@kotao/storefront 0.2.0

package/dist/routing-BfUp49o8.d.ts

@@ -0,0 +1,302 @@
+import { S as StorefrontClient, C as CacheStrategy, K as KotaoCache } from './client-D9YYA2w6.js';
+import { C as CartFormAction, a as Cart, b as CartLineInput, c as CartAttribute, d as CartBuyerIdentityInput, e as CartMutationResult, f as CartLineUpdateInput, g as CartMetafield, h as CartMetafieldIdentifier, i as CartDeliveryAddress, j as CartSelectedDeliveryOption, H as HydrogenSession } from './types-Df3bGbKU.js';
+
+interface CartCreateInput {
+    readonly lines?: readonly CartLineInput[];
+    readonly note?: string | null;
+    readonly attributes?: readonly CartAttribute[];
+    readonly buyerIdentity?: CartBuyerIdentityInput;
+}
+interface CartDispatchAction {
+    readonly action: CartFormAction;
+    readonly inputs: Record<string, unknown>;
+}
+interface CartHandler {
+    get(): Promise<Cart | null>;
+    getCart(): Promise<Cart | null>;
+    create(input?: CartCreateInput): Promise<CartMutationResult>;
+    addLines(lines: readonly CartLineInput[]): Promise<CartMutationResult>;
+    updateLines(lines: readonly CartLineUpdateInput[]): Promise<CartMutationResult>;
+    removeLines(lineIds: readonly string[]): Promise<CartMutationResult>;
+    updateBuyerIdentity(buyerIdentity: CartBuyerIdentityInput): Promise<CartMutationResult>;
+    updateDiscountCodes(discountCodes: readonly string[]): Promise<CartMutationResult>;
+    setCartId(cartId: string): Headers;
+    cartCreate(input?: CartCreateInput): Promise<CartMutationResult>;
+    linesAdd(lines: readonly CartLineInput[]): Promise<CartMutationResult>;
+    linesUpdate(lines: readonly CartLineUpdateInput[]): Promise<CartMutationResult>;
+    linesRemove(lineIds: readonly string[]): Promise<CartMutationResult>;
+    buyerIdentityUpdate(buyerIdentity: CartBuyerIdentityInput): Promise<CartMutationResult>;
+    discountCodesUpdate(discountCodes: readonly string[]): Promise<CartMutationResult>;
+    giftCardCodesAdd(giftCardCodes: readonly string[]): Promise<CartMutationResult>;
+    giftCardCodesRemove(giftCardCodes: readonly string[]): Promise<CartMutationResult>;
+    noteUpdate(note: string | null): Promise<CartMutationResult>;
+    attributesUpdate(attributes: readonly CartAttribute[]): Promise<CartMutationResult>;
+    metafieldsSet(metafields: readonly CartMetafield[]): Promise<CartMutationResult>;
+    metafieldsDelete(metafields: readonly CartMetafieldIdentifier[]): Promise<CartMutationResult>;
+    deliveryAddressesReplace(addresses: readonly CartDeliveryAddress[]): Promise<CartMutationResult>;
+    selectedDeliveryOptionsUpdate(selectedDeliveryOptions: readonly CartSelectedDeliveryOption[]): Promise<CartMutationResult>;
+    dispatch(action: CartDispatchAction): Promise<CartMutationResult>;
+}
+type MaybePromise<T> = T | Promise<T>;
+type CartGetId = () => MaybePromise<string | null | undefined>;
+type CartSetId = (cartId: string) => MaybePromise<string | Headers | null | undefined | void>;
+interface RequestCartHandlerOptions {
+    request: Request;
+    storefront: StorefrontClient;
+}
+interface HydrogenCartHandlerOptions {
+    storefront: StorefrontClient;
+    customerAccount?: unknown;
+    getCartId: CartGetId;
+    setCartId: CartSetId;
+}
+type CreateCartHandlerOptions = RequestCartHandlerOptions | HydrogenCartHandlerOptions;
+declare function cartGetIdDefault(headers: Headers): CartGetId;
+declare function cartSetIdDefault(): CartSetId;
+declare function createCartHandler(opts: CreateCartHandlerOptions): CartHandler;
+
+/**
+ * Typed customer-account shapes for the `@kotao/storefront` SDK surface (#91). The names/signatures
+ * mirror Hydrogen's Customer Account API so a Hydrogen→Kotao theme migration stays mechanical
+ * (ADR-0003). Kotao-native storefronts use the same-origin `/api/storefront` proxy, while migrated
+ * Hydrogen server contexts can keep Shopify Customer Account OAuth/session semantics.
+ */
+interface CustomerAccount {
+    readonly id: string;
+    readonly email: string;
+    readonly firstName: string | null;
+    readonly lastName: string | null;
+    readonly displayName: string | null;
+}
+interface Money {
+    readonly amount: string;
+    readonly currencyCode: string;
+}
+interface Order {
+    readonly id: string;
+    readonly number: string;
+    readonly processedAt: string;
+    readonly financialStatus: string;
+    readonly fulfillmentStatus: string;
+    readonly totalPrice: Money;
+}
+/** Order-history page info. Named distinctly from the SDK's relay-style `PageInfo` (pagination) to
+ *  avoid a barrel name collision. */
+interface OrderPageInfo {
+    readonly hasNextPage: boolean;
+    readonly endCursor: string | null;
+}
+interface OrderConnection {
+    readonly nodes: readonly Order[];
+    readonly pageInfo: OrderPageInfo;
+}
+interface RequestLoginCodeInput {
+    readonly email: string;
+}
+interface RequestLoginCodeResult {
+    readonly status: 'sent' | 'rate_limited' | 'error';
+}
+interface VerifyLoginCodeInput {
+    readonly email: string;
+    readonly code: string;
+    /** Same-origin path to redirect to after successful verification (optional). */
+    readonly returnTo?: string;
+}
+interface CustomerAccountGraphQLError {
+    readonly message: string;
+    readonly [key: string]: unknown;
+}
+interface CustomerAccountGraphQLResult<T = unknown> {
+    readonly data: T | null;
+    readonly errors?: readonly CustomerAccountGraphQLError[];
+}
+interface CustomerAccountGraphQLOptions {
+    readonly variables?: Record<string, unknown>;
+}
+interface OrdersOptions {
+    readonly first?: number;
+    readonly after?: string;
+}
+/** Maps the backend `AddressDTO` shape (kernel fields renamed to Shopify-compatible names). */
+interface Address {
+    readonly id: string;
+    readonly firstName: string | null;
+    readonly lastName: string | null;
+    readonly company: string | null;
+    readonly address1: string | null;
+    readonly address2: string | null;
+    readonly city: string | null;
+    readonly province: string | null;
+    readonly provinceCode: string | null;
+    readonly country: string | null;
+    readonly countryCode: string | null;
+    readonly zip: string | null;
+    readonly phone: string | null;
+    readonly default: boolean;
+}
+/** Input for creating or updating an address — same as `Address` minus the server-assigned `id`. */
+type AddressInput = Omit<Address, 'id'>;
+interface AddressConnection {
+    readonly nodes: readonly Address[];
+}
+type CustomerAccountErrorCode = 'unauthenticated' | 'unreachable' | 'api_error';
+/**
+ * Typed failure for account/order reads — the SDK never lets a bare network throw or a non-200
+ * escape to theme code (acceptance criterion). `unauthenticated` = no/invalid session (401);
+ * `unreachable` = the proxy fetch itself failed; `api_error` = any other non-OK response.
+ */
+declare class CustomerAccountError extends Error {
+    readonly code: CustomerAccountErrorCode;
+    constructor(code: CustomerAccountErrorCode, message: string);
+}
+interface CustomerAccountClient {
+    /**
+     * Hydrogen-compatible Customer Account GraphQL read. Kotao sessions go through the same-origin
+     * proxy; Hydrogen AppSession credentials can call Shopify's Customer Account API directly. When
+     * logged out it returns a GraphQL-shaped error instead of throwing so Hydrogen loaders can run their
+     * normal logout/login branch.
+     */
+    query<T = unknown>(query: string, options?: CustomerAccountGraphQLOptions): Promise<CustomerAccountGraphQLResult<T>>;
+    /** Hydrogen-compatible Customer Account GraphQL mutation through the active customer-account mode. */
+    mutate<T = unknown>(mutation: string, options?: CustomerAccountGraphQLOptions): Promise<CustomerAccountGraphQLResult<T>>;
+    /** Hydrogen-compatible login redirect entrypoint. */
+    login(): Response | Promise<Response>;
+    /** Hydrogen-compatible authorize callback entrypoint. */
+    authorize(): Response | Promise<Response>;
+    /** Throws the login redirect when unauthenticated, matching Hydrogen loader usage. */
+    handleAuthStatus(): Promise<void>;
+    /**
+     * POST to the proxy `/account/send` endpoint to trigger an OTP email. Returns a typed status:
+     * `sent` (200), `rate_limited` (429), or `error` (any other failure). Never throws.
+     */
+    requestLoginCode(input: RequestLoginCodeInput): Promise<RequestLoginCodeResult>;
+    /**
+     * POST to the proxy `/account/verify` endpoint with the OTP code. Returns the raw proxy `Response`
+     * so its `Set-Cookie` and 302 redirect headers propagate to the theme's RR7 action unchanged —
+     * do NOT swallow or re-create this Response.
+     */
+    verifyLoginCode(input: VerifyLoginCodeInput): Promise<Response>;
+    /** 302 logout redirect; also clears the active customer-account session cookie. */
+    logout(): Response | Promise<Response>;
+    /** Boolean session check — never throws (false on absent/invalid/unreachable). */
+    isLoggedIn(): Promise<boolean>;
+    /**
+     * The active customer credential, or null. In Kotao proxy mode this is the opaque per-shop session
+     * token from the cookie; in Hydrogen AppSession mode this is Shopify's Customer Account access
+     * token and may refresh the session before resolving. Treat it as a credential: do not log it or
+     * send it to unrelated origins.
+     */
+    getAccessToken(): Promise<string | null>;
+    /** The current customer profile; throws {@link CustomerAccountError} on failure. */
+    account(): Promise<CustomerAccount>;
+    /** Cursor-paginated order history; throws {@link CustomerAccountError} on failure. */
+    orders(options?: OrdersOptions): Promise<OrderConnection>;
+    /** List all saved addresses for the authenticated customer; throws {@link CustomerAccountError} on failure. */
+    addresses(): Promise<AddressConnection>;
+    /** Create a new address; returns the raw proxy Response. */
+    createAddress(input: AddressInput): Promise<Response>;
+    /** Update an existing address by id; returns the raw proxy Response. */
+    updateAddress(id: string, input: AddressInput): Promise<Response>;
+    /** Delete an address by id; returns the raw proxy Response. */
+    deleteAddress(id: string): Promise<Response>;
+}
+
+declare const GEO_HEADER = "x-kotao-geo";
+declare const GEO_SIGNATURE_HEADER = "x-kotao-geo-signature";
+/**
+ * Trusted geo surfaced to themes as `context.geo`. In untrusted WFP mode `request.cf` is
+ * stripped, so the Gateway Worker (#81) injects this as signed `x-kotao-*` headers and the
+ * SDK verifies them here. Both sides share this module so the contract can never drift.
+ */
+interface Geo {
+    country: string | null;
+    city: string | null;
+    colo: string | null;
+    botScore: number | null;
+    clientIp: string | null;
+}
+/** Gateway side (#81): produce the two header values for a geo payload. */
+declare function signGeo(geo: Geo, key: string): Promise<{
+    payload: string;
+    signature: string;
+}>;
+/** SDK side: reconstruct typed geo from signed headers. Returns null on any failure — never trusts unsigned data. */
+declare function verifyGeo(headers: Headers, key: string): Promise<Geo | null>;
+
+type WithCache = <T>(key: string, strategy: CacheStrategy, fn: () => Promise<T>) => Promise<T>;
+/** Mirrors Hydrogen's `createWithCache`: SWR caching for arbitrary third-party data. */
+declare const createWithCache: (cache: KotaoCache) => WithCache;
+
+interface KotaoEnv {
+    STOREFRONT_API_ENDPOINT: string;
+    STOREFRONT_API_TOKEN: string;
+    STOREFRONT_API_TOKEN_HEADER?: string;
+    STOREFRONT_GEO_SIGNING_KEY: string;
+    /**
+     * Per-deploy font CDN base `https://cdn.kotao.{stage}/{org}/fonts` (bound by apps/storefront-build).
+     * Migrated themes stamp it onto the render runtime so `font_face`/`font_url` resolve fonts from the
+     * org's R2-native CDN instead of the retired `/kotao-cdn/fonts/{id}` carve-out.
+     */
+    FONT_CDN_BASE?: string;
+    KOTAO_SITE_ID?: string;
+    KOTAO_SHOP_ID?: string;
+    /**
+     * Local-dev only: HMAC key for self-signing the shop-context the proxy verifies. In production
+     * the Gateway signs it (this is unset), so its presence is what enables the local signer below.
+     * Must match the api proxy's STOREFRONT_SHOP_CONTEXT_KEY.
+     */
+    STOREFRONT_SHOP_CONTEXT_KEY?: string;
+    SESSION_SECRET?: string;
+    PUBLIC_STOREFRONT_API_TOKEN?: string;
+    PRIVATE_STOREFRONT_API_TOKEN?: string;
+    PUBLIC_STORE_DOMAIN?: string;
+    PUBLIC_STOREFRONT_ID?: string;
+    PUBLIC_CUSTOMER_ACCOUNT_API_CLIENT_ID?: string;
+    PUBLIC_CUSTOMER_ACCOUNT_API_URL?: string;
+    PUBLIC_CHECKOUT_DOMAIN?: string;
+    SHOP_ID?: string;
+}
+interface KotaoSession extends HydrogenSession {
+    readonly isLoggedIn: boolean;
+}
+interface KotaoContext {
+    readonly storefront: StorefrontClient;
+    readonly cart: CartHandler;
+    readonly customerAccount: CustomerAccountClient;
+    readonly geo: Geo | null;
+    readonly withCache: WithCache;
+    readonly locale: string | null;
+    /** Cookie-presence hint. `isLoggedIn` is true when the session cookie is present in the request.
+     *  The authoritative check (HMAC verification) happens server-side in the proxy. */
+    readonly session: KotaoSession;
+    readonly env: any;
+    readonly waitUntil: (p: Promise<unknown>) => void;
+}
+/**
+ * Framework-agnostic per-request context, mirroring Hydrogen's `createHydrogenContext`:
+ * storefront client + verified geo + SWR cache + locale + session seam.
+ */
+declare function createKotaoContext(request: Request, env: KotaoEnv, executionCtx: ExecutionContext, deps?: {
+    openCache?: (name: string) => Promise<Cache>;
+    session?: HydrogenSession;
+}): Promise<KotaoContext>;
+
+declare const ROUTING_LOCALE_HEADER = "x-kotao-route-locale";
+declare const ROUTING_ORIGINAL_PATHNAME_HEADER = "x-kotao-original-pathname";
+interface StrippedLocalePath {
+    readonly locale: string | null;
+    readonly pathname: string;
+}
+interface LocalizePathOptions {
+    readonly primaryLocale?: string | null;
+}
+declare function isLocalePathSegment(segment: string): boolean;
+declare function localeFromAcceptLanguage(header: string | null | undefined, availableLocales?: readonly string[]): string | null;
+declare function localeFromPathname(pathname: string): string | null;
+declare function originalPathnameFromRequest(request: Request): string;
+declare function localeFromRequest(request: Request): string | null;
+declare function stripLocalePrefixFromPathname(pathname: string): StrippedLocalePath;
+declare function stripLocalePrefixFromRequest(request: Request): Request;
+declare function localizePath(path: string, locale: string | null | undefined, options?: LocalizePathOptions): string;
+
+export { type Address as A, isLocalePathSegment as B, type CartDispatchAction as C, localeFromAcceptLanguage as D, localeFromPathname as E, localeFromRequest as F, GEO_HEADER as G, type HydrogenCartHandlerOptions as H, localizePath as I, originalPathnameFromRequest as J, type KotaoEnv as K, type LocalizePathOptions as L, type Money as M, signGeo as N, type Order as O, stripLocalePrefixFromPathname as P, verifyGeo as Q, ROUTING_LOCALE_HEADER as R, type StrippedLocalePath as S, type VerifyLoginCodeInput as V, type WithCache as W, type KotaoContext as a, type KotaoSession as b, type CustomerAccountClient as c, type AddressConnection as d, type CartGetId as e, type CartHandler as f, type CartSetId as g, type CreateCartHandlerOptions as h, type CustomerAccount as i, CustomerAccountError as j, type CustomerAccountErrorCode as k, GEO_SIGNATURE_HEADER as l, type Geo as m, type OrderConnection as n, type OrderPageInfo as o, type OrdersOptions as p, ROUTING_ORIGINAL_PATHNAME_HEADER as q, type RequestCartHandlerOptions as r, stripLocalePrefixFromRequest as s, type RequestLoginCodeInput as t, type RequestLoginCodeResult as u, cartGetIdDefault as v, cartSetIdDefault as w, createCartHandler as x, createKotaoContext as y, createWithCache as z };

package/dist/seo.d.ts

@@ -0,0 +1,155 @@
+import { S as SeoConfig, b as SeoDescriptor, J as JsonLd } from './types-BDhHWZsP.js';
+export { A as Alternate, O as OpenGraph, a as OpenGraphImage, T as TwitterCard } from './types-BDhHWZsP.js';
+import { S as StorefrontClient } from './client-D9YYA2w6.js';
+
+/**
+ * Merge SEO config across levels and emit a flat, deduplicated descriptor list (RR7 `meta`-compatible):
+ * title, description, canonical, robots, Open Graph, Twitter Card, hreflang alternates, and JSON-LD.
+ * Open Graph / Twitter titles + descriptions fall back to the page title/description (Hydrogen-shaped).
+ */
+declare function getSeoMeta(...configs: SeoConfig[]): SeoDescriptor[];
+/**
+ * Serialize a JSON-LD object for inline `<script>` injection. Escapes `<` to `<` so a value
+ * containing `</script>` cannot break out of the script element (XSS guard). Use in any hand-rolled
+ * renderer; the `<Seo/>` component uses this.
+ */
+declare function serializeJsonLd(obj: JsonLd): string;
+
+interface BreadcrumbItem {
+    readonly name: string;
+    readonly url: string;
+}
+declare function breadcrumbListJsonLd(items: readonly BreadcrumbItem[]): JsonLd;
+interface OrganizationInput {
+    readonly name: string;
+    readonly url?: string;
+    readonly logo?: string;
+    readonly sameAs?: readonly string[];
+}
+declare function organizationJsonLd(input: OrganizationInput): JsonLd;
+interface WebSiteInput {
+    readonly name: string;
+    readonly url: string;
+    /** A URL template with `{search_term_string}` to enable the sitelinks search box. */
+    readonly searchUrlTemplate?: string;
+}
+declare function websiteJsonLd(input: WebSiteInput): JsonLd;
+
+interface OfferInput {
+    readonly price: string | number;
+    readonly currency: string;
+    /** schema.org ItemAvailability short name, e.g. 'InStock' | 'OutOfStock' | 'PreOrder'. */
+    readonly availability?: string;
+    readonly url?: string;
+    readonly sku?: string;
+}
+interface ProductJsonLdInput {
+    readonly name: string;
+    readonly description?: string;
+    readonly sku?: string;
+    readonly image?: string | readonly string[];
+    readonly brand?: string;
+    readonly url?: string;
+    readonly offer?: OfferInput;
+}
+declare function productJsonLd(input: ProductJsonLdInput): JsonLd;
+
+interface AddressInput {
+    readonly streetAddress?: string;
+    readonly locality?: string;
+    readonly region?: string;
+    readonly postalCode?: string;
+    readonly country?: string;
+}
+interface GeoInput {
+    readonly latitude: number;
+    readonly longitude: number;
+}
+interface LocalBusinessInput {
+    readonly name: string;
+    /** schema.org type, e.g. 'LocalBusiness' | 'Restaurant' | 'Store'. Defaults to 'LocalBusiness'. */
+    readonly type?: string;
+    readonly url?: string;
+    readonly telephone?: string;
+    readonly priceRange?: string;
+    readonly image?: string | readonly string[];
+    readonly address?: AddressInput;
+    readonly geo?: GeoInput;
+    /** schema.org openingHours strings, e.g. ['Mo-Fr 09:00-17:00', 'Sa 10:00-14:00']. */
+    readonly openingHours?: readonly string[];
+    /** Restaurant fields (used when type is 'Restaurant'). */
+    readonly servesCuisine?: string | readonly string[];
+    readonly menu?: string;
+    readonly acceptsReservations?: boolean;
+}
+/**
+ * LocalBusiness JSON-LD — the brick-and-mortar / restaurant differentiator beyond Shopify's defaults
+ * (the SDK table calls this out). `restaurantJsonLd` is the same builder pinned to `Restaurant`.
+ */
+declare function localBusinessJsonLd(input: LocalBusinessInput): JsonLd;
+declare function restaurantJsonLd(input: Omit<LocalBusinessInput, 'type'>): JsonLd;
+
+/**
+ * sitemap.xml + sitemap-index factories. The entry source is injected (the caller resolves it from the
+ * Storefront API or a search index — an open question, NOT decided here): build the entry list, then call
+ * these. The index shape exists so large catalogs split into child sitemaps rather than one document.
+ */
+type ChangeFreq = 'always' | 'hourly' | 'daily' | 'weekly' | 'monthly' | 'yearly' | 'never';
+interface SitemapEntry {
+    readonly loc: string;
+    readonly lastmod?: string;
+    readonly changefreq?: ChangeFreq;
+    /** 0.0–1.0 (clamped). */
+    readonly priority?: number;
+}
+interface SitemapIndexEntry {
+    readonly loc: string;
+    readonly lastmod?: string;
+}
+declare function buildSitemapXml(entries: readonly SitemapEntry[]): string;
+declare function buildSitemapIndexXml(sitemaps: readonly SitemapIndexEntry[]): string;
+declare function sitemapResponse(entries: readonly SitemapEntry[]): Response;
+declare function sitemapIndexResponse(sitemaps: readonly SitemapIndexEntry[]): Response;
+
+/**
+ * robots.txt factory. Non-production / preview deployments auto-disallow ALL crawling; production allows
+ * and references the sitemap. `production` comes from the SDK's stage signal (context.env), NEVER the
+ * request Host/URL (stage-pinned-config rule, AGENTS.md §Environments).
+ */
+interface RobotsOptions {
+    readonly production: boolean;
+    readonly sitemapUrl?: string;
+}
+declare function buildRobotsTxt(options: RobotsOptions): string;
+declare function robotsResponse(options: RobotsOptions): Response;
+
+/**
+ * Slug-change 301 handler. The redirect store is owned elsewhere (catalog/storefront-API work); this
+ * owns only the request-handling shape. The lookup is injected: given the current path, it returns the
+ * canonical target (or null). A self-redirect (target === path) returns null to avoid an immediate loop.
+ */
+type RedirectLookup = (path: string) => Promise<string | null> | string | null;
+interface RedirectOptions {
+    /** 301 (permanent, default) or 302 (temporary). */
+    readonly status?: 301 | 302;
+}
+interface StorefrontRedirectOptions extends RedirectOptions {
+    readonly request: Request;
+    readonly response: Response;
+    readonly storefront: StorefrontClient;
+}
+declare function resolveRedirect(lookup: RedirectLookup, path: string, options?: RedirectOptions): Promise<Response | null>;
+declare const URL_REDIRECT_QUERY = "#graphql\n  query UrlRedirect($path: String!) {\n    urlRedirect(path: $path) {\n      target\n    }\n  }\n";
+/**
+ * Look up `path` in the storefront-api's url_redirects and, if found, return a 301 Response.
+ * Returns null when there is no redirect, a self-redirect, or the lookup query fails (so the caller
+ * falls through to its normal 404 — a lookup failure must never become a 500).
+ */
+declare function resolveStorefrontRedirect(storefront: StorefrontClient, path: string, options?: RedirectOptions): Promise<Response | null>;
+/**
+ * Hydrogen-compatible 404 redirect helper. It preserves the original response when there is no
+ * matching URL redirect, mirroring the server.ts pattern used by Hydrogen demo stores.
+ */
+declare function storefrontRedirect(options: StorefrontRedirectOptions): Promise<Response>;
+
+export { type AddressInput, type BreadcrumbItem, type ChangeFreq, type GeoInput, JsonLd, type LocalBusinessInput, type OfferInput, type OrganizationInput, type ProductJsonLdInput, type RedirectLookup, type RedirectOptions, type RobotsOptions, SeoConfig, SeoDescriptor, type SitemapEntry, type SitemapIndexEntry, type StorefrontRedirectOptions, URL_REDIRECT_QUERY, type WebSiteInput, breadcrumbListJsonLd, buildRobotsTxt, buildSitemapIndexXml, buildSitemapXml, getSeoMeta, localBusinessJsonLd, organizationJsonLd, productJsonLd, resolveRedirect, resolveStorefrontRedirect, restaurantJsonLd, robotsResponse, serializeJsonLd, sitemapIndexResponse, sitemapResponse, storefrontRedirect, websiteJsonLd };

package/dist/seo.js

@@ -0,0 +1,4 @@
+export { URL_REDIRECT_QUERY, breadcrumbListJsonLd, buildRobotsTxt, buildSitemapIndexXml, buildSitemapXml, localBusinessJsonLd, organizationJsonLd, productJsonLd, resolveRedirect, resolveStorefrontRedirect, restaurantJsonLd, robotsResponse, sitemapIndexResponse, sitemapResponse, storefrontRedirect, websiteJsonLd } from './chunk-ISAFEOR2.js';
+export { getSeoMeta, serializeJsonLd } from './chunk-MYDKIJRH.js';
+//# sourceMappingURL=seo.js.map
+//# sourceMappingURL=seo.js.map

package/dist/seo.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"seo.js"}

package/dist/settings.d.ts

@@ -0,0 +1,87 @@
+import { SectionSchema, Preset, ValuesDocument, SettingInput, SectionInstance } from '@kotao/storefront-contracts/theme';
+import { a as ResolvedSection, b as ResolvedSettings, T as ThemeSettingsSnapshot } from './store-DQK1nhob.js';
+export { R as ResolvedBlock, c as ThemeSettingsStore, d as createThemeSettingsStore } from './store-DQK1nhob.js';
+import { f as StorefrontAuthHeader } from './client-D9YYA2w6.js';
+
+/**
+ * The settings-as-data merge engine (ADR-0003 §"Settings-as-data customizer", #93). Pure: it resolves
+ * a section's effective settings with the universal three-layer order
+ *
+ *     stored value  →  preset value  →  input `defaultValue`
+ *
+ * and composes that over a whole values document (`resolveThemeSettings`). It lives in the SDK (not a
+ * commerce module) because it consumes `@kotao/storefront-contracts` types — the storefront layer that
+ * may import them (turbo boundaries forbids a module from doing so). The per-shop stored values come from
+ * the web module's settings store, read server-side and handed to the SDK as a snapshot.
+ */
+
+/**
+ * Resolve one settings layer: for every input the schema declares, take the stored value, else the
+ * preset value, else the input's `defaultValue`. Only declared inputs appear (stray stored keys for
+ * removed settings are dropped).
+ */
+declare function mergeSettings(inputs: readonly SettingInput[], stored: Readonly<Record<string, unknown>> | undefined, preset: Readonly<Record<string, unknown>> | undefined): ResolvedSettings;
+/**
+ * Resolve a full section instance: its settings plus each contained block's settings, all three-layer
+ * merged against the section's schema (block instances come from the stored values).
+ */
+declare function mergeSection(args: {
+    readonly schema: SectionSchema;
+    readonly preset?: Preset;
+    readonly instance?: SectionInstance;
+}): ResolvedSection;
+interface ResolveThemeSettingsArgs {
+    /** Section schemas keyed by section `type` (from the deployment manifest). */
+    readonly schemas: Readonly<Record<string, SectionSchema>>;
+    /** Optional default preset per section `type`. */
+    readonly presets?: Readonly<Record<string, Preset>>;
+    /** The per-shop stored values document (from the web module's settings store). */
+    readonly values: ValuesDocument;
+    /** Template-specific values documents, keyed by handles like `index`, `product`, or `cart`. */
+    readonly templates?: Partial<Record<string, ValuesDocument>>;
+    /** Layout section-group values documents, keyed by handles like `header-group`. */
+    readonly sectionGroups?: Partial<Record<string, ValuesDocument>>;
+    /** Global theme-token inputs (logo/colors/fonts), merged the same way. */
+    readonly globalInputs?: readonly SettingInput[];
+    readonly globalStored?: Readonly<Record<string, unknown>>;
+    readonly globalPreset?: Readonly<Record<string, unknown>>;
+}
+/** Compose the merge over an entire values document → the snapshot a theme renders from. */
+declare function resolveThemeSettings(args: ResolveThemeSettingsArgs): ThemeSettingsSnapshot;
+
+/**
+ * The stored settings a theme hydrates from (#93): the layout document's ordered section instances +
+ * the global theme tokens. Pass to {@link resolveThemeSettings} together with the theme's bundled
+ * section schemas + presets to produce the merged {@link ThemeSettingsSnapshot}.
+ */
+interface StoredThemeSettings {
+    readonly shopId: string;
+    readonly sections: readonly SectionInstance[];
+    readonly global: Record<string, unknown>;
+    readonly templates?: Readonly<Partial<Record<string, ValuesDocument>>>;
+    readonly sectionGroups?: Readonly<Partial<Record<string, ValuesDocument>>>;
+}
+interface FetchThemeSettingsOptions {
+    /** Injectable for tests; defaults to the global `fetch`. */
+    readonly fetch?: typeof fetch;
+    /** Same-origin settings endpoint (default `/api/storefront/settings`). */
+    readonly endpoint?: string;
+    /**
+     * Explicit local-preview escape hatch for server-side theme workers that call the Kotao API directly.
+     * Production themes should keep the default same-origin path.
+     */
+    readonly allowCrossOrigin?: boolean;
+    /** Optional server-side auth headers for local previews. Never pass browser-visible tokens here. */
+    readonly auth?: {
+        readonly token: string;
+        readonly tokenHeader?: StorefrontAuthHeader;
+        readonly siteId?: string;
+    };
+}
+/**
+ * Fetch the shop's stored settings document via the same-origin `/api/storefront/settings` carve-out.
+ * The shop is resolved server-side from the Gateway-signed context — the theme sends no id and no token.
+ */
+declare function fetchThemeSettings(options?: FetchThemeSettingsOptions): Promise<StoredThemeSettings>;
+
+export { type FetchThemeSettingsOptions, type ResolveThemeSettingsArgs, ResolvedSection, ResolvedSettings, type StoredThemeSettings, ThemeSettingsSnapshot, fetchThemeSettings, mergeSection, mergeSettings, resolveThemeSettings };

package/dist/settings.js

@@ -0,0 +1,3 @@
+export { createThemeSettingsStore, fetchThemeSettings, mergeSection, mergeSettings, resolveThemeSettings } from './chunk-GCQI6OKH.js';
+//# sourceMappingURL=settings.js.map
+//# sourceMappingURL=settings.js.map

package/dist/settings.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"settings.js"}