@shoppexio/storefront 1.0.71 → 1.0.73

package/dist/index.js

@@ -24,93 +24,8 @@ import {
   url
 } from "./chunk-ZVOFFURI.js";
 
-// ../sdk/src/core/cache.ts
-var cache = /* @__PURE__ */ new Map();
-var pending = /* @__PURE__ */ new Map();
-var stats = {
-  hits: 0,
-  misses: 0
-};
-function isExpired(entry) {
-  return Date.now() > entry.expiresAt;
-}
-function getCacheStats() {
-  return {
-    hits: stats.hits,
-    misses: stats.misses,
-    pendingRequests: pending.size,
-    entries: cache.size
-  };
-}
-function clearCache() {
-  cache.clear();
-  pending.clear();
-}
-function invalidateCache(prefixOrKey) {
-  for (const key of cache.keys()) {
-    if (key === prefixOrKey || key.startsWith(prefixOrKey)) {
-      cache.delete(key);
-    }
-  }
-}
-function setCacheEntry(key, data, ttl) {
-  const now = Date.now();
-  cache.set(key, {
-    data,
-    ttl,
-    updatedAt: now,
-    expiresAt: now + ttl
-  });
-}
-function getCacheEntry(key) {
-  const entry = cache.get(key);
-  if (!entry) return null;
-  return entry;
-}
-async function getOrFetch(key, fetcher, options, shouldCache = () => true) {
-  const entry = getCacheEntry(key);
-  if (entry && !isExpired(entry)) {
-    stats.hits += 1;
-    return entry.data;
-  }
-  if (entry && options.staleWhileRevalidate) {
-    stats.hits += 1;
-    if (!pending.has(key)) {
-      const refreshPromise = (async () => {
-        try {
-          const data = await fetcher();
-          if (shouldCache(data)) {
-            setCacheEntry(key, data, options.ttl);
-          }
-          return data;
-        } finally {
-          pending.delete(key);
-        }
-      })();
-      pending.set(key, refreshPromise);
-    }
-    return entry.data;
-  }
-  if (pending.has(key)) {
-    return pending.get(key);
-  }
-  stats.misses += 1;
-  const promise = (async () => {
-    try {
-      const data = await fetcher();
-      if (shouldCache(data)) {
-        setCacheEntry(key, data, options.ttl);
-      }
-      return data;
-    } finally {
-      pending.delete(key);
-    }
-  })();
-  pending.set(key, promise);
-  return promise;
-}
-
 // ../sdk/src/core/errors.ts
+var CURRENCY_UNAVAILABLE_ERROR_CODE = "errors.storefront.currency_unavailable";
 var ShoppexError = class _ShoppexError extends Error {
   constructor(message, code, statusCode) {
     super(message);
@@ -1031,7 +946,7 @@ var PaymentGatewayStateSchema = object({
 
 // ../contracts/src/style-center.ts
 var CHECKOUT_PLATFORM_BRAND_COLOR = "#7c3aed";
-var CHECKOUT_PLATFORM_FONT_FAMILY = "Geist";
+var CHECKOUT_PLATFORM_FONT_FAMILY = "Inter";
 var checkoutStyleSurfaceValues = ["checkout", "payment_link", "embed"];
 var checkoutStyleDensityValues = ["comfortable", "compact"];
 var checkoutStyleModeValues = ["light", "dark", "system"];
@@ -1078,7 +993,7 @@ var checkoutStyleTokenDefinitions = [
   // `var(--spx-checkout-border, …)` chains loose. The hosted checkout draws
   // almost no hairlines any more — the slots that still do read this, the rest
   // resolve their border to `transparent` in the system CSS.
-  { key: "color.border", cssVar: "--spx-checkout-border", group: "color", type: "color", default: "#2c2c2c" },
+  { key: "color.border", cssVar: "--spx-checkout-border", group: "color", type: "color", default: "#3a3a3a" },
   { key: "color.focus", cssVar: "--spx-checkout-focus", group: "color", type: "color", default: CHECKOUT_PLATFORM_BRAND_COLOR, protected: true },
   { key: "color.success", cssVar: "--spx-checkout-success", group: "color", type: "color", default: "#22c55e", protected: true },
   { key: "color.warning", cssVar: "--spx-checkout-warning", group: "color", type: "color", default: "#f59e0b", protected: true },
@@ -1090,16 +1005,22 @@ var checkoutStyleTokenDefinitions = [
   // actually loaded.
   { key: "typography.googleFontFamily", cssVar: "--spx-checkout-google-font", group: "typography", type: "font", default: "" },
   { key: "typography.baseSize", cssVar: "--spx-checkout-font-size", group: "typography", type: "number", default: 14, min: 12, max: 18, step: 1, unit: "px" },
-  // 12px, not 8, for the same reason as the input below: the hosted pay CTA is
-  // `rounded-xl` and this token is materialised over every slotted button. At 8
-  // the store-credit and manual actions rendered one step tighter than the
-  // field directly above them and than the CTA they stand in for.
-  { key: "shape.buttonRadius", cssVar: "--spx-checkout-button-radius", group: "shape", type: "number", default: 10, min: 0, max: 24, step: 1, unit: "px" },
-  // 12px, not 8: the hosted `Input` primitive is `rounded-lg`, and this token is
-  // materialised over it. At 8 the system CSS rounded every field one step
-  // tighter than the component that drew it.
-  { key: "shape.inputRadius", cssVar: "--spx-checkout-input-radius", group: "shape", type: "number", default: 10, min: 0, max: 24, step: 1, unit: "px" },
-  { key: "shape.cardRadius", cssVar: "--spx-checkout-card-radius", group: "shape", type: "number", default: 10, min: 0, max: 28, step: 1, unit: "px" },
+  // ALL THREE ARE 8, and they have to be — this is one edge, stated in three
+  // places, and the whole reason it is worth a comment is that the three places
+  // are read by three different renderers:
+  //   1. these defaults, materialised into the live checkout root (the `shape`
+  //      group is a foundation group, so an untouched shop still gets them);
+  //   2. `--radius-sm` / `--radius-lg` in apps/checkout/app/globals.css, which
+  //      every component class paints from, both 0.5rem;
+  //   3. the Stripe Appearance object (`buildStripeAppearanceFromCheckoutStyle`),
+  //      which cannot resolve `var()` and is handed these same values as plain
+  //      strings for `borderRadius` and the `.Block` / `.AccordionItem` rules.
+  // A disagreement between any two of them is visible as a card inside the
+  // provider iframe rounded differently from the card around it. Pinned by
+  // `__tests__/checkout-radius-chain.test.ts` in apps/checkout.
+  { key: "shape.buttonRadius", cssVar: "--spx-checkout-button-radius", group: "shape", type: "number", default: 8, min: 0, max: 24, step: 1, unit: "px" },
+  { key: "shape.inputRadius", cssVar: "--spx-checkout-input-radius", group: "shape", type: "number", default: 8, min: 0, max: 24, step: 1, unit: "px" },
+  { key: "shape.cardRadius", cssVar: "--spx-checkout-card-radius", group: "shape", type: "number", default: 8, min: 0, max: 28, step: 1, unit: "px" },
   {
     key: "spacing.density",
     cssVar: "--spx-checkout-density",
@@ -1112,7 +1033,7 @@ var checkoutStyleTokenDefinitions = [
   { key: "component.primaryButton.background", cssVar: "--spx-checkout-button-bg", group: "component", type: "color", default: "", protected: true },
   { key: "component.primaryButton.text", cssVar: "--spx-checkout-button-text", group: "component", type: "color", default: "#ffffff", protected: true },
   { key: "component.input.background", cssVar: "--spx-checkout-input-bg", group: "component", type: "color", default: "#292929" },
-  { key: "component.input.border", cssVar: "--spx-checkout-input-border", group: "component", type: "color", default: "#2c2c2c" },
+  { key: "component.input.border", cssVar: "--spx-checkout-input-border", group: "component", type: "color", default: "#3a3a3a" },
   { key: "component.input.focusRing", cssVar: "--spx-checkout-input-focus-ring", group: "component", type: "color", default: "" },
   // Default '' is filtered out by the preview-iframe normaliser, so the
   // CSS fallback chain on [data-spx-slot="summary.panel"] resolves to
@@ -1126,9 +1047,28 @@ var checkoutStyleTokenDefinitions = [
   { key: "component.paymentMethod.selectedBackground", cssVar: "--spx-checkout-payment-method-selected-bg", group: "component", type: "color", default: "" },
   { key: "component.checkoutHeader.background", cssVar: "--spx-checkout-embed-header-bg", group: "component", type: "color", default: "" },
   { key: "component.checkoutHeader.text", cssVar: "--spx-checkout-embed-header-text", group: "component", type: "color", default: "" },
-  { key: "component.productCard.background", cssVar: "--spx-checkout-product-card-bg", group: "component", type: "color", default: "rgba(255,255,255,0.03)" },
-  { key: "component.productCard.border", cssVar: "--spx-checkout-product-card-border", group: "component", type: "color", default: "rgba(255,255,255,0.06)" },
-  { key: "component.productCard.shadow", cssVar: "--spx-checkout-product-card-shadow", group: "component", type: "shadow", default: "none" },
+  // THE PRODUCT CARD IS GONE FROM THE HOSTED CHECKOUT, and these three tokens
+  // are what is left of it.
+  //
+  // The 2026 rework replaced the boxed summary line item with a FLAT ROW
+  // (`data-spx-slot="product.line"`, apps/checkout/components/checkout/
+  // product-list.tsx). A flat row has no fill of its own, no edge and no cast —
+  // that is the design, not an omission — so there is nothing on the hosted or
+  // payment-link surface for a border or a shadow token to land on. They are
+  // NOT re-pointed at `product.line`: handing a merchant a border control for a
+  // row that must not have a border is a control that can only make the page
+  // worse, and the slot layer would paint it with `!important` where no call
+  // site could undo it.
+  //
+  // `background` is the exception and stays LIVE: the EMBED surface reads
+  // `--spx-checkout-product-card-bg` in `applyCheckoutStyleToEmbedStyles`
+  // (apps/checkout/lib/checkout-style.tsx), where it is the card fill AND the
+  // input to the embed's light/dark inference. It is marked `surface: 'embed'`
+  // so the Style Center offers it where it still does something, and it keeps
+  // being emitted for every stored theme.
+  { key: "component.productCard.background", cssVar: "--spx-checkout-product-card-bg", group: "component", type: "color", default: "rgba(255,255,255,0.03)", surface: "embed" },
+  { key: "component.productCard.border", cssVar: "--spx-checkout-product-card-border", group: "component", type: "color", default: "rgba(255,255,255,0.06)", deprecated: true },
+  { key: "component.productCard.shadow", cssVar: "--spx-checkout-product-card-shadow", group: "component", type: "shadow", default: "none", deprecated: true },
   { key: "component.productImage.background", cssVar: "--spx-checkout-product-image-bg", group: "component", type: "color", default: "rgba(255,255,255,0.06)" },
   { key: "component.productImage.border", cssVar: "--spx-checkout-product-image-border", group: "component", type: "color", default: "rgba(255,255,255,0.04)" },
   { key: "component.productImage.icon", cssVar: "--spx-checkout-product-image-icon", group: "component", type: "color", default: "rgba(250,250,250,0.4)" },
@@ -1208,28 +1148,91 @@ var checkoutStyleControlTokenDefinitions = [
 ];
 var checkoutStyleSlotValues = [
   "checkout.shell",
+  "checkout.chrome",
   "checkout.panel",
   "checkout.header",
+  "checkout.footer",
+  "checkout.trust",
+  "checkout.section.active",
+  "checkout.section.collapsed",
+  "checkout.mobile_pay_bar",
+  // The spacer under the bar, carrying the working column's ground so the last
+  // scroll does not step down onto the shell's.
+  "checkout.mobile_pay_bar_floor",
   "brand.logo",
+  "brand.hero",
+  // RETIRED, AND DELIBERATELY STILL HERE (see the note above). No element
+  // carries `product.card` any more (see `component.productCard.*` above), so a
+  // rule aimed at it is inert, which is the harmless half of the trade.
   "product.card",
+  // What replaced it: the flat summary row. A merchant can reach it for type
+  // and spacing; it has no card material to override, by design.
+  "product.line",
   "product.image",
   "product.title",
   "product.description",
   "product.price",
   "product.quantity",
+  "product.quantity_menu",
+  "product.remove",
   "product.addon",
+  // The "Included" marker a SELECTED add-on carries in place of its "+$9.00".
+  // Its own slot rather than `product.price`, because it is not a figure: the
+  // amount is already inside the line total above it, and a merchant styling
+  // their price column must not accidentally style a word.
+  "product.addon_included",
+  // The line of glyph-led metadata under the product's title in the embed's
+  // order bar — the description trigger plus whichever of the facts below the
+  // product has. Its own slot so a merchant can retune the whole row's rhythm
+  // (or hide it) without reaching into each fact one at a time.
+  "product.facts",
+  // How many are left. It appears in TWO places and deliberately shares one
+  // slot: on the facts row when the product has no variants, and on each option
+  // tile when it does — because with options there is no single stock figure,
+  // only one per option. A merchant styling scarcity means the same thing in
+  // both, and a shop is unlikely to have configured only the one it can see.
+  "product.stock",
+  "product.delivery",
+  // The billing period a recurring line states — "/month" beside the figure,
+  // or the full phrase on the metadata line when the period is not one-per-unit.
+  "product.recurrence",
+  "product.warranty",
   "paymentLink.hero",
   "summary.panel",
   "summary.line",
   "summary.total",
+  // The row that CLOSES the ledger, distinct from `summary.total` (the column's
+  // headline figure) and from `summary.line` (one part of the sum): it is the
+  // sum itself, and it is the only row in the table that draws a rule.
+  "summary.total_line",
+  // What the total does next month, stated directly under it.
+  "summary.recurrence",
+  "summary.total_note",
+  "summary.order_number",
+  "summary.tracking",
+  "summary.tip",
+  "summary.after_payment",
+  // The mobile order summary: a persistent bar that expands into the panel.
+  "summary.mobile_bar",
+  "summary.disclosure",
   "form.field",
   "form.label",
   "form.help",
+  "form.value",
+  "form.error",
+  "form.panel",
+  "form.save",
+  "form.saved",
   "coupon.input",
+  "coupon.applied",
   "input.base",
   "input.error",
+  // The reserved line under an input that holds its message. It is present
+  // whether or not there is something to say, which is the point: no reflow.
+  "input.message_slot",
   "button.primary",
   "button.secondary",
+  "button.blocked",
   "payment.methods",
   "payment.method",
   "payment.method.icon",
@@ -1237,13 +1240,35 @@ var checkoutStyleSlotValues = [
   "payment.method.meta",
   "payment.method.fee",
   "payment.method.indicator",
+  "payment.method.trailing",
+  "payment.method.change",
+  "payment.selected_method",
   "payment.provider_widget",
+  "payment.express_checkout",
+  "payment.paypal_shell",
+  "payment.acknowledgement",
+  "payment.free_completion",
+  "payment.notice",
+  "payment.trial_notice",
+  "payment.blocker_hint",
   "payment.loading",
   "payment.error",
   "payment.warning",
   "legal.terms",
   "status.success",
   "status.processing",
+  "status.details",
+  "status.wait_hint",
+  // The open order kept its gateway: the buyer is told which one, and why the
+  // picker is gone.
+  "status.method_locked",
+  "status.payment_rescue",
+  "status.recovery",
+  "status.delivery_destination",
+  "embed.overlay_root",
+  // The rest of the embed group belongs to the standalone widget bundle, which
+  // no longer carries these names on an element. Kept for the same reason
+  // `product.card` is kept: a stored theme that targets one must still save.
   "embed.launcher",
   "embed.launcher.icon",
   "embed.productCard",
@@ -1266,6 +1291,18 @@ var checkoutStyleProtectedSlotValues = [
   "summary.total",
   "payment.method.label",
   "payment.provider_widget",
+  // The pay control on mobile. It is the only one in the viewport once the
+  // page scrolls, so hiding it hides checkout.
+  "checkout.mobile_pay_bar",
+  // Whole payment routes: express wallets, the PayPal button host, and the
+  // completion control a zero-total order has instead of a gateway.
+  "payment.express_checkout",
+  "payment.paypal_shell",
+  "payment.free_completion",
+  // Disclosures. The acknowledgement is the buyer's consent to an offline
+  // payment; the trial notice is what they will be charged and when.
+  "payment.acknowledgement",
+  "payment.trial_notice",
   "payment.loading",
   "payment.error",
   "payment.warning",
@@ -2000,6 +2037,7 @@ var embedPaymentSessionWireSchema = external_exports.object({
   confirmations_needed: external_exports.number().optional()
 }).passthrough();
 var publicInvoiceWireCustomFieldDefinitionSchema = external_exports.object({
+  collect_after_payment: external_exports.boolean().optional(),
   default_value: external_exports.string().optional(),
   min_length: external_exports.number().optional(),
   name: external_exports.string(),
@@ -2008,6 +2046,17 @@ var publicInvoiceWireCustomFieldDefinitionSchema = external_exports.object({
   required: external_exports.boolean(),
   type: external_exports.string()
 });
+var pendingPostPaymentCustomFieldsSchema = external_exports.object({
+  version: external_exports.literal(1),
+  line_items: external_exports.array(external_exports.object({
+    line_item_id: external_exports.string().uuid(),
+    product_id: external_exports.string().uuid(),
+    product_title: external_exports.string(),
+    fields: external_exports.array(publicInvoiceWireCustomFieldDefinitionSchema.extend({
+      collect_after_payment: external_exports.literal(true)
+    }))
+  }))
+});
 var publicInvoiceWireProductAddonSchema = external_exports.object({
   id: external_exports.string(),
   price: external_exports.number(),
@@ -2044,6 +2093,7 @@ var publicInvoiceWireProductSchema = external_exports.object({
   currency: external_exports.string(),
   custom_fields: unknownRecordSchema.nullable().optional(),
   custom_fields_config: external_exports.array(publicInvoiceWireCustomFieldDefinitionSchema).nullable().optional(),
+  post_payment_custom_fields_config: external_exports.array(publicInvoiceWireCustomFieldDefinitionSchema).nullable().optional(),
   delivery_instruction: external_exports.unknown().optional(),
   delivery_instruction_config: external_exports.unknown().optional(),
   delivery_instruction_label: external_exports.unknown().optional(),
@@ -2352,6 +2402,20 @@ var publicInvoiceWireSchema = external_exports.object({
   buyer_identity: buyerIdentitySchema.nullable().optional(),
   checkout_tipping: checkoutTippingSchema.nullable().optional(),
   country_regulations: external_exports.string().nullable().optional(),
+  /**
+   * THAT a coupon is on the order — never WHICH one.
+   *
+   * The redeemed code has no key on this contract, and none is coming back to
+   * it: this is the wire of the anonymous invoice read, whose only credential
+   * is knowledge of the invoice URL. Coupon codes are merchant-authored and
+   * routinely private (campaign, influencer, single-buyer codes), so naming one
+   * to an unproven reader discloses the merchant's code. The producer withholds
+   * it too — `coupon_code`, `coupon_id` and the raw `discount_breakdown` are all
+   * outside `PUBLIC_INVOICE_FIELDS` — so the summary prints "Coupon −$9.80".
+   *
+   * A buyer-bound lane may name the coupon, but only from a source that proves
+   * the reader: this schema is not it.
+   */
   coupon_applied: external_exports.boolean().optional(),
   crypto_mode: external_exports.string().nullable().optional(),
   crypto_transactions: external_exports.array(cryptoTransactionSchema).optional(),
@@ -2380,6 +2444,7 @@ var publicInvoiceWireSchema = external_exports.object({
   paddle_transaction_id: external_exports.unknown().optional(),
   payment_link_id: external_exports.string().nullable().optional(),
   payment_method_overrides: external_exports.array(paymentMethodOverrideSchema).optional(),
+  pending_custom_fields: pendingPostPaymentCustomFieldsSchema.nullable().optional(),
   payment_session_state: invoicePaymentSessionStateSchema.nullable().optional(),
   polling: pollingSchema,
   pricing_breakdown: pricingBreakdownSchema.nullable().optional(),
@@ -2483,7 +2548,18 @@ var publicInvoiceWireSchema = external_exports.object({
   telegram_stars_payment_note: external_exports.string().nullable().optional(),
   updated_at: external_exports.string().optional(),
   virtual_payments_id: external_exports.string().nullable().optional(),
-  void_details: external_exports.unknown().optional()
+  void_details: external_exports.unknown().optional(),
+  // EU right-of-withdrawal consent (§ 356 Abs. 5 BGB / CRD Art. 16(m)).
+  // `withdrawal_consent_required` is the server's verdict for THIS invoice
+  // (shop opt-in + buyer country + digital deliverables, renewals exempt) and is
+  // REQUIRED on the wire: a missing verdict is a producer bug, not a licence for
+  // the checkout to assume `false` and show a pay button the backend refuses.
+  // The other two are the stored proof — always present, null until the buyer
+  // confirms. The checkout gates on these three and never infers the
+  // requirement itself.
+  withdrawal_consent_at: external_exports.string().nullable(),
+  withdrawal_consent_required: external_exports.boolean(),
+  withdrawal_consent_text_version: external_exports.string().nullable()
 }).catchall(external_exports.unknown());
 var embedCheckoutProductWireSchema = publicInvoiceWireProductSchema.extend({
   available_addons: external_exports.array(publicInvoiceWireAvailableAddonSchema).optional(),
@@ -2508,6 +2584,15 @@ var embedCheckoutInvoiceWireSchema = publicInvoiceWireSchema.extend({
   customer_email: external_exports.string().nullable(),
   checkout_style: checkoutStyleStateSchema.nullable().optional(),
   coupon_id: external_exports.string().nullable().optional(),
+  // Merchant toggle (shop_commerce_settings.coupon_field_always_visible):
+  // render the coupon input expanded instead of behind the "Add coupon code"
+  // trigger. Presentation only — coupon validation is unchanged.
+  //
+  // Required, not optional: the public producer (`InvoiceEnricher`) always
+  // resolves this to a boolean, so an absent field means the producer broke,
+  // not that the merchant left it unset. Failing here beats the checkout
+  // quietly rendering the collapsed default for a shop that turned it on.
+  coupon_field_always_visible: external_exports.boolean(),
   discount_breakdown: unknownRecordSchema.nullable().optional(),
   affiliate_code: external_exports.string().nullable().optional(),
   country: external_exports.string().nullable().optional(),
@@ -2589,6 +2674,32 @@ function resetTypedClient() {
   cachedBaseUrl = null;
 }
 
+// ../sdk/src/utils/requested-currency.ts
+function normalizeRequestedCurrency(value) {
+  const normalized = value?.trim().toUpperCase();
+  return normalized && /^[A-Z]{3}$/.test(normalized) ? normalized : null;
+}
+function getRequestedCurrencyFromLocation() {
+  if (typeof window === "undefined" || !window.location) {
+    return null;
+  }
+  const search = typeof window.location.search === "string" ? window.location.search : "";
+  if (search) {
+    return normalizeRequestedCurrency(new URLSearchParams(search).get("currency"));
+  }
+  const href = typeof window.location.href === "string" ? window.location.href : "";
+  if (!href) {
+    return null;
+  }
+  try {
+    return normalizeRequestedCurrency(
+      new URL(href, "https://storefront.shoppex.local").searchParams.get("currency")
+    );
+  } catch {
+    return null;
+  }
+}
+
 // ../sdk/src/core/config.ts
 var DEFAULT_API_BASE_URL = "https://api.shoppex.io";
 var currentConfig = null;
@@ -2597,20 +2708,29 @@ var DEFAULT_CHECKOUT_BASE_URL = "https://checkout.shoppex.io";
 function initConfig(storeSlug, options) {
   const normalizedShopId = options?.shopId?.trim();
   cachedShopId = normalizedShopId ? normalizedShopId : null;
-  const previousLocale = currentConfig?.locale;
   currentConfig = {
     storeSlug,
     locale: options?.locale,
-    currency: options?.currency,
+    currency: normalizeInitCurrency(options?.currency),
     apiBaseUrl: options?.apiBaseUrl ?? DEFAULT_API_BASE_URL,
     checkoutBaseUrl: options?.checkoutBaseUrl ?? DEFAULT_CHECKOUT_BASE_URL
   };
-  if (previousLocale !== currentConfig.locale) {
-    clearCache();
-  }
   resetTypedClient();
   return currentConfig;
 }
+function normalizeInitCurrency(value) {
+  if (value === void 0 || value.trim() === "") {
+    return void 0;
+  }
+  const normalized = normalizeRequestedCurrency(value);
+  if (!normalized) {
+    throw new ValidationError(
+      `Invalid currency "${value}": pass an ISO 4217 code such as "EUR".`,
+      ["currency"]
+    );
+  }
+  return normalized;
+}
 function getConfig() {
   if (!currentConfig) {
     throw new NotInitializedError();
@@ -3022,6 +3142,92 @@ function resolveStorefrontSocialLinks(store) {
   };
 }
 
+// ../sdk/src/core/cache.ts
+var cache = /* @__PURE__ */ new Map();
+var pending = /* @__PURE__ */ new Map();
+var stats = {
+  hits: 0,
+  misses: 0
+};
+function isExpired(entry) {
+  return Date.now() > entry.expiresAt;
+}
+function getCacheStats() {
+  return {
+    hits: stats.hits,
+    misses: stats.misses,
+    pendingRequests: pending.size,
+    entries: cache.size
+  };
+}
+function clearCache() {
+  cache.clear();
+  pending.clear();
+}
+function invalidateCache(prefixOrKey) {
+  for (const key of cache.keys()) {
+    if (key === prefixOrKey || key.startsWith(prefixOrKey)) {
+      cache.delete(key);
+    }
+  }
+}
+function setCacheEntry(key, data, ttl) {
+  const now = Date.now();
+  cache.set(key, {
+    data,
+    ttl,
+    updatedAt: now,
+    expiresAt: now + ttl
+  });
+}
+function getCacheEntry(key) {
+  const entry = cache.get(key);
+  if (!entry) return null;
+  return entry;
+}
+async function getOrFetch(key, fetcher, options, shouldCache = () => true) {
+  const entry = getCacheEntry(key);
+  if (entry && !isExpired(entry)) {
+    stats.hits += 1;
+    return entry.data;
+  }
+  if (entry && options.staleWhileRevalidate) {
+    stats.hits += 1;
+    if (!pending.has(key)) {
+      const refreshPromise = (async () => {
+        try {
+          const data = await fetcher();
+          if (shouldCache(data)) {
+            setCacheEntry(key, data, options.ttl);
+          }
+          return data;
+        } finally {
+          pending.delete(key);
+        }
+      })();
+      pending.set(key, refreshPromise);
+    }
+    return entry.data;
+  }
+  if (pending.has(key)) {
+    return pending.get(key);
+  }
+  stats.misses += 1;
+  const promise = (async () => {
+    try {
+      const data = await fetcher();
+      if (shouldCache(data)) {
+        setCacheEntry(key, data, options.ttl);
+      }
+      return data;
+    } finally {
+      pending.delete(key);
+    }
+  })();
+  pending.set(key, promise);
+  return promise;
+}
+
 // ../sdk/src/core/endpoint.ts
 var PARAM_PATTERN = /:([A-Za-z0-9_]+)/g;
 function buildEndpoint(template, params) {
@@ -3155,9 +3361,13 @@ var MAX_RETRIES = 2;
 async function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
+function appendQueryParam(url2, key, value) {
+  const separator = url2.includes("?") ? "&" : "?";
+  return `${url2}${separator}${encodeURIComponent(key)}=${encodeURIComponent(value)}`;
+}
 async function request(endpoint, options = {}) {
   const config = options.baseUrl ? null : getConfig();
-  const localeConfig = config ?? (isInitialized() ? getConfig() : null);
+  const audience = config ?? (isInitialized() ? getConfig() : null);
   const {
     method = "GET",
     body,
@@ -3165,25 +3375,27 @@ async function request(endpoint, options = {}) {
     retries,
     baseUrl,
     headers: requestHeaders,
-    cache: cache2
+    cache: cache2,
+    buyerCurrency: pricesInBuyerCurrency = false
   } = options;
   const retryCount = retries ?? (method === "GET" ? MAX_RETRIES : 0);
   const apiBaseUrl = baseUrl ?? config?.apiBaseUrl ?? "";
-  const url2 = `${apiBaseUrl}${endpoint}`;
+  const buyerCurrency = pricesInBuyerCurrency && audience?.currency ? audience.currency : null;
+  const url2 = buyerCurrency ? appendQueryParam(`${apiBaseUrl}${endpoint}`, "currency", buyerCurrency) : `${apiBaseUrl}${endpoint}`;
   const headers = {
     "Content-Type": "application/json",
     Accept: "application/json",
     ...requestHeaders
   };
-  if (typeof localeConfig?.locale === "string" && localeConfig.locale.trim()) {
-    headers["x-shoppex-locale"] = localeConfig.locale.trim();
+  const locale = typeof audience?.locale === "string" && audience.locale.trim() ? audience.locale.trim() : null;
+  if (locale) {
+    headers["x-shoppex-locale"] = locale;
   }
   let lastFailure = null;
   const executeRequest = async () => {
     for (let attempt = 0; attempt <= retryCount; attempt++) {
       let responseReceived = false;
       let responseDefinitive = false;
-      let responseChallenge;
       try {
         const controller = new AbortController();
         const timeoutId = setTimeout(() => controller.abort(), timeout);
@@ -3196,7 +3408,6 @@ async function request(endpoint, options = {}) {
         responseReceived = true;
         clearTimeout(timeoutId);
         const payload = await parseResponsePayload(response);
-        responseChallenge = readResponseChallenge(payload.data);
         if (!response.ok) {
           responseDefinitive = isDefinitiveHttpRefusal(payload.data) && response.status >= 400 && response.status < 500 && response.status !== 408;
           const fallbackHttpMessage = response.statusText ? `HTTP ${response.status}: ${response.statusText}` : `HTTP ${response.status}`;
@@ -3221,8 +3432,7 @@ async function request(endpoint, options = {}) {
           ...mapped,
           responseReceived: true,
           responseDefinitive: data.status >= 400 && data.status < 500 && data.status !== 408,
-          status: response.status,
-          ...responseChallenge ? { challenge: responseChallenge } : {}
+          status: response.status
         };
       } catch (error) {
         let normalizedError = error instanceof Error ? error : new Error(String(error));
@@ -3236,7 +3446,6 @@ async function request(endpoint, options = {}) {
           isTransport: statusCode === void 0 || statusCode === 408,
           responseReceived,
           responseDefinitive,
-          ...responseChallenge ? { challenge: responseChallenge } : {},
           ...normalizedError instanceof ApiError ? {
             code: normalizedError.code,
             ...normalizedError.errorParams ? { errorParams: normalizedError.errorParams } : {}
@@ -3258,13 +3467,12 @@ async function request(endpoint, options = {}) {
       ...lastFailure ? { responseReceived: lastFailure.responseReceived } : {},
       ...lastFailure?.responseDefinitive ? { responseDefinitive: true } : {},
       ...lastFailure?.responseReceived && lastFailure.statusCode !== void 0 ? { status: lastFailure.statusCode } : {},
-      ...lastFailure?.challenge ? { challenge: lastFailure.challenge } : {},
       ...lastFailure?.code ? { code: lastFailure.code } : {},
       ...lastFailure?.errorParams ? { errorParams: lastFailure.errorParams } : {}
     };
   };
   const result = method === "GET" && cache2 && cache2.ttl > 0 ? await getOrFetch(
-    cache2.key ?? `GET:${url2}`,
+    `${locale ?? ""}|${buyerCurrency ?? ""}|${cache2.key ?? `GET:${url2}`}`,
     executeRequest,
     { ttl: cache2.ttl, staleWhileRevalidate: cache2.staleWhileRevalidate },
     (value) => value.success
@@ -3319,25 +3527,6 @@ async function parseResponsePayload(response) {
     return { data: null, rawText: null };
   }
 }
-function readResponseChallenge(payload) {
-  if (!payload || typeof payload !== "object") {
-    return void 0;
-  }
-  const data = payload.data;
-  if (!data || typeof data !== "object") {
-    return void 0;
-  }
-  const challenge = data.challenge;
-  if (!challenge || typeof challenge !== "object") {
-    return void 0;
-  }
-  const provider = challenge.provider;
-  const siteKey = challenge.site_key;
-  if (provider !== "turnstile" || typeof siteKey !== "string" || !siteKey.trim()) {
-    return void 0;
-  }
-  return { provider, siteKey: siteKey.trim() };
-}
 function isDefinitiveHttpRefusal(payload) {
   if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
     return false;
@@ -3393,6 +3582,7 @@ async function getStore() {
       storeSlug: config.storeSlug
     }),
     {
+      buyerCurrency: true,
       cache: {
         key: `store:${config.storeSlug}`,
         ttl: STORE_CACHE_TTL,
@@ -3430,6 +3620,7 @@ async function resolveStoreByDomain(domain, apiBaseUrl) {
     }),
     {
       baseUrl,
+      buyerCurrency: true,
       cache: {
         key: `store:domain:${cleanDomain}`,
         ttl: STORE_CACHE_TTL,
@@ -3466,6 +3657,7 @@ async function getStorefront(options) {
       storeSlug: config.storeSlug
     })}${querySuffix}`,
     {
+      buyerCurrency: true,
       cache: {
         key: `storefront:${config.storeSlug}:${options?.productsLimit ?? "full"}:${options?.productsCursor ?? "start"}`,
         ttl: STORE_CACHE_TTL,
@@ -3563,6 +3755,7 @@ async function getProducts() {
       storeSlug: config.storeSlug
     }),
     {
+      buyerCurrency: true,
       cache: {
         key: `products:${config.storeSlug}`,
         ttl: PRODUCTS_CACHE_TTL,
@@ -3606,6 +3799,7 @@ async function getStorefrontProductsPage(options) {
       storeSlug: config.storeSlug
     })}${querySuffix}`,
     {
+      buyerCurrency: true,
       cache: {
         key: `products:page:${config.storeSlug}:${options?.limit ?? "default"}:${options?.cursor ?? "start"}:${options?.sort ?? "featured"}:${getStorefrontProductsPageCategoryCacheKey(options?.category)}:${options?.hideOutOfStock === true ? "in-stock" : "all-stock"}`,
         ttl: PRODUCTS_CACHE_TTL,
@@ -3637,6 +3831,7 @@ async function getProduct(idOrSlug) {
   const response = await get(
     `${buildEndpoint("/v1/storefront/products/unique/:idOrSlug", { idOrSlug })}${queryParams}`,
     {
+      buyerCurrency: true,
       cache: {
         key: `product:${idOrSlug}:${shopId ?? "no-shop"}`,
         ttl: PRODUCTS_CACHE_TTL,
@@ -3932,32 +4127,6 @@ function ensureCartLineId(item) {
   return { ...item, line_id: computeCartLineId(item) };
 }
 
-// ../sdk/src/utils/requested-currency.ts
-function normalizeRequestedCurrency(value) {
-  const normalized = value?.trim().toUpperCase();
-  return normalized && /^[A-Z]{3}$/.test(normalized) ? normalized : null;
-}
-function getRequestedCurrencyFromLocation() {
-  if (typeof window === "undefined" || !window.location) {
-    return null;
-  }
-  const search = typeof window.location.search === "string" ? window.location.search : "";
-  if (search) {
-    return normalizeRequestedCurrency(new URLSearchParams(search).get("currency"));
-  }
-  const href = typeof window.location.href === "string" ? window.location.href : "";
-  if (!href) {
-    return null;
-  }
-  try {
-    return normalizeRequestedCurrency(
-      new URL(href, "https://storefront.shoppex.local").searchParams.get("currency")
-    );
-  } catch {
-    return null;
-  }
-}
-
 // ../sdk/src/modules/cart.ts
 var STORAGE_KEYS = {
   cart: "cart",
@@ -4539,158 +4708,11 @@ async function quoteCart(coupon, currency) {
   return response;
 }
 
-// ../sdk/src/modules/checkout-challenge.ts
-var TURNSTILE_FRAME_MESSAGE_SOURCE = "shoppex-turnstile";
-var TURNSTILE_FRAME_MESSAGE_VERSION = 1;
-var TURNSTILE_FRAME_READY_TIMEOUT_MS = 1e4;
-function readFrameMessage(value, nonce) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
-  const record2 = value;
-  if (record2.source !== TURNSTILE_FRAME_MESSAGE_SOURCE || record2.version !== TURNSTILE_FRAME_MESSAGE_VERSION || record2.nonce !== nonce || !["ready", "visible", "hidden", "success", "expired", "timeout", "error"].includes(String(record2.type))) return null;
-  if (record2.type === "success" && (typeof record2.token !== "string" || !record2.token.trim())) {
-    return null;
-  }
-  return {
-    type: record2.type,
-    ...typeof record2.token === "string" ? { token: record2.token.trim() } : {}
-  };
-}
-var AUTO_CHALLENGE_INVISIBLE_TIMEOUT_MS = 3e4;
-async function resolveCheckoutChallengeProof(challenge) {
-  if (typeof document === "undefined" || challenge.provider !== "turnstile" || !challenge.siteKey.trim()) {
-    return null;
-  }
-  const host = document.createElement("div");
-  host.setAttribute("data-shoppex-checkout-challenge", "");
-  host.style.position = "fixed";
-  host.style.inset = "0";
-  host.style.display = "none";
-  host.style.alignItems = "center";
-  host.style.justifyContent = "center";
-  host.style.background = "rgba(0, 0, 0, 0.55)";
-  host.style.zIndex = "2147483646";
-  const card = document.createElement("div");
-  card.style.width = "min(340px, 90vw)";
-  card.style.background = "#ffffff";
-  card.style.borderRadius = "12px";
-  card.style.padding = "16px";
-  card.style.boxShadow = "0 12px 40px rgba(0, 0, 0, 0.35)";
-  host.appendChild(card);
-  document.body.appendChild(host);
-  return new Promise((resolve) => {
-    let settled = false;
-    let timeoutId = null;
-    let frame = null;
-    const finish = (token) => {
-      if (settled) return;
-      settled = true;
-      if (timeoutId !== null) window.clearTimeout(timeoutId);
-      frame?.dispose();
-      host.remove();
-      resolve(token);
-    };
-    const armTimeout = () => {
-      timeoutId = window.setTimeout(() => finish(null), AUTO_CHALLENGE_INVISIBLE_TIMEOUT_MS);
-    };
-    try {
-      frame = mountCheckoutChallenge(card, challenge, {
-        onSuccess: (token) => finish(token),
-        // `refresh-expired: auto` renews expired runs on its own; the
-        // invisible-run timeout stays the bound.
-        onExpired: () => {
-        },
-        onUnavailable: () => finish(null),
-        onVisibilityChange: (visible) => {
-          host.style.display = visible ? "flex" : "none";
-          if (visible) {
-            if (timeoutId !== null) {
-              window.clearTimeout(timeoutId);
-              timeoutId = null;
-            }
-          } else if (timeoutId === null && !settled) {
-            armTimeout();
-          }
-        }
-      });
-    } catch {
-      host.remove();
-      resolve(null);
-      return;
-    }
-    armTimeout();
-  });
-}
-function mountCheckoutChallenge(container, challenge, callbacks) {
-  if (challenge.provider !== "turnstile" || !challenge.siteKey.trim()) {
-    throw new Error("Checkout challenge is invalid.");
-  }
-  const win = container.ownerDocument.defaultView;
-  if (!win) throw new Error("Checkout challenge requires a browser document.");
-  const checkoutBaseUrl = getConfig().checkoutBaseUrl;
-  const frameUrl = new URL("/turnstile", checkoutBaseUrl);
-  if (frameUrl.protocol !== "https:" && frameUrl.protocol !== "http:") {
-    throw new Error("Checkout base URL must use http or https.");
-  }
-  const nonce = win.crypto.randomUUID();
-  frameUrl.searchParams.set("site_key", challenge.siteKey.trim());
-  frameUrl.searchParams.set("nonce", nonce);
-  const frame = container.ownerDocument.createElement("iframe");
-  frame.src = frameUrl.toString();
-  frame.title = "Checkout verification";
-  frame.referrerPolicy = "no-referrer";
-  frame.style.border = "0";
-  frame.style.width = "100%";
-  frame.style.height = "0";
-  let disposed = false;
-  let ready = false;
-  const readyTimeout = win.setTimeout(() => {
-    if (!disposed && !ready) callbacks.onUnavailable?.();
-  }, TURNSTILE_FRAME_READY_TIMEOUT_MS);
-  const onMessage = (event) => {
-    if (disposed || event.origin !== frameUrl.origin || event.source !== frame.contentWindow) return;
-    const message = readFrameMessage(event.data, nonce);
-    if (!message) return;
-    ready = true;
-    win.clearTimeout(readyTimeout);
-    if (message.type === "visible") {
-      frame.style.height = "72px";
-      callbacks.onVisibilityChange?.(true);
-    }
-    if (message.type === "hidden") {
-      frame.style.height = "0";
-      callbacks.onVisibilityChange?.(false);
-    }
-    if (message.type === "success") {
-      frame.style.height = "0";
-      callbacks.onVisibilityChange?.(false);
-      callbacks.onSuccess(message.token);
-    }
-    if (message.type === "expired" || message.type === "timeout") callbacks.onExpired?.();
-    if (message.type === "error") callbacks.onUnavailable?.();
-  };
-  const onFrameError = () => callbacks.onUnavailable?.();
-  win.addEventListener("message", onMessage);
-  frame.addEventListener("error", onFrameError, { once: true });
-  container.appendChild(frame);
-  return {
-    element: frame,
-    dispose() {
-      if (disposed) return;
-      disposed = true;
-      win.clearTimeout(readyTimeout);
-      win.removeEventListener("message", onMessage);
-      frame.removeEventListener("error", onFrameError);
-      frame.remove();
-    }
-  };
-}
-
 // ../sdk/src/modules/checkout.ts
 var CheckoutCreateError = class _CheckoutCreateError extends Error {
   constructor(message, options = {}) {
     super(message);
     this.name = "CheckoutCreateError";
-    this.challenge = options.challenge;
     this.code = options.code;
     this.status = options.status;
     Object.setPrototypeOf(this, _CheckoutCreateError.prototype);
@@ -4741,7 +4763,7 @@ function acquireCheckoutCreateIdempotency(requestTarget, createIntent) {
   return attempt;
 }
 function releaseCheckoutCreateIdempotency(attempt, outcomeDefinitive) {
-  if (outcomeDefinitive && pendingCheckoutCreates.get(attempt.fingerprint) === attempt) {
+  if (outcomeDefinitive && pendingCheckoutCreates.get(attempt.fingerprint)?.key === attempt.key) {
     pendingCheckoutCreates.delete(attempt.fingerprint);
   }
 }
@@ -4755,7 +4777,13 @@ function resolveCustomerCheckoutRequestTarget(options) {
   return { endpoint: "/v1/storefront/invoices/from-cart" };
 }
 function resolveRequestedCheckoutCurrency(options) {
-  return normalizeRequestedCurrency(options.currency) ?? getRequestedCurrencyFromLocation() ?? normalizeRequestedCurrency(getConfig().currency);
+  if (options.currency !== void 0) {
+    return normalizeRequestedCurrency(options.currency);
+  }
+  return getRequestedCurrencyFromLocation() ?? normalizeRequestedCurrency(getConfig().currency);
+}
+function getRequestedCheckoutCurrency() {
+  return getRequestedCurrencyFromLocation() ?? normalizeRequestedCurrency(getConfig().currency);
 }
 function normalizeCheckoutFailureMessage(rawMessage) {
   const message = rawMessage?.trim() ?? "";
@@ -4927,14 +4955,7 @@ function mapCartItemsForApi(items) {
 }
 async function checkout(couponOrOptions, options) {
   const resolvedOptions = resolveCheckoutOptions(couponOrOptions, options);
-  const firstAttempt = await performCheckout(resolvedOptions);
-  if (!firstAttempt.success && firstAttempt.challenge?.provider === "turnstile" && !resolvedOptions.turnstileToken && typeof document !== "undefined") {
-    const proof = await resolveCheckoutChallengeProof(firstAttempt.challenge);
-    if (proof) {
-      return performCheckout({ ...resolvedOptions, turnstileToken: proof });
-    }
-  }
-  return firstAttempt;
+  return performCheckout(resolvedOptions);
 }
 async function performCheckout(resolvedOptions) {
   const { autoRedirect = true, email: email2 } = resolvedOptions;
@@ -4978,16 +4999,12 @@ async function performCheckout(resolvedOptions) {
     // automatically so the server can refuse an invoice priced above it.
     // Undefined when nothing has been quoted this session — the endpoint
     // treats that exactly as an older SDK.
-    quote_token: getLatestQuoteToken() ?? void 0
-  };
-  const createCommand = {
-    ...createIntent,
-    turnstile_token: resolvedOptions.turnstileToken?.trim() || void 0
+    quote_token: resolvedOptions.quoteToken !== void 0 ? resolvedOptions.quoteToken ?? void 0 : getLatestQuoteToken() ?? void 0
   };
   const createAttempt = acquireCheckoutCreateIdempotency(checkoutRequestTarget, createIntent);
   const response = await post(
     checkoutRequestTarget.endpoint,
-    createCommand,
+    createIntent,
     {
       retries: 0,
       baseUrl: checkoutRequestTarget.baseUrl,
@@ -5007,8 +5024,7 @@ async function performCheckout(resolvedOptions) {
       // The server's machine-readable refusal, preserved so callers can react
       // to e.g. `errors.checkout.price_increased_since_quote` without matching
       // localized copy.
-      ...response.code ? { code: response.code } : {},
-      ...response.challenge ? { challenge: response.challenge } : {}
+      ...response.code ? { code: response.code } : {}
     };
   }
   const checkoutData = normalizeCheckoutResponse(response.data, config.checkoutBaseUrl);
@@ -5054,17 +5070,7 @@ async function performCheckout(resolvedOptions) {
 }
 async function buildCheckoutUrl(couponOrOptions, options) {
   const resolvedOptions = resolveCheckoutOptions(couponOrOptions, options);
-  try {
-    return await performBuildCheckoutUrl(resolvedOptions);
-  } catch (error) {
-    if (error instanceof CheckoutCreateError && error.challenge?.provider === "turnstile" && !resolvedOptions.turnstileToken && typeof document !== "undefined") {
-      const proof = await resolveCheckoutChallengeProof(error.challenge);
-      if (proof) {
-        return performBuildCheckoutUrl({ ...resolvedOptions, turnstileToken: proof });
-      }
-    }
-    throw error;
-  }
+  return performBuildCheckoutUrl(resolvedOptions);
 }
 async function performBuildCheckoutUrl(resolvedOptions) {
   const { email: email2 } = resolvedOptions;
@@ -5100,16 +5106,12 @@ async function performBuildCheckoutUrl(resolvedOptions) {
     // token here left a public path on which the server had nothing to check
     // the invoice against. Same optional semantics: undefined when nothing
     // was quoted this session.
-    quote_token: getLatestQuoteToken() ?? void 0
-  };
-  const createCommand = {
-    ...createIntent,
-    turnstile_token: resolvedOptions.turnstileToken?.trim() || void 0
+    quote_token: resolvedOptions.quoteToken !== void 0 ? resolvedOptions.quoteToken ?? void 0 : getLatestQuoteToken() ?? void 0
   };
   const createAttempt = acquireCheckoutCreateIdempotency(checkoutRequestTarget, createIntent);
   const response = await post(
     checkoutRequestTarget.endpoint,
-    createCommand,
+    createIntent,
     {
       retries: 0,
       baseUrl: checkoutRequestTarget.baseUrl,
@@ -5124,7 +5126,6 @@ async function performBuildCheckoutUrl(resolvedOptions) {
       clearCart();
     }
     throw new CheckoutCreateError(normalizeCheckoutFailureMessage(response.message), {
-      ...response.challenge ? { challenge: response.challenge } : {},
       ...response.code ? { code: response.code } : {},
       ...response.status !== void 0 ? { status: response.status } : {}
     });
@@ -6159,12 +6160,13 @@ var shoppex = {
   getCartStats,
   validateCartIntegrity,
   quoteCart,
+  getLatestQuoteToken,
   resolveCartLineId,
   // Checkout
   checkout,
   buildCheckoutUrl,
   buildCheckoutUrlSync,
-  mountCheckoutChallenge,
+  getRequestedCheckoutCurrency,
   // Affiliates
   captureAffiliateFromUrl,
   validateAffiliateCode,
@@ -6265,6 +6267,7 @@ export {
   ApiError,
   CATALOG_UNIT_PRICE_DECIMAL_PLACES,
   CATALOG_UNIT_PRICE_FORMAT_OPTIONS,
+  CURRENCY_UNAVAILABLE_ERROR_CODE,
   CartError,
   CheckoutCreateError,
   NetworkError,
@@ -6313,7 +6316,6 @@ export {
   loyalty,
   me,
   mergeSettings,
-  mountCheckoutChallenge,
   normalizeSearchQuery,
   normalizeStorefrontCustomFields,
   order,