@funnelsgrove/runtime 0.7.24 → 0.7.26

package/README.md

@@ -55,6 +55,9 @@ documented in [`docs/product-specs/funnel-template-runtime.md`](../../docs/produ
 - Do not import `@funnelsgrove/payments` or `@funnelsgrove/analytics` here for checkout or transport orchestration.
 - Runtime UI must be generic and copy-injectable.
 - Browser-only values must resolve after mount when SSR hydration can be affected.
+- Subscription handoff app and universal links receive the known funnel-user email even when the
+  configured template omits `{email}`. Store links never receive email, including case-insensitive
+  `email` keys present in configured URLs or first-touch attribution.
 - Funnel code must not copy `useSyncExternalStore`/`popstate` query-string hooks. Use
   `useBrowserLocationSearch`; the shared controller also notifies it after
   `history.pushState` and `history.replaceState` navigation.

package/dist/runtime/browser-helpers.d.ts

@@ -5,6 +5,7 @@ export declare const writeWindowStorageValue: (storageKey: string, value: string
 export declare const removeWindowStorageValue: (storageKey: string) => void;
 export declare const dispatchWindowCustomEvent: <Detail>(eventType: string, detail: Detail) => void;
 export declare const dispatchFunnelLocationChange: () => void;
+export declare const updateFunnelHistory: (method: "push" | "replace", state: Record<string, unknown>, location: string) => void;
 export declare const buildHostedStepLocation: (input: {
     currentHref: string;
     stepPath: string;

package/dist/runtime/browser-helpers.js

@@ -51,6 +51,15 @@ export const dispatchFunnelLocationChange = () => {
         href: window.location.href,
     });
 };
+export const updateFunnelHistory = (method, state, location) => {
+    const historyPrototype = Object.getPrototypeOf(window.history);
+    const update = method === 'replace'
+        ? historyPrototype.replaceState
+        : historyPrototype.pushState;
+    const currentState = window.history.state;
+    update.call(window.history, Object.assign(Object.assign({}, (currentState && typeof currentState === 'object' ? currentState : {})), state), '', location);
+    dispatchFunnelLocationChange();
+};
 const getHostedFunnelBaseSegments = (pathname) => {
     const pathSegments = pathname.split('/').filter(Boolean);
     if (pathSegments[0] === 'published' && pathSegments[1] === 'f' && pathSegments[2]) {

package/dist/runtime/subscription-handoff.js

@@ -1,3 +1,5 @@
+const LINK_RESOLUTION_BASE = 'https://subscription-handoff.invalid/';
+const ABSOLUTE_URL_PATTERN = /^[a-z][a-z\d+.-]*:/i;
 const asTrimmedString = (value) => {
     if (typeof value !== 'string') {
         return null;
@@ -16,33 +18,86 @@ const resolvePlatform = (userAgent) => {
     }
     return 'desktop';
 };
-const applyLinkTemplates = (value, variables) => {
+const normalizedQueryKey = (value) => value.trim().toLowerCase();
+const hasQueryKey = (url, key) => {
+    return [...url.searchParams.keys()].some((candidate) => normalizedQueryKey(candidate) === key);
+};
+const removeQueryKey = (url, key) => {
+    for (const candidate of [...url.searchParams.keys()]) {
+        if (normalizedQueryKey(candidate) === key) {
+            url.searchParams.delete(candidate);
+        }
+    }
+};
+const applyLinkTemplates = (value, variables, includeEmail) => {
     return value
         .replace(/\{user_id\}/g, encodeURIComponent(variables.userId))
-        .replace(/\{email\}/g, variables.email ? encodeURIComponent(variables.email) : '');
+        .replace(/\{email\}/g, includeEmail && variables.email ? encodeURIComponent(variables.email) : '');
+};
+const hasRelativeDotSegment = (source) => {
+    var _a, _b;
+    if (ABSOLUTE_URL_PATTERN.test(source) || source.startsWith('/')) {
+        return false;
+    }
+    const path = (_b = (_a = source.match(/^[^?#]*/)) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : '';
+    return path.split(/[\\/]/).some((segment) => {
+        try {
+            return /^\.{1,2}$/.test(decodeURIComponent(segment));
+        }
+        catch (_a) {
+            return false;
+        }
+    });
+};
+const hasAmbiguousPathBackslash = (source) => {
+    var _a, _b;
+    return ((_b = (_a = source.match(/^[^?#]*/)) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : '').includes('\\');
+};
+const serializeResolvedUrl = (url, source) => {
+    if (ABSOLUTE_URL_PATTERN.test(source)) {
+        return url.toString();
+    }
+    if (source.startsWith('//')) {
+        return url.toString().slice(url.protocol.length);
+    }
+    const relativeUrl = `${url.pathname}${url.search}${url.hash}`;
+    return source.startsWith('/') ? relativeUrl : relativeUrl.slice(1);
 };
-const resolveUrl = (value, variables, firstTouch) => {
+const resolveUrl = (value, variables, firstTouch, includeEmail = false) => {
     const normalized = asTrimmedString(value);
     if (!normalized) {
         return null;
     }
+    const templated = applyLinkTemplates(normalized, variables, includeEmail);
     try {
-        const url = new URL(applyLinkTemplates(normalized, variables));
+        if (hasAmbiguousPathBackslash(templated) || hasRelativeDotSegment(templated)) {
+            return null;
+        }
+        const url = new URL(templated, LINK_RESOLUTION_BASE);
         if (!url.searchParams.has('user_id')) {
             url.searchParams.set('user_id', variables.userId);
         }
+        if (!includeEmail) {
+            removeQueryKey(url, 'email');
+        }
+        else if (variables.email && !hasQueryKey(url, 'email')) {
+            url.searchParams.set('email', variables.email);
+        }
         for (const [key, rawValue] of Object.entries(firstTouch)) {
             const nextKey = key.trim();
             const nextValue = rawValue.trim();
-            if (!nextKey || !nextValue || url.searchParams.has(nextKey)) {
+            if (!nextKey
+                || !nextValue
+                || normalizedQueryKey(nextKey) === 'email'
+                || url.searchParams.has(nextKey)) {
                 continue;
             }
             url.searchParams.set(nextKey, nextValue);
         }
-        return url.toString();
+        return serializeResolvedUrl(url, templated);
     }
     catch (_a) {
-        return applyLinkTemplates(normalized, variables);
+        return null;
     }
 };
 const buildQrConfirmationUrl = (confirmationUrl, userId) => {
@@ -87,9 +142,9 @@ export const resolveSubscriptionHandoff = (input) => {
     const variables = { userId, email };
     const iosStoreUrl = resolveUrl(input.config.iosAppStoreUrl, variables, firstTouch);
     const androidStoreUrl = resolveUrl(input.config.androidPlayStoreUrl, variables, firstTouch);
-    const iosDeepLink = resolveUrl(input.config.iosDeepLink, variables, firstTouch);
-    const androidDeepLink = resolveUrl(input.config.androidDeepLink, variables, firstTouch);
-    const universalLink = resolveUrl(input.config.universalLink, variables, firstTouch);
+    const iosDeepLink = resolveUrl(input.config.iosDeepLink, variables, firstTouch, true);
+    const androidDeepLink = resolveUrl(input.config.androidDeepLink, variables, firstTouch, true);
+    const universalLink = resolveUrl(input.config.universalLink, variables, firstTouch, true);
     const openAppUrl = platform === 'ios'
         ? iosDeepLink || universalLink || iosStoreUrl
         : platform === 'android'

package/dist/runtime/use-funnel-flow-controller.js

@@ -5,7 +5,7 @@ import { writeStepChoice } from '../sdk/userAnswers.js';
 import { apiService } from '../services/api.service.js';
 import { logger } from '../services/logger.js';
 import { FUNNEL_ID, POSTHOG_API_HOST, POSTHOG_PROJECT_API_KEY, PROJECT_ID, } from '../services/runtime-api.config.js';
-import { buildHostedStepLocation, dispatchFunnelLocationChange, dispatchWindowCustomEvent, } from './browser-helpers.js';
+import { buildHostedStepLocation, dispatchWindowCustomEvent, updateFunnelHistory, } from './browser-helpers.js';
 import { isPreviewStepLockRequested, resolveNextStepFromContext, shouldRunAutoAdvanceTimer, } from './funnel-flow.js';
 import { usePreviewBridge } from './preview-bridge.js';
 import { resolveExperimentAssignment, resolveForcedExperimentAssignment, } from './experiment-assignment.js';
@@ -433,13 +433,7 @@ export function useFunnelFlowController({ api = apiService, analytics, stepContr
         });
         const currentLocation = `${window.location.pathname}${window.location.search}${window.location.hash}`;
         if (currentLocation !== nextLocation) {
-            if (isPreviewFrameRuntime()) {
-                window.history.replaceState({ stepId: safeStepId }, '', nextLocation);
-            }
-            else {
-                window.history.pushState({ stepId: safeStepId }, '', nextLocation);
-            }
-            dispatchFunnelLocationChange();
+            updateFunnelHistory(isPreviewFrameRuntime() ? 'replace' : 'push', { stepId: safeStepId }, nextLocation);
         }
         setActiveStepId(safeStepId);
     }, [getPathForStep]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@funnelsgrove/runtime",
-  "version": "0.7.24",
+  "version": "0.7.26",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/The-Solid-Grove/funnelsgrove.git",