@lime-bundles/widget 3.2.2 → 3.3.0

package/README.md

@@ -61,11 +61,30 @@ document.querySelector("lime-bundle").addEventListener(
 | `app-url` |  | Enables impression + add-to-cart analytics when set. |
 | `analytics` |  | `"false"` suppresses analytics even when `app-url` is set. |
 | `locale` |  | BCP-47 tag forwarded to the Storefront API. |
+| `country` |  | ISO-3166 alpha-2 (e.g. `"US"`). Adds `@inContext(country:)` to Storefront queries — Markets pricing + currency. |
+| `language` |  | ISO-639-1 (e.g. `"EN"`). Adds `@inContext(language:)`. |
+| `market-id` |  | Current visitor's Market GID. Hides market-restricted bundles whose allow-list doesn't include this market. |
 
 **Product resolution** (when `bundle-gid` is absent): explicit `product-handle` → `<meta name="shopify:product-handle">` → `/products/<handle>` URL segment.
 
 Changing any attribute at runtime re-fetches and re-renders.
 
+### B2B buyer identity (programmatic property only)
+
+`buyer` is **not** an HTML attribute. Set it on the element after creation so the customer access token never lands in DOM-snapshot tools (Sentry, analytics, browser extensions) or Referer headers:
+
+```js
+const el = document.querySelector("lime-bundle");
+el.buyer = async () => {
+  // Resolved per request — no token in static markup
+  return { customerAccessToken: await fetchToken(), companyLocationId: "gid://shopify/CompanyLocation/9" };
+};
+```
+
+The Customer Account API PKCE flow is the canonical token source. See https://shopify.dev/docs/api/customer/latest.
+
+Buyer-contextual Storefront responses MUST be `Cache-Control: private` — never share across users.
+
 ## Events
 
 All events bubble and pierce shadow-DOM boundaries (`composed: true`), so you can listen on any ancestor.

package/dist/index.cjs

@@ -4130,8 +4130,19 @@ var LimeBundleElement = class extends HTMLElement {
     "product-handle",
     "app-url",
     "analytics",
-    "locale"
+    "locale",
+    "country",
+    "language",
+    "market-id"
   ];
+  /**
+   * B2B buyer identity. Set programmatically — `element.buyer = {...}` or
+   * `element.buyer = () => fetchToken()`. NEVER expose as an HTML attribute
+   * because the customer access token would land in DOM snapshots (Sentry,
+   * analytics, browser extensions) and Referer headers. See the package
+   * README ("Markets & B2B").
+   */
+  buyer = void 0;
   shadow;
   bundles = [];
   abortController = null;
@@ -4194,6 +4205,40 @@ var LimeBundleElement = class extends HTMLElement {
   get analyticsEnabled() {
     return this.getAttribute("analytics") !== "false";
   }
+  get country() {
+    return this.getAttribute("country") ?? void 0;
+  }
+  get language() {
+    return this.getAttribute("language") ?? void 0;
+  }
+  get marketId() {
+    return this.getAttribute("market-id") ?? void 0;
+  }
+  /**
+   * Returns the @inContext-wrapped query when any context field is set;
+   * otherwise the plain query. Keeps responses publicly cacheable when
+   * no buyer/country/language is set.
+   */
+  wrapQueryForContext(query) {
+    return (0, import_core8.hasInContext)({
+      shopDomain: this.shopDomain,
+      accessToken: this.storefrontToken,
+      country: this.country,
+      language: this.language,
+      buyer: this.buyer
+    }) ? (0, import_core8.withInContext)(query) : query;
+  }
+  /**
+   * Returns true if this bundle should be hidden for the current market.
+   * For "all" bundles, always returns false (visible). For "specific"
+   * bundles, returns true when no marketId was set or when the bundle's
+   * marketIds doesn't include the configured market.
+   */
+  isMarketHidden(bundle) {
+    if (bundle.marketVisibility !== "specific") return false;
+    if (!this.marketId) return true;
+    return !bundle.marketIds.includes(this.marketId);
+  }
   async fetchBundle() {
     if (!this.shopDomain || !this.storefrontToken) {
       this.renderError(
@@ -4207,7 +4252,10 @@ var LimeBundleElement = class extends HTMLElement {
     this.renderLoading();
     const client = (0, import_core8.createStorefrontClient)({
       shopDomain: this.shopDomain,
-      accessToken: this.storefrontToken
+      accessToken: this.storefrontToken,
+      country: this.country,
+      language: this.language,
+      buyer: this.buyer
     });
     try {
       let bundlePromise;
@@ -4291,7 +4339,7 @@ var LimeBundleElement = class extends HTMLElement {
   }
   async fetchSingleBundle(client, signal) {
     const data = await client.query(
-      import_core8.BUNDLE_METAOBJECT_QUERY,
+      this.wrapQueryForContext(import_core8.BUNDLE_METAOBJECT_QUERY),
       { id: this.bundleGid },
       { signal }
     );
@@ -4303,11 +4351,11 @@ var LimeBundleElement = class extends HTMLElement {
       data.metaobject.id,
       data.metaobject.fields
     );
-    this.bundles = parsed ? [parsed] : [];
+    this.bundles = parsed && !this.isMarketHidden(parsed) ? [parsed] : [];
   }
   async fetchProductBundles(client, signal, productHandle) {
     const data = await client.query(
-      import_core8.BUNDLES_FOR_PRODUCT_QUERY,
+      this.wrapQueryForContext(import_core8.BUNDLES_FOR_PRODUCT_QUERY),
       { handle: productHandle },
       { signal }
     );
@@ -4319,7 +4367,7 @@ var LimeBundleElement = class extends HTMLElement {
     const bundles = [];
     for (const ref of refs) {
       const parsed = (0, import_core8.parseMetaobjectBundle)(ref.id, ref.fields);
-      if (parsed) bundles.push(parsed);
+      if (parsed && !this.isMarketHidden(parsed)) bundles.push(parsed);
     }
     this.bundles = bundles;
   }