@usethrottle/catalog 1.3.0 → 1.4.1

package/dist/index.d.cts

@@ -1,12 +1,58 @@
-import { S as StorefrontCategoryNode, b as StorefrontListAnswer, c as StorefrontListProduct, d as ReviewEligibilityAnswer, e as StorefrontProductAnswer } from './contract-types-BRyonOYH.cjs';
-export { C as CartCheckAnswer, f as CartCheckRequest, g as CartCreateAnswer, h as CartCreateRequest, i as CatalogContractErrorCode, R as ReviewSubmitAnswer, a as ReviewSubmitInput, j as StorefrontCategoriesAnswer, k as StorefrontCategoryAnswer, l as StorefrontCollectionAnswer, m as StorefrontCollectionsAnswer, n as StorefrontConfigAnswer, o as StorefrontFilterValuesAnswer, p as StorefrontRelatedAnswer, q as StorefrontReviewsAnswer, r as StorefrontSuggestAnswer, s as StorefrontTagsAnswer } from './contract-types-BRyonOYH.cjs';
+import { S as StorefrontSettings, b as StorefrontMenuItem, c as StorefrontCategoryNode, d as StorefrontListAnswer, e as StorefrontListProduct, f as ReviewEligibilityAnswer, g as StorefrontProductAnswer } from './contract-types-BJMeJSTz.cjs';
+export { C as CartCheckAnswer, h as CartCheckRequest, i as CartCreateAnswer, j as CartCreateRequest, k as CatalogContractErrorCode, R as ReviewSubmitAnswer, a as ReviewSubmitInput, l as StorefrontCategoriesAnswer, m as StorefrontCategoryAnswer, n as StorefrontCollectionAnswer, o as StorefrontCollectionsAnswer, p as StorefrontConfigAnswer, q as StorefrontFilterDefinition, r as StorefrontFilterValuesAnswer, s as StorefrontLatestReviewsAnswer, t as StorefrontLookupAnswer, u as StorefrontPageAnswer, v as StorefrontPagesAnswer, w as StorefrontRelatedAnswer, x as StorefrontReviewsAnswer, y as StorefrontSuggestAnswer, z as StorefrontTagsAnswer } from './contract-types-BJMeJSTz.cjs';
 export { S as SDK_VERSION } from './version-ev3p03v2.cjs';
 import * as money from '@usethrottle/money';
 export { money };
 export { CURRENCIES, CurrencyCode, MoneyValue, UnknownCurrencyError, currencySymbol, formatMoney, isKnownCurrency, minorUnitsOf, moneyValue, parseMoney, toDecimalString, toMinor } from '@usethrottle/money';
-export { C as CatalogClient, c as createCatalogClient } from './client-6j1Iz-iJ.cjs';
-export { c as CallOptions, d as CartAbsorb, e as CartCheckout, f as CartCheckoutInput, g as CartSession, h as CartSessionBranding, i as CartSessionDetail, j as CartSessionSnapshot, b as CartWarning, k as CartsNamespace, l as CatalogClientOptions, m as CatalogHttpCache, n as CatalogHttpCacheEntry, o as CatalogNamespaces, p as CategoriesNamespace, a as CategoryTreeDepth, q as CollectionsNamespace, C as CustomerCartSource, r as CustomerTokenSource, F as FieldsOption, s as FiltersNamespace, N as NextFetchOptions, O as OpenCartRef, t as ProductsNamespace, P as ProductsQuery, R as Redirect, u as ReviewsNamespace, S as SessionCallOptions, v as StorefrontSort, w as TagsNamespace, T as ThrottleCart, x as ThrottleLine } from './types-D0PywKnN.cjs';
-export { C as CartLineError, a as CartLineProblem, b as CatalogError, c as CatalogErrorCode, d as CatalogErrorInit, e as CatalogErrorIssue, f as CatalogErrorSource, g as ClientErrorCode, h as CustomerTokenInvalidError, F as FeatureUnavailableError, N as NetworkError, O as OriginNotAllowedError, R as RateLimitedError, j as ThrottleCartCode, T as TimeoutError, i as isCatalogError } from './catalog-error-BOaSKgY3.cjs';
+export { C as CatalogClient, c as createCatalogClient } from './client-CGGlbacq.cjs';
+export { c as CallOptions, d as CartAbsorb, e as CartCheckout, f as CartCheckoutInput, g as CartSession, h as CartSessionBranding, i as CartSessionDetail, j as CartSessionSnapshot, b as CartWarning, k as CartsNamespace, l as CatalogClientOptions, m as CatalogHttpCache, n as CatalogHttpCacheEntry, o as CatalogNamespaces, p as CategoriesNamespace, a as CategoryTreeDepth, q as CollectionsNamespace, C as CustomerCartSource, r as CustomerTokenSource, F as FieldsOption, s as FiltersNamespace, N as NextFetchOptions, O as OpenCartRef, t as PagesNamespace, u as ProductsNamespace, P as ProductsQuery, R as Redirect, v as ReviewsNamespace, S as SessionCallOptions, w as SettingsCallOptions, x as SettingsNamespace, y as StorefrontSettingsResult, z as StorefrontSort, A as TagsNamespace, T as ThrottleCart, B as ThrottleLine } from './types-BtBxMbM5.cjs';
+export { C as CartLineError, a as CartLineProblem, b as CatalogError, c as CatalogErrorCode, d as CatalogErrorInit, e as CatalogErrorIssue, f as CatalogErrorSource, g as ClientErrorCode, h as CustomerTokenInvalidError, F as FeatureUnavailableError, N as NetworkError, O as OriginNotAllowedError, R as RateLimitedError, j as ThrottleCartCode, T as TimeoutError, i as isCatalogError } from './catalog-error-bG1XHquN.cjs';
+
+/** The settings document as `/config` answers it: text resolved, targets as handles. */
+type ResolvedStorefrontSettings = StorefrontSettings;
+/** Where a menu item, announcement or hero button points. */
+type ResolvedMenuTarget = StorefrontMenuItem['target'];
+/** A key of `settings.strings`. */
+type StringKey = keyof StorefrontSettings['strings'];
+/**
+ * The English text of every storefront string: what `t` falls back to. Kept
+ * in step with the contract's defaults, which the Worker resolves first.
+ */
+declare const DEFAULT_STRINGS: Readonly<Record<StringKey, string>>;
+/**
+ * One string of the store, in the locale the settings were read for, with
+ * `{name}` placeholders filled from `vars` (a name without a value stays as
+ * written). A missing or empty string falls back to the English default.
+ */
+declare function t(settings: {
+    strings?: Partial<Record<StringKey, string>>;
+} | null | undefined, key: StringKey, vars?: Record<string, string | number>): string;
+/**
+ * The URL a menu target points to, from the store's route patterns
+ * (`settings.routes`); `null` when the target has nothing to point at (no
+ * handle, or a link that is not http(s) or a site path).
+ */
+declare function resolveMenuTarget(settings: Pick<ResolvedStorefrontSettings, 'routes'>, target: ResolvedMenuTarget): string | null;
+/** The style options `@usethrottle/auth` components take (the part this maps to). */
+type ThrottleAppearance = {
+    theme?: 'light' | 'dark' | 'auto';
+    variables?: Partial<Record<'colorPrimary' | 'colorPrimaryForeground' | 'colorBackground' | 'colorSurface' | 'colorForeground' | 'colorMuted' | 'colorMutedForeground' | 'colorBorder' | 'colorBorderControl' | 'colorDanger' | 'colorSuccess' | 'colorWarning' | 'fontFamily' | 'borderRadius', string>>;
+};
+type Fonts = StorefrontSettings['theme']['fonts'];
+/**
+ * One Google Fonts `css2` URL for the theme's fonts: each Google family once,
+ * with the weights the storefront uses (400 to 700, as far as the family has
+ * them) and `display=swap`. `null` when every font is a system stack.
+ */
+declare function fontStylesheetHref(theme: {
+    fonts: Fonts;
+}): string | null;
+/**
+ * The appearance for `@usethrottle/auth` components under the store's theme:
+ * the `scheme` palette (its accent and sale colours have no auth variable),
+ * `fonts.body` as `fontFamily` and `radius` as `borderRadius`.
+ */
+declare function toAuthAppearance(theme: Pick<StorefrontSettings['theme'], 'light' | 'dark' | 'fonts' | 'radius'>, scheme: 'light' | 'dark'): ThrottleAppearance;
 
 /** The answer of `reviews.eligibility`. */
 type ReviewEligibility = ReviewEligibilityAnswer;
@@ -19,5 +65,5 @@ type Filter = NonNullable<StorefrontListAnswer['filters']>[number];
 /** One node of the category tree. */
 type CategoryNode = StorefrontCategoryNode;
 
-export { ReviewEligibilityAnswer, StorefrontCategoryNode, StorefrontListAnswer, StorefrontListProduct, StorefrontProductAnswer };
-export type { CategoryNode, Filter, ListProduct, ReviewEligibility, StorefrontProduct };
+export { DEFAULT_STRINGS, ReviewEligibilityAnswer, StorefrontCategoryNode, StorefrontListAnswer, StorefrontListProduct, StorefrontMenuItem, StorefrontProductAnswer, StorefrontSettings, fontStylesheetHref, resolveMenuTarget, t, toAuthAppearance };
+export type { CategoryNode, Filter, ListProduct, ResolvedMenuTarget, ResolvedStorefrontSettings, ReviewEligibility, StorefrontProduct, StringKey, ThrottleAppearance };

package/dist/index.d.ts

@@ -1,12 +1,58 @@
-import { S as StorefrontCategoryNode, b as StorefrontListAnswer, c as StorefrontListProduct, d as ReviewEligibilityAnswer, e as StorefrontProductAnswer } from './contract-types-BRyonOYH.js';
-export { C as CartCheckAnswer, f as CartCheckRequest, g as CartCreateAnswer, h as CartCreateRequest, i as CatalogContractErrorCode, R as ReviewSubmitAnswer, a as ReviewSubmitInput, j as StorefrontCategoriesAnswer, k as StorefrontCategoryAnswer, l as StorefrontCollectionAnswer, m as StorefrontCollectionsAnswer, n as StorefrontConfigAnswer, o as StorefrontFilterValuesAnswer, p as StorefrontRelatedAnswer, q as StorefrontReviewsAnswer, r as StorefrontSuggestAnswer, s as StorefrontTagsAnswer } from './contract-types-BRyonOYH.js';
+import { S as StorefrontSettings, b as StorefrontMenuItem, c as StorefrontCategoryNode, d as StorefrontListAnswer, e as StorefrontListProduct, f as ReviewEligibilityAnswer, g as StorefrontProductAnswer } from './contract-types-BJMeJSTz.js';
+export { C as CartCheckAnswer, h as CartCheckRequest, i as CartCreateAnswer, j as CartCreateRequest, k as CatalogContractErrorCode, R as ReviewSubmitAnswer, a as ReviewSubmitInput, l as StorefrontCategoriesAnswer, m as StorefrontCategoryAnswer, n as StorefrontCollectionAnswer, o as StorefrontCollectionsAnswer, p as StorefrontConfigAnswer, q as StorefrontFilterDefinition, r as StorefrontFilterValuesAnswer, s as StorefrontLatestReviewsAnswer, t as StorefrontLookupAnswer, u as StorefrontPageAnswer, v as StorefrontPagesAnswer, w as StorefrontRelatedAnswer, x as StorefrontReviewsAnswer, y as StorefrontSuggestAnswer, z as StorefrontTagsAnswer } from './contract-types-BJMeJSTz.js';
 export { S as SDK_VERSION } from './version-ev3p03v2.js';
 import * as money from '@usethrottle/money';
 export { money };
 export { CURRENCIES, CurrencyCode, MoneyValue, UnknownCurrencyError, currencySymbol, formatMoney, isKnownCurrency, minorUnitsOf, moneyValue, parseMoney, toDecimalString, toMinor } from '@usethrottle/money';
-export { C as CatalogClient, c as createCatalogClient } from './client-B3mL2-xJ.js';
-export { c as CallOptions, d as CartAbsorb, e as CartCheckout, f as CartCheckoutInput, g as CartSession, h as CartSessionBranding, i as CartSessionDetail, j as CartSessionSnapshot, b as CartWarning, k as CartsNamespace, l as CatalogClientOptions, m as CatalogHttpCache, n as CatalogHttpCacheEntry, o as CatalogNamespaces, p as CategoriesNamespace, a as CategoryTreeDepth, q as CollectionsNamespace, C as CustomerCartSource, r as CustomerTokenSource, F as FieldsOption, s as FiltersNamespace, N as NextFetchOptions, O as OpenCartRef, t as ProductsNamespace, P as ProductsQuery, R as Redirect, u as ReviewsNamespace, S as SessionCallOptions, v as StorefrontSort, w as TagsNamespace, T as ThrottleCart, x as ThrottleLine } from './types-BfveENg1.js';
-export { C as CartLineError, a as CartLineProblem, b as CatalogError, c as CatalogErrorCode, d as CatalogErrorInit, e as CatalogErrorIssue, f as CatalogErrorSource, g as ClientErrorCode, h as CustomerTokenInvalidError, F as FeatureUnavailableError, N as NetworkError, O as OriginNotAllowedError, R as RateLimitedError, j as ThrottleCartCode, T as TimeoutError, i as isCatalogError } from './catalog-error-CSoPS0-d.js';
+export { C as CatalogClient, c as createCatalogClient } from './client-CNsVr2lR.js';
+export { c as CallOptions, d as CartAbsorb, e as CartCheckout, f as CartCheckoutInput, g as CartSession, h as CartSessionBranding, i as CartSessionDetail, j as CartSessionSnapshot, b as CartWarning, k as CartsNamespace, l as CatalogClientOptions, m as CatalogHttpCache, n as CatalogHttpCacheEntry, o as CatalogNamespaces, p as CategoriesNamespace, a as CategoryTreeDepth, q as CollectionsNamespace, C as CustomerCartSource, r as CustomerTokenSource, F as FieldsOption, s as FiltersNamespace, N as NextFetchOptions, O as OpenCartRef, t as PagesNamespace, u as ProductsNamespace, P as ProductsQuery, R as Redirect, v as ReviewsNamespace, S as SessionCallOptions, w as SettingsCallOptions, x as SettingsNamespace, y as StorefrontSettingsResult, z as StorefrontSort, A as TagsNamespace, T as ThrottleCart, B as ThrottleLine } from './types-dKvIfrVH.js';
+export { C as CartLineError, a as CartLineProblem, b as CatalogError, c as CatalogErrorCode, d as CatalogErrorInit, e as CatalogErrorIssue, f as CatalogErrorSource, g as ClientErrorCode, h as CustomerTokenInvalidError, F as FeatureUnavailableError, N as NetworkError, O as OriginNotAllowedError, R as RateLimitedError, j as ThrottleCartCode, T as TimeoutError, i as isCatalogError } from './catalog-error-c3BVgU6k.js';
+
+/** The settings document as `/config` answers it: text resolved, targets as handles. */
+type ResolvedStorefrontSettings = StorefrontSettings;
+/** Where a menu item, announcement or hero button points. */
+type ResolvedMenuTarget = StorefrontMenuItem['target'];
+/** A key of `settings.strings`. */
+type StringKey = keyof StorefrontSettings['strings'];
+/**
+ * The English text of every storefront string: what `t` falls back to. Kept
+ * in step with the contract's defaults, which the Worker resolves first.
+ */
+declare const DEFAULT_STRINGS: Readonly<Record<StringKey, string>>;
+/**
+ * One string of the store, in the locale the settings were read for, with
+ * `{name}` placeholders filled from `vars` (a name without a value stays as
+ * written). A missing or empty string falls back to the English default.
+ */
+declare function t(settings: {
+    strings?: Partial<Record<StringKey, string>>;
+} | null | undefined, key: StringKey, vars?: Record<string, string | number>): string;
+/**
+ * The URL a menu target points to, from the store's route patterns
+ * (`settings.routes`); `null` when the target has nothing to point at (no
+ * handle, or a link that is not http(s) or a site path).
+ */
+declare function resolveMenuTarget(settings: Pick<ResolvedStorefrontSettings, 'routes'>, target: ResolvedMenuTarget): string | null;
+/** The style options `@usethrottle/auth` components take (the part this maps to). */
+type ThrottleAppearance = {
+    theme?: 'light' | 'dark' | 'auto';
+    variables?: Partial<Record<'colorPrimary' | 'colorPrimaryForeground' | 'colorBackground' | 'colorSurface' | 'colorForeground' | 'colorMuted' | 'colorMutedForeground' | 'colorBorder' | 'colorBorderControl' | 'colorDanger' | 'colorSuccess' | 'colorWarning' | 'fontFamily' | 'borderRadius', string>>;
+};
+type Fonts = StorefrontSettings['theme']['fonts'];
+/**
+ * One Google Fonts `css2` URL for the theme's fonts: each Google family once,
+ * with the weights the storefront uses (400 to 700, as far as the family has
+ * them) and `display=swap`. `null` when every font is a system stack.
+ */
+declare function fontStylesheetHref(theme: {
+    fonts: Fonts;
+}): string | null;
+/**
+ * The appearance for `@usethrottle/auth` components under the store's theme:
+ * the `scheme` palette (its accent and sale colours have no auth variable),
+ * `fonts.body` as `fontFamily` and `radius` as `borderRadius`.
+ */
+declare function toAuthAppearance(theme: Pick<StorefrontSettings['theme'], 'light' | 'dark' | 'fonts' | 'radius'>, scheme: 'light' | 'dark'): ThrottleAppearance;
 
 /** The answer of `reviews.eligibility`. */
 type ReviewEligibility = ReviewEligibilityAnswer;
@@ -19,5 +65,5 @@ type Filter = NonNullable<StorefrontListAnswer['filters']>[number];
 /** One node of the category tree. */
 type CategoryNode = StorefrontCategoryNode;
 
-export { ReviewEligibilityAnswer, StorefrontCategoryNode, StorefrontListAnswer, StorefrontListProduct, StorefrontProductAnswer };
-export type { CategoryNode, Filter, ListProduct, ReviewEligibility, StorefrontProduct };
+export { DEFAULT_STRINGS, ReviewEligibilityAnswer, StorefrontCategoryNode, StorefrontListAnswer, StorefrontListProduct, StorefrontMenuItem, StorefrontProductAnswer, StorefrontSettings, fontStylesheetHref, resolveMenuTarget, t, toAuthAppearance };
+export type { CategoryNode, Filter, ListProduct, ResolvedMenuTarget, ResolvedStorefrontSettings, ReviewEligibility, StorefrontProduct, StringKey, ThrottleAppearance };

package/dist/index.js

@@ -3,6 +3,7 @@ import {
   CartLineError,
   CatalogError,
   CustomerTokenInvalidError,
+  DEFAULT_STRINGS,
   FeatureUnavailableError,
   NetworkError,
   OriginNotAllowedError,
@@ -12,6 +13,7 @@ import {
   UnknownCurrencyError,
   createCatalogClient,
   currencySymbol,
+  fontStylesheetHref,
   formatMoney,
   isCatalogError,
   isKnownCurrency,
@@ -19,15 +21,19 @@ import {
   money,
   moneyValue,
   parseMoney,
+  resolveMenuTarget,
+  t,
+  toAuthAppearance,
   toDecimalString,
   toMinor
-} from "./chunk-3DLH56OX.js";
+} from "./chunk-STNQNHNZ.js";
 import "./chunk-PKBMQBKP.js";
 export {
   CURRENCIES,
   CartLineError,
   CatalogError,
   CustomerTokenInvalidError,
+  DEFAULT_STRINGS,
   FeatureUnavailableError,
   NetworkError,
   OriginNotAllowedError,
@@ -37,6 +43,7 @@ export {
   UnknownCurrencyError,
   createCatalogClient,
   currencySymbol,
+  fontStylesheetHref,
   formatMoney,
   isCatalogError,
   isKnownCurrency,
@@ -44,6 +51,9 @@ export {
   money,
   moneyValue,
   parseMoney,
+  resolveMenuTarget,
+  t,
+  toAuthAppearance,
   toDecimalString,
   toMinor
 };

package/dist/next.cjs

@@ -0,0 +1,180 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } async function _asyncNullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return await rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+
+
+var _chunk5AJS3CX5cjs = require('./chunk-5AJS3CX5.cjs');
+
+
+
+var _chunk2ODFFMZ4cjs = require('./chunk-2ODFFMZ4.cjs');
+require('./chunk-ETV4XYOV.cjs');
+
+// src/next/verify.ts
+var HEX_SHA256 = /^[0-9a-fA-F]{64}$/u;
+var TOLERANCE_SECONDS = 300;
+var MAX_V1 = 8;
+var MAX_HEADER_BYTES = 1024;
+var encoder = new TextEncoder();
+async function hmac(secret, payload) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  return new Uint8Array(
+    await crypto.subtle.sign("HMAC", key, encoder.encode(payload))
+  );
+}
+function fromHex(hex) {
+  return Uint8Array.from(
+    { length: hex.length / 2 },
+    (_, i) => Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16)
+  );
+}
+function constantTimeEqual(left, right) {
+  const length = Math.max(left.length, right.length);
+  let difference = left.length ^ right.length;
+  for (let i = 0; i < length; i += 1)
+    difference |= (_nullishCoalesce(left[i], () => ( 0))) ^ (_nullishCoalesce(right[i], () => ( 0)));
+  return difference === 0;
+}
+async function verifyCatalogWebhook(input) {
+  try {
+    const { secret, rawBody, signature } = input;
+    const now = Math.floor(Date.now() / 1e3);
+    if (secret.length === 0 || rawBody.length === 0 || signature.length === 0 || encoder.encode(signature).byteLength > MAX_HEADER_BYTES)
+      return false;
+    const parts = signature.split(",").map((part) => part.split("="));
+    if (parts.some((part) => part.length !== 2)) return false;
+    const timestamps = parts.filter(([k]) => k === "t").map(([, v]) => _nullishCoalesce(v, () => ( "")));
+    const digests = parts.filter(([k]) => k === "v1").map(([, v]) => _nullishCoalesce(v, () => ( "")));
+    if (parts.some(([k]) => k !== "t" && k !== "v1") || timestamps.length !== 1 || digests.length === 0 || digests.length > MAX_V1 || digests.some((d) => !HEX_SHA256.test(d)))
+      return false;
+    const timestampText = _nullishCoalesce(timestamps[0], () => ( ""));
+    if (!/^(?:0|[1-9][0-9]*)$/u.test(timestampText)) return false;
+    const timestamp = Number(timestampText);
+    if (!Number.isSafeInteger(timestamp) || Math.abs(now - timestamp) > TOLERANCE_SECONDS)
+      return false;
+    const expected = await hmac(secret, `${timestampText}.${rawBody}`);
+    let matched = false;
+    for (const digest of digests)
+      matched = constantTimeEqual(expected, fromHex(digest)) || matched;
+    return matched;
+  } catch (e) {
+    return false;
+  }
+}
+
+// src/next/revalidate.ts
+var SIGNATURE_HEADER = "x-catalog-signature";
+var MAX_BODY_BYTES = 64 * 1024;
+async function readCapped(req) {
+  const declared = Number(req.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > MAX_BODY_BYTES) return null;
+  if (req.body === null) return "";
+  const reader = req.body.getReader();
+  const decoder = new TextDecoder();
+  let text = "";
+  let size = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) return text + decoder.decode();
+    size += value.byteLength;
+    if (size > MAX_BODY_BYTES) {
+      await reader.cancel();
+      return null;
+    }
+    text += decoder.decode(value, { stream: true });
+  }
+}
+var json = (status, body) => new Response(JSON.stringify(body), {
+  status,
+  headers: {
+    "content-type": "application/json",
+    "cache-control": "no-store"
+  }
+});
+function parseNotice(rawBody) {
+  let value;
+  try {
+    value = JSON.parse(rawBody);
+  } catch (e2) {
+    return null;
+  }
+  if (typeof value !== "object" || value === null) return null;
+  const event = value;
+  const { generation, scopes } = event;
+  if (event.type !== "storefront.changed" || typeof generation !== "number" || !Number.isSafeInteger(generation) || generation < 0 || !Array.isArray(scopes) || scopes.length === 0 || !scopes.every(
+    (scope) => typeof scope === "string" && scope.length > 0 && scope.length <= _chunk2ODFFMZ4cjs.TAG_MAX_CHARS
+  ) || event.test !== void 0 && typeof event.test !== "boolean")
+    return null;
+  return {
+    generation,
+    scopes,
+    test: event.test === true
+  };
+}
+async function defaultRevalidateTag() {
+  const { revalidateTag } = await Promise.resolve().then(() => _interopRequireWildcard(require("next/cache")));
+  return (tag) => revalidateTag(tag, { expire: 0 });
+}
+function createRevalidateHandler(options) {
+  return async (req) => {
+    const list = typeof options.secret === "string" || options.secret === void 0 ? [options.secret] : options.secret;
+    const secrets = list.filter(
+      (secret) => typeof secret === "string" && secret !== ""
+    );
+    if (secrets.length === 0)
+      return json(500, {
+        error: "createRevalidateHandler has no signing secret: set the webhook secret (for example THROTTLE_WEBHOOK_SECRET) in this environment."
+      });
+    const rawBody = await readCapped(req);
+    if (rawBody === null) return json(413, { error: "body too large" });
+    const signature = _nullishCoalesce(req.headers.get(SIGNATURE_HEADER), () => ( ""));
+    let verified = false;
+    for (const secret of secrets)
+      verified = await verifyCatalogWebhook({ rawBody, signature, secret }) || verified;
+    if (!verified) return json(401, { error: "invalid signature" });
+    const notice = parseNotice(rawBody);
+    if (notice === null) return json(400, { error: "invalid body" });
+    if (notice.test) return json(200, { revalidated: [] });
+    const tags = _chunk5AJS3CX5cjs.scopesToTags.call(void 0, notice.scopes);
+    const revalidate = await _asyncNullishCoalesce(options.revalidateTag, async () => ( await defaultRevalidateTag()));
+    for (const tag of tags) revalidate(tag);
+    _chunk5AJS3CX5cjs.noteMinGeneration.call(void 0, notice.generation, options.floorKey);
+    return json(200, { revalidated: tags });
+  };
+}
+
+// src/next/preview.ts
+var PREVIEW_COOKIE = "throttle_preview";
+var PREVIEW_PARAM = "throttle_preview";
+var PREVIEW_MAX_AGE_S = 3600;
+function previewMiddleware(req) {
+  const url = new URL(req.url);
+  const token = url.searchParams.get(PREVIEW_PARAM);
+  if (token === null || token === "") return null;
+  url.searchParams.delete(PREVIEW_PARAM);
+  return new Response(null, {
+    status: 307,
+    headers: {
+      location: url.toString(),
+      "set-cookie": `${PREVIEW_COOKIE}=${encodeURIComponent(token)}; Max-Age=${PREVIEW_MAX_AGE_S}; Path=/; HttpOnly; Secure; SameSite=None`,
+      "cache-control": "no-store"
+    }
+  });
+}
+async function getPreviewToken() {
+  const { cookies } = await Promise.resolve().then(() => _interopRequireWildcard(require("next/headers")));
+  const store = await cookies();
+  const value = _optionalChain([store, 'access', _2 => _2.get, 'call', _3 => _3(PREVIEW_COOKIE), 'optionalAccess', _4 => _4.value]);
+  return value === void 0 || value === "" ? void 0 : value;
+}
+
+
+
+
+
+
+exports.SDK_VERSION = _chunk2ODFFMZ4cjs.SDK_VERSION; exports.createRevalidateHandler = createRevalidateHandler; exports.getPreviewToken = getPreviewToken; exports.noteMinGeneration = _chunk5AJS3CX5cjs.noteMinGeneration; exports.previewMiddleware = previewMiddleware;

package/dist/next.d.cts

@@ -0,0 +1,60 @@
+export { S as SDK_VERSION } from './version-ev3p03v2.cjs';
+
+type CreateRevalidateHandlerOptions = {
+    /**
+     * The webhook's signing secret; pass `process.env` straight in. A list
+     * accepts any of them, so a rotated secret can be added before the old one
+     * is removed. Checked on each request, not here: an unset variable at
+     * `next build` time must not fail the build. With no secret a request is
+     * answered 500 and nothing is revalidated.
+     */
+    secret: string | undefined | readonly (string | undefined)[];
+    /**
+     * Whose floor the notice's generation raises (see `noteMinGeneration`).
+     * Omitted, it applies to every client in the process: right for one store.
+     * With several stores, pass the `publishableKey` of this store's server
+     * client (or the `floorKey` that client names).
+     */
+    floorKey?: string;
+    /**
+     * Called once per cache tag to clear. Defaults to `revalidateTag` from
+     * `next/cache`.
+     */
+    revalidateTag?: (tag: string) => void;
+};
+/**
+ * The route handler for the catalog's `storefront.changed` webhook. It checks
+ * the `x-catalog-signature` header (HMAC-SHA256 over `<t>.<body>`, 300 s
+ * tolerance, any of the given secrets), clears the cache tags of the event's
+ * scopes and notes its generation so the next `/config` read is fresh.
+ * Answers 200 `{ revalidated }`, 401 for a missing or wrong signature, 400
+ * for a body that is not a change notice, 413 for a body over 64 KB and 500
+ * when no secret is set. A `test` event is acknowledged
+ * (`{ revalidated: [] }`) and does nothing else.
+ */
+declare function createRevalidateHandler(options: CreateRevalidateHandlerOptions): (req: Request) => Promise<Response>;
+
+/**
+ * For Next middleware: a request with `?throttle_preview=<token>` is answered
+ * with a 307 to the same URL without that parameter and the token in an
+ * HTTP-only `SameSite=None; Secure` cookie (one hour), so it works inside the
+ * dashboard's preview iframe. Any other request returns `null`.
+ */
+declare function previewMiddleware(req: Request): Response | null;
+/**
+ * The preview token of the current request (the `throttle_preview` cookie),
+ * for `createServerCatalogClient({ previewToken })`. Reads `cookies()` from
+ * `next/headers`, which is a promise in Next 15 and later and a plain object
+ * in Next 14. Call it where Next allows a request-scoped read.
+ */
+declare function getPreviewToken(): Promise<string | undefined>;
+
+/**
+ * Records `generation` as the minimum the next `/config` read of `floorKey`'s
+ * store (every store, when omitted) must reach. The largest value noted stays
+ * until a `/config` answer reaches it.
+ */
+declare function noteMinGeneration(generation: number, floorKey?: string): void;
+
+export { createRevalidateHandler, getPreviewToken, noteMinGeneration, previewMiddleware };
+export type { CreateRevalidateHandlerOptions };

package/dist/next.d.ts

@@ -0,0 +1,60 @@
+export { S as SDK_VERSION } from './version-ev3p03v2.js';
+
+type CreateRevalidateHandlerOptions = {
+    /**
+     * The webhook's signing secret; pass `process.env` straight in. A list
+     * accepts any of them, so a rotated secret can be added before the old one
+     * is removed. Checked on each request, not here: an unset variable at
+     * `next build` time must not fail the build. With no secret a request is
+     * answered 500 and nothing is revalidated.
+     */
+    secret: string | undefined | readonly (string | undefined)[];
+    /**
+     * Whose floor the notice's generation raises (see `noteMinGeneration`).
+     * Omitted, it applies to every client in the process: right for one store.
+     * With several stores, pass the `publishableKey` of this store's server
+     * client (or the `floorKey` that client names).
+     */
+    floorKey?: string;
+    /**
+     * Called once per cache tag to clear. Defaults to `revalidateTag` from
+     * `next/cache`.
+     */
+    revalidateTag?: (tag: string) => void;
+};
+/**
+ * The route handler for the catalog's `storefront.changed` webhook. It checks
+ * the `x-catalog-signature` header (HMAC-SHA256 over `<t>.<body>`, 300 s
+ * tolerance, any of the given secrets), clears the cache tags of the event's
+ * scopes and notes its generation so the next `/config` read is fresh.
+ * Answers 200 `{ revalidated }`, 401 for a missing or wrong signature, 400
+ * for a body that is not a change notice, 413 for a body over 64 KB and 500
+ * when no secret is set. A `test` event is acknowledged
+ * (`{ revalidated: [] }`) and does nothing else.
+ */
+declare function createRevalidateHandler(options: CreateRevalidateHandlerOptions): (req: Request) => Promise<Response>;
+
+/**
+ * For Next middleware: a request with `?throttle_preview=<token>` is answered
+ * with a 307 to the same URL without that parameter and the token in an
+ * HTTP-only `SameSite=None; Secure` cookie (one hour), so it works inside the
+ * dashboard's preview iframe. Any other request returns `null`.
+ */
+declare function previewMiddleware(req: Request): Response | null;
+/**
+ * The preview token of the current request (the `throttle_preview` cookie),
+ * for `createServerCatalogClient({ previewToken })`. Reads `cookies()` from
+ * `next/headers`, which is a promise in Next 15 and later and a plain object
+ * in Next 14. Call it where Next allows a request-scoped read.
+ */
+declare function getPreviewToken(): Promise<string | undefined>;
+
+/**
+ * Records `generation` as the minimum the next `/config` read of `floorKey`'s
+ * store (every store, when omitted) must reach. The largest value noted stays
+ * until a `/config` answer reaches it.
+ */
+declare function noteMinGeneration(generation: number, floorKey?: string): void;
+
+export { createRevalidateHandler, getPreviewToken, noteMinGeneration, previewMiddleware };
+export type { CreateRevalidateHandlerOptions };