@magicstoreai/hydrogen 0.1.0

package/dist/server.cjs

@@ -0,0 +1,172 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/server.ts
+var server_exports = {};
+__export(server_exports, {
+  CACHE_TAGS: () => CACHE_TAGS,
+  SIGNATURE_TOLERANCE_SECONDS: () => SIGNATURE_TOLERANCE_SECONDS,
+  createWebhookHandler: () => createWebhookHandler,
+  nextCacheFetch: () => nextCacheFetch,
+  tagForPath: () => tagForPath,
+  tagsForTopic: () => tagsForTopic,
+  verifyWebhookSignature: () => verifyWebhookSignature
+});
+module.exports = __toCommonJS(server_exports);
+
+// src/server/webhook.ts
+var SIGNATURE_TOLERANCE_SECONDS = 300;
+async function verifyWebhookSignature(secret, header, rawBody, nowSeconds = Math.floor(Date.now() / 1e3)) {
+  if (!header || !secret) {
+    return false;
+  }
+  let timestamp = null;
+  const signatures = [];
+  for (const pair of header.split(",")) {
+    const separator = pair.indexOf("=");
+    const key = pair.slice(0, separator).trim();
+    const value = pair.slice(separator + 1).trim();
+    if (key === "t" && /^\d+$/.test(value)) {
+      timestamp = Number(value);
+    } else if (key === "v1" && value !== "") {
+      signatures.push(value.toLowerCase());
+    }
+  }
+  if (timestamp === null || signatures.length === 0 || Math.abs(nowSeconds - timestamp) > SIGNATURE_TOLERANCE_SECONDS) {
+    return false;
+  }
+  const expected = await hmacSha256Hex(secret, `${timestamp}.${rawBody}`);
+  return signatures.some((signature) => constantTimeEqual(signature, expected));
+}
+async function hmacSha256Hex(secret, message) {
+  const encoder = new TextEncoder();
+  const key = await globalThis.crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = await globalThis.crypto.subtle.sign("HMAC", key, encoder.encode(message));
+  return [...new Uint8Array(signature)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  let difference = 0;
+  for (let i = 0; i < a.length; i++) {
+    difference |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return difference === 0;
+}
+function createWebhookHandler(options) {
+  const seen = /* @__PURE__ */ new Set();
+  return async (request) => {
+    const rawBody = await request.text();
+    const now = Math.floor((options.now?.() ?? Date.now()) / 1e3);
+    if (!await verifyWebhookSignature(
+      options.secret,
+      request.headers.get("X-MagicStore-Signature"),
+      rawBody,
+      now
+    )) {
+      return new Response("invalid signature", { status: 401 });
+    }
+    let event;
+    try {
+      event = JSON.parse(rawBody);
+    } catch {
+      return new Response("invalid body", { status: 400 });
+    }
+    if (typeof event?.id !== "string" || typeof event.topic !== "string") {
+      return new Response("invalid body", { status: 400 });
+    }
+    if (seen.has(event.id)) {
+      return new Response(null, { status: 200 });
+    }
+    seen.add(event.id);
+    if (seen.size > 1e3) {
+      seen.delete(seen.values().next().value);
+    }
+    for (const tag of tagsForTopic(event.topic)) {
+      await options.revalidateTag?.(tag, "max");
+    }
+    await options.onEvent?.(event);
+    return new Response(null, { status: 200 });
+  };
+}
+var CACHE_TAGS = {
+  shop: "magicstore:shop",
+  catalog: "magicstore:catalog",
+  pages: "magicstore:pages",
+  home: "magicstore:home"
+};
+function tagsForTopic(topic) {
+  switch (topic) {
+    case "SHOP_UPDATED":
+      return [CACHE_TAGS.shop];
+    case "CATALOG_UPDATED":
+      return [CACHE_TAGS.catalog];
+    case "PAGES_UPDATED":
+      return [CACHE_TAGS.pages];
+    case "HOME_UPDATED":
+      return [CACHE_TAGS.home];
+    default:
+      return [];
+  }
+}
+
+// src/server/cache.ts
+function tagForPath(pathname) {
+  const path = pathname.replace(/^.*\/api\/v2\/storefront/, "");
+  if (path === "/shop" || path === "/contacts" || path === "/theme/section-schema") {
+    return CACHE_TAGS.shop;
+  }
+  if (path === "/home") {
+    return CACHE_TAGS.home;
+  }
+  if (path.startsWith("/pages") || path === "/menus/footer") {
+    return CACHE_TAGS.pages;
+  }
+  if (path.startsWith("/products") || path.startsWith("/collections") || path.startsWith("/menus/") || path === "/reels" || path === "/sitemap" || path === "/locations") {
+    return CACHE_TAGS.catalog;
+  }
+  return null;
+}
+function nextCacheFetch(options = {}) {
+  const base = options.fetch ?? globalThis.fetch;
+  return (input, init) => {
+    const request = input instanceof Request ? input : new Request(input, init);
+    const tag = request.method === "GET" && !request.headers.has("Authorization") ? tagForPath(new URL(request.url).pathname) : null;
+    const next = tag === null ? { cache: "no-store" } : { next: { tags: [tag], revalidate: options.revalidate ?? 3600 } };
+    return base(request, next);
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CACHE_TAGS,
+  SIGNATURE_TOLERANCE_SECONDS,
+  createWebhookHandler,
+  nextCacheFetch,
+  tagForPath,
+  tagsForTopic,
+  verifyWebhookSignature
+});
+//# sourceMappingURL=server.cjs.map

package/dist/server.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server.ts","../src/server/webhook.ts","../src/server/cache.ts"],"sourcesContent":["export { nextCacheFetch, tagForPath } from './server/cache';\nexport {\n  CACHE_TAGS,\n  SIGNATURE_TOLERANCE_SECONDS,\n  createWebhookHandler,\n  tagsForTopic,\n  verifyWebhookSignature,\n} from './server/webhook';\nexport type { WebhookEvent, WebhookHandlerOptions, WebhookTopic } from './server/webhook';\n","/** Topics the platform sends today. New ones may be added — ignore what you do not know. */\nexport type WebhookTopic = 'SHOP_UPDATED' | 'CATALOG_UPDATED' | 'PAGES_UPDATED' | 'HOME_UPDATED';\n\nexport interface WebhookEvent {\n  /** A ULID, the same across retries: deduplicate by it. */\n  id: string;\n  topic: WebhookTopic | (string & {});\n  /** The shop's key. */\n  shop: string;\n  occurredAt: string;\n  data: Record<string, unknown>;\n}\n\n/** How far the signature's timestamp may be from this clock (replay window). */\nexport const SIGNATURE_TOLERANCE_SECONDS = 300;\n\n/**\n * Verifies `X-MagicStore-Signature: t=<unix>,v1=<hex HMAC-SHA256(secret, \"<t>.<raw body>\")>` over\n * the RAW body, in constant time, with Web Crypto — so it runs in Node, edge runtimes and Workers.\n */\nexport async function verifyWebhookSignature(\n  secret: string,\n  header: string | null,\n  rawBody: string,\n  nowSeconds: number = Math.floor(Date.now() / 1000),\n): Promise<boolean> {\n  if (!header || !secret) {\n    return false;\n  }\n  let timestamp: number | null = null;\n  const signatures: string[] = [];\n  for (const pair of header.split(',')) {\n    const separator = pair.indexOf('=');\n    const key = pair.slice(0, separator).trim();\n    const value = pair.slice(separator + 1).trim();\n    if (key === 't' && /^\\d+$/.test(value)) {\n      timestamp = Number(value);\n    } else if (key === 'v1' && value !== '') {\n      signatures.push(value.toLowerCase());\n    }\n  }\n  if (\n    timestamp === null ||\n    signatures.length === 0 ||\n    Math.abs(nowSeconds - timestamp) > SIGNATURE_TOLERANCE_SECONDS\n  ) {\n    return false;\n  }\n  const expected = await hmacSha256Hex(secret, `${timestamp}.${rawBody}`);\n  return signatures.some((signature) => constantTimeEqual(signature, expected));\n}\n\nasync function hmacSha256Hex(secret: string, message: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const key = await globalThis.crypto.subtle.importKey(\n    'raw',\n    encoder.encode(secret),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign'],\n  );\n  const signature = await globalThis.crypto.subtle.sign('HMAC', key, encoder.encode(message));\n  return [...new Uint8Array(signature)].map((byte) => byte.toString(16).padStart(2, '0')).join('');\n}\n\nfunction constantTimeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n  let difference = 0;\n  for (let i = 0; i < a.length; i++) {\n    difference |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n  return difference === 0;\n}\n\nexport interface WebhookHandlerOptions {\n  /** The endpoint's signing secret (`whsec_…`). */\n  secret: string;\n  /**\n   * Called with each cache tag a topic invalidates — pass Next.js's `revalidateTag` as is: it gets\n   * the `'max'` profile (serve stale while it refetches), which Next.js 16 requires.\n   */\n  revalidateTag?: (tag: string, profile: 'max') => void | Promise<void>;\n  /** Anything else to do with a verified event. Runs after the tags are revalidated. */\n  onEvent?: (event: WebhookEvent) => void | Promise<void>;\n  /** For tests. */\n  now?: () => number;\n}\n\n/**\n * A route handler for the platform's webhook: `export const POST = createWebhookHandler({ secret,\n * revalidateTag })` in `app/api/magicstore/webhook/route.ts`. Answers 401 on a bad signature, 400\n * on a body that is not an event, 200 otherwise — including for a topic it does not know. Events\n * seen before (same id, this instance) are acknowledged and skipped.\n */\nexport function createWebhookHandler(\n  options: WebhookHandlerOptions,\n): (request: Request) => Promise<Response> {\n  const seen = new Set<string>();\n\n  return async (request) => {\n    const rawBody = await request.text();\n    const now = Math.floor((options.now?.() ?? Date.now()) / 1000);\n    if (\n      !(await verifyWebhookSignature(\n        options.secret,\n        request.headers.get('X-MagicStore-Signature'),\n        rawBody,\n        now,\n      ))\n    ) {\n      return new Response('invalid signature', { status: 401 });\n    }\n\n    let event: WebhookEvent;\n    try {\n      event = JSON.parse(rawBody) as WebhookEvent;\n    } catch {\n      return new Response('invalid body', { status: 400 });\n    }\n    if (typeof event?.id !== 'string' || typeof event.topic !== 'string') {\n      return new Response('invalid body', { status: 400 });\n    }\n\n    if (seen.has(event.id)) {\n      return new Response(null, { status: 200 });\n    }\n    seen.add(event.id);\n    if (seen.size > 1000) {\n      seen.delete(seen.values().next().value as string);\n    }\n\n    for (const tag of tagsForTopic(event.topic)) {\n      await options.revalidateTag?.(tag, 'max');\n    }\n    await options.onEvent?.(event);\n\n    return new Response(null, { status: 200 });\n  };\n}\n\n/** The cache tags a storefront gives what each topic invalidates. */\nexport const CACHE_TAGS = {\n  shop: 'magicstore:shop',\n  catalog: 'magicstore:catalog',\n  pages: 'magicstore:pages',\n  home: 'magicstore:home',\n} as const;\n\nexport function tagsForTopic(topic: string): string[] {\n  switch (topic) {\n    case 'SHOP_UPDATED':\n      return [CACHE_TAGS.shop];\n    case 'CATALOG_UPDATED':\n      return [CACHE_TAGS.catalog];\n    case 'PAGES_UPDATED':\n      return [CACHE_TAGS.pages];\n    case 'HOME_UPDATED':\n      return [CACHE_TAGS.home];\n    default:\n      return [];\n  }\n}\n","import { CACHE_TAGS } from './webhook';\n\n/**\n * The cache tag of an API path — what a webhook topic will invalidate. Personal and live data\n * (customer, cart, checkout, orders, search, stock-bearing listings are still catalog) get none:\n * they must never be cached across visitors.\n */\nexport function tagForPath(pathname: string): string | null {\n  const path = pathname.replace(/^.*\\/api\\/v2\\/storefront/, '');\n  if (path === '/shop' || path === '/contacts' || path === '/theme/section-schema') {\n    return CACHE_TAGS.shop;\n  }\n  if (path === '/home') {\n    return CACHE_TAGS.home;\n  }\n  if (path.startsWith('/pages') || path === '/menus/footer') {\n    return CACHE_TAGS.pages;\n  }\n  if (\n    path.startsWith('/products') ||\n    path.startsWith('/collections') ||\n    path.startsWith('/menus/') ||\n    path === '/reels' ||\n    path === '/sitemap' ||\n    path === '/locations'\n  ) {\n    return CACHE_TAGS.catalog;\n  }\n  return null;\n}\n\n/**\n * A `fetch` for `createStorefrontClient` on a Next.js server: public GETs are cached under the tag\n * a webhook revalidates (and at most `revalidate` seconds); everything else is `no-store`.\n *\n * ```ts\n * const client = createStorefrontClient({ shopDomain, fetch: nextCacheFetch() });\n * ```\n */\nexport function nextCacheFetch(\n  options: { revalidate?: number | false; fetch?: typeof globalThis.fetch } = {},\n): typeof globalThis.fetch {\n  const base = options.fetch ?? globalThis.fetch;\n  return (input, init) => {\n    const request = input instanceof Request ? input : new Request(input, init);\n    const tag =\n      request.method === 'GET' && !request.headers.has('Authorization')\n        ? tagForPath(new URL(request.url).pathname)\n        : null;\n    const next =\n      tag === null\n        ? { cache: 'no-store' as const }\n        : { next: { tags: [tag], revalidate: options.revalidate ?? 3600 } };\n    return base(request, next as RequestInit);\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACcO,IAAM,8BAA8B;AAM3C,eAAsB,uBACpB,QACA,QACA,SACA,aAAqB,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAC/B;AAClB,MAAI,CAAC,UAAU,CAAC,QAAQ;AACtB,WAAO;AAAA,EACT;AACA,MAAI,YAA2B;AAC/B,QAAM,aAAuB,CAAC;AAC9B,aAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AACpC,UAAM,YAAY,KAAK,QAAQ,GAAG;AAClC,UAAM,MAAM,KAAK,MAAM,GAAG,SAAS,EAAE,KAAK;AAC1C,UAAM,QAAQ,KAAK,MAAM,YAAY,CAAC,EAAE,KAAK;AAC7C,QAAI,QAAQ,OAAO,QAAQ,KAAK,KAAK,GAAG;AACtC,kBAAY,OAAO,KAAK;AAAA,IAC1B,WAAW,QAAQ,QAAQ,UAAU,IAAI;AACvC,iBAAW,KAAK,MAAM,YAAY,CAAC;AAAA,IACrC;AAAA,EACF;AACA,MACE,cAAc,QACd,WAAW,WAAW,KACtB,KAAK,IAAI,aAAa,SAAS,IAAI,6BACnC;AACA,WAAO;AAAA,EACT;AACA,QAAM,WAAW,MAAM,cAAc,QAAQ,GAAG,SAAS,IAAI,OAAO,EAAE;AACtE,SAAO,WAAW,KAAK,CAAC,cAAc,kBAAkB,WAAW,QAAQ,CAAC;AAC9E;AAEA,eAAe,cAAc,QAAgB,SAAkC;AAC7E,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,MAAM,MAAM,WAAW,OAAO,OAAO;AAAA,IACzC;AAAA,IACA,QAAQ,OAAO,MAAM;AAAA,IACrB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,YAAY,MAAM,WAAW,OAAO,OAAO,KAAK,QAAQ,KAAK,QAAQ,OAAO,OAAO,CAAC;AAC1F,SAAO,CAAC,GAAG,IAAI,WAAW,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACjG;AAEA,SAAS,kBAAkB,GAAW,GAAoB;AACxD,MAAI,EAAE,WAAW,EAAE,QAAQ;AACzB,WAAO;AAAA,EACT;AACA,MAAI,aAAa;AACjB,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,kBAAc,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;AAAA,EAChD;AACA,SAAO,eAAe;AACxB;AAsBO,SAAS,qBACd,SACyC;AACzC,QAAM,OAAO,oBAAI,IAAY;AAE7B,SAAO,OAAO,YAAY;AACxB,UAAM,UAAU,MAAM,QAAQ,KAAK;AACnC,UAAM,MAAM,KAAK,OAAO,QAAQ,MAAM,KAAK,KAAK,IAAI,KAAK,GAAI;AAC7D,QACE,CAAE,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,QAAQ,IAAI,wBAAwB;AAAA,MAC5C;AAAA,MACA;AAAA,IACF,GACA;AACA,aAAO,IAAI,SAAS,qBAAqB,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1D;AAEA,QAAI;AACJ,QAAI;AACF,cAAQ,KAAK,MAAM,OAAO;AAAA,IAC5B,QAAQ;AACN,aAAO,IAAI,SAAS,gBAAgB,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrD;AACA,QAAI,OAAO,OAAO,OAAO,YAAY,OAAO,MAAM,UAAU,UAAU;AACpE,aAAO,IAAI,SAAS,gBAAgB,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrD;AAEA,QAAI,KAAK,IAAI,MAAM,EAAE,GAAG;AACtB,aAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3C;AACA,SAAK,IAAI,MAAM,EAAE;AACjB,QAAI,KAAK,OAAO,KAAM;AACpB,WAAK,OAAO,KAAK,OAAO,EAAE,KAAK,EAAE,KAAe;AAAA,IAClD;AAEA,eAAW,OAAO,aAAa,MAAM,KAAK,GAAG;AAC3C,YAAM,QAAQ,gBAAgB,KAAK,KAAK;AAAA,IAC1C;AACA,UAAM,QAAQ,UAAU,KAAK;AAE7B,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3C;AACF;AAGO,IAAM,aAAa;AAAA,EACxB,MAAM;AAAA,EACN,SAAS;AAAA,EACT,OAAO;AAAA,EACP,MAAM;AACR;AAEO,SAAS,aAAa,OAAyB;AACpD,UAAQ,OAAO;AAAA,IACb,KAAK;AACH,aAAO,CAAC,WAAW,IAAI;AAAA,IACzB,KAAK;AACH,aAAO,CAAC,WAAW,OAAO;AAAA,IAC5B,KAAK;AACH,aAAO,CAAC,WAAW,KAAK;AAAA,IAC1B,KAAK;AACH,aAAO,CAAC,WAAW,IAAI;AAAA,IACzB;AACE,aAAO,CAAC;AAAA,EACZ;AACF;;;AC5JO,SAAS,WAAW,UAAiC;AAC1D,QAAM,OAAO,SAAS,QAAQ,4BAA4B,EAAE;AAC5D,MAAI,SAAS,WAAW,SAAS,eAAe,SAAS,yBAAyB;AAChF,WAAO,WAAW;AAAA,EACpB;AACA,MAAI,SAAS,SAAS;AACpB,WAAO,WAAW;AAAA,EACpB;AACA,MAAI,KAAK,WAAW,QAAQ,KAAK,SAAS,iBAAiB;AACzD,WAAO,WAAW;AAAA,EACpB;AACA,MACE,KAAK,WAAW,WAAW,KAC3B,KAAK,WAAW,cAAc,KAC9B,KAAK,WAAW,SAAS,KACzB,SAAS,YACT,SAAS,cACT,SAAS,cACT;AACA,WAAO,WAAW;AAAA,EACpB;AACA,SAAO;AACT;AAUO,SAAS,eACd,UAA4E,CAAC,GACpD;AACzB,QAAM,OAAO,QAAQ,SAAS,WAAW;AACzC,SAAO,CAAC,OAAO,SAAS;AACtB,UAAM,UAAU,iBAAiB,UAAU,QAAQ,IAAI,QAAQ,OAAO,IAAI;AAC1E,UAAM,MACJ,QAAQ,WAAW,SAAS,CAAC,QAAQ,QAAQ,IAAI,eAAe,IAC5D,WAAW,IAAI,IAAI,QAAQ,GAAG,EAAE,QAAQ,IACxC;AACN,UAAM,OACJ,QAAQ,OACJ,EAAE,OAAO,WAAoB,IAC7B,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,YAAY,QAAQ,cAAc,KAAK,EAAE;AACtE,WAAO,KAAK,SAAS,IAAmB;AAAA,EAC1C;AACF;","names":[]}

package/dist/server.d.cts

@@ -0,0 +1,67 @@
+/**
+ * The cache tag of an API path — what a webhook topic will invalidate. Personal and live data
+ * (customer, cart, checkout, orders, search, stock-bearing listings are still catalog) get none:
+ * they must never be cached across visitors.
+ */
+declare function tagForPath(pathname: string): string | null;
+/**
+ * A `fetch` for `createStorefrontClient` on a Next.js server: public GETs are cached under the tag
+ * a webhook revalidates (and at most `revalidate` seconds); everything else is `no-store`.
+ *
+ * ```ts
+ * const client = createStorefrontClient({ shopDomain, fetch: nextCacheFetch() });
+ * ```
+ */
+declare function nextCacheFetch(options?: {
+    revalidate?: number | false;
+    fetch?: typeof globalThis.fetch;
+}): typeof globalThis.fetch;
+
+/** Topics the platform sends today. New ones may be added — ignore what you do not know. */
+type WebhookTopic = 'SHOP_UPDATED' | 'CATALOG_UPDATED' | 'PAGES_UPDATED' | 'HOME_UPDATED';
+interface WebhookEvent {
+    /** A ULID, the same across retries: deduplicate by it. */
+    id: string;
+    topic: WebhookTopic | (string & {});
+    /** The shop's key. */
+    shop: string;
+    occurredAt: string;
+    data: Record<string, unknown>;
+}
+/** How far the signature's timestamp may be from this clock (replay window). */
+declare const SIGNATURE_TOLERANCE_SECONDS = 300;
+/**
+ * Verifies `X-MagicStore-Signature: t=<unix>,v1=<hex HMAC-SHA256(secret, "<t>.<raw body>")>` over
+ * the RAW body, in constant time, with Web Crypto — so it runs in Node, edge runtimes and Workers.
+ */
+declare function verifyWebhookSignature(secret: string, header: string | null, rawBody: string, nowSeconds?: number): Promise<boolean>;
+interface WebhookHandlerOptions {
+    /** The endpoint's signing secret (`whsec_…`). */
+    secret: string;
+    /**
+     * Called with each cache tag a topic invalidates — pass Next.js's `revalidateTag` as is: it gets
+     * the `'max'` profile (serve stale while it refetches), which Next.js 16 requires.
+     */
+    revalidateTag?: (tag: string, profile: 'max') => void | Promise<void>;
+    /** Anything else to do with a verified event. Runs after the tags are revalidated. */
+    onEvent?: (event: WebhookEvent) => void | Promise<void>;
+    /** For tests. */
+    now?: () => number;
+}
+/**
+ * A route handler for the platform's webhook: `export const POST = createWebhookHandler({ secret,
+ * revalidateTag })` in `app/api/magicstore/webhook/route.ts`. Answers 401 on a bad signature, 400
+ * on a body that is not an event, 200 otherwise — including for a topic it does not know. Events
+ * seen before (same id, this instance) are acknowledged and skipped.
+ */
+declare function createWebhookHandler(options: WebhookHandlerOptions): (request: Request) => Promise<Response>;
+/** The cache tags a storefront gives what each topic invalidates. */
+declare const CACHE_TAGS: {
+    readonly shop: "magicstore:shop";
+    readonly catalog: "magicstore:catalog";
+    readonly pages: "magicstore:pages";
+    readonly home: "magicstore:home";
+};
+declare function tagsForTopic(topic: string): string[];
+
+export { CACHE_TAGS, SIGNATURE_TOLERANCE_SECONDS, type WebhookEvent, type WebhookHandlerOptions, type WebhookTopic, createWebhookHandler, nextCacheFetch, tagForPath, tagsForTopic, verifyWebhookSignature };

package/dist/server.d.ts

@@ -0,0 +1,67 @@
+/**
+ * The cache tag of an API path — what a webhook topic will invalidate. Personal and live data
+ * (customer, cart, checkout, orders, search, stock-bearing listings are still catalog) get none:
+ * they must never be cached across visitors.
+ */
+declare function tagForPath(pathname: string): string | null;
+/**
+ * A `fetch` for `createStorefrontClient` on a Next.js server: public GETs are cached under the tag
+ * a webhook revalidates (and at most `revalidate` seconds); everything else is `no-store`.
+ *
+ * ```ts
+ * const client = createStorefrontClient({ shopDomain, fetch: nextCacheFetch() });
+ * ```
+ */
+declare function nextCacheFetch(options?: {
+    revalidate?: number | false;
+    fetch?: typeof globalThis.fetch;
+}): typeof globalThis.fetch;
+
+/** Topics the platform sends today. New ones may be added — ignore what you do not know. */
+type WebhookTopic = 'SHOP_UPDATED' | 'CATALOG_UPDATED' | 'PAGES_UPDATED' | 'HOME_UPDATED';
+interface WebhookEvent {
+    /** A ULID, the same across retries: deduplicate by it. */
+    id: string;
+    topic: WebhookTopic | (string & {});
+    /** The shop's key. */
+    shop: string;
+    occurredAt: string;
+    data: Record<string, unknown>;
+}
+/** How far the signature's timestamp may be from this clock (replay window). */
+declare const SIGNATURE_TOLERANCE_SECONDS = 300;
+/**
+ * Verifies `X-MagicStore-Signature: t=<unix>,v1=<hex HMAC-SHA256(secret, "<t>.<raw body>")>` over
+ * the RAW body, in constant time, with Web Crypto — so it runs in Node, edge runtimes and Workers.
+ */
+declare function verifyWebhookSignature(secret: string, header: string | null, rawBody: string, nowSeconds?: number): Promise<boolean>;
+interface WebhookHandlerOptions {
+    /** The endpoint's signing secret (`whsec_…`). */
+    secret: string;
+    /**
+     * Called with each cache tag a topic invalidates — pass Next.js's `revalidateTag` as is: it gets
+     * the `'max'` profile (serve stale while it refetches), which Next.js 16 requires.
+     */
+    revalidateTag?: (tag: string, profile: 'max') => void | Promise<void>;
+    /** Anything else to do with a verified event. Runs after the tags are revalidated. */
+    onEvent?: (event: WebhookEvent) => void | Promise<void>;
+    /** For tests. */
+    now?: () => number;
+}
+/**
+ * A route handler for the platform's webhook: `export const POST = createWebhookHandler({ secret,
+ * revalidateTag })` in `app/api/magicstore/webhook/route.ts`. Answers 401 on a bad signature, 400
+ * on a body that is not an event, 200 otherwise — including for a topic it does not know. Events
+ * seen before (same id, this instance) are acknowledged and skipped.
+ */
+declare function createWebhookHandler(options: WebhookHandlerOptions): (request: Request) => Promise<Response>;
+/** The cache tags a storefront gives what each topic invalidates. */
+declare const CACHE_TAGS: {
+    readonly shop: "magicstore:shop";
+    readonly catalog: "magicstore:catalog";
+    readonly pages: "magicstore:pages";
+    readonly home: "magicstore:home";
+};
+declare function tagsForTopic(topic: string): string[];
+
+export { CACHE_TAGS, SIGNATURE_TOLERANCE_SECONDS, type WebhookEvent, type WebhookHandlerOptions, type WebhookTopic, createWebhookHandler, nextCacheFetch, tagForPath, tagsForTopic, verifyWebhookSignature };

package/dist/server.js

@@ -0,0 +1,139 @@
+// src/server/webhook.ts
+var SIGNATURE_TOLERANCE_SECONDS = 300;
+async function verifyWebhookSignature(secret, header, rawBody, nowSeconds = Math.floor(Date.now() / 1e3)) {
+  if (!header || !secret) {
+    return false;
+  }
+  let timestamp = null;
+  const signatures = [];
+  for (const pair of header.split(",")) {
+    const separator = pair.indexOf("=");
+    const key = pair.slice(0, separator).trim();
+    const value = pair.slice(separator + 1).trim();
+    if (key === "t" && /^\d+$/.test(value)) {
+      timestamp = Number(value);
+    } else if (key === "v1" && value !== "") {
+      signatures.push(value.toLowerCase());
+    }
+  }
+  if (timestamp === null || signatures.length === 0 || Math.abs(nowSeconds - timestamp) > SIGNATURE_TOLERANCE_SECONDS) {
+    return false;
+  }
+  const expected = await hmacSha256Hex(secret, `${timestamp}.${rawBody}`);
+  return signatures.some((signature) => constantTimeEqual(signature, expected));
+}
+async function hmacSha256Hex(secret, message) {
+  const encoder = new TextEncoder();
+  const key = await globalThis.crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = await globalThis.crypto.subtle.sign("HMAC", key, encoder.encode(message));
+  return [...new Uint8Array(signature)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  let difference = 0;
+  for (let i = 0; i < a.length; i++) {
+    difference |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return difference === 0;
+}
+function createWebhookHandler(options) {
+  const seen = /* @__PURE__ */ new Set();
+  return async (request) => {
+    const rawBody = await request.text();
+    const now = Math.floor((options.now?.() ?? Date.now()) / 1e3);
+    if (!await verifyWebhookSignature(
+      options.secret,
+      request.headers.get("X-MagicStore-Signature"),
+      rawBody,
+      now
+    )) {
+      return new Response("invalid signature", { status: 401 });
+    }
+    let event;
+    try {
+      event = JSON.parse(rawBody);
+    } catch {
+      return new Response("invalid body", { status: 400 });
+    }
+    if (typeof event?.id !== "string" || typeof event.topic !== "string") {
+      return new Response("invalid body", { status: 400 });
+    }
+    if (seen.has(event.id)) {
+      return new Response(null, { status: 200 });
+    }
+    seen.add(event.id);
+    if (seen.size > 1e3) {
+      seen.delete(seen.values().next().value);
+    }
+    for (const tag of tagsForTopic(event.topic)) {
+      await options.revalidateTag?.(tag, "max");
+    }
+    await options.onEvent?.(event);
+    return new Response(null, { status: 200 });
+  };
+}
+var CACHE_TAGS = {
+  shop: "magicstore:shop",
+  catalog: "magicstore:catalog",
+  pages: "magicstore:pages",
+  home: "magicstore:home"
+};
+function tagsForTopic(topic) {
+  switch (topic) {
+    case "SHOP_UPDATED":
+      return [CACHE_TAGS.shop];
+    case "CATALOG_UPDATED":
+      return [CACHE_TAGS.catalog];
+    case "PAGES_UPDATED":
+      return [CACHE_TAGS.pages];
+    case "HOME_UPDATED":
+      return [CACHE_TAGS.home];
+    default:
+      return [];
+  }
+}
+
+// src/server/cache.ts
+function tagForPath(pathname) {
+  const path = pathname.replace(/^.*\/api\/v2\/storefront/, "");
+  if (path === "/shop" || path === "/contacts" || path === "/theme/section-schema") {
+    return CACHE_TAGS.shop;
+  }
+  if (path === "/home") {
+    return CACHE_TAGS.home;
+  }
+  if (path.startsWith("/pages") || path === "/menus/footer") {
+    return CACHE_TAGS.pages;
+  }
+  if (path.startsWith("/products") || path.startsWith("/collections") || path.startsWith("/menus/") || path === "/reels" || path === "/sitemap" || path === "/locations") {
+    return CACHE_TAGS.catalog;
+  }
+  return null;
+}
+function nextCacheFetch(options = {}) {
+  const base = options.fetch ?? globalThis.fetch;
+  return (input, init) => {
+    const request = input instanceof Request ? input : new Request(input, init);
+    const tag = request.method === "GET" && !request.headers.has("Authorization") ? tagForPath(new URL(request.url).pathname) : null;
+    const next = tag === null ? { cache: "no-store" } : { next: { tags: [tag], revalidate: options.revalidate ?? 3600 } };
+    return base(request, next);
+  };
+}
+export {
+  CACHE_TAGS,
+  SIGNATURE_TOLERANCE_SECONDS,
+  createWebhookHandler,
+  nextCacheFetch,
+  tagForPath,
+  tagsForTopic,
+  verifyWebhookSignature
+};
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/webhook.ts","../src/server/cache.ts"],"sourcesContent":["/** Topics the platform sends today. New ones may be added — ignore what you do not know. */\nexport type WebhookTopic = 'SHOP_UPDATED' | 'CATALOG_UPDATED' | 'PAGES_UPDATED' | 'HOME_UPDATED';\n\nexport interface WebhookEvent {\n  /** A ULID, the same across retries: deduplicate by it. */\n  id: string;\n  topic: WebhookTopic | (string & {});\n  /** The shop's key. */\n  shop: string;\n  occurredAt: string;\n  data: Record<string, unknown>;\n}\n\n/** How far the signature's timestamp may be from this clock (replay window). */\nexport const SIGNATURE_TOLERANCE_SECONDS = 300;\n\n/**\n * Verifies `X-MagicStore-Signature: t=<unix>,v1=<hex HMAC-SHA256(secret, \"<t>.<raw body>\")>` over\n * the RAW body, in constant time, with Web Crypto — so it runs in Node, edge runtimes and Workers.\n */\nexport async function verifyWebhookSignature(\n  secret: string,\n  header: string | null,\n  rawBody: string,\n  nowSeconds: number = Math.floor(Date.now() / 1000),\n): Promise<boolean> {\n  if (!header || !secret) {\n    return false;\n  }\n  let timestamp: number | null = null;\n  const signatures: string[] = [];\n  for (const pair of header.split(',')) {\n    const separator = pair.indexOf('=');\n    const key = pair.slice(0, separator).trim();\n    const value = pair.slice(separator + 1).trim();\n    if (key === 't' && /^\\d+$/.test(value)) {\n      timestamp = Number(value);\n    } else if (key === 'v1' && value !== '') {\n      signatures.push(value.toLowerCase());\n    }\n  }\n  if (\n    timestamp === null ||\n    signatures.length === 0 ||\n    Math.abs(nowSeconds - timestamp) > SIGNATURE_TOLERANCE_SECONDS\n  ) {\n    return false;\n  }\n  const expected = await hmacSha256Hex(secret, `${timestamp}.${rawBody}`);\n  return signatures.some((signature) => constantTimeEqual(signature, expected));\n}\n\nasync function hmacSha256Hex(secret: string, message: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const key = await globalThis.crypto.subtle.importKey(\n    'raw',\n    encoder.encode(secret),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign'],\n  );\n  const signature = await globalThis.crypto.subtle.sign('HMAC', key, encoder.encode(message));\n  return [...new Uint8Array(signature)].map((byte) => byte.toString(16).padStart(2, '0')).join('');\n}\n\nfunction constantTimeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) {\n    return false;\n  }\n  let difference = 0;\n  for (let i = 0; i < a.length; i++) {\n    difference |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n  return difference === 0;\n}\n\nexport interface WebhookHandlerOptions {\n  /** The endpoint's signing secret (`whsec_…`). */\n  secret: string;\n  /**\n   * Called with each cache tag a topic invalidates — pass Next.js's `revalidateTag` as is: it gets\n   * the `'max'` profile (serve stale while it refetches), which Next.js 16 requires.\n   */\n  revalidateTag?: (tag: string, profile: 'max') => void | Promise<void>;\n  /** Anything else to do with a verified event. Runs after the tags are revalidated. */\n  onEvent?: (event: WebhookEvent) => void | Promise<void>;\n  /** For tests. */\n  now?: () => number;\n}\n\n/**\n * A route handler for the platform's webhook: `export const POST = createWebhookHandler({ secret,\n * revalidateTag })` in `app/api/magicstore/webhook/route.ts`. Answers 401 on a bad signature, 400\n * on a body that is not an event, 200 otherwise — including for a topic it does not know. Events\n * seen before (same id, this instance) are acknowledged and skipped.\n */\nexport function createWebhookHandler(\n  options: WebhookHandlerOptions,\n): (request: Request) => Promise<Response> {\n  const seen = new Set<string>();\n\n  return async (request) => {\n    const rawBody = await request.text();\n    const now = Math.floor((options.now?.() ?? Date.now()) / 1000);\n    if (\n      !(await verifyWebhookSignature(\n        options.secret,\n        request.headers.get('X-MagicStore-Signature'),\n        rawBody,\n        now,\n      ))\n    ) {\n      return new Response('invalid signature', { status: 401 });\n    }\n\n    let event: WebhookEvent;\n    try {\n      event = JSON.parse(rawBody) as WebhookEvent;\n    } catch {\n      return new Response('invalid body', { status: 400 });\n    }\n    if (typeof event?.id !== 'string' || typeof event.topic !== 'string') {\n      return new Response('invalid body', { status: 400 });\n    }\n\n    if (seen.has(event.id)) {\n      return new Response(null, { status: 200 });\n    }\n    seen.add(event.id);\n    if (seen.size > 1000) {\n      seen.delete(seen.values().next().value as string);\n    }\n\n    for (const tag of tagsForTopic(event.topic)) {\n      await options.revalidateTag?.(tag, 'max');\n    }\n    await options.onEvent?.(event);\n\n    return new Response(null, { status: 200 });\n  };\n}\n\n/** The cache tags a storefront gives what each topic invalidates. */\nexport const CACHE_TAGS = {\n  shop: 'magicstore:shop',\n  catalog: 'magicstore:catalog',\n  pages: 'magicstore:pages',\n  home: 'magicstore:home',\n} as const;\n\nexport function tagsForTopic(topic: string): string[] {\n  switch (topic) {\n    case 'SHOP_UPDATED':\n      return [CACHE_TAGS.shop];\n    case 'CATALOG_UPDATED':\n      return [CACHE_TAGS.catalog];\n    case 'PAGES_UPDATED':\n      return [CACHE_TAGS.pages];\n    case 'HOME_UPDATED':\n      return [CACHE_TAGS.home];\n    default:\n      return [];\n  }\n}\n","import { CACHE_TAGS } from './webhook';\n\n/**\n * The cache tag of an API path — what a webhook topic will invalidate. Personal and live data\n * (customer, cart, checkout, orders, search, stock-bearing listings are still catalog) get none:\n * they must never be cached across visitors.\n */\nexport function tagForPath(pathname: string): string | null {\n  const path = pathname.replace(/^.*\\/api\\/v2\\/storefront/, '');\n  if (path === '/shop' || path === '/contacts' || path === '/theme/section-schema') {\n    return CACHE_TAGS.shop;\n  }\n  if (path === '/home') {\n    return CACHE_TAGS.home;\n  }\n  if (path.startsWith('/pages') || path === '/menus/footer') {\n    return CACHE_TAGS.pages;\n  }\n  if (\n    path.startsWith('/products') ||\n    path.startsWith('/collections') ||\n    path.startsWith('/menus/') ||\n    path === '/reels' ||\n    path === '/sitemap' ||\n    path === '/locations'\n  ) {\n    return CACHE_TAGS.catalog;\n  }\n  return null;\n}\n\n/**\n * A `fetch` for `createStorefrontClient` on a Next.js server: public GETs are cached under the tag\n * a webhook revalidates (and at most `revalidate` seconds); everything else is `no-store`.\n *\n * ```ts\n * const client = createStorefrontClient({ shopDomain, fetch: nextCacheFetch() });\n * ```\n */\nexport function nextCacheFetch(\n  options: { revalidate?: number | false; fetch?: typeof globalThis.fetch } = {},\n): typeof globalThis.fetch {\n  const base = options.fetch ?? globalThis.fetch;\n  return (input, init) => {\n    const request = input instanceof Request ? input : new Request(input, init);\n    const tag =\n      request.method === 'GET' && !request.headers.has('Authorization')\n        ? tagForPath(new URL(request.url).pathname)\n        : null;\n    const next =\n      tag === null\n        ? { cache: 'no-store' as const }\n        : { next: { tags: [tag], revalidate: options.revalidate ?? 3600 } };\n    return base(request, next as RequestInit);\n  };\n}\n"],"mappings":";AAcO,IAAM,8BAA8B;AAM3C,eAAsB,uBACpB,QACA,QACA,SACA,aAAqB,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAC/B;AAClB,MAAI,CAAC,UAAU,CAAC,QAAQ;AACtB,WAAO;AAAA,EACT;AACA,MAAI,YAA2B;AAC/B,QAAM,aAAuB,CAAC;AAC9B,aAAW,QAAQ,OAAO,MAAM,GAAG,GAAG;AACpC,UAAM,YAAY,KAAK,QAAQ,GAAG;AAClC,UAAM,MAAM,KAAK,MAAM,GAAG,SAAS,EAAE,KAAK;AAC1C,UAAM,QAAQ,KAAK,MAAM,YAAY,CAAC,EAAE,KAAK;AAC7C,QAAI,QAAQ,OAAO,QAAQ,KAAK,KAAK,GAAG;AACtC,kBAAY,OAAO,KAAK;AAAA,IAC1B,WAAW,QAAQ,QAAQ,UAAU,IAAI;AACvC,iBAAW,KAAK,MAAM,YAAY,CAAC;AAAA,IACrC;AAAA,EACF;AACA,MACE,cAAc,QACd,WAAW,WAAW,KACtB,KAAK,IAAI,aAAa,SAAS,IAAI,6BACnC;AACA,WAAO;AAAA,EACT;AACA,QAAM,WAAW,MAAM,cAAc,QAAQ,GAAG,SAAS,IAAI,OAAO,EAAE;AACtE,SAAO,WAAW,KAAK,CAAC,cAAc,kBAAkB,WAAW,QAAQ,CAAC;AAC9E;AAEA,eAAe,cAAc,QAAgB,SAAkC;AAC7E,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,MAAM,MAAM,WAAW,OAAO,OAAO;AAAA,IACzC;AAAA,IACA,QAAQ,OAAO,MAAM;AAAA,IACrB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,YAAY,MAAM,WAAW,OAAO,OAAO,KAAK,QAAQ,KAAK,QAAQ,OAAO,OAAO,CAAC;AAC1F,SAAO,CAAC,GAAG,IAAI,WAAW,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACjG;AAEA,SAAS,kBAAkB,GAAW,GAAoB;AACxD,MAAI,EAAE,WAAW,EAAE,QAAQ;AACzB,WAAO;AAAA,EACT;AACA,MAAI,aAAa;AACjB,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AACjC,kBAAc,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;AAAA,EAChD;AACA,SAAO,eAAe;AACxB;AAsBO,SAAS,qBACd,SACyC;AACzC,QAAM,OAAO,oBAAI,IAAY;AAE7B,SAAO,OAAO,YAAY;AACxB,UAAM,UAAU,MAAM,QAAQ,KAAK;AACnC,UAAM,MAAM,KAAK,OAAO,QAAQ,MAAM,KAAK,KAAK,IAAI,KAAK,GAAI;AAC7D,QACE,CAAE,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,QAAQ,IAAI,wBAAwB;AAAA,MAC5C;AAAA,MACA;AAAA,IACF,GACA;AACA,aAAO,IAAI,SAAS,qBAAqB,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1D;AAEA,QAAI;AACJ,QAAI;AACF,cAAQ,KAAK,MAAM,OAAO;AAAA,IAC5B,QAAQ;AACN,aAAO,IAAI,SAAS,gBAAgB,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrD;AACA,QAAI,OAAO,OAAO,OAAO,YAAY,OAAO,MAAM,UAAU,UAAU;AACpE,aAAO,IAAI,SAAS,gBAAgB,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrD;AAEA,QAAI,KAAK,IAAI,MAAM,EAAE,GAAG;AACtB,aAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3C;AACA,SAAK,IAAI,MAAM,EAAE;AACjB,QAAI,KAAK,OAAO,KAAM;AACpB,WAAK,OAAO,KAAK,OAAO,EAAE,KAAK,EAAE,KAAe;AAAA,IAClD;AAEA,eAAW,OAAO,aAAa,MAAM,KAAK,GAAG;AAC3C,YAAM,QAAQ,gBAAgB,KAAK,KAAK;AAAA,IAC1C;AACA,UAAM,QAAQ,UAAU,KAAK;AAE7B,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3C;AACF;AAGO,IAAM,aAAa;AAAA,EACxB,MAAM;AAAA,EACN,SAAS;AAAA,EACT,OAAO;AAAA,EACP,MAAM;AACR;AAEO,SAAS,aAAa,OAAyB;AACpD,UAAQ,OAAO;AAAA,IACb,KAAK;AACH,aAAO,CAAC,WAAW,IAAI;AAAA,IACzB,KAAK;AACH,aAAO,CAAC,WAAW,OAAO;AAAA,IAC5B,KAAK;AACH,aAAO,CAAC,WAAW,KAAK;AAAA,IAC1B,KAAK;AACH,aAAO,CAAC,WAAW,IAAI;AAAA,IACzB;AACE,aAAO,CAAC;AAAA,EACZ;AACF;;;AC5JO,SAAS,WAAW,UAAiC;AAC1D,QAAM,OAAO,SAAS,QAAQ,4BAA4B,EAAE;AAC5D,MAAI,SAAS,WAAW,SAAS,eAAe,SAAS,yBAAyB;AAChF,WAAO,WAAW;AAAA,EACpB;AACA,MAAI,SAAS,SAAS;AACpB,WAAO,WAAW;AAAA,EACpB;AACA,MAAI,KAAK,WAAW,QAAQ,KAAK,SAAS,iBAAiB;AACzD,WAAO,WAAW;AAAA,EACpB;AACA,MACE,KAAK,WAAW,WAAW,KAC3B,KAAK,WAAW,cAAc,KAC9B,KAAK,WAAW,SAAS,KACzB,SAAS,YACT,SAAS,cACT,SAAS,cACT;AACA,WAAO,WAAW;AAAA,EACpB;AACA,SAAO;AACT;AAUO,SAAS,eACd,UAA4E,CAAC,GACpD;AACzB,QAAM,OAAO,QAAQ,SAAS,WAAW;AACzC,SAAO,CAAC,OAAO,SAAS;AACtB,UAAM,UAAU,iBAAiB,UAAU,QAAQ,IAAI,QAAQ,OAAO,IAAI;AAC1E,UAAM,MACJ,QAAQ,WAAW,SAAS,CAAC,QAAQ,QAAQ,IAAI,eAAe,IAC5D,WAAW,IAAI,IAAI,QAAQ,GAAG,EAAE,QAAQ,IACxC;AACN,UAAM,OACJ,QAAQ,OACJ,EAAE,OAAO,WAAoB,IAC7B,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,YAAY,QAAQ,cAAc,KAAK,EAAE;AACtE,WAAO,KAAK,SAAS,IAAmB;AAAA,EAC1C;AACF;","names":[]}

package/package.json

@@ -0,0 +1,64 @@
+{
+  "name": "@magicstoreai/hydrogen",
+  "version": "0.1.0",
+  "description": "React building blocks for MagicStore storefronts: shop, customer, cart, wishlist, money, analytics, SEO and Next.js cache helpers",
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    },
+    "./core": {
+      "types": "./dist/core.d.ts",
+      "import": "./dist/core.js",
+      "require": "./dist/core.cjs"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js",
+      "require": "./dist/server.cjs"
+    },
+    "./seo": {
+      "types": "./dist/seo.d.ts",
+      "import": "./dist/seo.js",
+      "require": "./dist/seo.cjs"
+    }
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "CATALOGUE.md"
+  ],
+  "peerDependencies": {
+    "react": "^18.3.0 || ^19.0.0"
+  },
+  "devDependencies": {
+    "@testing-library/react": "^16.3.3",
+    "@types/node": "^26.6.2",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
+    "jsdom": "^30.1.1",
+    "react": "^19.3.0",
+    "react-dom": "^19.3.0",
+    "tsup": "^8.5.1",
+    "typescript": "5.9.3",
+    "vitest": "^5.0.1"
+  },
+  "dependencies": {
+    "@magicstoreai/storefront-client": "0.1.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsup",
+    "catalogue": "node scripts/catalogue.mjs",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  }
+}