@doswiftly/storefront-sdk 21.0.0 → 22.0.0

package/dist/react/server/index.d.ts

@@ -1,7 +1,7 @@
 export { getStorefrontClient, type ServerClientOptions } from './get-storefront-client';
 export { createStorefrontAuthRoute, type StorefrontAuthRouteOptions, type StorefrontAuthRouteHandlers, } from './create-storefront-auth-route';
 export { getInitialAuth, type InitialAuth } from './get-initial-auth';
-export { readCartIdCookie, readCartCredentials, readCurrencyCookie } from './cookie-readers';
+export { readCartIdCookie, readCartCredentials, readCurrencyCookie, readReferralCodeCookie } from './cookie-readers';
 export { serverCartSecretMiddleware } from '../../core/middleware/cart-secret';
 export { trustedForwardedHostValidator, originAllowlistValidator, type OriginValidator, type OriginValidatorContext, } from '../../core/auth/handlers';
 //# sourceMappingURL=index.d.ts.map

package/dist/react/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/react/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,KAAK,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAGxF,OAAO,EACL,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,GACjC,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EAAE,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAI7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAG/E,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,KAAK,eAAe,EACpB,KAAK,sBAAsB,GAC5B,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/react/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,KAAK,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAGxF,OAAO,EACL,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,GACjC,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EAAE,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAIrH,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAG/E,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,KAAK,eAAe,EACpB,KAAK,sBAAsB,GAC5B,MAAM,0BAA0B,CAAC"}

package/dist/react/server/index.js

@@ -3,8 +3,8 @@ export { getStorefrontClient } from './get-storefront-client';
 export { createStorefrontAuthRoute, } from './create-storefront-auth-route';
 // Server-only cold-start auth seed from the first-party cookies.
 export { getInitialAuth } from './get-initial-auth';
-// Server-first readers for the readable first-party cookies (cart-id, currency).
-export { readCartIdCookie, readCartCredentials, readCurrencyCookie } from './cookie-readers';
+// Server-first readers for the readable first-party cookies (cart-id, currency, referral).
+export { readCartIdCookie, readCartCredentials, readCurrencyCookie, readReferralCodeCookie } from './cookie-readers';
 // Server cart-secret middleware — prepend to `getStorefrontClient({ middleware })`
 // with `await readCartCredentials()` so SSR / edge cart reads carry the secret.
 export { serverCartSecretMiddleware } from '../../core/middleware/cart-secret';

package/dist/react/stores/auth.store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.store.d.ts","sourceRoot":"","sources":["../../../src/react/stores/auth.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAE/C,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IAExB,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;;OAKG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IAGnB,OAAO,EAAE,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACjG,SAAS,EAAE,MAAM,IAAI,CAAC;IACtB;;;;OAIG;IACH,YAAY,EAAE,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACjD,cAAc,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC;IACzD,UAAU,EAAE,CAAC,SAAS,EAAE,OAAO,KAAK,IAAI,CAAC;CAC1C;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,eAAO,MAAM,eAAe,GAAI,UAAU,sBAAsB;;;;;sBAyExC,YAAY,GAAG,IAAI;6BACZ,OAAO;;;;;;;;sBADd,YAAY,GAAG,IAAI;6BACZ,OAAO;;;CAUnC,CAAC"}
+{"version":3,"file":"auth.store.d.ts","sourceRoot":"","sources":["../../../src/react/stores/auth.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAE/C,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IAExB,QAAQ,EAAE,YAAY,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;;OAKG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IAGnB,OAAO,EAAE,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACjG,SAAS,EAAE,MAAM,IAAI,CAAC;IACtB;;;;OAIG;IACH,YAAY,EAAE,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACjD,cAAc,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC;IACzD,UAAU,EAAE,CAAC,SAAS,EAAE,OAAO,KAAK,IAAI,CAAC;CAC1C;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,eAAO,MAAM,eAAe,GAAI,UAAU,sBAAsB;;;;;sBA4ExC,YAAY,GAAG,IAAI;6BACZ,OAAO;;;;;;;;sBADd,YAAY,GAAG,IAAI;6BACZ,OAAO;;;CAUnC,CAAC"}

package/dist/react/stores/auth.store.js

@@ -42,10 +42,11 @@ export const createAuthStore = (options) => createStore()(persist((set) => ({
     setLoading: (isLoading) => set({ isLoading }),
 }), {
     name: AUTH_STORAGE_KEY,
-    version: 3, // v3 (Iteracja 2 — XSS fix): accessToken DROP'owany z localStorage
-    // persistence. Token żyje tylko w-memory + httpOnly cookie (browser auto-sent).
-    // Non-browser klienci (mobile native, server-to-server) ustawiają token explicit
-    // przez setAuth() — nigdy nie persistowany w localStorage SDK.
+    version: 3, // v3 (XSS hardening): accessToken dropped from localStorage
+    // persistence. The token lives only in memory + the httpOnly cookie
+    // (browser auto-sent). Non-browser clients (mobile native, server-to-server)
+    // set the token explicitly via setAuth() — it is never persisted to the
+    // SDK's localStorage slice.
     partialize: (state) => ({
         customer: state.customer,
         isAuthenticated: state.isAuthenticated,
@@ -63,18 +64,20 @@ export const createAuthStore = (options) => createStore()(persist((set) => ({
         return {
             ...currentState,
             customer: persisted.customer ?? currentState.customer,
-            // accessToken NIE persistowany w localStorage (Inv-5 XSS hardening) — spread
-            // `...currentState` propaguje wartość z factory: `null` (default) lub seed
-            // z `options.initialAccessToken` gdy konsumer podał token server-side.
+            // accessToken is never persisted to localStorage (XSS hardening) — the
+            // `...currentState` spread propagates the factory value: `null` (default)
+            // or the seed from `options.initialAccessToken` when the consumer provided
+            // a server-side token.
             // Server cookie is the authority — never let stale localStorage override it.
             isAuthenticated: currentState.isAuthenticated,
         };
     },
     migrate: (persistedState, version) => {
         if (version < 3) {
-            // v1→v2: Turbopack duplication cleanup; v2→v3: XSS fix — accessToken usunięty
-            // z localStorage. Po migracji store start fresh, użytkownik re-auth przez
-            // cookie hydration (BFF /api/auth/whoami) lub login flow.
+            // v1→v2: Turbopack duplication cleanup; v2→v3: XSS hardening — accessToken
+            // removed from localStorage. After the migration the store starts fresh;
+            // the user re-authenticates via cookie hydration (BFF /api/auth/whoami)
+            // or the login flow.
             return { customer: null, isAuthenticated: false };
         }
         return persistedState;

package/dist/react/stores/cart.store.d.ts

@@ -37,7 +37,7 @@
  *
  * const store = createCartStore({
  *   getActions: () => actions,
- *   onExpired: (e) => toast.error('Koszyk wygasł, dodaj produkty ponownie'),
+ *   onExpired: (e) => toast.error('Your cart expired — please add the items again'),
  * });
  * ```
  */

package/dist/react/stores/cart.store.js

@@ -37,7 +37,7 @@
  *
  * const store = createCartStore({
  *   getActions: () => actions,
- *   onExpired: (e) => toast.error('Koszyk wygasł, dodaj produkty ponownie'),
+ *   onExpired: (e) => toast.error('Your cart expired — please add the items again'),
  * });
  * ```
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@doswiftly/storefront-sdk",
-  "version": "21.0.0",
+  "version": "22.0.0",
   "description": "Storefront runtime SDK for DoSwiftly Commerce — layered transport, middleware pipeline, React providers, Zustand stores, cache strategies. 0 runtime dependencies in core.",
   "type": "module",
   "sideEffects": false,