@asteby/storefront 0.9.0 → 0.11.0

package/dist/mockup.d.cts

@@ -1,4 +1,4 @@
-import { ah as Product, an as ProductVariant } from './types-CSMuPSQA.cjs';
+import { aE as Product, aK as ProductVariant } from './types-C-Ley-Mt.cjs';
 import './geo.cjs';
 
 /**

package/dist/mockup.d.ts

@@ -1,4 +1,4 @@
-import { ah as Product, an as ProductVariant } from './types-iGGZ9EiC.js';
+import { aE as Product, aK as ProductVariant } from './types-D7UJxrba.js';
 import './geo.js';
 
 /**

package/dist/node.cjs

@@ -0,0 +1,243 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/node.ts
+var node_exports = {};
+__export(node_exports, {
+  ConnectError: () => ConnectError,
+  SDK_VERSION: () => SDK_VERSION,
+  connectStore: () => connectStore,
+  createFileTokenSource: () => createFileTokenSource,
+  loadConnectionState: () => loadConnectionState,
+  redeemConnectionCode: () => redeemConnectionCode,
+  saveConnection: () => saveConnection,
+  stateFileFor: () => stateFileFor,
+  storefrontTokenFromEnv: () => storefrontTokenFromEnv,
+  writeFileAtomic: () => writeFileAtomic
+});
+module.exports = __toCommonJS(node_exports);
+var import_node_fs = require("fs");
+var import_node_path = require("path");
+var import_node_os = require("os");
+
+// src/diagnose.ts
+function maskToken(token) {
+  if (!token) return "(sin token)";
+  const prefix = /^[a-z]{2}_/.exec(token)?.[0] ?? "";
+  return token.length <= prefix.length + 8 ? `${prefix}\u2026` : `${prefix}\u2026${token.slice(-4)}`;
+}
+
+// src/node.ts
+var SDK_VERSION = true ? "0.11.0" : "dev";
+function createFileTokenSource(file, options = {}) {
+  const ttl = options.ttlMs ?? 3e4;
+  const now = options.now ?? Date.now;
+  let token = "";
+  let stamp = "";
+  let checkedAt = -Infinity;
+  return () => {
+    if (token && now() - checkedAt < ttl) return token;
+    checkedAt = now();
+    try {
+      const st = (0, import_node_fs.statSync)(file);
+      const next = `${st.mtimeMs}:${st.size}`;
+      if (!token || next !== stamp) {
+        const text = (0, import_node_fs.readFileSync)(file, "utf8").trim();
+        if (text) {
+          token = text;
+          stamp = next;
+        } else if (!token) {
+          throw new Error("token file is empty");
+        }
+      }
+    } catch (err) {
+      if (!token) throw new Error(`Cannot read the storefront token file ${file}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return token;
+  };
+}
+function storefrontTokenFromEnv(env = process.env, options = {}) {
+  const file = env.STOREFRONT_TOKEN_FILE?.trim();
+  if (file) return createFileTokenSource(file, options);
+  const dir = env.CREDENTIALS_DIRECTORY?.trim();
+  if (dir) {
+    const f = (0, import_node_path.join)(dir, "storefront_token");
+    if ((0, import_node_fs.existsSync)(f)) return createFileTokenSource(f, options);
+  }
+  const plain = env.STOREFRONT_TOKEN?.trim();
+  return plain || void 0;
+}
+function writeFileAtomic(file, content, mode = 384) {
+  const dir = (0, import_node_path.dirname)(file);
+  (0, import_node_fs.mkdirSync)(dir, { recursive: true });
+  const tmp = (0, import_node_path.join)(dir, `.${file.split("/").pop()}.${process.pid}.${Date.now().toString(36)}.tmp`);
+  const fd = (0, import_node_fs.openSync)(tmp, "wx", mode);
+  try {
+    (0, import_node_fs.writeSync)(fd, content);
+    (0, import_node_fs.fsyncSync)(fd);
+  } catch (err) {
+    (0, import_node_fs.closeSync)(fd);
+    try {
+      (0, import_node_fs.unlinkSync)(tmp);
+    } catch {
+    }
+    throw err;
+  }
+  (0, import_node_fs.closeSync)(fd);
+  try {
+    (0, import_node_fs.chmodSync)(tmp, mode);
+    (0, import_node_fs.renameSync)(tmp, file);
+  } catch (err) {
+    try {
+      (0, import_node_fs.unlinkSync)(tmp);
+    } catch {
+    }
+    throw err;
+  }
+}
+var ConnectError = class extends Error {
+  constructor(kind, message, status = 0) {
+    super(message);
+    this.kind = kind;
+    this.status = status;
+  }
+  kind;
+  status;
+  name = "ConnectError";
+};
+var trimSlash = (u) => u.replace(/\/+$/, "");
+async function post(fetchImpl, url, body, bearer) {
+  let res;
+  try {
+    res = await fetchImpl(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Accept: "application/json", ...bearer ? { Authorization: `Bearer ${bearer}` } : {} },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(15e3)
+    });
+  } catch {
+    throw new ConnectError("network", "No pudimos comunicarnos con OPS. Revisa la direcci\xF3n y tu conexi\xF3n a internet.");
+  }
+  const text = await res.text().catch(() => "");
+  if (!res.ok) {
+    if (res.status === 429) throw new ConnectError("rate_limited", "Demasiados intentos. Espera unos minutos e int\xE9ntalo de nuevo.", 429);
+    if (res.status === 401 || res.status === 403) throw new ConnectError("unauthorized", "OPS rechaz\xF3 la credencial de esta tienda.", res.status);
+    if (res.status >= 500) throw new ConnectError("server", "OPS no pudo atender la solicitud. Int\xE9ntalo de nuevo en un momento.", res.status);
+    throw new ConnectError("invalid_code", "El c\xF3digo no es v\xE1lido, ya se us\xF3 o venci\xF3. Genera uno nuevo en OPS \u2192 Conexiones y API.", res.status);
+  }
+  if (!text) return void 0;
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new ConnectError("invalid_response", "OPS respondi\xF3 algo que no entendimos.", res.status);
+  }
+}
+function assertRedeem(r) {
+  const o = r;
+  if (!o || typeof o.secret_token !== "string" || !o.secret_token || typeof o.connection_id !== "string" || !Array.isArray(o.scopes)) {
+    throw new ConnectError("invalid_response", "OPS respondi\xF3 algo que no entendimos.");
+  }
+}
+async function redeemConnectionCode(opts) {
+  const fetchImpl = opts.fetch ?? globalThis.fetch.bind(globalThis);
+  const client_info = { sdk_version: SDK_VERSION, hostname: (0, import_node_os.hostname)(), ...opts.siteUrl ? { site_url: opts.siteUrl } : {} };
+  const res = await post(fetchImpl, `${trimSlash(opts.opsUrl)}/api/connect/v1/redeem`, { code: opts.code.trim(), client_info });
+  assertRedeem(res);
+  return res;
+}
+var stateFileFor = (tokenFile) => `${tokenFile}.json`;
+function saveConnection(tokenFile, r, opsUrl = r.ops_url) {
+  const state = { ops_url: trimSlash(r.ops_url || opsUrl), connection_id: r.connection_id, environment: r.environment, scopes: r.scopes, rotate_after: r.rotate_after };
+  writeFileAtomic(stateFileFor(tokenFile), JSON.stringify(state, null, 2) + "\n");
+  writeFileAtomic(tokenFile, r.secret_token + "\n");
+}
+function loadConnectionState(tokenFile) {
+  try {
+    return JSON.parse((0, import_node_fs.readFileSync)(stateFileFor(tokenFile), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function connectStore(options = {}) {
+  const tokenFile = (0, import_node_path.resolve)(options.tokenFile ?? process.env.STOREFRONT_TOKEN_FILE ?? "storefront_token");
+  const fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);
+  const now = options.now ?? Date.now;
+  const report = (m) => {
+    try {
+      options.onError?.(m);
+    } catch {
+    }
+  };
+  async function tick() {
+    const state = loadConnectionState(tokenFile);
+    const opsUrl = options.opsUrl ?? state?.ops_url;
+    let token;
+    try {
+      token = (0, import_node_fs.readFileSync)(tokenFile, "utf8").trim();
+    } catch {
+      report(`No se pudo leer el archivo del token (${tokenFile}).`);
+      return "failed";
+    }
+    if (!opsUrl || !token) {
+      report("Falta la direcci\xF3n de OPS o el token: vuelve a ejecutar `npx @asteby/storefront connect`.");
+      return "failed";
+    }
+    const base = `${trimSlash(opsUrl)}/api/connect/v1`;
+    try {
+      await post(fetchImpl, `${base}/heartbeat`, { sdk_version: SDK_VERSION, hostname: (0, import_node_os.hostname)() }, token);
+      const due = state?.rotate_after ? Date.parse(state.rotate_after) : NaN;
+      if (!Number.isNaN(due) && now() >= due) {
+        const next = await post(fetchImpl, `${base}/rotate`, {}, token);
+        assertRedeem(next);
+        saveConnection(tokenFile, { ...next, ops_url: next.ops_url || opsUrl }, opsUrl);
+        return "rotated";
+      }
+      return "ok";
+    } catch (err) {
+      report(err instanceof ConnectError ? `${err.message} (${maskToken(token)})` : `Fall\xF3 el latido de la conexi\xF3n (${maskToken(token)}).`);
+      return "failed";
+    }
+  }
+  return {
+    tokenFile,
+    /** One heartbeat (+ rotation when due). Resolves, never rejects. */
+    tick,
+    /** Starts the periodic heartbeat; returns `stop()`. */
+    keepFresh(opts = {}) {
+      const timer = setInterval(() => void tick(), opts.intervalMs ?? 6e5);
+      timer.unref?.();
+      void tick();
+      return () => clearInterval(timer);
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ConnectError,
+  SDK_VERSION,
+  connectStore,
+  createFileTokenSource,
+  loadConnectionState,
+  redeemConnectionCode,
+  saveConnection,
+  stateFileFor,
+  storefrontTokenFromEnv,
+  writeFileAtomic
+});
+//# sourceMappingURL=node.cjs.map

package/dist/node.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/node.ts","../src/diagnose.ts"],"sourcesContent":["/**\n * Node-only helpers (`@asteby/storefront/node`): read the store's token from a file that can rotate, and the\n * connection protocol with OPS (`connectStore`). Nothing here runs in browsers or edge runtimes.\n */\nimport { chmodSync, closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeSync } from 'node:fs'\nimport { dirname, join, resolve } from 'node:path'\nimport { hostname } from 'node:os'\nimport { maskToken } from './diagnose.js'\nimport type { FetchLike } from './client.js'\n\ndeclare const __SDK_VERSION__: string | undefined\nexport const SDK_VERSION: string = typeof __SDK_VERSION__ === 'string' ? __SDK_VERSION__ : 'dev'\n\n// ---------------------------------------------------------------------------\n// Token from a file\n// ---------------------------------------------------------------------------\n\nexport type FileTokenSourceOptions = {\n  /** How often the file is checked again (default 30 s). Between checks the cached token is returned. */\n  ttlMs?: number\n  /** Clock, for tests. */\n  now?: () => number\n}\n\n/**\n * A `() => string` for `createStorefrontClient({ token })` that reads `file`, caches it and looks again every\n * `ttlMs` (30 s): the file is read only when its mtime or size changed. A failed re-read keeps the last good token\n * (a rotation in progress never takes the store down); only a first read that fails throws.\n */\nexport function createFileTokenSource(file: string, options: FileTokenSourceOptions = {}): () => string {\n  const ttl = options.ttlMs ?? 30_000\n  const now = options.now ?? Date.now\n  let token = ''\n  let stamp = ''\n  let checkedAt = -Infinity\n  return () => {\n    if (token && now() - checkedAt < ttl) return token\n    checkedAt = now()\n    try {\n      const st = statSync(file)\n      const next = `${st.mtimeMs}:${st.size}`\n      if (!token || next !== stamp) {\n        const text = readFileSync(file, 'utf8').trim()\n        if (text) {\n          token = text\n          stamp = next\n        } else if (!token) {\n          throw new Error('token file is empty')\n        }\n      }\n    } catch (err) {\n      if (!token) throw new Error(`Cannot read the storefront token file ${file}: ${err instanceof Error ? err.message : String(err)}`)\n    }\n    return token\n  }\n}\n\nexport type TokenEnv = Record<string, string | undefined>\n\n/**\n * The store's token from the environment, in this order:\n * 1. `STOREFRONT_TOKEN_FILE` (path),\n * 2. `$CREDENTIALS_DIRECTORY/storefront_token` (systemd `LoadCredential=`),\n * 3. `STOREFRONT_TOKEN` (the plain variable, as before).\n * Files come back as a rotating source (re-read every 30 s); the variable as a plain string. `undefined` when\n * nothing is configured.\n */\nexport function storefrontTokenFromEnv(env: TokenEnv = process.env, options: FileTokenSourceOptions = {}): string | (() => string) | undefined {\n  const file = env.STOREFRONT_TOKEN_FILE?.trim()\n  if (file) return createFileTokenSource(file, options)\n  const dir = env.CREDENTIALS_DIRECTORY?.trim()\n  if (dir) {\n    const f = join(dir, 'storefront_token')\n    if (existsSync(f)) return createFileTokenSource(f, options)\n  }\n  const plain = env.STOREFRONT_TOKEN?.trim()\n  return plain || undefined\n}\n\n// ---------------------------------------------------------------------------\n// Atomic write\n// ---------------------------------------------------------------------------\n\n/** Writes `content` to `file` atomically (temp file in the same directory, fsync, rename) with mode 0600. */\nexport function writeFileAtomic(file: string, content: string, mode = 0o600): void {\n  const dir = dirname(file)\n  mkdirSync(dir, { recursive: true })\n  const tmp = join(dir, `.${file.split('/').pop()}.${process.pid}.${Date.now().toString(36)}.tmp`)\n  const fd = openSync(tmp, 'wx', mode)\n  try {\n    writeSync(fd, content)\n    fsyncSync(fd)\n  } catch (err) {\n    closeSync(fd)\n    try {\n      unlinkSync(tmp)\n    } catch {\n      /* best effort */\n    }\n    throw err\n  }\n  closeSync(fd)\n  try {\n    chmodSync(tmp, mode) // umask can only remove bits at creation; make it exact\n    renameSync(tmp, file)\n  } catch (err) {\n    try {\n      unlinkSync(tmp)\n    } catch {\n      /* best effort */\n    }\n    throw err\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Connection protocol\n// ---------------------------------------------------------------------------\n\nexport type RedeemResponse = {\n  ops_url: string\n  connection_id: string\n  environment: string\n  secret_token: string\n  publishable_token?: string\n  scopes: string[]\n  /** ISO time from which the token should be rotated. */\n  rotate_after: string\n}\n\nexport type ConnectClientInfo = { sdk_version: string; hostname: string; site_url?: string }\n\n/** Why a connection call failed, in terms an operator can act on. */\nexport type ConnectErrorKind = 'invalid_code' | 'rate_limited' | 'network' | 'unauthorized' | 'server' | 'invalid_response'\n\nexport class ConnectError extends Error {\n  override readonly name = 'ConnectError'\n  constructor(\n    readonly kind: ConnectErrorKind,\n    message: string,\n    readonly status = 0,\n  ) {\n    super(message)\n  }\n}\n\nconst trimSlash = (u: string) => u.replace(/\\/+$/, '')\n\nasync function post<T>(fetchImpl: FetchLike, url: string, body: unknown, bearer?: string): Promise<T> {\n  let res: Response\n  try {\n    res = await fetchImpl(url, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json', Accept: 'application/json', ...(bearer ? { Authorization: `Bearer ${bearer}` } : {}) },\n      body: JSON.stringify(body),\n      signal: AbortSignal.timeout(15_000),\n    })\n  } catch {\n    throw new ConnectError('network', 'No pudimos comunicarnos con OPS. Revisa la dirección y tu conexión a internet.')\n  }\n  const text = await res.text().catch(() => '')\n  if (!res.ok) {\n    if (res.status === 429) throw new ConnectError('rate_limited', 'Demasiados intentos. Espera unos minutos e inténtalo de nuevo.', 429)\n    if (res.status === 401 || res.status === 403) throw new ConnectError('unauthorized', 'OPS rechazó la credencial de esta tienda.', res.status)\n    if (res.status >= 500) throw new ConnectError('server', 'OPS no pudo atender la solicitud. Inténtalo de nuevo en un momento.', res.status)\n    throw new ConnectError('invalid_code', 'El código no es válido, ya se usó o venció. Genera uno nuevo en OPS → Conexiones y API.', res.status)\n  }\n  if (!text) return undefined as T\n  try {\n    return JSON.parse(text) as T\n  } catch {\n    throw new ConnectError('invalid_response', 'OPS respondió algo que no entendimos.', res.status)\n  }\n}\n\nfunction assertRedeem(r: unknown): asserts r is RedeemResponse {\n  const o = r as Partial<RedeemResponse> | undefined\n  if (!o || typeof o.secret_token !== 'string' || !o.secret_token || typeof o.connection_id !== 'string' || !Array.isArray(o.scopes)) {\n    throw new ConnectError('invalid_response', 'OPS respondió algo que no entendimos.')\n  }\n}\n\nexport type RedeemOptions = { opsUrl: string; code: string; siteUrl?: string; fetch?: FetchLike }\n\n/** Exchanges the one-time connection code for the store's token. `POST {ops}/api/connect/v1/redeem`. */\nexport async function redeemConnectionCode(opts: RedeemOptions): Promise<RedeemResponse> {\n  const fetchImpl = opts.fetch ?? (globalThis.fetch.bind(globalThis) as FetchLike)\n  const client_info: ConnectClientInfo = { sdk_version: SDK_VERSION, hostname: hostname(), ...(opts.siteUrl ? { site_url: opts.siteUrl } : {}) }\n  const res = await post<unknown>(fetchImpl, `${trimSlash(opts.opsUrl)}/api/connect/v1/redeem`, { code: opts.code.trim(), client_info })\n  assertRedeem(res)\n  return res\n}\n\n/** What is kept next to the token file: everything but the secret. */\nexport type ConnectionState = {\n  ops_url: string\n  connection_id: string\n  environment: string\n  scopes: string[]\n  rotate_after: string\n}\n\nexport const stateFileFor = (tokenFile: string) => `${tokenFile}.json`\n\n/** Saves a redeemed/rotated connection: the token (0600, atomic) and its non-secret state beside it. */\nexport function saveConnection(tokenFile: string, r: RedeemResponse, opsUrl = r.ops_url): void {\n  const state: ConnectionState = { ops_url: trimSlash(r.ops_url || opsUrl), connection_id: r.connection_id, environment: r.environment, scopes: r.scopes, rotate_after: r.rotate_after }\n  // State first: if the process dies in between, the old token still works and rotation is just retried.\n  writeFileAtomic(stateFileFor(tokenFile), JSON.stringify(state, null, 2) + '\\n')\n  writeFileAtomic(tokenFile, r.secret_token + '\\n')\n}\n\nexport function loadConnectionState(tokenFile: string): ConnectionState | null {\n  try {\n    return JSON.parse(readFileSync(stateFileFor(tokenFile), 'utf8')) as ConnectionState\n  } catch {\n    return null\n  }\n}\n\nexport type ConnectStoreOptions = {\n  /** OPS base URL (`https://ops.example.com`). Defaults to the one saved by `connect`. */\n  opsUrl?: string\n  /** File `connect` wrote (default: `STOREFRONT_TOKEN_FILE`, then `./storefront_token`). */\n  tokenFile?: string\n  fetch?: FetchLike\n  /** Clock, for tests. */\n  now?: () => number\n  /** Called with a short message when a heartbeat or rotation fails. It never receives a token. */\n  onError?: (message: string) => void\n}\n\nexport type KeepFreshOptions = {\n  /** Heartbeat period (default 10 min). */\n  intervalMs?: number\n}\n\n/**\n * The store's side of the connection after `connect`: `keepFresh()` sends a heartbeat and, when `rotate_after`\n * passes, rotates the token (`POST /api/connect/v1/rotate`, Bearer = current `sk_`), writes the new file and lets a\n * `createFileTokenSource` client pick it up within its re-read interval. The old token keeps working during a grace\n * period set by OPS. It never throws and never keeps the process alive.\n */\nexport function connectStore(options: ConnectStoreOptions = {}) {\n  const tokenFile = resolve(options.tokenFile ?? process.env.STOREFRONT_TOKEN_FILE ?? 'storefront_token')\n  const fetchImpl = options.fetch ?? (globalThis.fetch.bind(globalThis) as FetchLike)\n  const now = options.now ?? Date.now\n  const report = (m: string) => {\n    try {\n      options.onError?.(m)\n    } catch {\n      /* ignore */\n    }\n  }\n\n  async function tick(): Promise<'ok' | 'rotated' | 'failed'> {\n    const state = loadConnectionState(tokenFile)\n    const opsUrl = options.opsUrl ?? state?.ops_url\n    let token: string\n    try {\n      token = readFileSync(tokenFile, 'utf8').trim()\n    } catch {\n      report(`No se pudo leer el archivo del token (${tokenFile}).`)\n      return 'failed'\n    }\n    if (!opsUrl || !token) {\n      report('Falta la dirección de OPS o el token: vuelve a ejecutar `npx @asteby/storefront connect`.')\n      return 'failed'\n    }\n    const base = `${trimSlash(opsUrl)}/api/connect/v1`\n    try {\n      await post<unknown>(fetchImpl, `${base}/heartbeat`, { sdk_version: SDK_VERSION, hostname: hostname() }, token)\n      const due = state?.rotate_after ? Date.parse(state.rotate_after) : NaN\n      if (!Number.isNaN(due) && now() >= due) {\n        const next = await post<unknown>(fetchImpl, `${base}/rotate`, {}, token)\n        assertRedeem(next)\n        saveConnection(tokenFile, { ...next, ops_url: next.ops_url || opsUrl }, opsUrl)\n        return 'rotated'\n      }\n      return 'ok'\n    } catch (err) {\n      report(err instanceof ConnectError ? `${err.message} (${maskToken(token)})` : `Falló el latido de la conexión (${maskToken(token)}).`)\n      return 'failed'\n    }\n  }\n\n  return {\n    tokenFile,\n    /** One heartbeat (+ rotation when due). Resolves, never rejects. */\n    tick,\n    /** Starts the periodic heartbeat; returns `stop()`. */\n    keepFresh(opts: KeepFreshOptions = {}): () => void {\n      const timer = setInterval(() => void tick(), opts.intervalMs ?? 600_000)\n      timer.unref?.()\n      void tick()\n      return () => clearInterval(timer)\n    },\n  }\n}\n","import type { StorefrontClient } from './client.js'\nimport { isStorefrontError } from './errors.js'\nimport type { TokenIntrospection } from './types.js'\n\n/** `sk_…a91f`: the prefix and the last four characters, never enough to use the token. */\nexport function maskToken(token: string | null | undefined): string {\n  if (!token) return '(sin token)'\n  const prefix = /^[a-z]{2}_/.exec(token)?.[0] ?? ''\n  return token.length <= prefix.length + 8 ? `${prefix}…` : `${prefix}…${token.slice(-4)}`\n}\n\nexport type DiagnoseOptions = {\n  /** Where the warning goes (default `console.warn`). Receives ONE line per problem. */\n  log?: (message: string) => void\n  /** Name of the connection, shown in the repair path. */\n  connectionName?: string\n  /** Give up after this long (default 3000 ms). */\n  timeoutMs?: number\n}\n\n/** Where the operator repairs a connection in OPS (es-MX, as the screen names it). */\nexport function repairPath(connectionName?: string): string {\n  return `OPS → Conexiones y API → ${connectionName ?? '<conexión>'} → Reparar permisos`\n}\n\n/**\n * Startup check of the store's credential: asks `token.introspect()` and, when scopes are missing, logs ONE clear\n * warning with the repair path (never the token, only `sk_…a91f`). It NEVER throws and is meant to be fired and\n * forgotten, so it cannot delay or break the boot:\n *\n * ```ts\n * void diagnose(storefront)\n * ```\n *\n * Resolves with the introspection, or `null` when it could not be obtained (older OPS, outage, bad token).\n */\nexport async function diagnose(client: StorefrontClient, options: DiagnoseOptions = {}): Promise<TokenIntrospection | null> {\n  const log = options.log ?? ((m: string) => console.warn(m))\n  const timeoutMs = options.timeoutMs ?? 3000\n  const raw = client.config.token\n  let mask: string\n  try {\n    mask = maskToken(typeof raw === 'function' ? raw() : raw)\n  } catch {\n    mask = maskToken(null)\n  }\n  try {\n    const info = await client.token.introspect({ signal: AbortSignal.timeout(timeoutMs) })\n    const missing = Array.isArray(info?.missing_scopes) ? info.missing_scopes : []\n    if (missing.length > 0) {\n      log(\n        `[@asteby/storefront] La credencial ${mask} no tiene permisos que la tienda necesita: ${missing.join(', ')}. ` +\n          `Repáralo en ${repairPath(options.connectionName)} (no hace falta cambiar la clave ni reiniciar).`,\n      )\n    }\n    return info ?? null\n  } catch (err) {\n    if (isStorefrontError(err) && err.status === 401) {\n      try {\n        log(`[@asteby/storefront] OPS rechazó la credencial ${mask} (401): está revocada o vencida. Vuelve a conectar la tienda en OPS → Conexiones y API.`)\n      } catch {\n        /* a broken logger must not break boot */\n      }\n    }\n    return null\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,qBAA4I;AAC5I,uBAAuC;AACvC,qBAAyB;;;ACDlB,SAAS,UAAU,OAA0C;AAClE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,SAAS,aAAa,KAAK,KAAK,IAAI,CAAC,KAAK;AAChD,SAAO,MAAM,UAAU,OAAO,SAAS,IAAI,GAAG,MAAM,WAAM,GAAG,MAAM,SAAI,MAAM,MAAM,EAAE,CAAC;AACxF;;;ADEO,IAAM,cAAsB,OAAsC,WAAkB;AAkBpF,SAAS,sBAAsB,MAAc,UAAkC,CAAC,GAAiB;AACtG,QAAM,MAAM,QAAQ,SAAS;AAC7B,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,MAAI,YAAY;AAChB,SAAO,MAAM;AACX,QAAI,SAAS,IAAI,IAAI,YAAY,IAAK,QAAO;AAC7C,gBAAY,IAAI;AAChB,QAAI;AACF,YAAM,SAAK,yBAAS,IAAI;AACxB,YAAM,OAAO,GAAG,GAAG,OAAO,IAAI,GAAG,IAAI;AACrC,UAAI,CAAC,SAAS,SAAS,OAAO;AAC5B,cAAM,WAAO,6BAAa,MAAM,MAAM,EAAE,KAAK;AAC7C,YAAI,MAAM;AACR,kBAAQ;AACR,kBAAQ;AAAA,QACV,WAAW,CAAC,OAAO;AACjB,gBAAM,IAAI,MAAM,qBAAqB;AAAA,QACvC;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,CAAC,MAAO,OAAM,IAAI,MAAM,yCAAyC,IAAI,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,IAClI;AACA,WAAO;AAAA,EACT;AACF;AAYO,SAAS,uBAAuB,MAAgB,QAAQ,KAAK,UAAkC,CAAC,GAAwC;AAC7I,QAAM,OAAO,IAAI,uBAAuB,KAAK;AAC7C,MAAI,KAAM,QAAO,sBAAsB,MAAM,OAAO;AACpD,QAAM,MAAM,IAAI,uBAAuB,KAAK;AAC5C,MAAI,KAAK;AACP,UAAM,QAAI,uBAAK,KAAK,kBAAkB;AACtC,YAAI,2BAAW,CAAC,EAAG,QAAO,sBAAsB,GAAG,OAAO;AAAA,EAC5D;AACA,QAAM,QAAQ,IAAI,kBAAkB,KAAK;AACzC,SAAO,SAAS;AAClB;AAOO,SAAS,gBAAgB,MAAc,SAAiB,OAAO,KAAa;AACjF,QAAM,UAAM,0BAAQ,IAAI;AACxB,gCAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAClC,QAAM,UAAM,uBAAK,KAAK,IAAI,KAAK,MAAM,GAAG,EAAE,IAAI,CAAC,IAAI,QAAQ,GAAG,IAAI,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,MAAM;AAC/F,QAAM,SAAK,yBAAS,KAAK,MAAM,IAAI;AACnC,MAAI;AACF,kCAAU,IAAI,OAAO;AACrB,kCAAU,EAAE;AAAA,EACd,SAAS,KAAK;AACZ,kCAAU,EAAE;AACZ,QAAI;AACF,qCAAW,GAAG;AAAA,IAChB,QAAQ;AAAA,IAER;AACA,UAAM;AAAA,EACR;AACA,gCAAU,EAAE;AACZ,MAAI;AACF,kCAAU,KAAK,IAAI;AACnB,mCAAW,KAAK,IAAI;AAAA,EACtB,SAAS,KAAK;AACZ,QAAI;AACF,qCAAW,GAAG;AAAA,IAChB,QAAQ;AAAA,IAER;AACA,UAAM;AAAA,EACR;AACF;AAsBO,IAAM,eAAN,cAA2B,MAAM;AAAA,EAEtC,YACW,MACT,SACS,SAAS,GAClB;AACA,UAAM,OAAO;AAJJ;AAEA;AAAA,EAGX;AAAA,EALW;AAAA,EAEA;AAAA,EAJO,OAAO;AAQ3B;AAEA,IAAM,YAAY,CAAC,MAAc,EAAE,QAAQ,QAAQ,EAAE;AAErD,eAAe,KAAQ,WAAsB,KAAa,MAAe,QAA6B;AACpG,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,UAAU,KAAK;AAAA,MACzB,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oBAAoB,QAAQ,oBAAoB,GAAI,SAAS,EAAE,eAAe,UAAU,MAAM,GAAG,IAAI,CAAC,EAAG;AAAA,MACpI,MAAM,KAAK,UAAU,IAAI;AAAA,MACzB,QAAQ,YAAY,QAAQ,IAAM;AAAA,IACpC,CAAC;AAAA,EACH,QAAQ;AACN,UAAM,IAAI,aAAa,WAAW,sFAAgF;AAAA,EACpH;AACA,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE;AAC5C,MAAI,CAAC,IAAI,IAAI;AACX,QAAI,IAAI,WAAW,IAAK,OAAM,IAAI,aAAa,gBAAgB,qEAAkE,GAAG;AACpI,QAAI,IAAI,WAAW,OAAO,IAAI,WAAW,IAAK,OAAM,IAAI,aAAa,gBAAgB,gDAA6C,IAAI,MAAM;AAC5I,QAAI,IAAI,UAAU,IAAK,OAAM,IAAI,aAAa,UAAU,0EAAuE,IAAI,MAAM;AACzI,UAAM,IAAI,aAAa,gBAAgB,4GAA2F,IAAI,MAAM;AAAA,EAC9I;AACA,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,UAAM,IAAI,aAAa,oBAAoB,4CAAyC,IAAI,MAAM;AAAA,EAChG;AACF;AAEA,SAAS,aAAa,GAAyC;AAC7D,QAAM,IAAI;AACV,MAAI,CAAC,KAAK,OAAO,EAAE,iBAAiB,YAAY,CAAC,EAAE,gBAAgB,OAAO,EAAE,kBAAkB,YAAY,CAAC,MAAM,QAAQ,EAAE,MAAM,GAAG;AAClI,UAAM,IAAI,aAAa,oBAAoB,0CAAuC;AAAA,EACpF;AACF;AAKA,eAAsB,qBAAqB,MAA8C;AACvF,QAAM,YAAY,KAAK,SAAU,WAAW,MAAM,KAAK,UAAU;AACjE,QAAM,cAAiC,EAAE,aAAa,aAAa,cAAU,yBAAS,GAAG,GAAI,KAAK,UAAU,EAAE,UAAU,KAAK,QAAQ,IAAI,CAAC,EAAG;AAC7I,QAAM,MAAM,MAAM,KAAc,WAAW,GAAG,UAAU,KAAK,MAAM,CAAC,0BAA0B,EAAE,MAAM,KAAK,KAAK,KAAK,GAAG,YAAY,CAAC;AACrI,eAAa,GAAG;AAChB,SAAO;AACT;AAWO,IAAM,eAAe,CAAC,cAAsB,GAAG,SAAS;AAGxD,SAAS,eAAe,WAAmB,GAAmB,SAAS,EAAE,SAAe;AAC7F,QAAM,QAAyB,EAAE,SAAS,UAAU,EAAE,WAAW,MAAM,GAAG,eAAe,EAAE,eAAe,aAAa,EAAE,aAAa,QAAQ,EAAE,QAAQ,cAAc,EAAE,aAAa;AAErL,kBAAgB,aAAa,SAAS,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,IAAI,IAAI;AAC9E,kBAAgB,WAAW,EAAE,eAAe,IAAI;AAClD;AAEO,SAAS,oBAAoB,WAA2C;AAC7E,MAAI;AACF,WAAO,KAAK,UAAM,6BAAa,aAAa,SAAS,GAAG,MAAM,CAAC;AAAA,EACjE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAyBO,SAAS,aAAa,UAA+B,CAAC,GAAG;AAC9D,QAAM,gBAAY,0BAAQ,QAAQ,aAAa,QAAQ,IAAI,yBAAyB,kBAAkB;AACtG,QAAM,YAAY,QAAQ,SAAU,WAAW,MAAM,KAAK,UAAU;AACpE,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,SAAS,CAAC,MAAc;AAC5B,QAAI;AACF,cAAQ,UAAU,CAAC;AAAA,IACrB,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,iBAAe,OAA6C;AAC1D,UAAM,QAAQ,oBAAoB,SAAS;AAC3C,UAAM,SAAS,QAAQ,UAAU,OAAO;AACxC,QAAI;AACJ,QAAI;AACF,kBAAQ,6BAAa,WAAW,MAAM,EAAE,KAAK;AAAA,IAC/C,QAAQ;AACN,aAAO,yCAAyC,SAAS,IAAI;AAC7D,aAAO;AAAA,IACT;AACA,QAAI,CAAC,UAAU,CAAC,OAAO;AACrB,aAAO,8FAA2F;AAClG,aAAO;AAAA,IACT;AACA,UAAM,OAAO,GAAG,UAAU,MAAM,CAAC;AACjC,QAAI;AACF,YAAM,KAAc,WAAW,GAAG,IAAI,cAAc,EAAE,aAAa,aAAa,cAAU,yBAAS,EAAE,GAAG,KAAK;AAC7G,YAAM,MAAM,OAAO,eAAe,KAAK,MAAM,MAAM,YAAY,IAAI;AACnE,UAAI,CAAC,OAAO,MAAM,GAAG,KAAK,IAAI,KAAK,KAAK;AACtC,cAAM,OAAO,MAAM,KAAc,WAAW,GAAG,IAAI,WAAW,CAAC,GAAG,KAAK;AACvE,qBAAa,IAAI;AACjB,uBAAe,WAAW,EAAE,GAAG,MAAM,SAAS,KAAK,WAAW,OAAO,GAAG,MAAM;AAC9E,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,aAAO,eAAe,eAAe,GAAG,IAAI,OAAO,KAAK,UAAU,KAAK,CAAC,MAAM,yCAAmC,UAAU,KAAK,CAAC,IAAI;AACrI,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA,UAAU,OAAyB,CAAC,GAAe;AACjD,YAAM,QAAQ,YAAY,MAAM,KAAK,KAAK,GAAG,KAAK,cAAc,GAAO;AACvE,YAAM,QAAQ;AACd,WAAK,KAAK;AACV,aAAO,MAAM,cAAc,KAAK;AAAA,IAClC;AAAA,EACF;AACF;","names":[]}

package/dist/node.d.cts

@@ -0,0 +1,100 @@
+type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+
+declare const SDK_VERSION: string;
+type FileTokenSourceOptions = {
+    /** How often the file is checked again (default 30 s). Between checks the cached token is returned. */
+    ttlMs?: number;
+    /** Clock, for tests. */
+    now?: () => number;
+};
+/**
+ * A `() => string` for `createStorefrontClient({ token })` that reads `file`, caches it and looks again every
+ * `ttlMs` (30 s): the file is read only when its mtime or size changed. A failed re-read keeps the last good token
+ * (a rotation in progress never takes the store down); only a first read that fails throws.
+ */
+declare function createFileTokenSource(file: string, options?: FileTokenSourceOptions): () => string;
+type TokenEnv = Record<string, string | undefined>;
+/**
+ * The store's token from the environment, in this order:
+ * 1. `STOREFRONT_TOKEN_FILE` (path),
+ * 2. `$CREDENTIALS_DIRECTORY/storefront_token` (systemd `LoadCredential=`),
+ * 3. `STOREFRONT_TOKEN` (the plain variable, as before).
+ * Files come back as a rotating source (re-read every 30 s); the variable as a plain string. `undefined` when
+ * nothing is configured.
+ */
+declare function storefrontTokenFromEnv(env?: TokenEnv, options?: FileTokenSourceOptions): string | (() => string) | undefined;
+/** Writes `content` to `file` atomically (temp file in the same directory, fsync, rename) with mode 0600. */
+declare function writeFileAtomic(file: string, content: string, mode?: number): void;
+type RedeemResponse = {
+    ops_url: string;
+    connection_id: string;
+    environment: string;
+    secret_token: string;
+    publishable_token?: string;
+    scopes: string[];
+    /** ISO time from which the token should be rotated. */
+    rotate_after: string;
+};
+type ConnectClientInfo = {
+    sdk_version: string;
+    hostname: string;
+    site_url?: string;
+};
+/** Why a connection call failed, in terms an operator can act on. */
+type ConnectErrorKind = 'invalid_code' | 'rate_limited' | 'network' | 'unauthorized' | 'server' | 'invalid_response';
+declare class ConnectError extends Error {
+    readonly kind: ConnectErrorKind;
+    readonly status: number;
+    readonly name = "ConnectError";
+    constructor(kind: ConnectErrorKind, message: string, status?: number);
+}
+type RedeemOptions = {
+    opsUrl: string;
+    code: string;
+    siteUrl?: string;
+    fetch?: FetchLike;
+};
+/** Exchanges the one-time connection code for the store's token. `POST {ops}/api/connect/v1/redeem`. */
+declare function redeemConnectionCode(opts: RedeemOptions): Promise<RedeemResponse>;
+/** What is kept next to the token file: everything but the secret. */
+type ConnectionState = {
+    ops_url: string;
+    connection_id: string;
+    environment: string;
+    scopes: string[];
+    rotate_after: string;
+};
+declare const stateFileFor: (tokenFile: string) => string;
+/** Saves a redeemed/rotated connection: the token (0600, atomic) and its non-secret state beside it. */
+declare function saveConnection(tokenFile: string, r: RedeemResponse, opsUrl?: string): void;
+declare function loadConnectionState(tokenFile: string): ConnectionState | null;
+type ConnectStoreOptions = {
+    /** OPS base URL (`https://ops.example.com`). Defaults to the one saved by `connect`. */
+    opsUrl?: string;
+    /** File `connect` wrote (default: `STOREFRONT_TOKEN_FILE`, then `./storefront_token`). */
+    tokenFile?: string;
+    fetch?: FetchLike;
+    /** Clock, for tests. */
+    now?: () => number;
+    /** Called with a short message when a heartbeat or rotation fails. It never receives a token. */
+    onError?: (message: string) => void;
+};
+type KeepFreshOptions = {
+    /** Heartbeat period (default 10 min). */
+    intervalMs?: number;
+};
+/**
+ * The store's side of the connection after `connect`: `keepFresh()` sends a heartbeat and, when `rotate_after`
+ * passes, rotates the token (`POST /api/connect/v1/rotate`, Bearer = current `sk_`), writes the new file and lets a
+ * `createFileTokenSource` client pick it up within its re-read interval. The old token keeps working during a grace
+ * period set by OPS. It never throws and never keeps the process alive.
+ */
+declare function connectStore(options?: ConnectStoreOptions): {
+    tokenFile: string;
+    /** One heartbeat (+ rotation when due). Resolves, never rejects. */
+    tick: () => Promise<"ok" | "rotated" | "failed">;
+    /** Starts the periodic heartbeat; returns `stop()`. */
+    keepFresh(opts?: KeepFreshOptions): () => void;
+};
+
+export { type ConnectClientInfo, ConnectError, type ConnectErrorKind, type ConnectStoreOptions, type ConnectionState, type FileTokenSourceOptions, type KeepFreshOptions, type RedeemOptions, type RedeemResponse, SDK_VERSION, type TokenEnv, connectStore, createFileTokenSource, loadConnectionState, redeemConnectionCode, saveConnection, stateFileFor, storefrontTokenFromEnv, writeFileAtomic };

package/dist/node.d.ts

@@ -0,0 +1,100 @@
+type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+
+declare const SDK_VERSION: string;
+type FileTokenSourceOptions = {
+    /** How often the file is checked again (default 30 s). Between checks the cached token is returned. */
+    ttlMs?: number;
+    /** Clock, for tests. */
+    now?: () => number;
+};
+/**
+ * A `() => string` for `createStorefrontClient({ token })` that reads `file`, caches it and looks again every
+ * `ttlMs` (30 s): the file is read only when its mtime or size changed. A failed re-read keeps the last good token
+ * (a rotation in progress never takes the store down); only a first read that fails throws.
+ */
+declare function createFileTokenSource(file: string, options?: FileTokenSourceOptions): () => string;
+type TokenEnv = Record<string, string | undefined>;
+/**
+ * The store's token from the environment, in this order:
+ * 1. `STOREFRONT_TOKEN_FILE` (path),
+ * 2. `$CREDENTIALS_DIRECTORY/storefront_token` (systemd `LoadCredential=`),
+ * 3. `STOREFRONT_TOKEN` (the plain variable, as before).
+ * Files come back as a rotating source (re-read every 30 s); the variable as a plain string. `undefined` when
+ * nothing is configured.
+ */
+declare function storefrontTokenFromEnv(env?: TokenEnv, options?: FileTokenSourceOptions): string | (() => string) | undefined;
+/** Writes `content` to `file` atomically (temp file in the same directory, fsync, rename) with mode 0600. */
+declare function writeFileAtomic(file: string, content: string, mode?: number): void;
+type RedeemResponse = {
+    ops_url: string;
+    connection_id: string;
+    environment: string;
+    secret_token: string;
+    publishable_token?: string;
+    scopes: string[];
+    /** ISO time from which the token should be rotated. */
+    rotate_after: string;
+};
+type ConnectClientInfo = {
+    sdk_version: string;
+    hostname: string;
+    site_url?: string;
+};
+/** Why a connection call failed, in terms an operator can act on. */
+type ConnectErrorKind = 'invalid_code' | 'rate_limited' | 'network' | 'unauthorized' | 'server' | 'invalid_response';
+declare class ConnectError extends Error {
+    readonly kind: ConnectErrorKind;
+    readonly status: number;
+    readonly name = "ConnectError";
+    constructor(kind: ConnectErrorKind, message: string, status?: number);
+}
+type RedeemOptions = {
+    opsUrl: string;
+    code: string;
+    siteUrl?: string;
+    fetch?: FetchLike;
+};
+/** Exchanges the one-time connection code for the store's token. `POST {ops}/api/connect/v1/redeem`. */
+declare function redeemConnectionCode(opts: RedeemOptions): Promise<RedeemResponse>;
+/** What is kept next to the token file: everything but the secret. */
+type ConnectionState = {
+    ops_url: string;
+    connection_id: string;
+    environment: string;
+    scopes: string[];
+    rotate_after: string;
+};
+declare const stateFileFor: (tokenFile: string) => string;
+/** Saves a redeemed/rotated connection: the token (0600, atomic) and its non-secret state beside it. */
+declare function saveConnection(tokenFile: string, r: RedeemResponse, opsUrl?: string): void;
+declare function loadConnectionState(tokenFile: string): ConnectionState | null;
+type ConnectStoreOptions = {
+    /** OPS base URL (`https://ops.example.com`). Defaults to the one saved by `connect`. */
+    opsUrl?: string;
+    /** File `connect` wrote (default: `STOREFRONT_TOKEN_FILE`, then `./storefront_token`). */
+    tokenFile?: string;
+    fetch?: FetchLike;
+    /** Clock, for tests. */
+    now?: () => number;
+    /** Called with a short message when a heartbeat or rotation fails. It never receives a token. */
+    onError?: (message: string) => void;
+};
+type KeepFreshOptions = {
+    /** Heartbeat period (default 10 min). */
+    intervalMs?: number;
+};
+/**
+ * The store's side of the connection after `connect`: `keepFresh()` sends a heartbeat and, when `rotate_after`
+ * passes, rotates the token (`POST /api/connect/v1/rotate`, Bearer = current `sk_`), writes the new file and lets a
+ * `createFileTokenSource` client pick it up within its re-read interval. The old token keeps working during a grace
+ * period set by OPS. It never throws and never keeps the process alive.
+ */
+declare function connectStore(options?: ConnectStoreOptions): {
+    tokenFile: string;
+    /** One heartbeat (+ rotation when due). Resolves, never rejects. */
+    tick: () => Promise<"ok" | "rotated" | "failed">;
+    /** Starts the periodic heartbeat; returns `stop()`. */
+    keepFresh(opts?: KeepFreshOptions): () => void;
+};
+
+export { type ConnectClientInfo, ConnectError, type ConnectErrorKind, type ConnectStoreOptions, type ConnectionState, type FileTokenSourceOptions, type KeepFreshOptions, type RedeemOptions, type RedeemResponse, SDK_VERSION, type TokenEnv, connectStore, createFileTokenSource, loadConnectionState, redeemConnectionCode, saveConnection, stateFileFor, storefrontTokenFromEnv, writeFileAtomic };