@reblu/site-next 1.12.0 → 1.14.0

package/CHANGELOG.md

@@ -1,5 +1,62 @@
 # @reblu/site-next
 
+## 1.14.0
+
+### Minor Changes
+
+- 74a94ff: Add cart + checkout glue to the SDK (REB-829). New `./cart` subpath
+  (`CartProvider`, `useCart`, `useCartStore`, `CartItem` — zustand `persist`
+  with explicit client-side hydration, same `shop-cart` localStorage key
+  demo-site's local store already used, so an existing visitor cart survives
+  the migration). New `./shop-route-handlers` subpath (`createShopCheckoutRoute`,
+  `createShopValidateCartRoute`, `createShopApplyDiscountRoute`,
+  `createShopCheckEmailRoute`, `createShopOrderRoute`) — Route Handler
+  factories for the `/api/site/shop/{checkout,validate-cart,apply-discount,
+check-email,order/[sessionId]}` write flow, mirroring `createProxyRoute`'s
+  existing API-key/server-only handling. `./shop-server` gains
+  `getShopOrderSummary`, a server helper for an order-confirmation Server
+  Component.
+
+### Patch Changes
+
+- Updated dependencies [74a94ff]
+  - @reblu/site-contracts@1.5.0
+  - @reblu/site-client@5.2.0
+
+## 1.13.0
+
+### Minor Changes
+
+- 87b7fa0: Add `formatOpeningHours` (new `./opening-hours` subpath) and
+  `toOpeningHoursSpecification` (`./json-ld`) for REB-826's typed
+  `Config.openingHours`.
+
+  `formatOpeningHours(openingHours, { locale })` turns the typed value into
+  locale-formatted prose (Spanish default, English supported), grouping
+  consecutive days and split-schedule time windows. `toOpeningHoursSpecification`
+  maps it to schema.org `OpeningHoursSpecification` objects with `DayOfWeek`
+  URIs, one per range, for JSON-LD. Both defensively drop a range whose `days`
+  is empty or contains only unrecognised codes, since `Config.openingHours` is
+  a compile-time guarantee only.
+
+  Additive: two new exports, no changes to existing ones.
+
+### Patch Changes
+
+- 75d3963: Fix `parseShopSearchParams`/`serializeShopParams` forwarding an empty filter
+  to the API (REB-827). `taxonomy[marca]=` (an empty value — a term that was
+  just cleared, or a stale/hand-built link) previously parsed straight through
+  to `ShopProductsParams.taxonomy` as `{ marca: '' }`, and the same happened
+  for an empty/whitespace-only `attr[<key>]` value. Both bracket groups now
+  trim and drop an empty/whitespace-only value, mirroring how `q` is already
+  trimmed and dropped when empty — a key left with no surviving value is
+  absent entirely, never `{ key: '' }`/`{ key: [] }`. `serializeShopParams`
+  (and therefore `buildShopFilterHrefs`, built on it) got the same guard in
+  the other direction, so an already-empty value handed in from a caller-built
+  `active` object never reaches the querystring either.
+- Updated dependencies [87b7fa0]
+  - @reblu/site-contracts@1.4.0
+
 ## 1.12.0
 
 ### Minor Changes

package/README.md

@@ -312,6 +312,86 @@ resets pagination (`page`) — a filter change is never silently stuck on page
 reactively to `usePathname()`/`useSearchParams()`, for a filter bar that is
 its own Client Component.
 
+## Cart & checkout
+
+`./cart`, `./shop-route-handlers` and `./shop-server`'s `getShopOrderSummary`
+(REB-829) are the cart/checkout glue behind `@reblu/site-blocks`'s
+`CartLineList`/`CartSummary`/`CheckoutForm`/`CheckoutLoginPrompt`/
+`OrderConfirmation` — see that package's README for the component props.
+
+| Export | Subpath | Needs `'use client'`? |
+| ------ | ------- | ---------------------- |
+| `CartProvider`, `useCart()`, `useCartStore`, `CartItem` | `./cart` | **Yes** |
+| `createShopCheckoutRoute()` | `./shop-route-handlers` | No |
+| `createShopValidateCartRoute()` | `./shop-route-handlers` | No |
+| `createShopApplyDiscountRoute()` | `./shop-route-handlers` | No |
+| `createShopCheckEmailRoute()` | `./shop-route-handlers` | No |
+| `createShopOrderRoute()` | `./shop-route-handlers` | No |
+| `getShopOrderSummary(client, sessionId)` | `./shop-server` | No |
+
+### Wiring a SITE
+
+1. **Provider** — mount `CartProvider` once near the root layout, inside a
+   Client Component boundary (`app/layout.tsx` already has one for consent/
+   theme providers — add it there):
+
+   ```tsx
+   import { CartProvider } from '@reblu/site-next/cart'
+
+   // inside the root layout's client provider tree
+   <CartProvider>{children}</CartProvider>
+   ```
+
+2. **Route Handlers** — mount the five factories, one file each (mirrors the
+   `./route-handlers` auth pattern — a one-line file per route):
+
+   ```ts
+   // app/api/shop/checkout/route.ts
+   import { createShopCheckoutRoute } from '@reblu/site-next/shop-route-handlers'
+   export const POST = createShopCheckoutRoute()
+
+   // app/api/shop/validate-cart/route.ts
+   export const POST = createShopValidateCartRoute()
+
+   // app/api/shop/apply-discount/route.ts
+   export const POST = createShopApplyDiscountRoute()
+
+   // app/api/shop/check-email/route.ts
+   export const POST = createShopCheckEmailRoute()
+
+   // app/api/shop/order/[sessionId]/route.ts
+   export const GET = createShopOrderRoute()
+   ```
+
+   All five read `REBLU_API_BASE_URL`/`REBLU_API_KEY` lazily from `process.env`
+   (same as `./route-handlers`'s `createProxyRoute`, which they wrap) — the
+   API key never reaches the browser.
+
+3. **Pages** — create `app/shop/cart/page.tsx`, `app/shop/checkout/page.tsx`
+   and `app/shop/order-confirmation/page.tsx`. Read the cart with `useCart()`
+   from `./cart`, render `@reblu/site-blocks`'s `CartLineList`/`CartSummary`/
+   `CheckoutForm`/`OrderConfirmation`, and `fetch` the Route Handlers from
+   step 2 for checkout/validate-cart/apply-discount/check-email/order (never
+   call base-api directly from a Client Component — that's what step 2's
+   Route Handlers are for). See `apps/demo-site`'s `shop/{cart,checkout,
+   order-confirmation}/page.tsx` in this monorepo for a complete, working
+   example.
+
+### Cart persistence & consent
+
+The cart persists to `localStorage` under the key `'shop-cart'` (exported as
+`CART_STORAGE_KEY`), the SAME key demo-site's original hand-rolled store
+used — a SITE migrating from a local copy keeps its visitors' existing
+carts. This is **strictly necessary** storage (the visitor's own cart
+contents, not tracking), so it does not need cookie-consent gating the way
+`@reblu/site-next/consent`'s analytics scripts do.
+
+`skipHydration: true` on the underlying zustand `persist` middleware is
+load-bearing: it stops the store from reading `localStorage` during SSR
+(which would throw/desync). `CartProvider` calls
+`useCartStore.persist.rehydrate()` in a `useEffect` — mount it once, or the
+cart UI renders permanently empty.
+
 ## Structured data (JSON-LD)
 
 `@reblu/site-next/json-ld` (REB-622, server-only, dependency-free) renders one

package/dist/analytics.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/analytics.tsx","../src/json-ld.tsx"],"sourcesContent":["import Script from 'next/script'\n\nimport { jsonLdScriptContent } from './json-ld'\n\n/**\n * `<AnalyticsScripts>` — safe rendering of tenant-configured analytics tags (REB-617).\n *\n * THE HOLE THIS CLOSES. Every SITE built on this SDK interpolated the tenant's\n * analytics ids straight into the body of an executing `<script>`:\n *\n *   gtag('config','${analytics.gaId}');\n *   …\"clarity\",\"script\",\"${analytics.clarityId}\");\n *\n * No validation, no escaping. A `gaId` of `x');alert(document.cookie);//` closes\n * the string literal, closes the call, comments out the rest, and runs arbitrary\n * JS on the TENANT'S OWN ORIGIN — on every page including checkout, same origin\n * as the portal session cookie. For a medical tenant that is patient-session\n * territory. It is the same trust boundary as the nexus-authored HTML that\n * REB-613 closed on the sink next door, except this one reached the JS\n * interpreter with no sanitiser anywhere in the path.\n *\n * TWO INDEPENDENT LAYERS, because either alone is one refactor away from failing:\n *\n *   1. VALIDATION — an id that does not match its vendor-documented shape is\n *      dropped and NO script renders. Analytics silently does not load; the site\n *      keeps working. Failing closed matters more than failing loud here: the\n *      value is cosmetic, the sink is not.\n *   2. ESCAPING — `analyticsScriptLiteral` emits the id as a JSON string literal\n *      with the `<script>` boundary neutralised, so even a value that skipped\n *      layer 1 (a future field with a looser shape, a caller that reaches for the\n *      builders directly) is inert DATA rather than code.\n *\n * WHY VALIDATION ALONE IS NOT ENOUGH, and escaping alone is not either: layer 1\n * is a policy that a product decision can widen (someone adds `GT-` ids, or a\n * Meta Pixel field whose shape is numeric-but-unbounded), and layer 2 is a\n * mechanism that cannot express \"this is not a usable analytics id\". Keeping both\n * means widening the policy never reopens the sink.\n *\n * This lives in the SDK, not in `apps/demo-site`, because every external SITE repo\n * consuming `@reblu/site-contracts` carries the identical snippet — publishing the\n * safe component is the only way the fix reaches them.\n */\n\n/**\n * GA4 measurement id: `G-` followed by alphanumeric characters.\n *\n * Vendor source: Google Analytics Help 12270356 (\"formatted as 'G-' followed by\n * alphanumeric characters\", example `G-PSW1MY7HB4`).\n *\n * NO MINIMUM LENGTH, deliberately. The familiar id is ten characters, but Google\n * documents no length at all and its own docs print `gtag('config', 'G-12345')`\n * (Help 11259997) — inventing a floor here would reject an id Google itself\n * publishes. The upper bound is sanity, not security: the `[A-Z0-9]` class already\n * excludes every character that could leave a JS string literal, so length adds\n * nothing to the guarantee.\n *\n * Uppercase only — every documented example is uppercase, and a lowercase variant\n * is not a Google-issued id. Google tag ids also exist as `GT-` and `AW-`\n * (Help 12326985), but this field is specifically the GA4 *measurement id*\n * (the nexus form labels it so, and the SITE reads it as `gaId`); accepting the\n * other prefixes is a product decision, not a security one, and is deliberately\n * left out of this fix.\n */\nexport const GA_MEASUREMENT_ID_PATTERN = /^G-[A-Z0-9]{1,32}$/\n\n/**\n * Microsoft Clarity project id: lowercase alphanumeric.\n *\n * Vendor source: Microsoft Learn `clarity-setup` publishes a live demo project\n * under id `3t0wlogvdz`; every id Microsoft prints is lowercase alphanumeric of\n * about ten characters. Microsoft documents no formal grammar, so — as with GA —\n * the bound is generous and the character class carries the guarantee.\n *\n * RESIDUAL RISK, stated plainly: no vendor page enumerates the legal Clarity\n * alphabet, so this is inferred from published examples. If some tenant holds an\n * id containing a character outside `[a-z0-9]`, this rejects it. That is why the\n * API coerces a non-matching id to `null` instead of erroring — analytics stops\n * loading for that tenant, the site keeps serving, and the misconfiguration is\n * visible and fixable rather than an outage.\n */\nexport const CLARITY_PROJECT_ID_PATTERN = /^[a-z0-9]{1,32}$/\n\n/** True only for a string matching the vendor-documented GA4 measurement id shape. */\nexport function isValidGaMeasurementId(value: unknown): value is string {\n  return typeof value === 'string' && GA_MEASUREMENT_ID_PATTERN.test(value)\n}\n\n/** True only for a string matching the vendor-documented Clarity project id shape. */\nexport function isValidClarityProjectId(value: unknown): value is string {\n  return typeof value === 'string' && CLARITY_PROJECT_ID_PATTERN.test(value)\n}\n\n/**\n * Serialises `id` as a JS string literal safe to embed in a `<script>` body.\n *\n * Reuses `jsonLdScriptContent` rather than growing a second escaper: a JSON string\n * literal IS a valid JS string literal, and that helper already does the two things\n * required here — `JSON.stringify` for the quote/backslash/newline boundary, plus\n * `<` `>` `&` U+2028 U+2029 escaping for the HTML raw-text boundary that\n * `JSON.stringify` leaves wide open. One audited primitive, one place to fix.\n */\nexport function analyticsScriptLiteral(id: string): string {\n  return jsonLdScriptContent(id)\n}\n\n/** Body of the GA4 bootstrap script. Always escapes; never trusts its caller. */\nexport function gaInitScript(gaId: string): string {\n  return `window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments);}gtag('js',new Date());gtag('config',${analyticsScriptLiteral(gaId)});`\n}\n\n/** Body of the Microsoft Clarity bootstrap script. Always escapes; never trusts its caller. */\nexport function clarityInitScript(clarityId: string): string {\n  return `(function(c,l,a,r,i,t,y){c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)};t=l.createElement(r);t.async=1;t.src=\"https://www.clarity.ms/tag/\"+i;y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y)})(window,document,\"clarity\",\"script\",${analyticsScriptLiteral(clarityId)});`\n}\n\nexport interface AnalyticsScriptsProps {\n  /** GA4 measurement id from the SITE analytics contract. Ignored unless it matches `G-…`. */\n  gaId?: string | null\n  /** Microsoft Clarity project id from the SITE analytics contract. Ignored unless lowercase alphanumeric. */\n  clarityId?: string | null\n}\n\n/**\n * Renders the Google Analytics and Microsoft Clarity tags for a tenant, dropping\n * any id that does not match its vendor-documented shape.\n */\nexport function AnalyticsScripts({ gaId, clarityId }: AnalyticsScriptsProps) {\n  const safeGaId = isValidGaMeasurementId(gaId) ? gaId : null\n  const safeClarityId = isValidClarityProjectId(clarityId) ? clarityId : null\n\n  if (!safeGaId && !safeClarityId) return null\n\n  return (\n    <>\n      {safeGaId && (\n        <>\n          <Script\n            src={`https://www.googletagmanager.com/gtag/js?id=${encodeURIComponent(safeGaId)}`}\n            strategy='afterInteractive'\n          />\n          <Script\n            id='ga-init'\n            strategy='afterInteractive'\n            dangerouslySetInnerHTML={{ __html: gaInitScript(safeGaId) }}\n          />\n        </>\n      )}\n\n      {safeClarityId && (\n        <Script\n          id='clarity-init'\n          strategy='afterInteractive'\n          dangerouslySetInnerHTML={{ __html: clarityInitScript(safeClarityId) }}\n        />\n      )}\n    </>\n  )\n}\n","/**\n * `<JsonLd>` — safe `application/ld+json` script renderer (REB-622).\n *\n * A `<script>` element is HTML's \"raw text\" context: the parser closes it on the\n * first case-insensitive `</script` byte sequence it sees, no matter whether\n * that sequence sits inside a JSON string. `JSON.stringify` escapes for JSON\n * syntax, not for this HTML boundary, so it leaves `<` verbatim — turning any\n * JSON-LD payload built from tenant-authored data (page title, description,\n * FAQ copy, …) into a stored-XSS sink: a value containing\n * `</script><img src=x onerror=alert(1)>` breaks out of the element and runs.\n *\n * `jsonLdScriptContent` neutralises exactly that boundary while staying\n * byte-for-byte valid JSON: `<` / `>` / `&` are standard JSON\n * character escapes, so `JSON.parse` recovers the original value unchanged —\n * this is an ESCAPER, not a strip/allowlist sanitiser (see `sanitizeHtml` in\n * `@reblu/site-blocks` for that job, at the HTML boundary rather than the\n * script boundary). U+2028/U+2029 are escaped too: both are valid inside a\n * JSON string but are raw JS line terminators, and some `<script>` consumers\n * (older JS parsers, some static analysers) choke on them unescaped.\n *\n * This package, not `@reblu/site-blocks`, is the home for it: `site-blocks`'s\n * main entry bundles `parse5` + the `hast-util-*` chain + `marked` for\n * `sanitizeHtml` with `treeshake: false` — dist/index.js is ~463 KB, and PR #848\n * spent a full round removing exactly that weight (89 KB gzipped) from a client\n * bundle that only needed one HTML-escaping helper. `<JsonLd>` is Next-specific\n * (App Router's `suppressHydrationWarning` pattern) and this 40-line escaper has\n * zero dependencies of its own, so it ships as its OWN tsup entry\n * (`@reblu/site-next/json-ld`) rather than folding into the root `index` barrel\n * — importing it must never drag in `CtaButtons`/`EditableCta`'s `next/link` +\n * `@reblu/site-ui` graph, the same isolation `./cache` and `./route-handlers`\n * already use for the same reason.\n *\n * @see https://nextjs.org/docs/app/guides/json-ld\n */\n\nconst SCRIPT_BOUNDARY_UNSAFE = /[<>&\\u2028\\u2029]/g\n\nconst ESCAPES: Record<string, string> = {\n  '<': '\\\\u003c',\n  '>': '\\\\u003e',\n  '&': '\\\\u0026',\n  '\\u2028': '\\\\u2028',\n  '\\u2029': '\\\\u2029',\n}\n\n/**\n * Serialises `value` for embedding inside `<script type=\"application/ld+json\">`.\n * Escapes `<`, `>`, `&`, U+2028 and U+2029 — every escape is a standard JSON\n * character escape, so `JSON.parse(jsonLdScriptContent(value))` always recovers\n * `value` unchanged. This only ever ADDS escaping; it never strips or rewrites\n * data, unlike an HTML sanitiser.\n *\n * `JSON.stringify(undefined)` returns the JS value `undefined`, not a string\n * (`undefined` has no JSON representation), which would otherwise throw here.\n * `data` is typed `unknown` with zero friction toward `undefined`, so this\n * falls back to the JSON literal `'null'` rather than crashing an entire page\n * render over one missing field.\n */\nexport function jsonLdScriptContent(value: unknown): string {\n  const json = JSON.stringify(value) ?? 'null'\n  return json.replace(SCRIPT_BOUNDARY_UNSAFE, (char) => ESCAPES[char])\n}\n\nexport interface JsonLdProps {\n  /** Suffix for the rendered `<script>` id: `json-ld-${id}`. */\n  id: string\n  /** Structured data to serialise. Any JSON-serialisable value. */\n  data: unknown\n}\n\n/**\n * Renders one `application/ld+json` `<script>` tag using the official Next.js\n * App Router pattern. `suppressHydrationWarning` is required here: React warns\n * on a server/client `textContent` mismatch for this element even though there\n * is no real divergence — `dangerouslySetInnerHTML` content is opaque to React's\n * hydration diff.\n */\nexport function JsonLd({ id, data }: JsonLdProps) {\n  return (\n    <script\n      id={`json-ld-${id}`}\n      type='application/ld+json'\n      suppressHydrationWarning\n      dangerouslySetInnerHTML={{ __html: jsonLdScriptContent(data) }}\n    />\n  )\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAmB;;;AC+Ef;AA5CJ,IAAM,yBAAyB;AAE/B,IAAM,UAAkC;AAAA,EACtC,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,UAAU;AAAA,EACV,UAAU;AACZ;AAeO,SAAS,oBAAoB,OAAwB;AAC1D,QAAM,OAAO,KAAK,UAAU,KAAK,KAAK;AACtC,SAAO,KAAK,QAAQ,wBAAwB,CAAC,SAAS,QAAQ,IAAI,CAAC;AACrE;;;AD0EQ,IAAAA,sBAAA;AAxED,IAAM,4BAA4B;AAiBlC,IAAM,6BAA6B;AAGnC,SAAS,uBAAuB,OAAiC;AACtE,SAAO,OAAO,UAAU,YAAY,0BAA0B,KAAK,KAAK;AAC1E;AAGO,SAAS,wBAAwB,OAAiC;AACvE,SAAO,OAAO,UAAU,YAAY,2BAA2B,KAAK,KAAK;AAC3E;AAWO,SAAS,uBAAuB,IAAoB;AACzD,SAAO,oBAAoB,EAAE;AAC/B;AAGO,SAAS,aAAa,MAAsB;AACjD,SAAO,wHAAwH,uBAAuB,IAAI,CAAC;AAC7J;AAGO,SAAS,kBAAkB,WAA2B;AAC3D,SAAO,+PAA+P,uBAAuB,SAAS,CAAC;AACzS;AAaO,SAAS,iBAAiB,EAAE,MAAM,UAAU,GAA0B;AAC3E,QAAM,WAAW,uBAAuB,IAAI,IAAI,OAAO;AACvD,QAAM,gBAAgB,wBAAwB,SAAS,IAAI,YAAY;AAEvE,MAAI,CAAC,YAAY,CAAC,cAAe,QAAO;AAExC,SACE,8EACG;AAAA,gBACC,8EACE;AAAA;AAAA,QAAC,cAAAC;AAAA,QAAA;AAAA,UACC,KAAK,+CAA+C,mBAAmB,QAAQ,CAAC;AAAA,UAChF,UAAS;AAAA;AAAA,MACX;AAAA,MACA;AAAA,QAAC,cAAAA;AAAA,QAAA;AAAA,UACC,IAAG;AAAA,UACH,UAAS;AAAA,UACT,yBAAyB,EAAE,QAAQ,aAAa,QAAQ,EAAE;AAAA;AAAA,MAC5D;AAAA,OACF;AAAA,IAGD,iBACC;AAAA,MAAC,cAAAA;AAAA,MAAA;AAAA,QACC,IAAG;AAAA,QACH,UAAS;AAAA,QACT,yBAAyB,EAAE,QAAQ,kBAAkB,aAAa,EAAE;AAAA;AAAA,IACtE;AAAA,KAEJ;AAEJ;","names":["import_jsx_runtime","Script"]}
+{"version":3,"sources":["../src/analytics.tsx","../src/json-ld.tsx"],"sourcesContent":["import Script from 'next/script'\n\nimport { jsonLdScriptContent } from './json-ld'\n\n/**\n * `<AnalyticsScripts>` — safe rendering of tenant-configured analytics tags (REB-617).\n *\n * THE HOLE THIS CLOSES. Every SITE built on this SDK interpolated the tenant's\n * analytics ids straight into the body of an executing `<script>`:\n *\n *   gtag('config','${analytics.gaId}');\n *   …\"clarity\",\"script\",\"${analytics.clarityId}\");\n *\n * No validation, no escaping. A `gaId` of `x');alert(document.cookie);//` closes\n * the string literal, closes the call, comments out the rest, and runs arbitrary\n * JS on the TENANT'S OWN ORIGIN — on every page including checkout, same origin\n * as the portal session cookie. For a medical tenant that is patient-session\n * territory. It is the same trust boundary as the nexus-authored HTML that\n * REB-613 closed on the sink next door, except this one reached the JS\n * interpreter with no sanitiser anywhere in the path.\n *\n * TWO INDEPENDENT LAYERS, because either alone is one refactor away from failing:\n *\n *   1. VALIDATION — an id that does not match its vendor-documented shape is\n *      dropped and NO script renders. Analytics silently does not load; the site\n *      keeps working. Failing closed matters more than failing loud here: the\n *      value is cosmetic, the sink is not.\n *   2. ESCAPING — `analyticsScriptLiteral` emits the id as a JSON string literal\n *      with the `<script>` boundary neutralised, so even a value that skipped\n *      layer 1 (a future field with a looser shape, a caller that reaches for the\n *      builders directly) is inert DATA rather than code.\n *\n * WHY VALIDATION ALONE IS NOT ENOUGH, and escaping alone is not either: layer 1\n * is a policy that a product decision can widen (someone adds `GT-` ids, or a\n * Meta Pixel field whose shape is numeric-but-unbounded), and layer 2 is a\n * mechanism that cannot express \"this is not a usable analytics id\". Keeping both\n * means widening the policy never reopens the sink.\n *\n * This lives in the SDK, not in `apps/demo-site`, because every external SITE repo\n * consuming `@reblu/site-contracts` carries the identical snippet — publishing the\n * safe component is the only way the fix reaches them.\n */\n\n/**\n * GA4 measurement id: `G-` followed by alphanumeric characters.\n *\n * Vendor source: Google Analytics Help 12270356 (\"formatted as 'G-' followed by\n * alphanumeric characters\", example `G-PSW1MY7HB4`).\n *\n * NO MINIMUM LENGTH, deliberately. The familiar id is ten characters, but Google\n * documents no length at all and its own docs print `gtag('config', 'G-12345')`\n * (Help 11259997) — inventing a floor here would reject an id Google itself\n * publishes. The upper bound is sanity, not security: the `[A-Z0-9]` class already\n * excludes every character that could leave a JS string literal, so length adds\n * nothing to the guarantee.\n *\n * Uppercase only — every documented example is uppercase, and a lowercase variant\n * is not a Google-issued id. Google tag ids also exist as `GT-` and `AW-`\n * (Help 12326985), but this field is specifically the GA4 *measurement id*\n * (the nexus form labels it so, and the SITE reads it as `gaId`); accepting the\n * other prefixes is a product decision, not a security one, and is deliberately\n * left out of this fix.\n */\nexport const GA_MEASUREMENT_ID_PATTERN = /^G-[A-Z0-9]{1,32}$/\n\n/**\n * Microsoft Clarity project id: lowercase alphanumeric.\n *\n * Vendor source: Microsoft Learn `clarity-setup` publishes a live demo project\n * under id `3t0wlogvdz`; every id Microsoft prints is lowercase alphanumeric of\n * about ten characters. Microsoft documents no formal grammar, so — as with GA —\n * the bound is generous and the character class carries the guarantee.\n *\n * RESIDUAL RISK, stated plainly: no vendor page enumerates the legal Clarity\n * alphabet, so this is inferred from published examples. If some tenant holds an\n * id containing a character outside `[a-z0-9]`, this rejects it. That is why the\n * API coerces a non-matching id to `null` instead of erroring — analytics stops\n * loading for that tenant, the site keeps serving, and the misconfiguration is\n * visible and fixable rather than an outage.\n */\nexport const CLARITY_PROJECT_ID_PATTERN = /^[a-z0-9]{1,32}$/\n\n/** True only for a string matching the vendor-documented GA4 measurement id shape. */\nexport function isValidGaMeasurementId(value: unknown): value is string {\n  return typeof value === 'string' && GA_MEASUREMENT_ID_PATTERN.test(value)\n}\n\n/** True only for a string matching the vendor-documented Clarity project id shape. */\nexport function isValidClarityProjectId(value: unknown): value is string {\n  return typeof value === 'string' && CLARITY_PROJECT_ID_PATTERN.test(value)\n}\n\n/**\n * Serialises `id` as a JS string literal safe to embed in a `<script>` body.\n *\n * Reuses `jsonLdScriptContent` rather than growing a second escaper: a JSON string\n * literal IS a valid JS string literal, and that helper already does the two things\n * required here — `JSON.stringify` for the quote/backslash/newline boundary, plus\n * `<` `>` `&` U+2028 U+2029 escaping for the HTML raw-text boundary that\n * `JSON.stringify` leaves wide open. One audited primitive, one place to fix.\n */\nexport function analyticsScriptLiteral(id: string): string {\n  return jsonLdScriptContent(id)\n}\n\n/** Body of the GA4 bootstrap script. Always escapes; never trusts its caller. */\nexport function gaInitScript(gaId: string): string {\n  return `window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments);}gtag('js',new Date());gtag('config',${analyticsScriptLiteral(gaId)});`\n}\n\n/** Body of the Microsoft Clarity bootstrap script. Always escapes; never trusts its caller. */\nexport function clarityInitScript(clarityId: string): string {\n  return `(function(c,l,a,r,i,t,y){c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)};t=l.createElement(r);t.async=1;t.src=\"https://www.clarity.ms/tag/\"+i;y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y)})(window,document,\"clarity\",\"script\",${analyticsScriptLiteral(clarityId)});`\n}\n\nexport interface AnalyticsScriptsProps {\n  /** GA4 measurement id from the SITE analytics contract. Ignored unless it matches `G-…`. */\n  gaId?: string | null\n  /** Microsoft Clarity project id from the SITE analytics contract. Ignored unless lowercase alphanumeric. */\n  clarityId?: string | null\n}\n\n/**\n * Renders the Google Analytics and Microsoft Clarity tags for a tenant, dropping\n * any id that does not match its vendor-documented shape.\n */\nexport function AnalyticsScripts({ gaId, clarityId }: AnalyticsScriptsProps) {\n  const safeGaId = isValidGaMeasurementId(gaId) ? gaId : null\n  const safeClarityId = isValidClarityProjectId(clarityId) ? clarityId : null\n\n  if (!safeGaId && !safeClarityId) return null\n\n  return (\n    <>\n      {safeGaId && (\n        <>\n          <Script\n            src={`https://www.googletagmanager.com/gtag/js?id=${encodeURIComponent(safeGaId)}`}\n            strategy='afterInteractive'\n          />\n          <Script\n            id='ga-init'\n            strategy='afterInteractive'\n            dangerouslySetInnerHTML={{ __html: gaInitScript(safeGaId) }}\n          />\n        </>\n      )}\n\n      {safeClarityId && (\n        <Script\n          id='clarity-init'\n          strategy='afterInteractive'\n          dangerouslySetInnerHTML={{ __html: clarityInitScript(safeClarityId) }}\n        />\n      )}\n    </>\n  )\n}\n","/**\n * `<JsonLd>` — safe `application/ld+json` script renderer (REB-622).\n *\n * A `<script>` element is HTML's \"raw text\" context: the parser closes it on the\n * first case-insensitive `</script` byte sequence it sees, no matter whether\n * that sequence sits inside a JSON string. `JSON.stringify` escapes for JSON\n * syntax, not for this HTML boundary, so it leaves `<` verbatim — turning any\n * JSON-LD payload built from tenant-authored data (page title, description,\n * FAQ copy, …) into a stored-XSS sink: a value containing\n * `</script><img src=x onerror=alert(1)>` breaks out of the element and runs.\n *\n * `jsonLdScriptContent` neutralises exactly that boundary while staying\n * byte-for-byte valid JSON: `<` / `>` / `&` are standard JSON\n * character escapes, so `JSON.parse` recovers the original value unchanged —\n * this is an ESCAPER, not a strip/allowlist sanitiser (see `sanitizeHtml` in\n * `@reblu/site-blocks` for that job, at the HTML boundary rather than the\n * script boundary). U+2028/U+2029 are escaped too: both are valid inside a\n * JSON string but are raw JS line terminators, and some `<script>` consumers\n * (older JS parsers, some static analysers) choke on them unescaped.\n *\n * This package, not `@reblu/site-blocks`, is the home for it: `site-blocks`'s\n * main entry bundles `parse5` + the `hast-util-*` chain + `marked` for\n * `sanitizeHtml` with `treeshake: false` — dist/index.js is ~463 KB, and PR #848\n * spent a full round removing exactly that weight (89 KB gzipped) from a client\n * bundle that only needed one HTML-escaping helper. `<JsonLd>` is Next-specific\n * (App Router's `suppressHydrationWarning` pattern) and this 40-line escaper has\n * zero dependencies of its own, so it ships as its OWN tsup entry\n * (`@reblu/site-next/json-ld`) rather than folding into the root `index` barrel\n * — importing it must never drag in `CtaButtons`/`EditableCta`'s `next/link` +\n * `@reblu/site-ui` graph, the same isolation `./cache` and `./route-handlers`\n * already use for the same reason.\n *\n * @see https://nextjs.org/docs/app/guides/json-ld\n */\n\nimport type { ConfigOpeningHours, ConfigOpeningHoursDay } from '@reblu/site-contracts'\n\nconst SCRIPT_BOUNDARY_UNSAFE = /[<>&\\u2028\\u2029]/g\n\nconst ESCAPES: Record<string, string> = {\n  '<': '\\\\u003c',\n  '>': '\\\\u003e',\n  '&': '\\\\u0026',\n  '\\u2028': '\\\\u2028',\n  '\\u2029': '\\\\u2029',\n}\n\n/**\n * Serialises `value` for embedding inside `<script type=\"application/ld+json\">`.\n * Escapes `<`, `>`, `&`, U+2028 and U+2029 — every escape is a standard JSON\n * character escape, so `JSON.parse(jsonLdScriptContent(value))` always recovers\n * `value` unchanged. This only ever ADDS escaping; it never strips or rewrites\n * data, unlike an HTML sanitiser.\n *\n * `JSON.stringify(undefined)` returns the JS value `undefined`, not a string\n * (`undefined` has no JSON representation), which would otherwise throw here.\n * `data` is typed `unknown` with zero friction toward `undefined`, so this\n * falls back to the JSON literal `'null'` rather than crashing an entire page\n * render over one missing field.\n */\nexport function jsonLdScriptContent(value: unknown): string {\n  const json = JSON.stringify(value) ?? 'null'\n  return json.replace(SCRIPT_BOUNDARY_UNSAFE, (char) => ESCAPES[char])\n}\n\nexport interface JsonLdProps {\n  /** Suffix for the rendered `<script>` id: `json-ld-${id}`. */\n  id: string\n  /** Structured data to serialise. Any JSON-serialisable value. */\n  data: unknown\n}\n\n/**\n * Renders one `application/ld+json` `<script>` tag using the official Next.js\n * App Router pattern. `suppressHydrationWarning` is required here: React warns\n * on a server/client `textContent` mismatch for this element even though there\n * is no real divergence — `dangerouslySetInnerHTML` content is opaque to React's\n * hydration diff.\n */\nexport function JsonLd({ id, data }: JsonLdProps) {\n  return (\n    <script\n      id={`json-ld-${id}`}\n      type='application/ld+json'\n      suppressHydrationWarning\n      dangerouslySetInnerHTML={{ __html: jsonLdScriptContent(data) }}\n    />\n  )\n}\n\n// ─── Opening hours → schema.org OpeningHoursSpecification (REB-826) ──────────\n\n/** schema.org `OpeningHoursSpecification`, the shape a `LocalBusiness`/\n * `MedicalOrganization`/etc. entity's `openingHoursSpecification` array holds.\n * @see https://schema.org/OpeningHoursSpecification\n */\nexport interface OpeningHoursSpecification {\n  '@type': 'OpeningHoursSpecification'\n  dayOfWeek: string[]\n  opens: string\n  closes: string\n}\n\n/** schema.org `DayOfWeek` URIs, keyed by the Reblu `ConfigOpeningHoursDay` enum. */\nconst SCHEMA_DAY_OF_WEEK: Record<ConfigOpeningHoursDay, string> = {\n  MON: 'https://schema.org/Monday',\n  TUE: 'https://schema.org/Tuesday',\n  WED: 'https://schema.org/Wednesday',\n  THU: 'https://schema.org/Thursday',\n  FRI: 'https://schema.org/Friday',\n  SAT: 'https://schema.org/Saturday',\n  SUN: 'https://schema.org/Sunday',\n}\n\n/**\n * Maps the Reblu `Config.openingHours` typed value to one\n * `OpeningHoursSpecification` object per range, each with its `days` turned\n * into schema.org `DayOfWeek` URIs. One range = one spec object; this does\n * NOT group or reformat for display (see `formatOpeningHours` in\n * `@reblu/site-next/opening-hours` for that) — structured data wants one\n * entry per machine-readable (days, opens, closes) tuple, not prose.\n *\n * Returns `undefined` — not `[]` — for \"nothing to merge\" (no typed hours, or\n * a typed value with zero ranges), so a caller building a JSON-LD entity with\n * `entity.openingHoursSpecification = toOpeningHoursSpecification(...)` can\n * `if (spec)` guard it without emitting an empty array into the graph.\n *\n * Used both by SITE builds assembling their own JSON-LD (the published use\n * case this SDK exists for) and by base-api's own structured-data builder —\n * see `generate-structured-data.ts`. Unlike `cookiePolicyVersion`\n * (`@reblu/site-next/consent-server`), this is NOT duplicated into base-api:\n * that duplication exists only where two independently-deployed sides (a\n * SITE's stored cookie vs. base-api's request-time check) must each derive\n * the identical value without talking to each other. Here base-api is the\n * ONLY side computing this value — there is no second computation to agree\n * with — so importing the single implementation is strictly better than a\n * second copy that could drift.\n *\n * Defensive against a malformed stored value — `Config.openingHours` is a\n * compile-time guarantee only. A range whose `days` is empty, or whose codes\n * are all unrecognised (outside `SCHEMA_DAY_OF_WEEK`'s keys), is dropped\n * entirely rather than emitting a spec object with an empty `dayOfWeek` (or\n * one padded with `undefined` for every unrecognised code). If every range\n * is dropped this way, the result is `undefined`, never `[]`.\n */\nexport function toOpeningHoursSpecification(\n  openingHours: ConfigOpeningHours | null | undefined,\n): OpeningHoursSpecification[] | undefined {\n  if (!openingHours || openingHours.ranges.length === 0) return undefined\n  const specs: OpeningHoursSpecification[] = []\n  for (const range of openingHours.ranges) {\n    const dayOfWeek = range.days\n      // `Object.hasOwn`, not `day in SCHEMA_DAY_OF_WEEK`: the `in` operator\n      // also matches INHERITED properties (`'constructor'`, `'toString'`,\n      // `'hasOwnProperty'`, …), which are not own keys of this lookup object\n      // but would still pass an `in` check and resolve to a function, not a\n      // schema.org URI string — corrupting `dayOfWeek` with exactly the kind\n      // of malformed entry this filtering exists to prevent.\n      .filter((day): day is ConfigOpeningHoursDay => Object.hasOwn(SCHEMA_DAY_OF_WEEK, day))\n      .map((day) => SCHEMA_DAY_OF_WEEK[day])\n    if (dayOfWeek.length === 0) continue\n    specs.push({\n      '@type': 'OpeningHoursSpecification',\n      dayOfWeek,\n      opens: range.opens,\n      closes: range.closes,\n    })\n  }\n  return specs.length > 0 ? specs : undefined\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAmB;;;ACiFf;AA5CJ,IAAM,yBAAyB;AAE/B,IAAM,UAAkC;AAAA,EACtC,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,UAAU;AAAA,EACV,UAAU;AACZ;AAeO,SAAS,oBAAoB,OAAwB;AAC1D,QAAM,OAAO,KAAK,UAAU,KAAK,KAAK;AACtC,SAAO,KAAK,QAAQ,wBAAwB,CAAC,SAAS,QAAQ,IAAI,CAAC;AACrE;;;ADwEQ,IAAAA,sBAAA;AAxED,IAAM,4BAA4B;AAiBlC,IAAM,6BAA6B;AAGnC,SAAS,uBAAuB,OAAiC;AACtE,SAAO,OAAO,UAAU,YAAY,0BAA0B,KAAK,KAAK;AAC1E;AAGO,SAAS,wBAAwB,OAAiC;AACvE,SAAO,OAAO,UAAU,YAAY,2BAA2B,KAAK,KAAK;AAC3E;AAWO,SAAS,uBAAuB,IAAoB;AACzD,SAAO,oBAAoB,EAAE;AAC/B;AAGO,SAAS,aAAa,MAAsB;AACjD,SAAO,wHAAwH,uBAAuB,IAAI,CAAC;AAC7J;AAGO,SAAS,kBAAkB,WAA2B;AAC3D,SAAO,+PAA+P,uBAAuB,SAAS,CAAC;AACzS;AAaO,SAAS,iBAAiB,EAAE,MAAM,UAAU,GAA0B;AAC3E,QAAM,WAAW,uBAAuB,IAAI,IAAI,OAAO;AACvD,QAAM,gBAAgB,wBAAwB,SAAS,IAAI,YAAY;AAEvE,MAAI,CAAC,YAAY,CAAC,cAAe,QAAO;AAExC,SACE,8EACG;AAAA,gBACC,8EACE;AAAA;AAAA,QAAC,cAAAC;AAAA,QAAA;AAAA,UACC,KAAK,+CAA+C,mBAAmB,QAAQ,CAAC;AAAA,UAChF,UAAS;AAAA;AAAA,MACX;AAAA,MACA;AAAA,QAAC,cAAAA;AAAA,QAAA;AAAA,UACC,IAAG;AAAA,UACH,UAAS;AAAA,UACT,yBAAyB,EAAE,QAAQ,aAAa,QAAQ,EAAE;AAAA;AAAA,MAC5D;AAAA,OACF;AAAA,IAGD,iBACC;AAAA,MAAC,cAAAA;AAAA,MAAA;AAAA,QACC,IAAG;AAAA,QACH,UAAS;AAAA,QACT,yBAAyB,EAAE,QAAQ,kBAAkB,aAAa,EAAE;AAAA;AAAA,IACtE;AAAA,KAEJ;AAEJ;","names":["import_jsx_runtime","Script"]}

package/dist/analytics.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/analytics.tsx","../src/json-ld.tsx"],"sourcesContent":["import Script from 'next/script'\n\nimport { jsonLdScriptContent } from './json-ld'\n\n/**\n * `<AnalyticsScripts>` — safe rendering of tenant-configured analytics tags (REB-617).\n *\n * THE HOLE THIS CLOSES. Every SITE built on this SDK interpolated the tenant's\n * analytics ids straight into the body of an executing `<script>`:\n *\n *   gtag('config','${analytics.gaId}');\n *   …\"clarity\",\"script\",\"${analytics.clarityId}\");\n *\n * No validation, no escaping. A `gaId` of `x');alert(document.cookie);//` closes\n * the string literal, closes the call, comments out the rest, and runs arbitrary\n * JS on the TENANT'S OWN ORIGIN — on every page including checkout, same origin\n * as the portal session cookie. For a medical tenant that is patient-session\n * territory. It is the same trust boundary as the nexus-authored HTML that\n * REB-613 closed on the sink next door, except this one reached the JS\n * interpreter with no sanitiser anywhere in the path.\n *\n * TWO INDEPENDENT LAYERS, because either alone is one refactor away from failing:\n *\n *   1. VALIDATION — an id that does not match its vendor-documented shape is\n *      dropped and NO script renders. Analytics silently does not load; the site\n *      keeps working. Failing closed matters more than failing loud here: the\n *      value is cosmetic, the sink is not.\n *   2. ESCAPING — `analyticsScriptLiteral` emits the id as a JSON string literal\n *      with the `<script>` boundary neutralised, so even a value that skipped\n *      layer 1 (a future field with a looser shape, a caller that reaches for the\n *      builders directly) is inert DATA rather than code.\n *\n * WHY VALIDATION ALONE IS NOT ENOUGH, and escaping alone is not either: layer 1\n * is a policy that a product decision can widen (someone adds `GT-` ids, or a\n * Meta Pixel field whose shape is numeric-but-unbounded), and layer 2 is a\n * mechanism that cannot express \"this is not a usable analytics id\". Keeping both\n * means widening the policy never reopens the sink.\n *\n * This lives in the SDK, not in `apps/demo-site`, because every external SITE repo\n * consuming `@reblu/site-contracts` carries the identical snippet — publishing the\n * safe component is the only way the fix reaches them.\n */\n\n/**\n * GA4 measurement id: `G-` followed by alphanumeric characters.\n *\n * Vendor source: Google Analytics Help 12270356 (\"formatted as 'G-' followed by\n * alphanumeric characters\", example `G-PSW1MY7HB4`).\n *\n * NO MINIMUM LENGTH, deliberately. The familiar id is ten characters, but Google\n * documents no length at all and its own docs print `gtag('config', 'G-12345')`\n * (Help 11259997) — inventing a floor here would reject an id Google itself\n * publishes. The upper bound is sanity, not security: the `[A-Z0-9]` class already\n * excludes every character that could leave a JS string literal, so length adds\n * nothing to the guarantee.\n *\n * Uppercase only — every documented example is uppercase, and a lowercase variant\n * is not a Google-issued id. Google tag ids also exist as `GT-` and `AW-`\n * (Help 12326985), but this field is specifically the GA4 *measurement id*\n * (the nexus form labels it so, and the SITE reads it as `gaId`); accepting the\n * other prefixes is a product decision, not a security one, and is deliberately\n * left out of this fix.\n */\nexport const GA_MEASUREMENT_ID_PATTERN = /^G-[A-Z0-9]{1,32}$/\n\n/**\n * Microsoft Clarity project id: lowercase alphanumeric.\n *\n * Vendor source: Microsoft Learn `clarity-setup` publishes a live demo project\n * under id `3t0wlogvdz`; every id Microsoft prints is lowercase alphanumeric of\n * about ten characters. Microsoft documents no formal grammar, so — as with GA —\n * the bound is generous and the character class carries the guarantee.\n *\n * RESIDUAL RISK, stated plainly: no vendor page enumerates the legal Clarity\n * alphabet, so this is inferred from published examples. If some tenant holds an\n * id containing a character outside `[a-z0-9]`, this rejects it. That is why the\n * API coerces a non-matching id to `null` instead of erroring — analytics stops\n * loading for that tenant, the site keeps serving, and the misconfiguration is\n * visible and fixable rather than an outage.\n */\nexport const CLARITY_PROJECT_ID_PATTERN = /^[a-z0-9]{1,32}$/\n\n/** True only for a string matching the vendor-documented GA4 measurement id shape. */\nexport function isValidGaMeasurementId(value: unknown): value is string {\n  return typeof value === 'string' && GA_MEASUREMENT_ID_PATTERN.test(value)\n}\n\n/** True only for a string matching the vendor-documented Clarity project id shape. */\nexport function isValidClarityProjectId(value: unknown): value is string {\n  return typeof value === 'string' && CLARITY_PROJECT_ID_PATTERN.test(value)\n}\n\n/**\n * Serialises `id` as a JS string literal safe to embed in a `<script>` body.\n *\n * Reuses `jsonLdScriptContent` rather than growing a second escaper: a JSON string\n * literal IS a valid JS string literal, and that helper already does the two things\n * required here — `JSON.stringify` for the quote/backslash/newline boundary, plus\n * `<` `>` `&` U+2028 U+2029 escaping for the HTML raw-text boundary that\n * `JSON.stringify` leaves wide open. One audited primitive, one place to fix.\n */\nexport function analyticsScriptLiteral(id: string): string {\n  return jsonLdScriptContent(id)\n}\n\n/** Body of the GA4 bootstrap script. Always escapes; never trusts its caller. */\nexport function gaInitScript(gaId: string): string {\n  return `window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments);}gtag('js',new Date());gtag('config',${analyticsScriptLiteral(gaId)});`\n}\n\n/** Body of the Microsoft Clarity bootstrap script. Always escapes; never trusts its caller. */\nexport function clarityInitScript(clarityId: string): string {\n  return `(function(c,l,a,r,i,t,y){c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)};t=l.createElement(r);t.async=1;t.src=\"https://www.clarity.ms/tag/\"+i;y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y)})(window,document,\"clarity\",\"script\",${analyticsScriptLiteral(clarityId)});`\n}\n\nexport interface AnalyticsScriptsProps {\n  /** GA4 measurement id from the SITE analytics contract. Ignored unless it matches `G-…`. */\n  gaId?: string | null\n  /** Microsoft Clarity project id from the SITE analytics contract. Ignored unless lowercase alphanumeric. */\n  clarityId?: string | null\n}\n\n/**\n * Renders the Google Analytics and Microsoft Clarity tags for a tenant, dropping\n * any id that does not match its vendor-documented shape.\n */\nexport function AnalyticsScripts({ gaId, clarityId }: AnalyticsScriptsProps) {\n  const safeGaId = isValidGaMeasurementId(gaId) ? gaId : null\n  const safeClarityId = isValidClarityProjectId(clarityId) ? clarityId : null\n\n  if (!safeGaId && !safeClarityId) return null\n\n  return (\n    <>\n      {safeGaId && (\n        <>\n          <Script\n            src={`https://www.googletagmanager.com/gtag/js?id=${encodeURIComponent(safeGaId)}`}\n            strategy='afterInteractive'\n          />\n          <Script\n            id='ga-init'\n            strategy='afterInteractive'\n            dangerouslySetInnerHTML={{ __html: gaInitScript(safeGaId) }}\n          />\n        </>\n      )}\n\n      {safeClarityId && (\n        <Script\n          id='clarity-init'\n          strategy='afterInteractive'\n          dangerouslySetInnerHTML={{ __html: clarityInitScript(safeClarityId) }}\n        />\n      )}\n    </>\n  )\n}\n","/**\n * `<JsonLd>` — safe `application/ld+json` script renderer (REB-622).\n *\n * A `<script>` element is HTML's \"raw text\" context: the parser closes it on the\n * first case-insensitive `</script` byte sequence it sees, no matter whether\n * that sequence sits inside a JSON string. `JSON.stringify` escapes for JSON\n * syntax, not for this HTML boundary, so it leaves `<` verbatim — turning any\n * JSON-LD payload built from tenant-authored data (page title, description,\n * FAQ copy, …) into a stored-XSS sink: a value containing\n * `</script><img src=x onerror=alert(1)>` breaks out of the element and runs.\n *\n * `jsonLdScriptContent` neutralises exactly that boundary while staying\n * byte-for-byte valid JSON: `<` / `>` / `&` are standard JSON\n * character escapes, so `JSON.parse` recovers the original value unchanged —\n * this is an ESCAPER, not a strip/allowlist sanitiser (see `sanitizeHtml` in\n * `@reblu/site-blocks` for that job, at the HTML boundary rather than the\n * script boundary). U+2028/U+2029 are escaped too: both are valid inside a\n * JSON string but are raw JS line terminators, and some `<script>` consumers\n * (older JS parsers, some static analysers) choke on them unescaped.\n *\n * This package, not `@reblu/site-blocks`, is the home for it: `site-blocks`'s\n * main entry bundles `parse5` + the `hast-util-*` chain + `marked` for\n * `sanitizeHtml` with `treeshake: false` — dist/index.js is ~463 KB, and PR #848\n * spent a full round removing exactly that weight (89 KB gzipped) from a client\n * bundle that only needed one HTML-escaping helper. `<JsonLd>` is Next-specific\n * (App Router's `suppressHydrationWarning` pattern) and this 40-line escaper has\n * zero dependencies of its own, so it ships as its OWN tsup entry\n * (`@reblu/site-next/json-ld`) rather than folding into the root `index` barrel\n * — importing it must never drag in `CtaButtons`/`EditableCta`'s `next/link` +\n * `@reblu/site-ui` graph, the same isolation `./cache` and `./route-handlers`\n * already use for the same reason.\n *\n * @see https://nextjs.org/docs/app/guides/json-ld\n */\n\nconst SCRIPT_BOUNDARY_UNSAFE = /[<>&\\u2028\\u2029]/g\n\nconst ESCAPES: Record<string, string> = {\n  '<': '\\\\u003c',\n  '>': '\\\\u003e',\n  '&': '\\\\u0026',\n  '\\u2028': '\\\\u2028',\n  '\\u2029': '\\\\u2029',\n}\n\n/**\n * Serialises `value` for embedding inside `<script type=\"application/ld+json\">`.\n * Escapes `<`, `>`, `&`, U+2028 and U+2029 — every escape is a standard JSON\n * character escape, so `JSON.parse(jsonLdScriptContent(value))` always recovers\n * `value` unchanged. This only ever ADDS escaping; it never strips or rewrites\n * data, unlike an HTML sanitiser.\n *\n * `JSON.stringify(undefined)` returns the JS value `undefined`, not a string\n * (`undefined` has no JSON representation), which would otherwise throw here.\n * `data` is typed `unknown` with zero friction toward `undefined`, so this\n * falls back to the JSON literal `'null'` rather than crashing an entire page\n * render over one missing field.\n */\nexport function jsonLdScriptContent(value: unknown): string {\n  const json = JSON.stringify(value) ?? 'null'\n  return json.replace(SCRIPT_BOUNDARY_UNSAFE, (char) => ESCAPES[char])\n}\n\nexport interface JsonLdProps {\n  /** Suffix for the rendered `<script>` id: `json-ld-${id}`. */\n  id: string\n  /** Structured data to serialise. Any JSON-serialisable value. */\n  data: unknown\n}\n\n/**\n * Renders one `application/ld+json` `<script>` tag using the official Next.js\n * App Router pattern. `suppressHydrationWarning` is required here: React warns\n * on a server/client `textContent` mismatch for this element even though there\n * is no real divergence — `dangerouslySetInnerHTML` content is opaque to React's\n * hydration diff.\n */\nexport function JsonLd({ id, data }: JsonLdProps) {\n  return (\n    <script\n      id={`json-ld-${id}`}\n      type='application/ld+json'\n      suppressHydrationWarning\n      dangerouslySetInnerHTML={{ __html: jsonLdScriptContent(data) }}\n    />\n  )\n}\n"],"mappings":";AAAA,OAAO,YAAY;;;AC+Ef;AA5CJ,IAAM,yBAAyB;AAE/B,IAAM,UAAkC;AAAA,EACtC,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,UAAU;AAAA,EACV,UAAU;AACZ;AAeO,SAAS,oBAAoB,OAAwB;AAC1D,QAAM,OAAO,KAAK,UAAU,KAAK,KAAK;AACtC,SAAO,KAAK,QAAQ,wBAAwB,CAAC,SAAS,QAAQ,IAAI,CAAC;AACrE;;;AD0EQ,mBACE,OAAAA,MADF;AAxED,IAAM,4BAA4B;AAiBlC,IAAM,6BAA6B;AAGnC,SAAS,uBAAuB,OAAiC;AACtE,SAAO,OAAO,UAAU,YAAY,0BAA0B,KAAK,KAAK;AAC1E;AAGO,SAAS,wBAAwB,OAAiC;AACvE,SAAO,OAAO,UAAU,YAAY,2BAA2B,KAAK,KAAK;AAC3E;AAWO,SAAS,uBAAuB,IAAoB;AACzD,SAAO,oBAAoB,EAAE;AAC/B;AAGO,SAAS,aAAa,MAAsB;AACjD,SAAO,wHAAwH,uBAAuB,IAAI,CAAC;AAC7J;AAGO,SAAS,kBAAkB,WAA2B;AAC3D,SAAO,+PAA+P,uBAAuB,SAAS,CAAC;AACzS;AAaO,SAAS,iBAAiB,EAAE,MAAM,UAAU,GAA0B;AAC3E,QAAM,WAAW,uBAAuB,IAAI,IAAI,OAAO;AACvD,QAAM,gBAAgB,wBAAwB,SAAS,IAAI,YAAY;AAEvE,MAAI,CAAC,YAAY,CAAC,cAAe,QAAO;AAExC,SACE,iCACG;AAAA,gBACC,iCACE;AAAA,sBAAAA;AAAA,QAAC;AAAA;AAAA,UACC,KAAK,+CAA+C,mBAAmB,QAAQ,CAAC;AAAA,UAChF,UAAS;AAAA;AAAA,MACX;AAAA,MACA,gBAAAA;AAAA,QAAC;AAAA;AAAA,UACC,IAAG;AAAA,UACH,UAAS;AAAA,UACT,yBAAyB,EAAE,QAAQ,aAAa,QAAQ,EAAE;AAAA;AAAA,MAC5D;AAAA,OACF;AAAA,IAGD,iBACC,gBAAAA;AAAA,MAAC;AAAA;AAAA,QACC,IAAG;AAAA,QACH,UAAS;AAAA,QACT,yBAAyB,EAAE,QAAQ,kBAAkB,aAAa,EAAE;AAAA;AAAA,IACtE;AAAA,KAEJ;AAEJ;","names":["jsx"]}
+{"version":3,"sources":["../src/analytics.tsx","../src/json-ld.tsx"],"sourcesContent":["import Script from 'next/script'\n\nimport { jsonLdScriptContent } from './json-ld'\n\n/**\n * `<AnalyticsScripts>` — safe rendering of tenant-configured analytics tags (REB-617).\n *\n * THE HOLE THIS CLOSES. Every SITE built on this SDK interpolated the tenant's\n * analytics ids straight into the body of an executing `<script>`:\n *\n *   gtag('config','${analytics.gaId}');\n *   …\"clarity\",\"script\",\"${analytics.clarityId}\");\n *\n * No validation, no escaping. A `gaId` of `x');alert(document.cookie);//` closes\n * the string literal, closes the call, comments out the rest, and runs arbitrary\n * JS on the TENANT'S OWN ORIGIN — on every page including checkout, same origin\n * as the portal session cookie. For a medical tenant that is patient-session\n * territory. It is the same trust boundary as the nexus-authored HTML that\n * REB-613 closed on the sink next door, except this one reached the JS\n * interpreter with no sanitiser anywhere in the path.\n *\n * TWO INDEPENDENT LAYERS, because either alone is one refactor away from failing:\n *\n *   1. VALIDATION — an id that does not match its vendor-documented shape is\n *      dropped and NO script renders. Analytics silently does not load; the site\n *      keeps working. Failing closed matters more than failing loud here: the\n *      value is cosmetic, the sink is not.\n *   2. ESCAPING — `analyticsScriptLiteral` emits the id as a JSON string literal\n *      with the `<script>` boundary neutralised, so even a value that skipped\n *      layer 1 (a future field with a looser shape, a caller that reaches for the\n *      builders directly) is inert DATA rather than code.\n *\n * WHY VALIDATION ALONE IS NOT ENOUGH, and escaping alone is not either: layer 1\n * is a policy that a product decision can widen (someone adds `GT-` ids, or a\n * Meta Pixel field whose shape is numeric-but-unbounded), and layer 2 is a\n * mechanism that cannot express \"this is not a usable analytics id\". Keeping both\n * means widening the policy never reopens the sink.\n *\n * This lives in the SDK, not in `apps/demo-site`, because every external SITE repo\n * consuming `@reblu/site-contracts` carries the identical snippet — publishing the\n * safe component is the only way the fix reaches them.\n */\n\n/**\n * GA4 measurement id: `G-` followed by alphanumeric characters.\n *\n * Vendor source: Google Analytics Help 12270356 (\"formatted as 'G-' followed by\n * alphanumeric characters\", example `G-PSW1MY7HB4`).\n *\n * NO MINIMUM LENGTH, deliberately. The familiar id is ten characters, but Google\n * documents no length at all and its own docs print `gtag('config', 'G-12345')`\n * (Help 11259997) — inventing a floor here would reject an id Google itself\n * publishes. The upper bound is sanity, not security: the `[A-Z0-9]` class already\n * excludes every character that could leave a JS string literal, so length adds\n * nothing to the guarantee.\n *\n * Uppercase only — every documented example is uppercase, and a lowercase variant\n * is not a Google-issued id. Google tag ids also exist as `GT-` and `AW-`\n * (Help 12326985), but this field is specifically the GA4 *measurement id*\n * (the nexus form labels it so, and the SITE reads it as `gaId`); accepting the\n * other prefixes is a product decision, not a security one, and is deliberately\n * left out of this fix.\n */\nexport const GA_MEASUREMENT_ID_PATTERN = /^G-[A-Z0-9]{1,32}$/\n\n/**\n * Microsoft Clarity project id: lowercase alphanumeric.\n *\n * Vendor source: Microsoft Learn `clarity-setup` publishes a live demo project\n * under id `3t0wlogvdz`; every id Microsoft prints is lowercase alphanumeric of\n * about ten characters. Microsoft documents no formal grammar, so — as with GA —\n * the bound is generous and the character class carries the guarantee.\n *\n * RESIDUAL RISK, stated plainly: no vendor page enumerates the legal Clarity\n * alphabet, so this is inferred from published examples. If some tenant holds an\n * id containing a character outside `[a-z0-9]`, this rejects it. That is why the\n * API coerces a non-matching id to `null` instead of erroring — analytics stops\n * loading for that tenant, the site keeps serving, and the misconfiguration is\n * visible and fixable rather than an outage.\n */\nexport const CLARITY_PROJECT_ID_PATTERN = /^[a-z0-9]{1,32}$/\n\n/** True only for a string matching the vendor-documented GA4 measurement id shape. */\nexport function isValidGaMeasurementId(value: unknown): value is string {\n  return typeof value === 'string' && GA_MEASUREMENT_ID_PATTERN.test(value)\n}\n\n/** True only for a string matching the vendor-documented Clarity project id shape. */\nexport function isValidClarityProjectId(value: unknown): value is string {\n  return typeof value === 'string' && CLARITY_PROJECT_ID_PATTERN.test(value)\n}\n\n/**\n * Serialises `id` as a JS string literal safe to embed in a `<script>` body.\n *\n * Reuses `jsonLdScriptContent` rather than growing a second escaper: a JSON string\n * literal IS a valid JS string literal, and that helper already does the two things\n * required here — `JSON.stringify` for the quote/backslash/newline boundary, plus\n * `<` `>` `&` U+2028 U+2029 escaping for the HTML raw-text boundary that\n * `JSON.stringify` leaves wide open. One audited primitive, one place to fix.\n */\nexport function analyticsScriptLiteral(id: string): string {\n  return jsonLdScriptContent(id)\n}\n\n/** Body of the GA4 bootstrap script. Always escapes; never trusts its caller. */\nexport function gaInitScript(gaId: string): string {\n  return `window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments);}gtag('js',new Date());gtag('config',${analyticsScriptLiteral(gaId)});`\n}\n\n/** Body of the Microsoft Clarity bootstrap script. Always escapes; never trusts its caller. */\nexport function clarityInitScript(clarityId: string): string {\n  return `(function(c,l,a,r,i,t,y){c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)};t=l.createElement(r);t.async=1;t.src=\"https://www.clarity.ms/tag/\"+i;y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y)})(window,document,\"clarity\",\"script\",${analyticsScriptLiteral(clarityId)});`\n}\n\nexport interface AnalyticsScriptsProps {\n  /** GA4 measurement id from the SITE analytics contract. Ignored unless it matches `G-…`. */\n  gaId?: string | null\n  /** Microsoft Clarity project id from the SITE analytics contract. Ignored unless lowercase alphanumeric. */\n  clarityId?: string | null\n}\n\n/**\n * Renders the Google Analytics and Microsoft Clarity tags for a tenant, dropping\n * any id that does not match its vendor-documented shape.\n */\nexport function AnalyticsScripts({ gaId, clarityId }: AnalyticsScriptsProps) {\n  const safeGaId = isValidGaMeasurementId(gaId) ? gaId : null\n  const safeClarityId = isValidClarityProjectId(clarityId) ? clarityId : null\n\n  if (!safeGaId && !safeClarityId) return null\n\n  return (\n    <>\n      {safeGaId && (\n        <>\n          <Script\n            src={`https://www.googletagmanager.com/gtag/js?id=${encodeURIComponent(safeGaId)}`}\n            strategy='afterInteractive'\n          />\n          <Script\n            id='ga-init'\n            strategy='afterInteractive'\n            dangerouslySetInnerHTML={{ __html: gaInitScript(safeGaId) }}\n          />\n        </>\n      )}\n\n      {safeClarityId && (\n        <Script\n          id='clarity-init'\n          strategy='afterInteractive'\n          dangerouslySetInnerHTML={{ __html: clarityInitScript(safeClarityId) }}\n        />\n      )}\n    </>\n  )\n}\n","/**\n * `<JsonLd>` — safe `application/ld+json` script renderer (REB-622).\n *\n * A `<script>` element is HTML's \"raw text\" context: the parser closes it on the\n * first case-insensitive `</script` byte sequence it sees, no matter whether\n * that sequence sits inside a JSON string. `JSON.stringify` escapes for JSON\n * syntax, not for this HTML boundary, so it leaves `<` verbatim — turning any\n * JSON-LD payload built from tenant-authored data (page title, description,\n * FAQ copy, …) into a stored-XSS sink: a value containing\n * `</script><img src=x onerror=alert(1)>` breaks out of the element and runs.\n *\n * `jsonLdScriptContent` neutralises exactly that boundary while staying\n * byte-for-byte valid JSON: `<` / `>` / `&` are standard JSON\n * character escapes, so `JSON.parse` recovers the original value unchanged —\n * this is an ESCAPER, not a strip/allowlist sanitiser (see `sanitizeHtml` in\n * `@reblu/site-blocks` for that job, at the HTML boundary rather than the\n * script boundary). U+2028/U+2029 are escaped too: both are valid inside a\n * JSON string but are raw JS line terminators, and some `<script>` consumers\n * (older JS parsers, some static analysers) choke on them unescaped.\n *\n * This package, not `@reblu/site-blocks`, is the home for it: `site-blocks`'s\n * main entry bundles `parse5` + the `hast-util-*` chain + `marked` for\n * `sanitizeHtml` with `treeshake: false` — dist/index.js is ~463 KB, and PR #848\n * spent a full round removing exactly that weight (89 KB gzipped) from a client\n * bundle that only needed one HTML-escaping helper. `<JsonLd>` is Next-specific\n * (App Router's `suppressHydrationWarning` pattern) and this 40-line escaper has\n * zero dependencies of its own, so it ships as its OWN tsup entry\n * (`@reblu/site-next/json-ld`) rather than folding into the root `index` barrel\n * — importing it must never drag in `CtaButtons`/`EditableCta`'s `next/link` +\n * `@reblu/site-ui` graph, the same isolation `./cache` and `./route-handlers`\n * already use for the same reason.\n *\n * @see https://nextjs.org/docs/app/guides/json-ld\n */\n\nimport type { ConfigOpeningHours, ConfigOpeningHoursDay } from '@reblu/site-contracts'\n\nconst SCRIPT_BOUNDARY_UNSAFE = /[<>&\\u2028\\u2029]/g\n\nconst ESCAPES: Record<string, string> = {\n  '<': '\\\\u003c',\n  '>': '\\\\u003e',\n  '&': '\\\\u0026',\n  '\\u2028': '\\\\u2028',\n  '\\u2029': '\\\\u2029',\n}\n\n/**\n * Serialises `value` for embedding inside `<script type=\"application/ld+json\">`.\n * Escapes `<`, `>`, `&`, U+2028 and U+2029 — every escape is a standard JSON\n * character escape, so `JSON.parse(jsonLdScriptContent(value))` always recovers\n * `value` unchanged. This only ever ADDS escaping; it never strips or rewrites\n * data, unlike an HTML sanitiser.\n *\n * `JSON.stringify(undefined)` returns the JS value `undefined`, not a string\n * (`undefined` has no JSON representation), which would otherwise throw here.\n * `data` is typed `unknown` with zero friction toward `undefined`, so this\n * falls back to the JSON literal `'null'` rather than crashing an entire page\n * render over one missing field.\n */\nexport function jsonLdScriptContent(value: unknown): string {\n  const json = JSON.stringify(value) ?? 'null'\n  return json.replace(SCRIPT_BOUNDARY_UNSAFE, (char) => ESCAPES[char])\n}\n\nexport interface JsonLdProps {\n  /** Suffix for the rendered `<script>` id: `json-ld-${id}`. */\n  id: string\n  /** Structured data to serialise. Any JSON-serialisable value. */\n  data: unknown\n}\n\n/**\n * Renders one `application/ld+json` `<script>` tag using the official Next.js\n * App Router pattern. `suppressHydrationWarning` is required here: React warns\n * on a server/client `textContent` mismatch for this element even though there\n * is no real divergence — `dangerouslySetInnerHTML` content is opaque to React's\n * hydration diff.\n */\nexport function JsonLd({ id, data }: JsonLdProps) {\n  return (\n    <script\n      id={`json-ld-${id}`}\n      type='application/ld+json'\n      suppressHydrationWarning\n      dangerouslySetInnerHTML={{ __html: jsonLdScriptContent(data) }}\n    />\n  )\n}\n\n// ─── Opening hours → schema.org OpeningHoursSpecification (REB-826) ──────────\n\n/** schema.org `OpeningHoursSpecification`, the shape a `LocalBusiness`/\n * `MedicalOrganization`/etc. entity's `openingHoursSpecification` array holds.\n * @see https://schema.org/OpeningHoursSpecification\n */\nexport interface OpeningHoursSpecification {\n  '@type': 'OpeningHoursSpecification'\n  dayOfWeek: string[]\n  opens: string\n  closes: string\n}\n\n/** schema.org `DayOfWeek` URIs, keyed by the Reblu `ConfigOpeningHoursDay` enum. */\nconst SCHEMA_DAY_OF_WEEK: Record<ConfigOpeningHoursDay, string> = {\n  MON: 'https://schema.org/Monday',\n  TUE: 'https://schema.org/Tuesday',\n  WED: 'https://schema.org/Wednesday',\n  THU: 'https://schema.org/Thursday',\n  FRI: 'https://schema.org/Friday',\n  SAT: 'https://schema.org/Saturday',\n  SUN: 'https://schema.org/Sunday',\n}\n\n/**\n * Maps the Reblu `Config.openingHours` typed value to one\n * `OpeningHoursSpecification` object per range, each with its `days` turned\n * into schema.org `DayOfWeek` URIs. One range = one spec object; this does\n * NOT group or reformat for display (see `formatOpeningHours` in\n * `@reblu/site-next/opening-hours` for that) — structured data wants one\n * entry per machine-readable (days, opens, closes) tuple, not prose.\n *\n * Returns `undefined` — not `[]` — for \"nothing to merge\" (no typed hours, or\n * a typed value with zero ranges), so a caller building a JSON-LD entity with\n * `entity.openingHoursSpecification = toOpeningHoursSpecification(...)` can\n * `if (spec)` guard it without emitting an empty array into the graph.\n *\n * Used both by SITE builds assembling their own JSON-LD (the published use\n * case this SDK exists for) and by base-api's own structured-data builder —\n * see `generate-structured-data.ts`. Unlike `cookiePolicyVersion`\n * (`@reblu/site-next/consent-server`), this is NOT duplicated into base-api:\n * that duplication exists only where two independently-deployed sides (a\n * SITE's stored cookie vs. base-api's request-time check) must each derive\n * the identical value without talking to each other. Here base-api is the\n * ONLY side computing this value — there is no second computation to agree\n * with — so importing the single implementation is strictly better than a\n * second copy that could drift.\n *\n * Defensive against a malformed stored value — `Config.openingHours` is a\n * compile-time guarantee only. A range whose `days` is empty, or whose codes\n * are all unrecognised (outside `SCHEMA_DAY_OF_WEEK`'s keys), is dropped\n * entirely rather than emitting a spec object with an empty `dayOfWeek` (or\n * one padded with `undefined` for every unrecognised code). If every range\n * is dropped this way, the result is `undefined`, never `[]`.\n */\nexport function toOpeningHoursSpecification(\n  openingHours: ConfigOpeningHours | null | undefined,\n): OpeningHoursSpecification[] | undefined {\n  if (!openingHours || openingHours.ranges.length === 0) return undefined\n  const specs: OpeningHoursSpecification[] = []\n  for (const range of openingHours.ranges) {\n    const dayOfWeek = range.days\n      // `Object.hasOwn`, not `day in SCHEMA_DAY_OF_WEEK`: the `in` operator\n      // also matches INHERITED properties (`'constructor'`, `'toString'`,\n      // `'hasOwnProperty'`, …), which are not own keys of this lookup object\n      // but would still pass an `in` check and resolve to a function, not a\n      // schema.org URI string — corrupting `dayOfWeek` with exactly the kind\n      // of malformed entry this filtering exists to prevent.\n      .filter((day): day is ConfigOpeningHoursDay => Object.hasOwn(SCHEMA_DAY_OF_WEEK, day))\n      .map((day) => SCHEMA_DAY_OF_WEEK[day])\n    if (dayOfWeek.length === 0) continue\n    specs.push({\n      '@type': 'OpeningHoursSpecification',\n      dayOfWeek,\n      opens: range.opens,\n      closes: range.closes,\n    })\n  }\n  return specs.length > 0 ? specs : undefined\n}\n"],"mappings":";AAAA,OAAO,YAAY;;;ACiFf;AA5CJ,IAAM,yBAAyB;AAE/B,IAAM,UAAkC;AAAA,EACtC,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,UAAU;AAAA,EACV,UAAU;AACZ;AAeO,SAAS,oBAAoB,OAAwB;AAC1D,QAAM,OAAO,KAAK,UAAU,KAAK,KAAK;AACtC,SAAO,KAAK,QAAQ,wBAAwB,CAAC,SAAS,QAAQ,IAAI,CAAC;AACrE;;;ADwEQ,mBACE,OAAAA,MADF;AAxED,IAAM,4BAA4B;AAiBlC,IAAM,6BAA6B;AAGnC,SAAS,uBAAuB,OAAiC;AACtE,SAAO,OAAO,UAAU,YAAY,0BAA0B,KAAK,KAAK;AAC1E;AAGO,SAAS,wBAAwB,OAAiC;AACvE,SAAO,OAAO,UAAU,YAAY,2BAA2B,KAAK,KAAK;AAC3E;AAWO,SAAS,uBAAuB,IAAoB;AACzD,SAAO,oBAAoB,EAAE;AAC/B;AAGO,SAAS,aAAa,MAAsB;AACjD,SAAO,wHAAwH,uBAAuB,IAAI,CAAC;AAC7J;AAGO,SAAS,kBAAkB,WAA2B;AAC3D,SAAO,+PAA+P,uBAAuB,SAAS,CAAC;AACzS;AAaO,SAAS,iBAAiB,EAAE,MAAM,UAAU,GAA0B;AAC3E,QAAM,WAAW,uBAAuB,IAAI,IAAI,OAAO;AACvD,QAAM,gBAAgB,wBAAwB,SAAS,IAAI,YAAY;AAEvE,MAAI,CAAC,YAAY,CAAC,cAAe,QAAO;AAExC,SACE,iCACG;AAAA,gBACC,iCACE;AAAA,sBAAAA;AAAA,QAAC;AAAA;AAAA,UACC,KAAK,+CAA+C,mBAAmB,QAAQ,CAAC;AAAA,UAChF,UAAS;AAAA;AAAA,MACX;AAAA,MACA,gBAAAA;AAAA,QAAC;AAAA;AAAA,UACC,IAAG;AAAA,UACH,UAAS;AAAA,UACT,yBAAyB,EAAE,QAAQ,aAAa,QAAQ,EAAE;AAAA;AAAA,MAC5D;AAAA,OACF;AAAA,IAGD,iBACC,gBAAAA;AAAA,MAAC;AAAA;AAAA,QACC,IAAG;AAAA,QACH,UAAS;AAAA,QACT,yBAAyB,EAAE,QAAQ,kBAAkB,aAAa,EAAE;AAAA;AAAA,IACtE;AAAA,KAEJ;AAEJ;","names":["jsx"]}

package/dist/cart.cjs

@@ -0,0 +1,137 @@
+"use strict";
+"use client";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/cart/index.ts
+var cart_exports = {};
+__export(cart_exports, {
+  CART_STORAGE_KEY: () => CART_STORAGE_KEY,
+  CartProvider: () => CartProvider,
+  useCart: () => useCart,
+  useCartStore: () => useCartStore
+});
+module.exports = __toCommonJS(cart_exports);
+
+// src/cart/provider.tsx
+var import_react = require("react");
+
+// src/cart/store.ts
+var import_zustand = require("zustand");
+var import_middleware = require("zustand/middleware");
+var CART_STORAGE_KEY = "shop-cart";
+function isSameItem(a, productId, variantId) {
+  return a.productId === productId && (a.variantId ?? null) === (variantId ?? null);
+}
+function normalizeQuantity(quantity, maxStock) {
+  if (!Number.isFinite(quantity)) return 0;
+  const truncated = Math.trunc(quantity);
+  if (truncated < 1) return 0;
+  if (maxStock === null) return truncated;
+  const maxTruncated = Math.trunc(maxStock);
+  if (maxTruncated < 1) return 0;
+  return Math.min(truncated, maxTruncated);
+}
+var useCartStore = (0, import_zustand.create)()(
+  (0, import_middleware.persist)(
+    (set, get) => ({
+      items: [],
+      addItem: (item) => {
+        set((state) => {
+          const existing = state.items.find((i) => isSameItem(i, item.productId, item.variantId));
+          if (existing) {
+            if (item.maxStock !== null && Math.trunc(item.maxStock) < 1) {
+              return {
+                items: state.items.filter((i) => !isSameItem(i, item.productId, item.variantId))
+              };
+            }
+            const newQty = normalizeQuantity(existing.quantity + item.quantity, item.maxStock);
+            if (newQty < 1) {
+              return {};
+            }
+            return {
+              items: state.items.map(
+                (i) => isSameItem(i, item.productId, item.variantId) ? { ...i, quantity: newQty, maxStock: item.maxStock } : i
+              )
+            };
+          }
+          const qty = normalizeQuantity(item.quantity, item.maxStock);
+          if (qty < 1) {
+            return {};
+          }
+          return { items: [...state.items, { ...item, quantity: qty }] };
+        });
+      },
+      removeItem: (productId, variantId) => {
+        set((state) => ({
+          items: state.items.filter((i) => !isSameItem(i, productId, variantId))
+        }));
+      },
+      updateQuantity: (productId, variantId, quantity) => {
+        const existing = get().items.find((i) => isSameItem(i, productId, variantId));
+        if (!existing) return;
+        const newQty = normalizeQuantity(quantity, existing.maxStock);
+        if (newQty < 1) {
+          get().removeItem(productId, variantId);
+          return;
+        }
+        set((state) => ({
+          items: state.items.map(
+            (i) => isSameItem(i, productId, variantId) ? { ...i, quantity: newQty } : i
+          )
+        }));
+      },
+      clearCart: () => set({ items: [] }),
+      getTotal: () => get().items.reduce((sum, item) => sum + item.unitPrice * item.quantity, 0),
+      getItemCount: () => get().items.reduce((sum, item) => sum + item.quantity, 0)
+    }),
+    {
+      name: CART_STORAGE_KEY,
+      skipHydration: true
+    }
+  )
+);
+
+// src/cart/provider.tsx
+var import_jsx_runtime = require("react/jsx-runtime");
+function CartProvider({ children }) {
+  (0, import_react.useEffect)(() => {
+    useCartStore.persist.rehydrate();
+  }, []);
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_jsx_runtime.Fragment, { children });
+}
+
+// src/cart/use-cart.ts
+function useCart() {
+  const items = useCartStore((s) => s.items);
+  const addItem = useCartStore((s) => s.addItem);
+  const removeItem = useCartStore((s) => s.removeItem);
+  const updateQuantity = useCartStore((s) => s.updateQuantity);
+  const clearCart = useCartStore((s) => s.clearCart);
+  const total = items.reduce((sum, item) => sum + item.unitPrice * item.quantity, 0);
+  const itemCount = items.reduce((sum, item) => sum + item.quantity, 0);
+  return { items, total, itemCount, addItem, removeItem, updateQuantity, clearCart };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CART_STORAGE_KEY,
+  CartProvider,
+  useCart,
+  useCartStore
+});
+//# sourceMappingURL=cart.cjs.map

package/dist/cart.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cart/index.ts","../src/cart/provider.tsx","../src/cart/store.ts","../src/cart/use-cart.ts"],"sourcesContent":["'use client'\n\n/**\n * `@reblu/site-next/cart` (REB-829) — the SDK's cart client surface. This\n * barrel MUST begin with its OWN leading `'use client'` directive — same R4\n * rule as `./auth`/`./academy`: tsup only preserves a directive prologue\n * declared by the entry file itself (see `tsup.config.ts`).\n *\n * Mount `CartProvider` once near the root layout, then read/mutate the cart\n * from any Client Component via `useCart()` (derived `total`/`itemCount`) or\n * the raw `useCartStore` (per-field selectors, zustand-idiomatic). Both\n * share the SAME store instance and the SAME `shop-cart` localStorage key a\n * SITE migrating off a hand-rolled store already used.\n */\nexport { CartProvider } from './provider'\nexport { useCart, type UseCartResult } from './use-cart'\nexport { useCartStore, CART_STORAGE_KEY, type CartItem, type CartStore } from './store'\n","'use client'\n\nimport { useEffect } from 'react'\nimport { useCartStore } from './store'\n\n/**\n * `CartProvider` — mount this once near the root layout (inside a Client\n * Component boundary). It owns the ONE explicit-hydration call\n * `useCartStore.persist.rehydrate()` requires (`store.ts`'s `skipHydration`\n * doc) — a SITE that forgets to mount it gets an always-empty cart that never\n * reads back whatever a previous visit (or page reload) persisted.\n */\nexport function CartProvider({ children }: { children: React.ReactNode }) {\n  useEffect(() => {\n    useCartStore.persist.rehydrate()\n  }, [])\n\n  return <>{children}</>\n}\n","import { create } from 'zustand'\nimport { persist } from 'zustand/middleware'\n\n/**\n * `useCartStore` — the SDK's cart state (REB-829). Ported verbatim (same\n * shape, same quantity-clamping rules) from demo-site's local\n * `lib/store/cart-store.ts`, which every SITE was otherwise expected to\n * hand-copy. `CART_STORAGE_KEY` stays exactly `'shop-cart'` on purpose: a\n * SITE migrating from the local copy keeps its visitors' existing carts.\n *\n * `skipHydration: true` (zustand persist) is load-bearing for SSR: without\n * it, zustand's persist middleware reads `localStorage` synchronously during\n * module evaluation, which throws (or silently desyncs) on the server. The\n * `CartProvider` (`./provider`) calls `useCartStore.persist.rehydrate()`\n * inside a `useEffect`, so hydration only ever happens client-side, after\n * mount — the same explicit-hydration contract the SITE README documents.\n */\nexport const CART_STORAGE_KEY = 'shop-cart'\n\nexport interface CartItem {\n  productId: string\n  variantId?: string | null\n  name: string\n  variantName?: string\n  /** Integer cents — every Reblu shop price travels as cents, never a float. */\n  unitPrice: number\n  quantity: number\n  imageUrl?: string\n  /** `null` means untracked/unlimited stock — never clamp against it. */\n  maxStock: number | null\n  /** Basis points, e.g. `2100` = 21%. `null`/`undefined` = unknown or exempt. */\n  taxRateBps?: number | null\n  taxRateName?: string | null\n}\n\nexport interface CartStore {\n  items: CartItem[]\n  addItem: (item: CartItem) => void\n  removeItem: (productId: string, variantId?: string | null) => void\n  updateQuantity: (\n    productId: string,\n    variantId: string | null | undefined,\n    quantity: number,\n  ) => void\n  clearCart: () => void\n  getTotal: () => number\n  getItemCount: () => number\n}\n\nfunction isSameItem(a: CartItem, productId: string, variantId?: string | null): boolean {\n  return a.productId === productId && (a.variantId ?? null) === (variantId ?? null)\n}\n\n/**\n * REB-829 review finding: neither `addItem` nor `updateQuantity` validated\n * `quantity` — `0`, a negative number, `NaN` (e.g. a stray `parseInt('')`\n * upstream), a non-integer, or `maxStock` itself being `0` (out of stock)\n * all used to leave an invalid line sitting in the cart, silently reaching\n * checkout.\n *\n * Normalizes to a safe POSITIVE INTEGER clamped to `maxStock`. Returns `0`\n * to signal \"not a valid positive quantity\" — callers decide what that\n * means for them: `addItem` ignores the call (never creates/corrupts a\n * line), `updateQuantity` removes the line (same as its pre-existing\n * `quantity <= 0` → remove contract, just now reached by more inputs).\n *\n * `Math.trunc` rounds toward zero (not `Math.floor`, which would round a\n * negative input further negative before the `< 1` check below ever saw it\n * — not a behavioural difference here since any negative result is\n * rejected either way, but `trunc` is the operation that actually means\n * \"drop the fractional part\").\n */\nfunction normalizeQuantity(quantity: number, maxStock: number | null): number {\n  if (!Number.isFinite(quantity)) return 0\n  const truncated = Math.trunc(quantity)\n  if (truncated < 1) return 0\n  if (maxStock === null) return truncated\n  const maxTruncated = Math.trunc(maxStock)\n  if (maxTruncated < 1) return 0\n  return Math.min(truncated, maxTruncated)\n}\n\nexport const useCartStore = create<CartStore>()(\n  persist(\n    (set, get) => ({\n      items: [],\n\n      addItem: (item) => {\n        set((state) => {\n          const existing = state.items.find((i) => isSameItem(i, item.productId, item.variantId))\n\n          if (existing) {\n            // REB-829 review follow-up (a): incoming maxStock is the\n            // FRESHEST stock signal available — if it says 0, the product is\n            // confirmed out of stock right now, so the existing line is\n            // removed outright (same contract as updateQuantity's own\n            // \"quantity resolves to <1 → remove\"), not merely left alone.\n            if (item.maxStock !== null && Math.trunc(item.maxStock) < 1) {\n              return {\n                items: state.items.filter((i) => !isSameItem(i, item.productId, item.variantId)),\n              }\n            }\n\n            const newQty = normalizeQuantity(existing.quantity + item.quantity, item.maxStock)\n            if (newQty < 1) {\n              // Invalid delta (NaN/non-positive quantity) — leave the\n              // existing, previously-valid line untouched rather than\n              // destroying good data because of one bad call.\n              return {}\n            }\n\n            // Refresh maxStock with the incoming value on every successful\n            // merge — the stale-maxStock finding: a stored line used to keep\n            // its ORIGINAL maxStock forever, so a later updateQuantity call\n            // clamped against stock data that could be long out of date.\n            return {\n              items: state.items.map((i) =>\n                isSameItem(i, item.productId, item.variantId)\n                  ? { ...i, quantity: newQty, maxStock: item.maxStock }\n                  : i,\n              ),\n            }\n          }\n\n          const qty = normalizeQuantity(item.quantity, item.maxStock)\n          if (qty < 1) {\n            // Invalid quantity, or maxStock 0 (out of stock) — never create\n            // a line nobody could actually buy.\n            return {}\n          }\n\n          return { items: [...state.items, { ...item, quantity: qty }] }\n        })\n      },\n\n      removeItem: (productId, variantId) => {\n        set((state) => ({\n          items: state.items.filter((i) => !isSameItem(i, productId, variantId)),\n        }))\n      },\n\n      updateQuantity: (productId, variantId, quantity) => {\n        const existing = get().items.find((i) => isSameItem(i, productId, variantId))\n        if (!existing) return\n\n        const newQty = normalizeQuantity(quantity, existing.maxStock)\n        if (newQty < 1) {\n          get().removeItem(productId, variantId)\n          return\n        }\n\n        set((state) => ({\n          items: state.items.map((i) =>\n            isSameItem(i, productId, variantId) ? { ...i, quantity: newQty } : i,\n          ),\n        }))\n      },\n\n      clearCart: () => set({ items: [] }),\n\n      getTotal: () => get().items.reduce((sum, item) => sum + item.unitPrice * item.quantity, 0),\n\n      getItemCount: () => get().items.reduce((sum, item) => sum + item.quantity, 0),\n    }),\n    {\n      name: CART_STORAGE_KEY,\n      skipHydration: true,\n    },\n  ),\n)\n","'use client'\n\nimport { useCartStore, type CartItem } from './store'\n\nexport interface UseCartResult {\n  items: CartItem[]\n  /** Sum of every line's `unitPrice * quantity`, in integer cents. */\n  total: number\n  /** Sum of every line's `quantity`. */\n  itemCount: number\n  addItem: (item: CartItem) => void\n  removeItem: (productId: string, variantId?: string | null) => void\n  updateQuantity: (\n    productId: string,\n    variantId: string | null | undefined,\n    quantity: number,\n  ) => void\n  clearCart: () => void\n}\n\n/**\n * `useCart` — the ergonomic entry point for a SITE's cart UI: a single\n * selector call that re-renders only on `items` changes, with `total`/\n * `itemCount` derived inline (cheap — a plain `reduce` over a typically-small\n * array) rather than via `useCartStore`'s own `getTotal`/`getItemCount`\n * selectors, which are stable function references and would NOT trigger a\n * re-render on their own. A SITE that wants raw store access (existing\n * per-field selectors, e.g. `useCartStore((s) => s.addItem)`) can still\n * import `useCartStore` directly — this hook doesn't replace it.\n */\nexport function useCart(): UseCartResult {\n  const items = useCartStore((s) => s.items)\n  const addItem = useCartStore((s) => s.addItem)\n  const removeItem = useCartStore((s) => s.removeItem)\n  const updateQuantity = useCartStore((s) => s.updateQuantity)\n  const clearCart = useCartStore((s) => s.clearCart)\n\n  const total = items.reduce((sum, item) => sum + item.unitPrice * item.quantity, 0)\n  const itemCount = items.reduce((sum, item) => sum + item.quantity, 0)\n\n  return { items, total, itemCount, addItem, removeItem, updateQuantity, clearCart }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACEA,mBAA0B;;;ACF1B,qBAAuB;AACvB,wBAAwB;AAgBjB,IAAM,mBAAmB;AAgChC,SAAS,WAAW,GAAa,WAAmB,WAAoC;AACtF,SAAO,EAAE,cAAc,cAAc,EAAE,aAAa,WAAW,aAAa;AAC9E;AAqBA,SAAS,kBAAkB,UAAkB,UAAiC;AAC5E,MAAI,CAAC,OAAO,SAAS,QAAQ,EAAG,QAAO;AACvC,QAAM,YAAY,KAAK,MAAM,QAAQ;AACrC,MAAI,YAAY,EAAG,QAAO;AAC1B,MAAI,aAAa,KAAM,QAAO;AAC9B,QAAM,eAAe,KAAK,MAAM,QAAQ;AACxC,MAAI,eAAe,EAAG,QAAO;AAC7B,SAAO,KAAK,IAAI,WAAW,YAAY;AACzC;AAEO,IAAM,mBAAe,uBAAkB;AAAA,MAC5C;AAAA,IACE,CAAC,KAAK,SAAS;AAAA,MACb,OAAO,CAAC;AAAA,MAER,SAAS,CAAC,SAAS;AACjB,YAAI,CAAC,UAAU;AACb,gBAAM,WAAW,MAAM,MAAM,KAAK,CAAC,MAAM,WAAW,GAAG,KAAK,WAAW,KAAK,SAAS,CAAC;AAEtF,cAAI,UAAU;AAMZ,gBAAI,KAAK,aAAa,QAAQ,KAAK,MAAM,KAAK,QAAQ,IAAI,GAAG;AAC3D,qBAAO;AAAA,gBACL,OAAO,MAAM,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,GAAG,KAAK,WAAW,KAAK,SAAS,CAAC;AAAA,cACjF;AAAA,YACF;AAEA,kBAAM,SAAS,kBAAkB,SAAS,WAAW,KAAK,UAAU,KAAK,QAAQ;AACjF,gBAAI,SAAS,GAAG;AAId,qBAAO,CAAC;AAAA,YACV;AAMA,mBAAO;AAAA,cACL,OAAO,MAAM,MAAM;AAAA,gBAAI,CAAC,MACtB,WAAW,GAAG,KAAK,WAAW,KAAK,SAAS,IACxC,EAAE,GAAG,GAAG,UAAU,QAAQ,UAAU,KAAK,SAAS,IAClD;AAAA,cACN;AAAA,YACF;AAAA,UACF;AAEA,gBAAM,MAAM,kBAAkB,KAAK,UAAU,KAAK,QAAQ;AAC1D,cAAI,MAAM,GAAG;AAGX,mBAAO,CAAC;AAAA,UACV;AAEA,iBAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,EAAE,GAAG,MAAM,UAAU,IAAI,CAAC,EAAE;AAAA,QAC/D,CAAC;AAAA,MACH;AAAA,MAEA,YAAY,CAAC,WAAW,cAAc;AACpC,YAAI,CAAC,WAAW;AAAA,UACd,OAAO,MAAM,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,GAAG,WAAW,SAAS,CAAC;AAAA,QACvE,EAAE;AAAA,MACJ;AAAA,MAEA,gBAAgB,CAAC,WAAW,WAAW,aAAa;AAClD,cAAM,WAAW,IAAI,EAAE,MAAM,KAAK,CAAC,MAAM,WAAW,GAAG,WAAW,SAAS,CAAC;AAC5E,YAAI,CAAC,SAAU;AAEf,cAAM,SAAS,kBAAkB,UAAU,SAAS,QAAQ;AAC5D,YAAI,SAAS,GAAG;AACd,cAAI,EAAE,WAAW,WAAW,SAAS;AACrC;AAAA,QACF;AAEA,YAAI,CAAC,WAAW;AAAA,UACd,OAAO,MAAM,MAAM;AAAA,YAAI,CAAC,MACtB,WAAW,GAAG,WAAW,SAAS,IAAI,EAAE,GAAG,GAAG,UAAU,OAAO,IAAI;AAAA,UACrE;AAAA,QACF,EAAE;AAAA,MACJ;AAAA,MAEA,WAAW,MAAM,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;AAAA,MAElC,UAAU,MAAM,IAAI,EAAE,MAAM,OAAO,CAAC,KAAK,SAAS,MAAM,KAAK,YAAY,KAAK,UAAU,CAAC;AAAA,MAEzF,cAAc,MAAM,IAAI,EAAE,MAAM,OAAO,CAAC,KAAK,SAAS,MAAM,KAAK,UAAU,CAAC;AAAA,IAC9E;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN,eAAe;AAAA,IACjB;AAAA,EACF;AACF;;;ADxJS;AALF,SAAS,aAAa,EAAE,SAAS,GAAkC;AACxE,8BAAU,MAAM;AACd,iBAAa,QAAQ,UAAU;AAAA,EACjC,GAAG,CAAC,CAAC;AAEL,SAAO,2EAAG,UAAS;AACrB;;;AEYO,SAAS,UAAyB;AACvC,QAAM,QAAQ,aAAa,CAAC,MAAM,EAAE,KAAK;AACzC,QAAM,UAAU,aAAa,CAAC,MAAM,EAAE,OAAO;AAC7C,QAAM,aAAa,aAAa,CAAC,MAAM,EAAE,UAAU;AACnD,QAAM,iBAAiB,aAAa,CAAC,MAAM,EAAE,cAAc;AAC3D,QAAM,YAAY,aAAa,CAAC,MAAM,EAAE,SAAS;AAEjD,QAAM,QAAQ,MAAM,OAAO,CAAC,KAAK,SAAS,MAAM,KAAK,YAAY,KAAK,UAAU,CAAC;AACjF,QAAM,YAAY,MAAM,OAAO,CAAC,KAAK,SAAS,MAAM,KAAK,UAAU,CAAC;AAEpE,SAAO,EAAE,OAAO,OAAO,WAAW,SAAS,YAAY,gBAAgB,UAAU;AACnF;","names":[]}

package/dist/cart.d.cts

@@ -0,0 +1,92 @@
+import * as react_jsx_runtime from 'react/jsx-runtime';
+import * as zustand_middleware from 'zustand/middleware';
+import * as zustand from 'zustand';
+
+/**
+ * `CartProvider` — mount this once near the root layout (inside a Client
+ * Component boundary). It owns the ONE explicit-hydration call
+ * `useCartStore.persist.rehydrate()` requires (`store.ts`'s `skipHydration`
+ * doc) — a SITE that forgets to mount it gets an always-empty cart that never
+ * reads back whatever a previous visit (or page reload) persisted.
+ */
+declare function CartProvider({ children }: {
+    children: React.ReactNode;
+}): react_jsx_runtime.JSX.Element;
+
+/**
+ * `useCartStore` — the SDK's cart state (REB-829). Ported verbatim (same
+ * shape, same quantity-clamping rules) from demo-site's local
+ * `lib/store/cart-store.ts`, which every SITE was otherwise expected to
+ * hand-copy. `CART_STORAGE_KEY` stays exactly `'shop-cart'` on purpose: a
+ * SITE migrating from the local copy keeps its visitors' existing carts.
+ *
+ * `skipHydration: true` (zustand persist) is load-bearing for SSR: without
+ * it, zustand's persist middleware reads `localStorage` synchronously during
+ * module evaluation, which throws (or silently desyncs) on the server. The
+ * `CartProvider` (`./provider`) calls `useCartStore.persist.rehydrate()`
+ * inside a `useEffect`, so hydration only ever happens client-side, after
+ * mount — the same explicit-hydration contract the SITE README documents.
+ */
+declare const CART_STORAGE_KEY = "shop-cart";
+interface CartItem {
+    productId: string;
+    variantId?: string | null;
+    name: string;
+    variantName?: string;
+    /** Integer cents — every Reblu shop price travels as cents, never a float. */
+    unitPrice: number;
+    quantity: number;
+    imageUrl?: string;
+    /** `null` means untracked/unlimited stock — never clamp against it. */
+    maxStock: number | null;
+    /** Basis points, e.g. `2100` = 21%. `null`/`undefined` = unknown or exempt. */
+    taxRateBps?: number | null;
+    taxRateName?: string | null;
+}
+interface CartStore {
+    items: CartItem[];
+    addItem: (item: CartItem) => void;
+    removeItem: (productId: string, variantId?: string | null) => void;
+    updateQuantity: (productId: string, variantId: string | null | undefined, quantity: number) => void;
+    clearCart: () => void;
+    getTotal: () => number;
+    getItemCount: () => number;
+}
+declare const useCartStore: zustand.UseBoundStore<Omit<zustand.StoreApi<CartStore>, "setState" | "persist"> & {
+    setState(partial: CartStore | Partial<CartStore> | ((state: CartStore) => CartStore | Partial<CartStore>), replace?: false | undefined): unknown;
+    setState(state: CartStore | ((state: CartStore) => CartStore), replace: true): unknown;
+    persist: {
+        setOptions: (options: Partial<zustand_middleware.PersistOptions<CartStore, CartStore, unknown>>) => void;
+        clearStorage: () => void;
+        rehydrate: () => Promise<void> | void;
+        hasHydrated: () => boolean;
+        onHydrate: (fn: (state: CartStore) => void) => () => void;
+        onFinishHydration: (fn: (state: CartStore) => void) => () => void;
+        getOptions: () => Partial<zustand_middleware.PersistOptions<CartStore, CartStore, unknown>>;
+    };
+}>;
+
+interface UseCartResult {
+    items: CartItem[];
+    /** Sum of every line's `unitPrice * quantity`, in integer cents. */
+    total: number;
+    /** Sum of every line's `quantity`. */
+    itemCount: number;
+    addItem: (item: CartItem) => void;
+    removeItem: (productId: string, variantId?: string | null) => void;
+    updateQuantity: (productId: string, variantId: string | null | undefined, quantity: number) => void;
+    clearCart: () => void;
+}
+/**
+ * `useCart` — the ergonomic entry point for a SITE's cart UI: a single
+ * selector call that re-renders only on `items` changes, with `total`/
+ * `itemCount` derived inline (cheap — a plain `reduce` over a typically-small
+ * array) rather than via `useCartStore`'s own `getTotal`/`getItemCount`
+ * selectors, which are stable function references and would NOT trigger a
+ * re-render on their own. A SITE that wants raw store access (existing
+ * per-field selectors, e.g. `useCartStore((s) => s.addItem)`) can still
+ * import `useCartStore` directly — this hook doesn't replace it.
+ */
+declare function useCart(): UseCartResult;
+
+export { CART_STORAGE_KEY, type CartItem, CartProvider, type CartStore, type UseCartResult, useCart, useCartStore };