@scayle/storefront-nuxt 8.61.3 → 8.62.1

package/CHANGELOG.md

@@ -1,5 +1,84 @@
 # @scayle/storefront-nuxt
 
+## 8.62.1
+
+### Patch Changes
+
+- **\[Security\]** Use the patched Nuxt for build — `nuxt@3.21.8` (3.x) / `nuxt@4.4.8` (4.x), with matching `@nuxt/kit` and `@nuxt/schema` — which includes the fix for [CVE-2026-53721](https://nvd.nist.gov/vuln/detail/CVE-2026-53721) ([GHSA-mm7m-92g8-7m47](https://github.com/nuxt/nuxt/security/advisories/GHSA-mm7m-92g8-7m47)), a route-rule middleware bypass.
+
+  Compatibility with previously-supported Nuxt versions is unchanged and remains specified via each package's `peerDependencies` and the Nuxt compatibility flag. `@scayle/storefront-core` is released in lockstep with `@scayle/storefront-nuxt`.
+
+**Dependencies**
+
+**@scayle/storefront-core v8.62.1**
+
+- No changes in this release.
+
+## 8.62.0
+
+### Minor Changes
+
+- **\[Promotions\]** Enabled promotion segmentation on the client for `usePromotions`, `useCurrentPromotions`, and `usePromotionsByIds`.
+
+  These composables inject `segmentation: true` when `import.meta.client` is true, so logged-in shoppers receive promotions tailored to their customer segment without passing the flag manually. Server-side calls keep `segmentation: false` and continue to use the cached anonymous promotion list so customer-specific promotions are not stored in shared cache responses.
+
+  The public `params` type omits `segmentation` on these composables so storefront code does not set it directly.
+
+  **\[BREAKING\]** `usePromotionsByIds` now accepts `{ ids: string[] }` for `params` instead of `string[]`.
+  - Before:
+
+    ```ts
+    const { data } = usePromotionsByIds({
+      params: ['promo-1', 'promo-2'],
+    })
+    ```
+
+  - After:
+
+    ```ts
+    const { data } = usePromotionsByIds({
+      params: {
+        ids: ['promo-1', 'promo-2'],
+      },
+    })
+    ```
+
+  Segmentation is applied automatically on the client, same as `usePromotions` and `useCurrentPromotions`.
+
+### Patch Changes
+
+**Dependencies**
+
+**@scayle/storefront-core v8.62.0**
+
+- Minor
+  - **\[Promotions\]** Added customer-segmented promotion fetches when a valid session token is present.
+
+  `getPromotions`, `getCurrentPromotions`, and `getPromotionsByIds` accept a `segmentation` flag. When it is `true` and the request has a non-expired access token, the handlers call the Storefront API with `customerToken` and skip the shared cache so results match the logged-in customer. When it is `false`, handlers use the cached anonymous promotion list so customer-specific promotions are not stored in shared cache responses.
+
+  **\[BREAKING\]** `getPromotionsByIds` now expects `{ ids: string[], segmentation: boolean }` instead of a bare `string[]` array.
+  - Before (custom RPC handler via `context.callRpc`):
+
+    ```ts
+    const promotions = await context.callRpc?.('getPromotionsByIds', [
+      'promo-1',
+      'promo-2',
+    ])
+    ```
+
+  - After:
+
+    ```ts
+    const promotions = await context.callRpc?.('getPromotionsByIds', {
+      ids: ['promo-1', 'promo-2'],
+      segmentation: true,
+    })
+    ```
+
+  Promotion list handlers use `POST` instead of `GET` so `segmentation` and `customerToken` are not sent in the URL.
+
+  **\[User\]** Exported `getValidatedAccessToken` to return a JWT only when it is present and not expired. Basket merge and promotion handlers use it when passing `customerToken` to the Storefront API.
+
 ## 8.61.3
 
 ### Patch Changes

package/dist/module.json

@@ -1,6 +1,6 @@
 {
   "name": "@scayle/storefront-nuxt",
-  "version": "8.61.3",
+  "version": "8.62.1",
   "configKey": "storefront",
   "compatibility": {
     "nuxt": ">=3.13"

package/dist/module.mjs

@@ -57,7 +57,7 @@ export default {
 }`;
 }
 const PACKAGE_NAME = "@scayle/storefront-nuxt";
-const PACKAGE_VERSION = "8.61.3";
+const PACKAGE_VERSION = "8.62.1";
 const logger = createConsola({
   fancy: true,
   formatOptions: {

package/dist/runtime/composables/storefront/useCurrentPromotions.d.ts

@@ -26,6 +26,6 @@ import type { MaybeRefOrGetter } from 'vue';
  *          loading state, and any error information.
  */
 export declare function useCurrentPromotions<DataT = NormalizedRpcResponse<'getCurrentPromotions'>, PickKeys extends KeysOf<DataT> = KeysOf<DataT>, DefaultT = null>({ params, options, }?: Partial<{
-    params: MaybeRefOrGetter<RpcMethodParameters<'getCurrentPromotions'>>;
+    params: MaybeRefOrGetter<Omit<RpcMethodParameters<'getCurrentPromotions'>, 'segmentation'>>;
     options: UseRpcOptions<'getCurrentPromotions', DataT, PickKeys, DefaultT>;
 }>, key?: UseRpcCacheKey): UseRpcReturn<'getCurrentPromotions', DataT, PickKeys, DefaultT>;

package/dist/runtime/composables/storefront/useCurrentPromotions.js

@@ -1,9 +1,16 @@
 import { useRpc } from "../core/useRpc.js";
+import { toValue } from "vue";
 export function useCurrentPromotions({
   params,
   options
 } = {}, key = "useCurrentPromotions") {
-  return useRpc("getCurrentPromotions", key, params, {
+  const paramsWithSegmentation = () => {
+    return {
+      ...toValue(params),
+      segmentation: import.meta.client
+    };
+  };
+  return useRpc("getCurrentPromotions", key, paramsWithSegmentation, {
     getCachedData(cacheKey, nuxtApp) {
       const hydrationData = nuxtApp.isHydrating ? nuxtApp.payload.data[cacheKey] : nuxtApp.static.data[cacheKey];
       return hydrationData ?? nuxtApp._asyncData[cacheKey]?.data.value;

package/dist/runtime/composables/storefront/usePromotions.d.ts

@@ -23,6 +23,6 @@ import type { MaybeRefOrGetter } from 'vue';
  *          loading state, and any error information.
  */
 export declare function usePromotions<DataT = NormalizedRpcResponse<'getPromotions'>, PickKeys extends KeysOf<DataT> = KeysOf<DataT>, DefaultT = null>({ params, options, }?: Partial<{
-    params: MaybeRefOrGetter<RpcMethodParameters<'getPromotions'>>;
+    params: MaybeRefOrGetter<Omit<RpcMethodParameters<'getPromotions'>, 'segmentation'>>;
     options: UseRpcOptions<'getPromotions', DataT, PickKeys, DefaultT>;
 }>, key?: UseRpcCacheKey): UseRpcReturn<'getPromotions', DataT, PickKeys, DefaultT>;

package/dist/runtime/composables/storefront/usePromotions.js

@@ -1,7 +1,14 @@
 import { useRpc } from "../core/useRpc.js";
+import { toValue } from "vue";
 export function usePromotions({
   params,
   options
 } = {}, key = "usePromotions") {
-  return useRpc("getPromotions", key, params, options);
+  const paramsWithSegmentation = () => {
+    return {
+      ...toValue(params),
+      segmentation: import.meta.client
+    };
+  };
+  return useRpc("getPromotions", key, paramsWithSegmentation, options);
 }

package/dist/runtime/composables/storefront/usePromotionsByIds.d.ts

@@ -23,6 +23,6 @@ import type { MaybeRefOrGetter } from 'vue';
  *          loading state, and any error information.
  */
 export declare function usePromotionsByIds<DataT = NormalizedRpcResponse<'getPromotionsByIds'>, PickKeys extends KeysOf<DataT> = KeysOf<DataT>, DefaultT = null>({ params, options, }?: Partial<{
-    params: MaybeRefOrGetter<RpcMethodParameters<'getPromotionsByIds'>>;
+    params: MaybeRefOrGetter<Omit<RpcMethodParameters<'getPromotionsByIds'>, 'segmentation'>>;
     options: UseRpcOptions<'getPromotionsByIds', DataT, PickKeys, DefaultT>;
 }>, key?: UseRpcCacheKey): UseRpcReturn<'getPromotionsByIds', DataT, PickKeys, DefaultT>;

package/dist/runtime/composables/storefront/usePromotionsByIds.js

@@ -1,7 +1,15 @@
 import { useRpc } from "../core/useRpc.js";
+import { toValue } from "vue";
 export function usePromotionsByIds({
   params,
   options
 } = {}, key = "usePromotionsByIds") {
-  return useRpc("getPromotionsByIds", key, params, options);
+  const paramsWithSegmentation = () => {
+    const base = toValue(params);
+    return {
+      ids: base?.ids ?? [],
+      segmentation: import.meta.client
+    };
+  };
+  return useRpc("getPromotionsByIds", key, paramsWithSegmentation, options);
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@scayle/storefront-nuxt",
   "type": "module",
-  "version": "8.61.3",
+  "version": "8.62.1",
   "description": "Nuxt integration for the SCAYLE Commerce Engine and Storefront API",
   "author": "SCAYLE Commerce Engine",
   "license": "MIT",
@@ -68,7 +68,7 @@
   },
   "peerDependencies": {
     "@nuxt/kit": ">=3.13.0 || >=4.2.0",
-    "@scayle/storefront-api": "^19.0.0",
+    "@scayle/storefront-api": "^19.1.2",
     "fishery": "^2.2.2",
     "h3": "^1.10.0",
     "nitropack": "^2.9.7",
@@ -97,35 +97,35 @@
     "vue-router": "^4.4.0",
     "zod": "^4.0.0",
     "@scayle/h3-session": "0.7.0",
-    "@scayle/storefront-core": "8.61.3"
+    "@scayle/storefront-core": "8.62.1"
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.2",
     "@nuxt/eslint-config": "1.15.2",
-    "@nuxt/kit": "^3.20.2",
+    "@nuxt/kit": "^3.21.7",
     "@nuxtjs/i18n": "10.4.0",
     "@nuxt/module-builder": "1.0.2",
-    "@nuxt/schema": "^3.20.2",
+    "@nuxt/schema": "^3.21.7",
     "@nuxt/test-utils": "4.0.0",
     "@scayle/eslint-config-storefront": "^4.8.0",
     "@scayle/eslint-plugin-vue-composable": "^1.1.0",
     "@scayle/unstorage-scayle-kv-driver": "^2.1.0",
     "@types/node": "24.12.2",
-    "@vitest/coverage-v8": "4.1.7",
-    "eslint": "10.4.0",
+    "@vitest/coverage-v8": "4.1.9",
+    "eslint": "10.5.0",
     "eslint-formatter-gitlab": "7.1.0",
     "fishery": "2.4.0",
     "h3": "1.15.11",
-    "happy-dom": "20.9.0",
+    "happy-dom": "20.10.6",
     "nitro-test-utils": "0.11.2",
     "nitropack": "2.13.4",
     "node-mocks-http": "1.17.2",
-    "nuxt": "^3.20.2",
+    "nuxt": "^3.21.7",
     "publint": "0.3.21",
     "typescript": "6.0.3",
     "unbuild": "3.6.1",
-    "vitest": "4.1.7",
-    "vue-tsc": "3.3.2",
+    "vitest": "4.1.9",
+    "vue-tsc": "3.3.5",
     "@scayle/vitest-config-storefront": "1.0.0"
   },
   "scripts": {