@asstio-dev/storefront 0.14.0 → 0.16.1

package/README.md

@@ -360,8 +360,8 @@ answers the converted cart's completed attempt) with the same token, navigate to
 `order`, and clear the cookie only once the confirmation page holds the access token.
 
 **Copy and CSP.** The `pending` state ("awaiting payment approval") is your copy. Each provider's widget needs its
-domains in your CSP: Qliro One `*.qliro.com` (`pago.qit.nu` in the sandbox), Klarna/Kustom `*.klarna.com`
-(`*.kustom.co`), Walley `*.walleypay.com`, plus their `frame-src`/`script-src`/`connect-src` — the provider's
+domains in your CSP: Qliro One `*.qliro.com` (`pago.qit.nu` in the sandbox), Kustom `*.kustom.co` (verified, see
+below), Walley `*.walleypay.com`, plus their `frame-src`/`script-src`/`connect-src` — the provider's
 integration guide lists the exact hosts.
 
 Problem codes you will meet here: `CART_EMPTY`, `CHECKOUT_CART_CHANGED` (with `cart`), `CHECKOUT_PREVIEW_KEY`,
@@ -375,8 +375,10 @@ Problem codes you will meet here: `CART_EMPTY`, `CHECKOUT_CART_CHANGED` (with `c
 - The widget is Qliro's HTML snippet; `mountCheckout` re-creates its scripts so they run.
 - After every cart change, `handle.sync(update)` locks the widget (`q1.lock()`), and resumes it through
   `q1.onOrderUpdated`, which makes the iframe re-read the order. The widget unlocks only when Qliro's order shows the
-  confirmed total. If it does not within 10 seconds, or the change came before Qliro's script had loaded, the widget is
-  re-rendered from the confirmed checkout instead; it is never unlocked before Qliro shows the confirmed total.
+  confirmed total, or echoes the confirmed cart version (`MerchantUpdateVersion`, which the backend sends on a market
+  with shipping, where Qliro's total includes the fee). If it does neither within 10 seconds, or the change came before
+  Qliro's script had loaded, the widget is re-rendered from the confirmed checkout instead; it is never unlocked before
+  Qliro shows the confirmed total or version.
 - When our validation declines a purchase (the cart moved on, the attempt expired, a line is out of stock), Qliro shows
   its out-of-stock message and fires `q1.onPaymentDeclined`; the SDK then syncs by itself and remounts or resumes.
 
@@ -397,9 +399,18 @@ Problem codes you will meet here: `CART_EMPTY`, `CHECKOUT_CART_CHANGED` (with `c
   server's; the page does nothing for them.
 - The checkout page needs a `checkoutPath` and a `termsPath` in the market's checkout block (Purchase refuses a Kustom
   option without them).
-- **CSP hosts: pending K-C10** (`docs/ops/kustom-playground-checks.md`). Until the playground run records the hosts the
-  snippet really loads (card with 3-D Secure and the default method), allow `*.kustom.co` and `*.klarna.com` for
-  `script-src`, `frame-src` and `connect-src` as the general paragraph above says, and watch the console for blocked requests.
+- Never bind `can_not_complete_order` yourself through `window._klarnaCheckout(api => api.on(...))`. Kustom's `api.on`
+  replaces the listener per event instead of adding one, so yours and the SDK's would replace each other. Use
+  `onProblem`. Listeners for other events are not affected.
+- **CSP hosts** (K-C10, `docs/ops/kustom-playground-checks.md`, 2026-10-09: a card with 3-D Secure and the default
+  method, no blocked request). The checkout page itself loads only Kustom's script host. Everything else
+  (`kco.assets.kustomcdn.co`, Klarna, Stripe, hCaptcha, Google Pay, Amazon Pay) loads inside Kustom's iframe under
+  Kustom's own policy. Allow:
+  - `script-src 'unsafe-inline' https://*.kustom.co`;
+  - `frame-src https://*.kustom.co`;
+  - `connect-src https://*.kustom.co`.
+
+  `https://*.kustom.co` covers the playground (`js.playground.kustom.co`) and production (`js.kustom.co`).
 
 ## Headers
 

package/dist/checkout/browser.js

@@ -357,7 +357,7 @@ export function mountCheckout(container, checkout, options) {
                     // until its own answer *(plan review 2 #11)*. The provider unlocks once its view shows `dto.cart`; if it
                     // never does, the widget is re-rendered from this answer *(plan review 1 #3)*.
                     if (active <= 1)
-                        resume({ cart: dto.cart, onUnsynced: () => { if (alive(gen))
+                        resume({ cart: dto.cart, cartVersion: Number(dto.cartVersion), onUnsynced: () => { if (alive(gen))
                                 remount(dto); } });
                 }
                 else {

package/dist/checkout/controllers.d.ts

@@ -37,6 +37,9 @@ export interface ResumeTarget {
     cart: {
         grandTotalInc: string;
     };
+    /** The confirmed answer's cart version. On a shipping market Qliro's PUT carries it as `MerchantUpdateVersion`, so its
+     * echo in Qliro's order also shows the update landed (carriers 1b ruling R-S3-K1). */
+    cartVersion?: number;
     /** The provider never showed `cart` before its deadline: the handle re-renders the widget from the confirmed answer. */
     onUnsynced(): void;
 }
@@ -66,7 +69,9 @@ export type ControllerFactory = (win: ProviderWindow, timer: ControllerTimer) =>
  * re-rendered, never unlocked blindly *(plan review 1 #3)*. */
 export declare const QLIRO_SYNC_DEADLINE_MS = 10000;
 /** Qliro's check before `unlock()` (*Update order*: "Verify that the total amount of the order = total amount in the
- * shopping cart"), in öre. The total alone, as Qliro documents it *(plan review 1 #3, final review S1)*. */
-export declare function qliroOrderMatches(order: unknown, cart: ResumeTarget["cart"]): boolean;
+ * shopping cart"), in öre, **or** the `MerchantUpdateVersion` our PUT sent (carriers 1b ruling R-S3-K1: on a shipping
+ * market Qliro's total includes the fee, so the total alone never matches). The echo is a string in Qliro's schema; its
+ * name is read case-insensitively (VQ-8 records the real one). */
+export declare function qliroOrderMatches(order: unknown, target: Pick<ResumeTarget, "cart" | "cartVersion">): boolean;
 export declare const controllers: Record<"qliro-q1" | "klarna-kco" | "walley", ControllerFactory>;
 export declare function controllerFor(name: string, win: ProviderWindow, timer?: ControllerTimer): CheckoutController;

package/dist/checkout/controllers.js

@@ -5,10 +5,23 @@ export const KLARNA_READY_POLL_MS = 100;
 export const QLIRO_SYNC_DEADLINE_MS = 10_000;
 const ore = (v) => Math.round(Number(v) * 100);
 /** Qliro's check before `unlock()` (*Update order*: "Verify that the total amount of the order = total amount in the
- * shopping cart"), in öre. The total alone, as Qliro documents it *(plan review 1 #3, final review S1)*. */
-export function qliroOrderMatches(order, cart) {
-    const total = order?.totalPrice;
-    return (typeof total === "number" || typeof total === "string") && ore(total) === ore(cart.grandTotalInc);
+ * shopping cart"), in öre, **or** the `MerchantUpdateVersion` our PUT sent (carriers 1b ruling R-S3-K1: on a shipping
+ * market Qliro's total includes the fee, so the total alone never matches). The echo is a string in Qliro's schema; its
+ * name is read case-insensitively (VQ-8 records the real one). */
+export function qliroOrderMatches(order, target) {
+    const o = order;
+    const total = o?.totalPrice;
+    if ((typeof total === "number" || typeof total === "string") && ore(total) === ore(target.cart.grandTotalInc))
+        return true;
+    if (target.cartVersion === undefined || !o)
+        return false;
+    const key = Object.keys(o).find((k) => k.toLowerCase() === "merchantupdateversion");
+    const raw = key === undefined ? undefined : o[key];
+    // Only a number or a non-blank string is an echo: `Number("")` and `Number(null)` are 0, which must not match version 0.
+    if (!(typeof raw === "number" || (typeof raw === "string" && raw.trim() !== "")))
+        return false;
+    const echoed = Number(raw);
+    return Number.isFinite(echoed) && echoed === Number(target.cartVersion);
 }
 export const controllers = {
     "qliro-q1": (win, timer) => {
@@ -42,7 +55,7 @@ export const controllers = {
                 }
                 if (missedLock)
                     q1.lock(); // onOrderUpdated "requires q1.lock() to have been called first"
-                q1.onOrderUpdated((order) => { if (qliroOrderMatches(order, target.cart))
+                q1.onOrderUpdated((order) => { if (qliroOrderMatches(order, target))
                     unlock(); });
                 // Never unlocked blindly: past the deadline the handle re-renders the widget from the confirmed answer
                 // *(plan review 1 #3)*.

package/dist/schema.d.ts

@@ -102,6 +102,22 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/cart/shipping-estimate": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get: operations["GetShippingEstimate"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/categories": {
         parameters: {
             query?: never;
@@ -624,6 +640,14 @@ export interface components {
             /** Format: int32 */
             min: number;
         };
+        DeliveryTimeDto: {
+            /** Format: int32 */
+            maxDays: number | null | string;
+            /** Format: int32 */
+            minDays: number | null | string;
+            mode: string;
+            text: null | string;
+        };
         DescriptionDto: {
             html: string;
             text: string;
@@ -662,6 +686,11 @@ export interface components {
             facet: string;
             values: components["schemas"]["FacetValueDto"][];
         };
+        FreeShippingDto: {
+            free: boolean;
+            remaining: null | string;
+            threshold: null | string;
+        };
         /** @enum {unknown} */
         LineAvailability: "backorder" | "inStock";
         ListingResponse: {
@@ -791,6 +820,7 @@ export interface components {
             placedAt: string;
             promisedDelivery: null | components["schemas"]["DeliveryRangeDto"];
             reference: string;
+            shipping: null | components["schemas"]["OrderShippingDto"];
             status: components["schemas"]["OrderStatusDto"];
             test: boolean;
             totals: components["schemas"]["OrderTotalsDto"];
@@ -812,6 +842,21 @@ export interface components {
             variantId: null | string;
             vatRate: string;
         };
+        OrderShippingDto: {
+            carrier: string;
+            deliveryTime: null | components["schemas"]["DeliveryTimeDto"];
+            deliveryType: string;
+            fee: string;
+            name: string;
+            option: string;
+            point: null | components["schemas"]["OrderShippingPointDto"];
+        };
+        OrderShippingPointDto: {
+            city: null | string;
+            name: string;
+            postalCode: null | string;
+            street: null | string;
+        };
         OrderStatusDto: {
             fulfilment: string;
             order: string;
@@ -924,6 +969,27 @@ export interface components {
         SetCartMarketRequest: {
             market: string;
         };
+        ShippingEstimateDto: {
+            available: boolean;
+            freeShipping: null | components["schemas"]["FreeShippingDto"];
+            options: components["schemas"]["ShippingEstimateOptionDto"][];
+            reason: null | string;
+        };
+        ShippingEstimateOptionDto: {
+            deliveryType: string;
+            fee: string;
+            key: string;
+            labels: components["schemas"]["ShippingLabelDto"][];
+            name: string;
+            pointsAtCheckout: boolean;
+            preselected: boolean;
+            regularFee: null | string;
+        };
+        ShippingLabelDto: {
+            color: string;
+            icon: null | string;
+            name: string;
+        };
         SiteDto: {
             code: string;
             configVersion: string;
@@ -1859,6 +1925,98 @@ export interface operations {
             };
         };
     };
+    GetShippingEstimate: {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Publishable, preview or secret site key. Required on every request; secret keys are server-side only. */
+                "X-Site-Key": string;
+                /** @description Market code (e.g. "se"). Omit for the site's default market. */
+                "X-Market"?: string;
+                /** @description BCP-47 language tag. Omit to use the market's language. */
+                "Accept-Language"?: string;
+                /** @description The bearer token returned by POST /v1/cart. Identifies which cart this request reads or mutates. */
+                "X-Cart-Token": string;
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ShippingEstimateDto"];
+                };
+            };
+            /** @description problem+json. NOT_FOUND (X-Cart-Token missing). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["StorefrontProblem"];
+                };
+            };
+            /** @description problem+json. SITE_KEY_MISSING or SITE_KEY_INVALID. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["StorefrontProblem"];
+                };
+            };
+            /** @description problem+json. SECRET_KEY_FROM_BROWSER: a secret key was sent from a browser. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["StorefrontProblem"];
+                };
+            };
+            /** @description problem+json. SITE_INACTIVE, or NOT_FOUND for an unrouted path. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["StorefrontProblem"];
+                };
+            };
+            /** @description problem+json. CART_EXPIRED: this cart token belongs to an expired cart. */
+            410: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["StorefrontProblem"];
+                };
+            };
+            /** @description problem+json. RATE_LIMITED; retryAfterSeconds and the Retry-After header say how long to wait. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["StorefrontProblem"];
+                };
+            };
+            /** @description problem+json. SITE_REGISTRY_WARMING or INDEX_UNAVAILABLE — retry, the request was not wrong. */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["StorefrontProblem"];
+                };
+            };
+        };
+    };
     GetCategories: {
         parameters: {
             query?: never;
@@ -2043,7 +2201,7 @@ export interface operations {
                     "application/problem+json": components["schemas"]["StorefrontProblem"];
                 };
             };
-            /** @description problem+json. CHECKOUT_UNAVAILABLE or CHECKOUT_PROVIDER_UNAVAILABLE (Retry-After); SITE_REGISTRY_WARMING. */
+            /** @description problem+json. CHECKOUT_UNAVAILABLE, SHIPPING_UNAVAILABLE (the market's shipping configuration cannot be served) or CHECKOUT_PROVIDER_UNAVAILABLE (Retry-After); SITE_REGISTRY_WARMING. */
             503: {
                 headers: {
                     [name: string]: unknown;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@asstio-dev/storefront",
-  "version": "0.14.0",
+  "version": "0.16.1",
   "description": "Typed client for the Asstio Storefront API (generated from OpenAPI).",
   "repository": {
     "type": "git",

package/src/schema.d.ts

@@ -102,6 +102,22 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/cart/shipping-estimate": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get: operations["GetShippingEstimate"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/categories": {
         parameters: {
             query?: never;
@@ -624,6 +640,14 @@ export interface components {
             /** Format: int32 */
             min: number;
         };
+        DeliveryTimeDto: {
+            /** Format: int32 */
+            maxDays: number | null | string;
+            /** Format: int32 */
+            minDays: number | null | string;
+            mode: string;
+            text: null | string;
+        };
         DescriptionDto: {
             html: string;
             text: string;
@@ -662,6 +686,11 @@ export interface components {
             facet: string;
             values: components["schemas"]["FacetValueDto"][];
         };
+        FreeShippingDto: {
+            free: boolean;
+            remaining: null | string;
+            threshold: null | string;
+        };
         /** @enum {unknown} */
         LineAvailability: "backorder" | "inStock";
         ListingResponse: {
@@ -791,6 +820,7 @@ export interface components {
             placedAt: string;
             promisedDelivery: null | components["schemas"]["DeliveryRangeDto"];
             reference: string;
+            shipping: null | components["schemas"]["OrderShippingDto"];
             status: components["schemas"]["OrderStatusDto"];
             test: boolean;
             totals: components["schemas"]["OrderTotalsDto"];
@@ -812,6 +842,21 @@ export interface components {
             variantId: null | string;
             vatRate: string;
         };
+        OrderShippingDto: {
+            carrier: string;
+            deliveryTime: null | components["schemas"]["DeliveryTimeDto"];
+            deliveryType: string;
+            fee: string;
+            name: string;
+            option: string;
+            point: null | components["schemas"]["OrderShippingPointDto"];
+        };
+        OrderShippingPointDto: {
+            city: null | string;
+            name: string;
+            postalCode: null | string;
+            street: null | string;
+        };
         OrderStatusDto: {
             fulfilment: string;
             order: string;
@@ -924,6 +969,27 @@ export interface components {
         SetCartMarketRequest: {
             market: string;
         };
+        ShippingEstimateDto: {
+            available: boolean;
+            freeShipping: null | components["schemas"]["FreeShippingDto"];
+            options: components["schemas"]["ShippingEstimateOptionDto"][];
+            reason: null | string;
+        };
+        ShippingEstimateOptionDto: {
+            deliveryType: string;
+            fee: string;
+            key: string;
+            labels: components["schemas"]["ShippingLabelDto"][];
+            name: string;
+            pointsAtCheckout: boolean;
+            preselected: boolean;
+            regularFee: null | string;
+        };
+        ShippingLabelDto: {
+            color: string;
+            icon: null | string;
+            name: string;
+        };
         SiteDto: {
             code: string;
             configVersion: string;
@@ -1859,6 +1925,98 @@ export interface operations {
             };
         };
     };
+    GetShippingEstimate: {
+        parameters: {
+            query?: never;
+            header: {
+                /** @description Publishable, preview or secret site key. Required on every request; secret keys are server-side only. */
+                "X-Site-Key": string;
+                /** @description Market code (e.g. "se"). Omit for the site's default market. */
+                "X-Market"?: string;
+                /** @description BCP-47 language tag. Omit to use the market's language. */
+                "Accept-Language"?: string;
+                /** @description The bearer token returned by POST /v1/cart. Identifies which cart this request reads or mutates. */
+                "X-Cart-Token": string;
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ShippingEstimateDto"];
+                };
+            };
+            /** @description problem+json. NOT_FOUND (X-Cart-Token missing). */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["StorefrontProblem"];
+                };
+            };
+            /** @description problem+json. SITE_KEY_MISSING or SITE_KEY_INVALID. */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["StorefrontProblem"];
+                };
+            };
+            /** @description problem+json. SECRET_KEY_FROM_BROWSER: a secret key was sent from a browser. */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["StorefrontProblem"];
+                };
+            };
+            /** @description problem+json. SITE_INACTIVE, or NOT_FOUND for an unrouted path. */
+            404: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["StorefrontProblem"];
+                };
+            };
+            /** @description problem+json. CART_EXPIRED: this cart token belongs to an expired cart. */
+            410: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["StorefrontProblem"];
+                };
+            };
+            /** @description problem+json. RATE_LIMITED; retryAfterSeconds and the Retry-After header say how long to wait. */
+            429: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["StorefrontProblem"];
+                };
+            };
+            /** @description problem+json. SITE_REGISTRY_WARMING or INDEX_UNAVAILABLE — retry, the request was not wrong. */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["StorefrontProblem"];
+                };
+            };
+        };
+    };
     GetCategories: {
         parameters: {
             query?: never;
@@ -2043,7 +2201,7 @@ export interface operations {
                     "application/problem+json": components["schemas"]["StorefrontProblem"];
                 };
             };
-            /** @description problem+json. CHECKOUT_UNAVAILABLE or CHECKOUT_PROVIDER_UNAVAILABLE (Retry-After); SITE_REGISTRY_WARMING. */
+            /** @description problem+json. CHECKOUT_UNAVAILABLE, SHIPPING_UNAVAILABLE (the market's shipping configuration cannot be served) or CHECKOUT_PROVIDER_UNAVAILABLE (Retry-After); SITE_REGISTRY_WARMING. */
             503: {
                 headers: {
                     [name: string]: unknown;