@openpartner/sdk 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 OpenPartner contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,151 @@
+# @openpartner/sdk
+
+Client + server SDK for [OpenPartner](https://github.com/getcoherence/openpartner).
+
+- **Browser** — captures the `cref` attribution token from landing URLs and the first-party cookie, survives Safari / ITP cookie expiry via localStorage, and stitches to a logged-in user on auth.
+- **Server** — posts conversion events, stitches server-side where needed, with typed errors.
+
+Zero runtime dependencies. ~4 KB gzipped browser bundle.
+
+```bash
+npm install @openpartner/sdk
+```
+
+## Browser
+
+Embed once on every page of your marketing site and product. The SDK runs on init, pulling the cref out of `?cref=…` (first visit from a partner link) or the `_cref` cookie (subsequent pages) and stashing it in localStorage.
+
+```ts
+import { OpenPartner } from '@openpartner/sdk';
+
+const op = OpenPartner.init({
+  apiUrl: 'https://openpartner.example.com',
+});
+
+// On signup or login — any time you learn the user's id:
+await op.identify(currentUser.id);
+```
+
+That's the whole browser integration. The `identify()` call POSTs `{ cref, userId }` to `/attribution/identify` on your OpenPartner API. Errors are logged to the console by default — pass `onError` to hook in observability, or `await` the call and handle errors yourself.
+
+### Config
+
+```ts
+OpenPartner.init({
+  apiUrl: 'https://openpartner.example.com',
+  // Optional:
+  cookieName: '_cref',          // first-party cookie set by the click router
+  queryParam: 'cref',           // query param on landing URLs
+  storageKey: 'openpartner:cref', // localStorage key
+  onError: (err) => Sentry.captureException(err),
+});
+```
+
+### Framework notes
+
+- **React / Vue / SolidJS**: call `OpenPartner.init()` once at the top of your app. Call `op.identify()` from your auth callback.
+- **Next.js App Router**: put `OpenPartner.init()` in a `'use client'` provider component mounted in your root layout.
+- **SPA with route-based auth**: `captureCref()` runs on init, so you only need one init per page load. Subsequent SPA navigations don't need to re-init.
+
+## Server
+
+Use the server SDK in your backend — Node 18+, Bun, Deno, Cloudflare Workers (native fetch).
+
+```ts
+import { OpenPartnerServer } from '@openpartner/sdk/server';
+
+const op = new OpenPartnerServer({
+  apiUrl: process.env.OPENPARTNER_API_URL!,
+  apiKey: process.env.OPENPARTNER_API_KEY!,
+});
+
+// On signup (no revenue yet — still useful for funnel analysis):
+await op.trackEvent({ userId: user.id, type: 'signup' });
+
+// On first paid invoice:
+await op.trackEvent({
+  userId: user.id,
+  type: 'invoice_paid',
+  value: 249,
+  currency: 'USD',
+  metadata: { stripeInvoiceId: invoice.id },
+});
+```
+
+The response includes the attribution result:
+
+```ts
+{
+  ok: true,
+  eventId: '01K…',
+  attribution: {
+    status: 'attributed',        // or 'no_identity' / 'no_click' / 'outside_window'
+    model: 'last_click',
+    touches: [
+      { clickId, partnerId, weight: 1, attributionId, commissionId }
+    ],
+  }
+}
+```
+
+For multi-touch campaigns (`linear`, `position`, etc.) `touches` will contain one entry per attributed click with a fractional `weight`.
+
+### Stripe webhooks
+
+OpenPartner's API has a built-in `/webhooks/stripe` handler that ingests `customer.created`, `customer.subscription.created`, and `invoice.paid` automatically. If you're already using Stripe with OpenPartner, point your Stripe webhook at OpenPartner's API directly — you don't need to call `trackEvent` from your own code.
+
+Call `trackEvent` from your backend when:
+
+- You don't use Stripe (or Stripe isn't the source of the conversion).
+- You want to track custom event types (`trial_started`, `feature_activated`, etc.).
+- You want to override the event timestamp (`ts: '2026-04-20T12:00:00Z'`).
+
+### Error handling
+
+All failures throw an `OpenPartnerError` with:
+
+```ts
+try {
+  await op.trackEvent({ userId, type: 'signup' });
+} catch (err) {
+  if (err instanceof OpenPartnerError) {
+    console.error(err.status, err.code, err.detail);
+  }
+}
+```
+
+- `status` — HTTP status (400, 401, 403, 404, 500…)
+- `code` — the API's machine-readable error string (e.g. `invalid_body`)
+- `detail` — the full response body (often Zod's `flatten()` output)
+
+### Custom transport
+
+For tests or specialized environments, pass your own `fetch`:
+
+```ts
+new OpenPartnerServer({
+  apiUrl,
+  apiKey,
+  fetch: customFetch,
+});
+```
+
+## Attribution model
+
+```
+click (on vendor router)       ← Click row on vendor's OpenPartner
+  ↓
+identify(cref, userId)         ← Identity row stitches click to user
+  ↓
+trackEvent(userId, type, value)← Event row
+  ↓
+attribution engine             ← Applies campaign model, emits Attribution + Commission rows
+```
+
+- **click** — visitor lands on `https://vendor.example.com/r/<slug>`. The OpenPartner router sets `_cref` cookie and writes a `Click` row.
+- **identify** — once the visitor authenticates on the vendor's site, the browser SDK (or server SDK) calls `/attribution/identify` which writes an `Identity` row stitching `cref → userId`.
+- **trackEvent** — any subsequent conversion event is written as an `Event` row. The attribution engine walks `Event.userId → Identity → Click → Campaign`, checks the attribution window, applies the configured model (`last_click` / `first_click` / `linear` / `position`), and writes `Attribution` + `Commission` rows.
+
+## License
+
+MIT.

package/dist/browser.cjs

@@ -0,0 +1,166 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+
+// src/browser.ts
+var browser_exports = {};
+__export(browser_exports, {
+  OpenPartner: () => OpenPartner,
+  OpenPartnerError: () => OpenPartnerError
+});
+module.exports = __toCommonJS(browser_exports);
+
+// src/shared.ts
+var OpenPartnerError = class extends Error {
+  constructor(message, status, code, detail) {
+    super(message);
+    __publicField(this, "status", status);
+    __publicField(this, "code", code);
+    __publicField(this, "detail", detail);
+    this.name = "OpenPartnerError";
+  }
+};
+async function requestJson(input, init = {}, fetchImpl = globalThis.fetch) {
+  const headers = new Headers(init.headers);
+  if (init.body !== void 0 && !headers.has("content-type")) {
+    headers.set("content-type", "application/json");
+  }
+  const res = await fetchImpl(input, {
+    ...init,
+    headers,
+    body: init.body === void 0 ? void 0 : typeof init.body === "string" ? init.body : JSON.stringify(init.body)
+  });
+  const text = await res.text();
+  let body = void 0;
+  if (text) {
+    try {
+      body = JSON.parse(text);
+    } catch {
+      body = text;
+    }
+  }
+  if (!res.ok) {
+    const errBody = body ?? {};
+    throw new OpenPartnerError(
+      errBody.error ?? `${res.status} ${res.statusText}`,
+      res.status,
+      errBody.error,
+      errBody.detail ?? body
+    );
+  }
+  return body;
+}
+
+// src/browser.ts
+var DEFAULTS = {
+  cookieName: "_cref",
+  queryParam: "cref",
+  storageKey: "openpartner:cref",
+  onError: (err) => {
+    console.warn("[openpartner] identify failed", err);
+  }
+};
+var OpenPartner = class _OpenPartner {
+  constructor(config) {
+    __publicField(this, "config");
+    this.config = { ...DEFAULTS, ...config };
+    this.captureCref();
+  }
+  static init(config) {
+    return new _OpenPartner(config);
+  }
+  /** The cref we're holding onto, if any. Useful for debugging. */
+  getCref() {
+    if (typeof localStorage === "undefined") return null;
+    return localStorage.getItem(this.config.storageKey);
+  }
+  /**
+   * Captured referral token for this visitor. Pass to Stripe Checkout
+   * as `client_reference_id` to enable webhook-based attribution
+   * without an explicit identify() call:
+   *
+   *   stripe.checkout.sessions.create({
+   *     client_reference_id: op.getReferral() ?? undefined,
+   *     // ...
+   *   });
+   *
+   * Returns null if the visitor didn't arrive via a partner link.
+   */
+  getReferral() {
+    return this.getCref();
+  }
+  /** Explicitly discard the captured cref. */
+  clear() {
+    if (typeof localStorage === "undefined") return;
+    localStorage.removeItem(this.config.storageKey);
+  }
+  /**
+   * Capture the cref from query string or cookie and stash in
+   * localStorage. Runs on init so the value survives SPA navigations,
+   * ITP cookie expiry, and subsequent page loads.
+   */
+  captureCref() {
+    if (typeof window === "undefined" || typeof localStorage === "undefined") return;
+    const url = new URL(window.location.href);
+    const queryCref = url.searchParams.get(this.config.queryParam);
+    if (queryCref) {
+      localStorage.setItem(this.config.storageKey, queryCref);
+      return;
+    }
+    const cookieCref = this.readCookie(this.config.cookieName);
+    if (cookieCref && !localStorage.getItem(this.config.storageKey)) {
+      localStorage.setItem(this.config.storageKey, cookieCref);
+    }
+  }
+  readCookie(name) {
+    if (typeof document === "undefined") return null;
+    const match = document.cookie.match(new RegExp(`(^|; )${name}=([^;]+)`));
+    return match ? decodeURIComponent(match[2]) : null;
+  }
+  /**
+   * Stitch the current captured click to an authenticated user. Call
+   * this on login, signup, or anywhere the user becomes known.
+   *
+   * No-op if no cref was captured. Errors are reported through
+   * `config.onError` by default — attribution is best-effort from the
+   * browser — but you can await this and try/catch if you want to
+   * surface failures explicitly.
+   */
+  async identify(userId) {
+    const cref = this.getCref();
+    if (!cref) return null;
+    try {
+      return await requestJson(`${this.config.apiUrl}/attribution/identify`, {
+        method: "POST",
+        body: { cref, userId, ts: Date.now() },
+        keepalive: true
+      });
+    } catch (err) {
+      this.config.onError(err);
+      return null;
+    }
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  OpenPartner,
+  OpenPartnerError
+});
+//# sourceMappingURL=browser.cjs.map

package/dist/browser.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/browser.ts","../src/shared.ts"],"sourcesContent":["/**\n * Browser SDK — runs inside a merchant's web app. Captures the `cref`\n * attribution token from landing-page URLs and the first-party cookie\n * the click router sets, stashes it in localStorage so it survives\n * Safari / ITP cookie expiry and SPA navigations, and stitches to the\n * authenticated user on signup or login.\n *\n * Typical integration:\n *\n *   import { OpenPartner } from '@openpartner/sdk';\n *\n *   const op = OpenPartner.init({ apiUrl: 'https://openpartner.example.com' });\n *\n *   // After login/signup, once you know who the user is:\n *   await op.identify(user.id);\n */\n\nimport { OpenPartnerError, requestJson, type IdentifyResponse } from './shared.js';\n\nexport { OpenPartnerError };\nexport type { IdentifyResponse };\n\nexport interface OpenPartnerConfig {\n  /** Base URL of your OpenPartner API, e.g. \"https://openpartner.example.com\". */\n  apiUrl: string;\n  /** First-party cookie name set by the click router. Default `_cref`. */\n  cookieName?: string;\n  /** Query-string parameter that carries the cref on the landing URL. Default `cref`. */\n  queryParam?: string;\n  /** localStorage key the captured cref is stashed under. Default `openpartner:cref`. */\n  storageKey?: string;\n  /**\n   * Called when identify() fails. Default: log to console. Pass a noop\n   * to suppress entirely or hook into your observability stack.\n   */\n  onError?: (err: unknown) => void;\n}\n\nconst DEFAULTS = {\n  cookieName: '_cref',\n  queryParam: 'cref',\n  storageKey: 'openpartner:cref',\n  onError: (err: unknown) => {\n    console.warn('[openpartner] identify failed', err);\n  },\n};\n\nexport class OpenPartner {\n  private config: Required<OpenPartnerConfig>;\n\n  private constructor(config: OpenPartnerConfig) {\n    this.config = { ...DEFAULTS, ...config } as Required<OpenPartnerConfig>;\n    this.captureCref();\n  }\n\n  static init(config: OpenPartnerConfig): OpenPartner {\n    return new OpenPartner(config);\n  }\n\n  /** The cref we're holding onto, if any. Useful for debugging. */\n  getCref(): string | null {\n    if (typeof localStorage === 'undefined') return null;\n    return localStorage.getItem(this.config.storageKey);\n  }\n\n  /**\n   * Captured referral token for this visitor. Pass to Stripe Checkout\n   * as `client_reference_id` to enable webhook-based attribution\n   * without an explicit identify() call:\n   *\n   *   stripe.checkout.sessions.create({\n   *     client_reference_id: op.getReferral() ?? undefined,\n   *     // ...\n   *   });\n   *\n   * Returns null if the visitor didn't arrive via a partner link.\n   */\n  getReferral(): string | null {\n    return this.getCref();\n  }\n\n  /** Explicitly discard the captured cref. */\n  clear(): void {\n    if (typeof localStorage === 'undefined') return;\n    localStorage.removeItem(this.config.storageKey);\n  }\n\n  /**\n   * Capture the cref from query string or cookie and stash in\n   * localStorage. Runs on init so the value survives SPA navigations,\n   * ITP cookie expiry, and subsequent page loads.\n   */\n  private captureCref(): void {\n    if (typeof window === 'undefined' || typeof localStorage === 'undefined') return;\n\n    const url = new URL(window.location.href);\n    const queryCref = url.searchParams.get(this.config.queryParam);\n\n    if (queryCref) {\n      localStorage.setItem(this.config.storageKey, queryCref);\n      return;\n    }\n\n    const cookieCref = this.readCookie(this.config.cookieName);\n    if (cookieCref && !localStorage.getItem(this.config.storageKey)) {\n      localStorage.setItem(this.config.storageKey, cookieCref);\n    }\n  }\n\n  private readCookie(name: string): string | null {\n    if (typeof document === 'undefined') return null;\n    const match = document.cookie.match(new RegExp(`(^|; )${name}=([^;]+)`));\n    return match ? decodeURIComponent(match[2]!) : null;\n  }\n\n  /**\n   * Stitch the current captured click to an authenticated user. Call\n   * this on login, signup, or anywhere the user becomes known.\n   *\n   * No-op if no cref was captured. Errors are reported through\n   * `config.onError` by default — attribution is best-effort from the\n   * browser — but you can await this and try/catch if you want to\n   * surface failures explicitly.\n   */\n  async identify(userId: string): Promise<IdentifyResponse | null> {\n    const cref = this.getCref();\n    if (!cref) return null;\n\n    try {\n      return await requestJson<IdentifyResponse>(`${this.config.apiUrl}/attribution/identify`, {\n        method: 'POST',\n        body: { cref, userId, ts: Date.now() },\n        keepalive: true,\n      });\n    } catch (err) {\n      this.config.onError(err);\n      return null;\n    }\n  }\n}\n","/**\n * Shared types + error class for both the browser and server entry\n * points.\n *\n * Keeping these in their own module means browser imports won't drag in\n * `fetch` polyfills or server-only code, and server imports won't touch\n * anything that references `window` or `document`.\n */\n\nexport class OpenPartnerError extends Error {\n  constructor(\n    message: string,\n    public readonly status: number,\n    public readonly code?: string,\n    public readonly detail?: unknown,\n  ) {\n    super(message);\n    this.name = 'OpenPartnerError';\n  }\n}\n\nexport interface IdentifyResponse {\n  ok: boolean;\n  identityId: string | null;\n  firstStitch: boolean;\n  backfilledAttributions?: number;\n}\n\nexport interface EventAttribution {\n  status: 'attributed' | 'no_identity' | 'no_click' | 'outside_window' | 'already_attributed';\n  model?: 'last_click' | 'first_click' | 'linear' | 'position';\n  touches?: Array<{\n    clickId: string;\n    partnerId: string;\n    weight: number;\n    attributionId: string;\n    commissionId?: string;\n  }>;\n}\n\nexport interface EventResponse {\n  ok: boolean;\n  eventId: string;\n  attribution: EventAttribution;\n}\n\n/**\n * Small fetch helper used by both entries. Normalizes non-2xx responses\n * into OpenPartnerError so callers can try/catch with a stable shape\n * instead of poking at Response objects themselves.\n */\nexport type JsonRequestInit = Omit<RequestInit, 'body'> & { body?: unknown };\n\nexport async function requestJson<T>(\n  input: string,\n  init: JsonRequestInit = {},\n  fetchImpl: typeof fetch = globalThis.fetch,\n): Promise<T> {\n  const headers = new Headers(init.headers);\n  if (init.body !== undefined && !headers.has('content-type')) {\n    headers.set('content-type', 'application/json');\n  }\n  const res = await fetchImpl(input, {\n    ...init,\n    headers,\n    body:\n      init.body === undefined\n        ? undefined\n        : typeof init.body === 'string'\n          ? init.body\n          : JSON.stringify(init.body),\n  });\n\n  const text = await res.text();\n  let body: unknown = undefined;\n  if (text) {\n    try {\n      body = JSON.parse(text);\n    } catch {\n      body = text;\n    }\n  }\n\n  if (!res.ok) {\n    const errBody = (body ?? {}) as { error?: string; detail?: unknown };\n    throw new OpenPartnerError(\n      errBody.error ?? `${res.status} ${res.statusText}`,\n      res.status,\n      errBody.error,\n      errBody.detail ?? body,\n    );\n  }\n\n  return body as T;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACSO,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1C,YACE,SACgB,QACA,MACA,QAChB;AACA,UAAM,OAAO;AAJG;AACA;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAkCA,eAAsB,YACpB,OACA,OAAwB,CAAC,GACzB,YAA0B,WAAW,OACzB;AACZ,QAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,MAAI,KAAK,SAAS,UAAa,CAAC,QAAQ,IAAI,cAAc,GAAG;AAC3D,YAAQ,IAAI,gBAAgB,kBAAkB;AAAA,EAChD;AACA,QAAM,MAAM,MAAM,UAAU,OAAO;AAAA,IACjC,GAAG;AAAA,IACH;AAAA,IACA,MACE,KAAK,SAAS,SACV,SACA,OAAO,KAAK,SAAS,WACnB,KAAK,OACL,KAAK,UAAU,KAAK,IAAI;AAAA,EAClC,CAAC;AAED,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,MAAI,OAAgB;AACpB,MAAI,MAAM;AACR,QAAI;AACF,aAAO,KAAK,MAAM,IAAI;AAAA,IACxB,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,UAAW,QAAQ,CAAC;AAC1B,UAAM,IAAI;AAAA,MACR,QAAQ,SAAS,GAAG,IAAI,MAAM,IAAI,IAAI,UAAU;AAAA,MAChD,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,QAAQ,UAAU;AAAA,IACpB;AAAA,EACF;AAEA,SAAO;AACT;;;ADxDA,IAAM,WAAW;AAAA,EACf,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,SAAS,CAAC,QAAiB;AACzB,YAAQ,KAAK,iCAAiC,GAAG;AAAA,EACnD;AACF;AAEO,IAAM,cAAN,MAAM,aAAY;AAAA,EAGf,YAAY,QAA2B;AAF/C,wBAAQ;AAGN,SAAK,SAAS,EAAE,GAAG,UAAU,GAAG,OAAO;AACvC,SAAK,YAAY;AAAA,EACnB;AAAA,EAEA,OAAO,KAAK,QAAwC;AAClD,WAAO,IAAI,aAAY,MAAM;AAAA,EAC/B;AAAA;AAAA,EAGA,UAAyB;AACvB,QAAI,OAAO,iBAAiB,YAAa,QAAO;AAChD,WAAO,aAAa,QAAQ,KAAK,OAAO,UAAU;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,cAA6B;AAC3B,WAAO,KAAK,QAAQ;AAAA,EACtB;AAAA;AAAA,EAGA,QAAc;AACZ,QAAI,OAAO,iBAAiB,YAAa;AACzC,iBAAa,WAAW,KAAK,OAAO,UAAU;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,cAAoB;AAC1B,QAAI,OAAO,WAAW,eAAe,OAAO,iBAAiB,YAAa;AAE1E,UAAM,MAAM,IAAI,IAAI,OAAO,SAAS,IAAI;AACxC,UAAM,YAAY,IAAI,aAAa,IAAI,KAAK,OAAO,UAAU;AAE7D,QAAI,WAAW;AACb,mBAAa,QAAQ,KAAK,OAAO,YAAY,SAAS;AACtD;AAAA,IACF;AAEA,UAAM,aAAa,KAAK,WAAW,KAAK,OAAO,UAAU;AACzD,QAAI,cAAc,CAAC,aAAa,QAAQ,KAAK,OAAO,UAAU,GAAG;AAC/D,mBAAa,QAAQ,KAAK,OAAO,YAAY,UAAU;AAAA,IACzD;AAAA,EACF;AAAA,EAEQ,WAAW,MAA6B;AAC9C,QAAI,OAAO,aAAa,YAAa,QAAO;AAC5C,UAAM,QAAQ,SAAS,OAAO,MAAM,IAAI,OAAO,SAAS,IAAI,UAAU,CAAC;AACvE,WAAO,QAAQ,mBAAmB,MAAM,CAAC,CAAE,IAAI;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,SAAS,QAAkD;AAC/D,UAAM,OAAO,KAAK,QAAQ;AAC1B,QAAI,CAAC,KAAM,QAAO;AAElB,QAAI;AACF,aAAO,MAAM,YAA8B,GAAG,KAAK,OAAO,MAAM,yBAAyB;AAAA,QACvF,QAAQ;AAAA,QACR,MAAM,EAAE,MAAM,QAAQ,IAAI,KAAK,IAAI,EAAE;AAAA,QACrC,WAAW;AAAA,MACb,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,WAAK,OAAO,QAAQ,GAAG;AACvB,aAAO;AAAA,IACT;AAAA,EACF;AACF;","names":[]}

package/dist/browser.d.cts

@@ -0,0 +1,76 @@
+import { I as IdentifyResponse } from './shared-CLfBjPeb.cjs';
+export { O as OpenPartnerError } from './shared-CLfBjPeb.cjs';
+
+/**
+ * Browser SDK — runs inside a merchant's web app. Captures the `cref`
+ * attribution token from landing-page URLs and the first-party cookie
+ * the click router sets, stashes it in localStorage so it survives
+ * Safari / ITP cookie expiry and SPA navigations, and stitches to the
+ * authenticated user on signup or login.
+ *
+ * Typical integration:
+ *
+ *   import { OpenPartner } from '@openpartner/sdk';
+ *
+ *   const op = OpenPartner.init({ apiUrl: 'https://openpartner.example.com' });
+ *
+ *   // After login/signup, once you know who the user is:
+ *   await op.identify(user.id);
+ */
+
+interface OpenPartnerConfig {
+    /** Base URL of your OpenPartner API, e.g. "https://openpartner.example.com". */
+    apiUrl: string;
+    /** First-party cookie name set by the click router. Default `_cref`. */
+    cookieName?: string;
+    /** Query-string parameter that carries the cref on the landing URL. Default `cref`. */
+    queryParam?: string;
+    /** localStorage key the captured cref is stashed under. Default `openpartner:cref`. */
+    storageKey?: string;
+    /**
+     * Called when identify() fails. Default: log to console. Pass a noop
+     * to suppress entirely or hook into your observability stack.
+     */
+    onError?: (err: unknown) => void;
+}
+declare class OpenPartner {
+    private config;
+    private constructor();
+    static init(config: OpenPartnerConfig): OpenPartner;
+    /** The cref we're holding onto, if any. Useful for debugging. */
+    getCref(): string | null;
+    /**
+     * Captured referral token for this visitor. Pass to Stripe Checkout
+     * as `client_reference_id` to enable webhook-based attribution
+     * without an explicit identify() call:
+     *
+     *   stripe.checkout.sessions.create({
+     *     client_reference_id: op.getReferral() ?? undefined,
+     *     // ...
+     *   });
+     *
+     * Returns null if the visitor didn't arrive via a partner link.
+     */
+    getReferral(): string | null;
+    /** Explicitly discard the captured cref. */
+    clear(): void;
+    /**
+     * Capture the cref from query string or cookie and stash in
+     * localStorage. Runs on init so the value survives SPA navigations,
+     * ITP cookie expiry, and subsequent page loads.
+     */
+    private captureCref;
+    private readCookie;
+    /**
+     * Stitch the current captured click to an authenticated user. Call
+     * this on login, signup, or anywhere the user becomes known.
+     *
+     * No-op if no cref was captured. Errors are reported through
+     * `config.onError` by default — attribution is best-effort from the
+     * browser — but you can await this and try/catch if you want to
+     * surface failures explicitly.
+     */
+    identify(userId: string): Promise<IdentifyResponse | null>;
+}
+
+export { IdentifyResponse, OpenPartner, type OpenPartnerConfig };

package/dist/browser.d.ts

@@ -0,0 +1,76 @@
+import { I as IdentifyResponse } from './shared-CLfBjPeb.js';
+export { O as OpenPartnerError } from './shared-CLfBjPeb.js';
+
+/**
+ * Browser SDK — runs inside a merchant's web app. Captures the `cref`
+ * attribution token from landing-page URLs and the first-party cookie
+ * the click router sets, stashes it in localStorage so it survives
+ * Safari / ITP cookie expiry and SPA navigations, and stitches to the
+ * authenticated user on signup or login.
+ *
+ * Typical integration:
+ *
+ *   import { OpenPartner } from '@openpartner/sdk';
+ *
+ *   const op = OpenPartner.init({ apiUrl: 'https://openpartner.example.com' });
+ *
+ *   // After login/signup, once you know who the user is:
+ *   await op.identify(user.id);
+ */
+
+interface OpenPartnerConfig {
+    /** Base URL of your OpenPartner API, e.g. "https://openpartner.example.com". */
+    apiUrl: string;
+    /** First-party cookie name set by the click router. Default `_cref`. */
+    cookieName?: string;
+    /** Query-string parameter that carries the cref on the landing URL. Default `cref`. */
+    queryParam?: string;
+    /** localStorage key the captured cref is stashed under. Default `openpartner:cref`. */
+    storageKey?: string;
+    /**
+     * Called when identify() fails. Default: log to console. Pass a noop
+     * to suppress entirely or hook into your observability stack.
+     */
+    onError?: (err: unknown) => void;
+}
+declare class OpenPartner {
+    private config;
+    private constructor();
+    static init(config: OpenPartnerConfig): OpenPartner;
+    /** The cref we're holding onto, if any. Useful for debugging. */
+    getCref(): string | null;
+    /**
+     * Captured referral token for this visitor. Pass to Stripe Checkout
+     * as `client_reference_id` to enable webhook-based attribution
+     * without an explicit identify() call:
+     *
+     *   stripe.checkout.sessions.create({
+     *     client_reference_id: op.getReferral() ?? undefined,
+     *     // ...
+     *   });
+     *
+     * Returns null if the visitor didn't arrive via a partner link.
+     */
+    getReferral(): string | null;
+    /** Explicitly discard the captured cref. */
+    clear(): void;
+    /**
+     * Capture the cref from query string or cookie and stash in
+     * localStorage. Runs on init so the value survives SPA navigations,
+     * ITP cookie expiry, and subsequent page loads.
+     */
+    private captureCref;
+    private readCookie;
+    /**
+     * Stitch the current captured click to an authenticated user. Call
+     * this on login, signup, or anywhere the user becomes known.
+     *
+     * No-op if no cref was captured. Errors are reported through
+     * `config.onError` by default — attribution is best-effort from the
+     * browser — but you can await this and try/catch if you want to
+     * surface failures explicitly.
+     */
+    identify(userId: string): Promise<IdentifyResponse | null>;
+}
+
+export { IdentifyResponse, OpenPartner, type OpenPartnerConfig };

package/dist/browser.js

@@ -0,0 +1,140 @@
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+
+// src/shared.ts
+var OpenPartnerError = class extends Error {
+  constructor(message, status, code, detail) {
+    super(message);
+    __publicField(this, "status", status);
+    __publicField(this, "code", code);
+    __publicField(this, "detail", detail);
+    this.name = "OpenPartnerError";
+  }
+};
+async function requestJson(input, init = {}, fetchImpl = globalThis.fetch) {
+  const headers = new Headers(init.headers);
+  if (init.body !== void 0 && !headers.has("content-type")) {
+    headers.set("content-type", "application/json");
+  }
+  const res = await fetchImpl(input, {
+    ...init,
+    headers,
+    body: init.body === void 0 ? void 0 : typeof init.body === "string" ? init.body : JSON.stringify(init.body)
+  });
+  const text = await res.text();
+  let body = void 0;
+  if (text) {
+    try {
+      body = JSON.parse(text);
+    } catch {
+      body = text;
+    }
+  }
+  if (!res.ok) {
+    const errBody = body ?? {};
+    throw new OpenPartnerError(
+      errBody.error ?? `${res.status} ${res.statusText}`,
+      res.status,
+      errBody.error,
+      errBody.detail ?? body
+    );
+  }
+  return body;
+}
+
+// src/browser.ts
+var DEFAULTS = {
+  cookieName: "_cref",
+  queryParam: "cref",
+  storageKey: "openpartner:cref",
+  onError: (err) => {
+    console.warn("[openpartner] identify failed", err);
+  }
+};
+var OpenPartner = class _OpenPartner {
+  constructor(config) {
+    __publicField(this, "config");
+    this.config = { ...DEFAULTS, ...config };
+    this.captureCref();
+  }
+  static init(config) {
+    return new _OpenPartner(config);
+  }
+  /** The cref we're holding onto, if any. Useful for debugging. */
+  getCref() {
+    if (typeof localStorage === "undefined") return null;
+    return localStorage.getItem(this.config.storageKey);
+  }
+  /**
+   * Captured referral token for this visitor. Pass to Stripe Checkout
+   * as `client_reference_id` to enable webhook-based attribution
+   * without an explicit identify() call:
+   *
+   *   stripe.checkout.sessions.create({
+   *     client_reference_id: op.getReferral() ?? undefined,
+   *     // ...
+   *   });
+   *
+   * Returns null if the visitor didn't arrive via a partner link.
+   */
+  getReferral() {
+    return this.getCref();
+  }
+  /** Explicitly discard the captured cref. */
+  clear() {
+    if (typeof localStorage === "undefined") return;
+    localStorage.removeItem(this.config.storageKey);
+  }
+  /**
+   * Capture the cref from query string or cookie and stash in
+   * localStorage. Runs on init so the value survives SPA navigations,
+   * ITP cookie expiry, and subsequent page loads.
+   */
+  captureCref() {
+    if (typeof window === "undefined" || typeof localStorage === "undefined") return;
+    const url = new URL(window.location.href);
+    const queryCref = url.searchParams.get(this.config.queryParam);
+    if (queryCref) {
+      localStorage.setItem(this.config.storageKey, queryCref);
+      return;
+    }
+    const cookieCref = this.readCookie(this.config.cookieName);
+    if (cookieCref && !localStorage.getItem(this.config.storageKey)) {
+      localStorage.setItem(this.config.storageKey, cookieCref);
+    }
+  }
+  readCookie(name) {
+    if (typeof document === "undefined") return null;
+    const match = document.cookie.match(new RegExp(`(^|; )${name}=([^;]+)`));
+    return match ? decodeURIComponent(match[2]) : null;
+  }
+  /**
+   * Stitch the current captured click to an authenticated user. Call
+   * this on login, signup, or anywhere the user becomes known.
+   *
+   * No-op if no cref was captured. Errors are reported through
+   * `config.onError` by default — attribution is best-effort from the
+   * browser — but you can await this and try/catch if you want to
+   * surface failures explicitly.
+   */
+  async identify(userId) {
+    const cref = this.getCref();
+    if (!cref) return null;
+    try {
+      return await requestJson(`${this.config.apiUrl}/attribution/identify`, {
+        method: "POST",
+        body: { cref, userId, ts: Date.now() },
+        keepalive: true
+      });
+    } catch (err) {
+      this.config.onError(err);
+      return null;
+    }
+  }
+};
+export {
+  OpenPartner,
+  OpenPartnerError
+};
+//# sourceMappingURL=browser.js.map

package/dist/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/shared.ts","../src/browser.ts"],"sourcesContent":["/**\n * Shared types + error class for both the browser and server entry\n * points.\n *\n * Keeping these in their own module means browser imports won't drag in\n * `fetch` polyfills or server-only code, and server imports won't touch\n * anything that references `window` or `document`.\n */\n\nexport class OpenPartnerError extends Error {\n  constructor(\n    message: string,\n    public readonly status: number,\n    public readonly code?: string,\n    public readonly detail?: unknown,\n  ) {\n    super(message);\n    this.name = 'OpenPartnerError';\n  }\n}\n\nexport interface IdentifyResponse {\n  ok: boolean;\n  identityId: string | null;\n  firstStitch: boolean;\n  backfilledAttributions?: number;\n}\n\nexport interface EventAttribution {\n  status: 'attributed' | 'no_identity' | 'no_click' | 'outside_window' | 'already_attributed';\n  model?: 'last_click' | 'first_click' | 'linear' | 'position';\n  touches?: Array<{\n    clickId: string;\n    partnerId: string;\n    weight: number;\n    attributionId: string;\n    commissionId?: string;\n  }>;\n}\n\nexport interface EventResponse {\n  ok: boolean;\n  eventId: string;\n  attribution: EventAttribution;\n}\n\n/**\n * Small fetch helper used by both entries. Normalizes non-2xx responses\n * into OpenPartnerError so callers can try/catch with a stable shape\n * instead of poking at Response objects themselves.\n */\nexport type JsonRequestInit = Omit<RequestInit, 'body'> & { body?: unknown };\n\nexport async function requestJson<T>(\n  input: string,\n  init: JsonRequestInit = {},\n  fetchImpl: typeof fetch = globalThis.fetch,\n): Promise<T> {\n  const headers = new Headers(init.headers);\n  if (init.body !== undefined && !headers.has('content-type')) {\n    headers.set('content-type', 'application/json');\n  }\n  const res = await fetchImpl(input, {\n    ...init,\n    headers,\n    body:\n      init.body === undefined\n        ? undefined\n        : typeof init.body === 'string'\n          ? init.body\n          : JSON.stringify(init.body),\n  });\n\n  const text = await res.text();\n  let body: unknown = undefined;\n  if (text) {\n    try {\n      body = JSON.parse(text);\n    } catch {\n      body = text;\n    }\n  }\n\n  if (!res.ok) {\n    const errBody = (body ?? {}) as { error?: string; detail?: unknown };\n    throw new OpenPartnerError(\n      errBody.error ?? `${res.status} ${res.statusText}`,\n      res.status,\n      errBody.error,\n      errBody.detail ?? body,\n    );\n  }\n\n  return body as T;\n}\n","/**\n * Browser SDK — runs inside a merchant's web app. Captures the `cref`\n * attribution token from landing-page URLs and the first-party cookie\n * the click router sets, stashes it in localStorage so it survives\n * Safari / ITP cookie expiry and SPA navigations, and stitches to the\n * authenticated user on signup or login.\n *\n * Typical integration:\n *\n *   import { OpenPartner } from '@openpartner/sdk';\n *\n *   const op = OpenPartner.init({ apiUrl: 'https://openpartner.example.com' });\n *\n *   // After login/signup, once you know who the user is:\n *   await op.identify(user.id);\n */\n\nimport { OpenPartnerError, requestJson, type IdentifyResponse } from './shared.js';\n\nexport { OpenPartnerError };\nexport type { IdentifyResponse };\n\nexport interface OpenPartnerConfig {\n  /** Base URL of your OpenPartner API, e.g. \"https://openpartner.example.com\". */\n  apiUrl: string;\n  /** First-party cookie name set by the click router. Default `_cref`. */\n  cookieName?: string;\n  /** Query-string parameter that carries the cref on the landing URL. Default `cref`. */\n  queryParam?: string;\n  /** localStorage key the captured cref is stashed under. Default `openpartner:cref`. */\n  storageKey?: string;\n  /**\n   * Called when identify() fails. Default: log to console. Pass a noop\n   * to suppress entirely or hook into your observability stack.\n   */\n  onError?: (err: unknown) => void;\n}\n\nconst DEFAULTS = {\n  cookieName: '_cref',\n  queryParam: 'cref',\n  storageKey: 'openpartner:cref',\n  onError: (err: unknown) => {\n    console.warn('[openpartner] identify failed', err);\n  },\n};\n\nexport class OpenPartner {\n  private config: Required<OpenPartnerConfig>;\n\n  private constructor(config: OpenPartnerConfig) {\n    this.config = { ...DEFAULTS, ...config } as Required<OpenPartnerConfig>;\n    this.captureCref();\n  }\n\n  static init(config: OpenPartnerConfig): OpenPartner {\n    return new OpenPartner(config);\n  }\n\n  /** The cref we're holding onto, if any. Useful for debugging. */\n  getCref(): string | null {\n    if (typeof localStorage === 'undefined') return null;\n    return localStorage.getItem(this.config.storageKey);\n  }\n\n  /**\n   * Captured referral token for this visitor. Pass to Stripe Checkout\n   * as `client_reference_id` to enable webhook-based attribution\n   * without an explicit identify() call:\n   *\n   *   stripe.checkout.sessions.create({\n   *     client_reference_id: op.getReferral() ?? undefined,\n   *     // ...\n   *   });\n   *\n   * Returns null if the visitor didn't arrive via a partner link.\n   */\n  getReferral(): string | null {\n    return this.getCref();\n  }\n\n  /** Explicitly discard the captured cref. */\n  clear(): void {\n    if (typeof localStorage === 'undefined') return;\n    localStorage.removeItem(this.config.storageKey);\n  }\n\n  /**\n   * Capture the cref from query string or cookie and stash in\n   * localStorage. Runs on init so the value survives SPA navigations,\n   * ITP cookie expiry, and subsequent page loads.\n   */\n  private captureCref(): void {\n    if (typeof window === 'undefined' || typeof localStorage === 'undefined') return;\n\n    const url = new URL(window.location.href);\n    const queryCref = url.searchParams.get(this.config.queryParam);\n\n    if (queryCref) {\n      localStorage.setItem(this.config.storageKey, queryCref);\n      return;\n    }\n\n    const cookieCref = this.readCookie(this.config.cookieName);\n    if (cookieCref && !localStorage.getItem(this.config.storageKey)) {\n      localStorage.setItem(this.config.storageKey, cookieCref);\n    }\n  }\n\n  private readCookie(name: string): string | null {\n    if (typeof document === 'undefined') return null;\n    const match = document.cookie.match(new RegExp(`(^|; )${name}=([^;]+)`));\n    return match ? decodeURIComponent(match[2]!) : null;\n  }\n\n  /**\n   * Stitch the current captured click to an authenticated user. Call\n   * this on login, signup, or anywhere the user becomes known.\n   *\n   * No-op if no cref was captured. Errors are reported through\n   * `config.onError` by default — attribution is best-effort from the\n   * browser — but you can await this and try/catch if you want to\n   * surface failures explicitly.\n   */\n  async identify(userId: string): Promise<IdentifyResponse | null> {\n    const cref = this.getCref();\n    if (!cref) return null;\n\n    try {\n      return await requestJson<IdentifyResponse>(`${this.config.apiUrl}/attribution/identify`, {\n        method: 'POST',\n        body: { cref, userId, ts: Date.now() },\n        keepalive: true,\n      });\n    } catch (err) {\n      this.config.onError(err);\n      return null;\n    }\n  }\n}\n"],"mappings":";;;;;AASO,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1C,YACE,SACgB,QACA,MACA,QAChB;AACA,UAAM,OAAO;AAJG;AACA;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAkCA,eAAsB,YACpB,OACA,OAAwB,CAAC,GACzB,YAA0B,WAAW,OACzB;AACZ,QAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,MAAI,KAAK,SAAS,UAAa,CAAC,QAAQ,IAAI,cAAc,GAAG;AAC3D,YAAQ,IAAI,gBAAgB,kBAAkB;AAAA,EAChD;AACA,QAAM,MAAM,MAAM,UAAU,OAAO;AAAA,IACjC,GAAG;AAAA,IACH;AAAA,IACA,MACE,KAAK,SAAS,SACV,SACA,OAAO,KAAK,SAAS,WACnB,KAAK,OACL,KAAK,UAAU,KAAK,IAAI;AAAA,EAClC,CAAC;AAED,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,MAAI,OAAgB;AACpB,MAAI,MAAM;AACR,QAAI;AACF,aAAO,KAAK,MAAM,IAAI;AAAA,IACxB,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,UAAW,QAAQ,CAAC;AAC1B,UAAM,IAAI;AAAA,MACR,QAAQ,SAAS,GAAG,IAAI,MAAM,IAAI,IAAI,UAAU;AAAA,MAChD,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,QAAQ,UAAU;AAAA,IACpB;AAAA,EACF;AAEA,SAAO;AACT;;;ACxDA,IAAM,WAAW;AAAA,EACf,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,SAAS,CAAC,QAAiB;AACzB,YAAQ,KAAK,iCAAiC,GAAG;AAAA,EACnD;AACF;AAEO,IAAM,cAAN,MAAM,aAAY;AAAA,EAGf,YAAY,QAA2B;AAF/C,wBAAQ;AAGN,SAAK,SAAS,EAAE,GAAG,UAAU,GAAG,OAAO;AACvC,SAAK,YAAY;AAAA,EACnB;AAAA,EAEA,OAAO,KAAK,QAAwC;AAClD,WAAO,IAAI,aAAY,MAAM;AAAA,EAC/B;AAAA;AAAA,EAGA,UAAyB;AACvB,QAAI,OAAO,iBAAiB,YAAa,QAAO;AAChD,WAAO,aAAa,QAAQ,KAAK,OAAO,UAAU;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,cAA6B;AAC3B,WAAO,KAAK,QAAQ;AAAA,EACtB;AAAA;AAAA,EAGA,QAAc;AACZ,QAAI,OAAO,iBAAiB,YAAa;AACzC,iBAAa,WAAW,KAAK,OAAO,UAAU;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,cAAoB;AAC1B,QAAI,OAAO,WAAW,eAAe,OAAO,iBAAiB,YAAa;AAE1E,UAAM,MAAM,IAAI,IAAI,OAAO,SAAS,IAAI;AACxC,UAAM,YAAY,IAAI,aAAa,IAAI,KAAK,OAAO,UAAU;AAE7D,QAAI,WAAW;AACb,mBAAa,QAAQ,KAAK,OAAO,YAAY,SAAS;AACtD;AAAA,IACF;AAEA,UAAM,aAAa,KAAK,WAAW,KAAK,OAAO,UAAU;AACzD,QAAI,cAAc,CAAC,aAAa,QAAQ,KAAK,OAAO,UAAU,GAAG;AAC/D,mBAAa,QAAQ,KAAK,OAAO,YAAY,UAAU;AAAA,IACzD;AAAA,EACF;AAAA,EAEQ,WAAW,MAA6B;AAC9C,QAAI,OAAO,aAAa,YAAa,QAAO;AAC5C,UAAM,QAAQ,SAAS,OAAO,MAAM,IAAI,OAAO,SAAS,IAAI,UAAU,CAAC;AACvE,WAAO,QAAQ,mBAAmB,MAAM,CAAC,CAAE,IAAI;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,SAAS,QAAkD;AAC/D,UAAM,OAAO,KAAK,QAAQ;AAC1B,QAAI,CAAC,KAAM,QAAO;AAElB,QAAI;AACF,aAAO,MAAM,YAA8B,GAAG,KAAK,OAAO,MAAM,yBAAyB;AAAA,QACvF,QAAQ;AAAA,QACR,MAAM,EAAE,MAAM,QAAQ,IAAI,KAAK,IAAI,EAAE;AAAA,QACrC,WAAW;AAAA,MACb,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,WAAK,OAAO,QAAQ,GAAG;AACvB,aAAO;AAAA,IACT;AAAA,EACF;AACF;","names":[]}

package/dist/server.cjs

@@ -0,0 +1,120 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+
+// src/server.ts
+var server_exports = {};
+__export(server_exports, {
+  OpenPartnerError: () => OpenPartnerError,
+  OpenPartnerServer: () => OpenPartnerServer
+});
+module.exports = __toCommonJS(server_exports);
+
+// src/shared.ts
+var OpenPartnerError = class extends Error {
+  constructor(message, status, code, detail) {
+    super(message);
+    __publicField(this, "status", status);
+    __publicField(this, "code", code);
+    __publicField(this, "detail", detail);
+    this.name = "OpenPartnerError";
+  }
+};
+async function requestJson(input, init = {}, fetchImpl = globalThis.fetch) {
+  const headers = new Headers(init.headers);
+  if (init.body !== void 0 && !headers.has("content-type")) {
+    headers.set("content-type", "application/json");
+  }
+  const res = await fetchImpl(input, {
+    ...init,
+    headers,
+    body: init.body === void 0 ? void 0 : typeof init.body === "string" ? init.body : JSON.stringify(init.body)
+  });
+  const text = await res.text();
+  let body = void 0;
+  if (text) {
+    try {
+      body = JSON.parse(text);
+    } catch {
+      body = text;
+    }
+  }
+  if (!res.ok) {
+    const errBody = body ?? {};
+    throw new OpenPartnerError(
+      errBody.error ?? `${res.status} ${res.statusText}`,
+      res.status,
+      errBody.error,
+      errBody.detail ?? body
+    );
+  }
+  return body;
+}
+
+// src/server.ts
+var OpenPartnerServer = class {
+  constructor(config) {
+    __publicField(this, "apiUrl");
+    __publicField(this, "apiKey");
+    __publicField(this, "fetchImpl");
+    if (!config.apiUrl) throw new OpenPartnerError("apiUrl is required", 400, "config_missing");
+    if (!config.apiKey) throw new OpenPartnerError("apiKey is required", 400, "config_missing");
+    this.apiUrl = config.apiUrl.replace(/\/$/, "");
+    this.apiKey = config.apiKey;
+    this.fetchImpl = config.fetch ?? globalThis.fetch;
+  }
+  /**
+   * Record a conversion event. The server walks the userId back to a
+   * click, applies the campaign's attribution model, and writes the
+   * resulting attribution + commission rows.
+   */
+  async trackEvent(params) {
+    return this.request("/attribution/events", { method: "POST", body: params });
+  }
+  /**
+   * Stitch an attribution token (cref) to a known userId. Normally the
+   * browser SDK does this; use this overload if your backend receives
+   * the cref from the browser (e.g. as part of a signup payload) and
+   * wants to own the stitch call.
+   */
+  async identify(params) {
+    return this.request("/attribution/identify", {
+      method: "POST",
+      body: params
+    });
+  }
+  async request(path, init) {
+    const headers = new Headers(init.headers);
+    headers.set("authorization", `Bearer ${this.apiKey}`);
+    return requestJson(
+      `${this.apiUrl}${path}`,
+      { ...init, headers },
+      // Inject the configured fetch so tests (or alternate transports)
+      // can intercept.
+      this.fetchImpl
+    );
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  OpenPartnerError,
+  OpenPartnerServer
+});
+//# sourceMappingURL=server.cjs.map

package/dist/server.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server.ts","../src/shared.ts"],"sourcesContent":["/**\n * Server SDK — runs inside a merchant's backend. Used for the\n * server-to-server pieces of the attribution pipeline: posting\n * conversion events (signup / invoice_paid / custom), stitching\n * clicks to users from the backend, and reading dashboard snapshots.\n *\n * Typical integration:\n *\n *   import { OpenPartnerServer } from '@openpartner/sdk/server';\n *\n *   const op = new OpenPartnerServer({\n *     apiUrl: process.env.OPENPARTNER_API_URL!,\n *     apiKey: process.env.OPENPARTNER_API_KEY!,\n *   });\n *\n *   // On signup:\n *   await op.trackEvent({ userId, type: 'signup' });\n *\n *   // On invoice paid:\n *   await op.trackEvent({ userId, type: 'invoice_paid', value: 249, currency: 'USD' });\n */\n\nimport { OpenPartnerError, requestJson, type EventResponse, type IdentifyResponse, type JsonRequestInit } from './shared.js';\n\nexport { OpenPartnerError };\nexport type { EventResponse, IdentifyResponse };\nexport type { EventAttribution } from './shared.js';\n\nexport interface OpenPartnerServerConfig {\n  /** Base URL of the OpenPartner API. */\n  apiUrl: string;\n  /**\n   * Admin or scoped API key. For event ingest you need admin or a key\n   * with the right scope (the core API currently uses admin-only for\n   * /attribution/events). Never expose this to the browser.\n   */\n  apiKey: string;\n  /** Optional fetch override for tests or custom transports. */\n  fetch?: typeof fetch;\n}\n\nexport interface TrackEventParams {\n  /** The user the event pertains to. Must match how the browser SDK called identify(). */\n  userId: string;\n  /** Event type — typically 'signup' | 'trial_started' | 'subscription_created' | 'invoice_paid' | custom. */\n  type: string;\n  /** Dollar (or currency) value of the event, for percent-commission rules. */\n  value?: number;\n  /** ISO 4217 currency code. Defaults to USD on the server if omitted. */\n  currency?: string;\n  /** Arbitrary metadata you want to attach (stripeEventId, invoiceId, etc). */\n  metadata?: Record<string, unknown>;\n  /** Event time. Defaults to now on the server. Pass ISO 8601 to override. */\n  ts?: string;\n}\n\nexport class OpenPartnerServer {\n  private readonly apiUrl: string;\n  private readonly apiKey: string;\n  private readonly fetchImpl: typeof fetch;\n\n  constructor(config: OpenPartnerServerConfig) {\n    if (!config.apiUrl) throw new OpenPartnerError('apiUrl is required', 400, 'config_missing');\n    if (!config.apiKey) throw new OpenPartnerError('apiKey is required', 400, 'config_missing');\n    this.apiUrl = config.apiUrl.replace(/\\/$/, '');\n    this.apiKey = config.apiKey;\n    this.fetchImpl = config.fetch ?? globalThis.fetch;\n  }\n\n  /**\n   * Record a conversion event. The server walks the userId back to a\n   * click, applies the campaign's attribution model, and writes the\n   * resulting attribution + commission rows.\n   */\n  async trackEvent(params: TrackEventParams): Promise<EventResponse> {\n    return this.request<EventResponse>('/attribution/events', { method: 'POST', body: params });\n  }\n\n  /**\n   * Stitch an attribution token (cref) to a known userId. Normally the\n   * browser SDK does this; use this overload if your backend receives\n   * the cref from the browser (e.g. as part of a signup payload) and\n   * wants to own the stitch call.\n   */\n  async identify(params: { cref: string; userId: string; ts?: number }): Promise<IdentifyResponse> {\n    return this.request<IdentifyResponse>('/attribution/identify', {\n      method: 'POST',\n      body: params,\n    });\n  }\n\n  private async request<T>(path: string, init: JsonRequestInit): Promise<T> {\n    const headers = new Headers(init.headers);\n    headers.set('authorization', `Bearer ${this.apiKey}`);\n    return requestJson<T>(\n      `${this.apiUrl}${path}`,\n      { ...init, headers },\n      // Inject the configured fetch so tests (or alternate transports)\n      // can intercept.\n      this.fetchImpl,\n    );\n  }\n}\n","/**\n * Shared types + error class for both the browser and server entry\n * points.\n *\n * Keeping these in their own module means browser imports won't drag in\n * `fetch` polyfills or server-only code, and server imports won't touch\n * anything that references `window` or `document`.\n */\n\nexport class OpenPartnerError extends Error {\n  constructor(\n    message: string,\n    public readonly status: number,\n    public readonly code?: string,\n    public readonly detail?: unknown,\n  ) {\n    super(message);\n    this.name = 'OpenPartnerError';\n  }\n}\n\nexport interface IdentifyResponse {\n  ok: boolean;\n  identityId: string | null;\n  firstStitch: boolean;\n  backfilledAttributions?: number;\n}\n\nexport interface EventAttribution {\n  status: 'attributed' | 'no_identity' | 'no_click' | 'outside_window' | 'already_attributed';\n  model?: 'last_click' | 'first_click' | 'linear' | 'position';\n  touches?: Array<{\n    clickId: string;\n    partnerId: string;\n    weight: number;\n    attributionId: string;\n    commissionId?: string;\n  }>;\n}\n\nexport interface EventResponse {\n  ok: boolean;\n  eventId: string;\n  attribution: EventAttribution;\n}\n\n/**\n * Small fetch helper used by both entries. Normalizes non-2xx responses\n * into OpenPartnerError so callers can try/catch with a stable shape\n * instead of poking at Response objects themselves.\n */\nexport type JsonRequestInit = Omit<RequestInit, 'body'> & { body?: unknown };\n\nexport async function requestJson<T>(\n  input: string,\n  init: JsonRequestInit = {},\n  fetchImpl: typeof fetch = globalThis.fetch,\n): Promise<T> {\n  const headers = new Headers(init.headers);\n  if (init.body !== undefined && !headers.has('content-type')) {\n    headers.set('content-type', 'application/json');\n  }\n  const res = await fetchImpl(input, {\n    ...init,\n    headers,\n    body:\n      init.body === undefined\n        ? undefined\n        : typeof init.body === 'string'\n          ? init.body\n          : JSON.stringify(init.body),\n  });\n\n  const text = await res.text();\n  let body: unknown = undefined;\n  if (text) {\n    try {\n      body = JSON.parse(text);\n    } catch {\n      body = text;\n    }\n  }\n\n  if (!res.ok) {\n    const errBody = (body ?? {}) as { error?: string; detail?: unknown };\n    throw new OpenPartnerError(\n      errBody.error ?? `${res.status} ${res.statusText}`,\n      res.status,\n      errBody.error,\n      errBody.detail ?? body,\n    );\n  }\n\n  return body as T;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACSO,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1C,YACE,SACgB,QACA,MACA,QAChB;AACA,UAAM,OAAO;AAJG;AACA;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAkCA,eAAsB,YACpB,OACA,OAAwB,CAAC,GACzB,YAA0B,WAAW,OACzB;AACZ,QAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,MAAI,KAAK,SAAS,UAAa,CAAC,QAAQ,IAAI,cAAc,GAAG;AAC3D,YAAQ,IAAI,gBAAgB,kBAAkB;AAAA,EAChD;AACA,QAAM,MAAM,MAAM,UAAU,OAAO;AAAA,IACjC,GAAG;AAAA,IACH;AAAA,IACA,MACE,KAAK,SAAS,SACV,SACA,OAAO,KAAK,SAAS,WACnB,KAAK,OACL,KAAK,UAAU,KAAK,IAAI;AAAA,EAClC,CAAC;AAED,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,MAAI,OAAgB;AACpB,MAAI,MAAM;AACR,QAAI;AACF,aAAO,KAAK,MAAM,IAAI;AAAA,IACxB,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,UAAW,QAAQ,CAAC;AAC1B,UAAM,IAAI;AAAA,MACR,QAAQ,SAAS,GAAG,IAAI,MAAM,IAAI,IAAI,UAAU;AAAA,MAChD,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,QAAQ,UAAU;AAAA,IACpB;AAAA,EACF;AAEA,SAAO;AACT;;;ADtCO,IAAM,oBAAN,MAAwB;AAAA,EAK7B,YAAY,QAAiC;AAJ7C,wBAAiB;AACjB,wBAAiB;AACjB,wBAAiB;AAGf,QAAI,CAAC,OAAO,OAAQ,OAAM,IAAI,iBAAiB,sBAAsB,KAAK,gBAAgB;AAC1F,QAAI,CAAC,OAAO,OAAQ,OAAM,IAAI,iBAAiB,sBAAsB,KAAK,gBAAgB;AAC1F,SAAK,SAAS,OAAO,OAAO,QAAQ,OAAO,EAAE;AAC7C,SAAK,SAAS,OAAO;AACrB,SAAK,YAAY,OAAO,SAAS,WAAW;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,WAAW,QAAkD;AACjE,WAAO,KAAK,QAAuB,uBAAuB,EAAE,QAAQ,QAAQ,MAAM,OAAO,CAAC;AAAA,EAC5F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,SAAS,QAAkF;AAC/F,WAAO,KAAK,QAA0B,yBAAyB;AAAA,MAC7D,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,QAAW,MAAc,MAAmC;AACxE,UAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,YAAQ,IAAI,iBAAiB,UAAU,KAAK,MAAM,EAAE;AACpD,WAAO;AAAA,MACL,GAAG,KAAK,MAAM,GAAG,IAAI;AAAA,MACrB,EAAE,GAAG,MAAM,QAAQ;AAAA;AAAA;AAAA,MAGnB,KAAK;AAAA,IACP;AAAA,EACF;AACF;","names":[]}

package/dist/server.d.cts

@@ -0,0 +1,77 @@
+import { E as EventResponse, I as IdentifyResponse } from './shared-CLfBjPeb.cjs';
+export { a as EventAttribution, O as OpenPartnerError } from './shared-CLfBjPeb.cjs';
+
+/**
+ * Server SDK — runs inside a merchant's backend. Used for the
+ * server-to-server pieces of the attribution pipeline: posting
+ * conversion events (signup / invoice_paid / custom), stitching
+ * clicks to users from the backend, and reading dashboard snapshots.
+ *
+ * Typical integration:
+ *
+ *   import { OpenPartnerServer } from '@openpartner/sdk/server';
+ *
+ *   const op = new OpenPartnerServer({
+ *     apiUrl: process.env.OPENPARTNER_API_URL!,
+ *     apiKey: process.env.OPENPARTNER_API_KEY!,
+ *   });
+ *
+ *   // On signup:
+ *   await op.trackEvent({ userId, type: 'signup' });
+ *
+ *   // On invoice paid:
+ *   await op.trackEvent({ userId, type: 'invoice_paid', value: 249, currency: 'USD' });
+ */
+
+interface OpenPartnerServerConfig {
+    /** Base URL of the OpenPartner API. */
+    apiUrl: string;
+    /**
+     * Admin or scoped API key. For event ingest you need admin or a key
+     * with the right scope (the core API currently uses admin-only for
+     * /attribution/events). Never expose this to the browser.
+     */
+    apiKey: string;
+    /** Optional fetch override for tests or custom transports. */
+    fetch?: typeof fetch;
+}
+interface TrackEventParams {
+    /** The user the event pertains to. Must match how the browser SDK called identify(). */
+    userId: string;
+    /** Event type — typically 'signup' | 'trial_started' | 'subscription_created' | 'invoice_paid' | custom. */
+    type: string;
+    /** Dollar (or currency) value of the event, for percent-commission rules. */
+    value?: number;
+    /** ISO 4217 currency code. Defaults to USD on the server if omitted. */
+    currency?: string;
+    /** Arbitrary metadata you want to attach (stripeEventId, invoiceId, etc). */
+    metadata?: Record<string, unknown>;
+    /** Event time. Defaults to now on the server. Pass ISO 8601 to override. */
+    ts?: string;
+}
+declare class OpenPartnerServer {
+    private readonly apiUrl;
+    private readonly apiKey;
+    private readonly fetchImpl;
+    constructor(config: OpenPartnerServerConfig);
+    /**
+     * Record a conversion event. The server walks the userId back to a
+     * click, applies the campaign's attribution model, and writes the
+     * resulting attribution + commission rows.
+     */
+    trackEvent(params: TrackEventParams): Promise<EventResponse>;
+    /**
+     * Stitch an attribution token (cref) to a known userId. Normally the
+     * browser SDK does this; use this overload if your backend receives
+     * the cref from the browser (e.g. as part of a signup payload) and
+     * wants to own the stitch call.
+     */
+    identify(params: {
+        cref: string;
+        userId: string;
+        ts?: number;
+    }): Promise<IdentifyResponse>;
+    private request;
+}
+
+export { EventResponse, IdentifyResponse, OpenPartnerServer, type OpenPartnerServerConfig, type TrackEventParams };

package/dist/server.d.ts

@@ -0,0 +1,77 @@
+import { E as EventResponse, I as IdentifyResponse } from './shared-CLfBjPeb.js';
+export { a as EventAttribution, O as OpenPartnerError } from './shared-CLfBjPeb.js';
+
+/**
+ * Server SDK — runs inside a merchant's backend. Used for the
+ * server-to-server pieces of the attribution pipeline: posting
+ * conversion events (signup / invoice_paid / custom), stitching
+ * clicks to users from the backend, and reading dashboard snapshots.
+ *
+ * Typical integration:
+ *
+ *   import { OpenPartnerServer } from '@openpartner/sdk/server';
+ *
+ *   const op = new OpenPartnerServer({
+ *     apiUrl: process.env.OPENPARTNER_API_URL!,
+ *     apiKey: process.env.OPENPARTNER_API_KEY!,
+ *   });
+ *
+ *   // On signup:
+ *   await op.trackEvent({ userId, type: 'signup' });
+ *
+ *   // On invoice paid:
+ *   await op.trackEvent({ userId, type: 'invoice_paid', value: 249, currency: 'USD' });
+ */
+
+interface OpenPartnerServerConfig {
+    /** Base URL of the OpenPartner API. */
+    apiUrl: string;
+    /**
+     * Admin or scoped API key. For event ingest you need admin or a key
+     * with the right scope (the core API currently uses admin-only for
+     * /attribution/events). Never expose this to the browser.
+     */
+    apiKey: string;
+    /** Optional fetch override for tests or custom transports. */
+    fetch?: typeof fetch;
+}
+interface TrackEventParams {
+    /** The user the event pertains to. Must match how the browser SDK called identify(). */
+    userId: string;
+    /** Event type — typically 'signup' | 'trial_started' | 'subscription_created' | 'invoice_paid' | custom. */
+    type: string;
+    /** Dollar (or currency) value of the event, for percent-commission rules. */
+    value?: number;
+    /** ISO 4217 currency code. Defaults to USD on the server if omitted. */
+    currency?: string;
+    /** Arbitrary metadata you want to attach (stripeEventId, invoiceId, etc). */
+    metadata?: Record<string, unknown>;
+    /** Event time. Defaults to now on the server. Pass ISO 8601 to override. */
+    ts?: string;
+}
+declare class OpenPartnerServer {
+    private readonly apiUrl;
+    private readonly apiKey;
+    private readonly fetchImpl;
+    constructor(config: OpenPartnerServerConfig);
+    /**
+     * Record a conversion event. The server walks the userId back to a
+     * click, applies the campaign's attribution model, and writes the
+     * resulting attribution + commission rows.
+     */
+    trackEvent(params: TrackEventParams): Promise<EventResponse>;
+    /**
+     * Stitch an attribution token (cref) to a known userId. Normally the
+     * browser SDK does this; use this overload if your backend receives
+     * the cref from the browser (e.g. as part of a signup payload) and
+     * wants to own the stitch call.
+     */
+    identify(params: {
+        cref: string;
+        userId: string;
+        ts?: number;
+    }): Promise<IdentifyResponse>;
+    private request;
+}
+
+export { EventResponse, IdentifyResponse, OpenPartnerServer, type OpenPartnerServerConfig, type TrackEventParams };

package/dist/server.js

@@ -0,0 +1,94 @@
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+
+// src/shared.ts
+var OpenPartnerError = class extends Error {
+  constructor(message, status, code, detail) {
+    super(message);
+    __publicField(this, "status", status);
+    __publicField(this, "code", code);
+    __publicField(this, "detail", detail);
+    this.name = "OpenPartnerError";
+  }
+};
+async function requestJson(input, init = {}, fetchImpl = globalThis.fetch) {
+  const headers = new Headers(init.headers);
+  if (init.body !== void 0 && !headers.has("content-type")) {
+    headers.set("content-type", "application/json");
+  }
+  const res = await fetchImpl(input, {
+    ...init,
+    headers,
+    body: init.body === void 0 ? void 0 : typeof init.body === "string" ? init.body : JSON.stringify(init.body)
+  });
+  const text = await res.text();
+  let body = void 0;
+  if (text) {
+    try {
+      body = JSON.parse(text);
+    } catch {
+      body = text;
+    }
+  }
+  if (!res.ok) {
+    const errBody = body ?? {};
+    throw new OpenPartnerError(
+      errBody.error ?? `${res.status} ${res.statusText}`,
+      res.status,
+      errBody.error,
+      errBody.detail ?? body
+    );
+  }
+  return body;
+}
+
+// src/server.ts
+var OpenPartnerServer = class {
+  constructor(config) {
+    __publicField(this, "apiUrl");
+    __publicField(this, "apiKey");
+    __publicField(this, "fetchImpl");
+    if (!config.apiUrl) throw new OpenPartnerError("apiUrl is required", 400, "config_missing");
+    if (!config.apiKey) throw new OpenPartnerError("apiKey is required", 400, "config_missing");
+    this.apiUrl = config.apiUrl.replace(/\/$/, "");
+    this.apiKey = config.apiKey;
+    this.fetchImpl = config.fetch ?? globalThis.fetch;
+  }
+  /**
+   * Record a conversion event. The server walks the userId back to a
+   * click, applies the campaign's attribution model, and writes the
+   * resulting attribution + commission rows.
+   */
+  async trackEvent(params) {
+    return this.request("/attribution/events", { method: "POST", body: params });
+  }
+  /**
+   * Stitch an attribution token (cref) to a known userId. Normally the
+   * browser SDK does this; use this overload if your backend receives
+   * the cref from the browser (e.g. as part of a signup payload) and
+   * wants to own the stitch call.
+   */
+  async identify(params) {
+    return this.request("/attribution/identify", {
+      method: "POST",
+      body: params
+    });
+  }
+  async request(path, init) {
+    const headers = new Headers(init.headers);
+    headers.set("authorization", `Bearer ${this.apiKey}`);
+    return requestJson(
+      `${this.apiUrl}${path}`,
+      { ...init, headers },
+      // Inject the configured fetch so tests (or alternate transports)
+      // can intercept.
+      this.fetchImpl
+    );
+  }
+};
+export {
+  OpenPartnerError,
+  OpenPartnerServer
+};
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/shared.ts","../src/server.ts"],"sourcesContent":["/**\n * Shared types + error class for both the browser and server entry\n * points.\n *\n * Keeping these in their own module means browser imports won't drag in\n * `fetch` polyfills or server-only code, and server imports won't touch\n * anything that references `window` or `document`.\n */\n\nexport class OpenPartnerError extends Error {\n  constructor(\n    message: string,\n    public readonly status: number,\n    public readonly code?: string,\n    public readonly detail?: unknown,\n  ) {\n    super(message);\n    this.name = 'OpenPartnerError';\n  }\n}\n\nexport interface IdentifyResponse {\n  ok: boolean;\n  identityId: string | null;\n  firstStitch: boolean;\n  backfilledAttributions?: number;\n}\n\nexport interface EventAttribution {\n  status: 'attributed' | 'no_identity' | 'no_click' | 'outside_window' | 'already_attributed';\n  model?: 'last_click' | 'first_click' | 'linear' | 'position';\n  touches?: Array<{\n    clickId: string;\n    partnerId: string;\n    weight: number;\n    attributionId: string;\n    commissionId?: string;\n  }>;\n}\n\nexport interface EventResponse {\n  ok: boolean;\n  eventId: string;\n  attribution: EventAttribution;\n}\n\n/**\n * Small fetch helper used by both entries. Normalizes non-2xx responses\n * into OpenPartnerError so callers can try/catch with a stable shape\n * instead of poking at Response objects themselves.\n */\nexport type JsonRequestInit = Omit<RequestInit, 'body'> & { body?: unknown };\n\nexport async function requestJson<T>(\n  input: string,\n  init: JsonRequestInit = {},\n  fetchImpl: typeof fetch = globalThis.fetch,\n): Promise<T> {\n  const headers = new Headers(init.headers);\n  if (init.body !== undefined && !headers.has('content-type')) {\n    headers.set('content-type', 'application/json');\n  }\n  const res = await fetchImpl(input, {\n    ...init,\n    headers,\n    body:\n      init.body === undefined\n        ? undefined\n        : typeof init.body === 'string'\n          ? init.body\n          : JSON.stringify(init.body),\n  });\n\n  const text = await res.text();\n  let body: unknown = undefined;\n  if (text) {\n    try {\n      body = JSON.parse(text);\n    } catch {\n      body = text;\n    }\n  }\n\n  if (!res.ok) {\n    const errBody = (body ?? {}) as { error?: string; detail?: unknown };\n    throw new OpenPartnerError(\n      errBody.error ?? `${res.status} ${res.statusText}`,\n      res.status,\n      errBody.error,\n      errBody.detail ?? body,\n    );\n  }\n\n  return body as T;\n}\n","/**\n * Server SDK — runs inside a merchant's backend. Used for the\n * server-to-server pieces of the attribution pipeline: posting\n * conversion events (signup / invoice_paid / custom), stitching\n * clicks to users from the backend, and reading dashboard snapshots.\n *\n * Typical integration:\n *\n *   import { OpenPartnerServer } from '@openpartner/sdk/server';\n *\n *   const op = new OpenPartnerServer({\n *     apiUrl: process.env.OPENPARTNER_API_URL!,\n *     apiKey: process.env.OPENPARTNER_API_KEY!,\n *   });\n *\n *   // On signup:\n *   await op.trackEvent({ userId, type: 'signup' });\n *\n *   // On invoice paid:\n *   await op.trackEvent({ userId, type: 'invoice_paid', value: 249, currency: 'USD' });\n */\n\nimport { OpenPartnerError, requestJson, type EventResponse, type IdentifyResponse, type JsonRequestInit } from './shared.js';\n\nexport { OpenPartnerError };\nexport type { EventResponse, IdentifyResponse };\nexport type { EventAttribution } from './shared.js';\n\nexport interface OpenPartnerServerConfig {\n  /** Base URL of the OpenPartner API. */\n  apiUrl: string;\n  /**\n   * Admin or scoped API key. For event ingest you need admin or a key\n   * with the right scope (the core API currently uses admin-only for\n   * /attribution/events). Never expose this to the browser.\n   */\n  apiKey: string;\n  /** Optional fetch override for tests or custom transports. */\n  fetch?: typeof fetch;\n}\n\nexport interface TrackEventParams {\n  /** The user the event pertains to. Must match how the browser SDK called identify(). */\n  userId: string;\n  /** Event type — typically 'signup' | 'trial_started' | 'subscription_created' | 'invoice_paid' | custom. */\n  type: string;\n  /** Dollar (or currency) value of the event, for percent-commission rules. */\n  value?: number;\n  /** ISO 4217 currency code. Defaults to USD on the server if omitted. */\n  currency?: string;\n  /** Arbitrary metadata you want to attach (stripeEventId, invoiceId, etc). */\n  metadata?: Record<string, unknown>;\n  /** Event time. Defaults to now on the server. Pass ISO 8601 to override. */\n  ts?: string;\n}\n\nexport class OpenPartnerServer {\n  private readonly apiUrl: string;\n  private readonly apiKey: string;\n  private readonly fetchImpl: typeof fetch;\n\n  constructor(config: OpenPartnerServerConfig) {\n    if (!config.apiUrl) throw new OpenPartnerError('apiUrl is required', 400, 'config_missing');\n    if (!config.apiKey) throw new OpenPartnerError('apiKey is required', 400, 'config_missing');\n    this.apiUrl = config.apiUrl.replace(/\\/$/, '');\n    this.apiKey = config.apiKey;\n    this.fetchImpl = config.fetch ?? globalThis.fetch;\n  }\n\n  /**\n   * Record a conversion event. The server walks the userId back to a\n   * click, applies the campaign's attribution model, and writes the\n   * resulting attribution + commission rows.\n   */\n  async trackEvent(params: TrackEventParams): Promise<EventResponse> {\n    return this.request<EventResponse>('/attribution/events', { method: 'POST', body: params });\n  }\n\n  /**\n   * Stitch an attribution token (cref) to a known userId. Normally the\n   * browser SDK does this; use this overload if your backend receives\n   * the cref from the browser (e.g. as part of a signup payload) and\n   * wants to own the stitch call.\n   */\n  async identify(params: { cref: string; userId: string; ts?: number }): Promise<IdentifyResponse> {\n    return this.request<IdentifyResponse>('/attribution/identify', {\n      method: 'POST',\n      body: params,\n    });\n  }\n\n  private async request<T>(path: string, init: JsonRequestInit): Promise<T> {\n    const headers = new Headers(init.headers);\n    headers.set('authorization', `Bearer ${this.apiKey}`);\n    return requestJson<T>(\n      `${this.apiUrl}${path}`,\n      { ...init, headers },\n      // Inject the configured fetch so tests (or alternate transports)\n      // can intercept.\n      this.fetchImpl,\n    );\n  }\n}\n"],"mappings":";;;;;AASO,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1C,YACE,SACgB,QACA,MACA,QAChB;AACA,UAAM,OAAO;AAJG;AACA;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAkCA,eAAsB,YACpB,OACA,OAAwB,CAAC,GACzB,YAA0B,WAAW,OACzB;AACZ,QAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,MAAI,KAAK,SAAS,UAAa,CAAC,QAAQ,IAAI,cAAc,GAAG;AAC3D,YAAQ,IAAI,gBAAgB,kBAAkB;AAAA,EAChD;AACA,QAAM,MAAM,MAAM,UAAU,OAAO;AAAA,IACjC,GAAG;AAAA,IACH;AAAA,IACA,MACE,KAAK,SAAS,SACV,SACA,OAAO,KAAK,SAAS,WACnB,KAAK,OACL,KAAK,UAAU,KAAK,IAAI;AAAA,EAClC,CAAC;AAED,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,MAAI,OAAgB;AACpB,MAAI,MAAM;AACR,QAAI;AACF,aAAO,KAAK,MAAM,IAAI;AAAA,IACxB,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,UAAW,QAAQ,CAAC;AAC1B,UAAM,IAAI;AAAA,MACR,QAAQ,SAAS,GAAG,IAAI,MAAM,IAAI,IAAI,UAAU;AAAA,MAChD,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,QAAQ,UAAU;AAAA,IACpB;AAAA,EACF;AAEA,SAAO;AACT;;;ACtCO,IAAM,oBAAN,MAAwB;AAAA,EAK7B,YAAY,QAAiC;AAJ7C,wBAAiB;AACjB,wBAAiB;AACjB,wBAAiB;AAGf,QAAI,CAAC,OAAO,OAAQ,OAAM,IAAI,iBAAiB,sBAAsB,KAAK,gBAAgB;AAC1F,QAAI,CAAC,OAAO,OAAQ,OAAM,IAAI,iBAAiB,sBAAsB,KAAK,gBAAgB;AAC1F,SAAK,SAAS,OAAO,OAAO,QAAQ,OAAO,EAAE;AAC7C,SAAK,SAAS,OAAO;AACrB,SAAK,YAAY,OAAO,SAAS,WAAW;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,WAAW,QAAkD;AACjE,WAAO,KAAK,QAAuB,uBAAuB,EAAE,QAAQ,QAAQ,MAAM,OAAO,CAAC;AAAA,EAC5F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,SAAS,QAAkF;AAC/F,WAAO,KAAK,QAA0B,yBAAyB;AAAA,MAC7D,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,QAAW,MAAc,MAAmC;AACxE,UAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,YAAQ,IAAI,iBAAiB,UAAU,KAAK,MAAM,EAAE;AACpD,WAAO;AAAA,MACL,GAAG,KAAK,MAAM,GAAG,IAAI;AAAA,MACrB,EAAE,GAAG,MAAM,QAAQ;AAAA;AAAA;AAAA,MAGnB,KAAK;AAAA,IACP;AAAA,EACF;AACF;","names":[]}

package/dist/shared-CLfBjPeb.d.cts

@@ -0,0 +1,38 @@
+/**
+ * Shared types + error class for both the browser and server entry
+ * points.
+ *
+ * Keeping these in their own module means browser imports won't drag in
+ * `fetch` polyfills or server-only code, and server imports won't touch
+ * anything that references `window` or `document`.
+ */
+declare class OpenPartnerError extends Error {
+    readonly status: number;
+    readonly code?: string | undefined;
+    readonly detail?: unknown;
+    constructor(message: string, status: number, code?: string | undefined, detail?: unknown);
+}
+interface IdentifyResponse {
+    ok: boolean;
+    identityId: string | null;
+    firstStitch: boolean;
+    backfilledAttributions?: number;
+}
+interface EventAttribution {
+    status: 'attributed' | 'no_identity' | 'no_click' | 'outside_window' | 'already_attributed';
+    model?: 'last_click' | 'first_click' | 'linear' | 'position';
+    touches?: Array<{
+        clickId: string;
+        partnerId: string;
+        weight: number;
+        attributionId: string;
+        commissionId?: string;
+    }>;
+}
+interface EventResponse {
+    ok: boolean;
+    eventId: string;
+    attribution: EventAttribution;
+}
+
+export { type EventResponse as E, type IdentifyResponse as I, OpenPartnerError as O, type EventAttribution as a };

package/dist/shared-CLfBjPeb.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Shared types + error class for both the browser and server entry
+ * points.
+ *
+ * Keeping these in their own module means browser imports won't drag in
+ * `fetch` polyfills or server-only code, and server imports won't touch
+ * anything that references `window` or `document`.
+ */
+declare class OpenPartnerError extends Error {
+    readonly status: number;
+    readonly code?: string | undefined;
+    readonly detail?: unknown;
+    constructor(message: string, status: number, code?: string | undefined, detail?: unknown);
+}
+interface IdentifyResponse {
+    ok: boolean;
+    identityId: string | null;
+    firstStitch: boolean;
+    backfilledAttributions?: number;
+}
+interface EventAttribution {
+    status: 'attributed' | 'no_identity' | 'no_click' | 'outside_window' | 'already_attributed';
+    model?: 'last_click' | 'first_click' | 'linear' | 'position';
+    touches?: Array<{
+        clickId: string;
+        partnerId: string;
+        weight: number;
+        attributionId: string;
+        commissionId?: string;
+    }>;
+}
+interface EventResponse {
+    ok: boolean;
+    eventId: string;
+    attribution: EventAttribution;
+}
+
+export { type EventResponse as E, type IdentifyResponse as I, OpenPartnerError as O, type EventAttribution as a };

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "@openpartner/sdk",
+  "version": "0.1.0",
+  "description": "OpenPartner SDK. Browser client for click → identity stitching + Node server SDK for conversion events and attribution reads.",
+  "type": "module",
+  "main": "./dist/browser.cjs",
+  "module": "./dist/browser.js",
+  "types": "./dist/browser.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/browser.d.ts",
+      "import": "./dist/browser.js",
+      "require": "./dist/browser.cjs"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js",
+      "require": "./dist/server.cjs"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "openpartner",
+    "affiliate",
+    "attribution",
+    "referral",
+    "partner",
+    "sdk"
+  ],
+  "homepage": "https://github.com/getcoherence/openpartner/tree/main/packages/sdk",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/getcoherence/openpartner.git",
+    "directory": "packages/sdk"
+  },
+  "license": "MIT",
+  "sideEffects": false,
+  "devDependencies": {
+    "jsdom": "^29.0.2",
+    "tsup": "^8.5.1",
+    "typescript": "5.4.5",
+    "vitest": "^1.6.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "lint": "tsc --noEmit",
+    "test": "vitest run --passWithNoTests"
+  }
+}