@affiliateo/web 4.6.0 → 4.7.0

package/dist/provider.js

@@ -171,6 +171,23 @@ export function getAttribution() {
 // mount (host has the call sites) but we can shout in dev so the
 // mistake is visible.
 let providerMountCount = 0;
+/**
+ * True only when we can SEE that this is a production build.
+ *
+ * Every bundler (webpack, Vite, Next, Rollup) replaces `process.env.NODE_ENV`
+ * with a literal before shipping, which is why reading it works for almost
+ * everyone. Someone importing the ESM directly has no `process` at all, and
+ * touching it there throws a ReferenceError rather than reading undefined.
+ *
+ * UNKNOWN COUNTS AS NOT-PRODUCTION, deliberately. The only caller is the
+ * double-mount warning, and a double mount double-fires every pageview — which
+ * corrupts the merchant's own numbers and the affiliate attribution built on
+ * them. One stray console line on an unbundled production page is a smaller
+ * cost than silently letting that run.
+ */
+function isProductionBuild() {
+    return typeof process !== 'undefined' && process?.env?.NODE_ENV === 'production';
+}
 export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames, allowLocalhost, allowIframe, allowFileProtocol, debug, flushInterval, maxQueueSize, autoCapturePageviews, children, }) {
     // Normalize autoCapturePageviews. Three shapes:
     //   - undefined / true / object → auto-capture ON (with object overrides)
@@ -209,10 +226,8 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
     const log = useCallback((msg, data) => {
         if (!debug)
             return;
-        // eslint-disable-next-line no-console
         if (data !== undefined)
             console.log('[Affiliateo] ' + msg, data);
-        // eslint-disable-next-line no-console
         else
             console.log('[Affiliateo] ' + msg);
     }, [debug]);
@@ -265,6 +280,18 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
                 visitor_id: vid,
                 session_id: getSessionId(),
                 event_name: name,
+                // Page context, same three fields the pageview sender carries.
+                // A goal event used to go out without them, and the server's
+                // `path || hostname || '[Web]'` fallback then overwrote the
+                // visitor's real current_page with the literal string '[Web]' —
+                // which both broke the tracking-page popover and made the visitor
+                // invisible to any funnel step matching on a page path. The server
+                // no longer clobbers on missing values, but sending the real path
+                // is what actually keeps current_page correct as a visitor fires
+                // goals while navigating a single-page app.
+                url: window.location.href,
+                path: window.location.pathname,
+                hostname: window.location.hostname,
             };
             if (metadata && typeof metadata === 'object')
                 payload.metadata = metadata;
@@ -443,7 +470,6 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
         // Neither appId nor the legacy campaignId alias was passed — nothing to
         // attribute events to, so stay dormant instead of firing junk.
         if (!appIdRef.current) {
-            // eslint-disable-next-line no-console
             console.error('[Affiliateo] Missing appId — pass your app ID to <AffiliateoProvider appId="...">.');
             return;
         }
@@ -451,8 +477,7 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
         // ever mounted in the page lifetime. Dev-only; production swallows
         // the warning to avoid noise in real merchant consoles.
         providerMountCount += 1;
-        if (providerMountCount > 1 && process.env.NODE_ENV !== 'production') {
-            // eslint-disable-next-line no-console
+        if (providerMountCount > 1 && !isProductionBuild()) {
             console.warn('[Affiliateo] AffiliateoProvider mounted more than once. Mount it exactly once near the root of your app, or pageviews will double-fire.');
         }
         // Client-side bot detection. If the current browser context looks
@@ -952,6 +977,14 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
             queueRef.current = null;
             providerMountCount = Math.max(0, providerMountCount - 1);
         };
+        // flushInterval, maxQueueSize, allowFileProtocol and the autoCfg.* fields
+        // are BOOT configuration, read once when the queue and listeners are
+        // constructed. Listing them would tear the whole pipeline down and rebuild
+        // it whenever a host app re-renders with a new inline object, and
+        // shutdown() drops the in-memory queue — so honoring the rule here would
+        // cost real events. A host that needs different settings should remount
+        // the provider.
+        // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [apiBase, allowedHostnames, allowLocalhost, allowIframe, log, track, identify, trackPageview, reset, optOut, optIn, flush]);
     return (_jsx(AffiliateoContext.Provider, { value: state, children: children }));
 }

package/dist/queue.js

@@ -120,10 +120,27 @@ export class EventQueue {
     enqueue(endpoint, payload) {
         if (this.shuttingDown)
             return;
+        const id = uuid();
         this.queue.push({
-            id: uuid(),
+            id,
             endpoint,
-            payload,
+            // Delivery metadata is baked into the PERSISTED payload rather than
+            // added at flush time, so every retry — and every recovery after a
+            // page reload — sends a byte-identical body:
+            //
+            //   event_id  makes the server insert idempotent. Without it, a 5xx
+            //     raised after the row was already written, or a network timeout
+            //     on a request the server actually processed, lands the same
+            //     event twice: flush() only removes an entry on res.ok, so
+            //     anything else bumps retries and sends it again (MAX_RETRIES=3).
+            //     The server dedups on this via a unique index.
+            //
+            //   client_ts is when the event HAPPENED. The server used to stamp
+            //     arrival time, but the 5s flush cadence, the size-threshold
+            //     burst flush, and retries all reorder delivery freely — so
+            //     arrival order is not user order. Stamping at enqueue is the
+            //     only point that still knows the real sequence.
+            payload: { ...payload, event_id: id, client_ts: Date.now() },
             retries: 0,
         });
         // FIFO drop when over cap. Network outage edge case: if we're way

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@affiliateo/web",
-  "version": "4.6.0",
-  "description": "Affiliateo web SDK — affiliate attribution and tracking for web apps",
+  "version": "4.7.0",
+  "description": "Affiliateo web SDK \u2014 affiliate attribution and tracking for web apps",
   "main": "dist/index.js",
   "module": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -14,7 +14,7 @@
   },
   "scripts": {
     "build": "tsc",
-    "prepublishOnly": "npm run build"
+    "prepack": "npm run build"
   },
   "peerDependencies": {
     "react": ">=18.0.0"
@@ -28,7 +28,17 @@
     "@types/react": "^19.0.0",
     "typescript": "^5.0.0"
   },
-  "keywords": ["affiliateo", "affiliate", "attribution", "stripe", "web", "session", "tracking"],
+  "keywords": [
+    "affiliateo",
+    "affiliate",
+    "attribution",
+    "stripe",
+    "web",
+    "session",
+    "tracking"
+  ],
   "license": "MIT",
-  "files": ["dist"]
+  "files": [
+    "dist"
+  ]
 }