@hanzo/event 0.3.33 → 0.3.35

package/README.md

@@ -30,21 +30,33 @@ starve the other:
 ### No bundler? Use the hosted tag
 
 ```html
-<script defer src="https://api.hanzo.ai/v1/event.js" data-key="pk-…"></script>
+<script defer src="https://api.hanzo.ai/v1/event/tag.js" data-key="pk-…"></script>
 ```
 
 That one line is the whole install, and it is the same line for a published site,
 hanzo.team and a customer's own page. The tag is served by the door that eats the
 events, so a caller allowlists ONE host and the tag can never drift from the wire
-it posts to. It adds DOM **autocapture** — `$click` (with an element locator),
-`$outbound`, `$scroll`, `$form`, `$vitals` — which a bundled app does not need and
-a plain page cannot get, and it carries the site's tag config from `/v1/tags`, so a
-pixel is configured on the project rather than pasted into the page.
+it posts to — `.js` is part of a segment rather than a child of one, so the tag
+sits UNDER `/v1/event` rather than beside it, and the old sibling `/v1/event.js`
+404s.
+
+It autocaptures pageviews — the first one and every SPA navigation, since
+`history.pushState` fires no event of its own — plus uncaught errors and rejected
+promises. Anything a page means on purpose goes through `window.hanzo`
+(`track`, `identify`, `page`, `error`, `flush`). It also carries the site's tag
+config from `/v1/projects/tags`, so a pixel is configured on the project rather
+than pasted into the page.
+
+> A bundled app should NOT add this tag. Both clients post pageviews to the same
+> door, so a page running `@hanzo/event` and the tag counts every pageview twice.
+> One surface, one client.
 
 > **`data-key` is a publishable `pk-`, and without one the tag is INERT.** A write
 > the door cannot attribute is refused (`401 ingest_key_required`) silently, so a
-> keyless tag measures fine in the browser and files nothing. Mint one with
-> `POST /v1/keys {"type":"publishable"}`.
+> keyless tag measures fine in the browser and files nothing. A project mints one
+> with itself: `POST /v1/projects`. A key that names no project is refused
+> `403 ingest_key_unknown` — the door fails closed rather than filing a write it
+> cannot attribute.
 
 This package is the client for a surface that **builds**. There is no second
 script-tag distribution here: one wire, one door, one tag.

package/dist/index.cjs

@@ -91,6 +91,56 @@ function dsnForProduct(product, key) {
   return `https://${key}@api.hanzo.ai/v1/event/${projectId}`;
 }
 
+// src/org.ts
+var ORG_DOMAIN = Object.freeze({
+  hanzo: Object.freeze(["hanzo.ai", "hanzo.app", "hanzo.chat", "hanzo.id", "hanzo.bot", "hanzo.sh"]),
+  lux: Object.freeze([
+    "lux.network",
+    "lux.exchange",
+    "lux.market",
+    "lux.finance",
+    "lux.financial",
+    "lux.credit",
+    "lux.fund",
+    "lux.id"
+  ]),
+  zoo: Object.freeze(["zoo.ngo", "zoo.network", "zoolabs.id"])
+});
+var ORG_KEY = Object.freeze({
+  hanzo: "pk-rM_CdaF2MQckGCrla113SrR1oH4zvqN8xh2I95Z9tY8",
+  lux: "pk-gUZp6ZVfhJzSwK-rb4oLbVkpCnMBx5uSCpxf_5yEhQk",
+  zoo: "pk-3TKpKnERV9AQSsBUERWkZejC1O1mUxc1jRzsP3MPbs4"
+});
+var PUBLISHABLE = "pk-";
+var normalize = (host) => host.trim().toLowerCase().replace(/\.$/, "").split(":")[0] ?? "";
+function orgOf(host) {
+  const h = normalize(host);
+  if (!h) return void 0;
+  let best;
+  let bestLen = 0;
+  for (const [org, domains] of Object.entries(ORG_DOMAIN)) {
+    for (const d of domains) {
+      if ((h === d || h.endsWith(`.${d}`)) && d.length > bestLen) {
+        best = org;
+        bestLen = d.length;
+      }
+    }
+  }
+  return best;
+}
+function keyFor(host, keyring = ORG_KEY) {
+  const org = orgOf(host);
+  if (!org) return void 0;
+  const key = keyring[org];
+  if (typeof key !== "string") return void 0;
+  const trimmed = key.trim();
+  return trimmed.startsWith(PUBLISHABLE) ? trimmed : void 0;
+}
+function keyForPage(keyring = ORG_KEY) {
+  if (typeof location === "undefined") return void 0;
+  return keyFor(location.hostname, keyring);
+}
+
 // src/scrub.ts
 var REDACTED = "[redacted]";
 var EMAIL_MARK = "[email]";
@@ -212,8 +262,8 @@ function scrubText(s, capturePII = false) {
 }
 
 // src/anon.js
-var HZ_ANON_KEY = "hz_anon_id";
-var HZ_ANON_LEGACY_KEY = "hz_id";
+var HZ_ANON_KEY = "iam-anon-id";
+var HZ_ANON_ADOPT = ["hz_anon_id", "hz_id"];
 var HZ_ANON_DOMAIN = "hanzo.ai";
 var HZ_ANON_MAX_AGE = 2 * 365 * 24 * 60 * 60;
 var hzAnonMemo;
@@ -300,10 +350,17 @@ function hzAnonWrite(name, value) {
   } catch (e) {
   }
 }
+function hzAnonAdopted(s) {
+  for (var i = 0; i < HZ_ANON_ADOPT.length; i++) {
+    var id = hzAnonCookie(HZ_ANON_ADOPT[i]) || hzAnonItem(s, HZ_ANON_ADOPT[i]);
+    if (id) return id;
+  }
+  return "";
+}
 function hzAnonId() {
   if (typeof window === "undefined") return "";
   var s = hzAnonStore();
-  var id = hzAnonCookie(HZ_ANON_KEY) || hzAnonItem(s, HZ_ANON_KEY) || hzAnonItem(s, HZ_ANON_LEGACY_KEY) || hzAnonMemo || hzUuidv7();
+  var id = hzAnonCookie(HZ_ANON_KEY) || hzAnonItem(s, HZ_ANON_KEY) || hzAnonAdopted(s) || hzAnonMemo || hzUuidv7();
   hzAnonMemo = id;
   hzAnonWrite(HZ_ANON_KEY, id);
   try {
@@ -319,7 +376,7 @@ function uuidv7Time(id) {
 }
 
 // src/version.ts
-var VERSION = "0.3.33";
+var VERSION = "0.3.35";
 
 // src/sentry.ts
 var MAX_FRAMES = 50;
@@ -781,12 +838,20 @@ var Analytics = class {
       //      carries end to end — KMS `deploy/PUBLISHABLE_KEY` -> the PUBLISHABLE_KEY
       //      build-arg -> the NEXT_PUBLIC_ prefix Next inlines.
       //
-      // A surface that provides neither has no key, and its anonymous traffic
-      // files under `$public` (which drops track/identify/group and answers 200);
-      // the fix is to give it the KMS-sourced env, not to hardcode the org key
-      // here. The key is a credential-class value: its home is KMS, and the ONE
-      // build reads it from there.
-      ingestKey: config.ingestKey ?? readEnv("NEXT_PUBLIC_PUBLISHABLE_KEY")
+      //   3. the org that owns the HOST this page is served from (`org.ts`).
+      //
+      // Step 3 fires only when a surface configured NOTHING, so it never overrides
+      // the KMS chain above — it replaces going dark with reporting to the right
+      // brand. That is what a static export needs: `output: export` inlines no env,
+      // so before this the only way to report was to commit a key literal, and the
+      // fleet grew one copy per site of a value with a single source.
+      //
+      // A surface no brand claims still has no key, and the door REFUSES an
+      // unattributed event (401 `ingest_key_required`) — the reserved `$public`
+      // tenant that once caught keyless beacons is retired, and anonymous ingest is
+      // refused at every door on every brand host. So there is no quiet fallback to
+      // rely on: an event lands in the org a credential names, or it does not land.
+      ingestKey: config.ingestKey ?? readEnv("NEXT_PUBLIC_PUBLISHABLE_KEY") ?? keyForPage()
     };
     this.transport = config.transport ?? new DefaultTransport();
     this.dsn = parseDsn(
@@ -1159,6 +1224,8 @@ Object.defineProperty(exports, "eventsOf", {
 exports.Analytics = Analytics;
 exports.COHORTS = COHORTS;
 exports.GOALS = GOALS;
+exports.ORG_DOMAIN = ORG_DOMAIN;
+exports.ORG_KEY = ORG_KEY;
 exports.PRODUCT_PROJECT = PRODUCT_PROJECT;
 exports.VERSION = VERSION;
 exports.buildEnvelope = buildEnvelope;
@@ -1176,6 +1243,9 @@ exports.getFirstTouch = getFirstTouch;
 exports.hasAttribution = hasAttribution;
 exports.hostOf = hostOf;
 exports.isoWeek = isoWeek;
+exports.keyFor = keyFor;
+exports.keyForPage = keyForPage;
+exports.orgOf = orgOf;
 exports.parseAttribution = parseAttribution;
 exports.parseDsn = parseDsn;
 exports.redactSecrets = redactSecrets;