@curless/shopify-storefront 0.1.0

package/dist/rate-limit.js

@@ -0,0 +1,56 @@
+export class RateLimiter {
+    limit;
+    windowMs;
+    maxKeys;
+    buckets = new Map();
+    constructor(limit, windowMs, 
+    /** Bound the map so a flood of distinct IPs cannot grow it without limit. */
+    maxKeys = 10_000) {
+        this.limit = limit;
+        this.windowMs = windowMs;
+        this.maxKeys = maxKeys;
+    }
+    /** True when the call is allowed. */
+    take(key, now = Date.now()) {
+        const found = this.buckets.get(key);
+        if (!found || now >= found.resetAt) {
+            if (this.buckets.size >= this.maxKeys)
+                this.evictExpired(now);
+            this.buckets.set(key, { count: 1, resetAt: now + this.windowMs });
+            return true;
+        }
+        if (found.count >= this.limit)
+            return false;
+        found.count += 1;
+        return true;
+    }
+    evictExpired(now) {
+        for (const [k, b] of this.buckets) {
+            if (now >= b.resetAt)
+                this.buckets.delete(k);
+        }
+        // Still full of live buckets — this is a flood, not accumulation. Drop the
+        // oldest rather than grow: refusing to track is the same as rate limiting.
+        if (this.buckets.size >= this.maxKeys) {
+            const oldest = [...this.buckets.entries()]
+                .sort((a, b) => a[1].resetAt - b[1].resetAt)
+                .slice(0, Math.floor(this.maxKeys / 4));
+            for (const [k] of oldest)
+                this.buckets.delete(k);
+        }
+    }
+}
+// The caller's address as seen through Caddy. `x-forwarded-for` is a list; the
+// FIRST entry is the client, the rest are proxies. It is spoofable in general —
+// but our only ingress sets it, so the last hop is ours and the first entry is
+// what Caddy saw.
+export const clientIp = (headers, fallback = 'unknown') => {
+    const xff = headers.get('x-forwarded-for');
+    if (xff) {
+        const first = xff.split(',')[0]?.trim();
+        if (first)
+            return first;
+    }
+    return headers.get('x-real-ip')?.trim() || fallback;
+};
+//# sourceMappingURL=rate-limit.js.map

package/dist/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../src/rate-limit.ts"],"names":[],"mappings":"AAiBA,MAAM,OAAO,WAAW;IAIH;IACA;IAEA;IANX,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE5C,YACmB,KAAa,EACb,QAAgB;IACjC,6EAA6E;IAC5D,UAAU,MAAM;QAHhB,UAAK,GAAL,KAAK,CAAQ;QACb,aAAQ,GAAR,QAAQ,CAAQ;QAEhB,YAAO,GAAP,OAAO,CAAS;IAChC,CAAC;IAEJ,qCAAqC;IACrC,IAAI,CAAC,GAAW,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,IAAI,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC9D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAC5C,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,2EAA2E;QAC3E,2EAA2E;QAC3E,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;iBACvC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;iBAC3C,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;YAC1C,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;CACF;AAED,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,kBAAkB;AAClB,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,OAAgB,EAAE,QAAQ,GAAG,SAAS,EAAU,EAAE;IACzE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC3C,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACxC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;AACtD,CAAC,CAAC"}

package/dist/stock.d.ts

@@ -0,0 +1,39 @@
+/** One buyable combination, e.g. `{Left: '-5.75', Right: '-5.50'}`. */
+export type Combo = Record<string, string>;
+/**
+ * The buyable combinations out of a tool result, from wherever that result put
+ * them.
+ *
+ * The two views disagree, and reasonably: `get_moody_lens` nests everything
+ * about the lens under `product`, while `needs-options` keeps the answer to
+ * "what is still missing" at the top level beside `given` and `options`. The
+ * card read only the top level, so on the product view `stock` was always empty
+ * — and an empty list means "we do not know", which offers everything. Every
+ * prescription looked available at a store with 2 of 676 in stock.
+ *
+ * So the lookup lives here, next to the rule that consumes it, and is pinned by
+ * a test against BOTH shapes. Reading the wrong one is silent: nothing throws,
+ * nothing looks broken, the buyer is just quietly told they can have anything.
+ */
+export declare const stockOf: (sc: any) => Combo[];
+/**
+ * True when `value` for option `name` still leads to something buyable.
+ *
+ * A value survives when SOME in-stock combination has it and agrees with every
+ * OTHER choice already made — so picking a left eye narrows the right, which is
+ * how the two-eye matrix actually works. The option being asked about is excluded
+ * from that agreement check, or re-picking within a group could never widen it.
+ *
+ * An EMPTY stock list means "we do not know" — from a payload the server had to
+ * truncate — and everything is offered. Filtering on a partial list would hide
+ * prescriptions the store has, which is worse than the sold-out message: an
+ * invisible option cannot be argued with.
+ */
+export declare const offeredValue: (stock: Combo[], chosen: Combo, name: string, value: string) => boolean;
+/**
+ * The choices to keep after a new pick. Anything the latest pick has made
+ * impossible is dropped, so the buyer is never holding a combination the store
+ * does not have — and never sees Buy go live over one.
+ */
+export declare const pruneChoices: (stock: Combo[], chosen: Combo) => Combo;
+//# sourceMappingURL=stock.d.ts.map

package/dist/stock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stock.d.ts","sourceRoot":"","sources":["../src/stock.ts"],"names":[],"mappings":"AAeA,uEAAuE;AACvE,MAAM,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE3C;;;;;;;;;;;;;;GAcG;AAEH,eAAO,MAAM,OAAO,GAAI,IAAI,GAAG,KAAG,KAAK,EAOtC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,YAAY,GACvB,OAAO,KAAK,EAAE,EACd,QAAQ,KAAK,EACb,MAAM,MAAM,EACZ,OAAO,MAAM,KACZ,OAOF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,KAAK,EAAE,EAAE,QAAQ,KAAK,KAAG,KAU5D,CAAC"}

package/dist/stock.js

@@ -0,0 +1,77 @@
+// Which option values a buyer can still pick, given what the store actually has.
+//
+// This is the whole difference between a picker that works and one that wastes
+// the buyer's time. The option lists say what the store OFFERS — 26 left powers
+// × 26 right powers — and cannot say which PAIRS exist. At Moody, 674 of those
+// 676 pairs do not, so a picker built on the option lists alone tells the buyer
+// "sold out" on almost every choice they make.
+//
+// It lives on the SERVER side and the card imports it across the folder
+// boundary, because it is one half of a contract with the other: the server
+// decides what goes in `inStock`, the card decides what to do with it, and the
+// two disagreeing is invisible until a buyer is told the wrong thing. Here it is
+// plain, pure and unit-tested, rather than only checkable by clicking through a
+// live store.
+/**
+ * The buyable combinations out of a tool result, from wherever that result put
+ * them.
+ *
+ * The two views disagree, and reasonably: `get_moody_lens` nests everything
+ * about the lens under `product`, while `needs-options` keeps the answer to
+ * "what is still missing" at the top level beside `given` and `options`. The
+ * card read only the top level, so on the product view `stock` was always empty
+ * — and an empty list means "we do not know", which offers everything. Every
+ * prescription looked available at a store with 2 of 676 in stock.
+ *
+ * So the lookup lives here, next to the rule that consumes it, and is pinned by
+ * a test against BOTH shapes. Reading the wrong one is silent: nothing throws,
+ * nothing looks broken, the buyer is just quietly told they can have anything.
+ */
+// biome-ignore lint/suspicious/noExplicitAny: a server-shaped tool payload
+export const stockOf = (sc) => {
+    const at = sc?.inStock !== undefined ? sc : sc?.product;
+    // Truncated means the server had more than it would send. Filtering on a
+    // partial list would HIDE prescriptions the store has, which is worse than
+    // the sold-out message: an invisible option cannot be argued with.
+    if (!at || at.inStockTruncated)
+        return [];
+    return at.inStock ?? [];
+};
+/**
+ * True when `value` for option `name` still leads to something buyable.
+ *
+ * A value survives when SOME in-stock combination has it and agrees with every
+ * OTHER choice already made — so picking a left eye narrows the right, which is
+ * how the two-eye matrix actually works. The option being asked about is excluded
+ * from that agreement check, or re-picking within a group could never widen it.
+ *
+ * An EMPTY stock list means "we do not know" — from a payload the server had to
+ * truncate — and everything is offered. Filtering on a partial list would hide
+ * prescriptions the store has, which is worse than the sold-out message: an
+ * invisible option cannot be argued with.
+ */
+export const offeredValue = (stock, chosen, name, value) => {
+    if (stock.length === 0)
+        return true;
+    return stock.some((combo) => combo[name] === value &&
+        Object.entries(chosen).every(([k, v]) => k === name || combo[k] === v));
+};
+/**
+ * The choices to keep after a new pick. Anything the latest pick has made
+ * impossible is dropped, so the buyer is never holding a combination the store
+ * does not have — and never sees Buy go live over one.
+ */
+export const pruneChoices = (stock, chosen) => {
+    if (stock.length === 0)
+        return { ...chosen };
+    const kept = { ...chosen };
+    for (const name of Object.keys(chosen)) {
+        const rest = { ...kept };
+        delete rest[name];
+        const v = chosen[name];
+        if (v === undefined || !offeredValue(stock, rest, name, v))
+            delete kept[name];
+    }
+    return kept;
+};
+//# sourceMappingURL=stock.js.map

package/dist/stock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stock.js","sourceRoot":"","sources":["../src/stock.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,+CAA+C;AAC/C,EAAE;AACF,wEAAwE;AACxE,4EAA4E;AAC5E,+EAA+E;AAC/E,iFAAiF;AACjF,gFAAgF;AAChF,cAAc;AAKd;;;;;;;;;;;;;;GAcG;AACH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,EAAO,EAAW,EAAE;IAC1C,MAAM,EAAE,GAAG,EAAE,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC;IACxD,yEAAyE;IACzE,2EAA2E;IAC3E,mEAAmE;IACnE,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,gBAAgB;QAAE,OAAO,EAAE,CAAC;IAC1C,OAAQ,EAAE,CAAC,OAA+B,IAAI,EAAE,CAAC;AACnD,CAAC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,KAAc,EACd,MAAa,EACb,IAAY,EACZ,KAAa,EACJ,EAAE;IACX,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,KAAK,CAAC,IAAI,CACf,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK;QACrB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CACzE,CAAC;AACJ,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAE,MAAa,EAAS,EAAE;IACnE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;IAC7C,MAAM,IAAI,GAAU,EAAE,GAAG,MAAM,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}

package/dist/tenant.d.ts

@@ -0,0 +1,69 @@
+import type { ShopifyConfig } from '@curless/shopify-adapter';
+import type { CatalogRegistry } from './catalog-registry.js';
+import type { Catalog } from './catalog.js';
+import type { ResolvedStorefront } from './config.js';
+import type { MultiTokenStore } from './multi-token-store.js';
+import type { TokenStore } from './token-store.js';
+export type Tenant = {
+    shopDomain: string;
+    catalog: Catalog;
+    /**
+     * The Shopify credentials for THIS tenant.
+     *
+     * Returned by the resolver rather than fetched again by the caller: the
+     * resolver already read the token to decide whether the shop is installed,
+     * and a second lookup is a second chance to look it up for a different shop
+     * than the one just resolved.
+     */
+    shopify: ShopifyConfig;
+};
+/** Why no tenant — the caller decides what a buyer should see for each. */
+export type NoTenant = {
+    reason: 'no-shop';
+} | {
+    reason: 'bad-shop';
+    given: string;
+} | {
+    reason: 'not-installed';
+    shop: string;
+};
+export type Resolution = {
+    ok: true;
+    tenant: Tenant;
+} | ({
+    ok: false;
+} & NoTenant);
+export type TokenReader = Pick<TokenStore, 'get'>;
+export type MultiTokenReader = Pick<MultiTokenStore, 'get'>;
+export type CatalogSource = Pick<CatalogRegistry, 'for'>;
+export type SingleShopDeps = {
+    store: ResolvedStorefront;
+    catalog: Catalog;
+    tokens: TokenReader;
+};
+export type MultiShopDeps = {
+    registry: CatalogSource;
+    tokens: MultiTokenReader;
+};
+/**
+ * The branded case. The shop is fixed, so a `shop` on the request is not a
+ * question to answer — it is a claim to CHECK. A request naming a different
+ * shop than this deployment serves is refused rather than quietly served the
+ * only catalogue we have, because the caller asked about someone else.
+ */
+export declare const singleShopResolver: (deps: SingleShopDeps) => (requestedShop?: string) => Promise<Resolution>;
+/**
+ * The listed case. Every answer here depends on a value from the request, so
+ * each step refuses rather than guesses:
+ *
+ *   • no shop at all — there is no default, and picking one would answer as
+ *     whichever merchant happened to be first
+ *   • a shop we will not name — see multi-token-store; it is about to be a
+ *     filename
+ *   • a shop with no token — not installed HERE, which is an ordinary state
+ *     and not an error
+ */
+export declare const multiShopResolver: (deps: MultiShopDeps) => (requestedShop?: string) => Promise<Resolution>;
+/** One line a buyer can read, and one an operator can act on. */
+export declare const explainNoTenant: (r: NoTenant) => string;
+//# sourceMappingURL=tenant.d.ts.map

package/dist/tenant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../src/tenant.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,MAAM,MAAM,MAAM,GAAG;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;OAOG;IACH,OAAO,EAAE,aAAa,CAAC;CACxB,CAAC;AAEF,2EAA2E;AAC3E,MAAM,MAAM,QAAQ,GAChB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9C,MAAM,MAAM,UAAU,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,CAAC;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,GAAG,QAAQ,CAAC,CAAC;AAUnF,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AAClD,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;AAC5D,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;AAEzD,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,aAAa,CAAC;IACxB,MAAM,EAAE,gBAAgB,CAAC;CAC1B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC5B,MAAM,cAAc,MACd,gBAAgB,MAAM,KAAG,OAAO,CAAC,UAAU,CAkBjD,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAC3B,MAAM,aAAa,MACb,gBAAgB,MAAM,KAAG,OAAO,CAAC,UAAU,CAcjD,CAAC;AAEJ,iEAAiE;AACjE,eAAO,MAAM,eAAe,GAAI,GAAG,QAAQ,KAAG,MAS7C,CAAC"}

package/dist/tenant.js

@@ -0,0 +1,68 @@
+import { isStorableShop } from './multi-token-store.js';
+/**
+ * The branded case. The shop is fixed, so a `shop` on the request is not a
+ * question to answer — it is a claim to CHECK. A request naming a different
+ * shop than this deployment serves is refused rather than quietly served the
+ * only catalogue we have, because the caller asked about someone else.
+ */
+export const singleShopResolver = (deps) => async (requestedShop) => {
+    const configured = (deps.store.config.shopify.shopDomain ?? '').toLowerCase();
+    if (requestedShop && requestedShop.toLowerCase() !== configured) {
+        return { ok: false, reason: 'bad-shop', given: requestedShop };
+    }
+    // An env-supplied admin token skips the install entirely — the branded
+    // deployments used it before a merchant ever clicked anything.
+    const envToken = process.env.STOREFRONT_SHOPIFY_ADMIN_TOKEN;
+    const stored = envToken ? { accessToken: envToken } : await deps.tokens.get();
+    if (!stored)
+        return { ok: false, reason: 'not-installed', shop: configured };
+    return {
+        ok: true,
+        tenant: {
+            shopDomain: configured,
+            catalog: deps.catalog,
+            shopify: { shopDomain: configured, adminToken: stored.accessToken },
+        },
+    };
+};
+/**
+ * The listed case. Every answer here depends on a value from the request, so
+ * each step refuses rather than guesses:
+ *
+ *   • no shop at all — there is no default, and picking one would answer as
+ *     whichever merchant happened to be first
+ *   • a shop we will not name — see multi-token-store; it is about to be a
+ *     filename
+ *   • a shop with no token — not installed HERE, which is an ordinary state
+ *     and not an error
+ */
+export const multiShopResolver = (deps) => async (requestedShop) => {
+    const shop = (requestedShop ?? '').trim().toLowerCase();
+    if (!shop)
+        return { ok: false, reason: 'no-shop' };
+    if (!isStorableShop(shop))
+        return { ok: false, reason: 'bad-shop', given: shop };
+    const stored = await deps.tokens.get(shop);
+    if (!stored)
+        return { ok: false, reason: 'not-installed', shop };
+    return {
+        ok: true,
+        tenant: {
+            shopDomain: shop,
+            catalog: deps.registry.for(shop),
+            shopify: { shopDomain: shop, adminToken: stored.accessToken },
+        },
+    };
+};
+/** One line a buyer can read, and one an operator can act on. */
+export const explainNoTenant = (r) => {
+    switch (r.reason) {
+        case 'no-shop':
+            return 'No shop was named on this request, and this app serves several — say which store.';
+        case 'bad-shop':
+            return `${r.given} is not a store this connector serves.`;
+        case 'not-installed':
+            return `${r.shop} has not installed this app yet.`;
+    }
+};
+//# sourceMappingURL=tenant.js.map

package/dist/tenant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.js","sourceRoot":"","sources":["../src/tenant.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAgDxD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAC7B,CAAC,IAAoB,EAAE,EAAE,CACzB,KAAK,EAAE,aAAsB,EAAuB,EAAE;IACpD,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9E,IAAI,aAAa,IAAI,aAAa,CAAC,WAAW,EAAE,KAAK,UAAU,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IACjE,CAAC;IACD,uEAAuE;IACvE,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;IAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IAC9E,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC7E,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,UAAU,EAAE,UAAU;YACtB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE;SACpE;KACF,CAAC;AACJ,CAAC,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,CAAC,IAAmB,EAAE,EAAE,CACxB,KAAK,EAAE,aAAsB,EAAuB,EAAE;IACpD,MAAM,IAAI,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACnD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACjF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACjE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAChC,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE;SAC9D;KACF,CAAC;AACJ,CAAC,CAAC;AAEJ,iEAAiE;AACjE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAW,EAAU,EAAE;IACrD,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,SAAS;YACZ,OAAO,mFAAmF,CAAC;QAC7F,KAAK,UAAU;YACb,OAAO,GAAG,CAAC,CAAC,KAAK,wCAAwC,CAAC;QAC5D,KAAK,eAAe;YAClB,OAAO,GAAG,CAAC,CAAC,IAAI,kCAAkC,CAAC;IACvD,CAAC;AACH,CAAC,CAAC"}

package/dist/token-store.d.ts

@@ -0,0 +1,16 @@
+export type StoredToken = {
+    shopDomain: string;
+    accessToken: string;
+    /** The scopes Shopify actually granted — may differ from what we asked for. */
+    scope: string;
+    installedAt: string;
+};
+export declare class TokenStore {
+    private readonly path;
+    private cached;
+    private loaded;
+    constructor(path: string);
+    get(): Promise<StoredToken | null>;
+    set(token: StoredToken): Promise<void>;
+}
+//# sourceMappingURL=token-store.d.ts.map

package/dist/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAaA,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,qBAAa,UAAU;IAIT,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,MAAM,CAAS;gBAEM,IAAI,EAAE,MAAM;IAEnC,GAAG,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAelC,GAAG,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAU7C"}

package/dist/token-store.js

@@ -0,0 +1,47 @@
+// Where the merchant's access token lives after they install.
+//
+// A file, not a database: this connector deliberately owns no database, and
+// coupling a client's storefront to the payment gateway's Postgres would undo
+// the separation that keeps a client's credentials out of the gateway's blast
+// radius. One shop, one token, one small file.
+//
+// ⚠️ The file IS a credential — it grants read access to a real merchant's
+// products and orders. It must live on a mounted volume (so it survives a
+// redeploy) with the same care as .env, and it is written 0600.
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+export class TokenStore {
+    path;
+    cached = null;
+    loaded = false;
+    constructor(path) {
+        this.path = path;
+    }
+    async get() {
+        if (this.loaded)
+            return this.cached;
+        try {
+            const raw = await readFile(this.path, 'utf8');
+            const parsed = JSON.parse(raw);
+            this.cached = parsed.accessToken ? parsed : null;
+        }
+        catch {
+            // Absent or unreadable both mean "not installed yet". This is the normal
+            // state of a fresh deploy, not an error worth failing boot over.
+            this.cached = null;
+        }
+        this.loaded = true;
+        return this.cached;
+    }
+    async set(token) {
+        await mkdir(dirname(this.path), { recursive: true });
+        // Write-then-rename: a crash mid-write must not leave a truncated file that
+        // reads as "installed" with half a token.
+        const tmp = `${this.path}.tmp`;
+        await writeFile(tmp, JSON.stringify(token, null, 2), { mode: 0o600 });
+        await rename(tmp, this.path);
+        this.cached = token;
+        this.loaded = true;
+    }
+}
+//# sourceMappingURL=token-store.js.map

package/dist/token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,+CAA+C;AAC/C,EAAE;AACF,2EAA2E;AAC3E,0EAA0E;AAC1E,gEAAgE;AAChE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUpC,MAAM,OAAO,UAAU;IAIQ;IAHrB,MAAM,GAAuB,IAAI,CAAC;IAClC,MAAM,GAAG,KAAK,CAAC;IAEvB,YAA6B,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAE7C,KAAK,CAAC,GAAG;QACP,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;YAC9C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,iEAAiE;YACjE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAkB;QAC1B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,4EAA4E;QAC5E,0CAA0C;QAC1C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,MAAM,CAAC;QAC/B,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;CACF"}

package/dist/tools.d.ts

@@ -0,0 +1,201 @@
+import { type ShopifyConfig, type ShopifyProduct } from '@curless/shopify-adapter';
+import type { Catalog } from './catalog.js';
+import type { ToolNames, Vocabulary } from './config.js';
+/**
+ * The tool table, built for THIS storefront's names.
+ *
+ * A constant until there was a second merchant. A model choosing among
+ * several storefront connectors picks by tool name, so the names carry the
+ * merchant — and that means they cannot be literals here.
+ */
+export declare const buildTools: (n: ToolNames, v: Vocabulary) => readonly [{
+    readonly name: string;
+    readonly description: `Open the ${string} storefront \u2014 the live catalogue of the shop itself: the price it charges today, what it can actually ship, and the combinations it will accept, rendered as a card the buyer can buy from. Call this FIRST, with NO arguments, as soon as the buyer wants ${string} \u2014 it renders a card with pictures, filter chips and a Buy button on every ${string}, so they can browse and choose without being asked anything. Do not interview them first and do not recommend on top of it. Pass \`query\` only once they have said what they want.${string}`;
+    readonly annotations: {
+        readonly title: string;
+        readonly readOnlyHint: true;
+        readonly destructiveHint: false;
+        readonly openWorldHint: false;
+    };
+    readonly inputSchema: {
+        readonly type: "object";
+        readonly properties: {
+            readonly query: {
+                readonly type: "string";
+                readonly description: "Free text over the name, tags and description — this is how colour is searched (\"green\", \"brown\", \"matcha\")";
+            };
+            readonly maxPrice: {
+                readonly type: "number";
+                readonly description: "Upper bound in whole currency units";
+            };
+            readonly limit: {
+                readonly type: "number";
+                readonly description: "Default 20";
+            };
+        };
+    };
+}, {
+    readonly name: string;
+    readonly description: `One ${string} in full: its options, every value offered, prices and images. Check this BEFORE checkout \u2014 how many choices the buyer must make is set by the product, not fixed, so read them here rather than assuming.${string}`;
+    readonly annotations: {
+        readonly title: string;
+        readonly readOnlyHint: true;
+        readonly destructiveHint: false;
+        readonly openWorldHint: false;
+    };
+    readonly inputSchema: {
+        readonly type: "object";
+        readonly properties: {
+            readonly product: {
+                readonly type: "string";
+                readonly description: `The ${string} name or handle${string}`;
+            };
+        };
+        readonly required: readonly ["product"];
+    };
+}, {
+    readonly name: string;
+    readonly description: `Get the checkout link for ONE specific ${string} variant. Fill EVERY option the product has \u2014 if it offers two, both are required, and they are usually different. Never assume one answer carries to another option, and never round to a nearby value: ask. If the choices do not name exactly one variant this returns the options to ask about instead of guessing.${string}`;
+    readonly annotations: {
+        readonly title: string;
+        readonly readOnlyHint: true;
+        readonly destructiveHint: false;
+        readonly openWorldHint: false;
+    };
+    readonly inputSchema: {
+        readonly type: "object";
+        readonly properties: {
+            readonly product: {
+                readonly type: "string";
+                readonly description: `The ${string} name or handle`;
+            };
+            readonly options: {
+                readonly type: "object";
+                readonly description: `One value per option, keyed by the store's own option names.${string}`;
+                readonly additionalProperties: {
+                    readonly type: "string";
+                };
+            };
+            readonly quantity: {
+                readonly type: "number";
+                readonly description: "Default 1";
+            };
+        };
+        readonly required: readonly ["product", "options"];
+    };
+}, {
+    readonly name: string;
+    readonly description: "Find an order the buyer already placed. BOTH the order number and the email it was placed with are required — that pair is what proves the order is theirs.";
+    readonly annotations: {
+        readonly title: string;
+        readonly readOnlyHint: true;
+        readonly destructiveHint: false;
+        readonly openWorldHint: false;
+    };
+    readonly inputSchema: {
+        readonly type: "object";
+        readonly properties: {
+            readonly orderNumber: {
+                readonly type: "string";
+                readonly description: "From the confirmation email, e.g. \"#1052\"";
+            };
+            readonly email: {
+                readonly type: "string";
+                readonly description: "The email the order was placed with";
+            };
+        };
+        readonly required: readonly ["orderNumber", "email"];
+    };
+}];
+export declare const buildOutputSchemas: (n: ToolNames) => Record<string, unknown>;
+/** One choice in a filter row. `tags` is what a product must carry to match — a
+ * list because a bucket like "Large" covers several diameters. */
+export type FacetValue = {
+    label: string;
+    tags: string[];
+    count: number;
+};
+export type Facet = {
+    axis: string;
+    values: FacetValue[];
+};
+export declare const isAccessory: (title: string) => boolean;
+export type ToolDeps = {
+    catalog: Catalog;
+    /** This storefront's tool names — the dispatch below compares against these, not literals. */
+    tools: ToolNames;
+    /** The words this shop's goods are called, for the card's own copy. */
+    vocab: {
+        noun: string;
+        nounPlural: string;
+    };
+    shopify: ShopifyConfig;
+    /** Shown to the buyer as the merchant's name. */
+    merchantName: string;
+    /**
+     * THIS merchant's wordmark, for the card header.
+     *
+     * The card used to carry one baked into its HTML — which was the first
+     * merchant's, so every later storefront wore their brand. Passed in, and
+     * omitted when the merchant supplied none: a header with no wordmark falls
+     * back to the shop's name, which is at least true.
+     */
+    logoUrl?: string;
+    /**
+     * Where the card should ask for product images — our own `/img?u=` in front of
+     * Shopify's CDN. The card is drawn in a sandboxed iframe whose CSP the host
+     * sets, and Claude blocks cdn.shopify.com outright; the connector's own origin
+     * is the one host such an iframe is plausibly allowed to load from. The
+     * original CDN url rides along as `imageCdn` so the card can fall back.
+     */
+    imageProxy?: string;
+    /**
+     * Which assistant is shopping, when the client told us at handshake
+     * ("claude-ai", "ChatGPT", …). It rides along on the cart as an attribute so
+     * the merchant can see where an order came from — the order's `Channel` will
+     * always say Online Store, because that is the channel that created it.
+     */
+    assistant?: string;
+};
+export type ToolResult = {
+    structured: Record<string, unknown>;
+    text: string;
+};
+export declare const callTool: (deps: ToolDeps, name: string, args: Record<string, unknown>) => Promise<ToolResult>;
+/**
+ * `productSummary` under test. Exported rather than reached through a live
+ * catalogue because the thing worth pinning is the SHAPE — which fields exist
+ * for which store — and a fetch mock would bury that behind plumbing.
+ */
+export declare const productSummaryForTest: (p: ShopifyProduct, imageProxy?: string) => {
+    type: string | undefined;
+    tags: string[];
+    image: string | undefined;
+    imageCdn: string | undefined;
+    eyes: "unknown" | "pair" | "single";
+    prescriptions: string[];
+    name: string;
+    handle: string;
+    url: string | undefined;
+    price: string | undefined;
+    choices: {
+        name: string;
+        count: number;
+    }[];
+} | {
+    type: string | undefined;
+    tags: string[];
+    image: string | undefined;
+    imageCdn: string | undefined;
+    eyes?: undefined;
+    prescriptions?: undefined;
+    name: string;
+    handle: string;
+    url: string | undefined;
+    price: string | undefined;
+    choices: {
+        name: string;
+        count: number;
+    }[];
+};
+//# sourceMappingURL=tools.d.ts.map

package/dist/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,cAAc,EAKpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAO5C,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAazD;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,GAAI,GAAG,SAAS,EAAE,GAAG,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoF1C,CAAC;AAkBb,eAAO,MAAM,kBAAkB,GAAI,GAAG,SAAS,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAwEtE,CAAC;AA6EH;kEACkE;AAClE,MAAM,MAAM,UAAU,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAC1E,MAAM,MAAM,KAAK,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,UAAU,EAAE,CAAA;CAAE,CAAC;AA8I3D,eAAO,MAAM,WAAW,GAAI,OAAO,MAAM,KAAG,OAAgC,CAAC;AAiC7E,MAAM,MAAM,QAAQ,GAAG;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,8FAA8F;IAC9F,KAAK,EAAE,SAAS,CAAC;IACjB,uEAAuE;IACvE,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,OAAO,EAAE,aAAa,CAAC;IACvB,iDAAiD;IACjD,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAW/E,eAAO,MAAM,QAAQ,GACnB,MAAM,QAAQ,EACd,MAAM,MAAM,EACZ,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,OAAO,CAAC,UAAU,CAqWpB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,GAAG,cAAc,EAAE,aAAa,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAC7C,CAAC"}