@active-reach/web-sdk 1.37.0 → 1.39.0

package/dist/{analytics-Qyzk8JaB.mjs → analytics-DoHdxjjh.mjs}

@@ -164,6 +164,7 @@ class Identity {
     };
   }
 }
+const LINK_ATTRIBUTION_DURABLE_DAYS = 30;
 class SessionManager {
   constructor(storage, sessionTimeoutMinutes = 30) {
     this.eventCount = 0;
@@ -171,6 +172,7 @@ class SessionManager {
     this.activityThrottle = 1e3;
     this.lastActivityUpdate = 0;
     this.adClickIDs = {};
+    this.linkAttribution = {};
     this.storage = storage;
     this.sessionTimeout = sessionTimeoutMinutes * 60 * 1e3;
     this.lastActivityTime = Date.now();
@@ -183,6 +185,7 @@ class SessionManager {
       this.eventCount = session.eventCount;
       this.adClickIDs = session.adClickIDs || {};
       this.landingPage = session.landingPage;
+      this.linkAttribution = session.linkAttribution || {};
       logger.debug("Session loaded:", session);
     } else {
       this.sessionId = this.createNewSession();
@@ -228,7 +231,8 @@ class SessionManager {
       lastActivityTime: this.lastActivityTime,
       eventCount: this.eventCount,
       adClickIDs: this.adClickIDs,
-      landingPage: this.landingPage
+      landingPage: this.landingPage,
+      linkAttribution: this.linkAttribution
     };
     this.storage.set("session", JSON.stringify(sessionData));
   }
@@ -293,7 +297,8 @@ class SessionManager {
       lastActivityTime: this.lastActivityTime,
       eventCount: this.eventCount,
       adClickIDs: this.adClickIDs,
-      landingPage: this.landingPage
+      landingPage: this.landingPage,
+      linkAttribution: this.linkAttribution
     };
   }
   setAdClickIDs(adClickIDs, landingPage) {
@@ -334,6 +339,41 @@ class SessionManager {
   getLandingPage() {
     return this.landingPage;
   }
+  /**
+   * Record the landing's Aegis link attribution. LAST touch: a new `aegis_code`
+   * replaces the previous set whole — never merged, because the fields are the
+   * attributes of ONE link and a mix of two links describes neither.
+   * Session + durable (30d, the server's short-link attribution window) so a
+   * checkout in a later session can still name the send that brought them.
+   */
+  setLinkAttribution(attribution) {
+    if (!attribution.aegis_code) return;
+    this.linkAttribution = { ...attribution };
+    this.persistSession();
+    try {
+      this.storage.set(
+        "link_attribution",
+        JSON.stringify(this.linkAttribution),
+        LINK_ATTRIBUTION_DURABLE_DAYS
+      );
+    } catch {
+    }
+  }
+  getLinkAttribution() {
+    if (!this.linkAttribution.aegis_code) {
+      try {
+        const durable = this.storage.get("link_attribution");
+        if (durable) {
+          const parsed = JSON.parse(durable);
+          if (parsed && parsed.aegis_code) {
+            this.linkAttribution = parsed;
+          }
+        }
+      } catch {
+      }
+    }
+    return this.linkAttribution;
+  }
   destroy() {
     if (this.checkInterval) {
       clearInterval(this.checkInterval);
@@ -341,6 +381,97 @@ class SessionManager {
     }
   }
 }
+const FBP_COOKIE = "_fbp";
+const FBC_COOKIE = "_fbc";
+const COOKIE_LIFETIME_DAYS = 90;
+function readCookie(name) {
+  if (typeof document === "undefined") return null;
+  try {
+    const target = `${name}=`;
+    const parts = document.cookie.split(";");
+    for (let i = 0; i < parts.length; i++) {
+      let c = parts[i];
+      while (c.charAt(0) === " ") c = c.substring(1);
+      if (c.indexOf(target) === 0) {
+        return decodeURIComponent(c.substring(target.length));
+      }
+    }
+  } catch {
+  }
+  return null;
+}
+function writeCookie(name, value, days) {
+  if (typeof document === "undefined" || typeof window === "undefined") return;
+  try {
+    const expiry = new Date(Date.now() + days * 24 * 60 * 60 * 1e3).toUTCString();
+    const domain = getRootDomain();
+    const isHttps = window.location.protocol === "https:";
+    let cookieStr = `${name}=${encodeURIComponent(value)};expires=${expiry};path=/;SameSite=Lax`;
+    if (isHttps) cookieStr += ";Secure";
+    if (domain) cookieStr += `;domain=${domain}`;
+    document.cookie = cookieStr;
+  } catch {
+  }
+}
+function getRootDomain() {
+  if (typeof window === "undefined") return null;
+  const host = window.location.hostname;
+  if (!host || host === "localhost") return null;
+  if (/^\d+\.\d+\.\d+\.\d+$/.test(host)) return null;
+  const parts = host.split(".");
+  if (parts.length < 2) return null;
+  return "." + parts.slice(-2).join(".");
+}
+function subdomainIndex() {
+  if (typeof window === "undefined") return 1;
+  const host = window.location.hostname;
+  if (!host || host === "localhost" || /^\d+\.\d+\.\d+\.\d+$/.test(host)) return 1;
+  const parts = host.split(".");
+  return Math.max(1, parts.length - 1);
+}
+function randomToken() {
+  const n = Math.floor(Math.random() * 1e10);
+  return n.toString().padStart(10, "0");
+}
+function ensureFbp() {
+  const existing = readCookie(FBP_COOKIE);
+  if (existing) return existing;
+  const fbp = `fb.${subdomainIndex()}.${Date.now()}.${randomToken()}`;
+  writeCookie(FBP_COOKIE, fbp, COOKIE_LIFETIME_DAYS);
+  return fbp;
+}
+function ensureFbc() {
+  const existing = readCookie(FBC_COOKIE);
+  if (existing) return existing;
+  const fbclid = readFbclidFromUrl();
+  if (!fbclid) return null;
+  const fbc = `fb.${subdomainIndex()}.${Date.now()}.${fbclid}`;
+  writeCookie(FBC_COOKIE, fbc, COOKIE_LIFETIME_DAYS);
+  return fbc;
+}
+function readFbclidFromUrl() {
+  if (typeof window === "undefined") return null;
+  try {
+    return new URLSearchParams(window.location.search).get("fbclid");
+  } catch {
+    return null;
+  }
+}
+function captureMetaCookies() {
+  return {
+    fbp: ensureFbp(),
+    fbc: ensureFbc(),
+    fbclid: readFbclidFromUrl()
+  };
+}
+function redactMetaCookies(event) {
+  const props = event == null ? void 0 : event.properties;
+  if (!props || props.fbc === void 0 && props.fbp === void 0) return event;
+  const masked = { ...props };
+  if (masked.fbc !== void 0) masked.fbc = "[redacted]";
+  if (masked.fbp !== void 0) masked.fbp = "[redacted]";
+  return { ...event, properties: masked };
+}
 class EventQueue {
   constructor(config, transport, storage) {
     this.buffer = [];
@@ -428,7 +559,7 @@ class EventQueue {
       return;
     }
     this.buffer.push(event);
-    logger.debug("Event queued:", event.type, event);
+    logger.debug("Event queued:", event.type, redactMetaCookies(event));
     if (this.buffer.length >= this.config.batchSize) {
       this.flush();
     }
@@ -980,6 +1111,31 @@ class Storage {
     }
   }
 }
+const CREDENTIAL_URL_PARAMS = [
+  "t",
+  "k",
+  "code",
+  "session_code",
+  "aegis_pair",
+  "u",
+  // The Shopify CarrierService callback token (2026-09-18). Server-to-server
+  // today, so the SDK never sees one — it is here because the two lists are
+  // ONE rule, and a list that is only correct for today's callers is not.
+  "carrier_token"
+];
+const REDACTED = "REDACTED";
+const CREDENTIAL_PARAM_PATTERN = new RegExp(
+  `([?&])(${CREDENTIAL_URL_PARAMS.join("|")})=([^&#\\s"'<>]+)`,
+  "g"
+);
+function redactUrl(value) {
+  if (typeof value !== "string" || value.length === 0) return value;
+  try {
+    return value.replace(CREDENTIAL_PARAM_PATTERN, `$1$2=${REDACTED}`);
+  } catch {
+    return value;
+  }
+}
 function parseUTMParameters(url) {
   try {
     const searchParams = url ? new URL(url).searchParams : new URLSearchParams(window.location.search);
@@ -1010,6 +1166,8 @@ function parseAdClickIDs(url) {
     const adClickIDs = {};
     const clickIDKeys = [
       "gclid",
+      "gbraid",
+      "wbraid",
       "fbclid",
       "msclkid",
       "ctwa_clid",
@@ -1031,6 +1189,30 @@ function parseAdClickIDs(url) {
 function hasAdClickIDs(adClickIDs) {
   return Object.keys(adClickIDs).length > 0;
 }
+const LINK_ATTRIBUTION_KEYS = [
+  "aegis_code",
+  "aegis_campaign",
+  "aegis_journey",
+  "aegis_playbook",
+  "aegis_button"
+];
+function parseLinkAttribution(url) {
+  try {
+    const searchParams = url ? new URL(url).searchParams : new URLSearchParams(window.location.search);
+    if (!searchParams.get("aegis_code")) return {};
+    const attribution = {};
+    LINK_ATTRIBUTION_KEYS.forEach((key) => {
+      const value = searchParams.get(key);
+      if (value) {
+        attribution[key] = value;
+      }
+    });
+    return attribution;
+  } catch (error) {
+    console.warn("[Active Reach URL Parser] parseLinkAttribution failed:", error);
+    return {};
+  }
+}
 function buildContext(config, session) {
   const utm = config.capture_utm ? parseUTMParameters() : void 0;
   const device = detectDevice();
@@ -1038,18 +1220,22 @@ function buildContext(config, session) {
   const browser = detectBrowser();
   const network = detectNetworkInfo();
   const adClickIDs = session == null ? void 0 : session.getAdClickIDs();
-  const landingPage = session == null ? void 0 : session.getLandingPage();
+  const storedLandingPage = session == null ? void 0 : session.getLandingPage();
+  const landingPage = storedLandingPage ? redactUrl(storedLandingPage) : void 0;
   return {
     library: {
       name: "@active-reach/web-sdk",
       version: "1.0.0"
     },
+    // Credential params (`k`, `t`, `code`, ...) keep their key and lose their
+    // value here, where the URL enters the page object. The referrer is
+    // redacted too: the previous page can be our own order/landing link.
     page: {
       path: window.location.pathname,
-      referrer: config.capture_referrer ? document.referrer : "",
-      search: window.location.search,
+      referrer: config.capture_referrer ? redactUrl(document.referrer) : "",
+      search: redactUrl(window.location.search),
       title: document.title,
-      url: window.location.href,
+      url: redactUrl(window.location.href),
       hash: window.location.hash
     },
     userAgent: navigator.userAgent,
@@ -1525,96 +1711,13 @@ class ConsentManager {
     updateGoogleConsent();
   }
 }
-const FBP_COOKIE = "_fbp";
-const FBC_COOKIE = "_fbc";
-const COOKIE_LIFETIME_DAYS = 90;
-function readCookie(name) {
-  if (typeof document === "undefined") return null;
-  try {
-    const target = `${name}=`;
-    const parts = document.cookie.split(";");
-    for (let i = 0; i < parts.length; i++) {
-      let c = parts[i];
-      while (c.charAt(0) === " ") c = c.substring(1);
-      if (c.indexOf(target) === 0) {
-        return decodeURIComponent(c.substring(target.length));
-      }
-    }
-  } catch {
-  }
-  return null;
-}
-function writeCookie(name, value, days) {
-  if (typeof document === "undefined" || typeof window === "undefined") return;
-  try {
-    const expiry = new Date(Date.now() + days * 24 * 60 * 60 * 1e3).toUTCString();
-    const domain = getRootDomain();
-    const isHttps = window.location.protocol === "https:";
-    let cookieStr = `${name}=${encodeURIComponent(value)};expires=${expiry};path=/;SameSite=Lax`;
-    if (isHttps) cookieStr += ";Secure";
-    if (domain) cookieStr += `;domain=${domain}`;
-    document.cookie = cookieStr;
-  } catch {
-  }
-}
-function getRootDomain() {
-  if (typeof window === "undefined") return null;
-  const host = window.location.hostname;
-  if (!host || host === "localhost") return null;
-  if (/^\d+\.\d+\.\d+\.\d+$/.test(host)) return null;
-  const parts = host.split(".");
-  if (parts.length < 2) return null;
-  return "." + parts.slice(-2).join(".");
-}
-function subdomainIndex() {
-  if (typeof window === "undefined") return 1;
-  const host = window.location.hostname;
-  if (!host || host === "localhost" || /^\d+\.\d+\.\d+\.\d+$/.test(host)) return 1;
-  const parts = host.split(".");
-  return Math.max(1, parts.length - 1);
-}
-function randomToken() {
-  const n = Math.floor(Math.random() * 1e10);
-  return n.toString().padStart(10, "0");
-}
-function ensureFbp() {
-  const existing = readCookie(FBP_COOKIE);
-  if (existing) return existing;
-  const fbp = `fb.${subdomainIndex()}.${Date.now()}.${randomToken()}`;
-  writeCookie(FBP_COOKIE, fbp, COOKIE_LIFETIME_DAYS);
-  return fbp;
-}
-function ensureFbc() {
-  const existing = readCookie(FBC_COOKIE);
-  if (existing) return existing;
-  const fbclid = readFbclidFromUrl();
-  if (!fbclid) return null;
-  const fbc = `fb.${subdomainIndex()}.${Date.now()}.${fbclid}`;
-  writeCookie(FBC_COOKIE, fbc, COOKIE_LIFETIME_DAYS);
-  return fbc;
-}
-function readFbclidFromUrl() {
-  if (typeof window === "undefined") return null;
-  try {
-    return new URLSearchParams(window.location.search).get("fbclid");
-  } catch {
-    return null;
-  }
-}
-function captureMetaCookies() {
-  return {
-    fbp: ensureFbp(),
-    fbc: ensureFbc(),
-    fbclid: readFbclidFromUrl()
-  };
-}
 function sumItems(products) {
   return products.reduce((sum, p) => sum + (p.quantity ?? 1), 0);
 }
 function mapProducts(products) {
   return products.map((p) => ({
     product_id: p.product_id,
-    sku: p.sku ?? p.product_id,
+    sku: p.sku,
     name: p.name,
     price: p.price,
     quantity: p.quantity ?? 1,
@@ -1653,7 +1756,7 @@ class EcommerceTracker {
   productViewed(product) {
     this.aegis.track("product_viewed", {
       product_id: product.product_id,
-      sku: product.sku ?? product.product_id,
+      sku: product.sku,
       name: product.name,
       price: product.price,
       currency: product.currency ?? "INR",
@@ -1666,17 +1769,29 @@ class EcommerceTracker {
     });
   }
   productListViewed(list) {
+    const products = mapProducts(list.products);
     this.aegis.track("product_list_viewed", {
       list_id: list.list_id,
       list_name: list.list_name,
       category: list.category,
-      products: mapProducts(list.products)
+      products,
+      // `items` as well as `products` — a THIRD spelling of the same fact was
+      // one spelling too many. Every product reader in the platform looks for
+      // `items` (or `line_items`, the Shopify shape); this event alone said
+      // `products`, so a list view showed N products and contributed nothing to
+      // any of them. On ST that was 4 views recorded as `not measured`, and it
+      // is the same defect that made every Shopify order invisible.
+      //
+      // `products` is kept so nothing already reading it breaks. mapProducts
+      // already emits product_id / sku / name / price / quantity, which is
+      // exactly the canonical item shape — no second mapping to drift.
+      items: products
     });
   }
   productClicked(product, source) {
     this.aegis.track("product_clicked", {
       product_id: product.product_id,
-      sku: product.sku ?? product.product_id,
+      sku: product.sku,
       name: product.name,
       price: product.price,
       currency: product.currency ?? "INR",
@@ -1691,7 +1806,7 @@ class EcommerceTracker {
   productImpressed(product, source) {
     this.aegis.track("product_impression", {
       product_id: product.product_id,
-      sku: product.sku ?? product.product_id,
+      sku: product.sku,
       name: product.name,
       price: product.price,
       currency: product.currency ?? "INR",
@@ -1720,7 +1835,7 @@ class EcommerceTracker {
     const qty = product.quantity ?? 1;
     this.aegis.track("cart_item_added", {
       product_id: product.product_id,
-      sku: product.sku ?? product.product_id,
+      sku: product.sku,
       name: product.name,
       price: product.price,
       quantity: qty,
@@ -1739,7 +1854,7 @@ class EcommerceTracker {
     const qty = product.quantity ?? 1;
     this.aegis.track("cart_item_removed", {
       product_id: product.product_id,
-      sku: product.sku ?? product.product_id,
+      sku: product.sku,
       name: product.name,
       price: product.price,
       quantity: qty,
@@ -1834,7 +1949,7 @@ class EcommerceTracker {
       wishlist_id: wishlist.wishlist_id,
       wishlist_name: wishlist.wishlist_name,
       product_id: wishlist.product.product_id,
-      sku: wishlist.product.sku ?? wishlist.product.product_id,
+      sku: wishlist.product.sku,
       name: wishlist.product.name,
       price: wishlist.product.price,
       variant_id: wishlist.product.variant_id
@@ -1845,7 +1960,7 @@ class EcommerceTracker {
       wishlist_id: wishlist.wishlist_id,
       wishlist_name: wishlist.wishlist_name,
       product_id: wishlist.product.product_id,
-      sku: wishlist.product.sku ?? wishlist.product.product_id,
+      sku: wishlist.product.sku,
       name: wishlist.product.name,
       price: wishlist.product.price,
       variant_id: wishlist.product.variant_id
@@ -1862,7 +1977,7 @@ class EcommerceTracker {
   productWaitlisted(waitlist) {
     this.aegis.track("product_waitlisted", {
       product_id: waitlist.product.product_id,
-      sku: waitlist.product.sku ?? waitlist.product.product_id,
+      sku: waitlist.product.sku,
       variant_id: waitlist.product.variant_id,
       name: waitlist.product.name,
       price: waitlist.product.price,
@@ -2569,6 +2684,7 @@ class Aegis {
       if (currentUrl === this._lastPageUrl) return;
       this._lastPageUrl = currentUrl;
       setTimeout(() => {
+        if (!this._popstateHandler) return;
         this.page();
       }, 50);
     };
@@ -2617,9 +2733,13 @@ class Aegis {
     if (!this.session) return;
     const adClickIDs = parseAdClickIDs();
     if (hasAdClickIDs(adClickIDs)) {
-      this.session.setAdClickIDs(adClickIDs, window.location.href);
+      this.session.setAdClickIDs(adClickIDs, redactUrl(window.location.href));
       logger.info("Ad click IDs captured on page load:", adClickIDs);
     }
+    const linkAttribution = parseLinkAttribution();
+    if (linkAttribution.aegis_code) {
+      this.session.setLinkAttribution(linkAttribution);
+    }
   }
   async initializePlugins() {
     if (!this.config) return;
@@ -3028,26 +3148,38 @@ class Aegis {
     }
     const ctx = event.context;
     const props = event.properties;
-    if ((ctx == null ? void 0 : ctx.campaign) && props && !props.campaign_id) {
+    if ((ctx == null ? void 0 : ctx.campaign) && props) {
       const utm = ctx.campaign;
-      if (utm.campaign) props.campaign_id = utm.campaign;
-      if (utm.source) props.campaign_source = utm.source;
-      if (utm.medium) props.campaign_medium = utm.medium;
-      if (utm.content) props.campaign_content = utm.content;
-      if (utm.term) props.campaign_term = utm.term;
+      if (utm.source && !props.utm_source) props.utm_source = utm.source;
+      if (utm.medium && !props.utm_medium) props.utm_medium = utm.medium;
+      if (utm.campaign && !props.utm_campaign) props.utm_campaign = utm.campaign;
+      if (utm.content && !props.utm_content) props.utm_content = utm.content;
+      if (utm.term && !props.utm_term) props.utm_term = utm.term;
     }
     if ((ctx == null ? void 0 : ctx.adClickIDs) && props) {
       const clicks = ctx.adClickIDs;
+      if (clicks.gclid && !props.gclid) props.gclid = clicks.gclid;
+      if (clicks.gbraid && !props.gbraid) props.gbraid = clicks.gbraid;
+      if (clicks.wbraid && !props.wbraid) props.wbraid = clicks.wbraid;
+      if (clicks.fbclid && !props.fbclid) props.fbclid = clicks.fbclid;
       const clickId = clicks.gclid || clicks.fbclid || clicks.ctwa_clid || clicks.msclkid || clicks.ttclid;
       if (clickId && !props.campaign_click_id) props.campaign_click_id = clickId;
     }
+    if (props && this.session) {
+      const link = this.session.getLinkAttribution();
+      if (link.aegis_code) {
+        for (const [key, value] of Object.entries(link)) {
+          if (value && !props[key]) props[key] = value;
+        }
+      }
+    }
     if (props) {
       const meta = captureMetaCookies();
       if (meta.fbp && !props.fbp) props.fbp = meta.fbp;
       if (meta.fbc && !props.fbc) props.fbc = meta.fbc;
       if (meta.fbclid && !props.fbclid) props.fbclid = meta.fbclid;
     }
-    logger.debug("Capturing event:", event);
+    logger.debug("Capturing event:", redactMetaCookies(event));
     const transformedEvent = await this.plugins.executeHookChain(
       "beforeEventCapture",
       event
@@ -3154,6 +3286,18 @@ class Aegis {
     if (!this.identity) return null;
     return this.identity.getUserId();
   }
+  /**
+   * The Aegis short-link attribution captured from this visitor's landing URL
+   * (`aegis_code` + the link row's `aegis_campaign` / `aegis_journey` /
+   * `aegis_playbook` / `aegis_button`), or `{}` when they did not arrive
+   * through one. Hosts forward `aegis_code` with an order so the order can be
+   * joined to the send that brought the shopper. Never contains `utm_*`, `k`,
+   * `t` or `u`.
+   */
+  getLinkAttribution() {
+    if (!this.session) return {};
+    return { ...this.session.getLinkAttribution() };
+  }
   /**
    * Fetch the identified contact's REDEEMABLE rewards — coupon codes the
    * storefront can auto-apply at checkout + loyalty points balance/tier.
@@ -3345,6 +3489,7 @@ export {
   Storage as S,
   UserNamespace as U,
   logger as l,
-  murmurhash3_x86_32 as m
+  murmurhash3_x86_32 as m,
+  redactUrl as r
 };
-//# sourceMappingURL=analytics-Qyzk8JaB.mjs.map
+//# sourceMappingURL=analytics-DoHdxjjh.mjs.map