@satanwagen/reviewkit 0.1.2 → 0.1.4

package/dist/activate.cjs

@@ -0,0 +1,150 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/activate.ts
+var activate_exports = {};
+__export(activate_exports, {
+  STICKY_KEY: () => STICKY_KEY,
+  clearSticky: () => clearSticky,
+  hostAllowed: () => hostAllowed,
+  isLocalHost: () => isLocalHost,
+  isStickyEnabled: () => isStickyEnabled,
+  reviewParam: () => reviewParam,
+  setSticky: () => setSticky,
+  shouldActivate: () => shouldActivate
+});
+module.exports = __toCommonJS(activate_exports);
+var STICKY_KEY = "review-kit:sticky";
+var STICKY_TTL_MS = 4 * 60 * 60 * 1e3;
+function safeRemove(storage, key) {
+  try {
+    storage().removeItem(key);
+  } catch {
+  }
+}
+function readSticky() {
+  try {
+    const raw = window.sessionStorage.getItem(STICKY_KEY);
+    if (!raw) return null;
+    const parsed = JSON.parse(raw);
+    if (typeof parsed === "object" && parsed !== null && typeof parsed.token === "string" && typeof parsed.until === "number") {
+      return parsed;
+    }
+  } catch {
+  }
+  return null;
+}
+function isStickyEnabled(token) {
+  if (token === void 0 || token === "") return false;
+  const sticky = readSticky();
+  if (!sticky) return false;
+  if (sticky.until < Date.now() || sticky.token !== token) {
+    safeRemove(() => window.sessionStorage, STICKY_KEY);
+    return false;
+  }
+  return true;
+}
+function setSticky(token, on) {
+  try {
+    if (on && token !== void 0 && token !== "") {
+      const value = { token, until: Date.now() + STICKY_TTL_MS };
+      window.sessionStorage.setItem(STICKY_KEY, JSON.stringify(value));
+    } else {
+      window.sessionStorage.removeItem(STICKY_KEY);
+    }
+  } catch {
+  }
+}
+function clearSticky() {
+  safeRemove(() => window.sessionStorage, STICKY_KEY);
+}
+function reviewParam() {
+  try {
+    return new URLSearchParams(window.location.search).get("review");
+  } catch {
+    return null;
+  }
+}
+function hostAllowed(allowedHosts) {
+  if (!allowedHosts || allowedHosts.length === 0) return true;
+  let host = "";
+  try {
+    host = window.location.hostname.toLowerCase();
+  } catch {
+    return false;
+  }
+  return allowedHosts.some((pattern) => {
+    const regex = new RegExp(
+      "^" + pattern.toLowerCase().split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*") + "$"
+    );
+    return regex.test(host);
+  });
+}
+function isLocalHost() {
+  try {
+    const host = window.location.hostname.toLowerCase();
+    return host === "localhost" || host === "127.0.0.1" || host === "[::1]" || host.endsWith(".localhost");
+  } catch {
+    return false;
+  }
+}
+var warnedNoToken = false;
+var warnedMismatch = false;
+function shouldActivate(options = {}) {
+  if (typeof window === "undefined") return false;
+  if (options.enabled === false) return false;
+  if (!hostAllowed(options.allowedHosts)) return false;
+  const param = reviewParam();
+  if (param === "off") {
+    clearSticky();
+    return false;
+  }
+  if (options.devAutoOn === true) return true;
+  const token = options.token;
+  if (token === void 0 || token === "") {
+    if (param !== null && param !== "" && !warnedNoToken) {
+      warnedNoToken = true;
+      console.warn(
+        "[review-kit] `?review` is present but no `token` is configured; the layer stays off. Pass `token` to <ReviewKit /> (or `devAutoOn` for local development)."
+      );
+    }
+    return false;
+  }
+  if (param !== null && param !== "") {
+    if (param === token) return true;
+    if (!warnedMismatch) {
+      warnedMismatch = true;
+      console.warn("[review-kit] `?review` token does not match the configured token; staying inactive.");
+    }
+    return false;
+  }
+  return isStickyEnabled(token);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  STICKY_KEY,
+  clearSticky,
+  hostAllowed,
+  isLocalHost,
+  isStickyEnabled,
+  reviewParam,
+  setSticky,
+  shouldActivate
+});
+//# sourceMappingURL=activate.cjs.map

package/dist/activate.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/activate.ts"],"sourcesContent":["/**\n * `@satanwagen/reviewkit/activate` — the activation decision, React-free.\n *\n * Hosts that lazy-load the review layer need to know BEFORE importing any\n * React code whether this page load should show the layer at all. This\n * module is that decision, and the only supported way to read ReviewKit's\n * persisted opt-in state (the sessionStorage format is private and may\n * change; `shouldActivate` will not).\n *\n * Rules (no exceptions, no environment sniffing):\n *\n *   - `enabled: false`            → never.\n *   - hostname ∉ `allowedHosts`   → never (when an allowlist is given).\n *   - `?review=off`               → never; also clears the in-tab opt-in.\n *   - no `token` configured       → never. `?review=x` without a token logs\n *                                   a warning and stays off.\n *   - `?review=<token>`           → yes.\n *   - valid in-tab sticky session → yes (started by an earlier `?review=<token>`\n *                                   load in this tab, bound to the token,\n *                                   ~4 h sliding expiry).\n *   - `devAutoOn: true`           → yes, regardless of URL/token. The host\n *                                   decides when (e.g. `import.meta.env.DEV`);\n *                                   the library never reads NODE_ENV.\n */\n\nexport interface ActivationOptions {\n  /** The review token. Without it the layer never activates (except `devAutoOn`). */\n  token?: string;\n  /** Master switch. `false` short-circuits everything. Default `true`. */\n  enabled?: boolean;\n  /** Hostname allowlist with `*` wildcards. Unset = any host. */\n  allowedHosts?: string[];\n  /** Force the layer on for this page load (dev convenience; host-controlled). */\n  devAutoOn?: boolean;\n}\n\n/** @internal sessionStorage key of the per-tab opt-in. Format is private. */\nexport const STICKY_KEY = 'review-kit:sticky';\nconst STICKY_TTL_MS = 4 * 60 * 60 * 1000;\n\ninterface Sticky {\n  token: string;\n  until: number;\n}\n\nfunction safeRemove(storage: () => Storage, key: string): void {\n  try {\n    storage().removeItem(key);\n  } catch {\n    /* storage unavailable */\n  }\n}\n\nfunction readSticky(): Sticky | null {\n  try {\n    const raw = window.sessionStorage.getItem(STICKY_KEY);\n    if (!raw) return null;\n    const parsed: unknown = JSON.parse(raw);\n    if (\n      typeof parsed === 'object' &&\n      parsed !== null &&\n      typeof (parsed as Sticky).token === 'string' &&\n      typeof (parsed as Sticky).until === 'number'\n    ) {\n      return parsed as Sticky;\n    }\n  } catch {\n    /* unreadable */\n  }\n  return null;\n}\n\n/** @internal Is the per-tab opt-in present, unexpired and bound to `token`? */\nexport function isStickyEnabled(token: string | undefined): boolean {\n  if (token === undefined || token === '') return false;\n  const sticky = readSticky();\n  if (!sticky) return false;\n  if (sticky.until < Date.now() || sticky.token !== token) {\n    safeRemove(() => window.sessionStorage, STICKY_KEY);\n    return false;\n  }\n  return true;\n}\n\n/** @internal Start / renew / end the per-tab opt-in. No-op without a token. */\nexport function setSticky(token: string | undefined, on: boolean): void {\n  try {\n    if (on && token !== undefined && token !== '') {\n      const value: Sticky = { token, until: Date.now() + STICKY_TTL_MS };\n      window.sessionStorage.setItem(STICKY_KEY, JSON.stringify(value));\n    } else {\n      window.sessionStorage.removeItem(STICKY_KEY);\n    }\n  } catch {\n    /* storage unavailable — the choice just won't persist */\n  }\n}\n\n/** @internal Clear the per-tab opt-in. */\nexport function clearSticky(): void {\n  safeRemove(() => window.sessionStorage, STICKY_KEY);\n}\n\n/** @internal The raw `?review` value of the current URL, or null. */\nexport function reviewParam(): string | null {\n  try {\n    return new URLSearchParams(window.location.search).get('review');\n  } catch {\n    return null;\n  }\n}\n\n/** Does the current hostname match one of the allowed patterns?\n *  '*' matches any characters ('*.dev.example' → a.dev.example, a.b.dev.example). */\nexport function hostAllowed(allowedHosts: string[] | undefined): boolean {\n  if (!allowedHosts || allowedHosts.length === 0) return true;\n  let host = '';\n  try {\n    host = window.location.hostname.toLowerCase();\n  } catch {\n    return false;\n  }\n  return allowedHosts.some((pattern) => {\n    const regex = new RegExp(\n      '^' +\n        pattern\n          .toLowerCase()\n          .split('*')\n          .map((part) => part.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&'))\n          .join('.*') +\n        '$',\n    );\n    return regex.test(host);\n  });\n}\n\n/** Loopback hosts where a missing allowlist is expected, not a smell. */\nexport function isLocalHost(): boolean {\n  try {\n    const host = window.location.hostname.toLowerCase();\n    return host === 'localhost' || host === '127.0.0.1' || host === '[::1]' || host.endsWith('.localhost');\n  } catch {\n    return false;\n  }\n}\n\nlet warnedNoToken = false;\nlet warnedMismatch = false;\n\n/**\n * Should the review layer be active for this page load?\n *\n * Read-only except for one deliberate side effect: `?review=off` clears the\n * in-tab opt-in, so a host that gates a lazy import on this function still\n * honours \"off\" on the next load. Safe to call on the server (returns false).\n */\nexport function shouldActivate(options: ActivationOptions = {}): boolean {\n  if (typeof window === 'undefined') return false;\n  if (options.enabled === false) return false;\n  if (!hostAllowed(options.allowedHosts)) return false;\n\n  const param = reviewParam();\n  if (param === 'off') {\n    clearSticky();\n    return false;\n  }\n  if (options.devAutoOn === true) return true;\n\n  const token = options.token;\n  if (token === undefined || token === '') {\n    if (param !== null && param !== '' && !warnedNoToken) {\n      warnedNoToken = true;\n      console.warn(\n        '[review-kit] `?review` is present but no `token` is configured; the layer stays off. ' +\n          'Pass `token` to <ReviewKit /> (or `devAutoOn` for local development).',\n      );\n    }\n    return false;\n  }\n  if (param !== null && param !== '') {\n    if (param === token) return true;\n    if (!warnedMismatch) {\n      warnedMismatch = true;\n      console.warn('[review-kit] `?review` token does not match the configured token; staying inactive.');\n    }\n    return false;\n  }\n  return isStickyEnabled(token);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAqCO,IAAM,aAAa;AAC1B,IAAM,gBAAgB,IAAI,KAAK,KAAK;AAOpC,SAAS,WAAW,SAAwB,KAAmB;AAC7D,MAAI;AACF,YAAQ,EAAE,WAAW,GAAG;AAAA,EAC1B,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,aAA4B;AACnC,MAAI;AACF,UAAM,MAAM,OAAO,eAAe,QAAQ,UAAU;AACpD,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,SAAkB,KAAK,MAAM,GAAG;AACtC,QACE,OAAO,WAAW,YAClB,WAAW,QACX,OAAQ,OAAkB,UAAU,YACpC,OAAQ,OAAkB,UAAU,UACpC;AACA,aAAO;AAAA,IACT;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAGO,SAAS,gBAAgB,OAAoC;AAClE,MAAI,UAAU,UAAa,UAAU,GAAI,QAAO;AAChD,QAAM,SAAS,WAAW;AAC1B,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,OAAO,QAAQ,KAAK,IAAI,KAAK,OAAO,UAAU,OAAO;AACvD,eAAW,MAAM,OAAO,gBAAgB,UAAU;AAClD,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGO,SAAS,UAAU,OAA2B,IAAmB;AACtE,MAAI;AACF,QAAI,MAAM,UAAU,UAAa,UAAU,IAAI;AAC7C,YAAM,QAAgB,EAAE,OAAO,OAAO,KAAK,IAAI,IAAI,cAAc;AACjE,aAAO,eAAe,QAAQ,YAAY,KAAK,UAAU,KAAK,CAAC;AAAA,IACjE,OAAO;AACL,aAAO,eAAe,WAAW,UAAU;AAAA,IAC7C;AAAA,EACF,QAAQ;AAAA,EAER;AACF;AAGO,SAAS,cAAoB;AAClC,aAAW,MAAM,OAAO,gBAAgB,UAAU;AACpD;AAGO,SAAS,cAA6B;AAC3C,MAAI;AACF,WAAO,IAAI,gBAAgB,OAAO,SAAS,MAAM,EAAE,IAAI,QAAQ;AAAA,EACjE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIO,SAAS,YAAY,cAA6C;AACvE,MAAI,CAAC,gBAAgB,aAAa,WAAW,EAAG,QAAO;AACvD,MAAI,OAAO;AACX,MAAI;AACF,WAAO,OAAO,SAAS,SAAS,YAAY;AAAA,EAC9C,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO,aAAa,KAAK,CAAC,YAAY;AACpC,UAAM,QAAQ,IAAI;AAAA,MAChB,MACE,QACG,YAAY,EACZ,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,QAAQ,uBAAuB,MAAM,CAAC,EACzD,KAAK,IAAI,IACZ;AAAA,IACJ;AACA,WAAO,MAAM,KAAK,IAAI;AAAA,EACxB,CAAC;AACH;AAGO,SAAS,cAAuB;AACrC,MAAI;AACF,UAAM,OAAO,OAAO,SAAS,SAAS,YAAY;AAClD,WAAO,SAAS,eAAe,SAAS,eAAe,SAAS,WAAW,KAAK,SAAS,YAAY;AAAA,EACvG,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,IAAI,gBAAgB;AACpB,IAAI,iBAAiB;AASd,SAAS,eAAe,UAA6B,CAAC,GAAY;AACvE,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,MAAI,QAAQ,YAAY,MAAO,QAAO;AACtC,MAAI,CAAC,YAAY,QAAQ,YAAY,EAAG,QAAO;AAE/C,QAAM,QAAQ,YAAY;AAC1B,MAAI,UAAU,OAAO;AACnB,gBAAY;AACZ,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,cAAc,KAAM,QAAO;AAEvC,QAAM,QAAQ,QAAQ;AACtB,MAAI,UAAU,UAAa,UAAU,IAAI;AACvC,QAAI,UAAU,QAAQ,UAAU,MAAM,CAAC,eAAe;AACpD,sBAAgB;AAChB,cAAQ;AAAA,QACN;AAAA,MAEF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,MAAI,UAAU,QAAQ,UAAU,IAAI;AAClC,QAAI,UAAU,MAAO,QAAO;AAC5B,QAAI,CAAC,gBAAgB;AACnB,uBAAiB;AACjB,cAAQ,KAAK,qFAAqF;AAAA,IACpG;AACA,WAAO;AAAA,EACT;AACA,SAAO,gBAAgB,KAAK;AAC9B;","names":[]}

package/dist/activate.d.cts

@@ -0,0 +1,59 @@
+/**
+ * `@satanwagen/reviewkit/activate` — the activation decision, React-free.
+ *
+ * Hosts that lazy-load the review layer need to know BEFORE importing any
+ * React code whether this page load should show the layer at all. This
+ * module is that decision, and the only supported way to read ReviewKit's
+ * persisted opt-in state (the sessionStorage format is private and may
+ * change; `shouldActivate` will not).
+ *
+ * Rules (no exceptions, no environment sniffing):
+ *
+ *   - `enabled: false`            → never.
+ *   - hostname ∉ `allowedHosts`   → never (when an allowlist is given).
+ *   - `?review=off`               → never; also clears the in-tab opt-in.
+ *   - no `token` configured       → never. `?review=x` without a token logs
+ *                                   a warning and stays off.
+ *   - `?review=<token>`           → yes.
+ *   - valid in-tab sticky session → yes (started by an earlier `?review=<token>`
+ *                                   load in this tab, bound to the token,
+ *                                   ~4 h sliding expiry).
+ *   - `devAutoOn: true`           → yes, regardless of URL/token. The host
+ *                                   decides when (e.g. `import.meta.env.DEV`);
+ *                                   the library never reads NODE_ENV.
+ */
+interface ActivationOptions {
+    /** The review token. Without it the layer never activates (except `devAutoOn`). */
+    token?: string;
+    /** Master switch. `false` short-circuits everything. Default `true`. */
+    enabled?: boolean;
+    /** Hostname allowlist with `*` wildcards. Unset = any host. */
+    allowedHosts?: string[];
+    /** Force the layer on for this page load (dev convenience; host-controlled). */
+    devAutoOn?: boolean;
+}
+/** @internal sessionStorage key of the per-tab opt-in. Format is private. */
+declare const STICKY_KEY = "review-kit:sticky";
+/** @internal Is the per-tab opt-in present, unexpired and bound to `token`? */
+declare function isStickyEnabled(token: string | undefined): boolean;
+/** @internal Start / renew / end the per-tab opt-in. No-op without a token. */
+declare function setSticky(token: string | undefined, on: boolean): void;
+/** @internal Clear the per-tab opt-in. */
+declare function clearSticky(): void;
+/** @internal The raw `?review` value of the current URL, or null. */
+declare function reviewParam(): string | null;
+/** Does the current hostname match one of the allowed patterns?
+ *  '*' matches any characters ('*.dev.example' → a.dev.example, a.b.dev.example). */
+declare function hostAllowed(allowedHosts: string[] | undefined): boolean;
+/** Loopback hosts where a missing allowlist is expected, not a smell. */
+declare function isLocalHost(): boolean;
+/**
+ * Should the review layer be active for this page load?
+ *
+ * Read-only except for one deliberate side effect: `?review=off` clears the
+ * in-tab opt-in, so a host that gates a lazy import on this function still
+ * honours "off" on the next load. Safe to call on the server (returns false).
+ */
+declare function shouldActivate(options?: ActivationOptions): boolean;
+
+export { type ActivationOptions, STICKY_KEY, clearSticky, hostAllowed, isLocalHost, isStickyEnabled, reviewParam, setSticky, shouldActivate };

package/dist/activate.d.ts

@@ -0,0 +1,59 @@
+/**
+ * `@satanwagen/reviewkit/activate` — the activation decision, React-free.
+ *
+ * Hosts that lazy-load the review layer need to know BEFORE importing any
+ * React code whether this page load should show the layer at all. This
+ * module is that decision, and the only supported way to read ReviewKit's
+ * persisted opt-in state (the sessionStorage format is private and may
+ * change; `shouldActivate` will not).
+ *
+ * Rules (no exceptions, no environment sniffing):
+ *
+ *   - `enabled: false`            → never.
+ *   - hostname ∉ `allowedHosts`   → never (when an allowlist is given).
+ *   - `?review=off`               → never; also clears the in-tab opt-in.
+ *   - no `token` configured       → never. `?review=x` without a token logs
+ *                                   a warning and stays off.
+ *   - `?review=<token>`           → yes.
+ *   - valid in-tab sticky session → yes (started by an earlier `?review=<token>`
+ *                                   load in this tab, bound to the token,
+ *                                   ~4 h sliding expiry).
+ *   - `devAutoOn: true`           → yes, regardless of URL/token. The host
+ *                                   decides when (e.g. `import.meta.env.DEV`);
+ *                                   the library never reads NODE_ENV.
+ */
+interface ActivationOptions {
+    /** The review token. Without it the layer never activates (except `devAutoOn`). */
+    token?: string;
+    /** Master switch. `false` short-circuits everything. Default `true`. */
+    enabled?: boolean;
+    /** Hostname allowlist with `*` wildcards. Unset = any host. */
+    allowedHosts?: string[];
+    /** Force the layer on for this page load (dev convenience; host-controlled). */
+    devAutoOn?: boolean;
+}
+/** @internal sessionStorage key of the per-tab opt-in. Format is private. */
+declare const STICKY_KEY = "review-kit:sticky";
+/** @internal Is the per-tab opt-in present, unexpired and bound to `token`? */
+declare function isStickyEnabled(token: string | undefined): boolean;
+/** @internal Start / renew / end the per-tab opt-in. No-op without a token. */
+declare function setSticky(token: string | undefined, on: boolean): void;
+/** @internal Clear the per-tab opt-in. */
+declare function clearSticky(): void;
+/** @internal The raw `?review` value of the current URL, or null. */
+declare function reviewParam(): string | null;
+/** Does the current hostname match one of the allowed patterns?
+ *  '*' matches any characters ('*.dev.example' → a.dev.example, a.b.dev.example). */
+declare function hostAllowed(allowedHosts: string[] | undefined): boolean;
+/** Loopback hosts where a missing allowlist is expected, not a smell. */
+declare function isLocalHost(): boolean;
+/**
+ * Should the review layer be active for this page load?
+ *
+ * Read-only except for one deliberate side effect: `?review=off` clears the
+ * in-tab opt-in, so a host that gates a lazy import on this function still
+ * honours "off" on the next load. Safe to call on the server (returns false).
+ */
+declare function shouldActivate(options?: ActivationOptions): boolean;
+
+export { type ActivationOptions, STICKY_KEY, clearSticky, hostAllowed, isLocalHost, isStickyEnabled, reviewParam, setSticky, shouldActivate };

package/dist/activate.js

@@ -0,0 +1,21 @@
+import {
+  STICKY_KEY,
+  clearSticky,
+  hostAllowed,
+  isLocalHost,
+  isStickyEnabled,
+  reviewParam,
+  setSticky,
+  shouldActivate
+} from "./chunk-ETAGGIDN.js";
+export {
+  STICKY_KEY,
+  clearSticky,
+  hostAllowed,
+  isLocalHost,
+  isStickyEnabled,
+  reviewParam,
+  setSticky,
+  shouldActivate
+};
+//# sourceMappingURL=activate.js.map

package/dist/activate.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}