web-manager 4.3.2 → 4.3.4

package/src/modules/utilities.js

@@ -0,0 +1,310 @@
+// Methods are defined as arrow class fields so `this` is permanently bound to the instance.
+// This means consumers can safely alias or destructure methods without losing context:
+//   const { escapeHTML } = webManager.utilities(); // ✓ works
+//   const escape = webManager.utilities().escapeHTML; // ✓ works
+//   items.map(webManager.utilities().escapeHTML); // ✓ works
+// Safe because webManager.utilities() is a singleton — only one instance ever exists.
+class Utilities {
+  constructor(manager) {
+    this.manager = manager;
+  }
+
+  // Copy text to clipboard
+  clipboardCopy = (input) => {
+    // Get the text from the input
+    const text = input && input.nodeType
+      ? input.value || input.innerText || input.innerHTML
+      : input;
+
+    // Try to use the modern clipboard API
+    if (navigator.clipboard && navigator.clipboard.writeText) {
+      return navigator.clipboard.writeText(text).catch(() => {
+        fallbackCopy(text);
+      });
+    } else {
+      fallbackCopy(text);
+    }
+
+    function fallbackCopy(text) {
+      const el = document.createElement('textarea');
+      el.setAttribute('style', 'width:1px;border:0;opacity:0;');
+      el.value = text;
+      document.body.appendChild(el);
+      el.select();
+
+      try {
+        document.execCommand('copy');
+      } catch (e) {
+        console.error('Failed to copy to clipboard');
+      }
+
+      document.body.removeChild(el);
+    }
+  }
+
+  // Escape HTML to prevent XSS
+  // Accepts a string, object, or array — walks recursively, escaping all string values
+  escapeHTML = (input) => {
+    // Strings — escape and return
+    if (typeof input === 'string') {
+      this._shadowElement = this._shadowElement || document.createElement('p');
+      this._shadowElement.innerHTML = '';
+
+      // This automatically escapes HTML entities like <, >, &, etc.
+      this._shadowElement.appendChild(document.createTextNode(input));
+
+      // This is needed to escape quotes to prevent attribute injection
+      return this._shadowElement.innerHTML.replace(/["']/g, (m) => {
+        switch (m) {
+          case '"':
+            return '&quot;';
+          default:
+            return '&#039;';
+        }
+      });
+    }
+
+    // Null/undefined — pass through
+    if (input == null) {
+      return input;
+    }
+
+    // Arrays — recurse each item
+    if (Array.isArray(input)) {
+      return input.map(item => this.escapeHTML(item));
+    }
+
+    // Objects — shallow clone, recurse each value
+    if (typeof input === 'object') {
+      const result = {};
+      for (const [key, value] of Object.entries(input)) {
+        result[key] = this.escapeHTML(value);
+      }
+      return result;
+    }
+
+    // Numbers, booleans, etc. — pass through unchanged
+    return input;
+  }
+
+  // Sanitize URL to prevent javascript:, data:, and other dangerous URI schemes
+  // Returns the original URL if safe, or '' if rejected
+  sanitizeURL = (url) => {
+    if (!url || typeof url !== 'string') {
+      return '';
+    }
+
+    try {
+      const parsed = new URL(url, window.location.origin);
+
+      if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        return '';
+      }
+
+      return url;
+    } catch (e) {
+      return '';
+    }
+  }
+
+  // Show notification
+  showNotification = (message, options = {}) => {
+    // Handle different input types
+    let text = message;
+    let type = options.type || 'info';
+
+    // If message is an Error object, extract message and default to danger
+    if (message instanceof Error) {
+      text = message.message;
+      type = options.type || 'danger';
+    }
+
+    // Handle string as second parameter for backwards compatibility
+    if (typeof options === 'string') {
+      options = { type: options };
+      type = options.type;
+    }
+
+    // Extract options
+    const timeout = options.timeout !== undefined ? options.timeout : 5000;
+
+    const $notification = document.createElement('div');
+    $notification.className = `alert alert-${type} alert-dismissible fade show position-fixed`;
+    $notification.style.cssText = 'z-index: 9999; top: 1rem; left: 50%; transform: translateX(-50%); width: calc(100% - 2rem); max-width: 500px;';
+
+    const $text = document.createElement('span');
+    $text.textContent = text;
+
+    const $closeBtn = document.createElement('button');
+    $closeBtn.type = 'button';
+    $closeBtn.className = 'btn-close';
+    $closeBtn.setAttribute('data-bs-dismiss', 'alert');
+
+    $notification.appendChild($text);
+    $notification.appendChild($closeBtn);
+
+    document.body.appendChild($notification);
+
+    // Auto-remove after timeout (unless timeout is 0)
+    if (timeout > 0) {
+      setTimeout(() => {
+        $notification.remove();
+      }, timeout);
+    }
+  }
+
+  // Get platform (OS)
+  getPlatform = () => {
+    const ua = navigator.userAgent.toLowerCase();
+    const platform = (navigator.userAgentData?.platform || navigator.platform || '').toLowerCase();
+
+    // Check userAgent for mobile platforms (more reliable than platform string)
+    if (/iphone|ipad|ipod/.test(ua)) {
+      return 'ios';
+    }
+    if (/android/.test(ua)) {
+      return 'android';
+    }
+
+    // Check platform string for desktop OS
+    if (/win/.test(platform)) {
+      return 'windows';
+    }
+    if (/mac/.test(platform)) {
+      return 'mac';
+    }
+    if (/cros/.test(ua)) {
+      return 'chromeos';
+    }
+    if (/linux/.test(platform)) {
+      return 'linux';
+    }
+
+    return 'unknown';
+  }
+
+  // Get browser name
+  getBrowser = () => {
+    const ua = navigator.userAgent;
+
+    // Order matters - check more specific browsers first
+    // Edge before Chrome (Edge includes "Chrome" in UA)
+    if (/edg/i.test(ua)) {
+      return 'edge';
+    }
+
+    // Opera before Chrome (Opera includes "Chrome" in UA)
+    if (/opera|opr/i.test(ua)) {
+      return 'opera';
+    }
+
+    // Brave before Chrome (Brave includes "Chrome" in UA)
+    if (navigator.brave || /brave/i.test(ua)) {
+      return 'brave';
+    }
+
+    // Chrome (including Chromium-based browsers)
+    if (/chrome|chromium|crios/i.test(ua)) {
+      return 'chrome';
+    }
+
+    // Firefox
+    if (/firefox|fxios/i.test(ua)) {
+      return 'firefox';
+    }
+
+    // Safari last (most browsers include "Safari" in UA)
+    if (/safari/i.test(ua)) {
+      return 'safari';
+    }
+
+    // Fallback
+    return null;
+  }
+
+  // Get runtime environment
+  getRuntime = () => {
+    // Use config runtime if provided
+    if (this.manager?.config?.runtime) {
+      return this.manager.config.runtime;
+    }
+
+    // Browser extension (Chrome, Edge, Opera, Brave, Firefox, Safari, etc.)
+    if (
+      (typeof chrome !== 'undefined' && chrome.runtime?.id)
+      || (typeof browser !== 'undefined' && browser.runtime?.id)
+      || (typeof safari !== 'undefined' && safari.extension)
+    ) {
+      return 'browser-extension';
+    }
+
+    // Default: web browser
+    return 'web';
+  }
+
+  // Check if mobile device
+  isMobile = () => {
+    try {
+      // Try modern API first
+      const m = navigator.userAgentData?.mobile;
+      if (typeof m !== 'undefined') {
+        return m === true;
+      }
+    } catch (e) {
+      // Silent fail
+    }
+
+    // Fallback to media query
+    try {
+      return window.matchMedia('(max-width: 767px)').matches;
+    } catch (e) {
+      return false;
+    }
+  }
+
+  // Get device based on screen width
+  getDevice = () => {
+    const width = window.innerWidth;
+
+    // Mobile: < 768px (Bootstrap's md breakpoint)
+    if (width < 768) {
+      return 'mobile';
+    }
+
+    // Tablet: 768px - 1199px (between md and xl)
+    if (width < 1200) {
+      return 'tablet';
+    }
+
+    // Desktop: >= 1200px
+    return 'desktop';
+  }
+
+  // Get context information
+  getContext = () => {
+    // Return context information
+    return {
+      client: {
+        language: navigator.language,
+        mobile: this.isMobile(),
+        device: this.getDevice(),
+        platform: this.getPlatform(),
+        browser: this.getBrowser(),
+        vendor: navigator.vendor,
+        runtime: this.getRuntime(),
+        userAgent: navigator.userAgent,
+        url: window.location.href,
+      },
+      geolocation: {
+        ip: null,
+        country: null,
+        region: null,
+        city: null,
+        latitude: null,
+        longitude: null,
+      },
+    };
+  }
+}
+
+export default Utilities;

package/CHANGELOG.md

@@ -1,242 +0,0 @@
-# CHANGELOG
-
-All notable changes to this project will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
-
-## Changelog Categories
-
-- `BREAKING` for breaking changes.
-- `Added` for new features.
-- `Changed` for changes in existing functionality.
-- `Deprecated` for soon-to-be removed features.
-- `Removed` for now removed features.
-- `Fixed` for any bug fixes.
-- `Security` in case of vulnerabilities.
-
----
-## [4.3.2] - 2026-06-11
-
-### Added
-- **`docs/bindings.md`**: full `data-wm-bind` deep reference migrated from the `omega:ujm` skill into the repo (the module that implements the feature) — actions table, comma-separated multi-binding syntax + parser caveat, condition operators, auth/usage/custom state paths, JS API, skeleton-loader lifecycle (`wm-binding-skeleton` → `wm-bound`), multi-phase binding, composite-text pattern, and root-key update filtering. Linked from CLAUDE.md and `docs/modules.md`. Part of the skills-as-routers refactor: framework facts live in repo docs (version-matched via `node_modules`).
-
-### Changed
-- **Dependency bumps**: `@sentry/browser` `^10.54.0` → `^10.57.0`, `firebase` `^12.13.0` → `^12.14.0`.
-
----
-## [4.2.0] - 2026-05-21
-### Added
-- **Consent defaults in `DEFAULT_ACCOUNT`.** Phase A companion to `backend-manager` v5.2.0's marketing-consent system. `src/modules/auth.js` now defaults `account.consent.{legal,marketing}` to the canonical shape (`status: 'revoked'`, `grantedAt`/`revokedAt` with null leaves) so `resolveAccount()` always populates the field for legacy users whose Firestore doc predates the consent system. Without this, the account-page email-preferences toggle would read `undefined` for pre-migration users and mis-state.
-- **`docs/<topic>.md` deep references.** New `docs/architecture.md`, `docs/build-system.md`, `docs/code-patterns.md`, `docs/common-tasks.md`, `docs/dependencies.md`, `docs/modules.md`, `docs/testing.md`. Mirrors the architectural-overview-plus-deep-references pattern used in `backend-manager` and `electron-manager`.
-
-### Changed
-- **`CLAUDE.md` refactored to the architectural-overview pattern.** Trimmed from 301 lines to ~80; per-subsystem detail moved to the new `docs/*.md` files. Keeps Claude's loaded-context cost down on every conversation.
-
-### Fixed
-- **Toast notification width.** `src/modules/utilities.js`: notifications now have `width: calc(100% - 2rem); max-width: 500px` so longer text doesn't render as a narrow cramped strip at the top of the page.
-
----
-## [4.1.42] - 2026-05-11
-### Changed
-- **Firebase config: presence-driven + flat shape canonical.** Firebase now initializes when a `firebaseConfig` blob is present in config (matching BEM/BXM/EM/OMEGA shape) — no separate `firebase.app.enabled` flag needed. Removes the `enabled` redundancy where consumers had to set both a credentials blob AND flip a flag.
-- New internal helper `_resolveFirebaseConfig()` reads flat `config.firebaseConfig` first (canonical), falls back to nested `config.firebase.app.config` (UJM legacy yaml). Used by `_initializeFirebase`, `getFunctionsUrl`, `getApiUrl`, `service-worker.js`, and `auth.js#listen` (Firebase-not-configured short-circuit).
-- `_initializeFirebase` now reuses an existing `[DEFAULT]` Firebase app if present (via `getApps()` / `getApp()`) instead of throwing `app/duplicate-app` on re-init (live reload, test re-runs).
-- No backwards-compat shim needed for UJM: both shapes resolve. UJM can migrate to the flat `firebaseConfig` shape on its own schedule; until then, its `firebase.app.config` keeps working.
-
----
-## [4.1.41] - 2026-05-10
-### Changed
-- Bumped dependencies: `@sentry/browser` ^10.47.0 → ^10.52.0, `firebase` ^12.11.0 → ^12.13.0, `prepare-package` ^2.0.7 → ^2.1.0.
-- Added empty `hooks: {}` to `preparePackage` config to align with prepare-package 2.1.0 schema.
-
----
-## [4.1.40] - 2026-05-10
-### Changed
-- **BREAKING (internal)**: `_resolveUsage()` now reads `config.payment.products` instead of `config.payment.plans`. Aligns with OMEGA's canonical shape (the SSOT) — same key name in BEM, UJM, EM. No backwards-compat shim; consumers must use `payment.products`. Default in `_processConfiguration()` updated from `plans: []` to `products: []`. Renamed local vars `plan`/`plans`/`planConfig` → `productId`/`products`/`product`. CLAUDE.md updated.
-
----
-## [4.1.39] - 2026-04-10
-### Changed
-- Converted `Utilities` methods to arrow class fields so `this` is permanently bound to the instance, allowing methods to be destructured, aliased, or passed as callbacks without losing context.
-
----
-## [4.1.38] - 2026-04-08
-### Added
-- Added `sanitizeURL()` utility method that validates URLs against dangerous URI schemes (javascript:, data:, etc.), allowing only http: and https: protocols.
-
-## [4.1.37] - 2026-04-05
-### Added
-- Added `_resolveUsage()` to auth module that merges account usage data with plan limits from config, exposed as a top-level `usage` binding context.
-- Added `payment.processors` and `payment.plans` defaults to configuration.
-
-## [4.1.36] - 2026-04-02
-### Fixed
-- Fixed mocha binary path preventing `npm test` from running.
-- Fixed lodash ESM named import incompatibility with Node.js (`storage.js`).
-- Fixed test suite calling nonexistent API methods (`init` → `initialize`, `storage('local')` → `storage()`).
-- Fixed mocha hanging after tests due to `setInterval` in version checker (added `--exit` flag).
-
-### Changed
-- Enhanced `escapeHTML` to recursively handle objects, arrays, and pass through non-string types.
-- Rewrote `showNotification` to use safe DOM construction (`textContent`) instead of `innerHTML`.
-- Split monolithic `test.js` into 8 modular test files under `test/tests/`.
-- Expanded test coverage from ~10 broken tests to 70 passing tests.
-
-### Security
-- Blocked `javascript:` protocol in `@attr` bindings for URL attributes (`href`, `src`, `action`, `formaction`).
-
----
-## [4.1.35] - 2026-04-02
-### Changed
-- Bumped `chatsy` from `^2.0.13` to `^2.0.14`.
-
----
-## [4.1.34] - 2026-04-01
-### Changed
-- Bumped `@sentry/browser` from `^10.46.0` to `^10.47.0`.
-- Bumped `lodash` from `^4.17.23` to `^4.18.1`.
-- Improved CLAUDE.md singleton pattern documentation with clearer usage examples and explicit anti-patterns.
-
----
-## [4.1.31] - 2026-03-24
-### Changed
-- Switched from `getFirestore` to `initializeFirestore` in `index.js` to support custom Firestore configuration options.
-- Removed redundant `getFirestore` from firestore module's stored methods since the instance is already initialized in `index.js`.
-
----
-## [4.1.30] - 2026-03-20
-### Changed
-- Bumped `@sentry/browser` from `^10.43.0` to `^10.45.0`.
-- Bumped `chatsy` from `^2.0.9` to `^2.0.11`.
-- Bumped `firebase` from `^12.10.0` to `^12.11.0`.
-
----
-## [4.1.29] - 2026-03-19
-### Changed
-- Restructured notification subscription documents to use nested `metadata.created` and `metadata.updated` timestamps instead of top-level fields.
-- Update operations now use dot-notation (`metadata.updated`) to preserve `metadata.created` when updating existing subscriptions.
-
----
-## [4.1.28] - 2026-03-15
-### Changed
-- Bumped `chatsy` from `^2.0.5` to `^2.0.8`.
-- Upgraded `prepare-package` from `^1.2.6` to `^2.0.7` (major version with esbuild bundler).
-- Added `preparePackage.type = "copy"` config option.
-
----
-## [4.1.27] - 2026-03-14
-### Changed
-- Renamed default brand config values from `id:'app'`/`name:'Application'` to `id:'brand'`/`name:'Brand'`.
-- Renamed service worker config key from `app` to `brand` to align with brand terminology.
-
----
-## [4.1.25] - 2026-03-13
-### Added
-- Automatically attach resolved subscription state (`state.resolved`) to auth state during processing, making `plan`, `active`, `trialing`, and `cancelling` available to bindings and consumers without manual calls.
-
----
-## [4.1.24] - 2026-03-13
-### Added
-- Added `resolveSubscription()` method to Auth module that derives calculated subscription fields (plan, active, trialing, cancelling) from raw backend data.
-
----
-## [4.1.22] - 2026-03-11
-### Changed
-- Renamed `config.tracking` to `config.analytics` with simplified property names: `google-analytics` → `google`, `google-analytics-secret` → `googleSecret`, `meta-pixel` → `meta`, `tiktok-pixel` → `tiktok`.
-
----
-## [4.1.19] - 2026-03-11
-### Added
-- Added new chatsy import.
-
----
-## [4.1.15] - 2026-02-26
-### Fixed
-- Fixed bindings skeleton removal happening prematurely when partial context updates didn't match any of the element's bindings.
-
-### Changed
-- `_executeAction` now returns a boolean indicating whether the action was processed, allowing `update()` to defer skeleton removal until at least one binding runs.
-
----
-## [4.1.10] - 2026-02-17
-### Changed
-- Refactored auth to use promise-based settler pattern (`_authReady`) for reliable auth state detection, eliminating race conditions with late-registered listeners.
-- Split `listen()` into two clear paths: `once` (waits for settler, fires once) and persistent (subscribes to all changes, catches up if already settled).
-- Renamed `onAuthStateChanged` to `_subscribe` (internal-only).
-- Removed unused `_readyCallbacks`.
-
----
-## [4.1.1] - 2025-12-17
-### Added
-- Added `getBrowser()` utility to detect browser type (chrome, firefox, safari, edge, opera, brave).
-- Added `data-browser` HTML attribute set during initialization.
-- Added `browser` and `vendor` fields to `getContext().client`.
-- Added `geolocation` object to `getContext()` with placeholder fields (ip, country, region, city, latitude, longitude).
-
-### Changed
-- Moved `vendor` from `browser` object to `client` object in `getContext()`.
-- Replaced `browser` object with `geolocation` object in `getContext()` return structure.
-
----
-## [4.1.0] - 2025-12-16
-### Added
-- Added `analytics.js` module for Google Analytics 4 Measurement Protocol support (browser extensions and Electron).
-- Added `usage.js` module to track install date, session count, session duration, and version history.
-- Added `tracking` config section for analytics credentials (`google-analytics`, `google-analytics-secret`, `meta-pixel`, `tiktok-pixel`).
-- Added `runtime` config option for explicit runtime override.
-- Added `buildTimeISO` auto-calculated from `buildTime`.
-- Added `usage` data to bindings context for UI display.
-
-### Changed
-- Refactored `utilities.js` from standalone functions to class pattern for consistency with other modules.
-- Simplified `getApiUrl()` to always prepend `api.` subdomain instead of replacing first subdomain.
-
-## [4.0.33] - 2025-12-12
-### BREAKING
-- `@text` binding action no longer auto-detects input/textarea elements. Use `@value` for inputs instead.
-
-### Added
-- Added `@value` binding action for explicitly setting input/textarea values.
-
-## [4.0.31] - 2025-12-03
-### Added
-- Added HTML data attributes (`data-platform`, `data-runtime`, `data-device`) on initialization for CSS targeting.
-- Added `getPlatform()`, `getRuntime()`, `isMobile()`, and `getDeviceType()` as standalone exported utility functions.
-
-### Changed
-- Refactored `getContext()` to use the new standalone functions and include `deviceType` and `runtime` in client info.
-
-## [4.0.29] - 2025-12-02
-### Fixed
-- Fixed notification subscription storing to incorrect Firestore path (`users/{uid}/notifications/{token}` → `notifications/{token}`).
-
-### Changed
-- Refactored `_saveSubscription` to use internal Firestore wrapper instead of direct Firebase imports.
-
-## [4.0.28] - 2025-12-01
-### Added
-- Added `exports` field to package.json for explicit module resolution support.
-
-### Changed
-- Updated `@sentry/browser` from pinned `10.11.0` to `^10.27.0`.
-- Updated `firebase` from `^12.3.0` to `^12.6.0`.
-- Updated `prepare-package` dev dependency from `^1.2.2` to `^1.2.5`.
-
-## [4.0.0] - 2025-09-11
-### ⚠️ BREAKING
-- Updated to ITW 3.0 standard.
-
-### Added
-- Updated `@sentry/browser` to `10.11.0` to avoid breaking changes in `10.12.0` that affect Ultimate-Jekyll.
-  > When installing from NPM:
-  > lighthouse → @sentry/node@9.46.0 → @sentry/core@9.46.0
-  > web-manager → @sentry/browser@10.15.0 → expects
-  > @sentry/core@10.15.0
-
-## [3.2.74] - 2025-07-17
-### Added
-- Now looks for `build.json` in the `/@output/build/` directory to ensure it works with Vite's output structure.
-
-## [1.0.0] - 2024-06-19
-### Added
-- Initial release of the project 🚀

package/TODO.md

@@ -1,59 +0,0 @@
-RADOM
-Remove this remove this eventually once we test the VAPDI push notificationx issue
-
-
-      const tokenOptions = { serviceWorkerRegistration: swRegistration };
-      if (this._vapidKey) { tokenOptions.vapidKey = this._vapidKey; }
-      return await getToken(messaging, tokenOptions);
-
-Do we need to use polyfill? the project that consumes this  is using webpack and compiles to es5. we need to ensure we have
-- fetch api
-- promises
-- async
-
-
-Eventually update auth.js to have an intelligent schema for user object
-
-
-UTM management
-
-LOCALSTORAGE
-
-WRAPPERS FOR COMMON FUNCITONS LIKE FIRESTORE DOC READ and QUERY AND WRITE
-
-// Chrome extension Sentry integration
-// Extract only the functions we need (enables tree-shaking)
-// This is REQUIRED for browser extensions to avoid bundling the entire Sentry SDK
-// https://github.com/getsentry/sentry-javascript/issues/14010
-const {
-  init,
-  captureException,
-  browserTracingIntegration,
-  replayIntegration,
-  browserApiErrorsIntegration,
-  breadcrumbsIntegration,
-  globalHandlersIntegration,
-} = module;
-
-// Store references
-this.Sentry = {
-  init,
-  captureException,
-  browserTracingIntegration,
-  replayIntegration,
-  browserApiErrorsIntegration,
-  breadcrumbsIntegration,
-  globalHandlersIntegration,
-};
-
-// Expose limited API globally (only what's needed)
-window.Sentry = this.Sentry;
-
-
-what if in web-manager we put a special thing like
-
-    // Precedence: passed environment > query string > config.environment
-    const searchParams = new URLSearchParams(window.location.search);
-    const queryEnv = searchParams.get('_dev_loudLogs');
-
-and this will set a property of webManager to true that enables copious logs

package/_legacy/helpers/auth-pages.js

@@ -1,24 +0,0 @@
-/*
-*/
-var dom;
-
-function AuthPages() {
-  var self = this;
-  dom = window.Manager.dom();
-  var pageQueryString = window.Manager.properties.page.queryString;
-
-  dom.select('a[href*=signin], a[href*=signup], a[href*=forgot]').each(function (el) {
-    var href = el.getAttribute('href');
-    try {
-      var newURL = new URL(href);
-      pageQueryString.forEach(function(value, key) {
-        newURL.searchParams.set(key, value)
-      })
-      el.setAttribute('href', newURL.toString())
-    } catch (e) {
-      console.warn('Failed to set auth URL', e);
-    }
-  })
-}
-
-module.exports = AuthPages;