@affiliateo/web 4.7.0 → 4.9.0

package/dist/chat.js

@@ -0,0 +1,117 @@
+/**
+ * Live Chat (4.9.0): the chat bubble on a website that uses this package
+ * instead of the t.js snippet. Same behaviour as the snippet: once the
+ * business switches Live Chat on for this app in its Affiliateo dashboard,
+ * the bubble shows by itself. It is Affiliateo's own chat.js, loaded from the
+ * same origin as the API, so the website bubble looks and behaves the same
+ * whichever way a site installed Affiliateo.
+ *
+ * Asked once per visit: a site with the chat off is remembered for ten
+ * minutes in this tab (the same key t.js uses), so it costs one small request
+ * per visit, not per page.
+ */
+const OFF_FOR_MS = 10 * 60 * 1000;
+function chatGlobal() {
+    if (typeof window === 'undefined')
+        return undefined;
+    return window.AffiliateoChat;
+}
+export function loadLiveChat(opts) {
+    if (typeof window === 'undefined' || typeof document === 'undefined' || typeof fetch !== 'function')
+        return;
+    if (!opts.appId || chatGlobal()?.__loaded)
+        return;
+    if (document.querySelector('script[data-affiliateo-chat]'))
+        return;
+    const offKey = `affiliateo_chat_off:${opts.appId}`;
+    try {
+        const off = sessionStorage.getItem(offKey);
+        if (off && Date.now() - Number(off) < OFF_FOR_MS)
+            return;
+    }
+    catch {
+        /* storage refused: ask */
+    }
+    fetch(`${opts.apiBase}/api/live-chat/config?app=${encodeURIComponent(opts.appId)}`)
+        .then((r) => (r.ok ? r.json() : null))
+        .then((config) => {
+        if (!config || !config.enabled) {
+            try {
+                sessionStorage.setItem(offKey, String(Date.now()));
+            }
+            catch {
+                /* storage refused */
+            }
+            opts.log('chat: off for this app');
+            return;
+        }
+        if (chatGlobal()?.__loaded || document.querySelector('script[data-affiliateo-chat]'))
+            return;
+        const script = document.createElement('script');
+        script.src = `${opts.apiBase}/chat.js`;
+        script.async = true;
+        script.setAttribute('data-affiliateo-chat', '');
+        script.setAttribute('data-app', opts.appId);
+        if (opts.visitorId)
+            script.setAttribute('data-visitor', opts.visitorId);
+        if (opts.userId)
+            script.setAttribute('data-user', opts.userId.slice(0, 128));
+        if (opts.bubble === 'hidden')
+            script.setAttribute('data-bubble', 'hidden');
+        if (opts.theme)
+            script.setAttribute('data-theme', opts.theme);
+        const look = opts.look;
+        if (look?.color)
+            script.setAttribute('data-color', look.color);
+        if (look?.iconColor)
+            script.setAttribute('data-icon-color', look.iconColor);
+        if (look?.sendColor)
+            script.setAttribute('data-send-color', look.sendColor);
+        if (look?.placeholder)
+            script.setAttribute('data-placeholder', look.placeholder.slice(0, 60));
+        if (look?.style)
+            script.setAttribute('data-style', look.style);
+        if (look?.corner)
+            script.setAttribute('data-corner', look.corner);
+        if (look?.size)
+            script.setAttribute('data-size', String(look.size));
+        (document.head || document.documentElement).appendChild(script);
+        opts.log('chat: loading the bubble');
+    })
+        .catch(() => opts.log('chat: config check failed (network)'));
+}
+/** Open the chat window, from your own button. Does nothing while the chat is off or still loading. */
+export function openChat() {
+    chatGlobal()?.open?.();
+}
+/** Close the chat window. */
+export function closeChat() {
+    chatGlobal()?.close?.();
+}
+/** Show the chat bubble (after hideChatBubble, or with chat="hidden"). */
+export function showChatBubble() {
+    chatGlobal()?.show?.();
+}
+/** Hide the chat bubble, and close the window. */
+export function hideChatBubble() {
+    chatGlobal()?.hide?.();
+}
+/**
+ * The person signed out (logout(), reset()): their chat goes, so whoever
+ * signs in next starts a new thread. The token chat.js keeps goes from
+ * localStorage even while chat.js is still loading; once it has loaded, it
+ * also closes the window and clears the red number.
+ */
+export function forgetLiveChat(appId) {
+    if (typeof window === 'undefined')
+        return;
+    if (appId) {
+        try {
+            localStorage.removeItem(`affiliateo_chat_token:${appId}`);
+        }
+        catch {
+            /* storage refused */
+        }
+    }
+    chatGlobal()?.__forget?.();
+}

package/dist/index.d.ts

@@ -1,2 +1,3 @@
 export { AffiliateoProvider, useAffiliateRef, getAttribution } from './provider';
-export type { AffiliateoConfig, AffiliateoContextValue } from './types';
+export { openChat, closeChat, showChatBubble, hideChatBubble } from './chat';
+export type { AffiliateoConfig, AffiliateoContextValue, ChatLook } from './types';

package/dist/index.js

@@ -1,2 +1,3 @@
 'use client';
 export { AffiliateoProvider, useAffiliateRef, getAttribution } from './provider';
+export { openChat, closeChat, showChatBubble, hideChatBubble } from './chat';

package/dist/provider.d.ts

@@ -18,6 +18,6 @@ export declare function useAffiliateRef(): AffiliateoContextValue;
  * ```
  */
 export declare function getAttribution(): Record<string, string>;
-export declare function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames, allowLocalhost, allowIframe, allowFileProtocol, debug, flushInterval, maxQueueSize, autoCapturePageviews, children, }: AffiliateoConfig & {
+export declare function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames, allowLocalhost, allowIframe, allowFileProtocol, debug, flushInterval, maxQueueSize, autoCapturePageviews, chat, chatLook, children, }: AffiliateoConfig & {
     children: React.ReactNode;
 }): import("react/jsx-runtime").JSX.Element;

package/dist/provider.js

@@ -5,6 +5,8 @@ import { EventQueue } from './queue';
 import { isLikelyBot } from './bot-detect';
 import { isDevHost } from './dev-host';
 import { mintTurnstileToken, consumeTurnstileToken } from './turnstile';
+import { usableUserId } from './user-id';
+import { forgetLiveChat, loadLiveChat } from './chat';
 const DEFAULT_API_URL = 'https://affiliateo.com';
 const LS_VISITOR_ID = 'affiliateo_visitor_id';
 const LS_REF = 'affiliateo_ref';
@@ -12,11 +14,16 @@ const LS_REF = 'affiliateo_ref';
 // write the same key, and renaming it would orphan existing visitors'
 // attribution mid-session.
 const LS_APP_ID = 'affiliateo_campaign_id';
-// Persistent opt-out flag (affiliateo_opt_out) —
+// Persistent opt-out flag (affiliateo_opt_out) -
 // when set to "true" the SDK silently noops every outbound call. Survives
 // page reloads. removed by optIn(). Checked at init time so a previously
 // opted-out visitor never re-fires auto-pageviews after a refresh.
 const LS_OPT_OUT = 'affiliateo_opt_out';
+// Who is signed in (4.8.0), and the visit it was last sent in, so the SDK
+// re-sends it once per visit instead of on every page load. Same keys as
+// public/t.js, so a site that runs both keeps one record.
+const LS_USER_ID = 'affiliateo_user_id';
+const LS_USER_SENT = 'affiliateo_user_sent';
 // Client-owned session id. The BROWSER owns the session,
 // not the server. One id is reused for every event within a sliding
 // 10-minute activity window, then a fresh one is minted. Because the id is
@@ -126,6 +133,7 @@ const AffiliateoContext = createContext({
     identify: asyncNoop,
     trackPageview: asyncNoop,
     reset: asyncNoop,
+    logout: asyncNoop,
     optOut: syncNoop,
     optIn: syncNoop,
     flush: asyncNoop,
@@ -158,7 +166,7 @@ export function getAttribution() {
         data.affiliateo_visitor_id = vid;
     if (ref)
         data.affiliateo_ref = ref;
-    // Key renamed from affiliateo_campaign_id in 4.5.0 — the Affiliateo
+    // Key renamed from affiliateo_campaign_id in 4.5.0 - the Affiliateo
     // webhook accepts both, so checkouts created by older SDKs keep working.
     if (cid)
         data.affiliateo_app_id = cid;
@@ -180,7 +188,7 @@ let providerMountCount = 0;
  * touching it there throws a ReferenceError rather than reading undefined.
  *
  * UNKNOWN COUNTS AS NOT-PRODUCTION, deliberately. The only caller is the
- * double-mount warning, and a double mount double-fires every pageview — which
+ * double-mount warning, and a double mount double-fires every pageview - which
  * corrupts the merchant's own numbers and the affiliate attribution built on
  * them. One stray console line on an unbundled production page is a smaller
  * cost than silently letting that run.
@@ -188,7 +196,7 @@ let providerMountCount = 0;
 function isProductionBuild() {
     return typeof process !== 'undefined' && process?.env?.NODE_ENV === 'production';
 }
-export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames, allowLocalhost, allowIframe, allowFileProtocol, debug, flushInterval, maxQueueSize, autoCapturePageviews, children, }) {
+export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames, allowLocalhost, allowIframe, allowFileProtocol, debug, flushInterval, maxQueueSize, autoCapturePageviews, chat, chatLook, children, }) {
     // Normalize autoCapturePageviews. Three shapes:
     //   - undefined / true / object → auto-capture ON (with object overrides)
     //   - false → auto-capture OFF entirely (host must call trackPageview)
@@ -215,6 +223,7 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
         identify: asyncNoop,
         trackPageview: asyncNoop,
         reset: asyncNoop,
+        logout: asyncNoop,
         optOut: syncNoop,
         optIn: syncNoop,
         flush: asyncNoop,
@@ -222,7 +231,7 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
     // Debug logger. Closes over the `debug` prop so flipping it on/off at
     // runtime (e.g. by changing a feature flag) takes effect on the next
     // render without remounting. eslint-disable for the intentional
-    // console.log — that's the whole point of this helper.
+    // console.log - that's the whole point of this helper.
     const log = useCallback((msg, data) => {
         if (!debug)
             return;
@@ -248,7 +257,7 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
     // forcing the methods (track / identify / trackPageview) to depend
     // on it for useCallback equality. Initialized inside the route
     // effect since EventQueue's constructor touches localStorage and
-    // window — both unavailable during SSR. Methods called before init
+    // window - both unavailable during SSR. Methods called before init
     // (during the first render, before useEffect runs) silently noop;
     // this is fine because methods are only ever called from event
     // handlers, which fire after mount.
@@ -283,7 +292,7 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
                 // Page context, same three fields the pageview sender carries.
                 // A goal event used to go out without them, and the server's
                 // `path || hostname || '[Web]'` fallback then overwrote the
-                // visitor's real current_page with the literal string '[Web]' —
+                // visitor's real current_page with the literal string '[Web]' -
                 // which both broke the tracking-page popover and made the visitor
                 // invisible to any funnel step matching on a page path. The server
                 // no longer clobbers on missing values, but sending the real path
@@ -297,44 +306,90 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
                 payload.metadata = metadata;
             // Enqueue. EventQueue handles persist, retry, and flush. If the
             // queue hasn't initialized yet (called during first render before
-            // useEffect runs), this noops — that's a vanishingly rare race
+            // useEffect runs), this noops - that's a vanishingly rare race
             // since track() is virtually always called from a click handler.
             queueRef.current?.enqueue(`${apiBase}/api/v1/web/event`, payload);
             log('track', { event: name, metadata });
         }
         catch { /* swallow */ }
     }, [apiBase, log]);
-    // identify(userId). user_id only — the SDK does NOT accept, collect,
-    // or transmit email or any other PII. Cross-device stitching uses the
-    // merchant's own user_id; we never touch identifying personal data.
+    // identify(userId): say who is signed in (4.8.0). The server keeps one
+    // customer per person per app: a sign-in makes this browser that person's
+    // (folded in with their phone and other browsers), and a DIFFERENT user
+    // signing in here switches the browser to them. user_id only - the SDK
+    // does NOT accept, collect, or transmit email or any other PII.
+    //
+    // The id is stored and re-sent once per visit (the 10-minute session
+    // above), on mount, so the server stays in step without a request on
+    // every page load. Ids that mean "nobody" are skipped (user-id.ts), and
+    // nothing is sent while opted out. A 400 is not retried (queue.ts).
     const identify = useCallback(async (userId) => {
         try {
             if (typeof window === 'undefined')
                 return;
-            if (isOptedOut())
-                return;
-            if (!userId || typeof userId !== 'string')
+            if (isOptedOut()) {
+                log('identify skipped: opted out');
                 return;
-            const uid = userId.trim();
-            // Cap at 128 chars (matches the server). Covers every common
-            // foreign user-id shape: uuid, ulid, mongo objectId, auth0 sub,
-            // firebase uid, supabase uuid.
-            if (!uid || uid.length > 128)
+            }
+            const uid = usableUserId(userId);
+            if (!uid) {
+                log('identify skipped: not a user id (empty, over 128 characters, or a placeholder like "null", "guest" or "0")', { user_id: userId });
                 return;
+            }
+            lsSet(LS_USER_ID, uid);
             const cid = appIdRef.current;
             const vid = visitorIdRef.current;
-            if (!cid || !vid)
+            const queue = queueRef.current;
+            // Not tracking yet: the stored id goes out with the next mount.
+            if (!cid || !vid || !queue)
                 return;
-            const payload = {
+            const mark = `${vid} ${getSessionId()} ${uid}`;
+            if (lsGet(LS_USER_SENT) === mark) {
+                log('identify: already sent this visit', { user_id: uid });
+                return;
+            }
+            lsSet(LS_USER_SENT, mark);
+            // A sign-out still waiting in the queue is replaced by this sign-in;
+            // delivered after it, it would sign the new person out again.
+            const logoutEndpoint = `${apiBase}/api/v1/web/logout`;
+            queue.drop((e) => e.endpoint === logoutEndpoint && e.payload.visitor_id === vid);
+            queue.enqueue(`${apiBase}/api/v1/web/identify`, {
                 campaign_id: cid,
                 visitor_id: vid,
                 user_id: uid,
-            };
-            queueRef.current?.enqueue(`${apiBase}/api/v1/web/identify`, payload);
+            });
             log('identify', { user_id: uid });
         }
         catch { /* swallow */ }
     }, [apiBase, log]);
+    // logout(): the person signed out (4.8.0). POST /api/v1/web/logout: the
+    // browser starts over as a new anonymous customer of the app, so whoever
+    // signs in next (or nobody) is not counted as the person who just left,
+    // and everything already recorded stays with them. Forgets the stored
+    // user id and their Live Chat. The visitor id, the affiliate ref, the
+    // session and tracking itself all carry on unchanged.
+    const logout = useCallback(async () => {
+        try {
+            if (typeof window === 'undefined')
+                return;
+            log('logout');
+            lsRemove(LS_USER_ID);
+            lsRemove(LS_USER_SENT);
+            forgetLiveChat(appIdRef.current);
+            if (isOptedOut())
+                return;
+            const cid = appIdRef.current;
+            const vid = visitorIdRef.current;
+            const queue = queueRef.current;
+            if (!cid || !vid || !queue)
+                return;
+            queue.enqueue(`${apiBase}/api/v1/web/logout`, { campaign_id: cid, visitor_id: vid });
+            // Sign-out usually comes right before a redirect, so send it now.
+            // Still queued if this fails: the next page load delivers it.
+            await queue.flush();
+        }
+        catch { /* swallow */ }
+    }, [apiBase, log]);
     // Manual pageview via trackPageview(path?). Same payload
     // shape the auto-fired pageview uses (see sendPageview inside the route
     // effect below) so server-side routing / dedup / IP+UA enrichment behave
@@ -375,7 +430,7 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
                 utm_source: params.get('utm_source') || '',
                 utm_medium: params.get('utm_medium') || '',
                 utm_campaign: params.get('utm_campaign') || '',
-                // Ad-network click ids — set automatically on the landing URL by
+                // Ad-network click ids - set automatically on the landing URL by
                 // every Meta/TikTok/Google ad click. Label the sale's source and
                 // feed server-side conversion matching.
                 fbclid: params.get('fbclid') || '',
@@ -398,7 +453,7 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
     // batches and auto-flushes every 5s; this is the escape hatch for the
     // "I'm about to redirect, don't lose my events" case.
     //
-    // Resolves when the underlying queue.flush() completes — success OR
+    // Resolves when the underlying queue.flush() completes - success OR
     // failure. Events that fail to deliver stay in the queue and get
     // retried on the next normal flush cycle. Safe to await; never throws.
     const flush = useCallback(async () => {
@@ -408,49 +463,23 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
         }
         catch { /* swallow */ }
     }, [log]);
-    // reset(): wipe visitor identity. Mints a fresh UUID and clears the
-    // affiliate ref so the next pageview is a brand-new anonymous visitor.
-    // The campaign_id stays (it's a property of the site, not the visitor).
-    //
-    // reset() semantics for non-cookieless mode: new
-    // visitor, no event fired, caller handles "tell the server about it"
-    // by triggering whatever pageview / navigation comes next.
-    //
-    // Returns a Promise so callers can `await reset()` before navigating
-    // (the localStorage writes are sync but the Promise lets the API stay
-    // an async signature, future-proofing for
-    // server-minted IDs in cookieless mode).
-    const reset = useCallback(async () => {
-        try {
-            if (typeof window === 'undefined')
-                return;
-            // Drain any pending events for the OLD visitor before swapping IDs,
-            // otherwise they'd land server-side stamped to the OLD visitor_id
-            // (correct) but persisted-in-localStorage as if to-be-retried under
-            // the new identity — confusing on retry inspection. Best effort.
-            void queueRef.current?.flush();
-            queueRef.current?.clear();
-            const newVid = uuid();
-            lsSet(LS_VISITOR_ID, newVid);
-            lsRemove(LS_REF);
-            lsRemove(LS_SESSION);
-            visitorIdRef.current = newVid;
-            setState((prev) => ({ ...prev, visitorId: newVid, refCode: null }));
-        }
-        catch { /* swallow */ }
-    }, []);
+    // reset(): the same as logout() since 4.8.0. It used to mint a fresh
+    // visitor id and clear the affiliate ref and session, which split one
+    // person's history into two visitors and lost their affiliate. Kept so
+    // existing integrations keep compiling and now get the sign-out they meant.
+    const reset = logout;
     // optOut(): persistent "don't track me" flag. After this call every
     // track / identify / trackPageview noops until optIn() is called. The
     // flag survives reloads via localStorage, so a visitor who opts out
     // stays opted out across browser sessions on the same device.
     //
-    // We don't actively send a "stop tracking me" signal to the server —
+    // We don't actively send a "stop tracking me" signal to the server -
     // the server only knows about visitors who ping it, so an opted-out
     // visitor simply stops appearing. The visitor row left behind in
     // Postgres ages out via normal retention.
     const optOut = useCallback(() => {
         lsSet(LS_OPT_OUT, 'true');
-        // Drop pending events too. The visitor explicitly said no — sending
+        // Drop pending events too. The visitor explicitly said no - sending
         // queued events from before the opt-out would still violate consent
         // even if those events were captured prior to the user's decision.
         queueRef.current?.clear();
@@ -464,13 +493,26 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
         lsRemove(LS_OPT_OUT);
     }, []);
     const sentRef = useRef(false);
+    // Boot configuration, read once when the queue and the listeners are
+    // constructed. A ref kept current on every render rather than four more
+    // dependencies: listing them would tear the whole pipeline down and
+    // rebuild it whenever a host re-renders with a new inline object, and
+    // shutdown() drops the in-memory queue, so honoring the rule that way
+    // would cost real events. A host that needs different settings should
+    // remount the provider. (Hosts run React 18, so this is the latest-ref
+    // pattern rather than useEffectEvent.)
+    const bootRef = useRef({ flushInterval, maxQueueSize, allowFileProtocol, autoCfg });
+    useEffect(() => {
+        bootRef.current = { flushInterval, maxQueueSize, allowFileProtocol, autoCfg };
+    });
     useEffect(() => {
         if (typeof window === 'undefined')
             return;
-        // Neither appId nor the legacy campaignId alias was passed — nothing to
+        const { flushInterval, maxQueueSize, allowFileProtocol, autoCfg } = bootRef.current;
+        // Neither appId nor the legacy campaignId alias was passed - nothing to
         // attribute events to, so stay dormant instead of firing junk.
         if (!appIdRef.current) {
-            console.error('[Affiliateo] Missing appId — pass your app ID to <AffiliateoProvider appId="...">.');
+            console.error('[Affiliateo] Missing appId - pass your app ID to <AffiliateoProvider appId="...">.');
             return;
         }
         // Mount-count warning. Fires only when more than one Provider has
@@ -483,7 +525,7 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
         // Client-side bot detection. If the current browser context looks
         // like Selenium / Puppeteer / curl / a known automation tool, skip
         // ALL tracking before we even mint a queue. The server-side UA
-        // regex + Turnstile catch anything that sneaks past this check —
+        // regex + Turnstile catch anything that sneaks past this check -
         // this just saves the bot a round-trip and saves us a request.
         //
         // The hook still returns the four control methods (reset / optOut /
@@ -499,6 +541,7 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
                 identify: asyncNoop,
                 trackPageview: asyncNoop,
                 reset: asyncNoop,
+                logout: asyncNoop,
                 optOut: syncNoop,
                 optIn: syncNoop,
                 flush: asyncNoop,
@@ -523,6 +566,7 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
                 identify: asyncNoop,
                 trackPageview: asyncNoop,
                 reset: asyncNoop,
+                logout: asyncNoop,
                 optOut: syncNoop,
                 optIn: syncNoop,
                 flush: asyncNoop,
@@ -541,6 +585,7 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
                 identify: asyncNoop,
                 trackPageview: asyncNoop,
                 reset: asyncNoop,
+                logout: asyncNoop,
                 optOut: syncNoop,
                 optIn: syncNoop,
                 flush: asyncNoop,
@@ -575,6 +620,7 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
                     identify: asyncNoop,
                     trackPageview: asyncNoop,
                     reset: asyncNoop,
+                    logout: asyncNoop,
                     optOut: syncNoop,
                     optIn: syncNoop,
                     flush: asyncNoop,
@@ -583,8 +629,8 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
             }
         }
         // Initialize the event queue. Done inside useEffect (not in a useRef
-        // initializer) so the EventQueue constructor — which touches
-        // localStorage on hydration — only ever runs client-side. The queue
+        // initializer) so the EventQueue constructor - which touches
+        // localStorage on hydration - only ever runs client-side. The queue
         // takes over delivery for track / identify / trackPageview AND the
         // auto-fired pageview below; only session_end stays on sendBeacon
         // because tab-close urgency beats queue-retry reliability.
@@ -613,9 +659,9 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
             setState({
                 refCode: null,
                 visitorId: optedOutVid,
-                track, identify, trackPageview, reset, optOut, optIn, flush,
+                track, identify, trackPageview, reset, logout, optOut, optIn, flush,
             });
-            // Don't leave a queue running for an opted-out visitor — the timer
+            // Don't leave a queue running for an opted-out visitor - the timer
             // would just keep waking up to flush nothing.
             queue.shutdown();
             queueRef.current = null;
@@ -673,9 +719,13 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
         setState({
             refCode: ref,
             visitorId: vid,
-            track, identify, trackPageview, reset, optOut, optIn, flush,
+            track, identify, trackPageview, reset, logout, optOut, optIn, flush,
         });
         log('init', { app: appIdRef.current, visitor: vid, ref: ref || null });
+        // This visit's re-send of the signed-in user (see identify).
+        const storedUser = usableUserId(lsGet(LS_USER_ID));
+        if (storedUser)
+            void identify(storedUser);
         // lastSendTime drives the visibility-refire heuristic below (refire a
         // pageview when a tab returns after the session window). Duplicate
         // suppression itself is the persisted same-URL throttle inside
@@ -708,7 +758,7 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
             ended = false;
             // Attach the (single-use) Turnstile token to the session-opening
             // pageview. consumeTurnstileToken() returns null after the first
-            // consume, so SPA navigations go out bare — the server trusts them
+            // consume, so SPA navigations go out bare - the server trusts them
             // because the visitor row was created behind the verified token.
             const tsToken = consumeTurnstileToken();
             queue.enqueue(endpoint, {
@@ -739,7 +789,7 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
         // directly. The queue's fetch-with-keepalive is great for normal
         // events because it returns a status code we can retry on, but it
         // can't guarantee the request lands when the tab is in the act of
-        // closing — fetch may be aborted mid-flight. sendBeacon was
+        // closing - fetch may be aborted mid-flight. sendBeacon was
         // designed exactly for this case and CANNOT be cancelled by the
         // unload handler. We also try to drain the queue's pending events
         // here, which uses sendBeacon under the hood for the same reason.
@@ -772,7 +822,7 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
             }
         }
         // Server-side session window. Matches STALE_VISITOR_MS in the
-        // tracking Durable Object — after this much idle time the server
+        // tracking Durable Object - after this much idle time the server
         // treats the visitor as a new session, rotates session_id, and
         // expects a fresh pageview to anchor the new visit in
         // campaign_events. Without that anchor, funnel steps starting on
@@ -789,7 +839,7 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
                 // If the SDK's last pageview was longer ago than the server's
                 // 10-min session window, the server has already rolled the
                 // visitor over to a new session_id. Refire pageview so the new
-                // session has a proper anchor — otherwise the next scroll /
+                // session has a proper anchor - otherwise the next scroll /
                 // click / custom event arrives orphaned and the funnel overlay
                 // sees the visitor enter "mid-funnel" (e.g. on a scroll step)
                 // without ever passing through the page-step that should
@@ -812,7 +862,7 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
             //
             // sentRef is set HERE (not before the mint) so a StrictMode
             // double-mount can't mark the pageview as sent and then tear down the
-            // queue before the deferred send ever ran — the surviving mount's
+            // queue before the deferred send ever ran - the surviving mount's
             // callback sees sentRef still false and fires.
             if (cancelled)
                 return;
@@ -971,20 +1021,33 @@ export function AffiliateoProvider({ appId, campaignId, apiUrl, allowedHostnames
                 document.removeEventListener('keydown', onKeydownForLinkDecoration, true);
             }
             // Stop the queue's flush timer. The queue tries one final flush
-            // before going quiet — anything still queued lives in localStorage
+            // before going quiet - anything still queued lives in localStorage
             // and will be picked up by the next page load's queue init.
             queue.shutdown();
             queueRef.current = null;
             providerMountCount = Math.max(0, providerMountCount - 1);
         };
-        // flushInterval, maxQueueSize, allowFileProtocol and the autoCfg.* fields
-        // are BOOT configuration, read once when the queue and listeners are
-        // constructed. Listing them would tear the whole pipeline down and rebuild
-        // it whenever a host app re-renders with a new inline object, and
-        // shutdown() drops the in-memory queue — so honoring the rule here would
-        // cost real events. A host that needs different settings should remount
-        // the provider.
+        // The boot configuration comes off bootRef above, so this list is what
+        // legitimately rebuilds the pipeline.
+    }, [apiBase, allowedHostnames, allowLocalhost, allowIframe, log, track, identify, trackPageview, reset, logout, optOut, optIn, flush]);
+    // Live Chat (4.9.0, chat.ts). After the tracking effect above has read or
+    // minted the visitor id, so the inbox can name the visitor. Neither the
+    // visitor nor the signed-in user goes along while tracking is opted out.
+    useEffect(() => {
+        if (chat === false || !resolvedAppId)
+            return;
+        const optedOut = isOptedOut();
+        loadLiveChat({
+            apiBase,
+            appId: resolvedAppId,
+            visitorId: optedOut ? null : visitorIdRef.current ?? lsGet(LS_VISITOR_ID),
+            userId: optedOut ? null : usableUserId(lsGet(LS_USER_ID)),
+            bubble: chat === 'hidden' ? 'hidden' : 'visible',
+            look: chatLook,
+            log,
+        });
+        // The look is read when the bubble loads.
         // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, [apiBase, allowedHostnames, allowLocalhost, allowIframe, log, track, identify, trackPageview, reset, optOut, optIn, flush]);
+    }, [chat, resolvedAppId, apiBase, log]);
     return (_jsx(AffiliateoContext.Provider, { value: state, children: children }));
 }

package/dist/queue.d.ts

@@ -85,16 +85,20 @@ export declare class EventQueue {
      *  flush at a time. */
     flush(): Promise<void>;
     /** Best-effort sync flush triggered on page unload. Uses sendBeacon
-     *  for each event so it survives the tab closing. No retry — this is
+     *  for each event so it survives the tab closing. No retry - this is
      *  the last chance.
      *
      *  Called from the provider's pagehide / visibilitychange=hidden
      *  handlers so any events still queued at unload get one last shot.
      *  After this call, the in-memory queue is cleared (events that
-     *  sendBeacon couldn't queue are lost — that's the cost of the
+     *  sendBeacon couldn't queue are lost - that's the cost of the
      *  guaranteed-fast unload path). */
     flushOnUnload(): void;
-    /** Wipe the queue. Called by reset() and optOut(). Removes the
+    /** Remove the queued events `predicate` picks (4.8.0). A sign-in uses it
+     *  to drop a sign-out still waiting to be delivered: the sign-in replaces
+     *  it, and a sign-out retried after it would undo it. */
+    drop(predicate: (event: QueuedEvent) => boolean): void;
+    /** Wipe the queue. Called by optOut(). Removes the
      *  localStorage entry entirely so a reload doesn't re-hydrate the
      *  wiped events. */
     clear(): void;