@akinon/next 2.0.135-rc.1 → 2.0.136-beta.0

package/middlewares/pretty-url.ts

@@ -86,9 +86,7 @@ const withPrettyUrl =
     const matchedLanguagePrefix = url.pathname.match(
       urlLocaleMatcherRegex
     )?.[0];
-    const prettyUrlPathname = matchedLanguagePrefix
-      ? url.pathname.replace(matchedLanguagePrefix, '')
-      : url.pathname;
+    const prettyUrlPathname = url.pathname.replace(matchedLanguagePrefix, '');
     const isValidPrettyUrlPath = (pathname: string) => {
       return (
         new RegExp(/^\/[a-zA-Z0-9/]+(?:-[a-zA-Z0-9/]+)*$/).test(pathname) &&

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@akinon/next",
   "description": "Core package for Project Zero Next",
-  "version": "2.0.135-rc.1",
+  "version": "2.0.136-beta.0",
   "private": false,
   "license": "MIT",
   "bin": {
@@ -36,7 +36,7 @@
     "set-cookie-parser": "2.6.0"
   },
   "devDependencies": {
-    "@akinon/eslint-plugin-projectzero": "2.0.135-rc.1",
+    "@akinon/eslint-plugin-projectzero": "2.0.136-beta.0",
     "@babel/core": "7.26.10",
     "@babel/preset-env": "7.26.9",
     "@babel/preset-typescript": "7.27.0",

package/plugins.d.ts

@@ -37,16 +37,6 @@ declare module '@akinon/pz-cybersource-uc/src/redux/middleware' {
   export default middleware as any;
 }
 
-declare module '@akinon/pz-apple-pay' {}
-
-declare module '@akinon/pz-similar-products' {
-  export const SimilarProductsModal: any;
-  export const SimilarProductsFilterSidebar: any;
-  export const SimilarProductsResultsGrid: any;
-  export const SimilarProductsPlugin: any;
-  export const SimilarProductsButtonPlugin: any;
-}
-
 declare module '@akinon/pz-cybersource-uc/src/redux/reducer' {
   export default reducer as any;
 }

package/plugins.js

@@ -16,7 +16,6 @@ module.exports = [
   'pz-tabby-extension',
   'pz-apple-pay',
   'pz-tamara-extension',
-  'pz-similar-products',
   'pz-cybersource-uc',
   'pz-hepsipay',
   'pz-flow-payment',

package/redux/middlewares/checkout.ts

@@ -26,28 +26,13 @@ import {
 } from '../../redux/reducers/checkout';
 import { RootState, TypedDispatch } from 'redux/store';
 import { checkoutApi } from '../../data/client/checkout';
-import { CheckoutContext, MiddlewareAction, PreOrder } from '../../types';
+import { CheckoutContext, PreOrder } from '../../types';
 import { getCookie } from '../../utils';
 import settings from 'settings';
 import { LocaleUrlStrategy } from '../../localization';
 import { showMobile3dIframe } from '../../utils/mobile-3d-iframe';
 import { showRedirectionIframe } from '../../utils/redirection-iframe';
 
-const IFRAME_REDIRECTION_KEY = 'pz-iframe-redirection-active';
-
-const isIframeRedirectionActive = () =>
-  typeof window !== 'undefined' &&
-  sessionStorage.getItem(IFRAME_REDIRECTION_KEY) === 'true';
-
-const setIframeRedirectionActive = (active: boolean) => {
-  if (typeof window === 'undefined') return;
-  if (active) {
-    sessionStorage.setItem(IFRAME_REDIRECTION_KEY, 'true');
-  } else {
-    sessionStorage.removeItem(IFRAME_REDIRECTION_KEY);
-  }
-};
-
 interface CheckoutResult {
   payload: {
     errors?: Record<string, string[]>;
@@ -84,7 +69,7 @@ export const redirectUrlMiddleware: Middleware = () => {
     const result = next(action) as CheckoutResult;
     const redirectUrl = result?.payload?.redirect_url;
 
-    if (redirectUrl && !isIframeRedirectionActive()) {
+    if (redirectUrl) {
       const currentLocale = getCookie('pz-locale');
 
       let url = redirectUrl;
@@ -114,15 +99,8 @@ export const contextListMiddleware: Middleware = ({
     const { isMobileApp, userPhoneNumber } = getState().root;
     const result = next(action) as CheckoutResult;
     const preOrder = result?.payload?.pre_order;
-    const act = action as MiddlewareAction;
 
     if (result?.payload?.context_list) {
-      const endpointName = act.meta?.arg?.endpointName;
-      const isBinNumberResponse = endpointName === 'setBinNumber';
-      const hasCardTypeInContextList = result.payload.context_list.some(
-        (ctx) => ctx.page_context.card_type
-      );
-
       result.payload.context_list.forEach((context) => {
         const redirectUrl = context.page_context.redirect_url;
         const isIframe = context.page_context.is_iframe ?? false;
@@ -156,7 +134,6 @@ export const contextListMiddleware: Middleware = ({
           if (isMobileDevice && isIframePaymentOptionIncluded) {
             showMobile3dIframe(urlObj.toString());
           } else if (isIframe) {
-            setIframeRedirectionActive(true);
             showRedirectionIframe(urlObj.toString());
           } else {
             window.location.href = urlObj.toString();
@@ -232,34 +209,15 @@ export const contextListMiddleware: Middleware = ({
             (ctx) => ctx.page_name === 'DeliveryOptionSelectionPage'
           )
         ) {
-          const isCreditCardPayment =
-            preOrder?.payment_option?.payment_type === 'credit_card' ||
-            preOrder?.payment_option?.payment_type === 'masterpass';
-
           if (context.page_context.card_type) {
             dispatch(setCardType(context.page_context.card_type));
-          } else if (
-            isCreditCardPayment &&
-            isBinNumberResponse &&
-            !hasCardTypeInContextList
-          ) {
-            dispatch(setCardType(null));
-            dispatch(setInstallmentOptions([]));
           }
 
           if (
             context.page_context.installments &&
             preOrder?.payment_option?.payment_type !== 'masterpass_rest'
           ) {
-            if (
-              !isCreditCardPayment ||
-              context.page_context.card_type ||
-              hasCardTypeInContextList
-            ) {
-              dispatch(
-                setInstallmentOptions(context.page_context.installments)
-              );
-            }
+            dispatch(setInstallmentOptions(context.page_context.installments));
           }
         }
 

package/redux/middlewares/pre-order/installment-option.ts

@@ -14,17 +14,9 @@ export const installmentOptionMiddleware: Middleware = ({
       return result;
     }
 
-    const { installmentOptions, cardType } = getState().checkout;
+    const { installmentOptions } = getState().checkout;
     const { endpoints: apiEndpoints } = checkoutApi;
 
-    const isCreditCardPayment =
-      preOrder?.payment_option?.payment_type === 'credit_card' ||
-      preOrder?.payment_option?.payment_type === 'masterpass';
-
-    if (isCreditCardPayment && !cardType) {
-      return result;
-    }
-
     if (
       !preOrder?.installment &&
       preOrder?.payment_option?.payment_type !== 'saved_card' &&

package/types/index.ts

@@ -85,12 +85,6 @@ export interface Settings {
   };
   usePrettyUrlRoute?: boolean;
   commerceUrl: string;
-  /**
-   * This option allows you to track Sentry events on the client side, in addition to server and edge environments.
-   *
-   * It overrides process.env.NEXT_PUBLIC_SENTRY_DSN and process.env.SENTRY_DSN.
-   */
-  sentryDsn?: string;
   /**
    * CSRF cookie hardening settings.
    *
@@ -242,7 +236,6 @@ export interface Settings {
     separator?: string;
     segments: PzSegmentDefinition[];
   };
-  payloadOptimization?: import('../utils/payload-optimizer').PayloadOptimizationConfig;
 }
 
 export interface CacheOptions {
@@ -302,9 +295,7 @@ export interface PzSegmentsConfig {
 }
 
 // Search params type compatible with both Next.js resolved searchParams and URLSearchParams
-export type SearchParams =
-  | Record<string, string | string[] | undefined>
-  | URLSearchParams;
+export type SearchParams = Record<string, string | string[] | undefined> | URLSearchParams;
 
 // Raw Next 16 server prop shape, used at the middleware/HOC boundary before normalization
 export type RawSearchParams = Record<string, string | string[] | undefined>;
@@ -337,16 +328,14 @@ export interface RootLayoutProps<T = any> extends LayoutProps<T> {
 
 // Async versions for Next.js 16 generateMetadata and internal use
 export interface AsyncPageProps<T = any> {
-  params: Promise<
-    T & {
-      pz?: string;
-      commerce?: string;
-      locale?: string;
-      currency?: string;
-      url?: string;
-      [key: string]: any;
-    }
-  >;
+  params: Promise<T & {
+    pz?: string;
+    commerce?: string;
+    locale?: string;
+    currency?: string;
+    url?: string;
+    [key: string]: any;
+  }>;
   searchParams: Promise<{ [key: string]: string | string[] | undefined }>;
 }
 

package/utils/csrf.ts

@@ -46,7 +46,7 @@ export function getCsrfCookieFlags(): CsrfCookieFlags {
 
   return {
     httpOnly,
-    secure: process.env.NODE_ENV === 'production',
+    secure: httpOnly && process.env.NODE_ENV === 'production',
     sameSite: 'lax'
   };
 }

package/utils/theme-editor-health.ts

@@ -0,0 +1,141 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+/**
+ * What the theme editor needs from this storefront's environment, reported to
+ * the editor so it can refuse to run instead of failing silently.
+ *
+ * The one variable the editor cannot work without is
+ * `NEXT_PUBLIC_THEME_EDITOR_ORIGINS`. The preview drops every message whose
+ * origin is not on that list (`@akinon/pz-theme`'s editor bridge), and it has
+ * no way to say so: it cannot post back to an origin it does not trust. So a
+ * production storefront without the list, or without the editor's origin on
+ * it, renders in the preview and ignores the designer completely. The editor
+ * asks here, over plain HTTP, before relying on the preview.
+ *
+ * Only variable NAMES and whether they are usable leave the server — never a
+ * value — so the answer is safe to serve to any origin.
+ */
+
+export const THEME_EDITOR_HEALTH_PATH = '/theme-editor/health';
+
+export type ThemeEditorEnvProblem = 'missing' | 'invalid' | 'origin-not-listed';
+
+export interface ThemeEditorEnvCheck {
+  name: string;
+  ok: boolean;
+  problem?: ThemeEditorEnvProblem;
+}
+
+export interface ThemeEditorHealth {
+  version: 1;
+  /** Variables without which the editor cannot drive the preview. */
+  required: ThemeEditorEnvCheck[];
+  /** Variables whose absence disables a feature, not the editor. */
+  optional: ThemeEditorEnvCheck[];
+}
+
+export interface ThemeEditorEnv {
+  editorOrigins?: string;
+  previewSecret?: string;
+  mainAppUrl?: string;
+  production: boolean;
+}
+
+const originOf = (value: string): string | null => {
+  try {
+    const url = new URL(value);
+    return url.protocol === 'http:' || url.protocol === 'https:'
+      ? url.origin
+      : null;
+  } catch {
+    return null;
+  }
+};
+
+// The same two rules as `createOriginGuard` in `@akinon/theme-contract`, which
+// the preview applies to every message: the listed origins, plus any localhost
+// origin outside production. The answer here must match what the preview will
+// actually accept.
+const parseOriginList = (raw: string | undefined): string[] =>
+  (raw ?? '')
+    .split(/[\s,]+/)
+    .map((entry) => originOf(entry.trim()))
+    .filter((origin): origin is string => origin !== null);
+
+const LOCAL_DEV_ORIGIN = /^https?:\/\/(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/;
+
+const checkEditorOrigins = (
+  env: ThemeEditorEnv,
+  editorOrigin: string | null
+): ThemeEditorEnvCheck => {
+  const name = 'NEXT_PUBLIC_THEME_EDITOR_ORIGINS';
+  const raw = env.editorOrigins?.trim();
+  const origins = parseOriginList(raw);
+  const trustedLocally =
+    !env.production && !!editorOrigin && LOCAL_DEV_ORIGIN.test(editorOrigin);
+
+  if (editorOrigin && (origins.includes(editorOrigin) || trustedLocally)) {
+    return { name, ok: true };
+  }
+  if (!raw) {
+    // Development trusts localhost without a list; a request with no origin
+    // (curl, a server) cannot be judged beyond that.
+    return !env.production && !editorOrigin
+      ? { name, ok: true }
+      : { name, ok: false, problem: 'missing' };
+  }
+  if (origins.length === 0) return { name, ok: false, problem: 'invalid' };
+  if (!editorOrigin) return { name, ok: true };
+
+  return { name, ok: false, problem: 'origin-not-listed' };
+};
+
+export const getThemeEditorHealth = (
+  env: ThemeEditorEnv,
+  editorOrigin: string | null
+): ThemeEditorHealth => {
+  const mainAppUrl = env.mainAppUrl?.trim();
+
+  return {
+    version: 1,
+    required: [checkEditorOrigins(env, editorOrigin)],
+    optional: [
+      env.previewSecret?.trim()
+        ? { name: 'PREVIEW_SECRET', ok: true }
+        : { name: 'PREVIEW_SECRET', ok: false, problem: 'missing' },
+      !mainAppUrl
+        ? { name: 'MAIN_APP_URL', ok: false, problem: 'missing' }
+        : originOf(mainAppUrl)
+        ? { name: 'MAIN_APP_URL', ok: true }
+        : { name: 'MAIN_APP_URL', ok: false, problem: 'invalid' }
+    ]
+  };
+};
+
+/**
+ * The environment as this build sees it. `NEXT_PUBLIC_*` is read as a literal
+ * so Next.js inlines it here exactly as it does into the preview's bundle —
+ * the answer describes the list the preview was built with.
+ */
+export const readThemeEditorEnv = (): ThemeEditorEnv => ({
+  editorOrigins: process.env.NEXT_PUBLIC_THEME_EDITOR_ORIGINS,
+  previewSecret: process.env.PREVIEW_SECRET,
+  mainAppUrl: process.env.MAIN_APP_URL,
+  production: process.env.NODE_ENV === 'production'
+});
+
+export const themeEditorHealthResponse = (req: NextRequest): NextResponse =>
+  NextResponse.json(
+    getThemeEditorHealth(
+      readThemeEditorEnv(),
+      originOf(req.headers.get('origin') ?? '')
+    ),
+    {
+      headers: {
+        // Asked for by the editor, which runs on another origin — and by
+        // design before this storefront knows that origin is its editor.
+        'Access-Control-Allow-Origin': '*',
+        'Cache-Control': 'no-store'
+      }
+    }
+  );

package/with-pz-config.js

@@ -30,10 +30,6 @@ const defaultConfig = {
       {
         protocol: 'https',
         hostname: '**.akinoncdn.com'
-      },
-      {
-        protocol: 'https',
-        hostname: '**.akinoncloudcdn.com'
       }
     ]
   },
@@ -78,8 +74,7 @@ const defaultConfig = {
         acc[`@akinon/${plugin}`] = false;
         return acc;
       }, {}),
-      translations: false,
-      '@opentelemetry/exporter-jaeger': false
+      translations: false
     };
     // Ensure webpack can resolve deps from the app's node_modules when
     // compiling transpiled packages (e.g. @akinon/next) whose imports

package/api/client-env.ts

@@ -1,78 +0,0 @@
-import { NextRequest, NextResponse } from 'next/server';
-
-/**
- * Runtime access to public (`NEXT_PUBLIC_*`) environment variables.
- *
- * Next.js inlines `process.env.NEXT_PUBLIC_*` into the bundle at *build* time.
- * On hosting platforms where the build has no access to the environment (e.g.
- * Akinon Cloud Commerce), those references resolve to `undefined` in the
- * browser. This route reads the variables from the *server runtime* instead —
- * `process.env[name]` is a computed lookup, so webpack never statically inlines
- * it — and hands them back to the client.
- *
- * Only `NEXT_PUBLIC_`-prefixed names are resolvable. These values are public by
- * design (they are shipped to the browser anyway), so nothing secret can leak
- * through here; the prefix check is what keeps server-only secrets unreadable.
- *
- * Query: one or more `env` params, repeated (`?env=A&env=B`) and/or comma
- * separated (`?env=A,B`). Names must include the full prefix. Responds with a
- * `{ [name]: value | null }` map (`null` when the variable is not set).
- *
- * The consuming route file must set `export const dynamic = 'force-dynamic'` so
- * Next never statically caches a build-time (empty) response.
- *
- * @see `@akinon/next/hooks` — `useClientEnv` / `getClientEnv` read from here.
- */
-
-const CLIENT_ENV_NAME = /^NEXT_PUBLIC_[A-Za-z0-9_]+$/;
-
-export async function GET(request: NextRequest) {
-  try {
-    const { searchParams } = new URL(request.url);
-
-    const names = Array.from(
-      new Set(
-        searchParams
-          .getAll('env')
-          .flatMap((value) => value.split(','))
-          .map((value) => value.trim())
-          .filter(Boolean)
-      )
-    );
-
-    if (names.length === 0) {
-      return NextResponse.json(
-        { message: 'At least one `env` query parameter is required.' },
-        { status: 400 }
-      );
-    }
-
-    const invalid = names.filter((name) => !CLIENT_ENV_NAME.test(name));
-
-    if (invalid.length > 0) {
-      return NextResponse.json(
-        {
-          message:
-            'Only NEXT_PUBLIC_-prefixed environment variables can be read.',
-          invalid
-        },
-        { status: 400 }
-      );
-    }
-
-    const values = names.reduce<Record<string, string | null>>((acc, name) => {
-      acc[name] = process.env[name] ?? null;
-      return acc;
-    }, {});
-
-    return NextResponse.json(values, {
-      headers: { 'Cache-Control': 'no-store' }
-    });
-  } catch (error) {
-    console.error('Error in client-env API:', error);
-    return NextResponse.json(
-      { message: 'Internal server error' },
-      { status: 500 }
-    );
-  }
-}