@sovecom/theme-sdk 1.0.0-rc.1

package/dist/widget.js

@@ -0,0 +1,232 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.widgetDescriptorSchema = exports.submitFormPropsSchema = exports.toggleButtonPropsSchema = exports.productCarouselPropsSchema = exports.reviewListPropsSchema = exports.starRatingSummaryPropsSchema = exports.actionSchema = exports.actionPathSchema = exports.WIDGET_MAX_BYTES = exports.WIDGET_TYPES = void 0;
+exports.parseWidget = parseWidget;
+/**
+ * the module slot-widget CONTRACT + vocabulary.
+ *
+ * A sandboxed module contributes storefront UI by returning a typed **widget descriptor**
+ * `{ type, props }` — a widget `type` from a CLOSED, core-owned MIT vocabulary plus validated props.
+ * The storefront renders its OWN known MIT components with that data; NO code, NO HTML, NO SVG
+ * crosses the boundary — only DATA.
+ *
+ * Like `manifest.ts` / `template.ts`, this file is a declarative ASSET contract: PURE validators +
+ * types only. There is NO React, NO fetch, NO Node runtime API, NO render here. `parseWidget` mirrors
+ * `parseTemplate`'s byte-cap + JSON.parse + Zod pipeline, with ONE deliberate difference: it returns
+ * `null` on ANY failure (never throws) — the defensive fail-closed contract the storefront RSC relies
+ * on to "render nothing, never 500 the page".
+ *
+ * The byte cap is its own constant ({@link WIDGET_MAX_BYTES}) but reuses the manifest cap value so a
+ * widget descriptor is gated by the same finite bound — one numeric home, no divergence.
+ */
+const zod_1 = require("zod");
+const manifest_js_1 = require("./manifest.js");
+/**
+ * The CLOSED, core-owned widget vocabulary. A module author CANNOT register a new type;
+ * adding one is an MIT storefront contribution reviewed like adding a section. The
+ * `component` slug in a module manifest's `slots[]` IS one of these `type`s. The literal-tuple
+ * `as const` lets the discriminated union below mirror it exactly.
+ */
+exports.WIDGET_TYPES = [
+    'star-rating-summary',
+    'review-list',
+    'product-carousel',
+    'toggle-button',
+    'submit-form',
+];
+/**
+ * Byte cap for a raw widget descriptor. Reuses the manifest cap VALUE (one source of truth) — a
+ * descriptor is small data, so this generous bound only rejects pathological payloads up front, before
+ * any JSON.parse or schema work.
+ */
+exports.WIDGET_MAX_BYTES = manifest_js_1.MANIFEST_MAX_BYTES;
+// ── shared field bounds (every string capped, every array `.max`, every number ranged) ───
+const MAX_ID_LEN = 64;
+const MAX_REVIEW_BODY_LEN = 2000;
+const MAX_AUTHOR_LEN = 120;
+const MAX_REVIEW_ITEMS = 50;
+const MAX_HEADING_LEN = 120;
+const MAX_SLUG_LEN = 200;
+const MAX_TITLE_LEN = 200;
+const MAX_IMAGE_URL_LEN = 2048;
+const MAX_CAROUSEL_ITEMS = 24;
+const MAX_LABEL_LEN = 60;
+const MAX_FIELD_NAME_LEN = 40;
+const MAX_FIELD_LABEL_LEN = 120;
+const MAX_FORM_FIELDS = 8;
+const MAX_OPTION_LEN = 120;
+const MAX_OPTIONS = 20;
+const MAX_SUCCESS_MSG_LEN = 200;
+/** Generous-but-finite bound on an action path — rejects a pathological path before refining it. */
+const MAX_ACTION_PATH_LEN = 512;
+/**
+ * The required prefix for an interactive widget's POST-back `action`/`onAction`/`offAction` path.
+ * This layer can only validate the SHAPE — it cannot know the originating module's name. The storefront
+ * enforces that the path targets the ORIGINATING module's own mount (the module name comes from the slot
+ * BINDING, never from the descriptor). See {@link actionPathSchema}.
+ */
+const ACTION_PATH_PREFIX = '/store/v1/modules/';
+/**
+ * A header-injection-safe RELATIVE action path. This layer validates the SHAPE only; the storefront binds
+ * it to the originating module's mount. Rejects: anything not starting with {@link ACTION_PATH_PREFIX}
+ * (so no absolute `https://`/`http:`/`//host` URL, no scheme, no other origin); any `..` path traversal; any
+ * CR/LF or other ASCII control character (header-injection / response-splitting); and over-length.
+ *
+ * The allowlist regex is the real gate: a clean path is a `/store/v1/modules/` prefix followed only by
+ * URL-safe path characters (`A–Z a–z 0–9 - _ . ~ / : @ ! $ & ' ( ) * + , ; =`). Because `/` is the
+ * only structural separator and `\r`/`\n`/space/control bytes are NOT in the class, CRLF and control
+ * chars cannot match; `..` is rejected by an explicit segment check (defence in depth — a `.` IS in the
+ * class, so the regex alone would admit `..`).
+ *
+ * `%` is DELIBERATELY EXCLUDED from the class. An action path is a simple relative endpoint (POST
+ * params ride the body, never the path), so it never needs percent-encoding — and admitting `%` would
+ * open an encoding channel where `%2e%2e` (→ `..`) or `%0d%0a` (→ CR/LF) passes the char-by-char regex
+ * AND the RAW `split('/')` segment refine (which never decodes), re-introducing traversal / response-
+ * splitting after the fact. With `%` banned there is NO encoding channel: a literal `..` is caught by
+ * the segment refine, and CRLF / space / control / backslash / unicode are all already outside the class.
+ */
+const SAFE_PATH_BODY_RE = /^\/store\/v1\/modules\/[A-Za-z0-9\-._~/:@!$&'()*+,;=]*$/;
+exports.actionPathSchema = zod_1.z
+    .string()
+    .min(ACTION_PATH_PREFIX.length)
+    .max(MAX_ACTION_PATH_LEN)
+    .regex(SAFE_PATH_BODY_RE, 'action path must be a clean relative /store/v1/modules/... path')
+    .refine((p) => !p.split('/').includes('..'), {
+    message: 'action path must not contain `..` traversal',
+});
+/** An interactive widget's action target: just a validated relative `path` (C1 shape-only). */
+exports.actionSchema = zod_1.z.object({ path: exports.actionPathSchema }).strict();
+// ── per-widget props schemas (each `.strict()`, fully bounded) ────────────────────
+/** `star-rating-summary` props: an average in [0,5] and a non-negative integer count. */
+exports.starRatingSummaryPropsSchema = zod_1.z
+    .object({
+    average: zod_1.z.number().min(0).max(5),
+    count: zod_1.z.number().int().min(0),
+})
+    .strict();
+/** `review-list` props: a bounded list of bounded review items (id/rating/body/author/createdAt). */
+exports.reviewListPropsSchema = zod_1.z
+    .object({
+    items: zod_1.z
+        .array(zod_1.z
+        .object({
+        id: zod_1.z.string().min(1).max(MAX_ID_LEN),
+        rating: zod_1.z.number().int().min(1).max(5),
+        body: zod_1.z.string().max(MAX_REVIEW_BODY_LEN),
+        author: zod_1.z.string().max(MAX_AUTHOR_LEN).optional(),
+        // An ISO-8601 datetime string (e.g. `2026-06-22T10:00:00.000Z`). z.iso.datetime is a pure
+        // format check — no Date construction, no I/O.
+        createdAt: zod_1.z.iso.datetime(),
+    })
+        .strict())
+        .max(MAX_REVIEW_ITEMS),
+})
+    .strict();
+/**
+ * A product `slug` used to build a `/product/<slug>` link. Bounded length + a TRAVERSAL guard: it must
+ * not contain `/` or `\` (no extra path segments) and must not be a `..` segment — so a module can't
+ * return `slug:'../../admin'` and turn the carousel link into a within-origin redirect to another route.
+ * NOT constrained to a strict charset (real slugs vary by locale/tenant); only the traversal MECHANISM
+ * is barred. C2 ALSO `encodeURIComponent`s the slug at render (defense in depth) — this is the contract
+ * layer that rejects the descriptor outright. The `..` check is on the whole value (the slash ban already
+ * means a `..` can only appear as the entire slug, but checking explicitly keeps the intent legible).
+ */
+const carouselSlugSchema = zod_1.z
+    .string()
+    .min(1)
+    .max(MAX_SLUG_LEN)
+    .refine((s) => !s.includes('/') && !s.includes('\\') && s !== '..', {
+    message: 'slug must not contain path separators or a `..` traversal segment',
+});
+/** `product-carousel` props: an optional heading + a bounded list of bounded product cards. */
+exports.productCarouselPropsSchema = zod_1.z
+    .object({
+    heading: zod_1.z.string().max(MAX_HEADING_LEN).optional(),
+    items: zod_1.z
+        .array(zod_1.z
+        .object({
+        productId: zod_1.z.string().min(1).max(MAX_ID_LEN),
+        slug: carouselSlugSchema,
+        title: zod_1.z.string().min(1).max(MAX_TITLE_LEN),
+        imageUrl: zod_1.z.string().max(MAX_IMAGE_URL_LEN).optional(),
+    })
+        .strict())
+        .max(MAX_CAROUSEL_ITEMS),
+})
+    .strict();
+/** `toggle-button` props: on/off actions (relative paths), bounded labels, enum-only icon. */
+exports.toggleButtonPropsSchema = zod_1.z
+    .object({
+    initialOn: zod_1.z.boolean(),
+    onAction: exports.actionSchema,
+    offAction: exports.actionSchema,
+    labels: zod_1.z
+        .object({
+        on: zod_1.z.string().min(1).max(MAX_LABEL_LEN),
+        off: zod_1.z.string().min(1).max(MAX_LABEL_LEN),
+    })
+        .strict(),
+    icon: zod_1.z.enum(['heart', 'bell', 'star']),
+})
+    .strict();
+/** `submit-form` props: a relative action path, a bounded field list with enum-only kinds. */
+exports.submitFormPropsSchema = zod_1.z
+    .object({
+    action: exports.actionSchema,
+    submitLabel: zod_1.z.string().min(1).max(MAX_LABEL_LEN),
+    fields: zod_1.z
+        .array(zod_1.z
+        .object({
+        name: zod_1.z.string().min(1).max(MAX_FIELD_NAME_LEN),
+        label: zod_1.z.string().min(1).max(MAX_FIELD_LABEL_LEN),
+        kind: zod_1.z.enum(['text', 'textarea', 'rating', 'email', 'select']),
+        required: zod_1.z.boolean(),
+        options: zod_1.z.array(zod_1.z.string().max(MAX_OPTION_LEN)).max(MAX_OPTIONS).optional(),
+    })
+        .strict())
+        .max(MAX_FORM_FIELDS),
+    successMessage: zod_1.z.string().max(MAX_SUCCESS_MSG_LEN).optional(),
+})
+    .strict();
+/**
+ * The widget descriptor: `{ type, props }` discriminated on `type`, so each widget's props are
+ * validated against ITS OWN schema (wrong props for a type ⇒ fail). `.strict()` on each member rejects
+ * unknown keys at the descriptor level; the per-widget props schemas are `.strict()` too, so unknown
+ * keys are rejected at BOTH levels.
+ */
+exports.widgetDescriptorSchema = zod_1.z.discriminatedUnion('type', [
+    zod_1.z
+        .object({ type: zod_1.z.literal('star-rating-summary'), props: exports.starRatingSummaryPropsSchema })
+        .strict(),
+    zod_1.z.object({ type: zod_1.z.literal('review-list'), props: exports.reviewListPropsSchema }).strict(),
+    zod_1.z.object({ type: zod_1.z.literal('product-carousel'), props: exports.productCarouselPropsSchema }).strict(),
+    zod_1.z.object({ type: zod_1.z.literal('toggle-button'), props: exports.toggleButtonPropsSchema }).strict(),
+    zod_1.z.object({ type: zod_1.z.literal('submit-form'), props: exports.submitFormPropsSchema }).strict(),
+]);
+/**
+ * Parse + verify a raw widget descriptor. PURE — no I/O, no code execution, no render.
+ *
+ * Accepts either a JSON string (the wire form — byte-capped, then `JSON.parse`d, mirroring
+ * {@link parseTemplate}) or an already-parsed value (so the storefront can hand it the parsed JSON
+ * directly). Enforces the byte cap on the string form, validates against {@link widgetDescriptorSchema}
+ * (the discriminated union + per-widget `.strict()` props), and returns the typed descriptor — or
+ * `null` on ANY failure: oversized, non-JSON, non-object, unknown type, discriminator mismatch, an
+ * out-of-bounds / bad-enum / bad-path prop, or an unknown key at either level. It NEVER throws: the
+ * fail-closed contract the storefront RSC relies on to "render nothing, never block or 500 the page".
+ */
+function parseWidget(raw) {
+    let candidate = raw;
+    if (typeof raw === 'string') {
+        if (Buffer.byteLength(raw, 'utf8') > exports.WIDGET_MAX_BYTES)
+            return null;
+        try {
+            candidate = JSON.parse(raw);
+        }
+        catch {
+            return null;
+        }
+    }
+    const result = exports.widgetDescriptorSchema.safeParse(candidate);
+    return result.success ? result.data : null;
+}
+//# sourceMappingURL=widget.js.map

package/dist/widget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"widget.js","sourceRoot":"","sources":["../src/widget.ts"],"names":[],"mappings":";;;AAsPA,kCAcC;AApQD;;;;;;;;;;;;;;;;GAgBG;AACH,6BAAwB;AACxB,+CAAmD;AAEnD;;;;;GAKG;AACU,QAAA,YAAY,GAAG;IAC1B,qBAAqB;IACrB,aAAa;IACb,kBAAkB;IAClB,eAAe;IACf,aAAa;CACL,CAAC;AAKX;;;;GAIG;AACU,QAAA,gBAAgB,GAAG,gCAAkB,CAAC;AAEnD,4FAA4F;AAC5F,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACjC,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,oGAAoG;AACpG,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEhD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,iBAAiB,GAAG,yDAAyD,CAAC;AAEvE,QAAA,gBAAgB,GAAG,OAAC;KAC9B,MAAM,EAAE;KACR,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC;KAC9B,GAAG,CAAC,mBAAmB,CAAC;KACxB,KAAK,CAAC,iBAAiB,EAAE,iEAAiE,CAAC;KAC3F,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;IAC3C,OAAO,EAAE,6CAA6C;CACvD,CAAC,CAAC;AAEL,+FAA+F;AAClF,QAAA,YAAY,GAAG,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,wBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAE1E,qFAAqF;AAErF,yFAAyF;AAC5E,QAAA,4BAA4B,GAAG,OAAC;KAC1C,MAAM,CAAC;IACN,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,qGAAqG;AACxF,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,KAAK,EAAE,OAAC;SACL,KAAK,CACJ,OAAC;SACE,MAAM,CAAC;QACN,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;QACrC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC;QACzC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE;QACjD,0FAA0F;QAC1F,+CAA+C;QAC/C,SAAS,EAAE,OAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;KAC5B,CAAC;SACD,MAAM,EAAE,CACZ;SACA,GAAG,CAAC,gBAAgB,CAAC;CACzB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG,OAAC;KACzB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,YAAY,CAAC;KACjB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;IAClE,OAAO,EAAE,mEAAmE;CAC7E,CAAC,CAAC;AAEL,+FAA+F;AAClF,QAAA,0BAA0B,GAAG,OAAC;KACxC,MAAM,CAAC;IACN,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IACnD,KAAK,EAAE,OAAC;SACL,KAAK,CACJ,OAAC;SACE,MAAM,CAAC;QACN,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;QAC5C,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;QAC3C,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;KACvD,CAAC;SACD,MAAM,EAAE,CACZ;SACA,GAAG,CAAC,kBAAkB,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,8FAA8F;AACjF,QAAA,uBAAuB,GAAG,OAAC;KACrC,MAAM,CAAC;IACN,SAAS,EAAE,OAAC,CAAC,OAAO,EAAE;IACtB,QAAQ,EAAE,oBAAY;IACtB,SAAS,EAAE,oBAAY;IACvB,MAAM,EAAE,OAAC;SACN,MAAM,CAAC;QACN,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;QACxC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;KAC1C,CAAC;SACD,MAAM,EAAE;IACX,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,8FAA8F;AACjF,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,MAAM,EAAE,oBAAY;IACpB,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC;IACjD,MAAM,EAAE,OAAC;SACN,KAAK,CACJ,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC/C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC;QACjD,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/D,QAAQ,EAAE,OAAC,CAAC,OAAO,EAAE;QACrB,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;KAC7E,CAAC;SACD,MAAM,EAAE,CACZ;SACA,GAAG,CAAC,eAAe,CAAC;IACvB,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;CAC/D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;;;GAKG;AACU,QAAA,sBAAsB,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACjE,OAAC;SACE,MAAM,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,oCAA4B,EAAE,CAAC;SACvF,MAAM,EAAE;IACX,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,6BAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACnF,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,kCAA0B,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7F,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,+BAAuB,EAAE,CAAC,CAAC,MAAM,EAAE;IACvF,OAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,6BAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;CACpF,CAAC,CAAC;AAWH;;;;;;;;;;GAUG;AACH,SAAgB,WAAW,CAAC,GAAY;IACtC,IAAI,SAAS,GAAY,GAAG,CAAC;IAE7B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,wBAAgB;YAAE,OAAO,IAAI,CAAC;QACnE,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,8BAAsB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC"}

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@sovecom/theme-sdk",
+  "version": "1.0.0-rc.1",
+  "license": "MIT",
+  "description": "Public author-facing contract SDK for the SovEcom theme ecosystem",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/asifwanders/SovEcom.git",
+    "directory": "packages/theme-sdk"
+  },
+  "homepage": "https://github.com/asifwanders/SovEcom#readme",
+  "bugs": {
+    "url": "https://github.com/asifwanders/SovEcom/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "dependencies": {
+    "semver": "^7.8.4",
+    "zod": "^4.4.3",
+    "@sovecom/module-sdk": "1.0.0-rc.1"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "@types/semver": "^7.7.1",
+    "typescript": "^5.4.0",
+    "vitest": "^4.0.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "lint": "eslint src --ext .ts",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "clean": "rm -rf dist"
+  }
+}