@shoppexio/storefront 1.0.77 → 1.0.79

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 1.0.79
+
+- Attribution is now decided by the policy of the code that EARNED the hold, never by the one that just arrived. `captureAffiliateFromUrl()` sends the held code so the server can report its mode, and a first-click hold survives an affiliate on a last-click tier landing afterwards.
+- `applyAffiliateCode()` applies the same rules as a `?ref=` landing. It stores the code with the shop's (or tier's) real mode and window instead of a fixed 30-day last-click entry, and it no longer overrides a standing first-click hold — a themed "apply code" field was previously a way around the rule.
+- `applyAffiliateCode()` reports what is ATTRIBUTED: `data.affiliate_code` is the winning code and the new `data.applied` says whether that is the one you passed. Passing `data.affiliate_code` to `checkout()` therefore stays correct in both cases.
+- `validateAffiliateCode()` passes the resolved `attribution_mode`, `attribution_window_days` and `held_attribution_mode` through instead of dropping them.
+- `getStoredAffiliate()` also returns `expiresAt`, so a hold can be restored without extending the window it earned.
+- A transport failure or an HTTP error such as a rate limit no longer returns the arriving code while storage still holds another: both paths answer with the code that keeps the attribution.
+
+## 1.0.78
+
+- `captureAffiliateFromUrl()` honours the shop's attribution mode (ADR-0067). Under `FIRST_CLICK` a held, unexpired attribution wins and a newer `?ref=` no longer replaces it; the landing is still reported so click statistics stay complete. `LAST_CLICK` is unchanged and remains the default.
+- The attribution window is no longer fixed at 30 days: `/attribution` returns `attribution_mode` and `attribution_window_days`, and a newly stored referral uses the shop's (or its tier's) window.
+- New export `getStoredAffiliate()`, returning `{ code, mode }` for the held attribution, or `null`.
+- `setAffiliateCode(code, ttlDays, mode?)` accepts the mode to persist. Existing two-argument calls are unaffected.
+- The `shoppex:affiliate_code:v1` storage key is unchanged and entries written by earlier versions keep working: an entry without a mode reads as `LAST_CLICK`, the behaviour it was written under. No attribution is lost on upgrade.
+- Note: first-click is enforced in the browser, like the window itself. It is an attribution rule, not fraud protection.
+
 ## 1.0.77
 
 - Headless customer replacement requests now require `lineItemId` in the SDK types, matching the live API. Pass the invoice position UUID; omitted or null IDs are not valid. The read-only `replacementEligibility` query still allows omitting its line ID.

package/dist/index.cjs

@@ -19285,6 +19285,9 @@ var SESSION_STORAGE_KEY = "shoppex:affiliate_session:v1";
 var DEFAULT_TTL_DAYS = 30;
 var FALLBACK_SESSION_KEY_LENGTH = 24;
 var SESSION_KEY_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
+function normalizeMode(value) {
+  return value === "FIRST_CLICK" ? "FIRST_CLICK" : "LAST_CLICK";
+}
 function nowMs() {
   return Date.now();
 }
@@ -19302,7 +19305,7 @@ function safeRead() {
     if (!raw) return null;
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed.code !== "string" || typeof parsed.expiresAt !== "number") return null;
-    return parsed;
+    return parsed.mode === void 0 ? parsed : { ...parsed, mode: normalizeMode(parsed.mode) };
   } catch {
     return null;
   }
@@ -19314,15 +19317,35 @@ function safeWrite(value) {
   } catch {
   }
 }
-function setAffiliateCode(code, ttlDays = DEFAULT_TTL_DAYS) {
+function restoreStoredAffiliate(value) {
+  safeWrite(value);
+}
+function setAffiliateCode(code, ttlDays = DEFAULT_TTL_DAYS, mode) {
   const normalized = normalizeAffiliateCode(code);
   if (!normalized) {
     clearAffiliateCode();
     return null;
   }
-  safeWrite({ code: normalized, expiresAt: nowMs() + ttlMs(ttlDays) });
+  safeWrite({
+    code: normalized,
+    expiresAt: nowMs() + ttlMs(ttlDays),
+    windowDays: ttlDays,
+    ...mode ? { mode } : {}
+  });
   return normalized;
 }
+function getStoredAffiliate() {
+  const stored = safeRead();
+  if (!stored) return null;
+  if (stored.expiresAt <= nowMs()) {
+    clearAffiliateCode();
+    return null;
+  }
+  const code = normalizeAffiliateCode(stored.code);
+  if (!code) return null;
+  const windowDays = typeof stored.windowDays === "number" && stored.windowDays > 0 ? stored.windowDays : DEFAULT_TTL_DAYS;
+  return { code, mode: normalizeMode(stored.mode), windowDays, expiresAt: stored.expiresAt };
+}
 function clearAffiliateCode() {
   if (typeof window === "undefined") return;
   try {
@@ -19412,11 +19435,13 @@ async function validateAffiliateCode(code) {
     };
   }
   const config2 = getConfig();
+  const held = getStoredAffiliate();
   const response = await post(
     "/v1/storefront/affiliates/resolve",
     {
       shop_slug: config2.storeSlug,
-      code: normalizedCode
+      code: normalizedCode,
+      ...held && held.code !== normalizedCode ? { held_code: held.code } : {}
     },
     { retries: 0 }
   );
@@ -19444,15 +19469,36 @@ async function validateAffiliateCode(code) {
       ...response.data.program_enabled !== void 0 ? { program_enabled: response.data.program_enabled } : {},
       affiliate_code: normalizeAffiliateCode(response.data.affiliate_code),
       discount_active: Boolean(response.data.discount_active),
-      discount_percent: Number(response.data.discount_percent ?? 0)
+      discount_percent: Number(response.data.discount_percent ?? 0),
+      // Passed through rather than dropped: a caller that stores the code has
+      // no other way to learn the policy, and defaulting to 30-day last-click
+      // would quietly discard a first-click tier and any custom window.
+      attribution_mode: normalizeMode(response.data.attribution_mode),
+      attribution_window_days: typeof response.data.attribution_window_days === "number" && response.data.attribution_window_days >= 1 ? Math.trunc(response.data.attribution_window_days) : DEFAULT_TTL_DAYS,
+      held_attribution_mode: response.data.held_attribution_mode === "FIRST_CLICK" || response.data.held_attribution_mode === "LAST_CLICK" ? response.data.held_attribution_mode : null
     },
     ...response.message ? { message: response.message } : {}
   };
 }
 async function applyAffiliateCode(code) {
+  const held = getStoredAffiliate();
   const result = await validateAffiliateCode(code);
   if (result.success && result.data?.affiliate_code) {
-    setAffiliateCode(result.data.affiliate_code);
+    const applied = result.data.affiliate_code;
+    const holdsOtherCode = held !== null && held.code !== applied;
+    const heldMode = holdsOtherCode ? result.data.held_attribution_mode ?? held.mode : null;
+    if (heldMode === "FIRST_CLICK" && held) {
+      return {
+        ...result,
+        data: { ...result.data, affiliate_code: held.code, applied: false }
+      };
+    }
+    setAffiliateCode(
+      applied,
+      result.data.attribution_window_days ?? DEFAULT_TTL_DAYS,
+      result.data.attribution_mode
+    );
+    return { ...result, data: { ...result.data, applied: true } };
   }
   return result;
 }
@@ -19468,29 +19514,56 @@ async function captureAffiliateFromUrl(param = "ref") {
   }
   code = normalizeAffiliateCode(code);
   if (!code) return null;
-  setAffiliateCode(code);
+  const held = getStoredAffiliate();
+  const holdsOtherCode = held !== null && held.code !== code;
+  const mayHoldFirstClick = holdsOtherCode && held.mode === "FIRST_CLICK";
+  if (!mayHoldFirstClick) {
+    setAffiliateCode(code, held?.windowDays ?? DEFAULT_TTL_DAYS, held?.mode);
+  }
   if (isInitialized()) {
     try {
       const config2 = getConfig();
       const res = await post(
         "/v1/storefront/affiliates/attribution",
-        { shop_slug: config2.storeSlug, code },
+        {
+          shop_slug: config2.storeSlug,
+          code,
+          // Sent so the server can report the policy of the attribution we
+          // already hold. Its mode — not the arriving code's — decides whether
+          // that hold may be released.
+          ...held ? { held_code: held.code } : {}
+        },
         { retries: 0 }
       );
+      const serverMode = res.success && res.data?.attribution_mode ? normalizeMode(res.data.attribution_mode) : null;
+      const serverWindow = res.success && typeof res.data?.attribution_window_days === "number" ? res.data.attribution_window_days : DEFAULT_TTL_DAYS;
+      const heldMode = res.success && res.data?.held_attribution_mode ? normalizeMode(res.data.held_attribution_mode) : null;
+      const holdsFirstClick = holdsOtherCode && (heldMode ?? held?.mode) === "FIRST_CLICK";
+      if (holdsFirstClick && held) {
+        if (!mayHoldFirstClick) {
+          restoreStoredAffiliate({
+            code: held.code,
+            expiresAt: held.expiresAt,
+            windowDays: held.windowDays,
+            mode: heldMode ?? "FIRST_CLICK"
+          });
+        }
+        return held.code;
+      }
       if (res.success && res.data?.accepted && res.data.affiliate_code) {
-        setAffiliateCode(res.data.affiliate_code);
+        setAffiliateCode(res.data.affiliate_code, serverWindow, serverMode ?? void 0);
         return res.data.affiliate_code;
       }
       if (res.success && res.data && res.data.accepted === false) {
         clearAffiliateCode();
         return null;
       }
-      return code;
+      return mayHoldFirstClick ? held.code : code;
     } catch {
-      return code;
+      return mayHoldFirstClick ? held.code : code;
     }
   }
-  return code;
+  return mayHoldFirstClick ? held.code : code;
 }
 
 // ../sdk/src/utils/cart-line-id.ts
@@ -21575,6 +21648,7 @@ var shoppex = {
   validateAffiliateCode,
   applyAffiliateCode,
   getAffiliateCode,
+  getStoredAffiliate,
   setAffiliateCode,
   clearAffiliateCode,
   trackAffiliateEvent,