@buildbase/sdk 0.0.58 → 0.0.60

package/CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.0.60] - 2026-08-29
+
+### Fixed
+
+- **`coerceBadgeRef` is now actually exported from `/react`.** The 0.0.59 notes below said it was, and it was not: it reached only the package's internal badge index, so the import those notes told you to write failed to resolve. If you followed them, upgrade - there is no workaround on 0.0.59. `BadgeHrefOptions` is exported alongside it, since the badge's `params` prop is typed against it. Nothing else changed; `<BuildBaseBadge />`, `refCode` and `params` behave exactly as they did in 0.0.59.
+
+## [0.0.59] - 2026-08-29
+
+### Added
+
+- **`<BuildBaseBadge refCode="..." />` — the badge can now credit whoever installed it.** Set `refCode` and the badge links to `buildbase.app/?utm_source=badge&utm_medium=<variant>&ref=<code>`, so visits it sends are attributable to you. The code is coerced, not validated - lowercased, narrowed to `a-z0-9-_`, truncated at 64 - because this runs in the render path of your footer: a code with a space in it should cost the attribution, never throw inside your layout. An unusable code falls back to the plain badge link. `coerceBadgeRef` is exported if you want to show a user what their code will become.
+
+  **The prop is `refCode`, not `ref`, and that is not a style choice.** React 18 intercepts a prop named `ref` and never passes it to a function component, and React 18 is still in this package's peer range - so a prop spelled `ref` would work on React 19 and silently send no attribution for every React 18 consumer, with the badge still rendering perfectly. The query param is `ref`; only the prop is renamed.
+
+  `refCode` sets `ref` and nothing else. It deliberately does not also set `utm_campaign`: a referral is _who sent someone_, a campaign is _which piece of marketing they clicked_, and writing one from the other turns campaign reporting into a list of customer names.
+
+- **`params` — put anything else you need on the badge's link.** A plain object of key/value pairs appended verbatim: your own analytics params, a campaign, a click id, anything. Nothing is filtered for being unrecognised, keys and values are encoded so there is no character to avoid, and `null` / `undefined` entries are skipped so you can build the object conditionally. They are written last, so they can deliberately override the badge's own `utm_source` / `utm_medium` - your URL, your naming scheme.
+
+### Changed
+
+- **The badge's anchor drops `noreferrer` and keeps `noopener`.** `noopener` is the half that carries the security value; `noreferrer` additionally strips the `Referer` header, which meant every install that never set `refCode` sent us traffic that could not be attributed to the site it came from. No behaviour changes on the host page.
+
 ## [0.0.58] - 2026-08-29
 
 ### Added