@moonbase.sh/storefront-api 3.5.0 → 3.6.0

package/README.md

@@ -110,6 +110,68 @@ another tenant's) arrives as the same `NotFoundError`, so that a signed-in
 customer cannot use it to enumerate a merchant's group IDs. Joining twice
 succeeds and changes nothing.
 
+### Captchas on sign-up
+
+A merchant can ask customers to solve a captcha before they sign up. The vendor
+says whether this store does:
+
+```ts
+const vendor = await client.vendor.get()
+const captcha = vendor.features?.captcha // { url } when it does, null or undefined when not
+```
+
+`captcha.url` is a page on the store's own `<account-id>.moonbase.sh` that draws
+the challenge. Embed it in an iframe with `action=signup`, and it hands you the
+solution with `postMessage`:
+
+```ts
+const src = new URL(captcha.url)
+src.searchParams.set('action', 'signup') // optional: theme=light|dark|auto, size=normal|compact
+
+const frame = document.createElement('iframe')
+frame.src = src.href
+frame.title = 'Captcha'
+frame.style.cssText = 'border: none; color-scheme: normal; width: 300px; height: 65px'
+form.append(frame)
+
+let captchaToken: string | undefined
+window.addEventListener('message', (event) => {
+  if (event.source !== frame.contentWindow || event.origin !== src.origin || event.data?.source !== 'moonbase-captcha')
+    return
+  if (event.data.event === 'resize')
+    Object.assign(frame.style, { width: `${event.data.width}px`, height: `${event.data.height}px` })
+  else if (event.data.event === 'token')
+    captchaToken = event.data.token
+  else // 'expired', or 'error' with a `code` ('load-failed' when the challenge could not load)
+    captchaToken = undefined
+})
+```
+
+Then pass the solution along, and reset the frame after every attempt, since a
+solution is good for one:
+
+```ts
+try {
+  await client.identity.signUp('Jane', 'jane@example.com', 'password', null, true, true, true, {
+    captchaToken,
+  })
+}
+catch (err) {
+  if (err instanceof CaptchaRequiredError)
+    showError(err.message) // the API's own copy, safe to show
+  throw err
+}
+finally {
+  captchaToken = undefined
+  frame.contentWindow?.postMessage({ source: 'moonbase-captcha', command: 'reset' }, src.origin)
+}
+```
+
+Without a solution, or with one that is expired or already used, the sign-up is
+refused with `CaptchaRequiredError` (a `MoonbaseError`). A site with a
+Content-Security-Policy has to allow the store's `https://<account-id>.moonbase.sh`
+in `frame-src`.
+
 ## Inventory flow
 
 Most inventory endpoints require an authenticated user:

package/dist/index.cjs

@@ -25,6 +25,7 @@ __export(index_exports, {
   ActivationRequestStatus: () => ActivationRequestStatus,
   ActivationStatus: () => ActivationStatus,
   Architecture: () => Architecture,
+  CaptchaRequiredError: () => CaptchaRequiredError,
   CartUtils: () => CartUtils,
   ConnectableAccountProvider: () => ConnectableAccountProvider,
   ConsoleLogger: () => ConsoleLogger,
@@ -657,6 +658,12 @@ var MoonbaseError = class extends Error {
     }
   }
 };
+var CaptchaRequiredError = class extends MoonbaseError {
+  constructor(detail, title) {
+    super(title != null ? title : "Captcha required", detail != null ? detail : "Please confirm you're not a robot.", 400);
+    this.name = "CaptchaRequiredError";
+  }
+};
 
 // src/utils/problemDetails.ts
 var import_zod7 = require("zod");
@@ -699,6 +706,8 @@ async function handleResponseProblem(response, logger) {
   logger.debug("The response indicates a problem", problemDetails);
   if (problemDetails.errorType === "StoreClosed")
     throw new StoreClosedError(problemDetails.detail);
+  if (problemDetails.errorType === "CaptchaRequired")
+    throw new CaptchaRequiredError(problemDetails.detail, problemDetails.title);
   throw new MoonbaseError(
     problemDetails.title,
     problemDetails.detail,
@@ -808,7 +817,8 @@ var IdentityEndpoints = class {
       headers: {
         "Accept": "application/json",
         "Content-Type": "text/plain",
-        "x-mb-cors": "1"
+        "x-mb-cors": "1",
+        "x-mb-client": this.api.clientHeader
       },
       body: password
     });
@@ -833,7 +843,9 @@ var IdentityEndpoints = class {
       headers: {
         "Accept": "application/json",
         "Content-Type": "application/json",
-        "x-mb-cors": "1"
+        "x-mb-cors": "1",
+        "x-mb-client": this.api.clientHeader,
+        ...(options == null ? void 0 : options.captchaToken) ? { "X-MB-CAPTCHA": options.captchaToken } : {}
       },
       body: JSON.stringify({
         name,
@@ -899,7 +911,8 @@ var IdentityEndpoints = class {
       headers: {
         "Accept": "application/json",
         "Content-Type": "text/plain",
-        "x-mb-cors": "1"
+        "x-mb-cors": "1",
+        "x-mb-client": this.api.clientHeader
       },
       body: newPassword
     });
@@ -1065,8 +1078,8 @@ var ProductEndpoints = class {
     this.api = api;
     this.configuration = configuration;
   }
-  async get(productId, version) {
-    const response = await this.api.fetch(`/api/customer/inventory/products/${productId}${version ? `?version=${version}${this.configuration.includeManifests ? "&includeManifests=true" : ""}` : this.configuration.includeManifests ? "?includeManifests=true" : ""}`, productSummarySchema);
+  async get(productId, version2) {
+    const response = await this.api.fetch(`/api/customer/inventory/products/${productId}${version2 ? `?version=${version2}${this.configuration.includeManifests ? "&includeManifests=true" : ""}` : this.configuration.includeManifests ? "?includeManifests=true" : ""}`, productSummarySchema);
     return response.data;
   }
   async getOwned(nextUrl) {
@@ -1094,15 +1107,24 @@ var ProductEndpoints = class {
 // src/inventory/subscriptions/endpoints.ts
 var import_zod14 = require("zod");
 
+// package.json
+var version = "3.6.0";
+
+// src/utils/client.ts
+function buildClientHeader(sdk) {
+  return `${sdk != null ? sdk : ""} @moonbase.sh/storefront-api/${version}`.trim().replace(/\s+/g, " ");
+}
+
 // src/utils/api.ts
 function objectToQuery(obj) {
   return Object.entries(obj != null ? obj : {}).filter(([_, value]) => value !== void 0).map(([key, value]) => `${key}=${encodeURIComponent(value instanceof Date ? value.toISOString() : value)}`).join("&");
 }
 var MoonbaseApi = class {
-  constructor(baseUrl, tokenStore, logger) {
+  constructor(baseUrl, tokenStore, logger, sdk) {
     this.baseUrl = baseUrl;
     this.tokenStore = tokenStore;
     this.logger = logger;
+    this.clientHeader = buildClientHeader(sdk);
   }
   async authenticatedFetch(path, schema, options) {
     if (!this.tokenStore.user)
@@ -1127,7 +1149,8 @@ var MoonbaseApi = class {
         // While this fetch can be anonymous, we add the token if we have it
         ...accessToken ? { Authorization: `Bearer ${accessToken}` } : {},
         // Force CORS on all calls
-        "x-mb-cors": "1"
+        "x-mb-cors": "1",
+        "x-mb-client": this.clientHeader
       },
       body: (options == null ? void 0 : options.body) ? contentType !== "application/json" ? options.body : JSON.stringify(options.body) : void 0,
       signal: options == null ? void 0 : options.abort,
@@ -1186,7 +1209,8 @@ var MoonbaseApi = class {
         method: "POST",
         headers: {
           "Accept": "application/json",
-          "Content-Type": "application/json"
+          "Content-Type": "application/json",
+          "x-mb-client": this.clientHeader
         },
         body: JSON.stringify({
           title: "Parse error",
@@ -1208,7 +1232,8 @@ var MoonbaseApi = class {
         method: "POST",
         headers: {
           "Accept": "application/json",
-          "Content-Type": "application/json"
+          "Content-Type": "application/json",
+          "x-mb-client": this.clientHeader
         },
         body: JSON.stringify({
           title: "Request error",
@@ -1860,7 +1885,8 @@ var _TokenStore = class _TokenStore {
       headers: {
         "Accept": "application/json",
         "Content-Type": "text/plain",
-        "x-mb-cors": "1"
+        "x-mb-cors": "1",
+        "x-mb-client": buildClientHeader(this.configuration.sdk)
       },
       body: this.tokens.accessToken
     });
@@ -1896,13 +1922,26 @@ var TokenStore = _TokenStore;
 // src/vendor/schemas.ts
 var schemas_exports9 = {};
 __export(schemas_exports9, {
+  vendorCaptchaSchema: () => vendorCaptchaSchema,
+  vendorFeaturesSchema: () => vendorFeaturesSchema,
   vendorSchema: () => vendorSchema
 });
 var import_zod15 = require("zod");
+var vendorCaptchaSchema = import_zod15.z.object({
+  url: import_zod15.z.string()
+});
+var vendorFeaturesSchema = import_zod15.z.object({
+  customerPortal: import_zod15.z.boolean().optional(),
+  phoneNumber: import_zod15.z.boolean().optional(),
+  marketingConsent: import_zod15.z.nativeEnum(MarketingConsentType).optional().catch(void 0),
+  // Absent on backends from before captchas, which never ask for one.
+  captcha: vendorCaptchaSchema.nullish()
+});
 var vendorSchema = import_zod15.z.object({
   id: import_zod15.z.string(),
   name: import_zod15.z.string(),
-  logoUrl: import_zod15.z.string().nullable()
+  logoUrl: import_zod15.z.string().nullable(),
+  features: vendorFeaturesSchema.optional()
 });
 
 // src/vendor/endpoints.ts
@@ -2579,7 +2618,7 @@ var MoonbaseClient = class {
     this.configuration.endpoint = this.configuration.endpoint.replace(/\/$/, "");
     this.logger = (_a = this.configuration.logger) != null ? _a : new ConsoleLogger();
     this.tokenStore = new TokenStore(configuration);
-    this.api = new MoonbaseApi(this.configuration.endpoint, this.tokenStore, this.logger);
+    this.api = new MoonbaseApi(this.configuration.endpoint, this.tokenStore, this.logger, this.configuration.sdk);
     this.storefront = new StorefrontEndpoints(this.api, this.configuration);
     this.identity = new IdentityEndpoints(this.api, this.tokenStore, this.logger);
     this.communications = new CommunicationsEndpoints(this.api);
@@ -2598,6 +2637,7 @@ var MoonbaseClient = class {
   ActivationRequestStatus,
   ActivationStatus,
   Architecture,
+  CaptchaRequiredError,
   CartUtils,
   ConnectableAccountProvider,
   ConsoleLogger,

package/dist/index.d.cts

@@ -132,7 +132,13 @@ declare class MoonbaseApi {
     baseUrl: string;
     private tokenStore;
     private logger;
-    constructor(baseUrl: string, tokenStore: ITokenStore, logger: ILogger);
+    /**
+     * The `x-mb-client` header this client sends with every request.
+     *
+     * @internal
+     */
+    readonly clientHeader: string;
+    constructor(baseUrl: string, tokenStore: ITokenStore, logger: ILogger, sdk?: string);
     authenticatedFetch<T extends ZodTypeAny>(path: string, schema: T | null, options?: FetchOptions): Promise<Response<z.infer<T>>>;
     fetch<T extends ZodTypeAny>(path: string, schema: T | null, options?: FetchOptions): Promise<Response<z.infer<T>>>;
     private reportParsingProblem;
@@ -1671,6 +1677,15 @@ interface SignUpOptions {
      * ID left in a form can never fail a registration.
      */
     groupIds?: string[];
+    /**
+     * The customer's solution to the store's captcha, for stores that ask for one
+     * (`vendor.features.captcha`). Sent in the `X-MB-CAPTCHA` header.
+     *
+     * Without it (or with one that does not check out) such a store refuses the
+     * sign-up with a `CaptchaRequiredError`. Solutions are single-use and expire
+     * after about two minutes, so reset the captcha after every attempt.
+     */
+    captchaToken?: string;
 }
 
 declare class IdentityEndpoints {
@@ -24983,26 +24998,110 @@ declare class StorefrontEndpoints {
     }>;
 }
 
+/**
+ * The captcha a store asks customers to solve before signing up and checking out. `url` is a
+ * page on the store's own `<account-id>.moonbase.sh` that draws the challenge: embed it in an
+ * iframe, and it hands the solution to its parent with `postMessage`.
+ */
+declare const vendorCaptchaSchema: z.ZodObject<{
+    url: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    url: string;
+}, {
+    url: string;
+}>;
+declare const vendorFeaturesSchema: z.ZodObject<{
+    customerPortal: z.ZodOptional<z.ZodBoolean>;
+    phoneNumber: z.ZodOptional<z.ZodBoolean>;
+    marketingConsent: z.ZodCatch<z.ZodOptional<z.ZodNativeEnum<typeof MarketingConsentType>>>;
+    captcha: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        url: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        url: string;
+    }, {
+        url: string;
+    }>>>;
+}, "strip", z.ZodTypeAny, {
+    customerPortal?: boolean | undefined;
+    phoneNumber?: boolean | undefined;
+    marketingConsent?: MarketingConsentType | undefined;
+    captcha?: {
+        url: string;
+    } | null | undefined;
+}, {
+    customerPortal?: boolean | undefined;
+    phoneNumber?: boolean | undefined;
+    marketingConsent?: unknown;
+    captcha?: {
+        url: string;
+    } | null | undefined;
+}>;
 declare const vendorSchema: z.ZodObject<{
     id: z.ZodString;
     name: z.ZodString;
     logoUrl: z.ZodNullable<z.ZodString>;
+    features: z.ZodOptional<z.ZodObject<{
+        customerPortal: z.ZodOptional<z.ZodBoolean>;
+        phoneNumber: z.ZodOptional<z.ZodBoolean>;
+        marketingConsent: z.ZodCatch<z.ZodOptional<z.ZodNativeEnum<typeof MarketingConsentType>>>;
+        captcha: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            url: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            url: string;
+        }, {
+            url: string;
+        }>>>;
+    }, "strip", z.ZodTypeAny, {
+        customerPortal?: boolean | undefined;
+        phoneNumber?: boolean | undefined;
+        marketingConsent?: MarketingConsentType | undefined;
+        captcha?: {
+            url: string;
+        } | null | undefined;
+    }, {
+        customerPortal?: boolean | undefined;
+        phoneNumber?: boolean | undefined;
+        marketingConsent?: unknown;
+        captcha?: {
+            url: string;
+        } | null | undefined;
+    }>>;
 }, "strip", z.ZodTypeAny, {
     id: string;
     name: string;
     logoUrl: string | null;
+    features?: {
+        customerPortal?: boolean | undefined;
+        phoneNumber?: boolean | undefined;
+        marketingConsent?: MarketingConsentType | undefined;
+        captcha?: {
+            url: string;
+        } | null | undefined;
+    } | undefined;
 }, {
     id: string;
     name: string;
     logoUrl: string | null;
+    features?: {
+        customerPortal?: boolean | undefined;
+        phoneNumber?: boolean | undefined;
+        marketingConsent?: unknown;
+        captcha?: {
+            url: string;
+        } | null | undefined;
+    } | undefined;
 }>;
 
+declare const schemas$4_vendorCaptchaSchema: typeof vendorCaptchaSchema;
+declare const schemas$4_vendorFeaturesSchema: typeof vendorFeaturesSchema;
 declare const schemas$4_vendorSchema: typeof vendorSchema;
 declare namespace schemas$4 {
-  export { schemas$4_vendorSchema as vendorSchema };
+  export { schemas$4_vendorCaptchaSchema as vendorCaptchaSchema, schemas$4_vendorFeaturesSchema as vendorFeaturesSchema, schemas$4_vendorSchema as vendorSchema };
 }
 
 type Vendor = z.infer<typeof vendorSchema>;
+type VendorFeatures = z.infer<typeof vendorFeaturesSchema>;
+type VendorCaptcha = z.infer<typeof vendorCaptchaSchema>;
 
 declare class VendorEndpoints {
     private api;
@@ -47020,6 +47119,17 @@ declare class MoonbaseError extends Error {
     readonly errors?: Record<string, string> | undefined;
     constructor(title: string, detail: string | undefined, status?: number | undefined, errors?: Record<string, string> | undefined);
 }
+/**
+ * The store asks customers to solve a captcha (see `Vendor.features.captcha`), and the request
+ * carried none, or one that did not check out: unsolved, expired, already used, or solved on a
+ * site that is not one of the store's. `message` is the API's own copy for the customer, safe to
+ * show as is. Solutions are single-use, so reset the captcha and let them try again.
+ *
+ * A `MoonbaseError` like any other refusal, so code that already handles those keeps working.
+ */
+declare class CaptchaRequiredError extends MoonbaseError {
+    constructor(detail?: string, title?: string);
+}
 
 /**
  * Cleans up merchant-authored group IDs before they go on the wire.
@@ -47174,6 +47284,14 @@ interface MoonbaseConfiguration {
     includeManifests?: boolean;
     store?: IStore;
     logger?: ILogger;
+    /**
+     * Product tokens (`name/version`) of an SDK wrapping this one, such as
+     * `@moonbase.sh/vue/3.6.1`, sent ahead of this package's own token in the
+     * `x-mb-client` header.
+     *
+     * @internal
+     */
+    sdk?: string;
 }
 declare class MoonbaseClient {
     private readonly configuration;
@@ -47192,4 +47310,4 @@ declare class MoonbaseClient {
     orders: OrderEndpoints;
 }
 
-export { type Activation, ActivationMethod, type ActivationRequest, ActivationRequestFulfillmentType, ActivationRequestStatus, ActivationStatus, type Address, Architecture, type BundleLineItem, type CartCatalog, type CartOrder, type CartTotal, type CartTotalCondition, CartUtils, type CommunicationPreferences, type CommunicationPreferencesInput, type CommunicationPreferencesView, type CompletedOrder, ConnectableAccountProvider, type ConnectedAccount, ConsoleLogger, CycleLength, type Discount, DiscountUtils, type Download, type DownloadManifest, type ILogger, type IRecurrence, type IStore, type ITokenStore, type Identity, type ImageFit, type ImageFormat, type ImageTransform, ImageUtils, InMemoryStore, type License, LicenseStatus, type LineItem, type LineItemTotal, LocalStorageStore, LogLevel, MarketingConsentType, type MilestoneProgress, type Money, type MoneyCollection, MoneyCollectionUtils, MoonbaseApi, MoonbaseClient, type MoonbaseConfiguration, MoonbaseError, NotAuthenticatedError, NotAuthorizedError, NotFoundError, type OfferCondition, type OfferConditionContext, type OfferProgress, type OfferScope, OfferUtils, type OpenOrder, type Order, OrderStatus, type OrderTotal, type OwnedProduct, type Page, Platform, type PricingTier, type PricingVariation, type ProblemDetails, type ProductLineItem, type PromotionDisplay, type Quantifiable, type RawPropertyArray, type RawPropertyObject, type RawPropertyValue, type SignUpOptions, type SignUpResult, type SingleOrMultiple, StoreClosedError, type Storefront, type StorefrontBundle, type StorefrontOffer, type StorefrontOfferTarget, type StorefrontProduct, type StorefrontPromotion, type StorefrontPromotionCta, type StorefrontPromotionTarget, type SubscribeInput, type SubscribeResponse, type Subscription, type SubscriptionCancellationFeedback, SubscriptionCancellationReason, SubscriptionStatus, type TaxEstimate, TokenStore, type UrchinTrackingModule, type User, type UserAccountConfirmed, type UserAccountConfirmedStatus, type Vendor, type Voucher, imageWidths, isLocalStorageAvailable, isPromotionDisplay, isTransformableImageUrl, maxImageDimension, normalizeGroupIds, objectToQuery, parseOffSiteReferrer, problemDetailsSchema, promotionDisplays, resolveUtm, schemas, utmToObject };
+export { type Activation, ActivationMethod, type ActivationRequest, ActivationRequestFulfillmentType, ActivationRequestStatus, ActivationStatus, type Address, Architecture, type BundleLineItem, CaptchaRequiredError, type CartCatalog, type CartOrder, type CartTotal, type CartTotalCondition, CartUtils, type CommunicationPreferences, type CommunicationPreferencesInput, type CommunicationPreferencesView, type CompletedOrder, ConnectableAccountProvider, type ConnectedAccount, ConsoleLogger, CycleLength, type Discount, DiscountUtils, type Download, type DownloadManifest, type ILogger, type IRecurrence, type IStore, type ITokenStore, type Identity, type ImageFit, type ImageFormat, type ImageTransform, ImageUtils, InMemoryStore, type License, LicenseStatus, type LineItem, type LineItemTotal, LocalStorageStore, LogLevel, MarketingConsentType, type MilestoneProgress, type Money, type MoneyCollection, MoneyCollectionUtils, MoonbaseApi, MoonbaseClient, type MoonbaseConfiguration, MoonbaseError, NotAuthenticatedError, NotAuthorizedError, NotFoundError, type OfferCondition, type OfferConditionContext, type OfferProgress, type OfferScope, OfferUtils, type OpenOrder, type Order, OrderStatus, type OrderTotal, type OwnedProduct, type Page, Platform, type PricingTier, type PricingVariation, type ProblemDetails, type ProductLineItem, type PromotionDisplay, type Quantifiable, type RawPropertyArray, type RawPropertyObject, type RawPropertyValue, type SignUpOptions, type SignUpResult, type SingleOrMultiple, StoreClosedError, type Storefront, type StorefrontBundle, type StorefrontOffer, type StorefrontOfferTarget, type StorefrontProduct, type StorefrontPromotion, type StorefrontPromotionCta, type StorefrontPromotionTarget, type SubscribeInput, type SubscribeResponse, type Subscription, type SubscriptionCancellationFeedback, SubscriptionCancellationReason, SubscriptionStatus, type TaxEstimate, TokenStore, type UrchinTrackingModule, type User, type UserAccountConfirmed, type UserAccountConfirmedStatus, type Vendor, type VendorCaptcha, type VendorFeatures, type Voucher, imageWidths, isLocalStorageAvailable, isPromotionDisplay, isTransformableImageUrl, maxImageDimension, normalizeGroupIds, objectToQuery, parseOffSiteReferrer, problemDetailsSchema, promotionDisplays, resolveUtm, schemas, utmToObject };

package/dist/index.d.ts

@@ -132,7 +132,13 @@ declare class MoonbaseApi {
     baseUrl: string;
     private tokenStore;
     private logger;
-    constructor(baseUrl: string, tokenStore: ITokenStore, logger: ILogger);
+    /**
+     * The `x-mb-client` header this client sends with every request.
+     *
+     * @internal
+     */
+    readonly clientHeader: string;
+    constructor(baseUrl: string, tokenStore: ITokenStore, logger: ILogger, sdk?: string);
     authenticatedFetch<T extends ZodTypeAny>(path: string, schema: T | null, options?: FetchOptions): Promise<Response<z.infer<T>>>;
     fetch<T extends ZodTypeAny>(path: string, schema: T | null, options?: FetchOptions): Promise<Response<z.infer<T>>>;
     private reportParsingProblem;
@@ -1671,6 +1677,15 @@ interface SignUpOptions {
      * ID left in a form can never fail a registration.
      */
     groupIds?: string[];
+    /**
+     * The customer's solution to the store's captcha, for stores that ask for one
+     * (`vendor.features.captcha`). Sent in the `X-MB-CAPTCHA` header.
+     *
+     * Without it (or with one that does not check out) such a store refuses the
+     * sign-up with a `CaptchaRequiredError`. Solutions are single-use and expire
+     * after about two minutes, so reset the captcha after every attempt.
+     */
+    captchaToken?: string;
 }
 
 declare class IdentityEndpoints {
@@ -24983,26 +24998,110 @@ declare class StorefrontEndpoints {
     }>;
 }
 
+/**
+ * The captcha a store asks customers to solve before signing up and checking out. `url` is a
+ * page on the store's own `<account-id>.moonbase.sh` that draws the challenge: embed it in an
+ * iframe, and it hands the solution to its parent with `postMessage`.
+ */
+declare const vendorCaptchaSchema: z.ZodObject<{
+    url: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    url: string;
+}, {
+    url: string;
+}>;
+declare const vendorFeaturesSchema: z.ZodObject<{
+    customerPortal: z.ZodOptional<z.ZodBoolean>;
+    phoneNumber: z.ZodOptional<z.ZodBoolean>;
+    marketingConsent: z.ZodCatch<z.ZodOptional<z.ZodNativeEnum<typeof MarketingConsentType>>>;
+    captcha: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        url: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        url: string;
+    }, {
+        url: string;
+    }>>>;
+}, "strip", z.ZodTypeAny, {
+    customerPortal?: boolean | undefined;
+    phoneNumber?: boolean | undefined;
+    marketingConsent?: MarketingConsentType | undefined;
+    captcha?: {
+        url: string;
+    } | null | undefined;
+}, {
+    customerPortal?: boolean | undefined;
+    phoneNumber?: boolean | undefined;
+    marketingConsent?: unknown;
+    captcha?: {
+        url: string;
+    } | null | undefined;
+}>;
 declare const vendorSchema: z.ZodObject<{
     id: z.ZodString;
     name: z.ZodString;
     logoUrl: z.ZodNullable<z.ZodString>;
+    features: z.ZodOptional<z.ZodObject<{
+        customerPortal: z.ZodOptional<z.ZodBoolean>;
+        phoneNumber: z.ZodOptional<z.ZodBoolean>;
+        marketingConsent: z.ZodCatch<z.ZodOptional<z.ZodNativeEnum<typeof MarketingConsentType>>>;
+        captcha: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            url: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            url: string;
+        }, {
+            url: string;
+        }>>>;
+    }, "strip", z.ZodTypeAny, {
+        customerPortal?: boolean | undefined;
+        phoneNumber?: boolean | undefined;
+        marketingConsent?: MarketingConsentType | undefined;
+        captcha?: {
+            url: string;
+        } | null | undefined;
+    }, {
+        customerPortal?: boolean | undefined;
+        phoneNumber?: boolean | undefined;
+        marketingConsent?: unknown;
+        captcha?: {
+            url: string;
+        } | null | undefined;
+    }>>;
 }, "strip", z.ZodTypeAny, {
     id: string;
     name: string;
     logoUrl: string | null;
+    features?: {
+        customerPortal?: boolean | undefined;
+        phoneNumber?: boolean | undefined;
+        marketingConsent?: MarketingConsentType | undefined;
+        captcha?: {
+            url: string;
+        } | null | undefined;
+    } | undefined;
 }, {
     id: string;
     name: string;
     logoUrl: string | null;
+    features?: {
+        customerPortal?: boolean | undefined;
+        phoneNumber?: boolean | undefined;
+        marketingConsent?: unknown;
+        captcha?: {
+            url: string;
+        } | null | undefined;
+    } | undefined;
 }>;
 
+declare const schemas$4_vendorCaptchaSchema: typeof vendorCaptchaSchema;
+declare const schemas$4_vendorFeaturesSchema: typeof vendorFeaturesSchema;
 declare const schemas$4_vendorSchema: typeof vendorSchema;
 declare namespace schemas$4 {
-  export { schemas$4_vendorSchema as vendorSchema };
+  export { schemas$4_vendorCaptchaSchema as vendorCaptchaSchema, schemas$4_vendorFeaturesSchema as vendorFeaturesSchema, schemas$4_vendorSchema as vendorSchema };
 }
 
 type Vendor = z.infer<typeof vendorSchema>;
+type VendorFeatures = z.infer<typeof vendorFeaturesSchema>;
+type VendorCaptcha = z.infer<typeof vendorCaptchaSchema>;
 
 declare class VendorEndpoints {
     private api;
@@ -47020,6 +47119,17 @@ declare class MoonbaseError extends Error {
     readonly errors?: Record<string, string> | undefined;
     constructor(title: string, detail: string | undefined, status?: number | undefined, errors?: Record<string, string> | undefined);
 }
+/**
+ * The store asks customers to solve a captcha (see `Vendor.features.captcha`), and the request
+ * carried none, or one that did not check out: unsolved, expired, already used, or solved on a
+ * site that is not one of the store's. `message` is the API's own copy for the customer, safe to
+ * show as is. Solutions are single-use, so reset the captcha and let them try again.
+ *
+ * A `MoonbaseError` like any other refusal, so code that already handles those keeps working.
+ */
+declare class CaptchaRequiredError extends MoonbaseError {
+    constructor(detail?: string, title?: string);
+}
 
 /**
  * Cleans up merchant-authored group IDs before they go on the wire.
@@ -47174,6 +47284,14 @@ interface MoonbaseConfiguration {
     includeManifests?: boolean;
     store?: IStore;
     logger?: ILogger;
+    /**
+     * Product tokens (`name/version`) of an SDK wrapping this one, such as
+     * `@moonbase.sh/vue/3.6.1`, sent ahead of this package's own token in the
+     * `x-mb-client` header.
+     *
+     * @internal
+     */
+    sdk?: string;
 }
 declare class MoonbaseClient {
     private readonly configuration;
@@ -47192,4 +47310,4 @@ declare class MoonbaseClient {
     orders: OrderEndpoints;
 }
 
-export { type Activation, ActivationMethod, type ActivationRequest, ActivationRequestFulfillmentType, ActivationRequestStatus, ActivationStatus, type Address, Architecture, type BundleLineItem, type CartCatalog, type CartOrder, type CartTotal, type CartTotalCondition, CartUtils, type CommunicationPreferences, type CommunicationPreferencesInput, type CommunicationPreferencesView, type CompletedOrder, ConnectableAccountProvider, type ConnectedAccount, ConsoleLogger, CycleLength, type Discount, DiscountUtils, type Download, type DownloadManifest, type ILogger, type IRecurrence, type IStore, type ITokenStore, type Identity, type ImageFit, type ImageFormat, type ImageTransform, ImageUtils, InMemoryStore, type License, LicenseStatus, type LineItem, type LineItemTotal, LocalStorageStore, LogLevel, MarketingConsentType, type MilestoneProgress, type Money, type MoneyCollection, MoneyCollectionUtils, MoonbaseApi, MoonbaseClient, type MoonbaseConfiguration, MoonbaseError, NotAuthenticatedError, NotAuthorizedError, NotFoundError, type OfferCondition, type OfferConditionContext, type OfferProgress, type OfferScope, OfferUtils, type OpenOrder, type Order, OrderStatus, type OrderTotal, type OwnedProduct, type Page, Platform, type PricingTier, type PricingVariation, type ProblemDetails, type ProductLineItem, type PromotionDisplay, type Quantifiable, type RawPropertyArray, type RawPropertyObject, type RawPropertyValue, type SignUpOptions, type SignUpResult, type SingleOrMultiple, StoreClosedError, type Storefront, type StorefrontBundle, type StorefrontOffer, type StorefrontOfferTarget, type StorefrontProduct, type StorefrontPromotion, type StorefrontPromotionCta, type StorefrontPromotionTarget, type SubscribeInput, type SubscribeResponse, type Subscription, type SubscriptionCancellationFeedback, SubscriptionCancellationReason, SubscriptionStatus, type TaxEstimate, TokenStore, type UrchinTrackingModule, type User, type UserAccountConfirmed, type UserAccountConfirmedStatus, type Vendor, type Voucher, imageWidths, isLocalStorageAvailable, isPromotionDisplay, isTransformableImageUrl, maxImageDimension, normalizeGroupIds, objectToQuery, parseOffSiteReferrer, problemDetailsSchema, promotionDisplays, resolveUtm, schemas, utmToObject };
+export { type Activation, ActivationMethod, type ActivationRequest, ActivationRequestFulfillmentType, ActivationRequestStatus, ActivationStatus, type Address, Architecture, type BundleLineItem, CaptchaRequiredError, type CartCatalog, type CartOrder, type CartTotal, type CartTotalCondition, CartUtils, type CommunicationPreferences, type CommunicationPreferencesInput, type CommunicationPreferencesView, type CompletedOrder, ConnectableAccountProvider, type ConnectedAccount, ConsoleLogger, CycleLength, type Discount, DiscountUtils, type Download, type DownloadManifest, type ILogger, type IRecurrence, type IStore, type ITokenStore, type Identity, type ImageFit, type ImageFormat, type ImageTransform, ImageUtils, InMemoryStore, type License, LicenseStatus, type LineItem, type LineItemTotal, LocalStorageStore, LogLevel, MarketingConsentType, type MilestoneProgress, type Money, type MoneyCollection, MoneyCollectionUtils, MoonbaseApi, MoonbaseClient, type MoonbaseConfiguration, MoonbaseError, NotAuthenticatedError, NotAuthorizedError, NotFoundError, type OfferCondition, type OfferConditionContext, type OfferProgress, type OfferScope, OfferUtils, type OpenOrder, type Order, OrderStatus, type OrderTotal, type OwnedProduct, type Page, Platform, type PricingTier, type PricingVariation, type ProblemDetails, type ProductLineItem, type PromotionDisplay, type Quantifiable, type RawPropertyArray, type RawPropertyObject, type RawPropertyValue, type SignUpOptions, type SignUpResult, type SingleOrMultiple, StoreClosedError, type Storefront, type StorefrontBundle, type StorefrontOffer, type StorefrontOfferTarget, type StorefrontProduct, type StorefrontPromotion, type StorefrontPromotionCta, type StorefrontPromotionTarget, type SubscribeInput, type SubscribeResponse, type Subscription, type SubscriptionCancellationFeedback, SubscriptionCancellationReason, SubscriptionStatus, type TaxEstimate, TokenStore, type UrchinTrackingModule, type User, type UserAccountConfirmed, type UserAccountConfirmedStatus, type Vendor, type VendorCaptcha, type VendorFeatures, type Voucher, imageWidths, isLocalStorageAvailable, isPromotionDisplay, isTransformableImageUrl, maxImageDimension, normalizeGroupIds, objectToQuery, parseOffSiteReferrer, problemDetailsSchema, promotionDisplays, resolveUtm, schemas, utmToObject };

package/dist/index.js

@@ -595,6 +595,12 @@ var MoonbaseError = class extends Error {
     }
   }
 };
+var CaptchaRequiredError = class extends MoonbaseError {
+  constructor(detail, title) {
+    super(title != null ? title : "Captcha required", detail != null ? detail : "Please confirm you're not a robot.", 400);
+    this.name = "CaptchaRequiredError";
+  }
+};
 
 // src/utils/problemDetails.ts
 import { z as z7 } from "zod";
@@ -637,6 +643,8 @@ async function handleResponseProblem(response, logger) {
   logger.debug("The response indicates a problem", problemDetails);
   if (problemDetails.errorType === "StoreClosed")
     throw new StoreClosedError(problemDetails.detail);
+  if (problemDetails.errorType === "CaptchaRequired")
+    throw new CaptchaRequiredError(problemDetails.detail, problemDetails.title);
   throw new MoonbaseError(
     problemDetails.title,
     problemDetails.detail,
@@ -746,7 +754,8 @@ var IdentityEndpoints = class {
       headers: {
         "Accept": "application/json",
         "Content-Type": "text/plain",
-        "x-mb-cors": "1"
+        "x-mb-cors": "1",
+        "x-mb-client": this.api.clientHeader
       },
       body: password
     });
@@ -771,7 +780,9 @@ var IdentityEndpoints = class {
       headers: {
         "Accept": "application/json",
         "Content-Type": "application/json",
-        "x-mb-cors": "1"
+        "x-mb-cors": "1",
+        "x-mb-client": this.api.clientHeader,
+        ...(options == null ? void 0 : options.captchaToken) ? { "X-MB-CAPTCHA": options.captchaToken } : {}
       },
       body: JSON.stringify({
         name,
@@ -837,7 +848,8 @@ var IdentityEndpoints = class {
       headers: {
         "Accept": "application/json",
         "Content-Type": "text/plain",
-        "x-mb-cors": "1"
+        "x-mb-cors": "1",
+        "x-mb-client": this.api.clientHeader
       },
       body: newPassword
     });
@@ -1003,8 +1015,8 @@ var ProductEndpoints = class {
     this.api = api;
     this.configuration = configuration;
   }
-  async get(productId, version) {
-    const response = await this.api.fetch(`/api/customer/inventory/products/${productId}${version ? `?version=${version}${this.configuration.includeManifests ? "&includeManifests=true" : ""}` : this.configuration.includeManifests ? "?includeManifests=true" : ""}`, productSummarySchema);
+  async get(productId, version2) {
+    const response = await this.api.fetch(`/api/customer/inventory/products/${productId}${version2 ? `?version=${version2}${this.configuration.includeManifests ? "&includeManifests=true" : ""}` : this.configuration.includeManifests ? "?includeManifests=true" : ""}`, productSummarySchema);
     return response.data;
   }
   async getOwned(nextUrl) {
@@ -1032,15 +1044,24 @@ var ProductEndpoints = class {
 // src/inventory/subscriptions/endpoints.ts
 import { z as z14 } from "zod";
 
+// package.json
+var version = "3.6.0";
+
+// src/utils/client.ts
+function buildClientHeader(sdk) {
+  return `${sdk != null ? sdk : ""} @moonbase.sh/storefront-api/${version}`.trim().replace(/\s+/g, " ");
+}
+
 // src/utils/api.ts
 function objectToQuery(obj) {
   return Object.entries(obj != null ? obj : {}).filter(([_, value]) => value !== void 0).map(([key, value]) => `${key}=${encodeURIComponent(value instanceof Date ? value.toISOString() : value)}`).join("&");
 }
 var MoonbaseApi = class {
-  constructor(baseUrl, tokenStore, logger) {
+  constructor(baseUrl, tokenStore, logger, sdk) {
     this.baseUrl = baseUrl;
     this.tokenStore = tokenStore;
     this.logger = logger;
+    this.clientHeader = buildClientHeader(sdk);
   }
   async authenticatedFetch(path, schema, options) {
     if (!this.tokenStore.user)
@@ -1065,7 +1086,8 @@ var MoonbaseApi = class {
         // While this fetch can be anonymous, we add the token if we have it
         ...accessToken ? { Authorization: `Bearer ${accessToken}` } : {},
         // Force CORS on all calls
-        "x-mb-cors": "1"
+        "x-mb-cors": "1",
+        "x-mb-client": this.clientHeader
       },
       body: (options == null ? void 0 : options.body) ? contentType !== "application/json" ? options.body : JSON.stringify(options.body) : void 0,
       signal: options == null ? void 0 : options.abort,
@@ -1124,7 +1146,8 @@ var MoonbaseApi = class {
         method: "POST",
         headers: {
           "Accept": "application/json",
-          "Content-Type": "application/json"
+          "Content-Type": "application/json",
+          "x-mb-client": this.clientHeader
         },
         body: JSON.stringify({
           title: "Parse error",
@@ -1146,7 +1169,8 @@ var MoonbaseApi = class {
         method: "POST",
         headers: {
           "Accept": "application/json",
-          "Content-Type": "application/json"
+          "Content-Type": "application/json",
+          "x-mb-client": this.clientHeader
         },
         body: JSON.stringify({
           title: "Request error",
@@ -1798,7 +1822,8 @@ var _TokenStore = class _TokenStore {
       headers: {
         "Accept": "application/json",
         "Content-Type": "text/plain",
-        "x-mb-cors": "1"
+        "x-mb-cors": "1",
+        "x-mb-client": buildClientHeader(this.configuration.sdk)
       },
       body: this.tokens.accessToken
     });
@@ -1834,13 +1859,26 @@ var TokenStore = _TokenStore;
 // src/vendor/schemas.ts
 var schemas_exports9 = {};
 __export(schemas_exports9, {
+  vendorCaptchaSchema: () => vendorCaptchaSchema,
+  vendorFeaturesSchema: () => vendorFeaturesSchema,
   vendorSchema: () => vendorSchema
 });
 import { z as z15 } from "zod";
+var vendorCaptchaSchema = z15.object({
+  url: z15.string()
+});
+var vendorFeaturesSchema = z15.object({
+  customerPortal: z15.boolean().optional(),
+  phoneNumber: z15.boolean().optional(),
+  marketingConsent: z15.nativeEnum(MarketingConsentType).optional().catch(void 0),
+  // Absent on backends from before captchas, which never ask for one.
+  captcha: vendorCaptchaSchema.nullish()
+});
 var vendorSchema = z15.object({
   id: z15.string(),
   name: z15.string(),
-  logoUrl: z15.string().nullable()
+  logoUrl: z15.string().nullable(),
+  features: vendorFeaturesSchema.optional()
 });
 
 // src/vendor/endpoints.ts
@@ -2517,7 +2555,7 @@ var MoonbaseClient = class {
     this.configuration.endpoint = this.configuration.endpoint.replace(/\/$/, "");
     this.logger = (_a = this.configuration.logger) != null ? _a : new ConsoleLogger();
     this.tokenStore = new TokenStore(configuration);
-    this.api = new MoonbaseApi(this.configuration.endpoint, this.tokenStore, this.logger);
+    this.api = new MoonbaseApi(this.configuration.endpoint, this.tokenStore, this.logger, this.configuration.sdk);
     this.storefront = new StorefrontEndpoints(this.api, this.configuration);
     this.identity = new IdentityEndpoints(this.api, this.tokenStore, this.logger);
     this.communications = new CommunicationsEndpoints(this.api);
@@ -2535,6 +2573,7 @@ export {
   ActivationRequestStatus,
   ActivationStatus,
   Architecture,
+  CaptchaRequiredError,
   CartUtils,
   ConnectableAccountProvider,
   ConsoleLogger,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@moonbase.sh/storefront-api",
   "type": "module",
-  "version": "3.5.0",
+  "version": "3.6.0",
   "description": "Package to let you build storefronts with Moonbase.sh as payment and delivery provider",
   "author": "Tobias Lønnerød Madsen <m@dsen.tv>",
   "license": "MIT",