@getmicdrop/venue-calendar 4.2.33 → 4.2.35

package/dist/{zh-CAAnH4T4.js → zh-C8kyVh24.js}

@@ -172,7 +172,10 @@ var e = {
 	waitlistLinkUsed: "此链接已被使用。您仍在候补名单中",
 	waitlistLinkEmailMismatch: "此链接已发送至其他邮箱。您仍在候补名单中",
 	waitlistLinkInventoryExhausted: "这些门票刚刚已被抢完。您仍在候补名单中 — 如果再有余票释出，我们会发送邮件通知您",
-	dismiss: "关闭"
+	dismiss: "关闭",
+	keepMeUpdatedByVenue: "接收 {venue} 的活动及最新资讯",
+	privacyPolicyLink: "隐私政策",
+	paymentUnavailable: "目前无法为此订单收款 — 请刷新页面或联系场馆"
 };
 //#endregion
 export { e as zh };

package/dist/{zh-CwlRq_aG.js → zh-ydknixkJ.js}

@@ -439,7 +439,69 @@ var e = {
 	hasEvents: "有活动",
 	viewMode: "视图模式",
 	goToCurrentMonth: "返回本月",
-	nShowtimes: "{n} 个场次"
+	nShowtimes: "{n} 个场次",
+	checkoutUnavailableTitle: "此处暂不支持在线购票",
+	checkoutUnavailableBody: "您可以在下方浏览近期演出，但目前无法在本网站购票。请前往场馆自己的购票页面，或联系场馆预订。",
+	checkoutUnavailableOwnerNote: "网站所有者：{origin} 尚未注册结算功能。请联系 Micdrop 将此域名添加到您组织允许的嵌入域名中 — 更改最多需要 5 分钟生效。",
+	keepMeUpdatedByVenue: "接收 {venue} 的活动及最新资讯",
+	waitlistWindowNotice: "这些门票将为您保留",
+	waitlistWindowSuffix: "— 超时后，名额将让给下一位排队者",
+	waitlistWindowExpired: "您的购票时限已过 — 该座位正在提供给下一位排队者",
+	waitlistRequeueCta: "排到下一个位置",
+	waitlistRequeueBusy: "正在为您前移…",
+	waitlistRequeueDone: "您已排在第一位 — 下一个座位空出后我们会立即发邮件通知您",
+	waitlistRequeueNotOnList: "您已不在此候补名单中 — 请通过下方按钮重新加入",
+	waitlistRequeueFailed: "暂时无法为您前移 — 您仍在候补名单中",
+	waitlistPositionEstimate: "您目前大约排在第 {position} 位 — 座位空出后会向前移动",
+	waitlistLinkEventMismatch: "此链接属于另一场活动 — 请从那场演出的邮件中打开",
+	waitlistErrorNotEnabled: "本活动不提供候补名单",
+	waitlistErrorEventNotFound: "未找到活动",
+	waitlistErrorAlreadyPurchased: "您已购买本活动的门票",
+	waitlistErrorPhoneRegistered: "此电话号码已在候补名单中",
+	waitlistErrorJoinFailed: "加入候补名单失败，请重试",
+	waitlistErrorNetwork: "网络错误，请检查网络连接后重试",
+	sessionExpiringSoonMessage: "您的结算会话将在 {time} 后超时，所选门票将被释放回库存",
+	extensionsRemaining: "剩余延长次数：{count}",
+	continueCheckout: "继续结算",
+	okIllHurry: "好的，我会尽快",
+	maxExtensionsReached: "已达到延长次数上限",
+	sessionExpired: "会话已超时",
+	sessionExpiredMessage: "您的结算会话已超时，所选门票已被释放",
+	selectTicketsAgain: "重新选择门票",
+	selectTicketsLabel: "选择门票",
+	orderNotFound: "未找到订单",
+	orderNotFoundMessage: "我们找不到您的订单。这可能是因为会话已超时，或您直接打开了此页面。请重新选择门票",
+	pageSections: "页面栏目",
+	viewTicketsOrderNotFound: "未找到订单。请检查邮件中的链接",
+	viewTicketsLoadFailed: "无法加载您的门票，请重试",
+	doorsAtTime: "{time} 开场",
+	ticketCarousel: "门票轮播",
+	qrCodeForTicket: "门票 {number} 的二维码",
+	qrRefundedSuffix: "已退款，不可入场",
+	qrCheckedInSuffix: "已检票",
+	refunded: "已退款",
+	checkedIn: "已检票",
+	ticketRefundedNote: "此门票已退款，入场时将不被接受",
+	ticketCheckedInNote: "此门票已被扫描 — 无法再次使用",
+	previousTicket: "上一张门票",
+	nextTicket: "下一张门票",
+	ticketCountOfTotal: "第 {current} 张，共 {total} 张",
+	addToAppleWallet: "添加到 Apple Wallet",
+	addToGoogleWallet: "添加到 Google Wallet",
+	walletPassesComingSoon: "电子钱包票券即将推出。您的门票就在这里 — 可以截图或下载 PDF",
+	downloadPdf: "下载 PDF",
+	addToCalendarPrefix: "添加到日历：",
+	getDirections: "查看路线",
+	requestARefund: "申请退款",
+	refundRequestSent: "您的退款申请已发送给{venue}，他们会就您的订单与您联系",
+	refundReasonPrompt: "告诉{venue}您申请退款的原因（可选）",
+	refundNotePlaceholder: "给场馆留言…",
+	sending: "发送中…",
+	submitRefundRequest: "提交退款申请",
+	somethingWentWrong: "出了点问题，请稍后重试",
+	orderNumberLine: "订单 {orderNumber}",
+	questionsPrompt: "有疑问？",
+	opensInGoogleMaps: "（在 Google 地图中打开）"
 };
 //#endregion
 export { e as zh };

package/package.json

@@ -1,220 +1,220 @@
-{
-  "name": "@getmicdrop/venue-calendar",
-  "_version_comment": "4.1.55 was the last PUBLISHED version, and the tree carried 36 commits npm's 4.1.55 does not have — including the gate-password security fix and four money fixes. A filename must never reuse a version npm has taken (jsDelivr/unpkg cache the FIRST bytes they see under `@4.1.55` forever, so republishing that number ships the old widget to every venue that pinned it). Bumped to 4.2.0 here, BEFORE anything is built for publish. `npm run release:preflight` refuses to proceed when this number already exists in the registry.",
-  "version": "4.2.33",
-  "description": "A customizable Svelte calendar component for displaying comedy events",
-  "type": "module",
-  "types": "./dist/types/index.d.ts",
-  "main": "./dist/venue-calendar.umd.js",
-  "module": "./dist/venue-calendar.es.js",
-  "_exports_types_comment": "Every `types` path below must EXIST in the tarball; `npm run size` (scripts/size-guard.mjs, checkExportsTypesResolve) asserts it against the built dist and reds if one dangles. It dangled for real: `./api` pointed at ./dist/api/index.d.ts while vite-plugin-dts emitted ./dist/api/api/index.d.ts, because the `include` root (src/lib/api) is not the tree root the plugin derived — two transformers import $lib/public-calendar-flow, which hoisted entryRoot to src/lib and pushed everything down one directory. TypeScript does not error on a `types` target that is absent; it silently falls back to no types at all, so `import '@getmicdrop/venue-calendar/api'` was implicitly `any` for every consumer and nothing anywhere said so. Fixed by pinning entryRoot in vite.config.api.js (NOT by retyping the string here) so the emitted path matches the contract, the way ./seo already did by accident.",
-  "exports": {
-    ".": {
-      "types": "./dist/types/index.d.ts",
-      "svelte": "./dist/venue-calendar.es.js",
-      "import": "./dist/venue-calendar.es.js",
-      "require": "./dist/venue-calendar.umd.js",
-      "default": "./dist/venue-calendar.es.js"
-    },
-    "./api": {
-      "types": "./dist/api/index.d.ts",
-      "import": "./dist/api/api.mjs",
-      "require": "./dist/api/api.cjs",
-      "default": "./dist/api/api.mjs"
-    },
-    "./seo": {
-      "types": "./dist/seo/index.d.ts",
-      "import": "./dist/seo/seo.mjs",
-      "require": "./dist/seo/seo.cjs",
-      "default": "./dist/seo/seo.mjs"
-    },
-    "./theme": {
-      "import": "./src/lib/theme.js",
-      "default": "./src/lib/theme.js"
-    },
-    "./dist/venue-calendar.css": "./dist/venue-calendar.css"
-  },
-  "_files_comment": "The `!dist/**/*.map` negation is load-bearing and must stay HERE, not in .npmignore. npm-packlist gives a root `files` array precedence over a root .npmignore, so the `dist/**/*.map` rule .npmignore has carried since the 2026-06-10 audit never applied: `npm pack --dry-run` published 93 sourcemaps totalling 29.3 MB of a 37.4 MB tarball. This is the embed widget that installs onto third-party venue sites; the maps are debugging surface, not shipped surface.",
-  "files": [
-    "dist",
-    "!dist/**/*.map",
-    "src/lib/theme.js",
-    "README.md"
-  ],
-  "_sideEffects_comment": "There is deliberately NO `sideEffects` field, and adding one is a regression. Measured 2026-08-14 with a scratch consumer that imports a single export from the packed tarball and bundles it: vite 7.3.6 (the toolchain micdrop-frontend and performersportal actually run) produced 3,359,354 B over 53 chunks with no field and 3,359,364 B over 53 chunks with the allowlist — ten bytes LARGER. vite 8.2.1 (this repo's own) produced 3,303,350 B vs 3,303,181 B, a 169-byte saving on 3.30 MB (0.005%), and `sideEffects: false` came out byte-identical to the allowlist, i.e. the VALUE is inert. There is nothing to tree-shake: the ES entry is a pre-bundled single entry whose graph is reached by dynamic import. The risk is not inert. An AST scan of dist found 23 of 94 chunks carrying real import-time side effects — Svelte 5 `.delegate([...])` event registration in Input-*, ModalFooter-*, timezones-* and to-event-card-props-* (all inside the 23-file eager closure), zod's `globalThis.__zod_globalConfig` init in serverTotals-*, and in the entry itself the CSS-injection IIFE, `customElements.define`, the `window.__MICDROP_CALENDAR__` handshake and the auto-mount call. Those chunk filenames are content-hashed and change every build, so no allowlist can name them and stay correct; the first hash churn after a wrong list silently ships an unstyled widget with dead click handlers to third-party venue sites. Zero measurable upside against that is not a trade worth making.",
-  "scripts": {
-    "dev": "vite dev",
-    "build": "vite build",
-    "_build_lib_comment": "THREE passes, and the order is load-bearing. (1) VC_IIFE_ONLY=1 builds the IIFE and is the ONLY pass with emptyOutDir on — it owns the dist wipe. (2) the default pass appends ES + UMD. (3) vite.config.locales.js appends the version-pinned locale chunks the IIFE fetches at runtime. Move the locales pass earlier and it gets wiped by (1); give it emptyOutDir and it wipes the bundle it serves. Both failures are silent at build time and total at runtime, so scripts/size-guard.mjs asserts the IIFE and the locale tree coexist in dist.",
-    "build:lib": "cross-env VC_IIFE_ONLY=1 vite build --config vite.config.lib.js && vite build --config vite.config.lib.js && vite build --config vite.config.locales.js",
-    "build:api": "vite build --config vite.config.api.js",
-    "build:seo": "vite build --config vite.config.seo.js",
-    "build:all": "npm run build:lib && npm run build:api && npm run build:seo",
-    "preview": "vite preview",
-    "prepare": "node ./scripts/prepare.js",
-    "prepublishOnly": "npm run build:all",
-    "_lint_comment": "Ratchet cap. 2026-05-31: ESLint had NO svelte parser configured, so the entire .svelte tree was unparsed (300 'Unexpected token <' errors) and effectively unlinted. Wired the svelte parser (eslint.config.js) + downgraded the recommended svelte rules to 'warn' for the turn-on wave (mirrors performers-portal). 2026-06-10: ratcheted cap 1638 -> 418. 2026-07-16: burned the whole budget down (unused vars, navigation-without-resolve via resolve(), svelte/reactivity classes, hex -> color constants, @html removal, shadow renames) — cap is now 0 and stays 0; any new warning fails lint.",
-    "_lint_scope_comment": "Scope is `src e2e`, not `src` (#660). e2e/ was outside every CI lens while the pre-commit hook (lint-staged) enforced the SAME rules on any staged .js — so a committer was blocked by rules CI never measured. That is how #654 happened. #659 drained the 9 no-raw-date-construction violations first; this scope widening is the arming half, and it only ever runs green because the fixes landed first. Adding a directory here is cheap; leaving one out is invisible.",
-    "lint": "eslint src e2e --max-warnings 0",
-    "gate": "sh scripts/gate.sh",
-    "lint:fix": "eslint src e2e --fix",
-    "lint:css": "stylelint \"src/**/*.{css,scss,svelte}\" --allow-empty-input",
-    "lint:css:fix": "stylelint \"src/**/*.{css,scss,svelte}\" --allow-empty-input --fix",
-    "_format_comment": "Until #660 this repo had NO prettier check anywhere — not in package.json, not in any workflow. Formatting was enforced ONLY by the lint-staged pre-commit hook, which rewrites whatever you happen to stage. So a file that was never staged after a config change drifted forever, and the drift surfaced as an unrelated whole-file reformat in someone else's PR (#659 hit exactly that on e2e/embed-checkout.e2e.js). COVERED SURFACE IS `e2e` ONLY, deliberately. Two separate numbers, measured at e6f30590 — do not conflate them: `prettier --check .` reports 314 drifted files repo-wide, of which `prettier --check src` accounts for 129; the other 185 are docs/, .planning/, scripts/, plans/, test/, test-helpers/, canary/ and repo-root config. Reformatting product source is a separate change with its own blast radius (filed as #679, which covers the src/ 129 only — the non-src remainder is not yet filed). The arg is the DIRECTORY, not a glob with an extension list, so a new e2e/*.ts or e2e/**/fixtures/*.json is covered the day it lands instead of the day someone remembers to widen a pattern. Grow this scope by adding a directory; never by adding a file. `format:check:all` is the report-only view of the whole repo so the src backlog stays visible rather than hidden.",
-    "format:check": "prettier --check e2e",
-    "format:fix": "prettier --write e2e",
-    "format:check:all": "prettier --check .",
-    "knip": "knip",
-    "depcruise": "dependency-cruiser src --config .dependency-cruiser.cjs",
-    "design-system:check": "node scripts/design-system-check.mjs --report-only",
-    "design-system:check:strict": "node scripts/design-system-check.mjs --fail-on-new",
-    "design-system:baseline": "node scripts/design-system-check.mjs --baseline",
-    "cleanup-check": "node scripts/cleanup-on-destroy-check.mjs --report-only",
-    "cleanup-check:strict": "node scripts/cleanup-on-destroy-check.mjs --fail-on-new",
-    "cleanup-baseline": "node scripts/cleanup-on-destroy-check.mjs --baseline",
-    "checkout-lifecycle-check": "node scripts/checkout-lifecycle-check.mjs --report-only",
-    "checkout-lifecycle-check:strict": "node scripts/checkout-lifecycle-check.mjs --fail-on-new",
-    "checkout-lifecycle-baseline": "node scripts/checkout-lifecycle-check.mjs --baseline",
-    "quantity-clamp-check": "node scripts/quantity-clamp-check.mjs --report-only",
-    "quantity-clamp-check:strict": "node scripts/quantity-clamp-check.mjs --fail-on-new",
-    "quantity-clamp-baseline": "node scripts/quantity-clamp-check.mjs --baseline",
-    "no-new-skips-check": "node scripts/no-new-skips-check.mjs --report-only",
-    "no-new-skips-check:strict": "node scripts/no-new-skips-check.mjs --fail-on-new",
-    "no-new-skips-baseline": "node scripts/no-new-skips-check.mjs --baseline",
-    "no-sc-toast-check": "node scripts/no-sc-toast-check.mjs",
-    "no-sc-toast-check:report": "node scripts/no-sc-toast-check.mjs --report-only",
-    "lockfile-sync-check": "node scripts/lockfile-sync-check.mjs",
-    "lockfile-sync-check:report": "node scripts/lockfile-sync-check.mjs --report-only",
-    "failopen-loader-check": "node scripts/failopen-loader-check.mjs --report-only",
-    "failopen-loader-check:strict": "node scripts/failopen-loader-check.mjs --fail-on-new",
-    "voice:check": "node scripts/vc-copy-voice-ratchet.mjs --report-only",
-    "voice:check:strict": "node scripts/vc-copy-voice-ratchet.mjs",
-    "voice:vendor": "node scripts/gen-voice-rules-vendored.mjs",
-    "voice:vendor:check": "node scripts/gen-voice-rules-vendored.mjs --check",
-    "failopen-loader-baseline": "node scripts/failopen-loader-check.mjs --baseline",
-    "detectors:check": "node scripts/detectors/detectors-wired.mjs",
-    "git-hooks-resolve-check": "node scripts/detectors/git-hooks-resolve-check.mjs",
-    "git-hooks-resolve-check:report": "node scripts/detectors/git-hooks-resolve-check.mjs --report-only",
-    "class-emits-css-check": "node scripts/class-emits-css-check.mjs",
-    "token-resolves-check": "node scripts/token-resolves-check.mjs",
-    "check": "svelte-check --diagnostic-sources \"js,svelte\"",
-    "check:all": "svelte-check",
-    "test": "vitest run",
-    "test:ci-mute-guard": "vitest run scripts/ci-needs-graph.test.js",
-    "test:routes": "VITE_ROUTE_PROBE=1 vitest run src/lib/api/route-answers-probe.test.ts",
-    "test:watch": "vitest",
-    "test:ui": "vitest --ui",
-    "test:e2e": "playwright test",
-    "test:e2e:build": "npm run build:lib && playwright test",
-    "test:e2e:route": "playwright test --config playwright.route.config.js",
-    "test:e2e:route:build": "npm run build && playwright test --config playwright.route.config.js",
-    "_size_comment": "size-guard runs FIRST and is not decoration. size-limit resolves its config through lilconfig, whose search order puts package.json BEFORE .size-limit.js — so re-adding a package.json#size-limit key silently shadows the computed budget and the es cap goes back to measuring a 1 KB loader (#569) while CI stays green. size-guard re-runs that search order, re-derives the ES entry's static import closure, and refuses to hand off to size-limit unless the es cap measures it.",
-    "_release_preflight_comment": "Runs the checks that can only be answered about the ARTIFACT and the REGISTRY, not about the source tree — so it is deliberately NOT part of `npm run gate` (it needs a built dist and the network). Two questions: is this version already taken on npm (republishing a taken number is unrecoverable — jsDelivr/unpkg serve the first bytes they saw under that specifier forever), and does the tarball `npm pack` would actually upload contain any .map file. The second is asked of `npm pack --dry-run --json`, never of package.json#files, because `files` is what we INTENDED and the tarball is what SHIPS: published 4.1.55 carried 8.7 MB of maps with 786 sourcesContent entries despite an .npmignore that was supposed to stop it.",
-    "release:preflight": "node scripts/size-guard.mjs --release",
-    "size": "node scripts/size-guard.mjs && size-limit",
-    "size:why": "node scripts/size-guard.mjs && size-limit --why",
-    "heading-role-fidelity-check": "node scripts/heading-role-fidelity-check.mjs",
-    "heading-role-fidelity-check:report": "node scripts/heading-role-fidelity-check.mjs --report-only",
-    "composite-role-fidelity-check": "node scripts/composite-role-fidelity-check.mjs",
-    "composite-role-fidelity-check:report": "node scripts/composite-role-fidelity-check.mjs --report-only",
-    "dead-theme-selector-check": "node scripts/dead-theme-selector-check.mjs",
-    "label-name-resolves-check": "node scripts/label-name-resolves-check.mjs",
-    "stale-doc-comment-check": "node scripts/stale-doc-comment-check.mjs"
-  },
-  "keywords": [
-    "svelte",
-    "calendar",
-    "events",
-    "comedy",
-    "venue",
-    "component",
-    "micdrop"
-  ],
-  "author": "MicDrop",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/get-micdrop/venue-calendar.git"
-  },
-  "bugs": {
-    "url": "https://github.com/get-micdrop/venue-calendar/issues"
-  },
-  "homepage": "https://github.com/get-micdrop/venue-calendar#readme",
-  "_peerDependencies_comment": "TWO different contracts live here, and they cover DIFFERENT entry points. (a) `svelte` — the ES and UMD builds externalize svelte (vite.config.lib.js rollupOptions.external) and ship PRE-COMPILED output that binds through svelte/internal/client, a private, non-semver surface. So the consumer's svelte is the runtime for code this package's compiler emitted, and the compiler version is the real floor. The upper bound is the part that was missing: `>=5.56.0` admits Svelte 6, and this was the ONLY manifest in the fleet that would have taken it — svelte-stripe's `svelte: ^5` peer was the sole accidental brake, and moving that package to devDependencies (below) removes it, so the bound has to be explicit and it has to land in the same change. The floor is 5.56.4, NOT the 5.56.9 this repo compiles with: micdrop-frontend pins svelte to exactly 5.56.4 tree-wide and CANNOT move (mf 3ce86e22a reverted the 5.56.4 -> 5.56.9 bump because the Foundry Catalog Gate stops producing a byte-identical catalog under a different compiler, and that has to be fixed with the catalog regenerated in the same change, on Linux). A floor of 5.56.9 would therefore ERESOLVE against micdrop-frontend's own override on `npm ci` — i.e. it would brick the app that consumes this package in order to record an aspiration. The residual skew (consumer 5.56.4 < compiler 5.56.9) is real but not a missing-symbol crash: all 73 svelte/internal members the shipped dist references are present in 5.56.4. The exposure is SIGNATURE drift across the 7 differing internal/client files (reactivity/props.js `rest_props` is the one behind the June crash), which export-presence checks cannot catch. Close it by aligning the compilers, not by widening this range. (b) `@getmicdrop/svelte-components` — required by the ./api subpath ONLY: dist/api/api.mjs emits 5 SC subpath imports and api.cjs emits 7 (vite.config.api.js externalizes SC deliberately; the manifest never said so, and npm therefore never installed or warned about it). It is marked OPTIONAL below on purpose: @getmicdrop/venue-calendar is PUBLIC on npm but @getmicdrop/svelte-components is PRIVATE (an unauthenticated `npm view` of it 404s while this package resolves fine), so a REQUIRED peer would make `npm i @getmicdrop/venue-calendar` fail outright for every third party that only wants the widget entry — which bundles SC and needs nothing installed. Optional means npm stays quiet when SC is absent (it cannot be fetched anyway) but still version-checks it when present. The main/IIFE/UMD builds do NOT externalize SC; see the devDependencies pin. SEAM RESOLVED (2026-08-23): declaring SC in BOTH devDependencies (build) and peerDependencies (./api contract) is the intended shape, and the test no longer objects. It used to: scDepType asserted SC appeared in EXACTLY ONE of the four dependency maps and found two, failing 3 tests. The fix landed where this note said it should — scripts/lockfile-sync-check.test.js now derives INSTALL_DEP_TYPES as DEP_TYPES minus peerDependencies, so a peer is no longer counted as somewhere SC is installed from. The detector (scripts/lockfile-sync-check.mjs) always handled peers correctly. Nothing is outstanding here; this paragraph is kept as the record of why the two-map shape is deliberate rather than a mistake to be tidied away",
-  "peerDependencies": {
-    "@getmicdrop/svelte-components": "^6.24.325",
-    "svelte": ">=5.56.4 <6"
-  },
-  "peerDependenciesMeta": {
-    "@getmicdrop/svelte-components": {
-      "optional": true
-    }
-  },
-  "_tanstack_svelte_query_comment": "`@tanstack/svelte-query` in devDependencies is NOT dead, and it must not be deleted on the evidence that `grep -r '@tanstack/svelte-query' src` returns nothing — it does return nothing, and that is expected. It exists solely to satisfy @getmicdrop/svelte-components' peer range `^6.1.28`. Removing it shrinks no artifact (it reaches none); it silently changes how npm resolves SC's peer tree, which surfaces as a version-skew crash in someone else's build days later with nothing pointing back here. The exact pin mirrors micdrop-frontend, which pins the same version and additionally overrides @tanstack/query-core to 5.100.14 — keep the two manifests agreeing.",
-  "_devDependencies_pin_comment": "Three EXACT pins in here are load-bearing and must not be re-caretted by a dependency bot. (1) `@getmicdrop/svelte-components` — the ES/UMD/IIFE builds do NOT externalize SC, so it is COMPILED INTO every shipped artifact. RESTORED TO AN EXACT PIN 2026-08-23, having drifted back to a caret at some point between 6.24.311 and 6.24.316 — exactly the re-caretting this note warns about, which is worth knowing recurs. Under a caretted range like `^6.24.311` the SC version a venue's browser executes is whatever the range floats to on the publish machine at publish time, which is not recorded anywhere and is not reproducible after the fact; the `overrides` block below cannot help (it only ever covered esbuild, and consumers ignore a dependency's overrides entirely). Pinned exact so the artifact and the manifest agree, and vite.config.lib.js stamps the resolved version into the bundle as __VC_SC_VERSION__ so a venue's devtools can answer 'which SC is this?'. (2) `svelte` — the compiler whose private internal/client calls the pre-compiled dist binds to. `^5.56.9` let the compiler move under a peer range that stayed still; see _peerDependencies_comment. (3) `@stripe/stripe-js` in dependencies — see its own note there.",
-  "devDependencies": {
-    "@eslint/js": "^10.0.1",
-    "@getmicdrop/svelte-components": "6.24.325",
-    "@playwright/test": "^1.60.0",
-    "@size-limit/file": "^13.0.3",
-    "@sveltejs/adapter-auto": "^7.0.1",
-    "@sveltejs/kit": "^2.70.2",
-    "@sveltejs/vite-plugin-svelte": "^7.3.0",
-    "@tailwindcss/vite": "^4.3.3",
-    "@tanstack/svelte-query": "6.1.38",
-    "@testing-library/jest-dom": "^7.0.1",
-    "@testing-library/svelte": "^5.3.1",
-    "@types/node": "^26.2.0",
-    "@typescript-eslint/parser": "^8.59.2",
-    "@vitest/coverage-v8": "^4.1.10",
-    "cross-env": "^10.1.0",
-    "dependency-cruiser": "^18.2.0",
-    "eslint": "^10.8.1",
-    "eslint-plugin-svelte": "^3.22.0",
-    "fast-check": "^4.8.0",
-    "globals": "^17.11.0",
-    "husky": "^9.1.7",
-    "jsdom": "^29.1.1",
-    "knip": "^6.12.1",
-    "lint-staged": "^16.4.0",
-    "postcss": "^8.5.26",
-    "postcss-html": "^2.0.0",
-    "prettier": "^3.8.3",
-    "prettier-plugin-svelte": "^4.1.1",
-    "size-limit": "^13.0.3",
-    "stylelint": "^17.14.1",
-    "stylelint-config-standard": "^40.0.0",
-    "svelte": "5.56.9",
-    "svelte-check": "^4.3.5",
-    "svelte-stripe": "^2.0.0",
-    "tailwindcss": "^4.3.3",
-    "typescript": "^5.9.3",
-    "vite": "^8.2.1",
-    "vite-plugin-dts": "^5.0.3",
-    "vitest": "^4.1.10",
-    "yaml": "2.9.0"
-  },
-  "_overrides_comment": "esbuild is not a direct dependency here — it arrives as an OPTIONAL PEER of vite (^0.27.0 || ^0.28.0) and of unplugin-dts (*), and npm resolved it to 0.27.3, which is inside GHSA range 0.27.3-0.28.0 (arbitrary file read via the dev server on Windows; dev-only exposure, but this is a Windows shop). There is no direct dependency to bump, so the lift has to be an override. Keep this satisfying vite's peer range — ^0.28.x does; a 0.29 line would not.",
-  "overrides": {
-    "esbuild": "^0.28.2",
-    "svelte": "5.56.9",
-    "@tanstack/svelte-query": "6.1.38",
-    "@tanstack/query-core": "5.101.4"
-  },
-  "_dependencies_comment": "`@stripe/stripe-js` is pinned EXACT, and the caret it replaces was not a style choice. loadStripe() does not fetch a versioned URL — it builds `https://js.stripe.com/<RELEASE_TRAIN>/stripe.js` from a CONSTANT baked into whichever @stripe/stripe-js version resolves (9.13.0 hardcodes `RELEASE_TRAIN = 'dahlia'` in dist/index.mjs). This widget runs on third-party venue sites, many of which allowlist that exact script URL in their CSP, so a caret means a routine transitive bump silently MOVES the file a venue must allowlist and checkout dies on their site with a CSP violation and no signal on our side. The live 4.1.55 bundle still requests /clover/stripe.js while this tree resolves to /dahlia/ — the drift is not hypothetical. Pin it, and when the pin is raised, put the new train in the release notes so venue CSPs can be updated first. `svelte-stripe` USED to live here and has moved to devDependencies: no shipped artifact reaches it (dist mentions it only inside .map sourcesContent), CheckoutForm.svelte:81 deliberately calls Stripe.js directly instead ('Svelte 5 compatibility bug'), and the sole live import is a dynamic `import('svelte-stripe')` in src/routes/v/[venueSlug]/gift-cards/purchase/+page.svelte — a SvelteKit route in the dev/e2e app, which `files` does not publish. It stays installed for dev; it just stops being something every npm consumer downloads. Note what that move COSTS: svelte-stripe's own `svelte: ^5` peer was the only thing bounding a consumer's svelte below 6, so peerDependencies.svelte gained an explicit `<6` in the same change.",
-  "dependencies": {
-    "@stripe/stripe-js": "9.13.0",
-    "js-cookie": "^3.0.8",
-    "qrcode": "^1.5.4",
-    "zod": "^4.4.3"
-  },
-  "lint-staged": {
-    "*.{js,ts,svelte}": [
-      "eslint --fix",
-      "prettier --write"
-    ],
-    "*.{json,css,md}": [
-      "prettier --write"
-    ]
-  }
-}
+{
+  "name": "@getmicdrop/venue-calendar",
+  "_version_comment": "4.1.55 was the last PUBLISHED version, and the tree carried 36 commits npm's 4.1.55 does not have — including the gate-password security fix and four money fixes. A filename must never reuse a version npm has taken (jsDelivr/unpkg cache the FIRST bytes they see under `@4.1.55` forever, so republishing that number ships the old widget to every venue that pinned it). Bumped to 4.2.0 here, BEFORE anything is built for publish. `npm run release:preflight` refuses to proceed when this number already exists in the registry.",
+  "version": "4.2.35",
+  "description": "A customizable Svelte calendar component for displaying comedy events",
+  "type": "module",
+  "types": "./dist/types/index.d.ts",
+  "main": "./dist/venue-calendar.umd.js",
+  "module": "./dist/venue-calendar.es.js",
+  "_exports_types_comment": "Every `types` path below must EXIST in the tarball; `npm run size` (scripts/size-guard.mjs, checkExportsTypesResolve) asserts it against the built dist and reds if one dangles. It dangled for real: `./api` pointed at ./dist/api/index.d.ts while vite-plugin-dts emitted ./dist/api/api/index.d.ts, because the `include` root (src/lib/api) is not the tree root the plugin derived — two transformers import $lib/public-calendar-flow, which hoisted entryRoot to src/lib and pushed everything down one directory. TypeScript does not error on a `types` target that is absent; it silently falls back to no types at all, so `import '@getmicdrop/venue-calendar/api'` was implicitly `any` for every consumer and nothing anywhere said so. Fixed by pinning entryRoot in vite.config.api.js (NOT by retyping the string here) so the emitted path matches the contract, the way ./seo already did by accident.",
+  "exports": {
+    ".": {
+      "types": "./dist/types/index.d.ts",
+      "svelte": "./dist/venue-calendar.es.js",
+      "import": "./dist/venue-calendar.es.js",
+      "require": "./dist/venue-calendar.umd.js",
+      "default": "./dist/venue-calendar.es.js"
+    },
+    "./api": {
+      "types": "./dist/api/index.d.ts",
+      "import": "./dist/api/api.mjs",
+      "require": "./dist/api/api.cjs",
+      "default": "./dist/api/api.mjs"
+    },
+    "./seo": {
+      "types": "./dist/seo/index.d.ts",
+      "import": "./dist/seo/seo.mjs",
+      "require": "./dist/seo/seo.cjs",
+      "default": "./dist/seo/seo.mjs"
+    },
+    "./theme": {
+      "import": "./src/lib/theme.js",
+      "default": "./src/lib/theme.js"
+    },
+    "./dist/venue-calendar.css": "./dist/venue-calendar.css"
+  },
+  "_files_comment": "The `!dist/**/*.map` negation is load-bearing and must stay HERE, not in .npmignore. npm-packlist gives a root `files` array precedence over a root .npmignore, so the `dist/**/*.map` rule .npmignore has carried since the 2026-06-10 audit never applied: `npm pack --dry-run` published 93 sourcemaps totalling 29.3 MB of a 37.4 MB tarball. This is the embed widget that installs onto third-party venue sites; the maps are debugging surface, not shipped surface.",
+  "files": [
+    "dist",
+    "!dist/**/*.map",
+    "src/lib/theme.js",
+    "README.md"
+  ],
+  "_sideEffects_comment": "There is deliberately NO `sideEffects` field, and adding one is a regression. Measured 2026-08-14 with a scratch consumer that imports a single export from the packed tarball and bundles it: vite 7.3.6 (the toolchain micdrop-frontend and performersportal actually run) produced 3,359,354 B over 53 chunks with no field and 3,359,364 B over 53 chunks with the allowlist — ten bytes LARGER. vite 8.2.1 (this repo's own) produced 3,303,350 B vs 3,303,181 B, a 169-byte saving on 3.30 MB (0.005%), and `sideEffects: false` came out byte-identical to the allowlist, i.e. the VALUE is inert. There is nothing to tree-shake: the ES entry is a pre-bundled single entry whose graph is reached by dynamic import. The risk is not inert. An AST scan of dist found 23 of 94 chunks carrying real import-time side effects — Svelte 5 `.delegate([...])` event registration in Input-*, ModalFooter-*, timezones-* and to-event-card-props-* (all inside the 23-file eager closure), zod's `globalThis.__zod_globalConfig` init in serverTotals-*, and in the entry itself the CSS-injection IIFE, `customElements.define`, the `window.__MICDROP_CALENDAR__` handshake and the auto-mount call. Those chunk filenames are content-hashed and change every build, so no allowlist can name them and stay correct; the first hash churn after a wrong list silently ships an unstyled widget with dead click handlers to third-party venue sites. Zero measurable upside against that is not a trade worth making.",
+  "scripts": {
+    "dev": "vite dev",
+    "build": "vite build",
+    "_build_lib_comment": "THREE passes, and the order is load-bearing. (1) VC_IIFE_ONLY=1 builds the IIFE and is the ONLY pass with emptyOutDir on — it owns the dist wipe. (2) the default pass appends ES + UMD. (3) vite.config.locales.js appends the version-pinned locale chunks the IIFE fetches at runtime. Move the locales pass earlier and it gets wiped by (1); give it emptyOutDir and it wipes the bundle it serves. Both failures are silent at build time and total at runtime, so scripts/size-guard.mjs asserts the IIFE and the locale tree coexist in dist.",
+    "build:lib": "cross-env VC_IIFE_ONLY=1 vite build --config vite.config.lib.js && vite build --config vite.config.lib.js && vite build --config vite.config.locales.js",
+    "build:api": "vite build --config vite.config.api.js",
+    "build:seo": "vite build --config vite.config.seo.js",
+    "build:all": "npm run build:lib && npm run build:api && npm run build:seo",
+    "preview": "vite preview",
+    "prepare": "node ./scripts/prepare.js",
+    "prepublishOnly": "npm run build:all",
+    "_lint_comment": "Ratchet cap. 2026-05-31: ESLint had NO svelte parser configured, so the entire .svelte tree was unparsed (300 'Unexpected token <' errors) and effectively unlinted. Wired the svelte parser (eslint.config.js) + downgraded the recommended svelte rules to 'warn' for the turn-on wave (mirrors performers-portal). 2026-06-10: ratcheted cap 1638 -> 418. 2026-07-16: burned the whole budget down (unused vars, navigation-without-resolve via resolve(), svelte/reactivity classes, hex -> color constants, @html removal, shadow renames) — cap is now 0 and stays 0; any new warning fails lint.",
+    "_lint_scope_comment": "Scope is `src e2e`, not `src` (#660). e2e/ was outside every CI lens while the pre-commit hook (lint-staged) enforced the SAME rules on any staged .js — so a committer was blocked by rules CI never measured. That is how #654 happened. #659 drained the 9 no-raw-date-construction violations first; this scope widening is the arming half, and it only ever runs green because the fixes landed first. Adding a directory here is cheap; leaving one out is invisible.",
+    "lint": "eslint src e2e --max-warnings 0",
+    "gate": "sh scripts/gate.sh",
+    "lint:fix": "eslint src e2e --fix",
+    "lint:css": "stylelint \"src/**/*.{css,scss,svelte}\" --allow-empty-input",
+    "lint:css:fix": "stylelint \"src/**/*.{css,scss,svelte}\" --allow-empty-input --fix",
+    "_format_comment": "Until #660 this repo had NO prettier check anywhere — not in package.json, not in any workflow. Formatting was enforced ONLY by the lint-staged pre-commit hook, which rewrites whatever you happen to stage. So a file that was never staged after a config change drifted forever, and the drift surfaced as an unrelated whole-file reformat in someone else's PR (#659 hit exactly that on e2e/embed-checkout.e2e.js). COVERED SURFACE IS `e2e` ONLY, deliberately. Two separate numbers, measured at e6f30590 — do not conflate them: `prettier --check .` reports 314 drifted files repo-wide, of which `prettier --check src` accounts for 129; the other 185 are docs/, .planning/, scripts/, plans/, test/, test-helpers/, canary/ and repo-root config. Reformatting product source is a separate change with its own blast radius (filed as #679, which covers the src/ 129 only — the non-src remainder is not yet filed). The arg is the DIRECTORY, not a glob with an extension list, so a new e2e/*.ts or e2e/**/fixtures/*.json is covered the day it lands instead of the day someone remembers to widen a pattern. Grow this scope by adding a directory; never by adding a file. `format:check:all` is the report-only view of the whole repo so the src backlog stays visible rather than hidden.",
+    "format:check": "prettier --check e2e",
+    "format:fix": "prettier --write e2e",
+    "format:check:all": "prettier --check .",
+    "knip": "knip",
+    "depcruise": "dependency-cruiser src --config .dependency-cruiser.cjs",
+    "design-system:check": "node scripts/design-system-check.mjs --report-only",
+    "design-system:check:strict": "node scripts/design-system-check.mjs --fail-on-new",
+    "design-system:baseline": "node scripts/design-system-check.mjs --baseline",
+    "cleanup-check": "node scripts/cleanup-on-destroy-check.mjs --report-only",
+    "cleanup-check:strict": "node scripts/cleanup-on-destroy-check.mjs --fail-on-new",
+    "cleanup-baseline": "node scripts/cleanup-on-destroy-check.mjs --baseline",
+    "checkout-lifecycle-check": "node scripts/checkout-lifecycle-check.mjs --report-only",
+    "checkout-lifecycle-check:strict": "node scripts/checkout-lifecycle-check.mjs --fail-on-new",
+    "checkout-lifecycle-baseline": "node scripts/checkout-lifecycle-check.mjs --baseline",
+    "quantity-clamp-check": "node scripts/quantity-clamp-check.mjs --report-only",
+    "quantity-clamp-check:strict": "node scripts/quantity-clamp-check.mjs --fail-on-new",
+    "quantity-clamp-baseline": "node scripts/quantity-clamp-check.mjs --baseline",
+    "no-new-skips-check": "node scripts/no-new-skips-check.mjs --report-only",
+    "no-new-skips-check:strict": "node scripts/no-new-skips-check.mjs --fail-on-new",
+    "no-new-skips-baseline": "node scripts/no-new-skips-check.mjs --baseline",
+    "no-sc-toast-check": "node scripts/no-sc-toast-check.mjs",
+    "no-sc-toast-check:report": "node scripts/no-sc-toast-check.mjs --report-only",
+    "lockfile-sync-check": "node scripts/lockfile-sync-check.mjs",
+    "lockfile-sync-check:report": "node scripts/lockfile-sync-check.mjs --report-only",
+    "failopen-loader-check": "node scripts/failopen-loader-check.mjs --report-only",
+    "failopen-loader-check:strict": "node scripts/failopen-loader-check.mjs --fail-on-new",
+    "voice:check": "node scripts/vc-copy-voice-ratchet.mjs --report-only",
+    "voice:check:strict": "node scripts/vc-copy-voice-ratchet.mjs",
+    "voice:vendor": "node scripts/gen-voice-rules-vendored.mjs",
+    "voice:vendor:check": "node scripts/gen-voice-rules-vendored.mjs --check",
+    "failopen-loader-baseline": "node scripts/failopen-loader-check.mjs --baseline",
+    "detectors:check": "node scripts/detectors/detectors-wired.mjs",
+    "git-hooks-resolve-check": "node scripts/detectors/git-hooks-resolve-check.mjs",
+    "git-hooks-resolve-check:report": "node scripts/detectors/git-hooks-resolve-check.mjs --report-only",
+    "class-emits-css-check": "node scripts/class-emits-css-check.mjs",
+    "token-resolves-check": "node scripts/token-resolves-check.mjs",
+    "check": "svelte-check --diagnostic-sources \"js,svelte\"",
+    "check:all": "svelte-check",
+    "test": "vitest run",
+    "test:ci-mute-guard": "vitest run scripts/ci-needs-graph.test.js",
+    "test:routes": "VITE_ROUTE_PROBE=1 vitest run src/lib/api/route-answers-probe.test.ts",
+    "test:watch": "vitest",
+    "test:ui": "vitest --ui",
+    "test:e2e": "playwright test",
+    "test:e2e:build": "npm run build:lib && playwright test",
+    "test:e2e:route": "playwright test --config playwright.route.config.js",
+    "test:e2e:route:build": "npm run build && playwright test --config playwright.route.config.js",
+    "_size_comment": "size-guard runs FIRST and is not decoration. size-limit resolves its config through lilconfig, whose search order puts package.json BEFORE .size-limit.js — so re-adding a package.json#size-limit key silently shadows the computed budget and the es cap goes back to measuring a 1 KB loader (#569) while CI stays green. size-guard re-runs that search order, re-derives the ES entry's static import closure, and refuses to hand off to size-limit unless the es cap measures it.",
+    "_release_preflight_comment": "Runs the checks that can only be answered about the ARTIFACT and the REGISTRY, not about the source tree — so it is deliberately NOT part of `npm run gate` (it needs a built dist and the network). Two questions: is this version already taken on npm (republishing a taken number is unrecoverable — jsDelivr/unpkg serve the first bytes they saw under that specifier forever), and does the tarball `npm pack` would actually upload contain any .map file. The second is asked of `npm pack --dry-run --json`, never of package.json#files, because `files` is what we INTENDED and the tarball is what SHIPS: published 4.1.55 carried 8.7 MB of maps with 786 sourcesContent entries despite an .npmignore that was supposed to stop it.",
+    "release:preflight": "node scripts/size-guard.mjs --release",
+    "size": "node scripts/size-guard.mjs && size-limit",
+    "size:why": "node scripts/size-guard.mjs && size-limit --why",
+    "heading-role-fidelity-check": "node scripts/heading-role-fidelity-check.mjs",
+    "heading-role-fidelity-check:report": "node scripts/heading-role-fidelity-check.mjs --report-only",
+    "composite-role-fidelity-check": "node scripts/composite-role-fidelity-check.mjs",
+    "composite-role-fidelity-check:report": "node scripts/composite-role-fidelity-check.mjs --report-only",
+    "dead-theme-selector-check": "node scripts/dead-theme-selector-check.mjs",
+    "label-name-resolves-check": "node scripts/label-name-resolves-check.mjs",
+    "stale-doc-comment-check": "node scripts/stale-doc-comment-check.mjs"
+  },
+  "keywords": [
+    "svelte",
+    "calendar",
+    "events",
+    "comedy",
+    "venue",
+    "component",
+    "micdrop"
+  ],
+  "author": "MicDrop",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/get-micdrop/venue-calendar.git"
+  },
+  "bugs": {
+    "url": "https://github.com/get-micdrop/venue-calendar/issues"
+  },
+  "homepage": "https://github.com/get-micdrop/venue-calendar#readme",
+  "_peerDependencies_comment": "TWO different contracts live here, and they cover DIFFERENT entry points. (a) `svelte` — the ES and UMD builds externalize svelte (vite.config.lib.js rollupOptions.external) and ship PRE-COMPILED output that binds through svelte/internal/client, a private, non-semver surface. So the consumer's svelte is the runtime for code this package's compiler emitted, and the compiler version is the real floor. The upper bound is the part that was missing: `>=5.56.0` admits Svelte 6, and this was the ONLY manifest in the fleet that would have taken it — svelte-stripe's `svelte: ^5` peer was the sole accidental brake, and moving that package to devDependencies (below) removes it, so the bound has to be explicit and it has to land in the same change. The floor is 5.56.4, NOT the 5.56.9 this repo compiles with: micdrop-frontend pins svelte to exactly 5.56.4 tree-wide and CANNOT move (mf 3ce86e22a reverted the 5.56.4 -> 5.56.9 bump because the Foundry Catalog Gate stops producing a byte-identical catalog under a different compiler, and that has to be fixed with the catalog regenerated in the same change, on Linux). A floor of 5.56.9 would therefore ERESOLVE against micdrop-frontend's own override on `npm ci` — i.e. it would brick the app that consumes this package in order to record an aspiration. The residual skew (consumer 5.56.4 < compiler 5.56.9) is real but not a missing-symbol crash: all 73 svelte/internal members the shipped dist references are present in 5.56.4. The exposure is SIGNATURE drift across the 7 differing internal/client files (reactivity/props.js `rest_props` is the one behind the June crash), which export-presence checks cannot catch. Close it by aligning the compilers, not by widening this range. (b) `@getmicdrop/svelte-components` — required by the ./api subpath ONLY: dist/api/api.mjs emits 5 SC subpath imports and api.cjs emits 7 (vite.config.api.js externalizes SC deliberately; the manifest never said so, and npm therefore never installed or warned about it). It is marked OPTIONAL below on purpose: @getmicdrop/venue-calendar is PUBLIC on npm but @getmicdrop/svelte-components is PRIVATE (an unauthenticated `npm view` of it 404s while this package resolves fine), so a REQUIRED peer would make `npm i @getmicdrop/venue-calendar` fail outright for every third party that only wants the widget entry — which bundles SC and needs nothing installed. Optional means npm stays quiet when SC is absent (it cannot be fetched anyway) but still version-checks it when present. The main/IIFE/UMD builds do NOT externalize SC; see the devDependencies pin. SEAM RESOLVED (2026-08-23): declaring SC in BOTH devDependencies (build) and peerDependencies (./api contract) is the intended shape, and the test no longer objects. It used to: scDepType asserted SC appeared in EXACTLY ONE of the four dependency maps and found two, failing 3 tests. The fix landed where this note said it should — scripts/lockfile-sync-check.test.js now derives INSTALL_DEP_TYPES as DEP_TYPES minus peerDependencies, so a peer is no longer counted as somewhere SC is installed from. The detector (scripts/lockfile-sync-check.mjs) always handled peers correctly. Nothing is outstanding here; this paragraph is kept as the record of why the two-map shape is deliberate rather than a mistake to be tidied away",
+  "peerDependencies": {
+    "@getmicdrop/svelte-components": "^6.24.326",
+    "svelte": ">=5.56.4 <6"
+  },
+  "peerDependenciesMeta": {
+    "@getmicdrop/svelte-components": {
+      "optional": true
+    }
+  },
+  "_tanstack_svelte_query_comment": "`@tanstack/svelte-query` in devDependencies is NOT dead, and it must not be deleted on the evidence that `grep -r '@tanstack/svelte-query' src` returns nothing — it does return nothing, and that is expected. It exists solely to satisfy @getmicdrop/svelte-components' peer range `^6.1.28`. Removing it shrinks no artifact (it reaches none); it silently changes how npm resolves SC's peer tree, which surfaces as a version-skew crash in someone else's build days later with nothing pointing back here. The exact pin mirrors micdrop-frontend, which pins the same version and additionally overrides @tanstack/query-core to 5.100.14 — keep the two manifests agreeing.",
+  "_devDependencies_pin_comment": "Three EXACT pins in here are load-bearing and must not be re-caretted by a dependency bot. (1) `@getmicdrop/svelte-components` — the ES/UMD/IIFE builds do NOT externalize SC, so it is COMPILED INTO every shipped artifact. RESTORED TO AN EXACT PIN 2026-08-23, having drifted back to a caret at some point between 6.24.311 and 6.24.316 — exactly the re-caretting this note warns about, which is worth knowing recurs. Under a caretted range like `^6.24.311` the SC version a venue's browser executes is whatever the range floats to on the publish machine at publish time, which is not recorded anywhere and is not reproducible after the fact; the `overrides` block below cannot help (it only ever covered esbuild, and consumers ignore a dependency's overrides entirely). Pinned exact so the artifact and the manifest agree, and vite.config.lib.js stamps the resolved version into the bundle as __VC_SC_VERSION__ so a venue's devtools can answer 'which SC is this?'. (2) `svelte` — the compiler whose private internal/client calls the pre-compiled dist binds to. `^5.56.9` let the compiler move under a peer range that stayed still; see _peerDependencies_comment. (3) `@stripe/stripe-js` in dependencies — see its own note there.",
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@getmicdrop/svelte-components": "6.24.326",
+    "@playwright/test": "^1.60.0",
+    "@size-limit/file": "^13.0.3",
+    "@sveltejs/adapter-auto": "^7.0.1",
+    "@sveltejs/kit": "^2.70.2",
+    "@sveltejs/vite-plugin-svelte": "^7.3.0",
+    "@tailwindcss/vite": "^4.3.3",
+    "@tanstack/svelte-query": "6.1.38",
+    "@testing-library/jest-dom": "^7.0.1",
+    "@testing-library/svelte": "^5.3.1",
+    "@types/node": "^26.2.0",
+    "@typescript-eslint/parser": "^8.59.2",
+    "@vitest/coverage-v8": "^4.1.10",
+    "cross-env": "^10.1.0",
+    "dependency-cruiser": "^18.2.0",
+    "eslint": "^10.8.1",
+    "eslint-plugin-svelte": "^3.22.0",
+    "fast-check": "^4.8.0",
+    "globals": "^17.11.0",
+    "husky": "^9.1.7",
+    "jsdom": "^29.1.1",
+    "knip": "^6.12.1",
+    "lint-staged": "^16.4.0",
+    "postcss": "^8.5.26",
+    "postcss-html": "^2.0.0",
+    "prettier": "^3.8.3",
+    "prettier-plugin-svelte": "^4.1.1",
+    "size-limit": "^13.0.3",
+    "stylelint": "^17.14.1",
+    "stylelint-config-standard": "^40.0.0",
+    "svelte": "5.56.9",
+    "svelte-check": "^4.3.5",
+    "svelte-stripe": "^2.0.0",
+    "tailwindcss": "^4.3.3",
+    "typescript": "^5.9.3",
+    "vite": "^8.2.1",
+    "vite-plugin-dts": "^5.0.3",
+    "vitest": "^4.1.10",
+    "yaml": "2.9.0"
+  },
+  "_overrides_comment": "esbuild is not a direct dependency here — it arrives as an OPTIONAL PEER of vite (^0.27.0 || ^0.28.0) and of unplugin-dts (*), and npm resolved it to 0.27.3, which is inside GHSA range 0.27.3-0.28.0 (arbitrary file read via the dev server on Windows; dev-only exposure, but this is a Windows shop). There is no direct dependency to bump, so the lift has to be an override. Keep this satisfying vite's peer range — ^0.28.x does; a 0.29 line would not.",
+  "overrides": {
+    "esbuild": "^0.28.2",
+    "svelte": "5.56.9",
+    "@tanstack/svelte-query": "6.1.38",
+    "@tanstack/query-core": "5.101.4"
+  },
+  "_dependencies_comment": "`@stripe/stripe-js` is pinned EXACT, and the caret it replaces was not a style choice. loadStripe() does not fetch a versioned URL — it builds `https://js.stripe.com/<RELEASE_TRAIN>/stripe.js` from a CONSTANT baked into whichever @stripe/stripe-js version resolves (9.13.0 hardcodes `RELEASE_TRAIN = 'dahlia'` in dist/index.mjs). This widget runs on third-party venue sites, many of which allowlist that exact script URL in their CSP, so a caret means a routine transitive bump silently MOVES the file a venue must allowlist and checkout dies on their site with a CSP violation and no signal on our side. The live 4.1.55 bundle still requests /clover/stripe.js while this tree resolves to /dahlia/ — the drift is not hypothetical. Pin it, and when the pin is raised, put the new train in the release notes so venue CSPs can be updated first. `svelte-stripe` USED to live here and has moved to devDependencies: no shipped artifact reaches it (dist mentions it only inside .map sourcesContent), CheckoutForm.svelte:81 deliberately calls Stripe.js directly instead ('Svelte 5 compatibility bug'), and the sole live import is a dynamic `import('svelte-stripe')` in src/routes/v/[venueSlug]/gift-cards/purchase/+page.svelte — a SvelteKit route in the dev/e2e app, which `files` does not publish. It stays installed for dev; it just stops being something every npm consumer downloads. Note what that move COSTS: svelte-stripe's own `svelte: ^5` peer was the only thing bounding a consumer's svelte below 6, so peerDependencies.svelte gained an explicit `<6` in the same change.",
+  "dependencies": {
+    "@stripe/stripe-js": "9.13.0",
+    "js-cookie": "^3.0.8",
+    "qrcode": "^1.5.4",
+    "zod": "^4.4.3"
+  },
+  "lint-staged": {
+    "*.{js,ts,svelte}": [
+      "eslint --fix",
+      "prettier --write"
+    ],
+    "*.{json,css,md}": [
+      "prettier --write"
+    ]
+  }
+}