@getmicdrop/venue-calendar 4.2.2 → 4.2.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/{ArrowLeftIcon-DQ-h5PcH.js → ArrowLeftIcon-CxZXP_IT.js} +1 -1
- package/dist/{Badge-M6qZyfTF.js → Badge-Bv_MT-Vt.js} +10 -9
- package/dist/BlockPlaceholder-HZ6Coko5.js +52 -0
- package/dist/Button-C4uFgl7L.js +2141 -0
- package/dist/{Calendar-BX22svpz.js → Calendar-BKefLfIt.js} +292 -290
- package/dist/CalendarFoundryView-tDmFCrJ3.js +22292 -0
- package/dist/{CalendarIcon-DR197Ioz.js → CalendarIcon-CLGR_zlO.js} +1 -1
- package/dist/{CartView-B2VtVvZM.js → CartView-CHFlfWS9.js} +651 -644
- package/dist/{Checkout-BTqfjvDp.js → Checkout-C-A4t1eE.js} +92 -91
- package/dist/Checkout-CRX7dcRr.js +1807 -0
- package/dist/{CheckoutTimer-Cng5tcGO.js → CheckoutTimer-d3KUbevy.js} +5 -5
- package/dist/{ChevronDownIcon-C_RiK-BW.js → ChevronDownIcon-YtBeSqjf.js} +1 -1
- package/dist/{ClockIcon-BOJENuPq.js → ClockIcon-a9tJQ5El.js} +1 -1
- package/dist/{CloseIcon-Rc7tpX2a.js → CloseIcon-DSURK5co.js} +1 -1
- package/dist/CloseOutline-qpVa62mu.js +13 -0
- package/dist/{CollectionView-A1zP8yz5.js → CollectionView-BiBMllyw.js} +13 -12
- package/dist/CropImage-B0tj2_uN.js +404 -0
- package/dist/Event-1ZJVzqFN.js +3034 -0
- package/dist/{EventPage-hxrPKPhm.js → EventPage-C7K2yA4v.js} +168 -167
- package/dist/{Heading-B7VYbbfJ.js → Heading-Dfo3bjyn.js} +4 -3
- package/dist/Image-B3cEndLZ.js +87 -0
- package/dist/Input-DkYIFK4J.js +487 -0
- package/dist/{MailIcon-rxvK4Wga.js → MailIcon-DIrQpcGo.js} +1 -1
- package/dist/{Modal-BVD2O8hd.js → Modal-DrA1swbF.js} +2 -2
- package/dist/{ModalFooter-CfboEe1M.js → ModalFooter-r1NQNG9P.js} +59 -57
- package/dist/{PasswordInput-BAlq2j97.js → PasswordInput-DB4qa7kS.js} +4 -4
- package/dist/{ScarcityBadge-h7ygRD_C.js → ScarcityBadge-BJOm7_Ho.js} +4 -4
- package/dist/{SeriesPage-D-cwUNZM.js → SeriesPage-JVmqUSax.js} +5 -5
- package/dist/{Spinner-ChTN7t75.js → Spinner-BwiDys7C.js} +3 -3
- package/dist/{Success-CIAX5zmz.js → Success-DAE6gPZM.js} +77 -76
- package/dist/{TagIcon-V0qMu9wS.js → TagIcon-CrTNd8qE.js} +1 -1
- package/dist/{ViewTicketsEmbed-By-IcUJZ.js → ViewTicketsEmbed-Zx-mvP2p.js} +60 -59
- package/dist/{WarningCircleIcon-D32h6VDr.js → WarningCircleIcon-C5-op3Cy.js} +1 -1
- package/dist/{WarningTriIcon-BPDrCiKU.js → WarningTriIcon-BxIQn7c2.js} +1 -1
- package/dist/{__SKIP_PATHS__-DirqE5Xe.js → __SKIP_PATHS__-DyyiXBgB.js} +1 -1
- package/dist/api/types.d.ts +528 -528
- package/dist/{browser-25hnscei.js → browser-Um8Y6K99.js} +7 -7
- package/dist/{colors-5ifWyP6H.js → colors-MuuDk6KF.js} +30 -29
- package/dist/{constants-Dcj3kgZE.js → constants-CqrJv6nM.js} +73 -73
- package/dist/{copyToClipboard-CNxFW3ni.js → copyToClipboard-CTS9Wtmo.js} +1 -1
- package/dist/{createI18n-08XGDh1_.js → createI18n-DBUVdZra.js} +1 -1
- package/dist/{event-Cp5D4ctZ.js → event-BrptLro8.js} +1 -1
- package/dist/{event-transform-DSuEpMxr.js → event-transform-jFmHl0Qp.js} +4 -4
- package/dist/{eventStatusStream-CIZVH5Lp.js → eventStatusStream-D04pcbuu.js} +2 -2
- package/dist/{allowlist-BiUmz2AF.js → href-C8WGnROy.js} +21 -4
- package/dist/{i18n-CEeBd5Hi.js → i18n-CcJmTGJP.js} +11 -11
- package/dist/imageOptimizer-CB3wKJU8.js +47 -0
- package/dist/{labels-CtyfffZI.js → labels-Q4CaHsVM.js} +1 -1
- package/dist/{modalManager.svelte-BH-QJm9M.js → modalManager.svelte-qcVxl7C5.js} +2 -2
- package/dist/{order-totals-hcdvbJvw.js → order-totals-BImtvmoh.js} +15 -13
- package/dist/{orders-tzTe2hNM.js → orders-C8kt6c-E.js} +20 -19
- package/dist/{Input-W-QE9nWi.js → phoneUtils-FnBDCqO0.js} +694 -1132
- package/dist/{pixels-7kl8Fcjl.js → pixels-MEc7WYiV.js} +8 -7
- package/dist/{promo-BrMcoTYh.js → promo-DtLZRskK.js} +3 -3
- package/dist/{serverTotals-CpRaEe9K.js → serverTotals-BO126TTd.js} +1 -1
- package/dist/{shareCopyFeedback.svelte-DsyhrfiP.js → shareCopyFeedback.svelte-Dko8NIbm.js} +25 -25
- package/dist/{showcase-state-options-B2XfybZq.js → showcase-state-options-BoJxiEsg.js} +1 -1
- package/dist/sortable.esm--ZtTTTPp.js +1451 -0
- package/dist/timezones-C5l0SSHK.js +2030 -0
- package/dist/{to-event-card-props-VPne8W4I.js → to-event-card-props-BAHzloEA.js} +24 -23
- package/dist/{utils-DJVlBMbw.js → utils-Ts4-U13Y.js} +3 -3
- package/dist/venue-calendar.css +1 -1
- package/dist/venue-calendar.es.js +200 -199
- package/dist/venue-calendar.iife.js +63 -62
- package/dist/venue-calendar.umd.js +60 -59
- package/dist/z-index-B0Vk_Mp1.js +27 -0
- package/package.json +220 -220
- package/dist/BlockPlaceholder-IOcqxTx2.js +0 -62
- package/dist/CalendarFoundryView-Ct39xn0Q.js +0 -23561
- package/dist/Checkout-CXcjQfbc.js +0 -1805
- package/dist/Event-C_0lUZvV.js +0 -3040
- package/dist/Image-DBJAfLYe.js +0 -81
- package/dist/cancel-Cq2Q8qW7.js +0 -59
- package/dist/timezones-Cq1mLtfM.js +0 -4170
- /package/dist/locales/{4.2.2 → 4.2.3}/flow/de.js +0 -0
- /package/dist/locales/{4.2.2 → 4.2.3}/flow/es.js +0 -0
- /package/dist/locales/{4.2.2 → 4.2.3}/flow/fr.js +0 -0
- /package/dist/locales/{4.2.2 → 4.2.3}/flow/id.js +0 -0
- /package/dist/locales/{4.2.2 → 4.2.3}/flow/it.js +0 -0
- /package/dist/locales/{4.2.2 → 4.2.3}/flow/ja.js +0 -0
- /package/dist/locales/{4.2.2 → 4.2.3}/flow/ko.js +0 -0
- /package/dist/locales/{4.2.2 → 4.2.3}/flow/nl.js +0 -0
- /package/dist/locales/{4.2.2 → 4.2.3}/flow/pl.js +0 -0
- /package/dist/locales/{4.2.2 → 4.2.3}/flow/pt-br.js +0 -0
- /package/dist/locales/{4.2.2 → 4.2.3}/flow/tr.js +0 -0
- /package/dist/locales/{4.2.2 → 4.2.3}/flow/zh.js +0 -0
- /package/dist/locales/{4.2.2 → 4.2.3}/main/de.js +0 -0
- /package/dist/locales/{4.2.2 → 4.2.3}/main/es.js +0 -0
- /package/dist/locales/{4.2.2 → 4.2.3}/main/fr.js +0 -0
- /package/dist/locales/{4.2.2 → 4.2.3}/main/id.js +0 -0
- /package/dist/locales/{4.2.2 → 4.2.3}/main/it.js +0 -0
- /package/dist/locales/{4.2.2 → 4.2.3}/main/ja.js +0 -0
- /package/dist/locales/{4.2.2 → 4.2.3}/main/ko.js +0 -0
- /package/dist/locales/{4.2.2 → 4.2.3}/main/nl.js +0 -0
- /package/dist/locales/{4.2.2 → 4.2.3}/main/pl.js +0 -0
- /package/dist/locales/{4.2.2 → 4.2.3}/main/pt-br.js +0 -0
- /package/dist/locales/{4.2.2 → 4.2.3}/main/tr.js +0 -0
- /package/dist/locales/{4.2.2 → 4.2.3}/main/zh.js +0 -0
|
@@ -0,0 +1,27 @@
|
|
|
1
|
+
//#region node_modules/@getmicdrop/svelte-components/dist/tokens/z-index.js
|
|
2
|
+
var e = {
|
|
3
|
+
auto: "auto",
|
|
4
|
+
0: "0",
|
|
5
|
+
10: "10",
|
|
6
|
+
20: "20",
|
|
7
|
+
30: "30",
|
|
8
|
+
40: "40",
|
|
9
|
+
50: "50",
|
|
10
|
+
51: "51",
|
|
11
|
+
60: "60",
|
|
12
|
+
70: "70",
|
|
13
|
+
100: "100"
|
|
14
|
+
}, t = {
|
|
15
|
+
base: e[0],
|
|
16
|
+
sticky: e[10],
|
|
17
|
+
navigation: e[20],
|
|
18
|
+
dropdown: e[30],
|
|
19
|
+
overlay: e[40],
|
|
20
|
+
modal: e[50],
|
|
21
|
+
modalContent: e[51],
|
|
22
|
+
toast: e[60],
|
|
23
|
+
tooltip: e[70],
|
|
24
|
+
critical: e[100]
|
|
25
|
+
};
|
|
26
|
+
//#endregion
|
|
27
|
+
export { t };
|
package/package.json
CHANGED
|
@@ -1,220 +1,220 @@
|
|
|
1
|
-
{
|
|
2
|
-
"name": "@getmicdrop/venue-calendar",
|
|
3
|
-
"_version_comment": "4.1.55 was the last PUBLISHED version, and the tree carried 36 commits npm's 4.1.55 does not have — including the gate-password security fix and four money fixes. A filename must never reuse a version npm has taken (jsDelivr/unpkg cache the FIRST bytes they see under `@4.1.55` forever, so republishing that number ships the old widget to every venue that pinned it). Bumped to 4.2.0 here, BEFORE anything is built for publish. `npm run release:preflight` refuses to proceed when this number already exists in the registry.",
|
|
4
|
-
"version": "4.2.
|
|
5
|
-
"description": "A customizable Svelte calendar component for displaying comedy events",
|
|
6
|
-
"type": "module",
|
|
7
|
-
"types": "./dist/types/index.d.ts",
|
|
8
|
-
"main": "./dist/venue-calendar.umd.js",
|
|
9
|
-
"module": "./dist/venue-calendar.es.js",
|
|
10
|
-
"_exports_types_comment": "Every `types` path below must EXIST in the tarball; `npm run size` (scripts/size-guard.mjs, checkExportsTypesResolve) asserts it against the built dist and reds if one dangles. It dangled for real: `./api` pointed at ./dist/api/index.d.ts while vite-plugin-dts emitted ./dist/api/api/index.d.ts, because the `include` root (src/lib/api) is not the tree root the plugin derived — two transformers import $lib/public-calendar-flow, which hoisted entryRoot to src/lib and pushed everything down one directory. TypeScript does not error on a `types` target that is absent; it silently falls back to no types at all, so `import '@getmicdrop/venue-calendar/api'` was implicitly `any` for every consumer and nothing anywhere said so. Fixed by pinning entryRoot in vite.config.api.js (NOT by retyping the string here) so the emitted path matches the contract, the way ./seo already did by accident.",
|
|
11
|
-
"exports": {
|
|
12
|
-
".": {
|
|
13
|
-
"types": "./dist/types/index.d.ts",
|
|
14
|
-
"svelte": "./dist/venue-calendar.es.js",
|
|
15
|
-
"import": "./dist/venue-calendar.es.js",
|
|
16
|
-
"require": "./dist/venue-calendar.umd.js",
|
|
17
|
-
"default": "./dist/venue-calendar.es.js"
|
|
18
|
-
},
|
|
19
|
-
"./api": {
|
|
20
|
-
"types": "./dist/api/index.d.ts",
|
|
21
|
-
"import": "./dist/api/api.mjs",
|
|
22
|
-
"require": "./dist/api/api.cjs",
|
|
23
|
-
"default": "./dist/api/api.mjs"
|
|
24
|
-
},
|
|
25
|
-
"./seo": {
|
|
26
|
-
"types": "./dist/seo/index.d.ts",
|
|
27
|
-
"import": "./dist/seo/seo.mjs",
|
|
28
|
-
"require": "./dist/seo/seo.cjs",
|
|
29
|
-
"default": "./dist/seo/seo.mjs"
|
|
30
|
-
},
|
|
31
|
-
"./theme": {
|
|
32
|
-
"import": "./src/lib/theme.js",
|
|
33
|
-
"default": "./src/lib/theme.js"
|
|
34
|
-
},
|
|
35
|
-
"./dist/venue-calendar.css": "./dist/venue-calendar.css"
|
|
36
|
-
},
|
|
37
|
-
"_files_comment": "The `!dist/**/*.map` negation is load-bearing and must stay HERE, not in .npmignore. npm-packlist gives a root `files` array precedence over a root .npmignore, so the `dist/**/*.map` rule .npmignore has carried since the 2026-06-10 audit never applied: `npm pack --dry-run` published 93 sourcemaps totalling 29.3 MB of a 37.4 MB tarball. This is the embed widget that installs onto third-party venue sites; the maps are debugging surface, not shipped surface.",
|
|
38
|
-
"files": [
|
|
39
|
-
"dist",
|
|
40
|
-
"!dist/**/*.map",
|
|
41
|
-
"src/lib/theme.js",
|
|
42
|
-
"README.md"
|
|
43
|
-
],
|
|
44
|
-
"_sideEffects_comment": "There is deliberately NO `sideEffects` field, and adding one is a regression. Measured 2026-08-14 with a scratch consumer that imports a single export from the packed tarball and bundles it: vite 7.3.6 (the toolchain micdrop-frontend and performersportal actually run) produced 3,359,354 B over 53 chunks with no field and 3,359,364 B over 53 chunks with the allowlist — ten bytes LARGER. vite 8.2.1 (this repo's own) produced 3,303,350 B vs 3,303,181 B, a 169-byte saving on 3.30 MB (0.005%), and `sideEffects: false` came out byte-identical to the allowlist, i.e. the VALUE is inert. There is nothing to tree-shake: the ES entry is a pre-bundled single entry whose graph is reached by dynamic import. The risk is not inert. An AST scan of dist found 23 of 94 chunks carrying real import-time side effects — Svelte 5 `.delegate([...])` event registration in Input-*, ModalFooter-*, timezones-* and to-event-card-props-* (all inside the 23-file eager closure), zod's `globalThis.__zod_globalConfig` init in serverTotals-*, and in the entry itself the CSS-injection IIFE, `customElements.define`, the `window.__MICDROP_CALENDAR__` handshake and the auto-mount call. Those chunk filenames are content-hashed and change every build, so no allowlist can name them and stay correct; the first hash churn after a wrong list silently ships an unstyled widget with dead click handlers to third-party venue sites. Zero measurable upside against that is not a trade worth making.",
|
|
45
|
-
"scripts": {
|
|
46
|
-
"dev": "vite dev",
|
|
47
|
-
"build": "vite build",
|
|
48
|
-
"_build_lib_comment": "THREE passes, and the order is load-bearing. (1) VC_IIFE_ONLY=1 builds the IIFE and is the ONLY pass with emptyOutDir on — it owns the dist wipe. (2) the default pass appends ES + UMD. (3) vite.config.locales.js appends the version-pinned locale chunks the IIFE fetches at runtime. Move the locales pass earlier and it gets wiped by (1); give it emptyOutDir and it wipes the bundle it serves. Both failures are silent at build time and total at runtime, so scripts/size-guard.mjs asserts the IIFE and the locale tree coexist in dist.",
|
|
49
|
-
"build:lib": "cross-env VC_IIFE_ONLY=1 vite build --config vite.config.lib.js && vite build --config vite.config.lib.js && vite build --config vite.config.locales.js",
|
|
50
|
-
"build:api": "vite build --config vite.config.api.js",
|
|
51
|
-
"build:seo": "vite build --config vite.config.seo.js",
|
|
52
|
-
"build:all": "npm run build:lib && npm run build:api && npm run build:seo",
|
|
53
|
-
"preview": "vite preview",
|
|
54
|
-
"prepare": "node ./scripts/prepare.js",
|
|
55
|
-
"prepublishOnly": "npm run build:all",
|
|
56
|
-
"_lint_comment": "Ratchet cap. 2026-05-31: ESLint had NO svelte parser configured, so the entire .svelte tree was unparsed (300 'Unexpected token <' errors) and effectively unlinted. Wired the svelte parser (eslint.config.js) + downgraded the recommended svelte rules to 'warn' for the turn-on wave (mirrors performers-portal). 2026-06-10: ratcheted cap 1638 -> 418. 2026-07-16: burned the whole budget down (unused vars, navigation-without-resolve via resolve(), svelte/reactivity classes, hex -> color constants, @html removal, shadow renames) — cap is now 0 and stays 0; any new warning fails lint.",
|
|
57
|
-
"_lint_scope_comment": "Scope is `src e2e`, not `src` (#660). e2e/ was outside every CI lens while the pre-commit hook (lint-staged) enforced the SAME rules on any staged .js — so a committer was blocked by rules CI never measured. That is how #654 happened. #659 drained the 9 no-raw-date-construction violations first; this scope widening is the arming half, and it only ever runs green because the fixes landed first. Adding a directory here is cheap; leaving one out is invisible.",
|
|
58
|
-
"lint": "eslint src e2e --max-warnings 0",
|
|
59
|
-
"gate": "sh scripts/gate.sh",
|
|
60
|
-
"lint:fix": "eslint src e2e --fix",
|
|
61
|
-
"lint:css": "stylelint \"src/**/*.{css,scss,svelte}\" --allow-empty-input",
|
|
62
|
-
"lint:css:fix": "stylelint \"src/**/*.{css,scss,svelte}\" --allow-empty-input --fix",
|
|
63
|
-
"_format_comment": "Until #660 this repo had NO prettier check anywhere — not in package.json, not in any workflow. Formatting was enforced ONLY by the lint-staged pre-commit hook, which rewrites whatever you happen to stage. So a file that was never staged after a config change drifted forever, and the drift surfaced as an unrelated whole-file reformat in someone else's PR (#659 hit exactly that on e2e/embed-checkout.e2e.js). COVERED SURFACE IS `e2e` ONLY, deliberately. Two separate numbers, measured at e6f30590 — do not conflate them: `prettier --check .` reports 314 drifted files repo-wide, of which `prettier --check src` accounts for 129; the other 185 are docs/, .planning/, scripts/, plans/, test/, test-helpers/, canary/ and repo-root config. Reformatting product source is a separate change with its own blast radius (filed as #679, which covers the src/ 129 only — the non-src remainder is not yet filed). The arg is the DIRECTORY, not a glob with an extension list, so a new e2e/*.ts or e2e/**/fixtures/*.json is covered the day it lands instead of the day someone remembers to widen a pattern. Grow this scope by adding a directory; never by adding a file. `format:check:all` is the report-only view of the whole repo so the src backlog stays visible rather than hidden.",
|
|
64
|
-
"format:check": "prettier --check e2e",
|
|
65
|
-
"format:fix": "prettier --write e2e",
|
|
66
|
-
"format:check:all": "prettier --check .",
|
|
67
|
-
"knip": "knip",
|
|
68
|
-
"depcruise": "dependency-cruiser src --config .dependency-cruiser.cjs",
|
|
69
|
-
"design-system:check": "node scripts/design-system-check.mjs --report-only",
|
|
70
|
-
"design-system:check:strict": "node scripts/design-system-check.mjs --fail-on-new",
|
|
71
|
-
"design-system:baseline": "node scripts/design-system-check.mjs --baseline",
|
|
72
|
-
"cleanup-check": "node scripts/cleanup-on-destroy-check.mjs --report-only",
|
|
73
|
-
"cleanup-check:strict": "node scripts/cleanup-on-destroy-check.mjs --fail-on-new",
|
|
74
|
-
"cleanup-baseline": "node scripts/cleanup-on-destroy-check.mjs --baseline",
|
|
75
|
-
"checkout-lifecycle-check": "node scripts/checkout-lifecycle-check.mjs --report-only",
|
|
76
|
-
"checkout-lifecycle-check:strict": "node scripts/checkout-lifecycle-check.mjs --fail-on-new",
|
|
77
|
-
"checkout-lifecycle-baseline": "node scripts/checkout-lifecycle-check.mjs --baseline",
|
|
78
|
-
"quantity-clamp-check": "node scripts/quantity-clamp-check.mjs --report-only",
|
|
79
|
-
"quantity-clamp-check:strict": "node scripts/quantity-clamp-check.mjs --fail-on-new",
|
|
80
|
-
"quantity-clamp-baseline": "node scripts/quantity-clamp-check.mjs --baseline",
|
|
81
|
-
"no-new-skips-check": "node scripts/no-new-skips-check.mjs --report-only",
|
|
82
|
-
"no-new-skips-check:strict": "node scripts/no-new-skips-check.mjs --fail-on-new",
|
|
83
|
-
"no-new-skips-baseline": "node scripts/no-new-skips-check.mjs --baseline",
|
|
84
|
-
"no-sc-toast-check": "node scripts/no-sc-toast-check.mjs",
|
|
85
|
-
"no-sc-toast-check:report": "node scripts/no-sc-toast-check.mjs --report-only",
|
|
86
|
-
"lockfile-sync-check": "node scripts/lockfile-sync-check.mjs",
|
|
87
|
-
"lockfile-sync-check:report": "node scripts/lockfile-sync-check.mjs --report-only",
|
|
88
|
-
"failopen-loader-check": "node scripts/failopen-loader-check.mjs --report-only",
|
|
89
|
-
"failopen-loader-check:strict": "node scripts/failopen-loader-check.mjs --fail-on-new",
|
|
90
|
-
"voice:check": "node scripts/vc-copy-voice-ratchet.mjs --report-only",
|
|
91
|
-
"voice:check:strict": "node scripts/vc-copy-voice-ratchet.mjs",
|
|
92
|
-
"voice:vendor": "node scripts/gen-voice-rules-vendored.mjs",
|
|
93
|
-
"voice:vendor:check": "node scripts/gen-voice-rules-vendored.mjs --check",
|
|
94
|
-
"failopen-loader-baseline": "node scripts/failopen-loader-check.mjs --baseline",
|
|
95
|
-
"detectors:check": "node scripts/detectors/detectors-wired.mjs",
|
|
96
|
-
"git-hooks-resolve-check": "node scripts/detectors/git-hooks-resolve-check.mjs",
|
|
97
|
-
"git-hooks-resolve-check:report": "node scripts/detectors/git-hooks-resolve-check.mjs --report-only",
|
|
98
|
-
"class-emits-css-check": "node scripts/class-emits-css-check.mjs",
|
|
99
|
-
"token-resolves-check": "node scripts/token-resolves-check.mjs",
|
|
100
|
-
"check": "svelte-check --diagnostic-sources \"js,svelte\"",
|
|
101
|
-
"check:all": "svelte-check",
|
|
102
|
-
"test": "vitest run",
|
|
103
|
-
"test:ci-mute-guard": "vitest run scripts/ci-needs-graph.test.js",
|
|
104
|
-
"test:routes": "VITE_ROUTE_PROBE=1 vitest run src/lib/api/route-answers-probe.test.ts",
|
|
105
|
-
"test:watch": "vitest",
|
|
106
|
-
"test:ui": "vitest --ui",
|
|
107
|
-
"test:e2e": "playwright test",
|
|
108
|
-
"test:e2e:build": "npm run build:lib && playwright test",
|
|
109
|
-
"test:e2e:route": "playwright test --config playwright.route.config.js",
|
|
110
|
-
"test:e2e:route:build": "npm run build && playwright test --config playwright.route.config.js",
|
|
111
|
-
"_size_comment": "size-guard runs FIRST and is not decoration. size-limit resolves its config through lilconfig, whose search order puts package.json BEFORE .size-limit.js — so re-adding a package.json#size-limit key silently shadows the computed budget and the es cap goes back to measuring a 1 KB loader (#569) while CI stays green. size-guard re-runs that search order, re-derives the ES entry's static import closure, and refuses to hand off to size-limit unless the es cap measures it.",
|
|
112
|
-
"_release_preflight_comment": "Runs the checks that can only be answered about the ARTIFACT and the REGISTRY, not about the source tree — so it is deliberately NOT part of `npm run gate` (it needs a built dist and the network). Two questions: is this version already taken on npm (republishing a taken number is unrecoverable — jsDelivr/unpkg serve the first bytes they saw under that specifier forever), and does the tarball `npm pack` would actually upload contain any .map file. The second is asked of `npm pack --dry-run --json`, never of package.json#files, because `files` is what we INTENDED and the tarball is what SHIPS: published 4.1.55 carried 8.7 MB of maps with 786 sourcesContent entries despite an .npmignore that was supposed to stop it.",
|
|
113
|
-
"release:preflight": "node scripts/size-guard.mjs --release",
|
|
114
|
-
"size": "node scripts/size-guard.mjs && size-limit",
|
|
115
|
-
"size:why": "node scripts/size-guard.mjs && size-limit --why",
|
|
116
|
-
"heading-role-fidelity-check": "node scripts/heading-role-fidelity-check.mjs",
|
|
117
|
-
"heading-role-fidelity-check:report": "node scripts/heading-role-fidelity-check.mjs --report-only",
|
|
118
|
-
"composite-role-fidelity-check": "node scripts/composite-role-fidelity-check.mjs",
|
|
119
|
-
"composite-role-fidelity-check:report": "node scripts/composite-role-fidelity-check.mjs --report-only",
|
|
120
|
-
"dead-theme-selector-check": "node scripts/dead-theme-selector-check.mjs",
|
|
121
|
-
"label-name-resolves-check": "node scripts/label-name-resolves-check.mjs",
|
|
122
|
-
"stale-doc-comment-check": "node scripts/stale-doc-comment-check.mjs"
|
|
123
|
-
},
|
|
124
|
-
"keywords": [
|
|
125
|
-
"svelte",
|
|
126
|
-
"calendar",
|
|
127
|
-
"events",
|
|
128
|
-
"comedy",
|
|
129
|
-
"venue",
|
|
130
|
-
"component",
|
|
131
|
-
"micdrop"
|
|
132
|
-
],
|
|
133
|
-
"author": "MicDrop",
|
|
134
|
-
"license": "MIT",
|
|
135
|
-
"repository": {
|
|
136
|
-
"type": "git",
|
|
137
|
-
"url": "git+https://github.com/get-micdrop/venue-calendar.git"
|
|
138
|
-
},
|
|
139
|
-
"bugs": {
|
|
140
|
-
"url": "https://github.com/get-micdrop/venue-calendar/issues"
|
|
141
|
-
},
|
|
142
|
-
"homepage": "https://github.com/get-micdrop/venue-calendar#readme",
|
|
143
|
-
"_peerDependencies_comment": "TWO different contracts live here, and they cover DIFFERENT entry points. (a) `svelte` — the ES and UMD builds externalize svelte (vite.config.lib.js rollupOptions.external) and ship PRE-COMPILED output that binds through svelte/internal/client, a private, non-semver surface. So the consumer's svelte is the runtime for code this package's compiler emitted, and the compiler version is the real floor. The upper bound is the part that was missing: `>=5.56.0` admits Svelte 6, and this was the ONLY manifest in the fleet that would have taken it — svelte-stripe's `svelte: ^5` peer was the sole accidental brake, and moving that package to devDependencies (below) removes it, so the bound has to be explicit and it has to land in the same change. The floor is 5.56.4, NOT the 5.56.9 this repo compiles with: micdrop-frontend pins svelte to exactly 5.56.4 tree-wide and CANNOT move (mf 3ce86e22a reverted the 5.56.4 -> 5.56.9 bump because the Foundry Catalog Gate stops producing a byte-identical catalog under a different compiler, and that has to be fixed with the catalog regenerated in the same change, on Linux). A floor of 5.56.9 would therefore ERESOLVE against micdrop-frontend's own override on `npm ci` — i.e. it would brick the app that consumes this package in order to record an aspiration. The residual skew (consumer 5.56.4 < compiler 5.56.9) is real but not a missing-symbol crash: all 73 svelte/internal members the shipped dist references are present in 5.56.4. The exposure is SIGNATURE drift across the 7 differing internal/client files (reactivity/props.js `rest_props` is the one behind the June crash), which export-presence checks cannot catch. Close it by aligning the compilers, not by widening this range. (b) `@getmicdrop/svelte-components` — required by the ./api subpath ONLY: dist/api/api.mjs emits 5 SC subpath imports and api.cjs emits 7 (vite.config.api.js externalizes SC deliberately; the manifest never said so, and npm therefore never installed or warned about it). It is marked OPTIONAL below on purpose: @getmicdrop/venue-calendar is PUBLIC on npm but @getmicdrop/svelte-components is PRIVATE (an unauthenticated `npm view` of it 404s while this package resolves fine), so a REQUIRED peer would make `npm i @getmicdrop/venue-calendar` fail outright for every third party that only wants the widget entry — which bundles SC and needs nothing installed. Optional means npm stays quiet when SC is absent (it cannot be fetched anyway) but still version-checks it when present. The main/IIFE/UMD builds do NOT externalize SC; see the devDependencies pin.
|
|
144
|
-
"peerDependencies": {
|
|
145
|
-
"@getmicdrop/svelte-components": "^6.24.
|
|
146
|
-
"svelte": ">=5.56.4 <6"
|
|
147
|
-
},
|
|
148
|
-
"peerDependenciesMeta": {
|
|
149
|
-
"@getmicdrop/svelte-components": {
|
|
150
|
-
"optional": true
|
|
151
|
-
}
|
|
152
|
-
},
|
|
153
|
-
"_tanstack_svelte_query_comment": "`@tanstack/svelte-query` in devDependencies is NOT dead, and it must not be deleted on the evidence that `grep -r '@tanstack/svelte-query' src` returns nothing — it does return nothing, and that is expected. It exists solely to satisfy @getmicdrop/svelte-components' peer range `^6.1.28`. Removing it shrinks no artifact (it reaches none); it silently changes how npm resolves SC's peer tree, which surfaces as a version-skew crash in someone else's build days later with nothing pointing back here. The exact pin mirrors micdrop-frontend, which pins the same version and additionally overrides @tanstack/query-core to 5.100.14 — keep the two manifests agreeing.",
|
|
154
|
-
"_devDependencies_pin_comment": "Three EXACT pins in here are load-bearing and must not be re-caretted by a dependency bot. (1) `@getmicdrop/svelte-components` — the ES/UMD/IIFE builds do NOT externalize SC, so it is COMPILED INTO every shipped artifact. Under `^6.24.311` the SC version a venue's browser executes is whatever the range floats to on the publish machine at publish time, which is not recorded anywhere and is not reproducible after the fact; the `overrides` block below cannot help (it only ever covered esbuild, and consumers ignore a dependency's overrides entirely). Pinned exact so the artifact and the manifest agree, and vite.config.lib.js stamps the resolved version into the bundle as __VC_SC_VERSION__ so a venue's devtools can answer 'which SC is this?'. (2) `svelte` — the compiler whose private internal/client calls the pre-compiled dist binds to. `^5.56.9` let the compiler move under a peer range that stayed still; see _peerDependencies_comment. (3) `@stripe/stripe-js` in dependencies — see its own note there.",
|
|
155
|
-
"devDependencies": {
|
|
156
|
-
"@eslint/js": "^10.0.1",
|
|
157
|
-
"@getmicdrop/svelte-components": "
|
|
158
|
-
"@playwright/test": "^1.60.0",
|
|
159
|
-
"@size-limit/file": "^13.0.3",
|
|
160
|
-
"@sveltejs/adapter-auto": "^7.0.1",
|
|
161
|
-
"@sveltejs/kit": "^2.70.2",
|
|
162
|
-
"@sveltejs/vite-plugin-svelte": "^7.3.0",
|
|
163
|
-
"@tailwindcss/vite": "^4.3.3",
|
|
164
|
-
"@tanstack/svelte-query": "6.1.38",
|
|
165
|
-
"@testing-library/jest-dom": "^7.0.1",
|
|
166
|
-
"@testing-library/svelte": "^5.3.1",
|
|
167
|
-
"@types/node": "^26.2.0",
|
|
168
|
-
"@typescript-eslint/parser": "^8.59.2",
|
|
169
|
-
"@vitest/coverage-v8": "^4.1.10",
|
|
170
|
-
"cross-env": "^10.1.0",
|
|
171
|
-
"dependency-cruiser": "^18.2.0",
|
|
172
|
-
"eslint": "^10.8.1",
|
|
173
|
-
"eslint-plugin-svelte": "^3.22.0",
|
|
174
|
-
"fast-check": "^4.8.0",
|
|
175
|
-
"globals": "^17.11.0",
|
|
176
|
-
"husky": "^9.1.7",
|
|
177
|
-
"jsdom": "^29.1.1",
|
|
178
|
-
"knip": "^6.12.1",
|
|
179
|
-
"lint-staged": "^16.4.0",
|
|
180
|
-
"postcss": "^8.5.26",
|
|
181
|
-
"postcss-html": "^2.0.0",
|
|
182
|
-
"prettier": "^3.8.3",
|
|
183
|
-
"prettier-plugin-svelte": "^4.1.1",
|
|
184
|
-
"size-limit": "^13.0.3",
|
|
185
|
-
"stylelint": "^17.14.1",
|
|
186
|
-
"stylelint-config-standard": "^40.0.0",
|
|
187
|
-
"svelte": "5.56.9",
|
|
188
|
-
"svelte-check": "^4.3.5",
|
|
189
|
-
"svelte-stripe": "^2.0.0",
|
|
190
|
-
"tailwindcss": "^4.3.3",
|
|
191
|
-
"typescript": "^5.9.3",
|
|
192
|
-
"vite": "^8.2.1",
|
|
193
|
-
"vite-plugin-dts": "^5.0.3",
|
|
194
|
-
"vitest": "^4.1.10",
|
|
195
|
-
"yaml": "2.9.0"
|
|
196
|
-
},
|
|
197
|
-
"_overrides_comment": "esbuild is not a direct dependency here — it arrives as an OPTIONAL PEER of vite (^0.27.0 || ^0.28.0) and of unplugin-dts (*), and npm resolved it to 0.27.3, which is inside GHSA range 0.27.3-0.28.0 (arbitrary file read via the dev server on Windows; dev-only exposure, but this is a Windows shop). There is no direct dependency to bump, so the lift has to be an override. Keep this satisfying vite's peer range — ^0.28.x does; a 0.29 line would not.",
|
|
198
|
-
"overrides": {
|
|
199
|
-
"esbuild": "^0.28.2",
|
|
200
|
-
"svelte": "5.56.9",
|
|
201
|
-
"@tanstack/svelte-query": "6.1.38",
|
|
202
|
-
"@tanstack/query-core": "5.101.4"
|
|
203
|
-
},
|
|
204
|
-
"_dependencies_comment": "`@stripe/stripe-js` is pinned EXACT, and the caret it replaces was not a style choice. loadStripe() does not fetch a versioned URL — it builds `https://js.stripe.com/<RELEASE_TRAIN>/stripe.js` from a CONSTANT baked into whichever @stripe/stripe-js version resolves (9.13.0 hardcodes `RELEASE_TRAIN = 'dahlia'` in dist/index.mjs). This widget runs on third-party venue sites, many of which allowlist that exact script URL in their CSP, so a caret means a routine transitive bump silently MOVES the file a venue must allowlist and checkout dies on their site with a CSP violation and no signal on our side. The live 4.1.55 bundle still requests /clover/stripe.js while this tree resolves to /dahlia/ — the drift is not hypothetical. Pin it, and when the pin is raised, put the new train in the release notes so venue CSPs can be updated first. `svelte-stripe` USED to live here and has moved to devDependencies: no shipped artifact reaches it (dist mentions it only inside .map sourcesContent), CheckoutForm.svelte:81 deliberately calls Stripe.js directly instead ('Svelte 5 compatibility bug'), and the sole live import is a dynamic `import('svelte-stripe')` in src/routes/v/[venueSlug]/gift-cards/purchase/+page.svelte — a SvelteKit route in the dev/e2e app, which `files` does not publish. It stays installed for dev; it just stops being something every npm consumer downloads. Note what that move COSTS: svelte-stripe's own `svelte: ^5` peer was the only thing bounding a consumer's svelte below 6, so peerDependencies.svelte gained an explicit `<6` in the same change.",
|
|
205
|
-
"dependencies": {
|
|
206
|
-
"@stripe/stripe-js": "9.13.0",
|
|
207
|
-
"js-cookie": "^3.0.8",
|
|
208
|
-
"qrcode": "^1.5.4",
|
|
209
|
-
"zod": "^4.4.3"
|
|
210
|
-
},
|
|
211
|
-
"lint-staged": {
|
|
212
|
-
"*.{js,ts,svelte}": [
|
|
213
|
-
"eslint --fix",
|
|
214
|
-
"prettier --write"
|
|
215
|
-
],
|
|
216
|
-
"*.{json,css,md}": [
|
|
217
|
-
"prettier --write"
|
|
218
|
-
]
|
|
219
|
-
}
|
|
220
|
-
}
|
|
1
|
+
{
|
|
2
|
+
"name": "@getmicdrop/venue-calendar",
|
|
3
|
+
"_version_comment": "4.1.55 was the last PUBLISHED version, and the tree carried 36 commits npm's 4.1.55 does not have — including the gate-password security fix and four money fixes. A filename must never reuse a version npm has taken (jsDelivr/unpkg cache the FIRST bytes they see under `@4.1.55` forever, so republishing that number ships the old widget to every venue that pinned it). Bumped to 4.2.0 here, BEFORE anything is built for publish. `npm run release:preflight` refuses to proceed when this number already exists in the registry.",
|
|
4
|
+
"version": "4.2.3",
|
|
5
|
+
"description": "A customizable Svelte calendar component for displaying comedy events",
|
|
6
|
+
"type": "module",
|
|
7
|
+
"types": "./dist/types/index.d.ts",
|
|
8
|
+
"main": "./dist/venue-calendar.umd.js",
|
|
9
|
+
"module": "./dist/venue-calendar.es.js",
|
|
10
|
+
"_exports_types_comment": "Every `types` path below must EXIST in the tarball; `npm run size` (scripts/size-guard.mjs, checkExportsTypesResolve) asserts it against the built dist and reds if one dangles. It dangled for real: `./api` pointed at ./dist/api/index.d.ts while vite-plugin-dts emitted ./dist/api/api/index.d.ts, because the `include` root (src/lib/api) is not the tree root the plugin derived — two transformers import $lib/public-calendar-flow, which hoisted entryRoot to src/lib and pushed everything down one directory. TypeScript does not error on a `types` target that is absent; it silently falls back to no types at all, so `import '@getmicdrop/venue-calendar/api'` was implicitly `any` for every consumer and nothing anywhere said so. Fixed by pinning entryRoot in vite.config.api.js (NOT by retyping the string here) so the emitted path matches the contract, the way ./seo already did by accident.",
|
|
11
|
+
"exports": {
|
|
12
|
+
".": {
|
|
13
|
+
"types": "./dist/types/index.d.ts",
|
|
14
|
+
"svelte": "./dist/venue-calendar.es.js",
|
|
15
|
+
"import": "./dist/venue-calendar.es.js",
|
|
16
|
+
"require": "./dist/venue-calendar.umd.js",
|
|
17
|
+
"default": "./dist/venue-calendar.es.js"
|
|
18
|
+
},
|
|
19
|
+
"./api": {
|
|
20
|
+
"types": "./dist/api/index.d.ts",
|
|
21
|
+
"import": "./dist/api/api.mjs",
|
|
22
|
+
"require": "./dist/api/api.cjs",
|
|
23
|
+
"default": "./dist/api/api.mjs"
|
|
24
|
+
},
|
|
25
|
+
"./seo": {
|
|
26
|
+
"types": "./dist/seo/index.d.ts",
|
|
27
|
+
"import": "./dist/seo/seo.mjs",
|
|
28
|
+
"require": "./dist/seo/seo.cjs",
|
|
29
|
+
"default": "./dist/seo/seo.mjs"
|
|
30
|
+
},
|
|
31
|
+
"./theme": {
|
|
32
|
+
"import": "./src/lib/theme.js",
|
|
33
|
+
"default": "./src/lib/theme.js"
|
|
34
|
+
},
|
|
35
|
+
"./dist/venue-calendar.css": "./dist/venue-calendar.css"
|
|
36
|
+
},
|
|
37
|
+
"_files_comment": "The `!dist/**/*.map` negation is load-bearing and must stay HERE, not in .npmignore. npm-packlist gives a root `files` array precedence over a root .npmignore, so the `dist/**/*.map` rule .npmignore has carried since the 2026-06-10 audit never applied: `npm pack --dry-run` published 93 sourcemaps totalling 29.3 MB of a 37.4 MB tarball. This is the embed widget that installs onto third-party venue sites; the maps are debugging surface, not shipped surface.",
|
|
38
|
+
"files": [
|
|
39
|
+
"dist",
|
|
40
|
+
"!dist/**/*.map",
|
|
41
|
+
"src/lib/theme.js",
|
|
42
|
+
"README.md"
|
|
43
|
+
],
|
|
44
|
+
"_sideEffects_comment": "There is deliberately NO `sideEffects` field, and adding one is a regression. Measured 2026-08-14 with a scratch consumer that imports a single export from the packed tarball and bundles it: vite 7.3.6 (the toolchain micdrop-frontend and performersportal actually run) produced 3,359,354 B over 53 chunks with no field and 3,359,364 B over 53 chunks with the allowlist — ten bytes LARGER. vite 8.2.1 (this repo's own) produced 3,303,350 B vs 3,303,181 B, a 169-byte saving on 3.30 MB (0.005%), and `sideEffects: false` came out byte-identical to the allowlist, i.e. the VALUE is inert. There is nothing to tree-shake: the ES entry is a pre-bundled single entry whose graph is reached by dynamic import. The risk is not inert. An AST scan of dist found 23 of 94 chunks carrying real import-time side effects — Svelte 5 `.delegate([...])` event registration in Input-*, ModalFooter-*, timezones-* and to-event-card-props-* (all inside the 23-file eager closure), zod's `globalThis.__zod_globalConfig` init in serverTotals-*, and in the entry itself the CSS-injection IIFE, `customElements.define`, the `window.__MICDROP_CALENDAR__` handshake and the auto-mount call. Those chunk filenames are content-hashed and change every build, so no allowlist can name them and stay correct; the first hash churn after a wrong list silently ships an unstyled widget with dead click handlers to third-party venue sites. Zero measurable upside against that is not a trade worth making.",
|
|
45
|
+
"scripts": {
|
|
46
|
+
"dev": "vite dev",
|
|
47
|
+
"build": "vite build",
|
|
48
|
+
"_build_lib_comment": "THREE passes, and the order is load-bearing. (1) VC_IIFE_ONLY=1 builds the IIFE and is the ONLY pass with emptyOutDir on — it owns the dist wipe. (2) the default pass appends ES + UMD. (3) vite.config.locales.js appends the version-pinned locale chunks the IIFE fetches at runtime. Move the locales pass earlier and it gets wiped by (1); give it emptyOutDir and it wipes the bundle it serves. Both failures are silent at build time and total at runtime, so scripts/size-guard.mjs asserts the IIFE and the locale tree coexist in dist.",
|
|
49
|
+
"build:lib": "cross-env VC_IIFE_ONLY=1 vite build --config vite.config.lib.js && vite build --config vite.config.lib.js && vite build --config vite.config.locales.js",
|
|
50
|
+
"build:api": "vite build --config vite.config.api.js",
|
|
51
|
+
"build:seo": "vite build --config vite.config.seo.js",
|
|
52
|
+
"build:all": "npm run build:lib && npm run build:api && npm run build:seo",
|
|
53
|
+
"preview": "vite preview",
|
|
54
|
+
"prepare": "node ./scripts/prepare.js",
|
|
55
|
+
"prepublishOnly": "npm run build:all",
|
|
56
|
+
"_lint_comment": "Ratchet cap. 2026-05-31: ESLint had NO svelte parser configured, so the entire .svelte tree was unparsed (300 'Unexpected token <' errors) and effectively unlinted. Wired the svelte parser (eslint.config.js) + downgraded the recommended svelte rules to 'warn' for the turn-on wave (mirrors performers-portal). 2026-06-10: ratcheted cap 1638 -> 418. 2026-07-16: burned the whole budget down (unused vars, navigation-without-resolve via resolve(), svelte/reactivity classes, hex -> color constants, @html removal, shadow renames) — cap is now 0 and stays 0; any new warning fails lint.",
|
|
57
|
+
"_lint_scope_comment": "Scope is `src e2e`, not `src` (#660). e2e/ was outside every CI lens while the pre-commit hook (lint-staged) enforced the SAME rules on any staged .js — so a committer was blocked by rules CI never measured. That is how #654 happened. #659 drained the 9 no-raw-date-construction violations first; this scope widening is the arming half, and it only ever runs green because the fixes landed first. Adding a directory here is cheap; leaving one out is invisible.",
|
|
58
|
+
"lint": "eslint src e2e --max-warnings 0",
|
|
59
|
+
"gate": "sh scripts/gate.sh",
|
|
60
|
+
"lint:fix": "eslint src e2e --fix",
|
|
61
|
+
"lint:css": "stylelint \"src/**/*.{css,scss,svelte}\" --allow-empty-input",
|
|
62
|
+
"lint:css:fix": "stylelint \"src/**/*.{css,scss,svelte}\" --allow-empty-input --fix",
|
|
63
|
+
"_format_comment": "Until #660 this repo had NO prettier check anywhere — not in package.json, not in any workflow. Formatting was enforced ONLY by the lint-staged pre-commit hook, which rewrites whatever you happen to stage. So a file that was never staged after a config change drifted forever, and the drift surfaced as an unrelated whole-file reformat in someone else's PR (#659 hit exactly that on e2e/embed-checkout.e2e.js). COVERED SURFACE IS `e2e` ONLY, deliberately. Two separate numbers, measured at e6f30590 — do not conflate them: `prettier --check .` reports 314 drifted files repo-wide, of which `prettier --check src` accounts for 129; the other 185 are docs/, .planning/, scripts/, plans/, test/, test-helpers/, canary/ and repo-root config. Reformatting product source is a separate change with its own blast radius (filed as #679, which covers the src/ 129 only — the non-src remainder is not yet filed). The arg is the DIRECTORY, not a glob with an extension list, so a new e2e/*.ts or e2e/**/fixtures/*.json is covered the day it lands instead of the day someone remembers to widen a pattern. Grow this scope by adding a directory; never by adding a file. `format:check:all` is the report-only view of the whole repo so the src backlog stays visible rather than hidden.",
|
|
64
|
+
"format:check": "prettier --check e2e",
|
|
65
|
+
"format:fix": "prettier --write e2e",
|
|
66
|
+
"format:check:all": "prettier --check .",
|
|
67
|
+
"knip": "knip",
|
|
68
|
+
"depcruise": "dependency-cruiser src --config .dependency-cruiser.cjs",
|
|
69
|
+
"design-system:check": "node scripts/design-system-check.mjs --report-only",
|
|
70
|
+
"design-system:check:strict": "node scripts/design-system-check.mjs --fail-on-new",
|
|
71
|
+
"design-system:baseline": "node scripts/design-system-check.mjs --baseline",
|
|
72
|
+
"cleanup-check": "node scripts/cleanup-on-destroy-check.mjs --report-only",
|
|
73
|
+
"cleanup-check:strict": "node scripts/cleanup-on-destroy-check.mjs --fail-on-new",
|
|
74
|
+
"cleanup-baseline": "node scripts/cleanup-on-destroy-check.mjs --baseline",
|
|
75
|
+
"checkout-lifecycle-check": "node scripts/checkout-lifecycle-check.mjs --report-only",
|
|
76
|
+
"checkout-lifecycle-check:strict": "node scripts/checkout-lifecycle-check.mjs --fail-on-new",
|
|
77
|
+
"checkout-lifecycle-baseline": "node scripts/checkout-lifecycle-check.mjs --baseline",
|
|
78
|
+
"quantity-clamp-check": "node scripts/quantity-clamp-check.mjs --report-only",
|
|
79
|
+
"quantity-clamp-check:strict": "node scripts/quantity-clamp-check.mjs --fail-on-new",
|
|
80
|
+
"quantity-clamp-baseline": "node scripts/quantity-clamp-check.mjs --baseline",
|
|
81
|
+
"no-new-skips-check": "node scripts/no-new-skips-check.mjs --report-only",
|
|
82
|
+
"no-new-skips-check:strict": "node scripts/no-new-skips-check.mjs --fail-on-new",
|
|
83
|
+
"no-new-skips-baseline": "node scripts/no-new-skips-check.mjs --baseline",
|
|
84
|
+
"no-sc-toast-check": "node scripts/no-sc-toast-check.mjs",
|
|
85
|
+
"no-sc-toast-check:report": "node scripts/no-sc-toast-check.mjs --report-only",
|
|
86
|
+
"lockfile-sync-check": "node scripts/lockfile-sync-check.mjs",
|
|
87
|
+
"lockfile-sync-check:report": "node scripts/lockfile-sync-check.mjs --report-only",
|
|
88
|
+
"failopen-loader-check": "node scripts/failopen-loader-check.mjs --report-only",
|
|
89
|
+
"failopen-loader-check:strict": "node scripts/failopen-loader-check.mjs --fail-on-new",
|
|
90
|
+
"voice:check": "node scripts/vc-copy-voice-ratchet.mjs --report-only",
|
|
91
|
+
"voice:check:strict": "node scripts/vc-copy-voice-ratchet.mjs",
|
|
92
|
+
"voice:vendor": "node scripts/gen-voice-rules-vendored.mjs",
|
|
93
|
+
"voice:vendor:check": "node scripts/gen-voice-rules-vendored.mjs --check",
|
|
94
|
+
"failopen-loader-baseline": "node scripts/failopen-loader-check.mjs --baseline",
|
|
95
|
+
"detectors:check": "node scripts/detectors/detectors-wired.mjs",
|
|
96
|
+
"git-hooks-resolve-check": "node scripts/detectors/git-hooks-resolve-check.mjs",
|
|
97
|
+
"git-hooks-resolve-check:report": "node scripts/detectors/git-hooks-resolve-check.mjs --report-only",
|
|
98
|
+
"class-emits-css-check": "node scripts/class-emits-css-check.mjs",
|
|
99
|
+
"token-resolves-check": "node scripts/token-resolves-check.mjs",
|
|
100
|
+
"check": "svelte-check --diagnostic-sources \"js,svelte\"",
|
|
101
|
+
"check:all": "svelte-check",
|
|
102
|
+
"test": "vitest run",
|
|
103
|
+
"test:ci-mute-guard": "vitest run scripts/ci-needs-graph.test.js",
|
|
104
|
+
"test:routes": "VITE_ROUTE_PROBE=1 vitest run src/lib/api/route-answers-probe.test.ts",
|
|
105
|
+
"test:watch": "vitest",
|
|
106
|
+
"test:ui": "vitest --ui",
|
|
107
|
+
"test:e2e": "playwright test",
|
|
108
|
+
"test:e2e:build": "npm run build:lib && playwright test",
|
|
109
|
+
"test:e2e:route": "playwright test --config playwright.route.config.js",
|
|
110
|
+
"test:e2e:route:build": "npm run build && playwright test --config playwright.route.config.js",
|
|
111
|
+
"_size_comment": "size-guard runs FIRST and is not decoration. size-limit resolves its config through lilconfig, whose search order puts package.json BEFORE .size-limit.js — so re-adding a package.json#size-limit key silently shadows the computed budget and the es cap goes back to measuring a 1 KB loader (#569) while CI stays green. size-guard re-runs that search order, re-derives the ES entry's static import closure, and refuses to hand off to size-limit unless the es cap measures it.",
|
|
112
|
+
"_release_preflight_comment": "Runs the checks that can only be answered about the ARTIFACT and the REGISTRY, not about the source tree — so it is deliberately NOT part of `npm run gate` (it needs a built dist and the network). Two questions: is this version already taken on npm (republishing a taken number is unrecoverable — jsDelivr/unpkg serve the first bytes they saw under that specifier forever), and does the tarball `npm pack` would actually upload contain any .map file. The second is asked of `npm pack --dry-run --json`, never of package.json#files, because `files` is what we INTENDED and the tarball is what SHIPS: published 4.1.55 carried 8.7 MB of maps with 786 sourcesContent entries despite an .npmignore that was supposed to stop it.",
|
|
113
|
+
"release:preflight": "node scripts/size-guard.mjs --release",
|
|
114
|
+
"size": "node scripts/size-guard.mjs && size-limit",
|
|
115
|
+
"size:why": "node scripts/size-guard.mjs && size-limit --why",
|
|
116
|
+
"heading-role-fidelity-check": "node scripts/heading-role-fidelity-check.mjs",
|
|
117
|
+
"heading-role-fidelity-check:report": "node scripts/heading-role-fidelity-check.mjs --report-only",
|
|
118
|
+
"composite-role-fidelity-check": "node scripts/composite-role-fidelity-check.mjs",
|
|
119
|
+
"composite-role-fidelity-check:report": "node scripts/composite-role-fidelity-check.mjs --report-only",
|
|
120
|
+
"dead-theme-selector-check": "node scripts/dead-theme-selector-check.mjs",
|
|
121
|
+
"label-name-resolves-check": "node scripts/label-name-resolves-check.mjs",
|
|
122
|
+
"stale-doc-comment-check": "node scripts/stale-doc-comment-check.mjs"
|
|
123
|
+
},
|
|
124
|
+
"keywords": [
|
|
125
|
+
"svelte",
|
|
126
|
+
"calendar",
|
|
127
|
+
"events",
|
|
128
|
+
"comedy",
|
|
129
|
+
"venue",
|
|
130
|
+
"component",
|
|
131
|
+
"micdrop"
|
|
132
|
+
],
|
|
133
|
+
"author": "MicDrop",
|
|
134
|
+
"license": "MIT",
|
|
135
|
+
"repository": {
|
|
136
|
+
"type": "git",
|
|
137
|
+
"url": "git+https://github.com/get-micdrop/venue-calendar.git"
|
|
138
|
+
},
|
|
139
|
+
"bugs": {
|
|
140
|
+
"url": "https://github.com/get-micdrop/venue-calendar/issues"
|
|
141
|
+
},
|
|
142
|
+
"homepage": "https://github.com/get-micdrop/venue-calendar#readme",
|
|
143
|
+
"_peerDependencies_comment": "TWO different contracts live here, and they cover DIFFERENT entry points. (a) `svelte` — the ES and UMD builds externalize svelte (vite.config.lib.js rollupOptions.external) and ship PRE-COMPILED output that binds through svelte/internal/client, a private, non-semver surface. So the consumer's svelte is the runtime for code this package's compiler emitted, and the compiler version is the real floor. The upper bound is the part that was missing: `>=5.56.0` admits Svelte 6, and this was the ONLY manifest in the fleet that would have taken it — svelte-stripe's `svelte: ^5` peer was the sole accidental brake, and moving that package to devDependencies (below) removes it, so the bound has to be explicit and it has to land in the same change. The floor is 5.56.4, NOT the 5.56.9 this repo compiles with: micdrop-frontend pins svelte to exactly 5.56.4 tree-wide and CANNOT move (mf 3ce86e22a reverted the 5.56.4 -> 5.56.9 bump because the Foundry Catalog Gate stops producing a byte-identical catalog under a different compiler, and that has to be fixed with the catalog regenerated in the same change, on Linux). A floor of 5.56.9 would therefore ERESOLVE against micdrop-frontend's own override on `npm ci` — i.e. it would brick the app that consumes this package in order to record an aspiration. The residual skew (consumer 5.56.4 < compiler 5.56.9) is real but not a missing-symbol crash: all 73 svelte/internal members the shipped dist references are present in 5.56.4. The exposure is SIGNATURE drift across the 7 differing internal/client files (reactivity/props.js `rest_props` is the one behind the June crash), which export-presence checks cannot catch. Close it by aligning the compilers, not by widening this range. (b) `@getmicdrop/svelte-components` — required by the ./api subpath ONLY: dist/api/api.mjs emits 5 SC subpath imports and api.cjs emits 7 (vite.config.api.js externalizes SC deliberately; the manifest never said so, and npm therefore never installed or warned about it). It is marked OPTIONAL below on purpose: @getmicdrop/venue-calendar is PUBLIC on npm but @getmicdrop/svelte-components is PRIVATE (an unauthenticated `npm view` of it 404s while this package resolves fine), so a REQUIRED peer would make `npm i @getmicdrop/venue-calendar` fail outright for every third party that only wants the widget entry — which bundles SC and needs nothing installed. Optional means npm stays quiet when SC is absent (it cannot be fetched anyway) but still version-checks it when present. The main/IIFE/UMD builds do NOT externalize SC; see the devDependencies pin. SEAM RESOLVED (2026-08-23): declaring SC in BOTH devDependencies (build) and peerDependencies (./api contract) is the intended shape, and the test no longer objects. It used to: scDepType asserted SC appeared in EXACTLY ONE of the four dependency maps and found two, failing 3 tests. The fix landed where this note said it should — scripts/lockfile-sync-check.test.js now derives INSTALL_DEP_TYPES as DEP_TYPES minus peerDependencies, so a peer is no longer counted as somewhere SC is installed from. The detector (scripts/lockfile-sync-check.mjs) always handled peers correctly. Nothing is outstanding here; this paragraph is kept as the record of why the two-map shape is deliberate rather than a mistake to be tidied away",
|
|
144
|
+
"peerDependencies": {
|
|
145
|
+
"@getmicdrop/svelte-components": "^6.24.316",
|
|
146
|
+
"svelte": ">=5.56.4 <6"
|
|
147
|
+
},
|
|
148
|
+
"peerDependenciesMeta": {
|
|
149
|
+
"@getmicdrop/svelte-components": {
|
|
150
|
+
"optional": true
|
|
151
|
+
}
|
|
152
|
+
},
|
|
153
|
+
"_tanstack_svelte_query_comment": "`@tanstack/svelte-query` in devDependencies is NOT dead, and it must not be deleted on the evidence that `grep -r '@tanstack/svelte-query' src` returns nothing — it does return nothing, and that is expected. It exists solely to satisfy @getmicdrop/svelte-components' peer range `^6.1.28`. Removing it shrinks no artifact (it reaches none); it silently changes how npm resolves SC's peer tree, which surfaces as a version-skew crash in someone else's build days later with nothing pointing back here. The exact pin mirrors micdrop-frontend, which pins the same version and additionally overrides @tanstack/query-core to 5.100.14 — keep the two manifests agreeing.",
|
|
154
|
+
"_devDependencies_pin_comment": "Three EXACT pins in here are load-bearing and must not be re-caretted by a dependency bot. (1) `@getmicdrop/svelte-components` — the ES/UMD/IIFE builds do NOT externalize SC, so it is COMPILED INTO every shipped artifact. RESTORED TO AN EXACT PIN 2026-08-23, having drifted back to a caret at some point between 6.24.311 and 6.24.316 — exactly the re-caretting this note warns about, which is worth knowing recurs. Under a caretted range like `^6.24.311` the SC version a venue's browser executes is whatever the range floats to on the publish machine at publish time, which is not recorded anywhere and is not reproducible after the fact; the `overrides` block below cannot help (it only ever covered esbuild, and consumers ignore a dependency's overrides entirely). Pinned exact so the artifact and the manifest agree, and vite.config.lib.js stamps the resolved version into the bundle as __VC_SC_VERSION__ so a venue's devtools can answer 'which SC is this?'. (2) `svelte` — the compiler whose private internal/client calls the pre-compiled dist binds to. `^5.56.9` let the compiler move under a peer range that stayed still; see _peerDependencies_comment. (3) `@stripe/stripe-js` in dependencies — see its own note there.",
|
|
155
|
+
"devDependencies": {
|
|
156
|
+
"@eslint/js": "^10.0.1",
|
|
157
|
+
"@getmicdrop/svelte-components": "6.24.316",
|
|
158
|
+
"@playwright/test": "^1.60.0",
|
|
159
|
+
"@size-limit/file": "^13.0.3",
|
|
160
|
+
"@sveltejs/adapter-auto": "^7.0.1",
|
|
161
|
+
"@sveltejs/kit": "^2.70.2",
|
|
162
|
+
"@sveltejs/vite-plugin-svelte": "^7.3.0",
|
|
163
|
+
"@tailwindcss/vite": "^4.3.3",
|
|
164
|
+
"@tanstack/svelte-query": "6.1.38",
|
|
165
|
+
"@testing-library/jest-dom": "^7.0.1",
|
|
166
|
+
"@testing-library/svelte": "^5.3.1",
|
|
167
|
+
"@types/node": "^26.2.0",
|
|
168
|
+
"@typescript-eslint/parser": "^8.59.2",
|
|
169
|
+
"@vitest/coverage-v8": "^4.1.10",
|
|
170
|
+
"cross-env": "^10.1.0",
|
|
171
|
+
"dependency-cruiser": "^18.2.0",
|
|
172
|
+
"eslint": "^10.8.1",
|
|
173
|
+
"eslint-plugin-svelte": "^3.22.0",
|
|
174
|
+
"fast-check": "^4.8.0",
|
|
175
|
+
"globals": "^17.11.0",
|
|
176
|
+
"husky": "^9.1.7",
|
|
177
|
+
"jsdom": "^29.1.1",
|
|
178
|
+
"knip": "^6.12.1",
|
|
179
|
+
"lint-staged": "^16.4.0",
|
|
180
|
+
"postcss": "^8.5.26",
|
|
181
|
+
"postcss-html": "^2.0.0",
|
|
182
|
+
"prettier": "^3.8.3",
|
|
183
|
+
"prettier-plugin-svelte": "^4.1.1",
|
|
184
|
+
"size-limit": "^13.0.3",
|
|
185
|
+
"stylelint": "^17.14.1",
|
|
186
|
+
"stylelint-config-standard": "^40.0.0",
|
|
187
|
+
"svelte": "5.56.9",
|
|
188
|
+
"svelte-check": "^4.3.5",
|
|
189
|
+
"svelte-stripe": "^2.0.0",
|
|
190
|
+
"tailwindcss": "^4.3.3",
|
|
191
|
+
"typescript": "^5.9.3",
|
|
192
|
+
"vite": "^8.2.1",
|
|
193
|
+
"vite-plugin-dts": "^5.0.3",
|
|
194
|
+
"vitest": "^4.1.10",
|
|
195
|
+
"yaml": "2.9.0"
|
|
196
|
+
},
|
|
197
|
+
"_overrides_comment": "esbuild is not a direct dependency here — it arrives as an OPTIONAL PEER of vite (^0.27.0 || ^0.28.0) and of unplugin-dts (*), and npm resolved it to 0.27.3, which is inside GHSA range 0.27.3-0.28.0 (arbitrary file read via the dev server on Windows; dev-only exposure, but this is a Windows shop). There is no direct dependency to bump, so the lift has to be an override. Keep this satisfying vite's peer range — ^0.28.x does; a 0.29 line would not.",
|
|
198
|
+
"overrides": {
|
|
199
|
+
"esbuild": "^0.28.2",
|
|
200
|
+
"svelte": "5.56.9",
|
|
201
|
+
"@tanstack/svelte-query": "6.1.38",
|
|
202
|
+
"@tanstack/query-core": "5.101.4"
|
|
203
|
+
},
|
|
204
|
+
"_dependencies_comment": "`@stripe/stripe-js` is pinned EXACT, and the caret it replaces was not a style choice. loadStripe() does not fetch a versioned URL — it builds `https://js.stripe.com/<RELEASE_TRAIN>/stripe.js` from a CONSTANT baked into whichever @stripe/stripe-js version resolves (9.13.0 hardcodes `RELEASE_TRAIN = 'dahlia'` in dist/index.mjs). This widget runs on third-party venue sites, many of which allowlist that exact script URL in their CSP, so a caret means a routine transitive bump silently MOVES the file a venue must allowlist and checkout dies on their site with a CSP violation and no signal on our side. The live 4.1.55 bundle still requests /clover/stripe.js while this tree resolves to /dahlia/ — the drift is not hypothetical. Pin it, and when the pin is raised, put the new train in the release notes so venue CSPs can be updated first. `svelte-stripe` USED to live here and has moved to devDependencies: no shipped artifact reaches it (dist mentions it only inside .map sourcesContent), CheckoutForm.svelte:81 deliberately calls Stripe.js directly instead ('Svelte 5 compatibility bug'), and the sole live import is a dynamic `import('svelte-stripe')` in src/routes/v/[venueSlug]/gift-cards/purchase/+page.svelte — a SvelteKit route in the dev/e2e app, which `files` does not publish. It stays installed for dev; it just stops being something every npm consumer downloads. Note what that move COSTS: svelte-stripe's own `svelte: ^5` peer was the only thing bounding a consumer's svelte below 6, so peerDependencies.svelte gained an explicit `<6` in the same change.",
|
|
205
|
+
"dependencies": {
|
|
206
|
+
"@stripe/stripe-js": "9.13.0",
|
|
207
|
+
"js-cookie": "^3.0.8",
|
|
208
|
+
"qrcode": "^1.5.4",
|
|
209
|
+
"zod": "^4.4.3"
|
|
210
|
+
},
|
|
211
|
+
"lint-staged": {
|
|
212
|
+
"*.{js,ts,svelte}": [
|
|
213
|
+
"eslint --fix",
|
|
214
|
+
"prettier --write"
|
|
215
|
+
],
|
|
216
|
+
"*.{json,css,md}": [
|
|
217
|
+
"prettier --write"
|
|
218
|
+
]
|
|
219
|
+
}
|
|
220
|
+
}
|
|
@@ -1,62 +0,0 @@
|
|
|
1
|
-
import { rt as e } from "./timezones-Cq1mLtfM.js";
|
|
2
|
-
import { J as t } from "./constants-Dcj3kgZE.js";
|
|
3
|
-
import "svelte/internal/disclose-version";
|
|
4
|
-
import * as n from "svelte/internal/client";
|
|
5
|
-
//#region node_modules/@getmicdrop/svelte-components/dist/primitives/Icons/CloseOutline.svelte
|
|
6
|
-
var r = n.from_svg("<svg aria-hidden=\"true\" fill=\"none\" stroke-width=\"2\" viewBox=\"0 0 24 24\" xmlns=\"http://www.w3.org/2000/svg\"><path stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M6 18L18 6M6 6l12 12\"></path></svg>");
|
|
7
|
-
function i(e, t) {
|
|
8
|
-
let i = n.prop(t, "size", 3, "24"), a = n.prop(t, "color", 3, "currentColor"), o = n.prop(t, "class", 3, "");
|
|
9
|
-
var s = r();
|
|
10
|
-
n.template_effect(() => {
|
|
11
|
-
n.set_class(s, 0, n.clsx(o())), n.set_attribute(s, "width", i()), n.set_attribute(s, "height", i()), n.set_attribute(s, "stroke", a());
|
|
12
|
-
}), n.append(e, s);
|
|
13
|
-
}
|
|
14
|
-
//#endregion
|
|
15
|
-
//#region node_modules/@getmicdrop/svelte-components/dist/primitives/Icons/phosphor/InfoIcon.svelte
|
|
16
|
-
var a = n.from_svg("<path d=\"M128,24A104,104,0,1,0,232,128,104.11,104.11,0,0,0,128,24Zm-4,48a12,12,0,1,1-12,12A12,12,0,0,1,124,72Zm12,112a16,16,0,0,1-16-16V128a8,8,0,0,1,0-16,16,16,0,0,1,16,16v40a8,8,0,0,1,0,16Z\"></path>"), o = n.from_svg("<circle cx=\"128\" cy=\"128\" r=\"96\" fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"16\"></circle><path d=\"M120,120a8,8,0,0,1,8,8v40a8,8,0,0,0,8,8\" fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"16\"></path><circle cx=\"124\" cy=\"84\" r=\"12\"></circle>", 1), s = n.from_svg("<svg aria-hidden=\"true\" viewBox=\"0 0 256 256\" fill=\"currentColor\" xmlns=\"http://www.w3.org/2000/svg\"><!></svg>");
|
|
17
|
-
function c(e, r) {
|
|
18
|
-
n.push(r, !0);
|
|
19
|
-
let i = n.prop(r, "size", 3, "24"), c = n.prop(r, "color", 3, "currentColor"), l = n.prop(r, "class", 3, ""), u = t(), d = n.derived(() => r.weight ?? u?.weight ?? "regular");
|
|
20
|
-
var f = s();
|
|
21
|
-
let p;
|
|
22
|
-
var m = n.child(f), h = (e) => {
|
|
23
|
-
var t = a();
|
|
24
|
-
n.append(e, t);
|
|
25
|
-
}, g = (e) => {
|
|
26
|
-
var t = o();
|
|
27
|
-
n.next(2), n.append(e, t);
|
|
28
|
-
};
|
|
29
|
-
n.if(m, (e) => {
|
|
30
|
-
n.get(d) === "fill" ? e(h) : e(g, -1);
|
|
31
|
-
}), n.reset(f), n.template_effect(() => {
|
|
32
|
-
n.set_class(f, 0, n.clsx(l())), n.set_attribute(f, "width", i()), n.set_attribute(f, "height", i()), p = n.set_style(f, "", p, { color: c() === "currentColor" ? void 0 : c() });
|
|
33
|
-
}), n.append(e, f), n.pop();
|
|
34
|
-
}
|
|
35
|
-
//#endregion
|
|
36
|
-
//#region node_modules/@getmicdrop/svelte-components/dist/primitives/Skeleton/BlockPlaceholder.svelte
|
|
37
|
-
var l = n.from_html("<div></div>"), u = n.from_html("<div role=\"status\"><!> <span class=\"sr-only\"> </span></div>");
|
|
38
|
-
function d(t, r) {
|
|
39
|
-
n.push(r, !0);
|
|
40
|
-
let i = {
|
|
41
|
-
loadingContent: "Loading content",
|
|
42
|
-
loading: "Loading..."
|
|
43
|
-
}, a = n.prop(r, "rows", 3, 1), o = n.prop(r, "height", 3, "h-full"), s = n.prop(r, "rounded", 3, "lg"), c = n.prop(r, "tone", 3, "tertiary"), d = n.prop(r, "gap", 3, "space-y-2"), f = n.prop(r, "animate", 3, !0), p = n.prop(r, "class", 3, ""), m = n.prop(r, "labels", 19, () => ({})), h = n.derived(() => e(i, m())), g = {
|
|
44
|
-
md: "rounded-md",
|
|
45
|
-
lg: "rounded-lg",
|
|
46
|
-
xl: "rounded-xl"
|
|
47
|
-
}, _ = {
|
|
48
|
-
secondary: "bg-bg-secondary",
|
|
49
|
-
tertiary: "bg-bg-tertiary"
|
|
50
|
-
}, v = n.derived(() => g[s()] || g.lg), y = n.derived(() => _[c()] || _.tertiary), b = n.derived(() => f() ? "animate-pulse" : ""), x = n.derived(() => Math.max(0, Math.floor(a()))), S = n.derived(() => n.get(x) > 1 ? d() : "");
|
|
51
|
-
var C = u(), w = n.child(C);
|
|
52
|
-
n.each(w, 17, () => Array(n.get(x)), n.index, (e, t) => {
|
|
53
|
-
var r = l();
|
|
54
|
-
n.template_effect(() => n.set_class(r, 1, `w-full ${o() ?? ""} ${n.get(y) ?? ""} ${n.get(v) ?? ""}`)), n.append(e, r);
|
|
55
|
-
});
|
|
56
|
-
var T = n.sibling(w, 2), E = n.child(T, !0);
|
|
57
|
-
n.reset(T), n.reset(C), n.template_effect(() => {
|
|
58
|
-
n.set_class(C, 1, `${n.get(S) ?? ""} ${n.get(b) ?? ""} ${p() ?? ""}`), n.set_attribute(C, "aria-label", n.get(h).loadingContent), n.set_text(E, n.get(h).loading);
|
|
59
|
-
}), n.append(t, C), n.pop();
|
|
60
|
-
}
|
|
61
|
-
//#endregion
|
|
62
|
-
export { c as n, i as r, d as t };
|