@reblu/site-client 5.20.0 → 5.22.0

package/dist/index.d.cts

@@ -1,5 +1,5 @@
 import * as _reblu_site_contracts from '@reblu/site-contracts';
-import { AcademyCourseListQuery, PaginationMeta, PageType, PagesListSort, ShopSort, AcademyCheckoutErrorCode, TrustBadgeType, ContactFormInput } from '@reblu/site-contracts';
+import { AcademyCourseListQuery, PaginationMeta, PageType, PagesListSort, ShopSort, AcademyCheckoutErrorCode, TrustBadgeType, ContactFormInput, LeadAttribution, LeadTouch } from '@reblu/site-contracts';
 
 /**
  * Cache adapter — the seam that severs the SDK from any framework's caching
@@ -333,6 +333,11 @@ interface ReviewListParams {
     /** At most this many reviews (1..100). Omit for all of them. */
     limit?: number;
 }
+/** Options for {@link makeReviewsNamespace}'s `featured` (REB-1272). */
+interface FeaturedReviewsParams {
+    /** At most this many featured reviews (1..100). Omit for all of them. */
+    limit?: number;
+}
 
 /**
  * Stripe Checkout redirect-origin guard (REB-836, defence in depth).
@@ -392,6 +397,13 @@ interface ContactFormMetadataOptions {
     location?: PageLocation | null;
     /** Submission time. @default new Date() */
     now?: Date;
+    /**
+     * REB-1366 — the lead's origin (first and last touch). Defaults to what the
+     * page's store holds (`getLeadAttributionStore()`, filled by
+     * `LeadAttributionCapture` from `@reblu/site-next/consent`); `null` sends
+     * none. Omitted from the body when there is nothing to send.
+     */
+    attribution?: LeadAttribution | null;
 }
 /**
  * Path of the page the visitor is on — `location.pathname`, never with a query
@@ -401,7 +413,8 @@ declare function currentPagePath(location?: PageLocation | null): string;
 /**
  * The `metadata` for `contactForm.submit()` / `POST /api/site/contact-form`:
  * `fromPage` is the current page path, `currentUrl` the full href (base-api
- * reads the UTMs from it), `timestamp` the submission time.
+ * reads the UTMs from it), `timestamp` the submission time, and `attribution`
+ * the visit's first/last touch when the page recorded any (REB-1366).
  *
  * ```ts
  * body: JSON.stringify({ ...fields, captcha, metadata: buildContactFormMetadata() })
@@ -409,6 +422,84 @@ declare function currentPagePath(location?: PageLocation | null): string;
  */
 declare function buildContactFormMetadata(options?: ContactFormMetadataOptions): ContactFormMetadata;
 
+/**
+ * REB-1366 — where a lead came from, captured in the browser.
+ *
+ * Each full page load yields at most one RAW touch (`leadTouchFromVisit`):
+ * the `utm_*` params, the NAMES of ad click ids (never their values), the
+ * external referrer's HOST (never the full URL) and the landing path. The
+ * store keeps the FIRST touch and the LAST non-direct one. base-api decides
+ * the channel (campaign, search, social, referral, direct, email) from these
+ * raw inputs, so this module never classifies — one classifier, server-side.
+ *
+ * Consent (owner, 25-Oct-2026): memory only until the visitor grants the
+ * `analytics` cookie category; after that, a first-party cookie kept 90 days.
+ * Denying or withdrawing removes the cookie; memory still serves the page the
+ * visitor is on. Nothing here holds personal data: values that look like an
+ * email are dropped and every value is capped.
+ *
+ * Dependency-free on purpose: it runs on every page of every SITE.
+ */
+/** The first-party cookie the touches are kept in after `analytics` consent. */
+declare const LEAD_ATTRIBUTION_COOKIE_NAME = "reblu_attribution";
+/** 90 days (owner decision, 25-Oct-2026). */
+declare const LEAD_ATTRIBUTION_MAX_AGE_SECONDS: number;
+/** Ad click-id params whose NAMES are sent (base-api's list). */
+declare const LEAD_ATTRIBUTION_CLICK_IDS: readonly ["gclid", "gbraid", "wbraid", "dclid", "msclkid", "ttclid", "li_fat_id", "fbclid"];
+/** One page load: the URL it opened and the referrer it came from. */
+interface LeadVisit {
+    /** @default globalThis.location.href */
+    href?: string;
+    /** @default globalThis.document.referrer */
+    referrer?: string | null;
+    /** @default new Date() */
+    now?: Date;
+}
+/**
+ * The raw touch of one page load, or `null` when the load is not a new visit:
+ * a referrer on the SITE's own host (navigation), or a return from a payment
+ * or login flow. A load with no referrer and no campaign is a DIRECT touch
+ * (landing path and time only).
+ */
+declare function leadTouchFromVisit(visit?: LeadVisit): LeadTouch | null;
+/** Where the store keeps its cookie (`document.cookie` by default; a fake in tests). */
+interface LeadAttributionCookieJar {
+    read(): string | null;
+    write(value: string, maxAgeSeconds: number): void;
+    remove(): void;
+}
+interface LeadAttributionStore {
+    /** Records the touch of the current page load (`leadTouchFromVisit`). */
+    recordVisit(visit?: LeadVisit): void;
+    /** Keeps `touch` as first (if none yet) and as last (if not direct). Null is ignored. */
+    record(touch: LeadTouch | null): void;
+    /**
+     * The visitor's `analytics` consent. `true` reads the stored touches, merges
+     * them with this page's and writes the cookie; `false` removes the cookie.
+     * Until called, the store is memory-only and never touches the cookie.
+     */
+    setConsent(granted: boolean): void;
+    /** The touches to send with a lead, or `undefined` when there are none. */
+    get(): LeadAttribution | undefined;
+}
+interface LeadAttributionStoreOptions {
+    /** @default the `document.cookie` jar; `null` keeps the store memory-only. */
+    cookies?: LeadAttributionCookieJar | null;
+    /** @default () => new Date() */
+    now?: () => Date;
+}
+declare function createLeadAttributionStore(options?: LeadAttributionStoreOptions): LeadAttributionStore;
+/**
+ * The page's one store, shared by the capture (`LeadAttributionCapture` from
+ * `@reblu/site-next/consent`) and `buildContactFormMetadata()`. Kept on
+ * `globalThis` so two bundled copies of this package still share it. On the
+ * server (no `window`) every call gets a new, empty store: one process serves
+ * every visitor, so nothing may be shared there.
+ */
+declare function getLeadAttributionStore(): LeadAttributionStore;
+/** Drops the shared store (tests; a fresh one is created on the next call). */
+declare function resetLeadAttributionStore(): void;
+
 interface RebluClientConfig {
     /** Absolute origin of the Reblu SITE API, e.g. `https://api.reblu.app`. */
     baseUrl: string;
@@ -512,9 +603,10 @@ declare function createRebluClient(config: RebluClientConfig): {
     };
     reviews: {
         list: (params?: ReviewListParams, cache?: RebluCachePolicy) => Promise<ListResult<_reblu_site_contracts.Review>>;
+        featured: (params?: FeaturedReviewsParams, cache?: RebluCachePolicy) => Promise<_reblu_site_contracts.FeaturedReviews>;
     };
 };
 /** The assembled client returned by {@link createRebluClient}. */
 type RebluClient = ReturnType<typeof createRebluClient>;
 
-export { AcademyCheckoutError, type AcademyCheckoutErrorDetails, type AcademyCourseListParams, type AcademyEnrollmentRequestInput, type AcademyEnrollmentRequestResult, AmbiguousPageSlugError, ApiError, type ApiErrorBody, type ApiErrorDetails, type BlogListParams, type ContactFormMetadata, type ContactFormMetadataOptions, DEFAULT_CHECKOUT_REDIRECT_HOSTS, type FeaturedPagesOptions, type ListResult, type PageBySlugOptions, type PageLocation, type PageSlugCandidate, type PagesListParams, PlainCacheAdapter, RETRY_AFTER_CAP_MS, type RebluCacheAdapter, type RebluCachePolicy, type RebluClient, type RebluClientConfig, type RebluMutationOptions, type RequestScope, type ReviewListParams, type ShopProductsParams, type TrustBadgeListParams, UnsafeCheckoutRedirectError, VISITOR_IP_HEADER, buildContactFormMetadata, createRebluClient, currentPagePath, isSafeCheckoutRedirectUrl, visitorIpFromHeaders };
+export { AcademyCheckoutError, type AcademyCheckoutErrorDetails, type AcademyCourseListParams, type AcademyEnrollmentRequestInput, type AcademyEnrollmentRequestResult, AmbiguousPageSlugError, ApiError, type ApiErrorBody, type ApiErrorDetails, type BlogListParams, type ContactFormMetadata, type ContactFormMetadataOptions, DEFAULT_CHECKOUT_REDIRECT_HOSTS, type FeaturedPagesOptions, type FeaturedReviewsParams, LEAD_ATTRIBUTION_CLICK_IDS, LEAD_ATTRIBUTION_COOKIE_NAME, LEAD_ATTRIBUTION_MAX_AGE_SECONDS, type LeadAttributionCookieJar, type LeadAttributionStore, type LeadAttributionStoreOptions, type LeadVisit, type ListResult, type PageBySlugOptions, type PageLocation, type PageSlugCandidate, type PagesListParams, PlainCacheAdapter, RETRY_AFTER_CAP_MS, type RebluCacheAdapter, type RebluCachePolicy, type RebluClient, type RebluClientConfig, type RebluMutationOptions, type RequestScope, type ReviewListParams, type ShopProductsParams, type TrustBadgeListParams, UnsafeCheckoutRedirectError, VISITOR_IP_HEADER, buildContactFormMetadata, createLeadAttributionStore, createRebluClient, currentPagePath, getLeadAttributionStore, isSafeCheckoutRedirectUrl, leadTouchFromVisit, resetLeadAttributionStore, visitorIpFromHeaders };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import * as _reblu_site_contracts from '@reblu/site-contracts';
-import { AcademyCourseListQuery, PaginationMeta, PageType, PagesListSort, ShopSort, AcademyCheckoutErrorCode, TrustBadgeType, ContactFormInput } from '@reblu/site-contracts';
+import { AcademyCourseListQuery, PaginationMeta, PageType, PagesListSort, ShopSort, AcademyCheckoutErrorCode, TrustBadgeType, ContactFormInput, LeadAttribution, LeadTouch } from '@reblu/site-contracts';
 
 /**
  * Cache adapter — the seam that severs the SDK from any framework's caching
@@ -333,6 +333,11 @@ interface ReviewListParams {
     /** At most this many reviews (1..100). Omit for all of them. */
     limit?: number;
 }
+/** Options for {@link makeReviewsNamespace}'s `featured` (REB-1272). */
+interface FeaturedReviewsParams {
+    /** At most this many featured reviews (1..100). Omit for all of them. */
+    limit?: number;
+}
 
 /**
  * Stripe Checkout redirect-origin guard (REB-836, defence in depth).
@@ -392,6 +397,13 @@ interface ContactFormMetadataOptions {
     location?: PageLocation | null;
     /** Submission time. @default new Date() */
     now?: Date;
+    /**
+     * REB-1366 — the lead's origin (first and last touch). Defaults to what the
+     * page's store holds (`getLeadAttributionStore()`, filled by
+     * `LeadAttributionCapture` from `@reblu/site-next/consent`); `null` sends
+     * none. Omitted from the body when there is nothing to send.
+     */
+    attribution?: LeadAttribution | null;
 }
 /**
  * Path of the page the visitor is on — `location.pathname`, never with a query
@@ -401,7 +413,8 @@ declare function currentPagePath(location?: PageLocation | null): string;
 /**
  * The `metadata` for `contactForm.submit()` / `POST /api/site/contact-form`:
  * `fromPage` is the current page path, `currentUrl` the full href (base-api
- * reads the UTMs from it), `timestamp` the submission time.
+ * reads the UTMs from it), `timestamp` the submission time, and `attribution`
+ * the visit's first/last touch when the page recorded any (REB-1366).
  *
  * ```ts
  * body: JSON.stringify({ ...fields, captcha, metadata: buildContactFormMetadata() })
@@ -409,6 +422,84 @@ declare function currentPagePath(location?: PageLocation | null): string;
  */
 declare function buildContactFormMetadata(options?: ContactFormMetadataOptions): ContactFormMetadata;
 
+/**
+ * REB-1366 — where a lead came from, captured in the browser.
+ *
+ * Each full page load yields at most one RAW touch (`leadTouchFromVisit`):
+ * the `utm_*` params, the NAMES of ad click ids (never their values), the
+ * external referrer's HOST (never the full URL) and the landing path. The
+ * store keeps the FIRST touch and the LAST non-direct one. base-api decides
+ * the channel (campaign, search, social, referral, direct, email) from these
+ * raw inputs, so this module never classifies — one classifier, server-side.
+ *
+ * Consent (owner, 25-Oct-2026): memory only until the visitor grants the
+ * `analytics` cookie category; after that, a first-party cookie kept 90 days.
+ * Denying or withdrawing removes the cookie; memory still serves the page the
+ * visitor is on. Nothing here holds personal data: values that look like an
+ * email are dropped and every value is capped.
+ *
+ * Dependency-free on purpose: it runs on every page of every SITE.
+ */
+/** The first-party cookie the touches are kept in after `analytics` consent. */
+declare const LEAD_ATTRIBUTION_COOKIE_NAME = "reblu_attribution";
+/** 90 days (owner decision, 25-Oct-2026). */
+declare const LEAD_ATTRIBUTION_MAX_AGE_SECONDS: number;
+/** Ad click-id params whose NAMES are sent (base-api's list). */
+declare const LEAD_ATTRIBUTION_CLICK_IDS: readonly ["gclid", "gbraid", "wbraid", "dclid", "msclkid", "ttclid", "li_fat_id", "fbclid"];
+/** One page load: the URL it opened and the referrer it came from. */
+interface LeadVisit {
+    /** @default globalThis.location.href */
+    href?: string;
+    /** @default globalThis.document.referrer */
+    referrer?: string | null;
+    /** @default new Date() */
+    now?: Date;
+}
+/**
+ * The raw touch of one page load, or `null` when the load is not a new visit:
+ * a referrer on the SITE's own host (navigation), or a return from a payment
+ * or login flow. A load with no referrer and no campaign is a DIRECT touch
+ * (landing path and time only).
+ */
+declare function leadTouchFromVisit(visit?: LeadVisit): LeadTouch | null;
+/** Where the store keeps its cookie (`document.cookie` by default; a fake in tests). */
+interface LeadAttributionCookieJar {
+    read(): string | null;
+    write(value: string, maxAgeSeconds: number): void;
+    remove(): void;
+}
+interface LeadAttributionStore {
+    /** Records the touch of the current page load (`leadTouchFromVisit`). */
+    recordVisit(visit?: LeadVisit): void;
+    /** Keeps `touch` as first (if none yet) and as last (if not direct). Null is ignored. */
+    record(touch: LeadTouch | null): void;
+    /**
+     * The visitor's `analytics` consent. `true` reads the stored touches, merges
+     * them with this page's and writes the cookie; `false` removes the cookie.
+     * Until called, the store is memory-only and never touches the cookie.
+     */
+    setConsent(granted: boolean): void;
+    /** The touches to send with a lead, or `undefined` when there are none. */
+    get(): LeadAttribution | undefined;
+}
+interface LeadAttributionStoreOptions {
+    /** @default the `document.cookie` jar; `null` keeps the store memory-only. */
+    cookies?: LeadAttributionCookieJar | null;
+    /** @default () => new Date() */
+    now?: () => Date;
+}
+declare function createLeadAttributionStore(options?: LeadAttributionStoreOptions): LeadAttributionStore;
+/**
+ * The page's one store, shared by the capture (`LeadAttributionCapture` from
+ * `@reblu/site-next/consent`) and `buildContactFormMetadata()`. Kept on
+ * `globalThis` so two bundled copies of this package still share it. On the
+ * server (no `window`) every call gets a new, empty store: one process serves
+ * every visitor, so nothing may be shared there.
+ */
+declare function getLeadAttributionStore(): LeadAttributionStore;
+/** Drops the shared store (tests; a fresh one is created on the next call). */
+declare function resetLeadAttributionStore(): void;
+
 interface RebluClientConfig {
     /** Absolute origin of the Reblu SITE API, e.g. `https://api.reblu.app`. */
     baseUrl: string;
@@ -512,9 +603,10 @@ declare function createRebluClient(config: RebluClientConfig): {
     };
     reviews: {
         list: (params?: ReviewListParams, cache?: RebluCachePolicy) => Promise<ListResult<_reblu_site_contracts.Review>>;
+        featured: (params?: FeaturedReviewsParams, cache?: RebluCachePolicy) => Promise<_reblu_site_contracts.FeaturedReviews>;
     };
 };
 /** The assembled client returned by {@link createRebluClient}. */
 type RebluClient = ReturnType<typeof createRebluClient>;
 
-export { AcademyCheckoutError, type AcademyCheckoutErrorDetails, type AcademyCourseListParams, type AcademyEnrollmentRequestInput, type AcademyEnrollmentRequestResult, AmbiguousPageSlugError, ApiError, type ApiErrorBody, type ApiErrorDetails, type BlogListParams, type ContactFormMetadata, type ContactFormMetadataOptions, DEFAULT_CHECKOUT_REDIRECT_HOSTS, type FeaturedPagesOptions, type ListResult, type PageBySlugOptions, type PageLocation, type PageSlugCandidate, type PagesListParams, PlainCacheAdapter, RETRY_AFTER_CAP_MS, type RebluCacheAdapter, type RebluCachePolicy, type RebluClient, type RebluClientConfig, type RebluMutationOptions, type RequestScope, type ReviewListParams, type ShopProductsParams, type TrustBadgeListParams, UnsafeCheckoutRedirectError, VISITOR_IP_HEADER, buildContactFormMetadata, createRebluClient, currentPagePath, isSafeCheckoutRedirectUrl, visitorIpFromHeaders };
+export { AcademyCheckoutError, type AcademyCheckoutErrorDetails, type AcademyCourseListParams, type AcademyEnrollmentRequestInput, type AcademyEnrollmentRequestResult, AmbiguousPageSlugError, ApiError, type ApiErrorBody, type ApiErrorDetails, type BlogListParams, type ContactFormMetadata, type ContactFormMetadataOptions, DEFAULT_CHECKOUT_REDIRECT_HOSTS, type FeaturedPagesOptions, type FeaturedReviewsParams, LEAD_ATTRIBUTION_CLICK_IDS, LEAD_ATTRIBUTION_COOKIE_NAME, LEAD_ATTRIBUTION_MAX_AGE_SECONDS, type LeadAttributionCookieJar, type LeadAttributionStore, type LeadAttributionStoreOptions, type LeadVisit, type ListResult, type PageBySlugOptions, type PageLocation, type PageSlugCandidate, type PagesListParams, PlainCacheAdapter, RETRY_AFTER_CAP_MS, type RebluCacheAdapter, type RebluCachePolicy, type RebluClient, type RebluClientConfig, type RebluMutationOptions, type RequestScope, type ReviewListParams, type ShopProductsParams, type TrustBadgeListParams, UnsafeCheckoutRedirectError, VISITOR_IP_HEADER, buildContactFormMetadata, createLeadAttributionStore, createRebluClient, currentPagePath, getLeadAttributionStore, isSafeCheckoutRedirectUrl, leadTouchFromVisit, resetLeadAttributionStore, visitorIpFromHeaders };

package/dist/index.js

@@ -679,7 +679,14 @@ function makeReviewsNamespace(ctx) {
       { cachePolicy: cache }
     );
   }
-  return { list };
+  function featured(params = {}, cache) {
+    return requestOne(
+      ctx,
+      buildUrl("/api/site/reviews/featured", { limit: params.limit }),
+      { cachePolicy: cache }
+    );
+  }
+  return { list, featured };
 }
 
 // src/domains/trust-badges.ts
@@ -715,6 +722,214 @@ function makeWithdrawalRequestsNamespace(ctx) {
   };
 }
 
+// src/lead-attribution.ts
+var LEAD_ATTRIBUTION_COOKIE_NAME = "reblu_attribution";
+var LEAD_ATTRIBUTION_MAX_AGE_SECONDS = 90 * 24 * 60 * 60;
+var LEAD_ATTRIBUTION_CLICK_IDS = [
+  "gclid",
+  "gbraid",
+  "wbraid",
+  "dclid",
+  "msclkid",
+  "ttclid",
+  "li_fat_id",
+  "fbclid"
+];
+var UTM_KEYS = ["source", "medium", "campaign", "content", "term"];
+var VALUE_MAX_LENGTH = 100;
+var PATH_MAX_LENGTH = 200;
+var SHAPE_VERSION = 1;
+var CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
+var HOST = /^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$/;
+var IGNORED_HOSTS = [
+  "checkout.stripe.com",
+  "billing.stripe.com",
+  "paypal.com",
+  "accounts.google.com"
+];
+function cleanValue(value, max = VALUE_MAX_LENGTH) {
+  if (typeof value !== "string" || CONTROL_CHARS.test(value)) return void 0;
+  const clean = value.trim().slice(0, max);
+  return clean && !clean.includes("@") ? clean : void 0;
+}
+function cleanHost(value) {
+  const host = cleanValue(value)?.toLowerCase();
+  return host && HOST.test(host) ? host : void 0;
+}
+function cleanPath(value) {
+  const path = cleanValue(value, PATH_MAX_LENGTH)?.split(/[?#]/, 1)[0];
+  return path && path.startsWith("/") && !path.startsWith("//") ? path : void 0;
+}
+function cleanAt(value) {
+  return typeof value === "string" && !Number.isNaN(Date.parse(value)) ? value : void 0;
+}
+var withoutWww = (host) => host.replace(/^www\./, "");
+var matchesDomain = (host, domain) => host === domain || host.endsWith(`.${domain}`);
+function sanitizeTouch(raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return void 0;
+  const input = raw;
+  const touch = {};
+  const rawUtm = input.utm;
+  if (typeof rawUtm === "object" && rawUtm !== null) {
+    const utm = {};
+    for (const key of UTM_KEYS) {
+      const value = cleanValue(rawUtm[key]);
+      if (value) utm[key] = value;
+    }
+    if (Object.keys(utm).length > 0) touch.utm = utm;
+  }
+  const rawClickIds = input.clickIds;
+  if (Array.isArray(rawClickIds)) {
+    const known = LEAD_ATTRIBUTION_CLICK_IDS.filter((id) => rawClickIds.includes(id));
+    if (known.length > 0) touch.clickIds = known;
+  }
+  const referrer = cleanHost(input.referrer);
+  if (referrer) touch.referrer = referrer;
+  const landingPath = cleanPath(input.landingPath);
+  if (landingPath) touch.landingPath = landingPath;
+  const at = cleanAt(input.at);
+  if (at) touch.at = at;
+  return Object.keys(touch).length > 0 ? touch : void 0;
+}
+function isDirect(touch) {
+  return !touch.utm && !touch.clickIds && !touch.referrer;
+}
+function leadTouchFromVisit(visit = {}) {
+  const g = globalThis;
+  const href = visit.href ?? g.location?.href;
+  const referrer = visit.referrer === void 0 ? g.document?.referrer : visit.referrer;
+  let url;
+  try {
+    url = new URL(href ?? "");
+  } catch {
+    return null;
+  }
+  const raw = {};
+  const utm = {};
+  for (const key of UTM_KEYS) {
+    const value = url.searchParams.get(`utm_${key}`);
+    if (value) utm[key] = value;
+  }
+  if (Object.keys(utm).length > 0) raw.utm = utm;
+  const clickIds = LEAD_ATTRIBUTION_CLICK_IDS.filter((id) => url.searchParams.has(id));
+  if (clickIds.length > 0) raw.clickIds = clickIds;
+  let referrerHost;
+  try {
+    referrerHost = referrer ? new URL(referrer).hostname.toLowerCase() : void 0;
+  } catch {
+  }
+  const ownHost = withoutWww(url.hostname.toLowerCase());
+  const external = referrerHost && withoutWww(referrerHost) !== ownHost && !IGNORED_HOSTS.some((domain) => matchesDomain(referrerHost, domain));
+  if (external) raw.referrer = referrerHost;
+  if (referrerHost && !external && !raw.utm && !raw.clickIds) return null;
+  raw.landingPath = url.pathname;
+  raw.at = (visit.now ?? /* @__PURE__ */ new Date()).toISOString();
+  return sanitizeTouch(raw) ?? null;
+}
+function documentCookieJar() {
+  const doc = globalThis.document;
+  if (!doc) return null;
+  const name = LEAD_ATTRIBUTION_COOKIE_NAME;
+  return {
+    read() {
+      const match = doc.cookie.match(new RegExp(`(?:^|; )${name}=([^;]*)`));
+      if (!match) return null;
+      try {
+        return decodeURIComponent(match[1]);
+      } catch {
+        return null;
+      }
+    },
+    write(value, maxAgeSeconds) {
+      const https = globalThis.location?.protocol === "https:";
+      doc.cookie = `${name}=${encodeURIComponent(value)}; path=/; max-age=${maxAgeSeconds}; SameSite=Lax${https ? "; Secure" : ""}`;
+    },
+    remove() {
+      doc.cookie = `${name}=; path=/; max-age=0; SameSite=Lax`;
+    }
+  };
+}
+var atOf = (touch) => touch?.at ? Date.parse(touch.at) : Number.NaN;
+function createLeadAttributionStore(options = {}) {
+  const cookies = options.cookies === void 0 ? documentCookieJar() : options.cookies;
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  let first;
+  let last;
+  let granted = false;
+  const fresh = (touch) => {
+    const at = atOf(touch);
+    return touch && now().getTime() - at < LEAD_ATTRIBUTION_MAX_AGE_SECONDS * 1e3 ? touch : void 0;
+  };
+  const persist = () => {
+    if (!granted || !cookies) return;
+    const state = { v: SHAPE_VERSION, first: fresh(first), last: fresh(last) };
+    try {
+      if (state.first || state.last) {
+        cookies.write(JSON.stringify(state), LEAD_ATTRIBUTION_MAX_AGE_SECONDS);
+      } else {
+        cookies.remove();
+      }
+    } catch {
+    }
+  };
+  const loadStored = () => {
+    let stored;
+    try {
+      const raw = cookies?.read();
+      const parsed = raw ? JSON.parse(raw) : void 0;
+      if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+        stored = parsed;
+      }
+    } catch {
+    }
+    const storedFirst = fresh(sanitizeTouch(stored?.first));
+    const storedLast = fresh(sanitizeTouch(stored?.last));
+    if (storedFirst && !(atOf(first) < atOf(storedFirst))) first = storedFirst;
+    if (storedLast && !(atOf(last) > atOf(storedLast))) last = storedLast;
+  };
+  const store = {
+    recordVisit(visit) {
+      store.record(leadTouchFromVisit(visit));
+    },
+    record(touch) {
+      if (!touch) return;
+      if (!fresh(first)) first = touch;
+      if (!isDirect(touch)) last = touch;
+      persist();
+    },
+    setConsent(next) {
+      granted = next;
+      if (!cookies) return;
+      if (granted) {
+        loadStored();
+        persist();
+      } else {
+        try {
+          cookies.remove();
+        } catch {
+        }
+      }
+    },
+    get() {
+      const f = fresh(first);
+      const l = fresh(last);
+      if (!f && !l) return void 0;
+      return { ...f && { first: f }, ...l && { last: l } };
+    }
+  };
+  return store;
+}
+var GLOBAL_KEY = "__rebluLeadAttributionStore";
+function getLeadAttributionStore() {
+  const g = globalThis;
+  if (typeof g.window === "undefined") return createLeadAttributionStore({ cookies: null });
+  g[GLOBAL_KEY] ??= createLeadAttributionStore();
+  return g[GLOBAL_KEY];
+}
+function resetLeadAttributionStore() {
+  delete globalThis[GLOBAL_KEY];
+}
+
 // src/contact-form-metadata.ts
 function browserLocation() {
   const location = globalThis.location;
@@ -726,11 +941,13 @@ function currentPagePath(location = browserLocation()) {
 }
 function buildContactFormMetadata(options = {}) {
   const location = options.location === void 0 ? browserLocation() : options.location;
+  const attribution = options.attribution === void 0 ? getLeadAttributionStore().get() : options.attribution;
   return {
     fromPage: options.fromPage ?? currentPagePath(location),
     timestamp: (options.now ?? /* @__PURE__ */ new Date()).toISOString(),
     currentUrl: location?.href ?? "",
-    leadSource: options.leadSource ?? { platform: "organic" }
+    leadSource: options.leadSource ?? { platform: "organic" },
+    ...attribution && { attribution }
   };
 }
 
@@ -768,6 +985,6 @@ function createRebluClient(config) {
   };
 }
 
-export { AcademyCheckoutError, AmbiguousPageSlugError, ApiError, DEFAULT_CHECKOUT_REDIRECT_HOSTS, PlainCacheAdapter, RETRY_AFTER_CAP_MS, UnsafeCheckoutRedirectError, VISITOR_IP_HEADER, buildContactFormMetadata, createRebluClient, currentPagePath, isSafeCheckoutRedirectUrl, visitorIpFromHeaders };
+export { AcademyCheckoutError, AmbiguousPageSlugError, ApiError, DEFAULT_CHECKOUT_REDIRECT_HOSTS, LEAD_ATTRIBUTION_CLICK_IDS, LEAD_ATTRIBUTION_COOKIE_NAME, LEAD_ATTRIBUTION_MAX_AGE_SECONDS, PlainCacheAdapter, RETRY_AFTER_CAP_MS, UnsafeCheckoutRedirectError, VISITOR_IP_HEADER, buildContactFormMetadata, createLeadAttributionStore, createRebluClient, currentPagePath, getLeadAttributionStore, isSafeCheckoutRedirectUrl, leadTouchFromVisit, resetLeadAttributionStore, visitorIpFromHeaders };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map