@salla.sa/twilight-theme-engine 1.0.34 → 1.0.36

package/dist/utils/cookies.d.ts

@@ -22,16 +22,36 @@ export declare const STORE_ID_COOKIE_NAME = "salla_sid";
 /** Query parameter naming the store, on a host that serves more than one. */
 export declare const STORE_ID_PARAM = "storeId";
 /**
- * A store id is an integer, and anything else is not a store id.
+ * Which version of the theme's settings to render.
  *
- * Validated rather than passed through because this value ends up in an upstream
- * API path. Leading zeroes, signs, decimals and whitespace are all rejected: the
- * point is a single canonical form, not the widest set of things that could be
- * coerced into a number.
+ * A merchant's theme settings are versioned, and the storefront normally shows
+ * whichever version is live — the API answers with it, and names it back as
+ * `theme.profile.id`. Two places need a different one: the merchant's own theme
+ * editor, which previews a draft version before it is published, and a partner
+ * running a theme locally against a store whose settings they are editing. Both
+ * open the theme inside an iframe, and the version travels in that URL.
+ *
+ * Named `versionId` rather than the `version_id` the Dashboard uses internally,
+ * because it sits beside `?storeId=` and one URL should not spell two ids two
+ * ways. The value is the same one either way: the Optimus-encoded version id,
+ * which is exactly what `s-version-id` has always carried.
+ *
+ * The literal is a contract with `VERSION_COOKIE` in store-front-dispacher
+ * (`src/dispatch/preview.ts`), on the same terms as {@link STORE_ID_COOKIE_NAME}:
+ * nothing checks the two agree, and drift shows a merchant the wrong version of
+ * their own settings rather than failing.
  */
+export declare const VERSION_ID_COOKIE_NAME = "salla_vid";
+/** Query parameter naming the theme-settings version, where one may be named. */
+export declare const VERSION_ID_PARAM = "versionId";
+/** A store id in its canonical form, or null when it is not one. */
 export declare function parseStoreId(raw: string | null | undefined): string | null;
+/** A theme-settings version id in its canonical form, or null when it is not one. */
+export declare function parseVersionId(raw: string | null | undefined): string | null;
 /** The store id the dispatcher left in the cookie, or null when absent or malformed. */
 export declare function extractStoreIdFromCookies(cookieHeader: string | null): string | null;
+/** The version id the dispatcher left in the cookie, or null when absent or malformed. */
+export declare function extractVersionIdFromCookies(cookieHeader: string | null): string | null;
 /**
  * The only hosts on which a request may name its own store.
  *
@@ -59,6 +79,14 @@ export declare const STORE_ID_HOSTS: readonly string[];
  * a rule like "anything ending in salla.design" is one wildcard DNS record away
  * from admitting a host nobody meant to admit, and the list of hosts that serve
  * more than one store is short and known.
+ *
+ * It gates {@link resolveRequestVersionId} as well, and the name has been left
+ * alone rather than generalised because one predicate that both call is the
+ * property worth keeping — a second, subtly different list is how a host ends up
+ * permitted to name one thing and not the other. A version is worth gating for
+ * the same reason a store is: on a merchant's own domain, honouring
+ * `?versionId=` would publish whatever draft settings they are still working on
+ * to anyone who guessed the URL.
  */
 export declare function allowsRequestStoreId(host: string | null | undefined): boolean;
 /**
@@ -75,7 +103,7 @@ export declare function hostIdentifiesStore(host: string | null | undefined): bo
 /**
  * The store this request names, on a host permitted to name one.
  *
- * The host check is inside this function rather than at its call site, because a
+ * The host check is inside the resolution rather than at a call site, because a
  * call site is a thing someone can add without reading this comment. There is no
  * way to ask "what store did the request name?" without also asking "is this a
  * host that may say?" — get it wrong and the answer is a security bug that looks
@@ -87,6 +115,18 @@ export declare function hostIdentifiesStore(host: string | null | undefined): bo
  * just typed.
  */
 export declare function resolveRequestStoreId(url: string, cookieHeader: string | null, host: string | null | undefined): string | null;
+/**
+ * The theme-settings version this request names, on a host permitted to name one.
+ *
+ * Same shape and the same host gate as {@link resolveRequestStoreId}, deliberately:
+ * both answer "what did this request ask to be shown?", both are reached only on
+ * a host that serves more than one thing, and a version that could be named where
+ * a store could not would be a second rule to keep in step with the first.
+ *
+ * Null is the ordinary answer, and it is not a failure — it means nothing
+ * addressed a version, so the store's own live one is what gets rendered.
+ */
+export declare function resolveRequestVersionId(url: string, cookieHeader: string | null, host: string | null | undefined): string | null;
 /**
  * Deletes the auth `token` cookie. This cookie is written client-side by the theme
  * (TwilightProvider), not by the SDK — `salla.cookie.clearAll()` only clears its own

package/dist/utils/cookies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/utils/cookies.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB,UAAU,CAAC;AAC9C,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAEhD,6EAA6E;AAC7E,eAAO,MAAM,cAAc,YAAY,CAAC;AAExC;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAG1E;AAED,wFAAwF;AACxF,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAEpF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAA6B,CAAC;AAoB1E;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAI7E;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE5E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,MAAM,GAAG,IAAI,CAUf;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAG3C;AAED,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,UAAU,EAAE,MAAM,GACjB,MAAM,GAAG,IAAI,CA2Bf;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAeD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,WAAW,GAAG,IAAI,CAQvF;AAED,yDAAyD;AACzD,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAEpF;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,IAAI,WAAW,GAAG,IAAI,GAAG,SAAS,CAI7D;AAED,oFAAoF;AACpF,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,GAAG,SAAS,CAG1D;AAQD;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAYnE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAGzC"}
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/utils/cookies.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB,UAAU,CAAC;AAC9C,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAEhD,6EAA6E;AAC7E,eAAO,MAAM,cAAc,YAAY,CAAC;AAExC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,sBAAsB,cAAc,CAAC;AAElD,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAmB5C,oEAAoE;AACpE,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAE1E;AAED,qFAAqF;AACrF,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAE5E;AAED,wFAAwF;AACxF,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAEpF;AAED,0FAA0F;AAC1F,wBAAgB,2BAA2B,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAEtF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAA6B,CAAC;AAoB1E;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAI7E;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE5E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,MAAM,GAAG,IAAI,CAEf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,MAAM,GAAG,IAAI,CAEf;AA2BD;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAG3C;AAED,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,UAAU,EAAE,MAAM,GACjB,MAAM,GAAG,IAAI,CA2Bf;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAeD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,WAAW,GAAG,IAAI,CAQvF;AAED,yDAAyD;AACzD,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAEpF;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,IAAI,WAAW,GAAG,IAAI,GAAG,SAAS,CAI7D;AAED,oFAAoF;AACpF,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,GAAG,SAAS,CAG1D;AAQD;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,GAAG,OAAO,CAYnE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAGzC"}

package/dist/utils/index.js

@@ -1,13 +1,13 @@
 export { formatSallaPlural } from '../chunk-BT6HEEAP.js';
 export { stripUnsafeHtml } from '../chunk-RUHSV4Z6.js';
-export { dispatchRouteChanged } from '../chunk-EV4JSMFZ.js';
+export { dispatchRouteChanged } from '../chunk-X26WB7AG.js';
 export { mergeHead, resolveHead, setHeadAdapter } from '../chunk-B3EFOE57.js';
 export { sortOptions } from '../chunk-6Z4MOC4S.js';
 export { buildBaseHead, buildHreflangAlternates, localeToOgLocale } from '../chunk-TZ3E5BN4.js';
 export { color } from '../chunk-VVZNW5CB.js';
-export { applyAppScopeMocks, registerThemeHookSlots } from '../chunk-LG556DIE.js';
-export { AUTH_TOKEN_COOKIE_NAME, clearAuthTokenCookie, extractTokenFromCookies, getSallaSDK, getStoreIdentifier } from '../chunk-Y5FBDMFV.js';
-import '../chunk-5ACY5CD3.js';
+export { applyAppScopeMocks, registerThemeHookSlots } from '../chunk-6KI2QCPL.js';
+export { AUTH_TOKEN_COOKIE_NAME, clearAuthTokenCookie, extractTokenFromCookies, getSallaSDK, getStoreIdentifier } from '../chunk-JBXTU5NM.js';
+import '../chunk-6XWMNQ52.js';
 export { asset, cdn, isPlaceholder } from '../chunk-ZCH7W7DZ.js';
 export { mergeDocumentDescriptors, mergeElementAttrs, normalizeClasses, syncAttrsToElement, toReactProps } from '../chunk-CW625T2E.js';
 import '../chunk-T72DAX7R.js';

package/dist/utils/runtime-env.d.ts

@@ -4,6 +4,19 @@ export interface RuntimeEnv {
     apiBase?: string;
     /** Store identifier — `VITE_STORE_DOMAIN`. */
     storeIdentifier?: string;
+    /**
+     * The theme-settings version the request named, if any.
+     *
+     * Published for the same reason `storeIdentifier` is: the dispatcher strips
+     * `?versionId=` on the way in, so by the time the browser has the page its own
+     * URL no longer says which version it is showing. Without this the hydrated
+     * client would ask the API about the store's live version and quietly replace
+     * the draft it was handed.
+     *
+     * Absent — not empty — when nothing named one, so it drops out of the inline
+     * script entirely rather than publishing a value that means "live".
+     */
+    versionId?: string;
 }
 /**
  * A build-time `import.meta.env` var, falling back to the worker's runtime `process.env`

package/dist/utils/runtime-env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-env.d.ts","sourceRoot":"","sources":["../../src/utils/runtime-env.ts"],"names":[],"mappings":"AAOA,qFAAqF;AACrF,MAAM,WAAW,UAAU;IACzB,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUvD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,UAAU,CAgB9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,IAAI,UAAU,CAGlD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,UAAgC,GAAG,MAAM,GAAG,IAAI,CAK3F"}
+{"version":3,"file":"runtime-env.d.ts","sourceRoot":"","sources":["../../src/utils/runtime-env.ts"],"names":[],"mappings":"AAOA,qFAAqF;AACrF,MAAM,WAAW,UAAU;IACzB,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUvD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,UAAU,CAqB9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,IAAI,UAAU,CAGlD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,UAAgC,GAAG,MAAM,GAAG,IAAI,CAK3F"}

package/dist/utils/theme-version.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The version this request asked for, or null when it asked for none.
+ *
+ * Deliberately excludes the version the *settings* name. This is the answer to
+ * "what did the caller address?", and it has to be available before any settings
+ * exist — React Query keys are built from it, and a key that means one thing
+ * during SSR and another after hydration is how a page refetches everything it
+ * was just handed.
+ *
+ * 1. what the request named, seeded by `twilightMiddleware` on a host permitted
+ *    to name one;
+ * 2. what SSR resolved and published into the head, which is all the browser has
+ *    once the dispatcher has stripped `?versionId=` from the URL.
+ */
+export declare function requestedThemeVersionId(): string | null;
+/**
+ * The version every Salla API call is answered with — what goes in `s-version-id`.
+ *
+ * The requested version outranks the settings, because a request that named one
+ * is the only reason this is ever anything but the live version: falling back to
+ * the settings there would let the first answer overwrite the question.
+ *
+ * The settings' own `theme.profile.id` stays as the fallback, unchanged. It is
+ * what this header has always carried, and on an ordinary storefront it still
+ * is — it keeps the rest of a page's calls pinned to the version the settings
+ * call resolved, rather than letting a version go live mid-render.
+ *
+ * Reading the settings is guarded because `getTwilightContext().settings` throws
+ * a `SettingsError` when they have not loaded — which is the normal state on the
+ * very first call, the settings call itself.
+ */
+export declare function resolveThemeVersionId(): string | null;
+//# sourceMappingURL=theme-version.d.ts.map

package/dist/utils/theme-version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"theme-version.d.ts","sourceRoot":"","sources":["../../src/utils/theme-version.ts"],"names":[],"mappings":"AAsBA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,GAAG,IAAI,CAKvD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,IAAI,CAUrD"}

package/dist/vite/index.js

@@ -1,8 +1,8 @@
-import { tanstackHeadAdapter } from '../chunk-FQGCCV4T.js';
+import { tanstackHeadAdapter } from '../chunk-5TRRUV7N.js';
 import { nextjsHeadAdapter } from '../chunk-HOSHJBPS.js';
 import { setHeadAdapter } from '../chunk-B3EFOE57.js';
 import { RouteId } from '../chunk-MTONGOJD.js';
-import '../chunk-5ACY5CD3.js';
+import '../chunk-6XWMNQ52.js';
 import '../chunk-T72DAX7R.js';
 import '../chunk-DGUM43GV.js';
 import { readFile, readdir } from 'fs/promises';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salla.sa/twilight-theme-engine",
-  "version": "1.0.34",
+  "version": "1.0.36",
   "publishConfig": {
     "access": "public"
   },

package/dist/RenderWhenVisible-2BRWQDOQ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/components/common/RenderWhenVisible.tsx"],"names":["RenderWhenVisible"],"mappings":";;;;AAEA,SAAS,eAAA,CAAgB,EAAE,MAAA,EAAO,EAAuB;AACvD,EAAA,uBAAO,GAAA,CAAC,SAAI,KAAA,EAAO,EAAE,WAAW,MAAA,EAAO,EAAG,WAAU,mCAAA,EAAoC,CAAA;AAC1F;AAGA,SAAS,WAAA,CAAY,EAAE,OAAA,EAAQ,EAA4C;AACzE,EAAA,SAAA,CAAU,MAAM,OAAA,CAAQ,IAAI,CAAA,EAAG,CAAC,OAAO,CAAC,CAAA;AACxC,EAAA,OAAO,IAAA;AACT;AA0BO,IAAM,iBAAA,GAAoB,IAAA,CAAK,SAASA,kBAAAA,CAAkB;AAAA,EAC/D,QAAA;AAAA,EACA,UAAA,GAAa,MAAA;AAAA,EACb,WAAA;AAAA,EACA,SAAA;AAAA,EACA,EAAA;AAAA,EACA,eAAA,GAAkB,OAAA;AAAA,EAClB,aAAA,GAAgB;AAClB,CAAA,EAA2B;AACzB,EAAA,MAAM,GAAA,GAAM,OAAoB,IAAI,CAAA;AACpC,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAI,SAAS,aAAa,CAAA;AACpD,EAAA,MAAM,CAAC,OAAA,EAAS,UAAU,CAAA,GAAI,SAAS,KAAK,CAAA;AAE5C,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,iBAAiB,OAAA,EAAS;AAC9B,IAAA,MAAM,KAAK,GAAA,CAAI,OAAA;AACf,IAAA,IAAI,CAAC,EAAA,EAAI;AAET,IAAA,MAAM,WAAW,IAAI,oBAAA;AAAA,MACnB,CAAC,CAAC,KAAK,CAAA,KAAM;AACX,QAAA,IAAI,MAAM,cAAA,EAAgB;AACxB,UAAA,UAAA,CAAW,IAAI,CAAA;AACf,UAAA,QAAA,CAAS,UAAA,EAAW;AAAA,QACtB;AAAA,MACF,CAAA;AAAA,MACA,EAAE,UAAA;AAAW,KACf;AAEA,IAAA,QAAA,CAAS,QAAQ,EAAE,CAAA;AAEnB,IAAA,OAAO,MAAM,SAAS,UAAA,EAAW;AAAA,EACnC,CAAA,EAAG,CAAC,aAAA,EAAe,OAAA,EAAS,UAAU,CAAC,CAAA;AAEvC,EAAA,MAAM,QAAA,GAAW,WAAA,oBAAe,GAAA,CAAC,eAAA,EAAA,EAAgB,QAAQ,eAAA,EAAiB,CAAA;AAE1E,EAAA,uBACE,GAAA;AAAA,IAAC,SAAA;AAAA,IAAA;AAAA,MACC,GAAA,EAAK,CAAC,OAAA,GAAU,GAAA,GAAM,MAAA;AAAA,MACtB,SAAA;AAAA,MACA,EAAA;AAAA,MACA,KAAA,EAAO,EAAE,SAAA,EAAW,OAAA,GAAU,SAAY,eAAA,EAAgB;AAAA,MAEzD,QAAA,EAAA,OAAA,mBACC,IAAA,CAAC,QAAA,EAAA,EAAS,QAAA,EACP,QAAA,EAAA;AAAA,QAAA,QAAA;AAAA,wBACD,GAAA,CAAC,WAAA,EAAA,EAAY,OAAA,EAAS,UAAA,EAAY;AAAA,OAAA,EACpC,CAAA,GAEA;AAAA;AAAA,GAEJ;AAEJ,CAAC","file":"RenderWhenVisible-2BRWQDOQ.js","sourcesContent":["import { memo, useState, useEffect, useRef, Suspense, type ReactNode } from 'react';\n\nfunction DefaultSkeleton({ height }: { height: string }) {\n  return <div style={{ minHeight: height }} className=\"animate-pulse rounded bg-gray-100\" />;\n}\n\n/** Sibling of the children inside Suspense: its effect only runs once the boundary resolves. */\nfunction MarkMounted({ onMount }: { onMount: (mounted: boolean) => void }) {\n  useEffect(() => onMount(true), [onMount]);\n  return null;\n}\n\nexport interface RenderWhenVisibleProps {\n  children: ReactNode;\n  rootMargin?: string;\n  placeholder?: ReactNode;\n  className?: string;\n  id?: string;\n  estimatedHeight?: string;\n  renderOnMount?: boolean;\n}\n\n/**\n * RenderWhenVisible — defers mounting children until the container enters the viewport.\n *\n * Children are NOT in the React tree at all until the Intersection Observer fires,\n * so no effects, API calls, or renders happen for off-screen sections.\n * Once rendered, children stay mounted permanently (no re-unmount on scroll away).\n *\n * The `estimatedHeight` prop prevents the zero-height collapse problem: without it\n * every unrendered section stacks at the top with 0px height, causing all observers\n * to fire at once on mount. It applies as a min-height until the children have\n * actually committed — through the Suspense window too, since a custom placeholder\n * may be shorter than the estimate. After that the section's height is owned by its\n * content, so shorter blocks don't leave reserved dead space below them.\n */\nexport const RenderWhenVisible = memo(function RenderWhenVisible({\n  children,\n  rootMargin = '50px',\n  placeholder,\n  className,\n  id,\n  estimatedHeight = '400px',\n  renderOnMount = false,\n}: RenderWhenVisibleProps) {\n  const ref = useRef<HTMLElement>(null);\n  const [visible, setVisible] = useState(renderOnMount);\n  const [mounted, setMounted] = useState(false);\n\n  useEffect(() => {\n    if (renderOnMount || visible) return;\n    const el = ref.current;\n    if (!el) return;\n\n    const observer = new IntersectionObserver(\n      ([entry]) => {\n        if (entry.isIntersecting) {\n          setVisible(true);\n          observer.disconnect();\n        }\n      },\n      { rootMargin }\n    );\n\n    observer.observe(el);\n\n    return () => observer.disconnect();\n  }, [renderOnMount, visible, rootMargin]);\n\n  const fallback = placeholder ?? <DefaultSkeleton height={estimatedHeight} />;\n\n  return (\n    <section\n      ref={!visible ? ref : undefined}\n      className={className}\n      id={id}\n      style={{ minHeight: mounted ? undefined : estimatedHeight }}\n    >\n      {visible ? (\n        <Suspense fallback={fallback}>\n          {children}\n          <MarkMounted onMount={setMounted} />\n        </Suspense>\n      ) : (\n        fallback\n      )}\n    </section>\n  );\n});\n"]}

package/dist/chunk-3ABM2IWU.js

@@ -1,14 +0,0 @@
-import { lazy } from 'react';
-
-// src/components/cart/lazy.ts
-var LazyCartItem = lazy(() => import('./CartItem-ZNM7LS6N.js').then((m) => ({ default: m.CartItem })));
-var LazyCartSummary = lazy(
-  () => import('./CartSummary-GA7VKMOQ.js').then((m) => ({ default: m.CartSummary }))
-);
-var LazySeoCartWidget = lazy(
-  () => import('./SeoCartWidget-M43SKEQJ.js').then((m) => ({ default: m.SeoCartWidget }))
-);
-
-export { LazyCartItem, LazyCartSummary, LazySeoCartWidget };
-//# sourceMappingURL=chunk-3ABM2IWU.js.map
-//# sourceMappingURL=chunk-3ABM2IWU.js.map

package/dist/chunk-5ACY5CD3.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/utils/errors.ts","../src/providers/i18n-factory.ts","../src/twilight/context.ts"],"names":[],"mappings":";;;;;;AAAO,IAAM,aAAA,GAAN,cAA4B,KAAA,CAAM;AAAA,EACvC,YAAY,OAAA,EAAkB;AAC5B,IAAA,KAAA,CAAM,WAAW,qCAAqC,CAAA;AACtD,IAAA,IAAA,CAAK,IAAA,GAAO,eAAA;AAAA,EACd;AACF;ACOO,SAAS,kBAAA,CACd,MAAA,EACA,YAAA,EACA,iBAAA,EACc;AACd,EAAA,MAAM,WAAW,cAAA,EAAe;AAChC,EAAA,MAAM,QAAA,GAAW,GAAG,MAAM,CAAA,MAAA,CAAA;AAE1B,EAAA,QAAA,CAAS,GAAA,CAAI,gBAAgB,CAAA,CAAE,IAAA,CAAK;AAAA,IAClC,GAAA,EAAK,MAAA;AAAA,IACL,WAAA,EAAa,MAAA;AAAA,IACb,EAAA,EAAI,CAAC,KAAA,EAAO,OAAO,CAAA;AAAA,IACnB,SAAA,EAAW,KAAA;AAAA,IACX,UAAA,EAAY,OAAA;AAAA,IACZ,SAAA,EAAW;AAAA,MACT,CAAC,MAAM,GAAG;AAAA,QACR,GAAA,EAAK,YAAA,GAAe,QAAQ,CAAA,IAAK,EAAC;AAAA,QAClC,KAAA,EAAO,iBAAA,GAAoB,QAAQ,CAAA,IAAK;AAAC;AAC3C,KACF;AAAA,IACA,aAAA,EAAe,EAAE,WAAA,EAAa,KAAA,EAAM;AAAA,IACpC,KAAA,EAAO,EAAE,WAAA,EAAa,KAAA,EAAM;AAAA,IAC5B,YAAA,EAAc,GAAA;AAAA,IACd,WAAA,EAAa;AAAA,GACd,CAAA;AAED,EAAA,OAAO,QAAA;AACT;;;ACwCA,IAAM,gBAAA,GAAqC;AAAA,EACzC,IAAA,EAAM,EAAA;AAAA,EACN,QAAA,EAAU,EAAA;AAAA,EACV,QAAQ,EAAC;AAAA,EACT,SAAA,EAAW,EAAA;AAAA,EACX,OAAO,EAAC;AAAA,EACR,IAAA,EAAM;AACR,CAAA;AAmBA,IAAM,YAAA,GAA4B;AAAA,EAChC,WAAA,EAAa,IAAA;AAAA,EACb,QAAA,EAAU,IAAA;AAAA,EACV,MAAA,EAAQ,eAAA;AAAA,EACR,OAAA,EAAS,EAAA;AAAA,EACT,QAAA,EAAU,EAAE,GAAG,gBAAA,EAAiB;AAAA,EAChC,SAAA,EAAW,IAAA;AAAA,EACX,KAAA,EAAO,IAAA;AAAA,EACP,OAAA,EAAS,IAAA;AAAA,EACT,WAAA,EAAa,IAAA;AAAA,EACb,IAAA,EAAM,MAAA;AAAA,EACN,IAAA,EAAM;AACR,CAAA;AASA,IAAI,IAAA,GAA4C,IAAA;AAChD,IAAI,OAAO,WAAW,WAAA,EAAa;AACjC,EAAA,IAAI;AAEF,IAAA,MAAM,EAAE,iBAAA,EAAkB,GAAI,SAAA,CAAQ,aAAkB,CAAA;AAGxD,IAAA,IAAA,GAAO,IAAI,iBAAA,EAA+B;AAAA,EAC5C,CAAA,CAAA,MAAQ;AACN,IAAA,IAAA,GAAO,IAAA;AAAA,EACT;AACF;AAEA,IAAM,WAAA,GAA2B,EAAE,GAAG,YAAA,EAAa;AAEnD,SAAS,gBAAA,GAAgC;AACvC,EAAA,IAAI,IAAA,EAAM;AACR,IAAA,MAAM,KAAA,GAAQ,KAAK,QAAA,EAAS;AAC5B,IAAA,IAAI,CAAC,KAAA;AACH,MAAA,MAAM,IAAI,MAAM,oEAAoE,CAAA;AACtF,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,WAAA;AACT;AAUA,SAAS,cAAA,CAAe,OAAoB,OAAA,EAAyC;AACnF,EAAA,IAAI,iBAAiB,OAAA,IAAW,OAAA,CAAQ,WAAA,EAAa,KAAA,CAAM,cAAc,OAAA,CAAQ,WAAA;AACjF,EAAA,IAAI,cAAc,OAAA,IAAW,OAAA,CAAQ,YAAY,IAAA,EAAM,KAAA,CAAM,WAAW,OAAA,CAAQ,QAAA;AAChF,EAAA,IAAI,YAAY,OAAA,IAAW,OAAA,CAAQ,UAAU,IAAA,EAAM,KAAA,CAAM,SAAS,OAAA,CAAQ,MAAA;AAC1E,EAAA,IAAI,aAAa,OAAA,IAAW,OAAA,CAAQ,WAAW,IAAA,EAAM,KAAA,CAAM,UAAU,OAAA,CAAQ,OAAA;AAC7E,EAAA,IAAI,UAAA,IAAc,OAAA,IAAW,OAAA,CAAQ,QAAA,IAAY,IAAA;AAC/C,IAAA,KAAA,CAAM,WAAW,EAAE,GAAG,MAAM,QAAA,EAAU,GAAG,QAAQ,QAAA,EAAS;AAC5D,EAAA,IAAI,WAAA,IAAe,OAAA,IAAW,OAAA,CAAQ,SAAA,KAAc,MAAA;AAClD,IAAA,KAAA,CAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,IAAA;AACzC,EAAA,IAAI,OAAA,IAAW,WAAW,OAAA,CAAQ,KAAA,KAAU,QAAW,KAAA,CAAM,KAAA,GAAQ,QAAQ,KAAA,IAAS,IAAA;AAAA,OAAA,IAC7E,SAAA,IAAa,OAAA,IAAW,OAAA,CAAQ,OAAA,KAAY,MAAA;AACnD,IAAA,KAAA,CAAM,KAAA,GAAQ,QAAQ,OAAA,IAAW,IAAA,GAAO,OAAO,EAAE,EAAA,EAAI,QAAQ,OAAA,EAAQ;AACvE,EAAA,IAAI,SAAA,IAAa,OAAA,IAAW,OAAA,CAAQ,OAAA,KAAY,MAAA;AAC9C,IAAA,KAAA,CAAM,OAAA,GAAU,QAAQ,OAAA,IAAW,IAAA;AACrC,EAAA,IAAI,aAAA,IAAiB,OAAA,IAAW,OAAA,CAAQ,WAAA,KAAgB,MAAA;AACtD,IAAA,KAAA,CAAM,WAAA,GAAc,QAAQ,WAAA,IAAe,IAAA;AAC7C,EAAA,IAAI,UAAU,OAAA,IAAW,OAAA,CAAQ,QAAQ,IAAA,EAAM,KAAA,CAAM,OAAO,OAAA,CAAQ,IAAA;AACpE,EAAA,IAAI,MAAA,IAAU,OAAA,EAAS,KAAA,CAAM,IAAA,GAAO,OAAA,CAAQ,IAAA;AAC5C,EAAA,IAAI,cAAA,IAAkB,OAAA,EAAS,KAAA,CAAM,YAAA,GAAe,OAAA,CAAQ,YAAA;AAC5D,EAAA,IAAI,cAAA,IAAkB,OAAA,EAAS,KAAA,CAAM,YAAA,GAAe,OAAA,CAAQ,YAAA;AAC5D,EAAA,IAAI,QAAA,IAAY,OAAA,EAAS,KAAA,CAAM,MAAA,GAAS,OAAA,CAAQ,MAAA;AAClD;AAMO,SAAS,sBAAA,CAA0B,SAAmC,EAAA,EAAgB;AAC3F,EAAA,IAAI,IAAA,EAAM;AACR,IAAA,MAAM,IAAA,GAAoB,EAAE,GAAG,YAAA,EAAa;AAC5C,IAAA,cAAA,CAAe,MAAM,OAAO,CAAA;AAC5B,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,IAAA,EAAM,EAAE,CAAA;AAAA,EAC1B;AACA,EAAA,cAAA,CAAe,aAAa,OAAO,CAAA;AACnC,EAAA,OAAO,EAAA,EAAG;AACZ;AAIA,IAAM,SAAA,uBAAgB,GAAA,EAAgB;AAE/B,SAAS,kBAAkB,QAAA,EAAkC;AAClE,EAAA,SAAA,CAAU,IAAI,QAAQ,CAAA;AACtB,EAAA,OAAO,MAAM;AACX,IAAA,SAAA,CAAU,OAAO,QAAQ,CAAA;AAAA,EAC3B,CAAA;AACF;AAEO,SAAS,sBAAsB,OAAA,EAAyC;AAC7E,EAAA,cAAA,CAAe,gBAAA,IAAoB,OAAO,CAAA;AAE1C,EAAA,IAAI,OAAO,WAAW,WAAA,EAAa;AACjC,IAAA,KAAA,MAAW,QAAA,IAAY,WAAW,QAAA,EAAS;AAAA,EAC7C;AACF;AAWO,SAAS,mBAAA,GAA+B;AAC7C,EAAA,IAAI;AACF,IAAA,OAAO,gBAAA,GAAmB,QAAA,IAAY,IAAA;AAAA,EACxC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAUO,SAAS,eAAA,GAA0E;AACxF,EAAA,IAAI;AACF,IAAA,MAAM,OAAO,gBAAA,EAAiB;AAC9B,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,WAAA,EAAa,KAAK,WAAA,EAAY;AAAA,EAChE,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,WAAA,EAAa,IAAA,EAAK;AAAA,EAC5C;AACF;AAEO,SAAS,kBAAA,GAAsC;AACpD,EAAA,MAAM,OAAO,gBAAA,EAAiB;AAC9B,EAAA,OAAO;AAAA,IACL,IAAI,WAAA,GAAc;AAChB,MAAA,OAAO,IAAA,CAAK,WAAA;AAAA,IACd,CAAA;AAAA,IACA,IAAI,QAAA,GAAW;AACb,MAAA,IAAI,CAAC,IAAA,CAAK,QAAA,EAAU,MAAM,IAAI,aAAA,EAAc;AAC5C,MAAA,OAAO,IAAA,CAAK,QAAA;AAAA,IACd,CAAA;AAAA,IACA,IAAI,MAAA,GAAS;AACX,MAAA,OAAO,IAAA,CAAK,MAAA;AAAA,IACd,CAAA;AAAA,IACA,IAAI,OAAA,GAAU;AACZ,MAAA,OAAO,IAAA,CAAK,OAAA;AAAA,IACd,CAAA;AAAA,IACA,IAAI,QAAA,GAAW;AACb,MAAA,OAAO,IAAA,CAAK,QAAA;AAAA,IACd,CAAA;AAAA,IACA,IAAI,SAAA,GAAY;AACd,MAAA,OAAO,IAAA,CAAK,SAAA;AAAA,IACd,CAAA;AAAA,IACA,IAAI,KAAA,GAAQ;AACV,MAAA,OAAO,IAAA,CAAK,KAAA;AAAA,IACd,CAAA;AAAA,IACA,IAAI,OAAA,GAAU;AACZ,MAAA,OAAO,IAAA,CAAK,OAAO,EAAA,IAAM,IAAA;AAAA,IAC3B,CAAA;AAAA,IACA,IAAI,OAAA,GAAU;AACZ,MAAA,OAAO,IAAA,CAAK,OAAA;AAAA,IACd,CAAA;AAAA,IACA,IAAI,WAAA,GAAc;AAChB,MAAA,OAAO,IAAA,CAAK,WAAA;AAAA,IACd,CAAA;AAAA,IACA,IAAI,IAAA,GAAO;AACT,MAAA,IAAI,CAAC,KAAK,IAAA,EAAM;AACd,QAAA,MAAM,eAAe,IAAA,CAAK,WAAA,EAAa,YAAA,CAAa,CAAC,cAAc,CAAC,CAAA;AAEpE,QAAA,IAAA,CAAK,IAAA,GAAO,kBAAA,CAAmB,IAAA,CAAK,MAAA,EAAQ,YAAY,CAAA;AAAA,MAC1D;AACA,MAAA,OAAO,IAAA,CAAK,IAAA;AAAA,IACd,CAAA;AAAA,IACA,IAAI,GAAA,GAAM;AACR,MAAA,OAAO,eAAA,CAAgB,IAAA,CAAK,MAAM,CAAA,CAAE,GAAA;AAAA,IACtC,CAAA;AAAA,IACA,IAAI,IAAA,GAAO;AACT,MAAA,OAAO,IAAA,CAAK,IAAA;AAAA,IACd,CAAA;AAAA,IACA,IAAI,YAAA,GAAe;AACjB,MAAA,OAAO,IAAA,CAAK,YAAA;AAAA,IACd,CAAA;AAAA,IACA,IAAI,YAAA,GAAe;AACjB,MAAA,OAAO,IAAA,CAAK,YAAA;AAAA,IACd,CAAA;AAAA,IACA,IAAI,MAAA,GAAS;AACX,MAAA,OAAO,IAAA,CAAK,MAAA;AAAA,IACd;AAAA,GACF;AACF","file":"chunk-5ACY5CD3.js","sourcesContent":["export class SettingsError extends Error {\n  constructor(message?: string) {\n    super(message ?? 'Store settings could not be loaded.');\n    this.name = 'SettingsError';\n  }\n}\n","import { createInstance, type i18n as I18nInstance } from 'i18next';\nimport { initReactI18next } from 'react-i18next';\n\nexport type TranslationMessages = Record<string, Record<string, string>>;\n\n/**\n * Creates a new i18next instance for the given locale.\n *\n * @param locale - Active locale code, e.g. `'ar'`\n * @param translations - App translations from the Salla API (store-specific)\n * @param themeTranslations - Bundled theme translations (static defaults)\n */\nexport function createI18nInstance(\n  locale: string,\n  translations?: TranslationMessages,\n  themeTranslations?: TranslationMessages\n): I18nInstance {\n  const instance = createInstance();\n  const transKey = `${locale}.trans`;\n\n  instance.use(initReactI18next).init({\n    lng: locale,\n    fallbackLng: locale,\n    ns: ['app', 'theme'],\n    defaultNS: 'app',\n    fallbackNS: 'theme',\n    resources: {\n      [locale]: {\n        app: translations?.[transKey] ?? {},\n        theme: themeTranslations?.[transKey] ?? {},\n      },\n    },\n    interpolation: { escapeValue: false },\n    react: { useSuspense: false },\n    keySeparator: '.',\n    nsSeparator: false,\n  });\n\n  return instance;\n}\n\n/**\n * Creates i18n instance for testing\n * @param locale - Locale code (default: 'ar')\n * @param translations - Optional translations\n */\nexport function createTestI18n(locale = 'ar', translations?: TranslationMessages): I18nInstance {\n  return createI18nInstance(locale, translations);\n}\n","import type { QueryClient } from '@tanstack/react-query';\nimport type { i18n } from 'i18next';\nimport type { StoreContext } from '../api/store';\nimport type { AppSnippet, AppSettings } from '../api/apps';\nimport { FALLBACK_LOCALE, getLanguageInfo } from '../providers/locale-constants';\nimport type { TranslationMessages } from '../providers/i18n-factory';\nimport { createI18nInstance } from '../providers/i18n-factory';\nimport { SettingsError } from '../utils/errors';\nimport type { ActiveScope } from '../utils/cookies';\n\n// ============================================================================\n// Types\n// ============================================================================\n\nexport interface TwilightLocation<TSearch = Record<string, unknown>> {\n  href: string;\n  pathname: string;\n  search: TSearch;\n  searchStr: string;\n  state: Record<string, unknown>;\n  hash: string;\n}\n\nexport interface PageContext {\n  slug: string;\n  id?: string | number;\n  title: string;\n  url?: string;\n  parent?: { id: string | number; name: string; url: string } | null;\n  breadcrumbs?: { name: string; url: string }[];\n}\n\nexport interface TwilightContext {\n  queryClient: QueryClient;\n  settings: StoreContext;\n  locale: string;\n  routeId: string;\n  location: TwilightLocation;\n  authToken: string | null;\n  /**\n   * The selected market and, once bullet delivery confirmed one, its branch\n   * allocation — the full object the SDK sends as `s-scope-*` headers. Seeded from\n   * the `scope` cookie on the server; see {@link ActiveScope}.\n   */\n  scope: ActiveScope | null;\n  /** `scope.id`, kept for callers that only need the market. */\n  scopeId: string | null;\n  /**\n   * Which store this request is for, when something other than the hostname says\n   * so — the `?storeId=` a preview was opened with, or the cookie remembering it.\n   *\n   * Null on a live storefront, where the hostname is the answer and there is\n   * nothing to carry. See {@link resolveRequestStoreId}.\n   */\n  storeId: string | null;\n  /**\n   * The host this request arrived on, captured server-side.\n   *\n   * A theme worker is deployed with no vars and no bindings, so the request is\n   * the only thing that knows which storefront it is serving. On the client this\n   * is `window.location.host`; on the server nothing else has it.\n   */\n  requestHost: string | null;\n  i18n: i18n;\n  dir: 'ltr' | 'rtl';\n  page?: PageContext;\n  /** Installed apps' snippets, fetched in rootBeforeLoad so AppsSnippets can render CDN\n   *  <script> tags during SSR (React Query isn't dehydrated here, so useQuery has no SSR data). */\n  appsSnippets?: AppSnippet[];\n  /** Per-app public `app.*` buckets, fetched in rootBeforeLoad so rootHead can install the\n   *  `Salla.appScope` factory inline at parse time — ahead of the snippets' onReady callbacks. */\n  appsSettings?: AppSettings;\n  extras?: Record<string, unknown>;\n}\n\n// ============================================================================\n// Internal Store\n// ============================================================================\n\nconst DEFAULT_LOCATION: TwilightLocation = {\n  href: '',\n  pathname: '',\n  search: {},\n  searchStr: '',\n  state: {},\n  hash: '',\n};\n\ninterface ContextData {\n  queryClient: QueryClient;\n  settings: StoreContext | null;\n  locale: string;\n  routeId: string;\n  location: TwilightLocation;\n  authToken: string | null;\n  scope: ActiveScope | null;\n  storeId: string | null;\n  requestHost: string | null;\n  i18n?: i18n;\n  page?: PageContext;\n  appsSnippets?: AppSnippet[];\n  appsSettings?: AppSettings;\n  extras?: Record<string, unknown>;\n}\n\nconst DEFAULT_DATA: ContextData = {\n  queryClient: null as unknown as QueryClient,\n  settings: null,\n  locale: FALLBACK_LOCALE,\n  routeId: '',\n  location: { ...DEFAULT_LOCATION },\n  authToken: null,\n  scope: null,\n  storeId: null,\n  requestHost: null,\n  i18n: undefined,\n  page: undefined,\n};\n\n// ============================================================================\n// Storage: AsyncLocalStorage (server) or module-level store (client)\n// ============================================================================\n\ntype AsyncLocalStore<T> = { getStore(): T | undefined; run(val: T, fn: () => unknown): unknown };\n\n// Initialize ALS at module load time for SSR — no race condition\nlet _als: AsyncLocalStore<ContextData> | null = null;\nif (typeof window === 'undefined') {\n  try {\n    // eslint-disable-next-line @typescript-eslint/no-require-imports\n    const { AsyncLocalStorage } = require('node:async_hooks') as {\n      AsyncLocalStorage: new <T>() => AsyncLocalStore<T>;\n    };\n    _als = new AsyncLocalStorage<ContextData>();\n  } catch {\n    _als = null;\n  }\n}\n\nconst clientStore: ContextData = { ...DEFAULT_DATA };\n\nfunction getTwilightStore(): ContextData {\n  if (_als) {\n    const store = _als.getStore();\n    if (!store)\n      throw new Error('[Twilight] No request context. Wrap with runWithTwilightContext().');\n    return store;\n  }\n  return clientStore;\n}\n\nfunction writableStore(): ContextData {\n  if (_als) {\n    const store = _als.getStore();\n    if (store) return store;\n  }\n  return clientStore;\n}\n\nfunction mergeIntoStore(store: ContextData, partial: Partial<TwilightContext>): void {\n  if ('queryClient' in partial && partial.queryClient) store.queryClient = partial.queryClient;\n  if ('settings' in partial && partial.settings != null) store.settings = partial.settings;\n  if ('locale' in partial && partial.locale != null) store.locale = partial.locale;\n  if ('routeId' in partial && partial.routeId != null) store.routeId = partial.routeId;\n  if ('location' in partial && partial.location != null)\n    store.location = { ...store.location, ...partial.location };\n  if ('authToken' in partial && partial.authToken !== undefined)\n    store.authToken = partial.authToken ?? null;\n  if ('scope' in partial && partial.scope !== undefined) store.scope = partial.scope ?? null;\n  else if ('scopeId' in partial && partial.scopeId !== undefined)\n    store.scope = partial.scopeId == null ? null : { id: partial.scopeId };\n  if ('storeId' in partial && partial.storeId !== undefined)\n    store.storeId = partial.storeId ?? null;\n  if ('requestHost' in partial && partial.requestHost !== undefined)\n    store.requestHost = partial.requestHost ?? null;\n  if ('i18n' in partial && partial.i18n != null) store.i18n = partial.i18n;\n  if ('page' in partial) store.page = partial.page;\n  if ('appsSnippets' in partial) store.appsSnippets = partial.appsSnippets;\n  if ('appsSettings' in partial) store.appsSettings = partial.appsSettings;\n  if ('extras' in partial) store.extras = partial.extras;\n}\n\n// ============================================================================\n// Public API\n// ============================================================================\n\nexport function runWithTwilightContext<T>(partial: Partial<TwilightContext>, fn: () => T): T {\n  if (_als) {\n    const data: ContextData = { ...DEFAULT_DATA };\n    mergeIntoStore(data, partial);\n    return _als.run(data, fn) as T;\n  }\n  mergeIntoStore(clientStore, partial);\n  return fn();\n}\n\n// Client-only subscription so React consumers (useRouteId/useIsHome/…) re-render\n// when navigation mutates the module store. Mirrors hooks/useWishlist.ts.\nconst listeners = new Set<() => void>();\n\nexport function subscribeTwilight(listener: () => void): () => void {\n  listeners.add(listener);\n  return () => {\n    listeners.delete(listener);\n  };\n}\n\nexport function updateTwilightContext(partial: Partial<TwilightContext>): void {\n  mergeIntoStore(getTwilightStore(), partial);\n  // Server uses AsyncLocalStorage and has no React subscribers; notify on client only.\n  if (typeof window !== 'undefined') {\n    for (const listener of listeners) listener();\n  }\n}\n\n/**\n * Whether store settings are available, without throwing.\n *\n * `getTwilightContext().settings` throws a `SettingsError` when the store is\n * empty, which is fatal inside a head function during hydration. Callers that\n * need to *test* availability must use this instead of a try/catch around the\n * getter. Returns false when there is no request context at all (server-side\n * calls outside `runWithTwilightContext`).\n */\nexport function hasTwilightSettings(): boolean {\n  try {\n    return getTwilightStore().settings != null;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * The store this request names and the host it arrived on, without throwing.\n *\n * Separate from {@link getTwilightContext} because store identity is read while\n * deciding *what to fetch* — before there is a context worth having — and on the\n * server outside a request the getter throws. A caller asking \"which store?\" has\n * a sane answer for \"none named\"; it has none for an exception.\n */\nexport function getRequestStore(): { storeId: string | null; requestHost: string | null } {\n  try {\n    const data = getTwilightStore();\n    return { storeId: data.storeId, requestHost: data.requestHost };\n  } catch {\n    return { storeId: null, requestHost: null };\n  }\n}\n\nexport function getTwilightContext(): TwilightContext {\n  const data = getTwilightStore();\n  return {\n    get queryClient() {\n      return data.queryClient;\n    },\n    get settings() {\n      if (!data.settings) throw new SettingsError();\n      return data.settings;\n    },\n    get locale() {\n      return data.locale;\n    },\n    get routeId() {\n      return data.routeId;\n    },\n    get location() {\n      return data.location;\n    },\n    get authToken() {\n      return data.authToken;\n    },\n    get scope() {\n      return data.scope;\n    },\n    get scopeId() {\n      return data.scope?.id ?? null;\n    },\n    get storeId() {\n      return data.storeId;\n    },\n    get requestHost() {\n      return data.requestHost;\n    },\n    get i18n() {\n      if (!data.i18n) {\n        const translations = data.queryClient?.getQueryData(['translations']) as\n          TranslationMessages | undefined;\n        data.i18n = createI18nInstance(data.locale, translations);\n      }\n      return data.i18n;\n    },\n    get dir() {\n      return getLanguageInfo(data.locale).dir;\n    },\n    get page() {\n      return data.page;\n    },\n    get appsSnippets() {\n      return data.appsSnippets;\n    },\n    get appsSettings() {\n      return data.appsSettings;\n    },\n    get extras() {\n      return data.extras;\n    },\n  };\n}\n\n/** @internal Reset store for testing */\nexport function resetForTesting(): void {\n  Object.assign(writableStore(), { ...DEFAULT_DATA });\n}\n"]}

package/dist/chunk-WXOABH6J.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/api/client.ts"],"names":[],"mappings":";;;;;;AAsBA,IAAM,iBAAA,GAAoB,kBAAA,EAAmB,CAC1C,MAAA,CAAO,MAAqB;AAC3B,EAAA,IAAI;AACF,IAAA,OAAO,SAAA,CAAU,sBAAsB,CAAA,IAAK,IAAA;AAAA,EAC9C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF,CAAC,CAAA,CACA,OAAO,MAAqB;AAC3B,EAAA,MAAM,UAAA,GACJ,OAAO,QAAA,KAAa,WAAA,GAChB,wBAAwB,QAAA,CAAS,MAAA,EAAQ,sBAAsB,CAAA,GAC/D,IAAA;AACN,EAAA,IAAI,YAAY,OAAO,UAAA;AACvB,EAAA,MAAM,UAAU,OAAO,MAAA,KAAW,WAAA,GAAc,MAAA,CAAO,OAAO,OAAA,GAAU,MAAA;AACxE,EAAA,MAAM,WAAA,GACJ,OAAO,OAAA,EAAS,GAAA,KAAQ,aAAa,OAAA,CAAQ,GAAA,CAAI,sBAAsB,CAAA,GAAI,IAAA;AAC7E,EAAA,IAAI,OAAO,WAAA,KAAgB,QAAA,IAAY,WAAA,EAAa,OAAO,WAAA;AAE3D,EAAA,MAAM,aAAa,OAAO,MAAA,KAAW,cAAc,MAAA,CAAO,KAAA,EAAO,KAAK,KAAA,GAAQ,MAAA;AAC9E,EAAA,OAAO,OAAO,UAAA,KAAe,QAAA,IAAY,UAAA,GAAa,UAAA,GAAa,IAAA;AACrE,CAAC,CAAA;AAOI,IAAM,YAAA,GAAe,MAC1B,kBAAA,EAAmB,CAAE,aAAa,iBAAA;AAEpC,IAAM,WAAA,GAAc;AAAA,EAClB,MAAA,EAAQ,QAAA;AAAA,EACR,eAAA,EAAiB,iBAAA;AAAA,EACjB,MAAA,EAAQ,UAAA;AAAA,EACR,WAAA,EAAa,eAAA;AAAA,EACb,GAAA,EAAK,OAAA;AAAA,EACL,MAAA,EAAQ,UAAA;AAAA,EACR,UAAA,EAAY,cAAA;AAAA,EACZ,iBAAA,EAAmB,qBAAA;AAAA,EACnB,cAAA,EAAgB,kBAAA;AAAA,EAChB,kBAAA,EAAoB,yBAAA;AAAA,EACpB,gBAAA,EAAkB,kBAAA;AAAA,EAClB,aAAA,EAAe,eAAA;AAAA,EACf,UAAA,EAAY,cAAA;AAAA,EACZ,QAAA,EAAU,YAAA;AAAA,EACV,UAAA,EAAY,cAAA;AAAA,EACZ,qBAAA,EAAuB,yBAAA;AAAA,EACvB,mBAAA,EAAqB;AACvB,CAAA;AAUO,IAAM,0BAA0B,WAAA,CAAY;AAc5C,IAAM,iBAAiB,MAA0B;AAItD,EAAA,MAAM,cAAc,YAAA,EAAa;AACjC,EAAA,IAAI,WAAA,KAAgB,QAAW,OAAO,WAAA;AAEtC,EAAA,IAAI,OAAO,aAAa,WAAA,EAAa;AACnC,IAAA,MAAM,UAAA,GAAa,uBAAA,CAAwB,QAAA,CAAS,MAAM,CAAA;AAC1D,IAAA,IAAI,UAAA,IAAc,MAAM,OAAO,UAAA;AAAA,EACjC;AAEA,EAAA,IAAI;AACF,IAAA,OAAO,oBAAmB,CAAE,KAAA;AAAA,EAC9B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAGO,IAAM,gBAAA,GAAmB,MAAqB,cAAA,EAAe,EAAG,EAAA,IAAM;AAE7E,IAAM,aAAA,GAAgB,CAAC,MAAA,MAAoB;AAAA,EACzC,CAAC,WAAA,CAAY,MAAM,GAAG,kBAAA;AAAA,EACtB,CAAC,WAAA,CAAY,eAAe,GAAG,MAAA;AAAA,EAC/B,CAAC,WAAA,CAAY,MAAM,GAAG,SAAA;AAAA,EACtB,CAAC,WAAA,CAAY,WAAW,GAAG,UAAA;AAAA,EAC3B,CAAC,WAAA,CAAY,GAAG,GAAG,IAAA;AAAA,EACnB,CAAC,WAAA,CAAY,MAAM,GAAG,UAAA;AAAA,EACtB,CAAC,WAAA,CAAY,UAAU,GAAG,OAAA;AAAA,EAC1B,CAAC,WAAA,CAAY,iBAAiB,GAAG,QAAA;AAAA,EACjC,CAAC,WAAA,CAAY,cAAc,GAAG,gBAAA;AAAA,EAC9B,CAAC,WAAA,CAAY,kBAAkB,GAAG;AACpC,CAAA,CAAA;AAWO,IAAM,GAAA,GAAM,GAAG,MAAA,CAAO;AAAA,EAC3B,MAAA,EAAQ,gCAAA;AAAA;AAAA,EACR,OAAA,EAAS,GAAA;AAAA,EACT,KAAA,EAAO;AAAA,IACL,aAAA,EAAe;AAAA,MACb,CAAC,EAAE,OAAA,EAAQ,KAAM;AACf,QAAA,MAAM,EAAE,MAAA,EAAQ,SAAA,EAAU,GAAI,kBAAA,EAAmB;AACjD,QAAA,MAAM,OAAA,GAAU,cAAc,MAAM,CAAA;AACpC,QAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,UAAA,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,QAChC;AAIA,QAAA,IAAI,CAAC,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,WAAA,CAAY,gBAAgB,CAAA,EAAG;AACtD,UAAA,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,WAAA,CAAY,gBAAA,EAAkB,oBAAoB,CAAA;AAAA,QACxE;AAEA,QAAA,IAAI;AACF,UAAA,MAAM,SAAA,GAAY,kBAAA,EAAmB,CAAE,QAAA,EAAU,OAAO,OAAA,EAAS,EAAA;AACjE,UAAA,IAAI,aAAa,IAAA,EAAM;AACrB,YAAA,OAAA,CAAQ,QAAQ,GAAA,CAAI,WAAA,CAAY,UAAA,EAAY,MAAA,CAAO,SAAS,CAAC,CAAA;AAAA,UAC/D;AAAA,QACF,CAAA,CAAA,MAAQ;AAAA,QAER;AAEA,QAAA,MAAM,KAAA,GAAQ,aAAa,iBAAA,EAAkB;AAC7C,QAAA,IAAI,KAAA,EAAO;AACT,UAAA,OAAA,CAAQ,QAAQ,GAAA,CAAI,WAAA,CAAY,aAAA,EAAe,CAAA,OAAA,EAAU,KAAK,CAAA,CAAE,CAAA;AAAA,QAClE;AAIA,QAAA,MAAM,QAAQ,cAAA,EAAe;AAC7B,QAAA,IAAI,KAAA,EAAO;AACT,UAAA,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,WAAA,CAAY,QAAA,EAAU,MAAM,EAAE,CAAA;AAClD,UAAA,IAAI,KAAA,CAAM,MAAM,OAAA,CAAQ,OAAA,CAAQ,IAAI,WAAA,CAAY,UAAA,EAAY,MAAM,IAAI,CAAA;AACtE,UAAA,IAAI,KAAA,CAAM,eAAA;AACR,YAAA,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,WAAA,CAAY,qBAAA,EAAuB,MAAM,eAAe,CAAA;AAC9E,UAAA,IAAI,KAAA,CAAM,aAAA;AACR,YAAA,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,WAAA,CAAY,mBAAA,EAAqB,MAAM,aAAa,CAAA;AAAA,QAC5E;AAAA,MACF;AAAA;AACF;AAEJ,CAAC;AAEM,IAAM,GAAA,GAAM,GAAG,MAAA,CAAO;AAAA,EAC3B,MAAA,EAAQ,2BAAA;AAAA,EACR,OAAA,EAAS;AACX,CAAC","file":"chunk-WXOABH6J.js","sourcesContent":["import ky from 'ky';\nimport { createIsomorphicFn } from '@tanstack/react-start';\nimport { getCookie } from '@tanstack/react-start/server';\nimport { getStoreIdentifier } from '../utils/sdk-helpers';\n// import { getInjectedRuntimeEnv, readEnv } from '../utils/runtime-env';\nimport { getTwilightContext } from '../twilight/context';\nimport {\n  AUTH_TOKEN_COOKIE_NAME,\n  extractScopeFromCookies,\n  extractTokenFromCookies,\n  readSdkScope,\n  type ActiveScope,\n} from '../utils/cookies';\n\n// The twilight module store doesn't reliably carry authToken into every scope: on the\n// SERVER workerd has no AsyncLocalStorage, and on BOTH sides this api client can live in a\n// different module instance than the one rootBeforeLoad populates (engine subpath import vs\n// engine-internal relative import). So `getTwilightContext().authToken` is often null even\n// for logged-in users → API calls (orders/customer/…) return `token_not_provided` (400).\n// Read the token directly from the request cookie (server) or document.cookie / salla.storage\n// (client) as a fallback. The server-only import is stripped from the client bundle by\n// createIsomorphicFn.\nconst readFallbackToken = createIsomorphicFn()\n  .server((): string | null => {\n    try {\n      return getCookie(AUTH_TOKEN_COOKIE_NAME) ?? null;\n    } catch {\n      return null;\n    }\n  })\n  .client((): string | null => {\n    const fromCookie =\n      typeof document !== 'undefined'\n        ? extractTokenFromCookies(document.cookie, AUTH_TOKEN_COOKIE_NAME)\n        : null;\n    if (fromCookie) return fromCookie;\n    const storage = typeof window !== 'undefined' ? window.salla?.storage : undefined;\n    const fromStorage =\n      typeof storage?.get === 'function' ? storage.get(AUTH_TOKEN_COOKIE_NAME) : null;\n    if (typeof fromStorage === 'string' && fromStorage) return fromStorage;\n    // `?token=` webview injection lands only on the SDK's axios instance\n    const fromSdkApi = typeof window !== 'undefined' ? window.salla?.api?.token : undefined;\n    return typeof fromSdkApi === 'string' && fromSdkApi ? fromSdkApi : null;\n  });\n\n/**\n * The auth token as the api client sees it: twilight context first, cookie/storage fallback.\n * Use this (not `getTwilightContext().authToken`, which is often null for logged-in users —\n * see the note above) to decide whether an authenticated-only query should run.\n */\nexport const getAuthToken = (): string | null =>\n  getTwilightContext().authToken ?? readFallbackToken();\n\nconst API_HEADERS = {\n  ACCEPT: 'accept',\n  ACCEPT_LANGUAGE: 'accept-language',\n  APP_OS: 's-app-os',\n  APP_VERSION: 's-app-version',\n  RAY: 's-ray',\n  SOURCE: 's-source',\n  THEME_TYPE: 's-theme-type',\n  STORE_API_VERSION: 's-store-api-version',\n  REQUESTED_WITH: 'x-requested-with',\n  CF_PROXY_WHITELIST: 's-cf-proxy-whitelist-id',\n  STORE_IDENTIFIER: 'store-identifier',\n  AUTHORIZATION: 'Authorization',\n  VERSION_ID: 's-version-id',\n  SCOPE_ID: 's-scope-id',\n  SCOPE_TYPE: 's-scope-type',\n  SCOPE_ALLOCATION_TYPE: 's-scope-allocation-type',\n  SCOPE_ALLOCATION_ID: 's-scope-allocation-id',\n} as const;\n\n/**\n * The header every Salla API call is answered by store.\n *\n * Exported because a caller that already knows which store it is asking about\n * must be able to say so on the request itself — see `store.settings`. Without\n * it the only way to name a store is the ambient resolver, and \"the identifier\n * I checked\" and \"the identifier that was sent\" become two different things.\n */\nexport const STORE_IDENTIFIER_HEADER = API_HEADERS.STORE_IDENTIFIER;\n\n/**\n * Active scope: the market plus its branch allocation, as the SDK stores it. On the\n * client it comes from `salla.storage.get('scope')`; before the SDK hydrates storage\n * it falls back to the `scope` cookie the theme mirrors that selection into (see\n * writeScopeCookie), then to the scope twilightMiddleware seeded from the same\n * cookie on the server. Requests vary by the `s-scope-*` headers, so React Query\n * keys must include this to avoid serving another branch's cached categories/products.\n *\n * The cookie step matters for hydration: the SDK is not guaranteed to have\n * populated `salla.storage` by the time the client rebuilds a dehydrated query\n * key, and without it the client would compute null against a scoped SSR key.\n */\nexport const getActiveScope = (): ActiveScope | null => {\n  // `!== undefined`, not `!= null`: a null here is the SDK authoritatively saying \"no branch\n  // selected\", which must beat a cookie left over from the previous selection. Only a\n  // not-yet-ready storage API (undefined) falls through to the cookie.\n  const fromStorage = readSdkScope();\n  if (fromStorage !== undefined) return fromStorage;\n\n  if (typeof document !== 'undefined') {\n    const fromCookie = extractScopeFromCookies(document.cookie);\n    if (fromCookie != null) return fromCookie;\n  }\n\n  try {\n    return getTwilightContext().scope;\n  } catch {\n    return null;\n  }\n};\n\n/** {@link getActiveScope} reduced to the market id. */\nexport const getActiveScopeId = (): string | null => getActiveScope()?.id ?? null;\n\nconst sharedHeaders = (locale: string) => ({\n  [API_HEADERS.ACCEPT]: 'application/json' as const,\n  [API_HEADERS.ACCEPT_LANGUAGE]: locale,\n  [API_HEADERS.APP_OS]: 'browser',\n  [API_HEADERS.APP_VERSION]: '2.14.363',\n  [API_HEADERS.RAY]: '50',\n  [API_HEADERS.SOURCE]: 'twilight',\n  [API_HEADERS.THEME_TYPE]: 'react',\n  [API_HEADERS.STORE_API_VERSION]: 'swoole',\n  [API_HEADERS.REQUESTED_WITH]: 'XMLHttpRequest',\n  [API_HEADERS.CF_PROXY_WHITELIST]: '019a2f78-a64c-7edb-proxy-whitelist-id-9a3a-17afda90f03a',\n});\n\n/**\n * Store API base. `VITE_API_URL` override points a preview at a branch backend; unset → prod\n * `api.salla.dev`. Resolution order matters: the value the SSR worker resolved (published into\n * the head, since worker `vars` are server-only `process.env` and never reach the browser\n * bundle) wins, so the hydrated client keeps talking to the backend that rendered the page.\n */\n\n// const STORE_API_BASE = getInjectedRuntimeEnv().apiBase || readEnv('VITE_API_URL') || 'https://api.salla.dev/store/v1';\n\nexport const api = ky.extend({\n  prefix: 'https://api.salla.dev/store/v1', // TODO: check env\n  timeout: 8000,\n  hooks: {\n    beforeRequest: [\n      ({ request }) => {\n        const { locale, authToken } = getTwilightContext();\n        const headers = sharedHeaders(locale);\n        for (const [key, value] of Object.entries(headers)) {\n          request.headers.set(key, value);\n        }\n        // Only when the caller did not say. `headers.set` here would otherwise\n        // overwrite a per-request identifier with the ambient one, which is a\n        // silent way to answer a question about one store with another's data.\n        if (!request.headers.get(API_HEADERS.STORE_IDENTIFIER)) {\n          request.headers.set(API_HEADERS.STORE_IDENTIFIER, getStoreIdentifier());\n        }\n\n        try {\n          const profileId = getTwilightContext().settings?.theme?.profile?.id;\n          if (profileId != null) {\n            request.headers.set(API_HEADERS.VERSION_ID, String(profileId));\n          }\n        } catch {\n          // settings not loaded yet — skip VERSION_ID header\n        }\n\n        const token = authToken ?? readFallbackToken();\n        if (token) {\n          request.headers.set(API_HEADERS.AUTHORIZATION, `Bearer ${token}`);\n        }\n\n        // The same four the SDK's own client sends. The API resolves stock per\n        // allocation: id alone asks about the market, not the branch the shopper chose.\n        const scope = getActiveScope();\n        if (scope) {\n          request.headers.set(API_HEADERS.SCOPE_ID, scope.id);\n          if (scope.type) request.headers.set(API_HEADERS.SCOPE_TYPE, scope.type);\n          if (scope.allocation_type)\n            request.headers.set(API_HEADERS.SCOPE_ALLOCATION_TYPE, scope.allocation_type);\n          if (scope.allocation_id)\n            request.headers.set(API_HEADERS.SCOPE_ALLOCATION_ID, scope.allocation_id);\n        }\n      },\n    ],\n  },\n});\n\nexport const cdn = ky.extend({\n  prefix: 'https://cdn.salla.network',\n  timeout: 5000,\n});\n"]}

package/dist/chunk-Y5FBDMFV.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/utils/cookies.ts","../src/utils/inline-script.ts","../src/utils/runtime-env.ts","../src/utils/store-identity.ts","../src/utils/sdk-helpers.ts"],"names":[],"mappings":";;;AAAO,IAAM,sBAAA,GAAyB;AAC/B,IAAM,iBAAA,GAAoB,OAAA;AAoB1B,IAAM,oBAAA,GAAuB,WAAA;AAG7B,IAAM,cAAA,GAAiB,SAAA;AAUvB,SAAS,aAAa,GAAA,EAA+C;AAC1E,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,OAAO,oBAAA,CAAqB,IAAA,CAAK,GAAG,CAAA,GAAI,GAAA,GAAM,IAAA;AAChD;AAGO,SAAS,0BAA0B,YAAA,EAA4C;AACpF,EAAA,OAAO,YAAA,CAAa,uBAAA,CAAwB,YAAA,EAAc,oBAAoB,CAAC,CAAA;AACjF;AAqBO,IAAM,cAAA,GAAoC,CAAC,sBAAsB,CAAA;AAGxE,SAAS,WAAW,IAAA,EAAsB;AACxC,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,IAAA,EAAK,CAAE,WAAA,EAAY;AAExC,EAAA,IAAI,OAAA,CAAQ,UAAA,CAAW,GAAG,CAAA,EAAG,OAAO,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA,GAAI,CAAC,CAAA,IAAK,OAAA;AAClF,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,OAAA,CAAQ,GAAG,CAAA;AACjC,EAAA,OAAO,UAAU,EAAA,GAAK,OAAA,GAAU,OAAA,CAAQ,KAAA,CAAM,GAAG,KAAK,CAAA;AACxD;AAEA,SAAS,WAAW,QAAA,EAA2B;AAC7C,EAAA,OACE,QAAA,KAAa,eACb,QAAA,KAAa,WAAA,IACb,aAAa,OAAA,IACb,QAAA,CAAS,SAAS,YAAY,CAAA;AAElC;AAUO,SAAS,qBAAqB,IAAA,EAA0C;AAC7E,EAAA,IAAI,CAAC,MAAM,OAAO,KAAA;AAClB,EAAA,MAAM,QAAA,GAAW,WAAW,IAAI,CAAA;AAChC,EAAA,OAAO,cAAA,CAAe,QAAA,CAAS,QAAQ,CAAA,IAAK,WAAW,QAAQ,CAAA;AACjE;AAYO,SAAS,oBAAoB,IAAA,EAA0C;AAC5E,EAAA,OAAO,OAAA,CAAQ,IAAI,CAAA,IAAK,CAAC,qBAAqB,IAAI,CAAA;AACpD;AAgBO,SAAS,qBAAA,CACd,GAAA,EACA,YAAA,EACA,IAAA,EACe;AACf,EAAA,IAAI,CAAC,oBAAA,CAAqB,IAAI,CAAA,EAAG,OAAO,IAAA;AAExC,EAAA,IAAI,SAAA,GAA2B,IAAA;AAC/B,EAAA,IAAI;AACF,IAAA,SAAA,GAAY,YAAA,CAAa,IAAI,GAAA,CAAI,GAAG,EAAE,YAAA,CAAa,GAAA,CAAI,cAAc,CAAC,CAAA;AAAA,EACxE,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,SAAA,IAAa,0BAA0B,YAAY,CAAA;AAC5D;AAOO,SAAS,oBAAA,GAA6B;AAC3C,EAAA,IAAI,OAAO,aAAa,WAAA,EAAa;AACrC,EAAA,QAAA,CAAS,MAAA,GAAS,GAAG,sBAAsB,CAAA,gDAAA,CAAA;AAC7C;AAEO,SAAS,uBAAA,CACd,cACA,UAAA,EACe;AACf,EAAA,IAAI,CAAC,cAAc,OAAO,IAAA;AAE1B,EAAA,MAAM,MAAA,GAAS,GAAG,UAAU,CAAA,CAAA,CAAA;AAC5B,EAAA,IAAI,KAAA,GAAQ,CAAA;AAEZ,EAAA,OAAO,KAAA,GAAQ,aAAa,MAAA,EAAQ;AAClC,IAAA,MAAM,GAAA,GAAM,YAAA,CAAa,OAAA,CAAQ,MAAA,EAAQ,KAAK,CAAA;AAC9C,IAAA,IAAI,GAAA,KAAQ,IAAI,OAAO,IAAA;AAEvB,IAAA,MAAM,WAAW,GAAA,GAAM,CAAA,GAAI,YAAA,CAAa,GAAA,GAAM,CAAC,CAAA,GAAI,EAAA;AACnD,IAAA,IAAI,QAAA,KAAa,EAAA,IAAM,QAAA,KAAa,GAAA,IAAO,aAAa,GAAA,EAAK;AAC3D,MAAA,IAAI,GAAA,GAAM,YAAA,CAAa,OAAA,CAAQ,GAAA,EAAK,GAAG,CAAA;AACvC,MAAA,IAAI,GAAA,KAAQ,EAAA,EAAI,GAAA,GAAM,YAAA,CAAa,MAAA;AAEnC,MAAA,MAAM,KAAA,GAAQ,aAAa,KAAA,CAAM,GAAA,GAAM,OAAO,MAAA,EAAQ,GAAG,EAAE,IAAA,EAAK;AAChE,MAAA,IAAI;AACF,QAAA,OAAO,kBAAA,CAAmB,KAAK,CAAA,IAAK,IAAA;AAAA,MACtC,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,KAAA,IAAS,IAAA;AAAA,MAClB;AAAA,IACF;AAEA,IAAA,KAAA,GAAQ,MAAM,MAAA,CAAO,MAAA;AAAA,EACvB;AAEA,EAAA,OAAO,IAAA;AACT;AAiBA,SAAS,eAAe,GAAA,EAAkC;AACxD,EAAA,IAAI,GAAA,IAAO,MAAM,OAAO,IAAA;AACxB,EAAA,IAAI,OAAO,QAAQ,QAAA,EAAU,OAAO,EAAE,EAAA,EAAI,MAAA,CAAO,GAAG,CAAA,EAAE;AACtD,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,IAAI,CAAA,CAAE,EAAA,IAAM,IAAA,EAAM,OAAO,IAAA;AACzB,EAAA,MAAM,QAAqB,EAAE,EAAA,EAAI,MAAA,CAAO,CAAA,CAAE,EAAE,CAAA,EAAE;AAC9C,EAAA,IAAI,EAAE,IAAA,IAAQ,IAAA,QAAY,IAAA,GAAO,MAAA,CAAO,EAAE,IAAI,CAAA;AAC9C,EAAA,IAAI,EAAE,eAAA,IAAmB,IAAA,QAAY,eAAA,GAAkB,MAAA,CAAO,EAAE,eAAe,CAAA;AAC/E,EAAA,IAAI,EAAE,aAAA,IAAiB,IAAA,QAAY,aAAA,GAAgB,MAAA,CAAO,EAAE,aAAa,CAAA;AACzE,EAAA,OAAO,KAAA;AACT;AAQO,SAAS,wBAAwB,YAAA,EAAiD;AACvF,EAAA,MAAM,GAAA,GAAM,uBAAA,CAAwB,YAAA,EAAc,iBAAiB,CAAA;AACnE,EAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,EAAA,IAAI;AACF,IAAA,OAAO,cAAA,CAAe,IAAA,CAAK,KAAA,CAAM,GAAG,CAAC,CAAA;AAAA,EACvC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAcO,SAAS,YAAA,GAA+C;AAC7D,EAAA,MAAM,UAAU,OAAO,MAAA,KAAW,WAAA,GAAc,MAAA,CAAO,OAAO,OAAA,GAAU,MAAA;AACxE,EAAA,IAAI,OAAO,OAAA,EAAS,GAAA,KAAQ,UAAA,EAAY,OAAO,MAAA;AAC/C,EAAA,OAAO,cAAA,CAAe,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAC,CAAA;AACtD;AASA,IAAM,oBAAA,GAAuB,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,GAAA;AAE5C,IAAM,SAAA,GAAY,CAAC,CAAA,EAAuB,CAAA,KACxC,IAAA,CAAK,UAAU,CAAC,CAAA,KAAM,IAAA,CAAK,SAAA,CAAU,CAAC,CAAA;AAejC,SAAS,iBAAiB,KAAA,EAAoC;AACnE,EAAA,IAAI,OAAO,QAAA,KAAa,WAAA,EAAa,OAAO,KAAA;AAC5C,EAAA,IAAI,UAAU,uBAAA,CAAwB,QAAA,CAAS,MAAM,CAAA,EAAG,KAAK,GAAG,OAAO,KAAA;AAEvE,EAAA,IAAI,SAAS,IAAA,EAAM;AACjB,IAAA,QAAA,CAAS,MAAA,GAAS,GAAG,iBAAiB,CAAA,gDAAA,CAAA;AACtC,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,KAAA,GAAQ,kBAAA,CAAmB,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA;AACtD,EAAA,QAAA,CAAS,SAAS,CAAA,EAAG,iBAAiB,CAAA,CAAA,EAAI,KAAK,qBAAqB,oBAAoB,CAAA,cAAA,CAAA;AACxF,EAAA,OAAO,IAAA;AACT;AAOO,SAAS,eAAA,GAA2B;AACzC,EAAA,MAAM,QAAQ,YAAA,EAAa;AAC3B,EAAA,OAAO,KAAA,KAAU,MAAA,GAAY,KAAA,GAAQ,gBAAA,CAAiB,KAAK,CAAA;AAC7D;;;AC7RO,SAAS,sBAAsB,KAAA,EAAuB;AAC3D,EAAA,OAAO,MACJ,OAAA,CAAQ,IAAA,EAAM,SAAS,CAAA,CACvB,OAAA,CAAQ,MAAM,SAAS,CAAA,CACvB,QAAQ,IAAA,EAAM,SAAS,EACvB,OAAA,CAAQ,SAAA,EAAW,SAAS,CAAA,CAC5B,OAAA,CAAQ,WAAW,SAAS,CAAA;AACjC;;;ACRA,IAAM,eAAA,GAAkB,uBAAA;AAcjB,SAAS,QAAQ,GAAA,EAAiC;AACvD,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAQ,MAAA,CAAA,IAAA,CAAwE,GAAA,GACpF,GACF,CAAA;AACA,IAAA,IAAI,MAAM,OAAO,IAAA;AAAA,EACnB,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,OAAO,OAAA,KAAY,WAAA,GAAc,OAAA,CAAQ,GAAA,GAAM,GAAG,CAAA,GAAI,MAAA;AAC/D;AAOO,SAAS,iBAAA,GAAgC;AAC9C,EAAA,MAAM,WAAW,qBAAA,EAAsB;AACvC,EAAA,MAAM,EAAE,OAAA,EAAS,WAAA,EAAY,GAAI,eAAA,EAAgB;AACjD,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,QAAA,CAAS,OAAA,IAAW,OAAA,CAAQ,cAAc,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMnD,eAAA,EACE,QAAA,CAAS,eAAA,IACT,OAAA,KACC,mBAAA,CAAoB,WAAW,CAAA,GAAI,WAAA,GAAc,IAAA,CAAA,IAClD,OAAA,CAAQ,mBAAmB;AAAA,GAC/B;AACF;AAWO,SAAS,qBAAA,GAAoC;AAClD,EAAA,MAAM,MAAA,GAAS,UAAA;AACf,EAAA,OAAO,MAAA,CAAO,eAAe,CAAA,IAAK,EAAC;AACrC;AAMO,SAAS,sBAAA,CAAuB,GAAA,GAAkB,iBAAA,EAAkB,EAAkB;AAC3F,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA,CAAE,MAAA,CAAO,CAAC,GAAG,KAAK,CAAA,KAAM,OAAA,CAAQ,KAAK,CAAC,CAAA;AACpE,EAAA,IAAI,CAAC,GAAA,CAAI,MAAA,EAAQ,OAAO,IAAA;AACxB,EAAA,MAAM,IAAA,GAAO,sBAAsB,IAAA,CAAK,SAAA,CAAU,OAAO,WAAA,CAAY,GAAG,CAAC,CAAC,CAAA;AAC1E,EAAA,OAAO,CAAA,OAAA,EAAU,eAAe,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,CAAA;AAC1C;;;AC5BO,SAAS,uBAAuB,QAAA,EAA2B;AAChE,EAAA,IAAI,UAAU,OAAO,QAAA;AAErB,EAAA,MAAM,EAAE,OAAA,EAAS,WAAA,EAAY,GAAI,eAAA,EAAgB;AACjD,EAAA,IAAI,SAAS,OAAO,OAAA;AAEpB,EAAA,MAAM,QAAA,GAAW,uBAAsB,CAAE,eAAA;AACzC,EAAA,IAAI,UAAU,OAAO,QAAA;AAErB,EAAA,IAAI,mBAAA,CAAoB,WAAW,CAAA,EAAG,OAAO,WAAA;AAI7C,EAAA,MAAM,cAAc,OAAO,MAAA,KAAW,WAAA,GAAc,MAAA,CAAO,SAAS,IAAA,GAAO,IAAA;AAC3E,EAAA,IAAI,mBAAA,CAAoB,WAAW,CAAA,EAAG,OAAO,WAAA;AAE7C,EAAA,OAAO,OAAA,CAAQ,mBAAmB,CAAA,IAAK,OAAA,CAAQ,cAAc,CAAA,IAAK,EAAA;AACpE;;;AC/DA,IAAM,SAAA,GAAY,OAAO,MAAA,KAAW,WAAA;AAc7B,SAAS,mBAAmB,QAAA,EAA2B;AAC5D,EAAA,OAAO,uBAAuB,QAAQ,CAAA;AACxC;AAKO,SAAS,WAAA,GAA+C;AAC7D,EAAA,IAAI,CAAC,WAAW,OAAO,MAAA;AACvB,EAAA,OAAO,MAAA,CAAO,KAAA;AAChB;AAoBO,SAAS,cAAc,MAAA,EAAsB;AAClD,EAAA,MAAM,MAAM,WAAA,EAAY;AACxB,EAAA,IAAI,CAAC,GAAA,IAAO,CAAC,MAAA,EAAQ;AACrB,EAAA,IAAI;AACF,IAAA,GAAA,CAAI,IAAA,EAAM,YAAY,MAAM,CAAA;AAC5B,IAAA,GAAA,CAAI,GAAA,EAAK,SAAA,GAAY,iBAAA,EAAmB,MAAM,CAAA;AAG9C,IAAA,GAAA,CAAI,MAAA,EAAQ,GAAA,GAAM,oBAAA,EAAsB,MAAM,CAAA;AAAA,EAChD,CAAA,CAAA,MAAQ;AAAA,EAER;AACF","file":"chunk-Y5FBDMFV.js","sourcesContent":["export const AUTH_TOKEN_COOKIE_NAME = 'token';\nexport const SCOPE_COOKIE_NAME = 'scope';\n\n/**\n * Which store this request is for, when the hostname does not say.\n *\n * A live storefront is reached at its own domain, so the hostname identifies it\n * and nothing else is needed. A preview is not: every theme under review is\n * served from the one preview hostname, so the store has to be named some other\n * way — the dispatcher takes it from `?storeId=` and puts it here, the same way\n * it remembers which theme to serve.\n *\n * Written by the dispatcher rather than the theme, and set on the *forwarded\n * request* as well as the response, because the response cookie only arrives in\n * time for the second page load and the first one has to render too.\n *\n * The literal is a contract with `STORE_COOKIE` in store-front-dispacher\n * (`src/dispatch/preview.ts`), and **nothing checks the two agree**. Drift does\n * not fail loudly — it renders somebody else's shop. Grep both repos before\n * changing it.\n */\nexport const STORE_ID_COOKIE_NAME = 'salla_sid';\n\n/** Query parameter naming the store, on a host that serves more than one. */\nexport const STORE_ID_PARAM = 'storeId';\n\n/**\n * A store id is an integer, and anything else is not a store id.\n *\n * Validated rather than passed through because this value ends up in an upstream\n * API path. Leading zeroes, signs, decimals and whitespace are all rejected: the\n * point is a single canonical form, not the widest set of things that could be\n * coerced into a number.\n */\nexport function parseStoreId(raw: string | null | undefined): string | null {\n  if (!raw) return null;\n  return /^[1-9][0-9]{0,18}$/.test(raw) ? raw : null;\n}\n\n/** The store id the dispatcher left in the cookie, or null when absent or malformed. */\nexport function extractStoreIdFromCookies(cookieHeader: string | null): string | null {\n  return parseStoreId(extractTokenFromCookies(cookieHeader, STORE_ID_COOKIE_NAME));\n}\n\n/**\n * The only hosts on which a request may name its own store.\n *\n * **This is a security boundary, not a convenience.** On a merchant's own domain\n * the hostname *is* the store, and it is the only thing that may decide. A theme\n * that also honoured `?storeId=` there would let anyone open\n * `https://reefperfumes.com/?storeId=<someone else>` and be served a different\n * merchant's shop from the domain its owner controls — their branding, their\n * customers' address bar, somebody else's catalogue — and the cookie would keep\n * serving it for the rest of that browser's session. Salla points SaaS domains\n * at this dispatcher, so those hostnames are real and reachable.\n *\n * The override exists for one situation: a host that serves many stores and so\n * cannot identify one from its name. That is the preview host, where every theme\n * under review answers on the same address, and local development.\n *\n * Adding an entry grants that host the ability to render any store on request.\n * Add nothing that a merchant's traffic reaches.\n */\nexport const STORE_ID_HOSTS: readonly string[] = ['preview.salla.design'];\n\n/** The hostname alone — a port never distinguishes one host's authority from another's. */\nfunction hostnameOf(host: string): string {\n  const trimmed = host.trim().toLowerCase();\n  // IPv6 literals are bracketed, and the colons inside them are not a port.\n  if (trimmed.startsWith('[')) return trimmed.slice(0, trimmed.indexOf(']') + 1) || trimmed;\n  const colon = trimmed.indexOf(':');\n  return colon === -1 ? trimmed : trimmed.slice(0, colon);\n}\n\nfunction isLoopback(hostname: string): boolean {\n  return (\n    hostname === 'localhost' ||\n    hostname === '127.0.0.1' ||\n    hostname === '[::1]' ||\n    hostname.endsWith('.localhost')\n  );\n}\n\n/**\n * Whether this host is allowed to let the request choose a store.\n *\n * Deliberately an allowlist of exact hostnames plus loopback. No suffix matching:\n * a rule like \"anything ending in salla.design\" is one wildcard DNS record away\n * from admitting a host nobody meant to admit, and the list of hosts that serve\n * more than one store is short and known.\n */\nexport function allowsRequestStoreId(host: string | null | undefined): boolean {\n  if (!host) return false;\n  const hostname = hostnameOf(host);\n  return STORE_ID_HOSTS.includes(hostname) || isLoopback(hostname);\n}\n\n/**\n * Whether this host *is* a store, so its name can be used as the identifier.\n *\n * The exact inverse of {@link allowsRequestStoreId}, and deliberately written as\n * one so the two can never disagree: a host that may name its store is a host\n * that serves more than one, and a host that serves more than one cannot be the\n * answer to \"which store is this?\". `preview.salla.design` and `localhost:5188`\n * are not shops; asking the API about them earns a 422 and a page that reads as\n * a broken theme.\n */\nexport function hostIdentifiesStore(host: string | null | undefined): boolean {\n  return Boolean(host) && !allowsRequestStoreId(host);\n}\n\n/**\n * The store this request names, on a host permitted to name one.\n *\n * The host check is inside this function rather than at its call site, because a\n * call site is a thing someone can add without reading this comment. There is no\n * way to ask \"what store did the request name?\" without also asking \"is this a\n * host that may say?\" — get it wrong and the answer is a security bug that looks\n * like a feature.\n *\n * Between the two permitted sources the URL wins, the same precedence the\n * dispatcher uses for the theme and for the same reason: a link is how someone\n * switches, and a cookie they cannot see should never beat the address they\n * just typed.\n */\nexport function resolveRequestStoreId(\n  url: string,\n  cookieHeader: string | null,\n  host: string | null | undefined\n): string | null {\n  if (!allowsRequestStoreId(host)) return null;\n\n  let fromQuery: string | null = null;\n  try {\n    fromQuery = parseStoreId(new URL(url).searchParams.get(STORE_ID_PARAM));\n  } catch {\n    /* a relative or malformed URL simply names no store */\n  }\n  return fromQuery ?? extractStoreIdFromCookies(cookieHeader);\n}\n\n/**\n * Deletes the auth `token` cookie. This cookie is written client-side by the theme\n * (TwilightProvider), not by the SDK — `salla.cookie.clearAll()` only clears its own\n * allowlist and leaves `token` behind — so logout must clear it here. Client-only.\n */\nexport function clearAuthTokenCookie(): void {\n  if (typeof document === 'undefined') return;\n  document.cookie = `${AUTH_TOKEN_COOKIE_NAME}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/`;\n}\n\nexport function extractTokenFromCookies(\n  cookieHeader: string | null,\n  cookieName: string\n): string | null {\n  if (!cookieHeader) return null;\n\n  const prefix = `${cookieName}=`;\n  let start = 0;\n\n  while (start < cookieHeader.length) {\n    const idx = cookieHeader.indexOf(prefix, start);\n    if (idx === -1) return null;\n\n    const prevChar = idx > 0 ? cookieHeader[idx - 1] : '';\n    if (prevChar === '' || prevChar === ';' || prevChar === ' ') {\n      let end = cookieHeader.indexOf(';', idx);\n      if (end === -1) end = cookieHeader.length;\n\n      const value = cookieHeader.slice(idx + prefix.length, end).trim();\n      try {\n        return decodeURIComponent(value) || null;\n      } catch {\n        return value || null;\n      }\n    }\n\n    start = idx + prefix.length;\n  }\n\n  return null;\n}\n\n/**\n * The scope the Salla SDK persists as `scope`: the market (`id`/`type`) plus, once\n * bullet delivery confirms an address or branch, the allocation. The SDK sends all\n * four as request headers (`s-scope-id`, `s-scope-type`, `s-scope-allocation-type`,\n * `s-scope-allocation-id`) and the API resolves stock per allocation — a scope sent\n * without its allocation is a different question, answered from a different branch.\n */\nexport interface ActiveScope {\n  id: string;\n  type?: string;\n  allocation_type?: string;\n  allocation_id?: string;\n}\n\n/** The SDK stores the scope either as its full object or as a bare id. */\nfunction normalizeScope(raw: unknown): ActiveScope | null {\n  if (raw == null) return null;\n  if (typeof raw !== 'object') return { id: String(raw) };\n  const s = raw as Record<string, unknown>;\n  if (s.id == null) return null;\n  const scope: ActiveScope = { id: String(s.id) };\n  if (s.type != null) scope.type = String(s.type);\n  if (s.allocation_type != null) scope.allocation_type = String(s.allocation_type);\n  if (s.allocation_id != null) scope.allocation_id = String(s.allocation_id);\n  return scope;\n}\n\n/**\n * Reads the active scope from the `scope` cookie, which Salla persists as a JSON\n * object (e.g. `{\"id\":123,\"type\":\"scope\",\"allocation_type\":\"branch\",\"allocation_id\":\"9\"}`).\n * Returns null when the cookie is missing or unparseable. Used server-side, where\n * `salla.storage` is absent.\n */\nexport function extractScopeFromCookies(cookieHeader: string | null): ActiveScope | null {\n  const raw = extractTokenFromCookies(cookieHeader, SCOPE_COOKIE_NAME);\n  if (!raw) return null;\n  try {\n    return normalizeScope(JSON.parse(raw));\n  } catch {\n    return null;\n  }\n}\n\n/** {@link extractScopeFromCookies} reduced to the id. */\nexport function extractScopeIdFromCookies(cookieHeader: string | null): string | null {\n  return extractScopeFromCookies(cookieHeader)?.id ?? null;\n}\n\n/**\n * The scope the Salla SDK persisted in its storage (`salla.storage.get('scope')`).\n *\n * Returns `undefined` when the SDK storage API isn't ready yet — deliberately\n * distinct from `null` (\"no branch selected\"), so callers can't mistake a\n * not-yet-hydrated SDK for a cleared selection. Client-only.\n */\nexport function readSdkScope(): ActiveScope | null | undefined {\n  const storage = typeof window !== 'undefined' ? window.salla?.storage : undefined;\n  if (typeof storage?.get !== 'function') return undefined;\n  return normalizeScope(storage.get(SCOPE_COOKIE_NAME));\n}\n\n/** {@link readSdkScope} reduced to the id; keeps the not-ready/none distinction. */\nexport function readSdkScopeId(): string | null | undefined {\n  const scope = readSdkScope();\n  return scope === undefined ? undefined : (scope?.id ?? null);\n}\n\n/** One year — the SDK keeps the selected branch in localStorage indefinitely. */\nconst SCOPE_COOKIE_MAX_AGE = 60 * 60 * 24 * 365;\n\nconst sameScope = (a: ActiveScope | null, b: ActiveScope | null): boolean =>\n  JSON.stringify(a) === JSON.stringify(b);\n\n/**\n * Mirrors the scope the Salla SDK selected into the `scope` cookie so the SERVER\n * can see it. The SDK persists the selection in localStorage ONLY and writes no\n * cookie, so without this the server computes scope=null for every visitor who\n * picked a branch while the client computes the branch id — the dehydrated settings\n * query key never matches and the client refetches store settings on every page\n * load (SAL-122).\n *\n * Written in the SDK's own JSON shape so {@link extractScopeFromCookies} parses it,\n * allocation included: the bullet-delivery component writes the same cookie with the\n * full object, and rewriting it with the id alone would drop the branch the server\n * needs. Returns true when the cookie was (re)written. Client-only; no-op on the server.\n */\nexport function writeScopeCookie(scope: ActiveScope | null): boolean {\n  if (typeof document === 'undefined') return false;\n  if (sameScope(extractScopeFromCookies(document.cookie), scope)) return false;\n\n  if (scope == null) {\n    document.cookie = `${SCOPE_COOKIE_NAME}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/`;\n    return true;\n  }\n\n  const value = encodeURIComponent(JSON.stringify(scope));\n  document.cookie = `${SCOPE_COOKIE_NAME}=${value}; path=/; max-age=${SCOPE_COOKIE_MAX_AGE}; samesite=lax`;\n  return true;\n}\n\n/**\n * Keeps the `scope` cookie in step with the SDK's selected branch. Call on every\n * client navigation; it no-ops while the SDK storage API is still hydrating so a\n * late-loading SDK can't wipe a valid cookie.\n */\nexport function syncScopeCookie(): boolean {\n  const scope = readSdkScope();\n  return scope === undefined ? false : writeScopeCookie(scope);\n}\n","/**\n * Escape a JSON-stringified value for safe embedding inside an inline `<script>` body.\n *\n * The head injects script bodies raw, so a `</script>` inside partner-set data would break out\n * of the tag; U+2028/U+2029 are line terminators in JS but not in JSON, so they must go too.\n */\nexport function escapeForInlineScript(value: string): string {\n  return value\n    .replace(/</g, '\\\\u003c')\n    .replace(/>/g, '\\\\u003e')\n    .replace(/&/g, '\\\\u0026')\n    .replace(/\\u2028/g, '\\\\u2028')\n    .replace(/\\u2029/g, '\\\\u2029');\n}\n","import { escapeForInlineScript } from './inline-script';\nimport { getRequestStore } from '../twilight/context';\nimport { hostIdentifiesStore } from './cookies';\n\n/** Where `rootHead` publishes the SSR-resolved env for the browser bundle to read. */\nconst RUNTIME_ENV_KEY = '__SALLA_RUNTIME_ENV__';\n\n/** The env values that must agree between the SSR render and the hydrated client. */\nexport interface RuntimeEnv {\n  /** Store API base — `VITE_API_URL`. */\n  apiBase?: string;\n  /** Store identifier — `VITE_STORE_DOMAIN`. */\n  storeIdentifier?: string;\n}\n\n/**\n * A build-time `import.meta.env` var, falling back to the worker's runtime `process.env`\n * (wrangler `vars`, exposed via the `nodejs_compat_populate_process_env` flag).\n */\nexport function readEnv(key: string): string | undefined {\n  try {\n    const vite = (import.meta as unknown as { env?: Record<string, string | undefined> }).env?.[\n      key\n    ];\n    if (vite) return vite;\n  } catch {\n    /* import.meta.env not available in all environments */\n  }\n  return typeof process !== 'undefined' ? process.env?.[key] : undefined;\n}\n\n/**\n * What this runtime resolves from its own env — server-side that includes the worker vars.\n * Prefers what the server already published, so re-rendering the head during hydration yields\n * the same script instead of dropping it.\n */\nexport function resolveRuntimeEnv(): RuntimeEnv {\n  const injected = getInjectedRuntimeEnv();\n  const { storeId, requestHost } = getRequestStore();\n  return {\n    apiBase: injected.apiBase || readEnv('VITE_API_URL'),\n    // The request outranks the build-time var here for the same reason it does\n    // in `resolveStoreIdentifier`, and this is the copy that reaches the\n    // browser: publish the store SSR actually rendered, or hydration resolves\n    // again from a URL whose `?storeId=` the dispatcher has already stripped and\n    // queries a different store than the markup it is hydrating.\n    storeIdentifier:\n      injected.storeIdentifier ||\n      storeId ||\n      (hostIdentifiesStore(requestHost) ? requestHost : null) ||\n      readEnv('VITE_STORE_DOMAIN'),\n  };\n}\n\n/**\n * The env the SSR worker resolved, as handed to the browser by `rootHead`. Empty on the server\n * and on a client whose head carried nothing.\n *\n * Worker `vars` are *runtime* env: they live in `process.env` on the server only, while\n * `import.meta.env` is substituted at build time. A bundle built without those vars therefore\n * sees `undefined` in the browser and silently falls back to the production defaults — SSR\n * would render off the configured backend while every post-hydration fetch hits another one.\n */\nexport function getInjectedRuntimeEnv(): RuntimeEnv {\n  const holder = globalThis as typeof globalThis & { [RUNTIME_ENV_KEY]?: RuntimeEnv };\n  return holder[RUNTIME_ENV_KEY] ?? {};\n}\n\n/**\n * Inline head `<script>` body publishing the server-resolved env, or null when there is nothing\n * to publish (no overrides configured — the defaults already agree on both sides).\n */\nexport function renderRuntimeEnvScript(env: RuntimeEnv = resolveRuntimeEnv()): string | null {\n  const set = Object.entries(env).filter(([, value]) => Boolean(value));\n  if (!set.length) return null;\n  const json = escapeForInlineScript(JSON.stringify(Object.fromEntries(set)));\n  return `window.${RUNTIME_ENV_KEY}=${json};`;\n}\n","/**\n * @fileoverview Which store to ask about — the one answer, in one place.\n *\n * This lived in two places once. `api/store.ts` learned to read the store a\n * request names, and `utils/sdk-helpers.ts` — the copy `api/client.ts` actually\n * sets the `store-identifier` header from — did not. So the resolver that had\n * been taught the answer was consulted for a null check and thrown away, every\n * outgoing request carried an empty identifier, the API answered\n * `422 Store Identifier not found`, and every published theme rendered\n * \"Store Unavailable\" while its tests passed: the client's suite mocked the\n * resolver, and the resolver's suite never went near a request.\n *\n * Hence one module, imported by both. If a third place ever needs a store\n * identifier, it imports this — a second implementation is the bug, not a\n * refactor away from it.\n *\n * See `docs/store-identity.md` for the full picture, including the security\n * boundary on who may name a store.\n */\nimport { getRequestStore } from '../twilight/context';\nimport { hostIdentifiesStore } from './cookies';\nimport { getInjectedRuntimeEnv, readEnv } from './runtime-env';\n\n/**\n * Which store to ask about, in the order the answers can be trusted.\n *\n * A deployed theme worker is published with **no vars and no bindings** — the\n * script metadata carries `main_module`, compatibility settings, assets and tags\n * and nothing else — so `VITE_STORE_DOMAIN` exists only where a build baked it\n * in, which is local development. In production this function used to reach the\n * end of that chain and return the empty string, `store.settings` refused to\n * call with no identifier, and the root loader threw \"Store Unavailable\" — a\n * theme that renders its own failure page for every visitor of every store.\n *\n * The order:\n *\n * 1. what the caller passed, which is always deliberate;\n * 2. the store this request names — the `?storeId=` a preview was opened with,\n *    then the cookie remembering it — seeded by `twilightMiddleware`, and only\n *    on a host permitted to name one;\n * 3. what SSR already resolved and published, so the hydrated client asks about\n *    the same store the server rendered instead of resolving again from a URL\n *    that no longer names it;\n * 4. the request's own host, which *is* the identity of a live storefront —\n *    but only when that host is a storefront. `preview.salla.design` and\n *    `localhost` serve many stores, so their names identify none;\n * 5. `VITE_STORE_DOMAIN`, last, because a build-time constant is a development\n *    convenience and must never outrank what the request actually said.\n */\nexport function resolveStoreIdentifier(explicit?: string): string {\n  if (explicit) return explicit;\n\n  const { storeId, requestHost } = getRequestStore();\n  if (storeId) return storeId;\n\n  const injected = getInjectedRuntimeEnv().storeIdentifier;\n  if (injected) return injected;\n\n  if (hostIdentifiesStore(requestHost)) return requestHost as string;\n\n  // The browser's own address, for a client render that reached neither of the\n  // above — a live storefront, where the host is the store.\n  const browserHost = typeof window !== 'undefined' ? window.location.host : null;\n  if (hostIdentifiesStore(browserHost)) return browserHost as string;\n\n  return readEnv('VITE_STORE_DOMAIN') || readEnv('STORE_DOMAIN') || '';\n}\n","export type { StoreContext } from '../api/store';\nimport { resolveStoreIdentifier } from './store-identity';\n\nconst isBrowser = typeof window !== 'undefined';\n\n/**\n * Which store to ask the API about — see {@link resolveStoreIdentifier}.\n *\n * A delegation, not a second implementation. This name is the one on the wire\n * (`api/client.ts` sets the `store-identifier` header from it) and the one\n * themes import from `@salla.sa/twilight-theme-engine/utils`, so it stays; what\n * it must never do again is answer differently from the resolver everything\n * else asks. It had its own copy of the order once, missing the store the\n * request names and preferring the build-time `VITE_STORE_DOMAIN` that a\n * deployed worker does not have — so every published theme sent an empty\n * identifier and rendered \"Store Unavailable\".\n */\nexport function getStoreIdentifier(explicit?: string): string {\n  return resolveStoreIdentifier(explicit);\n}\n\n/**\n * Get Salla SDK instance if available\n */\nexport function getSallaSDK(): typeof window.salla | undefined {\n  if (!isBrowser) return undefined;\n  return window.salla;\n}\n\n/**\n * Push the active route locale onto the Salla SDK.\n *\n * Why this is needed (and why it must run on every navigation):\n *  - The SDK seeds its locale from `navigator.language` — the theme sets no `s-lang`\n *    cookie or `window.locale` — so an English browser starts the SDK in `en` even on\n *    an `/ar` store.\n *  - The SDK fixes its axios `accept-language` header ONCE, at init. `salla.lang.setLocale`\n *    only swaps UI translations (it never touches the header), and `salla.init()` is a\n *    no-op after `Salla.status === 'ready'`, so the header never refreshes on its own.\n *  - `profile::info.fetched` (login / profile refresh on navigation) overrides the header\n *    to the *account's* language.\n *\n * Net result without this: `salla.api.*` calls (cart/product details) return data in the\n * wrong locale — e.g. English cart item names on `/ar/cart` — intermittently, depending on\n * load order and whether a profile fetch ran. Re-asserting the URL locale here keeps the\n * header correct. No-op on the server and until the SDK exposes the methods.\n */\nexport function syncSdkLocale(locale: string): void {\n  const sdk = getSallaSDK();\n  if (!sdk || !locale) return;\n  try {\n    sdk.lang?.setLocale?.(locale);\n    sdk.api?.setHeader?.('accept-language', locale);\n    // The localization modal swaps `/${user.language_code}/` in the URL on submit;\n    // the SDK never sets this locally, so without it the switch reloads the same page.\n    sdk.config?.set?.('user.language_code', locale);\n  } catch {\n    // SDK partially loaded — the header is re-asserted on the next navigation.\n  }\n}\n"]}

package/dist/chunk-Z2BE6MDB.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/api/store.ts"],"names":[],"mappings":";;;;;AAQA,IAAM,qBAAA,GAAwB;AAAA,EAC5B,OAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA,gBAAA;AAAA,EACA,mBAAA;AAAA,EACA,YAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,iBAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAA;AAmDA,SAAS,iBAAiB,SAAA,EAA8D;AACtF,EAAA,IAAI,CAAC,WAAW,OAAO,MAAA;AAGvB,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA,CAAE,GAAA,CAAI,CAAC,IAAA,MAAU,EAAE,QAAA,EAAU,IAAA,CAAK,IAAA,EAAM,GAAG,MAAK,CAAE,CAAA;AAClF;AAEO,IAAM,KAAA,GAAQ;AAAA,EACnB,QAAA,EAAU,OAAO,eAAA,KAA2D;AAC1E,IAAA,MAAM,UAAA,GAAa,mBAAmB,sBAAA,EAAuB;AAE7D,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,OAAA,CAAQ,KAAK,gDAAgD,CAAA;AAC7D,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,MAAM,aAAA,GAAgB,qBAAA,CAAsB,GAAA,CAAI,CAAC,CAAA,KAAM,aAAa,CAAC,CAAA,CAAE,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AACjF,IAAA,MAAM,UAAU,gBAAA,EAAiB;AACjC,IAAA,MAAM,SAAS,OAAA,IAAW,IAAA,GAAO,GAAG,aAAa,CAAA,OAAA,EAAU,OAAO,CAAA,CAAA,GAAK,aAAA;AAEvE,IAAA,IAAI;AACF,MAAA,MAAM,OAAO,MAAM,GAAA,CAKhB,GAAA,CAAI,CAAA,eAAA,EAAkB,MAAM,CAAA,CAAA,EAAI;AAAA,QAC/B,OAAA,EAAS,GAAA;AAAA,QACT,OAAA,EAAS,EAAE,CAAC,uBAAuB,GAAG,UAAA;AAAW,OAClD,EACA,IAAA,EAAqC;AAExC,MAAA,MAAM,OAAO,IAAA,EAAM,IAAA;AACnB,MAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAGlB,MAAA,MAAM,SAAA,GAAY,gBAAA,CAAiB,IAAA,CAAK,SAAS,CAAA;AAEjD,MAAA,OAAO;AAAA,QACL,OAAO,IAAA,CAAK,KAAA;AAAA,QACZ,OAAO,IAAA,CAAK,KAAA;AAAA,QACZ,SAAA;AAAA,QACA,YAAY,IAAA,CAAK,UAAA;AAAA,QACjB,mBAAmB,IAAA,CAAK,iBAAA;AAAA,QACxB,SAAS,IAAA,CAAK,OAAA;AAAA,QACd,OAAO,IAAA,CAAK,KAAA;AAAA,QACZ,WAAW,IAAA,CAAK,SAAA;AAAA,QAChB,YAAY,IAAA,CAAK;AAAA,OACnB;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,OAAA,CAAQ,KAAA,CAAM,4BAA4B,KAAK,CAAA;AAC/C,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF,CAAA;AAAA,EAEA,OAAA,EAAS;AAAA,IACP,QAAA,EAAU,CAAC,eAAA,KACT,YAAA,CAAkC;AAAA,MAChC,QAAA,EAAU;AAAA,QACR,OAAA;AAAA,QACA,UAAA;AAAA,QACA,eAAA;AAAA,QACA,oBAAmB,CAAE,MAAA;AAAA,QACrB,cAAA;AAAe,OACjB;AAAA,MACA,OAAA,EAAS,MAAM,KAAA,CAAM,QAAA,CAAS,eAAe;AAAA,KAC9C;AAAA;AAEP","file":"chunk-Z2BE6MDB.js","sourcesContent":["import { queryOptions } from '@tanstack/react-query';\nimport { api, getActiveScope, getActiveScopeId, STORE_IDENTIFIER_HEADER } from './client';\nimport type { Store, Theme, Language } from '../types';\nimport { getTwilightContext } from '../twilight/context';\nimport { resolveStoreIdentifier } from '../utils/store-identity';\n\nexport { resolveStoreIdentifier };\n\nconst DEFAULT_INCLUDE_ITEMS = [\n  'store',\n  'settings',\n  'theme',\n  'theme_settings',\n  'external_services',\n  'currencies',\n  'languages',\n  'payments',\n  'product_widgets',\n  'rating',\n  'ratings',\n];\n\n/**\n * Raw API response for settings endpoint.\n * Languages come as object: { \"AR\": { code, name, ... }, \"EN\": {...} }\n */\ninterface SettingsApiResponse {\n  store?: Store;\n  theme?: Theme;\n  languages?: Record<string, Language>;\n  currencies?: Record<\n    string,\n    { code: string; name: string; symbol: string; amount: number; country_code: string }\n  >;\n  external_services?: Record<string, unknown>;\n  headers?: Record<string, unknown>;\n  login?: { url: string; turnstile_site_key: string };\n  affiliate?: { utm_url: string; cta_enabled: boolean };\n  debug?: boolean;\n  trace_console?: boolean;\n  policy_url?: string;\n}\n\n/**\n * Central settings context - single source of truth for all API data.\n * Contains everything from the settings endpoint response after processing.\n */\nexport interface StoreContext {\n  store?: Store;\n  theme?: Theme;\n  /** Languages as array after conversion from API object format */\n  languages?: Language[];\n  currencies?: Record<\n    string,\n    { code: string; name: string; symbol: string; amount: number; country_code: string }\n  >;\n  external_services?: Record<string, unknown>;\n  headers?: Record<string, unknown>;\n  login?: { url: string; turnstile_site_key: string };\n  affiliate?: { utm_url: string; cta_enabled: boolean };\n  debug?: boolean;\n  trace_console?: boolean; // todo:: remove it\n  policy_url?: string;\n}\n\n/**\n * Converts languages object from API to array format.\n * API returns: { \"AR\": { code, name, ... }, \"EN\": { ... } }\n * We need: [{ code, name, ... }, { code, name, ... }]\n * todo:: return the languages as object from the APIs to avoid this\n */\nfunction languagesToArray(languages?: Record<string, Language>): Language[] | undefined {\n  if (!languages) return undefined;\n  // The SDK's localization modal reads `lang.iso_code` (not `code`) when a language is\n  // selected — without it the switch navigates to `/undefined/...`.\n  return Object.values(languages).map((lang) => ({ iso_code: lang.code, ...lang }));\n}\n\nexport const store = {\n  settings: async (storeIdentifier?: string): Promise<StoreContext | null> => {\n    const identifier = storeIdentifier ?? resolveStoreIdentifier();\n\n    if (!identifier) {\n      console.warn('[store.settings] No store identifier available');\n      return null;\n    }\n\n    const includeParams = DEFAULT_INCLUDE_ITEMS.map((i) => `include[]=${i}`).join('&');\n    const scopeId = getActiveScopeId();\n    const params = scopeId != null ? `${includeParams}&scope=${scopeId}` : includeParams;\n\n    try {\n      const json = await api\n        // Sent explicitly rather than left to the client's own resolution, so\n        // the identifier this function checked is the identifier that travels.\n        // They agree today; a caller passing one and being answered about\n        // another is the failure this makes impossible rather than unlikely.\n        .get(`store/settings?${params}`, {\n          timeout: 5000,\n          headers: { [STORE_IDENTIFIER_HEADER]: identifier },\n        })\n        .json<{ data?: SettingsApiResponse }>();\n\n      const data = json?.data;\n      if (!data) return null;\n\n      // Convert languages from object to array\n      const languages = languagesToArray(data.languages);\n\n      return {\n        store: data.store,\n        theme: data.theme,\n        languages,\n        currencies: data.currencies,\n        external_services: data.external_services,\n        headers: data.headers,\n        login: data.login,\n        affiliate: data.affiliate,\n        policy_url: data.policy_url,\n      };\n    } catch (error) {\n      console.error('[store.settings] Failed:', error);\n      return null;\n    }\n  },\n\n  queries: {\n    settings: (storeIdentifier?: string) =>\n      queryOptions<StoreContext | null>({\n        queryKey: [\n          'store',\n          'settings',\n          storeIdentifier,\n          getTwilightContext().locale,\n          getActiveScope(),\n        ],\n        queryFn: () => store.settings(storeIdentifier),\n      }),\n  },\n};\n"]}

package/dist/document-class-HFVPENQI.js

@@ -1,23 +0,0 @@
-export { RouteDocumentSync, TanStackDocumentSync, tanstackDocumentAdapter, useTanstackDocumentAttrs } from './chunk-PZCHYB7O.js';
-import './chunk-Z4Y55HWX.js';
-import './chunk-FQGCCV4T.js';
-import './chunk-EV4JSMFZ.js';
-import './chunk-B3EFOE57.js';
-import './chunk-Z2BE6MDB.js';
-import './chunk-GCAIIFF3.js';
-import './chunk-TZ3E5BN4.js';
-import './chunk-TXYT42AU.js';
-import './chunk-LG556DIE.js';
-import './chunk-E3J2RXBS.js';
-import './chunk-MTONGOJD.js';
-import './chunk-WXOABH6J.js';
-import './chunk-Y5FBDMFV.js';
-import './chunk-5ACY5CD3.js';
-import './chunk-JWXJPJBO.js';
-import './chunk-CW625T2E.js';
-import './chunk-TYNZ5B2B.js';
-import './chunk-T72DAX7R.js';
-import './chunk-DF6FBKDN.js';
-import './chunk-DGUM43GV.js';
-//# sourceMappingURL=document-class-HFVPENQI.js.map
-//# sourceMappingURL=document-class-HFVPENQI.js.map