@doswiftly/storefront-sdk 22.1.0 → 22.3.0

package/dist/core/generated/operation-types.js

@@ -432,6 +432,15 @@ export const OrderPaymentStatus = {
     Unpaid: 'UNPAID',
     Voided: 'VOIDED'
 };
+export const PaymentAcknowledgementDocumentKind = {
+    InformationObligation: 'INFORMATION_OBLIGATION',
+    PrivacyPolicy: 'PRIVACY_POLICY',
+    Terms: 'TERMS'
+};
+export const PaymentAcknowledgementEnforcement = {
+    GatewayFallback: 'GATEWAY_FALLBACK',
+    StorefrontRequired: 'STOREFRONT_REQUIRED'
+};
 export const PaymentInitiationFlow = {
     InstantDirect: 'INSTANT_DIRECT',
     OfflineManual: 'OFFLINE_MANUAL',

package/dist/react/server/get-storefront-client.d.ts

@@ -41,12 +41,22 @@ export interface ServerClientOptions extends Omit<StorefrontClientConfig, 'middl
      */
     middleware?: Middleware[];
     /**
-     * OPTIONAL override for the buyer-IP source. Forwarded-IP signing is
-     * auto-configured: by default the SDK reads the request's `cf-connecting-ip`
-     * via `next/headers` (a server-rendered storefront would otherwise collapse
-     * every buyer onto its own server IP for rate limiting). Provide this only for
-     * non-Next server runtimes where `next/headers` is unavailable. May be async.
+     * Buyer-IP source that ENABLES forwarded-IP signing (opt-in). The forwarded-IP
+     * middleware is wired ONLY when this is provided — without it the client never
+     * reads the buyer IP and never signs (a fully static-safe, inert pass-through).
+     *
+     * Reading the buyer IP needs a request-scoped dynamic API (e.g. `next/headers`
+     * `headers()`), which is ILLEGAL in statically-generated / ISR routes — calling it
+     * there crashes the page ("static to dynamic at runtime"). So provide this ONLY on
+     * routes that are already dynamic (per-request rendered). A server-rendered
+     * storefront otherwise collapses every buyer onto its own server IP for rate
+     * limiting; forwarding the real IP restores per-buyer limits. May be async.
      * Server-side only.
+     *
+     * @example
+     * // ONLY on a dynamic route — `headers()` forces dynamic rendering:
+     * import { headers } from 'next/headers';
+     * getStorefrontClient({ apiUrl, shopSlug, getBuyerIp: async () => (await headers()).get('cf-connecting-ip') });
      */
     getBuyerIp?: () => string | null | undefined | Promise<string | null | undefined>;
     /**

package/dist/react/server/get-storefront-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-storefront-client.d.ts","sourceRoot":"","sources":["../../../src/react/server/get-storefront-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAOH,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAEpG,MAAM,WAAW,mBAAoB,SAAQ,IAAI,CAAC,sBAAsB,EAAE,YAAY,CAAC;IACrF;;;;;;;;;;;;;;;;;OAiBG;IACH,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC;IAE1B;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAElF;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;CAC7F;AAqBD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,mBAAmB,GAAG,gBAAgB,CA4BlF"}
+{"version":3,"file":"get-storefront-client.d.ts","sourceRoot":"","sources":["../../../src/react/server/get-storefront-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAOH,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAEpG,MAAM,WAAW,mBAAoB,SAAQ,IAAI,CAAC,sBAAsB,EAAE,YAAY,CAAC;IACrF;;;;;;;;;;;;;;;;;OAiBG;IACH,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC;IAE1B;;;;;;;;;;;;;;;;;OAiBG;IACH,UAAU,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAElF;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;CAC7F;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,mBAAmB,GAAG,gBAAgB,CAkClF"}

package/dist/react/server/get-storefront-client.js

@@ -24,25 +24,6 @@ import { retryMiddleware } from '../../core/middleware/retry';
 import { timeoutMiddleware } from '../../core/middleware/timeout';
 import { errorMiddleware } from '../../core/middleware/errors';
 import { forwardedIpMiddleware } from '../../core/middleware/forwarded-ip';
-/**
- * Default buyer-IP source: the request's `cf-connecting-ip` header, read via
- * `next/headers` (the same dynamic-import pattern used to read request cookies — a
- * graceful no-op outside a Next request scope or in runtimes without
- * `next/headers`). Override via `getBuyerIp` for other server frameworks.
- */
-async function readCfConnectingIp() {
-    try {
-        const { headers } = await import('next/headers');
-        const store = await headers();
-        // Prefer a forwarded client-IP header when present: if the request was
-        // proxied, the direct `cf-connecting-ip` is the proxy's address while this
-        // header carries the original client IP. Fall back to the direct connection IP.
-        return store.get('x-doswiftly-client-ip') ?? store.get('cf-connecting-ip');
-    }
-    catch {
-        return null;
-    }
-}
 /**
  * Create a StorefrontClient for server-side use.
  *
@@ -52,23 +33,29 @@ async function readCfConnectingIp() {
  */
 export function getStorefrontClient(options) {
     const { middleware: customMiddleware = [], getBuyerIp, getForwardedIpSecret, ...config } = options;
-    // Forward the real buyer IP for per-buyer rate limiting — fully self-configured,
-    // nothing for the storefront to wire. Buyer IP defaults to the request's
-    // `cf-connecting-ip` (via next/headers); the signing secret defaults to
-    // `process.env.DOSWIFTLY_FORWARDED_IP_SECRET` (set in the DoSwiftly deployment
-    // environment). The slug comes from the `X-Shop-Slug` header the client already
-    // sends, so the
-    // signed value matches what the backend verifies. The middleware signs ONLY when
-    // BOTH a buyer IP and a secret resolve at request time — so with no secret
-    // configured (or outside a Next request) it is an inert pass-through. Both
-    // getters can be overridden for non-Next runtimes.
-    const resolveBuyerIp = getBuyerIp ?? readCfConnectingIp;
-    const resolveSecret = getForwardedIpSecret ??
-        (() => (typeof process !== 'undefined' ? process.env?.DOSWIFTLY_FORWARDED_IP_SECRET : undefined));
+    // Forwarded-IP signing is OPT-IN: the middleware is wired ONLY when the caller
+    // supplies `getBuyerIp`. Reading the buyer IP needs a request-scoped dynamic API
+    // (`next/headers` `headers()`), which is illegal in statically-generated / ISR
+    // routes — auto-reading it there crashes the page ("static to dynamic at runtime").
+    // So the caller provides the IP source and uses it ONLY on dynamic routes; without
+    // `getBuyerIp` this client is a fully static-safe pass-through. The slug comes from
+    // the `X-Shop-Slug` header the client already sends, so the signed value matches
+    // what the backend verifies. The secret defaults to
+    // `process.env.DOSWIFTLY_FORWARDED_IP_SECRET` (override via `getForwardedIpSecret`);
+    // signing happens only when BOTH a buyer IP and a secret resolve at request time.
+    const forwardedIp = getBuyerIp
+        ? [
+            forwardedIpMiddleware({
+                getBuyerIp,
+                getSecret: getForwardedIpSecret ??
+                    (() => (typeof process !== 'undefined' ? process.env?.DOSWIFTLY_FORWARDED_IP_SECRET : undefined)),
+            }),
+        ]
+        : [];
     return createStorefrontClient({
         ...config,
         middleware: [
-            forwardedIpMiddleware({ getBuyerIp: resolveBuyerIp, getSecret: resolveSecret }),
+            ...forwardedIp,
             ...customMiddleware,
             retryMiddleware({ maxRetries: 2 }),
             timeoutMiddleware({ timeout: 10000 }), // Server-side: 10s timeout

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@doswiftly/storefront-sdk",
-  "version": "22.1.0",
+  "version": "22.3.0",
   "description": "Storefront runtime SDK for DoSwiftly Commerce — layered transport, middleware pipeline, React providers, Zustand stores, cache strategies. 0 runtime dependencies in core.",
   "type": "module",
   "sideEffects": false,