@swell/apps-sdk 1.0.190 → 2.0.0-alpha.1

package/dist/jwks.d.cts

@@ -0,0 +1 @@
+export declare function getVerificationKey(url: string, kid: string): Promise<CryptoKey>;

package/dist/jwks.d.ts

@@ -0,0 +1 @@
+export declare function getVerificationKey(url: string, kid: string): Promise<CryptoKey>;

package/dist/jwks.js

@@ -0,0 +1,70 @@
+import { SwellError } from './error.js';
+const CACHE_TTL = 300_000;
+const REFRESH_INTERVAL = 30_000;
+const FAILURE_RETRY_INTERVAL = 1000;
+const MAX_URLS = 8;
+// Public keys only: no tokens, credentials, identities or request results.
+const keySets = new Map();
+async function refresh(url, entry) {
+    entry.refreshAfter = Date.now() + REFRESH_INTERVAL;
+    try {
+        const response = await fetch(url, { redirect: 'manual', signal: AbortSignal.timeout(5000) });
+        if (!response.ok)
+            throw new Error('JWKS request failed');
+        const body = await response.json();
+        if (!Array.isArray(body?.keys))
+            throw new Error('Invalid JWKS');
+        const keys = new Map();
+        for (const jwk of body.keys) {
+            if (!jwk || jwk.kty !== 'EC' || jwk.crv !== 'P-256' || (jwk.alg && jwk.alg !== 'ES256') || (jwk.use && jwk.use !== 'sig'))
+                continue;
+            if (typeof jwk.kid !== 'string' || !jwk.kid || keys.has(jwk.kid) || jwk.d)
+                throw new Error('Invalid JWKS key');
+            keys.set(jwk.kid, await crypto.subtle.importKey('jwk', jwk, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['verify']));
+        }
+        if (!keys.size)
+            throw new Error('Empty JWKS');
+        entry.keys = keys;
+        entry.expiresAt = Date.now() + CACHE_TTL;
+        entry.error = undefined;
+    }
+    catch {
+        entry.refreshAfter = Date.now() + FAILURE_RETRY_INTERVAL;
+        entry.error = new SwellError('Swell verification keys unavailable', { status: 503, code: 'swell_jwks_unavailable' });
+        throw entry.error;
+    }
+}
+export async function getVerificationKey(url, kid) {
+    let entry = keySets.get(url);
+    if (!entry) {
+        if (keySets.size >= MAX_URLS)
+            keySets.delete(keySets.keys().next().value);
+        entry = { keys: new Map(), expiresAt: 0, refreshAfter: 0 };
+        keySets.set(url, entry);
+    }
+    const now = Date.now();
+    const cached = entry.keys.get(kid);
+    if (cached && now < entry.expiresAt)
+        return cached;
+    if (entry.pending) {
+        await entry.pending;
+    }
+    else if (now >= entry.expiresAt || !entry.keys.has(kid)) {
+        if (now >= entry.refreshAfter) {
+            entry.pending = refresh(url, entry);
+            try {
+                await entry.pending;
+            }
+            finally {
+                entry.pending = undefined;
+            }
+        }
+        else if (now >= entry.expiresAt) {
+            throw entry.error ?? new SwellError('Swell verification keys unavailable', { status: 503, code: 'swell_jwks_unavailable' });
+        }
+    }
+    const key = entry.keys.get(kid);
+    if (!key)
+        throw new SwellError('Unknown Swell signing key', { status: 401, code: 'invalid_swell_context' });
+    return key;
+}

package/dist/request-context.d.cts

@@ -0,0 +1,37 @@
+import type { HeaderReader } from './context.cjs';
+import type { StaffIdentity } from './staff.cjs';
+export interface SwellHeadersEnv {
+    SWELL_VERIFY_HEADERS?: string;
+    SWELL_HEADERS_JWKS_URL?: string;
+}
+export interface VerifySwellContextOptions {
+    /** Explicit Worker bindings or server configuration. Omit to read process.env when available. */
+    env?: SwellHeadersEnv;
+    /** Expected destination IDs from trusted app configuration, never incoming headers. */
+    appId?: string;
+    storeId?: string;
+    /** Trusted vault override; the unsigned Swell-Vault-Url header is not used. */
+    vaultUrl?: string;
+}
+/** Request-local server data. Only getStorefrontConfig's projection may be sent to the browser. */
+export interface SwellRequestContext {
+    readonly storeId: string;
+    readonly appId: string;
+    readonly installationId: string;
+    readonly environmentId?: string;
+    readonly storefrontId?: string;
+    readonly apiHost: string;
+    readonly adminUrl: string;
+    readonly accessToken?: string;
+    readonly publicKey?: string;
+    readonly requestId?: string;
+    readonly vaultUrl?: string;
+    readonly staff: Readonly<StaffIdentity> | null;
+    /** False only when trusted runtime configuration explicitly disables verification. */
+    readonly signatureVerified: boolean;
+}
+/**
+ * Resolves Swell-Context once per request. Uses ES256 and a pinned JWKS endpoint;
+ * never discovers keys from the request. No fallback to plain headers or staff cookies.
+ */
+export declare function verifySwellContext(headers: HeaderReader, options?: VerifySwellContextOptions): Promise<SwellRequestContext>;

package/dist/request-context.d.ts

@@ -0,0 +1,37 @@
+import type { HeaderReader } from './context.js';
+import type { StaffIdentity } from './staff.js';
+export interface SwellHeadersEnv {
+    SWELL_VERIFY_HEADERS?: string;
+    SWELL_HEADERS_JWKS_URL?: string;
+}
+export interface VerifySwellContextOptions {
+    /** Explicit Worker bindings or server configuration. Omit to read process.env when available. */
+    env?: SwellHeadersEnv;
+    /** Expected destination IDs from trusted app configuration, never incoming headers. */
+    appId?: string;
+    storeId?: string;
+    /** Trusted vault override; the unsigned Swell-Vault-Url header is not used. */
+    vaultUrl?: string;
+}
+/** Request-local server data. Only getStorefrontConfig's projection may be sent to the browser. */
+export interface SwellRequestContext {
+    readonly storeId: string;
+    readonly appId: string;
+    readonly installationId: string;
+    readonly environmentId?: string;
+    readonly storefrontId?: string;
+    readonly apiHost: string;
+    readonly adminUrl: string;
+    readonly accessToken?: string;
+    readonly publicKey?: string;
+    readonly requestId?: string;
+    readonly vaultUrl?: string;
+    readonly staff: Readonly<StaffIdentity> | null;
+    /** False only when trusted runtime configuration explicitly disables verification. */
+    readonly signatureVerified: boolean;
+}
+/**
+ * Resolves Swell-Context once per request. Uses ES256 and a pinned JWKS endpoint;
+ * never discovers keys from the request. No fallback to plain headers or staff cookies.
+ */
+export declare function verifySwellContext(headers: HeaderReader, options?: VerifySwellContextOptions): Promise<SwellRequestContext>;

package/dist/request-context.js

@@ -0,0 +1,99 @@
+import { requireString, validateUrl } from './context.js';
+import { SwellError } from './error.js';
+import { getVerificationKey } from './jwks.js';
+function invalidContext() {
+    return new SwellError('Missing or invalid Swell context', { status: 401, code: 'invalid_swell_context' });
+}
+function decode(value) {
+    if (!/^[A-Za-z0-9_-]+$/.test(value))
+        throw invalidContext();
+    return Uint8Array.from(atob(value.replace(/-/g, '+').replace(/_/g, '/')), char => char.charCodeAt(0));
+}
+function object(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw invalidContext();
+}
+/**
+ * Resolves Swell-Context once per request. Uses ES256 and a pinned JWKS endpoint;
+ * never discovers keys from the request. No fallback to plain headers or staff cookies.
+ */
+export async function verifySwellContext(headers, options = {}) {
+    const runtime = globalThis;
+    const env = options.env ?? runtime.process?.env ?? {};
+    const verify = env.SWELL_VERIFY_HEADERS !== 'false';
+    const jwksUrl = validateUrl(env.SWELL_HEADERS_JWKS_URL ?? 'https://swell.store/.well-known/jwks.json', 'SWELL_HEADERS_JWKS_URL');
+    const issuer = new URL(jwksUrl).origin;
+    for (const field of ['appId', 'storeId']) {
+        if (options[field] !== undefined)
+            requireString(options[field], field);
+    }
+    const vaultUrl = options.vaultUrl === undefined ? undefined : validateUrl(options.vaultUrl, 'vaultUrl');
+    const token = headers.get('Swell-Context');
+    if (!token || token.length > 16_384)
+        throw invalidContext();
+    let payload;
+    let header;
+    let signature;
+    const parts = token.split('.');
+    try {
+        if (parts.length !== 3)
+            throw invalidContext();
+        header = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(decode(parts[0])));
+        payload = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(decode(parts[1])));
+        object(header);
+        object(payload);
+        signature = decode(parts[2]);
+        if (header.alg !== 'ES256' || typeof header.kid !== 'string' || !header.kid || header.crit !== undefined || header.b64 !== undefined || signature.length !== 64)
+            throw invalidContext();
+    }
+    catch {
+        throw invalidContext();
+    }
+    if (verify) {
+        const key = await getVerificationKey(jwksUrl, header.kid);
+        if (!await crypto.subtle.verify({ name: 'ECDSA', hash: 'SHA-256' }, key, signature, new TextEncoder().encode(`${parts[0]}.${parts[1]}`)))
+            throw invalidContext();
+    }
+    try {
+        const now = Date.now() / 1000;
+        // The issuer controls token lifetime; allow five seconds for clock skew.
+        if (typeof payload.iat !== 'number' || !Number.isFinite(payload.iat) || payload.iat > now + 5 ||
+            typeof payload.exp !== 'number' || !Number.isFinite(payload.exp) || payload.exp <= now - 5 ||
+            payload.exp <= payload.iat)
+            throw invalidContext();
+        if (payload.nbf !== undefined && (typeof payload.nbf !== 'number' || !Number.isFinite(payload.nbf) || payload.nbf > now + 5))
+            throw invalidContext();
+        requireString(payload.iss, 'iss');
+        if (verify && payload.iss !== issuer)
+            throw invalidContext();
+        for (const field of ['store_id', 'app_id', 'installation_id'])
+            requireString(payload[field], field);
+        if (payload.aud !== payload.app_id || (options.appId !== undefined && payload.aud !== options.appId) ||
+            (options.storeId !== undefined && payload.store_id !== options.storeId))
+            throw invalidContext();
+        for (const field of ['environment_id', 'storefront_id']) {
+            if (payload[field] != null)
+                requireString(payload[field], field);
+        }
+        let staff = null;
+        if (payload.admin !== null) {
+            object(payload.admin);
+            requireString(payload.admin.user_id, 'admin.user_id');
+            staff = Object.freeze({ userId: payload.admin.user_id, storeId: payload.store_id });
+        }
+        return Object.freeze({
+            storeId: payload.store_id, appId: payload.app_id,
+            installationId: payload.installation_id,
+            environmentId: payload.environment_id ?? undefined,
+            storefrontId: payload.storefront_id ?? undefined,
+            apiHost: validateUrl(payload.api_host, 'api_host'), adminUrl: validateUrl(payload.admin_url, 'admin_url'),
+            accessToken: headers.get('Swell-Access-Token') ?? undefined,
+            publicKey: headers.get('Swell-Public-Key') ?? undefined,
+            requestId: headers.get('Swell-Request-ID') ?? undefined,
+            vaultUrl, staff, signatureVerified: verify,
+        });
+    }
+    catch {
+        throw invalidContext();
+    }
+}

package/dist/staff.d.cts

@@ -0,0 +1,7 @@
+import type { SwellRequestContext } from './request-context.cjs';
+export interface StaffIdentity {
+    readonly userId: string;
+    readonly storeId: string;
+}
+/** Identity only; any dashboard role counts. The proxy owns write-origin checks; the app owns permissions. */
+export declare function requireStaff(context: SwellRequestContext): StaffIdentity;

package/dist/staff.d.ts

@@ -0,0 +1,7 @@
+import type { SwellRequestContext } from './request-context.js';
+export interface StaffIdentity {
+    readonly userId: string;
+    readonly storeId: string;
+}
+/** Identity only; any dashboard role counts. The proxy owns write-origin checks; the app owns permissions. */
+export declare function requireStaff(context: SwellRequestContext): StaffIdentity;

package/dist/staff.js

@@ -0,0 +1,7 @@
+import { SwellError } from './error.js';
+/** Identity only; any dashboard role counts. The proxy owns write-origin checks; the app owns permissions. */
+export function requireStaff(context) {
+    if (!context.staff)
+        throw new SwellError('Staff identity required', { status: 401, code: 'staff_required' });
+    return context.staff;
+}

package/dist/storefront.d.cts

@@ -0,0 +1,28 @@
+import './guard.cjs';
+import type { PublicConfig, SwellClient } from 'swell-js';
+export interface CookieOptions {
+    path?: string;
+    maxAge?: number;
+    sameSite?: 'lax' | 'strict' | 'none';
+    domain?: string;
+    expires?: Date;
+    secure?: boolean;
+    httpOnly?: boolean;
+    [attribute: string]: string | number | boolean | Date | undefined;
+}
+export interface CookieAdapter {
+    /** Return decoded current values, including this request's writes/deletes. The adapter owns state. */
+    get(name: string): string | undefined;
+    /** Owns write policy: may skip a write, or throw when required persistence is unavailable. */
+    set?(name: string, value: string, options: CookieOptions): void;
+}
+export interface StorefrontOptions {
+    cookies: CookieAdapter;
+    /** Replaces native defaults (/, one week, SameSite=Lax). Use {} for adapter-owned policy. */
+    cookieOptions?: CookieOptions;
+}
+/** Creates an isolated native swell-js client. Replace request before first use to add caching. */
+export declare function createStorefrontClient(config: PublicConfig<'camel'> & {
+    useCamelCase: true;
+}, options: StorefrontOptions): SwellClient<'camel'>;
+export declare function createStorefrontClient<C extends 'snake' | 'camel' = 'snake'>(config: PublicConfig<C>, options: StorefrontOptions): SwellClient<C>;

package/dist/storefront.d.ts

@@ -0,0 +1,28 @@
+import './guard.js';
+import type { PublicConfig, SwellClient } from 'swell-js';
+export interface CookieOptions {
+    path?: string;
+    maxAge?: number;
+    sameSite?: 'lax' | 'strict' | 'none';
+    domain?: string;
+    expires?: Date;
+    secure?: boolean;
+    httpOnly?: boolean;
+    [attribute: string]: string | number | boolean | Date | undefined;
+}
+export interface CookieAdapter {
+    /** Return decoded current values, including this request's writes/deletes. The adapter owns state. */
+    get(name: string): string | undefined;
+    /** Owns write policy: may skip a write, or throw when required persistence is unavailable. */
+    set?(name: string, value: string, options: CookieOptions): void;
+}
+export interface StorefrontOptions {
+    cookies: CookieAdapter;
+    /** Replaces native defaults (/, one week, SameSite=Lax). Use {} for adapter-owned policy. */
+    cookieOptions?: CookieOptions;
+}
+/** Creates an isolated native swell-js client. Replace request before first use to add caching. */
+export declare function createStorefrontClient(config: PublicConfig<'camel'> & {
+    useCamelCase: true;
+}, options: StorefrontOptions): SwellClient<'camel'>;
+export declare function createStorefrontClient<C extends 'snake' | 'camel' = 'snake'>(config: PublicConfig<C>, options: StorefrontOptions): SwellClient<C>;

package/dist/storefront.js

@@ -0,0 +1,44 @@
+import './guard.js';
+import swell from 'swell-js';
+import { requireString, validateUrl } from './context.js';
+export function createStorefrontClient(config, { cookies, cookieOptions = { path: '/', maxAge: 604800, sameSite: 'lax' } }) {
+    for (const field of ['getCookie', 'setCookie', 'getCart', 'updateCart']) {
+        if (field in config)
+            throw new Error(`Invalid public config callback: ${field}`);
+    }
+    requireString(config.storeId, 'storeId');
+    requireString(config.publicKey, 'publicKey');
+    for (const field of ['url', 'vaultUrl']) {
+        if (config[field] !== undefined)
+            validateUrl(config[field], field);
+    }
+    for (const field of ['locale', 'currency', 'session', 'store', 'key']) {
+        if (config[field] !== undefined && typeof config[field] !== 'string')
+            throw new Error(`Invalid ${field}`);
+    }
+    for (const field of ['useCamelCase', 'previewContent']) {
+        if (config[field] !== undefined && typeof config[field] !== 'boolean')
+            throw new Error(`Invalid ${field}`);
+    }
+    if (config.timeout !== undefined && (!Number.isFinite(config.timeout) || config.timeout < 0))
+        throw new Error('Invalid timeout');
+    if (config.headers !== undefined && (!config.headers || typeof config.headers !== 'object' || Array.isArray(config.headers) || Object.values(config.headers).some(value => typeof value !== 'string')))
+        throw new Error('Invalid headers');
+    if (!cookies || typeof cookies.get !== 'function' || (cookies.set !== undefined && typeof cookies.set !== 'function'))
+        throw new Error('A cookie adapter with get() and optional set() is required');
+    return swell.create(config.storeId, config.publicKey, {
+        ...config,
+        headers: { ...config.headers },
+        getCookie: name => cookies.get(name),
+        setCookie(name, value, attributes = {}) {
+            if (!cookies.set)
+                throw new Error('Cannot write Swell cookies with a read-only adapter; use a writable route handler or action');
+            const options = { ...cookieOptions };
+            for (const [key, value] of Object.entries(attributes)) {
+                const normalized = { 'max-age': 'maxAge', maxage: 'maxAge', samesite: 'sameSite', httponly: 'httpOnly' }[key.toLowerCase()] ?? key;
+                options[normalized] = value;
+            }
+            return cookies.set(name, value, options);
+        },
+    });
+}

package/dist/version.d.cts

@@ -0,0 +1 @@
+export declare const USER_AGENT = "swell-apps-sdk/2.0.0-alpha.1";

package/dist/version.d.ts

@@ -0,0 +1 @@
+export declare const USER_AGENT = "swell-apps-sdk/2.0.0-alpha.1";

package/dist/version.js

@@ -0,0 +1,2 @@
+// Replaced with the package version by the build.
+export const USER_AGENT = 'swell-apps-sdk/2.0.0-alpha.1';

package/dist/workflow.d.cts

@@ -0,0 +1 @@
+export declare function validateWorkflowParams(params: unknown): unknown;

package/dist/workflow.d.ts

@@ -0,0 +1 @@
+export declare function validateWorkflowParams(params: unknown): unknown;

package/dist/workflow.js

@@ -0,0 +1,35 @@
+import { SwellError } from './error.js';
+function paramsError(code, message) {
+    return new SwellError({ error: { code, message, status: 400, retryable: false } }, { code, status: 400 });
+}
+function validateValue(value, seen) {
+    if (value === null || typeof value === 'string' || typeof value === 'boolean' || (typeof value === 'number' && Number.isFinite(value)))
+        return;
+    if (typeof value !== 'object' || value === null || seen.has(value) || Object.getOwnPropertySymbols(value).length) {
+        throw paramsError('workflow_params_unserializable', 'Workflow params must be JSON-safe values');
+    }
+    if (Array.isArray(value)) {
+        const keys = Object.keys(value);
+        if (keys.some(key => !/^(0|[1-9]\d*)$/.test(key) || Number(key) >= value.length)) {
+            throw paramsError('workflow_params_unserializable', 'Workflow params must be JSON-safe values');
+        }
+        for (let index = 0; index < value.length; index++) {
+            if (!Object.prototype.hasOwnProperty.call(value, index))
+                throw paramsError('workflow_params_unserializable', 'Workflow params must be JSON-safe values');
+        }
+    }
+    else if (Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) {
+        throw paramsError('workflow_params_unserializable', 'Workflow params must be JSON-safe values');
+    }
+    seen.add(value);
+    for (const item of Array.isArray(value) ? value : Object.values(value))
+        validateValue(item, seen);
+    seen.delete(value);
+}
+export function validateWorkflowParams(params) {
+    validateValue(params, new Set());
+    if (new TextEncoder().encode(JSON.stringify(params)).length > 128 * 1024) {
+        throw paramsError('workflow_params_too_large', 'Workflow params are too large; pass identifiers and re-fetch data inside the workflow');
+    }
+    return params;
+}

package/package.json

@@ -1,77 +1,62 @@
 {
   "name": "@swell/apps-sdk",
+  "version": "2.0.0-alpha.1",
+  "description": "Server SDK for Swell apps.",
   "type": "module",
-  "version": "1.0.190",
-  "description": "Swell SDK for building isomorphic apps.",
-  "author": "Swell",
   "license": "MIT",
   "engines": {
-    "node": ">=18.16.1",
-    "npm": ">=9.3.1"
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/swellstores/swell-apps-sdk"
-  },
-  "main": "./dist/index.cjs",
-  "module": "./dist/index.mjs",
-  "browser": "./dist/index.js",
-  "types": "./types/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./types/index.d.ts",
-      "require": "./dist/index.cjs",
-      "import": "./dist/index.mjs"
-    }
+    "node": ">=22.22.2"
   },
   "files": [
-    "dist",
-    "types/*.d.ts"
+    "dist"
   ],
   "scripts": {
-    "prebuild": "rimraf dist",
     "build": "node scripts/build.mjs",
-    "postbuild": "tsc --project tsconfig.build.json",
-    "prepare": "git config core.hooksPath .git-hooks || echo 'Not in a git repo'",
-    "prepublishOnly": "npm i && npm run build",
-    "watch": "node scripts/build.mjs watch",
-    "test": "jest --silent"
+    "prepack": "npm run build",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "npm run build && node --test test/*.test.mjs",
+    "test:package": "node scripts/verify-package.mjs",
+    "test:boundaries": "node scripts/verify-boundaries.mjs",
+    "test:worker": "node scripts/verify-worker.mjs",
+    "verify": "npm test && npm run typecheck && npm run test:package && npm run test:boundaries && npm run test:worker"
   },
-  "dependencies": {
-    "@swell/easyblocks-core": "^1.0.19",
-    "cache-manager": "^7.0.1",
-    "color": "^4.2.3",
-    "country-flag-icons": "1.5.18",
-    "json5": "^2.2.3",
-    "keyv": "^5.3.4",
-    "liquidjs": "^10.21.0",
-    "lodash-es": "^4.17.21",
-    "qs": "^6.12.3",
-    "strftime": "^0.10.3",
-    "swell-js": "^5.1.2"
+  "peerDependencies": {
+    "swell-js": ">=5.9.1"
   },
   "devDependencies": {
-    "@cloudflare/workers-types": "^4.20250902.0",
-    "@eslint/js": "^9.19.0",
-    "@jest/transform": "^29.7.0",
-    "@types/color": "^4.2.0",
-    "@types/jest": "^29.5.14",
-    "@types/lodash-es": "^4.17.12",
-    "@types/qs": "^6.9.15",
-    "@types/react": "^18.2.64",
-    "@types/react-dom": "^18.2.21",
-    "@types/strftime": "^0.9.8",
-    "esbuild": "^0.24.2",
-    "eslint": "^9.19.0",
-    "eslint-config-prettier": "^10.0.1",
-    "eslint-plugin-jest": "^28.11.0",
-    "eslint-plugin-prettier": "^5.2.3",
-    "jest": "29.7.0",
-    "jest-esbuild": "^0.4.0",
-    "prettier": "^3.4.2",
-    "rimraf": "^6.0.1",
-    "ts-jest": "^29.2.5",
-    "typescript": "^5.7.3",
-    "typescript-eslint": "^8.23.0"
-  }
+    "esbuild": "0.24.2",
+    "miniflare": "5.20260911.1-alpha",
+    "swell-js": "5.9.1",
+    "typescript": "5.7.3"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": {
+        "import": "./dist/index.d.ts",
+        "require": "./dist/index.d.cts"
+      },
+      "workerd": "./dist/index.js",
+      "node": "./dist/index.js",
+      "browser": "./dist/browser-refusal.js",
+      "default": "./dist/index.js"
+    },
+    "./storefront": {
+      "types": {
+        "import": "./dist/storefront.d.ts",
+        "require": "./dist/storefront.d.cts"
+      },
+      "workerd": "./dist/storefront.js",
+      "node": "./dist/storefront.js",
+      "browser": "./dist/browser-refusal.js",
+      "default": "./dist/storefront.js"
+    }
+  },
+  "sideEffects": [
+    "./dist/index.js",
+    "./dist/storefront.js",
+    "./dist/guard.js",
+    "./dist/browser-refusal.js"
+  ]
 }