Is Affiliate and referral tracking audited?

No. No full audit has been run against this block yet, which is not the same as a pass. What is verified about it is listed on this page, and what is not is listed beside it.

What do I still have to do myself?

Payouts are NOT automated. recordConversion() writes a ledger row marked pending; paying it needs a provider (Stripe Connect, PayPal) and is a deliberate manual step until you have chosen one.

It is a feature of the Vibe Coder Playground. Download the Playground, and see the pricing page for what each plan includes.

Playground features

Affiliate and referral tracking

Referral tracking, affiliate signup, and a payout-ready ledger

Gives each promoter their own link, counts the signups it brings in, and works out what they are owed. Taken from a referral system already running in a real product.

Three colored signposts each with a winding path leading to the same door, and beside each signpost a stack of coins at a different height

A feature of the Playground

This is a feature of the Vibe Coder Playground. It runs inside the Playground, with its audit record and its caveats beside it.

Download the Playground See pricing

The mistake it removes

Referral attribution is money, so the failure modes are money-shaped. The three that bite: SELF-REFERRAL (an affiliate buys through their own link), an attribution window with no upper bound (a cookie set once earns commission forever), and a commission recorded before the payment settles — a refunded order that already paid out. All three are handled here and named in the code, because each is invisible until an invoice is wrong.

What you still have to do

The feature cannot own your secrets, your host or your legal obligations. This is the part it deliberately does not claim.

Payouts are NOT automated. recordConversion() writes a ledger row marked pending; paying it needs a provider (Stripe Connect, PayPal) and is a deliberate manual step until you have chosen one.
Attribution is last-click within the window, which is the common default but IS a business decision — say so on your affiliate terms page rather than leaving it implied.
NO CLICK TIME, NO COMMISSION (ph105tsk28). recordConversion() refuses a sale that arrives without a referredAt, reason 'no-referral-time', rather than guessing an interval — both fallbacks are wrong, since the affiliate's signup date measures how long the AFFILIATE has existed and 'now' means the window never binds again. If you are wiring this up by hand, pass the referredAt that referral() gives you or nothing will ever record.
The click time comes from a COOKIE, so it is client-side and a determined referrer can forge it to look recent. That is a bounded loss — a forged click can only extend one referral's own window — but a server-side click record, written when the ?ref= link is followed, is the stronger answer and this block does not ship one.

What lands in your project

vanilla

vanilla/affiliate.js

attachReferral() captures ?ref= into a bounded cookie AND stamps the click time into it; referral() reads back {code, referredAt} and referralCode() still returns just the code; affiliateLink(code) builds the share URL. Send BOTH values to your conversion endpoint — referredAt is what bounds the attribution window, and recordConversion() refuses a sale it cannot date. Framework-free — the owner's React page can call these directly.

node

node/affiliate-api.js

Express/Fastify-agnostic handlers: apply(), me(), recordConversion(). Pure functions over a store you inject, so it drops onto any backend.

sql

sql/affiliate.sql

affiliates + affiliate_conversions. The unique index on (affiliate_id, order_id) is what makes recordConversion idempotent under webhook retries.

What you supply

ratePercent — commission percent (default 30, matching the owner's AFFILIATE_RATE)
windowDays — attribution window in days, measured from the referral CLICK and inclusive at the boundary (default 30, matching AFFILIATE_COOKIE_DAYS). A sale past it earns nothing, reason 'outside-window'.
cookieName — referral cookie (default wb_ref)

Get it