@affiliateo/web 4.2.0 → 4.4.0

package/dist/bot-detect.d.ts

@@ -1,5 +1,5 @@
 /**
- * Client-side bot detection. Mirrors Datafast / PostHog / Plausible's
+ * Client-side bot detection. Mirrors PostHog / Plausible's
  * approach: catch the obvious automation tools at SDK init so they
  * never fire a single network request.
  *
@@ -20,8 +20,8 @@
  * layer 3 (kicks in on the request), then layer 2 (server checks before
  * writing). If any one layer rejects, the event drops.
  *
- * Patterns sourced from the Datafast script tag + npm SDK (publicly
- * inspectable). We include their full list because it represents years
+ * Patterns sourced from widely-used analytics SDKs (publicly
+ * inspectable). We include a comprehensive list because it represents years
  * of accumulated bot-shape knowledge that's expensive to reproduce.
  */
 /**

package/dist/bot-detect.js

@@ -1,5 +1,5 @@
 /**
- * Client-side bot detection. Mirrors Datafast / PostHog / Plausible's
+ * Client-side bot detection. Mirrors PostHog / Plausible's
  * approach: catch the obvious automation tools at SDK init so they
  * never fire a single network request.
  *
@@ -20,8 +20,8 @@
  * layer 3 (kicks in on the request), then layer 2 (server checks before
  * writing). If any one layer rejects, the event drops.
  *
- * Patterns sourced from the Datafast script tag + npm SDK (publicly
- * inspectable). We include their full list because it represents years
+ * Patterns sourced from widely-used analytics SDKs (publicly
+ * inspectable). We include a comprehensive list because it represents years
  * of accumulated bot-shape knowledge that's expensive to reproduce.
  */
 // Selenium/WebDriver/headless flags set on window or navigator. Modern

package/dist/provider.js

@@ -8,12 +8,12 @@ const DEFAULT_API_URL = 'https://affiliateo.com';
 const LS_VISITOR_ID = 'affiliateo_visitor_id';
 const LS_REF = 'affiliateo_ref';
 const LS_CAMPAIGN_ID = 'affiliateo_campaign_id';
-// Persistent opt-out flag. Mirrors Datafast's DATAFAST_IGNORE_TRACKING key —
+// Persistent opt-out flag (affiliateo_opt_out) —
 // when set to "true" the SDK silently noops every outbound call. Survives
 // page reloads. removed by optIn(). Checked at init time so a previously
 // opted-out visitor never re-fires auto-pageviews after a refresh.
 const LS_OPT_OUT = 'affiliateo_opt_out';
-// Client-owned session id (Datafast-style). The BROWSER owns the session,
+// Client-owned session id. The BROWSER owns the session,
 // not the server. One id is reused for every event within a sliding
 // 10-minute activity window, then a fresh one is minted. Because the id is
 // generated here and sent on each event, a burst of pageviews (a redirect
@@ -26,7 +26,7 @@ const SESSION_WINDOW_MS = 10 * 60 * 1000;
 // Same-URL pageview throttle, persisted in sessionStorage so it survives
 // hard navigations / redirect bounces (the old in-memory throttle reset on
 // every fresh page context, which let a 3-hop bounce fire 3 pageviews).
-// Different URLs are never throttled against each other. Mirrors Datafast's
+// Different URLs are never throttled against each other, with a
 // 60s same-URL suppression.
 const SS_PV_THROTTLE = 'affiliateo_pv_throttle';
 const PV_THROTTLE_MS = 60 * 1000;
@@ -88,7 +88,7 @@ function uuid() {
 // Get-or-create the current session id with a sliding 10-minute window.
 // Stored in localStorage so every tab and every page load in the same
 // browser shares one session. Each call slides the window forward (the same
-// way Datafast refreshes its session cookie on each event), so an actively
+// way a session cookie is refreshed on each event), so an actively
 // browsing visitor keeps one id and a returning visitor past the window
 // gets a fresh one. Returns a UUID string the server stamps onto the event.
 function getSessionId() {
@@ -169,7 +169,7 @@ export function AffiliateoProvider({ campaignId, apiUrl, allowedHostnames, allow
     // Normalize autoCapturePageviews. Three shapes:
     //   - undefined / true / object → auto-capture ON (with object overrides)
     //   - false → auto-capture OFF entirely (host must call trackPageview)
-    // Defaults match Datafast: captureInitialPageview true, trackHashChanges
+    // Sensible defaults: captureInitialPageview true, trackHashChanges
     // false, debounceMs 100.
     const autoCfg = autoCapturePageviews === false
         ? { enabled: false, captureInitialPageview: false, trackHashChanges: false, debounceMs: 100 }
@@ -299,7 +299,7 @@ export function AffiliateoProvider({ campaignId, apiUrl, allowedHostnames, allow
         }
         catch { /* swallow */ }
     }, [apiBase, log]);
-    // Manual pageview. Mirrors Datafast's trackPageview(path?). Same payload
+    // Manual pageview via trackPageview(path?). Same payload
     // shape the auto-fired pageview uses (see sendPageview inside the route
     // effect below) so server-side routing / dedup / IP+UA enrichment behave
     // identically for both code paths.
@@ -339,6 +339,12 @@ export function AffiliateoProvider({ campaignId, apiUrl, allowedHostnames, allow
                 utm_source: params.get('utm_source') || '',
                 utm_medium: params.get('utm_medium') || '',
                 utm_campaign: params.get('utm_campaign') || '',
+                // Ad-network click ids — set automatically on the landing URL by
+                // every Meta/TikTok/Google ad click. Label the sale's source and
+                // feed server-side conversion matching.
+                fbclid: params.get('fbclid') || '',
+                ttclid: params.get('ttclid') || '',
+                gclid: params.get('gclid') || '',
                 screen_width: window.innerWidth,
             };
             queueRef.current?.enqueue(`${apiBase}/api/v1/web/event`, payload);
@@ -364,13 +370,13 @@ export function AffiliateoProvider({ campaignId, apiUrl, allowedHostnames, allow
     // affiliate ref so the next pageview is a brand-new anonymous visitor.
     // The campaign_id stays (it's a property of the site, not the visitor).
     //
-    // Matches Datafast's reset() semantics for non-cookieless mode: new
+    // reset() semantics for non-cookieless mode: new
     // visitor, no event fired, caller handles "tell the server about it"
     // by triggering whatever pageview / navigation comes next.
     //
     // Returns a Promise so callers can `await reset()` before navigating
     // (the localStorage writes are sync but the Promise lets the API stay
-    // consistent with Datafast's async signature, future-proofing for
+    // an async signature, future-proofing for
     // server-minted IDs in cookieless mode).
     const reset = useCallback(async () => {
         try {
@@ -666,6 +672,10 @@ export function AffiliateoProvider({ campaignId, apiUrl, allowedHostnames, allow
                 utm_source: params.get('utm_source') || '',
                 utm_medium: params.get('utm_medium') || '',
                 utm_campaign: params.get('utm_campaign') || '',
+                // Ad-network click ids from the landing URL (see trackPageview).
+                fbclid: params.get('fbclid') || '',
+                ttclid: params.get('ttclid') || '',
+                gclid: params.get('gclid') || '',
                 screen_width: window.innerWidth,
             });
             log('pageview', { path: window.location.pathname });
@@ -756,8 +766,8 @@ export function AffiliateoProvider({ campaignId, apiUrl, allowedHostnames, allow
         // Debouncing collapses back-to-back navigation events into one. Some
         // frameworks (Next.js, certain Vue routers) fire pushState then
         // replaceState in the same tick to canonicalize the URL; without
-        // debouncing that's two pageviews per real navigation. Default 100ms
-        // matches Datafast; set debounceMs to 0 to disable.
+        // debouncing that's two pageviews per real navigation. Default 100ms;
+        // set debounceMs to 0 to disable.
         let lastPath = window.location.pathname;
         let lastHash = window.location.hash;
         let pendingPageviewTimer = null;
@@ -802,7 +812,7 @@ export function AffiliateoProvider({ campaignId, apiUrl, allowedHostnames, allow
         };
         // HTML-attribute goal scanning (`data-affiliateo-goal`,
         // `data-affiliateo-scroll`) and the IntersectionObserver that drove
-        // them were removed in 3.0.0 to match Datafast's npm SDK ergonomics:
+        // them were removed in 3.0.0 to streamline the npm SDK ergonomics:
         // SDK does pageview + track() + identify(); merchants fire goals
         // themselves via onClick={() => track('signup_clicked')} or by
         // wiring their own IntersectionObserver and calling track() from it.

package/dist/queue.d.ts

@@ -9,7 +9,7 @@
  *   networks (train wifi, subway transitions, dropping 4G) merchants saw
  *   ~10-15% fewer events than they should have.
  *
- *   This queue mirrors the pattern PostHog / Segment / Amplitude / Datafast
+ *   This queue mirrors the pattern PostHog / Segment / Amplitude
  *   all converged on: in-memory queue, localStorage persistence so events
  *   survive page reload, periodic auto-flush, retry on failure up to N
  *   times, drop after N tries to bound memory.
@@ -37,7 +37,7 @@
  *   - MAX_QUEUE_SIZE   hard cap so a long network outage can't fill
  *                      localStorage and break the host app. Events
  *                      beyond the cap are dropped FIFO (oldest first).
- *   - FLUSH_INTERVAL_MS = 5_000   matches Datafast's web SDK default
+ *   - FLUSH_INTERVAL_MS = 5_000   a sensible web SDK default
  *   - SIZE_FLUSH_THRESHOLD = 10   triggers a flush when queue grows
  *                                 past this even before the timer fires
  */

package/dist/queue.js

@@ -9,7 +9,7 @@
  *   networks (train wifi, subway transitions, dropping 4G) merchants saw
  *   ~10-15% fewer events than they should have.
  *
- *   This queue mirrors the pattern PostHog / Segment / Amplitude / Datafast
+ *   This queue mirrors the pattern PostHog / Segment / Amplitude
  *   all converged on: in-memory queue, localStorage persistence so events
  *   survive page reload, periodic auto-flush, retry on failure up to N
  *   times, drop after N tries to bound memory.
@@ -37,7 +37,7 @@
  *   - MAX_QUEUE_SIZE   hard cap so a long network outage can't fill
  *                      localStorage and break the host app. Events
  *                      beyond the cap are dropped FIFO (oldest first).
- *   - FLUSH_INTERVAL_MS = 5_000   matches Datafast's web SDK default
+ *   - FLUSH_INTERVAL_MS = 5_000   a sensible web SDK default
  *   - SIZE_FLUSH_THRESHOLD = 10   triggers a flush when queue grows
  *                                 past this even before the timer fires
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@affiliateo/web",
-  "version": "4.2.0",
+  "version": "4.4.0",
   "description": "Affiliateo web SDK — affiliate attribution and tracking for web apps",
   "main": "dist/index.js",
   "module": "dist/index.js",