@aglyn/plugins-commerce 1.0.0-beta.143

package/src/lib/utils/generate-preset-id.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { ComponentId } from '@aglyn/aglyn';
+export declare const generatePresetId: (componentId: ComponentId, ...other: string[]) => ComponentId;
+export default generatePresetId;

package/src/lib/utils/generate-preset-id.js

@@ -0,0 +1,25 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { BUNDLE_ID } from "../constants/bundle-common.js";
+export const generatePresetId = (componentId, ...other)=>{
+    return `${BUNDLE_ID}:${[
+        componentId,
+        ...other
+    ].join('.')}`;
+};
+export default generatePresetId;
+
+//# sourceMappingURL=generate-preset-id.js.map

package/src/lib/utils/generate-preset-id.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/utils/generate-preset-id.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { ComponentId } from '@aglyn/aglyn'\nimport { BUNDLE_ID } from '../constants/bundle-common'\n\nexport const generatePresetId = (\n  componentId: ComponentId,\n  ...other: string[]\n): ComponentId => {\n  return `${BUNDLE_ID}:${[componentId, ...other].join('.')}`\n}\n\nexport default generatePresetId\n"],"names":["BUNDLE_ID","generatePresetId","componentId","other","join"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,SAASA,SAAS,QAAQ,gCAA4B;AAEtD,OAAO,MAAMC,mBAAmB,CAC9BC,aACA,GAAGC;IAEH,OAAO,GAAGH,UAAU,CAAC,EAAE;QAACE;WAAgBC;KAAM,CAACC,IAAI,CAAC,MAAM;AAC5D,EAAC;AAED,eAAeH,iBAAgB"}

package/src/lib/utils/member-continue.d.ts

@@ -0,0 +1,45 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Post-auth redirect target (AGL-553): the sign-in/up blocks honor a
+ * `continue` query parameter so gated pages can send visitors back where
+ * they came from. Open-redirect hardened — only same-origin RELATIVE paths
+ * pass.
+ *
+ * Delegates to {@link safeSameOriginPath} rather than testing the string's
+ * shape (AGL-1881). The character checks this used to carry — `//`, then `\`
+ * — were each correct and each incomplete: the URL parser strips tab, LF and
+ * CR before parsing, so `/<TAB>/evil.com` contains neither and still resolves
+ * off-site. The shared predicate resolves and compares origins, so it catches
+ * the forms nobody has enumerated yet.
+ */
+export declare function safeContinuePath(raw: string | null | undefined, fallback?: string): string;
+/** Reads + validates the `continue` param from the current location. */
+export declare function continuePathFromLocation(fallback?: string): string;
+/**
+ * Navigation seam for the member account doors.
+ *
+ * jsdom's `window.location` is not patchable, so a test that drives one of
+ * these forms cannot stub the redirect — it gets "Not implemented" thrown out
+ * of the handler instead, which aborts it partway and takes the analytics
+ * call above it with it. Every member block navigates through here so the
+ * destination stays assertable, and so the one place that leaves the site is
+ * the one place that resolves where to.
+ */
+export declare const memberNavigation: {
+    assign: (url: string) => void;
+};

package/src/lib/utils/member-continue.js

@@ -0,0 +1,49 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { safeSameOriginPath } from "@aglyn/shared-util-http/safe-redirect";
+/**
+ * Post-auth redirect target (AGL-553): the sign-in/up blocks honor a
+ * `continue` query parameter so gated pages can send visitors back where
+ * they came from. Open-redirect hardened — only same-origin RELATIVE paths
+ * pass.
+ *
+ * Delegates to {@link safeSameOriginPath} rather than testing the string's
+ * shape (AGL-1881). The character checks this used to carry — `//`, then `\`
+ * — were each correct and each incomplete: the URL parser strips tab, LF and
+ * CR before parsing, so `/<TAB>/evil.com` contains neither and still resolves
+ * off-site. The shared predicate resolves and compares origins, so it catches
+ * the forms nobody has enumerated yet.
+ */ export function safeContinuePath(raw, fallback = '/') {
+    return safeSameOriginPath(raw, fallback);
+}
+/** Reads + validates the `continue` param from the current location. */ export function continuePathFromLocation(fallback = '/') {
+    if (typeof window === 'undefined') return fallback;
+    return safeContinuePath(new URLSearchParams(window.location.search).get('continue'), fallback);
+}
+/**
+ * Navigation seam for the member account doors.
+ *
+ * jsdom's `window.location` is not patchable, so a test that drives one of
+ * these forms cannot stub the redirect — it gets "Not implemented" thrown out
+ * of the handler instead, which aborts it partway and takes the analytics
+ * call above it with it. Every member block navigates through here so the
+ * destination stays assertable, and so the one place that leaves the site is
+ * the one place that resolves where to.
+ */ export const memberNavigation = {
+    assign: (url)=>window.location.assign(url)
+};
+
+//# sourceMappingURL=member-continue.js.map

package/src/lib/utils/member-continue.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/utils/member-continue.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { safeSameOriginPath } from '@aglyn/shared-util-http/safe-redirect'\n\n/**\n * Post-auth redirect target (AGL-553): the sign-in/up blocks honor a\n * `continue` query parameter so gated pages can send visitors back where\n * they came from. Open-redirect hardened — only same-origin RELATIVE paths\n * pass.\n *\n * Delegates to {@link safeSameOriginPath} rather than testing the string's\n * shape (AGL-1881). The character checks this used to carry — `//`, then `\\`\n * — were each correct and each incomplete: the URL parser strips tab, LF and\n * CR before parsing, so `/<TAB>/evil.com` contains neither and still resolves\n * off-site. The shared predicate resolves and compares origins, so it catches\n * the forms nobody has enumerated yet.\n */\nexport function safeContinuePath(\n  raw: string | null | undefined,\n  fallback = '/',\n): string {\n  return safeSameOriginPath(raw, fallback)\n}\n\n/** Reads + validates the `continue` param from the current location. */\nexport function continuePathFromLocation(fallback = '/'): string {\n  if (typeof window === 'undefined') return fallback\n  return safeContinuePath(\n    new URLSearchParams(window.location.search).get('continue'),\n    fallback,\n  )\n}\n\n/**\n * Navigation seam for the member account doors.\n *\n * jsdom's `window.location` is not patchable, so a test that drives one of\n * these forms cannot stub the redirect — it gets \"Not implemented\" thrown out\n * of the handler instead, which aborts it partway and takes the analytics\n * call above it with it. Every member block navigates through here so the\n * destination stays assertable, and so the one place that leaves the site is\n * the one place that resolves where to.\n */\nexport const memberNavigation = {\n  assign: (url: string) => window.location.assign(url),\n}\n"],"names":["safeSameOriginPath","safeContinuePath","raw","fallback","continuePathFromLocation","window","URLSearchParams","location","search","get","memberNavigation","assign","url"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,kBAAkB,QAAQ,wCAAuC;AAE1E;;;;;;;;;;;;CAYC,GACD,OAAO,SAASC,iBACdC,GAA8B,EAC9BC,WAAW,GAAG;IAEd,OAAOH,mBAAmBE,KAAKC;AACjC;AAEA,sEAAsE,GACtE,OAAO,SAASC,yBAAyBD,WAAW,GAAG;IACrD,IAAI,OAAOE,WAAW,aAAa,OAAOF;IAC1C,OAAOF,iBACL,IAAIK,gBAAgBD,OAAOE,QAAQ,CAACC,MAAM,EAAEC,GAAG,CAAC,aAChDN;AAEJ;AAEA;;;;;;;;;CASC,GACD,OAAO,MAAMO,mBAAmB;IAC9BC,QAAQ,CAACC,MAAgBP,OAAOE,QAAQ,CAACI,MAAM,CAACC;AAClD,EAAC"}

package/src/lib/utils/use-storefront-purchase-event.d.ts

@@ -0,0 +1,60 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Report a completed storefront order to the MERCHANT's GA4 property
+ * (AGL-1641).
+ *
+ * ## Why this exists at all
+ *
+ * The commerce plugin instrumented `view_item`, `add_to_cart` and
+ * `begin_checkout` and then stopped. GA4's built-in ecommerce reports and the
+ * shopping-behaviour funnel are all terminated by `purchase`, so without it a
+ * merchant's property did not merely lack one number — it rendered an
+ * authoritative-looking 0% conversion rate and zero revenue. The console's own
+ * commerce analytics card meanwhile promised merchants that `purchase` already
+ * mirrored into their Google Analytics.
+ *
+ * ## Client-side, deliberately — the opposite of the call made for OUR revenue
+ *
+ * Aglyn's own `purchase` is sent server-side over the Measurement Protocol,
+ * because a lost hit there is lost revenue reporting on our books. This one is
+ * client-side, and the reasoning inverts with the consequence: server-side
+ * would require collecting, encrypting and supporting a per-host Measurement
+ * Protocol API secret we have nowhere to store, to buy accuracy against
+ * closed tabs and ad blockers that every storefront on the internet already
+ * accepts. For a merchant's product analytics that is the industry norm; for
+ * our revenue it would not have been.
+ *
+ * ## Where it fires
+ *
+ * On the page Stripe returns the shopper to, which is the page they left —
+ * there is no order-confirmation surface on a tenant storefront. That is the
+ * Cart for a cart checkout and the ProductDetail for a single-product buy,
+ * which is exactly why both call this hook.
+ *
+ * ## The two waits
+ *
+ * The order is written by the webhook, which can land AFTER the shopper is
+ * back, so the lookup retries. And `window.gtag` only exists once the visitor
+ * has granted analytics consent and the consent-gated script has loaded
+ * post-hydration, so the send waits for it — otherwise the event would be
+ * built correctly and dropped on the floor. Both waits are bounded; an
+ * ungranted visitor simply times out, which is the consent gate working.
+ */
+export declare function useStorefrontPurchaseEvent(hostId: string, 
+/** `Aglyn.useSiteFetch()`. A GET, so preview mode passes it straight through. */
+siteFetch?: typeof fetch): void;

package/src/lib/utils/use-storefront-purchase-event.js

@@ -0,0 +1,142 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { trackEvent } from "@aglyn/aglyn/app-utils/analytics-events";
+import { useEffect } from "react";
+import { buildStorefrontPurchaseParams } from "../model/purchase-analytics.js";
+/** How long to wait out the `checkout.session.completed` webhook. */ const MAX_ATTEMPTS = 8;
+const RETRY_MS = 1500;
+/** How long to wait for the consent-gated gtag script to exist. */ const GTAG_ATTEMPTS = 20;
+const GTAG_MS = 250;
+/**
+ * Once per browser session per order, across both mount points. `sessionStorage`
+ * survives the reload; the in-memory set covers a page carrying BOTH a Cart and
+ * a ProductDetail, which would otherwise race before either had written.
+ */ const reported = new Set();
+const STORAGE_PREFIX = 'aglyn:purchase-reported:';
+function alreadyReported(sessionId) {
+    if (reported.has(sessionId)) return true;
+    try {
+        return window.sessionStorage.getItem(STORAGE_PREFIX + sessionId) === '1';
+    } catch (unused) {
+        // Private mode / storage disabled. GA4's own de-duplication on
+        // `transaction_id` is the real guarantee; this is only the cheap half.
+        return false;
+    }
+}
+function markReported(sessionId) {
+    reported.add(sessionId);
+    try {
+        window.sessionStorage.setItem(STORAGE_PREFIX + sessionId, '1');
+    } catch (unused) {
+    /* see above */ }
+}
+const sleep = (ms)=>new Promise((resolve)=>setTimeout(resolve, ms));
+/**
+ * Report a completed storefront order to the MERCHANT's GA4 property
+ * (AGL-1641).
+ *
+ * ## Why this exists at all
+ *
+ * The commerce plugin instrumented `view_item`, `add_to_cart` and
+ * `begin_checkout` and then stopped. GA4's built-in ecommerce reports and the
+ * shopping-behaviour funnel are all terminated by `purchase`, so without it a
+ * merchant's property did not merely lack one number — it rendered an
+ * authoritative-looking 0% conversion rate and zero revenue. The console's own
+ * commerce analytics card meanwhile promised merchants that `purchase` already
+ * mirrored into their Google Analytics.
+ *
+ * ## Client-side, deliberately — the opposite of the call made for OUR revenue
+ *
+ * Aglyn's own `purchase` is sent server-side over the Measurement Protocol,
+ * because a lost hit there is lost revenue reporting on our books. This one is
+ * client-side, and the reasoning inverts with the consequence: server-side
+ * would require collecting, encrypting and supporting a per-host Measurement
+ * Protocol API secret we have nowhere to store, to buy accuracy against
+ * closed tabs and ad blockers that every storefront on the internet already
+ * accepts. For a merchant's product analytics that is the industry norm; for
+ * our revenue it would not have been.
+ *
+ * ## Where it fires
+ *
+ * On the page Stripe returns the shopper to, which is the page they left —
+ * there is no order-confirmation surface on a tenant storefront. That is the
+ * Cart for a cart checkout and the ProductDetail for a single-product buy,
+ * which is exactly why both call this hook.
+ *
+ * ## The two waits
+ *
+ * The order is written by the webhook, which can land AFTER the shopper is
+ * back, so the lookup retries. And `window.gtag` only exists once the visitor
+ * has granted analytics consent and the consent-gated script has loaded
+ * post-hydration, so the send waits for it — otherwise the event would be
+ * built correctly and dropped on the floor. Both waits are bounded; an
+ * ungranted visitor simply times out, which is the consent gate working.
+ */ export function useStorefrontPurchaseEvent(hostId, /** `Aglyn.useSiteFetch()`. A GET, so preview mode passes it straight through. */ siteFetch = fetch) {
+    useEffect(()=>{
+        var _params_get;
+        if (typeof window === 'undefined' || !hostId) return;
+        const params = new URLSearchParams(window.location.search);
+        if (params.get('order') !== 'success') return;
+        const sessionId = (_params_get = params.get('session_id')) != null ? _params_get : '';
+        if (!sessionId || alreadyReported(sessionId)) return;
+        let active = true;
+        // Claimed up front so a sibling mount in the same document cannot start a
+        // second poll for the same order. Persisted only once the hit is sent.
+        reported.add(sessionId);
+        void (async ()=>{
+            let source = null;
+            for(let attempt = 0; attempt < MAX_ATTEMPTS && active; attempt += 1){
+                try {
+                    const response = await siteFetch(`/api/commerce/order-analytics?hostId=${encodeURIComponent(hostId)}&sessionId=${encodeURIComponent(sessionId)}`);
+                    if (response.ok) {
+                        source = await response.json();
+                        break;
+                    }
+                    // 404 means the webhook has not written the order yet; anything
+                    // else is terminal and retrying it would only add load.
+                    if (response.status !== 404) return;
+                } catch (unused) {
+                // Network blip — treated like the race and retried.
+                }
+                await sleep(RETRY_MS);
+            }
+            if (!active || !source) return;
+            const purchase = buildStorefrontPurchaseParams(source);
+            if (!purchase) return;
+            // `trackEvent` no-ops when `window.gtag` is absent and never queues, so
+            // waiting for the tag IS the delivery mechanism here.
+            for(let attempt = 0; attempt < GTAG_ATTEMPTS && active; attempt += 1){
+                if (typeof window.gtag === 'function') {
+                    trackEvent('purchase', purchase);
+                    markReported(sessionId);
+                    return;
+                }
+                await sleep(GTAG_MS);
+            }
+        })();
+        return ()=>{
+            active = false;
+        };
+    // `siteFetch` is deliberately out of the dep list: it is a `useCallback`
+    // that changes identity on a preview toggle, and re-running this effect
+    // would restart a poll that has already claimed its session id.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [
+        hostId
+    ]);
+}
+
+//# sourceMappingURL=use-storefront-purchase-event.js.map

package/src/lib/utils/use-storefront-purchase-event.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/utils/use-storefront-purchase-event.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { trackEvent } from '@aglyn/aglyn/app-utils/analytics-events'\nimport { useEffect } from 'react'\nimport { buildStorefrontPurchaseParams } from '../model/purchase-analytics'\n\n/** How long to wait out the `checkout.session.completed` webhook. */\nconst MAX_ATTEMPTS = 8\nconst RETRY_MS = 1_500\n/** How long to wait for the consent-gated gtag script to exist. */\nconst GTAG_ATTEMPTS = 20\nconst GTAG_MS = 250\n\n/**\n * Once per browser session per order, across both mount points. `sessionStorage`\n * survives the reload; the in-memory set covers a page carrying BOTH a Cart and\n * a ProductDetail, which would otherwise race before either had written.\n */\nconst reported = new Set<string>()\nconst STORAGE_PREFIX = 'aglyn:purchase-reported:'\n\nfunction alreadyReported(sessionId: string): boolean {\n  if (reported.has(sessionId)) return true\n  try {\n    return window.sessionStorage.getItem(STORAGE_PREFIX + sessionId) === '1'\n  } catch {\n    // Private mode / storage disabled. GA4's own de-duplication on\n    // `transaction_id` is the real guarantee; this is only the cheap half.\n    return false\n  }\n}\n\nfunction markReported(sessionId: string): void {\n  reported.add(sessionId)\n  try {\n    window.sessionStorage.setItem(STORAGE_PREFIX + sessionId, '1')\n  } catch {\n    /* see above */\n  }\n}\n\nconst sleep = (ms: number) =>\n  new Promise<void>((resolve) => setTimeout(resolve, ms))\n\n/**\n * Report a completed storefront order to the MERCHANT's GA4 property\n * (AGL-1641).\n *\n * ## Why this exists at all\n *\n * The commerce plugin instrumented `view_item`, `add_to_cart` and\n * `begin_checkout` and then stopped. GA4's built-in ecommerce reports and the\n * shopping-behaviour funnel are all terminated by `purchase`, so without it a\n * merchant's property did not merely lack one number — it rendered an\n * authoritative-looking 0% conversion rate and zero revenue. The console's own\n * commerce analytics card meanwhile promised merchants that `purchase` already\n * mirrored into their Google Analytics.\n *\n * ## Client-side, deliberately — the opposite of the call made for OUR revenue\n *\n * Aglyn's own `purchase` is sent server-side over the Measurement Protocol,\n * because a lost hit there is lost revenue reporting on our books. This one is\n * client-side, and the reasoning inverts with the consequence: server-side\n * would require collecting, encrypting and supporting a per-host Measurement\n * Protocol API secret we have nowhere to store, to buy accuracy against\n * closed tabs and ad blockers that every storefront on the internet already\n * accepts. For a merchant's product analytics that is the industry norm; for\n * our revenue it would not have been.\n *\n * ## Where it fires\n *\n * On the page Stripe returns the shopper to, which is the page they left —\n * there is no order-confirmation surface on a tenant storefront. That is the\n * Cart for a cart checkout and the ProductDetail for a single-product buy,\n * which is exactly why both call this hook.\n *\n * ## The two waits\n *\n * The order is written by the webhook, which can land AFTER the shopper is\n * back, so the lookup retries. And `window.gtag` only exists once the visitor\n * has granted analytics consent and the consent-gated script has loaded\n * post-hydration, so the send waits for it — otherwise the event would be\n * built correctly and dropped on the floor. Both waits are bounded; an\n * ungranted visitor simply times out, which is the consent gate working.\n */\nexport function useStorefrontPurchaseEvent(\n  hostId: string,\n  /** `Aglyn.useSiteFetch()`. A GET, so preview mode passes it straight through. */\n  siteFetch: typeof fetch = fetch,\n): void {\n  useEffect(() => {\n    if (typeof window === 'undefined' || !hostId) return\n\n    const params = new URLSearchParams(window.location.search)\n    if (params.get('order') !== 'success') return\n    const sessionId = params.get('session_id') ?? ''\n    if (!sessionId || alreadyReported(sessionId)) return\n\n    let active = true\n    // Claimed up front so a sibling mount in the same document cannot start a\n    // second poll for the same order. Persisted only once the hit is sent.\n    reported.add(sessionId)\n\n    void (async () => {\n      let source: Parameters<typeof buildStorefrontPurchaseParams>[0] | null =\n        null\n      for (let attempt = 0; attempt < MAX_ATTEMPTS && active; attempt += 1) {\n        try {\n          const response = await siteFetch(\n            `/api/commerce/order-analytics?hostId=${encodeURIComponent(\n              hostId,\n            )}&sessionId=${encodeURIComponent(sessionId)}`,\n          )\n          if (response.ok) {\n            source = await response.json()\n            break\n          }\n          // 404 means the webhook has not written the order yet; anything\n          // else is terminal and retrying it would only add load.\n          if (response.status !== 404) return\n        } catch {\n          // Network blip — treated like the race and retried.\n        }\n        await sleep(RETRY_MS)\n      }\n      if (!active || !source) return\n\n      const purchase = buildStorefrontPurchaseParams(source)\n      if (!purchase) return\n\n      // `trackEvent` no-ops when `window.gtag` is absent and never queues, so\n      // waiting for the tag IS the delivery mechanism here.\n      for (let attempt = 0; attempt < GTAG_ATTEMPTS && active; attempt += 1) {\n        if (typeof (window as any).gtag === 'function') {\n          trackEvent('purchase', purchase)\n          markReported(sessionId)\n          return\n        }\n        await sleep(GTAG_MS)\n      }\n    })()\n\n    return () => {\n      active = false\n    }\n    // `siteFetch` is deliberately out of the dep list: it is a `useCallback`\n    // that changes identity on a preview toggle, and re-running this effect\n    // would restart a poll that has already claimed its session id.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [hostId])\n}\n"],"names":["trackEvent","useEffect","buildStorefrontPurchaseParams","MAX_ATTEMPTS","RETRY_MS","GTAG_ATTEMPTS","GTAG_MS","reported","Set","STORAGE_PREFIX","alreadyReported","sessionId","has","window","sessionStorage","getItem","markReported","add","setItem","sleep","ms","Promise","resolve","setTimeout","useStorefrontPurchaseEvent","hostId","siteFetch","fetch","params","URLSearchParams","location","search","get","active","source","attempt","response","encodeURIComponent","ok","json","status","purchase","gtag"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,UAAU,QAAQ,0CAAyC;AACpE,SAASC,SAAS,QAAQ,QAAO;AACjC,SAASC,6BAA6B,QAAQ,iCAA6B;AAE3E,mEAAmE,GACnE,MAAMC,eAAe;AACrB,MAAMC,WAAW;AACjB,iEAAiE,GACjE,MAAMC,gBAAgB;AACtB,MAAMC,UAAU;AAEhB;;;;CAIC,GACD,MAAMC,WAAW,IAAIC;AACrB,MAAMC,iBAAiB;AAEvB,SAASC,gBAAgBC,SAAiB;IACxC,IAAIJ,SAASK,GAAG,CAACD,YAAY,OAAO;IACpC,IAAI;QACF,OAAOE,OAAOC,cAAc,CAACC,OAAO,CAACN,iBAAiBE,eAAe;IACvE,EAAE,eAAM;QACN,+DAA+D;QAC/D,uEAAuE;QACvE,OAAO;IACT;AACF;AAEA,SAASK,aAAaL,SAAiB;IACrCJ,SAASU,GAAG,CAACN;IACb,IAAI;QACFE,OAAOC,cAAc,CAACI,OAAO,CAACT,iBAAiBE,WAAW;IAC5D,EAAE,eAAM;IACN,aAAa,GACf;AACF;AAEA,MAAMQ,QAAQ,CAACC,KACb,IAAIC,QAAc,CAACC,UAAYC,WAAWD,SAASF;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCC,GACD,OAAO,SAASI,2BACdC,MAAc,EACd,+EAA+E,GAC/EC,YAA0BC,KAAK;IAE/B1B,UAAU;YAKU2B;QAJlB,IAAI,OAAOf,WAAW,eAAe,CAACY,QAAQ;QAE9C,MAAMG,SAAS,IAAIC,gBAAgBhB,OAAOiB,QAAQ,CAACC,MAAM;QACzD,IAAIH,OAAOI,GAAG,CAAC,aAAa,WAAW;QACvC,MAAMrB,aAAYiB,cAAAA,OAAOI,GAAG,CAAC,yBAAXJ,cAA4B;QAC9C,IAAI,CAACjB,aAAaD,gBAAgBC,YAAY;QAE9C,IAAIsB,SAAS;QACb,0EAA0E;QAC1E,uEAAuE;QACvE1B,SAASU,GAAG,CAACN;QAEb,KAAK,AAAC,CAAA;YACJ,IAAIuB,SACF;YACF,IAAK,IAAIC,UAAU,GAAGA,UAAUhC,gBAAgB8B,QAAQE,WAAW,EAAG;gBACpE,IAAI;oBACF,MAAMC,WAAW,MAAMV,UACrB,CAAC,qCAAqC,EAAEW,mBACtCZ,QACA,WAAW,EAAEY,mBAAmB1B,YAAY;oBAEhD,IAAIyB,SAASE,EAAE,EAAE;wBACfJ,SAAS,MAAME,SAASG,IAAI;wBAC5B;oBACF;oBACA,gEAAgE;oBAChE,wDAAwD;oBACxD,IAAIH,SAASI,MAAM,KAAK,KAAK;gBAC/B,EAAE,eAAM;gBACN,oDAAoD;gBACtD;gBACA,MAAMrB,MAAMf;YACd;YACA,IAAI,CAAC6B,UAAU,CAACC,QAAQ;YAExB,MAAMO,WAAWvC,8BAA8BgC;YAC/C,IAAI,CAACO,UAAU;YAEf,wEAAwE;YACxE,sDAAsD;YACtD,IAAK,IAAIN,UAAU,GAAGA,UAAU9B,iBAAiB4B,QAAQE,WAAW,EAAG;gBACrE,IAAI,OAAO,AAACtB,OAAe6B,IAAI,KAAK,YAAY;oBAC9C1C,WAAW,YAAYyC;oBACvBzB,aAAaL;oBACb;gBACF;gBACA,MAAMQ,MAAMb;YACd;QACF,CAAA;QAEA,OAAO;YACL2B,SAAS;QACX;IACA,yEAAyE;IACzE,wEAAwE;IACxE,gEAAgE;IAChE,uDAAuD;IACzD,GAAG;QAACR;KAAO;AACb"}