@hanzo/event 0.3.49 → 0.3.52

package/dist/tags.d.ts

@@ -16,12 +16,13 @@ export interface TagOptions {
     domains?: string[];
 }
 /**
- * The publishable key of each site's project, which is how cloud finds the site's
- * tag set. A `pk-` is public by design (it ships in every page); it names a site,
- * never a platform id. A host absent here has no tag config unless `start` is
- * given a key.
+ * Resolves once every tag this visitor's choice loads has taken the page view, or after
+ * `limit` ms, whichever is first: the tag set has answered, gtag.js has loaded or failed,
+ * and Meta's library has replaced the stub that queued the call. A page that is about to
+ * leave waits on this so the visit is counted where it arrived. A tag the choice does not
+ * load is not waited for.
  */
-export declare const SITE_KEY: Readonly<Record<string, string>>;
+export declare function ready(limit?: number): Promise<void>;
 /**
  * Starts the tag manager: fetches the site's tag set and loads what consent
  * allows, again on every consent change. Safe to call on every page load, and

package/dist/tags.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tags.d.ts","sourceRoot":"","sources":["../src/tags.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AAEvC,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC;AAED,MAAM,WAAW,UAAU;IACzB,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAUpD,CAAA;AAuNF;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,CAAC,GAAE,UAAe,GAAG,MAAM,IAAI,CAmCpD;AAOD,uFAAuF;AACvF,wBAAgB,KAAK,IAAI,MAAM,CAc9B;AA+CD;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,SAAU,GAAG,IAAI,CAiCpG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,KAAK,CACnB,MAAM,EAAE,SAAS,GAAG,SAAS,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;AACpC,kGAAkG;AAClG,IAAI,CAAC,EAAE,MAAM,GACZ,IAAI,CAsBN;AAED,gGAAgG;AAChG,wBAAgB,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAG/C"}
+{"version":3,"file":"tags.d.ts","sourceRoot":"","sources":["../src/tags.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AAEvC,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAChC;AAED,MAAM,WAAW,UAAU;IACzB,wDAAwD;IACxD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAqCD;;;;;;GAMG;AACH,wBAAgB,KAAK,CAAC,KAAK,SAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAcjD;AAoLD;;;;GAIG;AACH,wBAAgB,KAAK,CAAC,CAAC,GAAE,UAAe,GAAG,MAAM,IAAI,CAoCpD;AAOD,uFAAuF;AACvF,wBAAgB,KAAK,IAAI,MAAM,CAc9B;AA+CD;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,SAAU,GAAG,IAAI,CAiCpG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,KAAK,CACnB,MAAM,EAAE,SAAS,GAAG,SAAS,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;AACpC,kGAAkG;AAClG,IAAI,CAAC,EAAE,MAAM,GACZ,IAAI,CAsBN;AAED,gGAAgG;AAChG,wBAAgB,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAG/C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanzo/event",
-  "version": "0.3.49",
+  "version": "0.3.52",
   "description": "Hanzo Event — the ONE telemetry client. Emits pageview/event/identify/group to the Hanzo Cloud event stream (POST /v1/event), AND reports errors to Sentry as real Sentry envelopes — the error plane needs a DSN, without one nothing reaches Sentry. First-touch attribution, beacon-on-unload, auto error capture, client-side secret/PII scrubbing, a shared event + goal vocabulary. Subsumes @sentry.",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

package/src/consent.test.ts

@@ -1,7 +1,7 @@
 // Consent: opt-in outside the US, opt-out inside it, GPC always wins.
 
 import { afterEach, describe, expect, it, vi } from 'vitest'
-import { CONSENT_COOKIE, acceptAll, asks, read, region, rejectAll, save } from './consent'
+import { CONSENT_COOKIE, CONSENT_VERSION_COOKIE, acceptAll, asks, notices, read, region, rejectAll, save, serve } from './consent'
 import { touch, capture } from './touch'
 
 const g = globalThis as Record<string, unknown>
@@ -42,6 +42,7 @@ function browser(zone: string, opts: { gpc?: boolean; cookie?: string; href?: st
 }
 
 afterEach(() => {
+  serve(null)
   for (const k of ['window', 'document', 'Event']) delete g[k]
   for (const [k, d] of Object.entries(original)) if (d) Object.defineProperty(globalThis, k, d)
   vi.restoreAllMocks()
@@ -77,9 +78,9 @@ describe('the default before a choice', () => {
     expect(asks()).toBe(false)
   })
 
-  it('Global Privacy Control turns marketing off in the US', () => {
+  it('Global Privacy Control turns marketing and ads off in the US, analytics stays', () => {
     browser('America/Denver', { gpc: true })
-    expect(read()).toEqual({ analytics: false, marketing: false, ads: false })
+    expect(read()).toEqual({ analytics: true, marketing: false, ads: false })
   })
 
   it('GPC wins over a stored yes', () => {
@@ -138,3 +139,59 @@ describe('click ids', () => {
     expect(touch({ analytics: true, marketing: false, ads: false })).not.toHaveProperty('gclid')
   })
 })
+
+describe('the rule cloud serves', () => {
+  const rule = (mode: 'opt-in' | 'opt-out', version = 1) => ({
+    region: mode === 'opt-in' ? 'DE' : 'US',
+    mode,
+    version,
+    gpc: false,
+    defaults:
+      mode === 'opt-in'
+        ? { analytics: false, marketing: false, ads: false }
+        : { analytics: true, marketing: true, ads: true },
+  })
+
+  it('beats the time zone, both ways', () => {
+    browser('America/New_York')
+    serve(rule('opt-in'))
+    expect(region()).toBe('opt-in')
+    expect(asks()).toBe(true)
+    expect(read()).toEqual({ analytics: false, marketing: false, ads: false })
+    browser('Europe/Berlin')
+    serve(rule('opt-out'))
+    expect(asks()).toBe(false)
+    expect(notices()).toBe(true)
+    expect(read()).toEqual({ analytics: true, marketing: true, ads: true })
+  })
+
+  it('tells the page when it arrives, so a banner drawn early redraws', () => {
+    const b = browser('Europe/Berlin')
+    serve(rule('opt-in'))
+    expect(b.fired).toContain('hzpolicy')
+  })
+
+  it('a choice made under an older policy is asked again', () => {
+    const b = browser('Europe/Berlin', { cookie: 'analytics' })
+    b.jar.set(CONSENT_VERSION_COOKIE, '1')
+    serve(rule('opt-in', 1))
+    expect(asks()).toBe(false)
+    serve(rule('opt-in', 2))
+    expect(asks()).toBe(true)
+    expect(read().analytics).toBe(false)
+  })
+
+  it('a choice is stored with the version it was made under', () => {
+    const b = browser('Europe/Berlin')
+    serve(rule('opt-in', 3))
+    acceptAll()
+    expect(b.jar.get(CONSENT_VERSION_COOKIE)).toBe('3')
+    expect(asks()).toBe(false)
+  })
+
+  it('ignores an answer that is not a rule', () => {
+    browser('Europe/Berlin')
+    serve({ tags: [] })
+    expect(region()).toBe('opt-in')
+  })
+})

package/src/consent.ts

@@ -15,10 +15,16 @@
 // ads off in every region whatever is stored: California reads GPC as the opt-out
 // of sale and sharing.
 //
-// There is no geo lookup. The page cannot ask a server where the visitor is, so
-// the zone is the browser's own time zone, and a zone that is not a US zone is
-// treated as opt-in. Wrong in the safe direction: a US visitor on a foreign
-// clock is asked, and a European is never presumed to have agreed.
+// The region comes from cloud. The site's tag config (`GET /v1/project/tags`) answers
+// with the rule that binds this visitor, resolved at the edge from where the request
+// came from (`serve`). Until it answers, and if it never does, the zone is the browser's
+// own time zone and a zone that is not a US zone is treated as opt-in: wrong in the
+// safe direction, a US visitor on a foreign clock is asked and a European is never
+// presumed to have agreed.
+//
+// The policy has a version. A choice is stored beside the version it was made under
+// (`hz_consent_v`); when the policy changes, the stored choice no longer counts and the
+// visitor is asked again.
 //
 // The choice is a first-party cookie, `hz_consent`, on the registrable domain
 // for 13 months: the granted categories, comma separated. cloud reads the same
@@ -28,6 +34,12 @@ import { get, set } from './cookie'
 
 export const CONSENT_COOKIE = 'hz_consent'
 
+/** The policy version the stored choice was made under. */
+export const CONSENT_VERSION_COOKIE = 'hz_consent_v'
+
+/** Fired on `window` when cloud's rule for this visitor arrives. */
+export const POLICY_EVENT = 'hzpolicy'
+
 /** Fired on `window` whenever a choice is stored. */
 export const CONSENT_EVENT = 'hzconsent'
 
@@ -39,6 +51,40 @@ export interface Choice {
 
 export type Region = 'opt-in' | 'opt-out'
 
+/** The rule cloud resolved for this visitor. */
+export interface Policy {
+  region: string
+  mode: Region
+  defaults: Choice
+  gpc: boolean
+  version: number
+  notice?: string
+}
+
+let served: Policy | undefined
+
+/** Takes cloud's rule for this visitor and tells the page, so a banner drawn early redraws. */
+export function serve(p: unknown): void {
+  if (p == null) {
+    served = undefined
+    return
+  }
+  const d = p as Partial<Policy>
+  if ( (d.mode !== 'opt-in' && d.mode !== 'opt-out') || !d.defaults) return
+  served = {
+    region: String(d.region ?? ''),
+    mode: d.mode,
+    defaults: { analytics: !!d.defaults.analytics, marketing: !!d.defaults.marketing, ads: !!d.defaults.ads },
+    gpc: d.gpc === true,
+    version: Number(d.version) || 0,
+    notice: typeof d.notice === 'string' ? d.notice : undefined,
+  }
+  if (typeof window !== 'undefined') window.dispatchEvent(new Event(POLICY_EVENT))
+}
+
+/** The rule cloud resolved, once it has answered. */
+export const policy = (): Policy | undefined => served
+
 type Nav = { doNotTrack?: string; msDoNotTrack?: string; globalPrivacyControl?: boolean }
 
 const US =
@@ -60,6 +106,7 @@ export function refused(): boolean {
 
 /** Which rule applies to this visitor. */
 export function region(): Region {
+  if (served) return served.mode
   try {
     const zone = Intl.DateTimeFormat().resolvedOptions().timeZone ?? ''
     return US.test(zone) ? 'opt-out' : 'opt-in'
@@ -70,18 +117,23 @@ export function region(): Region {
 
 /** Whether the visitor has stored a choice. */
 export function stored(): boolean {
-  return get(CONSENT_COOKIE) !== undefined
+  if (get(CONSENT_COOKIE) === undefined) return false
+  return !served || get(CONSENT_VERSION_COOKIE) === String(served.version)
 }
 
 /** The visitor's choice: the stored one, else the regional default, with GPC applied. */
 export function read(): Choice {
-  const kept = get(CONSENT_COOKIE)
+  const kept = stored() ? get(CONSENT_COOKIE) : undefined
   const on =
     kept !== undefined
       ? kept.split(',')
-      : region() === 'opt-in' || refused()
-        ? []
-        : ['analytics', 'marketing', 'ads']
+      : served
+        ? (['analytics', 'marketing', 'ads'] as const).filter((k) => served!.defaults[k])
+        : region() === 'opt-in'
+          ? []
+          : gpc()
+            ? ['analytics']
+            : ['analytics', 'marketing', 'ads']
   const has = (k: string) => on.includes(k)
   return { analytics: has('analytics'), marketing: has('marketing') && !gpc(), ads: has('ads') && !gpc() }
 }
@@ -91,6 +143,11 @@ export function asks(): boolean {
   return typeof document !== 'undefined' && region() === 'opt-in' && !stored()
 }
 
+/** Whether a small notice must be shown: an opt-out visitor who has not yet seen it. */
+export function notices(): boolean {
+  return typeof document !== 'undefined' && region() === 'opt-out' && !stored()
+}
+
 /** The choice as the `consent` property and the cookie spell it. */
 export function render(c: Choice): string {
   return (['analytics', 'marketing', 'ads'] as const).filter((k) => c[k]).join(',')
@@ -106,6 +163,7 @@ export function render(c: Choice): string {
 export function save(c: Choice): void {
   const out: Choice = { analytics: c.analytics, marketing: c.marketing && !gpc(), ads: c.ads && !gpc() }
   set(CONSENT_COOKIE, render(out), 395)
+  set(CONSENT_VERSION_COOKIE, String(served?.version ?? 0), 395)
   if (typeof window !== 'undefined') window.dispatchEvent(new Event(CONSENT_EVENT))
 }
 

package/src/core.test.ts

@@ -396,17 +396,17 @@ describe('Analytics capture', () => {
     expect(tx.sent[0].ingestKey).toBeUndefined()
   })
 
-  it('a signed-in bearer WINS over a key from the build env', () => {
-    // The leak this closes: one console bundle is served to several brands, and a
-    // pk- names ONE org. If an env-sourced key displaced the bearer, every
-    // signed-in user's events would re-file under whichever org minted the key.
+  it('a signed-in page sends the key AND the bearer; the bearer never replaces the key', () => {
+    // The person is the bearer and the project is the key. The server files the event
+    // under the key's project only when it belongs to the bearer's own org, so a key
+    // from the build env cannot re-file a person's events under another org.
     process.env.NEXT_PUBLIC_PUBLISHABLE_KEY = 'pk-live-one-org'
     try {
       const a = mk({ getToken: () => 'jwt-of-a-real-person' })
       a.capture('x')
       a.flush()
       expect(tx.sent[0].token).toBe('jwt-of-a-real-person')
-      expect(tx.sent[0].ingestKey).toBeUndefined()
+      expect(tx.sent[0].ingestKey).toBe('pk-live-one-org')
     } finally {
       delete process.env.NEXT_PUBLIC_PUBLISHABLE_KEY
     }

package/src/core.ts

@@ -105,6 +105,12 @@ function normalizeError(err: unknown): Exception {
 // unload listeners RN doesn't have), while `capture()`/`flush()` — which are NOT
 // gated on this and post through plain `fetch` — still emit. So the client is
 // inert-safe under SSR/Node and live on RN, without a second transport.
+/** The screen and language a page view carries, for the readers that derive device and locale. */
+const viewport = (): Record<string, string> =>
+  isBrowser()
+    ? { screen: `${window.screen?.width ?? 0}x${window.screen?.height ?? 0}`, language: navigator.language || '' }
+    : {}
+
 const isBrowser = () => typeof window !== 'undefined' && typeof document !== 'undefined'
 
 /** serializeBatch stringifies a batch, salvaging what it can. `properties` is
@@ -186,13 +192,15 @@ class DefaultTransport implements Transport {
     // for an origin that cannot pass one. A JWT is first-party by construction, so
     // it keeps the header and the session it travels with, and so does the error
     // plane, which names its own envelope type.
-    const simple = opts.ingestKey !== undefined && opts.contentType === undefined
+    const simple = opts.ingestKey !== undefined && opts.token === undefined && opts.contentType === undefined
     const headers: Record<string, string> = {
       'Content-Type': simple ? BEACON_CONTENT_TYPE : (opts.contentType ?? 'application/json'),
     }
-    const bearer = simple ? undefined : (opts.ingestKey ?? opts.token)
+    // A signed-in page sends the key (which project) in the query AND the person's bearer
+    // (who) in the header; the bearer never replaces the key.
+    const bearer = simple ? undefined : (opts.token ?? opts.ingestKey)
     if (bearer) headers.Authorization = `Bearer ${bearer}`
-    void fetch(simple ? appendQuery(url, 'ingest_key', opts.ingestKey!) : url, {
+    void fetch(opts.ingestKey ? appendQuery(url, 'ingest_key', opts.ingestKey) : url, {
       method: 'POST',
       headers,
       body,
@@ -375,7 +383,7 @@ export class Analytics {
     const view = (p ?? '') + '\0' + (isBrowser() ? window.location.href : '')
     if (view === this.counted) return
     this.counted = view
-    this.enqueue('pageview', PAGEVIEW, { path: p, properties })
+    this.enqueue('pageview', PAGEVIEW, { path: p, properties: { ...viewport(), ...properties } })
   }
 
   /** capture records a named product event with optional properties. Commerce
@@ -441,20 +449,10 @@ export class Analytics {
     this.queue = []
     this.clearTimer()
 
-    // A publishable key and a bearer JWT are mutually exclusive credentials, and the
-    // BEARER WINS. It names a real principal and resolves to THAT person's org;
-    // a pk- names one org for everybody holding it. So the key is what attributes
-    // a visitor nobody has vouched for, and it must never displace someone who
-    // has been.
-    //
-    // The precedence used to run the other way, which was survivable only while
-    // the key had to be passed in code. Once it also resolves from the build env,
-    // key-wins means setting one variable silently blanks every signed-in user's
-    // token and re-files their events under whichever org minted the key — on a
-    // console served to several brands from one bundle, that is a cross-tenant
-    // leak introduced by an env var.
+    // Two kinds of credential, and both ride when both are held: the publishable key
+    // names the project, the bearer names the person. The bearer never replaces the key.
     const token = this.cfg.getToken?.() ?? undefined
-    const key = token ? undefined : this.cfg.ingestKey?.trim() || undefined
+    const key = this.cfg.ingestKey?.trim() || undefined
     // Only a bearer JWT blocks the beacon: sendBeacon cannot set an Authorization
     // header. A pk- rides ?ingest_key; a cookie rides credentials.
     const useBeacon = beacon && !token

package/src/index.ts

@@ -24,12 +24,12 @@ export { EVENTS, EXCEPTION, PAGEVIEW } from './events'
 export { exceptionEntry, exceptionProperties, fingerprint, digest } from './exception'
 export type { EventName } from './events'
 export {
-  CONSENT_COOKIE, CONSENT_EVENT, acceptAll, asks, gpc, read as readConsent, refused, region,
+  CONSENT_COOKIE, CONSENT_EVENT, CONSENT_VERSION_COOKIE, POLICY_EVENT, acceptAll, asks, gpc, notices, policy as consentPolicy, serve as serveConsent, read as readConsent, refused, region,
   rejectAll, render as renderConsent, save as saveConsent, stored as storedConsent,
 } from './consent'
-export type { Choice, Region } from './consent'
+export type { Choice, Policy as ConsentRule, Region } from './consent'
 export { CLICK_IDS, capture as captureClick, touch } from './touch'
-export { start as startTags, track, mirror, reach, visit, SITE_KEY } from './tags'
+export { start as startTags, ready as tagsReady, track, mirror, reach, visit } from './tags'
 export type { BrowserTag, TagOptions } from './tags'
 export { commerceItem, worth } from './items'
 export type { CommerceItem, PlanLine } from './items'
@@ -64,5 +64,5 @@ export type {
  *  correctly while configuring nothing. `keyFor` takes an optional keyring so a
  *  runtime that receives one (hanzo.id serves every brand from one image) resolves
  *  through this same function rather than a second copy of it. */
-export { ORG_DOMAIN, ORG_KEY, orgOf, keyFor, keyForPage } from './org'
+export { ORG_DOMAIN, ORG_KEY, SITE_KEY, siteKey, orgOf, keyFor, keyForPage } from './org'
 export type { Keyring } from './org'

package/src/link.test.ts

@@ -204,11 +204,12 @@ describe('Analytics.link / authorize / identify', () => {
   })
 })
 
-describe('one ingest key across the journey', () => {
-  it('hanzo.ai, hanzo.id, hanzo.app resolve to the same org key', () => {
+describe('one visitor across the journey, each site its own project', () => {
+  it('www.hanzo.ai is hanzo.ai; every site owns a key; a runtime keyring stays per org', () => {
     const k = keyFor('hanzo.ai')
     expect(k).toBeTruthy()
-    for (const h of ['www.hanzo.ai', 'hanzo.id', 'hanzo.app', 'hanzo.team', 'hanzo.bot']) expect(keyFor(h)).toBe(k)
+    expect(keyFor('www.hanzo.ai')).toBe(k)
+    for (const h of ['hanzo.id', 'hanzo.app', 'hanzo.team', 'hanzo.bot']) expect(keyFor(h)).not.toBe(k)
     const ring = { hanzo: 'pk-runtime' }
     expect(keyFor('hanzo.id', ring)).toBe(keyFor('hanzo.ai', ring))
   })

package/src/org.test.ts

@@ -1,7 +1,7 @@
 import { describe, it, expect, afterEach } from 'vitest'
 
 import { createAnalytics } from './core'
-import { ORG_KEY, keyFor, keyForPage, orgOf } from './org'
+import { ORG_KEY, SITE_KEY, keyFor, keyForPage, orgOf, siteKey } from './org'
 
 const ENV = 'NEXT_PUBLIC_PUBLISHABLE_KEY'
 
@@ -45,7 +45,6 @@ describe('the org that owns a host', () => {
       'hanzo.codes',
       'hanzoskills.com',
       'hanzo.ventures',
-      'hanzo.team',
     ]) {
       expect(orgOf(host)).toBe('hanzo')
       expect(keyFor(host)).toBe(ORG_KEY.hanzo)
@@ -127,3 +126,33 @@ describe('a surface that configures nothing', () => {
     expect((none as unknown as { cfg: { ingestKey?: string } }).cfg.ingestKey).toBeUndefined()
   })
 })
+
+describe('the hanzo org names its sites', () => {
+  it('names hanzo.network, hanzo.market, hanzo.industries and hanzo.agency, each with its own project key', () => {
+    for (const host of ['hanzo.network', 'hanzo.market', 'hanzo.industries', 'hanzo.agency']) {
+      expect(orgOf(host)).toBe('hanzo')
+      expect(keyFor(host)).toBe(SITE_KEY[host])
+    }
+  })
+})
+
+describe('a site files its events under its own project', () => {
+  it('each first-party site resolves to its own key, and its tag set follows', () => {
+    const keys = Object.values(SITE_KEY)
+    expect(keyFor('docs.hanzo.ai')).toBe(SITE_KEY['docs.hanzo.ai'])
+    expect(keyFor('hanzo.chat')).toBe(SITE_KEY['hanzo.chat'])
+    expect(keyFor('hanzo.team')).not.toBe(keyFor('hanzo.ai'))
+    expect(keyFor('hanzo.ai')).toBe(ORG_KEY.hanzo)
+    expect(keys.every((k) => k.startsWith('pk-'))).toBe(true)
+  })
+
+  it('www. and a hanzo.app subdomain reach their site', () => {
+    expect(siteKey('www.hanzo.ai')).toBe(SITE_KEY['hanzo.ai'])
+    expect(siteKey('demo.hanzo.app')).toBe(SITE_KEY['hanzo.app'])
+    expect(siteKey('evil-hanzo.ai')).toBeUndefined()
+  })
+
+  it('a host with no site of its own falls back to its org', () => {
+    expect(keyFor('hanzo.works')).toBe(ORG_KEY.hanzo)
+  })
+})

package/src/org.ts

@@ -93,11 +93,45 @@ export const ORG_DOMAIN: Readonly<Record<string, readonly string[]>> = Object.fr
  * recreate a project, move BOTH.
  */
 export const ORG_KEY: Keyring = Object.freeze({
-  hanzo: 'pk-rM_CdaF2MQckGCrla113SrR1oH4zvqN8xh2I95Z9tY8',
+  hanzo: 'pk-CmfLA2K6kvsPflrS9DSkt06H_kSoQB_21sjedt6VJdc',
   lux: 'pk-gUZp6ZVfhJzSwK-rb4oLbVkpCnMBx5uSCpxf_5yEhQk',
   zoo: 'pk-3TKpKnERV9AQSsBUERWkZejC1O1mUxc1jRzsP3MPbs4',
 })
 
+/**
+ * The publishable key of each site's project, which is how cloud finds the site's
+ * tag set and the project its events are filed under. Each site is ONE project with its
+ * own key. A `pk-` is public by design (it ships in every page); it names a site,
+ * never a platform id. A host absent here falls back to its org's key for events and
+ * has no tag config unless `start` is given a key.
+ */
+export const SITE_KEY: Readonly<Record<string, string>> = Object.freeze({
+  'hanzo.ai': 'pk-CmfLA2K6kvsPflrS9DSkt06H_kSoQB_21sjedt6VJdc',
+  'www.hanzo.ai': 'pk-CmfLA2K6kvsPflrS9DSkt06H_kSoQB_21sjedt6VJdc',
+  'hanzo.app': 'pk-wlnXN2a9_vmCm60yTFtQ629Q8TyuaxBNZbY1RWT72gQ',
+  'hanzo.team': 'pk-NCzD2FiHpZv8KUpkCX4olT1LJOJsMxBC_Z8NkiQsOFQ',
+  'pay.hanzo.ai': 'pk-eX6kv7JZNoiYn1WkeJH3tT_8OvkVYScmCXnLMwxTKf8',
+  'platform.hanzo.ai': 'pk-My1RpZLEUnTj8vAdPbWKYdDUuhxZJ4dVjHcwjZN4rZ8',
+  'docs.hanzo.ai': 'pk-jukhtjMT2ymoeBDAeFjINQWlBv-v9sNn1TPztiCrrwk',
+  'hanzo.bot': 'pk-W5d7Mn7ZukT7igyscIy6Pqe8JpA0Ge604Yn4xNR4JCU',
+  'hanzo.chat': 'pk-ATxWeB2jNyRSxDgqnkGoDj3CCbzrmTxSktUh9zlrO-E',
+  'hanzo.id': 'pk-_GVF3KlaqprlPHDumBMRFeFU1lIGOaarQfgimNVDIo8',
+  'hanzo.industries': 'pk-Vh1wvL2HqIAv9qpVvmrznTI9uMHrTD-jyIC-vnlBsgY',
+  'hanzo.market': 'pk-DN3xQFa0H61epUVg9OkiOYLzCdteNt9hE6f-S-ednjQ',
+  'hanzo.network': 'pk-YJ2eiA_7ckLStMPte8Ar8FsmRp_ycmeIeRbpGprZYmM',
+  'hanzo.agency': 'pk-26a2clOaJFe24aKJZ0PkI-GWR9F4EEa8rthHzgy_Efw',
+  'console.hanzo.ai': 'pk-oFNXoiO1wOD8PqGdHYyiSq6jaNCdrd7TpztGpwM2ZiQ',
+  'admin.hanzo.ai': 'pk-RYZwxkomW-tlAnEu2DKo_kAzcxFbSF2YiYcsUY48QL0',
+  'bot.hanzo.ai': 'pk-W5d7Mn7ZukT7igyscIy6Pqe8JpA0Ge604Yn4xNR4JCU',
+  'cloud.hanzo.ai': 'pk-RAfEGHPoNdCEU9fnA_cPd_Xo9Tci44rlYQV9xuJ1Ob0',
+})
+
+/** The project key of the site a host is: its own entry, `www.` stripped, a `*.hanzo.app` site under hanzo.app. */
+export function siteKey(host: string): string | undefined {
+  const h = normalize(host).replace(/^www\./, '')
+  return SITE_KEY[h] ?? (h.endsWith('.hanzo.app') ? SITE_KEY['hanzo.app'] : undefined)
+}
+
 /** `pk-` is publishable; `sk-` is not, and there is no third thing. Checked at the
  *  one point a key becomes something a page will send, so a mistyped entry fails
  *  closed rather than putting a secret in every visitor's tab. */
@@ -142,6 +176,10 @@ export function orgOf(host: string): string | undefined {
  * this SAME function rather than a second copy of it.
  */
 export function keyFor(host: string, keyring: Keyring = ORG_KEY): string | undefined {
+  if (keyring === ORG_KEY) {
+    const site = siteKey(host)
+    if (site) return site
+  }
   const org = orgOf(host)
   if (!org) return undefined
   const key = keyring[org]

package/src/react.tsx

@@ -22,7 +22,7 @@ import {
 } from 'react'
 import { Analytics, createAnalytics } from './core'
 import type { AnalyticsConfig } from './types'
-import { CONSENT_EVENT, read, render, type Choice } from './consent'
+import { CONSENT_EVENT, POLICY_EVENT, read, render, type Choice } from './consent'
 
 const Ctx = createContext<Analytics | null>(null)
 
@@ -125,7 +125,11 @@ export class ErrorBoundary extends Component<ErrorBoundaryProps, ErrorBoundarySt
 
 const listen = (on: () => void) => {
   window.addEventListener(CONSENT_EVENT, on)
-  return () => window.removeEventListener(CONSENT_EVENT, on)
+  window.addEventListener(POLICY_EVENT, on)
+  return () => {
+    window.removeEventListener(CONSENT_EVENT, on)
+    window.removeEventListener(POLICY_EVENT, on)
+  }
 }
 
 /**

package/src/tags.ts

@@ -32,7 +32,8 @@
 // reads the same table.
 
 import { namesOn } from '@hanzo/events'
-import { CONSENT_EVENT, read, render, type Choice } from './consent'
+import { CONSENT_EVENT, read, render, serve, type Choice } from './consent'
+import { siteKey } from './org'
 import { capture, touch } from './touch'
 import type { Analytics } from './core'
 
@@ -54,24 +55,6 @@ export interface TagOptions {
   domains?: string[]
 }
 
-/**
- * The publishable key of each site's project, which is how cloud finds the site's
- * tag set. A `pk-` is public by design (it ships in every page); it names a site,
- * never a platform id. A host absent here has no tag config unless `start` is
- * given a key.
- */
-export const SITE_KEY: Readonly<Record<string, string>> = Object.freeze({
-  'hanzo.ai': 'pk-CmfLA2K6kvsPflrS9DSkt06H_kSoQB_21sjedt6VJdc',
-  'www.hanzo.ai': 'pk-CmfLA2K6kvsPflrS9DSkt06H_kSoQB_21sjedt6VJdc',
-  'hanzo.app': 'pk-wlnXN2a9_vmCm60yTFtQ629Q8TyuaxBNZbY1RWT72gQ',
-  'hanzo.team': 'pk-NCzD2FiHpZv8KUpkCX4olT1LJOJsMxBC_Z8NkiQsOFQ',
-  'pay.hanzo.ai': 'pk-eX6kv7JZNoiYn1WkeJH3tT_8OvkVYScmCXnLMwxTKf8',
-  'platform.hanzo.ai': 'pk-My1RpZLEUnTj8vAdPbWKYdDUuhxZJ4dVjHcwjZN4rZ8',
-  'docs.hanzo.ai': 'pk-jukhtjMT2ymoeBDAeFjINQWlBv-v9sNn1TPztiCrrwk',
-  'hanzo.bot': 'pk-W5d7Mn7ZukT7igyscIy6Pqe8JpA0Ge604Yn4xNR4JCU',
-  'cloud.hanzo.ai': 'pk-RAfEGHPoNdCEU9fnA_cPd_Xo9Tci44rlYQV9xuJ1Ob0',
-})
-
 type Call = (...args: unknown[]) => void
 type Page = {
   dataLayer?: unknown[]
@@ -107,6 +90,29 @@ function flush(): void {
   if (settled() || leaving) held.splice(0).forEach((send) => send())
 }
 
+/**
+ * Resolves once every tag this visitor's choice loads has taken the page view, or after
+ * `limit` ms, whichever is first: the tag set has answered, gtag.js has loaded or failed,
+ * and Meta's library has replaced the stub that queued the call. A page that is about to
+ * leave waits on this so the visit is counted where it arrived. A tag the choice does not
+ * load is not waited for.
+ */
+export function ready(limit = 3000): Promise<void> {
+  if (typeof window === 'undefined') return Promise.resolve()
+  const start = Date.now()
+  const meta = () => {
+    const fbq = page().fbq
+    return ![...loaded].some((k) => k.startsWith('meta:')) || typeof fbq?.callMethod === 'function'
+  }
+  return new Promise((resolve) => {
+    const tick = () => {
+      if ((configured && settled() && meta()) || Date.now() - start >= limit) return resolve()
+      setTimeout(tick, 100)
+    }
+    tick()
+  })
+}
+
 function script(src: string, onload?: () => void, onerror?: () => void): void {
   const s = document.createElement('script')
   s.async = true
@@ -300,7 +306,7 @@ export function start(o: TagOptions = {}): () => void {
     const base = (o.base ?? 'https://api.hanzo.ai').replace(/\/$/, '')
     const q = new URLSearchParams()
     const host = o.host ?? window.location.hostname
-    const key = o.key ?? SITE_KEY[host]
+    const key = o.key ?? siteKey(host)
     if (key) q.set('key', key)
     q.set('host', host)
     const answer = (list: BrowserTag[]) => {
@@ -312,8 +318,9 @@ export function start(o: TagOptions = {}): () => void {
     const cap = setTimeout(() => answer([]), 3000)
     fetch(`${base}/v1/project/tags?${q}`)
       .then((r) => (r.ok ? r.json() : { tags: [] }))
-      .then((j: { tags?: BrowserTag[] }) => {
+      .then((j: { tags?: BrowserTag[]; consent?: unknown }) => {
         clearTimeout(cap)
+        serve(j.consent)
         answer(Array.isArray(j.tags) ? j.tags : [])
       })
       .catch(() => {