@moonbase.sh/storefront-api 3.7.0 → 3.8.0

package/README.md

@@ -24,7 +24,7 @@ Configuration notes:
 
 - `endpoint`: your Moonbase storefront URL.
 - `includeManifests`: include downloadable file manifests when available.
-- `persistUtm`: store detected UTM values in localStorage instead of sessionStorage.
+- `persistUtm`: store detected UTM values and ad click IDs in localStorage instead of sessionStorage.
 
 ## Common usage
 
@@ -172,6 +172,38 @@ refused with `CaptchaRequiredError` (a `MoonbaseError`). A site with a
 Content-Security-Policy has to allow the store's `https://<account-id>.moonbase.sh`
 in `frame-src`.
 
+### Where a customer came from
+
+Pass the UTM tags, ad click IDs and referrer the visitor arrived with, the same
+shape orders take, so the merchant can see how the customer was acquired:
+
+```ts
+import { parseOffSiteReferrer } from '@moonbase.sh/storefront-api'
+
+const params = new URLSearchParams(window.location.search)
+
+await client.identity.signUp('Jane', 'jane@example.com', 'password', null, true, true, true, {
+  utm: {
+    source: params.get('utm_source') || undefined,
+    campaign: params.get('utm_campaign') || undefined,
+    // Click IDs ad platforms add to the link, often with no UTM tags beside them.
+    gclid: params.get('gclid') || undefined,
+    fbclid: params.get('fbclid') || undefined,
+    msclkid: params.get('msclkid') || undefined,
+    ttclid: params.get('ttclid') || undefined,
+    // The referring site's host only, and nothing when the visitor came from this site.
+    referrer: parseOffSiteReferrer(document.referrer, window.location.origin),
+  },
+})
+```
+
+Fields left out are not sent. The click IDs (`gclid`, `gbraid` and `wbraid` from
+Google Ads, `fbclid` from Meta, `msclkid` from Microsoft Advertising and `ttclid`
+from TikTok) go to the API under those names, and the rest as `utm_*`.
+`useAuth().signUp` in `@moonbase.sh/vue`, and so the storefront widget, fills this
+in from the tags and click IDs it has already picked up, unless you pass your own
+`utm`.
+
 ## Inventory flow
 
 Most inventory endpoints require an authenticated user:
@@ -191,6 +223,14 @@ while (page.hasMore && page.next) {
 }
 ```
 
+A product's release history needs no sign-in. `getReleases` lists its published releases, highest
+version first, each with its version, release notes, publish date and files, and whether the caller
+may download it (`downloadsAllowed`). It pages the same way:
+
+```ts
+const releases = await client.inventory.products.getReleases('my-product')
+```
+
 ## Endpoint groups
 
 `client.storefront`, `client.identity`, `client.orders`, `client.vouchers`, `client.inventory`, `client.activationRequests`, `client.vendor`, `client.communications`, `client.groups`.

package/dist/index.cjs

@@ -120,7 +120,13 @@ function utmToObject(utm) {
     utm_campaign: utm == null ? void 0 : utm.campaign,
     utm_term: utm == null ? void 0 : utm.term,
     utm_content: utm == null ? void 0 : utm.content,
-    utm_referrer: utm == null ? void 0 : utm.referrer
+    utm_referrer: utm == null ? void 0 : utm.referrer,
+    gclid: utm == null ? void 0 : utm.gclid,
+    gbraid: utm == null ? void 0 : utm.gbraid,
+    wbraid: utm == null ? void 0 : utm.wbraid,
+    fbclid: utm == null ? void 0 : utm.fbclid,
+    msclkid: utm == null ? void 0 : utm.msclkid,
+    ttclid: utm == null ? void 0 : utm.ttclid
   }).filter(([_, value]) => value !== void 0).reduce((obj, [key, value]) => ({
     ...obj,
     [key]: value
@@ -212,6 +218,7 @@ var schemas_exports = {};
 __export(schemas_exports, {
   downloadSchema: () => downloadSchema,
   manifestSchema: () => manifestSchema,
+  productReleaseSchema: () => productReleaseSchema,
   productSummarySchema: () => productSummarySchema
 });
 var import_zod2 = require("zod");
@@ -274,10 +281,20 @@ var productSummarySchema = import_zod2.z.object({
   downloadsNeedsOwnership: import_zod2.z.boolean(),
   downloadsNeedsGroupMembership: import_zod2.z.boolean(),
   // Whether this caller clears every requirement above, including the group membership the client
-  // can't see for itself.
+  // can't see for itself. False with none of them set means the merchant closed the release to everyone.
   downloadsAllowed: import_zod2.z.boolean(),
   downloads: import_zod2.z.array(downloadSchema).optional()
 });
+var productReleaseSchema = import_zod2.z.object({
+  version: import_zod2.z.string(),
+  description: import_zod2.z.string().nullish(),
+  publishedAt: import_zod2.z.coerce.date(),
+  // Whether this caller may download the release, resolved against its own access control: a
+  // merchant can keep past releases to owners while the current one is open to anyone.
+  downloadsAllowed: import_zod2.z.boolean(),
+  downloads: import_zod2.z.array(downloadSchema),
+  properties: import_zod2.z.record(rawPropertyValueSchema).nullish()
+});
 
 // src/storefront/schemas.ts
 var storefrontProductSchema = import_zod3.z.object({
@@ -841,8 +858,12 @@ var IdentityEndpoints = class {
     return userSchema.parse(identity);
   }
   async signUp(name, email, password, address, acceptedPrivacyPolicy, acceptedTermsAndConditions, communicationOptIn, options) {
-    const path = `/api/customer/identity/sign-up?scheme=JWT&communicationOptIn=${communicationOptIn ? "true" : "false"}`;
-    const response = await fetch(`${this.api.baseUrl}${path}`, {
+    const query = new URLSearchParams({
+      scheme: "JWT",
+      communicationOptIn: communicationOptIn ? "true" : "false",
+      ...utmToObject(options == null ? void 0 : options.utm)
+    });
+    const response = await fetch(`${this.api.baseUrl}/api/customer/identity/sign-up?${query.toString()}`, {
       method: "POST",
       headers: {
         "Accept": "application/json",
@@ -1091,6 +1112,15 @@ var ProductEndpoints = class {
     const response = await this.api.fetch(`/api/customer/inventory/products/${productId}${version2 ? `?version=${version2}${this.configuration.includeManifests ? "&includeManifests=true" : ""}` : this.configuration.includeManifests ? "?includeManifests=true" : ""}`, productSummarySchema);
     return response.data;
   }
+  /**
+   * The product's published releases, highest version first, with their release notes and files,
+   * and whether the caller may download each. Open to anyone who can see the product, signed in or
+   * not. A page can hold fewer releases than its size, so keep following `next` while `hasMore` is set.
+   */
+  async getReleases(productId, nextUrl) {
+    const response = await this.api.fetch(nextUrl || `/api/customer/inventory/products/${productId}/releases${this.configuration.includeManifests ? "?includeManifests=true" : ""}`, paged(productReleaseSchema));
+    return response.data;
+  }
   async getOwned(nextUrl) {
     const response = await this.api.authenticatedFetch(nextUrl || `/api/customer/inventory/products${this.configuration.includeManifests ? "?includeManifests=true" : ""}`, paged(productSummarySchema));
     return response.data;
@@ -1117,7 +1147,7 @@ var ProductEndpoints = class {
 var import_zod14 = require("zod");
 
 // package.json
-var version = "3.7.0";
+var version = "3.8.0";
 
 // src/utils/client.ts
 function buildClientHeader(sdk) {
@@ -2731,7 +2761,8 @@ function parseOffSiteReferrer(rawReferrer, currentOrigin) {
 }
 function resolveUtm(cached, fresh) {
   const freshHasUtm = !!(fresh.source || fresh.medium || fresh.campaign || fresh.term || fresh.content);
-  const freshIsExternalArrival = freshHasUtm || !!fresh.referrer;
+  const freshHasClickId = !!(fresh.gclid || fresh.gbraid || fresh.wbraid || fresh.fbclid || fresh.msclkid || fresh.ttclid);
+  const freshIsExternalArrival = freshHasUtm || freshHasClickId || !!fresh.referrer;
   if (freshIsExternalArrival)
     return fresh;
   return cached != null ? cached : fresh;