@kotao/storefront 0.2.0

package/dist/index.d.ts

@@ -0,0 +1,183 @@
+export { a as CacheCustom, b as CacheLong, c as CacheNone, d as CacheShort, C as CacheStrategy, H as HydrogenStorefrontClientOptions, K as KotaoCache, e as Storefront, f as StorefrontAuthHeader, S as StorefrontClient, g as StorefrontClientOptions, h as StorefrontClientResult, i as StorefrontDefaultCache, j as StorefrontQueryOptions, k as createCache, l as createStorefrontClient, m as generateCacheControlHeader } from './client-D9YYA2w6.js';
+import { a as Cart } from './types-Df3bGbKU.js';
+export { k as CART_FORM_ACTIONS, c as CartAttribute, l as CartBuyerIdentity, d as CartBuyerIdentityInput, i as CartDeliveryAddress, C as CartFormAction, m as CartLine, b as CartLineInput, f as CartLineUpdateInput, g as CartMetafield, h as CartMetafieldIdentifier, e as CartMutationResult, j as CartSelectedDeliveryOption, n as CartUserError, o as HydrogenCart, p as HydrogenCartCreateInput, q as HydrogenCartMutationResult, H as HydrogenSession, r as HydrogenSessionData } from './types-Df3bGbKU.js';
+import { C as ConsentBucket, a as ConsentState, B as BoundNonceProvider } from './shop-DkQmro-Y.js';
+export { A as ANALYTICS_EVENTS, b as AnalyticsBus, c as AnalyticsBusOptions, d as AnalyticsContext, e as AnalyticsEmitter, f as AnalyticsEventMap, g as AnalyticsEventName, h as AnalyticsGeo, i as CONSENT_BUCKETS, j as CONSENT_COOKIE, k as CartForm, l as CartFormProps, m as CartViewedPayload, n as CollectionViewedPayload, D as DENIED_CONSENT, E as EventHandler, G as GRANTED_CONSENT, o as GetShopAnalyticsOptions, P as PageViewedPayload, p as PixelEvent, q as PixelSend, r as PixelTransport, s as PixelTransportOptions, t as ProductAddedToCartPayload, u as ProductViewedPayload, S as SearchViewedPayload, v as ShopAnalytics, w as buildConsentCookie, x as createAnalyticsBus, y as createAnalyticsEmitter, z as createPixelTransport, F as getShopAnalytics, H as isGranted, I as mergeConsent, J as parseConsent, K as readConsentCookie, L as serializeConsent } from './shop-DkQmro-Y.js';
+import { C as CartDispatchAction, c as CustomerAccountClient } from './routing-BfUp49o8.js';
+export { A as Address, d as AddressConnection, e as CartGetId, f as CartHandler, g as CartSetId, h as CreateCartHandlerOptions, i as CustomerAccount, j as CustomerAccountError, k as CustomerAccountErrorCode, G as GEO_HEADER, l as GEO_SIGNATURE_HEADER, m as Geo, H as HydrogenCartHandlerOptions, a as KotaoContext, K as KotaoEnv, b as KotaoSession, L as LocalizePathOptions, M as Money, O as Order, n as OrderConnection, o as OrderPageInfo, p as OrdersOptions, R as ROUTING_LOCALE_HEADER, q as ROUTING_ORIGINAL_PATHNAME_HEADER, r as RequestCartHandlerOptions, t as RequestLoginCodeInput, u as RequestLoginCodeResult, S as StrippedLocalePath, V as VerifyLoginCodeInput, W as WithCache, v as cartGetIdDefault, w as cartSetIdDefault, x as createCartHandler, y as createKotaoContext, z as createWithCache, B as isLocalePathSegment, D as localeFromAcceptLanguage, E as localeFromPathname, F as localeFromRequest, I as localizePath, J as originalPathnameFromRequest, N as signGeo, P as stripLocalePrefixFromPathname, s as stripLocalePrefixFromRequest, Q as verifyGeo } from './routing-BfUp49o8.js';
+import { T as ThemeSettingsSnapshot } from './store-DQK1nhob.js';
+export { R as ResolvedBlock, a as ResolvedSection, b as ResolvedSettings, c as ThemeSettingsStore, d as createThemeSettingsStore } from './store-DQK1nhob.js';
+export { ImageAttrs, ImageAttrsOptions, ImageCrop, ImageData, ImageFit, ImageFormat, ImageSrcSetOptions, ImageUrlOptions, buildImageAttrs, imageSrcSet, imageUrl } from './image.js';
+export { C as Connection, a as ConnectionEdge, F as FlattenableConnection, P as PageInfo, b as PaginationInfo, c as PaginationOptions, d as PaginationVariables, f as flattenConnection, g as getPaginationInfo, e as getPaginationVariables } from './pagination-CPgH3fAa.js';
+export { MappedProductOptions, ProductLike, ProductOptionDef, ProductOptionState, ProductOptionValueState, SelectedOption, SelectedOptionsMap, VariantLike, VariantSelectionLike, getAdjacentAndFirstAvailableVariants, getProductOptions, getSelectedProductOptions, getSelectedVariant, mapSelectedProductOptionToObject, useOptimisticVariant, useSelectedOptionInUrlParam } from './product.js';
+export { FetchThemeSettingsOptions, ResolveThemeSettingsArgs, StoredThemeSettings, fetchThemeSettings, mergeSection, mergeSettings, resolveThemeSettings } from './settings.js';
+export { AddressInput, BreadcrumbItem, ChangeFreq, GeoInput, LocalBusinessInput, OfferInput, OrganizationInput, ProductJsonLdInput, RedirectLookup, RedirectOptions, RobotsOptions, SitemapEntry, SitemapIndexEntry, StorefrontRedirectOptions, URL_REDIRECT_QUERY, WebSiteInput, breadcrumbListJsonLd, buildRobotsTxt, buildSitemapIndexXml, buildSitemapXml, getSeoMeta, localBusinessJsonLd, organizationJsonLd, productJsonLd, resolveRedirect, resolveStorefrontRedirect, restaurantJsonLd, robotsResponse, serializeJsonLd, sitemapIndexResponse, sitemapResponse, storefrontRedirect, websiteJsonLd } from './seo.js';
+export { A as Alternate, J as JsonLd, O as OpenGraph, a as OpenGraphImage, S as SeoConfig, b as SeoDescriptor, T as TwitterCard } from './types-BDhHWZsP.js';
+export { CreateStorefrontEditorBridgeArgs, CreateStorefrontEditorHostBridgeArgs, StorefrontEditorBlockSchema, StorefrontEditorBridge, StorefrontEditorHostBridge, StorefrontEditorMessageEvent, StorefrontEditorMessageSource, StorefrontEditorMessageTarget, StorefrontEditorReady, StorefrontEditorSectionPreset, StorefrontEditorSectionPresetBlock, StorefrontEditorSectionSchema, StorefrontEditorSelection, StorefrontEditorSettingInput, StorefrontEditorSettingOption, createStorefrontEditorBridge, createStorefrontEditorHostBridge } from './editor.js';
+import 'react';
+import './storefront-api-types.js';
+import '@kotao/storefront-contracts/theme';
+
+declare const CART_ID_COOKIE = "kotao_cart";
+declare function readCartIdCookie(cookieHeader: string | null | undefined): string | null;
+declare function buildCartIdCookie(cartId: string): string;
+
+declare function applyOptimisticCartAction(cart: Cart, action: CartDispatchAction): Cart;
+/**
+ * Pure optimistic helper for React integrations. A React wrapper can call this from `useOptimistic`;
+ * keeping the reducer pure lets non-React tests exercise the exact overlay behavior.
+ */
+declare function useOptimisticCart(cart: Cart, action: CartDispatchAction | null): Cart;
+
+declare const CHECKOUT_CONSENT_PARAM_PREFIX = "consent_";
+declare const CHECKOUT_CONSENT_CATEGORIES: readonly ConsentBucket[];
+declare function encodeCheckoutConsent(state: ConsentState): URLSearchParams;
+declare function decodeCheckoutConsent(input: URLSearchParams | string | URL): ConsentState;
+
+interface ResolveCheckoutUrlOptions {
+    readonly checkoutUrl: string;
+    readonly consent: ConsentState;
+    readonly shopDomain?: string;
+    readonly requestUrl?: string | URL | Request;
+}
+declare function resolveCheckoutUrl(options: ResolveCheckoutUrlOptions): string;
+
+interface CheckoutDesignTokens {
+    readonly logo: {
+        readonly src: string;
+        readonly altText: string | null;
+    } | null;
+    readonly colors: {
+        readonly accent: string;
+        readonly background: string;
+        readonly foreground: string;
+    };
+    readonly fonts: {
+        readonly body: string;
+        readonly heading: string;
+    };
+}
+declare const CHECKOUT_DESIGN_TOKEN_INPUTS: readonly [{
+    readonly type: "url";
+    readonly name: "checkoutLogoUrl";
+    readonly label: "Checkout logo URL";
+}, {
+    readonly type: "text";
+    readonly name: "checkoutLogoAlt";
+    readonly label: "Checkout logo alt text";
+    readonly defaultValue: "";
+}, {
+    readonly type: "color";
+    readonly name: "checkoutColorAccent";
+    readonly label: "Checkout accent color";
+    readonly defaultValue: "#005bd3";
+}, {
+    readonly type: "color";
+    readonly name: "checkoutColorBackground";
+    readonly label: "Checkout background color";
+    readonly defaultValue: "#ffffff";
+}, {
+    readonly type: "color";
+    readonly name: "checkoutColorForeground";
+    readonly label: "Checkout foreground color";
+    readonly defaultValue: "#111827";
+}, {
+    readonly type: "font";
+    readonly name: "checkoutFontBody";
+    readonly label: "Checkout body font";
+    readonly defaultValue: "Inter";
+}, {
+    readonly type: "font";
+    readonly name: "checkoutFontHeading";
+    readonly label: "Checkout heading font";
+    readonly defaultValue: "Inter";
+}];
+declare function extractCheckoutDesignTokens(snapshot: Pick<ThemeSettingsSnapshot, 'global'>): CheckoutDesignTokens;
+
+interface ContentSecurityPolicyShop {
+    readonly checkoutDomain?: string;
+    readonly storeDomain?: string;
+}
+interface CreateContentSecurityPolicyOptions {
+    readonly shop?: ContentSecurityPolicyShop;
+    readonly scriptSrc?: readonly string[];
+    readonly connectSrc?: readonly string[];
+    readonly imgSrc?: readonly string[];
+    readonly styleSrc?: readonly string[];
+}
+interface ContentSecurityPolicyResult {
+    readonly nonce: string;
+    readonly header: string;
+    readonly NonceProvider: BoundNonceProvider;
+}
+declare function createContentSecurityPolicy(options?: CreateContentSecurityPolicyOptions): ContentSecurityPolicyResult;
+
+declare const LOCALIZATION_COOKIE = "kotao_localization";
+declare function readLocalizationCookie(cookieHeader: string | null | undefined): {
+    country: string | null;
+    locale: string | null;
+};
+declare function buildLocalizationCookie(sel: {
+    country?: string | null;
+    locale?: string | null;
+}): string;
+
+declare function handleLocalizationPost(request: Request): Promise<Response>;
+
+declare function encodeConsent(state: ConsentState): URLSearchParams;
+declare function decodeConsent(params: URLSearchParams): ConsentState;
+declare function appendConsentToCheckoutUrl(checkoutUrl: string, state: ConsentState): string;
+
+interface CustomerAccountClientOptions {
+    /** The inbound theme request — supplies the session cookie to forward + the shop host. */
+    readonly request: Request;
+    /** Injectable for tests; defaults to the global `fetch`. */
+    readonly fetch?: typeof fetch | undefined;
+    /** Same-origin proxy base (#85); must be an absolute same-origin path. Defaults to `/api/storefront`. */
+    readonly proxyBase?: string | undefined;
+    /** Hydrogen server compatibility: accepted for original server.ts call sites; Kotao proxies do not need it. */
+    readonly waitUntil?: ((promise: Promise<unknown>) => void) | undefined;
+    /** Hydrogen server compatibility: accepted for original server.ts call sites; Kotao proxies do not need it. */
+    readonly session?: unknown;
+    /** Hydrogen server compatibility: accepted for original server.ts call sites; Kotao proxies do not need it. */
+    readonly customerAccountId?: string | undefined;
+    /** Hydrogen server compatibility: accepted for original server.ts call sites; Kotao proxies do not need it. */
+    readonly shopId?: string | undefined;
+}
+/**
+ * Theme-facing customer-account client (#91), mirroring Hydrogen's `createCustomerAccount`. Kotao
+ * sessions go through the same-origin `/api/storefront` proxy, while original Hydrogen contexts can
+ * keep using Shopify Customer Account OAuth/session data when `shopId`, `customerAccountId`, and a
+ * Hydrogen AppSession are supplied. Untrusted-mode safe: no `request.cf`, no `caches.default`.
+ */
+declare function createCustomerAccountClient(opts: CustomerAccountClientOptions): CustomerAccountClient;
+
+/**
+ * Per-shop customer session cookie (#91). Sessions are scoped to the shop's custom hostname and MUST
+ * NOT be shared across shops or up to `.kotao.com` (ADR-0004, design §"Checkout handoff") — cross-shop
+ * session bleed is the footgun this module exists to prevent. The cookie name + attributes are defined
+ * here once so every reader/writer (theme runtime, proxy callback) agrees on the shape.
+ */
+declare const CUSTOMER_SESSION_COOKIE = "kotao_customer_session";
+declare const DEFAULT_SESSION_MAX_AGE: number;
+interface SessionCookieAttrs {
+    /**
+     * The shop's custom hostname. `Domain` is pinned to it host-scoped (no leading dot), so the cookie
+     * matches only this shop's host — never another shop and never the `.kotao.com` platform apex.
+     */
+    readonly hostname: string;
+    readonly maxAgeSeconds?: number;
+}
+/** The shop custom host of the current request — the session isolation boundary. */
+declare function shopHostname(request: Request): string;
+/**
+ * Build the session cookie: `HttpOnly` (theme JS can never read the token), `Secure`, `SameSite=Lax`
+ * (survives the IdP login-redirect round trip), `Domain` pinned host-scoped to the shop.
+ */
+declare function buildCustomerSessionCookie(token: string, attrs: SessionCookieAttrs): string;
+/** Expire the session cookie (logout) on the same host scope. */
+declare function clearCustomerSessionCookie(attrs: SessionCookieAttrs): string;
+/** Read the session token out of a server-side `Cookie` header; null if absent or empty. */
+declare function readCustomerSessionToken(cookieHeader: string | null | undefined): string | null;
+
+export { CART_ID_COOKIE, CHECKOUT_CONSENT_CATEGORIES, CHECKOUT_CONSENT_PARAM_PREFIX, CHECKOUT_DESIGN_TOKEN_INPUTS, CUSTOMER_SESSION_COOKIE, Cart, CartDispatchAction, type CheckoutDesignTokens, ConsentBucket, ConsentState, type ContentSecurityPolicyResult, type ContentSecurityPolicyShop, type CreateContentSecurityPolicyOptions, CustomerAccountClient, type CustomerAccountClientOptions, DEFAULT_SESSION_MAX_AGE, LOCALIZATION_COOKIE, type ResolveCheckoutUrlOptions, type SessionCookieAttrs, ThemeSettingsSnapshot, appendConsentToCheckoutUrl, applyOptimisticCartAction, buildCartIdCookie, buildCustomerSessionCookie, buildLocalizationCookie, clearCustomerSessionCookie, createContentSecurityPolicy, createCustomerAccountClient, decodeCheckoutConsent, decodeConsent, encodeCheckoutConsent, encodeConsent, extractCheckoutDesignTokens, handleLocalizationPost, readCartIdCookie, readCustomerSessionToken, readLocalizationCookie, resolveCheckoutUrl, shopHostname, useOptimisticCart };

package/dist/index.js

@@ -0,0 +1,208 @@
+export { URL_REDIRECT_QUERY, breadcrumbListJsonLd, buildRobotsTxt, buildSitemapIndexXml, buildSitemapXml, localBusinessJsonLd, organizationJsonLd, productJsonLd, resolveRedirect, resolveStorefrontRedirect, restaurantJsonLd, robotsResponse, sitemapIndexResponse, sitemapResponse, storefrontRedirect, websiteJsonLd } from './chunk-ISAFEOR2.js';
+export { createThemeSettingsStore, fetchThemeSettings, mergeSection, mergeSettings, resolveThemeSettings } from './chunk-GCQI6OKH.js';
+export { createStorefrontEditorBridge, createStorefrontEditorHostBridge } from './chunk-PXZ737N3.js';
+export { getAdjacentAndFirstAvailableVariants, getProductOptions, getSelectedProductOptions, getSelectedVariant, mapSelectedProductOptionToObject, useOptimisticVariant, useSelectedOptionInUrlParam } from './chunk-QOEEUTHQ.js';
+import { createNonceProvider } from './chunk-XMTWFJCZ.js';
+export { CartForm, createAnalyticsBus, createAnalyticsEmitter, createPixelTransport } from './chunk-XMTWFJCZ.js';
+export { getSeoMeta, serializeJsonLd } from './chunk-MYDKIJRH.js';
+export { buildImageAttrs, imageSrcSet, imageUrl } from './chunk-3YQXJNR7.js';
+export { flattenConnection, getPaginationInfo, getPaginationVariables } from './chunk-5QOFKGKD.js';
+import { localizePath, buildLocalizationCookie } from './chunk-U5677AEA.js';
+export { CART_ID_COOKIE, CHECKOUT_CONSENT_CATEGORIES, CHECKOUT_CONSENT_PARAM_PREFIX, CHECKOUT_DESIGN_TOKEN_INPUTS, CUSTOMER_SESSION_COOKIE, CacheCustom, CacheLong, CacheNone, CacheShort, CustomerAccountError, DEFAULT_SESSION_MAX_AGE, GEO_HEADER, GEO_SIGNATURE_HEADER, LOCALIZATION_COOKIE, ROUTING_LOCALE_HEADER, ROUTING_ORIGINAL_PATHNAME_HEADER, StorefrontDefaultCache, buildCartIdCookie, buildCustomerSessionCookie, buildLocalizationCookie, cartGetIdDefault, cartSetIdDefault, clearCustomerSessionCookie, createCache, createCartHandler, createCustomerAccountClient, createKotaoContext, createStorefrontClient, createWithCache, decodeCheckoutConsent, encodeCheckoutConsent, extractCheckoutDesignTokens, generateCacheControlHeader, isLocalePathSegment, localeFromAcceptLanguage, localeFromPathname, localeFromRequest, localizePath, originalPathnameFromRequest, readCartIdCookie, readCustomerSessionToken, readLocalizationCookie, resolveCheckoutUrl, shopHostname, signGeo, stripLocalePrefixFromPathname, stripLocalePrefixFromRequest, verifyGeo } from './chunk-U5677AEA.js';
+import { CART_FORM_ACTIONS, CONSENT_BUCKETS } from './chunk-OGWYTYYS.js';
+export { CART_FORM_ACTIONS, CONSENT_BUCKETS, CONSENT_COOKIE, DENIED_CONSENT, GRANTED_CONSENT, buildConsentCookie, isGranted, mergeConsent, parseConsent, readConsentCookie, serializeConsent } from './chunk-OGWYTYYS.js';
+
+// src/cart/useOptimisticCart.ts
+var recalculate = (cart, lines) => ({
+  ...cart,
+  lines,
+  totalQuantity: lines.reduce((sum, line) => sum + line.quantity, 0)
+});
+function applyOptimisticCartAction(cart, action) {
+  switch (action.action) {
+    case CART_FORM_ACTIONS.LinesAdd: {
+      const inputLines = action.inputs.lines ?? [];
+      const additions = inputLines.map((line) => ({
+        id: `optimistic:${line.merchandiseId}`,
+        quantity: line.quantity ?? 1,
+        merchandise: { id: line.merchandiseId },
+        attributes: []
+      }));
+      return recalculate(cart, [...cart.lines, ...additions]);
+    }
+    case CART_FORM_ACTIONS.LinesUpdate: {
+      const updates = new Map(
+        (action.inputs.lines ?? []).map(
+          (line) => [line.id, line]
+        )
+      );
+      const lines = cart.lines.map((line) => {
+        const update = updates.get(line.id);
+        if (!update) return line;
+        if (update.quantity === 0) return null;
+        return {
+          ...line,
+          quantity: update.quantity ?? line.quantity
+        };
+      }).filter((line) => line !== null);
+      return recalculate(cart, lines);
+    }
+    case CART_FORM_ACTIONS.LinesRemove: {
+      const remove = new Set(action.inputs.lineIds ?? []);
+      return recalculate(
+        cart,
+        cart.lines.filter((line) => !remove.has(line.id))
+      );
+    }
+    default:
+      return cart;
+  }
+}
+function useOptimisticCart(cart, action) {
+  return action ? applyOptimisticCartAction(cart, action) : cart;
+}
+
+// src/content-security-policy.ts
+var QUOTED_TOKENS = /* @__PURE__ */ new Set([
+  "self",
+  "none",
+  "unsafe-eval",
+  "unsafe-hashes",
+  "unsafe-inline",
+  "strict-dynamic",
+  "wasm-unsafe-eval"
+]);
+function createContentSecurityPolicy(options = {}) {
+  const nonce = createNonce();
+  const shopDomains = shopSources(options.shop);
+  const scriptSrc = uniqueSources([
+    ...normalizeSources(options.scriptSrc ?? ["self"]),
+    `'nonce-${nonce}'`
+  ]);
+  const connectSrc = uniqueSources([
+    "self",
+    ...shopDomains,
+    ...normalizeSources(options.connectSrc)
+  ]);
+  const imgSrc = uniqueSources([
+    "self",
+    "data:",
+    "https:",
+    ...shopDomains,
+    ...normalizeSources(options.imgSrc)
+  ]);
+  const styleSrc = uniqueSources(["self", "unsafe-inline", ...normalizeSources(options.styleSrc)]);
+  const directives = [
+    ["base-uri", ["'self'"]],
+    ["default-src", ["'self'"]],
+    ["connect-src", connectSrc],
+    ["img-src", imgSrc],
+    ["script-src", scriptSrc],
+    ["style-src", styleSrc]
+  ];
+  return {
+    nonce,
+    header: directives.map(([name, values]) => `${name} ${values.join(" ")}`).join("; "),
+    NonceProvider: createNonceProvider(nonce)
+  };
+}
+function createNonce() {
+  const bytes = new Uint8Array(18);
+  const runtimeCrypto = globalThis.crypto;
+  if (runtimeCrypto?.getRandomValues !== void 0) {
+    runtimeCrypto.getRandomValues(bytes);
+  } else {
+    for (let i = 0; i < bytes.length; i += 1) {
+      bytes[i] = Math.floor(Math.random() * 256);
+    }
+  }
+  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function shopSources(shop) {
+  if (shop === void 0) return [];
+  return [shop.storeDomain, shop.checkoutDomain].filter((domain) => domain !== void 0 && domain.trim() !== "").map((domain) => {
+    const trimmed = domain.trim();
+    return /^https?:\/\//i.test(trimmed) ? new URL(trimmed).origin : `https://${trimmed}`;
+  });
+}
+function normalizeSources(sources) {
+  return (sources ?? []).map((source) => {
+    const trimmed = source.trim();
+    return QUOTED_TOKENS.has(trimmed) ? `'${trimmed}'` : trimmed;
+  });
+}
+function uniqueSources(sources) {
+  return Array.from(new Set(sources.filter((source) => source.length > 0)));
+}
+
+// src/localization/handler.ts
+function safeReturnTo(raw) {
+  if (raw === null || raw === "") return { path: "/", safe: true };
+  return /^\/(?![/\\])/.test(raw) ? { path: raw, safe: true } : { path: "/", safe: false };
+}
+async function handleLocalizationPost(request) {
+  const form = await request.formData();
+  const country = (form.get("country_code") ?? "").toString().trim().toUpperCase() || null;
+  const locale = (form.get("locale_code") ?? "").toString().trim() || null;
+  const primaryLocale = (form.get("primary_locale") ?? "").toString().trim() || null;
+  const returnTo = safeReturnTo((form.get("return_to") ?? "").toString());
+  const location = returnTo.safe && primaryLocale !== null ? localizePath(returnTo.path, locale, { primaryLocale }) : returnTo.path;
+  return new Response(null, {
+    status: 302,
+    headers: { location, "set-cookie": buildLocalizationCookie({ country, locale }) }
+  });
+}
+
+// src/analytics/events.ts
+var ANALYTICS_EVENTS = {
+  pageViewed: "page_viewed",
+  productViewed: "product_viewed",
+  collectionViewed: "collection_viewed",
+  cartViewed: "cart_viewed",
+  searchViewed: "search_viewed",
+  productAddedToCart: "product_added_to_cart"
+};
+
+// src/analytics/shop.ts
+function getShopAnalytics(options) {
+  const language = options.storefront?.i18n?.language ?? null;
+  const country = options.storefront?.i18n?.country ?? null;
+  const currency = options.storefront?.i18n?.currency ?? null;
+  const acceptedLanguage = language != null && country != null ? `${language}-${country}` : language ?? country;
+  return {
+    ...acceptedLanguage != null ? { acceptedLanguage } : {},
+    ...currency != null ? { currency } : {},
+    ...options.publicStorefrontId != null ? { shopId: options.publicStorefrontId } : {},
+    ...options.publicStorefrontId != null ? { storefrontId: options.publicStorefrontId } : {}
+  };
+}
+
+// src/analytics/consent-encoding.ts
+var PARAM_PREFIX = "consent_";
+var RELATIVE_BASE = "https://kotao.invalid";
+function encodeConsent(state) {
+  const params = new URLSearchParams();
+  for (const bucket of CONSENT_BUCKETS)
+    params.set(`${PARAM_PREFIX}${bucket}`, state[bucket] ? "1" : "0");
+  return params;
+}
+function decodeConsent(params) {
+  const read = (bucket) => params.get(`${PARAM_PREFIX}${bucket}`) === "1";
+  return {
+    analytics: read("analytics"),
+    marketing: read("marketing"),
+    preferences: read("preferences")
+  };
+}
+function appendConsentToCheckoutUrl(checkoutUrl, state) {
+  if (!/^\/(?!\/)/.test(checkoutUrl)) {
+    throw new Error(`checkoutUrl must be a same-origin path starting with '/'; got: ${checkoutUrl}`);
+  }
+  const url = new URL(checkoutUrl, RELATIVE_BASE);
+  for (const [key, value] of encodeConsent(state)) url.searchParams.set(key, value);
+  return `${url.pathname}${url.search}${url.hash}`;
+}
+
+export { ANALYTICS_EVENTS, appendConsentToCheckoutUrl, applyOptimisticCartAction, createContentSecurityPolicy, decodeConsent, encodeConsent, getShopAnalytics, handleLocalizationPost, useOptimisticCart };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cart/useOptimisticCart.ts","../src/content-security-policy.ts","../src/localization/handler.ts","../src/analytics/events.ts","../src/analytics/shop.ts","../src/analytics/consent-encoding.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAIA,IAAM,WAAA,GAAc,CAAC,IAAA,EAAY,KAAA,MAAsC;AAAA,EACrE,GAAG,IAAA;AAAA,EACH,KAAA;AAAA,EACA,aAAA,EAAe,MAAM,MAAA,CAAO,CAAC,KAAK,IAAA,KAAS,GAAA,GAAM,IAAA,CAAK,QAAA,EAAU,CAAC;AACnE,CAAA,CAAA;AAEO,SAAS,yBAAA,CAA0B,MAAY,MAAA,EAAkC;AACtF,EAAA,QAAQ,OAAO,MAAA;AAAQ,IACrB,KAAK,kBAAkB,QAAA,EAAU;AAC/B,MAAA,MAAM,UAAA,GAAc,MAAA,CAAO,MAAA,CAAO,KAAA,IAAS,EAAC;AAI5C,MAAA,MAAM,SAAA,GAAY,UAAA,CAAW,GAAA,CAAc,CAAC,IAAA,MAAU;AAAA,QACpD,EAAA,EAAI,CAAA,WAAA,EAAc,IAAA,CAAK,aAAa,CAAA,CAAA;AAAA,QACpC,QAAA,EAAU,KAAK,QAAA,IAAY,CAAA;AAAA,QAC3B,WAAA,EAAa,EAAE,EAAA,EAAI,IAAA,CAAK,aAAA,EAAc;AAAA,QACtC,YAAY;AAAC,OACf,CAAE,CAAA;AACF,MAAA,OAAO,WAAA,CAAY,MAAM,CAAC,GAAG,KAAK,KAAA,EAAO,GAAG,SAAS,CAAC,CAAA;AAAA,IACxD;AAAA,IACA,KAAK,kBAAkB,WAAA,EAAa;AAClC,MAAA,MAAM,UAAU,IAAI,GAAA;AAAA,QAAA,CAChB,MAAA,CAAO,MAAA,CAAO,KAAA,IAAS,EAAC,EAAuD,GAAA;AAAA,UAC/E,CAAC,IAAA,KAAS,CAAC,IAAA,CAAK,IAAI,IAAI;AAAA;AAC1B,OACF;AACA,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAChB,GAAA,CAAI,CAAC,IAAA,KAAS;AACb,QAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,EAAE,CAAA;AAClC,QAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,QAAA,IAAI,MAAA,CAAO,QAAA,KAAa,CAAA,EAAG,OAAO,IAAA;AAClC,QAAA,OAAO;AAAA,UACL,GAAG,IAAA;AAAA,UACH,QAAA,EAAU,MAAA,CAAO,QAAA,IAAY,IAAA,CAAK;AAAA,SACpC;AAAA,MACF,CAAC,CAAA,CACA,MAAA,CAAO,CAAC,IAAA,KAA2B,SAAS,IAAI,CAAA;AACnD,MAAA,OAAO,WAAA,CAAY,MAAM,KAAK,CAAA;AAAA,IAChC;AAAA,IACA,KAAK,kBAAkB,WAAA,EAAa;AAClC,MAAA,MAAM,SAAS,IAAI,GAAA,CAAK,OAAO,MAAA,CAAO,OAAA,IAAW,EAAe,CAAA;AAChE,MAAA,OAAO,WAAA;AAAA,QACL,IAAA;AAAA,QACA,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,CAAC,IAAA,KAAS,CAAC,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,EAAE,CAAC;AAAA,OAClD;AAAA,IACF;AAAA,IACA;AACE,MAAA,OAAO,IAAA;AAAA;AAEb;AAMO,SAAS,iBAAA,CAAkB,MAAY,MAAA,EAAyC;AACrF,EAAA,OAAO,MAAA,GAAS,yBAAA,CAA0B,IAAA,EAAM,MAAM,CAAA,GAAI,IAAA;AAC5D;;;ACzCA,IAAM,aAAA,uBAAoB,GAAA,CAAI;AAAA,EAC5B,MAAA;AAAA,EACA,MAAA;AAAA,EACA,aAAA;AAAA,EACA,eAAA;AAAA,EACA,eAAA;AAAA,EACA,gBAAA;AAAA,EACA;AACF,CAAC,CAAA;AAEM,SAAS,2BAAA,CACd,OAAA,GAA8C,EAAC,EAClB;AAC7B,EAAA,MAAM,QAAQ,WAAA,EAAY;AAC1B,EAAA,MAAM,WAAA,GAAc,WAAA,CAAY,OAAA,CAAQ,IAAI,CAAA;AAC5C,EAAA,MAAM,YAAY,aAAA,CAAc;AAAA,IAC9B,GAAG,gBAAA,CAAiB,OAAA,CAAQ,SAAA,IAAa,CAAC,MAAM,CAAC,CAAA;AAAA,IACjD,UAAU,KAAK,CAAA,CAAA;AAAA,GAChB,CAAA;AACD,EAAA,MAAM,aAAa,aAAA,CAAc;AAAA,IAC/B,MAAA;AAAA,IACA,GAAG,WAAA;AAAA,IACH,GAAG,gBAAA,CAAiB,OAAA,CAAQ,UAAU;AAAA,GACvC,CAAA;AACD,EAAA,MAAM,SAAS,aAAA,CAAc;AAAA,IAC3B,MAAA;AAAA,IACA,OAAA;AAAA,IACA,QAAA;AAAA,IACA,GAAG,WAAA;AAAA,IACH,GAAG,gBAAA,CAAiB,OAAA,CAAQ,MAAM;AAAA,GACnC,CAAA;AACD,EAAA,MAAM,QAAA,GAAW,aAAA,CAAc,CAAC,MAAA,EAAQ,eAAA,EAAiB,GAAG,gBAAA,CAAiB,OAAA,CAAQ,QAAQ,CAAC,CAAC,CAAA;AAC/F,EAAA,MAAM,UAAA,GAAa;AAAA,IACjB,CAAC,UAAA,EAAY,CAAC,QAAQ,CAAC,CAAA;AAAA,IACvB,CAAC,aAAA,EAAe,CAAC,QAAQ,CAAC,CAAA;AAAA,IAC1B,CAAC,eAAe,UAAU,CAAA;AAAA,IAC1B,CAAC,WAAW,MAAM,CAAA;AAAA,IAClB,CAAC,cAAc,SAAS,CAAA;AAAA,IACxB,CAAC,aAAa,QAAQ;AAAA,GACxB;AACA,EAAA,OAAO;AAAA,IACL,KAAA;AAAA,IACA,QAAQ,UAAA,CACL,GAAA,CAAI,CAAC,CAAC,IAAA,EAAM,MAAM,CAAA,KAAM,CAAA,EAAG,IAAI,CAAA,CAAA,EAAK,OAA6B,IAAA,CAAK,GAAG,CAAC,CAAA,CAAE,CAAA,CAC5E,KAAK,IAAI,CAAA;AAAA,IACZ,aAAA,EAAe,oBAAoB,KAAK;AAAA,GAC1C;AACF;AAEA,SAAS,WAAA,GAAsB;AAC7B,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,EAAE,CAAA;AAC/B,EAAA,MAAM,gBAAiB,UAAA,CAAuD,MAAA;AAC9E,EAAA,IAAI,aAAA,EAAe,oBAAoB,MAAA,EAAW;AAChD,IAAA,aAAA,CAAc,gBAAgB,KAAK,CAAA;AAAA,EACrC,CAAA,MAAO;AACL,IAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,MAAA,EAAQ,KAAK,CAAA,EAAG;AACxC,MAAA,KAAA,CAAM,CAAC,CAAA,GAAI,IAAA,CAAK,MAAM,IAAA,CAAK,MAAA,KAAW,GAAG,CAAA;AAAA,IAC3C;AAAA,EACF;AACA,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,KAAA,EAAO,CAAC,SAAS,IAAA,CAAK,QAAA,CAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AAChF;AAEA,SAAS,YAAY,IAAA,EAAgE;AACnF,EAAA,IAAI,IAAA,KAAS,MAAA,EAAW,OAAO,EAAC;AAChC,EAAA,OAAO,CAAC,IAAA,CAAK,WAAA,EAAa,KAAK,cAAc,CAAA,CAC1C,OAAO,CAAC,MAAA,KAA6B,MAAA,KAAW,MAAA,IAAa,OAAO,IAAA,EAAK,KAAM,EAAE,CAAA,CACjF,GAAA,CAAI,CAAC,MAAA,KAAW;AACf,IAAA,MAAM,OAAA,GAAU,OAAO,IAAA,EAAK;AAC5B,IAAA,OAAO,eAAA,CAAgB,IAAA,CAAK,OAAO,CAAA,GAAI,IAAI,IAAI,OAAO,CAAA,CAAE,MAAA,GAAS,CAAA,QAAA,EAAW,OAAO,CAAA,CAAA;AAAA,EACrF,CAAC,CAAA;AACL;AAEA,SAAS,iBAAiB,OAAA,EAA2D;AACnF,EAAA,OAAA,CAAQ,OAAA,IAAW,EAAC,EAAG,GAAA,CAAI,CAAC,MAAA,KAAW;AACrC,IAAA,MAAM,OAAA,GAAU,OAAO,IAAA,EAAK;AAC5B,IAAA,OAAO,cAAc,GAAA,CAAI,OAAO,CAAA,GAAI,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA,CAAA,GAAM,OAAA;AAAA,EACvD,CAAC,CAAA;AACH;AAEA,SAAS,cAAc,OAAA,EAA+C;AACpE,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,IAAI,GAAA,CAAI,OAAA,CAAQ,MAAA,CAAO,CAAC,MAAA,KAAW,MAAA,CAAO,MAAA,GAAS,CAAC,CAAC,CAAC,CAAA;AAC1E;;;AClGA,SAAS,aAAa,GAAA,EAAqD;AACzE,EAAA,IAAI,GAAA,KAAQ,QAAQ,GAAA,KAAQ,EAAA,SAAW,EAAE,IAAA,EAAM,GAAA,EAAK,IAAA,EAAM,IAAA,EAAK;AAC/D,EAAA,OAAO,cAAA,CAAe,IAAA,CAAK,GAAG,CAAA,GAAI,EAAE,IAAA,EAAM,GAAA,EAAK,IAAA,EAAM,IAAA,EAAK,GAAI,EAAE,IAAA,EAAM,GAAA,EAAK,MAAM,KAAA,EAAM;AACzF;AAEA,eAAsB,uBAAuB,OAAA,EAAqC;AAChF,EAAA,MAAM,IAAA,GAAO,MAAM,OAAA,CAAQ,QAAA,EAAS;AACpC,EAAA,MAAM,OAAA,GAAA,CAAW,IAAA,CAAK,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA,EAAI,QAAA,EAAS,CAAE,IAAA,EAAK,CAAE,WAAA,EAAY,IAAK,IAAA;AACpF,EAAA,MAAM,MAAA,GAAA,CAAU,KAAK,GAAA,CAAI,aAAa,KAAK,EAAA,EAAI,QAAA,EAAS,CAAE,IAAA,EAAK,IAAK,IAAA;AACpE,EAAA,MAAM,aAAA,GAAA,CAAiB,KAAK,GAAA,CAAI,gBAAgB,KAAK,EAAA,EAAI,QAAA,EAAS,CAAE,IAAA,EAAK,IAAK,IAAA;AAC9E,EAAA,MAAM,QAAA,GAAW,cAAc,IAAA,CAAK,GAAA,CAAI,WAAW,CAAA,IAAK,EAAA,EAAI,UAAU,CAAA;AACtE,EAAA,MAAM,QAAA,GACJ,QAAA,CAAS,IAAA,IAAQ,aAAA,KAAkB,IAAA,GAC/B,YAAA,CAAa,QAAA,CAAS,IAAA,EAAM,MAAA,EAAQ,EAAE,aAAA,EAAe,IACrD,QAAA,CAAS,IAAA;AACf,EAAA,OAAO,IAAI,SAAS,IAAA,EAAM;AAAA,IACxB,MAAA,EAAQ,GAAA;AAAA,IACR,OAAA,EAAS,EAAE,QAAA,EAAU,YAAA,EAAc,wBAAwB,EAAE,OAAA,EAAS,MAAA,EAAQ,CAAA;AAAE,GACjF,CAAA;AACH;;;ACTO,IAAM,gBAAA,GAAmB;AAAA,EAC9B,UAAA,EAAY,aAAA;AAAA,EACZ,aAAA,EAAe,gBAAA;AAAA,EACf,gBAAA,EAAkB,mBAAA;AAAA,EAClB,UAAA,EAAY,aAAA;AAAA,EACZ,YAAA,EAAc,eAAA;AAAA,EACd,kBAAA,EAAoB;AACtB;;;ACFO,SAAS,iBAAiB,OAAA,EAAiD;AAChF,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,UAAA,EAAY,IAAA,EAAM,QAAA,IAAY,IAAA;AACvD,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,UAAA,EAAY,IAAA,EAAM,OAAA,IAAW,IAAA;AACrD,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,UAAA,EAAY,IAAA,EAAM,QAAA,IAAY,IAAA;AACvD,EAAA,MAAM,gBAAA,GACJ,QAAA,IAAY,IAAA,IAAQ,OAAA,IAAW,IAAA,GAAO,GAAG,QAAQ,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA,GAAM,QAAA,IAAY,OAAA;AAEhF,EAAA,OAAO;AAAA,IACL,GAAI,gBAAA,IAAoB,IAAA,GAAO,EAAE,gBAAA,KAAqB,EAAC;AAAA,IACvD,GAAI,QAAA,IAAY,IAAA,GAAO,EAAE,QAAA,KAAa,EAAC;AAAA,IACvC,GAAI,QAAQ,kBAAA,IAAsB,IAAA,GAAO,EAAE,MAAA,EAAQ,OAAA,CAAQ,kBAAA,EAAmB,GAAI,EAAC;AAAA,IACnF,GAAI,QAAQ,kBAAA,IAAsB,IAAA,GAAO,EAAE,YAAA,EAAc,OAAA,CAAQ,kBAAA,EAAmB,GAAI;AAAC,GAC3F;AACF;;;ACxBA,IAAM,YAAA,GAAe,UAAA;AACrB,IAAM,aAAA,GAAgB,uBAAA;AAEf,SAAS,cAAc,KAAA,EAAsC;AAClE,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,EAAgB;AACnC,EAAA,KAAA,MAAW,MAAA,IAAU,eAAA;AACnB,IAAA,MAAA,CAAO,GAAA,CAAI,CAAA,EAAG,YAAY,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,MAAM,CAAA,GAAI,GAAA,GAAM,GAAG,CAAA;AAClE,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,cAAc,MAAA,EAAuC;AACnE,EAAA,MAAM,IAAA,GAAO,CAAC,MAAA,KAAmC,MAAA,CAAO,GAAA,CAAI,GAAG,YAAY,CAAA,EAAG,MAAM,CAAA,CAAE,CAAA,KAAM,GAAA;AAC5F,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,KAAK,WAAW,CAAA;AAAA,IAC3B,SAAA,EAAW,KAAK,WAAW,CAAA;AAAA,IAC3B,WAAA,EAAa,KAAK,aAAa;AAAA,GACjC;AACF;AAEO,SAAS,0BAAA,CAA2B,aAAqB,KAAA,EAA6B;AAG3F,EAAA,IAAI,CAAC,WAAA,CAAY,IAAA,CAAK,WAAW,CAAA,EAAG;AAClC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,+DAAA,EAAkE,WAAW,CAAA,CAAE,CAAA;AAAA,EACjG;AACA,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,WAAA,EAAa,aAAa,CAAA;AAC9C,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,CAAA,IAAK,aAAA,CAAc,KAAK,CAAA,EAAG,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAChF,EAAA,OAAO,CAAA,EAAG,IAAI,QAAQ,CAAA,EAAG,IAAI,MAAM,CAAA,EAAG,IAAI,IAAI,CAAA,CAAA;AAChD","file":"index.js","sourcesContent":["import { CART_FORM_ACTIONS } from './actions'\nimport type { CartDispatchAction } from './createCartHandler'\nimport type { Cart, CartLine } from './types'\n\nconst recalculate = (cart: Cart, lines: readonly CartLine[]): Cart => ({\n  ...cart,\n  lines,\n  totalQuantity: lines.reduce((sum, line) => sum + line.quantity, 0),\n})\n\nexport function applyOptimisticCartAction(cart: Cart, action: CartDispatchAction): Cart {\n  switch (action.action) {\n    case CART_FORM_ACTIONS.LinesAdd: {\n      const inputLines = (action.inputs.lines ?? []) as Array<{\n        merchandiseId: string\n        quantity?: number | null\n      }>\n      const additions = inputLines.map<CartLine>((line) => ({\n        id: `optimistic:${line.merchandiseId}`,\n        quantity: line.quantity ?? 1,\n        merchandise: { id: line.merchandiseId },\n        attributes: [],\n      }))\n      return recalculate(cart, [...cart.lines, ...additions])\n    }\n    case CART_FORM_ACTIONS.LinesUpdate: {\n      const updates = new Map(\n        ((action.inputs.lines ?? []) as Array<{ id: string; quantity?: number | null }>).map(\n          (line) => [line.id, line],\n        ),\n      )\n      const lines = cart.lines\n        .map((line) => {\n          const update = updates.get(line.id)\n          if (!update) return line\n          if (update.quantity === 0) return null\n          return {\n            ...line,\n            quantity: update.quantity ?? line.quantity,\n          }\n        })\n        .filter((line): line is CartLine => line !== null)\n      return recalculate(cart, lines)\n    }\n    case CART_FORM_ACTIONS.LinesRemove: {\n      const remove = new Set((action.inputs.lineIds ?? []) as string[])\n      return recalculate(\n        cart,\n        cart.lines.filter((line) => !remove.has(line.id)),\n      )\n    }\n    default:\n      return cart\n  }\n}\n\n/**\n * Pure optimistic helper for React integrations. A React wrapper can call this from `useOptimistic`;\n * keeping the reducer pure lets non-React tests exercise the exact overlay behavior.\n */\nexport function useOptimisticCart(cart: Cart, action: CartDispatchAction | null): Cart {\n  return action ? applyOptimisticCartAction(cart, action) : cart\n}\n","import { createNonceProvider, type BoundNonceProvider } from './react/nonce'\n\nexport interface ContentSecurityPolicyShop {\n  readonly checkoutDomain?: string\n  readonly storeDomain?: string\n}\n\nexport interface CreateContentSecurityPolicyOptions {\n  readonly shop?: ContentSecurityPolicyShop\n  readonly scriptSrc?: readonly string[]\n  readonly connectSrc?: readonly string[]\n  readonly imgSrc?: readonly string[]\n  readonly styleSrc?: readonly string[]\n}\n\nexport interface ContentSecurityPolicyResult {\n  readonly nonce: string\n  readonly header: string\n  readonly NonceProvider: BoundNonceProvider\n}\n\nconst QUOTED_TOKENS = new Set([\n  'self',\n  'none',\n  'unsafe-eval',\n  'unsafe-hashes',\n  'unsafe-inline',\n  'strict-dynamic',\n  'wasm-unsafe-eval',\n])\n\nexport function createContentSecurityPolicy(\n  options: CreateContentSecurityPolicyOptions = {},\n): ContentSecurityPolicyResult {\n  const nonce = createNonce()\n  const shopDomains = shopSources(options.shop)\n  const scriptSrc = uniqueSources([\n    ...normalizeSources(options.scriptSrc ?? ['self']),\n    `'nonce-${nonce}'`,\n  ])\n  const connectSrc = uniqueSources([\n    'self',\n    ...shopDomains,\n    ...normalizeSources(options.connectSrc),\n  ])\n  const imgSrc = uniqueSources([\n    'self',\n    'data:',\n    'https:',\n    ...shopDomains,\n    ...normalizeSources(options.imgSrc),\n  ])\n  const styleSrc = uniqueSources(['self', 'unsafe-inline', ...normalizeSources(options.styleSrc)])\n  const directives = [\n    ['base-uri', [\"'self'\"]],\n    ['default-src', [\"'self'\"]],\n    ['connect-src', connectSrc],\n    ['img-src', imgSrc],\n    ['script-src', scriptSrc],\n    ['style-src', styleSrc],\n  ]\n  return {\n    nonce,\n    header: directives\n      .map(([name, values]) => `${name} ${(values as readonly string[]).join(' ')}`)\n      .join('; '),\n    NonceProvider: createNonceProvider(nonce),\n  }\n}\n\nfunction createNonce(): string {\n  const bytes = new Uint8Array(18)\n  const runtimeCrypto = (globalThis as typeof globalThis & { crypto?: Crypto }).crypto\n  if (runtimeCrypto?.getRandomValues !== undefined) {\n    runtimeCrypto.getRandomValues(bytes)\n  } else {\n    for (let i = 0; i < bytes.length; i += 1) {\n      bytes[i] = Math.floor(Math.random() * 256)\n    }\n  }\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join('')\n}\n\nfunction shopSources(shop: ContentSecurityPolicyShop | undefined): readonly string[] {\n  if (shop === undefined) return []\n  return [shop.storeDomain, shop.checkoutDomain]\n    .filter((domain): domain is string => domain !== undefined && domain.trim() !== '')\n    .map((domain) => {\n      const trimmed = domain.trim()\n      return /^https?:\\/\\//i.test(trimmed) ? new URL(trimmed).origin : `https://${trimmed}`\n    })\n}\n\nfunction normalizeSources(sources: readonly string[] | undefined): readonly string[] {\n  return (sources ?? []).map((source) => {\n    const trimmed = source.trim()\n    return QUOTED_TOKENS.has(trimmed) ? `'${trimmed}'` : trimmed\n  })\n}\n\nfunction uniqueSources(sources: readonly string[]): readonly string[] {\n  return Array.from(new Set(sources.filter((source) => source.length > 0)))\n}\n","import { buildLocalizationCookie } from './cookie'\nimport { localizePath } from './routing'\n\n/** Same-origin path only: must start with a single '/', not '//' or '/\\'. */\nfunction safeReturnTo(raw: string | null): { path: string; safe: boolean } {\n  if (raw === null || raw === '') return { path: '/', safe: true }\n  return /^\\/(?![/\\\\])/.test(raw) ? { path: raw, safe: true } : { path: '/', safe: false }\n}\n\nexport async function handleLocalizationPost(request: Request): Promise<Response> {\n  const form = await request.formData()\n  const country = (form.get('country_code') ?? '').toString().trim().toUpperCase() || null\n  const locale = (form.get('locale_code') ?? '').toString().trim() || null\n  const primaryLocale = (form.get('primary_locale') ?? '').toString().trim() || null\n  const returnTo = safeReturnTo((form.get('return_to') ?? '').toString())\n  const location =\n    returnTo.safe && primaryLocale !== null\n      ? localizePath(returnTo.path, locale, { primaryLocale })\n      : returnTo.path\n  return new Response(null, {\n    status: 302,\n    headers: { location, 'set-cookie': buildLocalizationCookie({ country, locale }) },\n  })\n}\n","/**\n * Coarse visitor geo attached to pixel events — structurally the SDK's `context.geo` (a `Geo` value is\n * assignable here). Declared locally so the analytics surface (and its DOM/React preset) need not pull\n * in the geo crypto module.\n */\nexport interface AnalyticsGeo {\n  readonly country: string | null\n  readonly city: string | null\n  readonly colo: string | null\n  readonly botScore: number | null\n  readonly clientIp: string | null\n}\n\n/** The standard storefront analytics events (Hydrogen-shaped names). */\nexport const ANALYTICS_EVENTS = {\n  pageViewed: 'page_viewed',\n  productViewed: 'product_viewed',\n  collectionViewed: 'collection_viewed',\n  cartViewed: 'cart_viewed',\n  searchViewed: 'search_viewed',\n  productAddedToCart: 'product_added_to_cart',\n} as const\n\nexport type AnalyticsEventName = (typeof ANALYTICS_EVENTS)[keyof typeof ANALYTICS_EVENTS]\n\n/** Ambient context the provider attaches to every event before it reaches the pixel. */\nexport interface AnalyticsContext {\n  readonly shopId?: string\n  readonly url?: string\n  readonly geo?: AnalyticsGeo\n}\n\nexport interface PageViewedPayload {\n  readonly title?: string\n}\nexport interface ProductViewedPayload {\n  readonly productId: string\n  readonly handle?: string\n}\nexport interface CollectionViewedPayload {\n  readonly collectionId: string\n  readonly handle?: string\n}\nexport interface CartViewedPayload {\n  readonly cartId?: string\n}\nexport interface SearchViewedPayload {\n  readonly query: string\n  readonly resultCount?: number\n}\nexport interface ProductAddedToCartPayload {\n  readonly productId: string\n  readonly variantId: string\n  readonly quantity: number\n}\n\n/** Event name → payload (the typed pub/sub surface). */\nexport interface AnalyticsEventMap {\n  page_viewed: PageViewedPayload\n  product_viewed: ProductViewedPayload\n  collection_viewed: CollectionViewedPayload\n  cart_viewed: CartViewedPayload\n  search_viewed: SearchViewedPayload\n  product_added_to_cart: ProductAddedToCartPayload\n}\n\n/** A pixel-bound event: the name, its payload, the ambient context, a timestamp, and consent state. */\nexport interface PixelEvent<E extends AnalyticsEventName = AnalyticsEventName> {\n  readonly event: E\n  readonly payload: AnalyticsEventMap[E]\n  readonly context: AnalyticsContext\n  readonly timestamp: string\n  /** Whether the analytics-consent bucket was granted when this event was recorded. */\n  readonly consent: boolean\n}\n","export interface ShopAnalytics {\n  readonly acceptedLanguage?: string\n  readonly currency?: string\n  readonly shopId?: string\n  readonly storefrontId?: string\n}\n\nexport interface GetShopAnalyticsOptions {\n  readonly publicStorefrontId?: string\n  readonly storefront?: {\n    readonly i18n?: {\n      readonly country?: string | null\n      readonly currency?: string | null\n      readonly language?: string | null\n      readonly pathPrefix?: string | null\n    } | null\n  } | null\n}\n\nexport function getShopAnalytics(options: GetShopAnalyticsOptions): ShopAnalytics {\n  const language = options.storefront?.i18n?.language ?? null\n  const country = options.storefront?.i18n?.country ?? null\n  const currency = options.storefront?.i18n?.currency ?? null\n  const acceptedLanguage =\n    language != null && country != null ? `${language}-${country}` : (language ?? country)\n\n  return {\n    ...(acceptedLanguage != null ? { acceptedLanguage } : {}),\n    ...(currency != null ? { currency } : {}),\n    ...(options.publicStorefrontId != null ? { shopId: options.publicStorefrontId } : {}),\n    ...(options.publicStorefrontId != null ? { storefrontId: options.publicStorefrontId } : {}),\n  }\n}\n","import { CONSENT_BUCKETS, type ConsentBucket, type ConsentState } from './consent'\n\n/**\n * Encode/decode consent into the `cart.checkoutUrl` handoff (query params), mirroring Shopify's\n * server-set-consent direction (design §Checkout handoff). The handoff target is the Gateway-owned\n * same-origin `/checkout/*` path — `appendConsentToCheckoutUrl` preserves a relative URL as relative\n * so it never points at a separate subdomain.\n */\nconst PARAM_PREFIX = 'consent_'\nconst RELATIVE_BASE = 'https://kotao.invalid'\n\nexport function encodeConsent(state: ConsentState): URLSearchParams {\n  const params = new URLSearchParams()\n  for (const bucket of CONSENT_BUCKETS)\n    params.set(`${PARAM_PREFIX}${bucket}`, state[bucket] ? '1' : '0')\n  return params\n}\n\nexport function decodeConsent(params: URLSearchParams): ConsentState {\n  const read = (bucket: ConsentBucket): boolean => params.get(`${PARAM_PREFIX}${bucket}`) === '1'\n  return {\n    analytics: read('analytics'),\n    marketing: read('marketing'),\n    preferences: read('preferences'),\n  }\n}\n\nexport function appendConsentToCheckoutUrl(checkoutUrl: string, state: ConsentState): string {\n  // The checkout handoff is the same-origin `/checkout/*` path (cart.checkoutUrl is relative). Reject\n  // absolute or protocol-relative URLs so consent params never ride to another origin.\n  if (!/^\\/(?!\\/)/.test(checkoutUrl)) {\n    throw new Error(`checkoutUrl must be a same-origin path starting with '/'; got: ${checkoutUrl}`)\n  }\n  const url = new URL(checkoutUrl, RELATIVE_BASE)\n  for (const [key, value] of encodeConsent(state)) url.searchParams.set(key, value)\n  return `${url.pathname}${url.search}${url.hash}`\n}\n"]}

package/dist/pagination-CPgH3fAa.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Framework-agnostic cursor pagination (ADR-0003 §SDK). Mirrors Shopify Hydrogen's
+ * `getPaginationVariables` + `<Pagination>` over a relay-style connection
+ * (`{ nodes, pageInfo { hasNextPage, hasPreviousPage, startCursor, endCursor } }`). Generic over the
+ * connection's node type, so it works with any Storefront API connection (today: `Cart.lines`).
+ *
+ * Pure logic, no React — the React `<Pagination>` render-props component is a thin wrapper.
+ */
+/** Relay PageInfo as the Storefront API emits it. */
+interface PageInfo {
+    readonly hasNextPage: boolean;
+    readonly hasPreviousPage: boolean;
+    readonly startCursor?: string | null;
+    readonly endCursor?: string | null;
+}
+interface Connection<T> {
+    readonly nodes: readonly T[];
+    readonly pageInfo: PageInfo;
+}
+interface ConnectionEdge<T> {
+    readonly node?: T | null;
+}
+interface FlattenableConnection<T> {
+    readonly nodes?: T[] | readonly T[] | null;
+    readonly edges?: readonly (ConnectionEdge<T> | null)[] | null;
+}
+type IsAny<T> = 0 extends 1 & T ? true : false;
+type NodeFromConnection<C> = IsAny<C> extends true ? any : C extends {
+    readonly nodes?: readonly (infer Node)[] | null;
+} ? Node : C extends {
+    readonly edges?: readonly (infer Edge | null)[] | null;
+} ? Edge extends {
+    readonly node?: infer Node | null;
+} ? NonNullable<Node> : unknown : unknown;
+/**
+ * Hydrogen-compatible connection flattener. Shopify code often accepts either Storefront API
+ * `nodes` connections or Relay `edges[].node` connections; migrated routes can keep that shape.
+ */
+declare function flattenConnection(connection: null | undefined): [];
+declare function flattenConnection<T>(connection: FlattenableConnection<T>): T[];
+declare function flattenConnection<C extends FlattenableConnection<unknown>>(connection: C | null | undefined): NodeFromConnection<C>[];
+/** The query variables a connection field takes for forward/backward paging. */
+interface PaginationVariables {
+    first?: number;
+    last?: number;
+    startCursor?: string;
+    endCursor?: string;
+}
+interface PaginationOptions {
+    pageSize?: number;
+    pageBy?: number;
+    /** Isolates the URL params when multiple paginations share a page (`{ns}_direction`/`{ns}_cursor`). */
+    namespace?: string;
+}
+/**
+ * Read `direction`/`cursor` from the request URL and return the connection variables for the page:
+ * forward → `{ first, endCursor }`, backward → `{ last, startCursor }`, no params → `{ first }`.
+ */
+declare function getPaginationVariables(input: URL | Request | URLSearchParams | string, options: PaginationOptions): PaginationVariables;
+interface PaginationInfo<T> {
+    readonly nodes: readonly T[];
+    readonly hasNextPage: boolean;
+    readonly hasPreviousPage: boolean;
+    /** Same-page URL with `direction=next` + the end cursor; absent when there is no next page. */
+    readonly nextPageUrl: string;
+    /** Same-page URL with `direction=previous` + the start cursor; absent when there is no previous page. */
+    readonly prevPageUrl: string;
+}
+/**
+ * Decorate a connection with the current page's nodes + the next/previous page URLs (built from the
+ * current URL + the connection's cursors). A theme renders links to `nextPageUrl`/`prevPageUrl`.
+ */
+declare function getPaginationInfo<T>(connection: Connection<T>, currentUrl: URL | string, options?: {
+    namespace?: string;
+}): PaginationInfo<T>;
+
+export { type Connection as C, type FlattenableConnection as F, type PageInfo as P, type ConnectionEdge as a, type PaginationInfo as b, type PaginationOptions as c, type PaginationVariables as d, getPaginationVariables as e, flattenConnection as f, getPaginationInfo as g };

package/dist/product.d.ts

@@ -0,0 +1,105 @@
+import { F as FlattenableConnection } from './pagination-CPgH3fAa.js';
+import { ProductOptionValueSwatch, Image } from './storefront-api-types.js';
+
+/**
+ * Framework-agnostic variant selection (ADR-0003 §SDK). Mirrors Shopify Hydrogen's MODERN approach —
+ * `getProductOptions` as a utility, not the deprecated `<VariantSelector>` component — adapted to the
+ * Kotao Storefront API `Product` shape (`options { name values }` + `variants { selectedOptions }`).
+ * A theme renders the returned grid however it likes and resolves the chosen variant.
+ *
+ * Pure logic, no React, so it stays in the SDK core and is reused by SSR and any framework preset.
+ */
+
+/** One option name + its chosen value on a variant (Storefront API SelectedOption). */
+interface SelectedOption {
+    readonly name: string;
+    readonly value: string;
+}
+/** A product option definition: a name and its distinct values, in display order. */
+interface ProductOptionDef {
+    readonly name: string;
+    readonly optionValues?: readonly (string | {
+        readonly name?: string;
+        readonly value?: string;
+        readonly swatch?: ProductOptionValueSwatch | null;
+    })[];
+    readonly values?: readonly string[];
+}
+/** The minimal variant shape variant-selection needs. `availableForSale` is optional — the Storefront
+ * API does not expose stock yet (inventory deferred), so a missing value is treated as available. */
+interface VariantSelectionLike {
+    readonly id: string;
+    readonly availableForSale?: boolean | null;
+    readonly selectedOptions: readonly SelectedOption[];
+}
+interface VariantLike extends VariantSelectionLike {
+    readonly compareAtPrice?: {
+        readonly amount: string;
+        readonly currencyCode: string;
+    } | null;
+    readonly image?: Pick<Image, 'altText' | 'height' | 'url' | 'width' | 'id'> | null;
+    readonly price: {
+        readonly amount: string;
+        readonly currencyCode: string;
+    };
+    readonly product: {
+        readonly handle: string;
+        readonly id?: string | null;
+        readonly title: string;
+    };
+    readonly selectedOptions: SelectedOption[];
+    readonly sku?: string | null;
+    readonly title?: string;
+}
+interface ProductLike {
+    readonly options: readonly ProductOptionDef[];
+    readonly handle?: string | null;
+    readonly variants: readonly VariantSelectionLike[] | FlattenableConnection<VariantSelectionLike>;
+    readonly selectedOrFirstAvailableVariant?: VariantSelectionLike | null;
+}
+/** A selection map: option name → chosen value. */
+type SelectedOptionsMap = Readonly<Record<string, string>>;
+/** One value of one option, decorated with selection/availability state for rendering. */
+interface ProductOptionValueState {
+    readonly name: string;
+    readonly value: string;
+    /** This value is the current selection for its option. */
+    readonly selected: boolean;
+    /** A variant exists for this value combined with the other currently-selected options. */
+    readonly exists: boolean;
+    /** That variant is purchasable (availableForSale; true when availability is unknown). */
+    readonly available: boolean;
+    /** The variant choosing this value (holding the other selected options) would land on, if any. */
+    readonly variant: VariantSelectionLike | null;
+    readonly handle: string;
+    readonly isDifferentProduct: boolean;
+    readonly swatch?: ProductOptionValueSwatch | null;
+    readonly variantUriQuery: string;
+}
+interface ProductOptionState {
+    readonly name: string;
+    readonly optionValues: readonly ProductOptionValueState[];
+    readonly values: readonly ProductOptionValueState[];
+}
+type MappedProductOptions = ProductOptionState;
+/** `[{ name: 'Size', value: 'M' }]` → `{ Size: 'M' }`. Mirrors Hydrogen mapSelectedProductOptionToObject. */
+declare function mapSelectedProductOptionToObject(selectedOptions: readonly SelectedOption[]): SelectedOptionsMap;
+/**
+ * The variant fully matching `selected` (every chosen option name → value), or null. Returns null
+ * unless the selection is unambiguous — a partial selection that matches several variants yields null.
+ */
+declare function getSelectedVariant(variants: readonly VariantSelectionLike[], selected: SelectedOptionsMap): VariantSelectionLike | null;
+/**
+ * Decorate each option value with `selected`/`exists`/`available` + the variant it resolves to, given
+ * the buyer's current `selected` map. `exists`/`available` hold the OTHER selected options fixed (so a
+ * swatch greys out when its combination is unbuyable) — Hydrogen's getProductOptions semantics.
+ */
+declare function getProductOptions(product: ProductLike, selected?: SelectedOptionsMap): ProductOptionState[];
+declare function getSelectedProductOptions(input: URL | Request | URLSearchParams | string): SelectedOption[];
+declare function getAdjacentAndFirstAvailableVariants(product: {
+    readonly variants?: readonly VariantLike[] | FlattenableConnection<VariantLike> | null;
+}): VariantLike[];
+declare function useOptimisticVariant(selectedVariant: VariantLike | null | undefined, variants?: readonly VariantLike[] | FlattenableConnection<VariantLike>): VariantLike;
+declare function useSelectedOptionInUrlParam(_selectedOptions: readonly SelectedOption[]): void;
+
+export { type MappedProductOptions, type ProductLike, type ProductOptionDef, type ProductOptionState, type ProductOptionValueState, type SelectedOption, type SelectedOptionsMap, type VariantLike, type VariantSelectionLike, getAdjacentAndFirstAvailableVariants, getProductOptions, getSelectedProductOptions, getSelectedVariant, mapSelectedProductOptionToObject, useOptimisticVariant, useSelectedOptionInUrlParam };

package/dist/product.js

@@ -0,0 +1,4 @@
+export { getAdjacentAndFirstAvailableVariants, getProductOptions, getSelectedProductOptions, getSelectedVariant, mapSelectedProductOptionToObject, useOptimisticVariant, useSelectedOptionInUrlParam } from './chunk-QOEEUTHQ.js';
+import './chunk-5QOFKGKD.js';
+//# sourceMappingURL=product.js.map
+//# sourceMappingURL=product.js.map

package/dist/product.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"product.js"}