@affiliateo/web 4.5.0 → 4.6.0

package/dist/provider.js

@@ -4,6 +4,7 @@ import { createContext, useCallback, useContext, useEffect, useRef, useState } f
 import { EventQueue } from './queue';
 import { isLikelyBot } from './bot-detect';
 import { isDevHost } from './dev-host';
+import { mintTurnstileToken, consumeTurnstileToken } from './turnstile';
 const DEFAULT_API_URL = 'https://affiliateo.com';
 const LS_VISITOR_ID = 'affiliateo_visitor_id';
 const LS_REF = 'affiliateo_ref';
@@ -355,6 +356,12 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
                 gclid: params.get('gclid') || '',
                 screen_width: window.innerWidth,
             };
+            // Attach the (single-use) Turnstile token if one is still unconsumed.
+            // Matters for consent flows where the host disabled auto-capture and
+            // this manual call is the session-opening event.
+            const tsToken = consumeTurnstileToken();
+            if (tsToken)
+                payload.cf_turnstile_token = tsToken;
             queueRef.current?.enqueue(`${apiBase}/api/v1/web/event`, payload);
             log('pageview (manual)', { path: pagePath });
         }
@@ -674,6 +681,11 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
             ssSet(SS_PV_THROTTLE, JSON.stringify({ url: href, time: now }));
             lastSendTime = now;
             ended = false;
+            // Attach the (single-use) Turnstile token to the session-opening
+            // pageview. consumeTurnstileToken() returns null after the first
+            // consume, so SPA navigations go out bare — the server trusts them
+            // because the visitor row was created behind the verified token.
+            const tsToken = consumeTurnstileToken();
             queue.enqueue(endpoint, {
                 type: 'pageview',
                 campaign_id: appIdRef.current,
@@ -692,6 +704,7 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
                 ttclid: params.get('ttclid') || '',
                 gclid: params.get('gclid') || '',
                 screen_width: window.innerWidth,
+                ...(tsToken ? { cf_turnstile_token: tsToken } : {}),
             });
             log('pageview', { path: window.location.pathname });
         }
@@ -761,13 +774,30 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
                 }
             }
         }
-        // Send pageview on mount. captureInitialPageview === false skips this
-        // for cookie-consent flows where the host wants to defer until the
-        // user accepts (then call trackPageview() manually).
-        if (!sentRef.current && autoCfg.captureInitialPageview && autoCfg.enabled) {
-            sentRef.current = true;
-            sendPageview();
-        }
+        // Kick off the Turnstile mint regardless of auto-capture config so a
+        // consent flow's later manual trackPageview() finds a token waiting.
+        // Never rejects; resolves with or without a token (see turnstile.ts).
+        let cancelled = false;
+        void mintTurnstileToken().then(() => {
+            // Send pageview on mount, deferred until the Turnstile mint settles so
+            // the session-opening event carries the token (SPA navigations reuse
+            // the resolved state and don't wait). captureInitialPageview === false
+            // skips this for cookie-consent flows where the host wants to defer
+            // until the user accepts (then call trackPageview() manually).
+            //
+            // sentRef is set HERE (not before the mint) so a StrictMode
+            // double-mount can't mark the pageview as sent and then tear down the
+            // queue before the deferred send ever ran — the surviving mount's
+            // callback sees sentRef still false and fires.
+            if (cancelled)
+                return;
+            if (sentRef.current)
+                return;
+            if (autoCfg.captureInitialPageview && autoCfg.enabled) {
+                sentRef.current = true;
+                sendPageview();
+            }
+        });
         // Detect user leaving
         document.addEventListener('visibilitychange', onVisibilityChange);
         window.addEventListener('pagehide', sendEnd);
@@ -899,6 +929,7 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
             document.addEventListener('keydown', onKeydownForLinkDecoration, true);
         }
         return () => {
+            cancelled = true;
             document.removeEventListener('visibilitychange', onVisibilityChange);
             window.removeEventListener('pagehide', sendEnd);
             window.removeEventListener('popstate', onUrlChange);

package/dist/turnstile.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Cloudflare Turnstile token minting. Mirrors the hosted t.js tracker:
+ * mint ONE invisible token at SDK init and attach it to the first pageview.
+ * The server verifies the token before creating the visitor row (and before
+ * counting a pay-per-click web_traffic click — the billable path REQUIRES a
+ * genuine pass when TURNSTILE_SECRET is configured). Subsequent events from
+ * the same visitor_id are trusted because the row was created behind a
+ * verified token, so the cost is one mint + one verify per session.
+ *
+ * Tokens are single-use at Cloudflare's siteverify, so consumeToken()
+ * hands the token out exactly once — re-sending a used token would get the
+ * event rejected server-side, not warn-allowed.
+ *
+ * Failure modes: if the Turnstile script is blocked (ad blockers, strict
+ * CSP), errors, or times out, minting resolves with no token and events go
+ * out bare. The server's warn-allow mode (TURNSTILE_REQUIRE unset) lets
+ * those through; commission-on-sale (web_affiliate) tracking never depends
+ * on the token at all.
+ */
+interface TurnstileApi {
+    render: (el: HTMLElement, opts: Record<string, unknown>) => unknown;
+}
+declare global {
+    interface Window {
+        turnstile?: TurnstileApi;
+        __affiliateoTSLoaded?: () => void;
+    }
+}
+/**
+ * Load the Turnstile script (once) and run the invisible challenge. Resolves
+ * when a token is available OR the mint failed/timed out — never rejects, so
+ * callers can unconditionally `.then(sendPageview)`.
+ */
+export declare function mintTurnstileToken(): Promise<void>;
+/**
+ * Hand out the minted token exactly once (single-use at siteverify).
+ * Returns null when no token was minted or it was already consumed.
+ */
+export declare function consumeTurnstileToken(): string | null;
+export {};

package/dist/turnstile.js

@@ -0,0 +1,105 @@
+/**
+ * Cloudflare Turnstile token minting. Mirrors the hosted t.js tracker:
+ * mint ONE invisible token at SDK init and attach it to the first pageview.
+ * The server verifies the token before creating the visitor row (and before
+ * counting a pay-per-click web_traffic click — the billable path REQUIRES a
+ * genuine pass when TURNSTILE_SECRET is configured). Subsequent events from
+ * the same visitor_id are trusted because the row was created behind a
+ * verified token, so the cost is one mint + one verify per session.
+ *
+ * Tokens are single-use at Cloudflare's siteverify, so consumeToken()
+ * hands the token out exactly once — re-sending a used token would get the
+ * event rejected server-side, not warn-allowed.
+ *
+ * Failure modes: if the Turnstile script is blocked (ad blockers, strict
+ * CSP), errors, or times out, minting resolves with no token and events go
+ * out bare. The server's warn-allow mode (TURNSTILE_REQUIRE unset) lets
+ * those through; commission-on-sale (web_affiliate) tracking never depends
+ * on the token at all.
+ */
+// Public sitekey (safe to expose) — the same one public/t.js ships. The
+// matching secret lives in TURNSTILE_SECRET on the server.
+const TURNSTILE_SITEKEY = '0x4AAAAAADR5UW2x6axFd13p';
+const TURNSTILE_SCRIPT_SRC = 'https://challenges.cloudflare.com/turnstile/v0/api.js?onload=__affiliateoTSLoaded&render=explicit';
+// Hard deadline for the whole mint (script load + challenge). t.js relies on
+// Turnstile's own timeout-callback, but a script tag that never loads never
+// fires ANY callback — this timer makes sure the first pageview can't be
+// held hostage by a blocked challenges.cloudflare.com.
+const MINT_TIMEOUT_MS = 3000;
+let token = null;
+let minting = null;
+/**
+ * Load the Turnstile script (once) and run the invisible challenge. Resolves
+ * when a token is available OR the mint failed/timed out — never rejects, so
+ * callers can unconditionally `.then(sendPageview)`.
+ */
+export function mintTurnstileToken() {
+    if (typeof window === 'undefined' || typeof document === 'undefined') {
+        return Promise.resolve();
+    }
+    if (minting)
+        return minting;
+    minting = new Promise((resolve) => {
+        let settled = false;
+        const settle = () => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(deadline);
+            resolve();
+        };
+        const deadline = setTimeout(settle, MINT_TIMEOUT_MS);
+        const render = () => {
+            if (!window.turnstile) {
+                settle();
+                return;
+            }
+            try {
+                const holder = document.createElement('div');
+                holder.style.display = 'none';
+                document.body.appendChild(holder);
+                window.turnstile.render(holder, {
+                    sitekey: TURNSTILE_SITEKEY,
+                    // Invisible widget — never shows UI. Real browsers pass the
+                    // challenge in 50-200ms with zero user interaction.
+                    size: 'invisible',
+                    callback: (tok) => {
+                        token = tok;
+                        settle();
+                    },
+                    'error-callback': settle,
+                    'timeout-callback': settle,
+                });
+            }
+            catch {
+                settle();
+            }
+        };
+        if (window.turnstile) {
+            render();
+            return;
+        }
+        try {
+            const script = document.createElement('script');
+            script.src = TURNSTILE_SCRIPT_SRC;
+            script.async = true;
+            script.defer = true;
+            script.onerror = settle;
+            window.__affiliateoTSLoaded = render;
+            document.head.appendChild(script);
+        }
+        catch {
+            settle();
+        }
+    });
+    return minting;
+}
+/**
+ * Hand out the minted token exactly once (single-use at siteverify).
+ * Returns null when no token was minted or it was already consumed.
+ */
+export function consumeTurnstileToken() {
+    const t = token;
+    token = null;
+    return t;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@affiliateo/web",
-  "version": "4.5.0",
+  "version": "4.6.0",
   "description": "Affiliateo web SDK — affiliate attribution and tracking for web apps",
   "main": "dist/index.js",
   "module": "dist/index.js",