holidoit 1.0.169 → 1.0.171

package/README.md

@@ -7,6 +7,42 @@ Booking embed and widgets for partner websites. See [widget installation](WIDGET
 Configure `.env`, then run `yarn install` and `yarn dev`.
 Playground: http://localhost:3001. `yarn build` creates a local production build.
 
+### Google Places for invoice addresses
+
+The optional browser key is configured locally in `.env`:
+
+```dotenv
+NEXT_PUBLIC_MAPS_API_KEY=your_browser_key
+```
+
+Restart `yarn dev` after changing it. Builds read `.env` and environment variables;
+changing a deployed key requires a new build. To disable address search locally,
+set `NEXT_PUBLIC_MAPS_API_KEY=` in `.env`. Without a key, manual invoice address
+entry remains available. Address search loads only while an eligible invoice form
+is visible in the customer step. Suggestions fill the existing editable address
+fields; foreign postal codes remain excluded from the invoice payload.
+
+For deployment, configure repository secrets `DEV_NEXT_PUBLIC_MAPS_API_KEY` and
+`PROD_NEXT_PUBLIC_MAPS_API_KEY`. Production never falls back to the development
+key. An absent key does not fail the build; verify the appropriate secret before
+releasing address search.
+
+Use a dedicated browser key with billing enabled and **Maps JavaScript API** and
+**Places API (New)** enabled. Restrict the key to these two APIs and authorized
+websites. For iframe checkout, authorize the domain serving the iframe, using the
+actual DEV/PROD `CDN_DOMAIN` values (default embed URL: `https://cdn.holidoit.com/`).
+For local testing authorize `http://localhost:3001/*`; authorize any custom host
+or direct integration domain separately.
+
+The key is visible in the browser bundle and Google requests, even when supplied
+through GitHub Secrets. Do not commit its value or print it in logs. Configure
+quotas and usage monitoring; budget alerts alone do not cap spending. Keys in the
+same Google project share project quotas, including any PayByLink usage. Real
+Google requests can be billed even when checkout payments are simulated.
+
+See [Google API security guidance](https://developers.google.com/maps/api-security-best-practices)
+and [dynamic library loading](https://developers.google.com/maps/documentation/javascript/load-maps-js-api).
+
 ## PayPal with Stripe Connect
 
 The full embed checkout supports cards and PayPal for connected partners. PayPal
@@ -33,6 +69,6 @@ Use repository **Settings → Secrets and variables → Actions**, with `DEV_` a
 | Variables | `AWS_S3_BUCKET`, `CDN_DOMAIN`, `AWS_CLOUDFRONT_DISTRIBUTION_ID` |
 | Variables (optional) | `AWS_REGION` (default: `eu-south-1`) |
 | Secrets | `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `BASE_API_URL`, `NEXT_PUBLIC_STRIPE_CLIENT_ID` |
-| Secrets (optional) | `NEXT_PUBLIC_PAYPAL_CLIENT_ID` |
+| Secrets (optional) | `NEXT_PUBLIC_PAYPAL_CLIENT_ID`, `NEXT_PUBLIC_MAPS_API_KEY` |
 
 `CDN_DOMAIN` is a hostname, without `https://`. AWS credentials need S3 upload and CloudFront invalidation permissions; CloudFront must be allowed to read release files. Public URLs must allow revalidation (CloudFront minimum TTL: 0).

package/dist/embed.html

@@ -29,4 +29,4 @@
                 html.holidoit-mobile-drawer-open.holidoit-mobile-keyboard-open {
                     background: #fff;
                 }
-            }</style></head><body><div id="holidoit-embed-root"></div><script defer="defer" src="holidoit-js-releases/20261016092624570-8991746b8358-07a98242/holidoit-embed.js"></script></body></html>
+            }</style></head><body><div id="holidoit-embed-root"></div><script defer="defer" src="holidoit-js-releases/20261021133939552-a42cd5a68ed0-178372e4/holidoit-embed.js"></script></body></html>