@shoppexio/storefront 1.0.77 → 1.0.78

package/dist/index.d.cts

@@ -1576,7 +1576,20 @@ interface SearchOptions {
 declare function searchCatalogItems(query: string, options?: SearchOptions): Promise<SDKResponse<StorefrontCatalogSearchItem[]>>;
 declare function searchProducts(query: string, options?: SearchOptions): Promise<SDKResponse<Product[]>>;
 
-declare function setAffiliateCode(code: string | null | undefined, ttlDays?: number): string | null;
+type AffiliateAttributionMode = 'LAST_CLICK' | 'FIRST_CLICK';
+declare function setAffiliateCode(code: string | null | undefined, ttlDays?: number, mode?: AffiliateAttributionMode): string | null;
+/**
+ * The stored attribution, or null when nothing valid is held.
+ *
+ * Unlike `getAffiliateCode()` this also reports the mode the entry was written
+ * under, which is what `captureAffiliateFromUrl` needs BEFORE it decides
+ * whether it may overwrite.
+ */
+declare function getStoredAffiliate(): {
+    code: string;
+    mode: AffiliateAttributionMode;
+    windowDays: number;
+} | null;
 declare function clearAffiliateCode(): void;
 declare function getAffiliateCode(): string | null;
 declare function trackAffiliateEvent(eventType: 'add_to_cart' | 'checkout_started', options?: {
@@ -1599,11 +1612,25 @@ declare function trackAffiliateEvent(eventType: 'add_to_cart' | 'checkout_starte
 declare function validateAffiliateCode(code: string): Promise<SDKResponse<AffiliateValidation>>;
 declare function applyAffiliateCode(code: string): Promise<SDKResponse<AffiliateValidation>>;
 /**
- * Capture an affiliate code from the current URL and store it for 30 days (last-click).
+ * Capture an affiliate code from the current URL and store it (ADR-0067).
  *
  * Example:
  * - URL: https://mystore.com/product/abc?ref=deadbeef
  * - captureAffiliateFromUrl() stores "deadbeef" and returns it.
+ *
+ * Under LAST_CLICK (the default, and the only behaviour before ADR-0067) a new
+ * `?ref=` replaces whatever was stored. Under FIRST_CLICK an existing,
+ * unexpired attribution wins and the new code is NOT stored — the landing is
+ * still reported to the server so the affiliate's click statistics stay
+ * honest, but the credit stays with whoever was there first.
+ *
+ * The mode comes from the server, which means the FIRST landing in a browser
+ * can never be blocked by it — correct, because there is nothing to protect
+ * yet. From then on the mode travels with the stored entry.
+ *
+ * Enforcement is client-side. A buyer who edits localStorage can re-attribute
+ * their own visit; this is the same trust level as the window itself and must
+ * not be presented to merchants as fraud protection.
  */
 declare function captureAffiliateFromUrl(param?: string): Promise<string | null>;
 
@@ -1926,6 +1953,7 @@ declare const shoppex: {
     validateAffiliateCode: typeof validateAffiliateCode;
     applyAffiliateCode: typeof applyAffiliateCode;
     getAffiliateCode: typeof getAffiliateCode;
+    getStoredAffiliate: typeof getStoredAffiliate;
     setAffiliateCode: typeof setAffiliateCode;
     clearAffiliateCode: typeof clearAffiliateCode;
     trackAffiliateEvent: typeof trackAffiliateEvent;

package/dist/index.d.ts

@@ -1576,7 +1576,20 @@ interface SearchOptions {
 declare function searchCatalogItems(query: string, options?: SearchOptions): Promise<SDKResponse<StorefrontCatalogSearchItem[]>>;
 declare function searchProducts(query: string, options?: SearchOptions): Promise<SDKResponse<Product[]>>;
 
-declare function setAffiliateCode(code: string | null | undefined, ttlDays?: number): string | null;
+type AffiliateAttributionMode = 'LAST_CLICK' | 'FIRST_CLICK';
+declare function setAffiliateCode(code: string | null | undefined, ttlDays?: number, mode?: AffiliateAttributionMode): string | null;
+/**
+ * The stored attribution, or null when nothing valid is held.
+ *
+ * Unlike `getAffiliateCode()` this also reports the mode the entry was written
+ * under, which is what `captureAffiliateFromUrl` needs BEFORE it decides
+ * whether it may overwrite.
+ */
+declare function getStoredAffiliate(): {
+    code: string;
+    mode: AffiliateAttributionMode;
+    windowDays: number;
+} | null;
 declare function clearAffiliateCode(): void;
 declare function getAffiliateCode(): string | null;
 declare function trackAffiliateEvent(eventType: 'add_to_cart' | 'checkout_started', options?: {
@@ -1599,11 +1612,25 @@ declare function trackAffiliateEvent(eventType: 'add_to_cart' | 'checkout_starte
 declare function validateAffiliateCode(code: string): Promise<SDKResponse<AffiliateValidation>>;
 declare function applyAffiliateCode(code: string): Promise<SDKResponse<AffiliateValidation>>;
 /**
- * Capture an affiliate code from the current URL and store it for 30 days (last-click).
+ * Capture an affiliate code from the current URL and store it (ADR-0067).
  *
  * Example:
  * - URL: https://mystore.com/product/abc?ref=deadbeef
  * - captureAffiliateFromUrl() stores "deadbeef" and returns it.
+ *
+ * Under LAST_CLICK (the default, and the only behaviour before ADR-0067) a new
+ * `?ref=` replaces whatever was stored. Under FIRST_CLICK an existing,
+ * unexpired attribution wins and the new code is NOT stored — the landing is
+ * still reported to the server so the affiliate's click statistics stay
+ * honest, but the credit stays with whoever was there first.
+ *
+ * The mode comes from the server, which means the FIRST landing in a browser
+ * can never be blocked by it — correct, because there is nothing to protect
+ * yet. From then on the mode travels with the stored entry.
+ *
+ * Enforcement is client-side. A buyer who edits localStorage can re-attribute
+ * their own visit; this is the same trust level as the window itself and must
+ * not be presented to merchants as fraud protection.
  */
 declare function captureAffiliateFromUrl(param?: string): Promise<string | null>;
 
@@ -1926,6 +1953,7 @@ declare const shoppex: {
     validateAffiliateCode: typeof validateAffiliateCode;
     applyAffiliateCode: typeof applyAffiliateCode;
     getAffiliateCode: typeof getAffiliateCode;
+    getStoredAffiliate: typeof getStoredAffiliate;
     setAffiliateCode: typeof setAffiliateCode;
     clearAffiliateCode: typeof clearAffiliateCode;
     trackAffiliateEvent: typeof trackAffiliateEvent;

package/dist/index.js

@@ -3890,6 +3890,9 @@ var SESSION_STORAGE_KEY = "shoppex:affiliate_session:v1";
 var DEFAULT_TTL_DAYS = 30;
 var FALLBACK_SESSION_KEY_LENGTH = 24;
 var SESSION_KEY_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
+function normalizeMode(value) {
+  return value === "FIRST_CLICK" ? "FIRST_CLICK" : "LAST_CLICK";
+}
 function nowMs() {
   return Date.now();
 }
@@ -3907,7 +3910,7 @@ function safeRead() {
     if (!raw) return null;
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed.code !== "string" || typeof parsed.expiresAt !== "number") return null;
-    return parsed;
+    return parsed.mode === void 0 ? parsed : { ...parsed, mode: normalizeMode(parsed.mode) };
   } catch {
     return null;
   }
@@ -3919,15 +3922,32 @@ function safeWrite(value) {
   } catch {
   }
 }
-function setAffiliateCode(code, ttlDays = DEFAULT_TTL_DAYS) {
+function setAffiliateCode(code, ttlDays = DEFAULT_TTL_DAYS, mode) {
   const normalized = normalizeAffiliateCode(code);
   if (!normalized) {
     clearAffiliateCode();
     return null;
   }
-  safeWrite({ code: normalized, expiresAt: nowMs() + ttlMs(ttlDays) });
+  safeWrite({
+    code: normalized,
+    expiresAt: nowMs() + ttlMs(ttlDays),
+    windowDays: ttlDays,
+    ...mode ? { mode } : {}
+  });
   return normalized;
 }
+function getStoredAffiliate() {
+  const stored = safeRead();
+  if (!stored) return null;
+  if (stored.expiresAt <= nowMs()) {
+    clearAffiliateCode();
+    return null;
+  }
+  const code = normalizeAffiliateCode(stored.code);
+  if (!code) return null;
+  const windowDays = typeof stored.windowDays === "number" && stored.windowDays > 0 ? stored.windowDays : DEFAULT_TTL_DAYS;
+  return { code, mode: normalizeMode(stored.mode), windowDays };
+}
 function clearAffiliateCode() {
   if (typeof window === "undefined") return;
   try {
@@ -4073,7 +4093,11 @@ async function captureAffiliateFromUrl(param = "ref") {
   }
   code = normalizeAffiliateCode(code);
   if (!code) return null;
-  setAffiliateCode(code);
+  const held = getStoredAffiliate();
+  const mayHoldFirstClick = held !== null && held.mode === "FIRST_CLICK" && held.code !== code;
+  if (!mayHoldFirstClick) {
+    setAffiliateCode(code, held?.windowDays ?? DEFAULT_TTL_DAYS, held?.mode);
+  }
   if (isInitialized()) {
     try {
       const config = getConfig();
@@ -4082,8 +4106,14 @@ async function captureAffiliateFromUrl(param = "ref") {
         { shop_slug: config.storeSlug, code },
         { retries: 0 }
       );
+      const serverMode = res.success && res.data?.attribution_mode ? normalizeMode(res.data.attribution_mode) : null;
+      const serverWindow = res.success && typeof res.data?.attribution_window_days === "number" ? res.data.attribution_window_days : DEFAULT_TTL_DAYS;
+      const holdsFirstClick = mayHoldFirstClick && serverMode !== "LAST_CLICK";
+      if (holdsFirstClick) {
+        return held.code;
+      }
       if (res.success && res.data?.accepted && res.data.affiliate_code) {
-        setAffiliateCode(res.data.affiliate_code);
+        setAffiliateCode(res.data.affiliate_code, serverWindow, serverMode ?? void 0);
         return res.data.affiliate_code;
       }
       if (res.success && res.data && res.data.accepted === false) {
@@ -4092,10 +4122,10 @@ async function captureAffiliateFromUrl(param = "ref") {
       }
       return code;
     } catch {
-      return code;
+      return mayHoldFirstClick ? held.code : code;
     }
   }
-  return code;
+  return mayHoldFirstClick ? held.code : code;
 }
 
 // ../sdk/src/utils/cart-line-id.ts
@@ -6180,6 +6210,7 @@ var shoppex = {
   validateAffiliateCode,
   applyAffiliateCode,
   getAffiliateCode,
+  getStoredAffiliate,
   setAffiliateCode,
   clearAffiliateCode,
   trackAffiliateEvent,