?tagIds=...). That nested iframe reads
// its OWN location.search, so a coupon forwarded into this sandbox never
// reaches it. Inject ONLY the coupon into such checkout iframe srcs.
// Scoped to /system/checkout/ URLs so we never leak params to third-party
// iframes (YouTube, Stripe, etc.). UTM/attribution are intentionally left
// alone here — they keep flowing through the sandbox document only.
function propagateCouponToCheckoutIframe(f) {
var rawSrc = f.getAttribute('src')
if (!rawSrc) return
try {
var target = new URL(rawSrc, location.href)
if (target.pathname.indexOf('/system/checkout/') === -1) return
var sandboxParams = new URLSearchParams(location.search)
var coupon = sandboxParams.get('coupon') || sandboxParams.get('COUPON')
if (!coupon) return
if (target.searchParams.has('coupon') || target.searchParams.has('COUPON')) return
target.searchParams.set('coupon', coupon)
f.setAttribute('src', target.toString())
} catch (_) {}
}
function mount(html, skipTracking) {
if (mounted) return
mounted = true
var container = document.createElement('div')
if (skipTracking) {
// An
parsed into a loads at once, detached or not: tracking pixels
// are removed while the code still sits in an inert .
var template = document.createElement('template')
template.innerHTML = html || ''
removeTrackingPixels(template.content)
container.appendChild(template.content)
stubTrackingFunctions()
} else {
container.innerHTML = html || ''
}
// Patch creator