@amboras-dev/profitmetrics

ProfitMetrics attribution/profit-analytics for Amboras storefronts. Ships the "Serverside Hybrid Universal Integration" ProfitMetrics documents — exactly two parts:

1. Server-side order sync (Repo B, medusa-backend-orchestrator): on every order.placed, a durable outbox + cron drainer POSTs the order to GET https://my.profitmetrics.io/l.php?v=3uh&pid=<PUBLIC_ID>&o=<order JSON>.
2. Client-side bundle (this package): ProfitMetricsProvider sets window.profitMetrics = {...} then injects https://cdn1.profitmetrics.io/{pid}/bundle.js, which autonomously captures browser tracking IDs (etid/gclid/fbp/fbaid/email) and pairs them with the server-side order within ProfitMetrics' own ~5 minute buffer window.

Auth model

Auth is a single non-secret Website Public ID (pid) — structurally identical to Meta's pixel_id. There is no OAuth app-review gate, no API secret, and nothing this package needs to keep off the client.

Install

pnpm add @amboras-dev/profitmetrics

Then in the storefront's app/_generated/plugin-registry.ts (the orchestrator regenerates this on every install — manual edits will be overwritten):

import { ProfitMetricsProvider } from '@amboras-dev/profitmetrics/slot-components'

export const PLUGIN_REGISTRY = {
  rootProviders: [
    { id: 'profitmetrics', Component: ProfitMetricsProvider, propsFromConfig: { pid: 'pid' } },
  ],
  // ...other slots empty — ProfitMetrics ships no other slot components
}

What's tracked

ProfitMetrics is a single-event (order) + passive-browser-tracking model — unlike GA4/Meta's discrete event catalog, there is no per-event component catalog to wire up. bundle.js's automatic order-confirmation-page email capture is what pairs the browser session with the server-side order POST; this package does not ship a checkoutComplete component.

Consent

ProfitMetricsProvider gates script injection on the storefront's amboras_consent cookie's analytics field (defaults to consent-granted when no cookie is set). Re-checks on the amboras-consent-changed event so it initializes the moment a merchant accepts, without a page reload. The same consent state is also passed into window.profitMetrics as cookieStatisticsConsent / cookieMarketingConsent, so bundle.js never captures more than the merchant's banner allows even if a future version of the bundle relaxes its own gating.

Programmatic API

import { getProfitMetricsConfig } from '@amboras-dev/profitmetrics'

const config = await getProfitMetricsConfig()
// { pid: string | null, enabled: boolean } — fails closed to `null` on error

Out of scope (T1)

• Product feed (XML/CSV cost/margin data) — optional for basic revenue tracking, deferred to a later release.
• Order/product-level overrides (shipping/payment/extra cost, gross profit, title/brand/category overrides) — optional cost/catalog enrichment.
• Any dedup token invention — etid is entirely owned by ProfitMetrics' own bundle.js; this package's only job is the consent-gated script injection.