@hanzo/event 0.3.44 → 0.3.49

package/src/core.ts

@@ -7,21 +7,10 @@
 //      Cloud resolves the tenant server-side (validated session, or the signed
 //      publishable key) and stamps it; the client NEVER sends the org.
 //
-//   2. ERROR PLANE — every captured exception is ALSO framed as a real Sentry
-//      envelope and POSTed to the error host named by the DSN:
-//        POST {dsn.base}/envelope/?sentry_key=…   ({base} = /v1/event/{projectId})
-//      This is what reaches sentry.hanzo.ai (issues, grouping, stack frames).
-//
-// These are NOT the same pipe and one does NOT feed the other. The event stream
-// stores a `type:'error'` row in the cloud event warehouse (readable via
-// GET /v1/errors) — that is product signal, not error tracking. There is no
-// server-side fan-out from /v1/event into Sentry; without the envelope below,
-// nothing ever reaches sentry.hanzo.ai. An earlier revision of this file claimed
-// the one entry point was "lensed server-side into … error tracking (sentry)". It was
-// wrong, and it silently cost the fleet all of its error telemetry.
-//
-// The error plane is inert (fail-safe) when no DSN is configured: nothing is
-// sent, nothing throws, and the event stream is unaffected.
+//   Errors ride the same pipe: a captured exception is ONE event of type 'error'
+//   carrying {type, message, frames|stack, handled} plus release, environment,
+//   site, product and level. The server files it on the error plane and groups it
+//   into an issue. There is no second endpoint, DSN or envelope.
 //
 // Auth is orthogonal — the SAME body to the SAME endpoint, differing only in how the
 // caller proves its tenant:
@@ -34,29 +23,17 @@
 //     is the carrier neither send needs a header for, which is what keeps both
 //     CORS-simple and therefore sendable from a customer's own origin.
 //
-// The wire is the canonical `Event` (== the cloud CaptureEvent): its `type` field
-// is what Cloud folds to event_type='error', which is how the event WAREHOUSE
-// classifies the row (GET /v1/errors). That is the extent of it — the fold does
-// not forward anything to Sentry. The error dashboard is fed only by the envelope
-// in plane 2 above, and only when a DSN is set.
+// The wire is the canonical `Event` (== the cloud CaptureEvent).
 
 import {
   parseAttribution,
   hasAttribution,
   deriveChannel,
 } from './attribution'
-import { dsnForProduct } from './dsn'
 import { keyForPage } from './org'
-import { EXCEPTION, PAGEVIEW } from './events'
-import { exceptionProperties } from './exception'
+import { PAGEVIEW } from './events'
 import { scrubText, withoutFragment } from './scrub'
-import {
-  buildEnvelope,
-  buildSentryEvent,
-  normalizeError as normalizeThrowable,
-  parseDsn,
-  type ErrorIdentity,
-} from './sentry'
+import { framesFromStack, normalizeError as normalizeThrowable } from './throwable'
 import {
   adoptAnonId,
   adoptSession,
@@ -74,7 +51,6 @@ import type {
   Attribution,
   CaptureErrorOptions,
   Cohort,
-  Dsn,
   EventKind,
   Exception,
   Transport,
@@ -86,7 +62,6 @@ export { VERSION }
 
 const EVENT_PATH = '/v1/event' // the ONE canonical ingestion entry point
 const DEFAULT_HOST = 'https://api.hanzo.ai' // the one edge; cookie apps pass host:''
-const ENVELOPE_CONTENT_TYPE = 'application/x-sentry-envelope'
 // The beacon body's type. text/plain is CORS-SAFELISTED, which is the whole
 // property: a safelisted type makes the POST a SIMPLE request, and a simple
 // request needs no preflight. An unloading document does not get a second round
@@ -95,22 +70,7 @@ const ENVELOPE_CONTENT_TYPE = 'application/x-sentry-envelope'
 // CORS class and nothing else.
 const BEACON_CONTENT_TYPE = 'text/plain'
 
-/** readEnvDsn resolves a DSN from the public env when config omits one, so an app
- *  gets the error plane by setting ONE build-time variable and nothing else.
- *  Next/Vite inline these at build; the access is guarded so it is safe in a bare
- *  browser and during SSR/prerender where `process` may not exist. */
-function readEnvDsn(): string | undefined {
-  try {
-    if (typeof process !== 'undefined' && process.env) {
-      return process.env.NEXT_PUBLIC_HANZO_EVENT_DSN || process.env.HANZO_EVENT_DSN || undefined
-    }
-  } catch {
-    /* no process — browser without inlined env */
-  }
-  return undefined
-}
-
-/** readEnv reads an inlined build-time variable, guarded like readEnvDsn. */
+/** readEnv reads an inlined build-time variable, guarded for SSR. */
 function readEnv(name: string): string | undefined {
   try {
     if (typeof process !== 'undefined' && process.env) return process.env[name] || undefined
@@ -127,14 +87,15 @@ function appendQuery(url: string, key: string, value: string): string {
 }
 
 /** Normalize anything thrown (Error | string | unknown) into an Exception. */
-/** normalizeError adapts the shared, hostile-input-safe normalizer (sentry.ts) to
- *  the event stream's Exception shape. ONE normalizer serves both planes: a thrown
- *  object may define `name`/`message`/`stack` as throwing getters, and when each
- *  plane rolled its own reader the stream still lost the report that the error
- *  plane had already survived. */
+/** normalizeError adapts the hostile-input-safe normalizer (sentry.ts) to the
+ *  stream's Exception shape: a thrown object may define `name`/`message`/`stack`
+ *  as throwing getters. */
 function normalizeError(err: unknown): Exception {
   const n = normalizeThrowable(err)
-  return { type: n.name, message: n.message, stack: n.stack }
+  const frames = framesFromStack(n.stack)
+    .slice(-50)
+    .map((f) => ({ function: f.function, file: f.filename, line: f.lineno, column: f.colno }))
+  return { type: n.name, message: n.message, stack: n.stack, frames }
 }
 
 // React Native defines a `window` but no `document` (and no `window.location`),
@@ -267,8 +228,6 @@ export class Analytics {
   private started = false
   /** The view pageview() last counted — path + location. */
   private counted?: string
-  /** Parsed error-plane DSN, or null when the plane is inert. */
-  private dsn: Dsn | null
   /** Guards against an error thrown *inside* the error path re-entering it. */
   private reentrant = false
 
@@ -304,43 +263,14 @@ export class Analytics {
         config.ingestKey ?? readEnv('NEXT_PUBLIC_PUBLISHABLE_KEY') ?? keyForPage(),
     }
     this.transport = config.transport ?? new DefaultTransport()
-    // Error plane, most specific source first: an explicit DSN wins, then the
-    // inlined build-time env (a per-deploy override), then the product registry —
-    // whose DSN carries the SAME resolved key (not a baked one), so declaring
-    // `product` + providing the key is enough to report errors. Malformed or
-    // absent => null => inert, never throwing into the host app.
-    this.dsn = parseDsn(
-      config.dsn ?? readEnvDsn() ?? dsnForProduct(this.cfg.product, this.cfg.ingestKey)
-    )
   }
 
   /** adopt gives this client a credential it does not have. The key belongs to
    *  the stream, not to whichever caller happened to ask for the handle first,
-   *  so a later caller carrying one hands it over. The error plane derives from
-   *  the key, so it comes up here too when it was inert for want of one.
-   *  Present fields are never overwritten: the first caller's key stays. */
+   *  so a later caller carrying one hands it over. Present fields are never overwritten: the first caller's key stays. */
   adopt(config: AnalyticsConfig): void {
     if (config.ingestKey && !this.cfg.ingestKey) this.cfg.ingestKey = config.ingestKey
     if (config.getToken && !this.cfg.getToken) this.cfg.getToken = config.getToken
-    if (!this.dsn) {
-      this.dsn = parseDsn(
-        config.dsn ?? readEnvDsn() ?? dsnForProduct(this.cfg.product, this.cfg.ingestKey),
-      )
-    }
-  }
-
-  /** errorPlaneEnabled reports whether captured exceptions can actually reach the
-   *  error host. False means a DSN was never configured — the documented
-   *  fail-safe. Exposed so an app (or a test) can assert its wiring instead of
-   *  discovering months later that nothing was ever reported. */
-  get errorPlaneEnabled(): boolean {
-    return this.dsn !== null
-  }
-
-  /** errorIngestUrl is the fully-derived envelope endpoint, or undefined when the
-   *  plane is inert. Diagnostics only. */
-  get errorIngestUrl(): string | undefined {
-    return this.dsn?.ingestUrl
   }
 
   /** init is idempotent and browser-only for its side effects: capture first-touch
@@ -383,10 +313,7 @@ export class Analytics {
     window.addEventListener('visibilitychange', flushHidden)
     window.addEventListener('pagehide', () => this.flush(true))
 
-    // Auto error capture — the drop-in @sentry replacement. Unhandled errors and
-    // rejected promises are reported on BOTH planes: a Sentry envelope to the DSN
-    // host (what reaches the error dashboard — requires a DSN) and a type:'error'
-    // event on the stream (product signal in the warehouse).
+    // Unhandled errors and rejected promises are reported as type:'error' events.
     if (this.cfg.captureErrors) {
       window.addEventListener('error', (e: ErrorEvent) => {
         this.captureError(e.error ?? e.message, { handled: false })
@@ -462,71 +389,30 @@ export class Analytics {
   }
 
   /** captureError reports a caught error, an unhandled rejection, a React render
-   *  error, or a manual report to BOTH planes, from one call:
-   *
-   *    - the ERROR PLANE — a real Sentry envelope to the DSN host. This is the one
-   *      that produces an issue in sentry.hanzo.ai (grouping, stack frames, AST).
-   *      Inert when no DSN is configured.
-   *    - the EVENT STREAM — a `type:'error'` row in the cloud event warehouse, so
-   *      an error stays correlated with the session's pageviews for product
-   *      analysis (readable via GET /v1/errors).
-   *
-   *  Both carry the SAME session and subject id, so an error and the pageview
-   *  before it join up. Never throws back into the app; errors are higher-signal
-   *  than pageviews, so both planes flush promptly (a crash may unload the page
-   *  moments later). */
+   *  error, or a manual report as ONE event of type 'error' on the one stream.
+   *  It carries the exception (type, message, frames, stack, handled) and the
+   *  release, environment, site, product and level that group and scope it, and
+   *  flushes promptly (a crash may unload the page moments later). Never throws
+   *  back into the app. */
   captureError(err: unknown, context?: CaptureErrorOptions): void {
     // A failure inside the error path must not recurse through the global handlers.
     if (this.reentrant) return
     this.reentrant = true
     try {
-      // ERROR PLANE FIRST, in its own try. The planes are independent, so neither
-      // may be able to starve the other: `properties` is arbitrary caller data
-      // (a DOM node, a React synthetic event, an axios error — all circular and
-      // all common), and serializing it on the event stream can throw. When the
-      // stream ran first, that throw escaped to the outer catch and the crash
-      // report was never sent — silently losing exactly the signal this client
-      // exists to deliver. Order and isolation are the fix.
-      try {
-        this.sendError(err, context)
-      } catch {
-        /* the error plane must never take the event stream down with it */
-      }
-
-      try {
-        const handled = context?.handled ?? true
-        const ex = normalizeError(err)
-        ex.handled = handled
-        // NAME: the reserved '$exception', never the message. The message was the
-        // name until 0.3.20, which put every distinct error string — one per failed
-        // chunk id, per ResizeObserver notification — permanently into the event
-        // taxonomy, and left Error Tracking (which reads this exact name) at zero.
-        //
-        // TYPE 'event', not 'error'. `type` alone picks the storage plane: 'error'
-        // routes to the error plane, which the product-event projection does not
-        // read, so an exception filed there is invisible to Error Tracking however
-        // well-formed it is. The full error record still reaches the error plane as
-        // a Sentry envelope above — this row is the product-analytics breadcrumb,
-        // which is what keeps a crash correlated with the session's pageviews.
-        //
-        // `error` is still carried: the server folds it into properties.$exception
-        // (scrubbing message and stack on the way), which is the shape existing
-        // readers bind to.
-        this.enqueue('event', EXCEPTION, {
-          error: ex,
-          properties: {
-            ...context?.properties,
-            ...exceptionProperties(err, {
-              handled,
-              id: uuidv7(),
-              level: context?.level,
-            }),
-          },
-        })
-        this.flush()
-      } catch {
-        /* nor the reverse */
-      }
+      const handled = context?.handled ?? true
+      const ex = normalizeError(err)
+      ex.handled = handled
+      this.enqueue('error', undefined, {
+        error: ex,
+        level: context?.level ?? (handled ? 'error' : 'fatal'),
+        release: this.cfg.release ?? readEnv('NEXT_PUBLIC_HANZO_RELEASE'),
+        environment: this.cfg.environment ?? readEnv('NODE_ENV'),
+        site: isBrowser() ? window.location.hostname : undefined,
+        properties: context?.properties,
+      })
+      this.flush()
+    } catch {
+      /* the error path never takes the app down */
     } finally {
       this.reentrant = false
     }
@@ -588,41 +474,6 @@ export class Analytics {
 
   // ── internals ────────────────────────────────────────────────────────────
 
-  /** sendError frames one exception as a Sentry envelope and posts it to the DSN's
-   *  ingest URL. The DSN's own key rides ?sentry_key= (the credential channel the
-   *  server trusts, and the only one a headerless beacon can carry), so NO bearer
-   *  or publishable key is attached here — the two planes authenticate
-   *  independently. Errors are sent one envelope per event, immediately: batching
-   *  a crash report is how you lose it. */
-  private sendError(err: unknown, options?: CaptureErrorOptions): void {
-    if (!this.cfg.enabled || !this.dsn) return
-    const event = buildSentryEvent({
-      error: err,
-      options,
-      identity: this.errorIdentity(),
-      capturePII: this.cfg.capturePII ?? false,
-    })
-    const body = buildEnvelope(event, this.dsn)
-    if (this.cfg.debug) console.debug('[event] error →', this.dsn.ingestUrl, event.event_id)
-    this.transport.send(this.dsn.ingestUrl, body, {
-      beacon: false,
-      contentType: ENVELOPE_CONTENT_TYPE,
-      debug: this.cfg.debug,
-    })
-  }
-
-  /** errorIdentity is the SAME identity the event stream stamps — the OIDC subject
-   *  once identify() has run, else the anon id. Never email/PII. */
-  private errorIdentity(): ErrorIdentity {
-    return {
-      userId: this.personId ?? anonId(),
-      sessionId: sessionId(),
-      product: this.cfg.product,
-      release: this.cfg.release ?? readEnv('NEXT_PUBLIC_HANZO_RELEASE'),
-      environment: this.cfg.environment ?? readEnv('NODE_ENV'),
-    }
-  }
-
   private enqueue(kind: EventKind, event: string | undefined, extra: Partial<WireEvent>): void {
     if (!this.cfg.enabled) return
     if (!this.started) this.init()

package/src/exception.ts

@@ -29,7 +29,7 @@
 // throw site. framesFromStack (sentry.ts) already returns that order, which is why
 // this module reuses it rather than re-parsing.
 
-import { framesFromStack, normalizeError } from './sentry'
+import { framesFromStack, normalizeError } from './throwable'
 import type {
   ExceptionEntry,
   ExceptionFrame,

package/src/index.ts

@@ -15,12 +15,10 @@ export {
   getCohort,
   getFirstTouch,
 } from './core'
-export { parseDsn, buildSentryEvent, buildEnvelope, framesFromStack } from './sentry'
+export { framesFromStack } from './throwable'
 export { uuidv7, uuidv7Time } from './uid'
 export { linkUrl, readLink, stripLink, LINK_PARAMS } from './link'
 export type { LinkState } from './link'
-export { PRODUCT_PROJECT, dsnForProduct } from './dsn'
-export type { ErrorIdentity } from './sentry'
 export { scrubText, redactSecrets, scrubPII } from './scrub'
 export { EVENTS, EXCEPTION, PAGEVIEW } from './events'
 export { exceptionEntry, exceptionProperties, fingerprint, digest } from './exception'
@@ -31,8 +29,10 @@ export {
 } from './consent'
 export type { Choice, Region } from './consent'
 export { CLICK_IDS, capture as captureClick, touch } from './touch'
-export { start as startTags, track, mirror, reach, visit } from './tags'
+export { start as startTags, track, mirror, reach, visit, SITE_KEY } from './tags'
 export type { BrowserTag, TagOptions } from './tags'
+export { commerceItem, worth } from './items'
+export type { CommerceItem, PlanLine } from './items'
 export { GOALS, COHORTS } from './goals'
 export type { GoalDef, CohortDef } from './goals'
 export { FUNNELS, PRODUCTS, eventsOf } from './funnels'
@@ -49,13 +49,11 @@ export type {
   Attribution,
   CaptureErrorOptions,
   Cohort,
-  Dsn,
   EventKind,
   Exception,
   ExceptionEntry,
   ExceptionFrame,
   ExceptionProperties,
-  SentryEvent,
   SentryFrame,
   SentryLevel,
   Transport,

package/src/items.test.ts

@@ -0,0 +1,22 @@
+import { describe, expect, it } from 'vitest'
+import { commerceItem, worth } from './items'
+
+describe('commerceItem', () => {
+  it('names an individual plan by its id, term and price', () => {
+    expect(commerceItem({ id: 'dev', name: 'Dev', interval: 'month', price: 19 })).toEqual({
+      item_id: 'dev', item_name: 'Dev', item_category: 'individual', item_variant: 'monthly', price: 19, quantity: 1,
+    })
+  })
+
+  it('names a team plan by its seats, and an annual term however commerce spells it', () => {
+    for (const interval of ['year', 'yearly', 'annual', 'Year']) {
+      const i = commerceItem({ id: 'team_standard', team: true, interval, price: 24, quantity: 3 })
+      expect(i).toMatchObject({ item_category: 'team', item_variant: 'annual', quantity: 3 })
+      expect(worth(i)).toBe(72)
+    }
+  })
+
+  it('a plan with no price is free, not unknown', () => {
+    expect(commerceItem({ id: 'free', interval: 'month', price: null }).price).toBe(0)
+  })
+})

package/src/items.ts

@@ -0,0 +1,44 @@
+// A plan as every ecommerce event names it: GA4's item shape, which the tag
+// manager hands Meta, TikTok and X, and which cloud's forwarder lifts from the
+// events the server states. One function, so a plan carries the same line from
+// the pricing page to the checkout to the order.
+//
+// `item_id` is the plan's id as the catalog spells it (free, dev, max, and the
+// team plans), `item_category` says who it is for, `item_variant` the term,
+// `price` the unit price for that term in US dollars and `quantity` the seats
+// (1 for an individual plan).
+
+export interface CommerceItem {
+  item_id: string
+  item_name?: string
+  item_category: 'individual' | 'team'
+  item_variant: 'monthly' | 'annual'
+  price: number
+  quantity: number
+}
+
+export interface PlanLine {
+  id: string
+  name?: string
+  /** A team plan is sold per seat. */
+  team?: boolean
+  /** The term, as commerce (`month`, `year`) or the funnel (`monthly`, `annual`) says it. */
+  interval: string
+  price: number | null
+  quantity?: number
+}
+
+export function commerceItem(p: PlanLine): CommerceItem {
+  const annual = /^(year|yearly|annual)$/i.test(p.interval)
+  return {
+    item_id: p.id,
+    ...(p.name ? { item_name: p.name } : {}),
+    item_category: p.team ? 'team' : 'individual',
+    item_variant: annual ? 'annual' : 'monthly',
+    price: p.price ?? 0,
+    quantity: p.quantity ?? 1,
+  }
+}
+
+/** What the whole order is worth: the unit price times the seats. */
+export const worth = (i: CommerceItem): number => i.price * i.quantity

package/src/org.ts

@@ -51,11 +51,15 @@ export const ORG_DOMAIN: Readonly<Record<string, readonly string[]>> = Object.fr
   // separate fact, which is the whole reason this is a table.
   hanzo: Object.freeze([
     'hanzo.ai',
+    'hanzo.agency',
     'hanzo.app',
     'hanzo.bot',
     'hanzo.chat',
     'hanzo.codes',
     'hanzo.id',
+    'hanzo.industries',
+    'hanzo.market',
+    'hanzo.network',
     'hanzo.sh',
     'hanzo.team',
     'hanzo.ventures',

package/src/react.tsx

@@ -16,11 +16,13 @@ import {
   useContext,
   useEffect,
   useRef,
+  useSyncExternalStore,
   type ErrorInfo,
   type ReactNode,
 } from 'react'
 import { Analytics, createAnalytics } from './core'
 import type { AnalyticsConfig } from './types'
+import { CONSENT_EVENT, read, render, type Choice } from './consent'
 
 const Ctx = createContext<Analytics | null>(null)
 
@@ -120,3 +122,23 @@ export class ErrorBoundary extends Component<ErrorBoundaryProps, ErrorBoundarySt
     return fallback ?? null
   }
 }
+
+const listen = (on: () => void) => {
+  window.addEventListener(CONSENT_EVENT, on)
+  return () => window.removeEventListener(CONSENT_EVENT, on)
+}
+
+/**
+ * The visitor's consent, live: what a region presumes until they choose, then
+ * what they chose, re-rendering the moment they do. `enabled: choice.analytics`
+ * on the provider's config is how a stream that started silent for an EU visitor
+ * starts on Accept, with no reload.
+ */
+export function useConsent(): Choice {
+  const kept = useSyncExternalStore(listen, () => render(read()), () => '')
+  return {
+    analytics: kept.includes('analytics'),
+    marketing: kept.includes('marketing'),
+    ads: kept.includes('ads'),
+  }
+}

package/src/stream.test.ts

@@ -81,13 +81,6 @@ describe('one stream, one client', () => {
     expect(tx.sent[0].token).toBe(KEY)
   })
 
-  it('brings up the error plane on the key it adopts', () => {
-    const a = createAnalytics({ product: 'console', host: HOST, transport: tx })
-    expect(a.errorPlaneEnabled).toBe(false)
-    createAnalytics({ product: 'console', host: HOST, ingestKey: KEY })
-    expect(a.errorPlaneEnabled).toBe(true)
-  })
-
   it('keeps the first credential rather than overwriting it', () => {
     createAnalytics({ product: 'site', host: HOST, ingestKey: KEY, transport: tx })
     createAnalytics({ product: 'site', host: HOST, ingestKey: 'pk-second' }).capture('x')

package/src/tags.test.ts

@@ -185,3 +185,21 @@ describe('one event, every tag', () => {
     expect(sent.items[0].price).toBe(0)
   })
 })
+
+describe('a paid order the server also states', () => {
+  it('fires the pixels under the order id and does not touch our stream', async () => {
+    browser('America/New_York')
+    const { startTags, track } = await import('./index')
+    startTags({ key: 'pk-x' })
+    await tick()
+    const w = g.window as unknown as Record<string, unknown>
+    const fbq: unknown[][] = []
+    const captured: unknown[] = []
+    w.gtag = () => undefined
+    w.fbq = (...a: unknown[]) => fbq.push(a)
+    track({ capture: (...a: unknown[]) => captured.push(a) } as never, 'order_completed', { event_id: 'sub_1', order_id: 'sub_1', value: 19 }, 'tags')
+    await tick()
+    expect(captured).toEqual([])
+    expect(fbq.map((a) => (a[3] as { eventID: string }).eventID)).toEqual(['sub_1', 'sub_1'])
+  })
+})

package/src/tags.ts

@@ -54,6 +54,24 @@ export interface TagOptions {
   domains?: string[]
 }
 
+/**
+ * The publishable key of each site's project, which is how cloud finds the site's
+ * tag set. A `pk-` is public by design (it ships in every page); it names a site,
+ * never a platform id. A host absent here has no tag config unless `start` is
+ * given a key.
+ */
+export const SITE_KEY: Readonly<Record<string, string>> = Object.freeze({
+  'hanzo.ai': 'pk-CmfLA2K6kvsPflrS9DSkt06H_kSoQB_21sjedt6VJdc',
+  'www.hanzo.ai': 'pk-CmfLA2K6kvsPflrS9DSkt06H_kSoQB_21sjedt6VJdc',
+  'hanzo.app': 'pk-wlnXN2a9_vmCm60yTFtQ629Q8TyuaxBNZbY1RWT72gQ',
+  'hanzo.team': 'pk-NCzD2FiHpZv8KUpkCX4olT1LJOJsMxBC_Z8NkiQsOFQ',
+  'pay.hanzo.ai': 'pk-eX6kv7JZNoiYn1WkeJH3tT_8OvkVYScmCXnLMwxTKf8',
+  'platform.hanzo.ai': 'pk-My1RpZLEUnTj8vAdPbWKYdDUuhxZJ4dVjHcwjZN4rZ8',
+  'docs.hanzo.ai': 'pk-jukhtjMT2ymoeBDAeFjINQWlBv-v9sNn1TPztiCrrwk',
+  'hanzo.bot': 'pk-W5d7Mn7ZukT7igyscIy6Pqe8JpA0Ge604Yn4xNR4JCU',
+  'cloud.hanzo.ai': 'pk-RAfEGHPoNdCEU9fnA_cPd_Xo9Tci44rlYQV9xuJ1Ob0',
+})
+
 type Call = (...args: unknown[]) => void
 type Page = {
   dataLayer?: unknown[]
@@ -281,8 +299,10 @@ export function start(o: TagOptions = {}): () => void {
     configured = true
     const base = (o.base ?? 'https://api.hanzo.ai').replace(/\/$/, '')
     const q = new URLSearchParams()
-    if (o.key) q.set('key', o.key)
-    q.set('host', o.host ?? window.location.hostname)
+    const host = o.host ?? window.location.hostname
+    const key = o.key ?? SITE_KEY[host]
+    if (key) q.set('key', key)
+    q.set('host', host)
     const answer = (list: BrowserTag[]) => {
       tags = list
       configAnswered = true
@@ -420,17 +440,30 @@ export function mirror(name: string, params: Record<string, unknown>, id: string
  * forwards on), and each browser tag that is running hears it too. A moment
  * that arrives while gtag.js is still on its way waits for it, so GA4 sees it
  * with a session; a page that is leaving sends what it holds as things stand.
+ *
+ * A paid order is stated by the SERVER on our stream (and forwarded server-side);
+ * its browser copy is `track(stream, 'order_completed', {event_id: order, order_id:
+ * order, …}, 'tags')`: the same id, the pixels only, so nothing counts twice.
  */
-export function track(stream: Analytics | undefined, name: string, params: Record<string, unknown> = {}): void {
+export function track(
+  stream: Analytics | undefined,
+  name: string,
+  params: Record<string, unknown> = {},
+  /** `'tags'` fires the browser pixels only: the server states this moment on our stream itself. */
+  only?: 'tags',
+): void {
   if (typeof window === 'undefined') return
   if (!leaving && !settled()) {
-    held.push(() => track(stream, name, params))
+    held.push(() => track(stream, name, params, only))
     return
   }
   const c = read()
-  const event_id = crypto.randomUUID()
+  // A moment the server also states (a paid order) brings its own id, the order's,
+  // so each platform sees the browser's copy and the server's as one.
+  const event_id = typeof params.event_id === 'string' && params.event_id ? params.event_id : crypto.randomUUID()
   const to = reach()
   mirror(name, params, event_id, to)
+  if (only === 'tags') return
   stream?.capture(name, {
     ...params,
     ...touch(c),