+      // so before this the only way to report was to commit a key literal, and the
+      // fleet grew one copy per site of a value with a single source.
+      //
+      // A surface no brand claims still has no key, and the door REFUSES an
+      // unattributed event (401 `ingest_key_required`) — the reserved `$public`
+      // tenant that once caught keyless beacons is retired, and anonymous ingest is
+      // refused at every door on every brand host. So there is no quiet fallback to
+      // rely on: an event lands in the org a credential names, or it does not land.
+      ingestKey: config.ingestKey ?? readEnv("NEXT_PUBLIC_PUBLISHABLE_KEY") ?? keyForPage()
     };
     this.transport = config.transport ?? new DefaultTransport();
     this.dsn = parseDsn(
@@ -1109,28 +1174,28 @@ var COHORTS = {
   channel: { field: "channel", label: "Acquisition channel" },
   refCode: { field: "ref_code", label: "Referral code" }
 };
-/*! anon.js — THE anonymous-identity chain. ONE implementation, three distributions.
+/*! anon.js — THE anonymous-identity chain. ONE implementation, two distributions.
  *
  * One browser is ONE person on every Hanzo surface, whichever client a page
- * happens to have loaded. There were three implementations writing TWO keys —
- * `hz_anon_id` (the npm client, the hosted tag) and `hz_id` (hz.js) — so the same
- * visitor was several people depending on which snippet the surface shipped.
+ * happens to have loaded. There were once three implementations writing TWO keys —
+ * `hz_anon_id` and `hz_id` — so the same visitor was several people depending on
+ * which snippet the surface shipped.
  *
- * The three call sites:
+ * The two call sites:
  *   1. src/storage.ts        — the bundled npm client; IMPORTS this file.
- *   2. hz.js                 — the no-build script tag; INLINES the marked region.
- *   3. hanzoai/cloud apps/analytics/tag.js — the tag the door hosts at
+ *   2. hanzoai/cloud apps/analytics/tag.js — the tag the door hosts at
  *      /v1/event.js; vendors this file and its tag.go serves the marked region
  *      with the tag as one asset, so the door holds no second copy either.
  *
- * (2) and (3) have no bundler and cannot import anything, which is why the chain
- * lives in a file that is plain ES5 rather than in a .ts: the region between the
- * BEGIN and END markers is COPIED VERBATIM, and src/anon.test.ts fails if hz.js's
- * copy is so much as a byte different. Keep the region ES5, dependency-free,
- * `hz`-prefixed (it is spliced into other people's scopes) and unformatted — a
- * reformat of one copy is a diff against the other.
+ * (2) has no bundler and cannot import anything, which is why the chain lives in a
+ * file that is plain ES5 rather than in a .ts: the region between the BEGIN and END
+ * markers is COPIED VERBATIM. Keep it ES5, dependency-free, `hz`-prefixed (it is
+ * spliced into other people's scopes) and unformatted — a reformat here is a diff
+ * against the vendored copy. After editing, resync the door:
+ *
+ *   curl -fsSL https://unpkg.com/@hanzo/event/src/anon.js -o apps/analytics/anon.js
  */
 
-export { Analytics, COHORTS, GOALS, PRODUCT_PROJECT, VERSION, buildEnvelope, buildSentryEvent, createAnalytics, deriveChannel, digest, dsnForProduct, exceptionEntry, exceptionProperties, fingerprint, framesFromStack, getCohort, getFirstTouch, hasAttribution, hostOf, isoWeek, parseAttribution, parseDsn, redactSecrets, scrubPII, scrubText, hzUuidv7 as uuidv7, uuidv7Time };
+export { Analytics, COHORTS, GOALS, ORG_DOMAIN, ORG_KEY, PRODUCT_PROJECT, VERSION, buildEnvelope, buildSentryEvent, createAnalytics, deriveChannel, digest, dsnForProduct, exceptionEntry, exceptionProperties, fingerprint, framesFromStack, getCohort, getFirstTouch, hasAttribution, hostOf, isoWeek, keyFor, keyForPage, orgOf, parseAttribution, parseDsn, redactSecrets, scrubPII, scrubText, hzUuidv7 as uuidv7, uuidv7Time };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map