@asstio-dev/storefront 0.28.0 → 0.31.1

package/dist/account/next.d.ts

@@ -0,0 +1,82 @@
+import { type AccountResult, type PrincipalDto, type ShopperClient } from "./index.js";
+import { type CopyBrowserCartResult } from "./cart.js";
+export interface AccountActionConfig {
+    /** e.g. https://api.storefront.asstio.com */
+    baseUrl: string;
+    /** The site's server key (`sfk_srv_…`), from the server's environment. */
+    serverKey: string;
+    /** Market code, e.g. "se". */
+    market: string;
+    acceptLanguage?: string;
+    /** The frontend's own origin, e.g. https://shop.example: decides `Secure` and the `__Host-` prefix (dropped on http://localhost). */
+    origin: string;
+    /** How many proxies append to `X-Forwarded-For` in front of this server (`shopperIpFrom`). */
+    trustedHops: number;
+    /**
+     * The name of the frontend's cart cookie, if any: sent as `X-Cart-Token` at verify, set to the cart a verify or a switch hands
+     * back when it is another one and cleared when a successful one hands back none it may keep (spec §7.8), read as the saved cart
+     * by `copyBrowserCartAction`, dropped at sign-out (spec §9.2).
+     */
+    cartCookie?: string;
+    fetch?: typeof fetch;
+}
+/** What a sign-in start shows the page: no binding (it is in the cookie). */
+export interface SignInStartedView {
+    challengeId: string;
+    expiresAt: string;
+    codeLength: number;
+}
+/** What a sign-in or switch shows the page: who the shopper now is. No token. */
+export interface SignedInView {
+    principal: PrincipalDto;
+    principals: PrincipalDto[];
+    expiresAt: string;
+    /**
+     * Where to send the shopper now (spec §7.8): the safe path the sign-in started from, also when the mailed link is opened in
+     * another browser. Null when the start gave none, and always null after a switch. Redirect to it (or your default) yourself.
+     */
+    returnPath: string | null;
+}
+/**
+ * Starts a sign-in: `POST /v1/auth/sign-in`, then the binding (with the challenge id) goes into the sign-in cookie for 10
+ * minutes. An unsafe `returnPath` is dropped here as the API would. The result carries the challenge id for the code form.
+ */
+export declare function startSignInAction(config: AccountActionConfig, email: string, returnPath?: string | null): Promise<AccountResult<SignInStartedView>>;
+export interface VerifySignInActionInput {
+    /** For a code: defaults to the challenge the sign-in cookie remembers. Never used with a link, which carries its own (R12). */
+    challengeId?: string | null;
+    code?: string | null;
+    link?: string | null;
+    confirm?: boolean | null;
+}
+/**
+ * Verifies a code or link with the binding from the sign-in cookie: on success the session cookie is set (to the session's
+ * absolute expiry) and the sign-in cookie cleared. `409 SIGN_IN_CONFIRM_REQUIRED` comes back as a problem with
+ * `maskedEmail` and `siteName`; ask the shopper, then call again with `confirm: true`.
+ */
+export declare function verifySignInAction(config: AccountActionConfig, input: VerifySignInActionInput): Promise<AccountResult<SignedInView>>;
+/**
+ * Switches the principal: the rotated token replaces the session cookie at once (the old one serves GETs for 30 s only).
+ * A failure (also `SESSION_INVALID`) is returned and leaves the cookie alone: a switch that lost to a concurrent one from
+ * another tab would otherwise delete the winner's fresh cookie. Refresh the session state; only `signOutAction` clears.
+ */
+export declare function switchPrincipalAction(config: AccountActionConfig, principal: string): Promise<AccountResult<SignedInView>>;
+/**
+ * Signs out (`everywhere` ends every session of the account). The session cookie, the sign-in cookie, the cart cookie and the
+ * browser-cart cookie are cleared whatever the API answered, and also when it cannot be reached (`{ ok: false, status: 0, problem.code: "NETWORK" }`)
+ * — a session already gone is still a sign-out for this browser.
+ */
+export declare function signOutAction(config: AccountActionConfig, opts?: {
+    everywhere?: boolean;
+}): Promise<AccountResult<void>>;
+/**
+ * "Lägg till i sparad varukorg" (spec §9.2): copies the browser cart (the browser-cart cookie) into the saved cart (the cart
+ * cookie, `config.cartCookie`) with `copyBrowserCart`, under the session. The browser-cart cookie is cleared only when no line
+ * failed: a retry reuses the same idempotency keys, so lines already copied are no-ops. The result lists line ids, never a token.
+ */
+export declare function copyBrowserCartAction(config: AccountActionConfig): Promise<AccountResult<CopyBrowserCartResult>>;
+/**
+ * A client for a server component or route handler of this request, with the session from the cookie (or none). It never
+ * sets a cookie: a render cannot.
+ */
+export declare function shopperClient(config: AccountActionConfig): Promise<ShopperClient>;

package/dist/account/next.js

@@ -0,0 +1,161 @@
+/**
+ * `@asstio-dev/storefront/account/next` — Next.js (15+) server-action wrappers for sign-in and sessions (accounts spec §7.1,
+ * §7.3, §11.4): the correct default a frontend copies. Call them from your own `"use server"` actions. Each one builds a
+ * client for this request only, reads the session and binding from the cookies, sets and clears the cookies through
+ * `next/headers`, and returns a result that never carries the session token, the binding or a cart token — those live in
+ * HttpOnly cookies only, so an action result rendered or logged in the browser holds no secret.
+ *
+ * Next.js sets cookies only in server actions, route handlers and middleware. A server-component render that meets
+ * `SESSION_INVALID` renders signed-out and leaves clearing the cookie to the next action (`signOutAction` clears it).
+ */
+// "next/headers.js", not "next/headers": next has no exports map, so plain Node ESM needs the file name; bundlers resolve both.
+import { cookies, headers } from "next/headers.js";
+import { createShopperClient, localFailure, signOut, startSignIn, switchPrincipal, verifySignIn, } from "./index.js";
+import { copyBrowserCart, CopyBrowserCartError } from "./cart.js";
+import { browserCartCookie, cartCookie, cookieSecurity, readSignInCookie, sessionCookie, signInCookie, } from "./cookies.js";
+import { safeReturnPath, shopperIpFrom } from "./security.js";
+async function context(config) {
+    const jar = await cookies();
+    const security = cookieSecurity(config.origin);
+    const shopperIp = shopperIpFrom(await headers(), { trustedHops: config.trustedHops });
+    const client = (session) => createShopperClient({
+        baseUrl: config.baseUrl, serverKey: config.serverKey, market: config.market, acceptLanguage: config.acceptLanguage,
+        session, shopperIp, fetch: config.fetch,
+    });
+    return { jar, security, client };
+}
+const set = (jar, spec) => jar.set(spec);
+const read = (jar, name) => jar.get(name)?.value || null;
+const session = (jar, security) => read(jar, sessionCookie.cookieName(security));
+function signedInView(data) {
+    // The API only stores a safe path; checked again so a view never carries anything else.
+    return { principal: data.principal, principals: data.principals, expiresAt: data.session.expiresAt, returnPath: safeReturnPath(data.returnPath, "") || null };
+}
+/**
+ * Spec §7.8, §9.2 (the truth table), only after a successful verify or switch: the answer's `cart` becomes the cart cookie (the
+ * saved cart B, the adopted cart A, or the new principal's cart). With a saved cart, the browser cart A beside it goes to the
+ * browser-cart cookie for "Lägg till i sparad varukorg". Without `cart`, a verify keeps the anonymous cart only when
+ * `browserCart` names it (A has had an attempt and stays anonymous); otherwise the cookie held no usable cart for this principal
+ * — no browser cart at verify, or the previous principal's cart at a switch — and is cleared.
+ */
+function keepCarts(jar, config, security, data, current) {
+    const keep = data.cart?.token ?? data.browserCart?.token ?? null;
+    if (config.cartCookie && keep && keep !== current)
+        set(jar, cartCookie(config.cartCookie).set(keep, security));
+    if (config.cartCookie && !keep && current)
+        set(jar, cartCookie(config.cartCookie).clear(security));
+    if (data.cart && data.browserCart)
+        set(jar, browserCartCookie(data.browserCart.token, security));
+}
+function withoutData(r, view) {
+    return r.ok ? { ok: true, data: view(r.data) } : r;
+}
+/**
+ * Starts a sign-in: `POST /v1/auth/sign-in`, then the binding (with the challenge id) goes into the sign-in cookie for 10
+ * minutes. An unsafe `returnPath` is dropped here as the API would. The result carries the challenge id for the code form.
+ */
+export async function startSignInAction(config, email, returnPath) {
+    const { jar, security, client } = await context(config);
+    const path = returnPath == null ? null : safeReturnPath(returnPath, "") || null;
+    const r = await startSignIn(client(null), email, path);
+    if (r.ok)
+        set(jar, signInCookie(r.data.binding, { ...security, challengeId: r.data.challengeId })); // the challenge id for the code path
+    return withoutData(r, (d) => ({ challengeId: d.challengeId, expiresAt: d.expiresAt, codeLength: Number(d.codeLength) }));
+}
+/**
+ * Verifies a code or link with the binding from the sign-in cookie: on success the session cookie is set (to the session's
+ * absolute expiry) and the sign-in cookie cleared. `409 SIGN_IN_CONFIRM_REQUIRED` comes back as a problem with
+ * `maskedEmail` and `siteName`; ask the shopper, then call again with `confirm: true`.
+ */
+export async function verifySignInAction(config, input) {
+    const { jar, security, client } = await context(config);
+    const pending = readSignInCookie(read(jar, signInCookie.cookieName(security)));
+    // A link names its own challenge (ruling R12): never the cookie's, which may belong to a later start in this browser.
+    const challengeId = input.link ? null : input.challengeId || pending?.challengeId || null;
+    if (!input.link && !challengeId)
+        return localFailure("SIGN_IN_CHALLENGE_MISSING", "No sign-in is in progress in this browser: start a new one.");
+    const cartToken = config.cartCookie ? read(jar, config.cartCookie) : null;
+    const r = await verifySignIn(client(null), {
+        challengeId, code: input.code ?? null, link: input.link ?? null, binding: pending?.binding ?? null, confirm: input.confirm ?? null,
+    }, cartToken);
+    if (r.ok) {
+        set(jar, sessionCookie(r.data.session.token, r.data.session.expiresAt, security));
+        set(jar, signInCookie.clear(security));
+        keepCarts(jar, config, security, r.data, cartToken);
+    }
+    return withoutData(r, signedInView);
+}
+/**
+ * Switches the principal: the rotated token replaces the session cookie at once (the old one serves GETs for 30 s only).
+ * A failure (also `SESSION_INVALID`) is returned and leaves the cookie alone: a switch that lost to a concurrent one from
+ * another tab would otherwise delete the winner's fresh cookie. Refresh the session state; only `signOutAction` clears.
+ */
+export async function switchPrincipalAction(config, principal) {
+    const { jar, security, client } = await context(config);
+    const token = session(jar, security);
+    const r = await switchPrincipal(client(token), principal);
+    if (r.ok) {
+        set(jar, sessionCookie(r.data.session.token, r.data.session.expiresAt, security));
+        // The old principal keeps its cart; the new principal's cart becomes the cart cookie, or the cookie is cleared when it has none.
+        keepCarts(jar, config, security, r.data, config.cartCookie ? read(jar, config.cartCookie) : null);
+    }
+    return withoutData(r, signedInView);
+}
+/**
+ * Signs out (`everywhere` ends every session of the account). The session cookie, the sign-in cookie, the cart cookie and the
+ * browser-cart cookie are cleared whatever the API answered, and also when it cannot be reached (`{ ok: false, status: 0, problem.code: "NETWORK" }`)
+ * — a session already gone is still a sign-out for this browser.
+ */
+export async function signOutAction(config, opts = {}) {
+    const { jar, security, client } = await context(config);
+    const token = session(jar, security);
+    try {
+        return token ? await signOut(client(token), opts) : { ok: true, data: undefined };
+    }
+    catch {
+        // Spec §7.8: an unreachable API still signs this browser out; the session ends server-side at its idle expiry.
+        return localFailure("NETWORK", "The API could not be reached; this browser is signed out.");
+    }
+    finally {
+        set(jar, sessionCookie.clear(security));
+        set(jar, signInCookie.clear(security));
+        if (config.cartCookie && read(jar, config.cartCookie))
+            set(jar, cartCookie(config.cartCookie).clear(security));
+        if (read(jar, browserCartCookie.cookieName(security)))
+            set(jar, browserCartCookie.clear(security));
+    }
+}
+/**
+ * "Lägg till i sparad varukorg" (spec §9.2): copies the browser cart (the browser-cart cookie) into the saved cart (the cart
+ * cookie, `config.cartCookie`) with `copyBrowserCart`, under the session. The browser-cart cookie is cleared only when no line
+ * failed: a retry reuses the same idempotency keys, so lines already copied are no-ops. The result lists line ids, never a token.
+ */
+export async function copyBrowserCartAction(config) {
+    const { jar, security, client } = await context(config);
+    const browser = read(jar, browserCartCookie.cookieName(security));
+    if (!browser)
+        return localFailure("BROWSER_CART_MISSING", "There is no browser cart to copy.");
+    const saved = config.cartCookie ? read(jar, config.cartCookie) : null;
+    if (!saved)
+        return localFailure("CART_MISSING", "There is no saved cart to copy into.");
+    let result;
+    try {
+        result = await copyBrowserCart(client(session(jar, security)), browser, saved);
+    }
+    catch (e) {
+        if (e instanceof CopyBrowserCartError && e.problem)
+            return { ok: false, status: e.status, problem: e.problem };
+        return localFailure("NETWORK", "The browser cart could not be read; nothing was copied.");
+    }
+    if (result.failed.length === 0)
+        set(jar, browserCartCookie.clear(security));
+    return { ok: true, data: result };
+}
+/**
+ * A client for a server component or route handler of this request, with the session from the cookie (or none). It never
+ * sets a cookie: a render cannot.
+ */
+export async function shopperClient(config) {
+    const { jar, security, client } = await context(config);
+    return client(session(jar, security));
+}

package/dist/account/security.d.ts

@@ -0,0 +1,30 @@
+/** Request-hop guards for the account flow (accounts spec §6.2, §7.4, §13.1). */
+/** `Headers`, Next.js's `headers()`, or a plain object of header values. */
+export type HeadersLike = {
+    get(name: string): string | null;
+} | Record<string, string | string[] | undefined>;
+/**
+ * The shopper's IP from `X-Forwarded-For` for `X-Shopper-Ip`. `trustedHops` is how many proxies you run in front of the
+ * server, each appending the address it saw: the shopper is the entry the outermost of them appended, `trustedHops` from
+ * the right. Anything left of it is the client's own word and is skipped. Null when the header has fewer entries than
+ * trusted hops, `trustedHops` is 0, or the entry is not an IP address.
+ */
+export declare function shopperIpFrom(headers: HeadersLike, opts: {
+    trustedHops: number;
+}): string | null;
+export declare class CrossOriginError extends Error {
+    readonly origin: string | null;
+    constructor(origin: string | null);
+}
+/**
+ * For a route handler that changes state (spec §7.4): throws `CrossOriginError` unless the `Origin` header is one of
+ * `origins`. Server actions get the same check from Next.js; route handlers do not.
+ */
+export declare function assertSameOrigin(request: {
+    headers: HeadersLike;
+}, origins: readonly string[]): void;
+/**
+ * The API's return-path rule (`ReturnPaths.IsSafe`): a same-origin path — `/` not followed by `/` or `\`, at most 512
+ * characters, no control character. Returns the path when it is one, else `fallback` (also for null or empty).
+ */
+export declare function safeReturnPath(path: string | null | undefined, fallback?: string): string;

package/dist/account/security.js

@@ -0,0 +1,85 @@
+/** Request-hop guards for the account flow (accounts spec §6.2, §7.4, §13.1). */
+function header(headers, name) {
+    if (typeof headers.get === "function")
+        return headers.get(name);
+    const record = headers;
+    const key = Object.keys(record).find((k) => k.toLowerCase() === name);
+    const value = key === undefined ? undefined : record[key];
+    return Array.isArray(value) ? value.join(",") : value ?? null;
+}
+const IPV4 = /^(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}$/;
+const IPV6 = /^[0-9a-f:.]+$/i;
+function isIp(value) {
+    if (IPV4.test(value))
+        return true;
+    if (!value.includes(":") || !IPV6.test(value))
+        return false;
+    try {
+        new URL(`http://[${value}]/`);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The shopper's IP from `X-Forwarded-For` for `X-Shopper-Ip`. `trustedHops` is how many proxies you run in front of the
+ * server, each appending the address it saw: the shopper is the entry the outermost of them appended, `trustedHops` from
+ * the right. Anything left of it is the client's own word and is skipped. Null when the header has fewer entries than
+ * trusted hops, `trustedHops` is 0, or the entry is not an IP address.
+ */
+export function shopperIpFrom(headers, opts) {
+    const hops = Math.floor(opts.trustedHops);
+    if (!(hops > 0))
+        return null;
+    const raw = header(headers, "x-forwarded-for");
+    if (!raw)
+        return null;
+    const entries = raw.split(",").map((e) => e.trim()).filter((e) => e.length > 0);
+    if (entries.length < hops)
+        return null;
+    const ip = entries[entries.length - hops];
+    return isIp(ip) ? ip : null;
+}
+export class CrossOriginError extends Error {
+    origin;
+    constructor(origin) {
+        super(origin === null ? "The request has no Origin header." : `The origin ${origin} is not allowed.`);
+        this.origin = origin;
+        this.name = "CrossOriginError";
+    }
+}
+/**
+ * For a route handler that changes state (spec §7.4): throws `CrossOriginError` unless the `Origin` header is one of
+ * `origins`. Server actions get the same check from Next.js; route handlers do not.
+ */
+export function assertSameOrigin(request, origins) {
+    const origin = header(request.headers, "origin");
+    if (!origin || origin === "null")
+        throw new CrossOriginError(origin);
+    let actual;
+    try {
+        actual = new URL(origin).origin;
+    }
+    catch {
+        throw new CrossOriginError(origin);
+    }
+    if (!origins.some((o) => new URL(o).origin === actual))
+        throw new CrossOriginError(origin);
+}
+/** The API's `ReturnPaths.MaxLength`. */
+const MAX_RETURN_PATH = 512;
+/** char.IsControl: U+0000–U+001F and U+007F–U+009F. */
+// eslint-disable-next-line no-control-regex
+const CONTROL = /[\u0000-\u001f\u007f-\u009f]/;
+/**
+ * The API's return-path rule (`ReturnPaths.IsSafe`): a same-origin path — `/` not followed by `/` or `\`, at most 512
+ * characters, no control character. Returns the path when it is one, else `fallback` (also for null or empty).
+ */
+export function safeReturnPath(path, fallback = "/") {
+    if (!path || path.length > MAX_RETURN_PATH || path[0] !== "/")
+        return fallback;
+    if (path.length > 1 && (path[1] === "/" || path[1] === "\\"))
+        return fallback;
+    return CONTROL.test(path) ? fallback : path;
+}

package/dist/checkout/server.d.ts

@@ -2,7 +2,16 @@ import type { Client } from "openapi-fetch";
 import type { StorefrontPaths } from "../index.js";
 import { type CheckoutResult, type LiveShippingResult, type OrderResult, type StatusResult } from "./types.js";
 export type CheckoutClient = Client<StorefrontPaths>;
-export interface StartCheckoutOptions {
+/**
+ * Accounts (spec §9.1, §9.2): a signed-in frontend passes its request-scoped shopper client — `createShopperClient` from
+ * `@asstio-dev/storefront/account`, with the server key and the session — and the call goes through it instead of `client`, so
+ * `X-Shopper-Session` travels: a saved (owned) cart checks out only under its owner's session, and the order records the
+ * principal. Signed out, omit it (or pass `null`): the call is exactly today's. Server-side only, like the shopper client itself.
+ */
+export interface ShopperOption {
+    shopper?: CheckoutClient | null;
+}
+export interface StartCheckoutOptions extends ShopperOption {
     /** One of `GET /v1/site` → `markets[].checkout.options[].key`; omit for the market's default. */
     option?: string;
     /** Replaces the market's origin in the URLs handed to the provider; must be one of the site's allowed origins. */
@@ -22,14 +31,15 @@ export declare function startCheckout(client: CheckoutClient, cartToken: string,
  * Never repeats a cart mutation: it only syncs. */
 export declare function syncCheckout(client: CheckoutClient, cartToken: string, opts?: StartCheckoutOptions, retry?: SyncRetryOptions): Promise<CheckoutResult>;
 /** `POST /v1/checkout/{attemptId}/complete`: the confirmation page's call; with the cart token the answer carries the order's access token (spec §8.3). */
-export declare function completeCheckout(client: CheckoutClient, attemptId: string, cartToken?: string): Promise<StatusResult>;
+export declare function completeCheckout(client: CheckoutClient, attemptId: string, cartToken?: string, opts?: ShopperOption): Promise<StatusResult>;
 /** `GET /v1/checkout/{attemptId}`: the non-mutating status read the browser module polls with. */
-export declare function getCheckoutStatus(client: CheckoutClient, attemptId: string, cartToken: string): Promise<StatusResult>;
+export declare function getCheckoutStatus(client: CheckoutClient, attemptId: string, cartToken: string, opts?: ShopperOption): Promise<StatusResult>;
 /** `GET /v1/checkout/{attemptId}/shipping` with the cart token: the live shipping view behind `mountCheckout`'s `liveShipping`.
  * Forward `retryAfter` (the `Retry-After` header) from a proxy; a 200 `unavailable` view may carry it too. */
-export declare function liveShippingFor(client: CheckoutClient, cartToken: string, attemptId: string): Promise<LiveShippingResult>;
-/** `GET /v1/orders/{orderId}` with `X-Order-Token` — a header only, never a query string (spec §8.3). */
-export declare function getOrder(client: CheckoutClient, orderId: string, token: string): Promise<OrderResult>;
+export declare function liveShippingFor(client: CheckoutClient, cartToken: string, attemptId: string, opts?: ShopperOption): Promise<LiveShippingResult>;
+/** `GET /v1/orders/{orderId}` with `X-Order-Token` — a header only, never a query string (spec §8.3). A company order opens to its
+ * own membership's session alone (`{ shopper }`, token `null`); its order token never opens it. */
+export declare function getOrder(client: CheckoutClient, orderId: string, token: string | null, opts?: ShopperOption): Promise<OrderResult>;
 export interface AwaitCompletionOptions {
     firstDelayMs?: number;
     maxDelayMs?: number;

package/dist/checkout/server.js

@@ -1,8 +1,9 @@
 import { localProblem, retryAfterSeconds } from "./types.js";
+const via = (client, opts) => opts.shopper ?? client;
 const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 /** `POST /v1/checkout`: creates the cart's attempt or converges on the live one (spec §5.3). Call it from a Server Action or route handler, never during render. */
 export async function startCheckout(client, cartToken, opts = {}) {
-    const { data, error, response } = await client.POST("/v1/checkout", {
+    const { data, error, response } = await via(client, opts).POST("/v1/checkout", {
         body: { option: opts.option ?? null, returnOrigin: opts.returnOrigin ?? null },
         headers: { "X-Cart-Token": cartToken },
     });
@@ -25,8 +26,8 @@ export async function syncCheckout(client, cartToken, opts = {}, retry = {}) {
     return result;
 }
 /** `POST /v1/checkout/{attemptId}/complete`: the confirmation page's call; with the cart token the answer carries the order's access token (spec §8.3). */
-export async function completeCheckout(client, attemptId, cartToken) {
-    const { data, error, response } = await client.POST("/v1/checkout/{attemptId}/complete", {
+export async function completeCheckout(client, attemptId, cartToken, opts = {}) {
+    const { data, error, response } = await via(client, opts).POST("/v1/checkout/{attemptId}/complete", {
         params: { path: { attemptId } },
         headers: cartToken ? { "X-Cart-Token": cartToken } : {},
     });
@@ -35,24 +36,25 @@ export async function completeCheckout(client, attemptId, cartToken) {
     return { ok: true, data };
 }
 /** `GET /v1/checkout/{attemptId}`: the non-mutating status read the browser module polls with. */
-export async function getCheckoutStatus(client, attemptId, cartToken) {
-    const { data, error, response } = await client.GET("/v1/checkout/{attemptId}", { params: { path: { attemptId } }, headers: { "X-Cart-Token": cartToken } });
+export async function getCheckoutStatus(client, attemptId, cartToken, opts = {}) {
+    const { data, error, response } = await via(client, opts).GET("/v1/checkout/{attemptId}", { params: { path: { attemptId } }, headers: { "X-Cart-Token": cartToken } });
     if (error || !data)
         return { ok: false, status: response.status, problem: (error ?? localProblem("SDK_EMPTY_ANSWER", "no body")), retryAfter: retryAfterSeconds(response) };
     return { ok: true, data };
 }
 /** `GET /v1/checkout/{attemptId}/shipping` with the cart token: the live shipping view behind `mountCheckout`'s `liveShipping`.
  * Forward `retryAfter` (the `Retry-After` header) from a proxy; a 200 `unavailable` view may carry it too. */
-export async function liveShippingFor(client, cartToken, attemptId) {
-    const { data, error, response } = await client.GET("/v1/checkout/{attemptId}/shipping", { params: { path: { attemptId } }, headers: { "X-Cart-Token": cartToken } });
+export async function liveShippingFor(client, cartToken, attemptId, opts = {}) {
+    const { data, error, response } = await via(client, opts).GET("/v1/checkout/{attemptId}/shipping", { params: { path: { attemptId } }, headers: { "X-Cart-Token": cartToken } });
     const retryAfter = retryAfterSeconds(response);
     if (error || !data)
         return { ok: false, status: response.status, problem: (error ?? localProblem("SDK_EMPTY_ANSWER", "no body")), retryAfter };
     return { ok: true, data, retryAfter };
 }
-/** `GET /v1/orders/{orderId}` with `X-Order-Token` — a header only, never a query string (spec §8.3). */
-export async function getOrder(client, orderId, token) {
-    const { data, error, response } = await client.GET("/v1/orders/{orderId}", { params: { path: { orderId } }, headers: { "X-Order-Token": token } });
+/** `GET /v1/orders/{orderId}` with `X-Order-Token` — a header only, never a query string (spec §8.3). A company order opens to its
+ * own membership's session alone (`{ shopper }`, token `null`); its order token never opens it. */
+export async function getOrder(client, orderId, token, opts = {}) {
+    const { data, error, response } = await via(client, opts).GET("/v1/orders/{orderId}", { params: { path: { orderId } }, headers: token ? { "X-Order-Token": token } : {} });
     if (error || !data)
         return { ok: false, status: response.status, problem: (error ?? localProblem("SDK_EMPTY_ANSWER", "no body")) };
     return { ok: true, data };

package/dist/index.d.ts

@@ -47,7 +47,7 @@ export type FilterSelection = NonNullable<NonNullable<paths["/v1/products"]["get
 export declare function filterQuery(selection: Record<string, string | string[] | undefined>): FilterSelection;
 export { decodeFilterValues, encodeFilterValues } from "./filters.js";
 export { coverOffset, fileUrl, fillFactor, formatFactor, formatImage, imageRect, mediaHash, mediaUrl, MediaUrlError, pickWidth, pictureSources, posterUrl, scaledSizes, srcSet, styleToCss, videoSources, type FormatFit, type FormattedImage, type MediaConfig, type MediaDescriptor, type MediaFormat, type PictureSources, type SlotSize, type VideoSource, } from "./media.js";
-export { awaitCompletion, completeCheckout, getCheckoutStatus, getOrder, liveShippingFor, startCheckout, syncCheckout, type CheckoutClient, type StartCheckoutOptions, type SyncRetryOptions, type AwaitCompletionOptions } from "./checkout/server.js";
+export { awaitCompletion, completeCheckout, getCheckoutStatus, getOrder, liveShippingFor, startCheckout, syncCheckout, type CheckoutClient, type ShopperOption, type StartCheckoutOptions, type SyncRetryOptions, type AwaitCompletionOptions } from "./checkout/server.js";
 export { retryAfterSeconds, type CheckoutDto, type CheckoutOrderRefDto, type CheckoutResult, type CheckoutShippingViewDto, type LiveShippingResult, type CheckoutStatusDto, type CheckoutWidgetDto, type OrderDto, type OrderResult, type StatusResult, type StorefrontProblem } from "./checkout/types.js";
 export { mountCheckout, type CheckoutHandle, type MountOptions, type MinimalDocument, type MinimalElement, type MinimalScript } from "./checkout/browser.js";
 export { controllers, type CheckoutController, type ProviderWindow } from "./checkout/controllers.js";
@@ -55,6 +55,7 @@ export { breadcrumbJsonLd } from "./seo/breadcrumb.js";
 export { brandHead, collectionHead, productHead, toNextMetadata } from "./seo/head.js";
 export { gtinJsonLd } from "./gtin.js";
 export { productJsonLd } from "./seo/product.js";
+export { sitemapEntries, toNextSitemap, type NextSitemapEntry, type SitemapOptions, type SitemapResult, type SitemapType, type SitemapUrl } from "./seo/sitemap.js";
 export { jsonLdScript } from "./seo/serialize.js";
 export { productFacts } from "./analytics/facts.js";
 export { longestCategory, toGa4Ecommerce, toGa4Item } from "./analytics/ga4.js";

package/dist/index.js

@@ -44,6 +44,7 @@ export { breadcrumbJsonLd } from "./seo/breadcrumb.js";
 export { brandHead, collectionHead, productHead, toNextMetadata } from "./seo/head.js";
 export { gtinJsonLd } from "./gtin.js";
 export { productJsonLd } from "./seo/product.js";
+export { sitemapEntries, toNextSitemap } from "./seo/sitemap.js";
 export { jsonLdScript } from "./seo/serialize.js";
 export { productFacts } from "./analytics/facts.js";
 export { longestCategory, toGa4Ecommerce, toGa4Item } from "./analytics/ga4.js";