, same patterns as lib/utils/checkout-link.ts (never
// /system/checkout/complete|upsell|free) — so we never leak params to third-party
// iframes (YouTube, Stripe, etc.). UTM/attribution are intentionally left
// alone here — they keep flowing through the sandbox document only.
var CHECKOUT_PATH_RE =
/^\/(?:system\/checkout\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|checkout\/[a-z0-9]{8})\/?$/i
function propagateCouponToCheckoutIframe(f) {
var rawSrc = f.getAttribute('src')
if (!rawSrc) return
try {
var target = new URL(rawSrc, location.href)
if (!CHECKOUT_PATH_RE.test(target.pathname)) return
var sandboxParams = new URLSearchParams(location.search)
var coupon = sandboxParams.get('coupon') || sandboxParams.get('COUPON')
if (!coupon) return
if (target.searchParams.has('coupon') || target.searchParams.has('COUPON')) return
target.searchParams.set('coupon', coupon)
f.setAttribute('src', target.toString())
} catch (_) {}
}
function mount(html, skipTracking) {
if (mounted) return
mounted = true
var container = document.createElement('div')
if (skipTracking) {
// An
parsed into a loads at once, detached or not: tracking pixels
// are removed while the code still sits in an inert .
var template = document.createElement('template')
template.innerHTML = html || ''
removeTrackingPixels(template.content)
container.appendChild(template.content)
stubTrackingFunctions()
} else {
container.innerHTML = html || ''
}
// Patch creator