@affiliateo/web 4.7.0 → 4.8.0

package/dist/turnstile.js

@@ -2,13 +2,13 @@
  * Cloudflare Turnstile token minting. Mirrors the hosted t.js tracker:
  * mint ONE invisible token at SDK init and attach it to the first pageview.
  * The server verifies the token before creating the visitor row (and before
- * counting a pay-per-click web_traffic click — the billable path REQUIRES a
+ * counting a pay-per-click web_traffic click - the billable path REQUIRES a
  * genuine pass when TURNSTILE_SECRET is configured). Subsequent events from
  * the same visitor_id are trusted because the row was created behind a
  * verified token, so the cost is one mint + one verify per session.
  *
  * Tokens are single-use at Cloudflare's siteverify, so consumeToken()
- * hands the token out exactly once — re-sending a used token would get the
+ * hands the token out exactly once - re-sending a used token would get the
  * event rejected server-side, not warn-allowed.
  *
  * Failure modes: if the Turnstile script is blocked (ad blockers, strict
@@ -17,20 +17,20 @@
  * those through; commission-on-sale (web_affiliate) tracking never depends
  * on the token at all.
  */
-// Public sitekey (safe to expose) — the same one public/t.js ships. The
+// Public sitekey (safe to expose) - the same one public/t.js ships. The
 // matching secret lives in TURNSTILE_SECRET on the server.
 const TURNSTILE_SITEKEY = '0x4AAAAAADR5UW2x6axFd13p';
 const TURNSTILE_SCRIPT_SRC = 'https://challenges.cloudflare.com/turnstile/v0/api.js?onload=__affiliateoTSLoaded&render=explicit';
 // Hard deadline for the whole mint (script load + challenge). t.js relies on
 // Turnstile's own timeout-callback, but a script tag that never loads never
-// fires ANY callback — this timer makes sure the first pageview can't be
+// fires ANY callback - this timer makes sure the first pageview can't be
 // held hostage by a blocked challenges.cloudflare.com.
 const MINT_TIMEOUT_MS = 3000;
 let token = null;
 let minting = null;
 /**
  * Load the Turnstile script (once) and run the invisible challenge. Resolves
- * when a token is available OR the mint failed/timed out — never rejects, so
+ * when a token is available OR the mint failed/timed out - never rejects, so
  * callers can unconditionally `.then(sendPageview)`.
  */
 export function mintTurnstileToken() {
@@ -60,7 +60,7 @@ export function mintTurnstileToken() {
                 document.body.appendChild(holder);
                 window.turnstile.render(holder, {
                     sitekey: TURNSTILE_SITEKEY,
-                    // Invisible widget — never shows UI. Real browsers pass the
+                    // Invisible widget - never shows UI. Real browsers pass the
                     // challenge in 50-200ms with zero user interaction.
                     size: 'invisible',
                     callback: (tok) => {

package/dist/types.d.ts

@@ -1,9 +1,9 @@
 export interface AffiliateoConfig {
-    /** Your Affiliateo app ID — shown in the dashboard when you create a
+    /** Your Affiliateo app ID - shown in the dashboard when you create a
      *  Web App Affiliate app. One of `appId` / `campaignId` is required;
      *  `appId` wins when both are set. */
     appId?: string;
-    /** @deprecated Affiliateo campaigns are now called apps — use `appId`.
+    /** @deprecated Affiliateo campaigns are now called apps - use `appId`.
      *  Kept working so existing integrations don't break. */
     campaignId?: string;
     /** Base URL for the API. Defaults to https://affiliateo.com */
@@ -55,7 +55,7 @@ export interface AffiliateoConfig {
      *  true, the SDK logs every action it takes (init, pageview fired,
      *  goal tracked, blocked by bot detection, blocked by localhost, queue
      *  flush attempted, etc.). Only the merchant or anyone manually opening
-     *  DevTools sees these — normal visitors never look at the console.
+     *  DevTools sees these - normal visitors never look at the console.
      *
      *  Turn on temporarily when investigating "why aren't my events
      *  showing up?". Leave off in production.
@@ -121,7 +121,14 @@ export interface AffiliateoContextValue {
      *  both events resolve to the same user_id and the funnel reports a
      *  single converted person.
      *
-     *  Idempotent: safe to call on every page load. user_id only —
+     *  Since 4.8.0 a different user signing in on this browser switches it
+     *  to them (it used to be refused). The SDK stores the id and re-sends it
+     *  once per visit; calling it again in the same visit sends nothing. Does
+     *  nothing while opted out, and skips ids that mean "nobody" ("null",
+     *  "undefined", "guest", "0", RevenueCat's $RCAnonymousID:...) that the
+     *  server would refuse.
+     *
+     *  Idempotent: safe to call on every page load. user_id only -
      *  the SDK does not accept or transmit email or any other PII.
      *
      *  Example:
@@ -142,22 +149,24 @@ export interface AffiliateoContextValue {
      *      useEffect(() => { if (open) trackPageview('/pricing-modal') }, [open])
      *    } */
     trackPageview: (path?: string) => Promise<void>;
-    /** Wipe the visitor identity. Mints a fresh visitor_id and clears the
-     *  affiliate ref + campaign_id from localStorage so the next pageview
-     *  is treated as a brand-new anonymous visitor.
-     *
-     *  Use case: call on user logout so a different person sitting down at
-     *  the same browser doesn't get their actions merged into the previous
-     *  user's funnel. Without this, shared family computers / kiosks /
-     *  hot-desks silently pollute attribution.
+    /** The user signed out (4.8.0). Call it on sign-out: this browser starts
+     *  over as a new anonymous customer of the app, so whoever signs in next
+     *  (or nobody) is not counted as the person who just left, and everything
+     *  already recorded stays with them. Forgets the stored user id. The
+     *  visitor id, the affiliate ref and tracking carry on unchanged.
      *
      *  Example:
-     *    const { reset } = useAffiliateRef()
+     *    const { logout } = useAffiliateRef()
      *    async function handleLogout() {
      *      await supabase.auth.signOut()
-     *      await reset()
+     *      await logout()
      *      router.push('/')
      *    } */
+    logout: () => Promise<void>;
+    /** The same as logout() since 4.8.0. It used to mint a fresh visitor id
+     *  and clear the affiliate ref, which split one person into two visitors
+     *  and lost their affiliate. Kept as an alias so existing integrations
+     *  get the sign-out they meant. */
     reset: () => Promise<void>;
     /** Stop tracking this visitor. Sets a persistent opt-out flag in
      *  localStorage and silences all subsequent track / identify / pageview
@@ -196,7 +205,7 @@ export interface AffiliateoContextValue {
      *    }
      *
      *  Returns a Promise that resolves when the flush attempt completes
-     *  (success OR failure — failed events stay in the queue for the next
+     *  (success OR failure - failed events stay in the queue for the next
      *  flush). Safe to await without timeout concerns. */
     flush: () => Promise<void>;
 }

package/dist/user-id.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Which user ids may name a signed-in person (4.8.0).
+ *
+ * Every device that signs in with the same user id becomes ONE customer of
+ * the app on Affiliateo's side, so an id that really means "nobody" ("null",
+ * "undefined", "guest", "0") would merge every stranger whose site sent it
+ * into one person. The server refuses these with a 400; this is the same
+ * list, checked here so a wrong call is skipped (and says so with
+ * debug={true}) instead of costing a request.
+ *
+ * KEEP IN SYNC with src/lib/customers/user-id.ts in the Affiliateo web repo,
+ * and with public/t.js, which the vanilla snippet loads.
+ */
+export declare const MAX_USER_ID_LENGTH = 128;
+/** The trimmed id when it can name a person, otherwise null. A number (a
+ *  database row id passed straight through) is read as its digits, the way
+ *  the server reads it. */
+export declare function usableUserId(value: unknown): string | null;

package/dist/user-id.js

@@ -0,0 +1,40 @@
+/**
+ * Which user ids may name a signed-in person (4.8.0).
+ *
+ * Every device that signs in with the same user id becomes ONE customer of
+ * the app on Affiliateo's side, so an id that really means "nobody" ("null",
+ * "undefined", "guest", "0") would merge every stranger whose site sent it
+ * into one person. The server refuses these with a 400; this is the same
+ * list, checked here so a wrong call is skipped (and says so with
+ * debug={true}) instead of costing a request.
+ *
+ * KEEP IN SYNC with src/lib/customers/user-id.ts in the Affiliateo web repo,
+ * and with public/t.js, which the vanilla snippet loads.
+ */
+export const MAX_USER_ID_LENGTH = 128;
+const NOT_A_USER = new Set([
+    'null', '(null)', '<null>', 'nil', 'none', 'no', 'undefined', 'unidentified',
+    'unknown', 'anonymous', 'anon', 'guest', 'nan', 'false', 'true',
+    '0', '-1', '[]', '{}', '[object object]',
+]);
+/** The trimmed id when it can name a person, otherwise null. A number (a
+ *  database row id passed straight through) is read as its digits, the way
+ *  the server reads it. */
+export function usableUserId(value) {
+    let raw;
+    if (typeof value === 'string')
+        raw = value;
+    else if (typeof value === 'number' && Number.isFinite(value))
+        raw = String(value);
+    else
+        return null;
+    const id = raw.trim();
+    if (id.length < 1 || id.length > MAX_USER_ID_LENGTH)
+        return null;
+    if (NOT_A_USER.has(id.toLowerCase()))
+        return null;
+    // RevenueCat's own anonymous id names an install, not a user.
+    if (id.startsWith('$RCAnonymousID:'))
+        return null;
+    return id;
+}

package/package.json

@@ -1,44 +1,46 @@
-{
-  "name": "@affiliateo/web",
-  "version": "4.7.0",
-  "description": "Affiliateo web SDK \u2014 affiliate attribution and tracking for web apps",
-  "main": "dist/index.js",
-  "module": "dist/index.js",
-  "types": "dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js",
-      "require": "./dist/index.js"
-    }
-  },
-  "scripts": {
-    "build": "tsc",
-    "prepack": "npm run build"
-  },
-  "peerDependencies": {
-    "react": ">=18.0.0"
-  },
-  "peerDependenciesMeta": {
-    "react": {
-      "optional": true
-    }
-  },
-  "devDependencies": {
-    "@types/react": "^19.0.0",
-    "typescript": "^5.0.0"
-  },
-  "keywords": [
-    "affiliateo",
-    "affiliate",
-    "attribution",
-    "stripe",
-    "web",
-    "session",
-    "tracking"
-  ],
-  "license": "MIT",
-  "files": [
-    "dist"
-  ]
-}
+{
+  "name": "@affiliateo/web",
+  "version": "4.8.0",
+  "description": "Affiliateo web SDK: affiliate attribution and tracking for web apps",
+  "main": "dist/index.js",
+  "module": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "prebuild": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "prepack": "npm run build"
+  },
+  "peerDependencies": {
+    "react": ">=18.0.0"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/react": "^19.0.0",
+    "typescript": "^5.0.0"
+  },
+  "keywords": [
+    "affiliateo",
+    "affiliate",
+    "attribution",
+    "stripe",
+    "web",
+    "session",
+    "tracking"
+  ],
+  "license": "MIT",
+  "files": [
+    "dist"
+  ]
+}