@vtex/faststore 0.0.1

package/dist/sdk/content/create-content-runtime.js

@@ -0,0 +1,503 @@
+import { cache } from "react";
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { cookies, draftMode } from "next/headers";
+import { connection } from "next/server";
+//#region src/sdk/content/create-content-runtime.tsx
+const ENTRY_REQUEST_TIMEOUT_MS = 5e3;
+/**
+* Retention ceilings for the last-good store, both estimated rather than measured: no production
+* store exists yet to size a real composite against, and the example schemas in this repo are demo
+* content, not authored pages, so neither is evidence of real scale.
+*
+* `MAX_RETAINED_BLOB_BYTES` bounds one entry. Ordinary editorial text (a title, a body, an image URL,
+* an alt text) stays in the hundreds of bytes to a few kilobytes per element regardless of how many
+* elements a page composes — even the largest composed layout in this repo (103 elements) does not
+* read as megabytes if every element stays plain text. The realistic way to exceed this is a single
+* field holding embedded binary — a base64 image pasted into a text field instead of uploaded through
+* the media widget — which is exactly the shape this guards against, independent of element count.
+*
+* `MAX_RETAINED_TOTAL_BYTES` bounds the whole store, and is the one that actually matters: the
+* per-blob cap alone does not bound total memory, because it multiplies by key count, and key count is
+* not small — a large store's pages and layouts, times its locales, is plausibly a few hundred keys.
+* A few hundred keys at a few megabytes each already exceeds a typical serverless heap (512 MB–1 GB)
+* on the per-blob cap alone; ~64 MB is a small slice of that heap while still holding many ordinary
+* pages at once.
+*
+* Both numbers count serialized JSON text (`blobByteLength`), not retained heap: a parsed object
+* typically costs more than its JSON text — V8 pays per-property and per-string object overhead that
+* the text itself does not — so the real footprint at either ceiling is larger than the number on the
+* tin, plausibly by a small multiple. Both ceilings still leave headroom against a 512 MB–1 GB heap at
+* that multiple; sizing them as retained heap instead would need a runtime memory measurement this
+* module has no cheap way to take.
+*
+* Both numbers are round and generous on purpose, not derived. `content.retention.skipped` below is
+* the real calibration path: once a production store exists, its log volume says whether either
+* ceiling needs to move.
+*/
+const MAX_RETAINED_BLOB_BYTES = 1e6;
+const MAX_RETAINED_TOTAL_BYTES = 64e6;
+/** Server-only preview credential, supplied at deployment time; never reaches the browser. */
+const PREVIEW_TOKEN_ENV = "CONTENT_PLATFORM_PREVIEW_TOKEN";
+/** Shared broker secret used to verify the signed preview context cookie. */
+const PREVIEW_SECRET_ENV = "CONTENT_PREVIEW_SECRET";
+/** The signed preview context cookie the Draft Mode route sets. */
+const PREVIEW_COOKIE = "__fs_content_preview";
+/**
+* Creates the one server-side content read surface for a store: a `React.cache`-deduped
+* `readContentSlices` the generated page or layout awaits once at the top, and the
+* `ContentEntryBoundary` the compiler wraps around each content-backed element. One read per scope
+* yields every element's `$content` value keyed by `element.id`, so a page issues at most two Data
+* Plane reads (its own entry plus its layout's) regardless of content-backed component count. Draft
+* Mode switches the same read to Control Plane's preview endpoint through a server-only credential.
+*/
+function createContentRuntime(config) {
+	const lastGood = /* @__PURE__ */ new Map();
+	let retainedBytes = 0;
+	/**
+	* Whether a successful read's blob replaces what `key` already holds, weighed against both
+	* ceilings. Skipping never deletes: whatever `key` held before, if anything, is left exactly as it
+	* was — only the update is declined, so a rare oversized read cannot erase a smaller last-good value
+	* that a future failure could still use.
+	*/
+	function retainBlob(key, blob, fields) {
+		const size = blobByteLength(blob);
+		if (size > MAX_RETAINED_BLOB_BYTES) {
+			logEvent("warn", "content.retention.skipped", {
+				...fields,
+				bytes: size,
+				reason: "blob-too-large"
+			});
+			return;
+		}
+		const existing = lastGood.get(key);
+		const existingSize = existing ? blobByteLength(existing) : 0;
+		if (retainedBytes - existingSize + size > MAX_RETAINED_TOTAL_BYTES) {
+			logEvent("warn", "content.retention.skipped", {
+				...fields,
+				bytes: size,
+				reason: "total-cap-reached"
+			});
+			return;
+		}
+		lastGood.set(key, blob);
+		retainedBytes += size - existingSize;
+	}
+	/**
+	* The published read plus the fallback that covers it. The upstream is always called and the store
+	* is read only in the `catch`, which is what makes this a fallback and not a cache: a publish is
+	* visible on the very next request. A success ordinarily overwrites the entry (see `retainBlob` for
+	* the two cases where it does not), a `not-found` leaves it alone so unpublishing still unpublishes,
+	* and nothing is ever removed or expired by age.
+	*
+	* Failure is structural — whatever leaves `readPublishedEntry` as a throw — rather than a status
+	* table, so a 403 or a 429 serves the stored blob, and a failure mode added there later is covered
+	* without touching this.
+	*/
+	async function readPublished(contentTypeId, entryId, locale) {
+		const key = `${contentTypeId}\u0000${entryId}\u0000${locale}`;
+		try {
+			const result = await readPublishedEntry(config.account, config.storeId, locale, contentTypeId, entryId);
+			if (result.status === "found") retainBlob(key, result.blob, {
+				contentTypeId,
+				entryId,
+				locale
+			});
+			return { result };
+		} catch (error) {
+			const reason = transientReason(error);
+			const stored = lastGood.get(key);
+			if (stored === void 0) return { result: {
+				status: "unavailable",
+				reason
+			} };
+			return {
+				result: {
+					status: "found",
+					blob: stored
+				},
+				staleReason: reason
+			};
+		}
+	}
+	const read = cache(async (contentTypeId, entryId, locale) => {
+		await connection();
+		const { isEnabled: draft } = await draftMode();
+		let result;
+		let staleReason;
+		if (draft) result = await readPreviewEntry(config, contentTypeId, entryId, locale);
+		else ({result, staleReason} = await readPublished(contentTypeId, entryId, locale));
+		const stale = staleReason !== void 0;
+		const { level, event } = stale ? STALE_READ_EVENT : READ_EVENTS[result.status];
+		const reason = staleReason ?? (result.status === "unavailable" || result.status === "invalid" ? result.reason : void 0);
+		if (!(!stale && result.status === "found" && process.env.NODE_ENV === "production")) logEvent(level, event, {
+			contentTypeId,
+			entryId,
+			locale,
+			source: draft ? "control-plane" : "data-plane",
+			...reason === void 0 ? {} : { reason }
+		});
+		return result;
+	});
+	/**
+	* The scope's one read, awaited before render: the composite entry, sliced into one `$content`
+	* value per content-backed element. The values reach the components as literal props, so they are
+	* part of the server render by construction — a `cloneElement` from a client-side provider lands
+	* only on hydration, which is what made server HTML and client DOM disagree.
+	*
+	* The public shape takes one object, so a call site cannot silently swap two same-typed positional
+	* arguments; `React.cache` keys on the positional ones underneath.
+	*/
+	async function readContentSlices({ contentTypeId, entryId, locale, elements }) {
+		const result = await read(contentTypeId, entryId, locale);
+		if (result.status !== "found") return emptySlices();
+		const slices = emptySlices();
+		const requested = Object.entries(elements);
+		const omissions = [];
+		for (const [elementId, modelId] of requested) {
+			const slice = sliceContent(result.blob, elementId, ownValue(config.contentTypes, modelId));
+			if (slice.status === "omitted") {
+				omissions.push({
+					elementId,
+					modelId,
+					reason: slice.reason
+				});
+				continue;
+			}
+			slices[elementId] = slice.content;
+		}
+		if (omissions.length > 0) logEvent("warn", "content.elements.omitted", {
+			contentTypeId,
+			entryId,
+			locale,
+			omitted: omissions.length,
+			total: requested.length,
+			omissions
+		});
+		return slices;
+	}
+	return {
+		readContentSlices,
+		ContentEntryBoundary
+	};
+}
+/**
+* The slice map, with no prototype. An element id is a schema string, so `__proto__` is a name the
+* map can be asked for; on a plain object the lookup would inherit `Object.prototype` and a boundary
+* would render an element whose `$content` is that object rather than omitting it. The failure path
+* returns this too — an entry that 404s must answer `undefined` for every key, including that one.
+*/
+function emptySlices() {
+	return Object.create(null);
+}
+/**
+* Renders its element only when that element's slice is present — the omission rule the content RFC
+* states. It no longer delivers the value (the page passes `$content` as a literal prop), so it
+* clones nothing and what wraps it no longer decides whether content arrives.
+*
+* Module scope, not a closure over `createContentRuntime`: it reads nothing from the runtime's
+* configuration, so every store shares one component identity.
+*/
+function ContentEntryBoundary({ value, children }) {
+	return value === void 0 ? null : children;
+}
+/**
+* The published read: one composite entry from the Data Plane, live on every request. A definitive
+* 404 resolves a `not-found` sentinel; a transient failure (network, timeout, 5xx, malformed body)
+* throws, and `readPublished` decides between the stored blob and an omit.
+*
+* Nothing caches it. This read sat under `'use cache'` until Cache Components was removed for a
+* platform that does not stream, and the five-minute `cacheLife` and 24-hour `expire` went with it —
+* a transient failure used to throw inside the cache and Next kept serving the last-good entry for
+* up to a day. What replaced that is the last-good store, which is a fallback and not a cache: it
+* never shortens or skips this read, so the happy path is unchanged and a publish lands on the very
+* next request. The page cache, the two cache tags this read emitted and the tag-based revalidation
+* route they fed are still gone, and still owed by whatever restores caching.
+*/
+async function readPublishedEntry(account, storeId, locale, contentTypeId, entryId) {
+	const url = buildDataPlaneUrl(account, storeId, locale, contentTypeId, entryId);
+	const response = await fetch(url, { signal: AbortSignal.timeout(ENTRY_REQUEST_TIMEOUT_MS) });
+	if (response.status === 404) return { status: "not-found" };
+	if (!response.ok) throw new Error(`content upstream status ${response.status}`);
+	let payload;
+	try {
+		payload = await response.json();
+	} catch {
+		throw new Error("content response is not JSON");
+	}
+	if (!isRecord(payload)) throw new Error("content response is not an object");
+	return {
+		status: "found",
+		blob: payload
+	};
+}
+/**
+* The Draft Mode read: the same composite entry resolved through Control Plane's preview endpoint
+* with a server-only credential, bypassing all caches. The branch comes from a SIGNED preview
+* context cookie whose HMAC is re-verified here against the broker secret — a tampered cookie fails
+* closed, so a valid session cannot read an unauthorized branch's drafts. The credential never
+* enters browser code, logs, URLs, or props. Uncached, so its sentinels are never persisted.
+*/
+async function readPreviewEntry(config, contentTypeId, entryId, locale) {
+	const token = process.env[PREVIEW_TOKEN_ENV];
+	if (!token) return {
+		status: "unavailable",
+		reason: "preview credential unavailable"
+	};
+	const secret = process.env[PREVIEW_SECRET_ENV];
+	if (!secret) return {
+		status: "unavailable",
+		reason: "preview secret unavailable"
+	};
+	const raw = (await cookies()).get(PREVIEW_COOKIE)?.value;
+	const claims = raw ? verifyPreviewContext(raw, secret) : null;
+	if (!claims || claims.account !== config.account || claims.storeId !== config.storeId || !claims.branch) return {
+		status: "unavailable",
+		reason: "invalid preview context"
+	};
+	const { account, storeId } = config;
+	return fetchPreview(`https://${account}.vtexcommercestable.com.br/api/content-platform/manage/${[
+		account,
+		storeId,
+		contentTypeId,
+		"entries",
+		"preview",
+		entryId
+	].map(encodeURIComponent).join("/")}?branchId=${encodeURIComponent(claims.branch)}&locale=${encodeURIComponent(locale)}`, token);
+}
+async function fetchPreview(url, token) {
+	let response;
+	try {
+		response = await fetch(url, {
+			cache: "no-store",
+			headers: { Authorization: `Bearer ${token}` },
+			signal: AbortSignal.timeout(ENTRY_REQUEST_TIMEOUT_MS)
+		});
+	} catch (error) {
+		return {
+			status: "unavailable",
+			reason: isTimeoutError(error) ? "timeout" : "network error"
+		};
+	}
+	if (response.status === 404) return { status: "not-found" };
+	if (!response.ok) return {
+		status: "unavailable",
+		reason: `upstream status ${response.status}`
+	};
+	let payload;
+	try {
+		payload = await response.json();
+	} catch {
+		return {
+			status: "invalid",
+			reason: "response body is not JSON"
+		};
+	}
+	if (!isRecord(payload)) return {
+		status: "invalid",
+		reason: "response body is not an object"
+	};
+	return {
+		status: "found",
+		blob: payload
+	};
+}
+/**
+* Verifies a signed preview context cookie (`base64url(claims).base64url(hmac)`) against the broker
+* secret with a constant-time comparison, returning the claims only when the signature holds and the
+* token has not expired — a captured cookie fails closed once past `exp`.
+*/
+function verifyPreviewContext(raw, secret) {
+	const [body, signature] = raw.split(".");
+	if (!body || !signature) return null;
+	const expected = createHmac("sha256", secret).update(body).digest("base64url");
+	const given = Buffer.from(signature, "utf8");
+	const want = Buffer.from(expected, "utf8");
+	if (given.length !== want.length || !timingSafeEqual(given, want)) return null;
+	try {
+		const claims = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+		if (typeof claims.branch !== "string" || !Number.isFinite(claims.exp) || Date.now() >= claims.exp) return null;
+		return claims;
+	} catch {
+		return null;
+	}
+}
+function buildDataPlaneUrl(account, storeId, locale, contentTypeId, entryId) {
+	return `https://${account}.vtexcommercestable.com.br/api/content-platform/data/${[
+		account,
+		storeId,
+		contentTypeId,
+		"entries",
+		entryId
+	].map(encodeURIComponent).join("/")}?locale=${encodeURIComponent(locale)}`;
+}
+/**
+* Slices one element's value out of the composite blob by its `element.id` and validates it against
+* that element's per-component model. Omits only this component on a missing key, a non-object
+* value, an unknown model, or a shape violation — keyword constraints are the preflight's job.
+* Failing closed on an unknown model keeps an unvalidated blob from reaching `$content` (which would
+* crash the route as a React child).
+*/
+function sliceContent(blob, elementId, model) {
+	const raw = ownValue(blob, elementId);
+	if (!isRecord(raw)) return {
+		status: "omitted",
+		reason: "missing or non-object value"
+	};
+	if (!model) return {
+		status: "omitted",
+		reason: "unknown model"
+	};
+	const content = projectObject(model.schema.properties, raw);
+	const violation = findShapeViolation(model, content);
+	if (violation !== null) return {
+		status: "omitted",
+		reason: violation
+	};
+	return {
+		status: "sliced",
+		content
+	};
+}
+/**
+* Keeps declared keys only, at every level the vocabulary admits, so the injected value matches the
+* `ContentValue` type the component was compiled against. A value of the wrong shape passes through
+* untouched for the validator below to reject.
+*/
+function projectObject(properties, raw) {
+	const projected = {};
+	for (const [key, property] of Object.entries(properties)) {
+		const value = ownValue(raw, key);
+		if (value === void 0) continue;
+		if (property.type === "array") projected[key] = Array.isArray(value) ? value.map((member) => isRecord(member) ? projectObject(property.items.properties, member) : member) : value;
+		else if (property.type === "object") projected[key] = isRecord(value) ? projectObject(property.properties, value) : value;
+		else projected[key] = value;
+	}
+	return projected;
+}
+/** Shape-level validation only (required presence, primitive type, enum membership), at every level. */
+function findShapeViolation(model, content) {
+	return findObjectViolation("", model.schema, content);
+}
+function findObjectViolation(path, shape, value) {
+	for (const key of shape.required ?? []) if (ownValue(value, key) === void 0) return `missing required property "${joinPath(path, key)}"`;
+	for (const [key, property] of Object.entries(shape.properties)) {
+		const member = ownValue(value, key);
+		if (member === void 0) continue;
+		const violation = findPropertyViolation(joinPath(path, key), property, member);
+		if (violation !== null) return violation;
+	}
+	return null;
+}
+function findPropertyViolation(path, property, value) {
+	if (property.type === "array") {
+		if (!Array.isArray(value)) return `property "${path}" does not match type "array"`;
+		for (const [index, member] of value.entries()) {
+			const itemPath = `${path}[${index}]`;
+			if (!isRecord(member)) return `property "${itemPath}" does not match type "object"`;
+			const violation = findObjectViolation(itemPath, property.items, member);
+			if (violation !== null) return violation;
+		}
+		return null;
+	}
+	if (property.type === "object") {
+		if (!isRecord(value)) return `property "${path}" does not match type "object"`;
+		return findObjectViolation(path, property, value);
+	}
+	if (!matchesScalarType(property.type, value)) return `property "${path}" does not match type "${property.type}"`;
+	if (property.enum && !property.enum.includes(value)) return `property "${path}" is not an allowed enum value`;
+	return null;
+}
+function joinPath(path, key) {
+	return path.length === 0 ? key : `${path}.${key}`;
+}
+function matchesScalarType(type, value) {
+	switch (type) {
+		case "string": return typeof value === "string";
+		case "boolean": return typeof value === "boolean";
+		case "number": return typeof value === "number" && Number.isFinite(value);
+		case "integer": return typeof value === "number" && Number.isInteger(value);
+	}
+}
+/**
+* Severity as a function of the read's status, and nothing else: `unavailable` means the runtime
+* could not read, which is the on-call signal; `not-found` and `invalid` mean the content is broken
+* while the runtime works. `source` is a payload field, so a preview read that cannot resolve is a
+* failure like any other. `invalid` is reachable from the preview branch only — the published path
+* throws on a bad body, which is why the store covers that case.
+*/
+const READ_EVENTS = {
+	found: {
+		level: "info",
+		event: "content.read.ok"
+	},
+	"not-found": {
+		level: "warn",
+		event: "content.read.missing"
+	},
+	invalid: {
+		level: "warn",
+		event: "content.read.invalid"
+	},
+	unavailable: {
+		level: "error",
+		event: "content.read.failed"
+	}
+};
+/**
+* The one line the status does not decide: the read failed and the stored blob covered it. `warn`
+* because the page rendered, which keeps `error` meaning exactly "the shopper is seeing holes". A
+* covered outage never escalates on its own, so alerting on one means filtering this event name.
+*/
+const STALE_READ_EVENT = {
+	level: "warn",
+	event: "content.read.stale"
+};
+/**
+* The runtime's one log line: a constant message plus a payload whose `event` is the sole event
+* discriminator, so rewording prose cannot break a consumer. Nothing here ever carries a content
+* value, a preview token, or the broker secret.
+*
+* `entryId` is high-cardinality and stays log-only. Feeding these events to a metrics pipeline —
+* which no part of this runtime has today — means dropping or hashing it at that boundary; the six
+* event names are the bounded dimension set such a pipeline would inherit.
+*/
+function logEvent(level, event, fields) {
+	console[level]("[content-runtime]", {
+		...fields,
+		event
+	});
+}
+function transientReason(error) {
+	if (isTimeoutError(error)) return "timeout";
+	return error instanceof Error ? error.message : "network error";
+}
+/**
+* The exact UTF-8 byte count of the serialized blob, not the JS string's UTF-16 code-unit count
+* (`.length`). Non-ASCII text — accented Latin, common in Portuguese-language content, at 2 bytes per
+* code unit, or CJK at 3 — makes those two numbers diverge, and a check against `.length` would let a
+* blob past both ceilings while genuinely over them in bytes.
+*/
+function blobByteLength(blob) {
+	return Buffer.byteLength(JSON.stringify(blob), "utf8");
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Own-property read. Every object keyed by an authored id here comes from `JSON.parse` or a plain
+* literal, so it carries `Object.prototype`: a key named `__proto__` or `constructor` would resolve
+* to something inherited instead of to `undefined`, and the absent-key branch would never be taken.
+*/
+function ownValue(source, key) {
+	return Object.hasOwn(source, key) ? source[key] : void 0;
+}
+/** Property check instead of `instanceof`: `AbortSignal.timeout` rejects with a `DOMException`. */
+function isTimeoutError(error) {
+	if (typeof error !== "object" || error === null) return false;
+	const { name } = error;
+	return name === "TimeoutError" || name === "AbortError";
+}
+//#endregion
+export { createContentRuntime };
+
+//# sourceMappingURL=create-content-runtime.js.map

package/dist/sdk/content/create-content-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-content-runtime.js","names":[],"sources":["../../../src/sdk/content/create-content-runtime.tsx"],"sourcesContent":["import { createHmac, timingSafeEqual } from 'node:crypto';\nimport type { ContentPropertySchema, ContentTypeDefinition } from '@vtex/fs-core';\nimport { cookies, draftMode } from 'next/headers';\nimport { connection } from 'next/server';\nimport { cache, type FC, type ReactNode } from 'react';\n\nexport type ContentRuntimeConfig = {\n  account: string;\n  storeId: string;\n  /** Canonical per-component models, verbatim from the aggregated content catalog, keyed by id. */\n  contentTypes: Record<string, ContentTypeDefinition>;\n};\n\n/** The coordinates of one composite read. `locale` arrives per call, so one build serves many. */\nexport type ReadContentSlicesArgs = {\n  contentTypeId: string;\n  entryId: string;\n  locale: string;\n  /** `element.id → per-component model id` for every content-backed element in the scope. */\n  elements: Record<string, string>;\n};\n\n/**\n * The scope's slices, keyed by `element.id`. A key is absent when its element must be omitted — a\n * missing key, a shape violation, or a whole-entry failure.\n *\n * The value type is unchecked on purpose: the generated page forwards it to a component whose\n * `$content` is `ContentValue<that component's model>`, a type that exists only in the component\n * package, and an index signature cannot satisfy a model's required properties. Stated once here\n * rather than cast at every emitted prop; the read below validates every value against its model.\n */\nexport type ContentSlices = {\n  // biome-ignore lint/suspicious/noExplicitAny: the model's type lives in the component package, not here.\n  [elementId: string]: any;\n};\n\nexport type ContentEntryBoundaryProps = {\n  /** This element's slice, read at the top of the scope. `undefined` omits the component. */\n  value: unknown;\n  children: ReactNode;\n};\n\nexport type ContentRuntime = {\n  readContentSlices: (args: ReadContentSlicesArgs) => Promise<ContentSlices>;\n  ContentEntryBoundary: FC<ContentEntryBoundaryProps>;\n};\n\n/** The signed preview context the Draft Mode route stores; re-verified here before use. */\ntype PreviewClaims = {\n  account: string;\n  storeId: string;\n  branch: string;\n  /** Millisecond epoch the token was minted / expires; a captured cookie stops working past `exp`. */\n  iat: number;\n  exp: number;\n};\n\n/**\n * Internal result taxonomy: a read either finds a validated composite blob or fails for a definite,\n * loggable reason. A transient upstream failure resolves `found` from the last-good store below when\n * that store holds the entry, and degrades to `unavailable` — omitting the affected components —\n * only when it does not.\n */\nexport type ContentEntryResult =\n  | { status: 'found'; blob: Record<string, unknown> }\n  | { status: 'not-found' }\n  | { status: 'unavailable'; reason: string }\n  | { status: 'invalid'; reason: string };\n\n/**\n * One published read's outcome. `staleReason` is present only when the fresh read failed and the\n * store covered it, and the result is then an ordinary `found`: no consumer has a fifth renderable\n * status to learn, and only the log line tells a served blob from a fresh one.\n */\ntype PublishedRead = { result: ContentEntryResult; staleReason?: string };\n\nconst ENTRY_REQUEST_TIMEOUT_MS = 5000;\n\n/**\n * Retention ceilings for the last-good store, both estimated rather than measured: no production\n * store exists yet to size a real composite against, and the example schemas in this repo are demo\n * content, not authored pages, so neither is evidence of real scale.\n *\n * `MAX_RETAINED_BLOB_BYTES` bounds one entry. Ordinary editorial text (a title, a body, an image URL,\n * an alt text) stays in the hundreds of bytes to a few kilobytes per element regardless of how many\n * elements a page composes — even the largest composed layout in this repo (103 elements) does not\n * read as megabytes if every element stays plain text. The realistic way to exceed this is a single\n * field holding embedded binary — a base64 image pasted into a text field instead of uploaded through\n * the media widget — which is exactly the shape this guards against, independent of element count.\n *\n * `MAX_RETAINED_TOTAL_BYTES` bounds the whole store, and is the one that actually matters: the\n * per-blob cap alone does not bound total memory, because it multiplies by key count, and key count is\n * not small — a large store's pages and layouts, times its locales, is plausibly a few hundred keys.\n * A few hundred keys at a few megabytes each already exceeds a typical serverless heap (512 MB–1 GB)\n * on the per-blob cap alone; ~64 MB is a small slice of that heap while still holding many ordinary\n * pages at once.\n *\n * Both numbers count serialized JSON text (`blobByteLength`), not retained heap: a parsed object\n * typically costs more than its JSON text — V8 pays per-property and per-string object overhead that\n * the text itself does not — so the real footprint at either ceiling is larger than the number on the\n * tin, plausibly by a small multiple. Both ceilings still leave headroom against a 512 MB–1 GB heap at\n * that multiple; sizing them as retained heap instead would need a runtime memory measurement this\n * module has no cheap way to take.\n *\n * Both numbers are round and generous on purpose, not derived. `content.retention.skipped` below is\n * the real calibration path: once a production store exists, its log volume says whether either\n * ceiling needs to move.\n */\nconst MAX_RETAINED_BLOB_BYTES = 1_000_000;\nconst MAX_RETAINED_TOTAL_BYTES = 64_000_000;\n\n/** Server-only preview credential, supplied at deployment time; never reaches the browser. */\nconst PREVIEW_TOKEN_ENV = 'CONTENT_PLATFORM_PREVIEW_TOKEN';\n/** Shared broker secret used to verify the signed preview context cookie. */\nconst PREVIEW_SECRET_ENV = 'CONTENT_PREVIEW_SECRET';\n/** The signed preview context cookie the Draft Mode route sets. */\nconst PREVIEW_COOKIE = '__fs_content_preview';\n\n/**\n * Creates the one server-side content read surface for a store: a `React.cache`-deduped\n * `readContentSlices` the generated page or layout awaits once at the top, and the\n * `ContentEntryBoundary` the compiler wraps around each content-backed element. One read per scope\n * yields every element's `$content` value keyed by `element.id`, so a page issues at most two Data\n * Plane reads (its own entry plus its layout's) regardless of content-backed component count. Draft\n * Mode switches the same read to Control Plane's preview endpoint through a server-only credential.\n */\nexport function createContentRuntime(config: ContentRuntimeConfig): ContentRuntime {\n  // The blob of the most recent successful published read, per entry, so a failing Data Plane\n  // renders the last content that worked instead of holes. Not `React.cache`, whose lifetime is the\n  // request and so shorter than the failure it has to cover, and not module scope, which every\n  // runtime in the process would share — two of them on the same coordinates would then serve each\n  // other's content. The generated consumer holds the runtime in a module-scope `const`, so the\n  // closure lives as long as the process either way.\n  //\n  // `contentTypeId` and `entryId` are compiler-emitted literals for the life of the deployment (a\n  // dynamic route gets one entry, not one per slug), so today's key domain is small: pages plus\n  // layouts, times locales. That is an invariant of the generated caller, not of this function —\n  // nothing here stops a future one from passing a request-derived value instead, and the moment it\n  // does, this map grows with traffic rather than with the store's page count.\n  const lastGood = new Map<string, Record<string, unknown>>();\n  let retainedBytes = 0;\n\n  /**\n   * Whether a successful read's blob replaces what `key` already holds, weighed against both\n   * ceilings. Skipping never deletes: whatever `key` held before, if anything, is left exactly as it\n   * was — only the update is declined, so a rare oversized read cannot erase a smaller last-good value\n   * that a future failure could still use.\n   */\n  function retainBlob(\n    key: string,\n    blob: Record<string, unknown>,\n    fields: { contentTypeId: string; entryId: string; locale: string },\n  ): void {\n    const size = blobByteLength(blob);\n    if (size > MAX_RETAINED_BLOB_BYTES) {\n      logEvent('warn', 'content.retention.skipped', { ...fields, bytes: size, reason: 'blob-too-large' });\n      return;\n    }\n    const existing = lastGood.get(key);\n    const existingSize = existing ? blobByteLength(existing) : 0;\n    if (retainedBytes - existingSize + size > MAX_RETAINED_TOTAL_BYTES) {\n      logEvent('warn', 'content.retention.skipped', { ...fields, bytes: size, reason: 'total-cap-reached' });\n      return;\n    }\n    lastGood.set(key, blob);\n    retainedBytes += size - existingSize;\n  }\n\n  /**\n   * The published read plus the fallback that covers it. The upstream is always called and the store\n   * is read only in the `catch`, which is what makes this a fallback and not a cache: a publish is\n   * visible on the very next request. A success ordinarily overwrites the entry (see `retainBlob` for\n   * the two cases where it does not), a `not-found` leaves it alone so unpublishing still unpublishes,\n   * and nothing is ever removed or expired by age.\n   *\n   * Failure is structural — whatever leaves `readPublishedEntry` as a throw — rather than a status\n   * table, so a 403 or a 429 serves the stored blob, and a failure mode added there later is covered\n   * without touching this.\n   */\n  async function readPublished(contentTypeId: string, entryId: string, locale: string): Promise<PublishedRead> {\n    // NUL appears in no content-type id, entry id, or BCP-47 tag, so two distinct triples cannot\n    // collide. Keyed on the same three values the memoisation below uses, so the two layers never\n    // disagree about what \"the same read\" is.\n    const key = `${contentTypeId}\\u0000${entryId}\\u0000${locale}`;\n    try {\n      const result = await readPublishedEntry(config.account, config.storeId, locale, contentTypeId, entryId);\n      if (result.status === 'found') {\n        retainBlob(key, result.blob, { contentTypeId, entryId, locale });\n      }\n      return { result };\n    } catch (error) {\n      const reason = transientReason(error);\n      const stored = lastGood.get(key);\n      // Nothing stored: omit the affected components while the rest of the route renders.\n      if (stored === undefined) return { result: { status: 'unavailable', reason } };\n      return { result: { status: 'found', blob: stored }, staleReason: reason };\n    }\n  }\n\n  // React.cache collapses same-entry awaits within one request: N boundaries reading the same\n  // composite entry share one upstream read and one read-log line. That is per-request memoisation\n  // only — nothing is reused across requests — so it is `readPublished` above, not this, that\n  // carries a value across the failure it covers. Either way a read never throws a route error.\n  const read = cache(async (contentTypeId: string, entryId: string, locale: string): Promise<ContentEntryResult> => {\n    // Content is read per request, never at build time. Nothing else on a content-only page is\n    // request-dependent — `draftMode()` prerenders as disabled and an uncached `fetch` does not bail\n    // out on its own — so without this the entry is captured by a static prerender and the store\n    // stops tracking the CMS until its next deploy. `'use cache'` used to hold the route open with a\n    // five-minute revalidate; removing it for a platform that does not stream took that with it.\n    // Outside the fallback's try, which lives in `readPublished`, so the bail-out it throws during\n    // static generation is never swallowed as a transient failure.\n    await connection();\n    const { isEnabled: draft } = await draftMode();\n    let result: ContentEntryResult;\n    let staleReason: string | undefined;\n    if (draft) {\n      // The preview branch neither reads the store nor writes it: an unpublished blob must not\n      // outlive the request that asked for it, and a draft must never cover a published failure.\n      result = await readPreviewEntry(config, contentTypeId, entryId, locale);\n    } else {\n      ({ result, staleReason } = await readPublished(contentTypeId, entryId, locale));\n    }\n    // A served blob is `found`, so the status alone would report it as a success.\n    const stale = staleReason !== undefined;\n    const { level, event } = stale ? STALE_READ_EVENT : READ_EVENTS[result.status];\n    const reason =\n      staleReason ?? (result.status === 'unavailable' || result.status === 'invalid' ? result.reason : undefined);\n    // The success line is the cheapest evidence of the ≤2-reads-per-page guarantee, and its only\n    // cost is production volume: nothing caches this read, so it would emit once or twice per page\n    // view and bury the rare failure line. Suppressed there, kept everywhere the count is checked —\n    // and the gate covers a genuine success only, so a covered outage stays audible in production.\n    const suppressed = !stale && result.status === 'found' && process.env.NODE_ENV === 'production';\n    if (!suppressed) {\n      logEvent(level, event, {\n        contentTypeId,\n        entryId,\n        locale,\n        source: draft ? 'control-plane' : 'data-plane',\n        ...(reason === undefined ? {} : { reason }),\n      });\n    }\n    return result;\n  });\n\n  /**\n   * The scope's one read, awaited before render: the composite entry, sliced into one `$content`\n   * value per content-backed element. The values reach the components as literal props, so they are\n   * part of the server render by construction — a `cloneElement` from a client-side provider lands\n   * only on hydration, which is what made server HTML and client DOM disagree.\n   *\n   * The public shape takes one object, so a call site cannot silently swap two same-typed positional\n   * arguments; `React.cache` keys on the positional ones underneath.\n   */\n  async function readContentSlices({\n    contentTypeId,\n    entryId,\n    locale,\n    elements,\n  }: ReadContentSlicesArgs): Promise<ContentSlices> {\n    const result = await read(contentTypeId, entryId, locale);\n    if (result.status !== 'found') {\n      // A whole-entry failure (404, invalid, or an upstream failure with nothing stored for the\n      // entry) omits every component sharing it: no key is present, so every boundary renders\n      // nothing. A failure the last-good store covered never arrives here — it arrives as `found`.\n      return emptySlices();\n    }\n    const slices = emptySlices();\n    const requested = Object.entries(elements);\n    const omissions: ElementOmission[] = [];\n    for (const [elementId, modelId] of requested) {\n      const slice = sliceContent(result.blob, elementId, ownValue(config.contentTypes, modelId));\n      if (slice.status === 'omitted') {\n        // A missing or invalid key within an otherwise-valid entry omits only this one component.\n        omissions.push({ elementId, modelId, reason: slice.reason });\n        continue;\n      }\n      slices[elementId] = slice.content;\n    }\n    if (omissions.length > 0) {\n      // One line per call rather than one per element: the operational fact is the ratio, and\n      // `omitted === total` is what tells a blank scope from a partial one. The level says only that\n      // the page rendered, so it stays `warn` at every ratio.\n      logEvent('warn', 'content.elements.omitted', {\n        contentTypeId,\n        entryId,\n        locale,\n        omitted: omissions.length,\n        total: requested.length,\n        omissions,\n      });\n    }\n    return slices;\n  }\n\n  return { readContentSlices, ContentEntryBoundary };\n}\n\n/**\n * The slice map, with no prototype. An element id is a schema string, so `__proto__` is a name the\n * map can be asked for; on a plain object the lookup would inherit `Object.prototype` and a boundary\n * would render an element whose `$content` is that object rather than omitting it. The failure path\n * returns this too — an entry that 404s must answer `undefined` for every key, including that one.\n */\nfunction emptySlices(): ContentSlices {\n  return Object.create(null) as ContentSlices;\n}\n\n/**\n * Renders its element only when that element's slice is present — the omission rule the content RFC\n * states. It no longer delivers the value (the page passes `$content` as a literal prop), so it\n * clones nothing and what wraps it no longer decides whether content arrives.\n *\n * Module scope, not a closure over `createContentRuntime`: it reads nothing from the runtime's\n * configuration, so every store shares one component identity.\n */\nfunction ContentEntryBoundary({ value, children }: ContentEntryBoundaryProps): ReactNode {\n  return value === undefined ? null : children;\n}\n\n/**\n * The published read: one composite entry from the Data Plane, live on every request. A definitive\n * 404 resolves a `not-found` sentinel; a transient failure (network, timeout, 5xx, malformed body)\n * throws, and `readPublished` decides between the stored blob and an omit.\n *\n * Nothing caches it. This read sat under `'use cache'` until Cache Components was removed for a\n * platform that does not stream, and the five-minute `cacheLife` and 24-hour `expire` went with it —\n * a transient failure used to throw inside the cache and Next kept serving the last-good entry for\n * up to a day. What replaced that is the last-good store, which is a fallback and not a cache: it\n * never shortens or skips this read, so the happy path is unchanged and a publish lands on the very\n * next request. The page cache, the two cache tags this read emitted and the tag-based revalidation\n * route they fed are still gone, and still owed by whatever restores caching.\n */\nasync function readPublishedEntry(\n  account: string,\n  storeId: string,\n  locale: string,\n  contentTypeId: string,\n  entryId: string,\n): Promise<ContentEntryResult> {\n  const url = buildDataPlaneUrl(account, storeId, locale, contentTypeId, entryId);\n  const response = await fetch(url, { signal: AbortSignal.timeout(ENTRY_REQUEST_TIMEOUT_MS) });\n\n  if (response.status === 404) return { status: 'not-found' };\n  if (!response.ok) throw new Error(`content upstream status ${response.status}`);\n\n  let payload: unknown;\n  try {\n    payload = await response.json();\n  } catch {\n    throw new Error('content response is not JSON');\n  }\n  if (!isRecord(payload)) throw new Error('content response is not an object');\n\n  return { status: 'found', blob: payload };\n}\n\n/**\n * The Draft Mode read: the same composite entry resolved through Control Plane's preview endpoint\n * with a server-only credential, bypassing all caches. The branch comes from a SIGNED preview\n * context cookie whose HMAC is re-verified here against the broker secret — a tampered cookie fails\n * closed, so a valid session cannot read an unauthorized branch's drafts. The credential never\n * enters browser code, logs, URLs, or props. Uncached, so its sentinels are never persisted.\n */\nasync function readPreviewEntry(\n  config: ContentRuntimeConfig,\n  contentTypeId: string,\n  entryId: string,\n  locale: string,\n): Promise<ContentEntryResult> {\n  const token = process.env[PREVIEW_TOKEN_ENV];\n  if (!token) return { status: 'unavailable', reason: 'preview credential unavailable' };\n  const secret = process.env[PREVIEW_SECRET_ENV];\n  if (!secret) return { status: 'unavailable', reason: 'preview secret unavailable' };\n\n  const store = await cookies();\n  const raw = store.get(PREVIEW_COOKIE)?.value;\n  const claims = raw ? verifyPreviewContext(raw, secret) : null;\n  if (!claims || claims.account !== config.account || claims.storeId !== config.storeId || !claims.branch) {\n    return { status: 'unavailable', reason: 'invalid preview context' };\n  }\n\n  const { account, storeId } = config;\n  const path = [account, storeId, contentTypeId, 'entries', 'preview', entryId].map(encodeURIComponent).join('/');\n  const url = `https://${account}.vtexcommercestable.com.br/api/content-platform/manage/${path}?branchId=${encodeURIComponent(claims.branch)}&locale=${encodeURIComponent(locale)}`;\n  return fetchPreview(url, token);\n}\n\nasync function fetchPreview(url: string, token: string): Promise<ContentEntryResult> {\n  let response: Response;\n  try {\n    response = await fetch(url, {\n      cache: 'no-store',\n      headers: { Authorization: `Bearer ${token}` },\n      signal: AbortSignal.timeout(ENTRY_REQUEST_TIMEOUT_MS),\n    });\n  } catch (error) {\n    return { status: 'unavailable', reason: isTimeoutError(error) ? 'timeout' : 'network error' };\n  }\n  if (response.status === 404) return { status: 'not-found' };\n  if (!response.ok) return { status: 'unavailable', reason: `upstream status ${response.status}` };\n  let payload: unknown;\n  try {\n    payload = await response.json();\n  } catch {\n    return { status: 'invalid', reason: 'response body is not JSON' };\n  }\n  if (!isRecord(payload)) return { status: 'invalid', reason: 'response body is not an object' };\n  return { status: 'found', blob: payload };\n}\n\n/**\n * Verifies a signed preview context cookie (`base64url(claims).base64url(hmac)`) against the broker\n * secret with a constant-time comparison, returning the claims only when the signature holds and the\n * token has not expired — a captured cookie fails closed once past `exp`.\n */\nfunction verifyPreviewContext(raw: string, secret: string): PreviewClaims | null {\n  const [body, signature] = raw.split('.');\n  if (!body || !signature) return null;\n  const expected = createHmac('sha256', secret).update(body).digest('base64url');\n  const given = Buffer.from(signature, 'utf8');\n  const want = Buffer.from(expected, 'utf8');\n  if (given.length !== want.length || !timingSafeEqual(given, want)) return null;\n  try {\n    const claims = JSON.parse(Buffer.from(body, 'base64url').toString('utf8')) as PreviewClaims;\n    if (typeof claims.branch !== 'string' || !Number.isFinite(claims.exp) || Date.now() >= claims.exp) {\n      return null;\n    }\n    return claims;\n  } catch {\n    return null;\n  }\n}\n\nfunction buildDataPlaneUrl(\n  account: string,\n  storeId: string,\n  locale: string,\n  contentTypeId: string,\n  entryId: string,\n): string {\n  const path = [account, storeId, contentTypeId, 'entries', entryId].map(encodeURIComponent).join('/');\n  return `https://${account}.vtexcommercestable.com.br/api/content-platform/data/${path}?locale=${encodeURIComponent(locale)}`;\n}\n\ntype ContentSliceResult =\n  | { status: 'sliced'; content: Record<string, unknown> }\n  | { status: 'omitted'; reason: string };\n\n/**\n * Slices one element's value out of the composite blob by its `element.id` and validates it against\n * that element's per-component model. Omits only this component on a missing key, a non-object\n * value, an unknown model, or a shape violation — keyword constraints are the preflight's job.\n * Failing closed on an unknown model keeps an unvalidated blob from reaching `$content` (which would\n * crash the route as a React child).\n */\nfunction sliceContent(\n  blob: Record<string, unknown>,\n  elementId: string,\n  model: ContentTypeDefinition | undefined,\n): ContentSliceResult {\n  const raw = ownValue(blob, elementId);\n  if (!isRecord(raw)) return { status: 'omitted', reason: 'missing or non-object value' };\n  if (!model) return { status: 'omitted', reason: 'unknown model' };\n\n  const content = projectObject(model.schema.properties, raw);\n  const violation = findShapeViolation(model, content);\n  if (violation !== null) return { status: 'omitted', reason: violation };\n  return { status: 'sliced', content };\n}\n\n/** A closed object shape, at the root or one level down. */\ntype ClosedObjectShape = {\n  required?: readonly string[];\n  properties: Record<string, ContentPropertySchema>;\n};\n\n/**\n * Keeps declared keys only, at every level the vocabulary admits, so the injected value matches the\n * `ContentValue` type the component was compiled against. A value of the wrong shape passes through\n * untouched for the validator below to reject.\n */\nfunction projectObject(\n  properties: Record<string, ContentPropertySchema>,\n  raw: Record<string, unknown>,\n): Record<string, unknown> {\n  const projected: Record<string, unknown> = {};\n  for (const [key, property] of Object.entries(properties)) {\n    const value = ownValue(raw, key);\n    if (value === undefined) continue;\n    if (property.type === 'array') {\n      projected[key] = Array.isArray(value)\n        ? value.map((member) => (isRecord(member) ? projectObject(property.items.properties, member) : member))\n        : value;\n    } else if (property.type === 'object') {\n      projected[key] = isRecord(value) ? projectObject(property.properties, value) : value;\n    } else {\n      projected[key] = value;\n    }\n  }\n  return projected;\n}\n\n/** Shape-level validation only (required presence, primitive type, enum membership), at every level. */\nfunction findShapeViolation(model: ContentTypeDefinition, content: Record<string, unknown>): string | null {\n  return findObjectViolation('', model.schema, content);\n}\n\nfunction findObjectViolation(path: string, shape: ClosedObjectShape, value: Record<string, unknown>): string | null {\n  for (const key of shape.required ?? []) {\n    if (ownValue(value, key) === undefined) return `missing required property \"${joinPath(path, key)}\"`;\n  }\n  for (const [key, property] of Object.entries(shape.properties)) {\n    const member = ownValue(value, key);\n    if (member === undefined) continue;\n    const violation = findPropertyViolation(joinPath(path, key), property, member);\n    if (violation !== null) return violation;\n  }\n  return null;\n}\n\nfunction findPropertyViolation(path: string, property: ContentPropertySchema, value: unknown): string | null {\n  if (property.type === 'array') {\n    if (!Array.isArray(value)) return `property \"${path}\" does not match type \"array\"`;\n    for (const [index, member] of value.entries()) {\n      const itemPath = `${path}[${index}]`;\n      if (!isRecord(member)) return `property \"${itemPath}\" does not match type \"object\"`;\n      const violation = findObjectViolation(itemPath, property.items, member);\n      if (violation !== null) return violation;\n    }\n    // minItems and maxItems are author-time bounds; the read path does not enforce them.\n    return null;\n  }\n  if (property.type === 'object') {\n    if (!isRecord(value)) return `property \"${path}\" does not match type \"object\"`;\n    return findObjectViolation(path, property, value);\n  }\n  if (!matchesScalarType(property.type, value)) return `property \"${path}\" does not match type \"${property.type}\"`;\n  if (property.enum && !property.enum.includes(value as string | number)) {\n    return `property \"${path}\" is not an allowed enum value`;\n  }\n  return null;\n}\n\nfunction joinPath(path: string, key: string): string {\n  return path.length === 0 ? key : `${path}.${key}`;\n}\n\nfunction matchesScalarType(type: 'string' | 'number' | 'integer' | 'boolean', value: unknown): boolean {\n  switch (type) {\n    case 'string':\n      return typeof value === 'string';\n    case 'boolean':\n      return typeof value === 'boolean';\n    case 'number':\n      return typeof value === 'number' && Number.isFinite(value);\n    case 'integer':\n      return typeof value === 'number' && Number.isInteger(value);\n  }\n}\n\ntype LogLevel = 'error' | 'warn' | 'info';\n\n/** The closed vocabulary a log consumer discriminates on. Nothing else is ever emitted. */\ntype ContentEvent =\n  | 'content.read.ok'\n  | 'content.read.stale'\n  | 'content.read.missing'\n  | 'content.read.invalid'\n  | 'content.read.failed'\n  | 'content.elements.omitted'\n  | 'content.retention.skipped';\n\n/** One omitted element, as the aggregate line reports it. `reason` is a path, never a value. */\ntype ElementOmission = { elementId: string; modelId: string; reason: string };\n\n/**\n * Severity as a function of the read's status, and nothing else: `unavailable` means the runtime\n * could not read, which is the on-call signal; `not-found` and `invalid` mean the content is broken\n * while the runtime works. `source` is a payload field, so a preview read that cannot resolve is a\n * failure like any other. `invalid` is reachable from the preview branch only — the published path\n * throws on a bad body, which is why the store covers that case.\n */\nconst READ_EVENTS: Record<ContentEntryResult['status'], { level: LogLevel; event: ContentEvent }> = {\n  found: { level: 'info', event: 'content.read.ok' },\n  'not-found': { level: 'warn', event: 'content.read.missing' },\n  invalid: { level: 'warn', event: 'content.read.invalid' },\n  unavailable: { level: 'error', event: 'content.read.failed' },\n};\n\n/**\n * The one line the status does not decide: the read failed and the stored blob covered it. `warn`\n * because the page rendered, which keeps `error` meaning exactly \"the shopper is seeing holes\". A\n * covered outage never escalates on its own, so alerting on one means filtering this event name.\n */\nconst STALE_READ_EVENT: { level: LogLevel; event: ContentEvent } = { level: 'warn', event: 'content.read.stale' };\n\n/**\n * The runtime's one log line: a constant message plus a payload whose `event` is the sole event\n * discriminator, so rewording prose cannot break a consumer. Nothing here ever carries a content\n * value, a preview token, or the broker secret.\n *\n * `entryId` is high-cardinality and stays log-only. Feeding these events to a metrics pipeline —\n * which no part of this runtime has today — means dropping or hashing it at that boundary; the six\n * event names are the bounded dimension set such a pipeline would inherit.\n */\nfunction logEvent(level: LogLevel, event: ContentEvent, fields: Record<string, unknown>): void {\n  // `event` spreads last so a `fields` key of the same name cannot displace the discriminator every\n  // consumer keys on. `fields` is a `Record<string, unknown>`, so nothing in the types would object.\n  console[level]('[content-runtime]', { ...fields, event });\n}\n\nfunction transientReason(error: unknown): string {\n  if (isTimeoutError(error)) return 'timeout';\n  return error instanceof Error ? error.message : 'network error';\n}\n\n/**\n * The exact UTF-8 byte count of the serialized blob, not the JS string's UTF-16 code-unit count\n * (`.length`). Non-ASCII text — accented Latin, common in Portuguese-language content, at 2 bytes per\n * code unit, or CJK at 3 — makes those two numbers diverge, and a check against `.length` would let a\n * blob past both ceilings while genuinely over them in bytes.\n */\nfunction blobByteLength(blob: Record<string, unknown>): number {\n  return Buffer.byteLength(JSON.stringify(blob), 'utf8');\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\n/**\n * Own-property read. Every object keyed by an authored id here comes from `JSON.parse` or a plain\n * literal, so it carries `Object.prototype`: a key named `__proto__` or `constructor` would resolve\n * to something inherited instead of to `undefined`, and the absent-key branch would never be taken.\n */\nfunction ownValue<T>(source: Record<string, T>, key: string): T | undefined {\n  return Object.hasOwn(source, key) ? source[key] : undefined;\n}\n\n/** Property check instead of `instanceof`: `AbortSignal.timeout` rejects with a `DOMException`. */\nfunction isTimeoutError(error: unknown): boolean {\n  if (typeof error !== 'object' || error === null) return false;\n  const { name } = error as { name?: unknown };\n  return name === 'TimeoutError' || name === 'AbortError';\n}\n"],"mappings":";;;;;AA4EA,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCjC,MAAM,0BAA0B;AAChC,MAAM,2BAA2B;;AAGjC,MAAM,oBAAoB;;AAE1B,MAAM,qBAAqB;;AAE3B,MAAM,iBAAiB;;;;;;;;;AAUvB,SAAgB,qBAAqB,QAA8C;CAajF,MAAM,2BAAW,IAAI,IAAqC;CAC1D,IAAI,gBAAgB;;;;;;;CAQpB,SAAS,WACP,KACA,MACA,QACM;EACN,MAAM,OAAO,eAAe,IAAI;EAChC,IAAI,OAAO,yBAAyB;GAClC,SAAS,QAAQ,6BAA6B;IAAE,GAAG;IAAQ,OAAO;IAAM,QAAQ;GAAiB,CAAC;GAClG;EACF;EACA,MAAM,WAAW,SAAS,IAAI,GAAG;EACjC,MAAM,eAAe,WAAW,eAAe,QAAQ,IAAI;EAC3D,IAAI,gBAAgB,eAAe,OAAO,0BAA0B;GAClE,SAAS,QAAQ,6BAA6B;IAAE,GAAG;IAAQ,OAAO;IAAM,QAAQ;GAAoB,CAAC;GACrG;EACF;EACA,SAAS,IAAI,KAAK,IAAI;EACtB,iBAAiB,OAAO;CAC1B;;;;;;;;;;;;CAaA,eAAe,cAAc,eAAuB,SAAiB,QAAwC;EAI3G,MAAM,MAAM,GAAG,cAAc,QAAQ,QAAQ,QAAQ;EACrD,IAAI;GACF,MAAM,SAAS,MAAM,mBAAmB,OAAO,SAAS,OAAO,SAAS,QAAQ,eAAe,OAAO;GACtG,IAAI,OAAO,WAAW,SACpB,WAAW,KAAK,OAAO,MAAM;IAAE;IAAe;IAAS;GAAO,CAAC;GAEjE,OAAO,EAAE,OAAO;EAClB,SAAS,OAAO;GACd,MAAM,SAAS,gBAAgB,KAAK;GACpC,MAAM,SAAS,SAAS,IAAI,GAAG;GAE/B,IAAI,WAAW,KAAA,GAAW,OAAO,EAAE,QAAQ;IAAE,QAAQ;IAAe;GAAO,EAAE;GAC7E,OAAO;IAAE,QAAQ;KAAE,QAAQ;KAAS,MAAM;IAAO;IAAG,aAAa;GAAO;EAC1E;CACF;CAMA,MAAM,OAAO,MAAM,OAAO,eAAuB,SAAiB,WAAgD;EAQhH,MAAM,WAAW;EACjB,MAAM,EAAE,WAAW,UAAU,MAAM,UAAU;EAC7C,IAAI;EACJ,IAAI;EACJ,IAAI,OAGF,SAAS,MAAM,iBAAiB,QAAQ,eAAe,SAAS,MAAM;OAEtE,CAAC,CAAE,QAAQ,eAAgB,MAAM,cAAc,eAAe,SAAS,MAAM;EAG/E,MAAM,QAAQ,gBAAgB,KAAA;EAC9B,MAAM,EAAE,OAAO,UAAU,QAAQ,mBAAmB,YAAY,OAAO;EACvE,MAAM,SACJ,gBAAgB,OAAO,WAAW,iBAAiB,OAAO,WAAW,YAAY,OAAO,SAAS,KAAA;EAMnG,IAAI,EADe,CAAC,SAAS,OAAO,WAAW,WAAW,QAAQ,IAAI,aAAa,eAEjF,SAAS,OAAO,OAAO;GACrB;GACA;GACA;GACA,QAAQ,QAAQ,kBAAkB;GAClC,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;EAC3C,CAAC;EAEH,OAAO;CACT,CAAC;;;;;;;;;;CAWD,eAAe,kBAAkB,EAC/B,eACA,SACA,QACA,YACgD;EAChD,MAAM,SAAS,MAAM,KAAK,eAAe,SAAS,MAAM;EACxD,IAAI,OAAO,WAAW,SAIpB,OAAO,YAAY;EAErB,MAAM,SAAS,YAAY;EAC3B,MAAM,YAAY,OAAO,QAAQ,QAAQ;EACzC,MAAM,YAA+B,CAAC;EACtC,KAAK,MAAM,CAAC,WAAW,YAAY,WAAW;GAC5C,MAAM,QAAQ,aAAa,OAAO,MAAM,WAAW,SAAS,OAAO,cAAc,OAAO,CAAC;GACzF,IAAI,MAAM,WAAW,WAAW;IAE9B,UAAU,KAAK;KAAE;KAAW;KAAS,QAAQ,MAAM;IAAO,CAAC;IAC3D;GACF;GACA,OAAO,aAAa,MAAM;EAC5B;EACA,IAAI,UAAU,SAAS,GAIrB,SAAS,QAAQ,4BAA4B;GAC3C;GACA;GACA;GACA,SAAS,UAAU;GACnB,OAAO,UAAU;GACjB;EACF,CAAC;EAEH,OAAO;CACT;CAEA,OAAO;EAAE;EAAmB;CAAqB;AACnD;;;;;;;AAQA,SAAS,cAA6B;CACpC,OAAO,OAAO,OAAO,IAAI;AAC3B;;;;;;;;;AAUA,SAAS,qBAAqB,EAAE,OAAO,YAAkD;CACvF,OAAO,UAAU,KAAA,IAAY,OAAO;AACtC;;;;;;;;;;;;;;AAeA,eAAe,mBACb,SACA,SACA,QACA,eACA,SAC6B;CAC7B,MAAM,MAAM,kBAAkB,SAAS,SAAS,QAAQ,eAAe,OAAO;CAC9E,MAAM,WAAW,MAAM,MAAM,KAAK,EAAE,QAAQ,YAAY,QAAQ,wBAAwB,EAAE,CAAC;CAE3F,IAAI,SAAS,WAAW,KAAK,OAAO,EAAE,QAAQ,YAAY;CAC1D,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,2BAA2B,SAAS,QAAQ;CAE9E,IAAI;CACJ,IAAI;EACF,UAAU,MAAM,SAAS,KAAK;CAChC,QAAQ;EACN,MAAM,IAAI,MAAM,8BAA8B;CAChD;CACA,IAAI,CAAC,SAAS,OAAO,GAAG,MAAM,IAAI,MAAM,mCAAmC;CAE3E,OAAO;EAAE,QAAQ;EAAS,MAAM;CAAQ;AAC1C;;;;;;;;AASA,eAAe,iBACb,QACA,eACA,SACA,QAC6B;CAC7B,MAAM,QAAQ,QAAQ,IAAI;CAC1B,IAAI,CAAC,OAAO,OAAO;EAAE,QAAQ;EAAe,QAAQ;CAAiC;CACrF,MAAM,SAAS,QAAQ,IAAI;CAC3B,IAAI,CAAC,QAAQ,OAAO;EAAE,QAAQ;EAAe,QAAQ;CAA6B;CAGlF,MAAM,OAAM,MADQ,QAAQ,EAAA,CACV,IAAI,cAAc,CAAC,EAAE;CACvC,MAAM,SAAS,MAAM,qBAAqB,KAAK,MAAM,IAAI;CACzD,IAAI,CAAC,UAAU,OAAO,YAAY,OAAO,WAAW,OAAO,YAAY,OAAO,WAAW,CAAC,OAAO,QAC/F,OAAO;EAAE,QAAQ;EAAe,QAAQ;CAA0B;CAGpE,MAAM,EAAE,SAAS,YAAY;CAG7B,OAAO,aAAa,WADG,QAAQ,yDADlB;EAAC;EAAS;EAAS;EAAe;EAAW;EAAW;CAAO,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAChB,EAAE,YAAY,mBAAmB,OAAO,MAAM,EAAE,UAAU,mBAAmB,MAAM,KACrJ,KAAK;AAChC;AAEA,eAAe,aAAa,KAAa,OAA4C;CACnF,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,MAAM,KAAK;GAC1B,OAAO;GACP,SAAS,EAAE,eAAe,UAAU,QAAQ;GAC5C,QAAQ,YAAY,QAAQ,wBAAwB;EACtD,CAAC;CACH,SAAS,OAAO;EACd,OAAO;GAAE,QAAQ;GAAe,QAAQ,eAAe,KAAK,IAAI,YAAY;EAAgB;CAC9F;CACA,IAAI,SAAS,WAAW,KAAK,OAAO,EAAE,QAAQ,YAAY;CAC1D,IAAI,CAAC,SAAS,IAAI,OAAO;EAAE,QAAQ;EAAe,QAAQ,mBAAmB,SAAS;CAAS;CAC/F,IAAI;CACJ,IAAI;EACF,UAAU,MAAM,SAAS,KAAK;CAChC,QAAQ;EACN,OAAO;GAAE,QAAQ;GAAW,QAAQ;EAA4B;CAClE;CACA,IAAI,CAAC,SAAS,OAAO,GAAG,OAAO;EAAE,QAAQ;EAAW,QAAQ;CAAiC;CAC7F,OAAO;EAAE,QAAQ;EAAS,MAAM;CAAQ;AAC1C;;;;;;AAOA,SAAS,qBAAqB,KAAa,QAAsC;CAC/E,MAAM,CAAC,MAAM,aAAa,IAAI,MAAM,GAAG;CACvC,IAAI,CAAC,QAAQ,CAAC,WAAW,OAAO;CAChC,MAAM,WAAW,WAAW,UAAU,MAAM,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,WAAW;CAC7E,MAAM,QAAQ,OAAO,KAAK,WAAW,MAAM;CAC3C,MAAM,OAAO,OAAO,KAAK,UAAU,MAAM;CACzC,IAAI,MAAM,WAAW,KAAK,UAAU,CAAC,gBAAgB,OAAO,IAAI,GAAG,OAAO;CAC1E,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,OAAO,KAAK,MAAM,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;EACzE,IAAI,OAAO,OAAO,WAAW,YAAY,CAAC,OAAO,SAAS,OAAO,GAAG,KAAK,KAAK,IAAI,KAAK,OAAO,KAC5F,OAAO;EAET,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,kBACP,SACA,SACA,QACA,eACA,SACQ;CAER,OAAO,WAAW,QAAQ,uDADb;EAAC;EAAS;EAAS;EAAe;EAAW;CAAO,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,KAAK,GACZ,EAAE,UAAU,mBAAmB,MAAM;AAC3H;;;;;;;;AAaA,SAAS,aACP,MACA,WACA,OACoB;CACpB,MAAM,MAAM,SAAS,MAAM,SAAS;CACpC,IAAI,CAAC,SAAS,GAAG,GAAG,OAAO;EAAE,QAAQ;EAAW,QAAQ;CAA8B;CACtF,IAAI,CAAC,OAAO,OAAO;EAAE,QAAQ;EAAW,QAAQ;CAAgB;CAEhE,MAAM,UAAU,cAAc,MAAM,OAAO,YAAY,GAAG;CAC1D,MAAM,YAAY,mBAAmB,OAAO,OAAO;CACnD,IAAI,cAAc,MAAM,OAAO;EAAE,QAAQ;EAAW,QAAQ;CAAU;CACtE,OAAO;EAAE,QAAQ;EAAU;CAAQ;AACrC;;;;;;AAaA,SAAS,cACP,YACA,KACyB;CACzB,MAAM,YAAqC,CAAC;CAC5C,KAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,UAAU,GAAG;EACxD,MAAM,QAAQ,SAAS,KAAK,GAAG;EAC/B,IAAI,UAAU,KAAA,GAAW;EACzB,IAAI,SAAS,SAAS,SACpB,UAAU,OAAO,MAAM,QAAQ,KAAK,IAChC,MAAM,KAAK,WAAY,SAAS,MAAM,IAAI,cAAc,SAAS,MAAM,YAAY,MAAM,IAAI,MAAO,IACpG;OACC,IAAI,SAAS,SAAS,UAC3B,UAAU,OAAO,SAAS,KAAK,IAAI,cAAc,SAAS,YAAY,KAAK,IAAI;OAE/E,UAAU,OAAO;CAErB;CACA,OAAO;AACT;;AAGA,SAAS,mBAAmB,OAA8B,SAAiD;CACzG,OAAO,oBAAoB,IAAI,MAAM,QAAQ,OAAO;AACtD;AAEA,SAAS,oBAAoB,MAAc,OAA0B,OAA+C;CAClH,KAAK,MAAM,OAAO,MAAM,YAAY,CAAC,GACnC,IAAI,SAAS,OAAO,GAAG,MAAM,KAAA,GAAW,OAAO,8BAA8B,SAAS,MAAM,GAAG,EAAE;CAEnG,KAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,MAAM,UAAU,GAAG;EAC9D,MAAM,SAAS,SAAS,OAAO,GAAG;EAClC,IAAI,WAAW,KAAA,GAAW;EAC1B,MAAM,YAAY,sBAAsB,SAAS,MAAM,GAAG,GAAG,UAAU,MAAM;EAC7E,IAAI,cAAc,MAAM,OAAO;CACjC;CACA,OAAO;AACT;AAEA,SAAS,sBAAsB,MAAc,UAAiC,OAA+B;CAC3G,IAAI,SAAS,SAAS,SAAS;EAC7B,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,OAAO,aAAa,KAAK;EACpD,KAAK,MAAM,CAAC,OAAO,WAAW,MAAM,QAAQ,GAAG;GAC7C,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM;GAClC,IAAI,CAAC,SAAS,MAAM,GAAG,OAAO,aAAa,SAAS;GACpD,MAAM,YAAY,oBAAoB,UAAU,SAAS,OAAO,MAAM;GACtE,IAAI,cAAc,MAAM,OAAO;EACjC;EAEA,OAAO;CACT;CACA,IAAI,SAAS,SAAS,UAAU;EAC9B,IAAI,CAAC,SAAS,KAAK,GAAG,OAAO,aAAa,KAAK;EAC/C,OAAO,oBAAoB,MAAM,UAAU,KAAK;CAClD;CACA,IAAI,CAAC,kBAAkB,SAAS,MAAM,KAAK,GAAG,OAAO,aAAa,KAAK,yBAAyB,SAAS,KAAK;CAC9G,IAAI,SAAS,QAAQ,CAAC,SAAS,KAAK,SAAS,KAAwB,GACnE,OAAO,aAAa,KAAK;CAE3B,OAAO;AACT;AAEA,SAAS,SAAS,MAAc,KAAqB;CACnD,OAAO,KAAK,WAAW,IAAI,MAAM,GAAG,KAAK,GAAG;AAC9C;AAEA,SAAS,kBAAkB,MAAmD,OAAyB;CACrG,QAAQ,MAAR;EACE,KAAK,UACH,OAAO,OAAO,UAAU;EAC1B,KAAK,WACH,OAAO,OAAO,UAAU;EAC1B,KAAK,UACH,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;EAC3D,KAAK,WACH,OAAO,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK;CAC9D;AACF;;;;;;;;AAwBA,MAAM,cAA8F;CAClG,OAAO;EAAE,OAAO;EAAQ,OAAO;CAAkB;CACjD,aAAa;EAAE,OAAO;EAAQ,OAAO;CAAuB;CAC5D,SAAS;EAAE,OAAO;EAAQ,OAAO;CAAuB;CACxD,aAAa;EAAE,OAAO;EAAS,OAAO;CAAsB;AAC9D;;;;;;AAOA,MAAM,mBAA6D;CAAE,OAAO;CAAQ,OAAO;AAAqB;;;;;;;;;;AAWhH,SAAS,SAAS,OAAiB,OAAqB,QAAuC;CAG7F,QAAQ,MAAM,CAAC,qBAAqB;EAAE,GAAG;EAAQ;CAAM,CAAC;AAC1D;AAEA,SAAS,gBAAgB,OAAwB;CAC/C,IAAI,eAAe,KAAK,GAAG,OAAO;CAClC,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAClD;;;;;;;AAQA,SAAS,eAAe,MAAuC;CAC7D,OAAO,OAAO,WAAW,KAAK,UAAU,IAAI,GAAG,MAAM;AACvD;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;;;;AAOA,SAAS,SAAY,QAA2B,KAA4B;CAC1E,OAAO,OAAO,OAAO,QAAQ,GAAG,IAAI,OAAO,OAAO,KAAA;AACpD;;AAGA,SAAS,eAAe,OAAyB;CAC/C,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,MAAM,EAAE,SAAS;CACjB,OAAO,SAAS,kBAAkB,SAAS;AAC7C"}

package/dist/sdk/context/headers.d.ts

@@ -0,0 +1,15 @@
+import { StorefrontContext } from "../../core/dist/schema/generated/schema.js";
+import "../../core/dist/index.js";
+//#region src/sdk/context/headers.d.ts
+/**
+ * The context headers every commerce operation carries, in the RFC's spelling. The `x-faststore-`
+ * prefix marks them as storefront-declared: API Core correlates on them, it does not trust them.
+ *
+ * One builder for all three request paths — the browser Apollo provider, `createClient`, and
+ * `registerPreloadQuery` — so a server-rendered request and its client-side follow-up can never
+ * disagree about the context they were made for. These win over explicit `headers` on merge: a
+ * caller must not be able to claim a context the app did not render.
+ */
+export declare function buildStorefrontContextHeaders(context: StorefrontContext): Record<string, string>;
+//#endregion
+//# sourceMappingURL=headers.d.ts.map

package/dist/sdk/context/headers.js

@@ -0,0 +1,21 @@
+//#region src/sdk/context/headers.ts
+/**
+* The context headers every commerce operation carries, in the RFC's spelling. The `x-faststore-`
+* prefix marks them as storefront-declared: API Core correlates on them, it does not trust them.
+*
+* One builder for all three request paths — the browser Apollo provider, `createClient`, and
+* `registerPreloadQuery` — so a server-rendered request and its client-side follow-up can never
+* disagree about the context they were made for. These win over explicit `headers` on merge: a
+* caller must not be able to claim a context the app did not render.
+*/
+function buildStorefrontContextHeaders(context) {
+	return {
+		"x-faststore-binding": context.bindingId,
+		"x-faststore-locale": context.locale,
+		"x-faststore-sales-channel": context.salesChannel
+	};
+}
+//#endregion
+export { buildStorefrontContextHeaders };
+
+//# sourceMappingURL=headers.js.map

package/dist/sdk/context/headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.js","names":[],"sources":["../../../src/sdk/context/headers.ts"],"sourcesContent":["import type { StorefrontContext } from '@vtex/fs-core';\n\n/**\n * The context headers every commerce operation carries, in the RFC's spelling. The `x-faststore-`\n * prefix marks them as storefront-declared: API Core correlates on them, it does not trust them.\n *\n * One builder for all three request paths — the browser Apollo provider, `createClient`, and\n * `registerPreloadQuery` — so a server-rendered request and its client-side follow-up can never\n * disagree about the context they were made for. These win over explicit `headers` on merge: a\n * caller must not be able to claim a context the app did not render.\n */\nexport function buildStorefrontContextHeaders(context: StorefrontContext): Record<string, string> {\n  return {\n    'x-faststore-binding': context.bindingId,\n    'x-faststore-locale': context.locale,\n    'x-faststore-sales-channel': context.salesChannel,\n  };\n}\n"],"mappings":";;;;;;;;;;AAWA,SAAgB,8BAA8B,SAAoD;CAChG,OAAO;EACL,uBAAuB,QAAQ;EAC/B,sBAAsB,QAAQ;EAC9B,6BAA6B,QAAQ;CACvC;AACF"}

package/dist/sdk/context/storefront-context.d.ts

@@ -0,0 +1,11 @@
+import { StorefrontContext } from "../../core/dist/schema/generated/schema.js";
+import "../../core/dist/index.js";
+import { ReactNode } from "react";
+//#region src/sdk/context/storefront-context.d.ts
+/**
+ * The active storefront context: locale, currency, sales channel, country, timezone, and text
+ * direction. Throws outside a `StorefrontProvider` that received a `context`.
+ */
+export declare function useStorefrontContext(): StorefrontContext;
+//#endregion
+//# sourceMappingURL=storefront-context.d.ts.map