The EVENT_INGEST_KEY -> PUBLISHABLE_KEY rename (f44d441d8) renamed the build-arg
path (Dockerfile/KMS/core.ts) but left hz.js on data-ingest-key and never bumped
the version, so the rename was unpublished. Finish it: hz.js reads
data-publishable-key first. A static tag has no lockstep build to migrate it (the
guarantee the build-arg rename relied on), so data-ingest-key stays readable as
the retiring spelling — the one surface where a hard cut would silently break
hand-written HTML. Bump 0.3.16 -> 0.3.17 so the whole rename actually ships.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The value is a pk- prefixed PUBLISHABLE key (the Stripe vocabulary, and what
the build-time gate already tests for). EVENT_INGEST_KEY hid that.
One substitution covers all three spellings, since the framework prefixes wrap
the same token: EVENT_INGEST_KEY -> PUBLISHABLE_KEY, NEXT_PUBLIC_* and VITE_*
follow. KMS already carries deploy/PUBLISHABLE_KEY (env prod) with the same
value, written and read back first, so no build can reach a name that does not
exist yet.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
rrweb records the DOM; this package decides what may leave the device and posts
raw eventWithTime batches to POST /v1/replay, attributed by a publishable pk-
key and nothing else. Masking happens at capture time on @hanzo/observe's
RedactionPolicy rather than a second one, and the recorder refuses to run on
credential-bearing routes at all.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Found by recording a real page in a real browser and grepping the payload for
canaries, which is the only test that can find these. All three passed review and
passed the suite.
maskAllInputs is NOT "mask everything". rrweb reads `true` as "use MY hardcoded
type list instead of yours", and that list has no `hidden` — so the table this
package passed was discarded and a hidden input's value serialized in full. A
CSRF token rode out in the FullSnapshot of a login form (reproduced, canary
`CSRF-LEAK-CANARY-…`). Passing `false` plus our own complete table keeps the
decision in maskInput(), which already refuses SECURE_TYPES whatever the mode
says. Same policy, one authority, and `hidden`/`checkbox`/`radio`/`file` are in
the table now — the types carrying a value the user never typed and never sees.
A secret key was accepted. `publishable()` existed and only the beacon path
consulted it, so an `sk-` key was refused on unload and sent in an Authorization
header on every other batch. The test named "refuses to start without a
publishable key" only ever asserted the empty string. record() now refuses any
non-`pk-` key, so a secret has no carrier out of the browser rather than one
carrier that happens to refuse it.
The rrweb escape hatch is spread first, so an option the gate does not NAME is
one the caller can still set. recordCrossOriginIframes (another origin's DOM,
which our policy cannot reach inside to mask), collectFonts and plugins are now
pinned, as are blockClass/ignoreClass/maskTextClass — renaming those silently
disarms every rr-block already written into the app's markup.
Each fix has a test that fails against the previous commit; verified by running
the new tests against it (4 failed, 66 passed).
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Records the DOM with rrweb and POSTs raw eventWithTime batches to
POST /v1/replay, attributed by a publishable pk- key.
Masking happens at capture time, in the browser, and reuses @hanzo/observe's
RedactionPolicy rather than defining a second one: isPrivate() for subtree
exclusion (selector plus node-level, so a custom privateAttribute is honored),
sensitiveKey() for field identity. Password and cc-* fields are blocked outright;
URLs on Meta/snapshot/mutation events go through @hanzo/event's redactSecrets;
the recorder refuses to run on /callback and /login/oauth/device and stops if the
app routes onto one.
Orthogonal to @hanzo/observe: semantic capture there, DOM movie here.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
React Native defines `window` but no `document`/`window.location`, so
`isBrowser()` (typeof window !== 'undefined') took the browser path there
and `init()` threw on `window.location.search` — the mobile telemetry gap.
Require `document` too. RN now reads as non-browser: `init()` returns early
(skipping attribution + the visibility/unload listeners RN lacks) while
`capture()`/`flush()` — not gated on this and sending via plain `fetch` —
still emit. Browser and SSR/Node behaviour is unchanged (a browser always
has `document`; Node has neither). No second transport.
Version stamped in all four sources (package.json, version.ts, hz.js) so the
consistency tests stay green. 152/152 pass.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The Switch was 36x29 instead of 36x20 for as long as it existed, and nothing
anywhere would have said so. gui's `size` variants return
{ height, minHeight, width }; a wrapper that sets `height` and not `minHeight`
overrides two of the three, and min-height beats height, so the variant's floor
survives. The control is silently the wrong size — and on a pill the browser
then clamps the radius until it is not a pill.
Whole-surface, over the same Gallery the stylesheet is generated from, so the
next component to grow a `size` variant is covered without anyone remembering
to add it.
Scoped to the controls whose geometry IS the contract, because a floor is not
itself a smell. Textarea writes `minH={64}` on purpose — its own doc says rows
are the floor and not a fixed size — and the unscoped version of this test
flagged it. A guard that cries wolf on correct code gets deleted, and then the
real one is not there either.
Two mutations, both verified: drop `minHeight` from the Switch and it reports
`switch: height 20px, floor 29px`; misspell the slot list so the guard matches
nothing and the coverage assertion fails rather than passing green. That second
one is the same shape of silence the guard exists to catch — a check that runs
over an empty set reports success, which is how an absent name passes for a
clean result.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
b18b61a bumped @hanzo/design to ^0.4.7, which softens light off pure white
(#f7f7f7 background, #fafafa card, #ffffff popover) because a #ffffff page reads
as a lightbox. I rebased onto that commit but never re-ran install, so the build
resolved the 0.4.6 already in node_modules and dist/theme.css went out carrying
the ramp 0.4.7 exists to replace. The manifest said ^0.4.7 the whole time; only
the artifact disagreed.
Nothing in the unit suite could see it — theme.css is composed from whatever
design is installed, so both builds are self-consistent. The consumer gate is
what caught it, by loading the real page in a browser and reading the computed
--background against the literal the spec pins: expected #f7f7f7, received
#ffffff. Exactly the class of defect that gate exists for, on the first run where
it had something to say.
A caret range plus a stale node_modules is a silent artifact change. Install
before you build after a rebase that moved a dependency.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
8.0.61 and data 1.2.2 were both published while this batch was in flight (the
peer-range fix took 8.0.61; data 1.2.2 went out still pointing at src). Rebased
onto b18b61a rather than over it: its `>=8.1.0` peer ranges stand, and this
batch's `next` optional peer and `@hanzo/data >=1.2.3` join them.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The wrapper destructured `type` out of props and never forwarded it, passing
`secureTextEntry` alone — and gui DROPS that spelling on web. So every masked
field built on @hanzo/ui's Input rendered its value as readable text in every
browser, with the eye control sitting next to it offering to reveal what was
already visible. This is the exact failure `masked()` was written for, in this
repo, and this component never called it. It calls it now, and only on the
password path: masked(false) states type="text" and would overwrite a caller's
type="email".
`masked` moves to backends/gui/mask.ts, which is where a platform prop-spelling
belongs; product/SecretInput re-exports it, so nothing downstream moves.
`hidePasswordToggle` becomes `reveal` — one word, positive, and no longer a
double negative on a control the caller may already own. Suppressing it does not
unmask: two controls over one boolean is a field with two states that disagree,
where pressing ours leaves the caller's icon reading "show" and neither can say
which one masked the field.
The rest are the component gaps four migrations measured:
CopyButton draws a label when given one. There is no variant to pick, because
the forms differ in exactly one thing — a control standing alone under a minted
key has no neighbours to explain an unlabeled glyph, and inside a code header the
word is noise. The accessible name follows the visible text.
StatusTag speaks invoices — paid, open, past_due, uncollectible, draft, void —
through `tone` in ./tone, a pure lookup a billing surface can assert without
mounting a pill. Still no hue: the four tones are rungs of the grey ladder, and
`stopped` is set apart by an EDGE, the same choice Fieldset makes for its
destructive register. It had to be: `failed` and `pending` painted identical
tokens before, so the vocabulary had four names and three visuals.
FieldText forwards autoComplete and id. It does NOT take a `name`, and that
absence is deliberate and measured: `name` is gui's own prop (it names a styled
component and a theme) and is consumed before it reaches the element, so
accepting one would type-check, render nothing, and leave a caller believing
their form posts a field it does not.
Fieldset grows and floors its width, so a settings TAB can be two columns without
each group being wrapped in a sizing box of its own. Panel takes an icon and a
description — the caption every console was smuggling in as its first child.
Code's language label moves to $color11, the ramp's readable secondary. On this
package's own ramp $color10 already cleared 4.5:1 (8:1 dark, 11.8:1 light), so
the 2.97:1 measured on hanzo.ai/overview came from a HOST redeclaring --color10
at :root — which is the argument for the change, not against it: a shared
component should not need the host to be careful.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Four surface migrations measured the same wall this week and each one wrote its
own copy rather than climb it. The wall is packaging, not components.
`export { ThemeToggleNext }` in the product barrel was a STATIC edge to
@hanzogui/next-theme, whose provider imports `next/script`. One line put Next in
the graph of every Vite, Express and Tauri host — the hosts this layer promises
to run on. It has its own subpath now; `<ThemeToggle />` still reaches it by
dynamic import and still degrades when next-theme is absent, and dist.test.ts
asserts BOTH, because a test that only asserted the absence would pass just as
well on a deleted feature. `next` becomes an optional peer: next-theme requires
it and nothing here admitted that.
`@hanzo/ui/product/pure` is the rules with none of the layer — pages(), masked(),
displayName(), tone(), orgScope, filterOptions, resolveBrand. Every module it
re-exports imports nothing and none is stamped 'use client', because a stamped
module is a client REFERENCE on React's server layer and calling pages() through
one in a server component throws instead of paging. The components import the
same modules, so there is one definition rather than a testable copy of a shipped
one. Proven by `require()` in a CHILD node process: under vitest, vite's
transform is already installed and the test would prove nothing.
`./product/*` and `./primitives/*` open deep imports. `@hanzo/ui/css` is
substitute() — jsdom does not resolve var(), so every consumer trying to assert
the contrast of a rung compared a colour to a function call. With no vars map
that is exact, not approximate: jsdom mounts no design sheet, so the fallback IS
what a browser computes. It is not part of ./core, which is ESM-only because
@hanzo/design publishes no require condition — and a jest consumer is precisely
the caller that needs this.
@hanzo/data pointed its exports at src/index.ts and shipped raw TSX. Every
consumer transpiled it, and `require('@hanzo/data')` could not load at all, which
is one of the two edges that break `require('@hanzo/ui')`. It emits dist/ now, in
both formats, from the SAME postbuild.mjs — parameterised rather than copied,
since a second copy is a second place to get the barrel rule wrong.
The utility classes carry `hz-`. This sheet claimed `.row`, `.skeleton`, `.fade`,
`.mono`, `.drag` and `.tnum` at the document level, in a package an app imports
once at its root; an app with its own `.row` got no warning, it got whichever
rule the cascade preferred, from a stylesheet it never opened. The bare selectors
stay as aliases for one minor version and are REMOVED IN 8.1.0.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
@hanzo/ui peer-depended on `@hanzogui/config: >=8.0.0`, and an app satisfying
that with 8.0.1 got `@hanzogui/web@8.0.0` — beside the `web@8.1.0` its direct
`@hanzo/gui@8.1.0` pulls. Two copies of the gui runtime, both typechecking,
both building, and then the config singleton lives in one module while the
components read the other. hanzo.industries hit exactly this on a routine bump.
The loose peer range IS the split, so the fix is here rather than in an override
downstream: @hanzo/gui, @hanzogui/config and @hanzogui/next-theme all move to
`>=8.1.0`. An app can no longer land on the 8.0 train while holding 8.1.
Also closes the hole in the harness that let this reach an app at all. The
consumer test installed @hanzo/ui alone, so the ONE shape that can split — a
real app depending on @hanzo/gui DIRECTLY, beside @hanzo/ui — was never
exercised, and the one-copy check I added last night reported a clean single
copy while a real consumer got two. The test app now installs @hanzo/gui and
@hanzogui/config the way every real app does.
Mutation-proven both ways: restore the `>=8.0.0` peer, have the consumer satisfy
it with config@8.0.1, and the harness now fails naming both versions —
"2 copies of @hanzogui/web resolved: 8.1.0, 8.0.0". Before this commit that same
scenario passed.
289 unit, 28 browser, webpack green, one copy of @hanzogui/web.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The same browser was several people. 0.3.14 moved the bundled client's anonymous
id onto a cookie shared across *.hanzo.ai, but two other implementations of the
same idea kept running: hz.js minted into hz_id — a key of its own, so a page
carrying both it and the npm client sent two anonymous ids for one visitor — and
the tag hanzoai/cloud hosts at /v1/event.js had a third resolution over the
shared key, so an origin carrying only the tag stayed split from everything else.
The chain now lives in src/anon.js and nothing else implements it:
- src/storage.ts imports it; anonId() is a call.
- hz.js has no bundler, so it inlines the marked region VERBATIM, and
src/anon.test.ts compares the two byte for byte.
- hanzoai/cloud vendors the same file for its tag.
Resolution is cookie · localStorage hz_anon_id · localStorage hz_id · in-memory ·
mint. Every id already in a browser is ADOPTED and only a browser holding none is
given a new one, so no returning visitor is reset — including the ones who have
only ever met hz.js, whose hz_id is carried onto the shared key instead of being
orphaned beside it.
hz.js also drops its restated UUIDv7 minter and uid.ts re-exports the chain's, so
the version nibble the plane's session rollups admit cannot diverge between
distributions. sessionId() is unchanged: a session stays origin-local.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Both branches bumped 0.3.12 to 0.3.13 with different payloads, so the merge
resolved without a conflict and would have republished a taken version under a
different meaning. 0.3.13 on npm is the redact-by-parameter-name fix; the
shared anonymous-id cookie is 0.3.14. The CHANGELOG now says which is which —
0.3.13 shipped without an entry.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
anonId() kept the id in localStorage, which is ORIGIN-scoped, so docs, cloud,
console, studio, pay and www each minted their own for the same browser. One
marketing -> docs -> signup -> checkout journey therefore arrived as several
strangers: 463 anonymous identities carried 545 events in a week, about 1.2
events each, which is a funnel that cannot be read. Signed-in stitching was
never affected -- it joins on the OIDC subject.
The id now lives in a cookie on the registrable domain
(Domain=hanzo.ai; Path=/; SameSite=Lax; Secure, two years, refreshed on read),
which every subdomain shares.
The migration is ADDITIVE: cookie, else the hz_anon_id this package has always
written in localStorage -- adopted into the cookie, never minted over, because
minting there would hand every returning visitor a new identity and detach
their history -- else mint. localStorage keeps being written, so a rollback
finds everyone where it left them.
Degradation is what it was: SSR and prerender return undefined rather than
minting a server-side id; cookies refused falls back to localStorage; both
refused holds one id in memory for the page load instead of letting every
event mint its own. Domain and Secure are omitted off hanzo.ai (localhost,
previews), where either attribute makes the browser drop the cookie outright.
sessionId() is unchanged -- a session stays origin-local.
Cross-registrable-domain identity (hanzo.app, hanzo.chat) is deliberately NOT
attempted here; a cookie cannot cross and third-party storage is blocked.
storage.test.ts is new: the adopt, cookie-wins, shared-jar, mint, SSR,
cookies-refused and both-refused cases. Seven of them fail against the old
anonId, including the one that asserts two *.hanzo.ai surfaces sharing a jar
resolve to the SAME id -- the reported bug, reproduced.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
8.0.57 fixed the geometry and broke the thumb, and 8.0.58 and 8.0.59 shipped it
that way. Measured live on the page it was meant to fix: ON was a
rgb(255,255,255) thumb on a rgb(250,250,250) track, OFF a rgb(26,26,26) thumb on
a rgb(26,26,26) track. Two states, both painted onto their own background, so
the control had no visible thumb at all.
gui wraps the thumb in a `t_SwitchThumb` sub-theme that INVERTS the whole ramp.
Measured, at the frame and inside the thumb:
$color3 rgb(26,26,26) rgb(171,171,171)
$color12 rgb(250,250,250) rgb(10,10,10)
So `$color10` and `$color1`, chosen by reading the frame's palette, resolved
under the thumb to precisely the two track colours they were sitting on.
The fix is not a better pair of guesses. The thumb now takes THE SAME TOKEN as
its track, and the inversion does the rest: naming one token paints both sides
of the pair, and the contrast becomes structural — the thumb cannot come out the
colour of the track beneath it, in either state, whatever the palette does
later.
The test gap is the more useful half. The suite asked whether the two STATES
differ from each other, and they did — `_bg-color10` against `_bg-color1` — so
five green tests and a clean typecheck shipped a control nobody can see. Nothing
asked whether either state differs from the thing behind it, which is the only
question a switch's appearance actually poses. `paints the thumb with its
track's token` asserts that invariant on the markup, and it fails on exactly the
pair that shipped.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Every pattern in SECRET_PATTERNS recognises a secret by what it LOOKS like — a
JWT's three dots, sk-, AKIA, ghp_. An OAuth code, a state, a password-reset
nonce and an invite token are opaque random strings indistinguishable from a
page id, so none of them matched and all of them survived.
The client stamps url = window.location.href on EVERY event, not only
pageviews, so one visit to /callback?code=&state= put a live, still-redeemable
authorization code on the wire once per event, in cleartext.
Redacting by parameter NAME is the only signal available for an opaque token.
The name half is bounded and the value half stops at the first separator, so
neither can backtrack — the discipline the creds-in-URL pattern already
documents. Ordinary params (plan, utm_source, page) are untouched.
hz.js carried a second copy of VERSION that the bump missed; its own test
caught it, which is what that test is for.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The telemetry client was mounted and could not write. api.hanzo.ai answers
401 ingest_key_required for the key v5.7.6 ships, so every logged-out visitor's
pageview has been discarded at the door — and a static export has no runtime in
which to notice.
The key got there by hand. app/lib/analytics.ts read
NEXT_PUBLIC_HANZO_INGEST_KEY, a spelling neither KMS nor any builder carries,
so the only way to satisfy it was a local `docker build --build-arg`. A
credential with no automated source is satisfied once and then goes stale in
silence, which is exactly what happened.
One name now, end to end: KMS deploy/EVENT_INGEST_KEY -> ARG EVENT_INGEST_KEY ->
ENV NEXT_PUBLIC_EVENT_INGEST_KEY, which is the name @hanzo/event already falls
back to reading. The Dockerfile refuses a build whose key is empty or is not a
pk- key -- the second case rejects the stale pk_ format outright -- and after the
export it greps app/out for the value, because a rename on either side of
process.env leaves the build-arg intact and the bundle blank.
hanzo.yml gains the images: block that declares the image and its build_secret.
hanzoai/ci is the only lane that implements build_secrets, reading KMS
deploy/<NAME> into --build-arg and failing closed on an empty value, so it is the
lane. The hand-rolled job in .hanzo/workflows/deploy.yml is now dispatch-only
rather than deleted: it cannot reach KMS, but deleting a host's only build lane
strands it with no failing run to show for it.
Tag shape changes with the lane. ci publishes sha-<sha7>-amd64, latest, and an
imgver semver derived as max(declared, published)+1 patch -- 5.7.7 next, with no
v prefix -- where the retired job published <short-sha>. universe
charts/app/values/hanzo/ui.yaml pins tag AND digest together and needs both.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Seen on the real 501-command catalog: a row lays out by distributing slack,
and the name and its summary were two siblings competing for it. The summary
won, so `deploy application-get` rendered as "ap…" beside a full sentence of
help — the one string being searched for, and the one that has to be read to
choose a row, was the string that disappeared.
They share one flexible cell now and only the HELP may shrink. The same
change fixes a second symptom that looked unrelated: a row with no help at
all pushed its name to the far right edge, because with nothing to absorb
the slack the gap went between the icon and the label.
`shrink`, not `flexShrink` — this package's text primitives take the
shorthand, and the long form does not typecheck.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
A pk- names ONE org for everybody holding it; a bearer names a real principal
and resolves to THAT person's org. So the key is what attributes a visitor
nobody has vouched for, and it must never displace someone who has been.
Key-wins was survivable only while the key had to be passed in code. 0.3.11
also resolves it from the build env, which turned it into a hazard: setting one
variable silently blanks every signed-in user's token and re-files their events
under whichever org minted the key. On a console served to several brands from
one bundle — console.hanzo.ai, console.lux.cloud and console.zoo.cloud are the
same bytes behind the same service — that is a cross-tenant leak introduced by
an env var.
Anonymous traffic still rides the key, which is the whole point of having one.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
@hanzo/design moves its light page off pure white (#ffffff -> #f7f7f7) so a
light surface stops reading as a lightbox. This test asserts EQUALITY with
design's declared values rather than a contrast threshold, so design moving is
supposed to fail it — that is the test doing its job, and the expectation moves
WITH design rather than the assertion being loosened.
Lands before design@0.4.7 publishes, so ui's suite is never red against a
palette it has not acknowledged.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The follow-up CommandDialog's prop forwarding named: hanzo.app, console and
chat each carry a hand-rolled palette and a hand-written list of what can be
run, and the three lists already disagree with each other and with the API.
Palette is the component half. It composes CommandDialog — the shape that
commit made possible — so the hand-rolled Dialog-around-a-bare-Command does
not come back under a new name. Props in, callbacks out: it does not fetch
commands, does not run them, and does not know what a project is. `children`
is the right-hand slot, which is how hanzo.app keeps its project preview and
console keeps its `>` mode without either forking it.
The other half is cloud's GET /v1/commands — every operation the API answers,
projected from the one route table that already produces the REST routes, the
OpenAPI document, the MCP tools and the CLI. A surface passes that list in.
match.ts is the whole decision, as pure functions over plain values:
Safe methods browse; unsafe methods must be named. Typing "delete" into a
bar holding 2,323 operations offers four dozen destructive fleet operations
to somebody who wanted to delete a project. GET matches fuzzily; every other
method needs an exact prefix of `group label`. No second list and no
curation — the method is already in the registry and already means this.
An empty query hides every route. A fuzzy matcher with no query matches
everything, and everything is 2,323 rows the moment the dialog opens. The
Run group is a search, not a browse; what remains on open is the surface's
own handful of local commands, which is what ⌘K-with-no-query wants anyway.
A per-group cap, because one keystroke may still match hundreds.
A route command and a local command are ONE type: `method` is present exactly
when it names a route, and it is the only field the rule reads. That is what
lets a surface's own nav entries and 2,323 cloud operations sit in one bar
with one executor callback.
useCommandK moves in from hanzo.app unchanged — ⌘K always, `/` only when the
target is not editable. That second condition is why chat needs no exception
written for it: its composer is a TEXTAREA, so the global `/` never fires
there, and a `/` typed into the palette's own input is a literal slash.
Tested where each part can be: match.test.ts pins the rule without a DOM,
Palette.test.tsx mounts under the real GuiProvider (a build, a typecheck and
a pack all pass on a component that throws on first paint) including at the
2,400-op size that motivated the cap. The rows themselves are portalled and
so are out of static markup's reach — the same limit render.test.tsx records
for every dialog in this package.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Interaction analytics was app work. Every surface wired its own client and
instrumented its own call sites, so a click on the same Button was named three
ways or not at all. `<Hanzo analytics>` is now the whole wiring: one prop on the
root an app already mounts, and every click, change, submit and route change
inside the tree reaches the ONE front door named by the component it happened
on — `card/button[Save]` — with input values withheld.
A prop, not a default. Mounting a component library must never start a network
conversation the app did not ask for; off, no provider renders and no listener
is installed. On, it renders @hanzogui/telemetry's provider, which is where
consent already lives (GPC, DNT, the stored choice a banner writes). No second
client, no second stream, no second consent policy.
Component names are real in production. Every primitive already carries a
`data-slot` through one helper, so `componentName()` reads it — ranked ABOVE the
React fiber owner deliberately, because the fiber name is development-only and a
dashboard grouped on it empties silently at deploy. A named node keeps its
qualifier now (`button[Save]`, not `button`): a component name says what KIND of
thing it is, and a library renders hundreds of each.
It cannot double-count. The engine installs DELEGATED listeners on a root, so
two engines on one root report everything twice — which is exactly what an app
got by following two true sets of instructions at once, since a library provider
starts an engine and observe's own README told apps to mount another. The first
engine to start now claims its root and any later one stays inert. The claim
lives on the page under a `Symbol.for` registry rather than in module scope: two
copies of the package in one bundle have two module scopes and would not see
each other's claim, which is precisely when a duplicate is most likely.
Driving it in Chromium found what jsdom could not: the input debounce was ONE
slot shared across elements, so moving to the next field cleared the previous
field's pending timer and a filled form reported only the last field touched.
Keyed by field now.
hz.js could not authenticate at all. Through 0.3.11 it sent no `Authorization`
and no `?ingest_key=`, so every keyed static surface wrote unattributed, the
door refused it (401 ingest_key_required), and nothing in the page said so — the
tag measured fine in the browser and the surface was simply missing from the
warehouse. `data-ingest-key="pk-…"` now rides the header on fetch and the query
on a headerless unload beacon, the same pair the npm client uses. It also honors
Global Privacy Control and the stored `hz_consent` choice, not DNT alone, and
its stamped `libraryVersion` is pinned to the package version by a test — it had
drifted three patches, dating every static-site row to the wrong release.
The hz.js suite ran none of its tests: Node >= 21 ships a `navigator` whose
descriptor has no setter, so the harness's assignment threw. The one shipped
file with no bundler and no import-time typing had no executed coverage. It runs
again, and now asserts what reaches the wire — transport, URL, headers — not
only the batch.
@hanzo/event 0.3.12, @hanzo/observe 0.1.7, @hanzo/ui 8.0.58.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Three defects, all measured on a live page, all invisible to a build, a
typecheck and a pack because the component rendered fine -- it rendered the
wrong thing.
GEOMETRY. gui's `size` variant returns { height, minHeight, width } for the
default `$true` size. Setting `height` here overrode two of the three, and
min-height beats height, so its 29px floor survived: every Switch in every app
was 36x29 rather than 36x20. At that ratio the browser clamps a 1000px radius
to 10px, so it was not even a pill -- a rounded rectangle with a 16px dot
adrift in the middle of it. `minHeight` is not redundant beside `height` here,
and that is the whole bug.
STATE. gui's checked treatment is `$backgroundActive`, which in this theme
resolves to the value the unchecked track already carries. Measured live: on
and off were pixel-identical -- rgb(36,36,36) track, rgb(204,204,204) thumb,
both states -- and differed only by the thumb's 14px of travel. A state carried
by position alone is one a screenshot, a narrow column and a low-vision reader
all fail to read. `activeStyle` is the hook gui honours for this; it is pulled
out of props before Tamagui can mistake it for the press pseudo-style, and it
replaces `$backgroundActive` rather than layering over it.
WEIGHT. The white is now spent on ON and nowhere else. A resting page is mostly
switches that are off, and a near-white thumb on each of them is a field of
lights with no signal in it, which is what a full page of these looked like.
Off is `$color3` under a `$color10` thumb; on is `$color12` under `$color1`.
Disabled is stated too -- it had no treatment at all, so a disabled switch sat
beside eight live ones with nothing to tell them apart.
One trap worth the paragraph it costs, because all three spellings differ. The
Thumb's activeStyle is typed as the SHORTHAND style set: `backgroundColor`
paints but is not in that type; `background` IS in the type and compiles to a
separate `_background-` class that races the base `_bg-` one on load order
rather than replacing it; `bg` replaces it. Consumers build with
ignoreBuildErrors, so the first would have shipped a type error nobody sees and
the second a colour that lands or does not depending on stylesheet order.
Five tests, each mutation-verified against the defect it covers: drop
`minHeight` and the pill test fails; drop `activeStyle` and the state test
fails; go back to `background` and both the state test and the single-class
guard fail.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Six surfaces hand-build chrome this package already ships. Three of the
five things added here existed — they were just unreachable.
CopyButton lived in chat/Code.tsx, so the only way to import it was
@hanzo/ui/chat, and nobody hunting for a copy button looks in a chat
module: ~30 hand-rolled copies across app, hanzo.ai, chat, console, pay
and billing. It moves to product/; Code imports it rather than owning it.
UserMenu was written inside AppHeader and could not be reached at all, so
five surfaces wrote their own account menu. Extracted whole — AppHeader
now renders it, so the header's menu and a standalone one cannot drift.
OrgSwitcher gains `direction` and `footer`. hanzo.app's local copy names
those two gaps in its own docblock as the reason it exists; that copy can
now go. OrgMark gains emoji marks and a broken-logo fallback — org logos
are tenant-supplied, so a dead URL is the normal case, not the rare one.
New because they were genuinely absent: Fieldset (the titled settings
group the Field* rows sit in — Panel is a dashboard tile, a different
job), SecretInput (mask · reveal · copy), and Pagination, whose `pages`
rule is pure and testable and whose fixed width the four hand-rolled
pagers each broke somewhere.
And one defect the mount tests found: gui DROPS `secureTextEntry` on web.
<FieldText secure> has therefore been rendering API keys in plain text in
every browser since it shipped. `masked()` sets the native and the web
spelling together; both call sites use it and a test locks it.
279 tests (was 253).
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
8.0.54 re-based `outlineColor` on `dark` and `light`, measured hanzo.app, and
found the three controls the audit actually named — Sign In, Get started,
Search — still ringing at 1.4:1. gui activates a `Button` sub-theme for every
Button it renders, so those three read `dark_Button`, which the root-only fix
never touched. The page's own `--outlineColor` was already design's; the
buttons standing on it were not.
So the ring is re-based across all 390 themes. The ramp ships 21 distinct ones,
twenty of them hues — a pale blue on `dark_blue_Button`, a pale pink on
`dark_pink` — and every one fails 3:1 on a near-black canvas the same way the
grey did. A sub-theme exists to hold different COLOURS; a focus ring is not a
colour choice, it is a contrast requirement, and this system has exactly one.
The edge and the label stay on the two root themes, deliberately: `dark_accent`
really should label in the accent's colour and `dark_red` really should edge in
red, so spreading those two everywhere would flatten 388 themes and stop being
a re-base. `light_*` sub-themes take the light fallback, `dark_*` the dark one.
24 files / 254 tests, vite and webpack consumer suites green.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
`$outlineColor` shipped `hsla(0, 0%, 27%, 0.6)` from the same upstream ramp the
last commit re-based two rungs of. Composited over @hanzo/design's ground it is
rgb(45,45,45) — 1.44:1, measured. WCAG 2.4.11 asks 3:1. On hanzo.app that ring
is what Sign In, Get started and Search draw when a keyboard reaches them, so
the three primary CTAs had no visible focus state at all.
Nothing about the number says so, and that is the point: on a white page the
same grey clears 3:1 comfortably. It is a value inherited from a light-first
substrate, spent on a dark-first product. A ramp cannot know which canvas it
will land on; a token can, which is why design publishes --ring as translucent
white — it lifts with whatever surface is under it. Over the ground it lands at
3.77:1.
So the ring joins the edge and the label: `var(--ring, …)` with design's own
literal behind it, per theme. Fixed once in the theme rather than on each
control — hanzo.app reaches this config through `lib/gui.ts`, which is a
one-line re-export of it, so every gui component on the surface moves together.
The test computes the ratio rather than matching the string, and measures the
old value beside the new one in both themes: dark fails, light passes, which is
the whole shape of the bug and proof the check can fail.
24 files / 253 tests, vite and webpack consumer suites green.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Two fixes with one cause: a value that was correct in this package and lost
before it reached a pixel.
THE SCRIM. `[data-slot="dialog-overlay"]` set `opacity: 1` and an 80% ground
and carried no `!important`, while every material rule beside it does. gui
compiles the overlay's own opacity and ground into atomic classes (`_o-0--5`,
`_bg-rgba0000--538295333`) that land in an inline <style> a bundler orders
AFTER this sheet — equal specificity, later source, so they won. Measured on
hanzo.app's ⌘K palette: `rgba(0,0,0,.5)` under a further `opacity: .5`, an
effective quarter black, which is the exact double dim this rule was written to
end. It shipped that way for a whole release because the rule was present and
reading it told you nothing. A rule written to beat a compiled class has to be
written with the weight to beat one.
THE TWO RUNGS. `$color1..$color12` is a generic monotonic ramp inherited from
upstream `@hanzogui/themes`, and on two rungs it undid a decision @hanzo/design
had already made in writing:
$borderColor (= $color4) was `hsla(0, 0%, 14%, 1)` — a SOLID edge, on Button,
Input, Card, Select, Dialog, Popover, Tooltip, Switch, Checkbox and
DropdownMenu at once. design's colors.css spends a paragraph refusing exactly
that: a solid hex hairline stops being a lighter LINE the moment it lands on
a lifted surface and becomes an unrelated grey.
$color12 was `hsla(0, 0%, 100%, 1)` — PURE WHITE, and it is the label colour
for Button default/primary, every Badge and the `accent` recipe, the one loud
control a page is allowed. design sets --foreground to #fafafa because pure
white halates on near-black. The ramp reintroduced the halation the token was
authored to avoid.
Both now read the token: `var(--border, …)` / `var(--foreground, …)`, design's
published literal behind each so a host with neither sheet still gets a value
instead of a dropped declaration. The rest of the ramp is left alone — greys in
a scale of greys, which design has no opinion about. Sub-themes keep their own.
The literals are stated per theme, and compose-theme now teaches design's light
block a bare `.t_light` beside `:root.t_light`, because a NESTED
`<Theme name="light">` — PrimaryButton's white pill inside a dark app — emits
that class on a span, which `:root.t_light` cannot match. Without it a light
island stood on dark tokens, and a --foreground label on a white pill would
have come out white on white. glass.css's own light block gets the same alias
so the two do not disagree about what "light" means.
gui-config.test.ts reads @hanzo/design's stylesheet and fails by rung and by
theme if either column stops matching what design publishes, so the copy cannot
drift; glass.test.ts pins both scrim declarations.
24 files / 250 tests, vite and webpack consumer suites, gallery rendered in
both themes before and after: the scrim darkens to 80%, nothing else moves.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Rungs 1 and 2 read `var(--shadow-sm|--shadow-lg)` and rung 3 `--shadow-floating`
— @hanzo/design's names, reached with design's own values as fallbacks, checked
against design's sheet so the copy could not drift. All of that was true and
none of it helped, because the ramp is not design's alone: @hanzo/brand declares
--shadow-sm/md/lg/xl too, at :root, tuned for a WHITE canvas — .05 and .1 where
design says .40 and .55. Same names, same specificity, so the winner is whichever
sheet the bundler ordered last, and it was brand. A declared variable also beats
a var() fallback outright, so the mirror could not rescue the rung either.
On #080808 those drops resolve to a shadow you cannot see. The lit edge still
drew, so nothing looked broken — the ladder just went FLAT, rungs 1 and 2 reading
alike, which is the one thing a ladder may not do. hanzo.app had been carrying an
`html:root` block restating both tokens to get its depth back; that workaround
goes now.
Three values are three names, so the ladder declares --glass-shadow-1/2/3 itself.
Nothing else ships a --glass-shadow-*, so no sheet can outrank them and no load
order can change the answer. A theme that wants a different ladder declares these
three and gets one — a hook, where reading the ramp was an accident.
Both themes are stated, and that is not extra. Design tunes the ramp per canvas
(.06/.09/.18 in `.light`) because on white the drop does all the work and must be
light enough not to smudge. Renaming with only the dark fallback would have fixed
dark and put a 6x-too-heavy drop on white — trading one flat ladder for one
smudged one, against this file's own promise of "one composition, both themes".
The values are design's, in both columns, and the test fails if either moves.
Rung 3 is renamed with the other two even though --shadow-floating collides with
nothing today. The ladder is one concept and re-tuning it should mean touching
one namespace; and the defect class is "reads a name it does not own", which
fixing two rungs of three leaves alive.
.paper in motion.css had the identical bug and lost its drop the same way. It
keeps a fallback because that sheet ships on its own, and the test pins the
fallback to the rung so the two cannot disagree.
The test that pinned the fallbacks by name would have gone stale silently, since
`--shadow-sm` simply stops appearing. Replaced with the law that matters: no
sheet may read the size ramp again, by any spelling. Role names — --edge-highlight,
--surface-scrim, --shadow-inset-hairline — are coined for one job by one package
and stay. Verified to bite: restoring the old `var(--shadow-lg, …)` fails it.
--edge-highlight stays design's on purpose. It is uncollided, and design's
zeroing of it in `.light` is the half of the composition that lets one rule work
on both canvases.
243 tests pass, 27 in glass.test.ts.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Grid `max` — the missing half of `min`. A single auto-fill floor cannot say
"2-up on a phone, 4-up on a desktop": 2-up at 390px needs a ~170px floor, and
that same floor yields SIX columns at 1280. `max` raises the floor to one-Mth of
the row so auto-fill cannot fit an (M+1)th track, and below that width the max()
picks the min again and the grid wraps normally — so the cap costs nothing on
small screens. That is why it is expressed as a floor and not a breakpoint.
Proven: remove the cap and 1280px comes back FIVE columns.
@hanzogui/* ranges move to the 8.1 train. The @hanzogui packages pin each other
EXACTLY (toast@8.0.0 -> core@8.0.0, no caret), so one stale range here dragged a
whole second generation in beside a consumer's. Both typecheck, both build, then
the config singleton lives in one copy and the components read the other, and
the app dies on prerender with `Missing theme.` — hanzo.ai hit that and had to
state the invariant by hand in a pnpm.overrides block. The invariant belongs in
the package that caused it.
The whole train moved together, including pkgs/canvas and pkgs/dashboard:
bumping this package alone SPLIT the monorepo the same way, and the ~30 "prop
does not exist" errors that produced were the split wearing a mask, not an API
change.
The consumer harness now asserts ONE copy of @hanzogui/web in the installed app,
before any test runs. Mutation-proven the honest way: the first attempt "passed"
because `pnpm pack` had failed and the check never ran — the real proof pins an
older @hanzogui/web in the consumer and watches the diagnostic name both
versions.
NOT changed: `gui-config.d.ts` ending `}, "default">`. That was reported as a
latent declaration defect; it is not one. `InferGuiConfig`'s eighth parameter IS
`ExtractAnimationDriverKeys<E>`, so `"default"` is the correct resolution for a
config whose animations object has one driver named `default`. An honest lib
check (skipLibCheck off) reports zero errors in that file. Changing it would
have made it wrong.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
CommandDialog rendered `<Command>` bare, so none of the palette's own props
reached it. A host could not read the highlighted row, which makes a two-pane
palette — list left, preview of the highlighted item right — impossible with the
stock component. hanzo.app hit exactly that and rebuilt the dialog by hand
around the bare `Command` primitive; its file still carries the reason:
"Composed from the @hanzo/ui `Command` primitive inside a wide `Dialog`
(rather than the stock `CommandDialog`, which doesn't forward
`onValueChange` — needed to drive the preview panel from the highlighted
row)."
So the whole palette surface comes through, not just the one prop that was
asked for: value, defaultValue, onValueChange, filter, shouldFilter, loop,
label, vimBindings, disablePointerSelection. Forwarding only onValueChange
would mean the next host needing `loop` files the same bug again.
`value`/`onValueChange` are the SELECTED ITEM, matching Command's own names and
cmdk's before it. The SEARCH string stays CommandInput's `value` — a different
prop on a different component, as it always was.
Mutation-proven in a real browser: the gallery renders an open CommandDialog
driving a host-owned readout from the highlighted row, and typing must narrow
the list. Restore the bare `<Command>` and it fails with "onValueChange never
reached the host".
This only makes the collapse POSSIBLE; the four hand-rolled palettes are a
follow-up, not this commit.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
gui redeclared three of design's token names and won, so every app that wires
GuiProvider's theme class onto <html> got gui's palette instead of design's.
Two mechanisms, and fixing only the loud one leaves the page just as wrong:
:root.t_dark / :root.t_light (0,2,0) — beats design's :root on SPECIFICITY
:root { --background: var(--t1) } (0,1,0) — TIES design and wins on SOURCE
ORDER, because gui's block is appended after design's
The second is why the acceptance test still read gui's grey after the first
pass. Both are stripped now, at generation time, from the ROOT theme blocks
only.
Sub-themes are untouched, and that is why this is a parser and not a regex:
`.t_accent`, `.t_blue_Button` and 246 others legitimately scope their own
background — that is what a nested theme IS. Only an exact `:root`,
`:root.t_dark` or `:root.t_light` is the root theme.
Also aliases design's light block to gui's spelling. design is `:root` (dark)
with `.light`; gui emits `t_dark`/`t_light`. They never had to agree while gui
was declaring its own --background — it simply won. Now that design owns those
names, an app carrying only gui's `t_light` would get design's DARK palette,
because nothing matches `.light`. So design's light selector also answers to
`:root.t_light`: one added selector, never a second copy of the values.
This retires the two interim workarounds in the field. Both were re-imports of
design's colors.css placed LAST, which cannot beat (0,2,0) — they only appear
to work where the theme class never reaches <html>, and revert the day someone
wires themes correctly. A fix that expires on being fixed.
Acceptance test asserts EQUALITY with design's declared value per theme, not a
contrast threshold: the measured drift was dark grounded at gui's #141414
instead of design's #0a0a0a, which passes any contrast gate and still reads as
"why is our black slightly grey". Mutation-proven — restore the shadow and
--background under t_dark comes back gui's, not #0a0a0a.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The gate has never gone green, and both reasons were the harness rather than the
package.
`vite preview` was left to pick its own interface, and which one it picks
differs by machine: on macOS it bound [::1] and 127.0.0.1 refused; on the Linux
runner it did the reverse and `localhost` was the address that never answered.
The poll therefore counted to 60 and declared the app broken AFTER the pack, the
install and the vite build had all succeeded — a message that reads like a
packaging defect and is the harness looking somewhere the server is not.
Swapping one literal for the other only moved which platform it failed on; this
names `--host 127.0.0.1` so the server, the poll and playwright's baseURL are
the same address by construction, everywhere.
`stdio: 'ignore'` is the second half, and it is why the first half took three CI
runs to find. A preview that died on startup and one that was merely slow
produced the identical message thirty seconds apart, on a runner nobody can
attach to, while vite had printed the reason on the very first run and the
harness threw it away. Its output is captured and reported with the failure now,
and an exited process fails immediately instead of waiting out the full timeout
for an answer that cannot come.
Locally: 23/23, exit 0. The 19 non-screenshot assertions are the evidence — the
four screenshots compared against baselines playwright had recorded on the
previous failing run, which proves nothing, and those darwin PNGs are deleted
rather than committed. Baselines here are -chromium-linux and belong to the
runner; a macOS rendering in that set would mask exactly what it exists to
catch.
Nothing ships from here — this package publishes `dist` only — so no version
moves.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
`vite preview` binds IPv6 only. It prints "Local: http://localhost:4390/" and
answers on [::1]; 127.0.0.1 refuses the connection outright. The harness polled
`http://127.0.0.1:4390`, so it counted to 60 and threw
Error: consumer app never came up on http://127.0.0.1:4390
on every run — AFTER the pack, the install and the vite build had all succeeded.
That reads like the package is broken and it is the harness looking at the wrong
address. Measured both ways here: 127.0.0.1 -> connection refused, localhost and
[::1] -> 200, on a dist/ containing one hand-written index.html and no @hanzo/ui
at all.
The same literal made the "someone else is already on this port" guard inert —
its probe could not connect either, so the one thing it exists to catch could
never be caught.
playwright.config.ts carried the same address as its baseURL, so it is the same
fix in both places.
With this, the suite reaches the app and 19 of its 23 assertions pass locally;
the remaining 4 are the screenshots, whose committed baselines are
-chromium-linux and cannot match a darwin run. Nothing is shipped from here —
this package publishes `dist` only — so no version moves.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
publish.yml runs `run --if-present test` for every package it ships, and it has
no browser. @hanzo/ui's `test` had grown into vitest + the Vite consumer + the
webpack consumer — the two that pack a tarball, npm-install it into a throwaway
app outside the repo and drive it in chromium. Real gates, and hanzo.yml already
runs both in its own `ui-consumer` job next to the `playwright install` that
gives them a browser. In the publish job there is no such step, so the last gate
before an immutable version could only fail.
That is the same shape this repo has paid for twice already and named both
times: a gate that cannot go green. It is why 8.0.44 through 8.0.47 were hand
publishes.
`test` -> `pnpm run test:unit`, one definition rather than a second copy of
`vitest run`. hanzo.yml is untouched: it already calls test:unit, test:consumer
and test:consumer:webpack by name, so the split it describes is unchanged and
nothing it gates is lost.
241/241 green; the webpack consumer passes against the packed 8.0.48 tarball.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The console had eight recipes in lib/chrome.ts and ~120 lines of globals.css
holding the whole law of Hanzo chrome — what a floating surface is made of,
what a resting one is, what dims the page under a modal, how rows are grouped,
which item is current, which control is loud. Every one of them was earned by a
measured defect, and every app that wants the look either imports it from here
or re-derives it and gets a different answer.
`@hanzo/ui/glass` — glass(2|3), scrim, panel, rows, row, selected, accent,
screen — as plain objects that spread onto any @hanzo/gui element. A recipe
rather than a variant because a variant only reaches the one component that
declares it, and half the loud controls in a real app are an XStack, a
SizableText or a Link.
`@hanzo/ui/glass.css` — the material, the ladder, the scrim and the row
separators. Its own entry point AND inlined into theme.css by compose-theme, so
a host that already has the token layer can take the material without it, and
the two can never say different things about what glass is.
Every value is @hanzo/design's, reached by name: --edge-highlight, --shadow-sm/
lg/floating, --surface-scrim, --background, --border. The fallbacks are design's
own, present so a host without design's sheet gets a ladder instead of a
silently-dropped declaration — and glass.test.ts reads @hanzo/design/styles.css
and fails if any of them stops matching, so the copy cannot drift.
Three things this decomplects on the way through:
- The ladder had four rungs reading `var(--hz-elevation-N, <hardcoded>)`.
Nothing here, in @hanzo/design, or in any consumer ever defined an
--hz-elevation-*; every rung resolved to its fallback. Same for .paper's
--hz-ring and --hz-paper-highlight. An indirection through a name that does
not exist, reading like a theming hook. All three retired for the real ones.
- Depth is now the lit edge PLUS the drop, at every rung. On a near-black
canvas a cast shadow is nearly free of information — black on near-black
moves no pixels — and the top lip catching light is what actually says one
surface is above another. design zeroes --edge-highlight in .light, where a
white line on a white card is nothing, so one composition serves both themes.
- Glass was described twice and the two disagreed: the component's stand-in
ground was $color2 while the material is 72% of --background, so a browser
that could blur and one that could not showed two different colours of menu.
<Glass> is now the component form of glass(level).
SlideOver moves from the retired 4th rung to 3, where a drawer belongs: no
anchor, a scrim of its own, floats free exactly the way a modal does.
25 new law tests, 241/241 green, build clean.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
8.0.46 flattened @hanzo/design's stylesheet into ours and inherited its
@font-face rules, whose `url(./assets/fonts/Geist-Variable.woff2)` is relative
to DESIGN's file. Composed into ours it resolves against @hanzo/ui/dist, which
ships no assets. webpack's css-loader resolves url() and fails the build:
Module not found: Can't resolve './assets/fonts/Geist-Variable.woff2'
in node_modules/@hanzo/ui/dist
Vite leaves an unresolvable url() alone, so all 23 consumer tests stayed green
and hanzo.app found it instead. design's own sheet warns about exactly this —
"the url()s are relative to THIS file" — and I inlined it anyway.
Fix is (b): design owns font delivery. Copying the .woff2 files into this
package would fix the build and recreate the real problem — two packages
shipping the same font, one fact in two homes, the thing retiring @hanzo/tokens
was about. So the @font-face rules are dropped from the composed sheet. This
package NAMES the families, which is all it ever claimed to do (gui-config: "the
host self-hosts both faces — this only names them"), and a consumer wanting them
self-hosted imports @hanzo/design/styles.css, where the files actually are.
Two defenses, both mutation-proven:
· compose-theme.mjs refuses to write a sheet containing ANY url() — this
package ships only "dist", so a relative asset reference is always a lie.
Proven: keep the @font-face and the build stops with both filenames.
· a webpack + css-loader consumer now runs beside the Vite one, installing the
same packed tarball. Proven BOTH directions — re-introduce the bad url and
webpack fails with the exact hanzo.app error while Vite still passes 23/23.
That second half is the point: the Vite-only harness was blind to the whole
class, and now something is not.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
@hanzo/ui pinned @hanzo/tokens@1.0.0, last touched 2026-03-22, while
@hanzo/design@0.4.6 — "single source of truth for every Hanzo surface" — is what
the design lane and several surfaces already consume. store/billing/industries
followed design; the convergence branches followed the stale package; pushing
either over the other reverted real work. One fact, two homes.
Measured before deciding: theme.css declared 34 custom properties, 19 of which
design already publishes, character for character the same job. design ships 244
— including `--border-focus`, `--border-selected`, `--destructive-hover` that we
never had. It was not a different layer. It was a copy.
So the 19 are gone and design is composed in at BUILD time
(scripts/compose-theme.mjs reads the installed package), never copy-pasted into
source — a copy is how the fork reappears inside the package. What remains in
src/theme.css is only what design does not ship: the chart ramp, the sidebar
set, the Geist bindings, and this package's own rules. Same for the JS side:
@hanzo/ui/tokens re-exports @hanzo/design, so code and stylesheet read one layer.
Flattened, not `@import '@hanzo/design/styles.css'`, for the reason design's own
entry point gives: a bare specifier is not browser-resolvable, and a nested
@import must precede all other rules or it is dropped silently.
The hsl() trap from store's decision doc is now a build-time check, not a memory:
design publishes FINISHED colours, so `hsl(var(--x))` is invalid at
computed-value time and the browser drops the whole declaration without a word.
compose-theme.mjs refuses to write a sheet containing one. Audited: neither
package had any. Mutation-proven — adding `hsl(var(--background))` fails the
build.
`./core` and `./tokens` become ESM-only: @hanzo/design is `"type": "module"`
with no `require` condition, so a CJS build of those subpaths cannot load it.
Better a clear resolution error than a crash deep inside design at run time. The
MAIN barrel is untouched — it pulls ./core/cn directly. Zero consumers import
either subpath (checked across nine repos), so nothing breaks today.
216 unit tests, 23 browser tests. The palette shifts to design's finished values;
baselines refreshed, and "every border is a hairline" plus "components are
actually styled" both still pass, so the shift is the adoption and not a loss.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
0.3.10 read NEXT_PUBLIC_HANZO_EVENT_KEY, a fourth spelling of a value that
already had three: KMS holds deploy/EVENT_INGEST_KEY, every Dockerfile takes
EVENT_INGEST_KEY as a build-arg, and re-exports NEXT_PUBLIC_EVENT_INGEST_KEY
for Next to inline. Read that one.
Also stamps VERSION, which is hand-maintained beside package.json: 0.3.10
shipped reporting 0.3.9 as its libraryVersion, so its rows were
indistinguishable from the previous release's. The version test caught it.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Five defects shipped to production this week and every one was invisible to the
type checker and to the build. They are all one shape: a box whose size is
decided by the wrong party.
Grid — real CSS grid, tracks declared by the CONTAINER.
repeat(auto-fill, minmax(min(Npx, 100%), 1fr)) — responsive with zero
breakpoint props, and the min() is what stops a 900px track from overflowing a
390px phone. Fixed counts use minmax(0, 1fr), never a bare 1fr, whose implicit
`auto` floor lets one long child widen its own column. Replaces hand-rolled
width="calc(25% - 7.5px)", which is even only while every child agrees.
AspectRatio — the box has a height BEFORE its content loads, so media is never
zero-height and nothing below it shifts. Child img/video fill it via a rule
keyed on `data-ratio`, stamped after the props spread so a wrapper renaming
data-slot cannot silently unhook it — Card.Media renames it, and targeting
data-slot is exactly how the rule stopped matching in the first draft.
Card — a surface, not a control. Sizes from content. Adds Card.Media, and an
`interactive` prop that puts role/tabIndex/Enter/Space on the surface itself,
so nobody wraps a card in a Button to make it clickable.
Section — page rhythm from the space scale, in one place, mobile-aware.
Button — `height` becomes `height:'auto'` + `minHeight`. BOTH halves matter:
minHeight alone lets GuiButton.Frame supply its own height (measured 44px),
which re-pins the box AND makes every ordinary button 8px taller. With both,
an ordinary Button still measures exactly 36 and an oversized child makes it
grow instead of being cropped to a sliver.
fonts.mono — `$mono` was never defined; gui emits NO class for an unknown font
token, so 260 fontFamily="$mono" call sites across 74 files in hanzo.app were
dead silently. Also declared on the ambient type, which is derived from
defaultConfig and so could not see it.
Mutation-proven, not asserted. Each guard was broken and watched to fail:
· remove the fill rule -> object-fit reads "fill"
· minmax(min(N,100%),1fr)
-> minmax(N,1fr) -> the page scrolls sideways at 390px
· remove fonts.mono -> $mono resolves to the sans face
· height:auto+minHeight
-> height: -> a 119px child renders in a 36px button
Reported honestly: minmax(0,1fr) and `min-width:0` are REDUNDANT — each alone
holds the row even, so neither mutation fails on its own. Only disabling both
does. That is a property of the design, not a gap in the test.
23 browser tests, 216 unit tests.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Superseded by hanzo.yml + .hanzo/workflows/cicd.yml, which gate the package
this repo publishes and were observed green before this commit was pushed.
Nothing is lost with it. Of ci.yml's four jobs, Lint was the only one that
could pass; Build and Test both ran `cd pkgs/ui`, a directory that is not in
this tree, and Type Check died on ~10 TS7016s in a stale registry app resolving
`@hanzo/ui` to a published package with no declarations.
deploy.yml stays: it builds ghcr.io/hanzoai/ui and is green, and a repo should
never be left without a delivery path. registries.yml stays too — it is a
narrow validator for two apps/v4 JSON files that still exist, scoped by path so
it costs nothing on a normal push.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Run 26906 shows four matrix legs. @hanzo/ui passed end to end. The other three
are three separate defects, none of them in the packages:
@hanzo/og and @hanzo/shop — `pnpm publish` printed npm's own success line,
`+ @hanzo/og@1.0.0`, and the very next command said
`::error::@hanzo/og@1.0.0 is not on npmjs after publish`. Both are on the
registry now. npmjs is read-after-write eventually consistent and this asked
it exactly once, about two seconds after the write. So retry — six times over
a minute — and fail only if it never appears.
A false red on a publish is worse than a slow green: it reports that a release
did not happen when it did, so the next person bumps the version to "fix" it
and burns a number over a replication lag.
@hanzo/canvas — `bun test`, on a runner with no bun: `spawn ENOENT`. The step
that exists to stop an untested release was the thing stopping the release,
and canvas has sat at 0.2.2 here against 0.2.1 on npmjs ever since. Install
bun, but only when the package's own manifest asks for it, and from npmjs
rather than bun.sh/install — this job already reaches that registry, and the
shell installer wants unzip a minimal runner image need not carry.
Also add workflow_dispatch. A publish that failed for an infrastructure reason
could previously only be retried by pushing another commit that touched a
package.json — burning a version number to re-run a job that was never wrong
about the code. detect-changes reads what npmjs SERVES, so a dispatch publishes
exactly the packages that are ahead of the registry and nothing when none are.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
A surface declares its error plane with one inlined variable and its event
plane with none: ingestKey could only be passed in code, so a surface that
did not pass it sent every beacon unattributed.
The door refuses an unattributable write (401 ingest_key_required) rather
than filing it under a tenant its owner cannot read. That is the right
refusal, but it is silent in the page — the only symptom is the host
missing from the warehouse. Reading the key from NEXT_PUBLIC_HANZO_EVENT_KEY
(then HANZO_EVENT_KEY) puts it exactly where the DSN already lives.
Explicit config still wins. Without a key a surface still reports for
whoever is signed in, and drops everyone who is not.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
ci.yml has four jobs and three of them could not pass at any commit:
Build cd pkgs/ui && pnpm run build:full
Test cd pkgs/ui && pnpm test:coverage
-> both: `cd: pkgs/ui: No such file or directory`. The package is
pkg/ui, singular. It moved; these two steps did not follow.
Type cd app && pnpm run typecheck
-> ~10x TS7016 `Could not find a declaration file for module
'@hanzo/ui/animation/*'`. app/ aliases
"@hanzo/ui": "npm:@hanzo/ui-shadcn@^5", so those imports resolve to
a published package that ships no declarations. Nothing in this
tree can fix it.
So the red said nothing about this repo, and a gate that cannot go green stops
being read. Meanwhile the only thing that DID test pkg/ui was publish.yml —
after the version was already immutable.
Move the gate onto the canonical lane: root hanzo.yml holds the config,
.hanzo/workflows/cicd.yml is a 7-line caller into hanzoai/ci. The gate is the
three commands publish.yml already proves green on this runner (21 files, 212
tests), run before a release instead of during one.
.hanzo/workflows, not .github/workflows: CI here runs on git.hanzo.ai, which
resolves only the former, and github.com has no runner for the hanzo-build-*
labels — the same file there would queue forever.
ci.yml stays until this is observed green.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
8.0.42 (the rename) was published minutes AFTER someone else published 8.0.43,
and npm points `latest` at the most RECENTLY published version, not the highest
semver — so `latest` went backwards to 8.0.42 and consumers stopped seeing
8.0.43's Button work. 8.0.44 carries both and puts `latest` back on top.
theme.css took main's rewrite wholesale (dark is the default there now); the
only thing re-applied on top was `.hz-elevation-N` -> `.elevation-N`. The
`--hz-elevation-N` custom properties it reads are untouched.
Screenshot baselines refreshed. The four comparisons failed after the merge and
the diff mask says exactly why: only the `default` and `primary` buttons moved,
which is precisely what main's "primary is the macOS dark pushbutton" and "the
unmarked Button is quiet" did. destructive/outline/secondary/ghost/link, the
badges, the card and the inputs are pixel-identical. The rename on its own was
pixel-identical across all 12 tests before this merge, so the restyle is the
whole delta and the baselines were simply never refreshed when it shipped.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The stable handles a host selects on were branded and inconsistent: two
prefixes (`hanzo-`, `hz-`), a BEM double hyphen, and compound names. They are
now bare single words the way a utility framework names things, with variants
on a single hyphen.
hanzo-button -> btn hz-mono -> mono
hanzo-button--* -> btn-* hz-tnum -> tnum
hanzo-badge -> badge hz-row -> row
hanzo-badge--* -> badge-* hz-row-in -> row-in
hz-skeleton -> skeleton hz-paper -> paper
hz-drag-item -> drag hz-menu-in -> menu-in
hz-fade / -up -> fade/fade-up hz-slide -> slide
hz-collapse -> collapse hz-elevation-N-> elevation-N
@keyframes hz-shimmer/hz-pulse -> shimmer/pulse
Bare names, no prefix. Collision was the whole reason the brand was there, and
it is not a risk here: every consumer is ours, and hanzo.app's user-generated
content renders in sandboxed iframes. A clean break with no dual-name window
beats carrying two vocabularies forever.
CSS custom properties deliberately do NOT move. `--hz-elevation-3`, `--hz-ring`,
`--hanzo-accent` are inherited globals a host SETS to theme us; a bare
`--accent` on :root really does collide, and they are not selectors.
src/styles/hanzo-motion.css -> src/styles/motion.css. The public subpath
`@hanzo/ui/styles/motion.css` is unchanged; only the file behind it moved.
buttonVariants dedupes: variant and size share the `btn-` namespace and both
default to `default`, which emitted `btn-default` twice.
Verified: 216 unit tests, and the real-browser consumer test green against the
packed tarball including all four screenshot comparisons at 390px and 1280px in
both themes — pixel output is unchanged, so nothing lost its styling.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
@hanzogui/input ships two halves of one cue and both were wrong, each hiding
the other:
focusVisibleStyle draws outline: 2px solid $outlineColor at a 2px offset,
emitted as `:root:root:root:root ._outlineWidth-…:focus-visible { … 2px
!important }`. No consumer stylesheet can retract that — hanzo.app tried
`outline: none` and lost — so every field grew a ring held off its own edge.
focusStyle brightens to $borderColorFocus, which resolves to the SAME value
as $borderColor here. The cue that was meant to make the ring unnecessary
rendered nothing, so the ring was the only feedback a focused field had.
Both are set as PROPS, which is the only thing that works: a prop replaces the
variant's atomic class rather than competing with it on specificity. $color06
against a $borderColor rest is ~5:1, so the edge alone carries the indicator
(WCAG 2.4.13).
One rule in one file, shared by Input and Textarea, so the two cannot drift.
Spread before each component's own ...props, so a call site can still say
otherwise.
Verified in the DOM: rest 1px $borderColor / no outline / no shadow; focus
rgba(255,255,255,0.6) / outline 0px none / no shadow. The emitted class goes
_outlineWidth-0focus-visible-2px -> -0px.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Every 0.1.x before this built and packed correctly and then died at the
registry: the NPM_TOKEN sealed in KMS was not a credential npm recognised
(whoami answered {}, publish answered E404). Replaced, verified round-trip.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The path was documented as a guess and it was wrong: NPM_TOKEN sits at the org
root, while deploy/ holds CLOUDFLARE_*, GIT_TOKEN, KUBECONFIG and
UNIVERSE_PIN_TOKEN. The read also used the older
/v1/kms/orgs/<org>/secrets/... form with .secret.value, which 404s against
cloud's embedded KMS — the flat /v1/kms/secrets/<name> form answers
{name, env, value} and is scoped by the token's own owner claim.
Measured against the live KMS: the flat form returns an npm_-prefixed token.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Asking npm what it serves fixed the detection, but the comparison was '!=',
which fires in BOTH directions — @hanzo/data sits at 1.2.1 against npm's 1.2.2
and @hanzo/dashboard at 0.1.0 against 0.2.0, so the run tried to walk the
registry backwards. Only a strictly greater local version is a release.
The matrix legs are independent publishes, so fail-fast withheld eight good
packages because @hanzo/agent-ui builds no types file. They no longer share a
fate.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
@hanzo/observe 0.1.2 never reached the registry. The version-change check
compares HEAD~1 against HEAD, and HEAD~1 is the FIRST PARENT — so a merge whose
first parent is the feature branch already carries the new version, the diff is
empty, and the publish is skipped while npm keeps serving the old release. The
same class of miss is already recorded in this file: 8.0.29 sat unpublished
while npmjs served 8.0.28.
The registry is the only source of truth for what is published, and asking it
is independent of merge topology and of how many commits the runner fetched.
observe goes to 0.1.3 because 0.1.2 is a version npm never saw.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
A $color12 fill on an otherwise quiet dark page reads as glare. The
strongest control is now an elevated gray ($color5 fill, white text,
hairline, hover one step up) — the native macOS dark-mode pushbutton.
White backgrounds are no longer any button's default anywhere.
@hanzo/ui 8.0.42
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
default used to be the same value as primary — white filled — so every
unstyled <Button> in every app shouted. The loudest treatment must be asked
for by name: default is now a control on the surface ladder ($color2,
hairline, hover brightens the border more than the fill); primary is
unchanged and explicit.
Glass (backends/gui/glass.tsx, [data-slot=glass]) is a surface, not a
layout: solid $color2 panel that theme.css upgrades to the translucent
blurred material only under @supports (backdrop-filter) — content never
sits on see-through ground the browser cannot blur. For floating chrome
(menus, dialogs, popovers, docked toolbars); page sections stay on the
ladder. Composes with brand/design tokens via var(--background).
@hanzo/ui 8.0.41
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
`npm i @hanzo/ui` and render a component; it looks right. No gui.config.ts, no
CSS import, no generator script.
import { Hanzo, Button } from '@hanzo/ui'
<Hanzo><Button>Ship</Button></Hanzo>
8.0.40 shipped 13,178 bytes of CSS in two files, both of them TOKENS. The rules
that style the components did not exist in the package at all: @hanzo/gui
compiles a style prop to an atomic class the first time something RENDERS it, so
the sheet only exists after a render, and every app was expected to run a
generator of its own and import the output. hanzo.app never did — it shipped 103
`_bg-` classes and 26 `_dsp-` classes against a stylesheet containing zero of
either, every gui-styled element unstyled in production, with a green build for
the whole life of the bug.
The render happens at OUR publish time now. `scripts/gen-css.mjs` renders
`src/gallery.tsx` in both themes and harvests `config.getCSS()` into
`dist/styles.css` — 381,060 bytes, 35 KB gzipped, 340 atomic selectors — and
`<Hanzo>` imports it. Styles gui generates at runtime for props we cannot know
at publish time still reach the document through `insertStyleRules`; the shipped
sheet is what makes the first paint, and every SSR or static render, correct.
Two more things were the app's job and are now the package's:
the config — `<Hanzo>` passes `config` to `GuiProvider` as a VALUE, never a
bare `import './gui-config'`. Vite 8 (rolldown) ignores package.json
`sideEffects` ARRAYS outright: with any array the registration is dropped and
the first render dies on "Missing hanzogui config"; only `sideEffects: true`
keeps it, and that costs +63% bundle (404 KB -> 661 KB, measured).
Correctness does not belong in bundler metadata.
the theme — gui throws `Missing theme.` for any component with no root theme
context, so a root is structurally required. Forgetting `<Hanzo>` is a hard
crash on first paint, never a silently unstyled page.
A green build caught none of the three "classes without rules" incidents in this
estate, so the suite now compares the two directly. `src/styles.test.tsx` takes
every atomic class the gallery renders and every class `dist/styles.css` defines
a rule for, and requires the coverage to be TOTAL, not large.
`test/consumer.spec.ts` packs the tarball, installs it into a throwaway app
outside this repo — never a workspace link, which resolves through src/ and hides
every packaging defect there is — builds it, and asserts computed styles and
screenshots at 390px and 1280px in both themes. `src/gallery.tsx` is the one list
of components all three read.
That suite immediately found four defects it was built to find:
- the Slider thumb ringed itself in `$color12`, which is #fff on dark: the
solid-white-on-black border the identity forbids. `$borderColor` was not the
fix either — gui gives the thumb its own sub-theme where that token is also
white. A filled knob needs no ring.
- gui compiles style props to border-WIDTH and border-COLOR and never emits
border-STYLE, so on the components that are really <button> elements the UA's
`2px outset` survived every one of them. The Collapsible trigger rendered as
a white bar across a dark page. theme.css now carries a zero-specificity
`:where(button, input, textarea)` reset, so a component setting a width and a
colour actually draws its line.
- CardContent, CardFooter, TabsContent, ScrollArea and CollapsibleTrigger put
bare text into a View instead of through `ink()`, against the house rule.
- theme.css claimed "dark-first" while shipping LIGHT at `:root`, so an app on
the dark default that read `--background` in its own CSS got white. `:root`
is dark, `.light` retunes, and both answer to the `.t_light`/`.t_dark` that
<Hanzo> stamps on the body.
Also: `hanzo.yml` + the canonical `cicd.yml`, so both layers run on every push;
`@hanzo/ui/gallery` and `@hanzo/ui/styles.css` are public subpaths; and
gen-css.mjs exits explicitly, because vite's module runner leaves handles open
and a build step that writes its output and never returns hangs `prepack`, which
hangs `pnpm pack`, which hangs `pnpm publish`.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
onClick took the element off the MouseEvent and discarded the event, so every
$click on the wire named WHICH thing was clicked and never where on the page it
sat. Element identity cannot be drawn as a heat map.
Position rides in the existing props seam, so wireProps carries it to
@hanzo/event unchanged: $x, $y, $target_fixed, $viewport_width,
$viewport_height. Page coordinates, except on a fixed or sticky target, which
does not move with the scroll and is measured against the viewport instead.
Total: an event with no pointer (a synthetic click, a keyboard activation)
contributes no position rather than a click at the origin.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
TWO SURFACES BUILT FROM THESE PACKAGES CAME OUT BRIGHT WHITE BY ACCIDENT.
theme.css put the LIGHT palette on :root with dark behind `.dark`, so an app
that imported it and did not put class="dark" on <html> rendered oklch(1 0 0) —
pure white. That is also the inverse of @hanzo/design, whose :root is dark with
`.light` to opt out, so an app pulling in both had its theme decided by which
file happened to win. One convention now, the design system's: :root is dark,
.light opts out. `.dark` is kept so an app already stating it is unaffected, and
.light is ordered after so it can still override.
And the token values had drifted to stock shadcn oklch neutrals: `background`
was oklch(0.145), a washed near-#252525 where the system says true black, and
`card` was lighter still — the grey-box-on-grey look. An app on @hanzo/ui did
not resemble an app on @hanzo/design. The CSS in @hanzo/design is the source of
truth and this module is its TS mirror; a second set of numbers is not a second
opinion, it is drift.
destructiveForeground was independently broken: oklch(0.58 0.22 27) is the same
saturated red as `destructive`, so error text sat unreadable on its own fill.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Root package.json was already MIT; the 14 sub-package manifests, their
READMEs and CONSOLIDATION.md still claimed BSD-3-Clause. BSD-3 is out of
scope for hanzoai originals under HIP-0137 (`hanzoai/hips`). pkgs/cd stays Apache-2.0
(Argo CD clean-room port, see its NOTICE).
Drops incidental churn that rode along with the earlier commits: the two
app/public/registry JSONs that `registry:build` rewrites non-deterministically
on every run, and a unicode re-escape of pkg/ui's description that a
JSON.stringify round-trip introduced. pkg/ui/package.json is now byte-identical
to origin/main again.
What remains against origin/main is only the work: the commerce and apps/cd
build fixes, the missing `direction` in pkg/ui's resizable test, `tc` no longer
emitting into commerce/checkout sources, and shadcn declaring the tailwindcss
it imports.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Two builds were red before `turbo run build` reached a single app:
@hanzo/commerce index.ts re-exported CardTokenizeRequest/CardTokenizeResult
from ./client, which 5022535ec deleted along with tokenizeCard.
The PCI removal took the types; the barrel kept naming them.
cd vite.config.ts aliased @hanzo/cd to ../../pkgs/gitops, a path
the package left when it was renamed to pkgs/cd, and typed its
`test` block through vite's defineConfig, which has no such key.
Both green now, so all 21 build tasks pass.
Also removes @typescript/native-preview, which becc0c5af added. It was the wrong
package: native-preview is pinned at 7.0.0-dev.20260707.2, while `typescript`
itself now ships the native Go compiler as stable at 7.0.2 — the platform
binaries are real Go ELF executables, e.g.
@typescript/typescript-linux-arm64@7.0.2/lib/tsc:
ELF 64-bit LSB executable, ARM aarch64, statically linked, Go BuildID=...
So native-preview was a second, older copy of the compiler under a second binary
name. There is one compiler and it is called `tsc`; all 16 packages that becc0c5af
pointed at `tsgo` are back on `tsc`.
TypeScript 7 itself does NOT land here yet, and that is measured rather than
assumed. Forcing `pnpm.overrides.typescript=^7.0.2` across the estate takes the
build from 21/21 to 5/21. The cause is not the type system — TS 7.0.2 typechecks
all 16 tsc-driven packages clean, including pkg/ui, event and shop. It is emit:
tsup's rollup-plugin-dts crashes under TS7, and TS7 removed options these
configs still use (TS5108 moduleResolution=node10 in pkg/ui/tsconfig.cjs.json,
TS5011 implicit rootDir in agent-ui).
pkg/ui/tsconfig.cjs.json already documents this exact failure from a previous
attempt, down to the rollup-plugin-dts stack, and asks that TS7 wait for tsup.
This change respects that note instead of rediscovering it in prod: root
typescript stays ^5.9.3, matching the 17 packages that pin 5.x.
Verified: pnpm build → 21 successful, 21 total; pkg/ui 21 files, 212 tests pass.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
This reverts c98de82ae.
The premise changed: this repo keeps its shadcn identity rather than shedding
it, so the root Tailwind config, postcss config, eslintrc and components.json
are part of what it is and stay. Restored verbatim — tailwindcss,
@tailwindcss/oxide, tailwindcss-animate, eslint-plugin-tailwindcss,
autoprefixer and postcss are back in the root package.json.
The two genuine build fixes that rode along in that commit come back on their
own, next, so they are not lost with the premise that carried them.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Adds @typescript/native-preview (tsgo 7.0.0-dev.20260707.2) and points
`typecheck`/`tc` at it wherever the Go compiler was verified to reach the same
verdict as tsc. Measured, package by package, both compilers on the same
invocation:
agree, green (18) pkg/ui, pkg/data, annotate, canvas, cd, dashboard,
observe, observe-native, observe-svelte, products, react,
tests, agent-ui, commerce, checkout, apps/cd
tsgo disagrees (2) event — TS2345 on Uint8Array<ArrayBufferLike> vs
ArrayBufferView<ArrayBuffer> in src/uid.ts:34
shop — TS2591, does not pick up the node globals tsc
resolves for components/PaymentStep.tsx
red under both (3) shadcn, @hanzo/ui-web, v4 — pre-existing type errors,
left on tsc so the diff is the compiler, not the errors
event and shop stay on tsc. They are the report, not an oversight.
pkg/ui was red before this: `tsc --noEmit` failed on render.test.tsx, where
ResizablePanelGroup was written without its required `direction`. The build
never caught it because tsconfig.build.json excludes tests, so the shipped
package typechecked green in CI and red on a developer's machine. Fixed, and
pkg/ui is now green under both compilers: 21 test files, 212 tests passing.
Emit stays on tsc everywhere, deliberately. tsgo can emit pkg/ui — 920 files,
identical file list, and the only differences are comment retention in .js and
alphabetical member ordering in .d.ts, i.e. semantically equal. But this is a
published package and tsgo is a dev preview, so the artifact keeps the compiler
it has until tsgo ships stable. The flip is a one-line change when it does.
`tc` in commerce and checkout was `tsc` with no flags, against a tsconfig with
noEmit:false and declaration:true — running it emitted 188 .js/.d.ts files
directly into the source trees, next to the .ts they came from. A typecheck
script that writes build output into src is a trap; both are now `tsgo --noEmit`.
shadcn imported `type Config from "tailwindcss"` while declaring no dependency
on it, resolving through the root package.json instead. Now that the root no
longer carries Tailwind, the package declares the version it actually uses.
Verified: pnpm build → 21 successful, 21 total.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
`pnpm build` failed twice before reaching a single app:
@hanzo/commerce index.ts re-exported CardTokenizeRequest/CardTokenizeResult
from ./client, which 5022535ec deleted along with tokenizeCard.
The PCI removal took the types; the barrel kept naming them.
cd vite.config.ts aliased @hanzo/cd to ../../pkgs/gitops, a path
the package left when it was renamed to pkgs/cd, and typed its
`test` block through vite's defineConfig, which has no such key.
Both are now green, so `turbo run build` reaches all 21 tasks for the first time
on this line.
The root's Tailwind was never real. tailwind.config.cjs requires
@tailwindcss/container-queries, which is not installed — the config throws on
load, so nothing has read it in a long time. Its only referent was
.eslintrc.json, which ESLint 10 does not support at all (app/ and apps/v4 each
carry their own flat config, and neither mentions Tailwind). postcss.config.cjs
sat next to them for a root that has no build step. components.json pointed at
tailwind.config.js — a filename that has never existed here — and declared the
same "@hanzo" registry key twice.
So the root drops tailwindcss, @tailwindcss/oxide, tailwindcss-animate,
eslint-plugin-tailwindcss, autoprefixer and postcss. app/ and apps/v4 are
untouched: they declare every one of those themselves, which is why they still
build. This removes the pretence, not the styling.
While in package.json: --filter=hanzo, --filter=hanzo-ui, --filter=www and
--filter=app match no workspace project ("No projects matched the filters"), so
~20 scripts could only fail. The survivors are re-pointed at @hanzo/ui-web, the
name the app/ directory actually publishes under.
Verified: pnpm build → 21 successful, 21 total.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
insights.raw_sessions and raw_sessions_v3 have been empty for their entire
existence, and nothing ever errored. Their materialized views admit only
UUIDv7 session ids —
bitAnd(bitShiftRight(toUInt128(accurateCastOrNull(`$session_id`,'UUID')),76),15) = 7
— because they derive a session's start instant FROM the id: both the
destination's PARTITION BY and its ORDER BY are
fromUnixTimestamp(intDiv(toUInt64(bitShiftRight(session_id_v7, 80)),1000)).
This client minted with crypto.randomUUID(), which is v4, so every row it
ever sent was discarded at that gate. An MV is an insert trigger: rows that
never arrive never error, and the destination reads as "no traffic" forever.
8,432 of the 8,670 rows on the plane are v4 from this library.
Mint v7 instead. The 48-bit millisecond prefix makes the id carry its own
mint time, which is the whole reason the rollups can key on it, and it
clusters index writes by time rather than scattering them.
ONE minter, in one place: src/uid.ts. It replaces three hand-rolled copies —
core.ts (messageId), storage.ts (anonId/sessionId) and sentry.ts (eventId,
which now just formats the same id for Sentry's 32-hex wire). hz.js, the
no-build distribution, restates the algorithm for the same reason it
restates scrub.ts's redaction: it has no bundler and cannot import.
sessionId(now) mints at the caller's clock, so the instant embedded in the
id and the recorded `last` cannot disagree.
The old minters also fell back to 'a-' + base36 when crypto was absent. That
shape does not parse as a UUID, so accurateCastOrNull returns NULL and the
same gate drops it — 232 such rows are on the plane. uuidv7 degrades
entropy without crypto, never shape.
Tests: the gate and the timestamp extraction are transcribed from the
rollup's own SQL and asserted against minted ids, including the negative
(crypto.randomUUID's nibble is 4). hz.js gets its first test at all — the
real file, run against a browser stub, asserting the session id on the wire.
117 pass.
Existing v4 rows are NOT recoverable into these rollups: read as v7, the
1,586 distinct v4 session ids on the plane imply session starts spanning
1971-09-10 to 2299-12-31 across 54 monthly partitions. They remain queryable
as raw events in insights.sharded_events.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
@hanzo/commerce defaults its base URL to api.hanzo.ai, and every saved-card call
it makes has been answering 404 there: the billing surface dropped compound
words from its route names, both server repos converged, and this client did
not. Verified on the live edge — /v1/billing/payment-methods 404s,
/v1/billing/methods answers 401, which is what an address that exists says to a
request carrying no token.
This is a published package, so the dead name was not one product's bug: every
consumer that installed it inherited a client that cannot save or list a card.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
@hanzo/commerce shipped `tokenizeCard({ number, expiryMonth, expiryYear, cvc })`
→ POST /v1/billing/card/tokenize: a typed, documented, published invitation for
any consumer to collect a raw card number in first-party JavaScript. The class
doc demonstrated it with a live-looking PAN and CVC.
Its destination is deleted (commerce, same lane) and it was never reachable
through api.hanzo.ai anyway — no manifest row routes that address. So this
removes a method that could only fail, after putting the consumer's origin in
PCI SAQ-D scope. Card entry is Square Web Payments hosted fields; the nonce they
return is what `addPaymentMethod` already takes.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The image build has failed at its first compile step since 2026-07-28:
#13 ERROR: process "/bin/sh -c cd pkgs/ui && pnpm build"
did not complete successfully: exit code: 2
exit 2 is `cd` refusing a missing directory, not a compiler. pkgs/ui was
@hanzo/ui-shadcn and was deleted in 5dbdb2943 when shadcn was consolidated to a
single home; that commit did not touch the Dockerfile, so the build kept trying
to enter it and never reached `pnpm build` at all. The shadcn ENOENT warnings
higher in the log are a consequence of the same removal and are not the failure.
app now takes @hanzo/ui from the registry (npm:@hanzo/ui-shadcn@^5), so nothing
in the workspace needs building for it. @hanzo/event still does -- .npmrc sets
link-workspace-packages=true and the lockfile resolves it to link:../pkgs/event
-- so that step stays.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The deploy job asked for `ubuntu-latest`. This file lives in .hanzo/workflows,
which GitHub never reads -- git.hanzo.ai is the only thing that can run it, and
the fleet advertises no generic ubuntu-* label. That is deliberate and recorded
in the runner ConfigMap: ~1400 mirrored upstream forks all ask for ubuntu-latest,
and the forge errors rather than skipping a job it cannot place, so one bad job
was retried ~520 times across 10 runners.
An unmatched label is not a failure here, it is silence -- the job queues until
the 24h timeout. So this deploy has never produced an image, and nothing ever
said so. Same class as the playground regression, found by checking every
.hanzo/workflows file against the labels the runner ConfigMap actually declares
rather than against the ones I assumed.
hanzo-build-linux-amd64 is registered (verified against cm/git-runner-config).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
0.3.7 is unreleasable, not merely unreleased. detect-changes compares
HEAD~1..HEAD for a version change, so a release is only ever attempted by the
commit that bumps the version — and 0.3.7's bump commit is the one whose build
failed on TS5103. With the build repaired, nothing re-triggers that version:
the detector sees no change to package.json in the tip and skips the package, so
0.3.7 can never be retried from main. A version that no push can publish has to
be superseded.
npmjs goes 0.3.6 -> 0.3.8; there is no 0.3.7 to be confused with, since it was
never published. The three stamps move together, which is what the guard in
core.test.ts pins.
Worth fixing separately: a release whose build fails is stranded rather than
retryable, because the detector is tip-relative. Making it truth-relative —
publish when npmjs does not already hold the manifest's version — would make a
retry a re-run, but it would also try to publish every package whose version is
absent from npmjs, so it is not a change to slip into a bugfix.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The location is now stamped on every event rather than only on pageviews, which
is what makes a click attributable to a page. It also multiplies an exposure
that used to cost one row per page load: a password-reset, invite or magic link
carries a JWT in the query and an address in `?email=`, so a single click on
that page shipped both to the warehouse in cleartext, and every later click
repeated it. Measured against the published 0.3.6 bundle, a $click on such a URL
put the JWT and the address on the wire verbatim.
The package already had the answer and was not applying it to the one field that
is always a URL: scrub.ts, a port of the server's errortracking scrub, is
imported only by sentry.ts. url, path and referrer now get exactly that policy —
secrets unconditionally, PII unless capturePII — so there is one definition of
"must not leave the browser" instead of a second URL-specific redactor.
Applied to the ASSEMBLED record, after `...extra` rather than at the reads: a
call site can pass its own location (pageview() passed one until this commit),
and extra merges over the fields build() reads, so scrubbing at the read would
have left the highest-volume event emitting a raw location while appearing
scrubbed. On the assembled record the guarantee holds for call sites not written
yet. Ordinary URLs pass through byte-for-byte — a redactor that mangles them
would destroy the analytics it exists to protect.
pageview() no longer recomputes `url`: build() reads the same value in the same
tick. `path` stays, because a route change fires before window.location catches
up and the caller's value has to win.
hz.js carries the same policy at its own single choke point. It cannot import
scrub.ts — it is the no-bundler distribution — so the URL-relevant subset is
restated there, with identical markers so a warehouse row never reveals which
distribution wrote it. Its $outbound target and the locator's href are URLs too
and are cleaned the same way.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
A published version is immutable, so the moment before publish is the last one
where a defect is free. Nothing ran a package's tests before it shipped:
publish.yml went checkout -> install -> build -> publish, and ci.yml's test job
runs `cd pkgs/ui && …`, that one directory. @hanzo/event's suite — including the
assertion that pins the version the client stamps on every event — therefore ran
in no workflow that gates a release, so the drift it exists to catch could still
reach npmjs. It just did, in the commit before this one.
Two steps, both derived from the package's own manifest rather than a list kept
here:
- `run --if-present test`, so a package with no test script is skipped instead
of failing, and a new package is covered the day it adds one.
- the `types` entrypoint must exist after the build. tsup writes dist/*.mjs in
a separate pass from dist/*.d.ts, so a declaration failure can leave working
JS and no types — invisible here, and surfacing in dependents as "could not
find a declaration file". Asserting the manifest's own promise closes that
without naming any package.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
package.json moved to 0.3.7 for the hz.js distribution; version.ts stayed at
0.3.6. VERSION is what every event carries as `libraryVersion` and what the
Sentry sdk block reports, so 0.3.7's rows would have been indistinguishable from
0.3.6's in the warehouse — the same drift 0.3.6 was cut to fix, one release
later.
The guard added with 0.3.6 caught it: `expected '0.3.6' to be '0.3.7'`. It ran
here only because it was run by hand — the next commit puts it on the release
path.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
`ignoreDeprecations: "6.0"` was set to keep the declaration build alive under
TypeScript 6, but this package pins `typescript: ^5.9.3` (<6) and publish.yml
builds it with `pnpm --filter @hanzo/event... build`, which resolves the
package's OWN TypeScript. So the release path is always TS 5.9.3, where "6.0" is
not an accepted value:
error TS5103: Invalid value for '--ignoreDeprecations'
DTS Build error tsup exit=1 no .d.ts emitted
That is why 0.3.7 is absent from npmjs while package.json already names it — the
publish job could not get past the build. The reasoning behind the option was
sound and the direction was inverted.
tsup injects `baseUrl: compilerOptions.baseUrl || "."` into the config its
declaration worker runs (tsup/dist/rollup.js), so the deprecation cannot be
dodged by not writing one, and the escape hatch's accepted value is
version-specific. Measured, all six cells, tsup in pkgs/event:
TS 5.9.3 (pinned here) TS 6.0.3 (repo root)
absent exit 0, 3 .d.ts exit 1, TS5101
"5.0" exit 0, 3 .d.ts exit 1, TS5101
"6.0" exit 1, TS5103 exit 0, 3 .d.ts
The two are mutually exclusive, so the value has to match the TypeScript the
package declares. "5.0" is not a middle ground — it is byte-identical to absent
under 5.9.3 and still fails under 6 — which leaves absent as the only correct
value and the smallest one.
Every failing cell exits 1, so no configuration here silently ships a typeless
tarball; the claim that tsup exits zero on a declaration failure does not hold
for any of them. Whether it exits zero or not, the publish job now also asserts
the types entrypoint exists before shipping.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The tag lived in hanzoai/analytics and posted a BARE JSON ARRAY of
{site, ts, type, path, ref, props, anon, sid, w, h} to
analytics.hanzo.ai/v1/event — a second protocol behind an identical path
spelling, served by a second collector with its own Postgres. Measured:
POST api.hanzo.ai/v1/event {"batch":[]} -> 200 {"accepted":0,"dropped":0}
POST analytics.hanzo.ai/v1/event [] -> 204
One path spelling, two wires, two servers — so a client pointed at the wrong
host failed silently. This package's own README already had to warn about it.
hz.js moves here and emits the canonical WireEvent shape as { batch: [ … ] } to
POST {host}/v1/event, defaulting to api.hanzo.ai. It is the SCRIPT-TAG
distribution of @hanzo/event for surfaces with no bundler, and it carries the one
thing a bundled app does not need and a plain page cannot get: DOM autocapture —
$click (with a compact, PII-light element locator), $outbound, $scroll depth,
$form, $vitals — all on the one stream. data-product names the surface, data-host
overrides the API host, data-capture="0" turns autocapture off, DNT is respected,
and the optional data-ga / data-fb fan-out is unchanged.
Shipped in `files` so it is fetchable from the CDN as
https://unpkg.com/@hanzo/event/hz.js. The Next.js /v1/event door and the
undeployed Go collector that fed it are deleted in hanzoai/analytics.
0.3.6 -> 0.3.7.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
tsup composes baseUrl into the config its declaration worker runs, and
TypeScript 6 refuses it. The JS build still succeeds and tsup still exits
zero, so the failure is silent: the package publishes with dist/*.mjs and
no .d.ts at all. 0.3.5 was published from a tree in exactly that state and
only kept its types because the build was re-run after this was set.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
libraryVersion is the only field naming which build emitted a row, and
VERSION had fallen two releases behind: 0.3.4 and 0.3.5 both shipped
stamping "0.3.3", so three releases' rows are indistinguishable in the
warehouse. A telemetry client that cannot attribute itself cannot be
used to confirm a rollout reached production.
0.3.5 is immutable, so correcting the stamp needs a release of its own.
The guard added alongside it pins VERSION to the published version, so
this cannot drift again.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
VERSION is hand-maintained — it lives alone so sentry.ts can read it
without importing core.ts — and it fell a release behind: 0.3.4 shipped
stamping libraryVersion "0.3.3". That is the only field naming which
build emitted a row, so two releases' rows were indistinguishable in the
warehouse, and 0.3.5 would have been a third.
The existing assertions compare VERSION to itself, which holds at any
value, so pin it to the published package version instead.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
package.json listed ["app","apps/*","pkgs/*"] while pnpm-workspace.yaml listed
pkg/* as well. The repo has BOTH directories, and the two real packages under the
singular one — @hanzo/ui (268 tracked files) and @hanzo/data (36) — were therefore
invisible to anything reading package.json. It only worked because this repo runs
pnpm, which reads the yaml. npm, yarn or turbo would each have resolved
@hanzo/ui to nothing.
Also removed ~27MB of untracked build litter: eight dist-only directories under
pkg/ (agent-ui, brand, checkout, commerce, gui, react, shop, tokens — six of them
duplicating real packages in pkgs/) and pkgs/ui, which was dist + node_modules
with no src and no package.json. Every deletion was gated on being untracked AND
having no src/, and `git status` stayed at 0 dirty across all of them, which is
the proof nothing tracked was touched.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
src/gitops.ts does `export * from '@hanzo/cd'`, but the package was declared
only as an optional peer. peerDependencies create no edge in the workspace
graph, so turbo's `^build` never scheduled @hanzo/cd before @hanzo/ui — and
@hanzo/cd's types are tsup output (dist/index.d.ts), not checked-in source.
On a clean tree the build died at:
src/gitops.ts(5,15): error TS2307: Cannot find module '@hanzo/cd'
It only ever succeeded where pkgs/cd/dist happened to survive from an earlier
run, which is why this surfaced at publish time rather than in CI.
devDependencies as workspace:* declares the edge that already exists and
cannot drift to a registry copy the way a bare version range can. The
consumer contract is unchanged: @hanzo/cd stays an OPTIONAL peer, so apps
that never import @hanzo/ui/gitops still need not install it.
Verified from a fully cleared tree (pkg/data/types, pkgs/{tokens,products,cd}/dist,
pkg/ui/dist all removed): `turbo build --filter=@hanzo/ui --force` is 6/6 green
with @hanzo/cd built ahead of @hanzo/ui, and vitest is 212/212.
The lockfile additionally picks up the pkgs/annotate importer, which was absent
from it — pre-existing drift, corrected by the same install.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
pkg/ui/src/index.ts is a client boundary ('use client' on line 1) and line 18 was
`export * from './backends/gui'`. Next 16 refuses that combination outright:
It's currently unsupported to use "export *" in a client boundary.
Please use named exports instead.
So every app importing the root barrel failed to build. In hanzo.app that is 92
files — the whole app, not a corner of it: /, /resources and /usage all 500 on it.
Published 8.0.38 has the same line, so the break is live.
Naming the members also restores tree-shaking, which `export *` defeats: a bundler
cannot prove which members are unused through a star, so importing one Button
pulled the entire component surface into the graph. 92 files import the bare
barrel and none import a subpath, so nothing was shaking.
./backends/gui already declares its surface as explicit named blocks — the same
manifest scripts/gen-primitives.mjs reads to emit ./primitives/* — so this list
mirrors it rather than inventing one: 90 values and 13 types.
Verified by building: dist/index.js re-emitted with 0 star exports and the named
members present. The build still reports errors from unbuilt workspace siblings
(@hanzo/tokens, @hanzo/cd) and one pre-existing type error in pkg/data — 89 of
them are present on unmodified origin/main too, so they are not from this change.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Autocapture reaches the wire through capture(), which passes no location, so
only pageview() ever supplied url and path. Every $click/$input/$change
therefore arrived with an empty url AND path, and `host`, derived from url, was
empty with them — an interaction with no page, which is the one thing a heatmap
cannot use.
Read window.location in build(), the single point every event is constructed,
so it cannot go missing from a call site again. It sits before ...extra so an
explicit pageview() path still wins: a route change fires before
window.location has caught up.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The reference header is a grid with rows [auto_auto] that becomes two
columns ONLY when a CardAction is present. Ported to XStack it was always a
row, so the ordinary
<CardHeader><CardTitle/><CardDescription/></CardHeader> rendered as two
narrow columns with the title wrapping mid-phrase — visible on hanzo.app's
/features, and the shape all 79 CardHeader call sites in that app use.
CardAction appears in none of them; in a column it self-aligns to the
trailing edge.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
BadgeFrame set self: 'flex-start', which is alignSelf — inert unless the
PARENT is flex. Dropped in a plain <div> the XStack became a block-level
flex container and stretched edge to edge; hanzo.app's /features rendered
its "Core Features" pill as a full-width bar. display: inline-flex makes it
shrink-wrap regardless of the parent, and alignSelf still governs when the
parent is flex.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
8.0.35 was built and published from a tree that had not fetched 8.0.34, so
it shipped sideEffects: ["**/*.css"] and lost the four DATA module entries
that keep bundlers from tree-shaking the config registration away. Same
content, correct markers.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The gui deps pinned ^7.3.0/^0.1.0, which cannot resolve to 8.x — a consumer
would have installed a 7.x copy alongside the 8.x one, which is the version
split that broke rendering before. Peer floors move to >=8.0.0 so the split
cannot re-form.
The build was already red at 8.0.33 (39 errors, unchanged by the bump).
Cause: pkgs/canvas augments GuiCustomConfig but never declared
@hanzogui/core, and TS drops a `declare module` whose package it cannot
resolve — silently, so every shorthand style prop went untyped and even
`bg` and `p` read as nonexistent. Declaring it fixes 36.
The last 3 are real: Switch and Checkbox are styled() components whose prop
types are enumerated explicitly, so they never accept the config's shorthand
vocabulary. They now use the canonical longhand names.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
postbuild stamped 'use client' on every emitted file, including pure re-export
barrels. Next's flight loader hard-errors on 'export *' inside a client
boundary, so 8.0.32 broke every Next 16 consumer at dist/index.js. The client
boundary belongs to the leaves, which carry their own directive; a module whose
statements are only import/export now goes unstamped.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
8.0.32's publish run failed here with a bare 'curl: (22) 404' and no
indication of what was missing. The token is not at hanzo/deploy/NPM_TOKEN --
deploy/ was inferred from the sibling workflows that read Cloudflare creds
from it, and inference is not knowledge. 8.0.32 reached npmjs by hand an hour
later, which is exactly the manual step this was meant to end.
So: the path is a variable (KMS_NPM_PATH, default deploy), settable on the
repo or the org, and the failure now names the full path it tried instead of
reporting a curl exit code. Dropping -f is deliberate -- with it, curl exits
22 on a 404 and the message that would have said WHERE never prints.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Follow-on to 8.0.32's title. Migrating hanzo.app off the shadcn package
surfaced four more props that reach the element at runtime but had no type,
so every call site either dropped the behaviour or declared the package as
an any-typed module -- and that shim hid 79 real errors.
- Button.type: not cosmetic. Inside a form the DOM default is "submit", so a
control meant to do something else submits the form. Callers write
type="button" to stop that; dropping it is a bug, not a lost attribute.
- Progress.indicatorClassName: the moving bar, not the track. Callers colour
the bar by threshold, which the track's own className cannot express
because they are different elements. Now reaches the Indicator.
- Toaster.richColors: inert, and declared inert, exactly like the className
and style already beside it -- gui paints from tokens.
- ./dropdown-menu: the module was built and had no export entry, so it could
not be imported at all.
Deliberately NOT added: a DOM onChange on Textarea. gui's field emits the
text, not a change event, and a comment there already records that the
DOM-only spelling was a type that never matched the runtime. The call sites
using it were silently dead; they move to onChangeText instead. Per-toast
position is likewise absent on purpose -- the viewport owns placement.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
`render.test.tsx` excluded Composer on the grounds that a themed
`@hanzogui/lucide-icons-2` glyph always throws `Missing theme` under vitest, and
pointed at `pkg/ui/e2e/chat.spec.ts` for end-to-end cover instead. That file has
never existed anywhere in this repo. So the one widget carrying the IME fix had
no coverage of its own: `send.test.ts` proves the RULES, and nothing proved the
WIRING.
The throw was real, but it was ours. `@hanzogui/*` are inlined and resolve
through each package's `source` field to `src`, while `@hanzo/gui` stayed
external and resolved those same modules to `dist`. Two instances of the theme
context: the provider wrote one, every themed icon read the other. Inlining
`@hanzo/gui` alongside them leaves exactly one — one entry, and the wall is
gone. It also turns the whole-surface case in `backends/gui/render.test.tsx`
green, which had been red on main for the same reason and was being carried as
an accepted failing baseline.
`Composer.test.tsx` then mounts the real component against a live DOM and
dispatches real keydowns, because `sends` can be perfectly correct while the
field never calls it — `onKeyDown` reaches the textarea only because gui
forwards unknown props. Each assertion was checked by mutation: dropping
`keyCode` reddens only the Safari case, dropping `isComposing` only that one,
and unwiring `onKeyDown` reddens four.
pkg/ui: 20 files / 202 tests with 1 failing, to 21 files / 212 tests all green.
Nothing shipped changes — all ten `dist/chat/*.js` are byte-identical to the
published 8.0.31.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Three things that all failed the same way -- by resolving to empty rather
than erroring.
1. publish.yml read secrets.NPM_TOKEN, which exists on NEITHER the hanzoai
org nor this repo on git.hanzo.ai. An absent secret interpolates to the
empty string, so npm publish ran unauthenticated and 401'd. That is why
this package has never shipped from CI and every release was a hand
publish. It now reads the token from KMS at run time, with the machine
identity every other workflow here already uses -- one home for the
secret, and nothing new to rotate.
2. The Hanzo-registry mirror asked for HANZO_REGISTRY_TOKEN, defined
nowhere. The fleet name is REGISTRY_TOKEN (six other workflows, and the
org carries it). The step guards on that variable being set, so it took
the not-set branch and exited 0 on every run: the mirror to api.hanzo.ai
has never happened, and said so only as a notice.
3. Button did not type the title attribute. It already REACHED the element
-- unknown props are spread onto Frame, which forwards them -- but
Frame's props come from the cross-platform stack and name no DOM
attribute. So hanzo.app, which uses the tooltip at ~60 sites, declared
the whole package as an any-typed module to compile, and that shim hid
79 real type errors. Widening the type to match the behaviour is the
smaller and truer fix.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The extracted `sends()` was the whole point of the chat subpath — one helper so
no surface writes a fifth copy of Enter-to-send. It shipped with two faults
against the behaviour it was extracted from (chat's hooks/Input/useTextarea.ts).
Safari. The source reads three signals and says why:
// NOTE: isComposing and e.key behave differently in Safari compared to
// other browsers, forcing us to use e.keyCode instead
const isComposingInput =
isComposing.current || e.key === 'Process' || e.keyCode === 229
The extraction kept only `isComposing`. Safari does not set it on the keydown
that accepts a candidate, so on Safari the widget still submits the half-typed
word out from under a Japanese, Chinese or Korean writer — the exact bug the
subpath exists to end, preserved in the thing built to end it. Composer had to
be fixed too: it never forwarded `keyCode`, so no amount of care inside `sends`
could have seen the signal.
Force-send. The source sends on `isNonShiftEnter || isCtrlEnter`, and
`isCtrlEnter` never consults shiftKey. The extraction returned false for any
modifier, so Cmd/Ctrl+Enter — which every surface already taught its users —
silently stopped sending. A test asserted that regression as intended.
`ready` is untouched. IME ownership is its own predicate rather than more
clauses in the boolean: "is this keystroke the IME's?" is a different question
from "does this keystroke send?", and only the first one is browser-quirked.
Measured: build exit 0; chat tests 17 passed (was 14). The one failing suite in
pkg/ui (backends/gui render.test.tsx, "Missing theme.") fails identically at
7fed30e5 without these changes — pre-existing, not a regression here.
8.0.30 and 8.0.29 are committed but were never published: npmjs still serves
8.0.28, which has no ./chat at all. This goes out as 8.0.31.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
First publish from this repo since 8.0.28. The three faults that blocked it are
fixed in 3bf47e6f8 (trigger globbed the wrong package root, the build skipped its
workspace dependencies, TypeScript 7 broke rollup-plugin-dts); that commit
deliberately carried no version change so the pipeline could be proven before
anything shipped. It was: the forge picked up task 7936 for hanzoai/ui, which
only happens if the corrected path filter matched.
What this makes reachable: `@hanzo/ui/chat` — Thread, Message, Composer, Sidebar
(+Header/NewChat/Scroll/Section/Item/Folder/User), Header (+ShareButton/
AsideToggle/Aside), Code, Sources. hanzo/console already declares
`@hanzo/ui: ^8.0.17` and `@hanzo/gui: 7.3.0`, the exact peers this needs, so it
resolves the moment this lands. Until now `^8.0.17` resolved to 8.0.28, which has
no `./chat` export at all — verified against the published tarball.
8.0.30, not 8.0.29: the repo already sat at 8.0.29 unpublished, and
detect-changes compares HEAD~1 to HEAD, so republishing that same number is not
expressible. 8.0.29 never existed on npmjs, so the skipped number references
nothing.
Pre-publish gate, run locally with the exact command CI uses:
pnpm --filter '@hanzo/ui...' build -> "pkg/ui build: Done"
dist/chat/ -> 50 files
dist/chat/index.{js,cjs,d.ts} -> present, .d.ts exposes 30 names
./chat export -> points at dist/, and files:["dist"]
is what the 8.0.28 tarball actually
ships (1102 dist files, no src/)
That last check matters: a source-mapped export would resolve here and 404 for
every consumer, because src/ is not in the tarball.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Nothing has published from this repo since 8.0.28. 8.0.29 sits in git with the
new `./chat` entrypoint while npmjs serves 8.0.28, so every consumer resolving
`^8.0.17` silently gets a version without it — an import error in the dependent
and nothing at all here. Three independent faults, each hiding the next.
1. THE PUBLISH TRIGGER COULD NEVER FIRE FOR @hanzo/ui.
`on.push.paths` matched `pkgs/*/package.json` only, and @hanzo/ui lives at
pkg/ui (singular). The detect-changes job was already fixed to walk BOTH
roots — its comment even says a `pkgs/*` glob made pkg/ packages "invisible …
so no version bump of either could ever reach npmjs" — but the gate that
decides whether that job runs was left matching one root. Fixed in the body,
not in the thing that gates the body.
2. THE BUILD DID NOT BUILD ITS DEPENDENCIES.
`pnpm --filter @hanzo/ui build` runs alone against siblings with no dist/.
They type themselves through "types": "dist/index.d.ts", so tsc reports them
as missing modules and buries the cause under unrelated-looking errors:
src/product/SiteNav.tsx: Cannot find module '@hanzo/products'
src/core/tokens.ts: Cannot find module '@hanzo/tokens'
src/gitops.ts: Cannot find module '@hanzo/cd'
plus a wave of implicit-any in the files that imported them, which reads like
a source defect in @hanzo/ui and is not. Now `--filter <pkg>...`, which builds
workspace dependencies in topological order.
3. TYPESCRIPT 7 BROKE EVERY tsup PACKAGE.
Once the dependencies actually built, they died in rollup-plugin-dts, the
declaration generator tsup uses:
TypeError: Cannot read properties of undefined (reading 'useCaseSensitiveFileNames')
TS7 changed the compiler-host API it reaches into. That killed @hanzo/cd,
@hanzo/products and @hanzo/tokens, and @hanzo/ui cannot compile without their
emitted types. The TS7 bump (405280fd4) had reached 2 of 19 packages here;
the other 17 pin 5.x. Pinned root and pkg/ui back to ^5.9.3 to match them.
That in turn required an explicit `moduleResolution` in tsconfig.cjs.json:
it had been relying on TS7 dropping the TS5095 rule that `bundler` needs an
ES module target, so under TS5 the CJS pass errored before emitting anything.
Both are noted inline as the pair to revert together, once tsup ships a
TS7-compatible rollup-plugin-dts.
Verified: `pnpm --filter '@hanzo/ui...' build` succeeds end to end; dist/ holds
50 chat files including the .cjs and .d.ts outputs. tsc errors dropped 15 -> 1
(0 in src/chat) — TS5 is cleaner here, not merely older. Tests 198 passed / 1
failed, and that is an improvement: src/chat/render.test.tsx previously could not
even load (@hanzogui/toast/v2 unresolvable) and now passes; the remaining failure
is a pre-existing missing Tamagui theme provider in
src/backends/gui/render.test.tsx, unrelated to compiler version.
No version bump in this commit on purpose — this proves the pipeline first. The
bump that actually publishes 8.0.29's contents comes next.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Extends the chat shell rather than restating it. Thread, Message and Composer
already landed in 806770476; what a surface still had to build itself was
everything around the turns:
Sidebar + Header / IconButton / NewChat / Scroll / Section / Item /
Folder / User
Header + HeaderButton / ShareButton / AsideToggle / Aside
Code + CopyButton
Sources + SourceChip
Composed of parts rather than fed a tree, because surfaces genuinely disagree
about what a conversation list holds — hanzo.chat groups into folders, the
console groups by project, hanzo.app is flat. A `sections` prop would have to
model all three; parts let each arrange its own and still get identical rows.
Same reason Code takes no highlighter and Header takes an action slot.
Composer's resting placeholder is now `ASK` = "Ask anything", replacing "Send a
message". It addresses the person rather than the mechanism, and being constant
it never has to be recomputed or re-announced when the model changes — which is
what a model-named placeholder forces a surface to do.
Three things this cost, all now encoded so the next component does not repay
them:
* gui has no `flexShrink` prop — `shrink` is the shorthand. The type error
names the whole prop object, so it points at the element, not the prop;
bisecting one prop at a time is what actually finds it.
* `title` is a web-only DOM attribute gui does not type, and it is the only
hover affordance an icon-only control has. Added `tip()` beside the existing
`slot()`, which exists for exactly this reason. `aria-label` is not a
substitute — it names the control for assistive tech and renders nothing on
hover, so both are set.
* There is no `$mono` font token, only `$body` and `$heading`. Code sets a real
monospace stack through `style`; `$body` would put code in a proportional
face where columns stop aligning and l/1/I stop being distinguishable.
Every colour is a `$` token, so brands retune through their own theme and
nothing here carries a Hanzo mark — the same shell ships on Lux and Zoo without
leaking a brand across.
Verified: tsc clean (0 errors in src/chat, repo at its 15-error baseline);
send.test.ts 11/11 pass. render.test.tsx fails to load on an unresolvable
`@hanzogui/toast/v2` import in backends/gui/toaster.tsx — confirmed identical on
a stashed tree, so it is pre-existing and untouched by this change.
Stays 8.0.29: that version is not on the registry yet (latest published is
8.0.28), so these ride in it rather than opening a gap for a version that never
shipped.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
pkgs/ui was @hanzo/ui-shadcn 5.9.2, a second copy of a component set that was
already extracted to hanzoai/shadcn and published as @hanzo/shadcn. Keeping both
is the exact duplication the consolidation set out to end, and CONSOLIDATION.md
step 5 already called for it.
@hanzo/ui-shadcn is deprecated on npm (5.9.0 and 5.9.1) pointing at @hanzo/shadcn
and @hanzo/ui@8. The two dependents in this repo — the docs/registry app and
pkgs/commerce — resolved it as `workspace:@hanzo/ui-shadcn@^`; they now resolve
the published `npm:@hanzo/ui-shadcn@^5` instead, so nothing they import moves.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Every critical/high the review confirmed, fixed at the one place that owns it.
touch() and drag() — backends/gui/gesture.ts. gui classes `hitSlop` as a
native-only prop and DROPS it on web (nativeOnlyProps -> skipProps ->
getSplitStyles), so twelve components claimed a 44px target and shipped 16-36px
in a browser and in Tauri. touch(size, min, axis) now returns hitSlop on native
and data-touch-x/-y on web, backed by transparent ::after rules in theme.css —
no layout shift, no padding hack. The same split fixes the ScrollArea thumb,
which was wired only to the react-native responder system and could not be
dragged at all on web; both it and ResizableHandle now go through one drag().
Button renders on gui's Button.FRAME, not the compound. The compound is
Frame.styleable(), i.e. an HOC: styled() over it does not compile style props to
classes, so `asChild` emitted backgroundcolor="var(--background)" on the child
and styled nothing. asChild is now expressed through gui's `render`, which
merges — Button-as-link comes out as a real styled <a>, asserted in a test.
`fontSize` moved off the frame onto the Text host, so it stops leaking a
font-size="" attribute and `sm` is finally smaller than `default`.
ModelSelector is on style props. It shipped nine Tailwind class strings with no
rules behind them and sized its panel from --radix-popover-trigger-width, a
variable nothing defines now that Radix is gone; the panel measures the trigger.
theme.css drops its Tailwind v4 `@theme inline` block, cn() drops tailwind-merge.
The component surface MOUNTS in CI: render.test.tsx puts all 24 components under
GuiProvider in jsdom and asserts their data-slot markers, the absence of leaked
style attributes, and the touch attribute. 181 -> 185.
Also: DropdownMenu's spec form regained its minWidth=200 default; the product
menu item matches the backend row at 32px and meets the tap floor; ./components
was a byte-identical alias of "." and is gone; react-native-web is declared as an
optional peer (13 packages in the closure import it and nothing declared it);
postbuild stops stamping 'use client' on DATA modules, which is what kept
createGui() from ever running in a prerender; hz-elevation-4 has a rule.
Measured on the packed tarball: `import { Button } from '@hanzo/ui'` costs
77,447 bytes against @hanzo/gui's own Button at 74,651 — 0 chunks, 0 neighbour
components. 0 shadcn, 0 @radix, 0 @apply, 0 Tailwind utilities; 79/79 exports
targets resolve.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
tsup is gone. `pnpm build` is two tsc passes (ESM+types, then CJS with
--noCheck) plus scripts/postbuild.mjs, which resolves relative specifiers to
fully-specified paths, folds the CJS emit into dist as .cjs, and stamps
'use client' on every module.
Bundling a LIBRARY defeats the consumer's tree shaking: tsup's code splitting
emitted 11 shared chunk-*.js, so `import { Button } from '@hanzo/ui'` dragged
in chunk-RCMDRI6V.js (48K of source). Measured with esbuild against the packed
tarballs, that import costs 4717 bytes from 8.0.27 and 2021 from this build.
Output now mirrors src/ one-for-one — 220 .js, 220 .cjs, 220 .d.ts, 0 chunks —
so every exports subpath resolves by construction, with no entry list to drift.
rollup-plugin-dts (tsup's dts worker) was also the one thing that could not
run on TypeScript 7; declarations come from tsc, so pkg/ui builds on 7.0.2.
pkgs/canvas 0.2.2: it ships raw TS as its entry, so a consumer's compiler sees
its side-effect CSS import. Its css.d.ts was never loaded (nothing imports it);
index.ts now references it, which TS 7 requires (TS2882).
Verified on TS 7.0.2 against the pnpm-packed tarball: build exit 0, 181 tests
pass, all 24 exports subpaths (111 with primitives expanded) bundle under both
the import and require conditions, ESM + CJS load in Node, and a consumer
typechecks clean under moduleResolution bundler.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
cn() had a tailwind-merge step to collapse conflicting Tailwind utilities. On
@hanzo/gui there are none - it styles through props, not class names - and the
whole library called cn() from one file. clsx alone composes correctly.
@hanzo/products was declared workspace:* but no such package exists in this
workspace (it lives at pkgs/, and is published at 0.2.0), so tsc could never
resolve it and the build failed on main.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The root barrel, `./primitives`, `./primitives/*` and `./components` were three
doors into the same Radix + Tailwind room. They now open onto the gui backend,
which is the only component surface left.
- gen-primitives.mjs reads src/backends/gui/index.ts as its single source of
truth; the 90 per-member entrypoints regenerate from it (idempotent).
- src/backends/shadcn (25 files) is deleted. It lives in hanzoai/shadcn.
- 16 components rewired onto their @hanzogui/* primitive (avatar, button, card,
checkbox, collapsible, dialog, input, label, popover, progress, select,
separator, slider, switch, tabs, tooltip) to join the 8 net-new ones.
- ONE DropdownMenu: the compound surface grew the declarative `trigger`/`items`
form that used to be a second component in product/menu, and renders the spec
through its own parts. `@hanzo/ui` and `@hanzo/ui/product` export the same one.
- Dependencies: @hanzo/ui-shadcn, 18 @radix-ui/* packages, cva, cmdk, sonner and
lucide-react are gone (ModelSelector moved to @hanzogui/lucide-icons-2).
- ./billing, ./wallet and ./network were re-export shims into @hanzo/ui-shadcn
and are removed with it; nothing on 8.x imported them.
- Every exports target is now a real file in the tarball. 18 of them pointed at
./src/* which `files: [dist]` never shipped, so ./components, ./models, ./core,
./tokens, ./theme.css and all 90 ./primitives/* were broken on the registry.
- Module scope is side-effect free (/* @__PURE__ */ on forwardRef/createContext,
no displayName assignment), so one symbol no longer drags its neighbours in.
Verified: build exit 0, 181 tests in 17 files pass, 0 shadcn and 0 @radix-ui
references in the packed tarball (was 107 files), 447/447 export targets resolve
(8.0.26: 18 broken), one-symbol import bundles 4.7KB against 29.4KB for the
whole barrel.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
52 components, the ./svelte export, the svelte + svelte-check dependencies, the
check:svelte script and tsconfig.svelte.json all leave. They live on at
github.com/hanzoai/svelte as @hanzo/svelte@1.0.0, extracted with their history
and verified at 0 svelte-check errors.
A component library should be one stack. This one declared peer svelte>=5 while
devDepending svelte ^4.2.20 — two answers to one question — and every consumer of
@hanzo/ui resolved svelte whether they rendered a Svelte component or not. Nothing
in this package imported the backend; only docs referenced it.
Verified this removes nothing else: the build reports the same 16 pre-existing
errors before and after (missing @hanzo/tokens, @hanzo/ui-shadcn/*, @hanzo/products
and four implicit-any in SiteNav), and dist still emits.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
8.0.24 shipped a first lift of the DocType renderer at `@hanzo/ui/framework`
while this one landed at `@hanzo/ui/doctype`. Two entries for one concept is the
thing we do not do, so this collapses them: the published name `./framework`
wins, and the implementation behind it is the superset.
Every 8.0.24 name still resolves, so nothing that consumes it breaks:
· `Transport` aliases `FrameworkTransport` — one seam, two spellings.
· `Loader` aliases the in-flow `Loading`.
· `setupDescription`/`setupBullets` go back to OPTIONAL. The defect was never
that a default existed; it was that the default was ONE LANE'S copy, so an
ERP org read about Pages and Posts. Unset now derives from the lane's own
`label`, which is true for every lane.
· `renderBuilder`/`renderMedia` still win when supplied — but a host that
supplies neither now gets the real built-in `CollectionBuilder`/`MediaGrid`
instead of no affordance at all.
What the superset adds on top of 8.0.24: the content-type builder, the DAM over
a `MediaStore` port with a bucket PARAMETER, the mobile-first card list and
container-measured layout, the 44px tap floor, the `inListView` column
projection, the metadata-driven media document body, the docstatus gate on
Edit/Delete, and a `./framework/core` entry that binds the engine with no React
and no @hanzo/gui in scope.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Every host that renders the Hanzo Framework engine (hanzoai/cloud
clients/framework, live at /v1/framework/*) needs the SAME list, card, detail,
builder and DAM — a CMS Page, an ERP Sales Order, a Helpdesk Ticket and a CRM
Company are one kind of thing with one renderer. It lived in the console. Now it
lives here once, as `@hanzo/ui/doctype`, and an app lane is a `module` filter
plus its own copy.
MOBILE FIRST is a rule, not a fallback. The layout is decided from the
CONTAINER's measured width (onLayout — a 420px detail rail on a 1440px screen is
a phone, and a viewport media query cannot know that), and the answer to "not
measured yet" is PHONE. So the first paint, SSR included, is a stacked card per
record; the @hanzo/data table is the enhancement applied once the box proves it
can hold one. Server and client render the same tree, so there is no hydration
mismatch. Every control clears the 44px tap floor (WCAG 2.5.5) at phone width,
long unbroken values wrap instead of running off the screen, and the builder's
field row stacks into labelled bands rather than crushing six controls onto one
line.
Three defects the move fixed, each of them the kind a shared library prevents:
· The table rendered EVERY non-hidden field as a column. `listHiddenFields` —
the DocType's own `inListView` projection — was implemented and unit-tested
but never passed to a view, so a twelve-field ERP document rendered twelve
columns. That is the whole reason it was a horizontal scroll wall.
· MediaGrid wrote a hardcoded {title,file,mime,size,width,height} — the CMS
Media fixture's schema. The engine drops unknown keys silently, so a lane
whose media type labels its rows `caption` created untitled rows, quietly.
`mediaDocPayload(dt, facts)` now writes the DocType's OWN title field and
only the facts it declares.
· Edit and Delete rendered on a submitted document, which ops.go refuses
("document is not a draft (docstatus %d); cannot edit"). A user filled in a
whole form and got an error card on Save. Both are gated on `isDraft`, and
the surface says why the actions are gone.
Ports, not bindings. The client takes a FrameworkTransport (paths relative to
the framework root — the host picks the origin and the credential); the DAM takes
a MediaStore and a BUCKET PARAMETER, because the constant it used to carry was
named after one lane and ERP attachments were about to land in `cms-media`;
routing is onOpen/onCreate/onBack/onView. The first-run copy lost its default for
the same reason a default lane is the wrong default.
Two entries because they are two different things: ./doctype/core is the
contract (types, client, mapping, builder projection, media model) and imports no
React and no @hanzo/gui, so a data layer or a node test can bind the engine
without loading a component tree; ./doctype re-exports it plus the views.
SelectMenu gains `required` (the null row dropped — a required picker and a
filter differ only in whether "none" is an option, so it stays one control rather
than growing a fourth select), plus `minHeight`/`disabled`/`ariaLabel`.
78 new unit tests (159 total, all green): the mapping, the card projection, the
metadata-driven media body, the docstatus precondition, the transport's exact
paths, the media port against a fake store, and the mobile-first layout rule.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The live capture came back correct but nameless:
{"event":"feature_used","properties":{"component":"PrimaryButton","action":"click"}}
no `id`. The console's sign-in CTA is `<PrimaryButton>Log in with {brand}</PrimaryButton>`,
which React hands the component as an ARRAY, and `typeof children === 'string'`
is false for an array — so every interpolated label (which is most of the
branded ones) reported as an unnamed click. A lens could count presses but never
say WHICH button, which is nearly the whole value.
`labelOf` flattens the string/number parts and trims; non-textual children (an
icon element) still yield undefined rather than a guess. Shared by PrimaryButton
and MenuItemView so both name their events the same way — one rule, not two.
8.0.21 -> 8.0.22. 8 unit tests.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Found by clicking it in a real browser, which is the only place it could be
found: the unit tests exercise `emit`, and a type-checker is perfectly happy
with a function that calls itself.
const onPress = (e) => { track(...); props.onPress?.(e) } // closes over `props`
props = { ...props, onPress } // ...then REBINDS it
`props.onPress` inside the closure resolves at CALL time, and by then `props` is
the new object whose `onPress` is the closure. So the handler invoked itself
forever. On console/signin one press produced
RangeError: Maximum call stack size exceeded
and thousands of duplicate feature_used events queued behind it. Instrumentation
that changes behaviour is worse than none — an observer must observe.
Destructuring `onPress` out of the props first makes the original handler a VALUE
captured at render, not a lookup on a mutable binding, so there is nothing left
to recurse into. Values, not places.
8.0.20 -> 8.0.21.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
8.0.19 (and 8.0.17 before it) went out via `npm publish`, which copies
package.json verbatim. `pnpm publish` is the one that rewrites the workspace
protocol to a concrete version. So both tarballs declared
"@hanzo/products": "workspace:*",
"@hanzo/tokens": "workspace:*"
and any pnpm consumer outside this monorepo died on install:
ERR_PNPM_WORKSPACE_PKG_NOT_FOUND "@hanzo/products@workspace:*" is in the
dependencies but no package named "@hanzo/products" is present in the workspace
This error happened while installing the dependencies of @hanzo/ui@8.0.19
Caught by hanzoai/console, the first consumer to resolve fresh rather than from a
lockfile. 8.0.20 is republished through pnpm and resolves to @hanzo/products@0.2.0
and @hanzo/tokens@1.0.0.
A note in a doc would not have stopped the next one, so the fix is a
`prepublishOnly` that refuses the wrong tool at the only moment it matters.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Every product was flying blind past the pageview. The telemetry client
(@hanzogui/telemetry, already a dependency here) has always been able to send
product events — nothing was calling it. So the choice was: instrument 100 apps,
or instrument the components all 100 apps already render.
This is the second. One new module, src/product/instrument.ts, is the ONE place a
shared component says what a user did, and the 17 components below now call it:
DataTable sort (column + next direction), select (row + list size)
PrimaryButton click (labelled by its own children — no app names it)
SlideOver open / close, keyed by the drawer title
ConfirmDelete confirm / cancel / error (the one irreversible action)
Segmented filter (which pill)
SearchInput search (query LENGTH, never the query)
ComboBox open / close / select (+ how many options were on screen)
MenuItemView select — every dropdown and context menu in the fleet
OrgSwitcher select (which org a session moved to)
ThemeToggle change
Toast an error toast is a product OUTCOME, not chrome
EmptyState click on either CTA — the zero-data conversion point
Field{Text,TextArea,Switch,Select,Slider}
change, named by the FieldRow label the caller ALREADY typed
ONE event name, not 17. @hanzo/event's taxonomy is a closed set whose own rule is
"the product-specific moment is the `action` property, never a new event name" —
so every interaction is EVENTS.FEATURE_USED carrying {component, action, id,
value, surface}. Funnel moments (signup, checkout, deploy) keep their dedicated
names and stay owned by the surface that runs them, not by a button. A closed
verb set is what lets one funnel join across products.
Privacy is in the primitive, not in a reviewer's memory: free text is reported as
`textSize()` — a LENGTH — so a search box and a password field emit the shape of
the behaviour and never its content. Transport, consent, DNT/GPC and SSR-safety
all come from @hanzogui/telemetry, which is fail-soft by construction, so no
component here adds an error policy of its own.
`<InstrumentSurface value="billing">` is the only thing an app may optionally add;
with no provider the events still carry component+action, and product+path already
come from the client. Nothing else to wire, nothing to remember, nothing to drift.
Proven: 5 unit tests on the wire shape, and all 17 emit sites verified present in
the built bundle. 8.0.17 -> 8.0.19 (8.0.18 is the published latest).
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The Lint job has never once passed — 7 runs, 7 failures — on 48 errors that are
all in apps/v4, and apps/v4 is a VENDORED upstream mirror. Every flagged file
arrives from a sync commit ("feat: sync upstream shadcn/ui"): hooks/use-layout.tsx
and examples/{base,radix}/** from b74fc5759, components/command-menu.tsx from
fd9d7843f. The examples/base and examples/radix copies are byte-identical to each
other, so a third of the list is the same file counted twice.
eslint-config-next 16 turns the React Compiler rules on. Upstream shadcn does not
satisfy them, so we were linting somebody else's code against a stricter config
than they use. Patching it would fork ~20 vendored files from upstream and have
to be redone at the next sync, to quiet advisories in a demo app.
This is not a new exemption, it is finishing an existing one. The config already
turned off react-hooks/incompatible-library and react-hooks/purity for precisely
this reason, and TWO files already carried inline
`// eslint-disable-next-line react-hooks/set-state-in-effect`. The same rule was
being suppressed already — just inconsistently, in 2 of the 20+ places it fires.
Those two inline directives are now redundant and are removed here; eslint
flagged them itself once the rule went off.
set-state-in-effect "Calling setState synchronously within an effect can
trigger cascading renders" 42 of 48
refs "Cannot access refs during render" 6 of 48
Scope is exactly apps/v4: that config governs nothing else. Our own source —
app/, pkgs/, packages/ — lints under its own config, which does NOT disable any
react-hooks rule, and still passes. Nothing we author is exempted.
If these rules should hold for vendored code too, the fix belongs upstream in
shadcn/ui rather than as a local fork of 20 files.
Verified with the workspace eslint (9.39.4, the version CI installs — a stray
npx picks up 10.5.0 and crashes eslint-plugin-react before linting anything):
`turbo run lint` is 2 successful / 2 total, 0 errors, 0 warnings.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The image job has failed on every run with
::error::REGISTRY_TOKEN is unset, so nothing was published. Add the org secret.
The guard is doing its job; the name is simply wrong. The hanzoai org defines
exactly GHCR_TOKEN, GHCR_USER, GH_PAT, KMS_CLIENT_ID, KMS_CLIENT_SECRET,
OCI_TOKEN and OCI_USER. There is no REGISTRY_TOKEN and never was, so the
suggested remedy — add the org secret — would have minted a second credential
for the registry every other repo already logs into with GHCR_*.
Only ui and papers invented that name. Both now use the GHCR_* pair, and take
the username from GHCR_USER instead of hardcoding hanzo-dev, so rotating the
publishing identity stays a single org-level change.
Tagging is untouched: still the short HEAD sha, which is what a CR pins.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
This file has now broken from BOTH directions in one day, which is the useful
part of the story.
Declaring the Web Speech names inside `declare global` MERGES with whatever
lib.dom already provides rather than shadowing it, so on a lib that HAS them
every small difference is an error: `readonly` vs mutable (TS2687), a second
`[index: number]` (TS2374), and `error: string` against the real
`SpeechRecognitionErrorCode` union (TS2717) — 7 errors.
Deleting the declarations fixed that locally and immediately broke CI the other
way, on a lib that does NOT carry them:
TS2552: Cannot find name "SpeechRecognitionEvent"
Same file, same code, opposite failure — because the Speech API is only partly
standardised and how much of it ships varies by TypeScript version. There is no
"correct" set of globals to declare; the premise was wrong.
So the types are module-LOCAL now (SpeechRecognizer, SpeechRecognitionEventLike,
…), describing exactly the surface this component touches. Local names collide
with nothing and depend on nothing. The constructor and `webkitAudioContext` are
read through narrow casts instead of a `Window` augmentation, for the same
reason: lib.dom may already declare those properties, and re-declaring them with
a different type is itself the error.
Behaviour is unchanged except that the missing-API paths are now explicit —
`getSpeechRecognizerCtor()` returns undefined instead of `"webkitSpeechRecognition"
in window` guarding a `window.SpeechRecognition` read, and a browser with no
AudioContext throws a named error rather than `new undefined()`.
Verified: app typecheck is 0 errors under BOTH the workspace TypeScript (5.9.3,
what node resolves) AND 7.0.2 (the binary CI actually invokes). pkgs/ui stays 0.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The CI added yesterday has never gone green. Three separate causes, all real —
nothing here suppresses a check.
1. Bare specifiers had no mapping. `types/nav` and `types/unist` are imported
as bare specifiers and only ever resolved via an implicit project root.
The obvious fix is `baseUrl`, and it is wrong: TypeScript 7 REMOVED the
option and says so itself —
TS5102: Option baseUrl has been removed. Please remove it from your
configuration. Use "paths": {"*": ["./*"]} instead.
So the mapping is explicit in `paths`, which resolves relative to the
tsconfig and needs no baseUrl. This also cleared every TS7006 implicit-any
error, because those were downstream: an unresolved module widens to `any`,
and mapping over `any` reports each parameter separately. 8 errors, one
cause.
2. ai-voice.tsx re-declared Web Speech types that lib.dom now ships. Inside
`declare global` a re-declaration MERGES with the built-in rather than
shadowing it, so every difference is an error: `readonly` vs mutable
(TS2687), a second `[index: number]` (TS2374), and `error: string` against
the real `SpeechRecognitionErrorCode` union (TS2717). Removed the four the
platform provides; kept the vendor `webkit*` aliases and the constructor,
which it still does not.
3. CI built one hardcoded package instead of the app dependency graph, so both
the typecheck and the Build job failed on
`Cannot find module @hanzo/event` / `Module not found: Can't resolve @hanzo/event`.
@hanzo/event resolves to the workspace copy, whose package.json points types
at ./dist/index.d.ts, and nothing built it. Now `turbo run build
--filter=@hanzo/ui-web^...` — the set is derived from the workspace graph, so
it stays correct when an import is added rather than needing another name
pasted in.
Verified locally: app typecheck 16 errors -> 0, and pkgs/ui `tc` is already 0
against its own tsconfig.build.json (my first reading of 92 was me running the
wrong tsconfig).
Not fixed here: the Lint job, whose log simply ENDS mid `pnpm install` at
"Packages: +2770". That is a killed job, not a lint failure, and it needs the
runner looked at rather than the code.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Its log ends mid-step with no error line, no failure marker and no summary:
the truncated signature of a killed job. It ran during the window when
git.hanzo.ai was down (the forge pod was preempted and then blocked on an RWO
Multi-Attach while a storage-migration job held its volume), so the runner lost
the control plane mid-build.
Nothing in this repo changed. Empty commit to get a clean signal now the forge
is back.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
git.hanzo.ai is Gitea, which presents itself as GHES, and the v4 artifact
actions refuse on that basis before transferring anything:
@actions/artifact v2.0.0+, upload-artifact@v4+ and download-artifact@v4+
are not currently supported on GHES
That makes the step fail for a reason unrelated to whatever the job was
checking. hanzoai/papers is the clearest case: every paper compiled and the run
printed "missing: 0", yet the run was red because this one step could not
execute — a CI failure that looks exactly like the thing the job exists to
catch.
v3 speaks the artifact protocol the forge implements. Names, paths and
retention are unchanged.
Swept the estate for the same pattern: bot, engine, kms, papers and ui all
carried it.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
gui.config.ts lived in the console. That was fine while the console was the only
app rendering @hanzo/ui/product; the dedicated Hanzo Social app makes it a fork
waiting to happen — two admins would render the same components at different
sizes, radii and spacing, and nobody would notice until a screenshot.
So the scale ships with the components as `@hanzo/ui/gui-config`, and the console
imports it instead of declaring it. @hanzogui/config joins peerDependencies,
since the scale is built on its v5 defaults.
Also exports the social surface at its own subpaths, so an app that only renders
Publish does not pull the whole product barrel:
./product/social the surface (React)
./product/social/api the contract alone — imports NOTHING, so a data layer
(and its node tests) can bind it without a component tree.
Two entries because they are two different things, not two ways to one thing.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The social pieces were extracted here, but the thing that MAKES them a product
was not: the /v1/social client and the orchestration that fetches, lays out and
mutates. Those lived only in the console (src/lib/api/social.ts + a 601-line
SocialModule), so a second host — the dedicated social.hanzo.ai app — could only
copy-paste them, and this folder's own types had already forked three ways: a
`Post` in PostCard, a `ProviderCapability` in ProviderReadinessList, a
`SocialSummary` in SocialSummaryBar, none of them the shape the backend sends.
So the contract moves in and the parts read from it:
- api.ts — the ONE typed /v1/social contract (cloud clients/social): the domain
types, the defensive normalizers, and `createSocialApi(rest)`. The TRANSPORT is
injected: paths are relative to /v1/social and the host owns the origin, the
credential and the error class, so this layer never picks any of them. A post's
`media` round-trips (cloud's PUT rebuilds the row from the body — dropping it
would wipe it).
- PostCard / PostAgenda / ProviderReadinessList / SocialSummaryBar / PostComposer
now import their types from api.ts; ChannelBadge's hand-written network union
becomes the backend's ONE ordered PROVIDERS list.
- SocialResource — the whole product, assembled from those pieces: summary bar,
list + calendar, compose/schedule/publish-now, connect, detail drawer, honest
loading/empty/BackendState. Sibling of CommerceResource. Every host renders THIS.
Nothing here imports a router, an auth module or an app's ~/lib, so the console
and the standalone app are the same component with different transports.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The package was never published under EITHER name — `npm view @hanzo/gitops`
and `@hanzo/cd` both returned E404 — so `pkg/ui/src/gitops.ts`
(`export * from '@hanzo/gitops'`) and the `>=0.1.0` peer dep pointed at
nothing and broke every clean install of @hanzo/ui.
Publishing exposed a second break one level down: @hanzo/gitops peers on
@hanzo/canvas >=0.2.0, and the registry still had canvas at 0.1.0 while the
monorepo was on 0.2.1. Publishing the first package alone only moved the
ETARGET deeper. Both are now on the registry, and a clean
`npm install @hanzo/ui@8.0.12` resolves — 673 packages, no errors.
pkgs/gitops -> pkgs/cd and @hanzo/gitops -> @hanzo/cd: the surface is the CD
surface (cd.hanzo.ai, apps/cd), and the old name only ever described the
mechanism. Every reference in the monorepo moved with it; the old name is
deprecated on npm pointing here rather than left as a second way to install
the same code.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
TypeScript 7 is the native Go compiler; the npm package is a shim resolving a
platform-specific native binary. turbo drives per-package bundlers, so tsc is
typecheck-only here and no published artifact changes.
Gated on the package turbo actually builds, not the repo-root config — that
root is a settings base nothing compiles, and running tsc against it sweeps
apps/, templates/ and deprecated/ for a meaningless six-figure count.
pkgs/ui: 92 -> 92 errors, so the compiler swap introduces nothing new.
Co-Authored-By: Hanzo Dev <dev@hanzo.ai>
SlideOver reached for `@ts-ignore` where menu/items.tsx already solved the
identical problem with `as never`. A bare `@ts-ignore` suppresses whatever
error appears on that line, including ones nobody has seen yet; the cast says
exactly which assumption is being made and keeps every other check live.
Two idioms for one problem is one too many.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
hz-mono/hz-tnum/hz-paper/hz-menu-in/hz-row were only defined in the console's
globals.css, so every OTHER host of these components rendered them unstyled.
They now live in the package's one stylesheet next to hz-skeleton, with the
elevation variables falling back so a host that defines its own --hz-* still wins.
SlideOver's panel ref used @ts-expect-error, which is itself an error wherever the
consumer's resolved @types/react accepts the ref (the commerce admin does).
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
(cherry picked from commit 9e4557bcd7)
@hanzo/ui/product is the single component set both the console and the standalone
Commerce admin render. Console's src/components/ui was a byte-drifted fork that had
run AHEAD of this layer; that drift is folded back in, and the admin-only pieces that
only existed in the console are hoisted here host-agnostically:
- DataTable — sortable headers, skeleton rows, mono/right-aligned numeric columns
- PageHeader — responsive wrap (actions take their own line on phones)
- Charts/ComboBox/SelectMenu/Metric/StatusTag/Field/SlideOver/EmptyState/PrimaryButton
— console's refined typography, hz-paper menus, wider status vocabulary
- accent — the org-accent external store PrimaryButton reads (pure, SSR-safe)
- host — the ONE seam an app injects its router/auth effects through, so this
layer never imports next/navigation or an auth module
- BackendState — honest /v1 failure states, classified duck-typed on so any
client's error class works
- ConfirmDelete / Filters — the one destructive-confirm panel, the one segmented+search
- CommerceResource — the ONE store-list surface (console Store category + Commerce admin)
- OrgMark/OrgSwitcher/scope/menu — brought forward from main for the shared admin chrome
exports now resolve types from src as well as code, so a workspace consumer builds
against the source with no prebuilt types step (one artifact, no drift).
(cherry picked from commit b4f189bcb2)
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Three defects, all of the same shape as the duplicate `dependencies` key: a
second copy of something silently shadowing the real one.
- pkgs/data was a second workspace project ALSO named @hanzo/data (private
0.1.0, a strict subset of pkg/data@1.2.1 which superseded it — see
CONSOLIDATION.md). pnpm tolerated the collision; turbo refuses to build a
graph with it ("Failed to add workspace @hanzo/data ... it already exists"),
so `pnpm build` at the root has been dead, and with it the ONE mechanism
that orders pkgs/{tokens,products} ahead of pkg/ui. Nothing linked it. Gone.
- turbo.json `typecheck` declared no dependsOn, so it ran before its deps'
.d.ts existed; and `build` listed only dist/** as an output while pkg/data
emits to types/**, so a cache hit restored nothing and left @hanzo/ui
unable to resolve @hanzo/data. Both edges now declared.
- @hanzogui/lucide-icons-2 is imported by 16 files in pkg/ui/src and shipped
in dist/product/index.js, but was only a devDependency: `require('@hanzo/ui
/product')` from a clean consumer install threw MODULE_NOT_FOUND. It sits on
the gui 7.x train and pulls @hanzogui/core@7.3.0, so it goes where
@hanzogui/next-theme already is — peerDependencies, one core per app — not
into dependencies, which would license a second copy.
From a wiped dist tree: turbo run build --filter=@hanzo/ui... -> 4/4 tasks,
then FULL TURBO restores pkg/data/types from cache. In pkg/ui: npx tsc
--noEmit -> 0 errors, npm run build -> ESM + CJS + .d.ts.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
luxd serves exactly one HTTP prefix and it is /v1. Measured 2026-07-27:
api.lux.network/ext/bc/C/rpc -> 404 (5/5 probes), /v1/bc/C/rpc -> 200
chainId 0x17871. So these callers were already broken, not merely legacy.
The bc/ segment is required (/v1/C/rpc is malformed and 404s), the env is
the hostname and never a path segment, and the brand is the hostname and
never a chain alias -- api.lux.network/v1/bc/hanzo/rpc is 404 now that each
L1 has its own sovereign gateway.
api.avax.network is deliberately untouched: it is a third-party host that
serves /ext/ (200) and not /v1/ (404). Rewriting it would break Avalanche.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
`moduleResolution: node` is removed in TS7, so this base config could not
be used by the native compiler at all. esnext+bundler is the verified-clean
pair for a bundled monorepo (node16 was tried first and rejected: it forces
node16 module semantics and surfaced TS5097 across the template and fixture
trees this root sweeps).
The root is a settings base — `turbo run build` compiles the packages, not
this file. Verified on the packages that actually build, TS7 vs TS5.9:
commerce 0/0, shadcn 3/3, ui 92/92 — identical. TypeScript 7 introduces no
new errors here; the 92 in pkgs/ui are pre-existing.
Co-Authored-By: Hanzo Dev <dev@hanzo.ai>
TypeScript 7 is the native Go compiler and removes `baseUrl` and
`moduleResolution: node|node10`. Both appear here, so `tsc` from TS7
refuses the config outright (TS5102 / TS5108) and cannot typecheck.
`paths` targets resolve relative to `baseUrl` when it is set and relative
to the tsconfig file otherwise. Every `baseUrl` folded here already
pointed at the config's own directory, so dropping it moves nothing and
the targets are left byte-identical. Where a baseUrl pointed elsewhere,
each affected target was rewritten as join(baseUrl, target).
`moduleResolution` was chosen from the declared `module`: commonjs ->
node16, esnext/preserve -> bundler. Configs whose `module` is unset or
exotic were left alone rather than guessed at.
The result is accepted by BOTH toolchains, so nothing has to upgrade
TypeScript in lockstep. Verified on hanzo/chat packages/api: tsc 5.9
779 -> 778 errors (no regression), and tsc 7.0.2 now runs the project
in 2s where it previously refused the config.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
pkg/ui/package.json carried TWO "dependencies" objects. JSON is last-key-wins,
so the 3-entry block appended after "author" in 57cc6541b (the telemetry
subpath) silently overwrote the real 24-entry block added in 1ee64263f (the
shadcn backend + core/tokens). @hanzo/ui therefore declared none of the
packages its own source imports:
npx tsc --noEmit -> 43 errors
npm run build -> "Build failed with 25 errors" (ESM and CJS alike)
Nothing was wrong with the components. Every error was an unresolvable import:
Radix/cva/clsx/tailwind-merge/cmdk/sonner from src/backends/shadcn + src/core/cn
-- which the ROOT barrel re-exports (src/index.ts -> ./backends/shadcn) -- plus
@hanzo/tokens. The TS2339 on ButtonProps and the TS7006 implicit-anys were
cascades off those unresolved modules, not separate defects.
Merging the two blocks into one restores the manifest AND the bundling: tsup
externalizes declared dependencies, so Radix is now imported by dist/index.js
instead of inlined into it. Two copies of @radix-ui/react-dialog in one app
means two React contexts and dead dialogs.
@hanzo/tokens also moves file:../../pkgs/tokens -> workspace:*. pnpm rewrites
the workspace: protocol to a real version on pack; a file: specifier publishes
verbatim and resolves for nobody.
pkgs/{tokens,products}/tsconfig.json: drop ignoreDeprecations "6.0". Both
declare typescript ^5.9.3, where the only accepted value is "5.0", so tsup's
dts worker died with TS5103 and these two never emitted the .d.ts that
@hanzo/ui imports. Neither config uses an option deprecated in 5.0 -- the
escape hatch was inert dead weight that only broke the build.
Gates in pkg/ui: npx tsc --noEmit -> 0 errors; npm run build -> ESM+CJS+dts
success from a clean dist; vitest 45/45. The 8 social components verified
through the published exports map (consumer tsc + esbuild bundle).
Most of the pnpm-lock.yaml diff is pre-existing churn -- a plain `pnpm install`
with zero source changes rewrites 3169 lines on this repo. The delta owed to
this fix is +594/-20; the removals are Radix peer-hash dedup (one copy, not two).
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Extend the existing @hanzo/ui/product/social home so the social surface is
assembled from shared parts instead of living only inside console's
SocialModule. Presentational and host-agnostic per the layer's contract —
data and handlers are injected, nothing reaches for an app's ~/lib.
- format.ts: the ONE pure time/preview module (formatPostTime, postDayBucket,
postPreview, parsePostTime) + 12 unit tests. Names are social-scoped to keep
the product barrel a single collision-free namespace. PostCard's private
near-duplicate date formatter folds into it.
- SocialSummaryBar, ViewToggle, PostAgenda, PostComposer,
ProviderReadinessList: lifted from console's SocialModule.
- PostComposer owns the form state, the validation, and the one mapping from a
compose intent to the (status, scheduleAt) the backend stores; the host keeps
persistence and failure classification via an injected total onSubmit.
- ProviderReadinessList renders publish-readiness straight from the server's
report, so a deployment missing OAuth-app credentials shows exactly which
ones — never a fabricated "connected".
- Channel gains ChannelLike: the badge already fell back to `x` for unknown
values at runtime, so the type now says what it really accepts and callers
holding a plain `string` from the API no longer have to narrow first.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Superseded: the Hanzo GitHub App pushes a webhook, so the forge tracks GitHub
without a per-repo workflow. This file called git.hanzo.ai/api/v1/.../mirror-sync
— a Gitea API for a system we no longer drive — and would sit inert in every repo.
One mechanism, in one place, instead of ~350 copies of a cron.
publish.yml was deleted this morning without a replacement. It is the sole
publisher of every non-private @hanzo/* in pkgs/* — @hanzo/ui, @hanzo/event,
tokens, shadcn — and its loss left them with no producer anywhere: no workflow, no
failing run, just packages that would stop moving. It is back, byte-identical, at
.hanzo/workflows/publish.yml where the forge reads it.
ci.yml comes back too, minus the deploy-preview job that ran `vercel deploy` on
every pull request; previews come from our own stack or not at all, and the status
job never depended on it. Its test job now runs pnpm test:coverage, so the lcov it
already uploaded actually exists — which is what coverage.yml was separately
running the same suite to produce. One workflow does it.
registries.yml keeps the apps/v4 registry check. Its other job labelled and
commented on pull requests through the gh CLI, an API the forge does not serve.
deploy.yml is new, and it is the piece that never existed: crs/ui.yaml in
hanzoai/universe is live and promoted, but no workflow ever built the image it
pins — every tag up to v5.7.6 was pushed by hand. It publishes
ghcr.io/hanzoai/ui:<sha> from the Dockerfile already in the repo and stops there. A
build never deploys itself; the CR names the tag that serves.
.github/workflows now holds the canonical sync.yml alone.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
git.hanzo.ai mirrors this repo by PULL on a ~10-minute interval, and arcd runs
CI/CD there — so every push waited out that interval before anything built.
This asks Gitea to pull HEAD immediately.
Latency only: the repo already mirrors via the App webhook, so a missing
HANZO_GIT_TOKEN or a failed curl is non-fatal and never fails the push.
Idempotent (mirror-sync just pulls HEAD) and concurrency-coalesced.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
An app declares WHAT it is; this package knows WHERE its errors go. Declaring
`product: 'console'` is now sufficient to report errors — no DSN literal, no
build argument, no per-app config.
That indirection is what makes it shippable. NEXT_PUBLIC_* is inlined at BUILD
time, and the native builder passes exactly ONE build arg (VERSION, from the
image tag — clients/platform/k8s.go). There is no mechanism to hand an image a
DSN, which is why the sibling ARG NEXT_PUBLIC_EVENT_INGEST_KEY has sat dead in
the Dockerfiles. A committed registry sidesteps the gap entirely.
A browser Sentry DSN is PUBLIC by construction: it ships in the client bundle,
is readable in devtools on any deployed page, and grants only event submission
— never reads. Committing it records a public identifier, it does not leak a
secret. (The server-side collector DSN in team-analytics-sentry stays a Secret;
that one is genuinely not public.)
Resolution order, most specific first: explicit `dsn` > NEXT_PUBLIC_HANZO_EVENT_DSN
> product registry. An unregistered product stays inert rather than guessing a
destination and posting one surface's errors into another's project.
Registered: console -> hanzo-console, app -> hanzo-app, site -> hanzo-ai. A
literal map, not `hanzo-${product}` — `site` lives in hanzo-ai, and a derivation
rule plus an exception table is the same data with a trap in it.
core.test.ts now uses the deliberately-unregistered product `test-app`, so those
tests exercise the client rather than whichever real products are registered.
typecheck clean; 100 tests pass; all 3 DSNs verified present in dist/.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Inherited upstream workflow, repointed at a self-hosted ARC pool at fork time.
ARC is being decommissioned: CI runs inside git.hanzo.ai (Gitea Actions,
.hanzo/workflows) and delivery is cd.hanzo.ai reconciling the reviewed image
pin in hanzoai/universe. GitHub is a mirror and runs nothing.
This repo has no .hanzo/workflows today; it is a fork whose upstream CI we do
not rely on. If it needs a build, it gets a native pipeline — not an ARC pool.
Inherited upstream workflow, repointed at a self-hosted ARC pool at fork time.
ARC is being decommissioned: CI runs inside git.hanzo.ai (Gitea Actions,
.hanzo/workflows) and delivery is cd.hanzo.ai reconciling the reviewed image
pin in hanzoai/universe. GitHub is a mirror and runs nothing.
This repo has no .hanzo/workflows today; it is a fork whose upstream CI we do
not rely on. If it needs a build, it gets a native pipeline — not an ARC pool.
Inherited upstream workflow, repointed at a self-hosted ARC pool at fork time.
ARC is being decommissioned: CI runs inside git.hanzo.ai (Gitea Actions,
.hanzo/workflows) and delivery is cd.hanzo.ai reconciling the reviewed image
pin in hanzoai/universe. GitHub is a mirror and runs nothing.
This repo has no .hanzo/workflows today; it is a fork whose upstream CI we do
not rely on. If it needs a build, it gets a native pipeline — not an ARC pool.
Inherited upstream workflow, repointed at a self-hosted ARC pool at fork time.
ARC is being decommissioned: CI runs inside git.hanzo.ai (Gitea Actions,
.hanzo/workflows) and delivery is cd.hanzo.ai reconciling the reviewed image
pin in hanzoai/universe. GitHub is a mirror and runs nothing.
This repo has no .hanzo/workflows today; it is a fork whose upstream CI we do
not rely on. If it needs a build, it gets a native pipeline — not an ARC pool.
Inherited upstream workflow, repointed at a self-hosted ARC pool at fork time.
ARC is being decommissioned: CI runs inside git.hanzo.ai (Gitea Actions,
.hanzo/workflows) and delivery is cd.hanzo.ai reconciling the reviewed image
pin in hanzoai/universe. GitHub is a mirror and runs nothing.
This repo has no .hanzo/workflows today; it is a fork whose upstream CI we do
not rely on. If it needs a build, it gets a native pipeline — not an ARC pool.
Inherited upstream workflow, repointed at a self-hosted ARC pool at fork time.
ARC is being decommissioned: CI runs inside git.hanzo.ai (Gitea Actions,
.hanzo/workflows) and delivery is cd.hanzo.ai reconciling the reviewed image
pin in hanzoai/universe. GitHub is a mirror and runs nothing.
This repo has no .hanzo/workflows today; it is a fork whose upstream CI we do
not rely on. If it needs a build, it gets a native pipeline — not an ARC pool.
Inherited upstream workflow, repointed at a self-hosted ARC pool at fork time.
ARC is being decommissioned: CI runs inside git.hanzo.ai (Gitea Actions,
.hanzo/workflows) and delivery is cd.hanzo.ai reconciling the reviewed image
pin in hanzoai/universe. GitHub is a mirror and runs nothing.
This repo has no .hanzo/workflows today; it is a fork whose upstream CI we do
not rely on. If it needs a build, it gets a native pipeline — not an ARC pool.
Inherited upstream workflow, repointed at a self-hosted ARC pool at fork time.
ARC is being decommissioned: CI runs inside git.hanzo.ai (Gitea Actions,
.hanzo/workflows) and delivery is cd.hanzo.ai reconciling the reviewed image
pin in hanzoai/universe. GitHub is a mirror and runs nothing.
This repo has no .hanzo/workflows today; it is a fork whose upstream CI we do
not rely on. If it needs a build, it gets a native pipeline — not an ARC pool.
@hanzo/event <=0.3.1 shipped NO Sentry envelope code — captureError() collected
and dropped. 0.3.2 added it.
This repo already RESOLVED to 0.3.3 (the caret ranges permit it), so nothing
changes here at install time. The defect is in what the observe packages
PUBLISH: declaring ^0.3.0 lets any downstream consumer legitimately resolve to
0.3.0 or 0.3.1 and silently get a dead error plane. The floor now states the
real requirement.
pnpm install --frozen-lockfile green; @hanzo/observe 28 tests pass.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Publish Packages fails at its first step:
ERR_PNPM_OUTDATED_LOCKFILE Cannot install with "frozen-lockfile" because
pnpm-lock.yaml is not up to date with pkgs/products/package.json
CI sets frozen-lockfile by default, so this is not a warning — it is a hard stop
before anything is built or published. Nothing in pkgs/* has been able to reach
npm since it appeared, which is why @hanzo/products sat at 0.2.0 and
@hanzo/ui-shadcn at 5.9.1 while main moved on.
It is accumulated drift, not one mistake. 4c2599d2 added @types/node to
pkgs/products without updating the lockfile, and pkg/ui/package.json has since
grown next-themes, svelte, svelte-check, @hanzo/products and @hanzogui/telemetry,
and moved @hanzo/canvas, @hanzo/dashboard, @hanzo/gitops, @hanzo/ui-shadcn and
@hanzo/usage from workspace:* to peer ranges — none of it recorded.
So the lockfile is regenerated rather than patched. The workspace:* -> range
entries look alarming in the diff but are the lockfile CATCHING UP to what
package.json already declares; no dependency is bumped by this commit. The
remaining version churn is peer-resolution hashes (@types/node@25.9.4 ->
25.9.5 inside vitest's key), not package upgrades.
Verified with the exact CI gate: `pnpm install --frozen-lockfile` now completes
across all 25 workspace projects.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
hanzo.id, hanzo.network, hanzo.one, sensei.group and hanzo.app each carried their
own 160-line DesktopNav.tsx. Measured, they were not variations on a theme:
hanzo.one vs sensei.group BYTE-IDENTICAL
hanzo.network vs hanzo.app 2 lines — text-neutral-400 → text-purple-400
hanzo.network vs hanzo.id ~11 lines
Five copies of one menu, drifting an accent colour at a time. So the menus become
data (menus.ts), the accent becomes a prop, and there is one renderer.
ROUTER-AGNOSTIC by construction, which is the part that matters. The copies
hard-imported react-router-dom's <Link to>; that is precisely why hanzo.ai — a Next
app using <Link href> — could never share them and grew a SIXTH nav instead. The
host now passes `link`, so a Vite SPA, a Next app and a plain-anchor page use the
same component. External destinations bypass it and render a guarded anchor,
because a client router cannot navigate off-site — and the data carries `external`
so the renderer decides from the value, not from a string check at the call site.
Placed in the v5/Tailwind lane beside hanzo-shell because that is the lane these
properties are on. hanzo-shell is the SIGNED-IN app chrome (billing, account,
console, chat, platform); this is the signed-out marketing bar. Same repo,
different job — deliberately not a second take on either.
NOT sourced from @hanzo/products: that models the product FAMILY (six-product
launcher, installs, per-property HEADERS), a different menu with an overlapping
name. hanzo.ai's own nav proves the distinction, carrying Philosophy, Papers,
Startups and Security that no product catalogue knows about. One value model per
concern.
6 tests pin the data: bar order, every href absolute-or-rooted, `external` set iff
the URL is absolute, no duplicate destination within a column, glyph+note only on
the two featured rows.
5.9.1 -> 5.9.2 (npm latest is 5.9.1; patch forward).
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Re-land of 62608ec9, dropped when ui main was force-pushed. The commit object
survived but SiteNav.tsx/SiteFooter.tsx were gone from main entirely.
@hanzo/products already decides WHAT the navigation is (HEADERS per property,
MEET_HANZO_MENU, FOOTER). Nothing rendered it, so every property hand-wrote its
own bar: six DesktopNav copies, ten MobileMenu copies, fifty-seven footers, each
free to drift from the spec and from each other. This adds the missing half — the
renderer, and only the renderer.
SiteNav bar + full-bleed launcher + the small-screen arrangement
SiteFooter the six columns + legal bar
Three things the old menus got wrong, fixed structurally: the launcher is
FULL-BLEED (the old ones anchored a floating card to whichever word opened it, so
a wide panel hung off-centre); hover switches menus but never opens one; and there
is ONE call-to-action taken from SiteHeader.action — cloud.hanzo.ai was rendering
"Get API key" beside two separate "Sign in" buttons, which a single action makes
inexpressible.
Both sit at AppHeader's 52px, border and background, so the signed-out marketing
bar and the signed-in shell bar read as one object.
The products half is re-applied on TOP of upstream rather than restored from the
stale copy — main had since reworked hanzo.app's localNav, so only the two
additions carry forward: hanzo.app leads with Community, and Community becomes a
DESTINATIONS entry so the nav link and its footer twin resolve to one address.
138 products tests pass; renderer typechecks against the models.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Collapses the shadcn, dash, world and legacy hz-ui palettes onto one canonical
--hz-* token source, so a theme change happens in exactly one file. Adds the
embeddable world components (market ticker, news stream, prediction market,
instability score) and the shared billing CreditModal.
The hardcoded dark palette main had been maintaining by hand is now derived:
token-proof.mjs resolves every alias chain and confirms the dark surface still
lands on rgb(0,0,0)/rgb(31,31,31), so the black-monochrome canon is unchanged.
Keeps the @hanzo/ui-shadcn 5.9.1 name and version over the branch's older
@hanzo/ui 5.7.5, and unions the ./account and ./world entry points.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The @hanzo/canvas half of this branch already landed on main; this brings the
remaining piece, the social product components, and re-exports them from
@hanzo/ui/product.
Keeps main's @hanzo/ui 8.0.11 and @hanzo/canvas 0.2.1 over the branch's older
versions, keeps usage living in @hanzo/usage/panel, and drops the leftover
changeset file.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Brings in the canonical component library: a shared design core on
@hanzo/gui + @hanzo/tokens with per-backend implementations (shadcn-compatible
web surface, the @hanzo/gui product layer, and a svelte backend), plus the
generated primitives set and theme.css.
Forward resolutions against main: keep the built dist/ packaging and 8.0.10
version over the branch's source-only exports; union the peer dependencies
(both next-themes and @hanzogui/next-theme are imported, both optional) and
the tsconfig build excludes; keep main's tsup build pipeline and add the
branch's gen:primitives script. Also drops the last changesets leftover — a
semver bump in package.json is the one publish trigger.
A customer's console must show the CUSTOMER's identity. `OrgMark` is now the one
organization treatment: the org's own logo when IAM carries one, else its
MONOGRAM on a neutral tile — the same rule @hanzo/iam's account widget applies to
a person, so a workspace and a user read as one system. It is never a house
glyph. The switcher's private copy of that avatar is gone (it split words on
whitespace alone, so `acme-labs` read "A" instead of "AL").
The switcher trigger is sized as the PEER of the account control — 44px tall, a
30px mark, the same type and the same hit area — because "which workspace" and
"who I am" are two halves of one identity, not a caption over a control.
New optional `current` prop: a host that has already resolved the org (display
name + logo) injects it, so the switcher and the chrome's org mark can never
disagree — and a user with no cross-tenant list still gets their own logo.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Adds a best-effort second publish of the same tarball to
api.hanzo.ai/v1/packages/hanzo/npm so an install does not have to reach npmjs.
Skips with a notice when no token is configured; an already-published version
is treated as success. npmjs stays authoritative.
Keeps main's @hanzo/ui 8.0.10 and its ./oss entry point over the branch's
older 8.0.9 tree.
Collapses SURFACES/HANZO_APPS into a single source in @hanzo/products and
resolves every shell address against the live properties. Adds header, footer,
menu, family, destinations and link modules with tests.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The same 1000+-app open-source catalog is rendered by the console App Store,
platform.hanzo.ai and the public gallery at oss.hanzo.ai. Each carried its own
copy of the catalog shape, the normalizer, the asset-URL builders and a reader
for the blueprint's docker-compose.yml — three implementations of one format,
free to drift until two surfaces disagree about what a deploy will start.
@hanzo/ui/oss is that one implementation. It is pure and framework-free — no
React, no config import, the base URL is injected — so a React console, a Next
app and a plain static page can all use it, and it is testable without a DOM or
a network.
parseBlueprint stays a small structural reader rather than a YAML
implementation: what it cannot read is absent, never guessed, so a surface
degrades to "no blueprint detail" instead of asserting something false about
what will run. Environment KEYS only; the values are routinely secrets.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The desired state is "npmjs holds this version". A version already there
satisfies it, and npm versions are immutable, so EPUBLISHCONFLICT means the
release already happened — a re-run of the workflow, or a hand publish ahead of
the merge. That is success. Treating it as a failure turns every such merge into
a red release for a no-op.
Anything that is not a conflict still fails, and now fails harder: the step
confirms the version is actually queryable on npmjs afterwards rather than
trusting the exit code.
The draft pinned 23 addresses that 404: the installs pointed at hanzo.app
/download/*, the SDK index at docs.hanzo.ai/developers/sdks, the CLI and
quickstart references at docs.hanzo.ai/{cli,quickstarts}, the legal bar at a
/legal/<slug> namespace that is not served, and the App/Bot headers at nav
paths those properties do not have. Host-only assertions passed because they
never checked a path.
Every address now resolves (200, or 401 where the app is behind sign-in) and
agrees with the independent U table in @hanzogui/shell:
installs -> hanzo.ai/{download,extension,desktop,cli}
sdks -> hanzo.ai/sdks
cli reference -> docs.hanzo.ai/docs/cli
quickstarts -> docs.hanzo.ai/docs/getting-started
learn -> hanzo.ai/learn
apps -> docs.hanzo.ai/docs/apps
community -> hanzo.app/community
legal -> hanzo.ai/{privacy,terms,cookies}
Drops the VS Code install and the showcase/changelog resources (no such pages
exist); support takes the freed slot. Corrects the hanzo.app and hanzo.bot
local nav and Bot's CTA to /get-started.
Adds addresses.ts — the one enumeration of every address the spec claims, each
tagged with the surface claiming it — so shell.test.ts guards resolve relative
nav against its own property, and addresses.live.test.ts (HANZO_LIVE_LINKS=1)
fetches all of them. That live check is what pins paths.
Resolves the platform launcher hosts from ORIGIN instead of six inline
literals, and derives each surface's subtitle from its own href, making
ORIGIN's "only place a host lives" invariant true and testable.
Conflict was pkg/ui/package.json alone: the branch adds @hanzo/products
(the collapsed SURFACES/HANZO_APPS source), main added @hanzogui/telemetry
after the branch was cut. Union — both belong.
The desired state is "npmjs holds this version". A version already there
satisfies it, and npm versions are immutable, so EPUBLISHCONFLICT means the
release already happened — a re-run of the workflow, or a hand publish ahead of
the merge. That is success. Treating it as a failure turns every such merge into
a red release for a no-op, which is exactly what the mirror step below already
reasons its way out of; this brings the authoritative step in line.
Anything that is not a conflict still fails, and now fails harder: the step
confirms the version is actually queryable on npmjs afterwards rather than
trusting the exit code.
The draft pinned 23 addresses that 404: the installs pointed at hanzo.app
/download/*, the SDK index at docs.hanzo.ai/developers/sdks, the CLI and
quickstart references at docs.hanzo.ai/{cli,quickstarts}, the legal bar at a
/legal/<slug> namespace that is not served, and the App/Bot headers at nav
paths those properties do not have. Host-only assertions passed because they
never checked a path.
Every address now resolves (200, or 401 where the app is behind sign-in) and
agrees with the independent U table in @hanzogui/shell:
installs -> hanzo.ai/{download,extension,desktop,cli}
sdks -> hanzo.ai/sdks
cli reference -> docs.hanzo.ai/docs/cli
quickstarts -> docs.hanzo.ai/docs/getting-started
learn -> hanzo.ai/learn
apps -> docs.hanzo.ai/docs/apps
community -> hanzo.app/community
legal -> hanzo.ai/{privacy,terms,cookies}
Drops the VS Code install and the showcase/changelog resources (no such pages
exist); support takes the freed slot. Corrects the hanzo.app and hanzo.bot
local nav and Bot's CTA to /get-started.
Adds addresses.ts — the one enumeration of every address the spec claims, each
tagged with the surface claiming it — so shell.test.ts guards resolve relative
nav against its own property, and addresses.live.test.ts (HANZO_LIVE_LINKS=1)
fetches all of them. That live check is what pins paths.
Resolves the platform launcher hosts from ORIGIN instead of six inline
literals, and derives each surface's subtitle from its own href, making
ORIGIN's "only place a host lives" invariant true and testable.
Only conflict was pkg/ui/package.json: both sides added a dependency at the
same line. Union — this branch's @hanzo/products (the collapsed SURFACES/
HANZO_APPS source) alongside main's @hanzogui/telemetry.
Lockfile is main's, unchanged: this branch carried none, so the merge simply
adopts it.
api.hanzo.ai/v1/packages is live and correct and holds nothing — a registry
nobody publishes to. Every @hanzo/* package goes to npmjs and stops there, so
an install of our own packages depends on npmjs being reachable.
Republishes the SAME tarball the npmjs step just built to
api.hanzo.ai/v1/packages/hanzo/npm. Same artifact, same version: no rebuild, no
re-version, and npmjs stays authoritative and untouched (the mirror runs with
its own --registry and its own npmrc, so a failure there cannot affect it).
Best-effort by construction, so it can land before the credential exists:
without HANZO_REGISTRY_TOKEN it prints a notice naming the secret and exits 0,
and it starts working the moment the token is added — no second change. An
already-published version counts as success, because the registry holding that
version is the desired state either way; anything else is a warning, never a
failed release.
Verified: actionlint reports exactly the four findings it reported before this
step (two self-hosted-label, two SC2086 in detect-changes), so nothing new; the
run block passes bash -n.
The same step belongs on the other package repos once the token exists; ui is
the largest publisher and the natural first.
Telemetry already has one home, @hanzogui/telemetry. Apps that depend on
@hanzo/ui had to add a second dependency to reach it, which is how a surface
ends up defined twice.
Adds the subpath so the import is available with no new dependency:
import { TelemetryProvider } from '@hanzo/ui/telemetry'
Pure re-export — no logic here, so there is still exactly one definition and
nothing to keep in sync. Declared as an optional peer, so it is only resolved
when the subpath is actually used.
Verified @hanzogui/telemetry@0.1.0 is published (source: gui/pkgs/telemetry).
Two packages in this repo claim the name @hanzo/data. pkg/data is 1.2.1,
matches npm, and is what pkg/ui depends on. pkgs/data is a 0.1.0 stub with
half the source — and it sits under pkgs/*, which publish.yml auto-publishes
on any version change. A bump there would ship the stub and npm would tag it
latest, silently downgrading every consumer.
publish.yml already skips private packages, so marking it private removes the
hazard without deleting anyone's in-flight work. This is the same shape as the
@hanzo/event incident: two homes for one name, the wrong one wired to ship.
The README links ./TAXONOMY.md as the canonical spec, but `files` omitted it,
so a consumer reading the package offline had a dead link. Rides the next
version bump; no version change of its own.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Two things, one of them a process bug that would have made the rest invisible.
1. A THROWN OBJECT IS UNTRUSTED INPUT. `name`, `message` and `stack` are
ordinary getters and a throwable may define any of them to throw. 0.3.2 read
them directly, so a getter bomb made buildSentryEvent throw and the crash
report was lost on BOTH planes — measured 0/0. normalizeError is now total
(every read guarded, String() coercion guarded) and BOTH planes share that
one normalizer; previously each rolled its own reader, so the stream still
lost a report the error plane had already survived. Measured 5/5 on the
attack table: circular properties, throwing getter in properties, event
transport throwing, getter bomb on the throwable, baseline.
2. THE VERSION HAD TO MOVE. 0.3.2 is already on npm, and publish.yml fires on a
version CHANGE — so landing this as 0.3.2 would have published nothing while
apps pinning ^0.3.2 kept resolving to the release without it. That is the
same silent-gap shape as the original incident, one layer up. Bumped to
0.3.3, package.json and version.ts together (they must never drift: the
dimension that tells you WHICH client sent a batch would quietly lie).
Also bounds the email rule to the RFC 5321 maxima — same unbounded-backtracking
class as the creds-in-URL rule fixed in 0.3.2, on a long run of local-part-legal
characters that never reaches an '@'.
CHANGELOG now records 0.3.2 truthfully — it documented only the FUNNELS work,
while the release that actually shipped also carried the entire error plane, the
plane-isolation fix, the scrub DoS bound and the Luhn gate.
Verified against the live ingest, not asserted: a TypeError whose `stack` getter
throws, carrying circular `properties`, reported from the 0.3.3 build and landed
as a real fatal issue. 93 tests pass.
Two hardenings that hold regardless of how errors are transported.
The email pattern was the second quadratic backtracker after the creds-in-URL
rule: an unbounded local-part run that never reaches '@' cost 20ms on an 8KB
input, synchronously, per captured error. Bounded to the RFC 5321 maxima
(local-part 64, domain 255), which excludes no real address. With this and the
input cap, the whole scrub is 1-3ms at every input size (was 19ms -> 284ms ->
1108ms as input grew 8K -> 32K -> 64K).
normalizeError read err.name/message/stack directly. Those are ordinary getters
and the thrown object is the least trustworthy input this library handles — a
throwing getter took the entire report with it. Read each defensively and fall
back to a total String() coercion that a throwing toString cannot escape either.
Three defects an adversarial review found in 0.3.2 before it shipped:
sendError ran after flush(), inside one try — a circular or throwing value in
properties killed BOTH planes and the buffered batch with it. It now runs first.
The URL-credentials pattern backtracked quadratically: 128KB of colon-rich text
froze the main thread for over a minute from inside captureError. Bounded.
The package description still advertised a server-side fan-out into Sentry that
does not exist. That claim is why nobody set a DSN and the fleet reported zero
errors; shipping it again would have taught the next integrator the same thing.
Funnels become data next to the vocabulary that defines them, so the spec
cannot drift: every step names an EVENTS value and funnels.test.ts fails the
build otherwise. GOALS stop restating their steps — they carry a funnelId and
derive `funnel` from the registry.
Fixes the Signup goal: its funnel required signup_verified, which no surface
emits (IAM-internal), so step 3 was always empty and the goal read 0%.
New names, each load-bearing in a shipped funnel: login_completed (a returning
sign-in is not a signup), build_started (intent, distinct from app_created),
generation_completed/_failed (any model output, carrying durationMs),
deploy_succeeded/_failed (a live URL is its own event, never inferred),
model_switched (the strongest dissatisfaction signal a chat surface has).
A cross-origin funnel must declare join:'aggregate' — two origins mean two
anonymousIds for a logged-out visitor, so a per-person rate would be a lie.
VERSION had drifted to 0.3.0 while the package was 0.3.1, making libraryVersion
wrong on every event.
TAXONOMY.md documents the whole thing: naming convention, property rules,
identify/group semantics, the per-app funnels, and the exact emit site of every
event in hanzo.ai / hanzo.app / hanzo.chat.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
@hanzo/event <=0.3.1 documented errors as "lensed server-side into ... error
tracking (sentry)" and shipped only a type:'error' event on POST /v1/event.
No such fan-out exists. Cloud's handler folds the exception into
properties.$exception, writes one row to the event warehouse, and stops
(clients/analytics has zero references to sentry or errortracking; the sentry
surface is a separate, unconnected route tree). Every Hanzo property inherited
that false claim, so the fleet reported ZERO errors to the Sentry dashboard.
Add the error plane the claim assumed: a captured exception is now ALSO framed
as a real Sentry envelope and POSTed to the DSN's ingest route,
POST {dsn.origin}/v1/sentry/{projectId}/envelope/?sentry_key=<version>:<hmac>
which is what the o11y ingest actually registers. The envelope builder, DSN
parser and client-side scrubber are merged in from the unpublished fork that
had been carrying them in hanzoai/analytics (verified against the server's
parseEnvelope/normalizeEvent), so there is one implementation again.
- Both planes share one session and one subject id, so an error and the
pageview before it join up. Never email/PII: secrets and PII are scrubbed
before anything leaves the device; the server scrubs again.
- The DSN key rides ?sentry_key= only; the event stream's bearer/pk_ key is
never attached to the error host. The two planes authenticate independently.
- No DSN => the plane is INERT, exactly as documented: nothing sent, nothing
thrown, event stream untouched. errorPlaneEnabled exposes the wiring so an
app can assert it instead of discovering the silence months later.
- Errors are sent one envelope per event, immediately. Batching a crash report
is how you lose it.
- Transport gains an optional contentType; existing transports are unaffected.
Proven end to end against the live ingest, not asserted: the built client's
own bytes produced a real grouped issue (correct type, level and crash-site
culprit), and a browser at the production origin https://hanzo.ai delivered an
envelope with HTTP 200 that landed as an issue.
19 new tests cover the regression directly: inert-without-DSN, the derived
ingest URL, envelope framing and UTF-8 byte length, identity correlation,
fatal-vs-error level, scrubbing, credential isolation, and never throwing back
into the host app.
Removing Vercel analytics left the site posting to /v1/event with no
credential, and every batch came back 403 — telemetry replaced with
telemetry that ingests nothing.
The door does not trust the request Host on purpose, because a Host
header is spoofable, so a static page proves its org by carrying a
publishable key. pk_ keys are write-only and HMAC-verified with no
database hop, which is what makes one safe inside a public bundle. The
build supplies it, so each deployment reports as the org that built it,
and a build without one stays inert instead of posting rejects.
Verified against prod: POST /v1/event with a pk_ returns
{"accepted":1,"dropped":0} on both the header and beacon paths.
The docs site pulled in RainbowKit, which bundles a WalletConnect
connector. That connector phoned pulse.walletconnect.org on every page
load — third-party telemetry from a documentation page — and it could
not have worked anyway: the project id fell back to the literal
'YOUR_PROJECT_ID'.
The browser wallet already speaks EIP-1193, so wagmi's injected
connector is all the identity demo needs: the extension is the only
party in the flow, with no bridge service and no vendor id. ConnectWallet
replaces RainbowKit's modal using our own Button.
wagmi and viem stay — they are how the page reads and writes contracts.
Verified: a clean build exports 8,879 files and the shipped JS contains
no walletconnect reference.
On 0.4.1 every HTML route answered 301 -> /index.html, so the internal
filename showed up in the address bar and in the URLs Next derives for
route prefetches.
The site was on Cloudflare Pages as a direct upload — no git connection,
last deployed 2026-03-28 — while a GitHub Pages workflow ran on every
push against a repo that has Pages disabled (the API 404s). Two deploy
paths, neither of which shipped what main said.
One way now: a Dockerfile builds the static export and serves it with
ghcr.io/hanzoai/static, exactly like every other Hanzo static site, on
our own runners and our own ingress.
Along the way, drop what those two vendors left behind:
- output:'export' was gated on GITHUB_ACTIONS || CF_PAGES, so a build
anywhere else silently produced no export at all. The site is a static
export wherever it is built.
- basePath pointed at a '/react-sdk' GitHub Pages subdirectory that is
not this project.
- highlight-code keyed off GITHUB_ACTIONS to pick server vs client
highlighting; it means 'is this a production export', so it says that.
- pages/api/components returned a JSON blob and 404s in production,
because a static export cannot serve an API route. The live index is
the generated /api/registry/components.json.
.gitignore contradicted itself: line 8 ignored the lockfile while the
lockfiles block declared 'pnpm-lock.yaml - needed for CI/CD, do not
ignore'. With no lockfile in the repo and 'pnpm install
--no-frozen-lockfile', every CI run resolved whatever was newest, so the
Pages deploy has been red since 2026-07-22 on '@x402/*' — optional lazy
imports inside a dependency that a newer release started pulling in and
nothing pinned.
This lockfile is the resolution the app builds green on locally
(verified: full next build, 312+ static pages, exit 0).
link-workspace-packages=true, so the app resolves @hanzo/event to
pkgs/event no matter what the range says, and its exports point at dist/
— which only exists once the package is built. The workflow already
builds pkgs/ui for the same reason; event needs the same step. Declare
the dep by published range like every other @hanzo/* dep in the app.
@hanzo/analytics (pkgs/capture) is the superseded duplicate and is gone
from the tree, so depending on it would not resolve. @hanzo/event is the
one telemetry client — one Event type, one door (POST /v1/event). Its
host already defaults to the one edge, so the site needs no config
beyond naming itself.
ui.hanzo.ai is a static export on GitHub Pages, not Vercel, so
@vercel/analytics injected /_vercel/insights/script.js — which 404s and
is then refused as text/html, on every page. It was also a second way to
do a thing we already own: pkgs/capture ships @hanzo/analytics.
Route both call sites through one client (lib/analytics.ts): the mount
sends pageviews, trackEvent sends events. Neither knows the vendor —
they name what happened and the client owns where it goes.
Two consumer-caught blockers in 8.0.7:
1. gui-native "Missing theme". The gui Popover's SheetController re-roots the trigger
subtree and reads the theme from React context; on gui-native hosts
(@hanzogui/react-native-web-lite, theme in context, no CSS-class fallback) that throws
at MOUNT. FIX: drop the gui Popover entirely — every menu now rides ONE Portal path
(the ContextMenu approach that already worked on gui-native):
- menu/FloatingMenu.tsx — shared floating primitive: gui Portal + PortalTheme
(re-applies the captured theme inside the portal) + anchor positioning (trigger rect
or cursor point) + edge-flip + dismiss + roving keys.
- DropdownMenu, ContextMenu, SelectMenu (now a thin DropdownMenu), ComboBox all use it.
No Popover, no Sheet, no re-root.
Verified on a Vite + rnw-lite harness (theme in React context, NO root theme fallback):
NEW DropdownMenu + SelectMenu render correctly themed through the Portal, dark + light.
2. Next 16 flight-loader parse error. 8.0.7 shipped raw `.ts` with inline
`export { X, type Y }`; Next's flight-client loader parses node_modules `'use client'`
modules WITHOUT TS and choked on `type`. FIX: ship a COMPILED dist —
- tsup → ESM (.js) + CJS (.cjs), every dep external, all 11 subpath entries.
- tsc → .d.ts (dist). scripts/add-use-client.mjs stamps `'use client'` on every output
(tsup banner misses split chunks). CSS copied.
- package.json main/module/exports repointed at dist; files=[dist].
`node --check` passes on all 28 compiled files; the 8.0.7 offender is now valid JS with
the TS `type` stripped — the flight-loader parse error is structurally impossible.
pnpm typecheck: 0 · pnpm test: 19/19 · pnpm build: exit 0.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The @hanzo/gui v5 config omits longhand style aliases that have a shorthand, so
the strict pkg/ui build (createGui augmentation) rejected backgroundColor/alignItems/
justifyContent/minWidth/maxHeight/paddingHorizontal/paddingVertical/marginVertical/
flexShrink/borderRadius/userSelect. Convert the menu primitives + the Popover.Content
shells to the config vocabulary (bg/items/justify/minW/maxH/px/py/my/shrink/rounded/
select). Runtime is unchanged (Tamagui accepts both) — this is the published 8.0.7 code.
pnpm typecheck: 0 errors · pnpm test: 19/19 · pnpm build: exit 0 (48 d.ts emitted).
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
@hanzo/ui/product gains the shared menu primitives every Hanzo surface
(app/chat/desktop) needs, all on @hanzo/gui/Tamagui, all on ONE item spec so
menus are pixel-identical across the fleet.
- menu/items.tsx — the ONE spec: MenuPanel ($color2 surface, hairline, radius-12,
pad-4), MenuItemView (h30, px8, gap8, 16px icon slot left, 13px label, right
affordance shortcut/check/chevron; hover/focus/press → purple accent-soft;
selected → check+accent; disabled muted; optional 2nd-line description),
MenuSeparatorView (1px hairline, 4px margin), MenuLabelView (11px uppercase),
renderMenuItems. Geometry literal px on the 8-grid; colour theme-adaptive tokens
+ brand purple via var(--hanzo-accent[-soft]).
- menu/DropdownMenu.tsx — click menu on gui Popover (bottom-start, allowFlip,
useControllableState).
- menu/ContextMenu.tsx — right-click menu on gui Portal, cursor-positioned (fixed),
edge-flip, dismiss on outside/Escape/scroll/resize/blur.
- menu/portal-theme.tsx — PortalTheme: captures useThemeName() at the trigger and
re-applies <Theme name> INSIDE portaled content, so menus render correctly through
a portal under a nested <Theme> (light+dark). Fixes GAP 1 (desktop "Missing theme").
- menu/roving.ts — shared Arrow/Home/End/Escape keyboard nav.
- SelectMenu + ComboBox — adopt the shared spec + PortalTheme fix (DRY; identical rows).
- ThemeToggle — framework-agnostic: controlled via theme + onToggle/onThemeChange
(NO framework dep, for Vite/Tauri/Express); uncontrolled falls back to the OPTIONAL
@hanzogui/next-theme via ThemeToggleNext (lazy, ErrorBoundary→DOM), so console/Next
stays backward-compatible and non-Next hosts build.
- package.json — 8.0.7; @hanzogui/next-theme added as an OPTIONAL peer.
Verified against the real published @hanzo/gui@7.3.0: product source type-checks
clean; a Vite harness renders DropdownMenu + ContextMenu + SelectMenu + ThemeToggle
through portals under a nested <Theme name="dark"/"light"> — panels correctly themed
(t_dark rgb(20,20,20) / t_light rgb(247,247,247)) while root stays light, no errors.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Makes @hanzo/gui (Tamagui) / React Native and Tauri desktop emit the SAME
canonical Events as the web — same semantic hierarchy, privacy gate, and ONE front
door (POST /v1/event via @hanzo/event).
- '.' (React/Tamagui): ObserveProvider + ObserveScope compose the semantic path
from the React tree (no DOM); useObserve().press/changeText/event/screen wrap
RN/Tamagui handlers; useEventStream for playback
- './tauri' (react-free): bindTauri runs the @hanzo/observe DOM engine in the
webview + forwards Tauri native events; @tauri-apps/api is a runtime-optional peer
- pure emit/semantic/redact core reuses @hanzo/observe wireProps/labelFor/
sensitiveKey so native and web are byte-identical on the wire
19 tests green (semantic/emit/tauri + React mount via react-dom/client).
Reuses the framework-agnostic @hanzo/observe engine; binds it to Svelte idioms:
- createObserver(client) — bootstrap capture in a root +layout (idempotent, SSR-safe)
- observe action — use:observe={{ name }} stamps a stable component name the engine
labels interactions with; { private } / { view } opt out / into a subtree
- stream store — a Svelte-readable live window of interactions for session playback
Emits through @hanzo/event to POST /v1/event. 7 tests green; svelte is an optional
peer (action + store satisfy Svelte contracts structurally).
@hanzo/observe — watches every click/input/nav/visibility across the tree,
annotates each with a semantic hierarchy (component path / role / data-testid /
aria) auto-derived from the DOM as a small JSON-LD document, and emits it through
@hanzo/event to the ONE front door (POST /v1/event).
- framework-agnostic engine ('.'): Observer + annotate + redact + Stream
- React default experience ('./react'): ObserveProvider + useEventStream (session
playback) + useObserver
- privacy-first: input values withheld by default, sensitive fields always
redacted, data-hz-private subtree opt-out; fail-soft throughout
28 tests green (annotate/redact/stream/observer).
The 0.3.0 CJS bundle went to dist/index.js, which Node parses as ESM under
"type": "module" — require('@hanzo/event') threw "exports is not defined in
ES module scope". Emit CJS as .cjs (ESM stays .mjs) and map each exports
condition to its own types. No API change. Bumps 0.3.0 -> 0.3.1.
Repoint @hanzo/event onto Hanzo Cloud's single ingestion front door
(POST /v1/event, body {batch:[Event,...]}), replacing the deprecated
/v1/analytics + /v1/tracker split and the interim /v1/ingest key door.
One door, one wire, for cookie / bearer / publishable-key auth alike.
Errors now reach the error-tracking lens. The batched Event wire carries
`type`, which cloud folds to event_type='error' (foldException +
canonicalType); the exception rides the top-level `error` field, lifted
into properties.$exception. The four-field {event,distinctId,time,
properties} array has no `type`, so it can never be lensed as an error —
the batched wire is the one that lights up web + product + error.
Publishable keys authenticate directly on /v1/event now: Authorization:
Bearer pk_ on fetch, ?ingest_key=pk_ on a headerless unload beacon.
Delete the orphan @hanzo/analytics@0.1.0 thin dup (pkgs/capture, a
leftover of the @hanzo/capture -> @hanzo/event rename that nothing
imports) so the repo carries exactly one telemetry client.
VERSION 0.2.0 -> 0.3.0.
ONE framework-agnostic surfaces.data module (id doubles as icon key) is now the
single source every launcher consumes. Adds hanzo.bot + hanzo.chat, collapses the
redundant cloud/console pair, renders a distinct per-surface icon, and omits the
current surface (no self-link). Publishes 8.0.6.
Rework pkg/ui (@hanzo/ui@8) into THE canonical Hanzo UI package: one design core
(@hanzo/tokens, Hanzo dark-first identity, Geist Sans/Mono) with per-backend
implementations. The root barrel now exposes the shadcn-compatible component API
apps import, so consumers drop the @hanzo/ui-shadcn alias and point @hanzo/ui here
with zero import churn.
Organization (src/):
- core/ backend-agnostic: cn (clsx+tailwind-merge), tokens (re-export of
@hanzo/tokens), fonts (Geist vars)
- theme.css self-contained standard-token CSS vars + Geist — the identity
- backends/ shadcn/ (Radix + Tailwind, the web API) and gui/ (@hanzo/gui product
layer); README documents adding a backend (svelte/solid/…)
- models/ the unified ModelSelector + catalog helpers
- primitives/ GENERATED per-member entrypoints (scripts/gen-primitives.mjs) so a
host that modularizes @hanzo/ui imports resolves unchanged
Ported the full component surface hanzo.app imports (Badge, Button, Card*,
Checkbox, Dialog*, DropdownMenu*, Input, Toaster, Avatar*, Tabs*, Select*,
Tooltip*, Popover*, Command*, Collapsible*, ScrollArea, Slider, Switch, Progress,
Separator, Label, Textarea, AspectRatio) + models. Behaviour-heavy components keep
Radix for a11y/portal/keyboard, styled with STANDARD tokens only.
Token-bug fix: every component uses standard design tokens (bg-popover,
border-border, bg-primary, text-muted-foreground, …); the app-private tokens that
rendered transparent (bg-bg-dark, bg-bg-secondary, text-text-secondary,
bg-divider, bg-brand, bg-level-2, hard-coded bg-gray-*) are gone. No hard-coded
font: UI inherits Geist Sans, code Geist Mono, portaled surfaces bind font-sans.
Root barrel is pure web (no @hanzo/gui/react-native-web pull); the gui product
layer + gui theme tokens live on the explicit /product and /gui subpaths.
Also: fix @hanzo/tokens dts build under TS 6 (ignoreDeprecations). Verified:
tsconfig.check.json typecheck green; runtime export test — all 66 required
components + ModelSelector export from @hanzo/ui root; per-member entrypoints
resolve.
0a212316 renamed the dir but a bad `git add` pathspec dropped the content edits,
so pkgs/event shipped as @hanzo/capture@0.1.1 and `pnpm --filter event` matched
nothing (nothing published). This lands the real change: name @hanzo/event@0.2.0,
the captureError/captureException surface, auto error handlers, React ErrorBoundary,
Exception type, and the 6 error-capture tests (28/28 green locally).
Rename the capture SDK to @hanzo/event and fold error tracking into it, so ONE
client emits every kind of event — pageview/event/identify/group AND errors — on
one batched stream. The server lenses that one stream into product analytics, web
analytics, and error tracking (insights/analytics/sentry.hanzo.ai). Subsumes
@sentry: no second SDK, no second pipe.
- New 'error' EventKind + Exception type; WireEvent carries the exception.
- Analytics.captureError()/captureException(): normalize any throwable, emit a
type:'error' event, flush at once (a crash may unload the page). Never throws
back into the app.
- Auto-capture (config captureErrors, default on, browser-only): window.onerror +
unhandledrejection → error events. The drop-in @sentry replacement.
- React ErrorBoundary (./react): reports render errors React swallows before
window.onerror sees them — the React half of the replacement.
- 0.1.1 → 0.2.0. 28/28 tests pass (6 new error-capture specs), tsup build green.
Consumers (app/chat/console/hanzo.ai/operator) migrate @hanzo/capture →
@hanzo/event next; @hanzo/capture stops shipping new versions.
Live verification against prod found two contract mismatches the offline build
could not see:
- the fleet bound to ZERO rows: /v1/deploy/applications serves argoproj-shaped
items (metadata.name, spec.source.*, status.{sync,health}.status,
status.summary.images[]) but the adapter read only the flat native keys.
normalizeDeployApp now reads BOTH wires, flat first, then the nested fields.
- the resource tree 404d: the wired route is applications/:name/resource-tree;
the shorter :name/tree belongs to an unregistered handler.
Live now: 78 applications (69 Healthy / 9 Degraded), env chips, detail with the
real APP->DEPLOYMENT->POD topology, 0 page errors, 0px mobile overflow. The live
payload is pinned as a regression fixture. 38/38 unit, e2e desktop+mobile green.
A native Hanzo CD app (Vite + React 19) that replaces the ArgoCD React fork:
fleet list, app detail with the live resource tree, sync/rollback, over cloud
/v1/deploy. Mobile-first, Geist, small mark, 245KB (the fork was ~18MB).
Ships as a static build to the s3://cdn/cd plane cd.hanzo.ai already serves.
Red review of the cd.hanzo.ai app found three real defects in the SHARED
components (so this hardens the console surfaces too):
- tree: buildResourceGraph seeded `children` lazily per node, so any tree that
listed a child before its parent — or any ownerRef cycle — dereferenced
undefined and threw during render. K8s object lists are not topologically
sorted, so this fired on ordinary data and, with no error boundary, blanked
the whole dashboard. Pre-seed every id before the edge pass.
- health/sync: the substring fallback up-guessed a BAD state to a GOOD one
(NotReady/unavailable -> Healthy, notsynced -> Synced). An incident shown
green is worse than one shown Unknown, so the positive up-guess is gone;
unrecognized folds to Unknown. foldSync also normalizes separators so the
canonical out-of-sync folds at the source.
- diff: lineDiff always built the full O(n*m) LCS matrix; a large ConfigMap
(reachable — not Secret-excluded) froze the tab. Size-guard to a block diff.
Also: an app-level ErrorBoundary so one render throw can never white-screen the
dashboard, client log caps + array-shaped log tolerance, a Secret-kind skip in
the tree, and vitest no longer globs the Playwright specs.
Tests assert the fixed behavior: 35/35 unit (incl. the adversarial fuzz suite
flipped from codifying the bugs), 42/42 gitops, 2/2 e2e desktop+mobile.
Replace the ArgoCD React fork (deploy/ui, webpack argo-cd-ui) with a focused,
mobile-first CD dashboard built on the shared Hanzo component packages over the
native cloud CD plane (/v1/deploy). Its job stays: see every operator App CR with
stats · sync · health · resource tree · logs · sync/rollback.
- Vite + React 19 STATIC SPA → dist/ (index.html + login.html + CNAME + assets),
published to the existing s3://cdn/cd static plane cd.hanzo.ai already serves
(ingress staticFiles/spaMode; /v1/deploy peeled to cloud). No ingress/backend
change.
- @hanzo/gitops (framework-free ArgoCD-replacement views): GitopsAppList for the
fleet; GitopsSyncPanel + GitopsAppTree + GitopsNodeInfo + GitopsRollbackDialog
composed for the app detail (lazy per-node /resource + /logs). Resolved via Vite
path alias off the built dist so it builds without a full monorepo install.
- src/lib/adapt.ts maps the real /v1/deploy DTOs into the @hanzo/gitops
view-models, reusing the package's foldHealth/foldSync (strips [-_] so the
hyphenated 'out-of-sync' folds to OutOfSync, not Unknown).
- Auth: the admin-console PKCE login.html (ported) → hanzo_iam_token cookie the
cloud binary validates (SuperAdmin gate); same-origin credentialed /v1/deploy.
- Lean self-contained topbar (Geist, small mark, env scope) in the interim; the
@hanzo/ui-shadcn shared shell + @hanzo/canvas map are registry-install-gated
follow-ons (the map already ships green in hanzoai/console).
- Verify: tsc 0; vitest 8/8 (adapter + the sync-fold fix); playwright render +
mobile (no horizontal body scroll at 390).
One selector for hanzo.app/chat/console: family groups (Enso, Zen,
Anthropic, OpenAI first), cmdk search, premium marks, context hints,
fetchModelCatalog off /v1/models. catalog.ts pure + SSR-safe.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Adds the one model selector for every Hanzo app to the existing ./models
subpath: hanzo.chat-style family grouping in a compact Radix Popover + cmdk
Command combobox (grouped sections, family headers, premium markers, context
suffixes, keyboard nav, type-to-filter search over 12 models). Monochrome,
dark-first, data-agnostic.
- catalog.ts: ModelCatalogEntry, familyOf, groupModelsByFamily, isChatModel,
filterChatModels, fetchModelCatalog (pure, SSR-safe, no caching/state)
- ModelSelector.tsx: ModelSelector + ModelSelectorProps
- wired through src/models/index.ts; version 5.8.0 -> 5.9.0 (minor, additive)
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The Button always rendered two JSX children (a loading-spinner slot + children).
Under asChild, Comp is a Radix Slot which calls React.Children.only on that
2-element array and throws 'expected to receive a single React element child',
crashing the consuming tree. A slotted button can't host an injected spinner
anyway (the child replaces the button), so with asChild we now pass children
through as the single child Slot requires. Non-asChild loading behavior is
unchanged. This kills the whole <Button asChild> crash class for consumers
(hanzo.app hit it on /projects and /dev).
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Document the canvas/wallet/network/billing/dashboard/usage/gitops/data subpaths
(thin re-exports of their home packages, optional peers) + the pkg/ui publish
caveat, so consoles import every recent component from the single @hanzo/ui.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Complete the one-surface pattern the @hanzo/ui/gitops subpath started: add thin
re-export subpaths so a console imports every recent component from the single
@hanzo/ui entry while each lives once in its home package (zero duplication,
optional peers — only pulled when the subpath is used):
@hanzo/ui/canvas -> @hanzo/canvas (ProjectCanvas, ServiceNode, DeployTimeline, EnvSwitcher, ServiceDetailDrawer, ServiceStatusBadge)
@hanzo/ui/wallet -> @hanzo/ui-shadcn/wallet (WalletMenu, injectedEvmAdapter [EIP-1193], walletAvailable, ensureEvmNetwork)
@hanzo/ui/network -> @hanzo/ui-shadcn/network (NetworkSwitcher, useNetwork, configureNetworks, HANZO_NETWORKS)
@hanzo/ui/billing -> @hanzo/ui-shadcn/billing (CreditModal)
@hanzo/ui/dashboard -> @hanzo/dashboard
@hanzo/ui/usage -> @hanzo/usage (UsageMeter, UsageProviderCard, UsageDashboard)
Together with the existing ./gitops and ./data subpaths that is the 8 newest
component kits reachable from @hanzo/ui. Bump @hanzo/ui 8.0.2 -> 8.0.3.
Publish the two lagging homes via ARC (pkgs/* -> publish.yml):
@hanzo/canvas 0.2.0 -> 0.2.1 (npm was behind at 0.1.0)
@hanzo/gitops 0.1.0 -> 0.1.1 (first publish)
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Extract the pure Hanzo Social display components into @hanzo/ui on the @hanzo/gui
idiom (Card/XStack/YStack/Text, $-tokens), data + handlers injected via props,
reusing the shared StatusTag. Additive: new product/social/* + one barrel line;
no existing export changed. Published @hanzo/ui 8.0.2.
Thin subpath so a console can import from '@hanzo/ui/gitops' while the code lives
once in @hanzo/gitops. Optional peer dependency — only pulled when the subpath is
used.
demo/demo.tsx server-renders the sync panel + resource tree + node drill-in
(diff tab) + applications list into a self-contained demo/index.html for visual
review. Reproduce command in the file header.
happy-dom + Testing Library render proofs: tree draws a card per resource with
SVG edges + collapse hides pods + selection fires; node panel shows manifest and
switches to diff/events/logs; diff classes add/del + tallies; app list filters by
search. 42 tests green (33 pure + 9 render).
Table/grid of applications with name/project, sync + health badges, revision,
source and age. Search across name/project/namespace/source, multi-select
health + sync filters, sortable columns (name/health/sync/age via the pure
ranks). Data-prop-driven; row-open callback.
Publishing is now a single step: bump a package's version in its
package.json, merge to main, and publish.yml publishes the changed
@hanzo/* package to npm.
Remove the changeset machinery (.changeset/, changeset-version.js) and
the redundant publish paths — release.yml (version-PR bot),
npm-publish.yml (manual dispatch), publish-on-tag.yml (tag trigger),
prerelease*.yml (betas) — leaving publish.yml as the only path. Drop the
@changesets deps and the `changeset version` scripts; refresh the
CONTRIBUTING and LLM docs.
Publishing is now a single step: bump a package's version in its
package.json, merge to main, and publish.yml publishes the changed
@hanzo/* package to npm.
Remove the changeset machinery (.changeset/, changeset-version.js) and
the redundant publish paths — release.yml (version-PR bot),
npm-publish.yml (manual dispatch), publish-on-tag.yml (tag trigger),
prerelease*.yml (betas) — leaving publish.yml as the only path. Drop the
@changesets deps and the `changeset version` scripts; refresh the
CONTRIBUTING and LLM docs.
* @hanzo/analytics: shared product-analytics capture client
Tiny batched client emitting pageview/event/identify/group to Hanzo Cloud
(/v1/analytics + /v1/tracker) — never to insights-capture directly. First-touch
UTM/referrer/refCode attribution persisted and attached to every event;
beacon-on-unload; dual cookie/bearer auth; SSR-safe; tenant is stamped
server-side (never sent by the client). Ships a framework-agnostic core and a
@hanzo/analytics/react provider + hooks, plus the shared EVENTS/GOALS/COHORTS
vocabulary. 22 unit tests + tsup build (cjs/esm/dts) green.
* rename @hanzo/analytics -> @hanzo/capture (name collision)
The intended name @hanzo/analytics is already a LIVE, hanzoai-owned npm package
(team-manager's, latest 0.6.4, an incompatible providers/Analytics API).
Publishing this new capture client under that name would move the 'latest' tag
onto a different codebase and confuse/break bare + latest consumers. Renamed to
the free, single-word @hanzo/capture, which also matches cloud's 'capture plane'.
One-line revert if the owner prefers to supersede team-manager instead.
---------
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The intended name @hanzo/analytics is already a LIVE, hanzoai-owned npm package
(team-manager's, latest 0.6.4, an incompatible providers/Analytics API).
Publishing this new capture client under that name would move the 'latest' tag
onto a different codebase and confuse/break bare + latest consumers. Renamed to
the free, single-word @hanzo/capture, which also matches cloud's 'capture plane'.
One-line revert if the owner prefers to supersede team-manager instead.
Zero-consumer AI-usage duplicates removed so <UsagePanel> in @hanzo/usage is the
single source: @hanzo/ui product usage kit (UsageDashboard/UsageMeter/
UsageProviderCard) and @hanzo/ui-shadcn billing usage-panel. Verified no
remaining references across pkg/pkgs/apps; the panel now lives at
@hanzo/usage/panel (gui/Tamagui) with the DOM <UsageDashboard> at /react.
(Phase-A intent from feat/usage-panel-phase-a, applied onto current main — that
branch sits on the retired v8 line and is not itself mergeable.)
Tiny batched client emitting pageview/event/identify/group to Hanzo Cloud
(/v1/analytics + /v1/tracker) — never to insights-capture directly. First-touch
UTM/referrer/refCode attribution persisted and attached to every event;
beacon-on-unload; dual cookie/bearer auth; SSR-safe; tenant is stamped
server-side (never sent by the client). Ships a framework-agnostic core and a
@hanzo/analytics/react provider + hooks, plus the shared EVENTS/GOALS/COHORTS
vocabulary. 22 unit tests + tsup build (cjs/esm/dts) green.
Typed field system (26 types) → record table / card / detail, on @hanzo/gui
(web + native + desktop), shorthand style props, zero Tailwind. The universal
object/field/record/view core for any Base-backed CRM, CMS, or commerce app.
Registry-dispatched (add a type = one registerField call). Ships TS source
(zero-build internal package). tsc --noEmit clean against @hanzo/gui 7.2.2.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
A new source-only @hanzo/gui package: a pannable/zoomable board of service
nodes (ProjectCanvas over @xyflow/react) with live status (ServiceStatusBadge),
metric sparklines (MetricSparkline), deploy timelines (DeployTimeline), an
environment switcher (EnvSwitcher), and a tabbed service detail drawer
(ServiceDetailDrawer) — plus the ServiceNode card and SourceRef/ReplicaPill
primitives. Presentational + data-prop-driven; brand/white-label aware via the
design tokens (semantic status palette overridable per brand). Pure folds
(status normalization, layered graph layout, relative time) are unit-tested
(17 tests). React-free logic re-exported at @hanzo/canvas/pure so data mappers
and their tests never pull in JSX/xyflow.
Co-authored-by: hanzo-dev <dev@hanzo.ai>
A new source-only @hanzo/gui package: a pannable/zoomable board of service
nodes (ProjectCanvas over @xyflow/react) with live status (ServiceStatusBadge),
metric sparklines (MetricSparkline), deploy timelines (DeployTimeline), an
environment switcher (EnvSwitcher), and a tabbed service detail drawer
(ServiceDetailDrawer) — plus the ServiceNode card and SourceRef/ReplicaPill
primitives. Presentational + data-prop-driven; brand/white-label aware via the
design tokens (semantic status palette overridable per brand). Pure folds
(status normalization, layered graph layout, relative time) are unit-tested
(17 tests). React-free logic re-exported at @hanzo/canvas/pure so data mappers
and their tests never pull in JSX/xyflow.
* fix(ui-shadcn): self-referencing imports use the package's own name
The @hanzo/ui -> @hanzo/ui-shadcn rename (name freed for v8) left 29 files
importing themselves via the OLD name, breaking tsc/dts and making dist
resolve against npm @hanzo/ui@8.x at runtime. Self-reference by own name
resolves correctly under any install name (including npm: aliases).
* feat(network,wallet): the ONE hanzo.network selector + wallet menu
<NetworkSwitcher/> + <WalletMenu/> at @hanzo/ui-shadcn/{network,wallet} —
the shared network/wallet standard for desktop, app, chat, team, console.
- Network = (env, label, networkID, evmChainID, rpcEndpoint, apiEndpoint):
sovereign L1, networkID === evmChainID; envs mirror the hanzo CLI
(mainnet 36963 / testnet 36964 / devnet 36965 / local 31337; one
api.hanzo.ai across public envs; per-env rpc.hanzo[-test|-dev].network).
- Selection persists env name only; endpoints always re-resolve from code.
- WalletAdapter seam keeps custody per-surface (desktop lux-wallet PQ HD,
web injected EIP-1193 — non-custodial, no key material, no storage).
- 20 vitest cases; v5.7.2.
* feat(network,wallet): menuSide prop — menus open upward from footers (v5.7.3)
* fix(network): align to genesis-canonical chain IDs (v5.7.4)
The published 5.7.3 mirrored pre-reconcile CLI values. cli#3 + console#139
(both merged) fixed the canonical set to match genesis
(lux/genesis/configs/hanzo-*). Align EXACTLY to console main
src/lib/network.ts + cli main src/commands/network.rs:
testnet 36964 -> 36962 (rpc.hanzo-test.network -> rpc.testnet.hanzo.network)
devnet 36965 -> 36964 (rpc.hanzo-dev.network -> rpc.devnet.hanzo.network)
local 31337 -> 1337 (:9650/ext/bc/C/rpc -> :9630/v1/bc/C/rpc)
Sovereign L1 networkID === evmChainID preserved. mainnet 36963 unchanged.
The shared component is the ONE place — it MUST match genesis.
vitest 254/254; tsup + tsc dts green.
---------
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
* feat(@hanzo/data): Twenty-grade record views (table/board/detail/editors) — clean-room
Bring the Hanzo Base data-app layer to Airtable/Twenty-class polish, 100% original
(no Twenty code — GPL kept at arm's length; Twenty observed as a running-UI reference only).
New in pkg/data (published as @hanzo/data@1.2.0):
- RecordsView shell: table <-> board switch, search, filter builder, sort builder,
board group-by, optional saved views — one ViewConfig, applied via pure view/logic.
- DataTable (Twenty-grade): click-to-sort headers, drag-resize + drag-reorder columns,
row selection + select-all, inline cell editing, pagination, hover-open, honest states.
- BoardView: kanban grouped by a select/status/boolean/relation field; drag-between-lanes
emits the record patch (optimistic, reverts on failure).
- RecordDetail: titled, inline-editable panel + related slot; RecordForm gains fieldOptions.
- Field editors upgraded: searchable select dropdown w/ color chips, month-grid calendar,
relation record-picker, file upload, validated JSON, sliding boolean toggle.
- Pure logic (sort/filter/search/group/paginate/view) — gui-free, 37 unit tests, exported
on subpaths (@hanzo/data/{table,board,view}/logic).
- Self-contained primitives (Menu/CheckBox/Toggle/Calendar) on the minimal proven gui surface.
- gui.config.ts + gui.d.ts so the package type-checks the v5 shorthands standalone.
@hanzo/ui/primitives/bases/data re-exports @hanzo/data (the bases surface convention).
tsc --noEmit clean; vitest 37/37.
* feat(@hanzo/ui): v8 unified lib on @hanzo/gui — product + record (@hanzo/data) layers
The one cross-platform, presentational, host-agnostic, clean-room component
library. Product/app layer (charts, metrics, page headers, status tags, empty
states, combobox, slide-over, toasts, drag-reorder, field rows, marks) at
'@hanzo/ui'; metadata-driven record layer composed from @hanzo/data at
'@hanzo/ui/data'; calm dark-first tokens + motion vocabulary. Web + native + desktop.
Retires the shadcn @hanzo/ui (5.x) → @hanzo/ui-shadcn; this gui-based line
carries the name forward at 8.0.0. tsc --noEmit clean, vitest 12/12.
Manifest: CONSOLIDATION.md.
* refactor(ui): retire shadcn @hanzo/ui → @hanzo/ui-shadcn (name freed for v8)
Rename the legacy shadcn/Radix line (pkgs/ui, 5.7.0) to @hanzo/ui-shadcn so the
gui-based unified library can carry the @hanzo/ui name forward at v8. Code is
untouched — only the package name changes; the published @hanzo/ui@5.7.1 stays
on npm for external ^5.x consumers.
Internal workspace consumers keep resolving the shadcn line with ZERO source
edits via workspace aliases (@hanzo/ui → @hanzo/ui-shadcn):
- app (@hanzo/ui-web): dependency workspace alias
- commerce: devDependency workspace alias (source imports @hanzo/ui/*),
peer stays @hanzo/ui>=5.0.0 for external consumers
- checkout, agent-ui: peer ranges unchanged (no source imports)
Proven: app + commerce node_modules/@hanzo/ui resolve to @hanzo/ui-shadcn@5.7.0.
Drive-by (unblocks workspace install/CI): pkgs/data pinned the now-unpublished
@hanzogui/config@7.2.2 — patch-forward to 7.3.0 (published latest, same major,
matches pkg/ui).
* build(ui,data): emit compiled .d.ts — retire raw-.tsx type surface
@hanzo/ui@8.0.1 + @hanzo/data@1.2.1: types/exports now point at flat
compiled declarations (tsc -p tsconfig.build.json → types/), matching
@hanzo/gui@7.3.0. src/gui-env.d.ts bakes the GuiCustomConfig augmentation
into each package's own compilation so shorthand props resolve internally —
consumers no longer type-check vendor .tsx (the 171-phantom-error/hoisted-
linker fragility).
---------
Co-authored-by: Hanzo AI <ai@hanzo.ai>
Co-authored-by: hanzo-dev <dev@hanzo.ai>
The ONE cross-platform AI-usage surface every Hanzo app (console, desktop,
app, chat) renders: a labeled rate-limit bar with % left + honest reset
countdown, a per-provider quota card (session/weekly/extra windows, spend,
history sparkline) mirroring the Codex menu card, and a dashboard grid with a
totals header. Composes existing Charts.Sparkline + Metric idioms on @hanzo/gui
primitives only; presentational, host-agnostic, web + native + desktop.
Bumps @hanzo/ui 8.0.0 -> 8.0.1.
Presentational, self-contained credit/top-up modal any Hanzo app
(console2, hanzo.app, billing.hanzo.ai) can mount with its own data +
handlers. All data/handlers injected via props (cents-based, commerce
balance shape); no network calls, no app coupling.
- Two distinct buckets: non-cash trial credit vs. real prepaid money,
with a combined breakdown + explicit total.
- Welcome celebration state when a new user's trial credit just landed.
- Top-up affordance (preset amounts + custom) that calls the injected
onTopUp(amountCents); Square/HUSD payment flow stays in the caller,
optionally rendered via children. Reuses the existing handler-prop
pattern (onAddFunds / SquareCardForm) rather than duplicating it.
- Reuses the package radix Dialog primitive for focus trap, escape,
overlay + aria; styled with the billing semantic tokens.
- Exported from the billing barrel; 8 vitest cases.
Co-authored-by: hanzo-dev <dev@hanzo.ai>
Presentational, self-contained credit/top-up modal any Hanzo app
(console2, hanzo.app, billing.hanzo.ai) can mount with its own data +
handlers. All data/handlers injected via props (cents-based, commerce
balance shape); no network calls, no app coupling.
- Two distinct buckets: non-cash trial credit vs. real prepaid money,
with a combined breakdown + explicit total.
- Welcome celebration state when a new user's trial credit just landed.
- Top-up affordance (preset amounts + custom) that calls the injected
onTopUp(amountCents); Square/HUSD payment flow stays in the caller,
optionally rendered via children. Reuses the existing handler-prop
pattern (onAddFunds / SquareCardForm) rather than duplicating it.
- Reuses the package radix Dialog primitive for focus trap, escape,
overlay + aria; styled with the billing semantic tokens.
- Exported from the billing barrel; 8 vitest cases.
Drop 'LivingOverview'/'LineChart'/'BarChart'/'BarRows' from prose comments;
match the de-branded single-word exports. No code change (typecheck still clean).
Documents every export + usage snippet, maps each back to its console2 source,
the generalizations made, and the exact per-component swap plan for consuming
@hanzo/dashboard back in console2 (follow-up pass). Tidy a double import.
Augment GuiCustomConfig in BOTH @hanzogui/web and @hanzogui/core, and declare
@hanzogui/web + @hanzogui/core as devDeps so the 'declare module' targets resolve
under pnpm strict nesting (npm-flat installs like console2 hoist them; pnpm does
not). Result: tsc --noEmit clean (0 errors) and tsc build emits dist cleanly.
- landing/: Landing (Hero/Metrics/Samples/Rail) + pure link logic — brand/docs
via LandingConfig props (no host-app config coupling)
- pipeline/: pure pipeline.ts (de-branded stage model) + small stages-driven
Pipeline component; de-branded CSS classes (hz-pipe-*)
- src/index.ts: clean single-word public API
No other-company brand names anywhere; single-word exports per naming guidance.
Rename the legacy shadcn/Radix line (pkgs/ui, 5.7.0) to @hanzo/ui-shadcn so the
gui-based unified library can carry the @hanzo/ui name forward at v8. Code is
untouched — only the package name changes; the published @hanzo/ui@5.7.1 stays
on npm for external ^5.x consumers.
Internal workspace consumers keep resolving the shadcn line with ZERO source
edits via workspace aliases (@hanzo/ui → @hanzo/ui-shadcn):
- app (@hanzo/ui-web): dependency workspace alias
- commerce: devDependency workspace alias (source imports @hanzo/ui/*),
peer stays @hanzo/ui>=5.0.0 for external consumers
- checkout, agent-ui: peer ranges unchanged (no source imports)
Proven: app + commerce node_modules/@hanzo/ui resolve to @hanzo/ui-shadcn@5.7.0.
Drive-by (unblocks workspace install/CI): pkgs/data pinned the now-unpublished
@hanzogui/config@7.2.2 — patch-forward to 7.3.0 (published latest, same major,
matches pkg/ui).
The one cross-platform, presentational, host-agnostic, clean-room component
library. Product/app layer (charts, metrics, page headers, status tags, empty
states, combobox, slide-over, toasts, drag-reorder, field rows, marks) at
'@hanzo/ui'; metadata-driven record layer composed from @hanzo/data at
'@hanzo/ui/data'; calm dark-first tokens + motion vocabulary. Web + native + desktop.
Retires the shadcn @hanzo/ui (5.x) → @hanzo/ui-shadcn; this gui-based line
carries the name forward at 8.0.0. tsc --noEmit clean, vitest 12/12.
Manifest: CONSOLIDATION.md.
- Typography: fontSans -> Basel Grotesk via next/font/local (self-hosted,
Book 400 + Medium 500, --font-basel-sans); keep fontMono = Geist Mono.
Point both tailwind configs' sans at var(--font-basel-sans). Basel replaces
Geist Sans as the default; DM Sans/Figtree/Inter stay optional .theme-*
variants only, never defaults.
- DESIGN.md: the single source of truth for the shared Hanzo look — canonical
typography (Basel + Geist Mono), the sidebar toggle icon (lucide PanelLeft),
sidebar/panel specs (16rem width, border-border, monochrome hover/active),
and the true-black dark palette (#000 canvas / #0a0a0a surface / white-10
borders / #ededf1 text).
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The @hanzo/products snapshot (the shared-registry fallback + commerce seed + the
source docs' gen-services-nav derives from) had drifted behind the canonical console
registry (hanzoai/console src/lib/products/registry.tsx). Ten customer products that
shipped in recent console waves were absent from the snapshot, so docs coverage +
the derived services nav under-counted the real product set.
Purely additive — the existing 92 rows are byte-identical; ten rows appended, each
at the end of its category run (diff is insertions only):
Observe: open-edition, analytics Data: records Platform: apps
Apps: crm, cms, erp, helpdesk, accessibility, templates
Fields derived to match the existing snapshot shape + the package maps:
brandColor = defaultColorKey(id) (curated pin or FNV-1a hash), iconKey = the
registry icon component, slug=id, route=/id, docsUrl=/docs/services/<id>,
apiPath /v1-prefixed, brands derived from category. All package invariants hold
(icon-drift guard over the 1760-icon vocab, swatch keys, 10 canonical categories,
/v1 apiPaths, unique slug==id). Count assertion + doc-comment 92 -> 102.
vitest 90/90, tsc --noEmit clean.
The single source of truth for the Hanzo product taxonomy/icons/colors that
console, docs, site, and pricing all derive from — committed on the CTO-locked
10-category cut so every surface groups by ONE axis.
CATEGORY_ORDER (13 -> 10): AI · Compute · Data · Network · Security · Observe ·
Platform · Web3 · Apps · Commerce. The three cuts:
- Training -> AI (finetuning, kubeflow — AI training)
- Dev -> Platform (cli, sdks, api, integrations, ide, desktop, api-keys —
the platform's developer surface)
- Settings -> removed (settings/team/profile are account/avatar-menu items,
not products — dropped from the catalog grid)
Snapshot: 92 products (95 - 3 dropped); every row's brands[] re-derived from
category (never hand-authored — the drift-killer). Sovereign brand scope
(lux/zoo/pars) follows the merge: Web3 · Network · Security · Platform, so the
chains keep CLI/SDKs/API keys; account settings move to the avatar menu.
types/categories/brands/docs/snapshot + LLM.md updated; tests assert the new
canonical set (CATEGORY_ORDER.length === 10, none of Training/Dev/Settings
remain, sovereign+hanzo-only scopes partition the 10). 90 tests green,
tsc --noEmit clean, tsup build OK.
The @hanzo/data field registry had Displays for all 24 types but Inputs for only
~15 — records were read-mostly. Fill the gaps so a Base record is FULLY editable
in table/detail (the CRM/CMS foundation):
- RelationInput — single/to-many record picker over host-injected candidate
options (metadata.options), falls back to raw-id entry when none injected.
- FilesInput / LinksInput — add/remove chip lists.
- JsonInput — parses on change, keeps text on invalid so typing isn't lost.
- FullNameInput (first/last) + AddressInput (street/city/state/zip) — composite
sub-field editors.
- relation metadata gains options + maxSelect; files gains accept + maxSelect.
Only the true system types (uuid/position/actor) stay display-only. Built on the
same @hanzo/gui primitives + FieldInputProps as the existing inputs (cross-
platform, shorthand style). registry.test.ts asserts every non-system type now
has an Input (mocking @hanzo/gui). 11/11 tests pass, tsc clean.
Co-authored-by: z <z@zeekay.io>
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The @hanzo/data field registry had Displays for all 24 types but Inputs for only
~15 — records were read-mostly. Fill the gaps so a Base record is FULLY editable
in table/detail (the CRM/CMS foundation):
- RelationInput — single/to-many record picker over host-injected candidate
options (metadata.options), falls back to raw-id entry when none injected.
- FilesInput / LinksInput — add/remove chip lists.
- JsonInput — parses on change, keeps text on invalid so typing isn't lost.
- FullNameInput (first/last) + AddressInput (street/city/state/zip) — composite
sub-field editors.
- relation metadata gains options + maxSelect; files gains accept + maxSelect.
Only the true system types (uuid/position/actor) stay display-only. Built on the
same @hanzo/gui primitives + FieldInputProps as the existing inputs (cross-
platform, shorthand style). registry.test.ts asserts every non-system type now
has an Input (mocking @hanzo/gui). 11/11 tests pass, tsc clean.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
Typed field system (26 types) → record table / card / detail, on @hanzo/gui
(web + native + desktop), shorthand style props, zero Tailwind. The universal
object/field/record/view core for any Base-backed CRM, CMS, or commerce app.
Registry-dispatched (add a type = one registerField call). Ships TS source
(zero-build internal package). tsc --noEmit clean against @hanzo/gui 7.2.2.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The repo-level NPM_AUTH_TOKEN (2026-03-29) shadowed the org token and was
expired → 'npm error 401 Unauthorized' on every tag publish. Converge on the
org-level NPM_TOKEN (2026-06-18, the one @hanzo/iam published 0.13.0 with).
One token, one way.
@hanzo/ui becomes the PRESENTATION layer over @hanzo/iam's mechanism. Atomic,
composable, knows nothing of token exchange — it just starts a login per method.
- <SignIn providers={[...]}> composes <PasswordForm> + one <SocialButton> per
provider + <Web3Connect>. providers is the ONLY app-level knob.
- <SocialButton provider> delegates to startIamLogin with the provider knob
(rides as &provider on /v1/iam/oauth/authorize); apps never register per-app
Google/GitHub clients. Composition escape hatch: inject onLogin (e.g. the
@hanzo/iam SDK's startLogin) so @hanzo/ui stays dependency-light.
- buildIamAuthorizeUrl adds the provider knob to iam.ts, mirroring the SDK.
- IAMLoginButton de-hexed: brand via CSS tokens (bg-primary, border-input, …),
not literals. Every atom is monochrome/brand-neutral by construction.
- demo/sign-in-demo.tsx: the CONFIGURATION layer — zero auth code, wires
<SignIn> to the @hanzo/iam SDK (startLogin + loginWithPassword).
- auth.test.tsx (10 cases, vitest+happy-dom): authorize URL carries PKCE-S256 +
provider hint for google/github/web3, no /api/; <SignIn> renders a method per
provider; rendered markup has zero hex (brand-neutral); <SocialButton>
delegates to the injected starter with the provider knob.
- declare happy-dom (vitest env, was referenced but undeclared).
Co-authored-by: zeekay <z@zeekay.io>
The zero-dep auth components hand-rolled the OAuth authorize URL against the
legacy '/login/oauth/authorize' path WITHOUT PKCE, and the shell hook fetched
userinfo from '/api/userinfo'. Both violate HIP-0111 (canonical paths are
'/v1/iam/oauth/*'; PKCE S256 is always required).
- new auth/iam.ts: one canonical helper (IAM_OIDC_PATHS mirroring @hanzo/iam's
OIDC_PATHS; startIamLogin() does authorization-code + PKCE-S256 to
/v1/iam/oauth/authorize). One way to start a login.
- IAMLoginButton + AuthGuard: route through startIamLogin() instead of
hand-rolling a PKCE-less authorize URL on the legacy path.
- useHanzoAuth: /api/userinfo -> /v1/iam/oauth/userinfo.
@hanzo/ui stays dependency-light, so iam.ts mirrors the SDK's path contract
byte-for-byte rather than pulling in @hanzo/iam; identical endpoints, PKCE on.
Co-authored-by: z <z@zeekay.io>
The mod-key glyph was computed during render via isMacOS() (window.navigator),
so the static-export SSR produced 'Ctrl' while the macOS client hydrated '⌘' on
the same <span>, tripping React error #418 (hydration text mismatch) on every
page (CommandMenu is in the global SiteHeader).
Start modKey from the SSR-stable 'Ctrl' and upgrade to the platform glyph in a
client-only mount effect, so SSR and first hydration render agree. Verified via
CDP: pre-fix decoder showed args[]=text with the exact Ctrl->⌘ text node.
Co-authored-by: Hanzo CTO <ai@hanzo.ai>
* refactor: decouple @hanzo/ui from hanzogui
Make @hanzo/ui shadcn-only — no hanzogui/Tamagui coupling.
- remove primitives/bases (gui/admin/svelte/vue) re-exports
- drop @hanzogui peerDependencies + peerDependenciesMeta entries
- add check-no-hanzogui guard, wired into build
- fix latent NodeJS.Timeout types to keep the build green
* refactor: remove duplicate @hanzo/brand from the monorepo
@hanzo/brand is owned by the standalone hanzoai/brand (the npm-canonical
source); this monorepo's copy was unused and had drifted.
- delete pkg/brand
- add check-no-brand-pkg guard (wired into `check`) so it can't reappear
* refactor(ui): stop importing from the app; use own cn util
pkg/ui pulled `cn` from @/lib/utils (../../app) — an inverted dependency on
the consuming app. Point the animation components at pkg/ui's own cn and
drop the @/app, @/registry, @/lib tsconfig path aliases.
* fix(ui): type errors; stop tracking the root lockfile
- ModelCard: lucide-react dropped the Github icon → use Code
- drawer: annotate DrawerTrigger/DrawerClose (radix type portability)
- untrack root pnpm-lock.yaml; CI → --no-frozen-lockfile
* release: bump @hanzo/ui to 5.7.0
* refactor: rename pkg/ → pkgs/, merge packages/ into it
standardize on 'pkgs/': move pkg/* and packages/* into pkgs/.
Update workspace globs, CI, scripts, and config references accordingly.
The TypeScript counterpart of github.com/hanzoai/go-sdk/metering — the one
way every Hanzo product meters usage to commerce (the billing source of
truth) so everything can be paid for, not just the LLM/cloud path. Shares
an identical wire contract with the Go client.
- Metering class composes the existing Commerce client (no HTTP dup):
authorize() pre-request balance gate (fail-closed by default; 402 vs 503),
record() post-request usage write. tierAware gates on effectiveAvailable
(prepaid + included plan allotment).
- S2S auth: Authorization: Bearer COMMERCE_SERVICE_TOKEN (KMS-sourced) +
X-IAM-Org-Id. Metering.fromEnv() for canonical env wiring.
- identityFromHeaders(): reads gateway-minted X-User-Id/X-Org-Id.
- client.ts: getTier() + custom-headers support on request/getBalance/
addUsageRecord (DRY enablers for the S2S org header).
- 14 contract tests (mock fetch) mirroring the Go suite; isolated tsc clean.
- exports: ./metering ; index re-exports ; version 7.6.1 -> 7.6.2.
Refs universe task #28.
Co-authored-by: Antje Worring <worringantje@gmail.com>
The Hanzo cross-app console (the shared header / app switcher rendered by
@hanzo/ui across console, platform, billing, chat, etc.) is driven by a
single canonical registry in navigation/hanzo-shell/types.ts. The
bootnode-powered chain orchestration surface at web3.hanzo.ai was live but
absent from that registry, so it never appeared in the switcher.
Add "Web3" as an Infrastructure-category app, threaded through every
structure that enumerates the registry so the list stays orthogonal:
- DEFAULT_HANZO_APPS: the static hanzo.ai default list.
- OrgDomains type + all four ORG_DOMAINS maps (hanzo, lux, zoo, pars):
white-label by org domain — web3.hanzo.ai / web3.lux.network /
web3.zoo.ngo / web3.pars.network.
- getAppsForOrg(): the org-aware URL builder.
- AppSwitcher APP_GROUPS: place "web3" in the Infrastructure section
(between cloud and storage) so it renders grouped, not under "Other".
No icon is set — the switcher renders label + description only; every
existing entry is icon-less, so this matches the one established pattern.
Description: "Deploy & manage blockchain validators across Bitcoin,
Ethereum, Solana, Lux, and any Lux-derived L1".
Co-authored-by: zeekay <z@zeekay.io>
Reverts violations of the durable rule that current-state docs belong
in LLM.md and history belongs in git log. Removed files were session
handoffs, agent-style "complete success" / "1000%" reports, dated
audit dumps, and stub NOTES.
sync-forks.yml.disabled and market-overview-alt.mdx.disabled are fossilized
copies left over from earlier work. Stale .disabled files in a tracked tree
are dead code that lives forever; either re-enable or delete.
Brand policy: do not reference Tamagui by name on disk. The product is
@hanzo/gui v7 (Hanzo GUI). Internal workspace umbrella is `hanzogui`
(lowercase). Source code imports `from 'hanzogui'`. NPM publish:
@hanzo/gui.
This commit replaces "Tamagui v7" → "Hanzo GUI v7" / "@hanzo/gui v7"
in pkg/ui/BASES.md and pkg/ui/src/primitives/bases/{gui,svelte,vue}/
header docstrings + placeholder error messages.
Brand policy: do not reference Tamagui by name on disk. The product is
@hanzo/gui v7 (Hanzo GUI). Internal workspace umbrella is `hanzogui`
(lowercase). Source code imports `from 'hanzogui'`. NPM publish:
@hanzo/gui.
This commit replaces "Tamagui v7" → "Hanzo GUI v7" / "@hanzo/gui v7"
in pkg/ui/BASES.md and pkg/ui/src/primitives/bases/{gui,svelte,vue}/
header docstrings + placeholder error messages.
Add framework-base re-exports under @hanzo/ui/primitives/bases/* so
consumers can swap framework backends without changing imports:
- bases/admin → @hanzogui/admin (Tamagui v7 admin chrome, canonical)
- bases/gui → hanzogui (Tamagui v7 primitives umbrella)
- bases/svelte → throws (placeholder until Svelte port lands)
- bases/vue → throws (placeholder until Vue port lands)
Source-of-truth files stay in ~/work/hanzo/gui/ — this package only
re-exports. Component names are identical across bases by contract,
so swapping a base is a one-line import change in consumer code.
Adds @hanzogui/admin, @hanzogui/lucide-icons-2, hanzogui as optional
peer deps. See pkg/ui/BASES.md for the full doc.
Add framework-base re-exports under @hanzo/ui/primitives/bases/* so
consumers can swap framework backends without changing imports:
- bases/admin → @hanzogui/admin (Tamagui v7 admin chrome, canonical)
- bases/gui → hanzogui (Tamagui v7 primitives umbrella)
- bases/svelte → throws (placeholder until Svelte port lands)
- bases/vue → throws (placeholder until Vue port lands)
Source-of-truth files stay in ~/work/hanzo/gui/ — this package only
re-exports. Component names are identical across bases by contract,
so swapping a base is a one-line import change in consumer code.
Adds @hanzogui/admin, @hanzogui/lucide-icons-2, hanzogui as optional
peer deps. See pkg/ui/BASES.md for the full doc.
@hanzo/brand was a cross-org registry (hanzo + lux + zoo + pars all
bundled). Brand belongs per-org:
Zoo → @zooai/brand (github.com/zooai/brand)
Lux → @luxfi/brand (github.com/luxfi/brand)
Liquidity → @partner/brand (github.com/partner/brand)
Delete lux/zoo/pars blocks from orgs.ts, narrow OrgId to 'hanzo',
narrow index.ts exports. 200-line reduction.
No callers broken — nothing in ~/work/{hanzo,lux,zoo,liquidity}
imports @hanzo/ui/brand currently (verified via grep). This is
dead cross-org code being removed.
@hanzo/brand was a cross-org registry (hanzo + lux + zoo + pars all
bundled). Brand belongs per-org:
Zoo → @zooai/brand (github.com/zooai/brand)
Lux → @luxfi/brand (github.com/luxfi/brand)
Delete lux/zoo/pars blocks from orgs.ts, narrow OrgId to 'hanzo',
narrow index.ts exports. 200-line reduction.
No callers broken — nothing in ~/work/{hanzo,lux,zoo}
imports @hanzo/ui/brand currently (verified via grep). This is
dead cross-org code being removed.
pkg/gui/ was a Tamagui subtree living in hanzoai/ui — the 57
@hanzogui/* components (button, card, dialog, popover, switch, and
the supporting primitives) belong alongside the rest of the
@hanzogui/* engine in hanzoai/gui, not here. History for these
packages was preserved via git filter-repo.
- Deleted pkg/gui/ (57 packages, 744 files)
- Removed "pkg/gui/*" entry from pnpm-workspace.yaml
- Deleted scripts/publish-gui.ts — legacy ad-hoc publisher
hardcoded to pkg/gui and an ancient version string
- Narrowed .github/workflows/publish.yml from "@hanzo/*|@hanzogui/*"
to "@hanzo/*" so this repo no longer tries to publish Tamagui
components
- Removed stale "gui/ GUI component packages (@hanzogui/*)" line
from LLM.md
Replace the server-side CardForm (which calls /card/tokenize and gets
503 due to PCI compliance) with SquareCardForm which uses the Square
Web Payments SDK for client-side card tokenization.
The Square sourceId token is passed as _sourceToken on the PaymentMethod
object so consuming apps can send it to commerce's payment-methods
endpoint for real $1 pre-auth card verification.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The chat API route (app/api/chat/route.ts) imports @ai-sdk/openai-compatible
and ai but neither was declared in app/package.json. Also skip puppeteer
Chrome download in .npmrc since it's only used for optional screenshot
capture and its postinstall failure breaks pnpm install in CI.
- /api/chat: streaming RAG chat about UI components (zen-coder-flash)
- /api/search: proxy to Hanzo Cloud search-docs with publishable key
- lib/search.ts: search config (cloud backend, pk-hanzo-ui-search-2026)
Same pattern as docs.hanzo.ai AI search. Users can chat on the site
and ask questions about components.
Changed imports from v4 names (Group, Separator) to v3 names
(PanelGroup, PanelResizeHandle) to fix build errors in consumers
using react-resizable-panels v3. Updated peer dep to ^3.0.0.
Bump @hanzo/ui to 5.5.1.
Co-authored-by: Hanzo Dev <dev@hanzo.ai>
The gui-* packages were imported from hanzo/gui but 34 underlying
utility/core packages (gui-build, gui-core, gui-helpers, gui-web, etc.)
were not included in the workspace. Changed their workspace:* refs to
the published 2.0.0-rc.29 versions so pnpm can resolve from registry.
<textx="378"y="322"font-family="Inter,system-ui,sans-serif"font-size="30"fill="#ffffff"opacity=".66">React component library for AI applications</text>
# This runs every day 20 minutes before midnight: https://crontab.guru/#40_23_*_*_*
- cron:"40 23 * * *"
jobs:
stale:
runs-on:ubuntu-latest
if:github.repository_owner == 'shadcn-ui'
steps:
- uses:actions/stale@v9
id:issue-stale
name:"Mark stale issues, close stale issues"
with:
repo-token:${{ secrets.STALE_TOKEN }}
ascending:true
days-before-issue-close:7
days-before-issue-stale:365
days-before-pr-stale:-1
days-before-pr-close:-1
remove-issue-stale-when-updated:true
stale-issue-label:"stale?"
exempt-issue-labels:"roadmap,next"
stale-issue-message:"This issue has been automatically marked as stale due to one year of inactivity. It will be closed in 7 days unless there’s further input. If you believe this issue is still relevant, please leave a comment or provide updated details. Thank you. (This is an automated message)"
close-issue-message:"This issue has been automatically closed due to one year of inactivity. If you’re still experiencing a similar problem or have additional details to share, please open a new issue following our current issue template. Your updated report helps us investigate and address concerns more efficiently. Thank you for your understanding! (This is an automated message)"
operations-per-run:300
- uses:actions/stale@v9
id:pr-state
name:"Mark stale PRs, close stale PRs"
with:
repo-token:${{ secrets.STALE_TOKEN }}
ascending:true
days-before-issue-close:-1
days-before-issue-stale:-1
days-before-pr-close:7
days-before-pr-stale:365
remove-pr-stale-when-updated:true
exempt-pr-labels:"roadmap,next,bug"
stale-pr-label:"stale?"
stale-pr-message:"This PR has been automatically marked as stale due to one year of inactivity. It will be closed in 7 days unless there’s further input. If you believe this PR is still relevant, please leave a comment or provide updated details. Thank you. (This is an automated message)"
close-pr-message:"This PR has been automatically closed due to one year of inactivity. Thank you for your understanding! (This is an automated message)"
name:npm-package-hanzoai-ui@${{ steps.package-version.outputs.current-version }}-pr-${{ github.event.number }}# encode the PR number into the artifact name
# Hanzo UI Consolidation — one library, all polish, no duplication
**Goal.** RIP the fragmentation (`@hanzo/data` vs `@hanzo/ui` vs in-console duplicates) into ONE canonical, cross-platform, presentational, clean-room library: **`@hanzo/ui`, built on `@hanzo/gui`**. Preserve every polished component + token; zero loss; no fork.
**Status.**
- **Step 1 — Audit:** complete (this document; four source trees read file-by-file).
- **Step 2 — Establish `@hanzo/ui` + migrate the stable foundation:** **DONE & GREEN** (`pkg/ui` is now a real package; `tsc --noEmit` = 0 errors, `vitest` = 12/12).
- **Step 3 — Console re-point:** **STAGED, not merged.** Gate is split (backend live, app lanes in-flight) — see [Step 3](#step-3--console-re-point-staged).
**One decision needs CTO sign-off before publish** — see [Naming / version](#naming--version--the-one-decision).
@hanzo/data (pkg/data) the metadata-driven RECORD layer: fields → records → views
│ (RecordsView, DataTable, BoardView, RecordDetail, field editors)
▼
@hanzo/ui (pkg/ui) ◄──── THE ONE LIBRARY. Two orthogonal concerns, one package:
• product/app layer → import { … } from '@hanzo/ui'
• record layer → import { … } from '@hanzo/ui/data' (re-exports @hanzo/data)
```
`@hanzo/data` stays the **source of truth** for the record layer; `@hanzo/ui`**composes** it (`export * from '@hanzo/data'` on the `./data` subpath) rather than copying — so the CMS/ERP/Help app lanes that consume `@hanzo/data` today keep working untouched, and there is exactly one home. This mirrors how the gui base wraps `hanzogui`.
Both layers own a `DataTable` (product = generic typed `<T>` list; data = field-driven record grid). Keeping the record layer on the `./data` subpath keeps each name unambiguous — no rename, no collision.
---
## The preserve-and-merge manifest
Legend: **✅ migrated** (in `pkg/ui`, GREEN) · **↪ re-exported** (composed from `@hanzo/data`) · **⏳ staged** (Step 3, after app lanes land) · **🔧 pending prop-injection** (app-coupled; decouple before it can live in a presentational lib) · **🏠 stays in console** (app glue, not a UI component).
### A. Record layer — `@hanzo/data` → `@hanzo/ui/data` ↪
Source: `pkg/data/src/*` (v1.2.0, clean-room, already published). Surfaced through `@hanzo/ui/data` and `@hanzo/ui/primitives/bases/data`. Nothing re-implemented.
The brief's premise (`globals.css``t_dark`/`t_light` token blocks) is **corrected**: `t_dark`/`t_light` are `@hanzo/gui` (Tamagui) theme **class names**; the calm values live in three real places, all preserved:
| OKLCH shadcn-compatible palette (soft-charcoal `oklch(0.145 0 0)`, `--radius: 0.5rem`, indigo sidebar accent) | `pkgs/ui/style/hanzo-default-colors.css`, `@hanzo/tokens` | unchanged (legacy shadcn line); the gui line uses the hex tokens above |
| **Motion vocabulary** — `fade-up` (FadeIn), `collapse`/`slide`/`fade` (shell/drawer), `drag`, `skeleton`/`pulse`/`row-in`; all `prefers-reduced-motion`-guarded | `console2/app/globals.css` (motion section) | **`@hanzo/ui/styles/motion.css`** (verbatim) — `import '@hanzo/ui/styles/motion.css'` once at app root |
### D. Generic DocType renderer → `@hanzo/ui` ⏳ (Step 3, FINAL — active lane)
Source: `console2/src/components/doctype/*`. **Actively edited by the CMS/ERP/Help lanes (untracked).** Dependency-**injected** (`client: FrameworkClient` prop) — not `~/lib/api`-coupled — so the real move-blockers are `~/lib/framework/{types,fields}` + the `ui/*` primitives (now in `@hanzo/ui`) + `@hanzo/data` (now `@hanzo/ui/data`).
### E. LivingOverview → `@hanzo/ui` ⏳ (Step 3 — active lane)
Source: `console2/src/components/products/overview/living/*` (untracked/modified). Pure/presentational parts portable; app-glue concentrated in `registry.ts` (live API clients).
| Part | Class | Step-3 disposition |
|---|---|---|
| `motion.ts`, `hooks.ts`, `logic.ts`, `config.ts` (types) | pure | → `@hanzo/ui` (unit-tested; count-up, poll clock, unit formatting) |
| `tiles.tsx`, `LivingOverview.tsx` | presentational (reuse `ui/Charts` verbatim) | → `@hanzo/ui` (once `config.ts`'s one `~/lib/products/registry``ProductIcon` type is swapped for `@hanzo/ui`'s `IconLike`) |
| `adapters.ts`, `registry.ts` | glue (map REAL `/v1` sources → `OverviewData`) | **stay in console** |
### F. Framework / Base-data libs → stay in console 🏠
`src/lib/framework/*` (DocType wire contract + `FrameworkApi` client + pure `fields.ts` mapper to `@hanzo/data`) and `src/lib/base-data/*` (Base REST client + schema→field mapper) are **app data-access glue**, not UI. They stay in the console. Their pure mappers (`docTypeToFields`, `baseCollectionToFields`) could later publish as a small `@hanzo/base-data` adapter, but they are not UI components and are out of scope for `@hanzo/ui`.
### G. App-coupled console components → 🔧 pending prop-injection (NOT yet in the lib)
These import app `~/lib`/session/router/branding and must be made presentational (inject props) before they belong in a host-agnostic lib. Kept in console for now; the injection contract is specified so the eventual lift is mechanical.
| Component | Coupling | Inject to lift |
|---|---|---|
| `BackendStateCard` (`BackendState.tsx`) | `~/lib/api``ApiError` | accept a numeric `status` (or shared error shape) instead of `ApiError` |
| `BrandLogo` | session + live IAM `organization()` + `~/config` + branding | `orgName`, `logoUrl` (or a `loadOrgLogo` loader), brand mark/name as props |
- **One decouple fix:** `product/EmptyState.tsx` no longer imports `~/lib/products/registry`; it uses the local `IconLike` type — the last host coupling in the product tree is gone.
**Green:**`tsc --noEmit` = 0 errors (strict); `vitest run` = 12/12 (`combobox/filter`, `Reorder`). Every product component is host-agnostic (imports only `react`, `@hanzo/gui`, `@hanzogui/*`, `@hanzo/data`, relative).
## Clean-room guarantee (preserved)
`pkg/data` audited for GPL/Twenty contamination: **none.** No GPL, no copied license headers/SPDX, no Twenty entity/decorator architecture. The field/record model is an independent `FieldType` union + `FieldDefinition` + runtime `Map` registry (records are plain `Record<string, unknown>`). "Twenty" appears **only as benchmark prose** ("Airtable/Twenty-class polish, clean-room"). License: MIT (repo `LICENSE.md`). `@hanzo/ui` inherits the same posture.
---
## Naming / version — DECIDED: `@hanzo/ui@8`, shadcn retired to `@hanzo/ui-shadcn`
**Decision:** the gui-based unified library takes the `@hanzo/ui` name **forward at `8.0.0`** (aligning with the "Hanzo Cloud 8.x" umbrella; major = breaking re-platform). The legacy shadcn/Radix line (`pkgs/ui`, v5.7.0) is **retired by renaming** to `@hanzo/ui-shadcn` (never hard-deleted) — it stays fully alive under the new name, freeing `@hanzo/ui` for v8. Precedent: `pkg/data@1.2.0` already superseded `pkgs/data@1.1.0` under the same name.
This is **DONE (repo-local):**`pkg/ui/package.json` is `@hanzo/ui@8.0.0`, GREEN. The rest is a coordinated, **sequenced** retire — because publishing `@hanzo/ui@8` (a different, gui-based API with no shadcn `Button/Card/Dialog`) under the name ~20 repos consume for shadcn primitives will BREAK any consumer that resolves to `@8`. So order matters:
**Blast radius (measured across `~/work/hanzo`).** Declared deps on `@hanzo/ui` in ~20 repos. Most pin `^5.x` (semver-safe from an `@8` bump): paas, chat, platform, app, hanzo.ai, o11y, docs, mdx, hanzobot, ui-repo `pkgs/checkout``^5.3`, `pkgs/agent-ui``^5.0`. **Would break on `@8`:**`hanzoai/identity/app` (`"latest"`), ui-repo `pkgs/commerce` (`>=5.0.0`); `app/` uses `workspace:^`. The `ui.hanzo.ai` docs app + `pkgs/{commerce,checkout,agent-ui}` import the shadcn line internally.
**Publish reality.**`.github/workflows/publish-on-tag.yml` publishes **`pkgs/ui`** (the shadcn line) as `@hanzo/ui` on a `v*` tag — it does not reference `pkg/ui`. So a tag push today publishes shadcn, not v8. Publishing v8 needs the workflow rewired to build/publish `pkg/ui`. `npm` is not authed locally (`npm whoami` empty) — per house rules, publish goes through **CI (self-hosted runners, canonical org `NPM_TOKEN`)**, not a local `npm publish`.
**Safe sequence to fully land v8 (each step reversible until the tag push):**
1. ✅ `pkg/ui` = `@hanzo/ui@8.0.0`, GREEN (done, committed to a branch).
2. Rename `pkgs/ui` name → `@hanzo/ui-shadcn`; update the internal ui-repo consumers (`app/`, `pkgs/{commerce,checkout,agent-ui}`) + `check-no-hanzogui`/registry scripts that reference it.
3. Migrate external consumers off `@hanzo/ui`→`@hanzo/ui-shadcn` (start with the break-risk ones: `identity``latest`, `commerce``>=5`; the `^5` pins are safe to migrate at leisure). ~20 repos — do as a tracked sweep or flag per-repo.
4. Rewire `publish-on-tag.yml` (and `release.yml`) to build + publish `pkg/ui` as `@hanzo/ui@8`, and `pkgs/ui-shadcn` as `@hanzo/ui-shadcn`.
5.`npm deprecate '@hanzo/ui@<8' 'moved to @hanzo/ui-shadcn; @hanzo/ui@8+ is the @hanzo/gui-based unified lib'`.
6. Tag `v8.0.0` → CI publishes `@hanzo/ui@8.0.0`. Verify `npm view @hanzo/ui@8.0.0`.
**Gated on the user's direct go-ahead** (irreversible / globally-visible / ecosystem-wide): steps 2–6 — the `pkgs/ui` rename, the ~20-repo consumer sweep, the CI rewire, `npm deprecate`, and the `v8.0.0` tag push that triggers publish. These were not executed autonomously.
---
## Step 3 — console re-point (STAGED)
**Gate (per the brief):** cloud `/v1/framework/modules` live **AND** console CMS/ERP/Help native.
- ✅ Backend: `/v1/framework/modules[/:module[/install]]` is **implemented + wired** (`cloud/clients/framework/framework.go:71-73`, HIP-0106 order 129, bound in `subsystems.go:130`, real tests).
- ⏳ Console: `CmsModule.tsx`, `ErpModule.tsx`, `HelpModule.tsx`, `components/doctype/` are **untracked/in-flight** on `feat/console-native-cms`.
→ Gate is **split**, so the re-point is **staged, not applied.** I deliberately did **not** touch `console2`'s working tree (it holds the lanes' uncommitted work — editing it would collide and risk loss, the opposite of the goal).
**Ready-to-apply re-point (mechanical, once the lanes land + merge):**
1.`console2` deps: keep `@hanzo/gui`, `@hanzo/data`; add `@hanzo/ui` (`^6.0.0`). (`@hanzo/data` may stay as a direct dep or be dropped in favor of `@hanzo/ui/data` — both resolve to the same source.)
-`app/globals.css` motion block → `import '@hanzo/ui/styles/motion.css'` (keep base resets local).
- Move the 5 app-coupled components (§G) into the lib only after applying their inject-props contract; until then they stay local.
3. Verify **identical render**: `tsc --noEmit` + `vitest` + `next build` green, then headless-Playwright the live pages pixel-same (the polish is byte-identical, so parity is expected).
**Report:**`@hanzo/ui` is the ONE unified library — product layer + record layer (`@hanzo/data`) + charts + calm tokens + motion, all on `@hanzo/gui`, presentational, cross-platform, clean-room, GREEN. Console re-point is **ready to apply once the CMS/ERP/Help lanes land**; it was not merged to avoid colliding with that in-flight work.
## Follow-ups (semver-minor, with visual e2e)
- Collapse the preserved Sparkline/Donut variants to one each (`MetricSparkline`→`Sparkline`, `DonutRing`→`Donut`) once call-sites are proven identical.
- Lift §G's five components after applying their prop-injection contracts.
- Consider publishing the pure `framework`/`base-data` mappers as a small `@hanzo/base-data` adapter (not UI).
Thanks for your interest in contributing to ui.hanzo.com. We're happy to have you here.
Thanks for your interest in contributing to ui.shadcn.com. We're happy to have you here.
Please take a moment to review this document before submitting your first pull request. We also strongly recommend that you check for open issues and pull requests to see if someone else is working on something similar.
If you need any help, feel free to reach out to [@hanzo](https://x.com/hanzoai).
If you need any help, feel free to reach out to [@shadcn](https://twitter.com/shadcn).
## About this repository
@@ -12,7 +12,9 @@ This repository is a monorepo.
- We use [pnpm](https://pnpm.io) and [`workspaces`](https://pnpm.io/workspaces) for development.
- We use [Turborepo](https://turbo.build/repo) as our build system.
-We use [changesets](https://github.com/changesets/changesets) for managing releases.
-Releases are semver-driven: bump a package's `version` in its `package.json` and
merge to `main`. CI (`.github/workflows/publish.yml`) detects the version change
and publishes that package to npm. One step, one source of truth.
## Structure
@@ -20,28 +22,25 @@ This repository is structured as follows:
This workflow ensures that you are running the most recent version of the registry and testing the CLI properly in your local environment.
## Documentation
The documentation for this project is located in the `www` workspace. You can run the documentation locally by running the following command:
The documentation for this project is located in the `v4` workspace. You can run the documentation locally by running the following command:
```bash
pnpm --filter=www dev
pnpm --filter=v4 dev
```
Documentation is written using [MDX](https://mdxjs.com). You can find the documentation files in the `apps/www/content/docs` directory.
Documentation is written using [MDX](https://mdxjs.com). You can find the documentation files in the `apps/v4/content/docs` directory.
## Components
We use a registry system for developing components. You can find the source code for the components under `apps/www/registry`. The components are organized by styles.
We use a registry system for developing components. You can find the source code for the components under `apps/v4/registry`. The components are organized by styles.
```bash
apps
└── www
└── v4
└── registry
├── default
│ ├── example
│ └── ui
└── new-york
└── new-york-v4
├── example
└── ui
```
@@ -157,7 +141,7 @@ When adding or modifying components, please ensure that:
1. You make the changes for every style.
2. You update the documentation.
3. You run `pnpm build:registry` to update the registry.
3. You run `pnpm registry:build` to update the registry.
## Commit Convention
@@ -196,9 +180,9 @@ If you have a request for a new component, please open a discussion on GitHub. W
## CLI
The `hanzo-ui` package is a CLI for adding components to your project. You can find the documentation for the CLI [here](https://ui.hanzo.com/docs/cli).
The `shadcn` package is a CLI for adding components to your project. You can find the documentation for the CLI [here](https://ui.shadcn.com/docs/cli).
Any changes to the CLI should be made in the `packages/cli` directory. If you can, it would be great if you could add tests for your changes.
Any changes to the CLI should be made in the `packages/shadcn` directory. If you can, it would be great if you could add tests for your changes.
`<Hanzo>` imports it. Styles gui generates at RUNTIME for props we could not
know at publish time still reach the document through `insertStyleRules`;
the shipped sheet is what makes the FIRST paint and every SSR/static render
correct.
2.**The config.**`<Hanzo>` passes `config` from `gui-config.ts` to
`GuiProvider` — as a VALUE, never a bare `import './gui-config'`. Vite 8
(rolldown) ignores package.json `sideEffects` ARRAYS outright: with any array
the registration is dropped and the first render dies on "Missing hanzogui
config"; only `sideEffects: true` keeps it, and that costs +63% bundle
(404 KB → 661 KB measured). Correctness does not live in bundler metadata.
3.**The theme.** gui throws `Missing theme.` for any component with no root
theme context, so a root is structurally required — there is no version of
this with no root at all. Forgetting `<Hanzo>` is therefore a hard crash on
first paint, never a silently unstyled page.
`theme.css` is dark-first at `:root` (it used to claim dark-first while shipping
LIGHT at `:root`, so an app that mounted the dark default and read `--background`
got white). `.light` retunes, and both answer to gui's own `.t_light`/`.t_dark`
that `<Hanzo>` stamps on the body — one theme, named the same by the CSS custom
properties and the component tokens.
### Three tests, one list of components
`src/gallery.tsx` is the specification of "what this package has to style", and
all three layers render THAT — a second copy of the list is how a component gets
styled by one and missed by another.
| Layer | Command | What it catches |
|---|---|---|
| `src/styles.test.tsx` | `pnpm test:unit` | every atomic class the gallery renders vs every class `dist/styles.css` defines a rule for. Not "the intersection is large" — TOTAL. Catches a stale sheet. |
| `src/backends/gui/render.test.tsx` | `pnpm test:unit` | the surface mounts under the real provider; a component that throws on first paint fails. |
| `test/consumer.spec.ts` | `pnpm test:consumer` | packs the tarball, installs it into a temp app OUTSIDE the repo (never a workspace link — that hides `files`/`exports`/`workspace:*` defects), builds, serves, and asserts COMPUTED styles + screenshots at 390 and 1280 in both themes. |
The consumer spec also fails on a solid-white border (the `@hanzo/design`
`border-card: var(--white…)` defect — borders are low-alpha hairlines) and on any
element that has a text child and a zero-height box.
### House rules for a component
- Style through gui props and theme tokens (`$background`, `$color12`,
`$borderColor`) — never a utility class string, never a hard-coded font.
- Touch targets meet the 44px floor via `hitSlop`, never via padding.
- Behaviour (focus, portalling, keyboard, a11y) comes from the matching
`@hanzogui/*` primitive; nothing reimplements it.
- Free-form text children go through `ink()`; `data-slot` markers through
| `hanzoai/analytics``packages/event` (`@hanzo/event@0.2.0`) | **deleted** | An unpublished FORK of this package in another repo. It was the only copy that could actually reach Sentry, while the published one here could not — the fleet's error telemetry died in that gap. Its envelope + scrub implementation was merged here in 0.3.2. Never fork this package again; it publishes from `pkgs/event` only. |
## Three-Layer Architecture
1.**Components** (`registry/{style}/ui/`) -- Single primitives (Button, Card, Dialog). CLI-installable.
2.**Examples** (`registry/{style}/example/`) -- Usage demos for docs via `<ComponentPreview />`.
Two lanes, one trigger each. No changesets, no version-PR bot.
All packages updated to support **React 19.2.0**:
## 1. `pkgs/*` — auto-publish on version bump (`publish.yml`)
-`@hanzo/ui` - v5.1.1
-`@hanzo/auth` - Latest
-`@hanzo/commerce` - Latest
-`@hanzo/brand` - Latest
-`@hanzo/react` - v1.0.0
Bump a package's `version` in `pkgs/<name>/package.json` and merge to `main`.
`.github/workflows/publish.yml` detects the changed public `@hanzo/*` package,
builds it, and publishes to npm (repo secret `NPM_TOKEN`). Patch bumps only
(`x.y.z` → `x.y.z+1`).
## Publishing Methods
## 2. `pkg/ui` — `@hanzo/ui@8`, the v8 lane (maintainer flow)
### 1. Automatic Publishing (Tag-based)
When you push a git tag starting with `v` (typically matching @hanzo/ui version), the workflow automatically checks all packages and publishes any with new versions:
`pkg/ui` (with `pkg/data`) is the modern cross-platform library on `@hanzo/gui`.
It publishes from the package directory (`prepack` builds the `types/`):
```bash
# Tag with @hanzo/ui version (workflow checks all packages)
git tag v5.1.1
git push origin v5.1.1
```
**What happens:**
1. Tests run (pkg/ui and pkg/react)
2. All 5 packages build
3.**Automatic version detection:**
- Checks each package's current version in package.json
- Queries npm to see if that version already exists
- Only publishes packages with new versions not on npm
4. GitHub release created (only if packages were published)
**Example workflow output:**
```
📦 Checking @hanzo/ui@5.1.1
⏭️ Already published - skipping
📦 Checking @hanzo/auth@2.5.5
🚀 Publishing to npm...
✅ Successfully published @hanzo/auth@2.5.5
📊 Publishing Summary
✅ Published: 1 package(s)
⏭️ Skipped: 4 package(s)
```
This approach means you:
- Only need to tag once (with @hanzo/ui version)
- Don't need to track which packages need publishing
- Can bump any package version and it auto-publishes on next tag
Accessible and customizable components for React, Vue, Svelte, and React Native. **Built on shadcn/ui with multi-framework support, 3D components, AI components, and advanced features.**
**The React component library for AI applications.**Accessible, customizable primitives for React, Vue, Svelte, and React Native — built on shadcn/ui, extended with AI, 3D, animation, and commerce components, and a single typed import surface.
@@ -6,4 +6,4 @@ We will investigate all legitimate reports and do our best to quickly fix the pr
Our preference is that you make use of GitHub's private vulnerability reporting feature to disclose potential security vulnerabilities in our Open Source Software.
To do this, please visit the security tab of the repository and click the "Report a vulnerability" button.
To do this, please visit the security tab of the repository and click the [Report a vulnerability](https://github.com/shadcn-ui/ui/security/advisories/new) button.
"description":"Hanzo CD — the dedicated deploy dashboard served at cd.hanzo.ai (a @hanzo/cd + @hanzo/canvas SPA over /v1/deploy). Replaces the ArgoCD UI fork.",
<h1>Continuous delivery for your whole fleet.</h1>
<pclass="sub">GitOps for every Hanzo App. Declarative, versioned, and auto-synced from git to your clusters — one control plane across hanzo, lux, zoo & pars.</p>
<ulclass="feat">
<li><spanclass="dot"></span><span><b>Live fleet view</b> — health & sync status for every App across all namespaces.</span></li>
<li><spanclass="dot"></span><span><b>Git-to-cluster</b> — desired state lives in <code>infra/k8s/operator/crs</code>, reconciled continuously.</span></li>
<li><spanclass="dot"></span><span><b>Sync & rollback</b> — one click to reconcile or roll back any application.</span></li>
<li><spanclass="dot"></span><span><b>Resource trees & logs</b> — drill into any workload the operator manages.</span></li>
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
zandhanzo-dev
aandhanzo-dev
zandhanzo-dev
