@kotao/storefront 0.2.4 → 0.2.6

package/README.md

@@ -14,14 +14,62 @@ frozen intra-request clock).
 | `CacheShort` / `CacheLong` / `CacheNone` | `CacheShort` / `CacheLong` / `CacheNone` / `CacheCustom` | plus `StorefrontDefaultCache` (fresh 1s / serve ~1 day)           |
 | `createHydrogenContext`                  | `createKotaoContext`                                     | storefront + geo + cache + locale + session seam                  |
 | Oxygen `request.cf`                      | `context.geo`                                            | backed by signed `x-kotao-*` headers; `null` if unsigned/tampered |
-| (Oxygen-managed)                         | `@kotao/storefront/react-router`                         | RR7 `getKotaoLoadContext`                                         |
+| (Oxygen-managed)                         | `@kotao/storefront/react-router`                         | RR8 `getKotaoLoadContext`                                         |
 
 The one real migration diff is `request.cf` → `context.geo`.
 
 ## Entry points
 
 - `@kotao/storefront` — framework-agnostic core (no React Router import).
-- `@kotao/storefront/react-router` — the React Router 7 binding (`getKotaoLoadContext`).
+- `@kotao/storefront/editor` — Liquid settings bridge plus the authenticated, bounded Hydrogen
+  component-instance protocol and preview store.
+- `@kotao/storefront/react` — Hydrogen-shaped React components and editor-only component
+  boundaries/registry helpers.
+- `@kotao/storefront/react-router` — the React Router 8 binding (`getKotaoLoadContext`).
+
+## Hydrogen editor preview
+
+`createHydrogenEditorPreviewRuntime` projects manifest-authorized operations into an in-memory
+instance tree. The source manifest and Git base remain authoritative; this store never writes source
+or becomes public configuration. Each message is bound to the exact admin/preview origin, expected
+window, session, base SHA, manifest hash, channel nonce, short-lived preview token, protocol version,
+message ID, and monotonic sequence. Payloads fail closed above 128 KiB/depth 32, and at most 100
+authenticated messages are buffered before Ready.
+
+React themes mount `HydrogenEditorProvider` only in authenticated editor previews, mark extracted
+instances with `HydrogenEditorBoundary`, and use `HydrogenEditorSlot` for declared insertion
+boundaries. Per-instance subscriptions let prop/style changes reconcile only the affected subtree;
+route, loader, Suspense, and HMR reconciliation retains draft operations and reports whether the
+selection is active or out of route. Ordinary public storefront responses must not mount these
+overlays or receive editor credentials.
+
+Preview servers turn the opaque token into browser-safe runtime configuration with
+`createHydrogenEditorPreviewBootstrap`. The `expected` binding must come from the trusted edit
+session, never from request parameters:
+
+```ts
+const editorBootstrap = await createHydrogenEditorPreviewBootstrap({
+  token: requestToken,
+  secret: env.HYDROGEN_EDITOR_PREVIEW_GRANT_SECRET,
+  expected: trustedEditSession.previewBinding,
+  now: Date.now(),
+})
+```
+
+An invalid, missing, expired, or incorrectly bound token returns `null`. Only a non-null result may
+be serialized into an editor-preview response; the signing secret is never part of that result.
+Public responses omit both the bootstrap and the editor entry point. In the browser, dynamically
+import `@kotao/storefront/editor` only when the server supplied a bootstrap, then call
+`createHydrogenEditorPreviewRuntimeFromBootstrap` with `currentOrigin: location.origin`. The
+factory refuses to start unless the current preview origin exactly matches the signed binding and
+targets every runtime message at the signed Workspaces origin.
+
+On editor-only preview hosts, the Gateway's Hydrogen canvas controller measures those stable DOM
+boundaries and emits same-document interaction intents for move, inline content, bounded layout,
+and insertion requests. `HydrogenEditorProvider` is the only consumer: it translates each intent
+through `dispatchCanvasIntent`, validates it against the live manifest/slot/capability contract,
+and only then applies and forwards the preview operation over the authenticated bridge. The DOM
+controller has no source-write path and cannot bypass unsupported or read-only boundaries.
 
 ## Signed geo contract
 

package/dist/bridge-ZKbKqgFd.d.ts

@@ -0,0 +1,239 @@
+import { T as ThemeSettingsStore, R as ResolvedSettings, a as ResolvedSection, b as ResolvedBlock } from './store-DO08fzJi.js';
+
+interface StorefrontEditorMessageTarget {
+    postMessage(message: unknown, targetOrigin: string): void;
+}
+interface StorefrontEditorMessageEvent {
+    readonly origin: string;
+    readonly data: unknown;
+    readonly source?: StorefrontEditorMessageTarget | null;
+}
+interface StorefrontEditorMessageSource {
+    addEventListener(type: 'message', listener: (event: StorefrontEditorMessageEvent) => void): void;
+    removeEventListener(type: 'message', listener: (event: StorefrontEditorMessageEvent) => void): void;
+}
+interface StorefrontEditorPointerEvent {
+    readonly target?: unknown;
+    readonly relatedTarget?: unknown;
+    preventDefault?(): void;
+    stopPropagation?(): void;
+}
+interface StorefrontEditorRect {
+    readonly top: number;
+    readonly right: number;
+    readonly bottom: number;
+    readonly left: number;
+    readonly width: number;
+    readonly height: number;
+}
+interface StorefrontEditorDomElement {
+    id: string;
+    innerHTML?: string;
+    textContent?: string | null;
+    closest(selector: string): StorefrontEditorDomElement | null;
+    contains(candidate: unknown): boolean;
+    getAttribute?(name: string): string | null;
+    getBoundingClientRect?(): StorefrontEditorRect;
+    addEventListener?(type: 'click', listener: (event: StorefrontEditorPointerEvent) => void): void;
+    removeEventListener?(type: 'click', listener: (event: StorefrontEditorPointerEvent) => void): void;
+    setAttribute(name: string, value: string): void;
+    removeAttribute(name: string): void;
+    remove?(): void;
+}
+interface StorefrontEditorStyleElement {
+    id: string;
+    textContent: string | null;
+    remove(): void;
+}
+interface StorefrontEditorDocument {
+    readonly documentElement: Pick<StorefrontEditorDomElement, 'setAttribute' | 'removeAttribute'>;
+    readonly head?: {
+        appendChild(element: StorefrontEditorStyleElement): void;
+    };
+    readonly body?: {
+        appendChild(element: StorefrontEditorDomElement): void;
+    };
+    readonly defaultView?: {
+        readonly innerWidth: number;
+        readonly innerHeight: number;
+        addEventListener?(type: 'scroll' | 'resize', listener: () => void, capture?: boolean): void;
+        removeEventListener?(type: 'scroll' | 'resize', listener: () => void, capture?: boolean): void;
+    };
+    createElement(tagName: 'style'): StorefrontEditorStyleElement;
+    createElement(tagName: 'div'): StorefrontEditorDomElement;
+    getElementById(id: string): StorefrontEditorDomElement | StorefrontEditorStyleElement | null;
+    querySelectorAll?(selector: string): readonly StorefrontEditorDomElement[];
+    addEventListener(type: 'pointerover' | 'pointerout' | 'click', listener: (event: StorefrontEditorPointerEvent) => void, capture?: boolean): void;
+    removeEventListener(type: 'pointerover' | 'pointerout' | 'click', listener: (event: StorefrontEditorPointerEvent) => void, capture?: boolean): void;
+}
+interface StorefrontEditorBridge {
+    ready(): void;
+    hoverSection(sectionId: string | null): void;
+    selectSection(sectionId: string): void;
+    selectBlock(sectionId: string, blockId: string): void;
+    dispose(): void;
+}
+interface StorefrontEditorSettingOption {
+    readonly value: string;
+    readonly label: string;
+}
+interface StorefrontEditorThemeStyle {
+    readonly name: string;
+    readonly settings: ResolvedSettings;
+}
+interface StorefrontEditorSettingInput {
+    readonly type: string;
+    readonly name: string;
+    readonly label: string;
+    readonly group?: string;
+    readonly defaultValue?: unknown;
+    readonly placeholder?: string;
+    readonly helpText?: string;
+    readonly options?: readonly StorefrontEditorSettingOption[];
+    readonly min?: number;
+    readonly max?: number;
+    readonly step?: number;
+    readonly unit?: string;
+}
+interface StorefrontEditorBlockSchema {
+    readonly type: string;
+    readonly label: string;
+    readonly settings: readonly StorefrontEditorSettingInput[];
+    readonly limit?: number;
+}
+interface StorefrontEditorSectionPresetBlock {
+    readonly type: string;
+    readonly settings?: ResolvedSettings;
+}
+interface StorefrontEditorSectionPreset {
+    readonly name: string;
+    readonly settings?: ResolvedSettings;
+    readonly blocks?: readonly StorefrontEditorSectionPresetBlock[];
+}
+interface StorefrontEditorSectionSchema {
+    readonly type: string;
+    readonly label: string;
+    readonly settings: readonly StorefrontEditorSettingInput[];
+    readonly blocks?: readonly StorefrontEditorBlockSchema[];
+    readonly maxBlocks?: number;
+    readonly presets?: readonly StorefrontEditorSectionPreset[];
+}
+type StorefrontEditorSelectionScope = {
+    readonly kind: 'template';
+    readonly handle: string;
+} | {
+    readonly kind: 'sectionGroup';
+    readonly handle: string;
+};
+interface StorefrontEditorSelection {
+    readonly sectionId: string;
+    readonly blockId?: string;
+    readonly block?: ResolvedBlock;
+    readonly scope?: StorefrontEditorSelectionScope;
+    readonly section?: ResolvedSection;
+    readonly sections?: readonly ResolvedSection[];
+    readonly schema?: StorefrontEditorSectionSchema;
+    readonly schemas?: Readonly<Record<string, StorefrontEditorSectionSchema>>;
+}
+type StorefrontEditorCanvasSectionAction = 'section.addBefore' | 'section.addAfter' | 'section.duplicate' | 'section.toggleVisibility' | 'section.moveUp' | 'section.moveDown' | 'section.remove';
+type StorefrontEditorCanvasBlockAction = 'block.duplicate' | 'block.toggleVisibility' | 'block.moveUp' | 'block.moveDown' | 'block.remove';
+type StorefrontEditorCanvasAction = {
+    readonly action: StorefrontEditorCanvasSectionAction;
+    readonly sectionId: string;
+    readonly scope?: StorefrontEditorSelectionScope;
+} | {
+    readonly action: StorefrontEditorCanvasBlockAction;
+    readonly sectionId: string;
+    readonly blockId: string;
+    readonly scope?: StorefrontEditorSelectionScope;
+};
+interface StorefrontEditorValuesDocument {
+    readonly shopId: string;
+    readonly sections: readonly ResolvedSection[];
+}
+interface StorefrontEditorReady {
+    readonly sections: readonly ResolvedSection[];
+    readonly global?: ResolvedSettings;
+    readonly schemas?: Readonly<Record<string, StorefrontEditorSectionSchema>>;
+    readonly globalInputs?: readonly StorefrontEditorSettingInput[];
+    readonly themeStyles?: readonly StorefrontEditorThemeStyle[];
+    readonly templates?: Readonly<Record<string, StorefrontEditorValuesDocument>>;
+    readonly sectionGroups?: Readonly<Record<string, StorefrontEditorValuesDocument>>;
+}
+interface StorefrontEditorHostBridge {
+    requestReady(): void;
+    hoverSection(sectionId: string | null): void;
+    activateSection(sectionId: string | null, blockId?: string): void;
+    patchSection(sectionId: string, settings: ResolvedSettings): void;
+    patchGlobal(settings: ResolvedSettings): void;
+    insertSection(section: ResolvedSection, index?: number): void;
+    removeSection(sectionId: string): void;
+    reorderSection(sectionId: string, index: number): void;
+    patchBlock(sectionId: string, blockId: string, settings: ResolvedSettings): void;
+    insertBlock(sectionId: string, block: ResolvedBlock, index?: number): void;
+    removeBlock(sectionId: string, blockId: string): void;
+    reorderBlock(sectionId: string, blockId: string, index: number): void;
+    replaceTemplate(handle: string, document: StorefrontEditorValuesDocument): void;
+    replaceSectionGroup(handle: string, document: StorefrontEditorValuesDocument): void;
+    replaceAppExtensions(extensions: readonly StorefrontEditorAppExtensionPreview[]): void;
+    dispose(): void;
+}
+interface StorefrontEditorAppExtensionPreview {
+    readonly instanceId: string;
+    readonly kind: 'app_embed' | 'app_section' | 'app_block';
+    readonly appId: string;
+    readonly appName: string;
+    readonly extensionId: string;
+    readonly extensionName: string;
+    readonly version: string;
+    readonly entrypointUrl: string;
+    readonly stylesheetUrls: readonly string[];
+    readonly capabilities: readonly string[];
+    readonly allowedOrigins: readonly string[];
+    readonly settings: ResolvedSettings;
+    readonly embedLocation?: 'head' | 'body_start' | 'body_end';
+    readonly target?: {
+        readonly kind: 'template' | 'section_group';
+        readonly handle: string;
+    };
+    readonly templateHandle?: string;
+    readonly sectionInstanceId?: string;
+    readonly position: number;
+}
+interface CreateStorefrontEditorBridgeArgs {
+    readonly adminOrigin: string;
+    readonly shopId: string;
+    readonly store: ThemeSettingsStore;
+    readonly schemas?: Readonly<Record<string, StorefrontEditorSectionSchema>>;
+    readonly globalInputs?: readonly StorefrontEditorSettingInput[];
+    readonly themeStyles?: readonly StorefrontEditorThemeStyle[];
+    readonly templates?: Readonly<Record<string, StorefrontEditorValuesDocument>>;
+    readonly sectionGroups?: Readonly<Record<string, StorefrontEditorValuesDocument>>;
+    readonly transport: StorefrontEditorMessageSource;
+    readonly target: StorefrontEditorMessageTarget;
+    readonly document?: StorefrontEditorDocument;
+}
+interface CreateStorefrontEditorHostBridgeArgs {
+    readonly onSelectSection: (selection: StorefrontEditorSelection) => void;
+    readonly onCanvasAction?: (action: StorefrontEditorCanvasAction) => void;
+    readonly onHoverSection?: (sectionId: string | null) => void;
+    readonly onReady?: (ready: StorefrontEditorReady) => void;
+    readonly previewOrigin: string;
+    readonly resolveTarget?: () => StorefrontEditorMessageTarget | null;
+    readonly shopId: string;
+    readonly transport: StorefrontEditorMessageSource;
+    readonly target: StorefrontEditorMessageTarget;
+}
+interface StorefrontEditorCanvasPosition {
+    readonly left: number;
+    readonly top: number;
+    readonly placement: 'above' | 'below';
+}
+declare function positionStorefrontEditorCanvasToolbar(anchor: StorefrontEditorRect, toolbar: Pick<StorefrontEditorRect, 'width' | 'height'>, viewport: {
+    readonly width: number;
+    readonly height: number;
+}): StorefrontEditorCanvasPosition;
+declare function createStorefrontEditorBridge({ adminOrigin, document: editorDocument, globalInputs, themeStyles, schemas, sectionGroups, shopId, store, target, templates, transport, }: CreateStorefrontEditorBridgeArgs): StorefrontEditorBridge;
+declare function createStorefrontEditorHostBridge({ onCanvasAction, onHoverSection, onReady, onSelectSection, previewOrigin, resolveTarget, shopId, target, transport, }: CreateStorefrontEditorHostBridgeArgs): StorefrontEditorHostBridge;
+
+export { type CreateStorefrontEditorBridgeArgs as C, type StorefrontEditorMessageSource as S, type StorefrontEditorMessageTarget as a, type CreateStorefrontEditorHostBridgeArgs as b, type StorefrontEditorAppExtensionPreview as c, type StorefrontEditorBlockSchema as d, type StorefrontEditorBridge as e, type StorefrontEditorCanvasAction as f, type StorefrontEditorCanvasBlockAction as g, type StorefrontEditorCanvasPosition as h, type StorefrontEditorCanvasSectionAction as i, type StorefrontEditorDocument as j, type StorefrontEditorHostBridge as k, type StorefrontEditorMessageEvent as l, type StorefrontEditorReady as m, type StorefrontEditorRect as n, type StorefrontEditorSectionPreset as o, type StorefrontEditorSectionPresetBlock as p, type StorefrontEditorSectionSchema as q, type StorefrontEditorSelection as r, type StorefrontEditorSelectionScope as s, type StorefrontEditorSettingInput as t, type StorefrontEditorSettingOption as u, type StorefrontEditorThemeStyle as v, type StorefrontEditorValuesDocument as w, createStorefrontEditorBridge as x, createStorefrontEditorHostBridge as y, positionStorefrontEditorCanvasToolbar as z };

package/dist/cart-documents-BLavRDiu.d.ts

@@ -0,0 +1,89 @@
+/** Public Smart Cart seam types for custom React storefronts.
+ *
+ * The Smart Cart implementation is bundled into `@kotao/storefront`; external themes must never
+ * need the private `@kotao/smart-cart` workspace package merely to consume the published type
+ * declarations. Keep this structural contract aligned with the bundled runtime seam.
+ */
+interface SmartCartMoney {
+    readonly amount: number;
+    readonly currency: string;
+}
+interface SmartCartLineOption {
+    readonly name: string;
+    readonly value: string;
+}
+interface SmartCartLineDiscount {
+    readonly code: string;
+    readonly amount: SmartCartMoney;
+    readonly quantity?: number;
+}
+interface SmartCartLine {
+    readonly id: string;
+    readonly title: string;
+    readonly variantTitle: string | null;
+    readonly variantId?: string | null;
+    readonly quantity: number;
+    readonly imageUrl: string | null;
+    readonly linePrice: SmartCartMoney;
+    readonly productHandle?: string | null;
+    readonly compareAtLinePrice?: SmartCartMoney;
+    readonly options?: readonly SmartCartLineOption[];
+    readonly properties?: readonly SmartCartLineOption[];
+    readonly attributes?: Record<string, string>;
+    readonly discountAllocations?: readonly SmartCartLineDiscount[];
+    readonly originalLinePrice?: SmartCartMoney;
+}
+interface SmartCartState {
+    readonly lines: readonly SmartCartLine[];
+    readonly subtotal: SmartCartMoney;
+    readonly checkoutUrl: string;
+    readonly currency: string;
+    readonly discountTotal?: SmartCartMoney;
+    readonly appliedCodes?: readonly string[];
+    readonly discountAllocations?: readonly {
+        readonly code: string;
+        readonly amount: SmartCartMoney;
+    }[];
+}
+interface CartAdapter {
+    getCart(): Promise<SmartCartState>;
+    addLine(merchandiseId: string, quantity: number, attributes?: Record<string, string>): Promise<SmartCartState>;
+    updateLine(lineId: string, quantity: number): Promise<SmartCartState>;
+    removeLine(lineId: string): Promise<SmartCartState>;
+    updateDiscountCodes(codes: readonly string[]): Promise<SmartCartState>;
+}
+interface SmartCartBranding {
+    readonly accent?: string;
+    readonly accentText?: string;
+    readonly surface?: string;
+    readonly text?: string;
+    readonly fontFamily?: string;
+    readonly radius?: string;
+}
+interface SmartCartMountConfig {
+    readonly selectors?: readonly string[];
+    readonly branding?: SmartCartBranding;
+    readonly widgets?: Record<string, {
+        enabled?: boolean;
+    } & Record<string, unknown>>;
+}
+
+/**
+ * All fully-resolved cart GraphQL document strings from the react seam adapter.
+ * Exported for schema-validation tests (apps/storefront-api/test/cart-graphql-documents.test.ts)
+ * that submit each document to a real graphql-yoga instance and assert zero validation errors,
+ * catching invalid field selections (e.g. subfields on a scalar) at test time rather than runtime.
+ */
+declare const REACT_SEAM_CART_DOCUMENTS: readonly string[];
+/**
+ * A CartAdapter that drives the storefront-api cart over the same-origin /api/storefront GraphQL proxy
+ * (the proxy injects the read token + resolves the shop server-side). The theme supplies the cart id
+ * (from its loader's cart cookie/session) and renders <CartDrawerOverlay adapter={this} />.
+ */
+declare function createStorefrontApiCartAdapter(opts: {
+    readonly cartId: string;
+    readonly apiPath?: string;
+    readonly fetchImpl?: typeof fetch;
+}): CartAdapter;
+
+export { type CartAdapter as C, REACT_SEAM_CART_DOCUMENTS as R, type SmartCartMountConfig as S, type SmartCartBranding as a, type SmartCartLine as b, type SmartCartLineDiscount as c, type SmartCartLineOption as d, type SmartCartMoney as e, type SmartCartState as f, createStorefrontApiCartAdapter as g };

package/dist/cart-documents.d.ts

@@ -1,2 +1 @@
-export { R as REACT_SEAM_CART_DOCUMENTS } from './cart-documents-CwwRTvm8.js';
-import '@kotao/smart-cart';
+export { R as REACT_SEAM_CART_DOCUMENTS } from './cart-documents-BLavRDiu.js';

package/dist/cart-documents.js

@@ -1,3 +1,3 @@
-export { REACT_SEAM_CART_DOCUMENTS } from './chunk-2IWNUDSZ.js';
+export { REACT_SEAM_CART_DOCUMENTS } from './chunk-WNXI3MPM.js';
 //# sourceMappingURL=cart-documents.js.map
 //# sourceMappingURL=cart-documents.js.map

package/dist/{chunk-M7BPQ54D.js → chunk-2MRB6SMP.js}

@@ -8,6 +8,7 @@ async function fetchThemeSettings(options = {}) {
     throw new Error(`theme-settings endpoint must be a same-origin path, got '${endpoint}'`);
   }
   const doFetch = options.fetch ?? fetch;
+  const requestEndpoint = options.templateHandle === void 0 ? endpoint : `${endpoint}${endpoint.includes("?") ? "&" : "?"}template=${encodeURIComponent(options.templateHandle)}`;
   const headers = { ...options.shopContextHeaders ?? {} };
   if (options.auth !== void 0) {
     headers[options.auth.tokenHeader ?? "x-kotao-storefront-token"] = options.auth.token;
@@ -16,11 +17,11 @@ async function fetchThemeSettings(options = {}) {
     }
   }
   const init = Object.keys(headers).length > 0 ? { headers } : void 0;
-  const res = await doFetch(endpoint, init);
+  const res = await doFetch(requestEndpoint, init);
   if (!res.ok) throw new Error(`theme settings fetch failed: HTTP ${res.status}`);
   return await res.json();
 }
 
 export { fetchThemeSettings };
-//# sourceMappingURL=chunk-M7BPQ54D.js.map
-//# sourceMappingURL=chunk-M7BPQ54D.js.map
+//# sourceMappingURL=chunk-2MRB6SMP.js.map
+//# sourceMappingURL=chunk-2MRB6SMP.js.map

package/dist/chunk-2MRB6SMP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/settings/fetch.ts"],"names":[],"mappings":";AAKA,IAAM,gBAAA,GAAmB,cAAA;AACzB,IAAM,cAAA,GAAiB,aAAA;AACvB,IAAM,gBAAA,GAAmB,0BAAA;AAkDzB,eAAsB,kBAAA,CACpB,OAAA,GAAqC,EAAC,EACR;AAC9B,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,gBAAA;AACrC,EAAA,IACE,CAAC,gBAAA,CAAiB,IAAA,CAAK,QAAQ,CAAA,IAC/B,EAAE,OAAA,CAAQ,gBAAA,KAAqB,IAAA,IAAQ,cAAA,CAAe,IAAA,CAAK,QAAQ,CAAA,CAAA,EACnE;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yDAAA,EAA4D,QAAQ,CAAA,CAAA,CAAG,CAAA;AAAA,EACzF;AACA,EAAA,MAAM,OAAA,GAAU,QAAQ,KAAA,IAAS,KAAA;AACjC,EAAA,MAAM,kBACJ,OAAA,CAAQ,cAAA,KAAmB,SACvB,QAAA,GACA,CAAA,EAAG,QAAQ,CAAA,EAAG,QAAA,CAAS,QAAA,CAAS,GAAG,IAAI,GAAA,GAAM,GAAG,YAAY,kBAAA,CAAmB,OAAA,CAAQ,cAAc,CAAC,CAAA,CAAA;AAC5G,EAAA,MAAM,UAAkC,EAAE,GAAI,OAAA,CAAQ,kBAAA,IAAsB,EAAC,EAAG;AAChF,EAAA,IAAI,OAAA,CAAQ,SAAS,MAAA,EAAW;AAC9B,IAAA,OAAA,CAAQ,QAAQ,IAAA,CAAK,WAAA,IAAe,0BAA0B,CAAA,GAAI,QAAQ,IAAA,CAAK,KAAA;AAC/E,IAAA,IAAI,OAAA,CAAQ,IAAA,CAAK,MAAA,KAAW,MAAA,IAAa,OAAA,CAAQ,KAAK,MAAA,CAAO,IAAA,EAAK,CAAE,MAAA,GAAS,CAAA,EAAG;AAC9E,MAAA,OAAA,CAAQ,iBAAiB,CAAA,GAAI,OAAA,CAAQ,IAAA,CAAK,MAAA;AAAA,IAC5C;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,OAAO,IAAA,CAAK,OAAO,EAAE,MAAA,GAAS,CAAA,GAAI,EAAE,OAAA,EAAQ,GAAI,MAAA;AAC7D,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,eAAA,EAAiB,IAAI,CAAA;AAC/C,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,kCAAA,EAAqC,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAC9E,EAAA,OAAQ,MAAM,IAAI,IAAA,EAAK;AACzB","file":"chunk-2MRB6SMP.js","sourcesContent":["import type { SectionInstance, ValuesDocument } from '@kotao/storefront-contracts/theme'\n\nimport type { StorefrontAuthHeader } from '../storefront-client/client'\n\n/** A single leading slash, not protocol-relative (`//`/`\\`) — keeps the fetch same-origin (no exfil). */\nconst SAME_ORIGIN_PATH = /^\\/(?![/\\\\])/\nconst HTTPS_ENDPOINT = /^https:\\/\\//\nconst DEFAULT_ENDPOINT = '/api/storefront/settings'\n\n/**\n * The stored settings a theme hydrates from (#93): the layout document's ordered section instances +\n * the global theme tokens. Pass to {@link resolveThemeSettings} together with the theme's bundled\n * section schemas + presets to produce the merged {@link ThemeSettingsSnapshot}.\n */\nexport interface StoredThemeSettings {\n  readonly shopId: string\n  readonly sections: readonly SectionInstance[]\n  readonly global: Record<string, unknown>\n  readonly templates?: Readonly<Partial<Record<string, ValuesDocument>>>\n  readonly sectionGroups?: Readonly<Partial<Record<string, ValuesDocument>>>\n}\n\nexport interface FetchThemeSettingsOptions {\n  /** Injectable for tests; defaults to the global `fetch`. */\n  readonly fetch?: typeof fetch\n  /** Same-origin settings endpoint (default `/api/storefront/settings`). */\n  readonly endpoint?: string\n  /**\n   * Restrict the response to one rendered template plus the base commerce templates and layout\n   * groups needed for a complete page. Omit for the legacy/full editor document.\n   */\n  readonly templateHandle?: string\n  /**\n   * Explicit local-preview escape hatch for server-side theme workers that call the Kotao API directly.\n   * Production themes should keep the default same-origin path.\n   */\n  readonly allowCrossOrigin?: boolean\n  /** Optional server-side auth headers for local previews. Never pass browser-visible tokens here. */\n  readonly auth?: {\n    readonly token: string\n    readonly tokenHeader?: StorefrontAuthHeader\n    readonly siteId?: string\n  }\n  /**\n   * Gateway-signed shop-context headers (`x-kotao-shop` + `x-kotao-shop-signature`) to forward to the\n   * upstream, mirroring the storefront GraphQL client. Required for the SSR worker path: a Worker\n   * subrequest to its own zone bypasses the Gateway, so the shop context has to be re-attached\n   * explicitly and the request sent cross-origin to the API. `context.loadThemeSettings()` wires this\n   * automatically from the inbound request; pass it by hand only when calling `fetchThemeSettings` raw.\n   */\n  readonly shopContextHeaders?: Readonly<Record<string, string>>\n}\n\n/**\n * Fetch the shop's stored settings document via the same-origin `/api/storefront/settings` carve-out.\n * The shop is resolved server-side from the Gateway-signed context — the theme sends no id and no token.\n */\nexport async function fetchThemeSettings(\n  options: FetchThemeSettingsOptions = {},\n): Promise<StoredThemeSettings> {\n  const endpoint = options.endpoint ?? DEFAULT_ENDPOINT\n  if (\n    !SAME_ORIGIN_PATH.test(endpoint) &&\n    !(options.allowCrossOrigin === true && HTTPS_ENDPOINT.test(endpoint))\n  ) {\n    throw new Error(`theme-settings endpoint must be a same-origin path, got '${endpoint}'`)\n  }\n  const doFetch = options.fetch ?? fetch\n  const requestEndpoint =\n    options.templateHandle === undefined\n      ? endpoint\n      : `${endpoint}${endpoint.includes('?') ? '&' : '?'}template=${encodeURIComponent(options.templateHandle)}`\n  const headers: Record<string, string> = { ...(options.shopContextHeaders ?? {}) }\n  if (options.auth !== undefined) {\n    headers[options.auth.tokenHeader ?? 'x-kotao-storefront-token'] = options.auth.token\n    if (options.auth.siteId !== undefined && options.auth.siteId.trim().length > 0) {\n      headers['x-kotao-site-id'] = options.auth.siteId\n    }\n  }\n  const init = Object.keys(headers).length > 0 ? { headers } : undefined\n  const res = await doFetch(requestEndpoint, init)\n  if (!res.ok) throw new Error(`theme settings fetch failed: HTTP ${res.status}`)\n  return (await res.json()) as StoredThemeSettings\n}\n"]}

package/dist/chunk-CKGI3Y7L.js

@@ -0,0 +1,19 @@
+// src/geo/base64url.ts
+var toBase64Url = (bytes) => {
+  let bin = "";
+  for (const b of bytes) bin += String.fromCharCode(b);
+  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+var fromBase64Url = (s) => {
+  const b64 = s.replace(/-/g, "+").replace(/_/g, "/");
+  const bin = atob(b64);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+};
+var encodeUtf8Base64Url = (text) => toBase64Url(new TextEncoder().encode(text));
+var decodeBase64UrlUtf8 = (s) => new TextDecoder().decode(fromBase64Url(s));
+
+export { decodeBase64UrlUtf8, encodeUtf8Base64Url, fromBase64Url, toBase64Url };
+//# sourceMappingURL=chunk-CKGI3Y7L.js.map
+//# sourceMappingURL=chunk-CKGI3Y7L.js.map

package/dist/chunk-CKGI3Y7L.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/geo/base64url.ts"],"names":[],"mappings":";AAAA,IAAM,WAAA,GAAc,CAAC,KAAA,KAA8B;AACjD,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,KAAA,MAAW,CAAA,IAAK,KAAA,EAAO,GAAA,IAAO,MAAA,CAAO,aAAa,CAAC,CAAA;AACnD,EAAA,OAAO,IAAA,CAAK,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC5E;AAEA,IAAM,aAAA,GAAgB,CAAC,CAAA,KAA0B;AAC/C,EAAA,MAAM,GAAA,GAAM,EAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAClD,EAAA,MAAM,GAAA,GAAM,KAAK,GAAG,CAAA;AACpB,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AACrC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,GAAA,CAAI,UAAA,CAAW,CAAC,CAAA;AAC9D,EAAA,OAAO,GAAA;AACT;AAEA,IAAM,mBAAA,GAAsB,CAAC,IAAA,KAAyB,WAAA,CAAY,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAC;AAChG,IAAM,mBAAA,GAAsB,CAAC,CAAA,KAAsB,IAAI,aAAY,CAAE,MAAA,CAAO,aAAA,CAAc,CAAC,CAAC","file":"chunk-CKGI3Y7L.js","sourcesContent":["const toBase64Url = (bytes: Uint8Array): string => {\n  let bin = ''\n  for (const b of bytes) bin += String.fromCharCode(b)\n  return btoa(bin).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n}\n\nconst fromBase64Url = (s: string): Uint8Array => {\n  const b64 = s.replace(/-/g, '+').replace(/_/g, '/')\n  const bin = atob(b64)\n  const out = new Uint8Array(bin.length)\n  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i)\n  return out\n}\n\nconst encodeUtf8Base64Url = (text: string): string => toBase64Url(new TextEncoder().encode(text))\nconst decodeBase64UrlUtf8 = (s: string): string => new TextDecoder().decode(fromBase64Url(s))\n\nexport { decodeBase64UrlUtf8, encodeUtf8Base64Url, fromBase64Url, toBase64Url }\n"]}