@vtex/faststore 0.0.6 → 0.0.8

package/dist/sdk/content/create-content-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-content-runtime.js","names":[],"sources":["../../../src/sdk/content/create-content-runtime.tsx"],"sourcesContent":["import { createHmac, timingSafeEqual } from 'node:crypto';\nimport type { ContentPropertySchema, ContentTypeDefinition } from '@vtex/fs-core';\nimport { cookies, draftMode } from 'next/headers';\nimport { connection } from 'next/server';\nimport { cache, type FC, type ReactNode } from 'react';\n\nexport type ContentRuntimeConfig = {\n  account: string;\n  storeId: string;\n  /** Canonical per-component models, verbatim from the aggregated content catalog, keyed by id. */\n  contentTypes: Record<string, ContentTypeDefinition>;\n};\n\n/** The coordinates of one composite read. `locale` arrives per call, so one build serves many. */\nexport type ReadContentSlicesArgs = {\n  contentTypeId: string;\n  entryId: string;\n  locale: string;\n  /** `element.id → per-component model id` for every content-backed element in the scope. */\n  elements: Record<string, string>;\n};\n\n/**\n * The scope's slices, keyed by `element.id`. A key is absent when its element must be omitted — a\n * missing key, a shape violation, or a whole-entry failure.\n *\n * The value type is unchecked on purpose: the generated page forwards it to a component whose\n * `$content` is `ContentValue<that component's model>`, a type that exists only in the component\n * package, and an index signature cannot satisfy a model's required properties. Stated once here\n * rather than cast at every emitted prop; the read below validates every value against its model.\n */\nexport type ContentSlices = {\n  // biome-ignore lint/suspicious/noExplicitAny: the model's type lives in the component package, not here.\n  [elementId: string]: any;\n};\n\nexport type ContentEntryBoundaryProps = {\n  /** This element's slice, read at the top of the scope. `undefined` omits the component. */\n  value: unknown;\n  children: ReactNode;\n};\n\nexport type ContentRuntime = {\n  readContentSlices: (args: ReadContentSlicesArgs) => Promise<ContentSlices>;\n  ContentEntryBoundary: FC<ContentEntryBoundaryProps>;\n};\n\n/** The signed preview context the Draft Mode route stores; re-verified here before use. */\ntype PreviewClaims = {\n  account: string;\n  storeId: string;\n  branch: string;\n  /** Millisecond epoch the token was minted / expires; a captured cookie stops working past `exp`. */\n  iat: number;\n  exp: number;\n};\n\n/**\n * Internal result taxonomy: a read either finds a validated composite blob or fails for a definite,\n * loggable reason. A transient upstream failure resolves `found` from the last-good store below when\n * that store holds the entry, and degrades to `unavailable` — omitting the affected components —\n * only when it does not.\n */\nexport type ContentEntryResult =\n  | { status: 'found'; blob: Record<string, unknown> }\n  | { status: 'not-found' }\n  | { status: 'unavailable'; reason: string }\n  | { status: 'invalid'; reason: string };\n\n/**\n * One published read's outcome. `staleReason` is present only when the fresh read failed and the\n * store covered it, and the result is then an ordinary `found`: no consumer has a fifth renderable\n * status to learn, and only the log line tells a served blob from a fresh one.\n */\ntype PublishedRead = { result: ContentEntryResult; staleReason?: string };\n\nconst ENTRY_REQUEST_TIMEOUT_MS = 5000;\n\n/**\n * Retention ceilings for the last-good store, both estimated rather than measured: no production\n * store exists yet to size a real composite against, and the example schemas in this repo are demo\n * content, not authored pages, so neither is evidence of real scale.\n *\n * `MAX_RETAINED_BLOB_BYTES` bounds one entry. Ordinary editorial text (a title, a body, an image URL,\n * an alt text) stays in the hundreds of bytes to a few kilobytes per element regardless of how many\n * elements a page composes — even the largest composed layout in this repo (103 elements) does not\n * read as megabytes if every element stays plain text. The realistic way to exceed this is a single\n * field holding embedded binary — a base64 image pasted into a text field instead of uploaded through\n * the media widget — which is exactly the shape this guards against, independent of element count.\n *\n * `MAX_RETAINED_TOTAL_BYTES` bounds the whole store, and is the one that actually matters: the\n * per-blob cap alone does not bound total memory, because it multiplies by key count, and key count is\n * not small — a large store's pages and layouts, times its locales, is plausibly a few hundred keys.\n * A few hundred keys at a few megabytes each already exceeds a typical serverless heap (512 MB–1 GB)\n * on the per-blob cap alone; ~64 MB is a small slice of that heap while still holding many ordinary\n * pages at once.\n *\n * Both numbers count serialized JSON text (`blobByteLength`), not retained heap: a parsed object\n * typically costs more than its JSON text — V8 pays per-property and per-string object overhead that\n * the text itself does not — so the real footprint at either ceiling is larger than the number on the\n * tin, plausibly by a small multiple. Both ceilings still leave headroom against a 512 MB–1 GB heap at\n * that multiple; sizing them as retained heap instead would need a runtime memory measurement this\n * module has no cheap way to take.\n *\n * Both numbers are round and generous on purpose, not derived. `content.retention.skipped` below is\n * the real calibration path: once a production store exists, its log volume says whether either\n * ceiling needs to move.\n */\nconst MAX_RETAINED_BLOB_BYTES = 1_000_000;\nconst MAX_RETAINED_TOTAL_BYTES = 64_000_000;\n\n/** Server-only preview credential, supplied at deployment time; never reaches the browser. */\nconst PREVIEW_TOKEN_ENV = 'CONTENT_PLATFORM_PREVIEW_TOKEN';\n/** Shared broker secret used to verify the signed preview context cookie. */\nconst PREVIEW_SECRET_ENV = 'CONTENT_PREVIEW_SECRET';\n/** The signed preview context cookie the Draft Mode route sets. */\nconst PREVIEW_COOKIE = '__fs_content_preview';\n\n/**\n * Creates the one server-side content read surface for a store: a `React.cache`-deduped\n * `readContentSlices` the generated page or layout awaits once at the top, and the\n * `ContentEntryBoundary` the compiler wraps around each content-backed element. One read per scope\n * yields every element's `$content` value keyed by `element.id`, so a page issues at most two Data\n * Plane reads (its own entry plus its layout's) regardless of content-backed component count. Draft\n * Mode switches the same read to Control Plane's preview endpoint through a server-only credential.\n */\nexport function createContentRuntime(config: ContentRuntimeConfig): ContentRuntime {\n  // The blob of the most recent successful published read, per entry, so a failing Data Plane\n  // renders the last content that worked instead of holes. Not `React.cache`, whose lifetime is the\n  // request and so shorter than the failure it has to cover, and not module scope, which every\n  // runtime in the process would share — two of them on the same coordinates would then serve each\n  // other's content. The generated consumer holds the runtime in a module-scope `const`, so the\n  // closure lives as long as the process either way.\n  //\n  // `contentTypeId` and `entryId` are compiler-emitted literals for the life of the deployment (a\n  // dynamic route gets one entry, not one per slug), so today's key domain is small: pages plus\n  // layouts, times locales. That is an invariant of the generated caller, not of this function —\n  // nothing here stops a future one from passing a request-derived value instead, and the moment it\n  // does, this map grows with traffic rather than with the store's page count.\n  const lastGood = new Map<string, Record<string, unknown>>();\n  let retainedBytes = 0;\n\n  /**\n   * Whether a successful read's blob replaces what `key` already holds, weighed against both\n   * ceilings. Skipping never deletes: whatever `key` held before, if anything, is left exactly as it\n   * was — only the update is declined, so a rare oversized read cannot erase a smaller last-good value\n   * that a future failure could still use.\n   */\n  function retainBlob(\n    key: string,\n    blob: Record<string, unknown>,\n    fields: { contentTypeId: string; entryId: string; locale: string },\n  ): void {\n    const size = blobByteLength(blob);\n    if (size > MAX_RETAINED_BLOB_BYTES) {\n      logEvent('warn', 'content.retention.skipped', { ...fields, bytes: size, reason: 'blob-too-large' });\n      return;\n    }\n    const existing = lastGood.get(key);\n    const existingSize = existing ? blobByteLength(existing) : 0;\n    if (retainedBytes - existingSize + size > MAX_RETAINED_TOTAL_BYTES) {\n      logEvent('warn', 'content.retention.skipped', { ...fields, bytes: size, reason: 'total-cap-reached' });\n      return;\n    }\n    lastGood.set(key, blob);\n    retainedBytes += size - existingSize;\n  }\n\n  /**\n   * The published read plus the fallback that covers it. The upstream is always called and the store\n   * is read only in the `catch`, which is what makes this a fallback and not a cache: a publish is\n   * visible on the very next request. A success ordinarily overwrites the entry (see `retainBlob` for\n   * the two cases where it does not), a `not-found` leaves it alone so unpublishing still unpublishes,\n   * and nothing is ever removed or expired by age.\n   *\n   * Failure is structural — whatever leaves `readPublishedEntry` as a throw — rather than a status\n   * table, so a 403 or a 429 serves the stored blob, and a failure mode added there later is covered\n   * without touching this.\n   */\n  async function readPublished(contentTypeId: string, entryId: string, locale: string): Promise<PublishedRead> {\n    // NUL appears in no content-type id, entry id, or BCP-47 tag, so two distinct triples cannot\n    // collide. Keyed on the same three values the memoisation below uses, so the two layers never\n    // disagree about what \"the same read\" is.\n    const key = `${contentTypeId}\\u0000${entryId}\\u0000${locale}`;\n    try {\n      const result = await readPublishedEntry(config.account, config.storeId, locale, contentTypeId, entryId);\n      if (result.status === 'found') {\n        retainBlob(key, result.blob, { contentTypeId, entryId, locale });\n      }\n      return { result };\n    } catch (error) {\n      const reason = transientReason(error);\n      const stored = lastGood.get(key);\n      // Nothing stored: omit the affected components while the rest of the route renders.\n      if (stored === undefined) return { result: { status: 'unavailable', reason } };\n      return { result: { status: 'found', blob: stored }, staleReason: reason };\n    }\n  }\n\n  // React.cache collapses same-entry awaits within one request: N boundaries reading the same\n  // composite entry share one upstream read and one read-log line. That is per-request memoisation\n  // only — nothing is reused across requests — so it is `readPublished` above, not this, that\n  // carries a value across the failure it covers. Either way a read never throws a route error.\n  const read = cache(async (contentTypeId: string, entryId: string, locale: string): Promise<ContentEntryResult> => {\n    // Content is read per request, never at build time. Nothing else on a content-only page is\n    // request-dependent — `draftMode()` prerenders as disabled and an uncached `fetch` does not bail\n    // out on its own — so without this the entry is captured by a static prerender and the store\n    // stops tracking the CMS until its next deploy. `'use cache'` used to hold the route open with a\n    // five-minute revalidate; removing it for a platform that does not stream took that with it.\n    // Outside the fallback's try, which lives in `readPublished`, so the bail-out it throws during\n    // static generation is never swallowed as a transient failure.\n    await connection();\n    const { isEnabled: draft } = await draftMode();\n    let result: ContentEntryResult;\n    let staleReason: string | undefined;\n    if (draft) {\n      // The preview branch neither reads the store nor writes it: an unpublished blob must not\n      // outlive the request that asked for it, and a draft must never cover a published failure.\n      result = await readPreviewEntry(config, contentTypeId, entryId, locale);\n    } else {\n      ({ result, staleReason } = await readPublished(contentTypeId, entryId, locale));\n    }\n    // A served blob is `found`, so the status alone would report it as a success.\n    const stale = staleReason !== undefined;\n    const { level, event } = stale ? STALE_READ_EVENT : READ_EVENTS[result.status];\n    const reason =\n      staleReason ?? (result.status === 'unavailable' || result.status === 'invalid' ? result.reason : undefined);\n    // The success line is the cheapest evidence of the ≤2-reads-per-page guarantee, and its only\n    // cost is production volume: nothing caches this read, so it would emit once or twice per page\n    // view and bury the rare failure line. Suppressed there, kept everywhere the count is checked —\n    // and the gate covers a genuine success only, so a covered outage stays audible in production.\n    const suppressed = !stale && result.status === 'found' && process.env.NODE_ENV === 'production';\n    if (!suppressed) {\n      logEvent(level, event, {\n        contentTypeId,\n        entryId,\n        locale,\n        source: draft ? 'control-plane' : 'data-plane',\n        ...(reason === undefined ? {} : { reason }),\n      });\n    }\n    return result;\n  });\n\n  /**\n   * The scope's one read, awaited before render: the composite entry, sliced into one `$content`\n   * value per content-backed element. The values reach the components as literal props, so they are\n   * part of the server render by construction — a `cloneElement` from a client-side provider lands\n   * only on hydration, which is what made server HTML and client DOM disagree.\n   *\n   * The public shape takes one object, so a call site cannot silently swap two same-typed positional\n   * arguments; `React.cache` keys on the positional ones underneath.\n   */\n  async function readContentSlices({\n    contentTypeId,\n    entryId,\n    locale,\n    elements,\n  }: ReadContentSlicesArgs): Promise<ContentSlices> {\n    const result = await read(contentTypeId, entryId, locale);\n    if (result.status !== 'found') {\n      // A whole-entry failure (404, invalid, or an upstream failure with nothing stored for the\n      // entry) omits every component sharing it: no key is present, so every boundary renders\n      // nothing. A failure the last-good store covered never arrives here — it arrives as `found`.\n      return emptySlices();\n    }\n    const slices = emptySlices();\n    const requested = Object.entries(elements);\n    const omissions: ElementOmission[] = [];\n    for (const [elementId, modelId] of requested) {\n      const slice = sliceContent(result.blob, elementId, ownValue(config.contentTypes, modelId));\n      if (slice.status === 'omitted') {\n        // A missing or invalid key within an otherwise-valid entry omits only this one component.\n        omissions.push({ elementId, modelId, reason: slice.reason });\n        continue;\n      }\n      slices[elementId] = slice.content;\n    }\n    if (omissions.length > 0) {\n      // One line per call rather than one per element: the operational fact is the ratio, and\n      // `omitted === total` is what tells a blank scope from a partial one. The level says only that\n      // the page rendered, so it stays `warn` at every ratio.\n      logEvent('warn', 'content.elements.omitted', {\n        contentTypeId,\n        entryId,\n        locale,\n        omitted: omissions.length,\n        total: requested.length,\n        omissions,\n      });\n    }\n    return slices;\n  }\n\n  return { readContentSlices, ContentEntryBoundary };\n}\n\n/**\n * The slice map, with no prototype. An element id is a schema string, so `__proto__` is a name the\n * map can be asked for; on a plain object the lookup would inherit `Object.prototype` and a boundary\n * would render an element whose `$content` is that object rather than omitting it. The failure path\n * returns this too — an entry that 404s must answer `undefined` for every key, including that one.\n */\nfunction emptySlices(): ContentSlices {\n  return Object.create(null) as ContentSlices;\n}\n\n/**\n * Renders its element only when that element's slice is present — the omission rule the content RFC\n * states. It no longer delivers the value (the page passes `$content` as a literal prop), so it\n * clones nothing and what wraps it no longer decides whether content arrives.\n *\n * Module scope, not a closure over `createContentRuntime`: it reads nothing from the runtime's\n * configuration, so every store shares one component identity.\n */\nfunction ContentEntryBoundary({ value, children }: ContentEntryBoundaryProps): ReactNode {\n  return value === undefined ? null : children;\n}\n\n/**\n * The published read: one composite entry from the Data Plane, live on every request. A definitive\n * 404 resolves a `not-found` sentinel; a transient failure (network, timeout, 5xx, malformed body)\n * throws, and `readPublished` decides between the stored blob and an omit.\n *\n * Nothing caches it. This read sat under `'use cache'` until Cache Components was removed for a\n * platform that does not stream, and the five-minute `cacheLife` and 24-hour `expire` went with it —\n * a transient failure used to throw inside the cache and Next kept serving the last-good entry for\n * up to a day. What replaced that is the last-good store, which is a fallback and not a cache: it\n * never shortens or skips this read, so the happy path is unchanged and a publish lands on the very\n * next request. The page cache, the two cache tags this read emitted and the tag-based revalidation\n * route they fed are still gone, and still owed by whatever restores caching.\n */\nasync function readPublishedEntry(\n  account: string,\n  storeId: string,\n  locale: string,\n  contentTypeId: string,\n  entryId: string,\n): Promise<ContentEntryResult> {\n  const url = buildDataPlaneUrl(account, storeId, locale, contentTypeId, entryId);\n  const response = await fetch(url, { signal: AbortSignal.timeout(ENTRY_REQUEST_TIMEOUT_MS) });\n\n  if (response.status === 404) return { status: 'not-found' };\n  if (!response.ok) throw new Error(`content upstream status ${response.status}`);\n\n  let payload: unknown;\n  try {\n    payload = await response.json();\n  } catch {\n    throw new Error('content response is not JSON');\n  }\n  if (!isRecord(payload)) throw new Error('content response is not an object');\n\n  return { status: 'found', blob: payload };\n}\n\n/**\n * The Draft Mode read: the same composite entry resolved through Control Plane's preview endpoint\n * with a server-only credential, bypassing all caches. The branch comes from a SIGNED preview\n * context cookie whose HMAC is re-verified here against the broker secret — a tampered cookie fails\n * closed, so a valid session cannot read an unauthorized branch's drafts. The credential never\n * enters browser code, logs, URLs, or props. Uncached, so its sentinels are never persisted.\n */\nasync function readPreviewEntry(\n  config: ContentRuntimeConfig,\n  contentTypeId: string,\n  entryId: string,\n  locale: string,\n): Promise<ContentEntryResult> {\n  const token = process.env[PREVIEW_TOKEN_ENV];\n  if (!token) return { status: 'unavailable', reason: 'preview credential unavailable' };\n  const secret = process.env[PREVIEW_SECRET_ENV];\n  if (!secret) return { status: 'unavailable', reason: 'preview secret unavailable' };\n\n  const store = await cookies();\n  const raw = store.get(PREVIEW_COOKIE)?.value;\n  const claims = raw ? verifyPreviewContext(raw, secret) : null;\n  if (!claims || claims.account !== config.account || claims.storeId !== config.storeId || !claims.branch) {\n    return { status: 'unavailable', reason: 'invalid preview context' };\n  }\n\n  const { account, storeId } = config;\n  const path = [account, storeId, contentTypeId, 'entries', 'preview', entryId].map(encodeURIComponent).join('/');\n  const url = `https://${account}.vtexcommercestable.com.br/api/content-platform/manage/${path}?branchId=${encodeURIComponent(claims.branch)}&locale=${encodeURIComponent(locale)}`;\n  return fetchPreview(url, token);\n}\n\nasync function fetchPreview(url: string, token: string): Promise<ContentEntryResult> {\n  let response: Response;\n  try {\n    response = await fetch(url, {\n      cache: 'no-store',\n      headers: { Authorization: `Bearer ${token}` },\n      signal: AbortSignal.timeout(ENTRY_REQUEST_TIMEOUT_MS),\n    });\n  } catch (error) {\n    return { status: 'unavailable', reason: isTimeoutError(error) ? 'timeout' : 'network error' };\n  }\n  if (response.status === 404) return { status: 'not-found' };\n  if (!response.ok) return { status: 'unavailable', reason: `upstream status ${response.status}` };\n  let payload: unknown;\n  try {\n    payload = await response.json();\n  } catch {\n    return { status: 'invalid', reason: 'response body is not JSON' };\n  }\n  if (!isRecord(payload)) return { status: 'invalid', reason: 'response body is not an object' };\n  return { status: 'found', blob: payload };\n}\n\n/**\n * Verifies a signed preview context cookie (`base64url(claims).base64url(hmac)`) against the broker\n * secret with a constant-time comparison, returning the claims only when the signature holds and the\n * token has not expired — a captured cookie fails closed once past `exp`.\n */\nfunction verifyPreviewContext(raw: string, secret: string): PreviewClaims | null {\n  const [body, signature] = raw.split('.');\n  if (!body || !signature) return null;\n  const expected = createHmac('sha256', secret).update(body).digest('base64url');\n  const given = Buffer.from(signature, 'utf8');\n  const want = Buffer.from(expected, 'utf8');\n  if (given.length !== want.length || !timingSafeEqual(given, want)) return null;\n  try {\n    const claims = JSON.parse(Buffer.from(body, 'base64url').toString('utf8')) as PreviewClaims;\n    if (typeof claims.branch !== 'string' || !Number.isFinite(claims.exp) || Date.now() >= claims.exp) {\n      return null;\n    }\n    return claims;\n  } catch {\n    return null;\n  }\n}\n\nfunction buildDataPlaneUrl(\n  account: string,\n  storeId: string,\n  locale: string,\n  contentTypeId: string,\n  entryId: string,\n): string {\n  const path = [account, storeId, contentTypeId, 'entries', entryId].map(encodeURIComponent).join('/');\n  return `https://${account}.vtexcommercestable.com.br/api/content-platform/data/${path}?locale=${encodeURIComponent(locale)}`;\n}\n\ntype ContentSliceResult =\n  | { status: 'sliced'; content: Record<string, unknown> }\n  | { status: 'omitted'; reason: string };\n\n/**\n * Slices one element's value out of the composite blob by its `element.id` and validates it against\n * that element's per-component model. Omits only this component on a missing key, a non-object\n * value, an unknown model, or a shape violation — keyword constraints are the preflight's job.\n * Failing closed on an unknown model keeps an unvalidated blob from reaching `$content` (which would\n * crash the route as a React child).\n */\nfunction sliceContent(\n  blob: Record<string, unknown>,\n  elementId: string,\n  model: ContentTypeDefinition | undefined,\n): ContentSliceResult {\n  const raw = ownValue(blob, elementId);\n  if (!isRecord(raw)) return { status: 'omitted', reason: 'missing or non-object value' };\n  if (!model) return { status: 'omitted', reason: 'unknown model' };\n\n  const content = projectObject(model.schema.properties, raw);\n  const violation = findShapeViolation(model, content);\n  if (violation !== null) return { status: 'omitted', reason: violation };\n  return { status: 'sliced', content };\n}\n\n/** A closed object shape, at the root or one level down. */\ntype ClosedObjectShape = {\n  required?: readonly string[];\n  properties: Record<string, ContentPropertySchema>;\n};\n\n/**\n * Keeps declared keys only, at every level the vocabulary admits, so the injected value matches the\n * `ContentValue` type the component was compiled against. A value of the wrong shape passes through\n * untouched for the validator below to reject.\n */\nfunction projectObject(\n  properties: Record<string, ContentPropertySchema>,\n  raw: Record<string, unknown>,\n): Record<string, unknown> {\n  const projected: Record<string, unknown> = {};\n  for (const [key, property] of Object.entries(properties)) {\n    const value = ownValue(raw, key);\n    if (value === undefined) continue;\n    if (property.type === 'array') {\n      projected[key] = Array.isArray(value)\n        ? value.map((member) => (isRecord(member) ? projectObject(property.items.properties, member) : member))\n        : value;\n    } else if (property.type === 'object') {\n      projected[key] = isRecord(value) ? projectObject(property.properties, value) : value;\n    } else {\n      projected[key] = value;\n    }\n  }\n  return projected;\n}\n\n/** Shape-level validation only (required presence, primitive type, enum membership), at every level. */\nfunction findShapeViolation(model: ContentTypeDefinition, content: Record<string, unknown>): string | null {\n  return findObjectViolation('', model.schema, content);\n}\n\nfunction findObjectViolation(path: string, shape: ClosedObjectShape, value: Record<string, unknown>): string | null {\n  for (const key of shape.required ?? []) {\n    if (ownValue(value, key) === undefined) return `missing required property \"${joinPath(path, key)}\"`;\n  }\n  for (const [key, property] of Object.entries(shape.properties)) {\n    const member = ownValue(value, key);\n    if (member === undefined) continue;\n    const violation = findPropertyViolation(joinPath(path, key), property, member);\n    if (violation !== null) return violation;\n  }\n  return null;\n}\n\nfunction findPropertyViolation(path: string, property: ContentPropertySchema, value: unknown): string | null {\n  if (property.type === 'array') {\n    if (!Array.isArray(value)) return `property \"${path}\" does not match type \"array\"`;\n    for (const [index, member] of value.entries()) {\n      const itemPath = `${path}[${index}]`;\n      if (!isRecord(member)) return `property \"${itemPath}\" does not match type \"object\"`;\n      const violation = findObjectViolation(itemPath, property.items, member);\n      if (violation !== null) return violation;\n    }\n    // minItems and maxItems are author-time bounds; the read path does not enforce them.\n    return null;\n  }\n  if (property.type === 'object') {\n    if (!isRecord(value)) return `property \"${path}\" does not match type \"object\"`;\n    return findObjectViolation(path, property, value);\n  }\n  if (!matchesScalarType(property.type, value)) return `property \"${path}\" does not match type \"${property.type}\"`;\n  if (property.enum && !property.enum.includes(value as string | number)) {\n    return `property \"${path}\" is not an allowed enum value`;\n  }\n  return null;\n}\n\nfunction joinPath(path: string, key: string): string {\n  return path.length === 0 ? key : `${path}.${key}`;\n}\n\nfunction matchesScalarType(type: 'string' | 'number' | 'integer' | 'boolean', value: unknown): boolean {\n  switch (type) {\n    case 'string':\n      return typeof value === 'string';\n    case 'boolean':\n      return typeof value === 'boolean';\n    case 'number':\n      return typeof value === 'number' && Number.isFinite(value);\n    case 'integer':\n      return typeof value === 'number' && Number.isInteger(value);\n  }\n}\n\ntype LogLevel = 'error' | 'warn' | 'info';\n\n/** The closed vocabulary a log consumer discriminates on. Nothing else is ever emitted. */\ntype ContentEvent =\n  | 'content.read.ok'\n  | 'content.read.stale'\n  | 'content.read.missing'\n  | 'content.read.invalid'\n  | 'content.read.failed'\n  | 'content.elements.omitted'\n  | 'content.retention.skipped';\n\n/** One omitted element, as the aggregate line reports it. `reason` is a path, never a value. */\ntype ElementOmission = { elementId: string; modelId: string; reason: string };\n\n/**\n * Severity as a function of the read's status, and nothing else: `unavailable` means the runtime\n * could not read, which is the on-call signal; `not-found` and `invalid` mean the content is broken\n * while the runtime works. `source` is a payload field, so a preview read that cannot resolve is a\n * failure like any other. `invalid` is reachable from the preview branch only — the published path\n * throws on a bad body, which is why the store covers that case.\n */\nconst READ_EVENTS: Record<ContentEntryResult['status'], { level: LogLevel; event: ContentEvent }> = {\n  found: { level: 'info', event: 'content.read.ok' },\n  'not-found': { level: 'warn', event: 'content.read.missing' },\n  invalid: { level: 'warn', event: 'content.read.invalid' },\n  unavailable: { level: 'error', event: 'content.read.failed' },\n};\n\n/**\n * The one line the status does not decide: the read failed and the stored blob covered it. `warn`\n * because the page rendered, which keeps `error` meaning exactly \"the shopper is seeing holes\". A\n * covered outage never escalates on its own, so alerting on one means filtering this event name.\n */\nconst STALE_READ_EVENT: { level: LogLevel; event: ContentEvent } = { level: 'warn', event: 'content.read.stale' };\n\n/**\n * The runtime's one log line: a constant message plus a payload whose `event` is the sole event\n * discriminator, so rewording prose cannot break a consumer. Nothing here ever carries a content\n * value, a preview token, or the broker secret.\n *\n * `entryId` is high-cardinality and stays log-only. Feeding these events to a metrics pipeline —\n * which no part of this runtime has today — means dropping or hashing it at that boundary; the six\n * event names are the bounded dimension set such a pipeline would inherit.\n */\nfunction logEvent(level: LogLevel, event: ContentEvent, fields: Record<string, unknown>): void {\n  // `event` spreads last so a `fields` key of the same name cannot displace the discriminator every\n  // consumer keys on. `fields` is a `Record<string, unknown>`, so nothing in the types would object.\n  console[level]('[content-runtime]', { ...fields, event });\n}\n\nfunction transientReason(error: unknown): string {\n  if (isTimeoutError(error)) return 'timeout';\n  return error instanceof Error ? error.message : 'network error';\n}\n\n/**\n * The exact UTF-8 byte count of the serialized blob, not the JS string's UTF-16 code-unit count\n * (`.length`). Non-ASCII text — accented Latin, common in Portuguese-language content, at 2 bytes per\n * code unit, or CJK at 3 — makes those two numbers diverge, and a check against `.length` would let a\n * blob past both ceilings while genuinely over them in bytes.\n */\nfunction blobByteLength(blob: Record<string, unknown>): number {\n  return Buffer.byteLength(JSON.stringify(blob), 'utf8');\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\n/**\n * Own-property read. Every object keyed by an authored id here comes from `JSON.parse` or a plain\n * literal, so it carries `Object.prototype`: a key named `__proto__` or `constructor` would resolve\n * to something inherited instead of to `undefined`, and the absent-key branch would never be taken.\n */\nfunction ownValue<T>(source: Record<string, T>, key: string): T | undefined {\n  return Object.hasOwn(source, key) ? source[key] : undefined;\n}\n\n/** Property check instead of `instanceof`: `AbortSignal.timeout` rejects with a `DOMException`. */\nfunction isTimeoutError(error: unknown): boolean {\n  if (typeof error !== 'object' || error === null) return false;\n  const { name } = error as { name?: unknown };\n  return name === 'TimeoutError' || name === 'AbortError';\n}\n"],"mappings":";;;;;AA4EA,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCjC,MAAM,0BAA0B;AAChC,MAAM,2BAA2B;;AAGjC,MAAM,oBAAoB;;AAE1B,MAAM,qBAAqB;;AAE3B,MAAM,iBAAiB;;;;;;;;;AAUvB,SAAgB,qBAAqB,QAA8C;CAajF,MAAM,2BAAW,IAAI,IAAqC;CAC1D,IAAI,gBAAgB;;;;;;;CAQpB,SAAS,WACP,KACA,MACA,QACM;EACN,MAAM,OAAO,eAAe,IAAI;EAChC,IAAI,OAAO,yBAAyB;GAClC,SAAS,QAAQ,6BAA6B;IAAE,GAAG;IAAQ,OAAO;IAAM,QAAQ;GAAiB,CAAC;GAClG;EACF;EACA,MAAM,WAAW,SAAS,IAAI,GAAG;EACjC,MAAM,eAAe,WAAW,eAAe,QAAQ,IAAI;EAC3D,IAAI,gBAAgB,eAAe,OAAO,0BAA0B;GAClE,SAAS,QAAQ,6BAA6B;IAAE,GAAG;IAAQ,OAAO;IAAM,QAAQ;GAAoB,CAAC;GACrG;EACF;EACA,SAAS,IAAI,KAAK,IAAI;EACtB,iBAAiB,OAAO;CAC1B;;;;;;;;;;;;CAaA,eAAe,cAAc,eAAuB,SAAiB,QAAwC;EAI3G,MAAM,MAAM,GAAG,cAAc,QAAQ,QAAQ,QAAQ;EACrD,IAAI;GACF,MAAM,SAAS,MAAM,mBAAmB,OAAO,SAAS,OAAO,SAAS,QAAQ,eAAe,OAAO;GACtG,IAAI,OAAO,WAAW,SACpB,WAAW,KAAK,OAAO,MAAM;IAAE;IAAe;IAAS;GAAO,CAAC;GAEjE,OAAO,EAAE,OAAO;EAClB,SAAS,OAAO;GACd,MAAM,SAAS,gBAAgB,KAAK;GACpC,MAAM,SAAS,SAAS,IAAI,GAAG;GAE/B,IAAI,WAAW,KAAA,GAAW,OAAO,EAAE,QAAQ;IAAE,QAAQ;IAAe;GAAO,EAAE;GAC7E,OAAO;IAAE,QAAQ;KAAE,QAAQ;KAAS,MAAM;IAAO;IAAG,aAAa;GAAO;EAC1E;CACF;CAMA,MAAM,OAAO,MAAM,OAAO,eAAuB,SAAiB,WAAgD;EAQhH,MAAM,WAAW;EACjB,MAAM,EAAE,WAAW,UAAU,MAAM,UAAU;EAC7C,IAAI;EACJ,IAAI;EACJ,IAAI,OAGF,SAAS,MAAM,iBAAiB,QAAQ,eAAe,SAAS,MAAM;OAEtE,CAAC,CAAE,QAAQ,eAAgB,MAAM,cAAc,eAAe,SAAS,MAAM;EAG/E,MAAM,QAAQ,gBAAgB,KAAA;EAC9B,MAAM,EAAE,OAAO,UAAU,QAAQ,mBAAmB,YAAY,OAAO;EACvE,MAAM,SACJ,gBAAgB,OAAO,WAAW,iBAAiB,OAAO,WAAW,YAAY,OAAO,SAAS,KAAA;EAMnG,IAAI,EADe,CAAC,SAAS,OAAO,WAAW,WAAW,QAAQ,IAAI,aAAa,eAEjF,SAAS,OAAO,OAAO;GACrB;GACA;GACA;GACA,QAAQ,QAAQ,kBAAkB;GAClC,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;EAC3C,CAAC;EAEH,OAAO;CACT,CAAC;;;;;;;;;;CAWD,eAAe,kBAAkB,EAC/B,eACA,SACA,QACA,YACgD;EAChD,MAAM,SAAS,MAAM,KAAK,eAAe,SAAS,MAAM;EACxD,IAAI,OAAO,WAAW,SAIpB,OAAO,YAAY;EAErB,MAAM,SAAS,YAAY;EAC3B,MAAM,YAAY,OAAO,QAAQ,QAAQ;EACzC,MAAM,YAA+B,CAAC;EACtC,KAAK,MAAM,CAAC,WAAW,YAAY,WAAW;GAC5C,MAAM,QAAQ,aAAa,OAAO,MAAM,WAAW,SAAS,OAAO,cAAc,OAAO,CAAC;GACzF,IAAI,MAAM,WAAW,WAAW;IAE9B,UAAU,KAAK;KAAE;KAAW;KAAS,QAAQ,MAAM;IAAO,CAAC;IAC3D;GACF;GACA,OAAO,aAAa,MAAM;EAC5B;EACA,IAAI,UAAU,SAAS,GAIrB,SAAS,QAAQ,4BAA4B;GAC3C;GACA;GACA;GACA,SAAS,UAAU;GACnB,OAAO,UAAU;GACjB;EACF,CAAC;EAEH,OAAO;CACT;CAEA,OAAO;EAAE;EAAmB;CAAqB;AACnD;;;;;;;AAQA,SAAS,cAA6B;CACpC,OAAO,OAAO,OAAO,IAAI;AAC3B;;;;;;;;;AAUA,SAAS,qBAAqB,EAAE,OAAO,YAAkD;CACvF,OAAO,UAAU,KAAA,IAAY,OAAO;AACtC;;;;;;;;;;;;;;AAeA,eAAe,mBACb,SACA,SACA,QACA,eACA,SAC6B;CAC7B,MAAM,MAAM,kBAAkB,SAAS,SAAS,QAAQ,eAAe,OAAO;CAC9E,MAAM,WAAW,MAAM,MAAM,KAAK,EAAE,QAAQ,YAAY,QAAQ,wBAAwB,EAAE,CAAC;CAE3F,IAAI,SAAS,WAAW,KAAK,OAAO,EAAE,QAAQ,YAAY;CAC1D,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,2BAA2B,SAAS,QAAQ;CAE9E,IAAI;CACJ,IAAI;EACF,UAAU,MAAM,SAAS,KAAK;CAChC,QAAQ;EACN,MAAM,IAAI,MAAM,8BAA8B;CAChD;CACA,IAAI,CAAC,SAAS,OAAO,GAAG,MAAM,IAAI,MAAM,mCAAmC;CAE3E,OAAO;EAAE,QAAQ;EAAS,MAAM;CAAQ;AAC1C;;;;;;;;AASA,eAAe,iBACb,QACA,eACA,SACA,QAC6B;CAC7B,MAAM,QAAQ,QAAQ,IAAI;CAC1B,IAAI,CAAC,OAAO,OAAO;EAAE,QAAQ;EAAe,QAAQ;CAAiC;CACrF,MAAM,SAAS,QAAQ,IAAI;CAC3B,IAAI,CAAC,QAAQ,OAAO;EAAE,QAAQ;EAAe,QAAQ;CAA6B;CAGlF,MAAM,OAAM,MADQ,QAAQ,EAAA,CACV,IAAI,cAAc,CAAC,EAAE;CACvC,MAAM,SAAS,MAAM,qBAAqB,KAAK,MAAM,IAAI;CACzD,IAAI,CAAC,UAAU,OAAO,YAAY,OAAO,WAAW,OAAO,YAAY,OAAO,WAAW,CAAC,OAAO,QAC/F,OAAO;EAAE,QAAQ;EAAe,QAAQ;CAA0B;CAGpE,MAAM,EAAE,SAAS,YAAY;CAG7B,OAAO,aAAa,WADG,QAAQ,yDADlB;EAAC;EAAS;EAAS;EAAe;EAAW;EAAW;CAAO,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAChB,EAAE,YAAY,mBAAmB,OAAO,MAAM,EAAE,UAAU,mBAAmB,MAAM,KACrJ,KAAK;AAChC;AAEA,eAAe,aAAa,KAAa,OAA4C;CACnF,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,MAAM,KAAK;GAC1B,OAAO;GACP,SAAS,EAAE,eAAe,UAAU,QAAQ;GAC5C,QAAQ,YAAY,QAAQ,wBAAwB;EACtD,CAAC;CACH,SAAS,OAAO;EACd,OAAO;GAAE,QAAQ;GAAe,QAAQ,eAAe,KAAK,IAAI,YAAY;EAAgB;CAC9F;CACA,IAAI,SAAS,WAAW,KAAK,OAAO,EAAE,QAAQ,YAAY;CAC1D,IAAI,CAAC,SAAS,IAAI,OAAO;EAAE,QAAQ;EAAe,QAAQ,mBAAmB,SAAS;CAAS;CAC/F,IAAI;CACJ,IAAI;EACF,UAAU,MAAM,SAAS,KAAK;CAChC,QAAQ;EACN,OAAO;GAAE,QAAQ;GAAW,QAAQ;EAA4B;CAClE;CACA,IAAI,CAAC,SAAS,OAAO,GAAG,OAAO;EAAE,QAAQ;EAAW,QAAQ;CAAiC;CAC7F,OAAO;EAAE,QAAQ;EAAS,MAAM;CAAQ;AAC1C;;;;;;AAOA,SAAS,qBAAqB,KAAa,QAAsC;CAC/E,MAAM,CAAC,MAAM,aAAa,IAAI,MAAM,GAAG;CACvC,IAAI,CAAC,QAAQ,CAAC,WAAW,OAAO;CAChC,MAAM,WAAW,WAAW,UAAU,MAAM,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,WAAW;CAC7E,MAAM,QAAQ,OAAO,KAAK,WAAW,MAAM;CAC3C,MAAM,OAAO,OAAO,KAAK,UAAU,MAAM;CACzC,IAAI,MAAM,WAAW,KAAK,UAAU,CAAC,gBAAgB,OAAO,IAAI,GAAG,OAAO;CAC1E,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,OAAO,KAAK,MAAM,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;EACzE,IAAI,OAAO,OAAO,WAAW,YAAY,CAAC,OAAO,SAAS,OAAO,GAAG,KAAK,KAAK,IAAI,KAAK,OAAO,KAC5F,OAAO;EAET,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,kBACP,SACA,SACA,QACA,eACA,SACQ;CAER,OAAO,WAAW,QAAQ,uDADb;EAAC;EAAS;EAAS;EAAe;EAAW;CAAO,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,KAAK,GACZ,EAAE,UAAU,mBAAmB,MAAM;AAC3H;;;;;;;;AAaA,SAAS,aACP,MACA,WACA,OACoB;CACpB,MAAM,MAAM,SAAS,MAAM,SAAS;CACpC,IAAI,CAAC,SAAS,GAAG,GAAG,OAAO;EAAE,QAAQ;EAAW,QAAQ;CAA8B;CACtF,IAAI,CAAC,OAAO,OAAO;EAAE,QAAQ;EAAW,QAAQ;CAAgB;CAEhE,MAAM,UAAU,cAAc,MAAM,OAAO,YAAY,GAAG;CAC1D,MAAM,YAAY,mBAAmB,OAAO,OAAO;CACnD,IAAI,cAAc,MAAM,OAAO;EAAE,QAAQ;EAAW,QAAQ;CAAU;CACtE,OAAO;EAAE,QAAQ;EAAU;CAAQ;AACrC;;;;;;AAaA,SAAS,cACP,YACA,KACyB;CACzB,MAAM,YAAqC,CAAC;CAC5C,KAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,UAAU,GAAG;EACxD,MAAM,QAAQ,SAAS,KAAK,GAAG;EAC/B,IAAI,UAAU,KAAA,GAAW;EACzB,IAAI,SAAS,SAAS,SACpB,UAAU,OAAO,MAAM,QAAQ,KAAK,IAChC,MAAM,KAAK,WAAY,SAAS,MAAM,IAAI,cAAc,SAAS,MAAM,YAAY,MAAM,IAAI,MAAO,IACpG;OACC,IAAI,SAAS,SAAS,UAC3B,UAAU,OAAO,SAAS,KAAK,IAAI,cAAc,SAAS,YAAY,KAAK,IAAI;OAE/E,UAAU,OAAO;CAErB;CACA,OAAO;AACT;;AAGA,SAAS,mBAAmB,OAA8B,SAAiD;CACzG,OAAO,oBAAoB,IAAI,MAAM,QAAQ,OAAO;AACtD;AAEA,SAAS,oBAAoB,MAAc,OAA0B,OAA+C;CAClH,KAAK,MAAM,OAAO,MAAM,YAAY,CAAC,GACnC,IAAI,SAAS,OAAO,GAAG,MAAM,KAAA,GAAW,OAAO,8BAA8B,SAAS,MAAM,GAAG,EAAE;CAEnG,KAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,MAAM,UAAU,GAAG;EAC9D,MAAM,SAAS,SAAS,OAAO,GAAG;EAClC,IAAI,WAAW,KAAA,GAAW;EAC1B,MAAM,YAAY,sBAAsB,SAAS,MAAM,GAAG,GAAG,UAAU,MAAM;EAC7E,IAAI,cAAc,MAAM,OAAO;CACjC;CACA,OAAO;AACT;AAEA,SAAS,sBAAsB,MAAc,UAAiC,OAA+B;CAC3G,IAAI,SAAS,SAAS,SAAS;EAC7B,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,OAAO,aAAa,KAAK;EACpD,KAAK,MAAM,CAAC,OAAO,WAAW,MAAM,QAAQ,GAAG;GAC7C,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM;GAClC,IAAI,CAAC,SAAS,MAAM,GAAG,OAAO,aAAa,SAAS;GACpD,MAAM,YAAY,oBAAoB,UAAU,SAAS,OAAO,MAAM;GACtE,IAAI,cAAc,MAAM,OAAO;EACjC;EAEA,OAAO;CACT;CACA,IAAI,SAAS,SAAS,UAAU;EAC9B,IAAI,CAAC,SAAS,KAAK,GAAG,OAAO,aAAa,KAAK;EAC/C,OAAO,oBAAoB,MAAM,UAAU,KAAK;CAClD;CACA,IAAI,CAAC,kBAAkB,SAAS,MAAM,KAAK,GAAG,OAAO,aAAa,KAAK,yBAAyB,SAAS,KAAK;CAC9G,IAAI,SAAS,QAAQ,CAAC,SAAS,KAAK,SAAS,KAAwB,GACnE,OAAO,aAAa,KAAK;CAE3B,OAAO;AACT;AAEA,SAAS,SAAS,MAAc,KAAqB;CACnD,OAAO,KAAK,WAAW,IAAI,MAAM,GAAG,KAAK,GAAG;AAC9C;AAEA,SAAS,kBAAkB,MAAmD,OAAyB;CACrG,QAAQ,MAAR;EACE,KAAK,UACH,OAAO,OAAO,UAAU;EAC1B,KAAK,WACH,OAAO,OAAO,UAAU;EAC1B,KAAK,UACH,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;EAC3D,KAAK,WACH,OAAO,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK;CAC9D;AACF;;;;;;;;AAwBA,MAAM,cAA8F;CAClG,OAAO;EAAE,OAAO;EAAQ,OAAO;CAAkB;CACjD,aAAa;EAAE,OAAO;EAAQ,OAAO;CAAuB;CAC5D,SAAS;EAAE,OAAO;EAAQ,OAAO;CAAuB;CACxD,aAAa;EAAE,OAAO;EAAS,OAAO;CAAsB;AAC9D;;;;;;AAOA,MAAM,mBAA6D;CAAE,OAAO;CAAQ,OAAO;AAAqB;;;;;;;;;;AAWhH,SAAS,SAAS,OAAiB,OAAqB,QAAuC;CAG7F,QAAQ,MAAM,CAAC,qBAAqB;EAAE,GAAG;EAAQ;CAAM,CAAC;AAC1D;AAEA,SAAS,gBAAgB,OAAwB;CAC/C,IAAI,eAAe,KAAK,GAAG,OAAO;CAClC,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAClD;;;;;;;AAQA,SAAS,eAAe,MAAuC;CAC7D,OAAO,OAAO,WAAW,KAAK,UAAU,IAAI,GAAG,MAAM;AACvD;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;;;;AAOA,SAAS,SAAY,QAA2B,KAA4B;CAC1E,OAAO,OAAO,OAAO,QAAQ,GAAG,IAAI,OAAO,OAAO,KAAA;AACpD;;AAGA,SAAS,eAAe,OAAyB;CAC/C,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,MAAM,EAAE,SAAS;CACjB,OAAO,SAAS,kBAAkB,SAAS;AAC7C"}
+{"version":3,"file":"create-content-runtime.js","names":[],"sources":["../../../src/sdk/content/create-content-runtime.tsx"],"sourcesContent":["import { createHmac, timingSafeEqual } from 'node:crypto';\nimport type { ContentPropertySchema, ContentTypeDefinition } from '@vtex/fs-core';\nimport { cookies, draftMode } from 'next/headers';\nimport { connection } from 'next/server';\nimport { cache, type FC, type ReactNode } from 'react';\nimport { ownValue } from '../../utils/own-value.js';\n\nexport type ContentRuntimeConfig = {\n  account: string;\n  storeId: string;\n  /** Canonical per-component models, verbatim from the aggregated content catalog, keyed by id. */\n  contentTypes: Record<string, ContentTypeDefinition>;\n};\n\n/** The coordinates of one composite read. `locale` arrives per call, so one build serves many. */\nexport type ReadContentSlicesArgs = {\n  contentTypeId: string;\n  entryId: string;\n  locale: string;\n  /** `element.id → per-component model id` for every content-backed element in the scope. */\n  elements: Record<string, string>;\n};\n\n/**\n * The scope's slices, keyed by `element.id`. A key is absent when its element must be omitted — a\n * missing key, a shape violation, or a whole-entry failure.\n *\n * The value type is unchecked on purpose: the generated page forwards it to a component whose\n * `$content` is `ContentValue<that component's model>`, a type that exists only in the component\n * package, and an index signature cannot satisfy a model's required properties. Stated once here\n * rather than cast at every emitted prop; the read below validates every value against its model.\n */\nexport type ContentSlices = {\n  // biome-ignore lint/suspicious/noExplicitAny: the model's type lives in the component package, not here.\n  [elementId: string]: any;\n};\n\nexport type ContentEntryBoundaryProps = {\n  /** This element's slice, read at the top of the scope. `undefined` omits the component. */\n  value: unknown;\n  children: ReactNode;\n};\n\n/** The coordinates of one item read. Object arguments, so two strings cannot be swapped at the call site. */\nexport type ReadContentItemArgs = {\n  contentTypeId: string;\n  slug: string;\n  locale: string;\n};\n\n/**\n * One item read. `found` is the resolved entry. `not-found` is HTTP 404 only. `unavailable` is every\n * other failure with nothing stored. There is no `invalid` arm: a 200 JSON object is the blob.\n */\nexport type ContentItemResult =\n  | { status: 'found'; blob: Record<string, unknown> }\n  | { status: 'not-found' }\n  | { status: 'unavailable'; reason: string };\n\nexport type ContentRuntime = {\n  readContentSlices: (args: ReadContentSlicesArgs) => Promise<ContentSlices>;\n  readContentItem: (args: ReadContentItemArgs) => Promise<ContentItemResult>;\n  ContentEntryBoundary: FC<ContentEntryBoundaryProps>;\n};\n\n/** The signed preview context the Draft Mode route stores; re-verified here before use. */\ntype PreviewClaims = {\n  account: string;\n  storeId: string;\n  branch: string;\n  /** Millisecond epoch the token was minted / expires; a captured cookie stops working past `exp`. */\n  iat: number;\n  exp: number;\n};\n\n/**\n * Internal result taxonomy: a read either finds a validated composite blob or fails for a definite,\n * loggable reason. A transient upstream failure resolves `found` from the last-good store below when\n * that store holds the entry, and degrades to `unavailable` — omitting the affected components —\n * only when it does not.\n */\nexport type ContentEntryResult =\n  | { status: 'found'; blob: Record<string, unknown> }\n  | { status: 'not-found' }\n  | { status: 'unavailable'; reason: string }\n  | { status: 'invalid'; reason: string };\n\n/**\n * One published read's outcome. `staleReason` is present only when the fresh read failed and the\n * store covered it, and the result is then an ordinary `found`: no consumer has a fifth renderable\n * status to learn, and only the log line tells a served blob from a fresh one.\n */\ntype PublishedRead = { result: ContentEntryResult; staleReason?: string };\n\n/** Same shape as `PublishedRead`, on the item taxonomy (no `invalid` arm). */\ntype PublishedItemRead = { result: ContentItemResult; staleReason?: string };\n\nconst ENTRY_REQUEST_TIMEOUT_MS = 5000;\n\n/**\n * Retention ceilings for the last-good store, both estimated rather than measured: no production\n * store exists yet to size a real composite against, and the example schemas in this repo are demo\n * content, not authored pages, so neither is evidence of real scale.\n *\n * `MAX_RETAINED_BLOB_BYTES` bounds one entry. Ordinary editorial text (a title, a body, an image URL,\n * an alt text) stays in the hundreds of bytes to a few kilobytes per element regardless of how many\n * elements a page composes — even the largest composed layout in this repo (103 elements) does not\n * read as megabytes if every element stays plain text. The realistic way to exceed this is a single\n * field holding embedded binary — a base64 image pasted into a text field instead of uploaded through\n * the media widget — which is exactly the shape this guards against, independent of element count.\n *\n * `MAX_RETAINED_TOTAL_BYTES` bounds the whole store, and is the one that actually matters: the\n * per-blob cap alone does not bound total memory, because it multiplies by key count, and key count is\n * not small — a large store's pages and layouts, times its locales, is plausibly a few hundred keys.\n * A few hundred keys at a few megabytes each already exceeds a typical serverless heap (512 MB–1 GB)\n * on the per-blob cap alone; ~64 MB is a small slice of that heap while still holding many ordinary\n * pages at once.\n *\n * Both numbers count serialized JSON text (`blobByteLength`), not retained heap: a parsed object\n * typically costs more than its JSON text — V8 pays per-property and per-string object overhead that\n * the text itself does not — so the real footprint at either ceiling is larger than the number on the\n * tin, plausibly by a small multiple. Both ceilings still leave headroom against a 512 MB–1 GB heap at\n * that multiple; sizing them as retained heap instead would need a runtime memory measurement this\n * module has no cheap way to take.\n *\n * Both numbers are round and generous on purpose, not derived. `content.retention.skipped` below is\n * the real calibration path: once a production store exists, its log volume says whether either\n * ceiling needs to move.\n */\nconst MAX_RETAINED_BLOB_BYTES = 1_000_000;\nconst MAX_RETAINED_TOTAL_BYTES = 64_000_000;\n\n/** Server-only preview credential, supplied at deployment time; never reaches the browser. */\nconst PREVIEW_TOKEN_ENV = 'CONTENT_PLATFORM_PREVIEW_TOKEN';\n/** Shared broker secret used to verify the signed preview context cookie. */\nconst PREVIEW_SECRET_ENV = 'CONTENT_PREVIEW_SECRET';\n/** The signed preview context cookie the Draft Mode route sets. */\nconst PREVIEW_COOKIE = '__fs_content_preview';\n\n/**\n * Creates the one server-side content read surface for a store: a `React.cache`-deduped\n * `readContentSlices` the generated page or layout awaits once at the top, and the\n * `ContentEntryBoundary` the compiler wraps around each content-backed element. One read per scope\n * yields every element's `$content` value keyed by `element.id`, so a page issues at most two Data\n * Plane reads (its own entry plus its layout's) regardless of content-backed component count. Draft\n * Mode switches that composite read to Control Plane's preview endpoint through a server-only\n * credential. `readContentItem` reads one entry by slug and does not consult Draft Mode.\n */\nexport function createContentRuntime(config: ContentRuntimeConfig): ContentRuntime {\n  // The blob of the most recent successful published read, per entry, so a failing Data Plane\n  // renders the last content that worked instead of holes. Not `React.cache`, whose lifetime is the\n  // request and so shorter than the failure it has to cover, and not module scope, which every\n  // runtime in the process would share — two of them on the same coordinates would then serve each\n  // other's content. The generated consumer holds the runtime in a module-scope `const`, so the\n  // closure lives as long as the process either way.\n  //\n  // `contentTypeId` and `entryId` are compiler-emitted literals for the life of the deployment (a\n  // dynamic route gets one entry, not one per slug), so today's key domain is small: pages plus\n  // layouts, times locales. That is an invariant of the generated caller, not of this function —\n  // nothing here stops a future one from passing a request-derived value instead, and the moment it\n  // does, this map grows with traffic rather than with the store's page count.\n  //\n  // Item reads share this map and both ceilings. Their key starts with `item` and a NUL, then the\n  // content type, slug, and locale, so it cannot equal a composite key even when the slug equals an\n  // entry id. A slug is request-derived, so that part of the map grows with distinct items.\n  const lastGood = new Map<string, Record<string, unknown>>();\n  let retainedBytes = 0;\n\n  type RetainFields =\n    | { contentTypeId: string; entryId: string; locale: string }\n    | { contentTypeId: string; slug: string; locale: string };\n\n  /**\n   * Whether a successful read's blob replaces what `key` already holds, weighed against both\n   * ceilings. Skipping never deletes: whatever `key` held before, if anything, is left exactly as it\n   * was — only the update is declined, so a rare oversized read cannot erase a smaller last-good value\n   * that a future failure could still use.\n   */\n  function retainBlob(key: string, blob: Record<string, unknown>, fields: RetainFields): void {\n    const size = blobByteLength(blob);\n    if (size > MAX_RETAINED_BLOB_BYTES) {\n      logEvent('warn', 'content.retention.skipped', { ...fields, bytes: size, reason: 'blob-too-large' });\n      return;\n    }\n    const existing = lastGood.get(key);\n    const existingSize = existing ? blobByteLength(existing) : 0;\n    if (retainedBytes - existingSize + size > MAX_RETAINED_TOTAL_BYTES) {\n      logEvent('warn', 'content.retention.skipped', { ...fields, bytes: size, reason: 'total-cap-reached' });\n      return;\n    }\n    lastGood.set(key, blob);\n    retainedBytes += size - existingSize;\n  }\n\n  /**\n   * The published read plus the fallback that covers it. The upstream is always called and the store\n   * is read only in the `catch`, which is what makes this a fallback and not a cache: a publish is\n   * visible on the very next request. A success ordinarily overwrites the entry (see `retainBlob` for\n   * the two cases where it does not), a `not-found` leaves it alone so unpublishing still unpublishes,\n   * and nothing is ever removed or expired by age.\n   *\n   * Failure is structural — whatever leaves `readPublishedEntry` as a throw — rather than a status\n   * table, so a 403 or a 429 serves the stored blob, and a failure mode added there later is covered\n   * without touching this.\n   */\n  async function readPublished(contentTypeId: string, entryId: string, locale: string): Promise<PublishedRead> {\n    // NUL appears in no content-type id, entry id, or BCP-47 tag, so two distinct triples cannot\n    // collide. Keyed on the same three values the memoisation below uses, so the two layers never\n    // disagree about what \"the same read\" is.\n    const key = `${contentTypeId}\\u0000${entryId}\\u0000${locale}`;\n    try {\n      const result = await readPublishedEntry(config.account, config.storeId, locale, contentTypeId, entryId);\n      if (result.status === 'found') {\n        retainBlob(key, result.blob, { contentTypeId, entryId, locale });\n      }\n      return { result };\n    } catch (error) {\n      const reason = transientReason(error);\n      const stored = lastGood.get(key);\n      // Nothing stored: omit the affected components while the rest of the route renders.\n      if (stored === undefined) return { result: { status: 'unavailable', reason } };\n      return { result: { status: 'found', blob: stored }, staleReason: reason };\n    }\n  }\n\n  /**\n   * The by-slug read plus the same fallback. Not a parameter of `readPublished`: the key, the URL,\n   * and the result taxonomy differ, and folding them together would put a slug on the composite log\n   * line. A `not-found` returns before the map is read or written.\n   */\n  async function readPublishedItem(contentTypeId: string, slug: string, locale: string): Promise<PublishedItemRead> {\n    // The `item` prefix is what keeps this off `${contentTypeId}\\u0000${entryId}\\u0000${locale}`.\n    const key = `item\\u0000${contentTypeId}\\u0000${slug}\\u0000${locale}`;\n    try {\n      const result = await readItemBySlug(config.account, config.storeId, locale, contentTypeId, slug);\n      if (result.status === 'found') {\n        retainBlob(key, result.blob, { contentTypeId, slug, locale });\n      }\n      return { result };\n    } catch (error) {\n      const reason = transientReason(error);\n      const stored = lastGood.get(key);\n      if (stored === undefined) return { result: { status: 'unavailable', reason } };\n      return { result: { status: 'found', blob: stored }, staleReason: reason };\n    }\n  }\n\n  // React.cache collapses same-entry awaits within one request: N boundaries reading the same\n  // composite entry share one upstream read and one read-log line. That is per-request memoisation\n  // only — nothing is reused across requests — so it is `readPublished` above, not this, that\n  // carries a value across the failure it covers. Either way a read never throws a route error.\n  const read = cache(async (contentTypeId: string, entryId: string, locale: string): Promise<ContentEntryResult> => {\n    // Content is read per request, never at build time. Nothing else on a content-only page is\n    // request-dependent — `draftMode()` prerenders as disabled and an uncached `fetch` does not bail\n    // out on its own — so without this the entry is captured by a static prerender and the store\n    // stops tracking the CMS until its next deploy. `'use cache'` used to hold the route open with a\n    // five-minute revalidate; removing it for a platform that does not stream took that with it.\n    // Outside the fallback's try, which lives in `readPublished`, so the bail-out it throws during\n    // static generation is never swallowed as a transient failure.\n    await connection();\n    const { isEnabled: draft } = await draftMode();\n    let result: ContentEntryResult;\n    let staleReason: string | undefined;\n    if (draft) {\n      // The preview branch neither reads the store nor writes it: an unpublished blob must not\n      // outlive the request that asked for it, and a draft must never cover a published failure.\n      result = await readPreviewEntry(config, contentTypeId, entryId, locale);\n    } else {\n      ({ result, staleReason } = await readPublished(contentTypeId, entryId, locale));\n    }\n    // A served blob is `found`, so the status alone would report it as a success.\n    const stale = staleReason !== undefined;\n    const { level, event } = stale ? STALE_READ_EVENT : READ_EVENTS[result.status];\n    const reason =\n      staleReason ?? (result.status === 'unavailable' || result.status === 'invalid' ? result.reason : undefined);\n    // The success line is the cheapest evidence of the ≤2-reads-per-page guarantee, and its only\n    // cost is production volume: nothing caches this read, so it would emit once or twice per page\n    // view and bury the rare failure line. Suppressed there, kept everywhere the count is checked —\n    // and the gate covers a genuine success only, so a covered outage stays audible in production.\n    const suppressed = !stale && result.status === 'found' && process.env.NODE_ENV === 'production';\n    if (!suppressed) {\n      logEvent(level, event, {\n        contentTypeId,\n        entryId,\n        locale,\n        source: draft ? 'control-plane' : 'data-plane',\n        ...(reason === undefined ? {} : { reason }),\n      });\n    }\n    return result;\n  });\n\n  /**\n   * The scope's one read, awaited before render: the composite entry, sliced into one `$content`\n   * value per content-backed element. The values reach the components as literal props, so they are\n   * part of the server render by construction — a `cloneElement` from a client-side provider lands\n   * only on hydration, which is what made server HTML and client DOM disagree.\n   *\n   * The public shape takes one object, so a call site cannot silently swap two same-typed positional\n   * arguments; `React.cache` keys on the positional ones underneath.\n   */\n  async function readContentSlices({\n    contentTypeId,\n    entryId,\n    locale,\n    elements,\n  }: ReadContentSlicesArgs): Promise<ContentSlices> {\n    const result = await read(contentTypeId, entryId, locale);\n    if (result.status !== 'found') {\n      // A whole-entry failure (404, invalid, or an upstream failure with nothing stored for the\n      // entry) omits every component sharing it: no key is present, so every boundary renders\n      // nothing. A failure the last-good store covered never arrives here — it arrives as `found`.\n      return emptySlices();\n    }\n    const slices = emptySlices();\n    const requested = Object.entries(elements);\n    const omissions: ElementOmission[] = [];\n    for (const [elementId, modelId] of requested) {\n      const slice = sliceContent(result.blob, elementId, ownValue(config.contentTypes, modelId));\n      if (slice.status === 'omitted') {\n        // A missing or invalid key within an otherwise-valid entry omits only this one component.\n        omissions.push({ elementId, modelId, reason: slice.reason });\n        continue;\n      }\n      slices[elementId] = slice.content;\n    }\n    if (omissions.length > 0) {\n      // One line per call rather than one per element: the operational fact is the ratio, and\n      // `omitted === total` is what tells a blank scope from a partial one. The level says only that\n      // the page rendered, so it stays `warn` at every ratio.\n      logEvent('warn', 'content.elements.omitted', {\n        contentTypeId,\n        entryId,\n        locale,\n        omitted: omissions.length,\n        total: requested.length,\n        omissions,\n      });\n    }\n    return slices;\n  }\n\n  // A separate cache from `read`. Positional key is content type, slug, locale. `connection()` is\n  // outside `readPublishedItem`'s try, so a prerender bail-out propagates unlogged. Draft Mode is\n  // not a branch this read has: there is no slug preview route, and a Data Plane `branch` query is\n  // ignored by the platform.\n  const readItem = cache(async (contentTypeId: string, slug: string, locale: string): Promise<ContentItemResult> => {\n    await connection();\n    const { result, staleReason } = await readPublishedItem(contentTypeId, slug, locale);\n    const stale = staleReason !== undefined;\n    const { level, event } = stale ? STALE_READ_EVENT : READ_EVENTS[result.status];\n    const reason = staleReason ?? (result.status === 'unavailable' ? result.reason : undefined);\n    const suppressed = !stale && result.status === 'found' && process.env.NODE_ENV === 'production';\n    if (!suppressed) {\n      logEvent(level, event, {\n        contentTypeId,\n        slug,\n        locale,\n        source: 'data-plane',\n        ...(reason === undefined ? {} : { reason }),\n      });\n    }\n    return result;\n  });\n\n  async function readContentItem({ contentTypeId, slug, locale }: ReadContentItemArgs): Promise<ContentItemResult> {\n    return readItem(contentTypeId, slug, locale);\n  }\n\n  return { readContentSlices, readContentItem, ContentEntryBoundary };\n}\n\n/**\n * The slice map, with no prototype. An element id is a schema string, so `__proto__` is a name the\n * map can be asked for; on a plain object the lookup would inherit `Object.prototype` and a boundary\n * would render an element whose `$content` is that object rather than omitting it. The failure path\n * returns this too — an entry that 404s must answer `undefined` for every key, including that one.\n */\nfunction emptySlices(): ContentSlices {\n  return Object.create(null) as ContentSlices;\n}\n\n/**\n * Renders its element only when that element's slice is present — the omission rule the content RFC\n * states. It no longer delivers the value (the page passes `$content` as a literal prop), so it\n * clones nothing and what wraps it no longer decides whether content arrives.\n *\n * Module scope, not a closure over `createContentRuntime`: it reads nothing from the runtime's\n * configuration, so every store shares one component identity.\n */\nfunction ContentEntryBoundary({ value, children }: ContentEntryBoundaryProps): ReactNode {\n  return value === undefined ? null : children;\n}\n\n/**\n * The published read: one composite entry from the Data Plane, live on every request. A definitive\n * 404 resolves a `not-found` sentinel; a transient failure (network, timeout, 5xx, malformed body)\n * throws, and `readPublished` decides between the stored blob and an omit.\n *\n * Nothing caches it. This read sat under `'use cache'` until Cache Components was removed for a\n * platform that does not stream, and the five-minute `cacheLife` and 24-hour `expire` went with it —\n * a transient failure used to throw inside the cache and Next kept serving the last-good entry for\n * up to a day. What replaced that is the last-good store, which is a fallback and not a cache: it\n * never shortens or skips this read, so the happy path is unchanged and a publish lands on the very\n * next request. The page cache, the two cache tags this read emitted and the tag-based revalidation\n * route they fed are still gone, and still owed by whatever restores caching.\n */\nasync function readPublishedEntry(\n  account: string,\n  storeId: string,\n  locale: string,\n  contentTypeId: string,\n  entryId: string,\n): Promise<ContentEntryResult> {\n  const url = buildDataPlaneUrl(account, storeId, locale, contentTypeId, entryId);\n  const response = await fetch(url, { signal: AbortSignal.timeout(ENTRY_REQUEST_TIMEOUT_MS) });\n\n  if (response.status === 404) return { status: 'not-found' };\n  if (!response.ok) throw new Error(`content upstream status ${response.status}`);\n\n  let payload: unknown;\n  try {\n    payload = await response.json();\n  } catch {\n    throw new Error('content response is not JSON');\n  }\n  if (!isRecord(payload)) throw new Error('content response is not an object');\n\n  return { status: 'found', blob: payload };\n}\n\n/**\n * One entry from the Data Plane by slug. A 404 resolves `not-found` before `json()`. Any other\n * non-OK status, a non-JSON body, or a non-object body throws, and `readPublishedItem` decides\n * between the stored blob and `unavailable`. A 200 object is `found` with no field-schema check.\n * `locale_metadata` is the platform envelope (it carries an inline SVG) and this path has no slicer,\n * so that own property is removed before the blob is returned or retained. No other key is dropped.\n * A list body is not an object, so it throws rather than resolving `not-found`.\n */\nasync function readItemBySlug(\n  account: string,\n  storeId: string,\n  locale: string,\n  contentTypeId: string,\n  slug: string,\n): Promise<ContentItemResult> {\n  const url = buildDataPlaneSlugUrl(account, storeId, locale, contentTypeId, slug);\n  const response = await fetch(url, { signal: AbortSignal.timeout(ENTRY_REQUEST_TIMEOUT_MS) });\n\n  if (response.status === 404) return { status: 'not-found' };\n  if (!response.ok) throw new Error(`content upstream status ${response.status}`);\n\n  let payload: unknown;\n  try {\n    payload = await response.json();\n  } catch {\n    throw new Error('content response is not JSON');\n  }\n  if (!isRecord(payload)) throw new Error('content response is not an object');\n  if (Object.hasOwn(payload, 'locale_metadata')) {\n    delete payload.locale_metadata;\n  }\n\n  return { status: 'found', blob: payload };\n}\n\n/**\n * The Draft Mode read: the same composite entry resolved through Control Plane's preview endpoint\n * with a server-only credential, bypassing all caches. The branch comes from a SIGNED preview\n * context cookie whose HMAC is re-verified here against the broker secret — a tampered cookie fails\n * closed, so a valid session cannot read an unauthorized branch's drafts. The credential never\n * enters browser code, logs, URLs, or props. Uncached, so its sentinels are never persisted.\n */\nasync function readPreviewEntry(\n  config: ContentRuntimeConfig,\n  contentTypeId: string,\n  entryId: string,\n  locale: string,\n): Promise<ContentEntryResult> {\n  const token = process.env[PREVIEW_TOKEN_ENV];\n  if (!token) return { status: 'unavailable', reason: 'preview credential unavailable' };\n  const secret = process.env[PREVIEW_SECRET_ENV];\n  if (!secret) return { status: 'unavailable', reason: 'preview secret unavailable' };\n\n  const store = await cookies();\n  const raw = store.get(PREVIEW_COOKIE)?.value;\n  const claims = raw ? verifyPreviewContext(raw, secret) : null;\n  if (!claims || claims.account !== config.account || claims.storeId !== config.storeId || !claims.branch) {\n    return { status: 'unavailable', reason: 'invalid preview context' };\n  }\n\n  const { account, storeId } = config;\n  const path = [account, storeId, contentTypeId, 'entries', 'preview', entryId].map(encodeURIComponent).join('/');\n  const url = `https://${account}.vtexcommercestable.com.br/api/content-platform/manage/${path}?branchId=${encodeURIComponent(claims.branch)}&locale=${encodeURIComponent(locale)}`;\n  return fetchPreview(url, token);\n}\n\nasync function fetchPreview(url: string, token: string): Promise<ContentEntryResult> {\n  let response: Response;\n  try {\n    response = await fetch(url, {\n      cache: 'no-store',\n      headers: { Authorization: `Bearer ${token}` },\n      signal: AbortSignal.timeout(ENTRY_REQUEST_TIMEOUT_MS),\n    });\n  } catch (error) {\n    return { status: 'unavailable', reason: isTimeoutError(error) ? 'timeout' : 'network error' };\n  }\n  if (response.status === 404) return { status: 'not-found' };\n  if (!response.ok) return { status: 'unavailable', reason: `upstream status ${response.status}` };\n  let payload: unknown;\n  try {\n    payload = await response.json();\n  } catch {\n    return { status: 'invalid', reason: 'response body is not JSON' };\n  }\n  if (!isRecord(payload)) return { status: 'invalid', reason: 'response body is not an object' };\n  return { status: 'found', blob: payload };\n}\n\n/**\n * Verifies a signed preview context cookie (`base64url(claims).base64url(hmac)`) against the broker\n * secret with a constant-time comparison, returning the claims only when the signature holds and the\n * token has not expired — a captured cookie fails closed once past `exp`.\n */\nfunction verifyPreviewContext(raw: string, secret: string): PreviewClaims | null {\n  const [body, signature] = raw.split('.');\n  if (!body || !signature) return null;\n  const expected = createHmac('sha256', secret).update(body).digest('base64url');\n  const given = Buffer.from(signature, 'utf8');\n  const want = Buffer.from(expected, 'utf8');\n  if (given.length !== want.length || !timingSafeEqual(given, want)) return null;\n  try {\n    const claims = JSON.parse(Buffer.from(body, 'base64url').toString('utf8')) as PreviewClaims;\n    if (typeof claims.branch !== 'string' || !Number.isFinite(claims.exp) || Date.now() >= claims.exp) {\n      return null;\n    }\n    return claims;\n  } catch {\n    return null;\n  }\n}\n\nfunction buildDataPlaneUrl(\n  account: string,\n  storeId: string,\n  locale: string,\n  contentTypeId: string,\n  entryId: string,\n): string {\n  const path = [account, storeId, contentTypeId, 'entries', entryId].map(encodeURIComponent).join('/');\n  return `https://${account}.vtexcommercestable.com.br/api/content-platform/data/${path}?locale=${encodeURIComponent(locale)}`;\n}\n\n/** Same origin and `locale` query as `buildDataPlaneUrl`. The slug is one segment: it is not split on `/`. */\nfunction buildDataPlaneSlugUrl(\n  account: string,\n  storeId: string,\n  locale: string,\n  contentTypeId: string,\n  slug: string,\n): string {\n  const path = [account, storeId, contentTypeId, 'entries', 'slug', slug].map(encodeURIComponent).join('/');\n  return `https://${account}.vtexcommercestable.com.br/api/content-platform/data/${path}?locale=${encodeURIComponent(locale)}`;\n}\n\ntype ContentSliceResult =\n  | { status: 'sliced'; content: Record<string, unknown> }\n  | { status: 'omitted'; reason: string };\n\n/**\n * Slices one element's value out of the composite blob by its `element.id` and validates it against\n * that element's per-component model. Omits only this component on a missing key, a non-object\n * value, an unknown model, or a shape violation — keyword constraints are the preflight's job.\n * Failing closed on an unknown model keeps an unvalidated blob from reaching `$content` (which would\n * crash the route as a React child).\n */\nfunction sliceContent(\n  blob: Record<string, unknown>,\n  elementId: string,\n  model: ContentTypeDefinition | undefined,\n): ContentSliceResult {\n  const raw = ownValue(blob, elementId);\n  if (!isRecord(raw)) return { status: 'omitted', reason: 'missing or non-object value' };\n  if (!model) return { status: 'omitted', reason: 'unknown model' };\n\n  const content = projectObject(model.schema.properties, raw);\n  const violation = findShapeViolation(model, content);\n  if (violation !== null) return { status: 'omitted', reason: violation };\n  return { status: 'sliced', content };\n}\n\n/** A closed object shape, at the root or one level down. */\ntype ClosedObjectShape = {\n  required?: readonly string[];\n  properties: Record<string, ContentPropertySchema>;\n};\n\n/**\n * Keeps declared keys only, at every level the vocabulary admits, so the injected value matches the\n * `ContentValue` type the component was compiled against. A value of the wrong shape passes through\n * untouched for the validator below to reject.\n */\nfunction projectObject(\n  properties: Record<string, ContentPropertySchema>,\n  raw: Record<string, unknown>,\n): Record<string, unknown> {\n  const projected: Record<string, unknown> = {};\n  for (const [key, property] of Object.entries(properties)) {\n    const value = ownValue(raw, key);\n    if (value === undefined) continue;\n    if (property.type === 'array') {\n      projected[key] = Array.isArray(value)\n        ? value.map((member) => (isRecord(member) ? projectObject(property.items.properties, member) : member))\n        : value;\n    } else if (property.type === 'object') {\n      projected[key] = isRecord(value) ? projectObject(property.properties, value) : value;\n    } else {\n      projected[key] = value;\n    }\n  }\n  return projected;\n}\n\n/** Shape-level validation only (required presence, primitive type, enum membership), at every level. */\nfunction findShapeViolation(model: ContentTypeDefinition, content: Record<string, unknown>): string | null {\n  return findObjectViolation('', model.schema, content);\n}\n\nfunction findObjectViolation(path: string, shape: ClosedObjectShape, value: Record<string, unknown>): string | null {\n  for (const key of shape.required ?? []) {\n    if (ownValue(value, key) === undefined) return `missing required property \"${joinPath(path, key)}\"`;\n  }\n  for (const [key, property] of Object.entries(shape.properties)) {\n    const member = ownValue(value, key);\n    if (member === undefined) continue;\n    const violation = findPropertyViolation(joinPath(path, key), property, member);\n    if (violation !== null) return violation;\n  }\n  return null;\n}\n\nfunction findPropertyViolation(path: string, property: ContentPropertySchema, value: unknown): string | null {\n  if (property.type === 'array') {\n    if (!Array.isArray(value)) return `property \"${path}\" does not match type \"array\"`;\n    for (const [index, member] of value.entries()) {\n      const itemPath = `${path}[${index}]`;\n      if (!isRecord(member)) return `property \"${itemPath}\" does not match type \"object\"`;\n      const violation = findObjectViolation(itemPath, property.items, member);\n      if (violation !== null) return violation;\n    }\n    // minItems and maxItems are author-time bounds; the read path does not enforce them.\n    return null;\n  }\n  if (property.type === 'object') {\n    if (!isRecord(value)) return `property \"${path}\" does not match type \"object\"`;\n    return findObjectViolation(path, property, value);\n  }\n  if (!matchesScalarType(property.type, value)) return `property \"${path}\" does not match type \"${property.type}\"`;\n  if (property.enum && !property.enum.includes(value as string | number)) {\n    return `property \"${path}\" is not an allowed enum value`;\n  }\n  return null;\n}\n\nfunction joinPath(path: string, key: string): string {\n  return path.length === 0 ? key : `${path}.${key}`;\n}\n\nfunction matchesScalarType(type: 'string' | 'number' | 'integer' | 'boolean', value: unknown): boolean {\n  switch (type) {\n    case 'string':\n      return typeof value === 'string';\n    case 'boolean':\n      return typeof value === 'boolean';\n    case 'number':\n      return typeof value === 'number' && Number.isFinite(value);\n    case 'integer':\n      return typeof value === 'number' && Number.isInteger(value);\n  }\n}\n\ntype LogLevel = 'error' | 'warn' | 'info';\n\n/** The closed vocabulary a log consumer discriminates on. Nothing else is ever emitted. */\ntype ContentEvent =\n  | 'content.read.ok'\n  | 'content.read.stale'\n  | 'content.read.missing'\n  | 'content.read.invalid'\n  | 'content.read.failed'\n  | 'content.elements.omitted'\n  | 'content.retention.skipped';\n\n/** One omitted element, as the aggregate line reports it. `reason` is a path, never a value. */\ntype ElementOmission = { elementId: string; modelId: string; reason: string };\n\n/**\n * Severity as a function of the read's status, and nothing else: `unavailable` means the runtime\n * could not read, which is the on-call signal; `not-found` and `invalid` mean the content is broken\n * while the runtime works. `source` is a payload field, so a preview read that cannot resolve is a\n * failure like any other. `invalid` is reachable from the preview branch only — the published path\n * throws on a bad body, which is why the store covers that case.\n */\nconst READ_EVENTS: Record<ContentEntryResult['status'], { level: LogLevel; event: ContentEvent }> = {\n  found: { level: 'info', event: 'content.read.ok' },\n  'not-found': { level: 'warn', event: 'content.read.missing' },\n  invalid: { level: 'warn', event: 'content.read.invalid' },\n  unavailable: { level: 'error', event: 'content.read.failed' },\n};\n\n/**\n * The one line the status does not decide: the read failed and the stored blob covered it. `warn`\n * because the page rendered, which keeps `error` meaning exactly \"the shopper is seeing holes\". A\n * covered outage never escalates on its own, so alerting on one means filtering this event name.\n */\nconst STALE_READ_EVENT: { level: LogLevel; event: ContentEvent } = { level: 'warn', event: 'content.read.stale' };\n\n/**\n * The runtime's one log line: a constant message plus a payload whose `event` is the sole event\n * discriminator, so rewording prose cannot break a consumer. Nothing here ever carries a content\n * value, a preview token, or the broker secret.\n *\n * `entryId` is high-cardinality and stays log-only. Feeding these events to a metrics pipeline —\n * which no part of this runtime has today — means dropping or hashing it at that boundary; the six\n * event names are the bounded dimension set such a pipeline would inherit.\n */\nfunction logEvent(level: LogLevel, event: ContentEvent, fields: Record<string, unknown>): void {\n  // `event` spreads last so a `fields` key of the same name cannot displace the discriminator every\n  // consumer keys on. `fields` is a `Record<string, unknown>`, so nothing in the types would object.\n  console[level]('[content-runtime]', { ...fields, event });\n}\n\nfunction transientReason(error: unknown): string {\n  if (isTimeoutError(error)) return 'timeout';\n  return error instanceof Error ? error.message : 'network error';\n}\n\n/**\n * The exact UTF-8 byte count of the serialized blob, not the JS string's UTF-16 code-unit count\n * (`.length`). Non-ASCII text — accented Latin, common in Portuguese-language content, at 2 bytes per\n * code unit, or CJK at 3 — makes those two numbers diverge, and a check against `.length` would let a\n * blob past both ceilings while genuinely over them in bytes.\n */\nfunction blobByteLength(blob: Record<string, unknown>): number {\n  return Buffer.byteLength(JSON.stringify(blob), 'utf8');\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\n/** Property check instead of `instanceof`: `AbortSignal.timeout` rejects with a `DOMException`. */\nfunction isTimeoutError(error: unknown): boolean {\n  if (typeof error !== 'object' || error === null) return false;\n  const { name } = error as { name?: unknown };\n  return name === 'TimeoutError' || name === 'AbortError';\n}\n"],"mappings":";;;;;;AAiGA,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCjC,MAAM,0BAA0B;AAChC,MAAM,2BAA2B;;AAGjC,MAAM,oBAAoB;;AAE1B,MAAM,qBAAqB;;AAE3B,MAAM,iBAAiB;;;;;;;;;;AAWvB,SAAgB,qBAAqB,QAA8C;CAiBjF,MAAM,2BAAW,IAAI,IAAqC;CAC1D,IAAI,gBAAgB;;;;;;;CAYpB,SAAS,WAAW,KAAa,MAA+B,QAA4B;EAC1F,MAAM,OAAO,eAAe,IAAI;EAChC,IAAI,OAAO,yBAAyB;GAClC,SAAS,QAAQ,6BAA6B;IAAE,GAAG;IAAQ,OAAO;IAAM,QAAQ;GAAiB,CAAC;GAClG;EACF;EACA,MAAM,WAAW,SAAS,IAAI,GAAG;EACjC,MAAM,eAAe,WAAW,eAAe,QAAQ,IAAI;EAC3D,IAAI,gBAAgB,eAAe,OAAO,0BAA0B;GAClE,SAAS,QAAQ,6BAA6B;IAAE,GAAG;IAAQ,OAAO;IAAM,QAAQ;GAAoB,CAAC;GACrG;EACF;EACA,SAAS,IAAI,KAAK,IAAI;EACtB,iBAAiB,OAAO;CAC1B;;;;;;;;;;;;CAaA,eAAe,cAAc,eAAuB,SAAiB,QAAwC;EAI3G,MAAM,MAAM,GAAG,cAAc,QAAQ,QAAQ,QAAQ;EACrD,IAAI;GACF,MAAM,SAAS,MAAM,mBAAmB,OAAO,SAAS,OAAO,SAAS,QAAQ,eAAe,OAAO;GACtG,IAAI,OAAO,WAAW,SACpB,WAAW,KAAK,OAAO,MAAM;IAAE;IAAe;IAAS;GAAO,CAAC;GAEjE,OAAO,EAAE,OAAO;EAClB,SAAS,OAAO;GACd,MAAM,SAAS,gBAAgB,KAAK;GACpC,MAAM,SAAS,SAAS,IAAI,GAAG;GAE/B,IAAI,WAAW,KAAA,GAAW,OAAO,EAAE,QAAQ;IAAE,QAAQ;IAAe;GAAO,EAAE;GAC7E,OAAO;IAAE,QAAQ;KAAE,QAAQ;KAAS,MAAM;IAAO;IAAG,aAAa;GAAO;EAC1E;CACF;;;;;;CAOA,eAAe,kBAAkB,eAAuB,MAAc,QAA4C;EAEhH,MAAM,MAAM,aAAa,cAAc,QAAQ,KAAK,QAAQ;EAC5D,IAAI;GACF,MAAM,SAAS,MAAM,eAAe,OAAO,SAAS,OAAO,SAAS,QAAQ,eAAe,IAAI;GAC/F,IAAI,OAAO,WAAW,SACpB,WAAW,KAAK,OAAO,MAAM;IAAE;IAAe;IAAM;GAAO,CAAC;GAE9D,OAAO,EAAE,OAAO;EAClB,SAAS,OAAO;GACd,MAAM,SAAS,gBAAgB,KAAK;GACpC,MAAM,SAAS,SAAS,IAAI,GAAG;GAC/B,IAAI,WAAW,KAAA,GAAW,OAAO,EAAE,QAAQ;IAAE,QAAQ;IAAe;GAAO,EAAE;GAC7E,OAAO;IAAE,QAAQ;KAAE,QAAQ;KAAS,MAAM;IAAO;IAAG,aAAa;GAAO;EAC1E;CACF;CAMA,MAAM,OAAO,MAAM,OAAO,eAAuB,SAAiB,WAAgD;EAQhH,MAAM,WAAW;EACjB,MAAM,EAAE,WAAW,UAAU,MAAM,UAAU;EAC7C,IAAI;EACJ,IAAI;EACJ,IAAI,OAGF,SAAS,MAAM,iBAAiB,QAAQ,eAAe,SAAS,MAAM;OAEtE,CAAC,CAAE,QAAQ,eAAgB,MAAM,cAAc,eAAe,SAAS,MAAM;EAG/E,MAAM,QAAQ,gBAAgB,KAAA;EAC9B,MAAM,EAAE,OAAO,UAAU,QAAQ,mBAAmB,YAAY,OAAO;EACvE,MAAM,SACJ,gBAAgB,OAAO,WAAW,iBAAiB,OAAO,WAAW,YAAY,OAAO,SAAS,KAAA;EAMnG,IAAI,EADe,CAAC,SAAS,OAAO,WAAW,WAAW,QAAQ,IAAI,aAAa,eAEjF,SAAS,OAAO,OAAO;GACrB;GACA;GACA;GACA,QAAQ,QAAQ,kBAAkB;GAClC,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;EAC3C,CAAC;EAEH,OAAO;CACT,CAAC;;;;;;;;;;CAWD,eAAe,kBAAkB,EAC/B,eACA,SACA,QACA,YACgD;EAChD,MAAM,SAAS,MAAM,KAAK,eAAe,SAAS,MAAM;EACxD,IAAI,OAAO,WAAW,SAIpB,OAAO,YAAY;EAErB,MAAM,SAAS,YAAY;EAC3B,MAAM,YAAY,OAAO,QAAQ,QAAQ;EACzC,MAAM,YAA+B,CAAC;EACtC,KAAK,MAAM,CAAC,WAAW,YAAY,WAAW;GAC5C,MAAM,QAAQ,aAAa,OAAO,MAAM,WAAW,SAAS,OAAO,cAAc,OAAO,CAAC;GACzF,IAAI,MAAM,WAAW,WAAW;IAE9B,UAAU,KAAK;KAAE;KAAW;KAAS,QAAQ,MAAM;IAAO,CAAC;IAC3D;GACF;GACA,OAAO,aAAa,MAAM;EAC5B;EACA,IAAI,UAAU,SAAS,GAIrB,SAAS,QAAQ,4BAA4B;GAC3C;GACA;GACA;GACA,SAAS,UAAU;GACnB,OAAO,UAAU;GACjB;EACF,CAAC;EAEH,OAAO;CACT;CAMA,MAAM,WAAW,MAAM,OAAO,eAAuB,MAAc,WAA+C;EAChH,MAAM,WAAW;EACjB,MAAM,EAAE,QAAQ,gBAAgB,MAAM,kBAAkB,eAAe,MAAM,MAAM;EACnF,MAAM,QAAQ,gBAAgB,KAAA;EAC9B,MAAM,EAAE,OAAO,UAAU,QAAQ,mBAAmB,YAAY,OAAO;EACvE,MAAM,SAAS,gBAAgB,OAAO,WAAW,gBAAgB,OAAO,SAAS,KAAA;EAEjF,IAAI,EADe,CAAC,SAAS,OAAO,WAAW,WAAW,QAAQ,IAAI,aAAa,eAEjF,SAAS,OAAO,OAAO;GACrB;GACA;GACA;GACA,QAAQ;GACR,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;EAC3C,CAAC;EAEH,OAAO;CACT,CAAC;CAED,eAAe,gBAAgB,EAAE,eAAe,MAAM,UAA2D;EAC/G,OAAO,SAAS,eAAe,MAAM,MAAM;CAC7C;CAEA,OAAO;EAAE;EAAmB;EAAiB;CAAqB;AACpE;;;;;;;AAQA,SAAS,cAA6B;CACpC,OAAO,OAAO,OAAO,IAAI;AAC3B;;;;;;;;;AAUA,SAAS,qBAAqB,EAAE,OAAO,YAAkD;CACvF,OAAO,UAAU,KAAA,IAAY,OAAO;AACtC;;;;;;;;;;;;;;AAeA,eAAe,mBACb,SACA,SACA,QACA,eACA,SAC6B;CAC7B,MAAM,MAAM,kBAAkB,SAAS,SAAS,QAAQ,eAAe,OAAO;CAC9E,MAAM,WAAW,MAAM,MAAM,KAAK,EAAE,QAAQ,YAAY,QAAQ,wBAAwB,EAAE,CAAC;CAE3F,IAAI,SAAS,WAAW,KAAK,OAAO,EAAE,QAAQ,YAAY;CAC1D,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,2BAA2B,SAAS,QAAQ;CAE9E,IAAI;CACJ,IAAI;EACF,UAAU,MAAM,SAAS,KAAK;CAChC,QAAQ;EACN,MAAM,IAAI,MAAM,8BAA8B;CAChD;CACA,IAAI,CAAC,SAAS,OAAO,GAAG,MAAM,IAAI,MAAM,mCAAmC;CAE3E,OAAO;EAAE,QAAQ;EAAS,MAAM;CAAQ;AAC1C;;;;;;;;;AAUA,eAAe,eACb,SACA,SACA,QACA,eACA,MAC4B;CAC5B,MAAM,MAAM,sBAAsB,SAAS,SAAS,QAAQ,eAAe,IAAI;CAC/E,MAAM,WAAW,MAAM,MAAM,KAAK,EAAE,QAAQ,YAAY,QAAQ,wBAAwB,EAAE,CAAC;CAE3F,IAAI,SAAS,WAAW,KAAK,OAAO,EAAE,QAAQ,YAAY;CAC1D,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,2BAA2B,SAAS,QAAQ;CAE9E,IAAI;CACJ,IAAI;EACF,UAAU,MAAM,SAAS,KAAK;CAChC,QAAQ;EACN,MAAM,IAAI,MAAM,8BAA8B;CAChD;CACA,IAAI,CAAC,SAAS,OAAO,GAAG,MAAM,IAAI,MAAM,mCAAmC;CAC3E,IAAI,OAAO,OAAO,SAAS,iBAAiB,GAC1C,OAAO,QAAQ;CAGjB,OAAO;EAAE,QAAQ;EAAS,MAAM;CAAQ;AAC1C;;;;;;;;AASA,eAAe,iBACb,QACA,eACA,SACA,QAC6B;CAC7B,MAAM,QAAQ,QAAQ,IAAI;CAC1B,IAAI,CAAC,OAAO,OAAO;EAAE,QAAQ;EAAe,QAAQ;CAAiC;CACrF,MAAM,SAAS,QAAQ,IAAI;CAC3B,IAAI,CAAC,QAAQ,OAAO;EAAE,QAAQ;EAAe,QAAQ;CAA6B;CAGlF,MAAM,OAAM,MADQ,QAAQ,EAAA,CACV,IAAI,cAAc,CAAC,EAAE;CACvC,MAAM,SAAS,MAAM,qBAAqB,KAAK,MAAM,IAAI;CACzD,IAAI,CAAC,UAAU,OAAO,YAAY,OAAO,WAAW,OAAO,YAAY,OAAO,WAAW,CAAC,OAAO,QAC/F,OAAO;EAAE,QAAQ;EAAe,QAAQ;CAA0B;CAGpE,MAAM,EAAE,SAAS,YAAY;CAG7B,OAAO,aAAa,WADG,QAAQ,yDADlB;EAAC;EAAS;EAAS;EAAe;EAAW;EAAW;CAAO,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAChB,EAAE,YAAY,mBAAmB,OAAO,MAAM,EAAE,UAAU,mBAAmB,MAAM,KACrJ,KAAK;AAChC;AAEA,eAAe,aAAa,KAAa,OAA4C;CACnF,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,MAAM,KAAK;GAC1B,OAAO;GACP,SAAS,EAAE,eAAe,UAAU,QAAQ;GAC5C,QAAQ,YAAY,QAAQ,wBAAwB;EACtD,CAAC;CACH,SAAS,OAAO;EACd,OAAO;GAAE,QAAQ;GAAe,QAAQ,eAAe,KAAK,IAAI,YAAY;EAAgB;CAC9F;CACA,IAAI,SAAS,WAAW,KAAK,OAAO,EAAE,QAAQ,YAAY;CAC1D,IAAI,CAAC,SAAS,IAAI,OAAO;EAAE,QAAQ;EAAe,QAAQ,mBAAmB,SAAS;CAAS;CAC/F,IAAI;CACJ,IAAI;EACF,UAAU,MAAM,SAAS,KAAK;CAChC,QAAQ;EACN,OAAO;GAAE,QAAQ;GAAW,QAAQ;EAA4B;CAClE;CACA,IAAI,CAAC,SAAS,OAAO,GAAG,OAAO;EAAE,QAAQ;EAAW,QAAQ;CAAiC;CAC7F,OAAO;EAAE,QAAQ;EAAS,MAAM;CAAQ;AAC1C;;;;;;AAOA,SAAS,qBAAqB,KAAa,QAAsC;CAC/E,MAAM,CAAC,MAAM,aAAa,IAAI,MAAM,GAAG;CACvC,IAAI,CAAC,QAAQ,CAAC,WAAW,OAAO;CAChC,MAAM,WAAW,WAAW,UAAU,MAAM,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,WAAW;CAC7E,MAAM,QAAQ,OAAO,KAAK,WAAW,MAAM;CAC3C,MAAM,OAAO,OAAO,KAAK,UAAU,MAAM;CACzC,IAAI,MAAM,WAAW,KAAK,UAAU,CAAC,gBAAgB,OAAO,IAAI,GAAG,OAAO;CAC1E,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,OAAO,KAAK,MAAM,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;EACzE,IAAI,OAAO,OAAO,WAAW,YAAY,CAAC,OAAO,SAAS,OAAO,GAAG,KAAK,KAAK,IAAI,KAAK,OAAO,KAC5F,OAAO;EAET,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,kBACP,SACA,SACA,QACA,eACA,SACQ;CAER,OAAO,WAAW,QAAQ,uDADb;EAAC;EAAS;EAAS;EAAe;EAAW;CAAO,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,KAAK,GACZ,EAAE,UAAU,mBAAmB,MAAM;AAC3H;;AAGA,SAAS,sBACP,SACA,SACA,QACA,eACA,MACQ;CAER,OAAO,WAAW,QAAQ,uDADb;EAAC;EAAS;EAAS;EAAe;EAAW;EAAQ;CAAI,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,KAAK,GACjB,EAAE,UAAU,mBAAmB,MAAM;AAC3H;;;;;;;;AAaA,SAAS,aACP,MACA,WACA,OACoB;CACpB,MAAM,MAAM,SAAS,MAAM,SAAS;CACpC,IAAI,CAAC,SAAS,GAAG,GAAG,OAAO;EAAE,QAAQ;EAAW,QAAQ;CAA8B;CACtF,IAAI,CAAC,OAAO,OAAO;EAAE,QAAQ;EAAW,QAAQ;CAAgB;CAEhE,MAAM,UAAU,cAAc,MAAM,OAAO,YAAY,GAAG;CAC1D,MAAM,YAAY,mBAAmB,OAAO,OAAO;CACnD,IAAI,cAAc,MAAM,OAAO;EAAE,QAAQ;EAAW,QAAQ;CAAU;CACtE,OAAO;EAAE,QAAQ;EAAU;CAAQ;AACrC;;;;;;AAaA,SAAS,cACP,YACA,KACyB;CACzB,MAAM,YAAqC,CAAC;CAC5C,KAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,UAAU,GAAG;EACxD,MAAM,QAAQ,SAAS,KAAK,GAAG;EAC/B,IAAI,UAAU,KAAA,GAAW;EACzB,IAAI,SAAS,SAAS,SACpB,UAAU,OAAO,MAAM,QAAQ,KAAK,IAChC,MAAM,KAAK,WAAY,SAAS,MAAM,IAAI,cAAc,SAAS,MAAM,YAAY,MAAM,IAAI,MAAO,IACpG;OACC,IAAI,SAAS,SAAS,UAC3B,UAAU,OAAO,SAAS,KAAK,IAAI,cAAc,SAAS,YAAY,KAAK,IAAI;OAE/E,UAAU,OAAO;CAErB;CACA,OAAO;AACT;;AAGA,SAAS,mBAAmB,OAA8B,SAAiD;CACzG,OAAO,oBAAoB,IAAI,MAAM,QAAQ,OAAO;AACtD;AAEA,SAAS,oBAAoB,MAAc,OAA0B,OAA+C;CAClH,KAAK,MAAM,OAAO,MAAM,YAAY,CAAC,GACnC,IAAI,SAAS,OAAO,GAAG,MAAM,KAAA,GAAW,OAAO,8BAA8B,SAAS,MAAM,GAAG,EAAE;CAEnG,KAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,MAAM,UAAU,GAAG;EAC9D,MAAM,SAAS,SAAS,OAAO,GAAG;EAClC,IAAI,WAAW,KAAA,GAAW;EAC1B,MAAM,YAAY,sBAAsB,SAAS,MAAM,GAAG,GAAG,UAAU,MAAM;EAC7E,IAAI,cAAc,MAAM,OAAO;CACjC;CACA,OAAO;AACT;AAEA,SAAS,sBAAsB,MAAc,UAAiC,OAA+B;CAC3G,IAAI,SAAS,SAAS,SAAS;EAC7B,IAAI,CAAC,MAAM,QAAQ,KAAK,GAAG,OAAO,aAAa,KAAK;EACpD,KAAK,MAAM,CAAC,OAAO,WAAW,MAAM,QAAQ,GAAG;GAC7C,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM;GAClC,IAAI,CAAC,SAAS,MAAM,GAAG,OAAO,aAAa,SAAS;GACpD,MAAM,YAAY,oBAAoB,UAAU,SAAS,OAAO,MAAM;GACtE,IAAI,cAAc,MAAM,OAAO;EACjC;EAEA,OAAO;CACT;CACA,IAAI,SAAS,SAAS,UAAU;EAC9B,IAAI,CAAC,SAAS,KAAK,GAAG,OAAO,aAAa,KAAK;EAC/C,OAAO,oBAAoB,MAAM,UAAU,KAAK;CAClD;CACA,IAAI,CAAC,kBAAkB,SAAS,MAAM,KAAK,GAAG,OAAO,aAAa,KAAK,yBAAyB,SAAS,KAAK;CAC9G,IAAI,SAAS,QAAQ,CAAC,SAAS,KAAK,SAAS,KAAwB,GACnE,OAAO,aAAa,KAAK;CAE3B,OAAO;AACT;AAEA,SAAS,SAAS,MAAc,KAAqB;CACnD,OAAO,KAAK,WAAW,IAAI,MAAM,GAAG,KAAK,GAAG;AAC9C;AAEA,SAAS,kBAAkB,MAAmD,OAAyB;CACrG,QAAQ,MAAR;EACE,KAAK,UACH,OAAO,OAAO,UAAU;EAC1B,KAAK,WACH,OAAO,OAAO,UAAU;EAC1B,KAAK,UACH,OAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;EAC3D,KAAK,WACH,OAAO,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK;CAC9D;AACF;;;;;;;;AAwBA,MAAM,cAA8F;CAClG,OAAO;EAAE,OAAO;EAAQ,OAAO;CAAkB;CACjD,aAAa;EAAE,OAAO;EAAQ,OAAO;CAAuB;CAC5D,SAAS;EAAE,OAAO;EAAQ,OAAO;CAAuB;CACxD,aAAa;EAAE,OAAO;EAAS,OAAO;CAAsB;AAC9D;;;;;;AAOA,MAAM,mBAA6D;CAAE,OAAO;CAAQ,OAAO;AAAqB;;;;;;;;;;AAWhH,SAAS,SAAS,OAAiB,OAAqB,QAAuC;CAG7F,QAAQ,MAAM,CAAC,qBAAqB;EAAE,GAAG;EAAQ;CAAM,CAAC;AAC1D;AAEA,SAAS,gBAAgB,OAAwB;CAC/C,IAAI,eAAe,KAAK,GAAG,OAAO;CAClC,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAClD;;;;;;;AAQA,SAAS,eAAe,MAAuC;CAC7D,OAAO,OAAO,WAAW,KAAK,UAAU,IAAI,GAAG,MAAM;AACvD;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;AAGA,SAAS,eAAe,OAAyB;CAC/C,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,MAAM,EAAE,SAAS;CACjB,OAAO,SAAS,kBAAkB,SAAS;AAC7C"}

package/dist/sdk/data/empty-content-value.js

@@ -0,0 +1,16 @@
+//#region src/sdk/data/empty-content-value.ts
+/**
+* The emptiness rule shared by the SDK helper that binds fragment variables and by the components
+* that pick between a content field and the prop of the same name: `undefined`, `null`, `""`, a
+* whitespace-only string and `[]` mean the merchant left the field unfilled. Trimming only decides
+* emptiness; the value itself is sent and rendered as authored (content-models reference).
+*/
+function isEmptyContentValue(value) {
+	if (value === void 0 || value === null) return true;
+	if (typeof value === "string") return value.trim() === "";
+	return Array.isArray(value) && value.length === 0;
+}
+//#endregion
+export { isEmptyContentValue };
+
+//# sourceMappingURL=empty-content-value.js.map

package/dist/sdk/data/empty-content-value.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"empty-content-value.js","names":[],"sources":["../../../src/sdk/data/empty-content-value.ts"],"sourcesContent":["/**\n * The emptiness rule shared by the SDK helper that binds fragment variables and by the components\n * that pick between a content field and the prop of the same name: `undefined`, `null`, `\"\"`, a\n * whitespace-only string and `[]` mean the merchant left the field unfilled. Trimming only decides\n * emptiness; the value itself is sent and rendered as authored (content-models reference).\n */\nexport function isEmptyContentValue(value: unknown): boolean {\n  if (value === undefined || value === null) return true;\n  if (typeof value === 'string') return value.trim() === '';\n  return Array.isArray(value) && value.length === 0;\n}\n"],"mappings":";;;;;;;AAMA,SAAgB,oBAAoB,OAAyB;CAC3D,IAAI,UAAU,KAAA,KAAa,UAAU,MAAM,OAAO;CAClD,IAAI,OAAO,UAAU,UAAU,OAAO,MAAM,KAAK,MAAM;CACvD,OAAO,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW;AAClD"}

package/dist/sdk/data/failed-fields.js

@@ -0,0 +1,23 @@
+import { CombinedGraphQLErrors } from "@apollo/client/errors";
+//#region src/sdk/data/failed-fields.ts
+/**
+* Response keys of the root fields a section cannot render from a result: `null` in `data` with an
+* error whose `path` starts at them. With no data at all, every root an error's `path` starts at.
+* Imported by both the server fetch and the client root, so it must stay free of either side.
+*/
+function getFailedFields(data, error) {
+	if (!CombinedGraphQLErrors.is(error)) return [];
+	if (data != null && typeof data !== "object") return [];
+	const record = data;
+	const failed = [];
+	for (const { path } of error.errors) {
+		const key = path?.[0];
+		if (typeof key !== "string" || failed.includes(key)) continue;
+		if (record == null || record[key] === null) failed.push(key);
+	}
+	return failed;
+}
+//#endregion
+export { getFailedFields };
+
+//# sourceMappingURL=failed-fields.js.map

package/dist/sdk/data/failed-fields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"failed-fields.js","names":[],"sources":["../../../src/sdk/data/failed-fields.ts"],"sourcesContent":["import type { ErrorLike } from '@apollo/client';\nimport { CombinedGraphQLErrors } from '@apollo/client/errors';\n\n/**\n * Response keys of the root fields a section cannot render from a result: `null` in `data` with an\n * error whose `path` starts at them. With no data at all, every root an error's `path` starts at.\n * Imported by both the server fetch and the client root, so it must stay free of either side.\n */\nexport function getFailedFields(data: unknown, error: ErrorLike | undefined): string[] {\n  if (!CombinedGraphQLErrors.is(error)) return [];\n  if (data != null && typeof data !== 'object') return [];\n  const record = data as Record<string, unknown> | null | undefined;\n  const failed: string[] = [];\n  for (const { path } of error.errors) {\n    const key = path?.[0];\n    if (typeof key !== 'string' || failed.includes(key)) continue;\n    if (record == null || record[key] === null) failed.push(key);\n  }\n  return failed;\n}\n"],"mappings":";;;;;;;AAQA,SAAgB,gBAAgB,MAAe,OAAwC;CACrF,IAAI,CAAC,sBAAsB,GAAG,KAAK,GAAG,OAAO,CAAC;CAC9C,IAAI,QAAQ,QAAQ,OAAO,SAAS,UAAU,OAAO,CAAC;CACtD,MAAM,SAAS;CACf,MAAM,SAAmB,CAAC;CAC1B,KAAK,MAAM,EAAE,UAAU,MAAM,QAAQ;EACnC,MAAM,MAAM,OAAO;EACnB,IAAI,OAAO,QAAQ,YAAY,OAAO,SAAS,GAAG,GAAG;EACrD,IAAI,UAAU,QAAQ,OAAO,SAAS,MAAM,OAAO,KAAK,GAAG;CAC7D;CACA,OAAO;AACT"}

package/dist/sdk/data/hot-data-provider.js

@@ -1,5 +1,6 @@
 "use client";
 import { DataOverrideContext } from "./data-override-context.js";
+import { loggableErrorName } from "../../utils/loggable-error-name.js";
 import { useQuery } from "@apollo/client/react";
 import { useEffect, useRef } from "react";
 import { jsx } from "react/jsx-runtime";
@@ -14,7 +15,7 @@ function HotDataProvider({ query, variables, field, fallbackData, children }) {
 	useEffect(() => {
 		if (error && !errorLoggedRef.current) {
 			errorLoggedRef.current = true;
-			console.error("[HotDataProvider] lazy fetch failed; falling back to composed page data.", error);
+			console.error("[HotDataProvider] lazy fetch failed; falling back to composed page data.", loggableErrorName(error));
 		}
 	}, [error]);
 	let resolved = fallbackData;

package/dist/sdk/data/hot-data-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"hot-data-provider.js","names":[],"sources":["../../../src/sdk/data/hot-data-provider.tsx"],"sourcesContent":["'use client';\n\nimport type { OperationVariables, TypedDocumentNode } from '@apollo/client';\nimport { useQuery } from '@apollo/client/react';\nimport type { ReactNode } from 'react';\nimport { useEffect, useRef } from 'react';\nimport { DataOverrideContext } from './data-override-context.js';\n\nexport type HotDataProviderProps<TData, TVariables extends OperationVariables> = Readonly<{\n  query: TypedDocumentNode<TData, TVariables>;\n  variables: TVariables;\n  /** Top-level field of the fragment to forward as `$data`. */\n  field: string;\n  /**\n   * Server-rendered value from the composed PAGE_QUERY result. It paints the first frame — `useQuery`\n   * issues no request during SSR and the client cache is empty at hydration — and stays on screen on\n   * error or a null payload.\n   */\n  fallbackData: unknown;\n  children: ReactNode;\n}>;\n\nexport function HotDataProvider<TData, TVariables extends OperationVariables>({\n  query,\n  variables,\n  field,\n  fallbackData,\n  children,\n}: HotDataProviderProps<TData, TVariables>): ReactNode {\n  // Non-suspending, so the element never becomes a boundary and the route stays one contiguous\n  // response. `cache-and-network` rather than `cache-first`: on a repeat client-side navigation the\n  // cache is warm and the whole point of a hot field is that it refreshes anyway.\n  const { data, error } = useQuery(query, {\n    variables,\n    errorPolicy: 'all',\n    fetchPolicy: 'cache-and-network',\n  });\n\n  const errorLoggedRef = useRef(false);\n  useEffect(() => {\n    if (error && !errorLoggedRef.current) {\n      errorLoggedRef.current = true;\n      console.error('[HotDataProvider] lazy fetch failed; falling back to composed page data.', error);\n    }\n  }, [error]);\n\n  let resolved: unknown = fallbackData;\n  if (!error && data != null) {\n    const fieldValue = (data as Record<string, unknown>)[field];\n    if (fieldValue != null) {\n      resolved = fieldValue;\n    }\n  }\n\n  return <DataOverrideContext value={resolved}>{children}</DataOverrideContext>;\n}\n"],"mappings":";;;;;;AAsBA,SAAgB,gBAA8D,EAC5E,OACA,WACA,OACA,cACA,YACqD;CAIrD,MAAM,EAAE,MAAM,UAAU,SAAS,OAAO;EACtC;EACA,aAAa;EACb,aAAa;CACf,CAAC;CAED,MAAM,iBAAiB,OAAO,KAAK;CACnC,gBAAgB;EACd,IAAI,SAAS,CAAC,eAAe,SAAS;GACpC,eAAe,UAAU;GACzB,QAAQ,MAAM,4EAA4E,KAAK;EACjG;CACF,GAAG,CAAC,KAAK,CAAC;CAEV,IAAI,WAAoB;CACxB,IAAI,CAAC,SAAS,QAAQ,MAAM;EAC1B,MAAM,aAAc,KAAiC;EACrD,IAAI,cAAc,MAChB,WAAW;CAEf;CAEA,OAAO,oBAAC,qBAAD;EAAqB,OAAO;EAAW;CAA8B,CAAA;AAC9E"}
+{"version":3,"file":"hot-data-provider.js","names":[],"sources":["../../../src/sdk/data/hot-data-provider.tsx"],"sourcesContent":["'use client';\n\nimport type { OperationVariables, TypedDocumentNode } from '@apollo/client';\nimport { useQuery } from '@apollo/client/react';\nimport type { ReactNode } from 'react';\nimport { useEffect, useRef } from 'react';\nimport { loggableErrorName } from '../../utils/loggable-error-name.js';\nimport { DataOverrideContext } from './data-override-context.js';\n\nexport type HotDataProviderProps<TData, TVariables extends OperationVariables> = Readonly<{\n  query: TypedDocumentNode<TData, TVariables>;\n  variables: TVariables;\n  /** Top-level field of the fragment to forward as `$data`. */\n  field: string;\n  /**\n   * Server-rendered value from the composed PAGE_QUERY result. It paints the first frame — `useQuery`\n   * issues no request during SSR and the client cache is empty at hydration — and stays on screen on\n   * error or a null payload.\n   */\n  fallbackData: unknown;\n  children: ReactNode;\n}>;\n\nexport function HotDataProvider<TData, TVariables extends OperationVariables>({\n  query,\n  variables,\n  field,\n  fallbackData,\n  children,\n}: HotDataProviderProps<TData, TVariables>): ReactNode {\n  // Non-suspending, so the element never becomes a boundary and the route stays one contiguous\n  // response. `cache-and-network` rather than `cache-first`: on a repeat client-side navigation the\n  // cache is warm and the whole point of a hot field is that it refreshes anyway.\n  const { data, error } = useQuery(query, {\n    variables,\n    errorPolicy: 'all',\n    fetchPolicy: 'cache-and-network',\n  });\n\n  const errorLoggedRef = useRef(false);\n  useEffect(() => {\n    if (error && !errorLoggedRef.current) {\n      errorLoggedRef.current = true;\n      console.error(\n        '[HotDataProvider] lazy fetch failed; falling back to composed page data.',\n        loggableErrorName(error),\n      );\n    }\n  }, [error]);\n\n  let resolved: unknown = fallbackData;\n  if (!error && data != null) {\n    const fieldValue = (data as Record<string, unknown>)[field];\n    if (fieldValue != null) {\n      resolved = fieldValue;\n    }\n  }\n\n  return <DataOverrideContext value={resolved}>{children}</DataOverrideContext>;\n}\n"],"mappings":";;;;;;;AAuBA,SAAgB,gBAA8D,EAC5E,OACA,WACA,OACA,cACA,YACqD;CAIrD,MAAM,EAAE,MAAM,UAAU,SAAS,OAAO;EACtC;EACA,aAAa;EACb,aAAa;CACf,CAAC;CAED,MAAM,iBAAiB,OAAO,KAAK;CACnC,gBAAgB;EACd,IAAI,SAAS,CAAC,eAAe,SAAS;GACpC,eAAe,UAAU;GACzB,QAAQ,MACN,4EACA,kBAAkB,KAAK,CACzB;EACF;CACF,GAAG,CAAC,KAAK,CAAC;CAEV,IAAI,WAAoB;CACxB,IAAI,CAAC,SAAS,QAAQ,MAAM;EAC1B,MAAM,aAAc,KAAiC;EACrD,IAAI,cAAc,MAChB,WAAW;CAEf;CAEA,OAAO,oBAAC,qBAAD;EAAqB,OAAO;EAAW;CAA8B,CAAA;AAC9E"}

package/dist/sdk/data/index.js

@@ -1,8 +1,8 @@
 import { DataOverrideContext, useDataOverride } from "./data-override-context.js";
-import { HotDataProvider } from "./hot-data-provider.js";
 import { ListItemRefContext, useListItemRef } from "./list-item-ref-context.js";
 import { PageReactiveDataRoot, ReactiveRootContext } from "./page-reactive-data-root.js";
 import "./entity-resolution-context.js";
+import { HotDataProvider } from "./hot-data-provider.js";
 import { MultipleReactiveDataProvider } from "./multiple-reactive-data-provider.js";
 import { ReactiveDataProvider } from "./reactive-data-provider.js";
 import { ReactiveListItemDataProvider } from "./reactive-list-item-data-provider.js";

package/dist/sdk/data/page-reactive-data-root.d.ts

@@ -16,6 +16,12 @@ export type PageReactiveDataRootProps<TData, TVars extends OperationVariables> =
   serverVariables?: TVars;
   /** Server-rendered PAGE_QUERY result. When present and shape-matched, seeded into the cache once. */
   initialData?: TData | null;
+  /**
+   * Root fields that failed on the server. Non-empty: `initialData` is not seeded and the first read
+   * for these `serverVariables` is `network-only`. Read on mount and when `serverVariables` change;
+   * a change to `failedFields` alone, with the same variables, sends nothing.
+   */
+  failedFields?: readonly string[];
   /** Reactive vars whose current values are merged into operation variables at render time. */
   clientVariables?: ClientVariablesMap<TVars>;
   children: ReactNode;
@@ -31,6 +37,8 @@ export type ReactiveRootContextValue<TData = unknown> = Readonly<{
    * Error from the underlying useQuery. With non-null root fields (e.g. `cart: Cart!`), a failed
    * fetch nulls the whole operation's `data` — descendants need this to tell "fetch failed" apart
    * from "entity is legitimately absent" (docs/storefront-core/reference-free-particle-model.md § Read side — data).
+   * A nullable root field that failed on the server reaches here too: the root skips the seed and
+   * asks again, and this carries the browser's error beside the partial data.
    */
   error: ErrorLike | undefined;
   /**
@@ -43,14 +51,28 @@ export type ReactiveRootContextValue<TData = unknown> = Readonly<{
    * Required, not optional, and deliberately so. This flag is the whole of what arms the gate in
    * `useReactiveEntity`, so a provider that omits it disarms the gate silently — measured: a value
    * that `satisfies ReactiveRootContextValue` without it reproduces the corrupting payload byte for
-   * byte on an otherwise-fixed tree, and no test fails. `ReactiveRootContext` is public surface via
-   * `sdk/data/index.ts`, so that provider need not live in this repo. Making it required moves that
-   * failure to compile time.
+   * byte on an otherwise-fixed tree, and no test fails. `ReactiveRootContext` ships through the
+   * package's `./internal/client` entry, so that provider need not live in this repo. Making it
+   * required moves that failure to compile time.
    *
    * A hand-built context value stands in for a root's *output*, not for the reactive runtime, so it
    * declares `false` and its subtree keeps gating on nothing.
    */
   hasRoot: boolean;
+  /**
+   * Re-runs the page query against the network with the root's current variables, the ones its
+   * latest render passed to `useQuery`, so a caller that changes a reactive variable calls it from an
+   * effect, not in the same handler. Sends nothing unless the root's last committed render had every
+   * required variable, nor after the root unmounted. Never rejects: a failure of the read arrives on
+   * `rootQueryData`, `loading`, and `error`, as it does on a first load, a cancelled refetch is
+   * silent, and any other failure is logged by its name and swallowed.
+   *
+   * Optional, unlike `hasRoot`: a provider that omits it only loses the in-place retry, where a
+   * provider that omits `hasRoot` corrupts what `useReactiveEntity` builds. `PageReactiveDataRoot`
+   * always sets it, but a provider built outside this repo may not, and a caller then falls back to
+   * reloading the page.
+   */
+  refetch?: () => Promise<void>;
 }>;
 export declare const ReactiveRootContext: import("react").Context<Readonly<{
   /** Current root query data exposed to descendant `ReactiveDataProvider`s. */
@@ -63,6 +85,8 @@ export declare const ReactiveRootContext: import("react").Context<Readonly<{
    * Error from the underlying useQuery. With non-null root fields (e.g. `cart: Cart!`), a failed
    * fetch nulls the whole operation's `data` — descendants need this to tell "fetch failed" apart
    * from "entity is legitimately absent" (docs/storefront-core/reference-free-particle-model.md § Read side — data).
+   * A nullable root field that failed on the server reaches here too: the root skips the seed and
+   * asks again, and this carries the browser's error beside the partial data.
    */
   error: ErrorLike | undefined;
   /**
@@ -75,15 +99,29 @@ export declare const ReactiveRootContext: import("react").Context<Readonly<{
    * Required, not optional, and deliberately so. This flag is the whole of what arms the gate in
    * `useReactiveEntity`, so a provider that omits it disarms the gate silently — measured: a value
    * that `satisfies ReactiveRootContextValue` without it reproduces the corrupting payload byte for
-   * byte on an otherwise-fixed tree, and no test fails. `ReactiveRootContext` is public surface via
-   * `sdk/data/index.ts`, so that provider need not live in this repo. Making it required moves that
-   * failure to compile time.
+   * byte on an otherwise-fixed tree, and no test fails. `ReactiveRootContext` ships through the
+   * package's `./internal/client` entry, so that provider need not live in this repo. Making it
+   * required moves that failure to compile time.
    *
    * A hand-built context value stands in for a root's *output*, not for the reactive runtime, so it
    * declares `false` and its subtree keeps gating on nothing.
    */
   hasRoot: boolean;
+  /**
+   * Re-runs the page query against the network with the root's current variables, the ones its
+   * latest render passed to `useQuery`, so a caller that changes a reactive variable calls it from an
+   * effect, not in the same handler. Sends nothing unless the root's last committed render had every
+   * required variable, nor after the root unmounted. Never rejects: a failure of the read arrives on
+   * `rootQueryData`, `loading`, and `error`, as it does on a first load, a cancelled refetch is
+   * silent, and any other failure is logged by its name and swallowed.
+   *
+   * Optional, unlike `hasRoot`: a provider that omits it only loses the in-place retry, where a
+   * provider that omits `hasRoot` corrupts what `useReactiveEntity` builds. `PageReactiveDataRoot`
+   * always sets it, but a provider built outside this repo may not, and a caller then falls back to
+   * reloading the page.
+   */
+  refetch?: () => Promise<void>;
 }>>;
-export declare function PageReactiveDataRoot<TData = unknown, TVars extends OperationVariables = OperationVariables>(props: PageReactiveDataRootProps<TData, TVars>): ReactNode;
+export declare function PageReactiveDataRoot<TData = unknown, TVars extends OperationVariables = OperationVariables>({ query, serverVariables, initialData, failedFields, clientVariables, children }: PageReactiveDataRootProps<TData, TVars>): ReactNode;
 //#endregion
 //# sourceMappingURL=page-reactive-data-root.d.ts.map

package/dist/sdk/data/page-reactive-data-root.js

@@ -1,8 +1,11 @@
 "use client";
+import { loggableErrorName } from "../../utils/loggable-error-name.js";
+import { getFailedFields } from "./failed-fields.js";
 import { useApolloClient, useQuery } from "@apollo/client/react";
-import { createContext, useCallback, useEffect, useMemo, useRef, useSyncExternalStore } from "react";
+import { createContext, useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";
 import { jsx } from "react/jsx-runtime";
 import { Kind } from "graphql";
+import { canonicalStringify } from "@apollo/client/utilities";
 //#region src/sdk/data/page-reactive-data-root.tsx
 const REACTIVE_VAR_REGISTRY = {};
 function resolveReactiveVar(value) {
@@ -35,6 +38,16 @@ function getTopLevelFieldNames(query) {
 	for (const sel of op.selectionSet.selections) if (sel.kind === Kind.FIELD) names.add((sel.alias ?? sel.name).value);
 	return names;
 }
+function stillShowsFailure(data, error) {
+	return data == null || getFailedFields(data, error).length > 0;
+}
+function withEntry(errors, key, error) {
+	if (errors.get(key) === error) return errors;
+	const next = new Map(errors);
+	if (error) next.set(key, error);
+	else next.delete(key);
+	return next;
+}
 function shapeMatches(query, data) {
 	if (data == null || typeof data !== "object") return false;
 	const expected = getTopLevelFieldNames(query);
@@ -96,10 +109,25 @@ function useClientVariableValues(clientVariables) {
 	useSyncExternalStore(subscribe, getSnapshot, getSnapshot);
 	return lastSnapshotRef.current?.value ?? {};
 }
-function PageReactiveDataRoot(props) {
-	const { query, serverVariables, initialData, clientVariables, children } = props;
+/**
+* Apollo rejects a refetch that ends with no value, as when the root unmounts mid-flight, with a
+* `DOMException` named `AbortError`, or a plain `Error` of that name where there is no `DOMException`.
+* A property check, since a `DOMException` is not always an `Error` instance (jsdom). The read is
+* guarded because a `.name` getter can throw, and `refetch` must not reject.
+*/
+function isAbort(failure) {
+	if (typeof failure !== "object" || failure === null) return false;
+	try {
+		return failure.name === "AbortError";
+	} catch {
+		return false;
+	}
+}
+function PageReactiveDataRoot({ query, serverVariables, initialData, failedFields, clientVariables, children }) {
 	const client = useApolloClient();
-	const seededRef = useRef(false);
+	const seededKeysRef = useRef(/* @__PURE__ */ new Set());
+	const hasFailedFields = failedFields != null && failedFields.length > 0;
+	const serverVariablesKey = canonicalStringify(serverVariables ?? null);
 	const clientValues = useClientVariableValues(clientVariables);
 	const mergedVariables = {
 		...serverVariables ?? {},
@@ -112,7 +140,8 @@ function PageReactiveDataRoot(props) {
 		return v !== null && v !== void 0;
 	});
 	useEffect(() => {
-		if (seededRef.current) return;
+		if (seededKeysRef.current.has(serverVariablesKey)) return;
+		if (hasFailedFields) return;
 		if (!serverVariables || initialData == null) return;
 		if (!shapeMatches(query, initialData)) return;
 		client.cache.writeQuery({
@@ -120,29 +149,76 @@ function PageReactiveDataRoot(props) {
 			variables: serverVariables,
 			data: initialData
 		});
-		seededRef.current = true;
+		seededKeysRef.current.add(serverVariablesKey);
 	}, [
 		client,
 		query,
 		serverVariables,
-		initialData
+		serverVariablesKey,
+		initialData,
+		hasFailedFields
 	]);
-	const { data, loading, error } = useQuery(query, {
+	const networkReadKeysRef = useRef(/* @__PURE__ */ new Set());
+	const nextFetchPolicy = useCallback((_current, { reason }) => {
+		if (!hasFailedFields) return "cache-first";
+		if (reason === "variables-changed" && !networkReadKeysRef.current.has(serverVariablesKey)) return "network-only";
+		networkReadKeysRef.current.add(serverVariablesKey);
+		return "cache-first";
+	}, [hasFailedFields, serverVariablesKey]);
+	const { data, loading, error, refetch: refetchQuery } = useQuery(query, {
 		variables: mergedVariables,
-		fetchPolicy: "cache-first",
+		fetchPolicy: hasFailedFields ? "network-only" : "cache-first",
+		nextFetchPolicy,
+		errorPolicy: "all",
 		skip: !hasAllRequiredVariables
 	});
+	const variablesKey = canonicalStringify(mergedVariables);
+	const [networkErrors, setNetworkErrors] = useState(() => /* @__PURE__ */ new Map());
+	const storedError = networkErrors.get(variablesKey);
+	const storedErrorApplies = storedError !== void 0 && !loading && stillShowsFailure(data, storedError);
+	useEffect(() => {
+		if (error) setNetworkErrors((errors) => withEntry(errors, variablesKey, error));
+		else if (loading || storedError !== void 0 && !storedErrorApplies) setNetworkErrors((errors) => withEntry(errors, variablesKey, void 0));
+	}, [
+		error,
+		loading,
+		variablesKey,
+		storedError,
+		storedErrorApplies
+	]);
+	const rootError = error ?? (storedErrorApplies ? storedError : void 0);
+	const latestRef = useRef(null);
+	useLayoutEffect(() => {
+		latestRef.current = {
+			refetchQuery,
+			hasAllRequiredVariables
+		};
+	});
+	useLayoutEffect(() => () => {
+		latestRef.current = null;
+	}, []);
+	const refetch = useCallback(async () => {
+		const latest = latestRef.current;
+		if (!latest?.hasAllRequiredVariables) return;
+		try {
+			await latest.refetchQuery();
+		} catch (error_) {
+			if (!isAbort(error_)) console.error("[PageReactiveDataRoot] refetch failed", loggableErrorName(error_));
+		}
+	}, []);
 	const contextValue = useMemo(() => ({
 		rootQueryData: data ?? void 0,
 		loading,
 		hasAllRequiredVariables,
-		error,
-		hasRoot: true
+		error: rootError,
+		hasRoot: true,
+		refetch
 	}), [
 		data,
 		loading,
 		hasAllRequiredVariables,
-		error
+		rootError,
+		refetch
 	]);
 	return /* @__PURE__ */ jsx(ReactiveRootContext.Provider, {
 		value: contextValue,