@salla.sa/twilight-components 2.14.507 → 2.14.509

package/dist/esm/catalog-recommendations-CL7OPpYS.js

@@ -0,0 +1,94 @@
+/*!
+ * Crafted with ❤ by Salla
+ */
+const RECOMMENDATIONS_BASE_PATH = '/recommendations/v1';
+const CART_BOUGHT_TOGETHER_MAX_PRODUCT_IDS = 5;
+const CATALOG_RECOMMENDATIONS_API = 'https://api.salla.dev';
+function getRecommendationsBaseUrl() {
+    // Recommendations live on the global catalog host (https://api.salla.dev), not
+    // under store.api — which is typically https://api.salla.dev/store/v1 and would
+    // produce a wrong path like /store/v1/recommendations/v1/...
+    return CATALOG_RECOMMENDATIONS_API;
+}
+function getRecommendationsUrl(path) {
+    return `${getRecommendationsBaseUrl()}${RECOMMENDATIONS_BASE_PATH}${path}`;
+}
+/**
+ * Minimal, CORS-allow-listed header set for the recommendations host.
+ *
+ * We deliberately do NOT go through `salla.api` here: axios injects default
+ * common headers (Authorization, UTM params, s-affiliate-code, allocation, …)
+ * that are not in the recommendations CORS allow-list and fail the preflight.
+ * Sending an explicit set via `fetch` avoids that whole class of failures.
+ * Store resolution uses the browser-set `Origin` header plus `s-store-id`.
+ *
+ * @internal exported for unit tests
+ */
+function getRecommendationsHeaders() {
+    const headers = {
+        's-store-id': String(salla.config.get('store.id')),
+        's-source': 'store',
+        lang: salla.lang.getLocale(),
+    };
+    // Only `s-scope-id` is on the recommendations CORS allow-list — `s-scope-type`
+    // is NOT, and requesting it makes the browser reject the preflight.
+    const scopeId = salla.api.getHeader?.('s-scope-id');
+    if (scopeId) {
+        headers['s-scope-id'] = String(scopeId);
+    }
+    return headers;
+}
+function extractRecommendationIds(response) {
+    return (response?.data ?? [])
+        .map(item => item?.id)
+        .filter((id) => Boolean(id));
+}
+/** Salla product ids are always numeric; reject anything else before it reaches the URL. */
+function toNumericId(value) {
+    const id = String(value);
+    return /^\d+$/.test(id) ? id : null;
+}
+function fetchRecommendations(path, params) {
+    const url = new URL(getRecommendationsUrl(path));
+    Object.entries(params).forEach(([key, value]) => url.searchParams.set(key, value));
+    // Native fetch (not salla.api) so only the explicit allow-listed headers are
+    // sent — no axios default headers to trip the recommendations CORS preflight.
+    // Best-effort feature: callers hide their section via .catch(), so no notifier.
+    // The host is the hardcoded constant CATALOG_RECOMMENDATIONS_API and only
+    // validated numeric ids reach the query string, so there is no SSRF surface.
+    // nosemgrep
+    return fetch(url.toString(), {
+        method: 'GET',
+        headers: getRecommendationsHeaders(),
+    })
+        .then((response) => {
+        if (!response.ok) {
+            throw new Error(`Recommendations request failed: ${response.status}`);
+        }
+        return response.json();
+    })
+        .then((payload) => extractRecommendationIds(payload));
+}
+function fetchCartBoughtTogether(productIds) {
+    const ids = productIds
+        .map(toNumericId)
+        .filter((id) => id !== null)
+        .slice(0, CART_BOUGHT_TOGETHER_MAX_PRODUCT_IDS);
+    if (!ids.length) {
+        return Promise.resolve([]);
+    }
+    return fetchRecommendations('/carts/bought-together', {
+        product_ids: ids.join(','),
+    });
+}
+function fetchProductCustomersAlsoBought(productId) {
+    const id = toNumericId(productId);
+    if (!id) {
+        return Promise.resolve([]);
+    }
+    return fetchRecommendations('/products/customers-also-bought', {
+        product_id: id,
+    });
+}
+
+export { fetchProductCustomersAlsoBought as a, fetchCartBoughtTogether as f };

package/dist/esm/{filepond-BfxOWgeR.js → filepond-Cu0hGP46.js}

@@ -1,7 +1,7 @@
 /*!
  * Crafted with ❤ by Salla
  */
-import { d as getDefaultExportFromCjs } from './index-DpTbeb50.js';
+import { d as getDefaultExportFromCjs } from './index-BEjZOd--.js';
 
 function _mergeNamespaces(n, m) {
     m.forEach(function (e) {

package/dist/esm/{filepond-plugin-file-poster-Dt5Vnuk4.js → filepond-plugin-file-poster-DBfLrjkx.js}

@@ -1,7 +1,7 @@
 /*!
  * Crafted with ❤ by Salla
  */
-import { d as getDefaultExportFromCjs } from './index-DpTbeb50.js';
+import { d as getDefaultExportFromCjs } from './index-BEjZOd--.js';
 
 function _mergeNamespaces(n, m) {
   m.forEach(function (e) {

package/dist/esm/{filepond-plugin-file-validate-size-D5WrsM0T.js → filepond-plugin-file-validate-size-Cq0e60aE.js}

@@ -1,7 +1,7 @@
 /*!
  * Crafted with ❤ by Salla
  */
-import { d as getDefaultExportFromCjs } from './index-DpTbeb50.js';
+import { d as getDefaultExportFromCjs } from './index-BEjZOd--.js';
 
 function _mergeNamespaces(n, m) {
     m.forEach(function (e) {

package/dist/esm/{filepond-plugin-file-validate-type-CjaeW32q.js → filepond-plugin-file-validate-type-CpRmNAFC.js}

@@ -1,7 +1,7 @@
 /*!
  * Crafted with ❤ by Salla
  */
-import { d as getDefaultExportFromCjs } from './index-DpTbeb50.js';
+import { d as getDefaultExportFromCjs } from './index-BEjZOd--.js';
 
 function _mergeNamespaces(n, m) {
     m.forEach(function (e) {

package/dist/esm/{filepond-plugin-image-edit-BTzFile_.js → filepond-plugin-image-edit-C-7yhkPK.js}

@@ -1,7 +1,7 @@
 /*!
  * Crafted with ❤ by Salla
  */
-import { d as getDefaultExportFromCjs } from './index-DpTbeb50.js';
+import { d as getDefaultExportFromCjs } from './index-BEjZOd--.js';
 
 function _mergeNamespaces(n, m) {
   m.forEach(function (e) {

package/dist/esm/{filepond-plugin-image-exif-orientation-DSNjqS_v.js → filepond-plugin-image-exif-orientation-CTn5LeXC.js}

@@ -1,7 +1,7 @@
 /*!
  * Crafted with ❤ by Salla
  */
-import { d as getDefaultExportFromCjs } from './index-DpTbeb50.js';
+import { d as getDefaultExportFromCjs } from './index-BEjZOd--.js';
 
 function _mergeNamespaces(n, m) {
   m.forEach(function (e) {

package/dist/esm/{filepond-plugin-image-preview-CCGiOVLr.js → filepond-plugin-image-preview-BsETbqVf.js}

@@ -1,7 +1,7 @@
 /*!
  * Crafted with ❤ by Salla
  */
-import { d as getDefaultExportFromCjs } from './index-DpTbeb50.js';
+import { d as getDefaultExportFromCjs } from './index-BEjZOd--.js';
 
 function _mergeNamespaces(n, m) {
   m.forEach(function (e) {

package/dist/esm/{functions-D05iBLQe.js → functions-DtC2lEvS.js}

@@ -1,7 +1,7 @@
 /*!
  * Crafted with ❤ by Salla
  */
-import { h } from './index-DpTbeb50.js';
+import { h } from './index-BEjZOd--.js';
 
 function nearestLowerMultiple(number, multipleOf = window.matchMedia('(min-width: 768px)').matches ? 3 : 2) {
     return number < multipleOf ? number : number - (number % multipleOf);