@withpotter/lib 0.13.0-next.101

package/dist/proxy-allowlist.js

@@ -0,0 +1,153 @@
+const ALLOWED_PATH_PREFIXES = [
+  // Identity checks for payouts (BVN / NIN). Without it the payouts screen's
+  // verification card gets "Invalid API path" from the proxy for every call.
+  "kyc",
+  "admin",
+  "tenants",
+  "accounts",
+  "billing",
+  "content",
+  "products",
+  "services",
+  "packages",
+  "orders",
+  // The live "money moved" stream behind LiveCommerceBridge.
+  "tenant-events",
+  // The cross-rail sales list. Without this the Sales screen 404s at the proxy
+  // before the request ever leaves the dashboard, and the page shows "Invalid
+  // API path" — which reads like the endpoint is missing when it is fine.
+  "commerce",
+  // The cross-rail sales list. Without this the Sales screen 404s at the proxy
+  // before the request ever leaves the dashboard, and the page shows "Invalid
+  // API path" — which reads like the endpoint is missing when it is fine.
+  // Transfer confirm/reject and the bulk variant live under /payments — without
+  // this the merchant's "confirm payment" actions 404 at the proxy.
+  "payments",
+  "bookings",
+  "customers",
+  "members",
+  "calendar",
+  "reviews",
+  "team",
+  "shift-notes",
+  "domains",
+  "settlements",
+  "communications",
+  "connect",
+  "social-sources",
+  "share-links",
+  "crm",
+  "membership",
+  "memberships",
+  "merchant-subscriptions",
+  "onboarding",
+  "money",
+  "analytics",
+  "media",
+  "inquiries",
+  "gallery",
+  // Link in bio performance. The API has served /bio/analytics/summary since
+  // the module shipped; this is the first thing to ask it for.
+  "bio",
+  "resources",
+  "resource-categories",
+  "pages",
+  "behaviors",
+  "collections",
+  "finance",
+  // The business's own hardware — counters, gates, readers. Distinct from
+  // `accounts/me/devices`, which is which browser somebody signed in from.
+  "business-devices",
+  // Drawer sessions. Its own prefix, not a child of business-devices: a
+  // merchant asking whether last night was short is not asking about hardware.
+  "device-shifts",
+  // Machines asked for and not yet owned. A different job from running them.
+  "hardware",
+  // Bands, and the balances they point at.
+  "credentials",
+  "invoices",
+  // Chargebacks. Fifth path caught by proxy-allowlist.test.ts — and the first
+  // one caught before a human hit it, because the disputes lens rendered its
+  // own empty state over a 404 rather than an error, so "no open disputes" and
+  // "the proxy refused to ask" look identical on screen.
+  "disputes",
+  // What the business owes: vendors, bills, and payments recorded against them.
+  "vendors",
+  "bills",
+  "digital-files",
+  "media",
+  "loyalty",
+  // The opt-out list lives at /marketing/suppressions. Without this the Opt-outs
+  // screen gets "Invalid API path" from the proxy, and because an empty list
+  // is a legitimate state it would read as "nobody has opted out".
+  "marketing",
+  "discounts",
+  "giftcards",
+  "referrals",
+  "merchant-referrals",
+  // Box's own: one business bringing another.
+  "waitlist",
+  "shipping",
+  // A shop's own riders (the Delivery page and an order's rider step), and
+  // several orders to one rider at once (POST /deliveries/assign).
+  "riders",
+  "deliveries",
+  "odoo",
+  "locations",
+  // Places the business operates from. Distinct from 'locations' above, the
+  // served country/state/city catalogue. Missing here meant every locations
+  // screen and the shell's branch switcher got a 404 through the proxy.
+  "business-locations",
+  // Third path found missing by this test in one day, after business-locations
+  // and wishlist. The allowlist is hand-maintained and adding a client method
+  // does not remind you to touch it, so the test is the only thing standing
+  // between a new endpoint and a silent 404.
+  "proposals",
+  // `GET /wishlist/demand` — what customers asked for and could not buy. Same
+  // omission as business-locations above: the client calls it, the proxy did
+  // not allow it, so it answered 404 "Invalid API path" and the panel was
+  // permanently empty rather than visibly broken.
+  "wishlist",
+  // `POST /potter/ask` — the assistant's answering route. Fourth path this
+  // allowlist would have swallowed: the client method exists, the proxy is
+  // hand-maintained, and a missing prefix answers 404 "Invalid API path" rather
+  // than failing loudly — so the assistant would simply never answer.
+  "potter",
+  "geo",
+  "public",
+  "organizations",
+  "feedback",
+  // The support inbox. Fifth prefix this list would have swallowed: a 404 here
+  // reads on screen as "you have no cases".
+  "service-operations",
+  "calendar-sync",
+  "campaigns",
+  // The promo a merchant runs, as opposed to the message that goes out.
+  "campaign-initiatives",
+  "capabilities",
+  "automations",
+  "abandoned-carts",
+  "blog",
+  "tabs",
+  "templates",
+  // Marketplaces the business sells on — Chowdeck, Glovo. Both the merchant's
+  // own calls and the accept/ready actions on an order live under this one
+  // prefix; without it the channel band on an order screen would render its
+  // empty state over a 404, which is the exact shape the disputes lens shipped.
+  "sales-channels",
+  // The platform back office. Every route under it is guarded by
+  // PlatformAdminGuard on the api side — a merchant token returns 401 there —
+  // so allowing the prefix here opens a door that is still locked.
+  //
+  // Written with // and no apostrophes ON PURPOSE: proxy-allowlist.test.ts
+  // parses this array by stripping line comments and then matching quote
+  // pairs, so a /** */ block or an apostrophe in prose silently drops entries
+  // and the guard reports a failure that is its own fault. Its own comment
+  // says so.
+  "platform-admin",
+  "product-insights"
+];
+export {
+  ALLOWED_PATH_PREFIXES
+};
+//# sourceMappingURL=proxy-allowlist.js.map

package/dist/proxy-allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/proxy-allowlist.ts"],"sourcesContent":["/**\n * Which API path prefixes the dashboard proxy will forward.\n *\n * Hand-maintained, and the reason it lives in its own file: a first path\n * segment that is not here answers 404 \"Invalid API path\" before the request\n * ever reaches potter-api — and nothing else fails. Types pass, lint passes,\n * the endpoint is perfect when curled directly. It breaks only in a browser,\n * and on a list with an empty state it breaks INVISIBLY: the 404 falls through\n * to \"nothing here\", which is pixel-identical to the truth and is a lie.\n *\n * `src/lib/proxy-allowlist.test.ts` compares this list against every literal\n * `apiFetch<...>('/segment')` in `lib/api/*.ts`. Run it whenever you add an api\n * client module; five paths shipped broken before it existed.\n */\nexport const ALLOWED_PATH_PREFIXES = [\n  // Identity checks for payouts (BVN / NIN). Without it the payouts screen's\n  // verification card gets \"Invalid API path\" from the proxy for every call.\n  'kyc',\n  'admin',\n  'tenants',\n  'accounts',\n  'billing',\n  'content',\n  'products',\n  'services',\n  'packages',\n  'orders',\n  // The live \"money moved\" stream behind LiveCommerceBridge.\n  'tenant-events',\n  // The cross-rail sales list. Without this the Sales screen 404s at the proxy\n  // before the request ever leaves the dashboard, and the page shows \"Invalid\n  // API path\" — which reads like the endpoint is missing when it is fine.\n  'commerce',\n  // The cross-rail sales list. Without this the Sales screen 404s at the proxy\n  // before the request ever leaves the dashboard, and the page shows \"Invalid\n  // API path\" — which reads like the endpoint is missing when it is fine.\n  // Transfer confirm/reject and the bulk variant live under /payments — without\n  // this the merchant's \"confirm payment\" actions 404 at the proxy.\n  'payments',\n  'bookings',\n  'customers',\n  'members',\n  'calendar',\n  'reviews',\n  'team',\n  'shift-notes',\n  'domains',\n  'settlements',\n  'communications',\n  'connect',\n  'social-sources',\n  'share-links',\n  'crm',\n  'membership',\n  'memberships',\n  'merchant-subscriptions',\n  'onboarding',\n  'money',\n  'analytics',\n  'media',\n  'inquiries',\n  'gallery',\n  // Link in bio performance. The API has served /bio/analytics/summary since\n  // the module shipped; this is the first thing to ask it for.\n  'bio',\n  'resources',\n  'resource-categories',\n  'pages',\n  'behaviors',\n  'collections',\n  'finance',\n  // The business's own hardware — counters, gates, readers. Distinct from\n  // `accounts/me/devices`, which is which browser somebody signed in from.\n  'business-devices',\n  // Drawer sessions. Its own prefix, not a child of business-devices: a\n  // merchant asking whether last night was short is not asking about hardware.\n  'device-shifts',\n  // Machines asked for and not yet owned. A different job from running them.\n  'hardware',\n  // Bands, and the balances they point at.\n  'credentials',\n  'invoices',\n  // Chargebacks. Fifth path caught by proxy-allowlist.test.ts — and the first\n  // one caught before a human hit it, because the disputes lens rendered its\n  // own empty state over a 404 rather than an error, so \"no open disputes\" and\n  // \"the proxy refused to ask\" look identical on screen.\n  'disputes',\n  // What the business owes: vendors, bills, and payments recorded against them.\n  'vendors',\n  'bills',\n  'digital-files',\n  'media',\n  'loyalty',\n  // The opt-out list lives at /marketing/suppressions. Without this the Opt-outs\n  // screen gets \"Invalid API path\" from the proxy, and because an empty list\n  // is a legitimate state it would read as \"nobody has opted out\".\n  'marketing',\n  'discounts',\n  'giftcards',\n  'referrals',\n  'merchant-referrals', // Box's own: one business bringing another.\n  'waitlist',\n  'shipping',\n  // A shop's own riders (the Delivery page and an order's rider step), and\n  // several orders to one rider at once (POST /deliveries/assign).\n  'riders',\n  'deliveries',\n  'odoo',\n  'locations',\n  // Places the business operates from. Distinct from 'locations' above, the\n  // served country/state/city catalogue. Missing here meant every locations\n  // screen and the shell's branch switcher got a 404 through the proxy.\n  'business-locations',\n  // Third path found missing by this test in one day, after business-locations\n  // and wishlist. The allowlist is hand-maintained and adding a client method\n  // does not remind you to touch it, so the test is the only thing standing\n  // between a new endpoint and a silent 404.\n  'proposals',\n  // `GET /wishlist/demand` — what customers asked for and could not buy. Same\n  // omission as business-locations above: the client calls it, the proxy did\n  // not allow it, so it answered 404 \"Invalid API path\" and the panel was\n  // permanently empty rather than visibly broken.\n  'wishlist',\n  // `POST /potter/ask` — the assistant's answering route. Fourth path this\n  // allowlist would have swallowed: the client method exists, the proxy is\n  // hand-maintained, and a missing prefix answers 404 \"Invalid API path\" rather\n  // than failing loudly — so the assistant would simply never answer.\n  'potter',\n  'geo',\n  'public',\n  'organizations',\n  'feedback',\n  // The support inbox. Fifth prefix this list would have swallowed: a 404 here\n  // reads on screen as \"you have no cases\".\n  'service-operations',\n  'calendar-sync',\n  'campaigns',\n  // The promo a merchant runs, as opposed to the message that goes out.\n  'campaign-initiatives',\n  'capabilities',\n  'automations',\n  'abandoned-carts',\n  'blog',\n  'tabs',\n  'templates',\n  // Marketplaces the business sells on — Chowdeck, Glovo. Both the merchant's\n  // own calls and the accept/ready actions on an order live under this one\n  // prefix; without it the channel band on an order screen would render its\n  // empty state over a 404, which is the exact shape the disputes lens shipped.\n  'sales-channels',\n  // The platform back office. Every route under it is guarded by\n  // PlatformAdminGuard on the api side — a merchant token returns 401 there —\n  // so allowing the prefix here opens a door that is still locked.\n  //\n  // Written with // and no apostrophes ON PURPOSE: proxy-allowlist.test.ts\n  // parses this array by stripping line comments and then matching quote\n  // pairs, so a /** */ block or an apostrophe in prose silently drops entries\n  // and the guard reports a failure that is its own fault. Its own comment\n  // says so.\n  'platform-admin',\n  'product-insights',\n];\n"],"mappings":"AAcO,MAAM,wBAAwB;AAAA;AAAA;AAAA,EAGnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA;AAAA,EACA;AACF;","names":[]}

package/dist/public-config-loader.d.ts

@@ -0,0 +1,27 @@
+import { ReactNode } from 'react';
+/**
+ * Server component that resolves the box's runtime public config and publishes
+ * it to the client.
+ *
+ * It reads the plain (non-`NEXT_PUBLIC_`) `STOREFRONT_DOMAIN` runtime env — set
+ * on the console container by `box deploy` from `box.yml` — at render time, so
+ * the per-box value is NOT inlined at `next build` and a single generic image
+ * serves every box. Wrap the console shell's root layout with it:
+ *
+ * ```tsx
+ * <PublicConfigLoader>{children}</PublicConfigLoader>
+ * ```
+ *
+ * The `await connection()` call opts this subtree out of static prerendering so
+ * the env is read at REQUEST time, not at `next build`. Without it, Next bakes
+ * the build-stage value (empty on Railway, where the ENV lives only in the
+ * runtime image stage) into the prerendered HTML and the runtime env is never
+ * consulted — the storefront preview then falls back to `NEXT_PUBLIC_WEB_URL`.
+ *
+ * When `STOREFRONT_DOMAIN` is unset, consumers fall back to the build-time
+ * `NEXT_PUBLIC_STOREFRONT_DOMAIN` (see `runtime-config`), so older shells keep
+ * working during rollout.
+ */
+export declare function PublicConfigLoader({ children }: {
+    children: ReactNode;
+}): Promise<import("react").JSX.Element>;

package/dist/public-config-loader.js

@@ -0,0 +1,12 @@
+import { jsx } from "react/jsx-runtime";
+import { connection } from "next/server";
+import { PublicConfigProvider } from "./public-config-provider";
+async function PublicConfigLoader({ children }) {
+  await connection();
+  const storefrontDomain = process.env.STOREFRONT_DOMAIN?.trim() || null;
+  return /* @__PURE__ */ jsx(PublicConfigProvider, { config: { storefrontDomain }, children });
+}
+export {
+  PublicConfigLoader
+};
+//# sourceMappingURL=public-config-loader.js.map

package/dist/public-config-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/public-config-loader.tsx"],"sourcesContent":["import { ReactNode } from 'react';\nimport { connection } from 'next/server';\nimport { PublicConfigProvider } from './public-config-provider';\n\n/**\n * Server component that resolves the box's runtime public config and publishes\n * it to the client.\n *\n * It reads the plain (non-`NEXT_PUBLIC_`) `STOREFRONT_DOMAIN` runtime env — set\n * on the console container by `box deploy` from `box.yml` — at render time, so\n * the per-box value is NOT inlined at `next build` and a single generic image\n * serves every box. Wrap the console shell's root layout with it:\n *\n * ```tsx\n * <PublicConfigLoader>{children}</PublicConfigLoader>\n * ```\n *\n * The `await connection()` call opts this subtree out of static prerendering so\n * the env is read at REQUEST time, not at `next build`. Without it, Next bakes\n * the build-stage value (empty on Railway, where the ENV lives only in the\n * runtime image stage) into the prerendered HTML and the runtime env is never\n * consulted — the storefront preview then falls back to `NEXT_PUBLIC_WEB_URL`.\n *\n * When `STOREFRONT_DOMAIN` is unset, consumers fall back to the build-time\n * `NEXT_PUBLIC_STOREFRONT_DOMAIN` (see `runtime-config`), so older shells keep\n * working during rollout.\n */\nexport async function PublicConfigLoader({ children }: { children: ReactNode }) {\n  await connection();\n  const storefrontDomain = process.env.STOREFRONT_DOMAIN?.trim() || null;\n  return (\n    <PublicConfigProvider config={{ storefrontDomain }}>\n      {children}\n    </PublicConfigProvider>\n  );\n}\n"],"mappings":"AA+BI;AA9BJ,SAAS,kBAAkB;AAC3B,SAAS,4BAA4B;AAyBrC,eAAsB,mBAAmB,EAAE,SAAS,GAA4B;AAC9E,QAAM,WAAW;AACjB,QAAM,mBAAmB,QAAQ,IAAI,mBAAmB,KAAK,KAAK;AAClE,SACE,oBAAC,wBAAqB,QAAQ,EAAE,iBAAiB,GAC9C,UACH;AAEJ;","names":[]}

package/dist/public-config-provider.d.ts

@@ -0,0 +1,16 @@
+import { ReactNode } from 'react';
+import { type PublicConfig } from './runtime-config';
+/**
+ * Publishes the server-resolved runtime config into the `runtime-config` module
+ * singleton so client helpers (e.g. `resolveStorefrontUrl`) read the per-box
+ * value. `setPublicConfig` runs in the render body, so it executes during both
+ * SSR and client render — populating the singleton before descendants read it
+ * and keeping SSR/hydration output consistent.
+ *
+ * Rendered for you by `PublicConfigLoader`; you normally don't use this
+ * directly.
+ */
+export declare function PublicConfigProvider({ config, children, }: {
+    config: PublicConfig;
+    children: ReactNode;
+}): import("react").JSX.Element;

package/dist/public-config-provider.js

@@ -0,0 +1,14 @@
+"use client";
+import { Fragment, jsx } from "react/jsx-runtime";
+import { setPublicConfig } from "./runtime-config";
+function PublicConfigProvider({
+  config,
+  children
+}) {
+  setPublicConfig(config);
+  return /* @__PURE__ */ jsx(Fragment, { children });
+}
+export {
+  PublicConfigProvider
+};
+//# sourceMappingURL=public-config-provider.js.map

package/dist/public-config-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/public-config-provider.tsx"],"sourcesContent":["'use client';\n\nimport { ReactNode } from 'react';\nimport { setPublicConfig, type PublicConfig } from './runtime-config';\n\n/**\n * Publishes the server-resolved runtime config into the `runtime-config` module\n * singleton so client helpers (e.g. `resolveStorefrontUrl`) read the per-box\n * value. `setPublicConfig` runs in the render body, so it executes during both\n * SSR and client render — populating the singleton before descendants read it\n * and keeping SSR/hydration output consistent.\n *\n * Rendered for you by `PublicConfigLoader`; you normally don't use this\n * directly.\n */\nexport function PublicConfigProvider({\n  config,\n  children,\n}: {\n  config: PublicConfig;\n  children: ReactNode;\n}) {\n  setPublicConfig(config);\n  return <>{children}</>;\n}\n"],"mappings":";AAuBS;AApBT,SAAS,uBAA0C;AAY5C,SAAS,qBAAqB;AAAA,EACnC;AAAA,EACA;AACF,GAGG;AACD,kBAAgB,MAAM;AACtB,SAAO,gCAAG,UAAS;AACrB;","names":[]}

package/dist/resolve-enabled-behaviors.d.ts

@@ -0,0 +1,55 @@
+import type { ContentBehavior, TemplateConfig } from './template-types';
+/** The standalone behaviors this tenant has explicitly turned on. */
+export declare function resolveStandaloneBehaviors(tenantSettings: Record<string, unknown> | undefined): ContentBehavior[];
+export declare function resolveBehaviorsFromIntents(intents: string[]): ContentBehavior[];
+/**
+ * What a single model grants on its own — used by Settings → Features to show,
+ * on hover, which capabilities a model is responsible for, and to preview what
+ * adding an unselected one would turn on.
+ */
+export declare function behaviorsForIntent(intentKey: string): ContentBehavior[];
+/**
+ * Per-behavior adjustments layered on top of the business model.
+ *
+ * A key is present ONLY when the merchant has deliberately overruled what their
+ * business model implies — `{ shippable: false }` for a shop that sells over a
+ * counter and never posts anything, `{ downloadable: true }` for a bookings
+ * business that also hands out a workbook. Absent key means "follow the model",
+ * which is why this is a sparse map and not a full behavior list: a stored list
+ * silently freezes, so adding a business model later would grant no new
+ * behaviors. The map only ever records the deltas.
+ */
+export type BehaviorOverrides = Partial<Record<ContentBehavior, boolean>>;
+export declare function readBehaviorOverrides(tenantSettings: Record<string, unknown> | undefined): BehaviorOverrides;
+/**
+ * Applies the merchant's overrides to a base behavior set.
+ *
+ * The result can never be empty. A business with zero behaviors can't transact
+ * at all — every behavior-gated nav item and storefront action disappears — so
+ * the last remaining behavior is a floor, and an override that would clear the
+ * set is ignored rather than honoured.
+ */
+export declare function applyBehaviorOverrides(base: ContentBehavior[], overrides: BehaviorOverrides): ContentBehavior[];
+/**
+ * Resolves which behaviors are enabled for a tenant.
+ *
+ * The business model (`selectedIntents`) is the control; it derives a base set.
+ * `behaviorOverrides` then layers the merchant's deliberate adjustments on top.
+ * Everything below that is fallback for tenants that predate intents.
+ *
+ * Priority:
+ * 1. Intent-derived base + `behaviorOverrides`
+ * 2. Legacy `enabledBehaviors` (tenants with no intents) + overrides
+ * 3. Template-level `behaviors` + overrides
+ * 4. Union of all content type behaviors + overrides
+ * 5. `['sellable']` + overrides
+ */
+export declare function resolveEnabledBehaviors(tenantSettings: Record<string, unknown> | undefined, template: TemplateConfig | null): ContentBehavior[];
+/**
+ * The behaviors the business model implies, BEFORE the merchant's overrides.
+ *
+ * Settings → Features needs both halves to tell the truth: this is what your
+ * model turns on, and this is where you've overruled it. Nothing else should
+ * need the pre-override set — read {@link resolveEnabledBehaviors} instead.
+ */
+export declare function resolveBaseBehaviors(tenantSettings: Record<string, unknown> | undefined, template: TemplateConfig | null): ContentBehavior[];

package/dist/resolve-enabled-behaviors.js

@@ -0,0 +1,134 @@
+const STANDALONE_BEHAVIORS = ["publishable", "showcase"];
+function resolveStandaloneBehaviors(tenantSettings) {
+  const stored = tenantSettings?.enabledBehaviors;
+  if (!Array.isArray(stored)) return [];
+  return STANDALONE_BEHAVIORS.filter((b) => stored.includes(b));
+}
+function resolveProfileBehaviors(tenantSettings) {
+  const operatingModel = tenantSettings?.operatingModel;
+  if (!Array.isArray(operatingModel?.profiles)) return [];
+  return operatingModel.profiles.filter((profile) => profile.enabled !== false).flatMap((profile) => profile.behaviorKeys ?? []);
+}
+function resolveBehaviorsFromIntents(intents) {
+  const behaviors = /* @__PURE__ */ new Set();
+  for (const intent of intents) {
+    switch (intent) {
+      case "sell-products":
+        behaviors.add("sellable");
+        behaviors.add("shippable");
+        break;
+      case "take-bookings":
+        behaviors.add("bookable");
+        break;
+      case "rent-property":
+        behaviors.add("bookable");
+        behaviors.add("rentable");
+        break;
+      case "food-orders":
+        behaviors.add("sellable");
+        behaviors.add("shippable");
+        break;
+      case "dine-in":
+        behaviors.add("sellable");
+        behaviors.add("bookable");
+        break;
+      case "subscriptions":
+        behaviors.add("subscribable");
+        break;
+      case "digital-products":
+        behaviors.add("sellable");
+        behaviors.add("downloadable");
+        break;
+      case "event-tickets":
+        behaviors.add("sellable");
+        behaviors.add("ticketed");
+        break;
+      case "send-invoices":
+        behaviors.add("billable");
+        break;
+      case "capture-leads":
+        behaviors.add("leadCapture");
+        break;
+    }
+  }
+  return [...behaviors];
+}
+function behaviorsForIntent(intentKey) {
+  return resolveBehaviorsFromIntents([intentKey]);
+}
+function readBehaviorOverrides(tenantSettings) {
+  const raw = tenantSettings?.behaviorOverrides;
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return {};
+  const out = {};
+  for (const [key, value] of Object.entries(raw)) {
+    if (typeof value === "boolean") out[key] = value;
+  }
+  return out;
+}
+function applyBehaviorOverrides(base, overrides) {
+  const next = new Set(base);
+  for (const [key, enabled] of Object.entries(overrides)) {
+    if (enabled) next.add(key);
+    else next.delete(key);
+  }
+  if (next.size === 0) return base.length > 0 ? base : ["sellable"];
+  return [...next];
+}
+function resolveEnabledBehaviors(tenantSettings, template) {
+  const overrides = readBehaviorOverrides(tenantSettings);
+  const withOverrides = (base) => applyBehaviorOverrides(base, overrides);
+  const selectedIntents = tenantSettings?.selectedIntents;
+  if (Array.isArray(selectedIntents) && selectedIntents.length > 0) {
+    return withOverrides([
+      ...resolveBehaviorsFromIntents(selectedIntents),
+      ...resolveProfileBehaviors(tenantSettings),
+      ...resolveStandaloneBehaviors(tenantSettings)
+    ]);
+  }
+  const tenantBehaviors = tenantSettings?.enabledBehaviors;
+  if (Array.isArray(tenantBehaviors) && tenantBehaviors.length > 0) {
+    return withOverrides(tenantBehaviors);
+  }
+  if (template?.behaviors && template.behaviors.length > 0) {
+    return withOverrides(template.behaviors);
+  }
+  if (template?.contentTypes) {
+    const behaviors = /* @__PURE__ */ new Set();
+    for (const ct of Object.values(template.contentTypes)) {
+      ct.behaviors?.forEach((b) => behaviors.add(b));
+    }
+    if (behaviors.size > 0) return withOverrides(Array.from(behaviors));
+  }
+  return withOverrides(["sellable"]);
+}
+function resolveBaseBehaviors(tenantSettings, template) {
+  const selectedIntents = tenantSettings?.selectedIntents;
+  if (Array.isArray(selectedIntents) && selectedIntents.length > 0) {
+    return resolveBehaviorsFromIntents(selectedIntents);
+  }
+  const tenantBehaviors = tenantSettings?.enabledBehaviors;
+  if (Array.isArray(tenantBehaviors) && tenantBehaviors.length > 0) {
+    return tenantBehaviors;
+  }
+  if (template?.behaviors && template.behaviors.length > 0) {
+    return template.behaviors;
+  }
+  if (template?.contentTypes) {
+    const behaviors = /* @__PURE__ */ new Set();
+    for (const ct of Object.values(template.contentTypes)) {
+      ct.behaviors?.forEach((b) => behaviors.add(b));
+    }
+    if (behaviors.size > 0) return Array.from(behaviors);
+  }
+  return ["sellable"];
+}
+export {
+  applyBehaviorOverrides,
+  behaviorsForIntent,
+  readBehaviorOverrides,
+  resolveBaseBehaviors,
+  resolveBehaviorsFromIntents,
+  resolveEnabledBehaviors,
+  resolveStandaloneBehaviors
+};
+//# sourceMappingURL=resolve-enabled-behaviors.js.map

package/dist/resolve-enabled-behaviors.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/resolve-enabled-behaviors.ts"],"sourcesContent":["import type { ContentBehavior, TemplateConfig } from './template-types';\n\n/**\n * Behaviors no business model implies, so `resolveBehaviorsFromIntents` can\n * never produce them and the intent-derived path would otherwise wipe them.\n *\n * Whether a business writes (`publishable`) or shows its work (`showcase`) has\n * nothing to do with whether it sells, books or rents. Both stay deliberate\n * opt-ins, read off the tenant's own `enabledBehaviors` and unioned onto\n * whatever the intents imply.\n */\nconst STANDALONE_BEHAVIORS: ContentBehavior[] = ['publishable', 'showcase'];\n\n/** The standalone behaviors this tenant has explicitly turned on. */\nexport function resolveStandaloneBehaviors(\n  tenantSettings: Record<string, unknown> | undefined,\n): ContentBehavior[] {\n  const stored = tenantSettings?.enabledBehaviors;\n  if (!Array.isArray(stored)) return [];\n  return STANDALONE_BEHAVIORS.filter((b) => stored.includes(b));\n}\n\n/**\n * What the merchant's *operating model* turns on, over and above the archetype.\n *\n * `OperatingModelProfile.behaviorKeys` has existed since the operating model\n * did, is persisted through `normalizeProfiles`, and was read by nothing. It is\n * the more honest place for several of these: \"we deliver\" is a fact about how\n * a business operates, not about what it sells — which is why a takeaway that\n * only does pickup currently has to switch `shippable` off by hand after the\n * archetype grants it.\n *\n * Additive on purpose. Intents stay authoritative for what an archetype\n * implies; a profile can only ever turn something else on, so no tenant loses a\n * behaviour by this being read at last.\n */\nfunction resolveProfileBehaviors(\n  tenantSettings: Record<string, unknown> | undefined,\n): ContentBehavior[] {\n  const operatingModel = tenantSettings?.operatingModel as\n    | { profiles?: Array<{ enabled?: boolean; behaviorKeys?: string[] }> }\n    | undefined;\n\n  if (!Array.isArray(operatingModel?.profiles)) return [];\n\n  return operatingModel.profiles\n    .filter((profile) => profile.enabled !== false)\n    .flatMap((profile) => profile.behaviorKeys ?? []) as ContentBehavior[];\n}\n\nexport function resolveBehaviorsFromIntents(\n  intents: string[],\n): ContentBehavior[] {\n  const behaviors = new Set<ContentBehavior>();\n\n  for (const intent of intents) {\n    switch (intent) {\n      case 'sell-products':\n        behaviors.add('sellable');\n        behaviors.add('shippable');\n        break;\n      case 'take-bookings':\n        behaviors.add('bookable');\n        break;\n      case 'rent-property':\n        behaviors.add('bookable');\n        behaviors.add('rentable');\n        break;\n      case 'food-orders':\n        behaviors.add('sellable');\n        // The archetype for food that LEAVES the counter — its operating\n        // profiles are dine-in, walk-in, QR, pickup and delivery, and the\n        // delivery one already says `hideShipping: false`. The storefront\n        // gates its whole delivery-address step on `shippable`, and Shipping\n        // and Service areas are gated on it here, so without it a takeaway\n        // could not say where it delivers, what delivery costs, or collect an\n        // address on its own site. A kitchen that never leaves the building\n        // switches it off in Settings → Features.\n        //\n        // Mirrored by INTENT_BEHAVIORS in potter-api; the two maps are\n        // separate and must move together or provisioning writes one thing\n        // while the dashboard resolves another.\n        behaviors.add('shippable');\n        break;\n      case 'dine-in':\n        // Reserve & Seat: sellable menu + bookable tables (as resources).\n        behaviors.add('sellable');\n        behaviors.add('bookable');\n        break;\n      case 'subscriptions':\n        behaviors.add('subscribable');\n        break;\n      case 'digital-products':\n        behaviors.add('sellable');\n        behaviors.add('downloadable');\n        break;\n      case 'event-tickets':\n        behaviors.add('sellable');\n        behaviors.add('ticketed');\n        break;\n      case 'send-invoices':\n        // Deliver & Quote: billed directly, never checked out of a storefront.\n        behaviors.add('billable');\n        break;\n      case 'capture-leads':\n        // Enquire & Qualify: nothing is bought. The thing that arrives is a\n        // person asking, and the storefront's job is to let them ask well.\n        behaviors.add('leadCapture');\n        break;\n    }\n  }\n\n  return [...behaviors];\n}\n\n/**\n * What a single model grants on its own — used by Settings → Features to show,\n * on hover, which capabilities a model is responsible for, and to preview what\n * adding an unselected one would turn on.\n */\nexport function behaviorsForIntent(intentKey: string): ContentBehavior[] {\n  return resolveBehaviorsFromIntents([intentKey]);\n}\n\n/**\n * Per-behavior adjustments layered on top of the business model.\n *\n * A key is present ONLY when the merchant has deliberately overruled what their\n * business model implies — `{ shippable: false }` for a shop that sells over a\n * counter and never posts anything, `{ downloadable: true }` for a bookings\n * business that also hands out a workbook. Absent key means \"follow the model\",\n * which is why this is a sparse map and not a full behavior list: a stored list\n * silently freezes, so adding a business model later would grant no new\n * behaviors. The map only ever records the deltas.\n */\nexport type BehaviorOverrides = Partial<Record<ContentBehavior, boolean>>;\n\nexport function readBehaviorOverrides(\n  tenantSettings: Record<string, unknown> | undefined,\n): BehaviorOverrides {\n  const raw = tenantSettings?.behaviorOverrides;\n  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return {};\n  const out: BehaviorOverrides = {};\n  for (const [key, value] of Object.entries(raw as Record<string, unknown>)) {\n    if (typeof value === 'boolean') out[key as ContentBehavior] = value;\n  }\n  return out;\n}\n\n/**\n * Applies the merchant's overrides to a base behavior set.\n *\n * The result can never be empty. A business with zero behaviors can't transact\n * at all — every behavior-gated nav item and storefront action disappears — so\n * the last remaining behavior is a floor, and an override that would clear the\n * set is ignored rather than honoured.\n */\nexport function applyBehaviorOverrides(\n  base: ContentBehavior[],\n  overrides: BehaviorOverrides,\n): ContentBehavior[] {\n  const next = new Set(base);\n  for (const [key, enabled] of Object.entries(overrides)) {\n    if (enabled) next.add(key as ContentBehavior);\n    else next.delete(key as ContentBehavior);\n  }\n  if (next.size === 0) return base.length > 0 ? base : ['sellable'];\n  return [...next];\n}\n\n/**\n * Resolves which behaviors are enabled for a tenant.\n *\n * The business model (`selectedIntents`) is the control; it derives a base set.\n * `behaviorOverrides` then layers the merchant's deliberate adjustments on top.\n * Everything below that is fallback for tenants that predate intents.\n *\n * Priority:\n * 1. Intent-derived base + `behaviorOverrides`\n * 2. Legacy `enabledBehaviors` (tenants with no intents) + overrides\n * 3. Template-level `behaviors` + overrides\n * 4. Union of all content type behaviors + overrides\n * 5. `['sellable']` + overrides\n */\nexport function resolveEnabledBehaviors(\n  tenantSettings: Record<string, unknown> | undefined,\n  template: TemplateConfig | null,\n): ContentBehavior[] {\n  const overrides = readBehaviorOverrides(tenantSettings);\n  const withOverrides = (base: ContentBehavior[]) =>\n    applyBehaviorOverrides(base, overrides);\n\n  // 1. Intent selection is authoritative when the merchant has actually picked\n  //    something. An EMPTY array is treated as unset, not as \"this business\n  //    does nothing\": resolveTenantIntentConfigs already falls back to\n  //    default-commerce for the empty case, so honouring empty here produced a\n  //    split state — the commerce nav still rendered while zero behaviors\n  //    resolved, silently stripping every behavior-gated item and leaving the\n  //    storefront with no way to transact. A merchant can reach that state by\n  //    deselecting their last business model in Settings → Features.\n  const selectedIntents = tenantSettings?.selectedIntents;\n  if (Array.isArray(selectedIntents) && selectedIntents.length > 0) {\n    // Overrides stay authoritative: they are applied last, so a switch turned\n    // off in Business model still wins over anything the union puts in.\n    return withOverrides([\n      ...resolveBehaviorsFromIntents(selectedIntents),\n      ...resolveProfileBehaviors(tenantSettings),\n      ...resolveStandaloneBehaviors(tenantSettings),\n    ]);\n  }\n\n  // 2. Legacy tenants that set behaviors directly, before intents existed.\n  const tenantBehaviors = tenantSettings?.enabledBehaviors;\n  if (Array.isArray(tenantBehaviors) && tenantBehaviors.length > 0) {\n    return withOverrides(tenantBehaviors as ContentBehavior[]);\n  }\n\n  // 3. Template declares behaviors — use as defaults\n  if (template?.behaviors && template.behaviors.length > 0) {\n    return withOverrides(template.behaviors);\n  }\n\n  // 4. Collect from template content types\n  if (template?.contentTypes) {\n    const behaviors = new Set<ContentBehavior>();\n    for (const ct of Object.values(template.contentTypes)) {\n      ct.behaviors?.forEach((b) => behaviors.add(b));\n    }\n    if (behaviors.size > 0) return withOverrides(Array.from(behaviors));\n  }\n\n  // 5. Absolute fallback\n  return withOverrides(['sellable']);\n}\n\n/**\n * The behaviors the business model implies, BEFORE the merchant's overrides.\n *\n * Settings → Features needs both halves to tell the truth: this is what your\n * model turns on, and this is where you've overruled it. Nothing else should\n * need the pre-override set — read {@link resolveEnabledBehaviors} instead.\n */\nexport function resolveBaseBehaviors(\n  tenantSettings: Record<string, unknown> | undefined,\n  template: TemplateConfig | null,\n): ContentBehavior[] {\n  const selectedIntents = tenantSettings?.selectedIntents;\n  if (Array.isArray(selectedIntents) && selectedIntents.length > 0) {\n    return resolveBehaviorsFromIntents(selectedIntents);\n  }\n  const tenantBehaviors = tenantSettings?.enabledBehaviors;\n  if (Array.isArray(tenantBehaviors) && tenantBehaviors.length > 0) {\n    return tenantBehaviors as ContentBehavior[];\n  }\n  if (template?.behaviors && template.behaviors.length > 0) {\n    return template.behaviors;\n  }\n  if (template?.contentTypes) {\n    const behaviors = new Set<ContentBehavior>();\n    for (const ct of Object.values(template.contentTypes)) {\n      ct.behaviors?.forEach((b) => behaviors.add(b));\n    }\n    if (behaviors.size > 0) return Array.from(behaviors);\n  }\n  return ['sellable'];\n}\n"],"mappings":"AAWA,MAAM,uBAA0C,CAAC,eAAe,UAAU;AAGnE,SAAS,2BACd,gBACmB;AACnB,QAAM,SAAS,gBAAgB;AAC/B,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO,CAAC;AACpC,SAAO,qBAAqB,OAAO,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAC9D;AAgBA,SAAS,wBACP,gBACmB;AACnB,QAAM,iBAAiB,gBAAgB;AAIvC,MAAI,CAAC,MAAM,QAAQ,gBAAgB,QAAQ,EAAG,QAAO,CAAC;AAEtD,SAAO,eAAe,SACnB,OAAO,CAAC,YAAY,QAAQ,YAAY,KAAK,EAC7C,QAAQ,CAAC,YAAY,QAAQ,gBAAgB,CAAC,CAAC;AACpD;AAEO,SAAS,4BACd,SACmB;AACnB,QAAM,YAAY,oBAAI,IAAqB;AAE3C,aAAW,UAAU,SAAS;AAC5B,YAAQ,QAAQ;AAAA,MACd,KAAK;AACH,kBAAU,IAAI,UAAU;AACxB,kBAAU,IAAI,WAAW;AACzB;AAAA,MACF,KAAK;AACH,kBAAU,IAAI,UAAU;AACxB;AAAA,MACF,KAAK;AACH,kBAAU,IAAI,UAAU;AACxB,kBAAU,IAAI,UAAU;AACxB;AAAA,MACF,KAAK;AACH,kBAAU,IAAI,UAAU;AAaxB,kBAAU,IAAI,WAAW;AACzB;AAAA,MACF,KAAK;AAEH,kBAAU,IAAI,UAAU;AACxB,kBAAU,IAAI,UAAU;AACxB;AAAA,MACF,KAAK;AACH,kBAAU,IAAI,cAAc;AAC5B;AAAA,MACF,KAAK;AACH,kBAAU,IAAI,UAAU;AACxB,kBAAU,IAAI,cAAc;AAC5B;AAAA,MACF,KAAK;AACH,kBAAU,IAAI,UAAU;AACxB,kBAAU,IAAI,UAAU;AACxB;AAAA,MACF,KAAK;AAEH,kBAAU,IAAI,UAAU;AACxB;AAAA,MACF,KAAK;AAGH,kBAAU,IAAI,aAAa;AAC3B;AAAA,IACJ;AAAA,EACF;AAEA,SAAO,CAAC,GAAG,SAAS;AACtB;AAOO,SAAS,mBAAmB,WAAsC;AACvE,SAAO,4BAA4B,CAAC,SAAS,CAAC;AAChD;AAeO,SAAS,sBACd,gBACmB;AACnB,QAAM,MAAM,gBAAgB;AAC5B,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,EAAG,QAAO,CAAC;AACnE,QAAM,MAAyB,CAAC;AAChC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,GAA8B,GAAG;AACzE,QAAI,OAAO,UAAU,UAAW,KAAI,GAAsB,IAAI;AAAA,EAChE;AACA,SAAO;AACT;AAUO,SAAS,uBACd,MACA,WACmB;AACnB,QAAM,OAAO,IAAI,IAAI,IAAI;AACzB,aAAW,CAAC,KAAK,OAAO,KAAK,OAAO,QAAQ,SAAS,GAAG;AACtD,QAAI,QAAS,MAAK,IAAI,GAAsB;AAAA,QACvC,MAAK,OAAO,GAAsB;AAAA,EACzC;AACA,MAAI,KAAK,SAAS,EAAG,QAAO,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU;AAChE,SAAO,CAAC,GAAG,IAAI;AACjB;AAgBO,SAAS,wBACd,gBACA,UACmB;AACnB,QAAM,YAAY,sBAAsB,cAAc;AACtD,QAAM,gBAAgB,CAAC,SACrB,uBAAuB,MAAM,SAAS;AAUxC,QAAM,kBAAkB,gBAAgB;AACxC,MAAI,MAAM,QAAQ,eAAe,KAAK,gBAAgB,SAAS,GAAG;AAGhE,WAAO,cAAc;AAAA,MACnB,GAAG,4BAA4B,eAAe;AAAA,MAC9C,GAAG,wBAAwB,cAAc;AAAA,MACzC,GAAG,2BAA2B,cAAc;AAAA,IAC9C,CAAC;AAAA,EACH;AAGA,QAAM,kBAAkB,gBAAgB;AACxC,MAAI,MAAM,QAAQ,eAAe,KAAK,gBAAgB,SAAS,GAAG;AAChE,WAAO,cAAc,eAAoC;AAAA,EAC3D;AAGA,MAAI,UAAU,aAAa,SAAS,UAAU,SAAS,GAAG;AACxD,WAAO,cAAc,SAAS,SAAS;AAAA,EACzC;AAGA,MAAI,UAAU,cAAc;AAC1B,UAAM,YAAY,oBAAI,IAAqB;AAC3C,eAAW,MAAM,OAAO,OAAO,SAAS,YAAY,GAAG;AACrD,SAAG,WAAW,QAAQ,CAAC,MAAM,UAAU,IAAI,CAAC,CAAC;AAAA,IAC/C;AACA,QAAI,UAAU,OAAO,EAAG,QAAO,cAAc,MAAM,KAAK,SAAS,CAAC;AAAA,EACpE;AAGA,SAAO,cAAc,CAAC,UAAU,CAAC;AACnC;AASO,SAAS,qBACd,gBACA,UACmB;AACnB,QAAM,kBAAkB,gBAAgB;AACxC,MAAI,MAAM,QAAQ,eAAe,KAAK,gBAAgB,SAAS,GAAG;AAChE,WAAO,4BAA4B,eAAe;AAAA,EACpD;AACA,QAAM,kBAAkB,gBAAgB;AACxC,MAAI,MAAM,QAAQ,eAAe,KAAK,gBAAgB,SAAS,GAAG;AAChE,WAAO;AAAA,EACT;AACA,MAAI,UAAU,aAAa,SAAS,UAAU,SAAS,GAAG;AACxD,WAAO,SAAS;AAAA,EAClB;AACA,MAAI,UAAU,cAAc;AAC1B,UAAM,YAAY,oBAAI,IAAqB;AAC3C,eAAW,MAAM,OAAO,OAAO,SAAS,YAAY,GAAG;AACrD,SAAG,WAAW,QAAQ,CAAC,MAAM,UAAU,IAAI,CAAC,CAAC;AAAA,IAC/C;AACA,QAAI,UAAU,OAAO,EAAG,QAAO,MAAM,KAAK,SAAS;AAAA,EACrD;AACA,SAAO,CAAC,UAAU;AACpB;","names":[]}