@affiliateo/web 4.5.0 → 4.6.1

package/dist/provider.js

@@ -4,6 +4,7 @@ import { createContext, useCallback, useContext, useEffect, useRef, useState } f
 import { EventQueue } from './queue';
 import { isLikelyBot } from './bot-detect';
 import { isDevHost } from './dev-host';
+import { mintTurnstileToken, consumeTurnstileToken } from './turnstile';
 const DEFAULT_API_URL = 'https://affiliateo.com';
 const LS_VISITOR_ID = 'affiliateo_visitor_id';
 const LS_REF = 'affiliateo_ref';
@@ -170,6 +171,23 @@ export function getAttribution() {
 // mount (host has the call sites) but we can shout in dev so the
 // mistake is visible.
 let providerMountCount = 0;
+/**
+ * True only when we can SEE that this is a production build.
+ *
+ * Every bundler (webpack, Vite, Next, Rollup) replaces `process.env.NODE_ENV`
+ * with a literal before shipping, which is why reading it works for almost
+ * everyone. Someone importing the ESM directly has no `process` at all, and
+ * touching it there throws a ReferenceError rather than reading undefined.
+ *
+ * UNKNOWN COUNTS AS NOT-PRODUCTION, deliberately. The only caller is the
+ * double-mount warning, and a double mount double-fires every pageview — which
+ * corrupts the merchant's own numbers and the affiliate attribution built on
+ * them. One stray console line on an unbundled production page is a smaller
+ * cost than silently letting that run.
+ */
+function isProductionBuild() {
+    return typeof process !== 'undefined' && process?.env?.NODE_ENV === 'production';
+}
 export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames, allowLocalhost, allowIframe, allowFileProtocol, debug, flushInterval, maxQueueSize, autoCapturePageviews, children, }) {
     // Normalize autoCapturePageviews. Three shapes:
     //   - undefined / true / object → auto-capture ON (with object overrides)
@@ -208,10 +226,8 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
     const log = useCallback((msg, data) => {
         if (!debug)
             return;
-        // eslint-disable-next-line no-console
         if (data !== undefined)
             console.log('[Affiliateo] ' + msg, data);
-        // eslint-disable-next-line no-console
         else
             console.log('[Affiliateo] ' + msg);
     }, [debug]);
@@ -355,6 +371,12 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
                 gclid: params.get('gclid') || '',
                 screen_width: window.innerWidth,
             };
+            // Attach the (single-use) Turnstile token if one is still unconsumed.
+            // Matters for consent flows where the host disabled auto-capture and
+            // this manual call is the session-opening event.
+            const tsToken = consumeTurnstileToken();
+            if (tsToken)
+                payload.cf_turnstile_token = tsToken;
             queueRef.current?.enqueue(`${apiBase}/api/v1/web/event`, payload);
             log('pageview (manual)', { path: pagePath });
         }
@@ -436,7 +458,6 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
         // Neither appId nor the legacy campaignId alias was passed — nothing to
         // attribute events to, so stay dormant instead of firing junk.
         if (!appIdRef.current) {
-            // eslint-disable-next-line no-console
             console.error('[Affiliateo] Missing appId — pass your app ID to <AffiliateoProvider appId="...">.');
             return;
         }
@@ -444,8 +465,7 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
         // ever mounted in the page lifetime. Dev-only; production swallows
         // the warning to avoid noise in real merchant consoles.
         providerMountCount += 1;
-        if (providerMountCount > 1 && process.env.NODE_ENV !== 'production') {
-            // eslint-disable-next-line no-console
+        if (providerMountCount > 1 && !isProductionBuild()) {
             console.warn('[Affiliateo] AffiliateoProvider mounted more than once. Mount it exactly once near the root of your app, or pageviews will double-fire.');
         }
         // Client-side bot detection. If the current browser context looks
@@ -674,6 +694,11 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
             ssSet(SS_PV_THROTTLE, JSON.stringify({ url: href, time: now }));
             lastSendTime = now;
             ended = false;
+            // Attach the (single-use) Turnstile token to the session-opening
+            // pageview. consumeTurnstileToken() returns null after the first
+            // consume, so SPA navigations go out bare — the server trusts them
+            // because the visitor row was created behind the verified token.
+            const tsToken = consumeTurnstileToken();
             queue.enqueue(endpoint, {
                 type: 'pageview',
                 campaign_id: appIdRef.current,
@@ -692,6 +717,7 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
                 ttclid: params.get('ttclid') || '',
                 gclid: params.get('gclid') || '',
                 screen_width: window.innerWidth,
+                ...(tsToken ? { cf_turnstile_token: tsToken } : {}),
             });
             log('pageview', { path: window.location.pathname });
         }
@@ -761,13 +787,30 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
                 }
             }
         }
-        // Send pageview on mount. captureInitialPageview === false skips this
-        // for cookie-consent flows where the host wants to defer until the
-        // user accepts (then call trackPageview() manually).
-        if (!sentRef.current && autoCfg.captureInitialPageview && autoCfg.enabled) {
-            sentRef.current = true;
-            sendPageview();
-        }
+        // Kick off the Turnstile mint regardless of auto-capture config so a
+        // consent flow's later manual trackPageview() finds a token waiting.
+        // Never rejects; resolves with or without a token (see turnstile.ts).
+        let cancelled = false;
+        void mintTurnstileToken().then(() => {
+            // Send pageview on mount, deferred until the Turnstile mint settles so
+            // the session-opening event carries the token (SPA navigations reuse
+            // the resolved state and don't wait). captureInitialPageview === false
+            // skips this for cookie-consent flows where the host wants to defer
+            // until the user accepts (then call trackPageview() manually).
+            //
+            // sentRef is set HERE (not before the mint) so a StrictMode
+            // double-mount can't mark the pageview as sent and then tear down the
+            // queue before the deferred send ever ran — the surviving mount's
+            // callback sees sentRef still false and fires.
+            if (cancelled)
+                return;
+            if (sentRef.current)
+                return;
+            if (autoCfg.captureInitialPageview && autoCfg.enabled) {
+                sentRef.current = true;
+                sendPageview();
+            }
+        });
         // Detect user leaving
         document.addEventListener('visibilitychange', onVisibilityChange);
         window.addEventListener('pagehide', sendEnd);
@@ -899,6 +942,7 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
             document.addEventListener('keydown', onKeydownForLinkDecoration, true);
         }
         return () => {
+            cancelled = true;
             document.removeEventListener('visibilitychange', onVisibilityChange);
             window.removeEventListener('pagehide', sendEnd);
             window.removeEventListener('popstate', onUrlChange);
@@ -921,6 +965,14 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
             queueRef.current = null;
             providerMountCount = Math.max(0, providerMountCount - 1);
         };
+        // flushInterval, maxQueueSize, allowFileProtocol and the autoCfg.* fields
+        // are BOOT configuration, read once when the queue and listeners are
+        // constructed. Listing them would tear the whole pipeline down and rebuild
+        // it whenever a host app re-renders with a new inline object, and
+        // shutdown() drops the in-memory queue — so honoring the rule here would
+        // cost real events. A host that needs different settings should remount
+        // the provider.
+        // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [apiBase, allowedHostnames, allowLocalhost, allowIframe, log, track, identify, trackPageview, reset, optOut, optIn, flush]);
     return (_jsx(AffiliateoContext.Provider, { value: state, children: children }));
 }

package/dist/turnstile.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Cloudflare Turnstile token minting. Mirrors the hosted t.js tracker:
+ * mint ONE invisible token at SDK init and attach it to the first pageview.
+ * The server verifies the token before creating the visitor row (and before
+ * counting a pay-per-click web_traffic click — the billable path REQUIRES a
+ * genuine pass when TURNSTILE_SECRET is configured). Subsequent events from
+ * the same visitor_id are trusted because the row was created behind a
+ * verified token, so the cost is one mint + one verify per session.
+ *
+ * Tokens are single-use at Cloudflare's siteverify, so consumeToken()
+ * hands the token out exactly once — re-sending a used token would get the
+ * event rejected server-side, not warn-allowed.
+ *
+ * Failure modes: if the Turnstile script is blocked (ad blockers, strict
+ * CSP), errors, or times out, minting resolves with no token and events go
+ * out bare. The server's warn-allow mode (TURNSTILE_REQUIRE unset) lets
+ * those through; commission-on-sale (web_affiliate) tracking never depends
+ * on the token at all.
+ */
+interface TurnstileApi {
+    render: (el: HTMLElement, opts: Record<string, unknown>) => unknown;
+}
+declare global {
+    interface Window {
+        turnstile?: TurnstileApi;
+        __affiliateoTSLoaded?: () => void;
+    }
+}
+/**
+ * Load the Turnstile script (once) and run the invisible challenge. Resolves
+ * when a token is available OR the mint failed/timed out — never rejects, so
+ * callers can unconditionally `.then(sendPageview)`.
+ */
+export declare function mintTurnstileToken(): Promise<void>;
+/**
+ * Hand out the minted token exactly once (single-use at siteverify).
+ * Returns null when no token was minted or it was already consumed.
+ */
+export declare function consumeTurnstileToken(): string | null;
+export {};

package/dist/turnstile.js

@@ -0,0 +1,105 @@
+/**
+ * Cloudflare Turnstile token minting. Mirrors the hosted t.js tracker:
+ * mint ONE invisible token at SDK init and attach it to the first pageview.
+ * The server verifies the token before creating the visitor row (and before
+ * counting a pay-per-click web_traffic click — the billable path REQUIRES a
+ * genuine pass when TURNSTILE_SECRET is configured). Subsequent events from
+ * the same visitor_id are trusted because the row was created behind a
+ * verified token, so the cost is one mint + one verify per session.
+ *
+ * Tokens are single-use at Cloudflare's siteverify, so consumeToken()
+ * hands the token out exactly once — re-sending a used token would get the
+ * event rejected server-side, not warn-allowed.
+ *
+ * Failure modes: if the Turnstile script is blocked (ad blockers, strict
+ * CSP), errors, or times out, minting resolves with no token and events go
+ * out bare. The server's warn-allow mode (TURNSTILE_REQUIRE unset) lets
+ * those through; commission-on-sale (web_affiliate) tracking never depends
+ * on the token at all.
+ */
+// Public sitekey (safe to expose) — the same one public/t.js ships. The
+// matching secret lives in TURNSTILE_SECRET on the server.
+const TURNSTILE_SITEKEY = '0x4AAAAAADR5UW2x6axFd13p';
+const TURNSTILE_SCRIPT_SRC = 'https://challenges.cloudflare.com/turnstile/v0/api.js?onload=__affiliateoTSLoaded&render=explicit';
+// Hard deadline for the whole mint (script load + challenge). t.js relies on
+// Turnstile's own timeout-callback, but a script tag that never loads never
+// fires ANY callback — this timer makes sure the first pageview can't be
+// held hostage by a blocked challenges.cloudflare.com.
+const MINT_TIMEOUT_MS = 3000;
+let token = null;
+let minting = null;
+/**
+ * Load the Turnstile script (once) and run the invisible challenge. Resolves
+ * when a token is available OR the mint failed/timed out — never rejects, so
+ * callers can unconditionally `.then(sendPageview)`.
+ */
+export function mintTurnstileToken() {
+    if (typeof window === 'undefined' || typeof document === 'undefined') {
+        return Promise.resolve();
+    }
+    if (minting)
+        return minting;
+    minting = new Promise((resolve) => {
+        let settled = false;
+        const settle = () => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(deadline);
+            resolve();
+        };
+        const deadline = setTimeout(settle, MINT_TIMEOUT_MS);
+        const render = () => {
+            if (!window.turnstile) {
+                settle();
+                return;
+            }
+            try {
+                const holder = document.createElement('div');
+                holder.style.display = 'none';
+                document.body.appendChild(holder);
+                window.turnstile.render(holder, {
+                    sitekey: TURNSTILE_SITEKEY,
+                    // Invisible widget — never shows UI. Real browsers pass the
+                    // challenge in 50-200ms with zero user interaction.
+                    size: 'invisible',
+                    callback: (tok) => {
+                        token = tok;
+                        settle();
+                    },
+                    'error-callback': settle,
+                    'timeout-callback': settle,
+                });
+            }
+            catch {
+                settle();
+            }
+        };
+        if (window.turnstile) {
+            render();
+            return;
+        }
+        try {
+            const script = document.createElement('script');
+            script.src = TURNSTILE_SCRIPT_SRC;
+            script.async = true;
+            script.defer = true;
+            script.onerror = settle;
+            window.__affiliateoTSLoaded = render;
+            document.head.appendChild(script);
+        }
+        catch {
+            settle();
+        }
+    });
+    return minting;
+}
+/**
+ * Hand out the minted token exactly once (single-use at siteverify).
+ * Returns null when no token was minted or it was already consumed.
+ */
+export function consumeTurnstileToken() {
+    const t = token;
+    token = null;
+    return t;
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@affiliateo/web",
-  "version": "4.5.0",
-  "description": "Affiliateo web SDK — affiliate attribution and tracking for web apps",
+  "version": "4.6.1",
+  "description": "Affiliateo web SDK \u2014 affiliate attribution and tracking for web apps",
   "main": "dist/index.js",
   "module": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -14,7 +14,7 @@
   },
   "scripts": {
     "build": "tsc",
-    "prepublishOnly": "npm run build"
+    "prepack": "npm run build"
   },
   "peerDependencies": {
     "react": ">=18.0.0"
@@ -28,7 +28,17 @@
     "@types/react": "^19.0.0",
     "typescript": "^5.0.0"
   },
-  "keywords": ["affiliateo", "affiliate", "attribution", "stripe", "web", "session", "tracking"],
+  "keywords": [
+    "affiliateo",
+    "affiliate",
+    "attribution",
+    "stripe",
+    "web",
+    "session",
+    "tracking"
+  ],
   "license": "MIT",
-  "files": ["dist"]
+  "files": [
+    "dist"
+  ]
 }