@decocms/apps-magento 8.1.0-next.0 → 8.1.0-next.2

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export { createMagentoClient, type MagentoClient, type MagentoClientConfig, type MagentoClientOptions, MagentoError, type MagentoRequestInit, } from "./magentoClient.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,YAAY,EACZ,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+// `@decocms/apps-magento`: the thin Magento client (see /next/upstream-clients).
+export { createMagentoClient, MagentoError, } from "./magentoClient.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,OAAO,EACL,mBAAmB,EAInB,YAAY,GAEb,MAAM,oBAAoB,CAAC"}

package/dist/magentoClient.d.ts

@@ -0,0 +1,62 @@
+/**
+ * The Magento client: a thin client for a Magento store's REST and GraphQL
+ * APIs, over the framework's instrumented fetch (provider "magento"). See
+ * /next/upstream-clients.
+ *
+ * Configuration comes in as arguments; the site reads its environment (or a
+ * `secret` block) where it creates the client. Converters, hooks, cart and
+ * session flows, caching and feature toggles belong to the site (platform
+ * templates), not here.
+ */
+import { createInstrumentedFetch } from "@decocms/blocks/fetch";
+export interface MagentoClientConfig {
+    /** The store's origin, e.g. `https://store.example.com`. Every request goes here. */
+    baseUrl: string;
+    /** Integration access token, sent as `Authorization: Bearer` unless a call opts out. */
+    apiKey?: string;
+    /** Optional value sent as `x-origin-header`, for stores behind an origin guard. */
+    originHeader?: string;
+}
+export interface MagentoClientOptions {
+    /** The fetch underneath, e.g. a fake in tests. Defaults to `globalThis.fetch`. */
+    fetch?: Parameters<typeof createInstrumentedFetch>[0]["fetch"];
+}
+export interface MagentoRequestInit extends RequestInit {
+    /** The operation label, the API's own name for the call (e.g. `getCart`), never a URL. */
+    operation: string;
+    /**
+     * Send the `apiKey` bearer token. Default true for `request`/`rest`, false
+     * for `graphql`. Never replaces an `Authorization` header the call sets
+     * (e.g. a customer token).
+     */
+    authenticated?: boolean;
+}
+/** Thrown on a non-2xx response or a GraphQL `errors` payload. Never carries bodies or tokens. */
+export declare class MagentoError extends Error {
+    readonly operation: string;
+    readonly status: number;
+    /** How many GraphQL errors the response carried (0 for an HTTP failure). */
+    readonly graphqlErrors: number;
+    constructor(operation: string, status: number, 
+    /** How many GraphQL errors the response carried (0 for an HTTP failure). */
+    graphqlErrors?: number);
+}
+export type MagentoClient = ReturnType<typeof createMagentoClient>;
+export declare function createMagentoClient(config: MagentoClientConfig, options?: MagentoClientOptions): {
+    request: (path: string, init: MagentoRequestInit) => Promise<Response>;
+    /** A REST call (`/rest/<store>/V1/...`) returning its parsed JSON body. */
+    rest<T>(path: string, init: MagentoRequestInit): Promise<T>;
+    /**
+     * A GraphQL operation on `/graphql`. `operationName` is sent with the
+     * request and is the operation label. `headers` adds per-call headers,
+     * such as `Store` or a customer `Authorization` token. Storefront
+     * GraphQL is public, so the `apiKey` is sent only with
+     * `authenticated: true`, and never over a customer token.
+     */
+    graphql<TData, TVariables = Record<string, unknown>>(query: string, variables: TVariables | undefined, init: {
+        operationName: string;
+        headers?: Record<string, string>;
+        authenticated?: boolean;
+    }): Promise<TData>;
+};
+//# sourceMappingURL=magentoClient.d.ts.map

package/dist/magentoClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"magentoClient.d.ts","sourceRoot":"","sources":["../src/magentoClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,MAAM,WAAW,mBAAmB;IAClC,qFAAqF;IACrF,OAAO,EAAE,MAAM,CAAC;IAChB,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,kFAAkF;IAClF,KAAK,CAAC,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,kBAAmB,SAAQ,WAAW;IACrD,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,kGAAkG;AAClG,qBAAa,YAAa,SAAQ,KAAK;IAEnC,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,4EAA4E;IAC5E,QAAQ,CAAC,aAAa;IAJxB,YACW,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM;IACvB,4EAA4E;IACnE,aAAa,SAAI,EAQ3B;CACF;AAED,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEnE,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,mBAAmB,EAC3B,OAAO,GAAE,oBAAyB;oBAUL,MAAM,QAAQ,kBAAkB,KAAG,OAAO,CAAC,QAAQ,CAAC;IAiB/E,2EAA2E;SAChE,CAAC,QAAQ,MAAM,QAAQ,kBAAkB,GAAG,OAAO,CAAC,CAAC,CAAC;IAWjE;;;;;;OAMG;YACW,KAAK,EAAE,UAAU,mCACtB,MAAM,aACF,UAAU,GAAG,SAAS,QAC3B;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,GACzF,OAAO,CAAC,KAAK,CAAC;EAoBpB"}

package/dist/magentoClient.js

@@ -0,0 +1,96 @@
+/**
+ * The Magento client: a thin client for a Magento store's REST and GraphQL
+ * APIs, over the framework's instrumented fetch (provider "magento"). See
+ * /next/upstream-clients.
+ *
+ * Configuration comes in as arguments; the site reads its environment (or a
+ * `secret` block) where it creates the client. Converters, hooks, cart and
+ * session flows, caching and feature toggles belong to the site (platform
+ * templates), not here.
+ */
+import { createInstrumentedFetch } from "@decocms/blocks/fetch";
+/** Thrown on a non-2xx response or a GraphQL `errors` payload. Never carries bodies or tokens. */
+export class MagentoError extends Error {
+    operation;
+    status;
+    graphqlErrors;
+    constructor(operation, status, 
+    /** How many GraphQL errors the response carried (0 for an HTTP failure). */
+    graphqlErrors = 0) {
+        super(graphqlErrors > 0
+            ? `magento ${operation} returned ${graphqlErrors} GraphQL error(s)`
+            : `magento ${operation} failed with HTTP ${status}`);
+        this.operation = operation;
+        this.status = status;
+        this.graphqlErrors = graphqlErrors;
+        this.name = "MagentoError";
+    }
+}
+export function createMagentoClient(config, options = {}) {
+    const instrumented = createInstrumentedFetch({ provider: "magento", fetch: options.fetch });
+    const origin = new URL(config.baseUrl).origin;
+    /**
+     * A request to a path on the store, e.g. `/rest/default/V1/carts/mine` or
+     * `/customer/section/load`, returning the raw response. Paths only: the
+     * store's credentials never go to another origin.
+     */
+    async function request(path, init) {
+        const { operation, authenticated = true, ...rest } = init;
+        const url = new URL(path, origin);
+        if (url.origin !== origin) {
+            throw new Error(`magento ${operation}: only paths on the configured store are allowed`);
+        }
+        const headers = new Headers(rest.headers);
+        if (authenticated && config.apiKey && !headers.has("authorization")) {
+            headers.set("authorization", `Bearer ${config.apiKey}`);
+        }
+        if (config.originHeader)
+            headers.set("x-origin-header", config.originHeader);
+        return instrumented(url, { ...rest, headers, operation });
+    }
+    return {
+        request,
+        /** A REST call (`/rest/<store>/V1/...`) returning its parsed JSON body. */
+        async rest(path, init) {
+            const headers = new Headers(init.headers);
+            if (init.body !== undefined && !headers.has("content-type")) {
+                headers.set("content-type", "application/json");
+            }
+            const response = await request(path, { ...init, headers });
+            if (!response.ok)
+                throw new MagentoError(init.operation, response.status);
+            if (response.status === 204)
+                return undefined;
+            return (await response.json());
+        },
+        /**
+         * A GraphQL operation on `/graphql`. `operationName` is sent with the
+         * request and is the operation label. `headers` adds per-call headers,
+         * such as `Store` or a customer `Authorization` token. Storefront
+         * GraphQL is public, so the `apiKey` is sent only with
+         * `authenticated: true`, and never over a customer token.
+         */
+        async graphql(query, variables, init) {
+            const { operationName, ...rest } = init;
+            const headers = new Headers(rest.headers);
+            headers.set("content-type", "application/json");
+            const response = await request("/graphql", {
+                operation: operationName,
+                authenticated: rest.authenticated ?? false,
+                method: "POST",
+                headers,
+                body: JSON.stringify({ query, variables, operationName }),
+            });
+            if (!response.ok)
+                throw new MagentoError(operationName, response.status);
+            const body = (await response.json());
+            if (body.errors?.length) {
+                throw new MagentoError(operationName, response.status, body.errors.length);
+            }
+            if (body.data === undefined)
+                throw new MagentoError(operationName, response.status);
+            return body.data;
+        },
+    };
+}
+//# sourceMappingURL=magentoClient.js.map

package/dist/magentoClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"magentoClient.js","sourceRoot":"","sources":["../src/magentoClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AA2BhE,kGAAkG;AAClG,MAAM,OAAO,YAAa,SAAQ,KAAK;IAE1B,SAAS;IACT,MAAM;IAEN,aAAa;IAJxB,YACW,SAAiB,EACjB,MAAc;IACvB,4EAA4E;IACnE,aAAa,GAAG,CAAC;QAE1B,KAAK,CACH,aAAa,GAAG,CAAC;YACf,CAAC,CAAC,WAAW,SAAS,aAAa,aAAa,mBAAmB;YACnE,CAAC,CAAC,WAAW,SAAS,qBAAqB,MAAM,EAAE,CACtD,CAAC;yBATO,SAAS;sBACT,MAAM;6BAEN,aAAa;QAOtB,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAID,MAAM,UAAU,mBAAmB,CACjC,MAA2B,EAC3B,OAAO,GAAyB,EAAE;IAElC,MAAM,YAAY,GAAG,uBAAuB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IAE9C;;;;OAIG;IACH,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,IAAwB;QAC3D,MAAM,EAAE,SAAS,EAAE,aAAa,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAClC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,WAAW,SAAS,kDAAkD,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,aAAa,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACpE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,MAAM,CAAC,YAAY;YAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC7E,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,OAAO;QACL,OAAO;QAEP,2EAA2E;QAC3E,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAwB;YAClD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC5D,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC3D,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC1E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,SAAc,CAAC;YACnD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;QACtC,CAAC;QAED;;;;;;WAMG;QACH,KAAK,CAAC,OAAO,CACX,KAAa,EACb,SAAiC,EACjC,IAA0F;YAE1F,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;YACxC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE;gBACzC,SAAS,EAAE,aAAa;gBACxB,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,KAAK;gBAC1C,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;aAC1D,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,YAAY,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACzE,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyC,CAAC;YAC7E,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;gBACxB,MAAM,IAAI,YAAY,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7E,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,YAAY,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpF,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,44 +1,36 @@
 {
   "name": "@decocms/apps-magento",
-  "version": "8.1.0-next.0",
+  "version": "8.1.0-next.2",
   "type": "module",
-  "description": "Deco commerce app: Magento integration",
+  "description": "Thin Magento (Adobe Commerce) API client for Deco sites",
   "repository": {
     "type": "git",
     "url": "https://github.com/decocms/blocks.git",
     "directory": "packages/apps-magento"
   },
-  "main": "./src/index.ts",
+  "files": [
+    "dist",
+    "src",
+    "!src/**/*.test.ts",
+    "!src/**/__tests__"
+  ],
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "exports": {
-    ".": "./src/index.ts",
-    "./client": "./src/client.ts",
-    "./types": "./src/types.ts",
-    "./middleware": "./src/middleware.ts",
-    "./loaders/*": "./src/loaders/*.ts",
-    "./actions/*": "./src/actions/*.ts",
-    "./utils/*": "./src/utils/*.ts",
-    "./hooks/*": "./src/hooks/*.ts"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "source": "./src/index.ts",
+      "default": "./dist/index.js"
+    }
   },
   "scripts": {
-    "build": "tsc",
+    "build": "node ../../scripts/tsc.mjs --clean dist -p tsconfig.build.json",
+    "prepack": "npm run build",
     "test": "vitest run --root ../.. packages/apps-magento/",
-    "typecheck": "tsc --noEmit",
-    "lint:unused": "knip"
+    "typecheck": "node ../../scripts/tsc.mjs -p tsconfig.json"
   },
   "dependencies": {
-    "@decocms/blocks": "8.1.0-next.0",
-    "@decocms/apps-commerce": "8.1.0-next.0",
-    "@decocms/tanstack": "8.1.0-next.0"
-  },
-  "peerDependencies": {
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0"
-  },
-  "devDependencies": {
-    "@types/react": "^19.0.0",
-    "@types/react-dom": "^19.0.0",
-    "knip": "^5.86.0",
-    "typescript": "^5.9.0"
+    "@decocms/blocks": "8.1.0-next.2"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",

package/src/index.ts

@@ -1,16 +1,4 @@
-// v8: the thin Magento client (see /next/upstream-clients).
-
-// v7 (kept for v7 consumers until the v7 modules are dropped)
-/**
- * Magento app entry point for @decocms/apps.
- * Re-exports client config + initializer.
- *
- * For actions/loaders/utils, use sub-path imports:
- *   import { features }     from "@decocms/apps/magento/loaders/features"
- *   import { cart }         from "@decocms/apps/magento/loaders/cart"
- *   import { magentoFetch } from "@decocms/apps/magento/client"
- */
-export * from "./client";
+// `@decocms/apps-magento`: the thin Magento client (see /next/upstream-clients).
 export {
   createMagentoClient,
   type MagentoClient,
@@ -18,19 +6,4 @@ export {
   type MagentoClientOptions,
   MagentoError,
   type MagentoRequestInit,
-} from "./magentoClient";
-export type { MagentoCart } from "./types";
-export {
-  clearFetchCache,
-  type FetchCacheOptions,
-  getFetchCacheStats,
-  magentoCachedFetch,
-} from "./utils/fetchCache";
-// Observability wiring — sites call `setMagentoFetch(createMagentoFetch())` at
-// boot to route every Magento egress call through the instrumented fetch
-// (upstream latency/status), and use `magentoCachedFetch` for cacheable GETs
-// (SWR hit/miss → `deco.cache.requests{layer="swr",profile="magento"}`).
-export {
-  type CreateMagentoFetchOptions,
-  createMagentoFetch,
-} from "./utils/instrumentedFetch";
+} from "./magentoClient.ts";

package/src/README.md

@@ -1,65 +0,0 @@
-# Magento app — initial scaffold
-
-This folder ports the Magento integration from `deco-cx/apps/magento`
-(Fresh/Deno) to `@decocms/apps/magento` (TanStack Start/Node), following
-the same shape as the existing `vtex/` and `shopify/` packages.
-
-## Status
-
-**Initial scaffold** — covers the configure/client surface and 2 reference
-loaders (`features`, `cart`) so that downstream sites can wire magento at
-all. The remaining 20+ loaders/actions exist as production-grade code in
-the original deco-cx/apps repo and need adaptation passes (Deno → Node,
-ctx-based to client-based state access, cookie helpers from
-`@decocms/start/sdk/cookie`).
-
-A real-world consumer (a production Magento storefront) is wiring magento
-in-site today using a thin adapter that wraps the legacy `magento/mod.ts`
-shape. Their adapter is the migration target — once this package covers
-the surface area they need, the in-site copy goes away.
-
-## What's here
-
-- `client.ts` — `configureMagento({ baseUrl, apiKey, storeId, ... })` +
-  `getMagentoConfig()` global accessor. Mirrors the `configureVtex`
-  pattern.
-- `types.ts` — request/response shapes shared between loaders.
-- `loaders/features.ts` — returns the feature flags block. The simplest
-  loader, used as a smoke test.
-- `loaders/cart.ts` — fetches the customer's active cart by cookie.
-  Pulls cookies via `@decocms/start/sdk/cookie`.
-- `middleware.ts` — passthrough today; real-world cart-id reconciliation
-  lives in the consumer site for now.
-- `index.ts` — re-export entry.
-
-## Pending port (PR follow-ups)
-
-| Path | Original location |
-|---|---|
-| `loaders/product/{detailsPage,detailsPageGQL,listingPage,list,relatedProducts}.ts` | `deco-cx/apps/magento/loaders/product/*` |
-| `loaders/{proxy,user,wishlist}.ts` | `deco-cx/apps/magento/loaders/*` |
-| `loaders/routes/getRouteType.ts` | idem |
-| `actions/cart/{addCoupon,addItem,removeCoupon,removeItem,setSimulation,simulation,updateItem}.ts` | `deco-cx/apps/magento/actions/cart/*` |
-| `actions/newsletter/subscribe.ts` | idem |
-| `actions/product/stockAlert.ts` | idem |
-| `actions/wishlist/{addItem,removeItem}.ts` | idem |
-| `utils/{clientGraphql,client,transform,cache,graphql,cart}.ts` | `deco-cx/apps/magento/utils/*` |
-| `hooks/{useCart,useUser,useWishlist}.ts` | `deco-cx/apps/magento/hooks/*` (refactor to react-query, like `vtex/hooks/`) |
-| `inline-loaders/*` | new, follow `vtex/inline-loaders/` shape |
-
-**Site-specific extensions (Livelo, Amasty)** in the deco-cx/apps repo
-should stay out of this package — they belong in consumer sites via the
-`ExtensionOf` pattern. Preserving that pattern in the generic loaders
-above is a hard requirement of this port.
-
-## Why a stub now
-
-A production Magento storefront's migration hit a HIGH parity finding:
-
-```
-invoke(magento/loaders/features) failed: handler not found
-```
-
-…because no `@decocms/apps/magento/*` resolver existed. The site is
-working around it locally; this PR begins the upstream fix so future
-magento sites don't have to repeat the in-site adapter.

package/src/__tests__/cart.test.ts

@@ -1,139 +0,0 @@
-/**
- * Tests for the cart loader.
- *
- * Parity goals against deco-cx/apps/magento/loaders/cart.ts (Fresh/Deno,
- * prod):
- *
- *   - Reads `dataservices_cart_id` cookie when caller doesn't supply
- *     `cartId` in props (matches `getCartCookie(req.headers)` in prod).
- *   - Honors props.cartId override (matches `_cartId ?? getCartCookie()`).
- *   - Hits /rest/:site/V1/carts/:cartId — the /rest/ prefix is what the
- *     Magento REST API exposes; the legacy clientAdmin's typed key was
- *     "GET /rest/:site/V1/carts/:cartId".
- *   - Encodes site + cartId so a malicious cookie can't escape the path
- *     segment and reach another admin endpoint with the Bearer token.
- *   - Returns null when no cookie (anonymous visitor — matches prod's
- *     `if (!cartId) return null`).
- *   - Returns null on 404 (expired cookie — prod hits this via the same
- *     branch but throws on other non-2xx; we surface a plain Error).
- *
- * NOT covered by this initial port (and intentionally not tested here):
- *   - Pre-cart `GET /rest/:site/V1/carts/mine` warm-up for logged-in
- *     users (the original does it inside a try/catch and discards the
- *     result — it's a cache primer, not a correctness invariant).
- *   - Parallel /totals fetch + image-pipeline transform — those land in
- *     follow-up PRs that port utils/cart.ts + utils/cache.ts.
- */
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { configureMagento } from "../client";
-import cart from "../loaders/cart";
-
-function mockResponse(body: unknown, status = 200): Response {
-	return new Response(JSON.stringify(body), {
-		status,
-		headers: { "content-type": "application/json" },
-	});
-}
-
-function requestWithCookie(cookie: string): Request {
-	const r = new Request("http://localhost/");
-	// Headers in a freshly-constructed Request enter "request" guard mode
-	// which silently drops `cookie`. Build a Headers manually then attach.
-	const headers = new Headers();
-	headers.set("cookie", cookie);
-	Object.defineProperty(r, "headers", { value: headers, configurable: true });
-	return r;
-}
-
-describe("cart loader", () => {
-	let fetchSpy: ReturnType<typeof vi.spyOn>;
-
-	beforeEach(() => {
-		configureMagento({
-			baseUrl: "https://loja.example.com/",
-			apiKey: "secret",
-			storeId: 1,
-			site: "example",
-		});
-		fetchSpy = vi.spyOn(globalThis, "fetch");
-	});
-
-	afterEach(() => {
-		vi.restoreAllMocks();
-	});
-
-	it("returns null when no cart cookie is present", async () => {
-		const req = new Request("http://localhost/");
-		const result = await cart(undefined, req);
-		expect(result).toBeNull();
-		expect(fetchSpy).not.toHaveBeenCalled();
-	});
-
-	it("reads cartId from the dataservices_cart_id cookie (JSON-encoded)", async () => {
-		fetchSpy.mockResolvedValue(mockResponse({ id: "abc123", items: [] }));
-		const req = requestWithCookie('dataservices_cart_id="abc123"');
-		await cart(undefined, req);
-		const [target] = fetchSpy.mock.calls[0] as [URL];
-		expect(target.toString()).toBe("https://loja.example.com/rest/example/V1/carts/abc123");
-	});
-
-	it("reads cartId from the cookie when it's not JSON-quoted", async () => {
-		fetchSpy.mockResolvedValue(mockResponse({ id: "raw-id", items: [] }));
-		const req = requestWithCookie("dataservices_cart_id=raw-id");
-		await cart(undefined, req);
-		const [target] = fetchSpy.mock.calls[0] as [URL];
-		expect(target.toString()).toBe("https://loja.example.com/rest/example/V1/carts/raw-id");
-	});
-
-	it("honors props.cartId override (cookie ignored)", async () => {
-		fetchSpy.mockResolvedValue(mockResponse({ id: "from-props", items: [] }));
-		const req = requestWithCookie('dataservices_cart_id="from-cookie"');
-		await cart({ cartId: "from-props" }, req);
-		const [target] = fetchSpy.mock.calls[0] as [URL];
-		expect(target.toString()).toContain("/rest/example/V1/carts/from-props");
-	});
-
-	it("URL-encodes the cartId to prevent path injection", async () => {
-		// A malicious cookie value tries to break out of the path segment
-		// and reach a different admin endpoint with the Bearer attached.
-		fetchSpy.mockResolvedValue(mockResponse(null, 404));
-		const req = requestWithCookie('dataservices_cart_id="../admin/leak?secret=1"');
-		await cart(undefined, req);
-		const [target] = fetchSpy.mock.calls[0] as [URL];
-		// Encoded: %2F (slash), %3F (?), %3D (=). The trailing
-		// "/admin/leak?secret=1" stays inside the path segment.
-		expect(target.pathname).toMatch(
-			/^\/rest\/example\/V1\/carts\/(\.\.|%2E%2E)%2Fadmin%2Fleak%3Fsecret%3D1$/i,
-		);
-	});
-
-	it("returns null on 404 (expired cart cookie)", async () => {
-		fetchSpy.mockResolvedValue(mockResponse(null, 404));
-		const req = requestWithCookie('dataservices_cart_id="stale"');
-		const result = await cart(undefined, req);
-		expect(result).toBeNull();
-	});
-
-	it("throws on non-404 errors", async () => {
-		fetchSpy.mockResolvedValue(mockResponse(null, 500));
-		const req = requestWithCookie('dataservices_cart_id="abc"');
-		await expect(cart(undefined, req)).rejects.toThrow(/cart loader: 500/);
-	});
-
-	it("attaches Bearer + x-origin-header (same-origin) on the cart fetch", async () => {
-		configureMagento({
-			baseUrl: "https://loja.example.com/",
-			apiKey: "secret",
-			storeId: 1,
-			site: "example",
-			originHeader: "origin-secret",
-		});
-		fetchSpy.mockResolvedValue(mockResponse({ id: "abc", items: [] }));
-		const req = requestWithCookie('dataservices_cart_id="abc"');
-		await cart(undefined, req);
-		const [, init] = fetchSpy.mock.calls[0] as [URL, RequestInit];
-		const headers = init.headers as Headers;
-		expect(headers.get("authorization")).toBe("Bearer secret");
-		expect(headers.get("x-origin-header")).toBe("origin-secret");
-	});
-});