@getmicdrop/venue-calendar 4.3.136 → 4.3.138

package/dist/{widget-key-context-Xn6MT23x.js → widget-key-context-BrWW0fyM.js}

@@ -1,11 +1,12 @@
-import { g as e, v as t } from "./sizing-B7ixYndz.js";
-import { E as n, N as r } from "./defaultLabels-Q5_A1ZrR.js";
-import { n as i } from "./Button-VUB2WJ88.js";
-import { n as a, t as o } from "./normalizers-CqGXhPZo.js";
-import { C as s, D as c, E as l, S as u, c as d, n as f, r as p, s as m } from "./client-SmFkruvn.js";
+import { t as e } from "./labels-CjSrA6gx.js";
+import { t } from "./logger-DM8WW61-.js";
+import { d as n, v as r } from "./instant-BkZCSGDm.js";
+import { t as i } from "./AppError-t1LnBwj_.js";
+import { n as a, t as o } from "./normalizers-WYh8Nr3V.js";
+import { C as s, D as c, E as l, S as u, c as d, n as f, r as p, s as m } from "./client-BIN_q-of.js";
 import * as h from "svelte/internal/client";
 import { getContext as ee } from "svelte";
-//#region node_modules/@getmicdrop/svelte-components/dist/errors/classes/ApiError.js
+// node_modules/@getmicdrop/svelte-components/dist/errors/classes/ApiError.js
 var g = class e extends i {
 	constructor(e, t, n = {}) {
 		super(e, `API_${t}`, {
@@ -63,8 +64,7 @@ function re(e) {
 function b(e) {
 	return !!e.utmSource && e.utmSource !== "direct";
 }
-//#endregion
-//#region src/lib/tracking/context.ts
+// src/lib/tracking/context.ts
 var x = null, S = null, C = {
 	search: null,
 	referrer: null,
@@ -103,8 +103,7 @@ function le() {
 	let e = navigator.userAgent.toLowerCase();
 	return /ipad|tablet|playbook|silk/.test(e) ? "tablet" : /mobile|iphone|ipod|android.*mobile|windows phone|blackberry/.test(e) ? "mobile" : /android/.test(e) ? "tablet" : "desktop";
 }
-//#endregion
-//#region src/lib/tracking/consent.ts
+// src/lib/tracking/consent.ts
 var T = null, E = !1, D = !1, O = !1;
 function ue(e) {
 	T = e;
@@ -139,12 +138,9 @@ function he() {
 	let e = window.__tcfapi;
 	try {
 		e("addEventListener", 2, (e, t) => {
-			if (!(!t || !e)) {
-				if (e.gdprApplies === !1) {
-					j() || (E = !0);
-					return;
-				}
-				if (e.eventStatus === "tcloaded" || e.eventStatus === "useractioncomplete") {
+			if (t && e) {
+				if (e.gdprApplies === !1) j() || (E = !0);
+				else if (e.eventStatus === "tcloaded" || e.eventStatus === "useractioncomplete") {
 					let t = e.purpose?.consents;
 					E = !!t && Object.values(t).some(Boolean);
 				}
@@ -152,8 +148,7 @@ function he() {
 		});
 	} catch {}
 }
-//#endregion
-//#region src/lib/tracking/identity.ts
+// src/lib/tracking/identity.ts
 var N = "micdrop_session_id", P = "micdrop_visitor_id", ge = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function F(e) {
 	return typeof e == "string" && ge.test(e);
@@ -211,8 +206,7 @@ function R() {
 		createdAt: e
 	}), n;
 }
-//#endregion
-//#region src/lib/tracking/attribution-store.ts
+// src/lib/tracking/attribution-store.ts
 var z = "micdrop_attribution";
 function ve(e, t) {
 	if (!e || !t) return !1;
@@ -232,7 +226,7 @@ function B() {
 }
 function be(e = w()) {
 	let t = ye(e), n = B();
-	!t && n || c(z, {
+	(t || !n) && c(z, {
 		utm: e.utm,
 		referrer: e.referrer,
 		marketing: t
@@ -251,9 +245,8 @@ function V() {
 		referrer: e.referrer || ""
 	};
 }
-//#endregion
-//#region src/lib/tracking/beacon.ts
-var xe = e("tracking"), Se = /* @__PURE__ */ new Set([
+// src/lib/tracking/beacon.ts
+var xe = t("tracking"), Se = /* @__PURE__ */ new Set([
 	"chunk_load_error",
 	"type_error",
 	"reference_error",
@@ -378,8 +371,7 @@ function Ie(e, t, n, r) {
 		}).catch(() => {});
 	} catch {}
 }
-//#endregion
-//#region src/lib/api/transformers/cart.ts
+// src/lib/api/transformers/cart.ts
 function Le(e) {
 	let t = e ?? {};
 	return {
@@ -408,8 +400,7 @@ function ze(e) {
 		giftCards: (t.GiftCards ?? t.giftCards ?? []).map(Re)
 	};
 }
-//#endregion
-//#region src/lib/i18n/localeLoader.svelte.js
+// src/lib/i18n/localeLoader.svelte.js
 var K = h.state(0);
 function Be() {
 	return h.get(K);
@@ -417,13 +408,12 @@ function Be() {
 function Ve() {
 	h.set(K, h.get(K) + 1);
 }
-//#endregion
-//#region src/lib/i18n/createI18n.js
+// src/lib/i18n/createI18n.js
 function q() {
 	return typeof navigator > "u" ? null : navigator.language || navigator.userLanguage || null;
 }
-function He({ defaults: e, locales: n = {}, loaders: r = {} }) {
-	let i = n.en ?? e, a = /* @__PURE__ */ new Map(), o = /* @__PURE__ */ new Map();
+function He({ defaults: t, locales: n = {}, loaders: r = {} }) {
+	let i = n.en ?? t, a = /* @__PURE__ */ new Map(), o = /* @__PURE__ */ new Map();
 	function s(e) {
 		return n[e] ? n[e] : a.has(e) ? a.get(e) : null;
 	}
@@ -461,7 +451,7 @@ function He({ defaults: e, locales: n = {}, loaders: r = {} }) {
 	}
 	function u(n = void 0, r = {}) {
 		let { labels: i } = l(n || q() || "en");
-		return t(t(e, i), r);
+		return e(e(t, i), r);
 	}
 	function d(e) {
 		if (!e || typeof e != "string") return Promise.resolve(i);
@@ -480,8 +470,7 @@ function He({ defaults: e, locales: n = {}, loaders: r = {} }) {
 		loadLocale: d
 	};
 }
-//#endregion
-//#region src/lib/i18n/localeSpec.js
+// src/lib/i18n/localeSpec.js
 var J = [
 	[
 		"es",
@@ -550,8 +539,7 @@ var J = [
 	]
 ];
 Array.from(new Set(J.map(([, e]) => e)));
-//#endregion
-//#region src/lib/i18n/buyerLocale.ts
+// src/lib/i18n/buyerLocale.ts
 var Y = new Map([["en", "en"], ...J.map(([e]) => [e, e === "pt" || e === "pt-br" ? "pt-BR" : e])]);
 function X(e) {
 	let t = e || q();
@@ -559,9 +547,8 @@ function X(e) {
 	let n = t.toLowerCase();
 	return Y.get(n) ?? Y.get(n.split("-")[0]);
 }
-//#endregion
-//#region src/lib/api/orders.ts
-var Z = e("VC");
+// src/lib/api/orders.ts
+var Z = t("VC");
 async function Q(e, t, n, r, i, a) {
 	let o = X(i);
 	return p(`${m()}/cart/${e}/payment-intent`, {
@@ -734,11 +721,9 @@ async function Ze(e, t) {
 		return Z.error("Error getting session status:", e), { error: "Network error getting session status" };
 	}
 }
-//#endregion
-//#region src/lib/widget-key-context.ts
+// src/lib/widget-key-context.ts
 var $ = Symbol("micdrop-widget-key");
 function Qe() {
 	return ee($) || void 0;
 }
-//#endregion
 export { he as A, V as C, de as D, k as E, g as F, ie as M, v as N, ue as O, y as P, ke as S, me as T, Oe as _, Ke as a, Fe as b, Ge as c, X as d, He as f, je as g, Ne as h, Xe as i, ae as j, fe as k, qe as l, Me as m, Qe as n, Ze as o, q as p, Ue as r, Je as s, $ as t, Ye as u, Ae as v, R as w, Ie as x, Pe as y };

package/dist/{zh-apNTBV5B.js → zh-BaZ_hYJV.js}

@@ -1,4 +1,4 @@
-//#region src/lib/public-calendar-flow/i18n/locales/zh.js
+// src/lib/public-calendar-flow/i18n/locales/zh.js
 var e = {
 	decrease: "减少",
 	increase: "增加",
@@ -224,5 +224,4 @@ var e = {
 	shareX: "X",
 	shareMore: "更多"
 };
-//#endregion
 export { e as zh };

package/dist/{zh-DLwlt3JO.js → zh-DHfgJplH.js}

@@ -1,4 +1,4 @@
-//#region src/lib/i18n/locales/zh.js
+// src/lib/i18n/locales/zh.js
 var e = {
 	viewList: "列表",
 	viewGallery: "画廊",
@@ -549,5 +549,4 @@ var e = {
 	ticketsAtTheDoor: "仅限现场购票",
 	showAtTime: "演出 {time}"
 };
-//#endregion
 export { e as zh };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@getmicdrop/venue-calendar",
   "_version_comment": "4.1.55 was the last PUBLISHED version, and the tree carried 36 commits npm's 4.1.55 does not have — including the gate-password security fix and four money fixes. A filename must never reuse a version npm has taken (jsDelivr/unpkg cache the FIRST bytes they see under `@4.1.55` forever, so republishing that number ships the old widget to every venue that pinned it). Bumped to 4.2.0 here, BEFORE anything is built for publish. `npm run release:preflight` refuses to proceed when this number already exists in the registry.",
-  "version": "4.3.136",
+  "version": "4.3.138",
   "description": "A customizable Svelte calendar component for displaying comedy events",
   "type": "module",
   "types": "./dist/types/index.d.ts",
@@ -155,19 +155,19 @@
   "_devDependencies_pin_comment": "Three EXACT pins in here are load-bearing and must not be re-caretted by a dependency bot. (1) `@getmicdrop/svelte-components` — the ES/UMD/IIFE builds do NOT externalize SC, so it is COMPILED INTO every shipped artifact. RESTORED TO AN EXACT PIN 2026-08-23, having drifted back to a caret at some point between 6.24.311 and 6.24.316 — exactly the re-caretting this note warns about, which is worth knowing recurs. Under a caretted range like `^6.24.311` the SC version a venue's browser executes is whatever the range floats to on the publish machine at publish time, which is not recorded anywhere and is not reproducible after the fact; the `overrides` block below cannot help (it only ever covered esbuild, and consumers ignore a dependency's overrides entirely). Pinned exact so the artifact and the manifest agree, and vite.config.lib.js stamps the resolved version into the bundle as __VC_SC_VERSION__ so a venue's devtools can answer 'which SC is this?'. (2) `svelte` — the compiler whose private internal/client calls the pre-compiled dist binds to. `^5.56.9` let the compiler move under a peer range that stayed still; see _peerDependencies_comment. (3) `@stripe/stripe-js` in dependencies — see its own note there.",
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@getmicdrop/svelte-components": "6.24.435",
+    "@getmicdrop/svelte-components": "6.24.443",
     "@playwright/test": "^1.60.0",
-    "@size-limit/file": "^13.0.3",
+    "@size-limit/file": "^14.3.0",
     "@sveltejs/adapter-auto": "^7.0.1",
     "@sveltejs/kit": "^2.70.2",
     "@sveltejs/vite-plugin-svelte": "^7.3.0",
     "@tailwindcss/vite": "^4.3.3",
-    "@tanstack/svelte-query": "6.1.38",
+    "@tanstack/svelte-query": "6.3.5",
     "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/svelte": "^5.3.1",
     "@types/node": "^26.2.0",
     "@typescript-eslint/parser": "^8.59.2",
-    "@vitest/coverage-v8": "^4.1.10",
+    "@vitest/coverage-v8": "^5.0.5",
     "cross-env": "^10.1.0",
     "dependency-cruiser": "^18.2.0",
     "eslint": "^10.8.1",
@@ -175,36 +175,36 @@
     "fast-check": "^4.8.0",
     "globals": "^17.11.0",
     "husky": "^9.1.7",
-    "jsdom": "^29.1.1",
+    "jsdom": "^30.1.3",
     "knip": "^6.12.1",
-    "lint-staged": "^16.4.0",
+    "lint-staged": "^17.6.0",
     "postcss": "^8.5.26",
     "postcss-html": "^2.0.0",
     "prettier": "^3.8.3",
     "prettier-plugin-svelte": "^4.1.1",
-    "size-limit": "^13.0.3",
+    "size-limit": "^14.3.0",
     "stylelint": "^17.14.1",
     "stylelint-config-standard": "^40.0.0",
-    "svelte": "5.56.9",
+    "svelte": "5.57.2",
     "svelte-check": "^4.3.5",
     "svelte-stripe": "^2.0.0",
     "tailwindcss": "^4.3.3",
     "typescript": "^5.9.3",
     "vite": "^8.2.1",
     "vite-plugin-dts": "^5.0.3",
-    "vitest": "^4.1.10",
-    "yaml": "2.9.0"
+    "vitest": "^5.0.5",
+    "yaml": "2.9.1"
   },
   "_overrides_comment": "esbuild is not a direct dependency here — it arrives as an OPTIONAL PEER of vite (^0.27.0 || ^0.28.0) and of unplugin-dts (*), and npm resolved it to 0.27.3, which is inside GHSA range 0.27.3-0.28.0 (arbitrary file read via the dev server on Windows; dev-only exposure, but this is a Windows shop). There is no direct dependency to bump, so the lift has to be an override. Keep this satisfying vite's peer range — ^0.28.x does; a 0.29 line would not.",
   "overrides": {
     "esbuild": "^0.28.2",
-    "svelte": "5.56.9",
-    "@tanstack/svelte-query": "6.1.38",
+    "svelte": "5.57.2",
+    "@tanstack/svelte-query": "6.3.5",
     "@tanstack/query-core": "5.101.4"
   },
   "_dependencies_comment": "`@stripe/stripe-js` is pinned EXACT, and the caret it replaces was not a style choice. loadStripe() does not fetch a versioned URL — it builds `https://js.stripe.com/<RELEASE_TRAIN>/stripe.js` from a CONSTANT baked into whichever @stripe/stripe-js version resolves (9.13.0 hardcodes `RELEASE_TRAIN = 'dahlia'` in dist/index.mjs). This widget runs on third-party venue sites, many of which allowlist that exact script URL in their CSP, so a caret means a routine transitive bump silently MOVES the file a venue must allowlist and checkout dies on their site with a CSP violation and no signal on our side. The live 4.1.55 bundle still requests /clover/stripe.js while this tree resolves to /dahlia/ — the drift is not hypothetical. Pin it, and when the pin is raised, put the new train in the release notes so venue CSPs can be updated first. `svelte-stripe` USED to live here and has moved to devDependencies: no shipped artifact reaches it (dist mentions it only inside .map sourcesContent), CheckoutForm.svelte:81 deliberately calls Stripe.js directly instead ('Svelte 5 compatibility bug'), and the sole live import is a dynamic `import('svelte-stripe')` in src/routes/v/[venueSlug]/gift-cards/purchase/+page.svelte — a SvelteKit route in the dev/e2e app, which `files` does not publish. It stays installed for dev; it just stops being something every npm consumer downloads. Note what that move COSTS: svelte-stripe's own `svelte: ^5` peer was the only thing bounding a consumer's svelte below 6, so peerDependencies.svelte gained an explicit `<6` in the same change.",
   "dependencies": {
-    "@stripe/stripe-js": "9.13.0",
+    "@stripe/stripe-js": "10.1.0",
     "js-cookie": "^3.0.8",
     "qrcode": "^1.5.4",
     "zod": "^4.4.3"