@ikas/component-cli 1.4.0-beta.20 → 1.4.0-beta.201

package/dist/utils/find-component-for-file.d.ts

@@ -0,0 +1,12 @@
+import type { ComponentDefinition } from "../types.js";
+/**
+ * Get the component definition that contains a file path.
+ *
+ * Accepts relative or absolute paths: chokidar emits paths relative to cwd for the dev
+ * server's relative watch patterns, so the incoming path is resolved here (normalize alone
+ * would leave it relative and it could never match the absolute entry/styles/dir paths below).
+ */
+export declare function findComponentForFile(config: {
+    components: ComponentDefinition[];
+}, filePath: string): ComponentDefinition | null;
+//# sourceMappingURL=find-component-for-file.d.ts.map

package/dist/utils/find-component-for-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-component-for-file.d.ts","sourceRoot":"","sources":["../../src/utils/find-component-for-file.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE;IAAE,UAAU,EAAE,mBAAmB,EAAE,CAAA;CAAE,EAC7C,QAAQ,EAAE,MAAM,GACf,mBAAmB,GAAG,IAAI,CAmB5B"}

package/dist/utils/find-component-for-file.js

@@ -0,0 +1,24 @@
+import * as path from "path";
+/**
+ * Get the component definition that contains a file path.
+ *
+ * Accepts relative or absolute paths: chokidar emits paths relative to cwd for the dev
+ * server's relative watch patterns, so the incoming path is resolved here (normalize alone
+ * would leave it relative and it could never match the absolute entry/styles/dir paths below).
+ */
+export function findComponentForFile(config, filePath) {
+    const normalizedPath = path.resolve(filePath);
+    for (const component of config.components) {
+        const entryPath = path.resolve(process.cwd(), component.entry);
+        const stylesPath = path.resolve(process.cwd(), component.styles);
+        const componentDir = path.dirname(entryPath);
+        // Check if the file is the entry, styles, or in the component directory
+        if (normalizedPath === entryPath ||
+            normalizedPath === stylesPath ||
+            normalizedPath.startsWith(componentDir + path.sep)) {
+            return component;
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=find-component-for-file.js.map

package/dist/utils/find-component-for-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-component-for-file.js","sourceRoot":"","sources":["../../src/utils/find-component-for-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAG7B;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAA6C,EAC7C,QAAgB;IAEhB,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE9C,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAE7C,wEAAwE;QACxE,IACE,cAAc,KAAK,SAAS;YAC5B,cAAc,KAAK,UAAU;YAC7B,cAAc,CAAC,UAAU,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,EAClD,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/utils/forbid-deep-imports.d.ts

@@ -0,0 +1,3 @@
+import type { Plugin } from "esbuild";
+export declare function forbidDeepStorefrontImportsPlugin(): Plugin;
+//# sourceMappingURL=forbid-deep-imports.d.ts.map

package/dist/utils/forbid-deep-imports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forbid-deep-imports.d.ts","sourceRoot":"","sources":["../../src/utils/forbid-deep-imports.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AA2BtC,wBAAgB,iCAAiC,IAAI,MAAM,CA6B1D"}

package/dist/utils/forbid-deep-imports.js

@@ -0,0 +1,54 @@
+/**
+ * Fail the build on deep imports into the storefront packages.
+ *
+ * `@ikas/bp-storefront` (and its `-models` / `-config` / `-api` siblings) are marked
+ * EXTERNAL during compilation, so esbuild does NOT resolve their subpaths — a hand-written
+ * deep import like `@ikas/bp-storefront/dist/functions/api/cart` would otherwise sail through
+ * the bundle untouched and only break later (the published storefront exposes the package as
+ * window globals keyed off the ROOT export names; a `/dist/...` or `/src/...` subpath has no
+ * corresponding global, so the component throws at runtime in the canvas/published theme).
+ *
+ * The public contract is: import ONLY from the bare package root. Anything after the package
+ * name is a private path. This plugin turns that contract into a hard compile error with a
+ * message pointing at the correct root import, instead of letting the component build "succeed"
+ * and fail in the browser. Models often reach for these subpaths when they can't find a public
+ * helper (e.g. coupon code) — the error nudges them back to the documented root exports.
+ */
+// Matches `@ikas/bp-storefront` (and its -models / -config / -api siblings) with an OPTIONAL
+// subpath. Group 1 = package root, group 2 = the subpath (including its leading "/"), if any.
+//
+// NOTE: these packages MUST NOT also sit in esbuild's `external: [...]` array. esbuild applies
+// the external array BEFORE running plugin onResolve callbacks, so an external-listed deep
+// import is short-circuited and the plugin never sees it. We therefore externalize the valid
+// ROOT import from inside this plugin instead, which lets the same callback reject subpaths.
+const STOREFRONT_PKG = /^(@ikas\/bp-storefront(?:-(?:models|config|api))?)(\/.*)?$/;
+export function forbidDeepStorefrontImportsPlugin() {
+    return {
+        name: "ikas-forbid-deep-storefront-imports",
+        setup(build) {
+            build.onResolve({ filter: STOREFRONT_PKG }, (args) => {
+                const [, root, subpath] = args.path.match(STOREFRONT_PKG);
+                // Bare root import (or a lone trailing slash) — the allowed form. Externalize it, the
+                // same way the old `external: [...]` entry did, so the published storefront's window
+                // globals satisfy it.
+                if (!subpath || subpath === "/") {
+                    return { path: root, external: true };
+                }
+                return {
+                    errors: [
+                        {
+                            text: `Deep import "${args.path}" is not allowed. Import only from the package root ` +
+                                `"${root}" — e.g. import { saveCouponCode, getCart } from "${root}". ` +
+                                `Subpaths like "/dist/..." or "/src/..." are private: they bundle fine but have ` +
+                                `no window global in the published storefront, so the component breaks at runtime. ` +
+                                `If a helper seems missing from the root, it almost always has a public name there ` +
+                                `(coupon code, for instance, is getCouponCodeForm / setCouponCodeFormCouponCode / ` +
+                                `submitCouponCodeForm).`,
+                        },
+                    ],
+                };
+            });
+        },
+    };
+}
+//# sourceMappingURL=forbid-deep-imports.js.map

package/dist/utils/forbid-deep-imports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forbid-deep-imports.js","sourceRoot":"","sources":["../../src/utils/forbid-deep-imports.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AACH,6FAA6F;AAC7F,8FAA8F;AAC9F,EAAE;AACF,+FAA+F;AAC/F,2FAA2F;AAC3F,6FAA6F;AAC7F,6FAA6F;AAC7F,MAAM,cAAc,GAAG,4DAA4D,CAAC;AAEpF,MAAM,UAAU,iCAAiC;IAC/C,OAAO;QACL,IAAI,EAAE,qCAAqC;QAC3C,KAAK,CAAC,KAAK;YACT,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;gBACnD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAE,CAAC;gBAC3D,sFAAsF;gBACtF,qFAAqF;gBACrF,sBAAsB;gBACtB,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;oBAChC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBACxC,CAAC;gBACD,OAAO;oBACL,MAAM,EAAE;wBACN;4BACE,IAAI,EACF,gBAAgB,IAAI,CAAC,IAAI,sDAAsD;gCAC/E,IAAI,IAAI,qDAAqD,IAAI,KAAK;gCACtE,iFAAiF;gCACjF,oFAAoF;gCACpF,oFAAoF;gCACpF,mFAAmF;gCACnF,wBAAwB;yBAC3B;qBACF;iBACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/utils/forbid-external-packages.d.ts

@@ -0,0 +1,26 @@
+import type { Plugin } from "esbuild";
+/**
+ * Fail the build when a code component imports an npm package that is not on the allowlist.
+ *
+ * Themes are untrusted source. Only the reference-theme baseline packages plus `three` and
+ * `animejs` may be bundled into a component. Anything else (lodash, axios, a random UI kit, ...)
+ * becomes a hard compile error instead of a silently-bundled dependency — so installing an extra
+ * package and importing it blows the build up immediately with an actionable message.
+ *
+ * NOTE: esbuild applies the `external: [...]` array BEFORE plugin onResolve, so the externalized
+ * runtime packages (preact, preact/hooks, mobx, preact-render-to-string) are short-circuited and
+ * never reach this plugin — they are allowed implicitly. Non-external subpaths (e.g.
+ * `preact/compat`) DO reach here and resolve to an allowed root.
+ */
+export declare function forbidExternalPackagesPlugin(options?: {
+    /**
+     * Importers whose bare imports bypass the allowlist entirely.
+     *
+     * Set only when a package is vendored into the artifact (see `vendorStorefrontPlugin`). The
+     * allowlist governs what a component *author* may reach for; once we choose to bundle the
+     * storefront SDK, its own dependencies (`lodash`, `uuid`, ...) come along as a consequence of
+     * that choice, and rejecting them would just be the build arguing with itself.
+     */
+    allowFrom?: (importer: string) => boolean;
+}): Plugin;
+//# sourceMappingURL=forbid-external-packages.d.ts.map

package/dist/utils/forbid-external-packages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forbid-external-packages.d.ts","sourceRoot":"","sources":["../../src/utils/forbid-external-packages.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAqDtC;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,CAAC,EAAE;IACrD;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;CAC3C,GAAG,MAAM,CAoCT"}

package/dist/utils/forbid-external-packages.js

@@ -0,0 +1,99 @@
+import path from "path";
+import { builtinModules } from "module";
+/**
+ * Allowlist of npm packages a theme's code components are permitted to import.
+ *
+ * Intentionally STATIC — it is NOT derived from the theme's own package.json. The whole point
+ * is to stop themes from pulling in arbitrary third-party packages, so trusting their manifest
+ * would defeat the purpose: a theme could just add the dependency there. Instead we pin the set
+ * here, mirroring apps/reference-theme/package.json's runtime dependencies plus the two
+ * explicitly-permitted libraries.
+ *
+ * The list holds package ROOTS. Subpaths resolve to their root (e.g. `preact/hooks` → `preact`,
+ * `three/examples/jsm/...` → `three`), so every subpath of an allowed package is allowed too.
+ * Deep imports into the storefront SDK are separately restricted by
+ * `forbidDeepStorefrontImportsPlugin` (which runs first).
+ */
+const ALLOWED_PACKAGE_ROOTS = new Set([
+    // Preact runtime (root + any subpath: preact/hooks, preact/compat, preact/jsx-runtime, ...).
+    // The bare `preact` / `preact/hooks` specifiers are externalized (short-circuited before this
+    // plugin runs), but non-external subpaths like `preact/compat` still resolve through here.
+    "preact",
+    // MobX reactivity — pulled in by the injected observer runtime. Externalized in both builds,
+    // so this is a guard in case the externals list ever changes rather than a reachable import.
+    "mobx",
+    // ikas storefront SDK (deep-import rules enforced by forbidDeepStorefrontImportsPlugin)
+    "@ikas/bp-storefront",
+    "@ikas/bp-storefront-models",
+    "@ikas/bp-storefront-config",
+    "@ikas/bp-storefront-api",
+    // Virtual module injected by ikasComponentUtilsPlugin
+    "@ikas/component-utils",
+    // Explicitly permitted third-party libraries for themes
+    "three",
+    "animejs",
+]);
+// Node built-ins (with and without the `node:` prefix). Only an already-allowed package would
+// reach for these, and platform:node externalizes them anyway — never flag them.
+const NODE_BUILTINS = new Set([
+    ...builtinModules,
+    ...builtinModules.map((m) => `node:${m}`),
+]);
+/** Extract the package root from a bare import specifier (handles `@scope/name`). */
+function packageRootOf(specifier) {
+    if (specifier.startsWith("@")) {
+        const parts = specifier.split("/");
+        return parts.slice(0, 2).join("/");
+    }
+    return specifier.split("/")[0];
+}
+/**
+ * Fail the build when a code component imports an npm package that is not on the allowlist.
+ *
+ * Themes are untrusted source. Only the reference-theme baseline packages plus `three` and
+ * `animejs` may be bundled into a component. Anything else (lodash, axios, a random UI kit, ...)
+ * becomes a hard compile error instead of a silently-bundled dependency — so installing an extra
+ * package and importing it blows the build up immediately with an actionable message.
+ *
+ * NOTE: esbuild applies the `external: [...]` array BEFORE plugin onResolve, so the externalized
+ * runtime packages (preact, preact/hooks, mobx, preact-render-to-string) are short-circuited and
+ * never reach this plugin — they are allowed implicitly. Non-external subpaths (e.g.
+ * `preact/compat`) DO reach here and resolve to an allowed root.
+ */
+export function forbidExternalPackagesPlugin(options) {
+    return {
+        name: "ikas-forbid-external-packages",
+        setup(build) {
+            // Bare specifiers only — skip relative ("./", "../") and absolute ("/") imports.
+            build.onResolve({ filter: /^[^./]/ }, (args) => {
+                const specifier = args.path;
+                // Windows absolute paths (C:\..., C:/..., \\server\...) start with neither "." nor "/",
+                // so they slip past the bare-specifier filter above (esbuild's Go regex has no lookahead
+                // to exclude drive letters). Entry points and the injected JSX shim arrive here as
+                // absolute paths on Windows. win32.isAbsolute also accepts POSIX "/" paths, so this one
+                // check is safe on every platform — and bare npm specifiers can never contain ":".
+                if (path.win32.isAbsolute(specifier))
+                    return undefined;
+                if (NODE_BUILTINS.has(specifier))
+                    return undefined;
+                if (options?.allowFrom?.(args.importer))
+                    return undefined;
+                const root = packageRootOf(specifier);
+                if (ALLOWED_PACKAGE_ROOTS.has(root))
+                    return undefined;
+                return {
+                    errors: [
+                        {
+                            text: `Package "${root}" is not allowed in ikas themes. ` +
+                                `Code components may only import the default theme packages plus "three" and "animejs", ` +
+                                `so installing and importing "${specifier}" fails the build by design. ` +
+                                `Remove the dependency (inline the code you need, or switch to an allowed package). ` +
+                                `Allowed packages: ${Array.from(ALLOWED_PACKAGE_ROOTS).sort().join(", ")}.`,
+                        },
+                    ],
+                };
+            });
+        },
+    };
+}
+//# sourceMappingURL=forbid-external-packages.js.map

package/dist/utils/forbid-external-packages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forbid-external-packages.js","sourceRoot":"","sources":["../../src/utils/forbid-external-packages.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AAExC;;;;;;;;;;;;;GAaG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAS;IAC5C,6FAA6F;IAC7F,8FAA8F;IAC9F,2FAA2F;IAC3F,QAAQ;IACR,6FAA6F;IAC7F,6FAA6F;IAC7F,MAAM;IACN,wFAAwF;IACxF,qBAAqB;IACrB,4BAA4B;IAC5B,4BAA4B;IAC5B,yBAAyB;IACzB,sDAAsD;IACtD,uBAAuB;IACvB,wDAAwD;IACxD,OAAO;IACP,SAAS;CACV,CAAC,CAAC;AAEH,8FAA8F;AAC9F,iFAAiF;AACjF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS;IACpC,GAAG,cAAc;IACjB,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;CAC1C,CAAC,CAAC;AAEH,qFAAqF;AACrF,SAAS,aAAa,CAAC,SAAiB;IACtC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAU5C;IACC,OAAO;QACL,IAAI,EAAE,+BAA+B;QACrC,KAAK,CAAC,KAAK;YACT,iFAAiF;YACjF,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC;gBAE5B,wFAAwF;gBACxF,yFAAyF;gBACzF,mFAAmF;gBACnF,wFAAwF;gBACxF,mFAAmF;gBACnF,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;oBAAE,OAAO,SAAS,CAAC;gBAEvD,IAAI,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC;oBAAE,OAAO,SAAS,CAAC;gBACnD,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAAE,OAAO,SAAS,CAAC;gBAE1D,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;gBACtC,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,OAAO,SAAS,CAAC;gBAEtD,OAAO;oBACL,MAAM,EAAE;wBACN;4BACE,IAAI,EACF,YAAY,IAAI,mCAAmC;gCACnD,yFAAyF;gCACzF,gCAAgC,SAAS,+BAA+B;gCACxE,qFAAqF;gCACrF,qBAAqB,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;yBAC9E;qBACF;iBACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/utils/load-image.d.ts

@@ -0,0 +1,16 @@
+export declare const VALID_IMAGE_TYPES: string[];
+export interface ImageSource {
+    file?: string;
+    url?: string;
+}
+export interface LoadedImage {
+    base64: string;
+    mimeType: string;
+    fileName: string;
+}
+/**
+ * Read an image from a local file path or URL and return its base64 (raw, no
+ * data: prefix), mime type, and a file name. Validates type and the 10MB limit.
+ */
+export declare function loadImageSource(src: ImageSource): Promise<LoadedImage>;
+//# sourceMappingURL=load-image.d.ts.map

package/dist/utils/load-image.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-image.d.ts","sourceRoot":"","sources":["../../src/utils/load-image.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,iBAAiB,UAA6B,CAAC;AAG5D,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAsC5E"}

package/dist/utils/load-image.js

@@ -0,0 +1,50 @@
+import { readFile } from "node:fs/promises";
+import { basename, extname } from "node:path";
+const MIME_BY_EXT = {
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".webp": "image/webp",
+    ".gif": "image/gif",
+};
+export const VALID_IMAGE_TYPES = Object.values(MIME_BY_EXT);
+const MAX_SIZE_BYTES = 10 * 1024 * 1024; // 10MB, mirrors the editor's IMAGE_UPLOAD_LIMIT_SIZE
+/**
+ * Read an image from a local file path or URL and return its base64 (raw, no
+ * data: prefix), mime type, and a file name. Validates type and the 10MB limit.
+ */
+export async function loadImageSource(src) {
+    if (src.file && src.url) {
+        throw new Error("Provide only one of file or url, not both");
+    }
+    if (src.file) {
+        const buffer = await readFile(src.file);
+        const ext = extname(src.file).toLowerCase();
+        const mimeType = MIME_BY_EXT[ext];
+        if (!mimeType) {
+            throw new Error(`Unsupported image extension "${ext || "(none)"}" for ${src.file}. Supported: ${Object.keys(MIME_BY_EXT).join(", ")}`);
+        }
+        if (buffer.byteLength > MAX_SIZE_BYTES) {
+            throw new Error(`${src.file} is ${(buffer.byteLength / 1024 / 1024).toFixed(1)}MB; the limit is 10MB`);
+        }
+        return { base64: buffer.toString("base64"), mimeType, fileName: basename(src.file) };
+    }
+    if (src.url) {
+        const res = await fetch(src.url);
+        if (!res.ok) {
+            throw new Error(`Failed to fetch ${src.url}: ${res.status} ${res.statusText}`);
+        }
+        const mimeType = (res.headers.get("content-type") || "").split(";")[0].trim();
+        if (!VALID_IMAGE_TYPES.includes(mimeType)) {
+            throw new Error(`${src.url} returned content-type "${mimeType || "(none)"}". Supported: ${VALID_IMAGE_TYPES.join(", ")}`);
+        }
+        const buffer = Buffer.from(await res.arrayBuffer());
+        if (buffer.byteLength > MAX_SIZE_BYTES) {
+            throw new Error(`${src.url} is ${(buffer.byteLength / 1024 / 1024).toFixed(1)}MB; the limit is 10MB`);
+        }
+        const urlName = basename(new URL(src.url).pathname) || "image";
+        return { base64: buffer.toString("base64"), mimeType, fileName: urlName };
+    }
+    throw new Error("Provide a file path or url");
+}
+//# sourceMappingURL=load-image.js.map

package/dist/utils/load-image.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-image.js","sourceRoot":"","sources":["../../src/utils/load-image.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE9C,MAAM,WAAW,GAA2B;IAC1C,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC5D,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,qDAAqD;AAa9F;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAgB;IACpD,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,gCAAgC,GAAG,IAAI,QAAQ,SAAS,GAAG,CAAC,IAAI,gBAAgB,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtH,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,GAAG,cAAc,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC;QACzG,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;IACvF,CAAC;IAED,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9E,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,2BAA2B,QAAQ,IAAI,QAAQ,iBAAiB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5H,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,UAAU,GAAG,cAAc,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC;QAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC5E,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;AAChD,CAAC"}

package/dist/utils/vendor-storefront.d.ts

@@ -0,0 +1,13 @@
+import type { Plugin } from "esbuild";
+export declare function isVendoredDependencyFile(file: string): boolean;
+/**
+ * Bundle the storefront SDK into the component artifact.
+ *
+ * Deep imports stay forbidden for *component* source — the public contract is still "import only
+ * from the package root", and a component reaching into `/src/...` is still a bug worth failing
+ * on. But the SDK's own modules deep-import each other constantly (97 lazy `import()` calls into
+ * `@ikas/bp-storefront-api/src/__api/...` alone), and those are internal business. So the rule is
+ * keyed on who is importing, not on what is imported.
+ */
+export declare function vendorStorefrontPlugin(): Plugin;
+//# sourceMappingURL=vendor-storefront.d.ts.map

package/dist/utils/vendor-storefront.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vendor-storefront.d.ts","sourceRoot":"","sources":["../../src/utils/vendor-storefront.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAqCtC,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAK9D;AAqBD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CA+B/C"}

package/dist/utils/vendor-storefront.js

@@ -0,0 +1,91 @@
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+/**
+ * Compile the storefront SDK *into* the artifact instead of resolving it against the host.
+ *
+ * The default path (`forbidDeepStorefrontImportsPlugin`) leaves `@ikas/bp-storefront*` external,
+ * so a theme has to hand the component every named export it uses at runtime. That makes the set
+ * of names a contract between two independently-released things: publish a component that reaches
+ * for a name older themes lack and the page renders an error box for every visitor, with nothing
+ * to fall back to.
+ *
+ * Vendoring removes the contract rather than versioning it. The artifact carries the SDK code it
+ * was built against, so what a host must still provide shrinks to the handful of packages that
+ * genuinely have to be shared (`preact`, `preact/hooks`, `mobx` — see the externals in compile.ts)
+ * and cannot grow when we add a feature.
+ *
+ * The trade is duplication: a page rendering a vendored component ships this code even though the
+ * theme already has its own copy. That is the point — the two copies are free to be different
+ * versions.
+ */
+/** `@ikas/bp-storefront` and its siblings, with an optional subpath. */
+const VENDORED_PKG = /^(@ikas\/bp-storefront(?:-(?:models|config|api|api-client))?)(\/.*)?$/;
+/**
+ * True for files that belong to a vendored dependency rather than to component source.
+ *
+ * Two shapes, because the SDK resolves differently depending on where the build runs: an npm
+ * install puts it under `node_modules/@ikas/bp-storefront*`, while inside this monorepo npm
+ * workspaces symlink it and esbuild reports the real path under `packages/storefront*`.
+ */
+const VENDORED_FILE = /[\\/](?:node_modules[\\/]@ikas[\\/]bp-storefront[^\\/]*|packages[\\/]storefront(?:-(?:api|api-client|config|models))?)[\\/]/;
+export function isVendoredDependencyFile(file) {
+    if (!file)
+        return false;
+    // Anything already inside node_modules is a transitive dependency of a package we chose to
+    // vendor, not something a component author wrote — the allowlist has no say over it.
+    return file.includes(`${path.sep}node_modules${path.sep}`) || VENDORED_FILE.test(file);
+}
+/**
+ * Stand-in for `isomorphic-fetch`, which the SDK imports in three places.
+ *
+ * That package pulls `node-fetch` in, which references `global` and dies in a browser with
+ * "global is not defined" — a failure the monorepo never sees while the SDK is merely *external*,
+ * because nothing bundles it there. Vendoring is exactly what makes it reachable, so it has to be
+ * aliased away here rather than left to be discovered at runtime.
+ *
+ * Both build targets already have a native `fetch` (browsers, and Node 18+ for the SSR build), so
+ * the shim is a forwarder. It calls through `globalThis` on every invocation instead of capturing
+ * the function, which keeps `this` correct (a bare reference throws "Illegal invocation") and lets
+ * a host install a polyfill after this module is evaluated.
+ */
+const FETCH_SHIM = path.join(os.tmpdir(), "ikas-vendored-fetch-shim.mjs");
+fs.writeFileSync(FETCH_SHIM, "const f = (...args) => globalThis.fetch(...args);\nexport default f;\nexport { f as fetch };\n");
+/**
+ * Bundle the storefront SDK into the component artifact.
+ *
+ * Deep imports stay forbidden for *component* source — the public contract is still "import only
+ * from the package root", and a component reaching into `/src/...` is still a bug worth failing
+ * on. But the SDK's own modules deep-import each other constantly (97 lazy `import()` calls into
+ * `@ikas/bp-storefront-api/src/__api/...` alone), and those are internal business. So the rule is
+ * keyed on who is importing, not on what is imported.
+ */
+export function vendorStorefrontPlugin() {
+    return {
+        name: "ikas-vendor-storefront",
+        setup(build) {
+            build.onResolve({ filter: /^isomorphic-fetch$/ }, () => ({ path: FETCH_SHIM }));
+            build.onResolve({ filter: VENDORED_PKG }, (args) => {
+                const [, root, subpath] = args.path.match(VENDORED_PKG);
+                if (subpath && subpath !== "/" && !isVendoredDependencyFile(args.importer)) {
+                    return {
+                        errors: [
+                            {
+                                text: `Deep import "${args.path}" is not allowed. Import only from the package root ` +
+                                    `"${root}" — e.g. import { saveCouponCode, getCart } from "${root}". ` +
+                                    `Subpaths like "/dist/..." or "/src/..." are private and may be renamed without ` +
+                                    `notice. If a helper seems missing from the root, it almost always has a public ` +
+                                    `name there (coupon code, for instance, is getCouponCodeForm / ` +
+                                    `setCouponCodeFormCouponCode / submitCouponCodeForm).`,
+                            },
+                        ],
+                    };
+                }
+                // Returning nothing hands the specifier back to esbuild's normal resolution, which is
+                // what pulls the source into the bundle. The default path returns `external: true` here.
+                return undefined;
+            });
+        },
+    };
+}
+//# sourceMappingURL=vendor-storefront.js.map

package/dist/utils/vendor-storefront.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vendor-storefront.js","sourceRoot":"","sources":["../../src/utils/vendor-storefront.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B;;;;;;;;;;;;;;;;;GAiBG;AAEH,wEAAwE;AACxE,MAAM,YAAY,GAAG,uEAAuE,CAAC;AAE7F;;;;;;GAMG;AACH,MAAM,aAAa,GACjB,6HAA6H,CAAC;AAEhI,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,2FAA2F;IAC3F,qFAAqF;IACrF,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,eAAe,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,8BAA8B,CAAC,CAAC;AAC1E,EAAE,CAAC,aAAa,CACd,UAAU,EACV,gGAAgG,CACjG,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,KAAK,CAAC,KAAK;YACT,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;YAEhF,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;gBACjD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAE,CAAC;gBAEzD,IAAI,OAAO,IAAI,OAAO,KAAK,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC3E,OAAO;wBACL,MAAM,EAAE;4BACN;gCACE,IAAI,EACF,gBAAgB,IAAI,CAAC,IAAI,sDAAsD;oCAC/E,IAAI,IAAI,qDAAqD,IAAI,KAAK;oCACtE,iFAAiF;oCACjF,iFAAiF;oCACjF,gEAAgE;oCAChE,sDAAsD;6BACzD;yBACF;qBACF,CAAC;gBACJ,CAAC;gBAED,sFAAsF;gBACtF,yFAAyF;gBACzF,OAAO,SAAS,CAAC;YACnB,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}