@endora-commerce/mod-comparisons 0.0.0-stage → 0.100.0

package/dist/backend/routes.public.js

@@ -0,0 +1,215 @@
+import { ERROR_CODES, comparisonAddProductInputSchema, comparisonSetDisplayModeInputSchema, } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+import { productAudienceOf } from '@endora-commerce/platform/http';
+import { getResolvedChannel } from '@endora-commerce/platform/kernel';
+import { ComparisonFullError, ComparisonNotFoundError, ProductNotFoundError, ProductNotInComparisonError, } from './services/comparison-service.js';
+import { COMPARE_TOKEN_COOKIE, readAnonymousToken, writeAnonymousToken, } from './services/anonymous-token-cookie.js';
+import { customerActor } from './request-actor.js';
+export async function registerComparisonsPublicRoutes(app, deps) {
+    const { comparisonService, tokens, pdfRenderer } = deps;
+    // -----------------------------------------------------------------
+    // GET /me — read
+    // -----------------------------------------------------------------
+    app.get('/api/v1/comparisons/me', async (request, reply) => {
+        const owner = readOwner(request);
+        if (!owner) {
+            reply.code(204);
+            return null;
+        }
+        const comparison = await comparisonService.getForOwner(owner);
+        if (!comparison) {
+            reply.code(204);
+            return null;
+        }
+        const channel = getResolvedChannel(request);
+        reply.header('cache-control', 'no-store');
+        return {
+            data: await comparisonService.buildOwnerView(comparison, channel.id, { kind: 'buyer', audience: productAudienceOf(request) }),
+        };
+    });
+    // -----------------------------------------------------------------
+    // POST /me/products — add (creates on first call)
+    // -----------------------------------------------------------------
+    app.post('/api/v1/comparisons/me/products', async (request, reply) => {
+        const body = parse(comparisonAddProductInputSchema, request.body);
+        const owner = ensureOwner(request, reply, tokens);
+        const channel = getResolvedChannel(request);
+        let comparison;
+        try {
+            comparison = await comparisonService.addProduct(owner, channel.id, body.productId, productAudienceOf(request));
+        }
+        catch (err) {
+            throw translate(err);
+        }
+        reply.header('cache-control', 'no-store');
+        return {
+            data: await comparisonService.buildOwnerView(comparison, channel.id, { kind: 'buyer', audience: productAudienceOf(request) }),
+        };
+    });
+    // -----------------------------------------------------------------
+    // DELETE /me/products/:productId — remove
+    // -----------------------------------------------------------------
+    app.delete('/api/v1/comparisons/me/products/:productId', async (request, reply) => {
+        const owner = readOwner(request);
+        if (!owner)
+            throw notFoundComparison();
+        let comparison;
+        try {
+            comparison = await comparisonService.removeProduct(owner, request.params.productId);
+        }
+        catch (err) {
+            throw translate(err);
+        }
+        const channel = getResolvedChannel(request);
+        reply.header('cache-control', 'no-store');
+        return {
+            data: await comparisonService.buildOwnerView(comparison, channel.id, { kind: 'buyer', audience: productAudienceOf(request) }),
+        };
+    });
+    // -----------------------------------------------------------------
+    // PATCH /me — set display mode
+    // -----------------------------------------------------------------
+    app.patch('/api/v1/comparisons/me', async (request, reply) => {
+        const body = parse(comparisonSetDisplayModeInputSchema, request.body);
+        const owner = readOwner(request);
+        if (!owner)
+            throw notFoundComparison();
+        let comparison;
+        try {
+            comparison = await comparisonService.setDisplayMode(owner, body.displayMode);
+        }
+        catch (err) {
+            throw translate(err);
+        }
+        const channel = getResolvedChannel(request);
+        reply.header('cache-control', 'no-store');
+        return {
+            data: await comparisonService.buildOwnerView(comparison, channel.id, { kind: 'buyer', audience: productAudienceOf(request) }),
+        };
+    });
+    // -----------------------------------------------------------------
+    // GET /me/pdf — owner-only export (US4)
+    // -----------------------------------------------------------------
+    if (pdfRenderer) {
+        app.get('/api/v1/comparisons/me/pdf', { config: { streamingResponse: true } }, async (request, reply) => {
+            const owner = readOwner(request);
+            if (!owner)
+                throw notFoundComparison();
+            const comparison = await comparisonService.getForOwner(owner);
+            if (!comparison)
+                throw notFoundComparison();
+            const channel = getResolvedChannel(request);
+            const view = await comparisonService.buildOwnerView(comparison, channel.id, { kind: 'buyer', audience: productAudienceOf(request) });
+            if (view.products.length === 0) {
+                throw new HttpError(409, ERROR_CODES.COMPARISON_EMPTY, 'Cannot export an empty comparison.');
+            }
+            let bytes;
+            try {
+                bytes = await pdfRenderer.render(view);
+            }
+            catch {
+                throw new HttpError(503, ERROR_CODES.PDF_GENERATION_FAILED, 'PDF generation failed.');
+            }
+            const shortToken = comparison.shareToken.slice(0, 8);
+            reply.header('content-type', 'application/pdf');
+            reply.header('content-disposition', `attachment; filename="comparison-${shortToken}.pdf"`);
+            reply.header('cache-control', 'no-store');
+            return reply.send(bytes);
+        });
+    }
+    // -----------------------------------------------------------------
+    // DELETE /me — hard-delete
+    // -----------------------------------------------------------------
+    app.delete('/api/v1/comparisons/me', async (request, reply) => {
+        const owner = readOwner(request);
+        if (!owner)
+            throw notFoundComparison();
+        try {
+            await comparisonService.deleteForOwner(owner);
+        }
+        catch (err) {
+            throw translate(err);
+        }
+        reply.code(204);
+        reply.header('cache-control', 'no-store');
+        return null;
+    });
+}
+// ---------------------------------------------------------------------------
+// Owner resolution
+// ---------------------------------------------------------------------------
+/**
+ * Read the caller's owner identity for a *read* path. Returns null when
+ * the caller is anonymous and has no `compare_token` cookie. Read paths
+ * never mint a fresh cookie — only writes do.
+ */
+function readOwner(request) {
+    const customer = customerActor(request);
+    if (customer !== null) {
+        return {
+            kind: 'customer',
+            customerAccountId: customer.customerAccountId,
+        };
+    }
+    const token = readAnonymousToken(request);
+    if (token)
+        return { kind: 'anonymous', anonymousToken: token };
+    return null;
+}
+/**
+ * Same as readOwner, but for *write* paths: when no identity is present,
+ * mint a fresh anonymous token and set the `compare_token` cookie on the
+ * response. Returns the owner for the just-minted identity so the
+ * service can attach it to the new Comparison row.
+ */
+function ensureOwner(request, reply, tokens) {
+    const existing = readOwner(request);
+    if (existing)
+        return existing;
+    const token = tokens.generate();
+    writeAnonymousToken(reply, token);
+    return { kind: 'anonymous', anonymousToken: token };
+}
+// ---------------------------------------------------------------------------
+// Error envelope translation
+// ---------------------------------------------------------------------------
+function translate(err) {
+    if (err instanceof HttpError)
+        return err;
+    if (err instanceof ComparisonFullError) {
+        return new HttpError(409, ERROR_CODES.COMPARISON_FULL, err.message);
+    }
+    if (err instanceof ComparisonNotFoundError) {
+        return notFoundComparison();
+    }
+    if (err instanceof ProductNotFoundError) {
+        return new HttpError(404, ERROR_CODES.PRODUCT_NOT_FOUND, err.message);
+    }
+    if (err instanceof ProductNotInComparisonError) {
+        return new HttpError(404, ERROR_CODES.PRODUCT_NOT_IN_COMPARISON, err.message);
+    }
+    if (err instanceof Error) {
+        return new HttpError(500, ERROR_CODES.INTERNAL, err.message);
+    }
+    return new HttpError(500, ERROR_CODES.INTERNAL, 'Unexpected error.');
+}
+function notFoundComparison() {
+    return new HttpError(404, ERROR_CODES.COMPARISON_NOT_FOUND, 'Comparison not found.');
+}
+// ---------------------------------------------------------------------------
+// Tiny zod-parse helper that turns Zod errors into 422 with the project's
+// error envelope.
+// ---------------------------------------------------------------------------
+function parse(schema, input) {
+    const parsed = schema.safeParse(input);
+    if (!parsed.success) {
+        throw new HttpError(422, ERROR_CODES.VALIDATION_FAILED, 'Validation failed.', parsed.error.issues.map((i) => ({
+            path: i.path.map(String).join('.'),
+            issue: i.message,
+        })));
+    }
+    return parsed.data;
+}
+// Re-export the cookie name so test-server / docs can reference it.
+export { COMPARE_TOKEN_COOKIE };
+//# sourceMappingURL=routes.public.js.map

package/dist/backend/routes.public.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.public.js","sourceRoot":"","sources":["../../src/backend/routes.public.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,WAAW,EACX,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,2BAA2B,GAG5B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AA6BnD,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,GAAoB,EACpB,IAA2B;IAE3B,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IAExD,oEAAoE;IACpE,iBAAiB;IACjB,oEAAoE;IAEpE,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACzD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC5C,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC1C,OAAO;YACL,IAAI,EAAE,MAAM,iBAAiB,CAAC,cAAc,CAC1C,UAAU,EACV,OAAO,CAAC,EAAE,EACV,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,CACxD;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,kDAAkD;IAClD,oEAAoE;IAEpE,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnE,MAAM,IAAI,GAAG,KAAK,CAAC,+BAA+B,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,UAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,iBAAiB,CAAC,UAAU,CAC7C,KAAK,EACL,OAAO,CAAC,EAAE,EACV,IAAI,CAAC,SAAS,EACd,iBAAiB,CAAC,OAAO,CAAC,CAC3B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC1C,OAAO;YACL,IAAI,EAAE,MAAM,iBAAiB,CAAC,cAAc,CAC1C,UAAU,EACV,OAAO,CAAC,EAAE,EACV,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,CACxD;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,0CAA0C;IAC1C,oEAAoE;IAEpE,GAAG,CAAC,MAAM,CACR,4CAA4C,EAC5C,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK;YAAE,MAAM,kBAAkB,EAAE,CAAC;QACvC,IAAI,UAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,iBAAiB,CAAC,aAAa,CAChD,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,SAAS,CACzB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC5C,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC1C,OAAO;YACL,IAAI,EAAE,MAAM,iBAAiB,CAAC,cAAc,CAC1C,UAAU,EACV,OAAO,CAAC,EAAE,EACV,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,CACxD;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,oEAAoE;IACpE,+BAA+B;IAC/B,oEAAoE;IAEpE,GAAG,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,mCAAmC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK;YAAE,MAAM,kBAAkB,EAAE,CAAC;QACvC,IAAI,UAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,iBAAiB,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC5C,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC1C,OAAO;YACL,IAAI,EAAE,MAAM,iBAAiB,CAAC,cAAc,CAC1C,UAAU,EACV,OAAO,CAAC,EAAE,EACV,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,CACxD;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,wCAAwC;IACxC,oEAAoE;IAEpE,IAAI,WAAW,EAAE,CAAC;QAChB,GAAG,CAAC,GAAG,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACtG,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,CAAC,KAAK;gBAAE,MAAM,kBAAkB,EAAE,CAAC;YACvC,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC9D,IAAI,CAAC,UAAU;gBAAE,MAAM,kBAAkB,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,cAAc,CACjD,UAAU,EACV,OAAO,CAAC,EAAE,EACV,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,CACxD,CAAC;YACF,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,gBAAgB,EAC5B,oCAAoC,CACrC,CAAC;YACJ,CAAC;YACD,IAAI,KAAa,CAAC;YAClB,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACzC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,qBAAqB,EACjC,wBAAwB,CACzB,CAAC;YACJ,CAAC;YACD,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACrD,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;YAChD,KAAK,CAAC,MAAM,CACV,qBAAqB,EACrB,oCAAoC,UAAU,OAAO,CACtD,CAAC;YACF,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAC1C,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,2BAA2B;IAC3B,oEAAoE;IAEpE,GAAG,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC5D,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK;YAAE,MAAM,kBAAkB,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,iBAAiB,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,SAAS,CAAC,OAAuB;IACxC,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;SAC9C,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IAC/D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAClB,OAAuB,EACvB,KAAmB,EACnB,MAA2B;IAE3B,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAChC,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAClC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AACtD,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,GAAG,YAAY,SAAS;QAAE,OAAO,GAAG,CAAC;IACzC,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;QACvC,OAAO,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;QAC3C,OAAO,kBAAkB,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;QACxC,OAAO,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,GAAG,YAAY,2BAA2B,EAAE,CAAC;QAC/C,OAAO,IAAI,SAAS,CAClB,GAAG,EACH,WAAW,CAAC,yBAAyB,EACrC,GAAG,CAAC,OAAO,CACZ,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACzB,OAAO,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,IAAI,SAAS,CAClB,GAAG,EACH,WAAW,CAAC,oBAAoB,EAChC,uBAAuB,CACxB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,kBAAkB;AAClB,8EAA8E;AAE9E,SAAS,KAAK,CAAI,MAAoB,EAAE,KAAc;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,iBAAiB,EAC7B,oBAAoB,EACpB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAClC,KAAK,EAAE,CAAC,CAAC,OAAO;SACjB,CAAC,CAAC,CACJ,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,oEAAoE;AACpE,OAAO,EAAE,oBAAoB,EAAE,CAAC"}

package/dist/backend/routes.share.d.ts

@@ -0,0 +1,27 @@
+import type { FastifyInstance } from 'fastify';
+import type { ComparisonService } from './services/comparison-service.js';
+/**
+ * Public share-token endpoint — feature 007 / US2 / T040.
+ *
+ *   GET /api/v1/comparisons/share/:token
+ *
+ * Resolves the share token in O(1) via the UNIQUE index, projects the
+ * comparison through the **recipient's** sales-channel context (so
+ * prices and availability reflect the recipient's channel, not the
+ * creator's — per data-model.md §3.2), and returns a typed response
+ * with `meta.viewerIsOwner` so the storefront knows whether to render
+ * owner-only affordances. No mutation surface; no auth.
+ *
+ * The recipient's **identity** decides the prices for the same reason their
+ * channel does, and one step further: a signed-in recipient from another
+ * organisation is quoted their own negotiated figures, an anonymous one the
+ * channel's. The token names the products; it never carries the sender's
+ * pricing identity, so a link cannot disclose what the sender pays. The view
+ * says which of the two it is in `data.pricedFor`, because a reader who cannot
+ * tell whose prices these are cannot act on either.
+ */
+export interface ComparisonsShareDeps {
+    comparisonService: ComparisonService;
+}
+export declare function registerComparisonsShareRoutes(app: FastifyInstance, deps: ComparisonsShareDeps): Promise<void>;
+//# sourceMappingURL=routes.share.d.ts.map

package/dist/backend/routes.share.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.share.d.ts","sourceRoot":"","sources":["../../src/backend/routes.share.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,SAAS,CAAC;AAK/D,OAAO,KAAK,EAAmB,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAI3F;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,oBAAoB;IACnC,iBAAiB,EAAE,iBAAiB,CAAC;CACtC;AAED,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,IAAI,CAAC,CAgCf"}

package/dist/backend/routes.share.js

@@ -0,0 +1,49 @@
+import { ERROR_CODES } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+import { productAudienceOf } from '@endora-commerce/platform/http';
+import { getResolvedChannel } from '@endora-commerce/platform/kernel';
+import { readAnonymousToken } from './services/anonymous-token-cookie.js';
+import { customerActor } from './request-actor.js';
+export async function registerComparisonsShareRoutes(app, deps) {
+    const { comparisonService } = deps;
+    app.get('/api/v1/comparisons/share/:token', async (request, reply) => {
+        const token = request.params.token;
+        if (!token || token.length < 8 || token.length > 32) {
+            throw notFound();
+        }
+        const comparison = await comparisonService.findByShareToken(token);
+        if (!comparison)
+            throw notFound();
+        const channel = getResolvedChannel(request);
+        const view = await comparisonService.buildOwnerView(comparison, channel.id, { kind: 'buyer', audience: productAudienceOf(request) });
+        const viewerIsOwner = comparisonService.isOwnedBy(comparison, viewerIdentity(request));
+        reply.header('cache-control', 'no-store');
+        // Strip `maxProducts` from the wire shape — the cap is irrelevant
+        // to the recipient (they cannot mutate the comparison).
+        const { maxProducts: _stripped, ...sharedView } = view;
+        return {
+            data: sharedView,
+            meta: { viewerIsOwner },
+        };
+    });
+}
+function notFound() {
+    return new HttpError(404, ERROR_CODES.COMPARISON_NOT_FOUND, 'Comparison not found.');
+}
+/**
+ * Best-effort owner detection on a no-auth endpoint. Returns the owner
+ * identity if one of the two paths resolves (authenticated customer or
+ * `compare_token` cookie); otherwise null.
+ */
+function viewerIdentity(request) {
+    const customer = customerActor(request);
+    if (customer !== null) {
+        return {
+            kind: 'customer',
+            customerAccountId: customer.customerAccountId,
+        };
+    }
+    const token = readAnonymousToken(request);
+    return token ? { kind: 'anonymous', anonymousToken: token } : null;
+}
+//# sourceMappingURL=routes.share.js.map

package/dist/backend/routes.share.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.share.js","sourceRoot":"","sources":["../../src/backend/routes.share.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAEtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AA2BnD,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,GAAoB,EACpB,IAA0B;IAE1B,MAAM,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;IAEnC,GAAG,CAAC,GAAG,CACL,kCAAkC,EAClC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QACnC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACpD,MAAM,QAAQ,EAAE,CAAC;QACnB,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,CAAC,UAAU;YAAE,MAAM,QAAQ,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,cAAc,CACjD,UAAU,EACV,OAAO,CAAC,EAAE,EACV,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,CACxD,CAAC;QACF,MAAM,aAAa,GAAG,iBAAiB,CAAC,SAAS,CAC/C,UAAU,EACV,cAAc,CAAC,OAAO,CAAC,CACxB,CAAC;QACF,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC1C,kEAAkE;QAClE,wDAAwD;QACxD,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,CAAC;QACvD,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,EAAE,aAAa,EAAE;SACxB,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,IAAI,SAAS,CAClB,GAAG,EACH,WAAW,CAAC,oBAAoB,EAChC,uBAAuB,CACxB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,OAAuB;IAC7C,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;SAC9C,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrE,CAAC"}

package/dist/backend/services/anonymous-token-cookie.d.ts

@@ -0,0 +1,23 @@
+import type { FastifyReply, FastifyRequest } from 'fastify';
+/**
+ * Cookie helpers for the comparisons module's anonymous owner identity
+ * (research.md R-2). The cookie holds a 22-char base64url token that
+ * doubles as the row's `comparisons.anonymous_token` column. It is *not*
+ * the share token — leaking the cookie should not leak shareable URLs.
+ *
+ * Flags:
+ *   - `HttpOnly`           → JavaScript on the storefront cannot read the
+ *                            token, mitigating XSS exfiltration.
+ *   - `SameSite=Lax`       → cookie is sent on top-level navigation but
+ *                            not on cross-site POSTs, mitigating CSRF.
+ *   - `Path=/`             → applies platform-wide so server-rendered
+ *                            pages and the API see the same cookie.
+ *   - `Max-Age = 1 year`   → long-lived; spec FR-005 ties anonymous
+ *                            ownership to "their browser session" but in
+ *                            practice the cookie is what carries that
+ *                            identity across visits.
+ */
+export declare const COMPARE_TOKEN_COOKIE = "compare_token";
+export declare function readAnonymousToken(request: FastifyRequest): string | null;
+export declare function writeAnonymousToken(reply: FastifyReply, token: string): void;
+//# sourceMappingURL=anonymous-token-cookie.d.ts.map

package/dist/backend/services/anonymous-token-cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anonymous-token-cookie.d.ts","sourceRoot":"","sources":["../../../src/backend/services/anonymous-token-cookie.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE5D;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,oBAAoB,kBAAkB,CAAC;AAIpD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAGzE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAO5E"}

package/dist/backend/services/anonymous-token-cookie.js

@@ -0,0 +1,33 @@
+/**
+ * Cookie helpers for the comparisons module's anonymous owner identity
+ * (research.md R-2). The cookie holds a 22-char base64url token that
+ * doubles as the row's `comparisons.anonymous_token` column. It is *not*
+ * the share token — leaking the cookie should not leak shareable URLs.
+ *
+ * Flags:
+ *   - `HttpOnly`           → JavaScript on the storefront cannot read the
+ *                            token, mitigating XSS exfiltration.
+ *   - `SameSite=Lax`       → cookie is sent on top-level navigation but
+ *                            not on cross-site POSTs, mitigating CSRF.
+ *   - `Path=/`             → applies platform-wide so server-rendered
+ *                            pages and the API see the same cookie.
+ *   - `Max-Age = 1 year`   → long-lived; spec FR-005 ties anonymous
+ *                            ownership to "their browser session" but in
+ *                            practice the cookie is what carries that
+ *                            identity across visits.
+ */
+export const COMPARE_TOKEN_COOKIE = 'compare_token';
+const ONE_YEAR_SECONDS = 60 * 60 * 24 * 365;
+export function readAnonymousToken(request) {
+    const cookies = request.cookies;
+    return cookies?.[COMPARE_TOKEN_COOKIE] ?? null;
+}
+export function writeAnonymousToken(reply, token) {
+    reply.setCookie(COMPARE_TOKEN_COOKIE, token, {
+        path: '/',
+        sameSite: 'lax',
+        httpOnly: true,
+        maxAge: ONE_YEAR_SECONDS,
+    });
+}
+//# sourceMappingURL=anonymous-token-cookie.js.map

package/dist/backend/services/anonymous-token-cookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anonymous-token-cookie.js","sourceRoot":"","sources":["../../../src/backend/services/anonymous-token-cookie.ts"],"names":[],"mappings":"AAWA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,eAAe,CAAC;AAEpD,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC;AAE5C,MAAM,UAAU,kBAAkB,CAAC,OAAuB;IACxD,MAAM,OAAO,GAAI,OAA4D,CAAC,OAAO,CAAC;IACtF,OAAO,OAAO,EAAE,CAAC,oBAAoB,CAAC,IAAI,IAAI,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAmB,EAAE,KAAa;IACpE,KAAK,CAAC,SAAS,CAAC,oBAAoB,EAAE,KAAK,EAAE;QAC3C,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,gBAAgB;KACzB,CAAC,CAAC;AACL,CAAC"}

package/dist/backend/services/asset-byte-fetcher.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Per-request asset-byte fetcher used by the PDF renderer
+ * (research.md R-8 / feature 007 / T054).
+ *
+ * pdfmake accepts inline base64 image data — but the bytes have to come
+ * from somewhere. The renderer asks this fetcher for each base-image
+ * URL it found on the comparison's products. We:
+ *
+ *   - fetch the bytes (HTTP for remote URLs, file-system read for
+ *     `file://` URLs and any path-shaped string the assets module
+ *     emits for local storage),
+ *   - cache the result in a per-request `Map<key, Buffer>` so the same
+ *     image is never fetched twice within one PDF render,
+ *   - fall back to {@link IMAGE_FALLBACK_BYTES} (a 1×1 transparent PNG)
+ *     on any failure — fetch error, non-2xx, network timeout — so the
+ *     PDF still renders rather than 503'ing the whole export
+ *     (spec FR-018).
+ *
+ * Construct one fetcher per request; do not reuse across renders.
+ */
+/** 1×1 transparent PNG. Used when an image is unavailable. */
+export declare const IMAGE_FALLBACK_BYTES: Buffer;
+export declare class AssetByteFetcher {
+    #private;
+    private readonly cache;
+    /** Per-fetch timeout — short; we'd rather fall back than block the PDF response. */
+    private readonly timeoutMs;
+    constructor(opts?: {
+        timeoutMs?: number;
+    });
+    /**
+     * Fetch the bytes at `url`. Returns {@link IMAGE_FALLBACK_BYTES} on any
+     * failure. Cached per-instance.
+     */
+    fetch(url: string): Promise<Buffer>;
+}
+//# sourceMappingURL=asset-byte-fetcher.d.ts.map

package/dist/backend/services/asset-byte-fetcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-byte-fetcher.d.ts","sourceRoot":"","sources":["../../../src/backend/services/asset-byte-fetcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,8DAA8D;AAC9D,eAAO,MAAM,oBAAoB,EAAE,MAIlC,CAAC;AAEF,qBAAa,gBAAgB;;IAC3B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IACnD,oFAAoF;IACpF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,IAAI,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO;IAI7C;;;OAGG;IACG,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CA8B1C"}

package/dist/backend/services/asset-byte-fetcher.js

@@ -0,0 +1,70 @@
+/**
+ * Per-request asset-byte fetcher used by the PDF renderer
+ * (research.md R-8 / feature 007 / T054).
+ *
+ * pdfmake accepts inline base64 image data — but the bytes have to come
+ * from somewhere. The renderer asks this fetcher for each base-image
+ * URL it found on the comparison's products. We:
+ *
+ *   - fetch the bytes (HTTP for remote URLs, file-system read for
+ *     `file://` URLs and any path-shaped string the assets module
+ *     emits for local storage),
+ *   - cache the result in a per-request `Map<key, Buffer>` so the same
+ *     image is never fetched twice within one PDF render,
+ *   - fall back to {@link IMAGE_FALLBACK_BYTES} (a 1×1 transparent PNG)
+ *     on any failure — fetch error, non-2xx, network timeout — so the
+ *     PDF still renders rather than 503'ing the whole export
+ *     (spec FR-018).
+ *
+ * Construct one fetcher per request; do not reuse across renders.
+ */
+import { readFile } from 'node:fs/promises';
+/** 1×1 transparent PNG. Used when an image is unavailable. */
+export const IMAGE_FALLBACK_BYTES = Buffer.from(
+// 67-byte minimal transparent PNG.
+'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNgAAIAAAUAAen63NgAAAAASUVORK5CYII=', 'base64');
+export class AssetByteFetcher {
+    cache = new Map();
+    /** Per-fetch timeout — short; we'd rather fall back than block the PDF response. */
+    timeoutMs;
+    constructor(opts = {}) {
+        this.timeoutMs = opts.timeoutMs ?? 3_000;
+    }
+    /**
+     * Fetch the bytes at `url`. Returns {@link IMAGE_FALLBACK_BYTES} on any
+     * failure. Cached per-instance.
+     */
+    async fetch(url) {
+        const cached = this.cache.get(url);
+        if (cached)
+            return cached;
+        const bytes = await this.#read(url).catch(() => IMAGE_FALLBACK_BYTES);
+        this.cache.set(url, bytes);
+        return bytes;
+    }
+    async #read(url) {
+        if (url.startsWith('file://')) {
+            return readFile(new URL(url));
+        }
+        if (url.startsWith('/') || url.startsWith('./')) {
+            // Bare filesystem path the assets module sometimes emits.
+            return readFile(url);
+        }
+        if (url.startsWith('http://') || url.startsWith('https://')) {
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+            try {
+                const res = await fetch(url, { signal: controller.signal });
+                if (!res.ok)
+                    throw new Error(`HTTP ${res.status}`);
+                const arr = new Uint8Array(await res.arrayBuffer());
+                return Buffer.from(arr);
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        }
+        throw new Error(`unsupported URL scheme: ${url}`);
+    }
+}
+//# sourceMappingURL=asset-byte-fetcher.js.map

package/dist/backend/services/asset-byte-fetcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset-byte-fetcher.js","sourceRoot":"","sources":["../../../src/backend/services/asset-byte-fetcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,8DAA8D;AAC9D,MAAM,CAAC,MAAM,oBAAoB,GAAW,MAAM,CAAC,IAAI;AACrD,mCAAmC;AACnC,8FAA8F,EAC9F,QAAQ,CACT,CAAC;AAEF,MAAM,OAAO,gBAAgB;IACV,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnD,oFAAoF;IACnE,SAAS,CAAS;IAEnC,YAAY,OAA+B,EAAE;QAC3C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CAAC,GAAW;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,CAAC;QACtE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW;QACrB,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,OAAO,QAAQ,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,0DAA0D;YAC1D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACnE,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC5D,IAAI,CAAC,GAAG,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBACnD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;gBACpD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;CACF"}

package/dist/backend/services/comparable-attribute-projection.d.ts

@@ -0,0 +1,57 @@
+import type { AttributeValueType, ComparisonAttributeRow, ComparisonRowClass } from '@endora-commerce/contracts';
+/**
+ * The slice of the catalog's composed `CatalogAttributeView` this projection
+ * needs (feature 061 — comparisons no longer imports catalog entities; the
+ * definitions arrive through the injected `CatalogAttributeReadService`).
+ */
+export interface ComparableAttributeDefinition {
+    key: string;
+    label: Record<string, string>;
+    valueType: AttributeValueType;
+}
+/**
+ * Pure projection from "products + comparable-attribute definitions" to
+ * the body rows of the comparison page (and PDF). Implements research.md
+ * R-6 algorithm.
+ *
+ * Inputs:
+ *   - `products` — the column-ordered list of products in the comparison.
+ *     Each product carries its `attributeValues` JSONB record (catalog
+ *     stores values keyed by attribute key).
+ *   - `attributeDefinitions` — every catalog attribute flagged
+ *     `is_comparable=true`, in display order. Order is preserved in the
+ *     output so the client / PDF both render rows top-to-bottom in the
+ *     same sequence.
+ *
+ * Output: one `ComparisonAttributeRow` per definition, with one entry
+ * per product (in column order) and the row's classification (`common`
+ * vs `different`). Pre-formatted strings ride on the wire so the
+ * storefront table doesn't have to re-format multi-value attributes.
+ *
+ * Equality semantics (R-6):
+ *   - `multiselect`           — set equality (full overlap), order-insensitive.
+ *   - `enum` / `string`       — `===` after `String(v).trim()`.
+ *   - `number` / `price`      — `===` after `Number(v)` (no tolerance).
+ *   - `boolean`               — `===`.
+ *   - `date`                  — `===` after ISO-8601 normalisation (parse → toISOString).
+ *   - missing value on either side — classified as `different`; cell is `null`.
+ *
+ * Pure: no DB, no HTTP, no I/O. Unit-testable in isolation.
+ */
+export declare class ComparableAttributeProjection {
+    projectRows(products: Array<{
+        attributeValues: Record<string, unknown>;
+    }>, attributeDefinitions: ComparableAttributeDefinition[]): ComparisonAttributeRow[];
+}
+/**
+ * Pre-format a raw `attributeValues[key]` for display. Returns null when
+ * the value is missing — the storefront / PDF render `—` for null cells.
+ */
+export declare function formatForDisplay(valueType: AttributeValueType, v: unknown): string | null;
+/**
+ * Returns 'common' iff every product carries an equivalent value for the
+ * attribute (per R-6 equality semantics) AND no product is missing. Any
+ * other case is 'different'.
+ */
+export declare function classifyRow(valueType: AttributeValueType, rawValues: unknown[]): ComparisonRowClass;
+//# sourceMappingURL=comparable-attribute-projection.d.ts.map

package/dist/backend/services/comparable-attribute-projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"comparable-attribute-projection.d.ts","sourceRoot":"","sources":["../../../src/backend/services/comparable-attribute-projection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,sBAAsB,EACtB,kBAAkB,EACnB,MAAM,4BAA4B,CAAC;AAEpC;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,SAAS,EAAE,kBAAkB,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,qBAAa,6BAA6B;IACxC,WAAW,CACT,QAAQ,EAAE,KAAK,CAAC;QAAE,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,EAC7D,oBAAoB,EAAE,6BAA6B,EAAE,GACpD,sBAAsB,EAAE;CAgB5B;AAcD;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,kBAAkB,EAC7B,CAAC,EAAE,OAAO,GACT,MAAM,GAAG,IAAI,CAoBf;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAAE,kBAAkB,EAC7B,SAAS,EAAE,OAAO,EAAE,GACnB,kBAAkB,CAYpB"}