@vtex/faststore 0.0.1

package/dist/utils/safe-href.js

@@ -0,0 +1,63 @@
+//#region src/utils/safe-href.ts
+const ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set([
+	"http:",
+	"https:",
+	"mailto:",
+	"tel:"
+]);
+/**
+* The only gate on a CMS-authored destination: `http:`, `https:`, `mailto:`, `tel:`, and paths
+* starting with a single `/`. Neither the runtime slice nor the sukima preflight enforces a model's
+* `pattern`, so an authored `javascript:` value reaches the component intact and this is what stands
+* between it and an `href`.
+*
+* Rejects rather than sanitizes: a destination that comes back safe is character-for-character the
+* trimmed authored value, so no value is ever silently rewritten into a different working one.
+*/
+function resolveSafeHref(raw) {
+	const href = raw.trim();
+	if (href.length === 0) return {
+		safe: false,
+		reason: "blank"
+	};
+	if (hasStrippableCharacter(href)) return {
+		safe: false,
+		reason: "malformed"
+	};
+	if (/^[/\\]{2}/.test(href)) return {
+		safe: false,
+		reason: "protocol-relative"
+	};
+	if (href.startsWith("/")) return {
+		safe: true,
+		href
+	};
+	let protocol;
+	try {
+		protocol = new URL(href).protocol;
+	} catch {
+		return {
+			safe: false,
+			reason: "malformed"
+		};
+	}
+	return ALLOWED_PROTOCOLS.has(protocol) ? {
+		safe: true,
+		href
+	} : {
+		safe: false,
+		reason: "forbidden-scheme"
+	};
+}
+/** Any C0 control or space anywhere in the value — the set a URL parser removes or trims. */
+function hasStrippableCharacter(value) {
+	for (const character of value) {
+		const code = character.codePointAt(0) ?? 0;
+		if (code <= 32 || code === 127) return true;
+	}
+	return false;
+}
+//#endregion
+export { resolveSafeHref };
+
+//# sourceMappingURL=safe-href.js.map

package/dist/utils/safe-href.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-href.js","names":[],"sources":["../../src/utils/safe-href.ts"],"sourcesContent":["export type SafeHrefRejection = 'blank' | 'malformed' | 'protocol-relative' | 'forbidden-scheme';\n\nexport type SafeHrefResult = { safe: true; href: string } | { safe: false; reason: SafeHrefRejection };\n\nconst ALLOWED_PROTOCOLS = new Set(['http:', 'https:', 'mailto:', 'tel:']);\n\n/**\n * The only gate on a CMS-authored destination: `http:`, `https:`, `mailto:`, `tel:`, and paths\n * starting with a single `/`. Neither the runtime slice nor the sukima preflight enforces a model's\n * `pattern`, so an authored `javascript:` value reaches the component intact and this is what stands\n * between it and an `href`.\n *\n * Rejects rather than sanitizes: a destination that comes back safe is character-for-character the\n * trimmed authored value, so no value is ever silently rewritten into a different working one.\n */\nexport function resolveSafeHref(raw: string): SafeHrefResult {\n  const href = raw.trim();\n  if (href.length === 0) {\n    return { safe: false, reason: 'blank' };\n  }\n  // Browsers strip ASCII tabs and newlines from a URL before parsing it, so `java<TAB>script:alert(1)`\n  // executes. Refusing the whole value is the only defense that does not depend on stripping the same\n  // characters in the same order the parser does.\n  if (hasStrippableCharacter(href)) {\n    return { safe: false, reason: 'malformed' };\n  }\n  // A URL parser reads `\\` as `/` under a special scheme, so `/\\evil.example` resolves against the\n  // store's origin as an authority rather than a path. Any pair of leading slashes is an off-site\n  // jump however it is spelled, and only `//` looks like one.\n  if (/^[/\\\\]{2}/.test(href)) {\n    return { safe: false, reason: 'protocol-relative' };\n  }\n  if (href.startsWith('/')) {\n    return { safe: true, href };\n  }\n\n  let protocol: string;\n  try {\n    protocol = new URL(href).protocol;\n  } catch {\n    return { safe: false, reason: 'malformed' };\n  }\n  // `new URL` lowercases the protocol, so `JavaScript:` and `javascript:` are the same rejection.\n  return ALLOWED_PROTOCOLS.has(protocol) ? { safe: true, href } : { safe: false, reason: 'forbidden-scheme' };\n}\n\n/** Any C0 control or space anywhere in the value — the set a URL parser removes or trims. */\nfunction hasStrippableCharacter(value: string): boolean {\n  for (const character of value) {\n    const code = character.codePointAt(0) ?? 0;\n    if (code <= 0x20 || code === 0x7f) {\n      return true;\n    }\n  }\n  return false;\n}\n"],"mappings":";AAIA,MAAM,oCAAoB,IAAI,IAAI;CAAC;CAAS;CAAU;CAAW;AAAM,CAAC;;;;;;;;;;AAWxE,SAAgB,gBAAgB,KAA6B;CAC3D,MAAM,OAAO,IAAI,KAAK;CACtB,IAAI,KAAK,WAAW,GAClB,OAAO;EAAE,MAAM;EAAO,QAAQ;CAAQ;CAKxC,IAAI,uBAAuB,IAAI,GAC7B,OAAO;EAAE,MAAM;EAAO,QAAQ;CAAY;CAK5C,IAAI,YAAY,KAAK,IAAI,GACvB,OAAO;EAAE,MAAM;EAAO,QAAQ;CAAoB;CAEpD,IAAI,KAAK,WAAW,GAAG,GACrB,OAAO;EAAE,MAAM;EAAM;CAAK;CAG5B,IAAI;CACJ,IAAI;EACF,WAAW,IAAI,IAAI,IAAI,CAAC,CAAC;CAC3B,QAAQ;EACN,OAAO;GAAE,MAAM;GAAO,QAAQ;EAAY;CAC5C;CAEA,OAAO,kBAAkB,IAAI,QAAQ,IAAI;EAAE,MAAM;EAAM;CAAK,IAAI;EAAE,MAAM;EAAO,QAAQ;CAAmB;AAC5G;;AAGA,SAAS,uBAAuB,OAAwB;CACtD,KAAK,MAAM,aAAa,OAAO;EAC7B,MAAM,OAAO,UAAU,YAAY,CAAC,KAAK;EACzC,IAAI,QAAQ,MAAQ,SAAS,KAC3B,OAAO;CAEX;CACA,OAAO;AACT"}

package/package.json

@@ -0,0 +1,84 @@
+{
+  "name": "@vtex/faststore",
+  "version": "0.0.1",
+  "description": "FastStore AI Native component library built on Base UI with AI-editable styles",
+  "license": "MIT",
+  "homepage": "https://developers.vtex.com/docs/guides/faststore",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./client": {
+      "types": "./dist/client.d.ts",
+      "import": "./dist/client.js"
+    },
+    "./components": {
+      "types": "./dist/components.d.ts",
+      "import": "./dist/components.js"
+    },
+    "./graphql": {
+      "types": "./dist/graphql.d.ts",
+      "import": "./dist/graphql.js",
+      "default": "./dist/graphql.js"
+    },
+    "./internal/client": {
+      "types": "./dist/internal/client.d.ts",
+      "import": "./dist/internal/client.js"
+    },
+    "./internal/server": {
+      "types": "./dist/internal/server.d.ts",
+      "import": "./dist/internal/server.js"
+    },
+    "./internal/server/content": {
+      "types": "./dist/internal/content.d.ts",
+      "import": "./dist/internal/content.js"
+    },
+    "./catalog.json": "./dist/catalog.json",
+    "./actions.json": "./dist/actions.json",
+    "./content-types.json": "./dist/content-types.json",
+    "./message-locales.json": "./dist/message-locales.json",
+    "./tailwind.css": "./src/styles/tailwind.css"
+  },
+  "files": [
+    "dist",
+    "src/styles/tailwind.css",
+    "CHANGELOG.md"
+  ],
+  "dependencies": {
+    "@base-ui/react": "^1.3.0",
+    "@graphql-typed-document-node/core": "^3.2.0",
+    "graphql": "^16.13.1",
+    "react-intl": "^10.1.22",
+    "rxjs": "^7.8.2",
+    "tailwindcss": "^4.2.2",
+    "zustand": "^5.0.0"
+  },
+  "peerDependencies": {
+    "@apollo/client": "^4.1.7",
+    "@apollo/client-integration-nextjs": "^0.14.5",
+    "next": ">=16",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@apollo/client": {
+      "optional": true
+    },
+    "@apollo/client-integration-nextjs": {
+      "optional": true
+    },
+    "next": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    },
+    "react-dom": {
+      "optional": true
+    }
+  }
+}

package/src/styles/tailwind.css

@@ -0,0 +1,32 @@
+@import "tailwindcss";
+
+@theme {
+  --color-brand: #2953b2;
+  --color-brand-light: #4a7ae0;
+  --color-text: #171a1f;
+  --color-text-inverse: #ffffff;
+  --color-bg: #ffffff;
+  --color-bg-muted: #f3f4f6;
+  --color-border: #d1d5db;
+
+  --font-size-sm: 0.875rem;
+  --font-size-md: 1rem;
+  --font-size-lg: 1.25rem;
+
+  --spacing-xs: 0.25rem;
+  --spacing-sm: 0.5rem;
+  --spacing-md: 1rem;
+  --spacing-lg: 1.5rem;
+
+  --radius-sm: 0.25rem;
+  --radius-md: 0.5rem;
+  --radius-lg: 0.75rem;
+
+  /* --spacing-{xs,sm,md,lg} above take precedence over Tailwind's container scale for width
+     utilities (tailwindlabs/tailwindcss#16047). Restore the documented container-based sizing
+     for the utilities this project actually uses. */
+  --max-width-xs: var(--container-xs);
+  --max-width-sm: var(--container-sm);
+  --max-width-md: var(--container-md);
+  --max-width-lg: var(--container-lg);
+}