@decocms/apps-magento 7.2.0

package/src/__tests__/wishlist-loader.test.ts

@@ -0,0 +1,97 @@
+/**
+ * Tests for the wishlist loader.
+ *
+ * Parity goals against deco-cx/apps/magento/loaders/wishlist.ts:
+ *   - Returns null when no PHPSESSID (anonymous).
+ *   - Hits /customer/section/load?sections=wishlist with the Cookie header.
+ *   - Returns the wishlist payload directly when present.
+ *   - Returns null when the bundle has no wishlist slice.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { configureMagento } from "../client";
+import wishlist from "../loaders/wishlist";
+
+function mockResponse(body: unknown, status = 200): Response {
+	return new Response(JSON.stringify(body), {
+		status,
+		headers: { "content-type": "application/json" },
+	});
+}
+
+function requestWithCookie(cookie: string): Request {
+	const r = new Request("http://localhost/");
+	const headers = new Headers();
+	headers.set("cookie", cookie);
+	Object.defineProperty(r, "headers", { value: headers, configurable: true });
+	return r;
+}
+
+describe("wishlist loader", () => {
+	let fetchSpy: ReturnType<typeof vi.spyOn>;
+
+	beforeEach(() => {
+		configureMagento({
+			baseUrl: "https://loja.example.com/",
+			apiKey: "secret",
+			storeId: 1,
+			site: "example",
+		});
+		fetchSpy = vi.spyOn(globalThis, "fetch");
+	});
+
+	afterEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	it("returns null when no PHPSESSID cookie is present", async () => {
+		expect(await wishlist(null, new Request("http://localhost/"))).toBeNull();
+		expect(fetchSpy).not.toHaveBeenCalled();
+	});
+
+	it("requests /customer/section/load?sections=wishlist", async () => {
+		fetchSpy.mockResolvedValue(
+			mockResponse({
+				wishlist: { counter: "0", items: [], counter_number: 0, data_id: 1 },
+			}),
+		);
+		await wishlist(null, requestWithCookie("PHPSESSID=abc"));
+		const [target] = fetchSpy.mock.calls[0] as [URL];
+		expect(target.toString()).toBe(
+			"https://loja.example.com/example/customer/section/load?sections=wishlist",
+		);
+	});
+
+	it("returns the wishlist payload on success", async () => {
+		const wl = {
+			counter: "1",
+			counter_number: 1,
+			data_id: 1,
+			items: [
+				{
+					image: { template: "", src: "", width: 0, height: 0, alt: "" },
+					product_sku: "ABC",
+					product_id: "1",
+					product_url: "",
+					product_name: "n",
+					product_price: "10",
+					product_is_saleable_and_visible: true,
+					product_has_required_options: false,
+					add_to_cart_params: "",
+					delete_item_params: "",
+				},
+			],
+		};
+		fetchSpy.mockResolvedValue(mockResponse({ wishlist: wl }));
+		expect(await wishlist(null, requestWithCookie("PHPSESSID=abc"))).toEqual(wl);
+	});
+
+	it("returns null when bundle lacks a wishlist slice", async () => {
+		fetchSpy.mockResolvedValue(mockResponse({}));
+		expect(await wishlist(null, requestWithCookie("PHPSESSID=abc"))).toBeNull();
+	});
+
+	it("returns null on non-2xx response", async () => {
+		fetchSpy.mockResolvedValue(mockResponse(null, 500));
+		expect(await wishlist(null, requestWithCookie("PHPSESSID=abc"))).toBeNull();
+	});
+});

package/src/actions/newsletter/subscribe.ts

@@ -0,0 +1,40 @@
+/**
+ * Magento newsletter subscribe — POST a customer email to the
+ * `/V1/newsletter/subscribed` REST endpoint.
+ *
+ * Verbatim port of `deco-cx/apps/magento/actions/newsletter/subscribe.ts`:
+ * the legacy version took `(props, _req, ctx)` and pulled `storeId` /
+ * `clientAdmin` / `site` off the App() context. The TanStack/Node port
+ * reads the same fields from `getMagentoConfig()` and uses
+ * `magentoFetch` so auth/origin/Referer headers stay aligned with the
+ * rest of the magento app. Endpoint shape and request body are
+ * unchanged so the Magento backend doesn't need re-tuning.
+ */
+import { getMagentoConfig, magentoFetch } from "../../client";
+import type { NewsletterData } from "../../types";
+
+export interface SubscribeProps {
+	/**
+	 * @title Email
+	 */
+	email: string;
+}
+
+export default async function subscribe(props: SubscribeProps): Promise<NewsletterData | null> {
+	const { site, storeId } = getMagentoConfig();
+	const path = `/rest/${encodeURIComponent(site)}/V1/newsletter/subscribed`;
+
+	const res = await magentoFetch(path, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({
+			email: props.email,
+			store_id: Number(storeId),
+		}),
+	});
+
+	if (!res.ok) return null;
+	const result = (await res.json()) as NewsletterData | { success: false };
+	if (!result || (result as NewsletterData).success === false) return null;
+	return result as NewsletterData;
+}

package/src/actions/product/stockAlert.ts

@@ -0,0 +1,67 @@
+/**
+ * Magento product stock-alert subscribe — fires a GraphQL mutation so
+ * the customer gets notified when an out-of-stock SKU is replenished.
+ *
+ * Verbatim port of `deco-cx/apps/magento/actions/product/stockAlert.ts`.
+ * The Fresh version called `ctx.clientGraphql.query(...)` with a third
+ * `STALE` parameter that opted into a 1h SWR cache. The TanStack/Node
+ * port uses `magentoFetch` against `/graphql` directly; STALE was a
+ * cache hint only — the mutation is a write so no caching applies and
+ * we can drop the parameter (the original passed it but mutations are
+ * never cached server-side, so the behavior is identical).
+ *
+ * Response shape preserved: returns `{ data: { productStockAlert } }`
+ * on success or `{ error: string }` on failure.
+ */
+import { getMagentoConfig, magentoFetch } from "../../client";
+import type { ProductStockAlertResponse } from "../../types";
+
+export interface StockAlertProps {
+	product_id: number;
+	name: string;
+	email: string;
+}
+
+const MUTATION = `mutation ProductStockAlert($product_id: Int!, $name: String!, $email: String!) {
+  productStockAlert(
+    product_id: $product_id
+    name: $name
+    email: $email
+  ) {
+    message
+    status
+  }
+}`;
+
+export default async function stockAlert(
+	props: StockAlertProps,
+): Promise<ProductStockAlertResponse | { error: string }> {
+	const { product_id, name, email } = props;
+	const { baseUrl } = getMagentoConfig();
+
+	try {
+		const res = await magentoFetch(`${baseUrl.replace(/\/$/, "")}/graphql`, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				operationName: "ProductStockAlert",
+				variables: { product_id, name, email },
+				query: MUTATION,
+			}),
+		});
+
+		const json = (await res.json()) as {
+			data?: { productStockAlert: { message: string; status: boolean } };
+		};
+
+		if (!json.data?.productStockAlert) {
+			return { error: "productStockAlert payload missing in GraphQL response" };
+		}
+
+		return { data: { productStockAlert: json.data.productStockAlert } };
+	} catch (error) {
+		return {
+			error: error instanceof Error ? error.message : "Erro desconhecido",
+		};
+	}
+}

package/src/actions/wishlist/addItem.ts

@@ -0,0 +1,57 @@
+/**
+ * Adds a product to the customer's wishlist and returns the refreshed
+ * wishlist on success (or null on failure).
+ *
+ * Ported from `deco-cx/apps/magento/actions/wishlist/addItem.ts`. The
+ * Fresh version posted multipart FormData with `product` + `form_key`
+ * to `/wishlist/index/add/` and on success delegated to
+ * wishlistLoader to fetch the updated state. Same flow here — but the
+ * wishlistLoader is imported from the upstream port instead of the
+ * legacy in-site path.
+ */
+import { getCookies } from "@decocms/blocks/sdk/cookie";
+import { getMagentoConfig, magentoFetch } from "../../client";
+import wishlistLoader from "../../loaders/wishlist";
+import type { Wishlist } from "../../utils/client/types";
+import { FORM_KEY_COOKIE, SESSION_COOKIE } from "../../utils/constants";
+import { getUserCookie } from "../../utils/user";
+
+export interface AddWishlistItemProps {
+	productId: string;
+}
+
+export default async function addItem(
+	{ productId }: AddWishlistItemProps,
+	req: Request,
+): Promise<Wishlist | null> {
+	try {
+		const sessionId = getUserCookie(req.headers);
+		if (!sessionId) return null;
+
+		const cookies = getCookies(req.headers);
+		const formKey = cookies[FORM_KEY_COOKIE];
+		if (!formKey) return null;
+
+		const { site } = getMagentoConfig();
+		const body = new FormData();
+		body.append("product", productId);
+		body.append("form_key", formKey);
+
+		const res = await magentoFetch(`/${encodeURIComponent(site)}/wishlist/index/add/`, {
+			method: "POST",
+			headers: {
+				Cookie: `${SESSION_COOKIE}=${sessionId}`,
+				"x-requested-with": "XMLHttpRequest",
+			},
+			body,
+		});
+
+		if (!res.ok) return null;
+		const { success } = (await res.json()) as { success?: boolean };
+		if (!success) return null;
+
+		return wishlistLoader(null, req);
+	} catch {
+		return null;
+	}
+}

package/src/actions/wishlist/removeItem.ts

@@ -0,0 +1,59 @@
+/**
+ * Removes a wishlist item by its Magento item id and returns the
+ * refreshed wishlist on success (or null on failure).
+ *
+ * Ported from `deco-cx/apps/magento/actions/wishlist/removeItem.ts`.
+ * The legacy code also passed an empty `uenc=""` form param — kept
+ * here byte-for-byte because Magento's wishlist controller treats the
+ * absence of `uenc` differently from an empty value and we don't want
+ * a silent behavior shift.
+ */
+import { getCookies } from "@decocms/blocks/sdk/cookie";
+import { getMagentoConfig, magentoFetch } from "../../client";
+import wishlistLoader from "../../loaders/wishlist";
+import type { Wishlist } from "../../utils/client/types";
+import { FORM_KEY_COOKIE, SESSION_COOKIE } from "../../utils/constants";
+import { getUserCookie } from "../../utils/user";
+
+export interface RemoveWishlistItemProps {
+	/** Magento wishlist item id (NOT the product id — the wishlist row id) */
+	productId: string;
+}
+
+export default async function removeItem(
+	{ productId }: RemoveWishlistItemProps,
+	req: Request,
+): Promise<Wishlist | null> {
+	try {
+		const sessionId = getUserCookie(req.headers);
+		if (!sessionId) return null;
+
+		const cookies = getCookies(req.headers);
+		const formKey = cookies[FORM_KEY_COOKIE];
+		if (!formKey) return null;
+
+		const { site } = getMagentoConfig();
+		const body = new FormData();
+		body.append("item", productId);
+		body.append("uenc", "");
+		body.append("form_key", formKey);
+
+		const res = await magentoFetch(`/${encodeURIComponent(site)}/wishlist/index/remove/`, {
+			method: "POST",
+			headers: {
+				Cookie: `${SESSION_COOKIE}=${sessionId}`,
+				"x-requested-with": "XMLHttpRequest",
+				"Content-Type": "application/x-www-form-urlencoded",
+			},
+			body,
+		});
+
+		if (!res.ok) return null;
+		const { success } = (await res.json()) as { success?: boolean };
+		if (!success) return null;
+
+		return wishlistLoader(null, req);
+	} catch {
+		return null;
+	}
+}

package/src/client.ts

@@ -0,0 +1,228 @@
+/**
+ * Magento API client config — module-global, set once at app boot.
+ *
+ * Mirrors `vtex/client.ts`'s configureVtex/getVtexConfig pattern so the
+ * same wiring contract works across commerce apps. Sites should call
+ * `configureMagento(...)` once from their setup phase before any
+ * loader/action runs; loaders consume `getMagentoConfig()` to pick up
+ * baseUrl, auth, and feature toggles.
+ *
+ * Two reasons we don't pass config explicitly to every loader:
+ *  1. CMS-resolved loader instances don't know where the config block
+ *     lives; the site's `initMagentoFromBlocks(blocks)` adapter is the
+ *     single source of truth.
+ *  2. Matches the rest of @decocms/apps so a site touching VTEX and
+ *     Magento has consistent muscle memory.
+ */
+
+// ---------------------------------------------------------------------------
+// Config shapes
+// ---------------------------------------------------------------------------
+
+/**
+ * URL-search-param filter mapping consumed by GraphQL product loaders.
+ * Each entry pairs a Magento attribute slug (`value`) with the
+ * comparison operator the storefront's URL filters use (`type`). The
+ * default mapping lives in `utils/constants.ts:DEFAULT_GRAPHQL_FILTERS`;
+ * sites extend it via the `customFilters` prop on PLP/list loaders.
+ */
+export interface FiltersGraphQL {
+	value: string;
+	type: "EQUAL" | "MATCH" | "RANGE";
+}
+
+export interface MagentoFeatures {
+	dangerouslyDisableWishlist?: boolean;
+	dangerouslyDisableOnLoadUpdate?: boolean;
+	dangerouslyReturnNullAfterAction?: boolean;
+	dangerouslyDontReturnCartAfterAction?: boolean;
+	dangerouslyDisableOnVisibilityChangeUpdate?: boolean;
+}
+
+export interface MagentoImagesConfig {
+	imagesQtd: number;
+	imagesUrl: string;
+}
+
+export interface MagentoPricingConfig {
+	maxInstallments: number;
+	minInstallmentValue: number;
+}
+
+export interface MagentoCartConfigs {
+	countProductImageInCart?: number;
+	changeCardIdAfterCheckout?: boolean;
+	cartErrorMessages?: string[];
+}
+
+export interface MagentoConfig {
+	/** Magento storefront base URL, e.g. `https://loja.granado.com.br/` */
+	baseUrl: string;
+	/** Bearer token for `Authorization` header on admin REST calls */
+	apiKey: string;
+	/** Store ID used in headers + path prefixes */
+	storeId: number;
+	/** Site/site-code used in path segments */
+	site: string;
+	/** Which Store header to send (default: "site") */
+	storeHeader?: string;
+	/** Optional opaque header value sent as `x-origin-header` */
+	originHeader?: string;
+	/** Currency code (e.g. "BRL") */
+	currencyCode?: string;
+	/** Whether to append `_suffix` to admin endpoints */
+	useSuffix?: boolean;
+	/** Behavior toggles surfaced to client hooks */
+	features?: MagentoFeatures;
+	/** Cart-specific tunables */
+	cartConfigs?: MagentoCartConfigs;
+	/** Images CDN config */
+	imagesConfig?: MagentoImagesConfig;
+	/** Pricing rules for installments display */
+	pricingConfig?: MagentoPricingConfig;
+}
+
+// ---------------------------------------------------------------------------
+// Module-global state
+// ---------------------------------------------------------------------------
+
+let config: MagentoConfig | null = null;
+
+export function configureMagento(c: MagentoConfig): void {
+	config = c;
+}
+
+export function getMagentoConfig(): MagentoConfig {
+	if (!config) {
+		throw new Error(
+			"[Magento] configureMagento() must be called before loaders run. " +
+				"Wire it in your site's setup, e.g. configureMagento(blocks.magento).",
+		);
+	}
+	return config;
+}
+
+/**
+ * Best-effort init from a CMS block — mirrors `initVtexFromBlocks`.
+ *
+ * Resolves secret references stored in the CMS block (`apiKey`,
+ * `originHeader`) in this priority:
+ *   1. Plain string                                              (dev override)
+ *   2. `{ get: () => string }` object                            (legacy)
+ *   3. `{ encrypted: "<hex>" }` decrypted via `DECO_CRYPTO_KEY`   (prod)
+ *   4. `{ name: "ENV_VAR" }` → `process.env[name]`               (fallback)
+ *
+ * (3) is what the production Deco CMS actually stores — admin
+ * encrypts the secret with the site's `DECO_CRYPTO_KEY` so the value
+ * never leaves the worker in plain text. Previously this init only
+ * read `process.env[name]`, which silently produced `apiKey: ""` for
+ * any site that hadn't *also* set the named env var as a CF Worker
+ * secret. Result: `Authorization: Bearer ` header missing on every
+ * request → Magento 401 → minicart/cart-related loaders dead. The
+ * shared `resolveSecret` helper from `@decocms/blocks/sdk/crypto`
+ * handles the full chain, matching how VTEX and Shopify configure
+ * themselves.
+ *
+ * Because the AES-CBC decrypt step is async, this function is now
+ * `Promise<void>` — site setups must `await` the call before any
+ * loader fires.
+ */
+export async function initMagentoFromBlocks(blocks: Record<string, unknown>): Promise<void> {
+	// Lazy-imported to keep `@decocms/blocks/sdk/crypto` out of the
+	// import graph for sites that wire Magento manually via
+	// `configureMagento({ apiKey: "..." })` without ever calling this
+	// helper (e.g. unit tests, CLI tools).
+	const { resolveSecret } = await import("@decocms/blocks/sdk/crypto");
+
+	const block = blocks.magento as Record<string, any> | undefined;
+	if (!block) {
+		console.warn("[Magento] No `magento` block found in CMS; skipping init.");
+		return;
+	}
+
+	const apiConfig = block.apiConfig ?? {};
+
+	// The env-var fallback names match the Secret block's `name` field
+	// when present. `resolveSecret` cycles through the chain documented
+	// above; an empty string here means every layer was empty, which we
+	// pass through verbatim so `buildHeaders` can detect it.
+	const extractEnvName = (value: unknown): string => {
+		if (value && typeof value === "object") {
+			const name = (value as { name?: unknown }).name;
+			if (typeof name === "string") return name;
+		}
+		return "";
+	};
+	const apiKeyEnvName = extractEnvName(apiConfig.apiKey);
+	const originHeaderEnvName = extractEnvName(apiConfig.originHeader);
+
+	const apiKey = (await resolveSecret(apiConfig.apiKey, apiKeyEnvName)) ?? "";
+	const originHeader = (await resolveSecret(apiConfig.originHeader, originHeaderEnvName)) ?? "";
+
+	configureMagento({
+		baseUrl: apiConfig.baseUrl ?? "",
+		apiKey,
+		storeId: apiConfig.storeId ?? 1,
+		site: apiConfig.site ?? "",
+		storeHeader: apiConfig.storeHeader,
+		originHeader,
+		currencyCode: apiConfig.currencyCode,
+		useSuffix: apiConfig.useSuffix,
+		features: block.features,
+		cartConfigs: block.cartConfigs,
+		imagesConfig: block.imagesConfig,
+		pricingConfig: block.pricingConfig,
+	});
+}
+
+// ---------------------------------------------------------------------------
+// HTTP helpers (thin wrappers over fetch with auth pre-applied)
+// ---------------------------------------------------------------------------
+
+export interface MagentoFetchOpts extends RequestInit {
+	/** Whether to attach the admin Bearer token. Default true. */
+	authenticated?: boolean;
+}
+
+function buildHeaders(
+	opts: MagentoFetchOpts,
+	c: MagentoConfig,
+	attachMagentoIdentity: boolean,
+): Headers {
+	const headers = new Headers(opts.headers ?? {});
+	// `attachMagentoIdentity` is false when the request is going to a host
+	// that isn't the configured Magento backend. None of the Magento-only
+	// headers below should leak in that case: the Bearer is privileged, the
+	// `x-origin-header` is a secret that third parties shouldn't see, and a
+	// forced `Referer` would broadcast our Magento storefront URL.
+	if (!attachMagentoIdentity) return headers;
+
+	if (opts.authenticated !== false && c.apiKey) {
+		headers.set("Authorization", `Bearer ${c.apiKey}`);
+	}
+	if (c.originHeader) {
+		headers.set("x-origin-header", c.originHeader);
+	}
+	if (!headers.has("Referer")) {
+		headers.set("Referer", c.baseUrl);
+	}
+	return headers;
+}
+
+export function magentoFetch(path: string, opts: MagentoFetchOpts = {}): Promise<Response> {
+	const c = getMagentoConfig();
+	const baseUrl = new URL(c.baseUrl);
+	const target = path.startsWith("http")
+		? new URL(path)
+		: new URL(path.startsWith("/") ? path : `/${path}`, baseUrl);
+
+	// Only attach Magento identity (Bearer, x-origin-header, forced Referer)
+	// when the request is going to the configured Magento host. An absolute
+	// URL to a different origin would otherwise leak the admin token *and*
+	// our origin/Referer secrets to that third party. Callers that genuinely
+	// want a third-party call must still pass `authenticated: false` for
+	// clarity at the call site.
+	const sameOrigin = target.origin === baseUrl.origin;
+
+	return fetch(target, { ...opts, headers: buildHeaders(opts, c, sameOrigin) });
+}

package/src/index.ts

@@ -0,0 +1,11 @@
+/**
+ * Magento app entry point for @decocms/apps.
+ * Re-exports client config + initializer.
+ *
+ * For actions/loaders/utils, use sub-path imports:
+ *   import { features }     from "@decocms/apps/magento/loaders/features"
+ *   import { cart }         from "@decocms/apps/magento/loaders/cart"
+ *   import { magentoFetch } from "@decocms/apps/magento/client"
+ */
+export * from "./client";
+export type { MagentoCart } from "./types";

package/src/loaders/cart.ts

@@ -0,0 +1,64 @@
+/**
+ * Magento cart loader — fetches the customer's active cart by cookie.
+ *
+ * Reads the `dataservices_cart_id` cookie from the request, calls the
+ * Magento admin REST endpoint, and returns the cart payload. Returns
+ * `null` when no cart cookie is present (anonymous visitor — expected).
+ *
+ * This is a minimal port of `deco-cx/apps/magento/loaders/cart.ts`.
+ * It omits, for now, the image-handling pipeline (`handleCartImages`)
+ * and the cart-items-with-images transform. Those depend on
+ * `utils/cache.ts` and `utils/cart.ts` from the original — both
+ * pending ports (see magento/README.md).
+ */
+import { getCookies } from "@decocms/blocks/sdk/cookie";
+import { getMagentoConfig, magentoFetch } from "../client";
+import type { MagentoCart } from "../types";
+
+const CART_COOKIE = "dataservices_cart_id";
+
+function readCartIdFromCookie(headers: Headers): string | null {
+	const cookies = getCookies(headers);
+	const raw = cookies[CART_COOKIE];
+	if (!raw) return null;
+	// Magento sets the cookie as `"<id>"` (JSON-encoded). Try to parse;
+	// fall back to the raw string if it isn't quoted.
+	try {
+		const parsed = JSON.parse(raw);
+		return typeof parsed === "string" ? parsed : raw;
+	} catch {
+		return raw;
+	}
+}
+
+export interface CartLoaderProps {
+	/** Override the cart id (used by checkout flows that already know it). */
+	cartId?: string;
+}
+
+export default async function cart(
+	props: CartLoaderProps | undefined,
+	req: Request,
+): Promise<MagentoCart | null> {
+	const cartId = props?.cartId ?? readCartIdFromCookie(req.headers);
+	if (!cartId) return null;
+
+	const { site } = getMagentoConfig();
+	// Magento exposes the cart endpoint at /rest/:site/V1/carts/:cartId — the
+	// /rest/ prefix is mandatory and matches the Fresh/Deno original
+	// (deco-cx/apps/magento/loaders/cart.ts uses
+	// clientAdmin["GET /rest/:site/V1/carts/:cartId"]).
+	//
+	// cartId comes from the request cookie and is user-controlled. Both
+	// `site` and `cartId` are URL-encoded so neither can break out of its
+	// path segment and hit a different endpoint while the privileged
+	// Bearer token is still attached.
+	const path = `/rest/${encodeURIComponent(site)}/V1/carts/${encodeURIComponent(cartId)}`;
+
+	const res = await magentoFetch(path);
+	if (!res.ok) {
+		if (res.status === 404) return null; // expired/invalid cart cookie
+		throw new Error(`[Magento] cart loader: ${res.status} ${res.statusText}`);
+	}
+	return (await res.json()) as MagentoCart;
+}

package/src/loaders/features.ts

@@ -0,0 +1,16 @@
+/**
+ * Magento feature flags — returns the `features` block from the resolved
+ * Magento config. Sites read this to gate optional client-side behavior
+ * (cart on-load update, wishlist visibility, on-visibility-change update,
+ * etc.) without re-deploying.
+ *
+ * In the legacy deco-cx/apps shape this lived as a 3-arg loader
+ * `(_props, _req, ctx) => ctx.features`. The TanStack/Node port uses
+ * the module-global config set by `configureMagento(...)` instead of a
+ * per-request ctx, which matches the rest of @decocms/apps.
+ */
+import { getMagentoConfig, type MagentoFeatures } from "../client";
+
+export default function features(): MagentoFeatures {
+	return getMagentoConfig().features ?? {};
+}