@aglyn/plugins-commerce 1.0.0-beta.143

package/src/lib/components/storefront-payment-element.js

@@ -0,0 +1,156 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ 'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { CheckoutProvider, PaymentElement, useCheckout } from "@stripe/react-stripe-js";
+// `/pure` deliberately, not the bare entry (AGL-2486). The bare entry ends
+// with a module-scope `Promise.resolve().then(() => getStripePromise())`,
+// so merely EVALUATING it injects the js.stripe.com/v3 script tag —
+// 249 KB gzipped — on any page that reaches this module, whether or not
+// `loadStripe` is ever called. `/pure` is the same API without that
+// statement, so the script is fetched when we ask for it and not before.
+import { loadStripe } from "@stripe/stripe-js/pure";
+import Alert from "@mui/material/Alert";
+import Box from "@mui/material/Box";
+import Button from "@mui/material/Button";
+import { useCallback, useMemo, useState } from "react";
+/**
+ * `loadStripe` injects a script tag, so it is memoized per key rather than
+ * called per render. Keyed because a page could in principle mount this for
+ * two different merchants; in practice it is one, and the map costs nothing.
+ */ const stripePromises = new Map();
+function getStripe(publishableKey) {
+    if (!publishableKey) return null;
+    let promise = stripePromises.get(publishableKey);
+    if (!promise) {
+        promise = loadStripe(publishableKey);
+        stripePromises.set(publishableKey, promise);
+    }
+    return promise;
+}
+/** Test seam: `loadStripe` caches per key across a file's tests otherwise. */ export function __resetStripePromises() {
+    stripePromises.clear();
+}
+function PaymentForm({ payLabel, onCancel }) {
+    const checkout = useCheckout();
+    const [status, setStatus] = useState('idle');
+    const [message, setMessage] = useState('');
+    const handlePay = useCallback(async ()=>{
+        // Guarded rather than merely disabled: a disabled button is a rendering
+        // fact, and a keyboard or a slow re-render can still land a second call
+        // during a 3DS challenge.
+        if (status === 'confirming') return;
+        setStatus('confirming');
+        setMessage('');
+        try {
+            const result = await checkout.confirm();
+            if ((result == null ? void 0 : result.type) === 'error') {
+                var _ref;
+                var _result_error;
+                // A decline, an expired card, an incomplete field. Recoverable: the
+                // form stays mounted with everything the shopper typed still in it.
+                setMessage(String((_ref = (_result_error = result.error) == null ? void 0 : _result_error.message) != null ? _ref : '') || 'That payment could not be completed. Try another card.');
+                setStatus('error');
+                return;
+            }
+        // Success does NOT mean fulfilled, and nothing is reported to our server
+        // here. Stripe redirects to the `return_url` the session carries; if it
+        // has not by the time this resolves, the confirm is still in flight and
+        // the button stays disabled rather than inviting a second attempt.
+        } catch (unused) {
+            setMessage('That payment could not be completed. Try another card.');
+            setStatus('error');
+        }
+    }, [
+        checkout,
+        status
+    ]);
+    return /*#__PURE__*/ _jsxs(Box, {
+        sx: {
+            display: 'flex',
+            flexDirection: 'column',
+            gap: 2
+        },
+        children: [
+            /*#__PURE__*/ _jsx(PaymentElement, {}),
+            message ? // `error` severity is right here and wrong for a lockdown pause — this
+            // really is "your payment did not go through", which is the one thing
+            // a shopper must be told plainly.
+            /*#__PURE__*/ _jsx(Alert, {
+                severity: "error",
+                role: "alert",
+                children: message
+            }) : null,
+            /*#__PURE__*/ _jsxs(Box, {
+                sx: {
+                    display: 'flex',
+                    gap: 1
+                },
+                children: [
+                    /*#__PURE__*/ _jsx(Button, {
+                        variant: "contained",
+                        onClick: handlePay,
+                        disabled: status === 'confirming',
+                        fullWidth: true,
+                        children: status === 'confirming' ? 'Paying…' : payLabel || 'Pay now'
+                    }),
+                    onCancel ? /*#__PURE__*/ _jsx(Button, {
+                        variant: "text",
+                        onClick: onCancel,
+                        disabled: status === 'confirming',
+                        children: 'Cancel'
+                    }) : null
+                ]
+            })
+        ]
+    });
+}
+export function StorefrontPaymentElement({ clientSecret, publishableKey, payLabel, onCancel }) {
+    const stripe = useMemo(()=>getStripe(publishableKey), [
+        publishableKey
+    ]);
+    // Belt and braces with the server's own gate, which already refuses native
+    // mode without a publishable key: rendering nothing beats rendering an empty
+    // white box that looks like a broken payment form.
+    if (!clientSecret || !stripe) return null;
+    return /*#__PURE__*/ _jsx(CheckoutProvider, {
+        stripe: stripe,
+        options: {
+            clientSecret
+        },
+        children: /*#__PURE__*/ _jsx(Box, {
+            sx: {
+                py: 2
+            },
+            "data-testid": "storefront-payment-element",
+            children: /*#__PURE__*/ _jsx(PaymentForm, {
+                payLabel: payLabel,
+                onCancel: onCancel
+            })
+        })
+    });
+}
+/**
+ * Re-exported so the old import path still resolves, but the definition now
+ * lives in its own module (AGL-2486): a fallback imported FROM the lazily
+ * loaded module drags that module into the eager bundle and cancels the
+ * `lazy()`. Callers must import it from `./storefront-payment-element-fallback`
+ * — importing it from here is exactly the bug, and re-exporting it does not
+ * make that safe.
+ */ export { StorefrontPaymentElementFallback } from "./storefront-payment-element-fallback.js";
+export default StorefrontPaymentElement;
+
+//# sourceMappingURL=storefront-payment-element.js.map

package/src/lib/components/storefront-payment-element.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/components/storefront-payment-element.tsx"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n'use client'\n\nimport { CheckoutProvider, PaymentElement, useCheckout } from '@stripe/react-stripe-js'\n// `/pure` deliberately, not the bare entry (AGL-2486). The bare entry ends\n// with a module-scope `Promise.resolve().then(() => getStripePromise())`,\n// so merely EVALUATING it injects the js.stripe.com/v3 script tag —\n// 249 KB gzipped — on any page that reaches this module, whether or not\n// `loadStripe` is ever called. `/pure` is the same API without that\n// statement, so the script is fetched when we ask for it and not before.\nimport { loadStripe } from '@stripe/stripe-js/pure'\n// The TYPE only, and from the bare entry because `/pure` does not re-export\n// it. `import type` is erased entirely at compile time, so this adds no\n// runtime import and cannot re-introduce the script injection above.\nimport type { Stripe } from '@stripe/stripe-js'\nimport Alert from '@mui/material/Alert'\nimport Box from '@mui/material/Box'\nimport Button from '@mui/material/Button'\nimport { useCallback, useMemo, useState } from 'react'\n\n/**\n * The storefront Payment Element (AGL-1944) — the shopper pays on the\n * merchant's own domain instead of being sent to `checkout.stripe.com`.\n *\n * ## THIS COMPONENT DOES NOT FULFIL ANYTHING\n *\n * It has no success callback, and that absence is the design rather than an\n * omission. `libs/plugins/commerce/src/lib/server/billing-webhook.ts` creates\n * the order on `checkout.session.completed` and is the only thing that ever\n * does. An in-page flow makes trusting the browser far more tempting than a\n * redirect does — the form is right there, `confirm()` resolves in hand, and\n * posting \"done, please fulfil\" is one line away — and the browser is the one\n * participant in a payment that can lie about having paid.\n *\n * It is also the participant that can VANISH. A shopper who confirms and\n * closes the tab never runs a callback, so a flow that fulfils here loses the\n * order outright while keeping the money; a shopper who refreshes the return\n * page runs it twice. Neither is reachable from a design with no callback in\n * it. What happens after a successful confirm is a redirect to `return_url`,\n * carrying the `session_id` the server put there — so the page can SHOW the\n * shopper a result by looking the order up, without being TOLD the outcome by\n * this code.\n *\n * ## Declines and 3DS\n *\n * Both were handled for us by the redirect and now have to be handled here.\n *\n * A decline resolves as `{ type: 'error' }` and is rendered inline WITHOUT\n * unmounting the form: the shopper's basket, address and chosen method are all\n * still on screen and they can try another card. That is the whole difference\n * between a recoverable decline and a dead end, and it is why the error state\n * below sits beside the element rather than replacing it.\n *\n * A 3DS challenge is Stripe's own: `confirm()` presents the challenge and, for\n * redirect-based methods, sends the browser to `return_url` and back. Nothing\n * here has to model it — but the button must stay disabled across the whole\n * await, because a second `confirm()` during a challenge is exactly the\n * double-submit the server's idempotency claim exists to survive and there is\n * no reason to make it lean on that.\n */\n\nexport interface StorefrontPaymentElementProps {\n  /** Stripe's instruction to the browser. Not a claim that money moved. */\n  clientSecret: string\n  publishableKey: string\n  /** Shown on the pay button, so the merchant's own total reads through. */\n  payLabel?: string\n  /** Abandon the in-page form and return to the store. */\n  onCancel?: () => void\n}\n\n/**\n * `loadStripe` injects a script tag, so it is memoized per key rather than\n * called per render. Keyed because a page could in principle mount this for\n * two different merchants; in practice it is one, and the map costs nothing.\n */\nconst stripePromises = new Map<string, Promise<Stripe | null>>()\nfunction getStripe(publishableKey: string): Promise<Stripe | null> | null {\n  if (!publishableKey) return null\n  let promise = stripePromises.get(publishableKey)\n  if (!promise) {\n    promise = loadStripe(publishableKey)\n    stripePromises.set(publishableKey, promise)\n  }\n  return promise\n}\n\n/** Test seam: `loadStripe` caches per key across a file's tests otherwise. */\nexport function __resetStripePromises(): void {\n  stripePromises.clear()\n}\n\nfunction PaymentForm({\n  payLabel,\n  onCancel,\n}: Pick<StorefrontPaymentElementProps, 'payLabel' | 'onCancel'>) {\n  const checkout = useCheckout()\n  const [status, setStatus] = useState<'idle' | 'confirming' | 'error'>('idle')\n  const [message, setMessage] = useState('')\n\n  const handlePay = useCallback(async () => {\n    // Guarded rather than merely disabled: a disabled button is a rendering\n    // fact, and a keyboard or a slow re-render can still land a second call\n    // during a 3DS challenge.\n    if (status === 'confirming') return\n    setStatus('confirming')\n    setMessage('')\n    try {\n      const result = await checkout.confirm()\n      if (result?.type === 'error') {\n        // A decline, an expired card, an incomplete field. Recoverable: the\n        // form stays mounted with everything the shopper typed still in it.\n        setMessage(\n          String(result.error?.message ?? '') ||\n            'That payment could not be completed. Try another card.',\n        )\n        setStatus('error')\n        return\n      }\n      // Success does NOT mean fulfilled, and nothing is reported to our server\n      // here. Stripe redirects to the `return_url` the session carries; if it\n      // has not by the time this resolves, the confirm is still in flight and\n      // the button stays disabled rather than inviting a second attempt.\n    } catch {\n      setMessage('That payment could not be completed. Try another card.')\n      setStatus('error')\n    }\n  }, [checkout, status])\n\n  return (\n    <Box sx={{ display: 'flex', flexDirection: 'column', gap: 2 }}>\n      <PaymentElement />\n      {message ? (\n        // `error` severity is right here and wrong for a lockdown pause — this\n        // really is \"your payment did not go through\", which is the one thing\n        // a shopper must be told plainly.\n        <Alert severity=\"error\" role=\"alert\">\n          {message}\n        </Alert>\n      ) : null}\n      <Box sx={{ display: 'flex', gap: 1 }}>\n        <Button\n          variant=\"contained\"\n          onClick={handlePay}\n          disabled={status === 'confirming'}\n          fullWidth\n        >\n          {status === 'confirming' ? 'Paying…' : payLabel || 'Pay now'}\n        </Button>\n        {onCancel ? (\n          <Button\n            variant=\"text\"\n            onClick={onCancel}\n            disabled={status === 'confirming'}\n          >\n            {'Cancel'}\n          </Button>\n        ) : null}\n      </Box>\n    </Box>\n  )\n}\n\nexport function StorefrontPaymentElement({\n  clientSecret,\n  publishableKey,\n  payLabel,\n  onCancel,\n}: StorefrontPaymentElementProps) {\n  const stripe = useMemo(() => getStripe(publishableKey), [publishableKey])\n  // Belt and braces with the server's own gate, which already refuses native\n  // mode without a publishable key: rendering nothing beats rendering an empty\n  // white box that looks like a broken payment form.\n  if (!clientSecret || !stripe) return null\n  return (\n    <CheckoutProvider stripe={stripe} options={{ clientSecret }}>\n      <Box sx={{ py: 2 }} data-testid=\"storefront-payment-element\">\n        <PaymentForm payLabel={payLabel} onCancel={onCancel} />\n      </Box>\n    </CheckoutProvider>\n  )\n}\n\n/**\n * Re-exported so the old import path still resolves, but the definition now\n * lives in its own module (AGL-2486): a fallback imported FROM the lazily\n * loaded module drags that module into the eager bundle and cancels the\n * `lazy()`. Callers must import it from `./storefront-payment-element-fallback`\n * — importing it from here is exactly the bug, and re-exporting it does not\n * make that safe.\n */\nexport { StorefrontPaymentElementFallback } from './storefront-payment-element-fallback'\n\nexport default StorefrontPaymentElement\n"],"names":["CheckoutProvider","PaymentElement","useCheckout","loadStripe","Alert","Box","Button","useCallback","useMemo","useState","stripePromises","Map","getStripe","publishableKey","promise","get","set","__resetStripePromises","clear","PaymentForm","payLabel","onCancel","checkout","status","setStatus","message","setMessage","handlePay","result","confirm","type","String","error","sx","display","flexDirection","gap","severity","role","variant","onClick","disabled","fullWidth","StorefrontPaymentElement","clientSecret","stripe","options","py","data-testid","StorefrontPaymentElementFallback"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;AAEA,SAASA,gBAAgB,EAAEC,cAAc,EAAEC,WAAW,QAAQ,0BAAyB;AACvF,2EAA2E;AAC3E,0EAA0E;AAC1E,oEAAoE;AACpE,wEAAwE;AACxE,oEAAoE;AACpE,yEAAyE;AACzE,SAASC,UAAU,QAAQ,yBAAwB;AAKnD,OAAOC,WAAW,sBAAqB;AACvC,OAAOC,SAAS,oBAAmB;AACnC,OAAOC,YAAY,uBAAsB;AACzC,SAASC,WAAW,EAAEC,OAAO,EAAEC,QAAQ,QAAQ,QAAO;AAqDtD;;;;CAIC,GACD,MAAMC,iBAAiB,IAAIC;AAC3B,SAASC,UAAUC,cAAsB;IACvC,IAAI,CAACA,gBAAgB,OAAO;IAC5B,IAAIC,UAAUJ,eAAeK,GAAG,CAACF;IACjC,IAAI,CAACC,SAAS;QACZA,UAAUX,WAAWU;QACrBH,eAAeM,GAAG,CAACH,gBAAgBC;IACrC;IACA,OAAOA;AACT;AAEA,4EAA4E,GAC5E,OAAO,SAASG;IACdP,eAAeQ,KAAK;AACtB;AAEA,SAASC,YAAY,EACnBC,QAAQ,EACRC,QAAQ,EACqD;IAC7D,MAAMC,WAAWpB;IACjB,MAAM,CAACqB,QAAQC,UAAU,GAAGf,SAA0C;IACtE,MAAM,CAACgB,SAASC,WAAW,GAAGjB,SAAS;IAEvC,MAAMkB,YAAYpB,YAAY;QAC5B,wEAAwE;QACxE,wEAAwE;QACxE,0BAA0B;QAC1B,IAAIgB,WAAW,cAAc;QAC7BC,UAAU;QACVE,WAAW;QACX,IAAI;YACF,MAAME,SAAS,MAAMN,SAASO,OAAO;YACrC,IAAID,CAAAA,0BAAAA,OAAQE,IAAI,MAAK,SAAS;;oBAInBF;gBAHT,oEAAoE;gBACpE,oEAAoE;gBACpEF,WACEK,gBAAOH,gBAAAA,OAAOI,KAAK,qBAAZJ,cAAcH,OAAO,mBAAI,OAC9B;gBAEJD,UAAU;gBACV;YACF;QACA,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,mEAAmE;QACrE,EAAE,eAAM;YACNE,WAAW;YACXF,UAAU;QACZ;IACF,GAAG;QAACF;QAAUC;KAAO;IAErB,qBACE,MAAClB;QAAI4B,IAAI;YAAEC,SAAS;YAAQC,eAAe;YAAUC,KAAK;QAAE;;0BAC1D,KAACnC;YACAwB,UACC,uEAAuE;YACvE,sEAAsE;YACtE,kCAAkC;0BAClC,KAACrB;gBAAMiC,UAAS;gBAAQC,MAAK;0BAC1Bb;iBAED;0BACJ,MAACpB;gBAAI4B,IAAI;oBAAEC,SAAS;oBAAQE,KAAK;gBAAE;;kCACjC,KAAC9B;wBACCiC,SAAQ;wBACRC,SAASb;wBACTc,UAAUlB,WAAW;wBACrBmB,SAAS;kCAERnB,WAAW,eAAe,YAAYH,YAAY;;oBAEpDC,yBACC,KAACf;wBACCiC,SAAQ;wBACRC,SAASnB;wBACToB,UAAUlB,WAAW;kCAEpB;yBAED;;;;;AAIZ;AAEA,OAAO,SAASoB,yBAAyB,EACvCC,YAAY,EACZ/B,cAAc,EACdO,QAAQ,EACRC,QAAQ,EACsB;IAC9B,MAAMwB,SAASrC,QAAQ,IAAMI,UAAUC,iBAAiB;QAACA;KAAe;IACxE,2EAA2E;IAC3E,6EAA6E;IAC7E,mDAAmD;IACnD,IAAI,CAAC+B,gBAAgB,CAACC,QAAQ,OAAO;IACrC,qBACE,KAAC7C;QAAiB6C,QAAQA;QAAQC,SAAS;YAAEF;QAAa;kBACxD,cAAA,KAACvC;YAAI4B,IAAI;gBAAEc,IAAI;YAAE;YAAGC,eAAY;sBAC9B,cAAA,KAAC7B;gBAAYC,UAAUA;gBAAUC,UAAUA;;;;AAInD;AAEA;;;;;;;CAOC,GACD,SAAS4B,gCAAgC,QAAQ,2CAAuC;AAExF,eAAeN,yBAAwB"}

package/src/lib/components/wishlist.d.ts

@@ -0,0 +1,46 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import * as Aglyn from '@aglyn/aglyn';
+export declare const ID: Aglyn.ComponentId;
+export declare const WISHLIST_UPDATED_EVENT = "aglyn:wishlist-updated";
+/** Guest wishlist ids from localStorage. */
+export declare function readLocalWishlist(hostId: string): string[];
+/**
+ * Toggles a product on the wishlist (AGL-297): members persist on their
+ * doc (guest list merges in on first signed-in call); guests persist in
+ * localStorage. Returns whether the product is on the list afterward.
+ *
+ * Takes its own `fetch` (AGL-1139). This is a plain module function, not a
+ * component, so it cannot read the site context that says whether it is
+ * running in Preview — and both callers are components that can. Defaulting
+ * to the global keeps every other caller unchanged; passing `useSiteFetch()`
+ * is what stops a preview click from writing to a real member's wishlist.
+ */
+export declare function toggleWishlist(hostId: string, productId: string, siteFetch?: typeof fetch): Promise<boolean>;
+export interface WishlistProps {
+    heading?: string;
+    emptyText?: string;
+}
+/**
+ * Wishlist block (AGL-297): renders the saved products (member doc when
+ * signed in — merging any guest list — else localStorage) as cards
+ * linking to their PDPs, with remove buttons.
+ */
+declare const Wishlist: import("react").ForwardRefExoticComponent<WishlistProps & import("react").RefAttributes<HTMLDivElement>>;
+export declare const schema: Aglyn.ComponentSchema<WishlistProps>;
+export declare const presets: Aglyn.PresetSchema[];
+export default Wishlist;

package/src/lib/components/wishlist.js

@@ -0,0 +1,304 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { _ as _object_without_properties_loose } from "@swc/helpers/_/_object_without_properties_loose";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import * as Aglyn from "@aglyn/aglyn";
+import { mdiHeartOutline } from "@aglyn/shared-data-mdi";
+import Box from "@mui/material/Box";
+import Button from "@mui/material/Button";
+import Card from "@mui/material/Card";
+import CardActionArea from "@mui/material/CardActionArea";
+import CardContent from "@mui/material/CardContent";
+import CardMedia from "@mui/material/CardMedia";
+import Typography from "@mui/material/Typography";
+import { forwardRef, useCallback, useEffect, useState } from "react";
+import { BUNDLE_ID } from "../constants/bundle-common.js";
+import { generatePresetId } from "../utils/generate-preset-id.js";
+// Component ids are persisted in screen documents; never rename.
+export const ID = 'wishlist';
+export const WISHLIST_UPDATED_EVENT = 'aglyn:wishlist-updated';
+function storageKey(hostId) {
+    return `aglyn_wishlist_${hostId}`;
+}
+/** Guest wishlist ids from localStorage. */ export function readLocalWishlist(hostId) {
+    try {
+        const raw = window.localStorage.getItem(storageKey(hostId));
+        return raw ? JSON.parse(raw).slice(0, 200) : [];
+    } catch (unused) {
+        return [];
+    }
+}
+function writeLocalWishlist(hostId, productIds) {
+    try {
+        window.localStorage.setItem(storageKey(hostId), JSON.stringify(productIds.slice(0, 200)));
+    } catch (unused) {
+    // Private-mode storage failures degrade to session-only behavior.
+    }
+}
+/**
+ * Toggles a product on the wishlist (AGL-297): members persist on their
+ * doc (guest list merges in on first signed-in call); guests persist in
+ * localStorage. Returns whether the product is on the list afterward.
+ *
+ * Takes its own `fetch` (AGL-1139). This is a plain module function, not a
+ * component, so it cannot read the site context that says whether it is
+ * running in Preview — and both callers are components that can. Defaulting
+ * to the global keeps every other caller unchanged; passing `useSiteFetch()`
+ * is what stops a preview click from writing to a real member's wishlist.
+ */ export async function toggleWishlist(hostId, productId, siteFetch = fetch) {
+    const local = readLocalWishlist(hostId);
+    const has = local.includes(productId);
+    const next = has ? local.filter((id)=>id !== productId) : [
+        ...local,
+        productId
+    ];
+    writeLocalWishlist(hostId, next);
+    // Best-effort member sync — 401 just means guest.
+    void siteFetch('/api/membership/wishlist', {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json'
+        },
+        body: JSON.stringify({
+            hostId,
+            action: has ? 'remove' : 'add',
+            productId
+        })
+    }).catch(()=>undefined);
+    window.dispatchEvent(new Event(WISHLIST_UPDATED_EVENT));
+    return !has;
+}
+/**
+ * Wishlist block (AGL-297): renders the saved products (member doc when
+ * signed in — merging any guest list — else localStorage) as cards
+ * linking to their PDPs, with remove buttons.
+ */ const Wishlist = /*#__PURE__*/ forwardRef((props, ref)=>{
+    const { heading, emptyText } = props, rest = _object_without_properties_loose(props, [
+        "heading",
+        "emptyText"
+    ]);
+    // Node styles ride the renderer-merged sx; recompose (stack.ts pattern).
+    const nodeSx = Array.isArray(props['sx']) ? props['sx'] : [
+        props['sx']
+    ];
+    const { hostId } = Aglyn.useSite();
+    const siteFetch = Aglyn.useSiteFetch();
+    const [items, setItems] = useState(null);
+    const refresh = useCallback(async ()=>{
+        if (!hostId) return;
+        let productIds = readLocalWishlist(hostId);
+        try {
+            // Merge the guest list into the member doc; response is canonical.
+            const response = await siteFetch('/api/membership/wishlist', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json'
+                },
+                body: JSON.stringify({
+                    hostId,
+                    action: 'merge',
+                    productIds
+                })
+            });
+            if (response.ok) {
+                var _ref;
+                const payload = await response.json();
+                productIds = (_ref = payload == null ? void 0 : payload.productIds) != null ? _ref : productIds;
+                writeLocalWishlist(hostId, productIds);
+            }
+        } catch (unused) {
+        // Guest path.
+        }
+        if (productIds.length === 0) return setItems([]);
+        try {
+            var _ref1;
+            const response = await fetch(`/api/commerce/catalog?hostId=${encodeURIComponent(hostId)}` + `&ids=${encodeURIComponent(productIds.join(','))}&limit=100`);
+            const payload = await response.json();
+            setItems((_ref1 = payload == null ? void 0 : payload.items) != null ? _ref1 : []);
+        } catch (unused) {
+            setItems([]);
+        }
+    }, [
+        hostId,
+        siteFetch
+    ]);
+    useEffect(()=>{
+        void refresh();
+        const handler = ()=>void refresh();
+        window.addEventListener(WISHLIST_UPDATED_EVENT, handler);
+        return ()=>window.removeEventListener(WISHLIST_UPDATED_EVENT, handler);
+    }, [
+        refresh
+    ]);
+    if (!hostId) {
+        return /*#__PURE__*/ _jsx(Box, _extends({
+            ref: ref
+        }, rest, {
+            sx: [
+                {
+                    p: 3,
+                    border: '1px dashed',
+                    borderColor: 'divider',
+                    borderRadius: 1,
+                    color: 'text.secondary',
+                    fontSize: 13,
+                    fontFamily: 'system-ui, sans-serif'
+                },
+                ...nodeSx
+            ],
+            children: 'Wishlist — saved products render here'
+        }));
+    }
+    return /*#__PURE__*/ _jsxs(Box, _extends({
+        ref: ref
+    }, rest, {
+        children: [
+            heading ? /*#__PURE__*/ _jsx(Typography, {
+                variant: "h5",
+                gutterBottom: true,
+                children: heading
+            }) : null,
+            items && items.length === 0 ? /*#__PURE__*/ _jsx(Typography, {
+                variant: "body2",
+                color: "text.secondary",
+                children: emptyText || 'Nothing saved yet — tap the heart on any product.'
+            }) : /*#__PURE__*/ _jsx(Box, {
+                sx: {
+                    display: 'grid',
+                    gap: 2,
+                    gridTemplateColumns: {
+                        xs: 'repeat(2, 1fr)',
+                        md: 'repeat(4, 1fr)'
+                    }
+                },
+                children: (items != null ? items : []).map((item)=>{
+                    // AGL-1726: resolved BEFORE the guard — see the note in
+                    // `product-detail.tsx`.
+                    const imageUrl = Aglyn.siteRelativeMediaSrc(item.imageUrl, {
+                        hostId
+                    });
+                    return /*#__PURE__*/ _jsxs(Card, {
+                        variant: "outlined",
+                        children: [
+                            /*#__PURE__*/ _jsxs(CardActionArea, {
+                                href: `/products/${item.slug}`,
+                                children: [
+                                    imageUrl ? /*#__PURE__*/ _jsx(CardMedia, _extends({
+                                        component: "img",
+                                        image: imageUrl,
+                                        alt: item.name,
+                                        sx: {
+                                            height: 120,
+                                            objectFit: 'cover'
+                                        }
+                                    }, Aglyn.DEFERRED_IMAGE_ATTRIBUTES)) : /*#__PURE__*/ _jsx(Box, {
+                                        sx: {
+                                            height: 120,
+                                            bgcolor: 'action.hover'
+                                        }
+                                    }),
+                                    /*#__PURE__*/ _jsxs(CardContent, {
+                                        sx: {
+                                            pb: 1
+                                        },
+                                        children: [
+                                            /*#__PURE__*/ _jsx(Typography, {
+                                                variant: "body2",
+                                                noWrap: true,
+                                                children: item.name
+                                            }),
+                                            /*#__PURE__*/ _jsx(Typography, {
+                                                variant: "caption",
+                                                color: "text.secondary",
+                                                children: item.soldOut ? 'Sold out' : `$${item.priceUsd}`
+                                            })
+                                        ]
+                                    })
+                                ]
+                            }),
+                            /*#__PURE__*/ _jsx(Button, {
+                                size: "small",
+                                color: "error",
+                                fullWidth: true,
+                                onClick: ()=>void toggleWishlist(hostId, item.id, siteFetch),
+                                children: 'Remove'
+                            })
+                        ]
+                    }, item.id);
+                })
+            })
+        ]
+    }));
+});
+Wishlist.displayName = 'AglynWishlist';
+export const schema = {
+    $id: ID,
+    pluginId: BUNDLE_ID,
+    displayName: 'Wishlist',
+    description: 'Products a visitor saved, linking back to their pages.',
+    category: Aglyn.ComponentCategory.COMMERCE,
+    icon: {
+        path: mdiHeartOutline.path,
+        sx: {
+            color: '#2e7d32'
+        }
+    },
+    flags: {
+        selfClosing: Aglyn.FEATURE_FLAG.ENABLED
+    },
+    attributes: [
+        {
+            name: 'heading',
+            label: 'Heading',
+            description: 'Shown above the saved products.',
+            component: Aglyn.FieldComponentType.TEXT_FIELD
+        },
+        {
+            name: 'emptyText',
+            label: 'Empty text',
+            description: 'Copy when nothing is saved.',
+            component: Aglyn.FieldComponentType.TEXT_FIELD
+        }
+    ]
+};
+export const presets = [
+    {
+        $id: generatePresetId(ID),
+        type: Aglyn.NodeType.PRESET,
+        displayName: 'Wishlist',
+        pluginId: BUNDLE_ID,
+        description: 'Saved products with links back to their pages',
+        category: Aglyn.ComponentCategory.COMMERCE,
+        icon: {
+            path: mdiHeartOutline.path,
+            sx: {
+                color: '#2e7d32'
+            }
+        },
+        data: {
+            $id: null,
+            componentId: ID,
+            pluginId: BUNDLE_ID,
+            props: {
+                heading: 'Your wishlist'
+            }
+        }
+    }
+];
+export default Wishlist;
+
+//# sourceMappingURL=wishlist.js.map

package/src/lib/components/wishlist.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/components/wishlist.tsx"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn'\nimport { mdiHeartOutline } from '@aglyn/shared-data-mdi'\nimport Box from '@mui/material/Box'\nimport Button from '@mui/material/Button'\nimport Card from '@mui/material/Card'\nimport CardActionArea from '@mui/material/CardActionArea'\nimport CardContent from '@mui/material/CardContent'\nimport CardMedia from '@mui/material/CardMedia'\nimport Typography from '@mui/material/Typography'\nimport { forwardRef, useCallback, useEffect, useState } from 'react'\nimport { BUNDLE_ID } from '../constants/bundle-common'\nimport { generatePresetId } from '../utils/generate-preset-id'\n\n// Component ids are persisted in screen documents; never rename.\nexport const ID: Aglyn.ComponentId = 'wishlist'\n\nexport const WISHLIST_UPDATED_EVENT = 'aglyn:wishlist-updated'\n\nfunction storageKey(hostId: string): string {\n  return `aglyn_wishlist_${hostId}`\n}\n\n/** Guest wishlist ids from localStorage. */\nexport function readLocalWishlist(hostId: string): string[] {\n  try {\n    const raw = window.localStorage.getItem(storageKey(hostId))\n    return raw ? (JSON.parse(raw) as string[]).slice(0, 200) : []\n  } catch {\n    return []\n  }\n}\n\nfunction writeLocalWishlist(hostId: string, productIds: string[]): void {\n  try {\n    window.localStorage.setItem(\n      storageKey(hostId),\n      JSON.stringify(productIds.slice(0, 200)),\n    )\n  } catch {\n    // Private-mode storage failures degrade to session-only behavior.\n  }\n}\n\n/**\n * Toggles a product on the wishlist (AGL-297): members persist on their\n * doc (guest list merges in on first signed-in call); guests persist in\n * localStorage. Returns whether the product is on the list afterward.\n *\n * Takes its own `fetch` (AGL-1139). This is a plain module function, not a\n * component, so it cannot read the site context that says whether it is\n * running in Preview — and both callers are components that can. Defaulting\n * to the global keeps every other caller unchanged; passing `useSiteFetch()`\n * is what stops a preview click from writing to a real member's wishlist.\n */\nexport async function toggleWishlist(\n  hostId: string,\n  productId: string,\n  siteFetch: typeof fetch = fetch,\n): Promise<boolean> {\n  const local = readLocalWishlist(hostId)\n  const has = local.includes(productId)\n  const next = has\n    ? local.filter((id) => id !== productId)\n    : [...local, productId]\n  writeLocalWishlist(hostId, next)\n  // Best-effort member sync — 401 just means guest.\n  void siteFetch('/api/membership/wishlist', {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      hostId,\n      action: has ? 'remove' : 'add',\n      productId,\n    }),\n  }).catch(() => undefined)\n  window.dispatchEvent(new Event(WISHLIST_UPDATED_EVENT))\n  return !has\n}\n\nexport interface WishlistProps {\n  heading?: string\n  emptyText?: string\n}\n\ninterface CatalogItem {\n  id: string\n  name: string\n  slug: string\n  priceUsd: number\n  imageUrl?: string\n  soldOut: boolean\n}\n\n/**\n * Wishlist block (AGL-297): renders the saved products (member doc when\n * signed in — merging any guest list — else localStorage) as cards\n * linking to their PDPs, with remove buttons.\n */\nconst Wishlist = forwardRef<HTMLDivElement, WishlistProps>((props, ref) => {\n  const { heading, emptyText, ...rest } = props\n  // Node styles ride the renderer-merged sx; recompose (stack.ts pattern).\n  const nodeSx = Array.isArray(props['sx']) ? props['sx'] : [props['sx']]\n  const { hostId } = Aglyn.useSite()\n  const siteFetch = Aglyn.useSiteFetch()\n  const [items, setItems] = useState<CatalogItem[] | null>(null)\n\n  const refresh = useCallback(async () => {\n    if (!hostId) return\n    let productIds = readLocalWishlist(hostId)\n    try {\n      // Merge the guest list into the member doc; response is canonical.\n      const response = await siteFetch('/api/membership/wishlist', {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({ hostId, action: 'merge', productIds }),\n      })\n      if (response.ok) {\n        const payload = await response.json()\n        productIds = payload?.productIds ?? productIds\n        writeLocalWishlist(hostId, productIds)\n      }\n    } catch {\n      // Guest path.\n    }\n    if (productIds.length === 0) return setItems([])\n    try {\n      const response = await fetch(\n        `/api/commerce/catalog?hostId=${encodeURIComponent(hostId)}` +\n          `&ids=${encodeURIComponent(productIds.join(','))}&limit=100`,\n      )\n      const payload = await response.json()\n      setItems(payload?.items ?? [])\n    } catch {\n      setItems([])\n    }\n  }, [hostId, siteFetch])\n\n  useEffect(() => {\n    void refresh()\n    const handler = () => void refresh()\n    window.addEventListener(WISHLIST_UPDATED_EVENT, handler)\n    return () => window.removeEventListener(WISHLIST_UPDATED_EVENT, handler)\n  }, [refresh])\n\n  if (!hostId) {\n    return (\n      <Box\n        ref={ref}\n        {...rest}\n        sx={[\n          {\n            p: 3,\n            border: '1px dashed',\n            borderColor: 'divider',\n            borderRadius: 1,\n            color: 'text.secondary',\n            fontSize: 13,\n            fontFamily: 'system-ui, sans-serif',\n          },\n          ...nodeSx,\n        ]}\n      >\n        {'Wishlist — saved products render here'}\n      </Box>\n    )\n  }\n\n  return (\n    <Box ref={ref} {...rest}>\n      {heading ? (\n        <Typography variant=\"h5\" gutterBottom>\n          {heading}\n        </Typography>\n      ) : null}\n      {items && items.length === 0 ? (\n        <Typography variant=\"body2\" color=\"text.secondary\">\n          {emptyText || 'Nothing saved yet — tap the heart on any product.'}\n        </Typography>\n      ) : (\n        <Box\n          sx={{\n            display: 'grid',\n            gap: 2,\n            gridTemplateColumns: {\n              xs: 'repeat(2, 1fr)',\n              md: 'repeat(4, 1fr)',\n            },\n          }}\n        >\n          {(items ?? []).map((item) => {\n            // AGL-1726: resolved BEFORE the guard — see the note in\n            // `product-detail.tsx`.\n            const imageUrl = Aglyn.siteRelativeMediaSrc(item.imageUrl, {\n              hostId,\n            })\n            return (\n            <Card key={item.id} variant=\"outlined\">\n              <CardActionArea href={`/products/${item.slug}`}>\n                {imageUrl ? (\n                  <CardMedia\n                    component=\"img\"\n                    image={imageUrl}\n                    alt={item.name}\n                    sx={{ height: 120, objectFit: 'cover' }}\n                    // Deferred (AGL-2486), same reasoning as the product\n                    // grid: one image per saved item, none of them the lead.\n                    {...Aglyn.DEFERRED_IMAGE_ATTRIBUTES}\n                  />\n                ) : (\n                  <Box sx={{ height: 120, bgcolor: 'action.hover' }} />\n                )}\n                <CardContent sx={{ pb: 1 }}>\n                  <Typography variant=\"body2\" noWrap>\n                    {item.name}\n                  </Typography>\n                  <Typography variant=\"caption\" color=\"text.secondary\">\n                    {item.soldOut ? 'Sold out' : `$${item.priceUsd}`}\n                  </Typography>\n                </CardContent>\n              </CardActionArea>\n              <Button\n                size=\"small\"\n                color=\"error\"\n                fullWidth\n                onClick={() => void toggleWishlist(hostId, item.id, siteFetch)}\n              >\n                {'Remove'}\n              </Button>\n            </Card>\n            )\n          })}\n        </Box>\n      )}\n    </Box>\n  )\n})\nWishlist.displayName = 'AglynWishlist'\n\nexport const schema: Aglyn.ComponentSchema<WishlistProps> = {\n  $id: ID,\n  pluginId: BUNDLE_ID,\n  displayName: 'Wishlist',\n  description: 'Products a visitor saved, linking back to their pages.',\n  category: Aglyn.ComponentCategory.COMMERCE,\n  icon: { path: mdiHeartOutline.path, sx: { color: '#2e7d32' } },\n  flags: { selfClosing: Aglyn.FEATURE_FLAG.ENABLED },\n  attributes: [\n    {\n      name: 'heading',\n      label: 'Heading',\n      description: 'Shown above the saved products.',\n      component: Aglyn.FieldComponentType.TEXT_FIELD,\n    },\n    {\n      name: 'emptyText',\n      label: 'Empty text',\n      description: 'Copy when nothing is saved.',\n      component: Aglyn.FieldComponentType.TEXT_FIELD,\n    },\n  ],\n}\n\nexport const presets: Aglyn.PresetSchema[] = [\n  {\n    $id: generatePresetId(ID),\n    type: Aglyn.NodeType.PRESET,\n    displayName: 'Wishlist',\n    pluginId: BUNDLE_ID,\n    description: 'Saved products with links back to their pages',\n    category: Aglyn.ComponentCategory.COMMERCE,\n    icon: { path: mdiHeartOutline.path, sx: { color: '#2e7d32' } },\n    data: {\n      $id: null,\n      componentId: ID,\n      pluginId: BUNDLE_ID,\n      props: { heading: 'Your wishlist' },\n    },\n  },\n]\n\nexport default Wishlist\n"],"names":["Aglyn","mdiHeartOutline","Box","Button","Card","CardActionArea","CardContent","CardMedia","Typography","forwardRef","useCallback","useEffect","useState","BUNDLE_ID","generatePresetId","ID","WISHLIST_UPDATED_EVENT","storageKey","hostId","readLocalWishlist","raw","window","localStorage","getItem","JSON","parse","slice","writeLocalWishlist","productIds","setItem","stringify","toggleWishlist","productId","siteFetch","fetch","local","has","includes","next","filter","id","method","headers","body","action","catch","undefined","dispatchEvent","Event","Wishlist","props","ref","heading","emptyText","rest","nodeSx","Array","isArray","useSite","useSiteFetch","items","setItems","refresh","response","ok","payload","json","length","encodeURIComponent","join","handler","addEventListener","removeEventListener","sx","p","border","borderColor","borderRadius","color","fontSize","fontFamily","variant","gutterBottom","display","gap","gridTemplateColumns","xs","md","map","item","imageUrl","siteRelativeMediaSrc","href","slug","component","image","alt","name","height","objectFit","DEFERRED_IMAGE_ATTRIBUTES","bgcolor","pb","noWrap","soldOut","priceUsd","size","fullWidth","onClick","displayName","schema","$id","pluginId","description","category","ComponentCategory","COMMERCE","icon","path","flags","selfClosing","FEATURE_FLAG","ENABLED","attributes","label","FieldComponentType","TEXT_FIELD","presets","type","NodeType","PRESET","data","componentId"],"mappings":";;;AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,WAAW,eAAc;AACrC,SAASC,eAAe,QAAQ,yBAAwB;AACxD,OAAOC,SAAS,oBAAmB;AACnC,OAAOC,YAAY,uBAAsB;AACzC,OAAOC,UAAU,qBAAoB;AACrC,OAAOC,oBAAoB,+BAA8B;AACzD,OAAOC,iBAAiB,4BAA2B;AACnD,OAAOC,eAAe,0BAAyB;AAC/C,OAAOC,gBAAgB,2BAA0B;AACjD,SAASC,UAAU,EAAEC,WAAW,EAAEC,SAAS,EAAEC,QAAQ,QAAQ,QAAO;AACpE,SAASC,SAAS,QAAQ,gCAA4B;AACtD,SAASC,gBAAgB,QAAQ,iCAA6B;AAE9D,iEAAiE;AACjE,OAAO,MAAMC,KAAwB,WAAU;AAE/C,OAAO,MAAMC,yBAAyB,yBAAwB;AAE9D,SAASC,WAAWC,MAAc;IAChC,OAAO,CAAC,eAAe,EAAEA,QAAQ;AACnC;AAEA,0CAA0C,GAC1C,OAAO,SAASC,kBAAkBD,MAAc;IAC9C,IAAI;QACF,MAAME,MAAMC,OAAOC,YAAY,CAACC,OAAO,CAACN,WAAWC;QACnD,OAAOE,MAAM,AAACI,KAAKC,KAAK,CAACL,KAAkBM,KAAK,CAAC,GAAG,OAAO,EAAE;IAC/D,EAAE,eAAM;QACN,OAAO,EAAE;IACX;AACF;AAEA,SAASC,mBAAmBT,MAAc,EAAEU,UAAoB;IAC9D,IAAI;QACFP,OAAOC,YAAY,CAACO,OAAO,CACzBZ,WAAWC,SACXM,KAAKM,SAAS,CAACF,WAAWF,KAAK,CAAC,GAAG;IAEvC,EAAE,eAAM;IACN,kEAAkE;IACpE;AACF;AAEA;;;;;;;;;;CAUC,GACD,OAAO,eAAeK,eACpBb,MAAc,EACdc,SAAiB,EACjBC,YAA0BC,KAAK;IAE/B,MAAMC,QAAQhB,kBAAkBD;IAChC,MAAMkB,MAAMD,MAAME,QAAQ,CAACL;IAC3B,MAAMM,OAAOF,MACTD,MAAMI,MAAM,CAAC,CAACC,KAAOA,OAAOR,aAC5B;WAAIG;QAAOH;KAAU;IACzBL,mBAAmBT,QAAQoB;IAC3B,kDAAkD;IAClD,KAAKL,UAAU,4BAA4B;QACzCQ,QAAQ;QACRC,SAAS;YAAE,gBAAgB;QAAmB;QAC9CC,MAAMnB,KAAKM,SAAS,CAAC;YACnBZ;YACA0B,QAAQR,MAAM,WAAW;YACzBJ;QACF;IACF,GAAGa,KAAK,CAAC,IAAMC;IACfzB,OAAO0B,aAAa,CAAC,IAAIC,MAAMhC;IAC/B,OAAO,CAACoB;AACV;AAgBA;;;;CAIC,GACD,MAAMa,yBAAWxC,WAA0C,CAACyC,OAAOC;IACjE,MAAM,EAAEC,OAAO,EAAEC,SAAS,EAAW,GAAGH,OAATI,wCAASJ;;;;IACxC,yEAAyE;IACzE,MAAMK,SAASC,MAAMC,OAAO,CAACP,KAAK,CAAC,KAAK,IAAIA,KAAK,CAAC,KAAK,GAAG;QAACA,KAAK,CAAC,KAAK;KAAC;IACvE,MAAM,EAAEhC,MAAM,EAAE,GAAGlB,MAAM0D,OAAO;IAChC,MAAMzB,YAAYjC,MAAM2D,YAAY;IACpC,MAAM,CAACC,OAAOC,SAAS,GAAGjD,SAA+B;IAEzD,MAAMkD,UAAUpD,YAAY;QAC1B,IAAI,CAACQ,QAAQ;QACb,IAAIU,aAAaT,kBAAkBD;QACnC,IAAI;YACF,mEAAmE;YACnE,MAAM6C,WAAW,MAAM9B,UAAU,4BAA4B;gBAC3DQ,QAAQ;gBACRC,SAAS;oBAAE,gBAAgB;gBAAmB;gBAC9CC,MAAMnB,KAAKM,SAAS,CAAC;oBAAEZ;oBAAQ0B,QAAQ;oBAAShB;gBAAW;YAC7D;YACA,IAAImC,SAASC,EAAE,EAAE;;gBACf,MAAMC,UAAU,MAAMF,SAASG,IAAI;gBACnCtC,qBAAaqC,2BAAAA,QAASrC,UAAU,mBAAIA;gBACpCD,mBAAmBT,QAAQU;YAC7B;QACF,EAAE,eAAM;QACN,cAAc;QAChB;QACA,IAAIA,WAAWuC,MAAM,KAAK,GAAG,OAAON,SAAS,EAAE;QAC/C,IAAI;;YACF,MAAME,WAAW,MAAM7B,MACrB,CAAC,6BAA6B,EAAEkC,mBAAmBlD,SAAS,GAC1D,CAAC,KAAK,EAAEkD,mBAAmBxC,WAAWyC,IAAI,CAAC,MAAM,UAAU,CAAC;YAEhE,MAAMJ,UAAU,MAAMF,SAASG,IAAI;YACnCL,kBAASI,2BAAAA,QAASL,KAAK,oBAAI,EAAE;QAC/B,EAAE,eAAM;YACNC,SAAS,EAAE;QACb;IACF,GAAG;QAAC3C;QAAQe;KAAU;IAEtBtB,UAAU;QACR,KAAKmD;QACL,MAAMQ,UAAU,IAAM,KAAKR;QAC3BzC,OAAOkD,gBAAgB,CAACvD,wBAAwBsD;QAChD,OAAO,IAAMjD,OAAOmD,mBAAmB,CAACxD,wBAAwBsD;IAClE,GAAG;QAACR;KAAQ;IAEZ,IAAI,CAAC5C,QAAQ;QACX,qBACE,KAAChB;YACCiD,KAAKA;WACDG;YACJmB,IAAI;gBACF;oBACEC,GAAG;oBACHC,QAAQ;oBACRC,aAAa;oBACbC,cAAc;oBACdC,OAAO;oBACPC,UAAU;oBACVC,YAAY;gBACd;mBACGzB;aACJ;sBAEA;;IAGP;IAEA,qBACE,MAACrD;QAAIiD,KAAKA;OAASG;;YAChBF,wBACC,KAAC5C;gBAAWyE,SAAQ;gBAAKC,YAAY;0BAClC9B;iBAED;YACHQ,SAASA,MAAMO,MAAM,KAAK,kBACzB,KAAC3D;gBAAWyE,SAAQ;gBAAQH,OAAM;0BAC/BzB,aAAa;+BAGhB,KAACnD;gBACCuE,IAAI;oBACFU,SAAS;oBACTC,KAAK;oBACLC,qBAAqB;wBACnBC,IAAI;wBACJC,IAAI;oBACN;gBACF;0BAEC,CAAC3B,gBAAAA,QAAS,EAAE,EAAE4B,GAAG,CAAC,CAACC;oBAClB,wDAAwD;oBACxD,wBAAwB;oBACxB,MAAMC,WAAW1F,MAAM2F,oBAAoB,CAACF,KAAKC,QAAQ,EAAE;wBACzDxE;oBACF;oBACA,qBACA,MAACd;wBAAmB6E,SAAQ;;0CAC1B,MAAC5E;gCAAeuF,MAAM,CAAC,UAAU,EAAEH,KAAKI,IAAI,EAAE;;oCAC3CH,yBACC,KAACnF;wCACCuF,WAAU;wCACVC,OAAOL;wCACPM,KAAKP,KAAKQ,IAAI;wCACdxB,IAAI;4CAAEyB,QAAQ;4CAAKC,WAAW;wCAAQ;uCAGlCnG,MAAMoG,yBAAyB,mBAGrC,KAAClG;wCAAIuE,IAAI;4CAAEyB,QAAQ;4CAAKG,SAAS;wCAAe;;kDAElD,MAAC/F;wCAAYmE,IAAI;4CAAE6B,IAAI;wCAAE;;0DACvB,KAAC9F;gDAAWyE,SAAQ;gDAAQsB,MAAM;0DAC/Bd,KAAKQ,IAAI;;0DAEZ,KAACzF;gDAAWyE,SAAQ;gDAAUH,OAAM;0DACjCW,KAAKe,OAAO,GAAG,aAAa,CAAC,CAAC,EAAEf,KAAKgB,QAAQ,EAAE;;;;;;0CAItD,KAACtG;gCACCuG,MAAK;gCACL5B,OAAM;gCACN6B,SAAS;gCACTC,SAAS,IAAM,KAAK7E,eAAeb,QAAQuE,KAAKjD,EAAE,EAAEP;0CAEnD;;;uBA9BMwD,KAAKjD,EAAE;gBAkCpB;;;;AAKV;AACAS,SAAS4D,WAAW,GAAG;AAEvB,OAAO,MAAMC,SAA+C;IAC1DC,KAAKhG;IACLiG,UAAUnG;IACVgG,aAAa;IACbI,aAAa;IACbC,UAAUlH,MAAMmH,iBAAiB,CAACC,QAAQ;IAC1CC,MAAM;QAAEC,MAAMrH,gBAAgBqH,IAAI;QAAE7C,IAAI;YAAEK,OAAO;QAAU;IAAE;IAC7DyC,OAAO;QAAEC,aAAaxH,MAAMyH,YAAY,CAACC,OAAO;IAAC;IACjDC,YAAY;QACV;YACE1B,MAAM;YACN2B,OAAO;YACPX,aAAa;YACbnB,WAAW9F,MAAM6H,kBAAkB,CAACC,UAAU;QAChD;QACA;YACE7B,MAAM;YACN2B,OAAO;YACPX,aAAa;YACbnB,WAAW9F,MAAM6H,kBAAkB,CAACC,UAAU;QAChD;KACD;AACH,EAAC;AAED,OAAO,MAAMC,UAAgC;IAC3C;QACEhB,KAAKjG,iBAAiBC;QACtBiH,MAAMhI,MAAMiI,QAAQ,CAACC,MAAM;QAC3BrB,aAAa;QACbG,UAAUnG;QACVoG,aAAa;QACbC,UAAUlH,MAAMmH,iBAAiB,CAACC,QAAQ;QAC1CC,MAAM;YAAEC,MAAMrH,gBAAgBqH,IAAI;YAAE7C,IAAI;gBAAEK,OAAO;YAAU;QAAE;QAC7DqD,MAAM;YACJpB,KAAK;YACLqB,aAAarH;YACbiG,UAAUnG;YACVqC,OAAO;gBAAEE,SAAS;YAAgB;QACpC;IACF;CACD,CAAA;AAED,eAAeH,SAAQ"}

package/src/lib/constants/bundle-common.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** Persisted as pluginId in screen docs — never rename (AGL-290). */
+export declare const BUNDLE_ID = "commerce";

package/src/lib/constants/bundle-common.js

@@ -0,0 +1,18 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /** Persisted as pluginId in screen docs — never rename (AGL-290). */ export const BUNDLE_ID = 'commerce';
+
+//# sourceMappingURL=bundle-common.js.map

package/src/lib/constants/bundle-common.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/commerce/src/lib/constants/bundle-common.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/** Persisted as pluginId in screen docs — never rename (AGL-290). */\nexport const BUNDLE_ID = 'commerce'\n"],"names":["BUNDLE_ID"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,mEAAmE,GACnE,OAAO,MAAMA,YAAY,WAAU"}

package/src/lib/constants/product-filters.d.ts

@@ -0,0 +1,35 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { ListFilterField } from '@aglyn/shared-ui-jsx/const/list-filter';
+/**
+ * Products (`hosts/{hostId}/products`).
+ *
+ * The card's listener is `limit(500)` and stays that way — a 25,000-product
+ * catalog does not belong in a table, and the head-count has been a server
+ * aggregate since AGL-1716. What that cap must NOT decide is what a search can
+ * find, and it did: the search compared the rows already fetched, so a product
+ * past the window answered "no products match".
+ *
+ * ⛔ A SKU is matched WHOLE, not as a substring. It lived inside `variants`, an
+ * array of objects, and Firestore cannot look inside one — so the write path
+ * flattens them into `skus` and this is an `array-contains`. A SKU is a value
+ * somebody copies rather than half-remembers, which is why that trade is the
+ * right way round.
+ */
+export declare const PRODUCT_LIST_FILTER_FIELDS: readonly ListFilterField[];
+/** Headers for product fields that are filterable without being columns. */
+export declare const PRODUCT_LIST_FILTER_HEADERS: Readonly<Record<string, string>>;