@wildo-ai/saas-website 1.1.4 → 1.1.6

package/src/core/external-providers/provider-scripts.website.ts

@@ -1,126 +0,0 @@
-/**
- * Loading what a website provider actually declared, instead of naming it.
- *
- * `FRONTEND_SDK` was a label on this surface. The layout resolved the analytics,
- * error-monitoring and captcha provider refs and stamped them into `data-*`
- * attributes on the page root; no consumer loaded anything. A provider could be
- * declared, enabled, hydrated — and do nothing at all.
- *
- * This is the consumer for the DATA half of a provider's executable surface: the
- * `scripts` it declares (#332). It serves the case a dynamic `import()` cannot,
- * and it is the dominant case on a marketing site: a vendor that ships a
- * global-installing `<script>` tag rather than an npm module (reCAPTCHA, tag
- * managers, chat widgets, and the CDN distributions of most analytics SDKs).
- *
- * The npm half — `sdk.activate`, a dynamic import inside the provider package —
- * needs the CODE channel, which needs this package to depend on
- * `@wildo-ai/external-connectors-public`. That dependency is not added here; see
- * the note in the S4a ledger. Nothing below anticipates it: a provider that
- * declares both gets its scripts from here and its SDK from there.
- *
- * ## Client-side injection, and the alternative that was rejected
- *
- * This is an Astro static site, so the "obvious" home for a third-party tag is
- * the built HTML `<head>`. That was rejected for now: the set of live providers
- * is per SERVICE and per ENVIRONMENT, resolved from the materialized artifact,
- * while the built HTML is one artifact shared across deploys of the same build.
- * Baking the tags in would make the build environment-specific — the same class
- * of coupling the DATA channel exists to avoid. Injecting from the client keeps
- * one build correct everywhere, at the cost of the tag arriving after hydration.
- * Revisit if a provider ever needs to run before first paint.
- */
-
-import type { ProviderFrontendScriptDeclaration } from '@wildo-ai/saas-models/public-runtime';
-import type { FrontendWebsiteProviderRegistry } from './frontend-provider-registry.website';
-
-/**
- * Marks a `<script>` this module owns, so a re-render, a client-side route
- * change or a second layout mount finds it instead of appending a duplicate.
- * A vendor tag loaded twice initialises twice — two analytics clients, two sets
- * of events — which is the failure mode this attribute exists to prevent.
- */
-export const PROVIDER_SCRIPT_MARKER_ATTRIBUTE = 'data-wildo-provider-script';
-
-export interface DeclaredProviderScript {
-  readonly providerRef: string;
-  readonly declaration: ProviderFrontendScriptDeclaration;
-}
-
-/**
- * Every script declared by the providers live on this surface, in registry
- * order, with the declaring ref kept beside each one so a failure can name it.
- */
-export function collectDeclaredProviderScripts(
-  registry: FrontendWebsiteProviderRegistry | undefined,
-): ReadonlyArray<DeclaredProviderScript> {
-  if (registry === undefined) return [];
-
-  const collected: DeclaredProviderScript[] = [];
-  for (const provider of registry.modules.values()) {
-    for (const declaration of provider.scripts ?? []) {
-      collected.push({ providerRef: provider.metadata.ref, declaration });
-    }
-  }
-  return collected;
-}
-
-export interface InjectProviderScriptsResult {
-  /** Refs whose script this call added. */
-  readonly injected: ReadonlyArray<string>;
-  /** Refs whose script was already present, so nothing was added. */
-  readonly alreadyPresent: ReadonlyArray<string>;
-}
-
-/**
- * Adds each declared script to the document, once.
- *
- * Idempotent by `src`: a declaration whose element is already in the document is
- * skipped. Callers may therefore run this on every mount without tracking state.
- *
- * `async` defaults to TRUE when the declaration says nothing. A third-party tag
- * that blocks parsing is the single most common way an analytics provider costs
- * a marketing site its paint metrics, and a provider author who has not thought
- * about it should get the safe answer rather than the blocking one.
- */
-export function injectProviderScripts(
-  scripts: ReadonlyArray<DeclaredProviderScript>,
-  targetDocument: Document,
-): InjectProviderScriptsResult {
-  const injected: string[] = [];
-  const alreadyPresent: string[] = [];
-
-  for (const { providerRef, declaration } of scripts) {
-    // Matched by reading the attribute rather than by a selector carrying the
-    // URL: a `src` can contain characters a CSS selector would have to escape,
-    // and an escaping bug here would show up as a duplicated vendor tag — two
-    // analytics clients, two sets of events — rather than as an error.
-    const existing = [
-      ...targetDocument.querySelectorAll(`script[${PROVIDER_SCRIPT_MARKER_ATTRIBUTE}]`),
-    ].some((element) => element.getAttribute('src') === declaration.src);
-    if (existing) {
-      alreadyPresent.push(providerRef);
-      continue;
-    }
-
-    const element = targetDocument.createElement('script');
-    element.src = declaration.src;
-    element.setAttribute(PROVIDER_SCRIPT_MARKER_ATTRIBUTE, providerRef);
-
-    if (declaration.integrity !== undefined) {
-      element.integrity = declaration.integrity;
-    }
-    if (declaration.crossOrigin !== undefined) {
-      element.crossOrigin = declaration.crossOrigin;
-    }
-    // Both flags are set explicitly rather than left to the element's defaults:
-    // a dynamically created script is `async` by default, so `defer: true` alone
-    // would be silently ignored without the paired `async = false`.
-    element.async = declaration.async ?? declaration.defer !== true;
-    element.defer = declaration.defer ?? false;
-
-    targetDocument.head.appendChild(element);
-    injected.push(providerRef);
-  }
-
-  return { injected, alreadyPresent };
-}