@swell/apps-sdk 1.0.189 → 2.0.0-alpha.0

package/dist/staff.d.cts

@@ -0,0 +1,16 @@
+import type { HeaderReader } from './context.cjs';
+export interface StaffIdentity {
+    userId: string;
+    storeId: string;
+}
+export interface StaffOptions {
+    headers: HeaderReader;
+    method: string;
+    /** Trusted app/iframe origin, never an unchecked forwarded-host value. */
+    origin: string;
+    cookies: {
+        get(name: string): string | undefined;
+    };
+}
+/** Verifies store staff identity only. The application still owns authorization policy. */
+export declare function requireStaff({ headers, method, origin, cookies }: StaffOptions): Promise<StaffIdentity>;

package/dist/staff.d.ts

@@ -0,0 +1,16 @@
+import type { HeaderReader } from './context.js';
+export interface StaffIdentity {
+    userId: string;
+    storeId: string;
+}
+export interface StaffOptions {
+    headers: HeaderReader;
+    method: string;
+    /** Trusted app/iframe origin, never an unchecked forwarded-host value. */
+    origin: string;
+    cookies: {
+        get(name: string): string | undefined;
+    };
+}
+/** Verifies store staff identity only. The application still owns authorization policy. */
+export declare function requireStaff({ headers, method, origin, cookies }: StaffOptions): Promise<StaffIdentity>;

package/dist/staff.js

@@ -0,0 +1,33 @@
+import { parseSwellHeaders, requireString, validateUrl } from './context.js';
+import { SwellError } from './error.js';
+import { USER_AGENT } from './version.js';
+/** Verifies store staff identity only. The application still owns authorization policy. */
+export async function requireStaff({ headers, method, origin, cookies }) {
+    const { storeId, adminUrl } = parseSwellHeaders(headers);
+    requireString(storeId, 'storeId');
+    const url = validateUrl(adminUrl, 'adminUrl');
+    requireString(method, 'method');
+    if (method.toUpperCase() !== 'GET') {
+        const expected = validateUrl(origin, 'origin');
+        const supplied = headers.get('Origin');
+        if (new URL(expected).origin !== origin)
+            throw new Error('origin must be an absolute app origin');
+        if (supplied !== origin || (headers.get('Sec-Fetch-Site') !== null && headers.get('Sec-Fetch-Site') !== 'same-origin')) {
+            throw new SwellError('Staff request origin rejected', { status: 403 });
+        }
+    }
+    const sessionId = cookies.get('_swell_admin_session');
+    if (!sessionId)
+        throw new SwellError('Staff session required', { status: 401 });
+    const response = await fetch(new URL('/admin/api/session', url), {
+        headers: { 'X-Session': sessionId, 'User-Agent': USER_AGENT }, redirect: 'manual',
+    });
+    if (response.status === 401 || response.status === 403)
+        throw new SwellError('Invalid staff session', { status: 401 });
+    if (!response.ok)
+        throw new SwellError('Staff session verification failed', { status: response.status });
+    const session = await response.json();
+    if (typeof session?.user_id !== 'string' || !session.user_id || session.client_id !== storeId)
+        throw new SwellError('Invalid staff session', { status: 401 });
+    return { userId: session.user_id, storeId };
+}

package/dist/storefront.d.cts

@@ -0,0 +1,28 @@
+import './guard.cjs';
+import type { PublicConfig, SwellClient } from 'swell-js';
+export interface CookieOptions {
+    path?: string;
+    maxAge?: number;
+    sameSite?: 'lax' | 'strict' | 'none';
+    domain?: string;
+    expires?: Date;
+    secure?: boolean;
+    httpOnly?: boolean;
+    [attribute: string]: string | number | boolean | Date | undefined;
+}
+export interface CookieAdapter {
+    /** Return decoded current values, including this request's writes/deletes. The adapter owns state. */
+    get(name: string): string | undefined;
+    /** Owns write policy: may skip a write, or throw when required persistence is unavailable. */
+    set?(name: string, value: string, options: CookieOptions): void;
+}
+export interface StorefrontOptions {
+    cookies: CookieAdapter;
+    /** Replaces native defaults (/, one week, SameSite=Lax). Use {} for adapter-owned policy. */
+    cookieOptions?: CookieOptions;
+}
+/** Creates an isolated native swell-js client. Replace request before first use to add caching. */
+export declare function createStorefrontClient(config: PublicConfig<'camel'> & {
+    useCamelCase: true;
+}, options: StorefrontOptions): SwellClient<'camel'>;
+export declare function createStorefrontClient<C extends 'snake' | 'camel' = 'snake'>(config: PublicConfig<C>, options: StorefrontOptions): SwellClient<C>;

package/dist/storefront.d.ts

@@ -0,0 +1,28 @@
+import './guard.js';
+import type { PublicConfig, SwellClient } from 'swell-js';
+export interface CookieOptions {
+    path?: string;
+    maxAge?: number;
+    sameSite?: 'lax' | 'strict' | 'none';
+    domain?: string;
+    expires?: Date;
+    secure?: boolean;
+    httpOnly?: boolean;
+    [attribute: string]: string | number | boolean | Date | undefined;
+}
+export interface CookieAdapter {
+    /** Return decoded current values, including this request's writes/deletes. The adapter owns state. */
+    get(name: string): string | undefined;
+    /** Owns write policy: may skip a write, or throw when required persistence is unavailable. */
+    set?(name: string, value: string, options: CookieOptions): void;
+}
+export interface StorefrontOptions {
+    cookies: CookieAdapter;
+    /** Replaces native defaults (/, one week, SameSite=Lax). Use {} for adapter-owned policy. */
+    cookieOptions?: CookieOptions;
+}
+/** Creates an isolated native swell-js client. Replace request before first use to add caching. */
+export declare function createStorefrontClient(config: PublicConfig<'camel'> & {
+    useCamelCase: true;
+}, options: StorefrontOptions): SwellClient<'camel'>;
+export declare function createStorefrontClient<C extends 'snake' | 'camel' = 'snake'>(config: PublicConfig<C>, options: StorefrontOptions): SwellClient<C>;

package/dist/storefront.js

@@ -0,0 +1,44 @@
+import './guard.js';
+import swell from 'swell-js';
+import { requireString, validateUrl } from './context.js';
+export function createStorefrontClient(config, { cookies, cookieOptions = { path: '/', maxAge: 604800, sameSite: 'lax' } }) {
+    for (const field of ['getCookie', 'setCookie', 'getCart', 'updateCart']) {
+        if (field in config)
+            throw new Error(`Invalid public config callback: ${field}`);
+    }
+    requireString(config.storeId, 'storeId');
+    requireString(config.publicKey, 'publicKey');
+    for (const field of ['url', 'vaultUrl']) {
+        if (config[field] !== undefined)
+            validateUrl(config[field], field);
+    }
+    for (const field of ['locale', 'currency', 'session', 'store', 'key']) {
+        if (config[field] !== undefined && typeof config[field] !== 'string')
+            throw new Error(`Invalid ${field}`);
+    }
+    for (const field of ['useCamelCase', 'previewContent']) {
+        if (config[field] !== undefined && typeof config[field] !== 'boolean')
+            throw new Error(`Invalid ${field}`);
+    }
+    if (config.timeout !== undefined && (!Number.isFinite(config.timeout) || config.timeout < 0))
+        throw new Error('Invalid timeout');
+    if (config.headers !== undefined && (!config.headers || typeof config.headers !== 'object' || Array.isArray(config.headers) || Object.values(config.headers).some(value => typeof value !== 'string')))
+        throw new Error('Invalid headers');
+    if (!cookies || typeof cookies.get !== 'function' || (cookies.set !== undefined && typeof cookies.set !== 'function'))
+        throw new Error('A cookie adapter with get() and optional set() is required');
+    return swell.create(config.storeId, config.publicKey, {
+        ...config,
+        headers: { ...config.headers },
+        getCookie: name => cookies.get(name),
+        setCookie(name, value, attributes = {}) {
+            if (!cookies.set)
+                throw new Error('Cannot write Swell cookies with a read-only adapter; use a writable route handler or action');
+            const options = { ...cookieOptions };
+            for (const [key, value] of Object.entries(attributes)) {
+                const normalized = { 'max-age': 'maxAge', maxage: 'maxAge', samesite: 'sameSite', httponly: 'httpOnly' }[key.toLowerCase()] ?? key;
+                options[normalized] = value;
+            }
+            return cookies.set(name, value, options);
+        },
+    });
+}

package/dist/version.d.cts

@@ -0,0 +1 @@
+export declare const USER_AGENT = "swell-apps-sdk/2.0.0-alpha.0";

package/dist/version.d.ts

@@ -0,0 +1 @@
+export declare const USER_AGENT = "swell-apps-sdk/2.0.0-alpha.0";

package/dist/version.js

@@ -0,0 +1,2 @@
+// Replaced with the package version by the build.
+export const USER_AGENT = 'swell-apps-sdk/2.0.0-alpha.0';

package/dist/workflow.d.cts

@@ -0,0 +1 @@
+export declare function validateWorkflowParams(params: unknown): unknown;

package/dist/workflow.d.ts

@@ -0,0 +1 @@
+export declare function validateWorkflowParams(params: unknown): unknown;

package/dist/workflow.js

@@ -0,0 +1,35 @@
+import { SwellError } from './error.js';
+function paramsError(code, message) {
+    return new SwellError({ error: { code, message, status: 400, retryable: false } }, { code, status: 400 });
+}
+function validateValue(value, seen) {
+    if (value === null || typeof value === 'string' || typeof value === 'boolean' || (typeof value === 'number' && Number.isFinite(value)))
+        return;
+    if (typeof value !== 'object' || value === null || seen.has(value) || Object.getOwnPropertySymbols(value).length) {
+        throw paramsError('workflow_params_unserializable', 'Workflow params must be JSON-safe values');
+    }
+    if (Array.isArray(value)) {
+        const keys = Object.keys(value);
+        if (keys.some(key => !/^(0|[1-9]\d*)$/.test(key) || Number(key) >= value.length)) {
+            throw paramsError('workflow_params_unserializable', 'Workflow params must be JSON-safe values');
+        }
+        for (let index = 0; index < value.length; index++) {
+            if (!Object.prototype.hasOwnProperty.call(value, index))
+                throw paramsError('workflow_params_unserializable', 'Workflow params must be JSON-safe values');
+        }
+    }
+    else if (Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) {
+        throw paramsError('workflow_params_unserializable', 'Workflow params must be JSON-safe values');
+    }
+    seen.add(value);
+    for (const item of Array.isArray(value) ? value : Object.values(value))
+        validateValue(item, seen);
+    seen.delete(value);
+}
+export function validateWorkflowParams(params) {
+    validateValue(params, new Set());
+    if (new TextEncoder().encode(JSON.stringify(params)).length > 128 * 1024) {
+        throw paramsError('workflow_params_too_large', 'Workflow params are too large; pass identifiers and re-fetch data inside the workflow');
+    }
+    return params;
+}

package/package.json

@@ -1,77 +1,62 @@
 {
   "name": "@swell/apps-sdk",
+  "version": "2.0.0-alpha.0",
+  "description": "Server SDK for Swell apps.",
   "type": "module",
-  "version": "1.0.189",
-  "description": "Swell SDK for building isomorphic apps.",
-  "author": "Swell",
   "license": "MIT",
   "engines": {
-    "node": ">=18.16.1",
-    "npm": ">=9.3.1"
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/swellstores/swell-apps-sdk"
-  },
-  "main": "./dist/index.cjs",
-  "module": "./dist/index.mjs",
-  "browser": "./dist/index.js",
-  "types": "./types/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./types/index.d.ts",
-      "require": "./dist/index.cjs",
-      "import": "./dist/index.mjs"
-    }
+    "node": ">=22.22.2"
   },
   "files": [
-    "dist",
-    "types/*.d.ts"
+    "dist"
   ],
   "scripts": {
-    "prebuild": "rimraf dist",
     "build": "node scripts/build.mjs",
-    "postbuild": "tsc --project tsconfig.build.json",
-    "prepare": "git config core.hooksPath .git-hooks || echo 'Not in a git repo'",
-    "prepublishOnly": "npm i && npm run build",
-    "watch": "node scripts/build.mjs watch",
-    "test": "jest --silent"
+    "prepack": "npm run build",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "npm run build && node --test test/*.test.mjs",
+    "test:package": "node scripts/verify-package.mjs",
+    "test:boundaries": "node scripts/verify-boundaries.mjs",
+    "test:worker": "node scripts/verify-worker.mjs",
+    "verify": "npm test && npm run typecheck && npm run test:package && npm run test:boundaries && npm run test:worker"
   },
-  "dependencies": {
-    "@swell/easyblocks-core": "^1.0.19",
-    "cache-manager": "^7.0.1",
-    "color": "^4.2.3",
-    "country-flag-icons": "1.5.18",
-    "json5": "^2.2.3",
-    "keyv": "^5.3.4",
-    "liquidjs": "^10.21.0",
-    "lodash-es": "^4.17.21",
-    "qs": "^6.12.3",
-    "strftime": "^0.10.3",
-    "swell-js": "^5.1.2"
+  "peerDependencies": {
+    "swell-js": ">=5.9.1"
   },
   "devDependencies": {
-    "@cloudflare/workers-types": "^4.20250902.0",
-    "@eslint/js": "^9.19.0",
-    "@jest/transform": "^29.7.0",
-    "@types/color": "^4.2.0",
-    "@types/jest": "^29.5.14",
-    "@types/lodash-es": "^4.17.12",
-    "@types/qs": "^6.9.15",
-    "@types/react": "^18.2.64",
-    "@types/react-dom": "^18.2.21",
-    "@types/strftime": "^0.9.8",
-    "esbuild": "^0.24.2",
-    "eslint": "^9.19.0",
-    "eslint-config-prettier": "^10.0.1",
-    "eslint-plugin-jest": "^28.11.0",
-    "eslint-plugin-prettier": "^5.2.3",
-    "jest": "29.7.0",
-    "jest-esbuild": "^0.4.0",
-    "prettier": "^3.4.2",
-    "rimraf": "^6.0.1",
-    "ts-jest": "^29.2.5",
-    "typescript": "^5.7.3",
-    "typescript-eslint": "^8.23.0"
-  }
+    "esbuild": "0.24.2",
+    "miniflare": "5.20260911.1-alpha",
+    "swell-js": "5.9.1",
+    "typescript": "5.7.3"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": {
+        "import": "./dist/index.d.ts",
+        "require": "./dist/index.d.cts"
+      },
+      "workerd": "./dist/index.js",
+      "node": "./dist/index.js",
+      "browser": "./dist/browser-refusal.js",
+      "default": "./dist/index.js"
+    },
+    "./storefront": {
+      "types": {
+        "import": "./dist/storefront.d.ts",
+        "require": "./dist/storefront.d.cts"
+      },
+      "workerd": "./dist/storefront.js",
+      "node": "./dist/storefront.js",
+      "browser": "./dist/browser-refusal.js",
+      "default": "./dist/storefront.js"
+    }
+  },
+  "sideEffects": [
+    "./dist/index.js",
+    "./dist/storefront.js",
+    "./dist/guard.js",
+    "./dist/browser-refusal.js"
+  ]
 }