@cartbase/storefront 0.15.0 → 0.17.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cartbase/storefront",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "description": "Storefront SDK + UI component library for Cartbase stores: typed API client, checkout orchestration, cart drawer, product/catalog components, tracking. Source-shipped TypeScript — add it to transpilePackages.",
   "license": "MIT",
   "repository": {
@@ -56,6 +56,7 @@
     "./lib/hooks/use-intersection": "./src/lib/hooks/use-intersection.ts",
     "./lib/hooks/use-toggle-state": "./src/lib/hooks/use-toggle-state.ts",
     "./lib/cookie-names": "./src/lib/cookie-names.ts",
+    "./lib/media-image": "./src/lib/media-image.tsx",
     "./lib/platform": "./src/lib/platform.ts",
     "./lib/visitor": "./src/lib/visitor.ts",
     "./platform": "./src/platform/index.ts",
@@ -155,6 +156,8 @@
     "./products/product-price": "./src/products/product-price.tsx",
     "./products/option-select": "./src/products/option-select.tsx",
     "./products/image-gallery": "./src/products/image-gallery.tsx",
+    "./products/variant-url": "./src/products/variant-url.ts",
+    "./products/use-product-actions": "./src/products/use-product-actions.ts",
     "./products/product-actions": "./src/products/product-actions.tsx",
     "./products/mobile-actions": "./src/products/mobile-actions.tsx",
     "./products/product-tabs": "./src/products/product-tabs.tsx",

package/src/api/customers.ts

@@ -43,10 +43,11 @@ export interface CustomerAddress {
 /**
  * The customer payload: the customer's own row as the store serves it, plus
  * addresses. Named columns since 2026-09-14: no tenant id, no soft-delete
- * stamp, no staff identity, no provider account id.
+ * stamp, no staff identity, no provider account id, and no merchant tags
+ * (the labels a merchant puts on a customer are staff knowledge and never
+ * reach the shopper).
  * `account_status` (`pending` | `approved`) gates B2B storefront content
- * when the store's approval policy is on (b2b-v1). `tags` are admin-only
- * labels — readable here, never writable from the store surface.
+ * when the store's approval policy is on (b2b-v1).
  */
 export interface StoreCustomer {
   id: string
@@ -61,7 +62,6 @@ export interface StoreCustomer {
   has_account: boolean
   /** `pending` | `approved` — store approval policy (customer-accounts card). */
   account_status: string
-  tags: string[]
   metadata: Record<string, unknown> | null
   created_at: IsoDateString
   updated_at: IsoDateString
@@ -120,12 +120,11 @@ export interface UpdateCustomerInput {
   company_eik?: string | null
   vat_number?: string | null
   metadata?: Record<string, unknown>
-  // NOTE: `tags` deliberately absent — admin-only; the server strips them.
 }
 
 /**
- * POST /api/store/customers/me — update own profile. Unknown keys (incl.
- * `tags`) are stripped server-side; returns the refreshed customer.
+ * POST /api/store/customers/me — update own profile. Unknown keys are
+ * stripped server-side; returns the refreshed customer.
  *
  * Auth: Bearer JWT (+ x-client-id).
  * Errors: 401 unauthenticated · 400 validation_failed.

package/src/api/http.ts

@@ -42,6 +42,42 @@ export interface StorefrontClientConfig {
 export type QueryValue = string | number | boolean | null | undefined
 export type Query = Record<string, QueryValue | QueryValue[]>
 
+/**
+ * The reads the platform's CDN holds for anonymous shoppers (store-api.md
+ * § Caching). Such a request carries the store's publishable key in its
+ * address as `pk`, so the edge can tell one store's answers from another's,
+ * and the shopper's locale as `locale`. A request with a customer token
+ * carries neither: its prices are the shopper's own, and an address without
+ * the key is never held and never served from the hold. Carts, checkout,
+ * consent, customers and every write are never on this list.
+ */
+const CACHEABLE_READ_PREFIXES = [
+  "/api/store/store",
+  "/api/store/menus",
+  "/api/store/regions",
+  "/api/store/collections",
+  "/api/store/products",
+  "/api/store/product-variants",
+  "/api/store/product-categories",
+  "/api/store/product-types",
+  "/api/store/product-tags",
+  "/api/store/reviews",
+  "/api/store/currencies",
+  "/api/store/countries",
+  "/api/store/locales",
+  "/api/store/pages",
+  "/api/store/blogs",
+  "/api/store/metaobjects",
+  "/api/store/url-redirects",
+  "/api/store/return-reasons",
+]
+
+export function isCacheableStoreRead(pathname: string): boolean {
+  return CACHEABLE_READ_PREFIXES.some(
+    (prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`)
+  )
+}
+
 export interface RequestOptions {
   method?: "GET" | "POST" | "DELETE"
   query?: Query
@@ -92,9 +128,23 @@ export class StorefrontClient {
     const locale = this.config.getLocale ? await this.config.getLocale() : null
     if (locale && !headers["x-locale"]) headers["x-locale"] = locale
 
+    // An anonymous catalogue read carries its key (and locale) in the
+    // address, so the platform's CDN may hold the answer for this store.
+    const method = opts.method ?? "GET"
+    const anonymous = !headers.authorization
+    if (
+      method === "GET" &&
+      anonymous &&
+      this.config.publishableKey &&
+      isCacheableStoreRead(url.pathname)
+    ) {
+      url.searchParams.set("pk", this.config.publishableKey)
+      if (locale) url.searchParams.set("locale", locale)
+    }
+
     const doFetch = this.config.fetch ?? fetch
     const res = await doFetch(url.toString(), {
-      method: opts.method ?? "GET",
+      method,
       headers,
       body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,
       cache: opts.cache,