@cartbase/storefront 0.7.0 → 0.9.0

package/src/checkout/shipping-method-list.tsx

@@ -3,7 +3,7 @@
 import type { StorefrontClient } from "../api/http"
 import type { StoreShippingOption } from "../api/checkout"
 import type { BoxNowLocker } from "../api/integrations"
-import { DualPrice } from "../lib/dual-price"
+import { Price } from "../lib/price"
 import { cn } from "../lib/utils"
 import { useCheckoutLabels } from "./context"
 import {
@@ -273,7 +273,7 @@ export function CheckoutShippingMethodList({
                       isFree ? (
                         labels.shippingFree
                       ) : (
-                        <DualPrice amount={price} currencyCode={currencyCode} />
+                        <Price amount={price} currencyCode={currencyCode} />
                       )
                     ) : isLoadingPrices ? (
                       <svg

package/src/lib/cookie-names.ts

@@ -39,3 +39,48 @@ export function readCartCookie(
 ): string | undefined {
   return get(CART_COOKIE) ?? get(LEGACY_CART_COOKIE)
 }
+
+/**
+ * THE VISITOR ID — our own per-browser id and the join key between browsing
+ * and money (ecommerce-analytics §3.1). It is OURS deliberately: the
+ * analytics engine is swappable, so a key owned by the engine would couple
+ * the whole platform to it.
+ *
+ * Written by the injected storefront proxy in a `Set-Cookie` header, never
+ * by `document.cookie`, and that is not a style preference: Safari's ITP
+ * caps JavaScript-written cookies at 7 days while server-set first-party
+ * cookies live up to 400. A JS-written id makes every returning Safari
+ * visitor read as new after a week.
+ */
+export const VISITOR_COOKIE = "_cartbase_visitor"
+
+/** @deprecated Pre-rename name — read-only compat, never written. */
+export const LEGACY_VISITOR_COOKIE = "_1c_anon"
+
+/** First-touch UTM tuple, written once, 365 days. */
+export const UTM_FIRST_COOKIE = "_cartbase_utm_first"
+/** @deprecated Pre-rename name — read-only compat, never written. */
+export const LEGACY_UTM_FIRST_COOKIE = "_1c_utm_first"
+
+/** Last-touch UTM tuple, rewritten on every UTM-bearing visit, 90 days. */
+export const UTM_LAST_COOKIE = "_cartbase_utm_last"
+/** @deprecated Pre-rename name — read-only compat, never written. */
+export const LEGACY_UTM_LAST_COOKIE = "_1c_utm_last"
+
+/** Known-visitor marker (localStorage, not a cookie). */
+export const KNOWN_VISITOR_KEY = "_cartbase_visitor_v1"
+/** @deprecated Pre-rename key — read-only compat, never written. */
+export const LEGACY_KNOWN_VISITOR_KEY = "_1c_visitor_v1"
+
+/**
+ * Read a value preferring the current name and falling back to the legacy
+ * one, so a visitor who arrived before the rename keeps their identity and
+ * their attribution instead of being counted as somebody new.
+ */
+export function readRenamedCookie(
+  get: (name: string) => string | undefined,
+  current: string,
+  legacy: string
+): string | undefined {
+  return get(current) ?? get(legacy)
+}

package/src/lib/money.ts

@@ -2,7 +2,7 @@
  * Money utilities — pure, side-effect-free currency formatting helpers.
  *
  * Extracted from mindpages-storefront src/lib/util/money.ts + isEmpty.ts.
- * Used by DualPrice and any other price rendering in the library.
+ * Used by Price and any other price rendering in the library.
  */
 
 function isEmpty(value: unknown): boolean {

package/src/lib/platform.ts

@@ -0,0 +1,13 @@
+/**
+ * The platform's origin (one key, store-birth-and-doors item 6, 2026-09-07):
+ * a constant, not an input. Every Cartbase store's API lives here; a
+ * storefront overrides it only to point at a local or staging platform
+ * (`NEXT_PUBLIC_CARTBASE_URL`), never to find its own store, which the
+ * publishable key does.
+ */
+export const CARTBASE_API_ORIGIN = "https://admin.cartbase.ai"
+
+/** The origin to call: the override when set, else the platform. */
+export function cartbaseApiOrigin(override?: string | null): string {
+  return (override && override.trim()) || CARTBASE_API_ORIGIN
+}

package/src/lib/price.tsx

@@ -0,0 +1,39 @@
+import * as React from "react"
+
+import { convertToLocale } from "./money"
+
+/**
+ * Price — render an amount in its own currency, and nothing else.
+ *
+ * Replaces `DualPrice` (deleted 2026-09-13, Alexander: "clean and clear
+ * the dual pricing"). That component appended a grey BGN leg to every EUR
+ * price for Bulgaria's euro-changeover disclosure rule, with the statutory
+ * 1.95583 rate baked in. Cartbase prices in EUR (see the EUR-only law) and
+ * the second currency belongs to a store's own locale work if it ever
+ * wants one, not to every price in the library.
+ *
+ * Stateless and side-effect-free, so it renders in server and client
+ * components alike, and it is deliberately NOT a client component: the old
+ * one carried "use client" for no reason, which pulled every price
+ * rendering into the client bundle.
+ *
+ * @example
+ *   <Price amount={19.99} currencyCode="eur" />   // "€19.99"
+ */
+
+export type PriceProps = {
+  /** Amount in major units of the currency (19.99 for €19.99). */
+  amount: number
+  /** ISO currency code, case-insensitive. */
+  currencyCode: string
+  /** Class for the span. */
+  className?: string
+}
+
+export function Price({ amount, currencyCode, className }: PriceProps): React.ReactElement {
+  return (
+    <span className={className}>
+      {convertToLocale({ amount, currency_code: currencyCode })}
+    </span>
+  )
+}

package/src/lib/visitor.ts

@@ -0,0 +1,74 @@
+import { VISITOR_COOKIE, LEGACY_VISITOR_COOKIE } from "./cookie-names"
+
+/**
+ * THE VISITOR'S TWO IDS. One module, because three copies of a cookie read
+ * had already appeared across the package and a fourth was about to.
+ *
+ *  - The VISITOR id is the durable one. It is written by the platform's
+ *    injected proxy as a `Set-Cookie` on the very first request, which is
+ *    what makes it survive: Safari caps a cookie written by JavaScript at
+ *    seven days, so a returning visitor read from a JS-written id looks new
+ *    every week. It is the join key between a browsing session and the cart
+ *    and order it becomes.
+ *  - The TAB SESSION id is per tab and dies with it. Two tabs are two
+ *    sessions, which is what a merchant counting live visitors sees on
+ *    their own screen.
+ */
+
+/**
+ * Reads the platform's first-party visitor cookie, preferring the current
+ * name and falling back to the pre-rename one. Server-side there is no
+ * document, and callers pass the value explicitly instead.
+ */
+export function readVisitorId(): string | undefined {
+  if (typeof document === "undefined") return undefined
+  for (const name of [VISITOR_COOKIE, LEGACY_VISITOR_COOKIE]) {
+    const match = document.cookie.match(new RegExp(`(?:^|; )${name}=([^;]*)`))
+    if (match) return decodeURIComponent(match[1])
+  }
+  return undefined
+}
+
+const TAB_SESSION_KEY = "_cartbase_live_session"
+
+function randomId(): string {
+  return typeof crypto !== "undefined" && typeof crypto.randomUUID === "function"
+    ? crypto.randomUUID()
+    : `${Date.now().toString(36)}${Math.random().toString(36).slice(2, 10)}`
+}
+
+/**
+ * One id per tab, shared by the heartbeat and the pageview tracker so the
+ * live count and the traffic report are talking about the same sessions.
+ */
+export function getTabSessionId(): string {
+  try {
+    const existing = window.sessionStorage.getItem(TAB_SESSION_KEY)
+    if (existing) return existing
+    const id = randomId()
+    window.sessionStorage.setItem(TAB_SESSION_KEY, id)
+    return id
+  } catch {
+    // Private mode with storage blocked: a per-mount id still produces an
+    // honest count, it just does not survive a reload.
+    return randomId()
+  }
+}
+
+/**
+ * True when the platform's injected collector is already running on this
+ * page. It claims the flag synchronously, before hydration, so any React
+ * component that checks this on mount sees a settled answer.
+ *
+ * Why it exists: every deployed storefront gets the collector injected at
+ * deploy time, and the scaffold ALSO mounts <StorefrontTags>. Without this
+ * check every store built from the scaffold would count every pageview
+ * twice, which is the kind of defect that looks like growth.
+ */
+export function platformCollectorPresent(): boolean {
+  try {
+    return Boolean((window as unknown as { __cartbase_collector?: unknown }).__cartbase_collector)
+  } catch {
+    return false
+  }
+}

package/src/order/order-delivery-card.tsx

@@ -1,5 +1,5 @@
 import { ExternalLink, MapPin, PackageSearch, Truck } from "lucide-react"
-import { DualPrice } from "../lib/dual-price"
+import { Price } from "../lib/price"
 import type { StoreOrderFulfillment } from "../api/orders"
 import { defaultOrderLabels, type OrderLabels } from "./labels"
 
@@ -245,7 +245,7 @@ function ShippingMethodRow({
       {amount === 0 ? (
         <span className="text-sm font-medium text-success">{labels.free}</span>
       ) : (
-        <DualPrice
+        <Price
           amount={amount}
           currencyCode={currencyCode}
           className="text-sm font-medium text-foreground"

package/src/order/order-item.tsx

@@ -1,6 +1,6 @@
 import Image from "next/image"
 import { ImageOff } from "lucide-react"
-import { DualPrice } from "../lib/dual-price"
+import { Price } from "../lib/price"
 import type { StoreOrderItem } from "../api/orders"
 import { defaultOrderLabels, type OrderLabels } from "./labels"
 
@@ -177,14 +177,14 @@ export function OrderItem({ item, currencyCode, labels }: OrderItemProps) {
           <div className="text-right flex-shrink-0">
             {hasDiscount && (
               <span className="text-xs text-muted-foreground line-through block leading-none mb-0.5">
-                <DualPrice
+                <Price
                   amount={item.originalTotal ?? 0}
                   currencyCode={currencyCode}
                   className="text-xs text-muted-foreground"
                 />
               </span>
             )}
-            <DualPrice
+            <Price
               amount={item.total}
               currencyCode={currencyCode}
               className={`text-sm font-bold ${

package/src/order/order-totals.tsx

@@ -1,4 +1,4 @@
-import { DualPrice } from "../lib/dual-price"
+import { Price } from "../lib/price"
 import { findFeeLine, type LineLike } from "../lib/cart-helpers"
 import { defaultOrderLabels, type OrderLabels } from "./labels"
 
@@ -217,14 +217,14 @@ export function OrderTotals({
             ) : row.negative ? (
               <span className="text-sm text-success">
                 -{" "}
-                <DualPrice
+                <Price
                   amount={row.amount}
                   currencyCode={currencyCode}
                   className="text-sm text-success"
                 />
               </span>
             ) : (
-              <DualPrice
+              <Price
                 amount={row.amount}
                 currencyCode={currencyCode}
                 className="text-sm text-foreground"
@@ -237,7 +237,7 @@ export function OrderTotals({
       <div className="h-px bg-border my-3" />
       <div className="flex justify-between items-baseline">
         <span className="text-[15px] font-bold text-foreground">{l.total}</span>
-        <DualPrice
+        <Price
           amount={total}
           currencyCode={currencyCode}
           className="text-xl font-bold text-foreground tracking-tight"

package/src/tracking/attribution.ts

@@ -1,5 +1,16 @@
 "use client"
 
+import {
+  KNOWN_VISITOR_KEY,
+  LEGACY_KNOWN_VISITOR_KEY,
+  LEGACY_UTM_FIRST_COOKIE,
+  LEGACY_UTM_LAST_COOKIE,
+  LEGACY_VISITOR_COOKIE,
+  UTM_FIRST_COOKIE,
+  UTM_LAST_COOKIE,
+  VISITOR_COOKIE,
+} from "../lib/cookie-names"
+
 /**
  * Self-managed Facebook attribution helpers.
  *
@@ -29,10 +40,13 @@
 
 const FBP_COOKIE = "_fbp"
 const FBC_COOKIE = "_fbc"
-const ANON_ID_COOKIE = "_1c_anon"
-const KNOWN_VISITOR_LS = "_1c_visitor_v1"
-const UTM_FIRST_COOKIE = "_1c_utm_first"
-const UTM_LAST_COOKIE = "_1c_utm_last"
+
+// The visitor id and the UTM tuples moved into THE cookie registry
+// (cookie-names.ts) with the platform prefix, 2026-09-04. Every read
+// prefers the new name and falls back to the pre-rename one, so a visitor
+// who arrived earlier keeps their identity instead of being counted as new.
+const ANON_ID_COOKIE = VISITOR_COOKIE
+const KNOWN_VISITOR_LS = KNOWN_VISITOR_KEY
 
 /** _fbp / _fbc TTL per Meta spec — 90 days first-party. */
 const FB_COOKIE_TTL_DAYS = 90
@@ -157,7 +171,7 @@ export function getOrCreateFbc(): string | undefined {
  * it to cart.metadata for the order.placed subscriber.
  */
 export function getOrCreateAnonId(): string | undefined {
-  const existing = getCookie(ANON_ID_COOKIE)
+  const existing = getCookie(ANON_ID_COOKIE) ?? getCookie(LEGACY_VISITOR_COOKIE)
   if (existing) return existing
   if (!isBrowser()) return undefined
 
@@ -192,7 +206,9 @@ export function getKnownVisitor(): KnownVisitor {
   let stored: KnownVisitor = {}
   if (isBrowser()) {
     try {
-      const raw = window.localStorage.getItem(KNOWN_VISITOR_LS)
+      const raw =
+        window.localStorage.getItem(KNOWN_VISITOR_LS) ??
+        window.localStorage.getItem(LEGACY_KNOWN_VISITOR_KEY)
       if (raw) stored = JSON.parse(raw) as KnownVisitor
     } catch {
       // localStorage unavailable / parse error — return empty
@@ -373,8 +389,8 @@ function readUtmsFromSearch(search: string): CapturedUtms | null {
 /** Read + parse one of the two UTM cookies. Defensive — malformed JSON
  *  or shape drift returns null so the caller treats it as missing
  *  instead of crashing. */
-function readUtmsCookie(name: string): CapturedUtms | null {
-  const raw = getCookie(name)
+function readUtmsCookie(name: string, legacy?: string): CapturedUtms | null {
+  const raw = getCookie(name) ?? (legacy ? getCookie(legacy) : undefined)
   if (!raw) return null
   try {
     const parsed = JSON.parse(decodeURIComponent(raw)) as Partial<CapturedUtms>
@@ -420,7 +436,7 @@ export function captureUtmsFromUrl(): void {
   // First-touch: write only when the cookie is currently absent.
   // Re-arriving with a fresh UTM does NOT overwrite the original
   // acquisition record — that's the whole point of "first-touch".
-  if (!readUtmsCookie(UTM_FIRST_COOKIE)) {
+  if (!readUtmsCookie(UTM_FIRST_COOKIE, LEGACY_UTM_FIRST_COOKIE)) {
     writeUtmsCookie(UTM_FIRST_COOKIE, utms, UTM_FIRST_TTL_DAYS)
   }
   // Last-touch: always overwrite when the URL carries UTMs. Refreshes
@@ -436,7 +452,7 @@ export function captureUtmsFromUrl(): void {
  * cookies() API) instead — this function is browser-only.
  */
 export function getCapturedFirstTouchUtms(): CapturedUtms | null {
-  return readUtmsCookie(UTM_FIRST_COOKIE)
+  return readUtmsCookie(UTM_FIRST_COOKIE, LEGACY_UTM_FIRST_COOKIE)
 }
 
 /**
@@ -446,99 +462,112 @@ export function getCapturedFirstTouchUtms(): CapturedUtms | null {
  * this is browser-only.
  */
 export function getCapturedLastTouchUtms(): CapturedUtms | null {
-  return readUtmsCookie(UTM_LAST_COOKIE)
+  return readUtmsCookie(UTM_LAST_COOKIE, LEGACY_UTM_LAST_COOKIE)
+}
+
+// ── Ad-click identifiers ─────────────────────────────────────────────
+//
+// Meta's `fbclid` is folded into the `_fbc` cookie above by Meta's own
+// format. TikTok's and Google's click ids have no such carrier, and both
+// platforms need them:
+//
+//   ttclid  appended by TikTok to the landing URL on an ad click.
+//           Without it TikTok cannot tie a conversion back to the click
+//           that caused it, which is the reporting an advertiser checks
+//           first. Forwarded to the Events API as `user.ttclid`.
+//   _ttp    a first-party cookie the TikTok pixel writes ITSELF once
+//           first-party cookies are enabled in pixel settings. We never
+//           write it, only read it; forwarded as `user.ttp`.
+//   gclid   Google's standard click id.
+//   gbraid  iOS app-to-web variant.
+//   wbraid  iOS web-to-web variant.
+//
+// A Google campaign can deliver any one of those three, so capturing
+// gclid alone silently loses iOS traffic — the traffic most likely to be
+// missing a cookie in the first place.
+//
+// Write-once semantics deliberately do NOT apply: a newer click of the
+// same kind overwrites, because the most recent click is what the ad
+// platforms attribute to. What must never happen is a later ORGANIC
+// visit clearing the click that acquired the visitor, and that is why
+// each cookie is only touched when its parameter is actually present.
+
+const TTCLID_COOKIE = "_1c_ttclid"
+const GCLID_COOKIE = "_1c_gclid"
+const GBRAID_COOKIE = "_1c_gbraid"
+const WBRAID_COOKIE = "_1c_wbraid"
+/**
+ * OpenAI's click id, from `oppref` on the landing URL.
+ *
+ * Their own SDK stores the same parameter in a first-party `__oppref`
+ * cookie at init, and we capture it here anyway: the Conversions API takes
+ * `oppref` on the server event explicitly, and this module runs on the
+ * landing page whether or not their script loaded or was consented to. Ours
+ * is the one the server reads.
+ */
+const OPPREF_COOKIE = "_1c_oppref"
+
+/** TikTok's ttclid lifetime follows the CTA window in Attribution
+ *  Manager; Google's conversion window tops out at 90 days. One TTL
+ *  covers both, and each platform applies its own window on top and
+ *  ignores anything older. */
+const CLICK_ID_TTL_DAYS = 90
+
+/** Cookie name → the URL parameter it is captured from. */
+const CLICK_ID_CAPTURE: ReadonlyArray<readonly [string, string]> = [
+  [TTCLID_COOKIE, "ttclid"],
+  [GCLID_COOKIE, "gclid"],
+  [GBRAID_COOKIE, "gbraid"],
+  [WBRAID_COOKIE, "wbraid"],
+  [OPPREF_COOKIE, "oppref"],
+]
+
+/**
+ * The cookies the click ids live in, and the flat `order.metadata` keys
+ * the checkout writeback maps them onto. `ttp` is in the list because it
+ * is READ from TikTok's own cookie; it is never written here.
+ */
+export const CLICK_ID_COOKIES = {
+  ttclid: TTCLID_COOKIE,
+  gclid: GCLID_COOKIE,
+  gbraid: GBRAID_COOKIE,
+  wbraid: WBRAID_COOKIE,
+  ttp: "_ttp",
+  oppref: OPPREF_COOKIE,
+} as const
+
+/** cookie name → order.metadata key (code truth for the server side:
+ *  `TrackingAttributionMeta` in src/lib/tracking/constants.ts). */
+export const CLICK_ID_METADATA_KEYS: ReadonlyArray<readonly [string, string]> = [
+  [CLICK_ID_COOKIES.ttclid, "tt_ttclid"],
+  [CLICK_ID_COOKIES.ttp, "tt_ttp"],
+  [CLICK_ID_COOKIES.gclid, "google_gclid"],
+  [CLICK_ID_COOKIES.gbraid, "google_gbraid"],
+  [CLICK_ID_COOKIES.wbraid, "google_wbraid"],
+  [CLICK_ID_COOKIES.oppref, "oai_oppref"],
+]
+
+/**
+ * Capture every ad-click identifier present on the current URL.
+ *
+ * Idempotent and safe to call on every mount, next to
+ * `captureUtmsFromUrl()`: a URL carrying no click id leaves every
+ * existing cookie untouched.
+ */
+export function captureClickIdsFromUrl(): void {
+  if (!isBrowser()) return
+
+  let params: URLSearchParams
+  try {
+    params = new URLSearchParams(window.location.search)
+  } catch {
+    return
+  }
+
+  for (const [cookieName, param] of CLICK_ID_CAPTURE) {
+    const raw = params.get(param)
+    if (raw && raw.trim().length > 0) {
+      setCookie(cookieName, encodeURIComponent(raw.trim()), CLICK_ID_TTL_DAYS)
+    }
+  }
 }
-
-// ── Ad-click identifiers ─────────────────────────────────────────────
-//
-// Meta's `fbclid` is folded into the `_fbc` cookie above by Meta's own
-// format. TikTok's and Google's click ids have no such carrier, and both
-// platforms need them:
-//
-//   ttclid  appended by TikTok to the landing URL on an ad click.
-//           Without it TikTok cannot tie a conversion back to the click
-//           that caused it, which is the reporting an advertiser checks
-//           first. Forwarded to the Events API as `user.ttclid`.
-//   _ttp    a first-party cookie the TikTok pixel writes ITSELF once
-//           first-party cookies are enabled in pixel settings. We never
-//           write it, only read it; forwarded as `user.ttp`.
-//   gclid   Google's standard click id.
-//   gbraid  iOS app-to-web variant.
-//   wbraid  iOS web-to-web variant.
-//
-// A Google campaign can deliver any one of those three, so capturing
-// gclid alone silently loses iOS traffic — the traffic most likely to be
-// missing a cookie in the first place.
-//
-// Write-once semantics deliberately do NOT apply: a newer click of the
-// same kind overwrites, because the most recent click is what the ad
-// platforms attribute to. What must never happen is a later ORGANIC
-// visit clearing the click that acquired the visitor, and that is why
-// each cookie is only touched when its parameter is actually present.
-
-const TTCLID_COOKIE = "_1c_ttclid"
-const GCLID_COOKIE = "_1c_gclid"
-const GBRAID_COOKIE = "_1c_gbraid"
-const WBRAID_COOKIE = "_1c_wbraid"
-
-/** TikTok's ttclid lifetime follows the CTA window in Attribution
- *  Manager; Google's conversion window tops out at 90 days. One TTL
- *  covers both, and each platform applies its own window on top and
- *  ignores anything older. */
-const CLICK_ID_TTL_DAYS = 90
-
-/** Cookie name → the URL parameter it is captured from. */
-const CLICK_ID_CAPTURE: ReadonlyArray<readonly [string, string]> = [
-  [TTCLID_COOKIE, "ttclid"],
-  [GCLID_COOKIE, "gclid"],
-  [GBRAID_COOKIE, "gbraid"],
-  [WBRAID_COOKIE, "wbraid"],
-]
-
-/**
- * The cookies the click ids live in, and the flat `order.metadata` keys
- * the checkout writeback maps them onto. `ttp` is in the list because it
- * is READ from TikTok's own cookie; it is never written here.
- */
-export const CLICK_ID_COOKIES = {
-  ttclid: TTCLID_COOKIE,
-  gclid: GCLID_COOKIE,
-  gbraid: GBRAID_COOKIE,
-  wbraid: WBRAID_COOKIE,
-  ttp: "_ttp",
-} as const
-
-/** cookie name → order.metadata key (code truth for the server side:
- *  `TrackingAttributionMeta` in src/lib/tracking/constants.ts). */
-export const CLICK_ID_METADATA_KEYS: ReadonlyArray<readonly [string, string]> = [
-  [CLICK_ID_COOKIES.ttclid, "tt_ttclid"],
-  [CLICK_ID_COOKIES.ttp, "tt_ttp"],
-  [CLICK_ID_COOKIES.gclid, "google_gclid"],
-  [CLICK_ID_COOKIES.gbraid, "google_gbraid"],
-  [CLICK_ID_COOKIES.wbraid, "google_wbraid"],
-]
-
-/**
- * Capture every ad-click identifier present on the current URL.
- *
- * Idempotent and safe to call on every mount, next to
- * `captureUtmsFromUrl()`: a URL carrying no click id leaves every
- * existing cookie untouched.
- */
-export function captureClickIdsFromUrl(): void {
-  if (!isBrowser()) return
-
-  let params: URLSearchParams
-  try {
-    params = new URLSearchParams(window.location.search)
-  } catch {
-    return
-  }
-
-  for (const [cookieName, param] of CLICK_ID_CAPTURE) {
-    const raw = params.get(param)
-    if (raw && raw.trim().length > 0) {
-      setCookie(cookieName, encodeURIComponent(raw.trim()), CLICK_ID_TTL_DAYS)
-    }
-  }
-}

package/src/tracking/chatgpt-pixel.tsx

@@ -0,0 +1,92 @@
+"use client"
+
+import Script from "next/script"
+
+import { CONSENT_COOKIE } from "./consent"
+import { jsStringLiteral } from "./inline-script"
+
+/**
+ * ChatGptPixel — the OpenAI measurement pixel, the ChatGPT Ads twin of
+ * <MetaPixel> and <TikTokPixel>.
+ *
+ * The loader is OpenAI's own, verbatim from
+ * https://developers.openai.com/ads/measurement-pixel: a command queue on
+ * `window.oaiq` that buffers calls until the SDK arrives from
+ * bzrcdn.openai.com, injected with `<Script strategy="afterInteractive">`.
+ *
+ * CONSENT IS CLOSED BEFORE INIT, and that order is the whole point. Their
+ * consent default is TRUE, so an unconsented visitor is measured unless we
+ * say otherwise first:
+ *
+ *     oaiq("consent", false)   // queued BEFORE init — no pings
+ *     oaiq("init", { pixelId })
+ *     oaiq("consent", true)    // only once the visitor accepted
+ *
+ * The script is LOADED either way, like the Meta and TikTok gates beside
+ * it, so a later grant costs no round trip. But the page view is fired
+ * only AFTER a grant, and that is deliberate rather than cautious: their
+ * docs state that with consent false the pixel sends no measurement
+ * pings, and they do NOT document whether a call made while consent was
+ * false is released on a later grant. TikTok documents exactly that
+ * (`holdConsent` queues, `grantConsent` flushes) and our TikTok gate
+ * relies on it. Nothing here relies on behaviour OpenAI has not written
+ * down: an unconsented page view is not sent, and not counted on later.
+ *
+ * The decision is read from the shared `_1c_consent` cookie inside the
+ * snippet, before anything can be sent, and live changes arrive through
+ * `applyConsent()` in ./consent.ts — there is no cookie watcher.
+ *
+ * The page view is ours to fire at all: their pixel sends nothing at init,
+ * unlike Meta's and TikTok's base code.
+ *
+ * Their SDK also captures `oppref` off the landing URL into a first-party
+ * `__oppref` cookie by itself. Our attribution module captures the same
+ * parameter into `_1c_oppref` independently, so the server-side
+ * Conversions API event can carry the click even on a visit where this
+ * script never loaded at all.
+ *
+ * Renders nothing when `pixelId` is falsy, so a layout can mount it
+ * unconditionally.
+ */
+export function ChatGptPixel({ pixelId }: { pixelId?: string }) {
+  if (!pixelId) return null
+
+  const id = jsStringLiteral(pixelId)
+
+  const initSnippet = `
+(function (w, d, s, u) {
+  if (w.oaiq) return;
+  var q = function () { q.q.push(arguments); };
+  q.q = [];
+  w.oaiq = q;
+  var js = d.createElement(s);
+  js.async = true;
+  js.src = u;
+  var f = d.getElementsByTagName(s)[0];
+  f.parentNode.insertBefore(js, f);
+})(window, document, "script", "https://bzrcdn.openai.com/sdk/oaiq.min.js");
+
+oaiq("consent", false);
+oaiq("init", { pixelId: ${id} });
+
+(function (d) {
+  var ads = false;
+  try {
+    var m = d.cookie.match(/(?:^|; )${CONSENT_COOKIE}=([^;]*)/);
+    if (m) { ads = !!JSON.parse(decodeURIComponent(m[1])).ads; }
+  } catch (e) {}
+  if (ads) {
+    oaiq("consent", true);
+    oaiq("measure", "page_viewed", { type: "contents" });
+  }
+})(document);
+`.trim()
+
+  return (
+    <Script
+      id="chatgpt-pixel-init"
+      strategy="afterInteractive"
+      dangerouslySetInnerHTML={{ __html: initSnippet }}
+    />
+  )
+}