@vitrine-kit/core 0.2.1 → 0.3.0

package/README.md

@@ -1,5 +1,24 @@
 # @vitrine-kit/core
 
-Vitrine's critical logic: the slot and adapter runtime, the order pipeline, and the Stripe webhook handler.
+Vitrine's critical logic: the slot and adapter runtime, the order pipeline, and provider-neutral payment webhook dispatch.
 
 This is where "a bug = an incident for every client at once" (spec §4). That's why it's a **versioned package** rather than copy-in: a critical fix reaches everyone via a version bump.
+
+## Global registries and isolation
+
+`slotRegistry`, `adapters`, and `payments` are **module-level singletons** — state is shared by
+everything importing this package in one process. That is the right default for a Vitrine client
+(1 client = 1 repository = 1 store; `lib/slots.ts` / `lib/payments.ts` register once at module
+load, which is idempotent-safe because generated registration modules only run once per process).
+
+Do NOT reach for the globals when you need isolation:
+
+- **Tests** — create your own: `createSlotRegistry()`, `createAdapterRegistry()`,
+  `createPaymentRegistry()`; `<Slot registry={...}>` accepts one. Or `clear()` the global in a
+  `finally` block.
+- **Multi-tenant / multi-store servers** — one process serving several stores must NOT share the
+  globals (registrations from one tenant would leak into another). Keep a registry instance per
+  tenant and pass it explicitly.
+
+Registering the same mount twice (e.g. calling a `register<Feature>Slots()` again after HMR)
+duplicates it — re-registration should go through `clear()` first.

package/dist/index.d.ts

@@ -1,6 +1,8 @@
 export { S as SlotRegistry, c as createSlotRegistry, g as getSlotMounts, r as registerSlot, s as slotRegistry } from './registry-CfORxf9H.js';
 import { Backend, SiteConfig, CatalogSource, CommerceBackend, Cart, Order, Money, CurrencyCode, OrderStatus } from '@vitrine-kit/contracts';
 
+declare const CORE_VERSION: "0.3.0";
+
 interface AdapterFactory {
     backend: Backend;
     createCatalog(config: SiteConfig): CatalogSource;
@@ -27,7 +29,7 @@ interface OrderPipelineContext {
 type OrderStage<T = OrderPipelineContext> = (ctx: T) => T | Promise<T>;
 /**
  * Runs the context through the stages sequentially. Any stage error aborts the
- * pipeline (rollback/idempotency are the responsibility of specific stages in M8).
+ * pipeline (rollback/idempotency are the responsibility of specific stages).
  */
 declare function runPipeline<T>(ctx: T, stages: ReadonlyArray<OrderStage<T>>): Promise<T>;
 
@@ -141,6 +143,19 @@ interface BuildOrderOptions {
 /** Snapshots the cart into an order (after payment). Totals come from the cart — not recomputed. */
 declare function buildOrderFromCart(cart: Cart, opts: BuildOrderOptions): Order;
 
-declare const CORE_VERSION: "0.1.0";
+interface RateLimitOptions {
+    /** Max requests allowed within the window. */
+    limit: number;
+    /** Window size in milliseconds. */
+    windowMs: number;
+}
+interface RateLimitResult {
+    allowed: boolean;
+    /** Milliseconds until the caller may retry — present only when !allowed. */
+    retryAfterMs?: number;
+}
+declare function checkRateLimit(key: string, { limit, windowMs }: RateLimitOptions): RateLimitResult;
+/** Best-effort client IP from standard proxy headers (Web Fetch API `Headers`). */
+declare function clientIpFromHeaders(headers: Headers): string;
 
-export { type AdapterFactory, type AdapterRegistry, type BuildOrderOptions, CORE_VERSION, type CreateCheckoutArgs, type NewLineInput, type NormalizedPaymentEvent, type OrderCreationGuard, type OrderPipelineContext, type OrderStage, type PaymentProvider, type PaymentProviderName, type PaymentRegistry, type PaymentWebhookHandlers, type PaymentWebhookRequest, type PaymentWebhookResult, adapters, addCartLine, buildOrderFromCart, cartItemCount, computeLineTotal, createAdapterRegistry, createPaymentRegistry, emptyCart, handlePaymentWebhook, payments, recalcCart, removeCartLine, runPipeline, setCartLineQty, shouldCreateOrder };
+export { type AdapterFactory, type AdapterRegistry, type BuildOrderOptions, CORE_VERSION, type CreateCheckoutArgs, type NewLineInput, type NormalizedPaymentEvent, type OrderCreationGuard, type OrderPipelineContext, type OrderStage, type PaymentProvider, type PaymentProviderName, type PaymentRegistry, type PaymentWebhookHandlers, type PaymentWebhookRequest, type PaymentWebhookResult, type RateLimitOptions, type RateLimitResult, adapters, addCartLine, buildOrderFromCart, cartItemCount, checkRateLimit, clientIpFromHeaders, computeLineTotal, createAdapterRegistry, createPaymentRegistry, emptyCart, handlePaymentWebhook, payments, recalcCart, removeCartLine, runPipeline, setCartLineQty, shouldCreateOrder };

package/dist/index.js

@@ -5,6 +5,9 @@ import {
   slotRegistry
 } from "./chunk-BQVNYHVU.js";
 
+// src/version.generated.ts
+var CORE_VERSION = "0.3.0";
+
 // src/adapter/resolver.ts
 function createAdapterRegistry() {
   const factories = /* @__PURE__ */ new Map();
@@ -184,14 +187,34 @@ function buildOrderFromCart(cart, opts) {
   };
 }
 
-// src/index.ts
-var CORE_VERSION = "0.1.0";
+// src/security/rate-limit.ts
+var buckets = /* @__PURE__ */ new Map();
+function checkRateLimit(key, { limit, windowMs }) {
+  const now = Date.now();
+  const bucket = buckets.get(key);
+  if (!bucket || bucket.resetAt <= now) {
+    buckets.set(key, { count: 1, resetAt: now + windowMs });
+    return { allowed: true };
+  }
+  if (bucket.count >= limit) {
+    return { allowed: false, retryAfterMs: bucket.resetAt - now };
+  }
+  bucket.count += 1;
+  return { allowed: true };
+}
+function clientIpFromHeaders(headers) {
+  const forwarded = headers.get("x-forwarded-for");
+  const first = forwarded?.split(",")[0]?.trim();
+  return first || headers.get("x-real-ip") || "unknown";
+}
 export {
   CORE_VERSION,
   adapters,
   addCartLine,
   buildOrderFromCart,
   cartItemCount,
+  checkRateLimit,
+  clientIpFromHeaders,
   computeLineTotal,
   createAdapterRegistry,
   createPaymentRegistry,

package/dist/react.js

@@ -12,10 +12,17 @@ function Slot(props) {
   const reg = registry ?? slotRegistry;
   const mounts = reg.get(name);
   if (mounts.length === 0) return fallback;
+  const seen = /* @__PURE__ */ new Map();
   return createElement(
     Fragment,
     null,
-    ...mounts.map((m, i) => createElement(m.component, { key: i, ...rest }))
+    ...mounts.map((m) => {
+      const c = m.component;
+      const base = c.displayName ?? (c.name || "mount");
+      const n = seen.get(base) ?? 0;
+      seen.set(base, n + 1);
+      return createElement(m.component, { key: n === 0 ? base : `${base}:${n}`, ...rest });
+    })
   );
 }
 export {

package/package.json

@@ -1,9 +1,13 @@
 {
   "name": "@vitrine-kit/core",
-  "version": "0.2.1",
-  "description": "Vitrine core — slot/adapter runtime, order pipeline, Stripe webhook. Critical logic (a bug = an incident for everyone).",
+  "version": "0.3.0",
+  "description": "Vitrine core — slot/adapter runtime, order pipeline, provider-neutral payment webhook dispatch. Critical logic (a bug = an incident for everyone).",
   "license": "MIT",
   "type": "module",
+  "sideEffects": false,
+  "engines": {
+    "node": ">=20"
+  },
   "types": "./dist/index.d.ts",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -29,7 +33,7 @@
     "directory": "packages/core"
   },
   "dependencies": {
-    "@vitrine-kit/contracts": "1.2.0"
+    "@vitrine-kit/contracts": "1.2.1"
   },
   "peerDependencies": {
     "react": ">=18.0.0"
@@ -44,8 +48,8 @@
     "react": "^18.3.1"
   },
   "scripts": {
-    "build": "tsup src/index.ts src/react.ts --format esm --dts --clean",
-    "typecheck": "tsc --noEmit",
+    "build": "node scripts/generate-version.mjs && tsup src/index.ts src/react.ts --format esm --dts --clean",
+    "typecheck": "node scripts/generate-version.mjs && tsc --noEmit",
     "test": "vitest run --passWithNoTests"
   }
 }