@shoppexio/storefront 1.0.78 → 1.0.79

package/dist/index.d.cts

@@ -591,6 +591,33 @@ interface AffiliateValidation {
     discount_active: boolean;
     discount_percent: number;
     message?: string;
+    /**
+     * The attribution policy that governs this code (ADR-0067).
+     *
+     * Absent when the code did not resolve, or when an older API answered. A
+     * caller storing the code itself must apply these rather than the 30-day
+     * last-click default, or a first-click tier and any non-30-day window are
+     * silently lost.
+     */
+    attribution_mode?: 'LAST_CLICK' | 'FIRST_CLICK';
+    attribution_window_days?: number;
+    /**
+     * The policy of the attribution the browser already holds, when one was sent.
+     * Null when that code no longer resolves — the stored mode is then the only
+     * information left.
+     */
+    held_attribution_mode?: 'LAST_CLICK' | 'FIRST_CLICK' | null;
+    /**
+     * `applyAffiliateCode` only: whether the code you passed is the one now
+     * attributed.
+     *
+     * False when an unexpired first-click attribution kept the sale — the code
+     * you passed is still valid, it just did not win. `affiliate_code` then
+     * carries the code that DID, because the documented integration feeds that
+     * field straight into `checkout({ affiliateCode })` and an explicit checkout
+     * code overrides storage.
+     */
+    applied?: boolean;
 }
 interface ProductGroup {
     id?: string;
@@ -1589,6 +1616,12 @@ declare function getStoredAffiliate(): {
     code: string;
     mode: AffiliateAttributionMode;
     windowDays: number;
+    /**
+     * When this entry expires, as written. Reported so a hold that has to be put
+     * back after an early overwrite keeps its original expiry — the window runs
+     * from the click that earned it, not from the landing that failed to take it.
+     */
+    expiresAt: number;
 } | null;
 declare function clearAffiliateCode(): void;
 declare function getAffiliateCode(): string | null;
@@ -1610,6 +1643,23 @@ declare function trackAffiliateEvent(eventType: 'add_to_cart' | 'checkout_starte
     dedupeKey?: string;
 }): Promise<void>;
 declare function validateAffiliateCode(code: string): Promise<SDKResponse<AffiliateValidation>>;
+/**
+ * Validate a manually entered code and store it (ADR-0067).
+ *
+ * Attribution is governed by the same rules as a `?ref=` landing, deliberately:
+ * a themed "apply code" box must not be a way around first-click, or the rule
+ * is bypassed by any storefront that offers one. So a still-protected hold
+ * keeps the sale, and the stored entry always carries the mode and window the
+ * server just reported — the old unconditional `setAffiliateCode(code)` wrote
+ * a 30-day last-click entry whatever the shop or tier had configured.
+ *
+ * The result reports what is now ATTRIBUTED, not merely what was validated:
+ * `affiliate_code` carries the winning code and `applied` says whether that is
+ * the one you passed. The documented integration hands `affiliate_code`
+ * straight to `checkout({ affiliateCode })`, and an explicit checkout code
+ * overrides storage — so returning the losing code here would credit it and
+ * walk right around the hold this function just honoured.
+ */
 declare function applyAffiliateCode(code: string): Promise<SDKResponse<AffiliateValidation>>;
 /**
  * Capture an affiliate code from the current URL and store it (ADR-0067).

package/dist/index.d.ts

@@ -591,6 +591,33 @@ interface AffiliateValidation {
     discount_active: boolean;
     discount_percent: number;
     message?: string;
+    /**
+     * The attribution policy that governs this code (ADR-0067).
+     *
+     * Absent when the code did not resolve, or when an older API answered. A
+     * caller storing the code itself must apply these rather than the 30-day
+     * last-click default, or a first-click tier and any non-30-day window are
+     * silently lost.
+     */
+    attribution_mode?: 'LAST_CLICK' | 'FIRST_CLICK';
+    attribution_window_days?: number;
+    /**
+     * The policy of the attribution the browser already holds, when one was sent.
+     * Null when that code no longer resolves — the stored mode is then the only
+     * information left.
+     */
+    held_attribution_mode?: 'LAST_CLICK' | 'FIRST_CLICK' | null;
+    /**
+     * `applyAffiliateCode` only: whether the code you passed is the one now
+     * attributed.
+     *
+     * False when an unexpired first-click attribution kept the sale — the code
+     * you passed is still valid, it just did not win. `affiliate_code` then
+     * carries the code that DID, because the documented integration feeds that
+     * field straight into `checkout({ affiliateCode })` and an explicit checkout
+     * code overrides storage.
+     */
+    applied?: boolean;
 }
 interface ProductGroup {
     id?: string;
@@ -1589,6 +1616,12 @@ declare function getStoredAffiliate(): {
     code: string;
     mode: AffiliateAttributionMode;
     windowDays: number;
+    /**
+     * When this entry expires, as written. Reported so a hold that has to be put
+     * back after an early overwrite keeps its original expiry — the window runs
+     * from the click that earned it, not from the landing that failed to take it.
+     */
+    expiresAt: number;
 } | null;
 declare function clearAffiliateCode(): void;
 declare function getAffiliateCode(): string | null;
@@ -1610,6 +1643,23 @@ declare function trackAffiliateEvent(eventType: 'add_to_cart' | 'checkout_starte
     dedupeKey?: string;
 }): Promise<void>;
 declare function validateAffiliateCode(code: string): Promise<SDKResponse<AffiliateValidation>>;
+/**
+ * Validate a manually entered code and store it (ADR-0067).
+ *
+ * Attribution is governed by the same rules as a `?ref=` landing, deliberately:
+ * a themed "apply code" box must not be a way around first-click, or the rule
+ * is bypassed by any storefront that offers one. So a still-protected hold
+ * keeps the sale, and the stored entry always carries the mode and window the
+ * server just reported — the old unconditional `setAffiliateCode(code)` wrote
+ * a 30-day last-click entry whatever the shop or tier had configured.
+ *
+ * The result reports what is now ATTRIBUTED, not merely what was validated:
+ * `affiliate_code` carries the winning code and `applied` says whether that is
+ * the one you passed. The documented integration hands `affiliate_code`
+ * straight to `checkout({ affiliateCode })`, and an explicit checkout code
+ * overrides storage — so returning the losing code here would credit it and
+ * walk right around the hold this function just honoured.
+ */
 declare function applyAffiliateCode(code: string): Promise<SDKResponse<AffiliateValidation>>;
 /**
  * Capture an affiliate code from the current URL and store it (ADR-0067).

package/dist/index.js

@@ -3922,6 +3922,9 @@ function safeWrite(value) {
   } catch {
   }
 }
+function restoreStoredAffiliate(value) {
+  safeWrite(value);
+}
 function setAffiliateCode(code, ttlDays = DEFAULT_TTL_DAYS, mode) {
   const normalized = normalizeAffiliateCode(code);
   if (!normalized) {
@@ -3946,7 +3949,7 @@ function getStoredAffiliate() {
   const code = normalizeAffiliateCode(stored.code);
   if (!code) return null;
   const windowDays = typeof stored.windowDays === "number" && stored.windowDays > 0 ? stored.windowDays : DEFAULT_TTL_DAYS;
-  return { code, mode: normalizeMode(stored.mode), windowDays };
+  return { code, mode: normalizeMode(stored.mode), windowDays, expiresAt: stored.expiresAt };
 }
 function clearAffiliateCode() {
   if (typeof window === "undefined") return;
@@ -4037,11 +4040,13 @@ async function validateAffiliateCode(code) {
     };
   }
   const config = getConfig();
+  const held = getStoredAffiliate();
   const response = await post(
     "/v1/storefront/affiliates/resolve",
     {
       shop_slug: config.storeSlug,
-      code: normalizedCode
+      code: normalizedCode,
+      ...held && held.code !== normalizedCode ? { held_code: held.code } : {}
     },
     { retries: 0 }
   );
@@ -4069,15 +4074,36 @@ async function validateAffiliateCode(code) {
       ...response.data.program_enabled !== void 0 ? { program_enabled: response.data.program_enabled } : {},
       affiliate_code: normalizeAffiliateCode(response.data.affiliate_code),
       discount_active: Boolean(response.data.discount_active),
-      discount_percent: Number(response.data.discount_percent ?? 0)
+      discount_percent: Number(response.data.discount_percent ?? 0),
+      // Passed through rather than dropped: a caller that stores the code has
+      // no other way to learn the policy, and defaulting to 30-day last-click
+      // would quietly discard a first-click tier and any custom window.
+      attribution_mode: normalizeMode(response.data.attribution_mode),
+      attribution_window_days: typeof response.data.attribution_window_days === "number" && response.data.attribution_window_days >= 1 ? Math.trunc(response.data.attribution_window_days) : DEFAULT_TTL_DAYS,
+      held_attribution_mode: response.data.held_attribution_mode === "FIRST_CLICK" || response.data.held_attribution_mode === "LAST_CLICK" ? response.data.held_attribution_mode : null
     },
     ...response.message ? { message: response.message } : {}
   };
 }
 async function applyAffiliateCode(code) {
+  const held = getStoredAffiliate();
   const result = await validateAffiliateCode(code);
   if (result.success && result.data?.affiliate_code) {
-    setAffiliateCode(result.data.affiliate_code);
+    const applied = result.data.affiliate_code;
+    const holdsOtherCode = held !== null && held.code !== applied;
+    const heldMode = holdsOtherCode ? result.data.held_attribution_mode ?? held.mode : null;
+    if (heldMode === "FIRST_CLICK" && held) {
+      return {
+        ...result,
+        data: { ...result.data, affiliate_code: held.code, applied: false }
+      };
+    }
+    setAffiliateCode(
+      applied,
+      result.data.attribution_window_days ?? DEFAULT_TTL_DAYS,
+      result.data.attribution_mode
+    );
+    return { ...result, data: { ...result.data, applied: true } };
   }
   return result;
 }
@@ -4094,7 +4120,8 @@ async function captureAffiliateFromUrl(param = "ref") {
   code = normalizeAffiliateCode(code);
   if (!code) return null;
   const held = getStoredAffiliate();
-  const mayHoldFirstClick = held !== null && held.mode === "FIRST_CLICK" && held.code !== code;
+  const holdsOtherCode = held !== null && held.code !== code;
+  const mayHoldFirstClick = holdsOtherCode && held.mode === "FIRST_CLICK";
   if (!mayHoldFirstClick) {
     setAffiliateCode(code, held?.windowDays ?? DEFAULT_TTL_DAYS, held?.mode);
   }
@@ -4103,13 +4130,29 @@ async function captureAffiliateFromUrl(param = "ref") {
       const config = getConfig();
       const res = await post(
         "/v1/storefront/affiliates/attribution",
-        { shop_slug: config.storeSlug, code },
+        {
+          shop_slug: config.storeSlug,
+          code,
+          // Sent so the server can report the policy of the attribution we
+          // already hold. Its mode — not the arriving code's — decides whether
+          // that hold may be released.
+          ...held ? { held_code: held.code } : {}
+        },
         { retries: 0 }
       );
       const serverMode = res.success && res.data?.attribution_mode ? normalizeMode(res.data.attribution_mode) : null;
       const serverWindow = res.success && typeof res.data?.attribution_window_days === "number" ? res.data.attribution_window_days : DEFAULT_TTL_DAYS;
-      const holdsFirstClick = mayHoldFirstClick && serverMode !== "LAST_CLICK";
-      if (holdsFirstClick) {
+      const heldMode = res.success && res.data?.held_attribution_mode ? normalizeMode(res.data.held_attribution_mode) : null;
+      const holdsFirstClick = holdsOtherCode && (heldMode ?? held?.mode) === "FIRST_CLICK";
+      if (holdsFirstClick && held) {
+        if (!mayHoldFirstClick) {
+          restoreStoredAffiliate({
+            code: held.code,
+            expiresAt: held.expiresAt,
+            windowDays: held.windowDays,
+            mode: heldMode ?? "FIRST_CLICK"
+          });
+        }
         return held.code;
       }
       if (res.success && res.data?.accepted && res.data.affiliate_code) {
@@ -4120,7 +4163,7 @@ async function captureAffiliateFromUrl(param = "ref") {
         clearAffiliateCode();
         return null;
       }
-      return code;
+      return mayHoldFirstClick ? held.code : code;
     } catch {
       return mayHoldFirstClick ? held.code : code;
     }