Files
zeekayandClaude Opus 5.5 3314477005 hanzo.agency sends its telemetry as a CORS-simple request, which the browser delivers from any origin
@hanzo/event 0.3.11 posted JSON with the publishable key in Authorization and
credentials: "include". That request preflights, and the preflight must carry
Access-Control-Allow-Credentials: true, which the edge grants only to the
first-party origins that sign visitors in (hanzoai/universe
infra/cf-zones/cors.py). hanzo.agency signs no one in, so it is not on that list.

0.3.41 puts the key on ?ingest_key, sends text/plain and asks for no
credentials. That needs no preflight and no credentialed grant.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
2026-09-23 13:20:33 -07:00

50 lines
895 B
YAML

name: agency
slug: agency
version: 0.1.7
type: site
framework:
name: vite
preset: react
buildCommand: pnpm build
outputDir: dist
singlePageApp: true
routing:
domain: hanzo.agency
aliases:
- www.hanzo.agency
- agency.hanzo.ai
deploy:
plane: sites
publishScript: https://git.hanzo.ai/hanzoai/ci/.github/actions/site@v1
image: ghcr.io/hanzoai/agency
kubernetes:
namespace: hanzo
service: agency
port: 3000
commerce:
org: hanzo
checkoutUrl: https://pay.hanzo.ai
commerceApi: https://api.hanzo.ai/v1/commerce
providers:
- square
- crypto
- wire
disallowed:
- stripe
iam:
issuer: https://hanzo.id
clientId: hanzo-agency
billingPortal: https://billing.hanzo.ai
calendar:
bookingUrl: https://calendar.app.google/z1YsZQrqR4s6jQqD8
analytics:
googleAnalyticsId: G-BCXWVKFL1K
insightsUrl: https://api.hanzo.ai/v1/event