@blotoutio/providers-dataflywheel-sdk 1.75.1 → 1.76.1

package/index.mjs

@@ -1,383 +1,183 @@
-const packageName = 'dataFlywheel';
-// Browser identifiers the edge persists against the EdgeTag user id, the way
-// Facebook stores _fbp/_fbc. The identify request carries no providerData and
-// dfw_nid is third-party to the merchant, so this is n_id's only route there.
-const storedNIdKey = 'n_id';
-const storedSessionIdKey = 'session_id';
-const storedSessionExpiryKey = 'session_expires_at';
-// The same identifiers published into the EdgeTag SDK's kv store, which rides
-// on every request including identify. Namespaced the way the edge splits them
-// back apart, as Facebook does with facebook::_fbp.
-const kvKey = (key) => `${packageName}::${key}`;
-const sessionStateKeyPrefix = 'dfw_sdk_state';
-const sessionBootstrapPath = 'v1/session';
+// A network ID is 128 random bits, spelled like Qinto's IDs: `n_` and a hyphenated UUID. Earlier IDs, still in some
+// cookies and copies, are `n_<32 hex>`; they are read, and spelled the new way from then on. PlanetScale stores the UUID.
+// Same rules as qinto-apps/data-flywheel/src/nid.ts; keep the two in step.
+const NID_RE = /^n_([0-9a-f]{8})-?([0-9a-f]{4})-?([0-9a-f]{4})-?([0-9a-f]{4})-?([0-9a-f]{12})$/;
+// The ID in its current spelling, or null when the value is not a network ID.
+const toNid = (value) => {
+    const parts = typeof value === 'string' ? NID_RE.exec(value) : null;
+    return parts === null ? null : `n_${parts.slice(1).join('-')}`;
+};
 
-const keyPrefix = `_worker`;
+const packageName = 'dataFlywheel';
+// The provider's own endpoints on the merchant's EdgeTag Worker (cdn/src/lib/api.ts), named like the network Worker's:
+// /nid for approach 1, /nid1 for approach 2.
+const nidPath = '/providers/dataFlywheel/nid';
+const nidLookupPath = '/providers/dataFlywheel/nid1';
 
-const canLog = () => {
-    try {
-        return localStorage.getItem('edgeTagDebug') === '1';
-    }
-    catch {
-        return false;
-    }
-};
-const prefix = `[EdgeTag]`;
-const logger = {
-    log: (...args) => {
-        if (canLog()) {
-            console.log(prefix, ...args);
+// eslint-disable-next-line @nx/enforce-module-boundaries
+// The network ID, shared by every Data Flywheel merchant in one browser (on Qinto and EdgeTag), lives in a cookie on the
+// network domain, which the network Worker reads and keeps. The same two approaches as the Qinto app
+// (qinto-apps/data-flywheel/src/network.ts), each with its own cookie, so they can be compared:
+// - approach 1, the primary (`dfw_nid`): the Worker mints an ID on the spot, with no lookup anywhere;
+// - approach 2, the lookup (`dfw_nid_1`): the provider's endpoint on the merchant's EdgeTag Worker mints it, handing a
+//   visitor back the ID it had before, so a cleared cookie comes back the same.
+// Each merchant keeps its own copy in localStorage, with when it last checked it (`<key>_at`). A page whose copy was
+// checked in the last 7 days does nothing more: it calls neither the Worker nor the endpoint. Any other page (a first
+// visit, cleared storage, a copy from before the timestamp, or 7 days on) runs the approach, which also sets the cookie
+// again so its lifetime starts over, and checks the copy afresh. The endpoint only hears about an ID this merchant has
+// not kept before.
+const WAIT_MS = 5000;
+const RECHECK_MS = 7 * 24 * 60 * 60 * 1000;
+// Storage can be missing or refuse writes (private windows, blocked site data), which makes every page due.
+const localCache = (key, userId) => {
+    const get = () => {
+        try {
+            return toNid(localStorage.getItem(key));
         }
-    },
-    error: (...args) => {
-        if (canLog()) {
-            console.error(prefix, ...args);
+        catch {
+            return null;
         }
-    },
-    info: (...args) => {
-        if (canLog()) {
-            console.info(prefix, ...args);
+    };
+    const owned = () => {
+        try {
+            return localStorage.getItem(`${key}_uid`) === userId;
         }
-    },
-    trace: (...args) => {
-        if (canLog()) {
-            console.trace(prefix, ...args);
+        catch {
+            return false;
         }
-    },
-};
-
-const initKey = `${keyPrefix}StoreMultiple`;
-const saveKV = (destination, data) => {
-    const currentSession = getData(destination, 'session');
-    if (!currentSession['kv']) {
-        currentSession['kv'] = {};
-    }
-    currentSession['kv'] = {
-        ...currentSession['kv'],
-        ...data,
     };
-    saveData(destination, 'session', currentSession);
-};
-const saveData = (destination, persistType, value, key = initKey) => {
-    if (persistType === 'session') {
-        const data = getSession(key);
-        data[destination] = value;
-        saveSession(data, key);
-        return;
-    }
-    const data = getLocal(key);
-    data[destination] = value;
-    saveLocal(data, key);
-};
-const getData = (destination, persistType, key = initKey) => {
-    let data;
-    if (persistType === 'session') {
-        data = getSession(key);
-    }
-    else {
-        data = getLocal(key);
-    }
-    return (data === null || data === void 0 ? void 0 : data[destination]) || {};
+    return {
+        get,
+        owned,
+        set: (nId) => {
+            try {
+                localStorage.setItem(key, nId);
+                localStorage.setItem(`${key}_at`, String(Date.now()));
+                localStorage.setItem(`${key}_uid`, userId);
+            }
+            catch {
+                // nothing to keep
+            }
+        },
+        due: () => {
+            try {
+                const age = Date.now() - Number(localStorage.getItem(`${key}_at`));
+                return !owned() || get() === null || !(age >= 0 && age < RECHECK_MS);
+            }
+            catch {
+                return true;
+            }
+        },
+    };
 };
-const saveLocal = (value, key) => {
-    try {
-        if (!localStorage) {
-            return;
-        }
-        localStorage.setItem(key, JSON.stringify(value));
-    }
-    catch {
-        logger.log('Local storage not supported.');
-    }
+const withTimeout = (work) => new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error('timeout')), WAIT_MS);
+    work.then(resolve, reject).finally(() => clearTimeout(timer));
+});
+// One JSON call, answering its `nId` when it is a well-formed ID.
+const nIdOf = async (response) => {
+    const body = (await withTimeout((await withTimeout(response)).json()));
+    return toNid(body.nId);
+};
+const endpointFor = (destination, userId) => (path, init = {}) => {
+    const headers = new Headers(init.headers);
+    if (userId) {
+        headers.set('EdgeTagUserId', userId);
+    }
+    return fetch(new URL(path, destination).toString(), {
+        ...init,
+        headers,
+        credentials: 'include',
+    });
 };
-const getLocal = (key) => {
+const recorder = (endpoint, path) => async (nId) => {
+    const response = await withTimeout(endpoint(path, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ nId, pageUrl: location.href }),
+    }));
+    return ((await withTimeout(response.json())).linked ===
+        true);
+};
+const workerNetwork = (origin) => (existing) => nIdOf(fetch(`${origin}/nid${existing === null ? '' : `?existing=${existing}`}`, { credentials: 'include' }));
+const runNetworkCheck = async (network, record, cache) => {
     try {
-        if (!localStorage) {
-            return {};
-        }
-        const data = localStorage.getItem(key);
-        if (!data) {
-            return {};
+        const copy = cache.get();
+        const nId = await network(copy);
+        if (nId !== null &&
+            ((nId === copy && cache.owned()) || (await record(nId)))) {
+            cache.set(nId);
         }
-        return JSON.parse(data) || {};
     }
     catch {
-        return {};
-    }
-};
-const saveSession = (value, key) => {
+        // fails open
+    }
+};
+const workerLookup = (origin) => ({
+    read: (existing) => nIdOf(fetch(`${origin}/nid1${existing === null ? '' : `?existing=${existing}`}`, {
+        credentials: 'include',
+    })),
+    set: (nId) => nIdOf(fetch(`${origin}/nid1`, {
+        method: 'POST',
+        credentials: 'include',
+        body: JSON.stringify({ set: nId }),
+    })),
+});
+const lookupServer = (endpoint) => ({
+    lookup: () => nIdOf(endpoint(nidLookupPath)),
+    confirm: recorder(endpoint, nidLookupPath),
+});
+const runLookupCheck = async (network, server, cache) => {
     try {
-        if (!sessionStorage) {
+        const copy = cache.get();
+        const held = await network.read(copy);
+        if (held !== null) {
+            if ((held === copy && cache.owned()) || (await server.confirm(held))) {
+                cache.set(held);
+            }
             return;
         }
-        sessionStorage.setItem(key, JSON.stringify(value));
-    }
-    catch {
-        logger.log('Session storage not supported.');
-    }
-};
-const getSession = (key) => {
-    try {
-        if (!sessionStorage) {
-            return {};
-        }
-        const data = sessionStorage.getItem(key);
-        if (!data) {
-            return {};
+        const nId = await server.lookup();
+        if (nId !== null && (await network.set(nId)) === nId) {
+            cache.set(nId);
         }
-        return JSON.parse(data) || {};
     }
     catch {
-        return {};
+        // fails open
     }
 };
-
-// eslint-disable-next-line @nx/enforce-module-boundaries
-// Coalesces concurrent cold bootstraps per merchant: events firing in the same
-// tick share one in-flight /v1/session call instead of racing N handshakes.
-const inFlight = new Map();
-const memoryStates = new Map();
-const stringValue = (value) => typeof value === 'string' && value.trim() ? value.trim() : undefined;
-const numberValue = (value) => typeof value === 'number' && Number.isFinite(value) ? value : undefined;
-const isEnabledFlag = (value, defaultValue = true) => {
-    if (value == null || value === '')
-        return defaultValue;
-    return value !== '0' && value.toLowerCase() !== 'false';
-};
-const shouldBootstrap = (now, expiresAt) => expiresAt == null || now >= expiresAt;
-const browserOrigin = () => {
-    var _a, _b;
-    try {
-        if (typeof window === 'undefined')
-            return null;
-        return typeof window.origin === 'string'
-            ? window.origin
-            : (_b = (_a = window.location) === null || _a === void 0 ? void 0 : _a.origin) !== null && _b !== void 0 ? _b : null;
-    }
-    catch {
-        // If a sandbox prevents origin inspection, fail closed before issuing a
-        // credentialed request that the DFW Worker cannot safely authorize.
-        return 'null';
+const startNetworkId = (endpoint, network, userId) => {
+    const cache = localCache('dfw_nid', userId);
+    if (cache.due()) {
+        void runNetworkCheck(network, recorder(endpoint, nidPath), cache);
     }
 };
-const stateKey = (merchantId) => `${sessionStateKeyPrefix}:${merchantId}`;
-const browserStorage = () => {
-    var _a;
-    try {
-        if (typeof window === 'undefined')
-            return null;
-        return (_a = window.sessionStorage) !== null && _a !== void 0 ? _a : null;
-    }
-    catch {
-        return null;
-    }
-};
-const sessionStorageFor = (storage) => (storage === undefined ? browserStorage() : storage);
-const readSessionState = (storage, merchantId) => {
-    var _a;
-    const key = stateKey(merchantId);
-    const fallback = () => { var _a; return (_a = memoryStates.get(key)) !== null && _a !== void 0 ? _a : null; };
-    if (!storage)
-        return fallback();
-    try {
-        const raw = storage.getItem(key);
-        if (!raw)
-            return fallback();
-        const parsed = JSON.parse(raw);
-        const nId = stringValue(parsed.n_id);
-        const sessionId = stringValue(parsed.session_id);
-        const expiresAt = stringValue(parsed.expires_at);
-        if (!nId || !sessionId || !expiresAt)
-            return fallback();
-        return {
-            n_id: nId,
-            session_id: sessionId,
-            expires_at: expiresAt,
-            last_touch_at: (_a = numberValue(parsed.last_touch_at)) !== null && _a !== void 0 ? _a : 0,
-        };
-    }
-    catch {
-        return fallback();
+const startLookupNetworkId = (endpoint, network, userId) => {
+    const cache = localCache('dfw_nid_1', userId);
+    if (cache.due()) {
+        void runLookupCheck(network, lookupServer(endpoint), cache);
     }
 };
-const writeSessionState = (storage, merchantId, state) => {
-    const key = stateKey(merchantId);
-    if (!storage) {
-        memoryStates.set(key, state);
-        return;
-    }
-    try {
-        storage.setItem(key, JSON.stringify(state));
-    }
-    catch {
-        memoryStates.set(key, state);
-        // Storage can be disabled or full. The worker cookies remain authoritative.
-    }
-};
-function expiresAtMs(state) {
-    if (!state)
-        return null;
-    const expiresAt = Date.parse(state.expires_at);
-    return Number.isFinite(expiresAt) ? expiresAt : null;
-}
-// The dfw_nid cookie belongs to the DataFlywheel identity host, so the merchant's
-// edge never receives it. Publishing into the SDK's kv store puts the same values
-// on every request body instead -- identify included, which providerData is not.
-const published = new Map();
-function publishToKv(destination, state) {
-    if (!destination || !state)
-        return;
-    // saveKV rewrites the whole multi-destination blob synchronously, and the
-    // cached path runs on every event, so skip when nothing moved.
-    const last = published.get(destination);
-    if (last &&
-        last.n_id === state.n_id &&
-        last.session_id === state.session_id &&
-        last.expires_at === state.expires_at) {
+
+// Every page load: each network ID approach runs unless the merchant already keeps its copy (network.ts).
+const init = ({ manifest, destination, userId, }) => {
+    const variables = manifest.variables;
+    if (!(variables === null || variables === void 0 ? void 0 : variables.networkOrigin)) {
         return;
     }
-    published.set(destination, {
-        n_id: state.n_id,
-        session_id: state.session_id,
-        expires_at: state.expires_at,
-    });
-    try {
-        saveKV(destination, {
-            [kvKey(storedNIdKey)]: state.n_id,
-            [kvKey(storedSessionIdKey)]: state.session_id,
-            [kvKey(storedSessionExpiryKey)]: state.expires_at,
-        });
-    }
-    catch {
-        // Storage can be unavailable; the providerData and provider-key routes remain.
-    }
-}
-function bootstrapUrl(input) {
-    const base = input.dataFlywheelUrl.endsWith('/')
-        ? input.dataFlywheelUrl
-        : `${input.dataFlywheelUrl}/`;
-    const url = new URL(sessionBootstrapPath, base);
-    url.searchParams.set('merchant_id', input.merchantId);
-    const pageUrl = stringValue(input.pageUrl);
-    if (pageUrl) {
-        url.searchParams.set('page_url', pageUrl);
-    }
-    return url.toString();
-}
-function parseBootstrapResponse(body, now) {
-    var _a, _b;
-    const nId = stringValue(body.n_id);
-    const sessionId = stringValue((_a = body.session) === null || _a === void 0 ? void 0 : _a.session_id);
-    const expiresAt = stringValue((_b = body.session) === null || _b === void 0 ? void 0 : _b.expires_at);
-    if (!nId || !sessionId || !expiresAt)
-        return null;
-    return {
-        n_id: nId,
-        session_id: sessionId,
-        expires_at: expiresAt,
-        last_touch_at: now,
-    };
-}
-async function bootstrapSession(input) {
-    try {
-        const response = await input.fetcher(bootstrapUrl({
-            dataFlywheelUrl: input.dataFlywheelUrl,
-            merchantId: input.merchantId,
-            pageUrl: input.pageUrl,
-        }), { credentials: 'include' });
-        if (!response.ok)
-            return null;
-        const state = parseBootstrapResponse((await response.json()), input.now);
-        if (!state)
-            return null;
-        writeSessionState(input.storage, input.merchantId, state);
-        return state;
-    }
-    catch {
-        return null;
-    }
-}
-function ensureSession(input) {
-    var _a, _b, _c, _d;
-    const variables = (_a = input.variables) !== null && _a !== void 0 ? _a : {};
-    const dataFlywheelUrl = stringValue(variables.dataFlywheelUrl);
-    const merchantId = stringValue(variables.merchantId);
-    if (!dataFlywheelUrl ||
-        !merchantId ||
-        !isEnabledFlag(variables.dataFlywheelSessionEnabled)) {
-        return Promise.resolve(null);
+    const endpoint = endpointFor(destination, userId);
+    if (variables.nidEnabled === '1') {
+        startNetworkId(endpoint, workerNetwork(variables.networkOrigin), userId);
     }
-    const storage = sessionStorageFor(input.storage);
-    const now = (_c = (_b = input.now) === null || _b === void 0 ? void 0 : _b.call(input)) !== null && _c !== void 0 ? _c : Date.now();
-    const existing = readSessionState(storage, merchantId);
-    if (!shouldBootstrap(now, expiresAtMs(existing))) {
-        publishToKv(input.destination, existing);
-        return Promise.resolve(existing);
+    if (variables.nidLookupEnabled === '1') {
+        startLookupNetworkId(endpoint, workerLookup(variables.networkOrigin), userId);
     }
-    // Opaque origins (sandboxed iframes like Shopify pixels) serialize to the
-    // string 'null' per the HTML spec — that is what window.origin returns and
-    // what the fail-closed browserOrigin() catch emits. JS null means no window
-    // at all (non-browser host), which is not an opaque-origin sandbox.
-    if ((input.origin === undefined ? browserOrigin() : input.origin) === 'null') {
-        return Promise.resolve(null);
-    }
-    const key = stateKey(merchantId);
-    const existingBootstrap = inFlight.get(key);
-    if (existingBootstrap)
-        return existingBootstrap;
-    const fetcher = (_d = input.fetcher) !== null && _d !== void 0 ? _d : (typeof fetch === 'function' ? fetch.bind(globalThis) : null);
-    if (!fetcher)
-        return Promise.resolve(null);
-    const bootstrap = bootstrapSession({
-        dataFlywheelUrl,
-        merchantId,
-        pageUrl: input.pageUrl,
-        storage,
-        fetcher,
-        now,
-    })
-        .then((state) => {
-        publishToKv(input.destination, state);
-        return state;
-    })
-        .finally(() => {
-        inFlight.delete(key);
-    });
-    inFlight.set(key, bootstrap);
-    return bootstrap;
-}
-function toProviderData(state) {
-    if (!state)
-        return {};
-    return {
-        n_id: state.n_id,
-        session_id: state.session_id,
-        expires_at: state.expires_at,
-    };
-}
-
-const init = (params) => {
-    void ensureSession({
-        variables: params.manifest.variables,
-        pageUrl: params.pageUrl,
-        destination: params.destination,
-    });
-};
-
-const tag = async ({ manifestVariables, pageUrl, destination, }) => {
-    const state = await ensureSession({
-        variables: manifestVariables,
-        pageUrl,
-        destination,
-    });
-    return toProviderData(state);
 };
 
 // eslint-disable-next-line @nx/enforce-module-boundaries
 const data = {
     name: packageName,
     init,
-    tag,
 };
 try {
     if (typeof window !== 'undefined') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blotoutio/providers-dataflywheel-sdk",
-  "version": "1.75.1",
+  "version": "1.76.1",
   "description": "DataFlywheel browser SDK for EdgeTag",
   "author": "Blotout",
   "license": "MIT",