Route outbound links through a referral endpoint where we have one

[ralyodio]

Adds the Dedirock referral link Anthony supplied, plus the machinery to use it.

Where the table lives, and why not the database

packages/core/src/affiliates.js, not a column on providers. That table is a mirror: sync upserts it with coalesce(excluded.x, providers.x) on every column, so a referral URL stored there would arrive as null on each sync and survive only by the grace of that coalesce. In source it is reviewable in a diff, and a provider who is not in the catalogue yet is already wired up for the day they appear.

That is the case here. Nothing in the NicheDB hosting collection names Dedirock today, so this link earns nothing until they are indexed. It is wired and waiting rather than live.

The landing-only problem

Dedirock's endpoint is WHMCS aff.php. Measured 2026-09-25:

$ curl -I 'https://billing.dedirock.com/aff.php?aff=960'
HTTP/2 301
location: https://dedirock.com
set-cookie: WHMCSAffiliateID=960; Max-Age=7776000

It ignores url and goto, and passing aff=960 inline on a billing page sets no cookie at all. So there is no way to earn the referral and land on a named plan.

Given that, a landing-only link replaces a link to the provider's front door — where nothing is lost, because that is where it lands regardless — and never replaces a deep link to a particular offer. Dropping somebody who clicked a named plan onto a homepage to earn a commission is how a directory stops being worth reading. A deep link simply earns nothing.

Disclosure

Every affiliate link is labelled affiliate in the link itself and carries rel="noopener nofollow sponsored". Incidentally that is now accurate: the order button previously declared sponsored on every provider, paid or not.

Verification

• 20 new tests: substitution rule, deep-link guard, subdomain match (notdedirock.com must not borrow the deal), empty-URL handling.
• Full suite green: 59 pass / 2 skip / 0 fail. Lint clean.
• Rendered the real provider page: Dedirock gets the referral URL + sponsored + the marker; Hetzner is byte-for-byte untouched.
• Rendered Outbound as servers.jsx calls it: front door swapped, deep link left alone, no URL renders nothing.

Not verified live — r4ck.dev is on dev2, which is currently down.

🤖 Generated with Claude Code