@open-mercato/core 0.9.1-develop.7473.1.de5b22888f → 0.9.1-develop.7475.1.28ca93ed97

package/dist/modules/ecommerce/api/storefront/products/route.js

@@ -0,0 +1,78 @@
+import { NextResponse } from "next/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { rateLimitErrorSchema } from "@open-mercato/shared/lib/ratelimit/helpers";
+import { ecommerceStorefrontProductListQuerySchema } from "../../../data/validators.js";
+import { enforceStorefrontRateLimit } from "../../../lib/storefrontRateLimit.js";
+import { cachedListStorefrontProducts } from "../../../lib/storefrontProductCache.js";
+import { parseStorefrontProductListQuery } from "../../../lib/storefrontQuery.js";
+import {
+  storefrontErrorSchema,
+  storefrontInvalidQueryErrorSchema,
+  storefrontRouteErrorResponse,
+  storefrontSuccessHeaders,
+  runInStoreCacheTenant
+} from "../storefrontRouteSupport.js";
+import { storefrontProductListResponseSchema } from "./openapiSchemas.js";
+const metadata = {
+  path: "/ecommerce/storefront/products",
+  GET: {
+    requireAuth: false
+  }
+};
+const ANONYMOUS_CACHE_CONTROL = "public, max-age=30, stale-while-revalidate=30";
+async function GET(req) {
+  try {
+    const query = parseStorefrontProductListQuery(new URL(req.url).searchParams);
+    const container = await createRequestContainer();
+    const service = container.resolve("storeContextService");
+    const context = await service.resolve(req, { pathname: query.path ?? "/" });
+    return await runInStoreCacheTenant(context, async () => {
+      const rateLimited = await enforceStorefrontRateLimit(container, req, context, "products");
+      if (rateLimited) return rateLimited;
+      const body = await cachedListStorefrontProducts(container, context, query);
+      const headers = storefrontSuccessHeaders(context, ANONYMOUS_CACHE_CONTROL);
+      if (body.sortApproximate) headers["X-Sort-Approximate"] = "true";
+      if (body.sortUnavailable) headers["X-Sort-Unavailable"] = "true";
+      return NextResponse.json(body, { headers });
+    });
+  } catch (error) {
+    return storefrontRouteErrorResponse(error, {
+      message: "Storefront product listing failed",
+      code: "ecommerce.storefront_products_failed"
+    });
+  }
+}
+var route_default = GET;
+const storefrontProductsTag = "Ecommerce";
+const storefrontProductsGetDoc = {
+  summary: "List storefront products for the current buyer",
+  description: "Public. Resolves the store from the Host header and the optional portal session, then lists the products of the buyer's effective assortment with buyer-resolved prices. Unknown, repeated or malformed parameters are rejected with 400. Options use bracket notation (`options[color]=red,blue`). `availability=` is page-scoped: `total` counts the pre-availability set and a page may be short. Facets count each dimension against every other active filter (cross-exclusion); category, tag, option and product-type counts are shared per assortment scope (and empty past 10 000 products in the search universe), `priceRange` spans the buyer's own prices over the filtered set without the price filter, and `availability` counts the returned page only. `X-Sort-Approximate: true` marks a price order past the sort cap; `X-Sort-Unavailable: true` marks a declined price sort. Anonymous responses are `public, max-age=30, stale-while-revalidate=30`; authenticated responses are `private, no-store`. Cached server-side for 30 s per buyer context digest. Rate limited per IP and store.",
+  tags: [storefrontProductsTag],
+  query: ecommerceStorefrontProductListQuerySchema,
+  responses: [
+    { status: 200, description: "Products of the buyer's effective assortment.", schema: storefrontProductListResponseSchema }
+  ],
+  errors: [
+    { status: 400, description: "Unknown, repeated or malformed query parameters", schema: storefrontInvalidQueryErrorSchema },
+    { status: 401, description: "Portal session invalid or issued for another tenant or organization", schema: storefrontErrorSchema },
+    { status: 403, description: "Draft store (only when OM_ECOMMERCE_DEV_STORE_SLUG=true)", schema: storefrontErrorSchema },
+    { status: 404, description: "No store serves this host or path", schema: storefrontErrorSchema },
+    { status: 410, description: "Store archived", schema: storefrontErrorSchema },
+    { status: 429, description: "Too many requests", schema: rateLimitErrorSchema },
+    { status: 503, description: "Store misconfigured (no default channel binding)", schema: storefrontErrorSchema }
+  ]
+};
+const openApi = {
+  tag: storefrontProductsTag,
+  summary: "Public storefront product listing",
+  methods: {
+    GET: storefrontProductsGetDoc
+  }
+};
+export {
+  GET,
+  route_default as default,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/ecommerce/api/storefront/products/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/ecommerce/api/storefront/products/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { ecommerceStorefrontProductListQuerySchema } from '../../../data/validators'\nimport { enforceStorefrontRateLimit } from '../../../lib/storefrontRateLimit'\nimport type { StoreContextService } from '../../../lib/storeContextService'\nimport { cachedListStorefrontProducts } from '../../../lib/storefrontProductCache'\nimport { parseStorefrontProductListQuery } from '../../../lib/storefrontQuery'\nimport {\n  storefrontErrorSchema,\n  storefrontInvalidQueryErrorSchema,\n  storefrontRouteErrorResponse,\n  storefrontSuccessHeaders,\n  runInStoreCacheTenant,\n} from '../storefrontRouteSupport'\nimport { storefrontProductListResponseSchema } from './openapiSchemas'\n\nexport const metadata = {\n  path: '/ecommerce/storefront/products',\n  GET: {\n    requireAuth: false,\n  },\n}\n\nconst ANONYMOUS_CACHE_CONTROL = 'public, max-age=30, stale-while-revalidate=30'\n\nexport async function GET(req: Request) {\n  try {\n    const query = parseStorefrontProductListQuery(new URL(req.url).searchParams)\n    const container = await createRequestContainer()\n    const service = container.resolve('storeContextService') as StoreContextService\n    const context = await service.resolve(req, { pathname: query.path ?? '/' })\n    return await runInStoreCacheTenant(context, async () => {\n      const rateLimited = await enforceStorefrontRateLimit(container, req, context, 'products')\n      if (rateLimited) return rateLimited\n      const body = await cachedListStorefrontProducts(container, context, query)\n      const headers = storefrontSuccessHeaders(context, ANONYMOUS_CACHE_CONTROL)\n      if (body.sortApproximate) headers['X-Sort-Approximate'] = 'true'\n      if (body.sortUnavailable) headers['X-Sort-Unavailable'] = 'true'\n      return NextResponse.json(body, { headers })\n    })\n  } catch (error) {\n    return storefrontRouteErrorResponse(error, {\n      message: 'Storefront product listing failed',\n      code: 'ecommerce.storefront_products_failed',\n    })\n  }\n}\n\nexport default GET\n\nconst storefrontProductsTag = 'Ecommerce'\n\nconst storefrontProductsGetDoc: OpenApiMethodDoc = {\n  summary: 'List storefront products for the current buyer',\n  description:\n    'Public. Resolves the store from the Host header and the optional portal session, then lists the products of the buyer\\'s effective assortment with buyer-resolved prices. Unknown, repeated or malformed parameters are rejected with 400. Options use bracket notation (`options[color]=red,blue`). `availability=` is page-scoped: `total` counts the pre-availability set and a page may be short. Facets count each dimension against every other active filter (cross-exclusion); category, tag, option and product-type counts are shared per assortment scope (and empty past 10 000 products in the search universe), `priceRange` spans the buyer\\'s own prices over the filtered set without the price filter, and `availability` counts the returned page only. `X-Sort-Approximate: true` marks a price order past the sort cap; `X-Sort-Unavailable: true` marks a declined price sort. Anonymous responses are `public, max-age=30, stale-while-revalidate=30`; authenticated responses are `private, no-store`. Cached server-side for 30 s per buyer context digest. Rate limited per IP and store.',\n  tags: [storefrontProductsTag],\n  query: ecommerceStorefrontProductListQuerySchema,\n  responses: [\n    { status: 200, description: 'Products of the buyer\\'s effective assortment.', schema: storefrontProductListResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Unknown, repeated or malformed query parameters', schema: storefrontInvalidQueryErrorSchema },\n    { status: 401, description: 'Portal session invalid or issued for another tenant or organization', schema: storefrontErrorSchema },\n    { status: 403, description: 'Draft store (only when OM_ECOMMERCE_DEV_STORE_SLUG=true)', schema: storefrontErrorSchema },\n    { status: 404, description: 'No store serves this host or path', schema: storefrontErrorSchema },\n    { status: 410, description: 'Store archived', schema: storefrontErrorSchema },\n    { status: 429, description: 'Too many requests', schema: rateLimitErrorSchema },\n    { status: 503, description: 'Store misconfigured (no default channel binding)', schema: storefrontErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: storefrontProductsTag,\n  summary: 'Public storefront product listing',\n  methods: {\n    GET: storefrontProductsGetDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AAEvC,SAAS,4BAA4B;AACrC,SAAS,iDAAiD;AAC1D,SAAS,kCAAkC;AAE3C,SAAS,oCAAoC;AAC7C,SAAS,uCAAuC;AAChD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,2CAA2C;AAE7C,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,KAAK;AAAA,IACH,aAAa;AAAA,EACf;AACF;AAEA,MAAM,0BAA0B;AAEhC,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,QAAQ,gCAAgC,IAAI,IAAI,IAAI,GAAG,EAAE,YAAY;AAC3E,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,UAAU,UAAU,QAAQ,qBAAqB;AACvD,UAAM,UAAU,MAAM,QAAQ,QAAQ,KAAK,EAAE,UAAU,MAAM,QAAQ,IAAI,CAAC;AAC1E,WAAO,MAAM,sBAAsB,SAAS,YAAY;AACtD,YAAM,cAAc,MAAM,2BAA2B,WAAW,KAAK,SAAS,UAAU;AACxF,UAAI,YAAa,QAAO;AACxB,YAAM,OAAO,MAAM,6BAA6B,WAAW,SAAS,KAAK;AACzE,YAAM,UAAU,yBAAyB,SAAS,uBAAuB;AACzE,UAAI,KAAK,gBAAiB,SAAQ,oBAAoB,IAAI;AAC1D,UAAI,KAAK,gBAAiB,SAAQ,oBAAoB,IAAI;AAC1D,aAAO,aAAa,KAAK,MAAM,EAAE,QAAQ,CAAC;AAAA,IAC5C,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,6BAA6B,OAAO;AAAA,MACzC,SAAS;AAAA,MACT,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACF;AAEA,IAAO,gBAAQ;AAEf,MAAM,wBAAwB;AAE9B,MAAM,2BAA6C;AAAA,EACjD,SAAS;AAAA,EACT,aACE;AAAA,EACF,MAAM,CAAC,qBAAqB;AAAA,EAC5B,OAAO;AAAA,EACP,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,iDAAkD,QAAQ,oCAAoC;AAAA,EAC5H;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,mDAAmD,QAAQ,kCAAkC;AAAA,IACzH,EAAE,QAAQ,KAAK,aAAa,uEAAuE,QAAQ,sBAAsB;AAAA,IACjI,EAAE,QAAQ,KAAK,aAAa,4DAA4D,QAAQ,sBAAsB;AAAA,IACtH,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,sBAAsB;AAAA,IAC/F,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,sBAAsB;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB;AAAA,IAC9E,EAAE,QAAQ,KAAK,aAAa,oDAAoD,QAAQ,sBAAsB;AAAA,EAChH;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,EACP;AACF;",
+  "names": []
+}

package/dist/modules/ecommerce/api/storefront/search/suggest/openapiSchemas.js

@@ -0,0 +1,25 @@
+import { z } from "zod";
+const storefrontSearchSuggestResponseSchema = z.object({
+  products: z.array(
+    z.object({
+      id: z.string().uuid(),
+      handle: z.string().nullable(),
+      title: z.string(),
+      defaultMediaUrl: z.string().nullable(),
+      formattedPrice: z.string().nullable().describe("The buyer's resolved price (the lowest variant price for products priced per variant)")
+    })
+  ),
+  categories: z.array(
+    z.object({
+      id: z.string().uuid(),
+      name: z.string(),
+      slug: z.string().nullable()
+    })
+  ),
+  suggestions: z.array(z.string()).describe("Query completions; always empty in this phase"),
+  effectiveLocale: z.string()
+});
+export {
+  storefrontSearchSuggestResponseSchema
+};
+//# sourceMappingURL=openapiSchemas.js.map

package/dist/modules/ecommerce/api/storefront/search/suggest/openapiSchemas.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/ecommerce/api/storefront/search/suggest/openapiSchemas.ts"],
+  "sourcesContent": ["import { z } from 'zod'\n\nexport const storefrontSearchSuggestResponseSchema = z.object({\n  products: z.array(\n    z.object({\n      id: z.string().uuid(),\n      handle: z.string().nullable(),\n      title: z.string(),\n      defaultMediaUrl: z.string().nullable(),\n      formattedPrice: z\n        .string()\n        .nullable()\n        .describe('The buyer\\'s resolved price (the lowest variant price for products priced per variant)'),\n    }),\n  ),\n  categories: z.array(\n    z.object({\n      id: z.string().uuid(),\n      name: z.string(),\n      slug: z.string().nullable(),\n    }),\n  ),\n  suggestions: z.array(z.string()).describe('Query completions; always empty in this phase'),\n  effectiveLocale: z.string(),\n})\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAEX,MAAM,wCAAwC,EAAE,OAAO;AAAA,EAC5D,UAAU,EAAE;AAAA,IACV,EAAE,OAAO;AAAA,MACP,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,MACpB,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,MAC5B,OAAO,EAAE,OAAO;AAAA,MAChB,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,MACrC,gBAAgB,EACb,OAAO,EACP,SAAS,EACT,SAAS,uFAAwF;AAAA,IACtG,CAAC;AAAA,EACH;AAAA,EACA,YAAY,EAAE;AAAA,IACZ,EAAE,OAAO;AAAA,MACP,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,MACpB,MAAM,EAAE,OAAO;AAAA,MACf,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,IAC5B,CAAC;AAAA,EACH;AAAA,EACA,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,+CAA+C;AAAA,EACzF,iBAAiB,EAAE,OAAO;AAC5B,CAAC;",
+  "names": []
+}

package/dist/modules/ecommerce/api/storefront/search/suggest/route.js

@@ -0,0 +1,75 @@
+import { NextResponse } from "next/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { rateLimitErrorSchema } from "@open-mercato/shared/lib/ratelimit/helpers";
+import { ecommerceStorefrontSearchSuggestQuerySchema } from "../../../../data/validators.js";
+import { enforceStorefrontRateLimit } from "../../../../lib/storefrontRateLimit.js";
+import { parseStorefrontSearchSuggestQuery } from "../../../../lib/storefrontQuery.js";
+import { cachedSuggestStorefrontSearch } from "../../../../lib/storefrontSearchCache.js";
+import {
+  storefrontErrorSchema,
+  storefrontInvalidQueryErrorSchema,
+  storefrontRouteErrorResponse,
+  storefrontSuccessHeaders,
+  runInStoreCacheTenant
+} from "../../storefrontRouteSupport.js";
+import { storefrontSearchSuggestResponseSchema } from "./openapiSchemas.js";
+const metadata = {
+  path: "/ecommerce/storefront/search/suggest",
+  GET: {
+    requireAuth: false
+  }
+};
+const ANONYMOUS_CACHE_CONTROL = "public, max-age=30, stale-while-revalidate=30";
+async function GET(req) {
+  try {
+    const query = parseStorefrontSearchSuggestQuery(new URL(req.url).searchParams);
+    const container = await createRequestContainer();
+    const service = container.resolve("storeContextService");
+    const context = await service.resolve(req, { pathname: query.path ?? "/" });
+    return await runInStoreCacheTenant(context, async () => {
+      const rateLimited = await enforceStorefrontRateLimit(container, req, context, "searchSuggest");
+      if (rateLimited) return rateLimited;
+      const body = await cachedSuggestStorefrontSearch(container, context, query);
+      return NextResponse.json(body, { headers: storefrontSuccessHeaders(context, ANONYMOUS_CACHE_CONTROL) });
+    });
+  } catch (error) {
+    return storefrontRouteErrorResponse(error, {
+      message: "Storefront search suggest failed",
+      code: "ecommerce.storefront_search_suggest_failed"
+    });
+  }
+}
+var route_default = GET;
+const storefrontSearchTag = "Ecommerce";
+const storefrontSearchSuggestGetDoc = {
+  summary: "Typeahead suggestions for the current buyer",
+  description: "Public. Resolves the store from the Host header and the optional portal session, then returns up to `limit` products of the buyer's effective assortment matching `q`, with the buyer's formatted price, and up to `limit` visible categories whose localized name matches `q`. Products are ranked by the `tokens` or `pgvector` search strategy with the assortment scope inside the ranking query, or by the escaped `ILIKE` match when neither is available; the payload is identical either way. A `q` shorter than 2 characters returns empty arrays, never an error. Products whose availability policy hides them when out of stock are omitted. No facets are computed. Anonymous responses are `public, max-age=30, stale-while-revalidate=30`; authenticated responses are `private, no-store`. Cached server-side for 30 s per buyer context digest. Rate limited per IP and store.",
+  tags: [storefrontSearchTag],
+  query: ecommerceStorefrontSearchSuggestQuerySchema,
+  responses: [
+    { status: 200, description: "Products and categories matching the query.", schema: storefrontSearchSuggestResponseSchema }
+  ],
+  errors: [
+    { status: 400, description: "Missing `q`, or unknown, repeated or malformed query parameters", schema: storefrontInvalidQueryErrorSchema },
+    { status: 401, description: "Portal session invalid or issued for another tenant or organization", schema: storefrontErrorSchema },
+    { status: 403, description: "Draft store (only when OM_ECOMMERCE_DEV_STORE_SLUG=true)", schema: storefrontErrorSchema },
+    { status: 404, description: "No store serves this host or path", schema: storefrontErrorSchema },
+    { status: 410, description: "Store archived", schema: storefrontErrorSchema },
+    { status: 429, description: "Too many requests", schema: rateLimitErrorSchema },
+    { status: 503, description: "Store misconfigured (no default channel binding)", schema: storefrontErrorSchema }
+  ]
+};
+const openApi = {
+  tag: storefrontSearchTag,
+  summary: "Public storefront search suggestions",
+  methods: {
+    GET: storefrontSearchSuggestGetDoc
+  }
+};
+export {
+  GET,
+  route_default as default,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/ecommerce/api/storefront/search/suggest/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/ecommerce/api/storefront/search/suggest/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { ecommerceStorefrontSearchSuggestQuerySchema } from '../../../../data/validators'\nimport { enforceStorefrontRateLimit } from '../../../../lib/storefrontRateLimit'\nimport type { StoreContextService } from '../../../../lib/storeContextService'\nimport { parseStorefrontSearchSuggestQuery } from '../../../../lib/storefrontQuery'\nimport { cachedSuggestStorefrontSearch } from '../../../../lib/storefrontSearchCache'\nimport {\n  storefrontErrorSchema,\n  storefrontInvalidQueryErrorSchema,\n  storefrontRouteErrorResponse,\n  storefrontSuccessHeaders,\n  runInStoreCacheTenant,\n} from '../../storefrontRouteSupport'\nimport { storefrontSearchSuggestResponseSchema } from './openapiSchemas'\n\nexport const metadata = {\n  path: '/ecommerce/storefront/search/suggest',\n  GET: {\n    requireAuth: false,\n  },\n}\n\nconst ANONYMOUS_CACHE_CONTROL = 'public, max-age=30, stale-while-revalidate=30'\n\nexport async function GET(req: Request) {\n  try {\n    const query = parseStorefrontSearchSuggestQuery(new URL(req.url).searchParams)\n    const container = await createRequestContainer()\n    const service = container.resolve('storeContextService') as StoreContextService\n    const context = await service.resolve(req, { pathname: query.path ?? '/' })\n    return await runInStoreCacheTenant(context, async () => {\n      const rateLimited = await enforceStorefrontRateLimit(container, req, context, 'searchSuggest')\n      if (rateLimited) return rateLimited\n      const body = await cachedSuggestStorefrontSearch(container, context, query)\n      return NextResponse.json(body, { headers: storefrontSuccessHeaders(context, ANONYMOUS_CACHE_CONTROL) })\n    })\n  } catch (error) {\n    return storefrontRouteErrorResponse(error, {\n      message: 'Storefront search suggest failed',\n      code: 'ecommerce.storefront_search_suggest_failed',\n    })\n  }\n}\n\nexport default GET\n\nconst storefrontSearchTag = 'Ecommerce'\n\nconst storefrontSearchSuggestGetDoc: OpenApiMethodDoc = {\n  summary: 'Typeahead suggestions for the current buyer',\n  description:\n    'Public. Resolves the store from the Host header and the optional portal session, then returns up to `limit` products of the buyer\\'s effective assortment matching `q`, with the buyer\\'s formatted price, and up to `limit` visible categories whose localized name matches `q`. Products are ranked by the `tokens` or `pgvector` search strategy with the assortment scope inside the ranking query, or by the escaped `ILIKE` match when neither is available; the payload is identical either way. A `q` shorter than 2 characters returns empty arrays, never an error. Products whose availability policy hides them when out of stock are omitted. No facets are computed. Anonymous responses are `public, max-age=30, stale-while-revalidate=30`; authenticated responses are `private, no-store`. Cached server-side for 30 s per buyer context digest. Rate limited per IP and store.',\n  tags: [storefrontSearchTag],\n  query: ecommerceStorefrontSearchSuggestQuerySchema,\n  responses: [\n    { status: 200, description: 'Products and categories matching the query.', schema: storefrontSearchSuggestResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Missing `q`, or unknown, repeated or malformed query parameters', schema: storefrontInvalidQueryErrorSchema },\n    { status: 401, description: 'Portal session invalid or issued for another tenant or organization', schema: storefrontErrorSchema },\n    { status: 403, description: 'Draft store (only when OM_ECOMMERCE_DEV_STORE_SLUG=true)', schema: storefrontErrorSchema },\n    { status: 404, description: 'No store serves this host or path', schema: storefrontErrorSchema },\n    { status: 410, description: 'Store archived', schema: storefrontErrorSchema },\n    { status: 429, description: 'Too many requests', schema: rateLimitErrorSchema },\n    { status: 503, description: 'Store misconfigured (no default channel binding)', schema: storefrontErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: storefrontSearchTag,\n  summary: 'Public storefront search suggestions',\n  methods: {\n    GET: storefrontSearchSuggestGetDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AAEvC,SAAS,4BAA4B;AACrC,SAAS,mDAAmD;AAC5D,SAAS,kCAAkC;AAE3C,SAAS,yCAAyC;AAClD,SAAS,qCAAqC;AAC9C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,6CAA6C;AAE/C,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,KAAK;AAAA,IACH,aAAa;AAAA,EACf;AACF;AAEA,MAAM,0BAA0B;AAEhC,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,QAAQ,kCAAkC,IAAI,IAAI,IAAI,GAAG,EAAE,YAAY;AAC7E,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,UAAU,UAAU,QAAQ,qBAAqB;AACvD,UAAM,UAAU,MAAM,QAAQ,QAAQ,KAAK,EAAE,UAAU,MAAM,QAAQ,IAAI,CAAC;AAC1E,WAAO,MAAM,sBAAsB,SAAS,YAAY;AACtD,YAAM,cAAc,MAAM,2BAA2B,WAAW,KAAK,SAAS,eAAe;AAC7F,UAAI,YAAa,QAAO;AACxB,YAAM,OAAO,MAAM,8BAA8B,WAAW,SAAS,KAAK;AAC1E,aAAO,aAAa,KAAK,MAAM,EAAE,SAAS,yBAAyB,SAAS,uBAAuB,EAAE,CAAC;AAAA,IACxG,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,6BAA6B,OAAO;AAAA,MACzC,SAAS;AAAA,MACT,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACF;AAEA,IAAO,gBAAQ;AAEf,MAAM,sBAAsB;AAE5B,MAAM,gCAAkD;AAAA,EACtD,SAAS;AAAA,EACT,aACE;AAAA,EACF,MAAM,CAAC,mBAAmB;AAAA,EAC1B,OAAO;AAAA,EACP,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,+CAA+C,QAAQ,sCAAsC;AAAA,EAC3H;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,mEAAmE,QAAQ,kCAAkC;AAAA,IACzI,EAAE,QAAQ,KAAK,aAAa,uEAAuE,QAAQ,sBAAsB;AAAA,IACjI,EAAE,QAAQ,KAAK,aAAa,4DAA4D,QAAQ,sBAAsB;AAAA,IACtH,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,sBAAsB;AAAA,IAC/F,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,sBAAsB;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB;AAAA,IAC9E,EAAE,QAAQ,KAAK,aAAa,oDAAoD,QAAQ,sBAAsB;AAAA,EAChH;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,EACP;AACF;",
+  "names": []
+}

package/dist/modules/ecommerce/api/storefront/storefrontRouteSupport.js

@@ -0,0 +1,58 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { runWithCacheTenant } from "@open-mercato/cache";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { getTelemetryRuntime } from "@open-mercato/shared/lib/telemetry/runtime";
+import { isStorefrontResolutionError } from "../../lib/storeContext.js";
+import { isStorefrontQueryError } from "../../lib/storefrontQuery.js";
+const STOREFRONT_VARY_HEADER = "Cookie, Authorization, X-Locale, Accept-Language";
+const STOREFRONT_PRIVATE_CACHE_CONTROL = "private, no-store";
+const STOREFRONT_ERROR_CACHE_CONTROL = "no-store";
+const storefrontErrorSchema = z.object({ error: z.string() });
+const storefrontInvalidQueryErrorSchema = z.object({
+  error: z.literal("invalid_query"),
+  fields: z.record(z.string(), z.string())
+});
+const logger = createLogger("ecommerce").child({ component: "storefront-route" });
+function storefrontErrorResponse(status, body) {
+  return NextResponse.json(body, {
+    status,
+    headers: { "Cache-Control": STOREFRONT_ERROR_CACHE_CONTROL, Vary: STOREFRONT_VARY_HEADER }
+  });
+}
+function storefrontInvalidQueryResponse(error) {
+  const fields = {};
+  for (const issue of error.issues) {
+    if (!(issue.parameter in fields)) fields[issue.parameter] = issue.message;
+  }
+  return storefrontErrorResponse(400, { error: "invalid_query", fields });
+}
+function storefrontSuccessHeaders(context, anonymousCacheControl) {
+  return {
+    "Cache-Control": context.buyer.isAuthenticated ? STOREFRONT_PRIVATE_CACHE_CONTROL : anonymousCacheControl,
+    Vary: STOREFRONT_VARY_HEADER
+  };
+}
+function storefrontRouteErrorResponse(error, failure) {
+  if (isStorefrontQueryError(error)) return storefrontInvalidQueryResponse(error);
+  if (isStorefrontResolutionError(error)) return storefrontErrorResponse(error.status, { error: error.code });
+  logger.error(failure.message, { err: error });
+  getTelemetryRuntime()?.reportError(error, { module: "ecommerce", code: failure.code });
+  return storefrontErrorResponse(500, { error: "internal_error" });
+}
+function runInStoreCacheTenant(context, fn) {
+  return runWithCacheTenant(context.tenantId, fn);
+}
+export {
+  STOREFRONT_ERROR_CACHE_CONTROL,
+  STOREFRONT_PRIVATE_CACHE_CONTROL,
+  STOREFRONT_VARY_HEADER,
+  runInStoreCacheTenant,
+  storefrontErrorResponse,
+  storefrontErrorSchema,
+  storefrontInvalidQueryErrorSchema,
+  storefrontInvalidQueryResponse,
+  storefrontRouteErrorResponse,
+  storefrontSuccessHeaders
+};
+//# sourceMappingURL=storefrontRouteSupport.js.map

package/dist/modules/ecommerce/api/storefront/storefrontRouteSupport.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/ecommerce/api/storefront/storefrontRouteSupport.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { runWithCacheTenant } from '@open-mercato/cache'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'\nimport { isStorefrontResolutionError } from '../../lib/storeContext'\nimport { isStorefrontQueryError, type StorefrontQueryError } from '../../lib/storefrontQuery'\nimport type { StoreContext } from '../../lib/types'\n\nexport const STOREFRONT_VARY_HEADER = 'Cookie, Authorization, X-Locale, Accept-Language'\nexport const STOREFRONT_PRIVATE_CACHE_CONTROL = 'private, no-store'\nexport const STOREFRONT_ERROR_CACHE_CONTROL = 'no-store'\n\nexport const storefrontErrorSchema = z.object({ error: z.string() })\n\nexport const storefrontInvalidQueryErrorSchema = z.object({\n  error: z.literal('invalid_query'),\n  fields: z.record(z.string(), z.string()),\n})\n\nconst logger = createLogger('ecommerce').child({ component: 'storefront-route' })\n\nexport function storefrontErrorResponse(status: number, body: Record<string, unknown>): NextResponse {\n  return NextResponse.json(body, {\n    status,\n    headers: { 'Cache-Control': STOREFRONT_ERROR_CACHE_CONTROL, Vary: STOREFRONT_VARY_HEADER },\n  })\n}\n\nexport function storefrontInvalidQueryResponse(error: StorefrontQueryError): NextResponse {\n  const fields: Record<string, string> = {}\n  for (const issue of error.issues) {\n    if (!(issue.parameter in fields)) fields[issue.parameter] = issue.message\n  }\n  return storefrontErrorResponse(400, { error: 'invalid_query', fields })\n}\n\n/**\n * Authenticated responses are never stored by a browser or CDN (`private, no-store`); anonymous\n * ones may be, for the given policy. The server-side cache applies to both, keyed on the digest.\n */\nexport function storefrontSuccessHeaders(context: StoreContext, anonymousCacheControl: string): Record<string, string> {\n  return {\n    'Cache-Control': context.buyer.isAuthenticated ? STOREFRONT_PRIVATE_CACHE_CONTROL : anonymousCacheControl,\n    Vary: STOREFRONT_VARY_HEADER,\n  }\n}\n\nexport type StorefrontRouteFailure = { message: string; code: string }\n\n/** Query grammar \u2192 400, store resolution \u2192 its status with `{ error: code }`, anything else \u2192 reported 500. */\nexport function storefrontRouteErrorResponse(error: unknown, failure: StorefrontRouteFailure): NextResponse {\n  if (isStorefrontQueryError(error)) return storefrontInvalidQueryResponse(error)\n  if (isStorefrontResolutionError(error)) return storefrontErrorResponse(error.status, { error: error.code })\n  logger.error(failure.message, { err: error })\n  getTelemetryRuntime()?.reportError(error, { module: 'ecommerce', code: failure.code })\n  return storefrontErrorResponse(500, { error: 'internal_error' })\n}\n\n/**\n * Runs the rest of a storefront request in the resolved store's cache tenant. Admin writes invalidate\n * cached values (module config, Omnibus results, CRUD lists) in their tenant's namespace; an\n * unauthenticated storefront request would otherwise read the global namespace and keep serving a\n * copy those invalidations never reach.\n */\nexport function runInStoreCacheTenant<T>(context: Pick<StoreContext, 'tenantId'>, fn: () => Promise<T>): Promise<T> {\n  return runWithCacheTenant(context.tenantId, fn)\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,mCAAmC;AAC5C,SAAS,8BAAyD;AAG3D,MAAM,yBAAyB;AAC/B,MAAM,mCAAmC;AACzC,MAAM,iCAAiC;AAEvC,MAAM,wBAAwB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAE5D,MAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,OAAO,EAAE,QAAQ,eAAe;AAAA,EAChC,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC;AACzC,CAAC;AAED,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,mBAAmB,CAAC;AAEzE,SAAS,wBAAwB,QAAgB,MAA6C;AACnG,SAAO,aAAa,KAAK,MAAM;AAAA,IAC7B;AAAA,IACA,SAAS,EAAE,iBAAiB,gCAAgC,MAAM,uBAAuB;AAAA,EAC3F,CAAC;AACH;AAEO,SAAS,+BAA+B,OAA2C;AACxF,QAAM,SAAiC,CAAC;AACxC,aAAW,SAAS,MAAM,QAAQ;AAChC,QAAI,EAAE,MAAM,aAAa,QAAS,QAAO,MAAM,SAAS,IAAI,MAAM;AAAA,EACpE;AACA,SAAO,wBAAwB,KAAK,EAAE,OAAO,iBAAiB,OAAO,CAAC;AACxE;AAMO,SAAS,yBAAyB,SAAuB,uBAAuD;AACrH,SAAO;AAAA,IACL,iBAAiB,QAAQ,MAAM,kBAAkB,mCAAmC;AAAA,IACpF,MAAM;AAAA,EACR;AACF;AAKO,SAAS,6BAA6B,OAAgB,SAA+C;AAC1G,MAAI,uBAAuB,KAAK,EAAG,QAAO,+BAA+B,KAAK;AAC9E,MAAI,4BAA4B,KAAK,EAAG,QAAO,wBAAwB,MAAM,QAAQ,EAAE,OAAO,MAAM,KAAK,CAAC;AAC1G,SAAO,MAAM,QAAQ,SAAS,EAAE,KAAK,MAAM,CAAC;AAC5C,sBAAoB,GAAG,YAAY,OAAO,EAAE,QAAQ,aAAa,MAAM,QAAQ,KAAK,CAAC;AACrF,SAAO,wBAAwB,KAAK,EAAE,OAAO,iBAAiB,CAAC;AACjE;AAQO,SAAS,sBAAyB,SAAyC,IAAkC;AAClH,SAAO,mBAAmB,QAAQ,UAAU,EAAE;AAChD;",
+  "names": []
+}

package/dist/modules/ecommerce/api/stores/[id]/branding/route.js

@@ -0,0 +1,183 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
+import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import {
+  bridgeLegacyGuard,
+  runMutationGuards
+} from "@open-mercato/shared/lib/crud/mutation-guard-registry";
+import { getAllMutationGuardInstances } from "@open-mercato/shared/lib/crud/mutation-guard-store";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { ecommerceStoreBrandingSchema } from "../../../../data/validators.js";
+import {
+  BRANDING_MANAGE_FEATURE,
+  resolveBrandingRouteContext,
+  resolveGrantedFeatures,
+  storeIdParamSchema
+} from "../../../../lib/storeBrandingRoute.js";
+import {
+  parseBrandingInput,
+  STORE_BRANDING_RESOURCE_KIND,
+  STORE_BRANDING_UPDATE_COMMAND_ID
+} from "../../../../lib/storeBranding.js";
+import { ecommerceInternalErrorBody } from "../../../../lib/crudSupport.js";
+const metadata = {
+  PUT: { requireAuth: true, requireFeatures: [BRANDING_MANAGE_FEATURE] }
+};
+const logger = createLogger("ecommerce").child({ component: "store-branding-route" });
+async function readStoreId(ctx) {
+  const params = await ctx.params;
+  const parsed = storeIdParamSchema.safeParse(params?.id);
+  return parsed.success ? parsed.data : null;
+}
+async function readJsonBody(req) {
+  const text = await req.text();
+  if (text.trim().length === 0) return { ok: true, body: {} };
+  try {
+    return { ok: true, body: JSON.parse(text) };
+  } catch {
+    return { ok: false };
+  }
+}
+function invalidBranding(fieldErrors) {
+  const [message] = Object.values(fieldErrors);
+  return NextResponse.json({ error: message, fieldErrors }, { status: 400 });
+}
+async function PUT(req, ctx) {
+  try {
+    const context = await resolveBrandingRouteContext(req);
+    const { translate } = await resolveTranslations();
+    const storeId = await readStoreId(ctx);
+    if (!storeId) return NextResponse.json({ error: translate("ecommerce.errors.storeNotFound", "The selected store does not exist in this organization.") }, { status: 404 });
+    const raw = await readJsonBody(req);
+    if (!raw.ok) {
+      return NextResponse.json(
+        { error: translate("ecommerce.errors.invalidJsonBody", "The request body is not valid JSON.") },
+        { status: 400 }
+      );
+    }
+    const parsed = parseBrandingInput(raw.body, translate);
+    if (!parsed.ok) return invalidBranding(parsed.fieldErrors);
+    let branding = parsed.branding;
+    const legacyGuard = bridgeLegacyGuard(context.container);
+    const guards = [...getAllMutationGuardInstances()];
+    if (legacyGuard) guards.push(legacyGuard);
+    const guardInput = {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      userId: context.auth.sub ?? "",
+      resourceKind: STORE_BRANDING_RESOURCE_KIND,
+      resourceId: storeId,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers
+    };
+    const guardResult = await runMutationGuards(
+      guards,
+      { ...guardInput, mutationPayload: { ...branding } },
+      { userFeatures: await resolveGrantedFeatures(context) }
+    );
+    if (!guardResult.ok) {
+      const blocked = guardResult.errorBody ?? {
+        error: translate("ecommerce.errors.operationBlocked", "This change was blocked. Review the store and try again.")
+      };
+      return NextResponse.json(blocked, {
+        status: guardResult.errorStatus ?? 422
+      });
+    }
+    if (guardResult.modifiedPayload) {
+      const merged = parseBrandingInput({ ...branding, ...guardResult.modifiedPayload }, translate);
+      if (!merged.ok) return invalidBranding(merged.fieldErrors);
+      branding = merged.branding;
+    }
+    const commandBus = context.container.resolve("commandBus");
+    const { result, logEntry } = await commandBus.execute(
+      STORE_BRANDING_UPDATE_COMMAND_ID,
+      {
+        input: { id: storeId, tenantId: context.tenantId, organizationId: context.organizationId, branding },
+        ctx: context.commandCtx
+      }
+    );
+    for (const callback of guardResult.afterSuccessCallbacks) {
+      if (!callback.guard.afterSuccess) continue;
+      try {
+        await callback.guard.afterSuccess({ ...guardInput, metadata: callback.metadata ?? null });
+      } catch (callbackError) {
+        logger.error("Mutation guard afterSuccess callback failed", {
+          guardId: callback.guard.id,
+          err: callbackError
+        });
+      }
+    }
+    const response = NextResponse.json({ id: result.id, updatedAt: result.updatedAt, branding: result.branding });
+    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {
+      response.headers.set(
+        "x-om-operation",
+        serializeOperationMetadata({
+          id: logEntry.id,
+          undoToken: logEntry.undoToken,
+          commandId: logEntry.commandId,
+          actionLabel: logEntry.actionLabel ?? null,
+          resourceKind: logEntry.resourceKind ?? STORE_BRANDING_RESOURCE_KIND,
+          resourceId: logEntry.resourceId ?? result.id,
+          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : typeof logEntry.createdAt === "string" ? logEntry.createdAt : (/* @__PURE__ */ new Date()).toISOString()
+        })
+      );
+    }
+    return response;
+  } catch (err) {
+    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status });
+    const interceptorRejection = getCommandInterceptorHttpRejection(err);
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status });
+    }
+    logger.error("ecommerce.stores.branding.PUT failed", { err });
+    return NextResponse.json(await ecommerceInternalErrorBody(), { status: 500 });
+  }
+}
+const brandingResponseSchema = z.object({
+  id: z.string().uuid(),
+  updatedAt: z.string().describe("The store updated_at after the write; send it as the expected version of the next save."),
+  branding: ecommerceStoreBrandingSchema
+});
+const errorSchema = z.object({ error: z.string() }).passthrough();
+const fieldErrorsSchema = z.object({
+  error: z.string(),
+  fieldErrors: z.record(z.string(), z.string())
+});
+const conflictSchema = z.object({
+  error: z.string(),
+  code: z.string(),
+  currentUpdatedAt: z.string(),
+  expectedUpdatedAt: z.string()
+});
+const openApi = {
+  tag: "Ecommerce",
+  summary: "Store branding",
+  pathParams: z.object({ id: z.string().uuid() }),
+  methods: {
+    PUT: {
+      summary: "Replace the branding of a store",
+      description: "Command route behind the Branding tab. Replaces settings.branding with the validated body (omitted or empty keys are cleared) and merges it into the stored settings server-side, so contact, display and SEO values are never touched. Requires ecommerce.branding.manage. Runs the mutation guard registry as an update, honours the x-om-ext-optimistic-lock-expected-updated-at header against the store updated_at (409 on a stale version), is undoable, and emits ecommerce.store.branding_updated, which evicts the storefront caches of the store.",
+      tags: ["Ecommerce"],
+      requestBody: { schema: ecommerceStoreBrandingSchema },
+      responses: [{ status: 200, description: "Branding saved", schema: brandingResponseSchema }],
+      errors: [
+        { status: 400, description: "A branding value is invalid; fieldErrors maps each rejected key to a message", schema: fieldErrorsSchema },
+        { status: 401, description: "Unauthorized", schema: errorSchema },
+        { status: 403, description: "Missing ecommerce.branding.manage", schema: errorSchema },
+        { status: 404, description: "The store does not exist in the selected organization", schema: errorSchema },
+        { status: 409, description: "The store changed since it was loaded (optimistic lock)", schema: conflictSchema },
+        { status: 422, description: "Blocked by a mutation guard", schema: errorSchema }
+      ]
+    }
+  }
+};
+export {
+  PUT,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/ecommerce/api/stores/[id]/branding/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/ecommerce/api/stores/%5Bid%5D/branding/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport {\n  bridgeLegacyGuard,\n  runMutationGuards,\n  type MutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard-registry'\nimport { getAllMutationGuardInstances } from '@open-mercato/shared/lib/crud/mutation-guard-store'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { StoreBrandingUpdateInput, StoreBrandingUpdateResult } from '../../../../commands/stores'\nimport { ecommerceStoreBrandingSchema, type EcommerceStoreBranding } from '../../../../data/validators'\nimport {\n  BRANDING_MANAGE_FEATURE,\n  resolveBrandingRouteContext,\n  resolveGrantedFeatures,\n  storeIdParamSchema,\n} from '../../../../lib/storeBrandingRoute'\nimport {\n  parseBrandingInput,\n  STORE_BRANDING_RESOURCE_KIND,\n  STORE_BRANDING_UPDATE_COMMAND_ID,\n} from '../../../../lib/storeBranding'\nimport { ecommerceInternalErrorBody } from '../../../../lib/crudSupport'\n\nexport const metadata = {\n  PUT: { requireAuth: true, requireFeatures: [BRANDING_MANAGE_FEATURE] },\n}\n\nconst logger = createLogger('ecommerce').child({ component: 'store-branding-route' })\n\ntype RouteParams = { params?: { id?: string } | Promise<{ id?: string }> }\n\nasync function readStoreId(ctx: RouteParams): Promise<string | null> {\n  const params = await ctx.params\n  const parsed = storeIdParamSchema.safeParse(params?.id)\n  return parsed.success ? parsed.data : null\n}\n\nasync function readJsonBody(req: Request): Promise<{ ok: true; body: unknown } | { ok: false }> {\n  const text = await req.text()\n  if (text.trim().length === 0) return { ok: true, body: {} }\n  try {\n    return { ok: true, body: JSON.parse(text) }\n  } catch {\n    return { ok: false }\n  }\n}\n\nfunction invalidBranding(fieldErrors: Record<string, string>) {\n  const [message] = Object.values(fieldErrors)\n  return NextResponse.json({ error: message, fieldErrors }, { status: 400 })\n}\n\nexport async function PUT(req: Request, ctx: RouteParams) {\n  try {\n    const context = await resolveBrandingRouteContext(req)\n    const { translate } = await resolveTranslations()\n    const storeId = await readStoreId(ctx)\n    if (!storeId) return NextResponse.json({ error: translate('ecommerce.errors.storeNotFound', 'The selected store does not exist in this organization.') }, { status: 404 })\n\n    const raw = await readJsonBody(req)\n    if (!raw.ok) {\n      return NextResponse.json(\n        { error: translate('ecommerce.errors.invalidJsonBody', 'The request body is not valid JSON.') },\n        { status: 400 },\n      )\n    }\n    const parsed = parseBrandingInput(raw.body, translate)\n    if (!parsed.ok) return invalidBranding(parsed.fieldErrors)\n    let branding: EcommerceStoreBranding = parsed.branding\n\n    const legacyGuard = bridgeLegacyGuard(context.container)\n    const guards: MutationGuard[] = [...getAllMutationGuardInstances()]\n    if (legacyGuard) guards.push(legacyGuard)\n    const guardInput = {\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n      userId: context.auth.sub ?? '',\n      resourceKind: STORE_BRANDING_RESOURCE_KIND,\n      resourceId: storeId,\n      operation: 'update' as const,\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    }\n    const guardResult = await runMutationGuards(\n      guards,\n      { ...guardInput, mutationPayload: { ...branding } },\n      { userFeatures: await resolveGrantedFeatures(context) },\n    )\n    if (!guardResult.ok) {\n      const blocked = guardResult.errorBody ?? {\n        error: translate('ecommerce.errors.operationBlocked', 'This change was blocked. Review the store and try again.'),\n      }\n      return NextResponse.json(blocked, {\n        status: guardResult.errorStatus ?? 422,\n      })\n    }\n    if (guardResult.modifiedPayload) {\n      const merged = parseBrandingInput({ ...branding, ...guardResult.modifiedPayload }, translate)\n      if (!merged.ok) return invalidBranding(merged.fieldErrors)\n      branding = merged.branding\n    }\n\n    const commandBus = context.container.resolve('commandBus') as CommandBus\n    const { result, logEntry } = await commandBus.execute<StoreBrandingUpdateInput, StoreBrandingUpdateResult>(\n      STORE_BRANDING_UPDATE_COMMAND_ID,\n      {\n        input: { id: storeId, tenantId: context.tenantId, organizationId: context.organizationId, branding },\n        ctx: context.commandCtx,\n      },\n    )\n\n    for (const callback of guardResult.afterSuccessCallbacks) {\n      if (!callback.guard.afterSuccess) continue\n      try {\n        await callback.guard.afterSuccess({ ...guardInput, metadata: callback.metadata ?? null })\n      } catch (callbackError) {\n        logger.error('Mutation guard afterSuccess callback failed', {\n          guardId: callback.guard.id,\n          err: callbackError,\n        })\n      }\n    }\n\n    const response = NextResponse.json({ id: result.id, updatedAt: result.updatedAt, branding: result.branding })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? STORE_BRANDING_RESOURCE_KIND,\n          resourceId: logEntry.resourceId ?? result.id,\n          executedAt:\n            logEntry.createdAt instanceof Date\n              ? logEntry.createdAt.toISOString()\n              : typeof logEntry.createdAt === 'string'\n                ? logEntry.createdAt\n                : new Date().toISOString(),\n        }),\n      )\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    logger.error('ecommerce.stores.branding.PUT failed', { err })\n    return NextResponse.json(await ecommerceInternalErrorBody(), { status: 500 })\n  }\n}\n\nconst brandingResponseSchema = z.object({\n  id: z.string().uuid(),\n  updatedAt: z.string().describe('The store updated_at after the write; send it as the expected version of the next save.'),\n  branding: ecommerceStoreBrandingSchema,\n})\n\nconst errorSchema = z.object({ error: z.string() }).passthrough()\n\nconst fieldErrorsSchema = z.object({\n  error: z.string(),\n  fieldErrors: z.record(z.string(), z.string()),\n})\n\nconst conflictSchema = z.object({\n  error: z.string(),\n  code: z.string(),\n  currentUpdatedAt: z.string(),\n  expectedUpdatedAt: z.string(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Ecommerce',\n  summary: 'Store branding',\n  pathParams: z.object({ id: z.string().uuid() }),\n  methods: {\n    PUT: {\n      summary: 'Replace the branding of a store',\n      description:\n        'Command route behind the Branding tab. Replaces settings.branding with the validated body (omitted or empty keys are cleared) and merges it into the stored settings server-side, so contact, display and SEO values are never touched. Requires ecommerce.branding.manage. Runs the mutation guard registry as an update, honours the x-om-ext-optimistic-lock-expected-updated-at header against the store updated_at (409 on a stale version), is undoable, and emits ecommerce.store.branding_updated, which evicts the storefront caches of the store.',\n      tags: ['Ecommerce'],\n      requestBody: { schema: ecommerceStoreBrandingSchema },\n      responses: [{ status: 200, description: 'Branding saved', schema: brandingResponseSchema }],\n      errors: [\n        { status: 400, description: 'A branding value is invalid; fieldErrors maps each rejected key to a message', schema: fieldErrorsSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Missing ecommerce.branding.manage', schema: errorSchema },\n        { status: 404, description: 'The store does not exist in the selected organization', schema: errorSchema },\n        { status: 409, description: 'The store changed since it was loaded (optimistic lock)', schema: conflictSchema },\n        { status: 422, description: 'Blocked by a mutation guard', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAC3C,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,oCAAoC;AAC7C,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAG7B,SAAS,oCAAiE;AAC1E;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,kCAAkC;AAEpC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AACvE;AAEA,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,uBAAuB,CAAC;AAIpF,eAAe,YAAY,KAA0C;AACnE,QAAM,SAAS,MAAM,IAAI;AACzB,QAAM,SAAS,mBAAmB,UAAU,QAAQ,EAAE;AACtD,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEA,eAAe,aAAa,KAAoE;AAC9F,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,MAAI,KAAK,KAAK,EAAE,WAAW,EAAG,QAAO,EAAE,IAAI,MAAM,MAAM,CAAC,EAAE;AAC1D,MAAI;AACF,WAAO,EAAE,IAAI,MAAM,MAAM,KAAK,MAAM,IAAI,EAAE;AAAA,EAC5C,QAAQ;AACN,WAAO,EAAE,IAAI,MAAM;AAAA,EACrB;AACF;AAEA,SAAS,gBAAgB,aAAqC;AAC5D,QAAM,CAAC,OAAO,IAAI,OAAO,OAAO,WAAW;AAC3C,SAAO,aAAa,KAAK,EAAE,OAAO,SAAS,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC3E;AAEA,eAAsB,IAAI,KAAc,KAAkB;AACxD,MAAI;AACF,UAAM,UAAU,MAAM,4BAA4B,GAAG;AACrD,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,UAAM,UAAU,MAAM,YAAY,GAAG;AACrC,QAAI,CAAC,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,UAAU,kCAAkC,yDAAyD,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEzK,UAAM,MAAM,MAAM,aAAa,GAAG;AAClC,QAAI,CAAC,IAAI,IAAI;AACX,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,oCAAoC,qCAAqC,EAAE;AAAA,QAC9F,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,UAAM,SAAS,mBAAmB,IAAI,MAAM,SAAS;AACrD,QAAI,CAAC,OAAO,GAAI,QAAO,gBAAgB,OAAO,WAAW;AACzD,QAAI,WAAmC,OAAO;AAE9C,UAAM,cAAc,kBAAkB,QAAQ,SAAS;AACvD,UAAM,SAA0B,CAAC,GAAG,6BAA6B,CAAC;AAClE,QAAI,YAAa,QAAO,KAAK,WAAW;AACxC,UAAM,aAAa;AAAA,MACjB,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,QAAQ,QAAQ,KAAK,OAAO;AAAA,MAC5B,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB;AACA,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MACA,EAAE,GAAG,YAAY,iBAAiB,EAAE,GAAG,SAAS,EAAE;AAAA,MAClD,EAAE,cAAc,MAAM,uBAAuB,OAAO,EAAE;AAAA,IACxD;AACA,QAAI,CAAC,YAAY,IAAI;AACnB,YAAM,UAAU,YAAY,aAAa;AAAA,QACvC,OAAO,UAAU,qCAAqC,0DAA0D;AAAA,MAClH;AACA,aAAO,aAAa,KAAK,SAAS;AAAA,QAChC,QAAQ,YAAY,eAAe;AAAA,MACrC,CAAC;AAAA,IACH;AACA,QAAI,YAAY,iBAAiB;AAC/B,YAAM,SAAS,mBAAmB,EAAE,GAAG,UAAU,GAAG,YAAY,gBAAgB,GAAG,SAAS;AAC5F,UAAI,CAAC,OAAO,GAAI,QAAO,gBAAgB,OAAO,WAAW;AACzD,iBAAW,OAAO;AAAA,IACpB;AAEA,UAAM,aAAa,QAAQ,UAAU,QAAQ,YAAY;AACzD,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,MAC5C;AAAA,MACA;AAAA,QACE,OAAO,EAAE,IAAI,SAAS,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,gBAAgB,SAAS;AAAA,QACnG,KAAK,QAAQ;AAAA,MACf;AAAA,IACF;AAEA,eAAW,YAAY,YAAY,uBAAuB;AACxD,UAAI,CAAC,SAAS,MAAM,aAAc;AAClC,UAAI;AACF,cAAM,SAAS,MAAM,aAAa,EAAE,GAAG,YAAY,UAAU,SAAS,YAAY,KAAK,CAAC;AAAA,MAC1F,SAAS,eAAe;AACtB,eAAO,MAAM,+CAA+C;AAAA,UAC1D,SAAS,SAAS,MAAM;AAAA,UACxB,KAAK;AAAA,QACP,CAAC;AAAA,MACH;AAAA,IACF;AAEA,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,OAAO,IAAI,WAAW,OAAO,WAAW,UAAU,OAAO,SAAS,CAAC;AAC5G,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,SAAS,cAAc,OAAO;AAAA,UAC1C,YACE,SAAS,qBAAqB,OAC1B,SAAS,UAAU,YAAY,IAC/B,OAAO,SAAS,cAAc,WAC5B,SAAS,aACT,oBAAI,KAAK,GAAE,YAAY;AAAA,QACjC,CAAC;AAAA,MACH;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,MAAM,wCAAwC,EAAE,IAAI,CAAC;AAC5D,WAAO,aAAa,KAAK,MAAM,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACF;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,SAAS,yFAAyF;AAAA,EACxH,UAAU;AACZ,CAAC;AAED,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY;AAEhE,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,OAAO,EAAE,OAAO;AAAA,EAChB,aAAa,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC;AAC9C,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,OAAO,EAAE,OAAO;AAAA,EAChB,MAAM,EAAE,OAAO;AAAA,EACf,kBAAkB,EAAE,OAAO;AAAA,EAC3B,mBAAmB,EAAE,OAAO;AAC9B,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9C,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,MAAM,CAAC,WAAW;AAAA,MAClB,aAAa,EAAE,QAAQ,6BAA6B;AAAA,MACpD,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,uBAAuB,CAAC;AAAA,MAC1F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gFAAgF,QAAQ,kBAAkB;AAAA,QACtI,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,YAAY;AAAA,QACrF,EAAE,QAAQ,KAAK,aAAa,yDAAyD,QAAQ,YAAY;AAAA,QACzG,EAAE,QAAQ,KAAK,aAAa,2DAA2D,QAAQ,eAAe;AAAA,QAC9G,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,YAAY;AAAA,MACjF;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/ecommerce/api/stores/[id]/preview-branding/route.js

@@ -0,0 +1,92 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { ecommerceStoreBrandingSchema } from "../../../../data/validators.js";
+import {
+  buildBrandingDeclarations,
+  renderBrandingRootRule,
+  renderBrandingStyleBlock
+} from "../../../../lib/brandingStyles.js";
+import { parseBrandingInput } from "../../../../lib/storeBranding.js";
+import { ecommerceInternalErrorBody } from "../../../../lib/crudSupport.js";
+import {
+  BRANDING_MANAGE_FEATURE,
+  requireScopedStore,
+  resolveBrandingRouteContext,
+  storeIdParamSchema
+} from "../../../../lib/storeBrandingRoute.js";
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: [BRANDING_MANAGE_FEATURE] }
+};
+const logger = createLogger("ecommerce").child({ component: "store-branding-preview-route" });
+function readQueryValues(url) {
+  const values = {};
+  for (const [key, value] of new URL(url).searchParams.entries()) values[key] = value;
+  return values;
+}
+async function GET(req, ctx) {
+  try {
+    const context = await resolveBrandingRouteContext(req);
+    const { translate } = await resolveTranslations();
+    const params = await ctx.params;
+    const storeId = storeIdParamSchema.safeParse(params?.id);
+    if (!storeId.success) {
+      return NextResponse.json(
+        { error: translate("ecommerce.errors.storeNotFound", "The selected store does not exist in this organization.") },
+        { status: 404 }
+      );
+    }
+    await requireScopedStore(context, storeId.data);
+    const parsed = parseBrandingInput(readQueryValues(req.url), translate);
+    if (!parsed.ok) {
+      const [message] = Object.values(parsed.fieldErrors);
+      return NextResponse.json({ error: message, fieldErrors: parsed.fieldErrors }, { status: 400 });
+    }
+    return NextResponse.json(
+      {
+        css: renderBrandingRootRule(parsed.branding),
+        styleBlock: renderBrandingStyleBlock(parsed.branding),
+        declarations: buildBrandingDeclarations(parsed.branding)
+      },
+      { headers: { "Cache-Control": "no-store" } }
+    );
+  } catch (err) {
+    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status });
+    logger.error("ecommerce.stores.preview-branding.GET failed", { err });
+    return NextResponse.json(await ecommerceInternalErrorBody(), { status: 500 });
+  }
+}
+const previewResponseSchema = z.object({
+  css: z.string().describe("The :root rule that the storefront emits for these values."),
+  styleBlock: z.string().describe("The same rule wrapped in the style element the storefront server-renders."),
+  declarations: z.array(z.object({ property: z.string(), value: z.string() }))
+});
+const errorSchema = z.object({ error: z.string() }).passthrough();
+const openApi = {
+  tag: "Ecommerce",
+  summary: "Store branding preview",
+  pathParams: z.object({ id: z.string().uuid() }),
+  methods: {
+    GET: {
+      summary: "Preview the stylesheet for candidate branding values",
+      description: "Validates the candidate branding values passed as query parameters with the same rules as the save route and returns the CSS the storefront would emit. Nothing is persisted. Requires ecommerce.branding.manage.",
+      tags: ["Ecommerce"],
+      query: ecommerceStoreBrandingSchema,
+      responses: [{ status: 200, description: "Rendered branding stylesheet", schema: previewResponseSchema }],
+      errors: [
+        { status: 400, description: "A branding value is invalid", schema: errorSchema },
+        { status: 401, description: "Unauthorized", schema: errorSchema },
+        { status: 403, description: "Missing ecommerce.branding.manage", schema: errorSchema },
+        { status: 404, description: "The store does not exist in the selected organization", schema: errorSchema }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map