@wix/web5-core 1.56.0

package/dist/cjs/utils/unifiedMarkdownParser.js

@@ -0,0 +1,44 @@
+"use strict";
+
+var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault");
+exports.__esModule = true;
+exports.parseAstToMarkdown = exports.UnifiedMarkdownParser = void 0;
+exports.parseMarkdownToAst = parseMarkdownToAst;
+var _defineProperty2 = _interopRequireDefault(require("@babel/runtime/helpers/defineProperty"));
+var _unified = require("unified");
+var _remarkParse = _interopRequireDefault(require("remark-parse"));
+var _remarkGfm = _interopRequireDefault(require("remark-gfm"));
+var _mdastUtilToMarkdown = require("mdast-util-to-markdown");
+var _mdastUtilGfm = require("mdast-util-gfm");
+class UnifiedMarkdownParser {
+  constructor() {
+    (0, _defineProperty2.default)(this, "processor", void 0);
+    this.processor = (0, _unified.unified)().use(_remarkParse.default).use(_remarkGfm.default);
+  }
+  parse(markdown) {
+    try {
+      return this.processor.parse(markdown);
+    } catch (error) {
+      console.error('Unified parse error:', error);
+      return {
+        type: 'root',
+        children: []
+      };
+    }
+  }
+}
+exports.UnifiedMarkdownParser = UnifiedMarkdownParser;
+function parseMarkdownToAst(markdown) {
+  const parser = new UnifiedMarkdownParser();
+  return parser.parse(markdown);
+}
+const parseAstToMarkdown = nodes => {
+  return (0, _mdastUtilToMarkdown.toMarkdown)({
+    type: 'root',
+    children: nodes
+  }, {
+    extensions: [(0, _mdastUtilGfm.gfmToMarkdown)()]
+  });
+};
+exports.parseAstToMarkdown = parseAstToMarkdown;
+//# sourceMappingURL=unifiedMarkdownParser.js.map

package/dist/cjs/utils/unifiedMarkdownParser.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_unified","require","_remarkParse","_interopRequireDefault","_remarkGfm","_mdastUtilToMarkdown","_mdastUtilGfm","UnifiedMarkdownParser","constructor","_defineProperty2","default","processor","unified","use","remarkParse","remarkGfm","parse","markdown","error","console","type","children","exports","parseMarkdownToAst","parser","parseAstToMarkdown","nodes","toMarkdown","extensions","gfmToMarkdown"],"sources":["../../../src/utils/unifiedMarkdownParser.ts"],"sourcesContent":["import { unified } from 'unified';\nimport remarkParse from 'remark-parse';\nimport type { Root, Node, RootContent } from 'mdast';\nimport remarkGfm from 'remark-gfm';\nimport { toMarkdown } from 'mdast-util-to-markdown';\nimport { gfmToMarkdown } from 'mdast-util-gfm';\n\nexport class UnifiedMarkdownParser {\n  private processor;\n\n  constructor() {\n    this.processor = unified().use(remarkParse).use(remarkGfm);\n  }\n\n  parse(markdown: string): Root {\n    try {\n      return this.processor.parse(markdown) as Root;\n    } catch (error) {\n      console.error('Unified parse error:', error);\n      return { type: 'root', children: [] };\n    }\n  }\n}\n\nexport function parseMarkdownToAst(markdown: string): Root {\n  const parser = new UnifiedMarkdownParser();\n  return parser.parse(markdown);\n}\n\nexport const parseAstToMarkdown = (nodes: Node[]): string => {\n  return toMarkdown(\n    { type: 'root', children: nodes as RootContent[] },\n    {\n      extensions: [gfmToMarkdown()],\n    },\n  );\n};\n"],"mappings":";;;;;;;AAAA,IAAAA,QAAA,GAAAC,OAAA;AACA,IAAAC,YAAA,GAAAC,sBAAA,CAAAF,OAAA;AAEA,IAAAG,UAAA,GAAAD,sBAAA,CAAAF,OAAA;AACA,IAAAI,oBAAA,GAAAJ,OAAA;AACA,IAAAK,aAAA,GAAAL,OAAA;AAEO,MAAMM,qBAAqB,CAAC;EAGjCC,WAAWA,CAAA,EAAG;IAAA,IAAAC,gBAAA,CAAAC,OAAA;IACZ,IAAI,CAACC,SAAS,GAAG,IAAAC,gBAAO,EAAC,CAAC,CAACC,GAAG,CAACC,oBAAW,CAAC,CAACD,GAAG,CAACE,kBAAS,CAAC;EAC5D;EAEAC,KAAKA,CAACC,QAAgB,EAAQ;IAC5B,IAAI;MACF,OAAO,IAAI,CAACN,SAAS,CAACK,KAAK,CAACC,QAAQ,CAAC;IACvC,CAAC,CAAC,OAAOC,KAAK,EAAE;MACdC,OAAO,CAACD,KAAK,CAAC,sBAAsB,EAAEA,KAAK,CAAC;MAC5C,OAAO;QAAEE,IAAI,EAAE,MAAM;QAAEC,QAAQ,EAAE;MAAG,CAAC;IACvC;EACF;AACF;AAACC,OAAA,CAAAf,qBAAA,GAAAA,qBAAA;AAEM,SAASgB,kBAAkBA,CAACN,QAAgB,EAAQ;EACzD,MAAMO,MAAM,GAAG,IAAIjB,qBAAqB,CAAC,CAAC;EAC1C,OAAOiB,MAAM,CAACR,KAAK,CAACC,QAAQ,CAAC;AAC/B;AAEO,MAAMQ,kBAAkB,GAAIC,KAAa,IAAa;EAC3D,OAAO,IAAAC,+BAAU,EACf;IAAEP,IAAI,EAAE,MAAM;IAAEC,QAAQ,EAAEK;EAAuB,CAAC,EAClD;IACEE,UAAU,EAAE,CAAC,IAAAC,2BAAa,EAAC,CAAC;EAC9B,CACF,CAAC;AACH,CAAC;AAACP,OAAA,CAAAG,kBAAA,GAAAA,kBAAA","ignoreList":[]}

package/dist/cjs/utils/web5LinkValidator.js

@@ -0,0 +1,56 @@
+"use strict";
+
+exports.__esModule = true;
+exports.findInvalidWeb5Links = findInvalidWeb5Links;
+var _entityLinkParser = require("./entityLinkParser");
+const LEGACY_PROTOCOLS = ['entity://', 'image://', 'action://', 'ask://'];
+/**
+ * Walk AST nodes and find link/image URLs that fail validation:
+ *  - `web5://` URLs that don't parse,
+ *  - legacy-protocol URLs (`entity://`, `image://`, etc.),
+ *  - link nodes with a missing or whitespace-only href.
+ */
+function findInvalidWeb5Links(nodes) {
+  const results = [];
+  const seen = new Set();
+  function visit(node) {
+    const url = node.url;
+    if (node.type === 'link' && (typeof url !== 'string' || url.trim() === '')) {
+      // Use a unique key per node since multiple empty hrefs share the same value.
+      const key = `__empty_link__${results.length}`;
+      if (!seen.has(key)) {
+        seen.add(key);
+        results.push({
+          url: url ?? '',
+          nodeType: node.type,
+          reason: 'empty'
+        });
+      }
+    } else if (url && !seen.has(url)) {
+      seen.add(url);
+      if (url.startsWith('web5://') && !(0, _entityLinkParser.parseWeb5Url)(url)) {
+        results.push({
+          url,
+          nodeType: node.type,
+          reason: 'invalid'
+        });
+      } else if (LEGACY_PROTOCOLS.some(p => url.startsWith(p))) {
+        results.push({
+          url,
+          nodeType: node.type,
+          reason: 'legacy'
+        });
+      }
+    }
+    if (node.children) {
+      for (const child of node.children) {
+        visit(child);
+      }
+    }
+  }
+  for (const node of nodes) {
+    visit(node);
+  }
+  return results;
+}
+//# sourceMappingURL=web5LinkValidator.js.map

package/dist/cjs/utils/web5LinkValidator.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_entityLinkParser","require","LEGACY_PROTOCOLS","findInvalidWeb5Links","nodes","results","seen","Set","visit","node","url","type","trim","key","length","has","add","push","nodeType","reason","startsWith","parseWeb5Url","some","p","children","child"],"sources":["../../../src/utils/web5LinkValidator.ts"],"sourcesContent":["import type { RootContent } from 'mdast';\nimport { parseWeb5Url } from './entityLinkParser';\n\nconst LEGACY_PROTOCOLS = ['entity://', 'image://', 'action://', 'ask://'];\n\nexport interface InvalidWeb5Link {\n  url: string;\n  nodeType: string;\n  reason: 'invalid' | 'legacy' | 'empty';\n}\n\n/**\n * Walk AST nodes and find link/image URLs that fail validation:\n *  - `web5://` URLs that don't parse,\n *  - legacy-protocol URLs (`entity://`, `image://`, etc.),\n *  - link nodes with a missing or whitespace-only href.\n */\nexport function findInvalidWeb5Links(nodes: RootContent[]): InvalidWeb5Link[] {\n  const results: InvalidWeb5Link[] = [];\n  const seen = new Set<string>();\n\n  function visit(node: any) {\n    const url: string | undefined = node.url;\n\n    if (\n      node.type === 'link' &&\n      (typeof url !== 'string' || url.trim() === '')\n    ) {\n      // Use a unique key per node since multiple empty hrefs share the same value.\n      const key = `__empty_link__${results.length}`;\n      if (!seen.has(key)) {\n        seen.add(key);\n        results.push({ url: url ?? '', nodeType: node.type, reason: 'empty' });\n      }\n    } else if (url && !seen.has(url)) {\n      seen.add(url);\n\n      if (url.startsWith('web5://') && !parseWeb5Url(url)) {\n        results.push({ url, nodeType: node.type, reason: 'invalid' });\n      } else if (LEGACY_PROTOCOLS.some((p) => url.startsWith(p))) {\n        results.push({ url, nodeType: node.type, reason: 'legacy' });\n      }\n    }\n\n    if (node.children) {\n      for (const child of node.children) {\n        visit(child);\n      }\n    }\n  }\n\n  for (const node of nodes) {\n    visit(node);\n  }\n\n  return results;\n}\n"],"mappings":";;;;AACA,IAAAA,iBAAA,GAAAC,OAAA;AAEA,MAAMC,gBAAgB,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC;AAQzE;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,oBAAoBA,CAACC,KAAoB,EAAqB;EAC5E,MAAMC,OAA0B,GAAG,EAAE;EACrC,MAAMC,IAAI,GAAG,IAAIC,GAAG,CAAS,CAAC;EAE9B,SAASC,KAAKA,CAACC,IAAS,EAAE;IACxB,MAAMC,GAAuB,GAAGD,IAAI,CAACC,GAAG;IAExC,IACED,IAAI,CAACE,IAAI,KAAK,MAAM,KACnB,OAAOD,GAAG,KAAK,QAAQ,IAAIA,GAAG,CAACE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,EAC9C;MACA;MACA,MAAMC,GAAG,GAAG,iBAAiBR,OAAO,CAACS,MAAM,EAAE;MAC7C,IAAI,CAACR,IAAI,CAACS,GAAG,CAACF,GAAG,CAAC,EAAE;QAClBP,IAAI,CAACU,GAAG,CAACH,GAAG,CAAC;QACbR,OAAO,CAACY,IAAI,CAAC;UAAEP,GAAG,EAAEA,GAAG,IAAI,EAAE;UAAEQ,QAAQ,EAAET,IAAI,CAACE,IAAI;UAAEQ,MAAM,EAAE;QAAQ,CAAC,CAAC;MACxE;IACF,CAAC,MAAM,IAAIT,GAAG,IAAI,CAACJ,IAAI,CAACS,GAAG,CAACL,GAAG,CAAC,EAAE;MAChCJ,IAAI,CAACU,GAAG,CAACN,GAAG,CAAC;MAEb,IAAIA,GAAG,CAACU,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,IAAAC,8BAAY,EAACX,GAAG,CAAC,EAAE;QACnDL,OAAO,CAACY,IAAI,CAAC;UAAEP,GAAG;UAAEQ,QAAQ,EAAET,IAAI,CAACE,IAAI;UAAEQ,MAAM,EAAE;QAAU,CAAC,CAAC;MAC/D,CAAC,MAAM,IAAIjB,gBAAgB,CAACoB,IAAI,CAAEC,CAAC,IAAKb,GAAG,CAACU,UAAU,CAACG,CAAC,CAAC,CAAC,EAAE;QAC1DlB,OAAO,CAACY,IAAI,CAAC;UAAEP,GAAG;UAAEQ,QAAQ,EAAET,IAAI,CAACE,IAAI;UAAEQ,MAAM,EAAE;QAAS,CAAC,CAAC;MAC9D;IACF;IAEA,IAAIV,IAAI,CAACe,QAAQ,EAAE;MACjB,KAAK,MAAMC,KAAK,IAAIhB,IAAI,CAACe,QAAQ,EAAE;QACjChB,KAAK,CAACiB,KAAK,CAAC;MACd;IACF;EACF;EAEA,KAAK,MAAMhB,IAAI,IAAIL,KAAK,EAAE;IACxBI,KAAK,CAACC,IAAI,CAAC;EACb;EAEA,OAAOJ,OAAO;AAChB","ignoreList":[]}

package/dist/cjs/utils/web5LinkValidator.test.js

@@ -0,0 +1,115 @@
+"use strict";
+
+var _vitest = require("vitest");
+var _web5LinkValidator = require("./web5LinkValidator");
+function makeImageNode(url) {
+  return {
+    type: 'paragraph',
+    children: [{
+      type: 'image',
+      url,
+      alt: '',
+      title: null
+    }]
+  };
+}
+function makeLinkNode(url) {
+  return {
+    type: 'paragraph',
+    children: [{
+      type: 'link',
+      url,
+      children: [{
+        type: 'text',
+        value: 'link text'
+      }]
+    }]
+  };
+}
+(0, _vitest.describe)('findInvalidWeb5Links', () => {
+  (0, _vitest.it)('returns empty for valid web5:// URLs', () => {
+    const nodes = [makeImageNode('web5://icon/chart'), makeImageNode('web5://image/sales'), makeLinkNode('web5://entity/solution/123'), makeLinkNode('web5://action/doSomething'), makeLinkNode('web5://search/query'), makeLinkNode('web5://ask/question')];
+    (0, _vitest.expect)((0, _web5LinkValidator.findInvalidWeb5Links)(nodes)).toEqual([]);
+  });
+  (0, _vitest.it)('detects invalid web5:// URLs with missing slash', () => {
+    const nodes = [makeImageNode('web5://icon-chart')];
+    const result = (0, _web5LinkValidator.findInvalidWeb5Links)(nodes);
+    (0, _vitest.expect)(result).toEqual([{
+      url: 'web5://icon-chart',
+      nodeType: 'image',
+      reason: 'invalid'
+    }]);
+  });
+  (0, _vitest.it)('detects invalid web5:// URLs with unknown type prefix', () => {
+    const nodes = [makeLinkNode('web5://unknown/something')];
+    const result = (0, _web5LinkValidator.findInvalidWeb5Links)(nodes);
+    (0, _vitest.expect)(result).toEqual([{
+      url: 'web5://unknown/something',
+      nodeType: 'link',
+      reason: 'invalid'
+    }]);
+  });
+  (0, _vitest.it)('detects legacy protocol URLs', () => {
+    const nodes = [makeLinkNode('entity://solution/123'), makeLinkNode('image://photo.png')];
+    const result = (0, _web5LinkValidator.findInvalidWeb5Links)(nodes);
+    (0, _vitest.expect)(result).toHaveLength(2);
+    (0, _vitest.expect)(result[0]).toEqual({
+      url: 'entity://solution/123',
+      nodeType: 'link',
+      reason: 'legacy'
+    });
+    (0, _vitest.expect)(result[1]).toEqual({
+      url: 'image://photo.png',
+      nodeType: 'link',
+      reason: 'legacy'
+    });
+  });
+  (0, _vitest.it)('ignores non-web5 URLs', () => {
+    const nodes = [makeLinkNode('https://example.com'), makeLinkNode('mailto:test@test.com'), makeImageNode('https://cdn.example.com/image.png')];
+    (0, _vitest.expect)((0, _web5LinkValidator.findInvalidWeb5Links)(nodes)).toEqual([]);
+  });
+  (0, _vitest.it)('deduplicates same URL appearing multiple times', () => {
+    const nodes = [makeImageNode('web5://icon-chart'), makeImageNode('web5://icon-chart')];
+    const result = (0, _web5LinkValidator.findInvalidWeb5Links)(nodes);
+    (0, _vitest.expect)(result).toHaveLength(1);
+  });
+  (0, _vitest.it)('handles mixed valid and invalid URLs', () => {
+    const nodes = [makeImageNode('web5://icon/chart'), makeImageNode('web5://icon-chart'), makeLinkNode('web5://entity/solution/123'), makeLinkNode('entity://solution/456')];
+    const result = (0, _web5LinkValidator.findInvalidWeb5Links)(nodes);
+    (0, _vitest.expect)(result).toHaveLength(2);
+    (0, _vitest.expect)(result[0].url).toBe('web5://icon-chart');
+    (0, _vitest.expect)(result[1].url).toBe('entity://solution/456');
+  });
+  (0, _vitest.it)('returns empty for empty input', () => {
+    (0, _vitest.expect)((0, _web5LinkValidator.findInvalidWeb5Links)([])).toEqual([]);
+  });
+  (0, _vitest.it)('detects link nodes with empty href', () => {
+    const nodes = [makeLinkNode('')];
+    const result = (0, _web5LinkValidator.findInvalidWeb5Links)(nodes);
+    (0, _vitest.expect)(result).toEqual([{
+      url: '',
+      nodeType: 'link',
+      reason: 'empty'
+    }]);
+  });
+  (0, _vitest.it)('detects link nodes with whitespace-only href', () => {
+    const nodes = [makeLinkNode('   ')];
+    const result = (0, _web5LinkValidator.findInvalidWeb5Links)(nodes);
+    (0, _vitest.expect)(result).toEqual([{
+      url: '   ',
+      nodeType: 'link',
+      reason: 'empty'
+    }]);
+  });
+  (0, _vitest.it)('reports each empty-href link separately (no dedup by url)', () => {
+    const nodes = [makeLinkNode(''), makeLinkNode('')];
+    const result = (0, _web5LinkValidator.findInvalidWeb5Links)(nodes);
+    (0, _vitest.expect)(result).toHaveLength(2);
+    (0, _vitest.expect)(result.every(r => r.reason === 'empty')).toBe(true);
+  });
+  (0, _vitest.it)('does not flag image nodes with empty url as empty-link', () => {
+    const nodes = [makeImageNode('')];
+    (0, _vitest.expect)((0, _web5LinkValidator.findInvalidWeb5Links)(nodes)).toEqual([]);
+  });
+});
+//# sourceMappingURL=web5LinkValidator.test.js.map

package/dist/cjs/utils/web5LinkValidator.test.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_vitest","require","_web5LinkValidator","makeImageNode","url","type","children","alt","title","makeLinkNode","value","describe","it","nodes","expect","findInvalidWeb5Links","toEqual","result","nodeType","reason","toHaveLength","toBe","every","r"],"sources":["../../../src/utils/web5LinkValidator.test.ts"],"sourcesContent":["import { describe, it, expect } from 'vitest';\nimport { findInvalidWeb5Links } from './web5LinkValidator';\nimport type { RootContent } from 'mdast';\n\nfunction makeImageNode(url: string): RootContent {\n  return {\n    type: 'paragraph',\n    children: [{ type: 'image', url, alt: '', title: null } as any],\n  } as any;\n}\n\nfunction makeLinkNode(url: string): RootContent {\n  return {\n    type: 'paragraph',\n    children: [\n      {\n        type: 'link',\n        url,\n        children: [{ type: 'text', value: 'link text' }],\n      } as any,\n    ],\n  } as any;\n}\n\ndescribe('findInvalidWeb5Links', () => {\n  it('returns empty for valid web5:// URLs', () => {\n    const nodes = [\n      makeImageNode('web5://icon/chart'),\n      makeImageNode('web5://image/sales'),\n      makeLinkNode('web5://entity/solution/123'),\n      makeLinkNode('web5://action/doSomething'),\n      makeLinkNode('web5://search/query'),\n      makeLinkNode('web5://ask/question'),\n    ];\n    expect(findInvalidWeb5Links(nodes)).toEqual([]);\n  });\n\n  it('detects invalid web5:// URLs with missing slash', () => {\n    const nodes = [makeImageNode('web5://icon-chart')];\n    const result = findInvalidWeb5Links(nodes);\n    expect(result).toEqual([\n      { url: 'web5://icon-chart', nodeType: 'image', reason: 'invalid' },\n    ]);\n  });\n\n  it('detects invalid web5:// URLs with unknown type prefix', () => {\n    const nodes = [makeLinkNode('web5://unknown/something')];\n    const result = findInvalidWeb5Links(nodes);\n    expect(result).toEqual([\n      {\n        url: 'web5://unknown/something',\n        nodeType: 'link',\n        reason: 'invalid',\n      },\n    ]);\n  });\n\n  it('detects legacy protocol URLs', () => {\n    const nodes = [\n      makeLinkNode('entity://solution/123'),\n      makeLinkNode('image://photo.png'),\n    ];\n    const result = findInvalidWeb5Links(nodes);\n    expect(result).toHaveLength(2);\n    expect(result[0]).toEqual({\n      url: 'entity://solution/123',\n      nodeType: 'link',\n      reason: 'legacy',\n    });\n    expect(result[1]).toEqual({\n      url: 'image://photo.png',\n      nodeType: 'link',\n      reason: 'legacy',\n    });\n  });\n\n  it('ignores non-web5 URLs', () => {\n    const nodes = [\n      makeLinkNode('https://example.com'),\n      makeLinkNode('mailto:test@test.com'),\n      makeImageNode('https://cdn.example.com/image.png'),\n    ];\n    expect(findInvalidWeb5Links(nodes)).toEqual([]);\n  });\n\n  it('deduplicates same URL appearing multiple times', () => {\n    const nodes = [\n      makeImageNode('web5://icon-chart'),\n      makeImageNode('web5://icon-chart'),\n    ];\n    const result = findInvalidWeb5Links(nodes);\n    expect(result).toHaveLength(1);\n  });\n\n  it('handles mixed valid and invalid URLs', () => {\n    const nodes = [\n      makeImageNode('web5://icon/chart'),\n      makeImageNode('web5://icon-chart'),\n      makeLinkNode('web5://entity/solution/123'),\n      makeLinkNode('entity://solution/456'),\n    ];\n    const result = findInvalidWeb5Links(nodes);\n    expect(result).toHaveLength(2);\n    expect(result[0].url).toBe('web5://icon-chart');\n    expect(result[1].url).toBe('entity://solution/456');\n  });\n\n  it('returns empty for empty input', () => {\n    expect(findInvalidWeb5Links([])).toEqual([]);\n  });\n\n  it('detects link nodes with empty href', () => {\n    const nodes = [makeLinkNode('')];\n    const result = findInvalidWeb5Links(nodes);\n    expect(result).toEqual([{ url: '', nodeType: 'link', reason: 'empty' }]);\n  });\n\n  it('detects link nodes with whitespace-only href', () => {\n    const nodes = [makeLinkNode('   ')];\n    const result = findInvalidWeb5Links(nodes);\n    expect(result).toEqual([{ url: '   ', nodeType: 'link', reason: 'empty' }]);\n  });\n\n  it('reports each empty-href link separately (no dedup by url)', () => {\n    const nodes = [makeLinkNode(''), makeLinkNode('')];\n    const result = findInvalidWeb5Links(nodes);\n    expect(result).toHaveLength(2);\n    expect(result.every((r) => r.reason === 'empty')).toBe(true);\n  });\n\n  it('does not flag image nodes with empty url as empty-link', () => {\n    const nodes = [makeImageNode('')];\n    expect(findInvalidWeb5Links(nodes)).toEqual([]);\n  });\n});\n"],"mappings":";;AAAA,IAAAA,OAAA,GAAAC,OAAA;AACA,IAAAC,kBAAA,GAAAD,OAAA;AAGA,SAASE,aAAaA,CAACC,GAAW,EAAe;EAC/C,OAAO;IACLC,IAAI,EAAE,WAAW;IACjBC,QAAQ,EAAE,CAAC;MAAED,IAAI,EAAE,OAAO;MAAED,GAAG;MAAEG,GAAG,EAAE,EAAE;MAAEC,KAAK,EAAE;IAAK,CAAC;EACzD,CAAC;AACH;AAEA,SAASC,YAAYA,CAACL,GAAW,EAAe;EAC9C,OAAO;IACLC,IAAI,EAAE,WAAW;IACjBC,QAAQ,EAAE,CACR;MACED,IAAI,EAAE,MAAM;MACZD,GAAG;MACHE,QAAQ,EAAE,CAAC;QAAED,IAAI,EAAE,MAAM;QAAEK,KAAK,EAAE;MAAY,CAAC;IACjD,CAAC;EAEL,CAAC;AACH;AAEA,IAAAC,gBAAQ,EAAC,sBAAsB,EAAE,MAAM;EACrC,IAAAC,UAAE,EAAC,sCAAsC,EAAE,MAAM;IAC/C,MAAMC,KAAK,GAAG,CACZV,aAAa,CAAC,mBAAmB,CAAC,EAClCA,aAAa,CAAC,oBAAoB,CAAC,EACnCM,YAAY,CAAC,4BAA4B,CAAC,EAC1CA,YAAY,CAAC,2BAA2B,CAAC,EACzCA,YAAY,CAAC,qBAAqB,CAAC,EACnCA,YAAY,CAAC,qBAAqB,CAAC,CACpC;IACD,IAAAK,cAAM,EAAC,IAAAC,uCAAoB,EAACF,KAAK,CAAC,CAAC,CAACG,OAAO,CAAC,EAAE,CAAC;EACjD,CAAC,CAAC;EAEF,IAAAJ,UAAE,EAAC,iDAAiD,EAAE,MAAM;IAC1D,MAAMC,KAAK,GAAG,CAACV,aAAa,CAAC,mBAAmB,CAAC,CAAC;IAClD,MAAMc,MAAM,GAAG,IAAAF,uCAAoB,EAACF,KAAK,CAAC;IAC1C,IAAAC,cAAM,EAACG,MAAM,CAAC,CAACD,OAAO,CAAC,CACrB;MAAEZ,GAAG,EAAE,mBAAmB;MAAEc,QAAQ,EAAE,OAAO;MAAEC,MAAM,EAAE;IAAU,CAAC,CACnE,CAAC;EACJ,CAAC,CAAC;EAEF,IAAAP,UAAE,EAAC,uDAAuD,EAAE,MAAM;IAChE,MAAMC,KAAK,GAAG,CAACJ,YAAY,CAAC,0BAA0B,CAAC,CAAC;IACxD,MAAMQ,MAAM,GAAG,IAAAF,uCAAoB,EAACF,KAAK,CAAC;IAC1C,IAAAC,cAAM,EAACG,MAAM,CAAC,CAACD,OAAO,CAAC,CACrB;MACEZ,GAAG,EAAE,0BAA0B;MAC/Bc,QAAQ,EAAE,MAAM;MAChBC,MAAM,EAAE;IACV,CAAC,CACF,CAAC;EACJ,CAAC,CAAC;EAEF,IAAAP,UAAE,EAAC,8BAA8B,EAAE,MAAM;IACvC,MAAMC,KAAK,GAAG,CACZJ,YAAY,CAAC,uBAAuB,CAAC,EACrCA,YAAY,CAAC,mBAAmB,CAAC,CAClC;IACD,MAAMQ,MAAM,GAAG,IAAAF,uCAAoB,EAACF,KAAK,CAAC;IAC1C,IAAAC,cAAM,EAACG,MAAM,CAAC,CAACG,YAAY,CAAC,CAAC,CAAC;IAC9B,IAAAN,cAAM,EAACG,MAAM,CAAC,CAAC,CAAC,CAAC,CAACD,OAAO,CAAC;MACxBZ,GAAG,EAAE,uBAAuB;MAC5Bc,QAAQ,EAAE,MAAM;MAChBC,MAAM,EAAE;IACV,CAAC,CAAC;IACF,IAAAL,cAAM,EAACG,MAAM,CAAC,CAAC,CAAC,CAAC,CAACD,OAAO,CAAC;MACxBZ,GAAG,EAAE,mBAAmB;MACxBc,QAAQ,EAAE,MAAM;MAChBC,MAAM,EAAE;IACV,CAAC,CAAC;EACJ,CAAC,CAAC;EAEF,IAAAP,UAAE,EAAC,uBAAuB,EAAE,MAAM;IAChC,MAAMC,KAAK,GAAG,CACZJ,YAAY,CAAC,qBAAqB,CAAC,EACnCA,YAAY,CAAC,sBAAsB,CAAC,EACpCN,aAAa,CAAC,mCAAmC,CAAC,CACnD;IACD,IAAAW,cAAM,EAAC,IAAAC,uCAAoB,EAACF,KAAK,CAAC,CAAC,CAACG,OAAO,CAAC,EAAE,CAAC;EACjD,CAAC,CAAC;EAEF,IAAAJ,UAAE,EAAC,gDAAgD,EAAE,MAAM;IACzD,MAAMC,KAAK,GAAG,CACZV,aAAa,CAAC,mBAAmB,CAAC,EAClCA,aAAa,CAAC,mBAAmB,CAAC,CACnC;IACD,MAAMc,MAAM,GAAG,IAAAF,uCAAoB,EAACF,KAAK,CAAC;IAC1C,IAAAC,cAAM,EAACG,MAAM,CAAC,CAACG,YAAY,CAAC,CAAC,CAAC;EAChC,CAAC,CAAC;EAEF,IAAAR,UAAE,EAAC,sCAAsC,EAAE,MAAM;IAC/C,MAAMC,KAAK,GAAG,CACZV,aAAa,CAAC,mBAAmB,CAAC,EAClCA,aAAa,CAAC,mBAAmB,CAAC,EAClCM,YAAY,CAAC,4BAA4B,CAAC,EAC1CA,YAAY,CAAC,uBAAuB,CAAC,CACtC;IACD,MAAMQ,MAAM,GAAG,IAAAF,uCAAoB,EAACF,KAAK,CAAC;IAC1C,IAAAC,cAAM,EAACG,MAAM,CAAC,CAACG,YAAY,CAAC,CAAC,CAAC;IAC9B,IAAAN,cAAM,EAACG,MAAM,CAAC,CAAC,CAAC,CAACb,GAAG,CAAC,CAACiB,IAAI,CAAC,mBAAmB,CAAC;IAC/C,IAAAP,cAAM,EAACG,MAAM,CAAC,CAAC,CAAC,CAACb,GAAG,CAAC,CAACiB,IAAI,CAAC,uBAAuB,CAAC;EACrD,CAAC,CAAC;EAEF,IAAAT,UAAE,EAAC,+BAA+B,EAAE,MAAM;IACxC,IAAAE,cAAM,EAAC,IAAAC,uCAAoB,EAAC,EAAE,CAAC,CAAC,CAACC,OAAO,CAAC,EAAE,CAAC;EAC9C,CAAC,CAAC;EAEF,IAAAJ,UAAE,EAAC,oCAAoC,EAAE,MAAM;IAC7C,MAAMC,KAAK,GAAG,CAACJ,YAAY,CAAC,EAAE,CAAC,CAAC;IAChC,MAAMQ,MAAM,GAAG,IAAAF,uCAAoB,EAACF,KAAK,CAAC;IAC1C,IAAAC,cAAM,EAACG,MAAM,CAAC,CAACD,OAAO,CAAC,CAAC;MAAEZ,GAAG,EAAE,EAAE;MAAEc,QAAQ,EAAE,MAAM;MAAEC,MAAM,EAAE;IAAQ,CAAC,CAAC,CAAC;EAC1E,CAAC,CAAC;EAEF,IAAAP,UAAE,EAAC,8CAA8C,EAAE,MAAM;IACvD,MAAMC,KAAK,GAAG,CAACJ,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,MAAMQ,MAAM,GAAG,IAAAF,uCAAoB,EAACF,KAAK,CAAC;IAC1C,IAAAC,cAAM,EAACG,MAAM,CAAC,CAACD,OAAO,CAAC,CAAC;MAAEZ,GAAG,EAAE,KAAK;MAAEc,QAAQ,EAAE,MAAM;MAAEC,MAAM,EAAE;IAAQ,CAAC,CAAC,CAAC;EAC7E,CAAC,CAAC;EAEF,IAAAP,UAAE,EAAC,2DAA2D,EAAE,MAAM;IACpE,MAAMC,KAAK,GAAG,CAACJ,YAAY,CAAC,EAAE,CAAC,EAAEA,YAAY,CAAC,EAAE,CAAC,CAAC;IAClD,MAAMQ,MAAM,GAAG,IAAAF,uCAAoB,EAACF,KAAK,CAAC;IAC1C,IAAAC,cAAM,EAACG,MAAM,CAAC,CAACG,YAAY,CAAC,CAAC,CAAC;IAC9B,IAAAN,cAAM,EAACG,MAAM,CAACK,KAAK,CAAEC,CAAC,IAAKA,CAAC,CAACJ,MAAM,KAAK,OAAO,CAAC,CAAC,CAACE,IAAI,CAAC,IAAI,CAAC;EAC9D,CAAC,CAAC;EAEF,IAAAT,UAAE,EAAC,wDAAwD,EAAE,MAAM;IACjE,MAAMC,KAAK,GAAG,CAACV,aAAa,CAAC,EAAE,CAAC,CAAC;IACjC,IAAAW,cAAM,EAAC,IAAAC,uCAAoB,EAACF,KAAK,CAAC,CAAC,CAACG,OAAO,CAAC,EAAE,CAAC;EACjD,CAAC,CAAC;AACJ,CAAC,CAAC","ignoreList":[]}

package/dist/esm/client/clientBundleOverride.js

@@ -0,0 +1,43 @@
+/**
+ * `?clientBundleUrl=…` dev override — shared between `web50-server-ui`
+ * (the main app, DL #094) and `embed-placement` (the Shopify-page widget).
+ *
+ * Both load a `w5-client-*` UMD at runtime; both need the same per-tab
+ * escape hatch for local builds. Centralizing the trusted-host gate here
+ * means a new CDN URL is added in one place and can't drift between the
+ * two callers — divergence on a security boundary would be a real bug.
+ */
+
+const TRUSTED_BUNDLE_HOSTS = new Set(['localhost', 'd13cktzsgh0qls.cloudfront.net']);
+
+/**
+ * Returns true when `url`'s host is one we'll execute as JavaScript on the
+ * caller's page. The boundary is on WHERE the bundle is served from, not on
+ * the page origin — `?clientBundleUrl=` works from any storefront.
+ */
+export function isTrustedBundleHost(url) {
+  try {
+    const {
+      hostname
+    } = new URL(url);
+    return TRUSTED_BUNDLE_HOSTS.has(hostname);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Reads `?clientBundleUrl=…` from a query string and returns it when the
+ * URL points at a trusted host, else `null` (caller falls back to its
+ * normal resolver).
+ *
+ * Examples:
+ *   ?clientBundleUrl=http://localhost:5001/w5-client-feature-com.umd.js
+ *   ?clientBundleUrl=https://d13cktzsgh0qls.cloudfront.net/<msid>/latest/w5-components.umd.js
+ */
+export function getClientBundleOverride(search) {
+  const value = new URLSearchParams(search).get('clientBundleUrl');
+  if (!value || !isTrustedBundleHost(value)) return null;
+  return value;
+}
+//# sourceMappingURL=clientBundleOverride.js.map

package/dist/esm/client/clientBundleOverride.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["TRUSTED_BUNDLE_HOSTS","Set","isTrustedBundleHost","url","hostname","URL","has","getClientBundleOverride","search","value","URLSearchParams","get"],"sources":["../../../src/client/clientBundleOverride.ts"],"sourcesContent":["/**\n * `?clientBundleUrl=…` dev override — shared between `web50-server-ui`\n * (the main app, DL #094) and `embed-placement` (the Shopify-page widget).\n *\n * Both load a `w5-client-*` UMD at runtime; both need the same per-tab\n * escape hatch for local builds. Centralizing the trusted-host gate here\n * means a new CDN URL is added in one place and can't drift between the\n * two callers — divergence on a security boundary would be a real bug.\n */\n\nconst TRUSTED_BUNDLE_HOSTS: ReadonlySet<string> = new Set([\n  'localhost',\n  'd13cktzsgh0qls.cloudfront.net',\n]);\n\n/**\n * Returns true when `url`'s host is one we'll execute as JavaScript on the\n * caller's page. The boundary is on WHERE the bundle is served from, not on\n * the page origin — `?clientBundleUrl=` works from any storefront.\n */\nexport function isTrustedBundleHost(url: string): boolean {\n  try {\n    const { hostname } = new URL(url);\n    return TRUSTED_BUNDLE_HOSTS.has(hostname);\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Reads `?clientBundleUrl=…` from a query string and returns it when the\n * URL points at a trusted host, else `null` (caller falls back to its\n * normal resolver).\n *\n * Examples:\n *   ?clientBundleUrl=http://localhost:5001/w5-client-feature-com.umd.js\n *   ?clientBundleUrl=https://d13cktzsgh0qls.cloudfront.net/<msid>/latest/w5-components.umd.js\n */\nexport function getClientBundleOverride(search: string): string | null {\n  const value = new URLSearchParams(search).get('clientBundleUrl');\n  if (!value || !isTrustedBundleHost(value)) return null;\n  return value;\n}\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,MAAMA,oBAAyC,GAAG,IAAIC,GAAG,CAAC,CACxD,WAAW,EACX,+BAA+B,CAChC,CAAC;;AAEF;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,mBAAmBA,CAACC,GAAW,EAAW;EACxD,IAAI;IACF,MAAM;MAAEC;IAAS,CAAC,GAAG,IAAIC,GAAG,CAACF,GAAG,CAAC;IACjC,OAAOH,oBAAoB,CAACM,GAAG,CAACF,QAAQ,CAAC;EAC3C,CAAC,CAAC,MAAM;IACN,OAAO,KAAK;EACd;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASG,uBAAuBA,CAACC,MAAc,EAAiB;EACrE,MAAMC,KAAK,GAAG,IAAIC,eAAe,CAACF,MAAM,CAAC,CAACG,GAAG,CAAC,iBAAiB,CAAC;EAChE,IAAI,CAACF,KAAK,IAAI,CAACP,mBAAmB,CAACO,KAAK,CAAC,EAAE,OAAO,IAAI;EACtD,OAAOA,KAAK;AACd","ignoreList":[]}

package/dist/esm/client/devEnvironment.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=devEnvironment.js.map

package/dist/esm/client/devEnvironment.js.map

@@ -0,0 +1 @@
+{"version":3,"names":[],"sources":["../../../src/client/devEnvironment.ts"],"sourcesContent":["/**\n * Optional dev-only hook each client package can export to wrap the React\n * root in a host-site-like shell (header / footer / sidebars) so local\n * development looks closer to the customer page the bundle is embedded in.\n *\n * Implementations live behind an `import.meta.env.DEV` guard inside the\n * client package so they tree-shake out of the production UMD.\n */\nexport interface DevEnvironment {\n  /**\n   * Called by `client.tsx` after the bundle loads but before `createRoot`,\n   * in dev mode only. Free to mutate the DOM around `rootElement` (move it,\n   * inject siblings, append <style>/<link>, etc.).\n   *\n   * Return `{ mountElement }` to redirect React to a different node;\n   * otherwise React mounts on the original `rootElement`.\n   */\n  setup(args: { rootElement: HTMLElement }): { mountElement: HTMLElement } | void;\n}\n"],"mappings":"","ignoreList":[]}

package/dist/esm/client/loadClientBundle.js

@@ -0,0 +1,82 @@
+/**
+ * Client bundle loader (DL #088 D3.3, lifted from `web50-server-ui`).
+ *
+ * Injects a client UMD `<script>` tag at the given URL, exposes the running
+ * `web5-core` instance as `window.Web5Core` so the bundle shares React-context
+ * instances with the host, and resolves with whatever the bundle attached to
+ * `window.W5ClientPackage`.
+ *
+ * Generic over the module shape — callers know what their specific bundle
+ * exports, and this primitive intentionally doesn't enforce a schema. The
+ * full app extends with rich `ClientPackageModule` / `ClientPackage` types
+ * locally; placement-style consumers only need `createDefaultRegistry` from
+ * the resolved object.
+ */
+import * as React from 'react';
+import * as ReactDOM from 'react-dom';
+import * as Web5Core from '../index.js';
+const W5_CLIENT_PACKAGE_GLOBAL = 'W5ClientPackage';
+const WEB5_CORE_GLOBAL = 'Web5Core';
+const REACT_GLOBAL = 'React';
+const REACT_DOM_GLOBAL = 'ReactDOM';
+
+/**
+ * Subset of an HTMLScriptElement used by this module. Lets tests substitute a
+ * plain object with `onload` / `onerror` setters rather than spinning up a DOM.
+ */
+
+function defaultInject(src) {
+  const script = document.createElement('script');
+  script.src = src;
+  document.head.appendChild(script);
+  return script;
+}
+
+/**
+ * Inject a client UMD bundle's `<script>` tag, expose the running `web5-core`
+ * instance as `globalThis.Web5Core` for shared React contexts, and resolve
+ * with the module the bundle attached to `globalThis.W5ClientPackage`.
+ *
+ * @param bundleUrl - The CDN URL of the client UMD. Typically comes from
+ *   `Configuration.bundleUrl` (DL #075) or a route-specific override.
+ * @param opts - Optional test hooks for DOM-less environments.
+ */
+export async function loadClientBundle(bundleUrl, opts) {
+  if (opts === void 0) {
+    opts = {};
+  }
+  const global = opts.globalRef ?? globalThis;
+  const inject = opts.injectScript ?? defaultInject;
+
+  // Expose the running web5-core instance so the UMD bundle shares the same
+  // React-context instances instead of creating duplicates inside its own
+  // import scope. Same shared-global trick web50-server-ui has used since DL #056.
+  global[WEB5_CORE_GLOBAL] = Web5Core;
+  // The client UMD lists `react` and `react-dom` as externals (see
+  // packages/web5-core/scripts/vite-cdn-config.ts) and expects `window.React`
+  // and `window.ReactDOM`. embed-placement bundles its own React inside the
+  // widget IIFE — without these assignments the UMD evaluates against
+  // `undefined` and ReactDOM throws on `__SECRET_INTERNALS_DO_NOT_USE_…`.
+  global[REACT_GLOBAL] ??= React;
+  global[REACT_DOM_GLOBAL] ??= ReactDOM;
+
+  // NOTE: client bundles MUST be IIFEs, not UMD — Wix Thunderbolt host pages
+  // ship RequireJS, whose global `define.amd` makes a UMD wrapper register as
+  // an anonymous AMD module instead of assigning `window.W5ClientPackage`
+  // (observed as a blank app on demoweb5cr.com). The format is enforced at
+  // build time by `scripts/vite-cdn-config.ts`; this loader deliberately does
+  // NOT touch `window.define` at runtime.
+  return new Promise((resolve, reject) => {
+    const script = inject(bundleUrl);
+    script.onload = () => {
+      const mod = global[W5_CLIENT_PACKAGE_GLOBAL];
+      if (!mod) {
+        reject(new Error(`[Web5] Bundle at ${bundleUrl} did not expose window.${W5_CLIENT_PACKAGE_GLOBAL}`));
+        return;
+      }
+      resolve(mod);
+    };
+    script.onerror = () => reject(new Error(`[Web5] Failed to load client bundle from ${bundleUrl}`));
+  });
+}
+//# sourceMappingURL=loadClientBundle.js.map

package/dist/esm/client/loadClientBundle.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["React","ReactDOM","Web5Core","W5_CLIENT_PACKAGE_GLOBAL","WEB5_CORE_GLOBAL","REACT_GLOBAL","REACT_DOM_GLOBAL","defaultInject","src","script","document","createElement","head","appendChild","loadClientBundle","bundleUrl","opts","global","globalRef","globalThis","inject","injectScript","Promise","resolve","reject","onload","mod","Error","onerror"],"sources":["../../../src/client/loadClientBundle.ts"],"sourcesContent":["/**\n * Client bundle loader (DL #088 D3.3, lifted from `web50-server-ui`).\n *\n * Injects a client UMD `<script>` tag at the given URL, exposes the running\n * `web5-core` instance as `window.Web5Core` so the bundle shares React-context\n * instances with the host, and resolves with whatever the bundle attached to\n * `window.W5ClientPackage`.\n *\n * Generic over the module shape — callers know what their specific bundle\n * exports, and this primitive intentionally doesn't enforce a schema. The\n * full app extends with rich `ClientPackageModule` / `ClientPackage` types\n * locally; placement-style consumers only need `createDefaultRegistry` from\n * the resolved object.\n */\nimport * as React from 'react';\nimport * as ReactDOM from 'react-dom';\nimport * as Web5Core from '../index';\n\nconst W5_CLIENT_PACKAGE_GLOBAL = 'W5ClientPackage';\nconst WEB5_CORE_GLOBAL = 'Web5Core';\nconst REACT_GLOBAL = 'React';\nconst REACT_DOM_GLOBAL = 'ReactDOM';\n\n/**\n * Subset of an HTMLScriptElement used by this module. Lets tests substitute a\n * plain object with `onload` / `onerror` setters rather than spinning up a DOM.\n */\nexport interface ScriptHandle {\n  onload: ((ev?: unknown) => void) | null;\n  onerror: ((ev?: unknown) => void) | null;\n}\n\ntype ScriptInjector = (src: string) => ScriptHandle;\n\nexport interface LoadClientBundleOptions {\n  /** Test hook — inject the `<script>` via a custom function. */\n  injectScript?: ScriptInjector;\n  /** Test hook — read/write the bundle + core globals on this object instead of `globalThis`. */\n  globalRef?: Record<string, unknown>;\n}\n\nfunction defaultInject(src: string): ScriptHandle {\n  const script = document.createElement('script');\n  script.src = src;\n  document.head.appendChild(script);\n  return script as ScriptHandle;\n}\n\n/**\n * Inject a client UMD bundle's `<script>` tag, expose the running `web5-core`\n * instance as `globalThis.Web5Core` for shared React contexts, and resolve\n * with the module the bundle attached to `globalThis.W5ClientPackage`.\n *\n * @param bundleUrl - The CDN URL of the client UMD. Typically comes from\n *   `Configuration.bundleUrl` (DL #075) or a route-specific override.\n * @param opts - Optional test hooks for DOM-less environments.\n */\nexport async function loadClientBundle<T>(\n  bundleUrl: string,\n  opts: LoadClientBundleOptions = {},\n): Promise<T> {\n  const global = opts.globalRef ?? (globalThis as unknown as Record<string, unknown>);\n  const inject = opts.injectScript ?? defaultInject;\n\n  // Expose the running web5-core instance so the UMD bundle shares the same\n  // React-context instances instead of creating duplicates inside its own\n  // import scope. Same shared-global trick web50-server-ui has used since DL #056.\n  global[WEB5_CORE_GLOBAL] = Web5Core;\n  // The client UMD lists `react` and `react-dom` as externals (see\n  // packages/web5-core/scripts/vite-cdn-config.ts) and expects `window.React`\n  // and `window.ReactDOM`. embed-placement bundles its own React inside the\n  // widget IIFE — without these assignments the UMD evaluates against\n  // `undefined` and ReactDOM throws on `__SECRET_INTERNALS_DO_NOT_USE_…`.\n  global[REACT_GLOBAL] ??= React;\n  global[REACT_DOM_GLOBAL] ??= ReactDOM;\n\n  // NOTE: client bundles MUST be IIFEs, not UMD — Wix Thunderbolt host pages\n  // ship RequireJS, whose global `define.amd` makes a UMD wrapper register as\n  // an anonymous AMD module instead of assigning `window.W5ClientPackage`\n  // (observed as a blank app on demoweb5cr.com). The format is enforced at\n  // build time by `scripts/vite-cdn-config.ts`; this loader deliberately does\n  // NOT touch `window.define` at runtime.\n  return new Promise<T>((resolve, reject) => {\n    const script = inject(bundleUrl);\n    script.onload = () => {\n      const mod = global[W5_CLIENT_PACKAGE_GLOBAL] as T | undefined;\n      if (!mod) {\n        reject(\n          new Error(\n            `[Web5] Bundle at ${bundleUrl} did not expose window.${W5_CLIENT_PACKAGE_GLOBAL}`,\n          ),\n        );\n        return;\n      }\n      resolve(mod);\n    };\n    script.onerror = () =>\n      reject(new Error(`[Web5] Failed to load client bundle from ${bundleUrl}`));\n  });\n}\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,KAAKA,KAAK,MAAM,OAAO;AAC9B,OAAO,KAAKC,QAAQ,MAAM,WAAW;AACrC,OAAO,KAAKC,QAAQ,MAAM,UAAU;AAEpC,MAAMC,wBAAwB,GAAG,iBAAiB;AAClD,MAAMC,gBAAgB,GAAG,UAAU;AACnC,MAAMC,YAAY,GAAG,OAAO;AAC5B,MAAMC,gBAAgB,GAAG,UAAU;;AAEnC;AACA;AACA;AACA;;AAeA,SAASC,aAAaA,CAACC,GAAW,EAAgB;EAChD,MAAMC,MAAM,GAAGC,QAAQ,CAACC,aAAa,CAAC,QAAQ,CAAC;EAC/CF,MAAM,CAACD,GAAG,GAAGA,GAAG;EAChBE,QAAQ,CAACE,IAAI,CAACC,WAAW,CAACJ,MAAM,CAAC;EACjC,OAAOA,MAAM;AACf;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeK,gBAAgBA,CACpCC,SAAiB,EACjBC,IAA6B,EACjB;EAAA,IADZA,IAA6B;IAA7BA,IAA6B,GAAG,CAAC,CAAC;EAAA;EAElC,MAAMC,MAAM,GAAGD,IAAI,CAACE,SAAS,IAAKC,UAAiD;EACnF,MAAMC,MAAM,GAAGJ,IAAI,CAACK,YAAY,IAAId,aAAa;;EAEjD;EACA;EACA;EACAU,MAAM,CAACb,gBAAgB,CAAC,GAAGF,QAAQ;EACnC;EACA;EACA;EACA;EACA;EACAe,MAAM,CAACZ,YAAY,CAAC,KAAKL,KAAK;EAC9BiB,MAAM,CAACX,gBAAgB,CAAC,KAAKL,QAAQ;;EAErC;EACA;EACA;EACA;EACA;EACA;EACA,OAAO,IAAIqB,OAAO,CAAI,CAACC,OAAO,EAAEC,MAAM,KAAK;IACzC,MAAMf,MAAM,GAAGW,MAAM,CAACL,SAAS,CAAC;IAChCN,MAAM,CAACgB,MAAM,GAAG,MAAM;MACpB,MAAMC,GAAG,GAAGT,MAAM,CAACd,wBAAwB,CAAkB;MAC7D,IAAI,CAACuB,GAAG,EAAE;QACRF,MAAM,CACJ,IAAIG,KAAK,CACP,oBAAoBZ,SAAS,0BAA0BZ,wBAAwB,EACjF,CACF,CAAC;QACD;MACF;MACAoB,OAAO,CAACG,GAAG,CAAC;IACd,CAAC;IACDjB,MAAM,CAACmB,OAAO,GAAG,MACfJ,MAAM,CAAC,IAAIG,KAAK,CAAC,4CAA4CZ,SAAS,EAAE,CAAC,CAAC;EAC9E,CAAC,CAAC;AACJ","ignoreList":[]}

package/dist/esm/client/wixAuthFetch.js

@@ -0,0 +1,68 @@
+/**
+ * Wix-authenticated `fetch` for Web5 BE calls from a host (third-party) origin.
+ *
+ * `wixapis.com`'s `/wix-assistant-web5/v1/conversation` endpoint refuses
+ * cross-origin anonymous calls (HTTP 500) — the only auth path that survives
+ * CORS from a host (e.g. Shopify) origin is `@wix/sdk`'s `OAuthStrategy`, which
+ * supplies the `Authorization` header the BE allowlists.
+ *
+ * Shared by every embed bundle that talks to the conversation endpoint — the
+ * placement bundle and the input-widget chip generator — so they all attach
+ * the same token. Token caching uses the same `localStorage` key format
+ * (`web5_tokens_<clientId>`) as `web50-server-ui`'s token cache, so the loader,
+ * full app, placement, and input widget share one OAuth token instead of each
+ * burning a `/oauth2/token` round-trip per page load.
+ */
+import { createClient, OAuthStrategy } from '@wix/sdk';
+const TOKEN_CACHE_KEY_PREFIX = 'web5_tokens_';
+function tokenKey(clientId) {
+  return `${TOKEN_CACHE_KEY_PREFIX}${clientId}`;
+}
+function loadTokens(client, clientId) {
+  try {
+    const raw = localStorage.getItem(tokenKey(clientId));
+    if (!raw) return;
+    client.auth.setTokens(JSON.parse(raw));
+  } catch {
+    try {
+      localStorage.removeItem(tokenKey(clientId));
+    } catch {
+      /* ignore */
+    }
+  }
+}
+function saveTokens(client, clientId) {
+  try {
+    localStorage.setItem(tokenKey(clientId), JSON.stringify(client.auth.getTokens()));
+  } catch {
+    // privacy mode / quota — in-memory token still works for this session
+  }
+}
+
+/**
+ * Build a `fetch`-shaped function pre-bound to the given Wix client id. The
+ * returned value is drop-in compatible with any `fetchImpl` option
+ * (`placementFetch`, `fetchContextualChips`, …).
+ *
+ * Each call loads cached tokens before the request, then saves the (possibly
+ * refreshed) tokens after the response headers arrive — we deliberately do NOT
+ * wait for the streaming body; the SDK's refresh runs alongside the stream and
+ * the saved tokens benefit subsequent calls.
+ */
+export function createWixAuthFetch(clientId) {
+  if (!clientId) {
+    throw new Error('[web5-core] createWixAuthFetch: clientId is empty');
+  }
+  const client = createClient({
+    auth: OAuthStrategy({
+      clientId
+    })
+  });
+  return async (input, init) => {
+    loadTokens(client, clientId);
+    const res = await client.fetchWithAuth(input, init);
+    saveTokens(client, clientId);
+    return res;
+  };
+}
+//# sourceMappingURL=wixAuthFetch.js.map

package/dist/esm/client/wixAuthFetch.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["createClient","OAuthStrategy","TOKEN_CACHE_KEY_PREFIX","tokenKey","clientId","loadTokens","client","raw","localStorage","getItem","auth","setTokens","JSON","parse","removeItem","saveTokens","setItem","stringify","getTokens","createWixAuthFetch","Error","input","init","res","fetchWithAuth"],"sources":["../../../src/client/wixAuthFetch.ts"],"sourcesContent":["/**\n * Wix-authenticated `fetch` for Web5 BE calls from a host (third-party) origin.\n *\n * `wixapis.com`'s `/wix-assistant-web5/v1/conversation` endpoint refuses\n * cross-origin anonymous calls (HTTP 500) — the only auth path that survives\n * CORS from a host (e.g. Shopify) origin is `@wix/sdk`'s `OAuthStrategy`, which\n * supplies the `Authorization` header the BE allowlists.\n *\n * Shared by every embed bundle that talks to the conversation endpoint — the\n * placement bundle and the input-widget chip generator — so they all attach\n * the same token. Token caching uses the same `localStorage` key format\n * (`web5_tokens_<clientId>`) as `web50-server-ui`'s token cache, so the loader,\n * full app, placement, and input widget share one OAuth token instead of each\n * burning a `/oauth2/token` round-trip per page load.\n */\nimport { createClient, OAuthStrategy } from '@wix/sdk';\n\nconst TOKEN_CACHE_KEY_PREFIX = 'web5_tokens_';\n\ninterface SdkClient {\n  fetchWithAuth: typeof fetch;\n  auth: {\n    setTokens: (tokens: unknown) => void;\n    getTokens: () => unknown;\n  };\n}\n\nfunction tokenKey(clientId: string): string {\n  return `${TOKEN_CACHE_KEY_PREFIX}${clientId}`;\n}\n\nfunction loadTokens(client: SdkClient, clientId: string): void {\n  try {\n    const raw = localStorage.getItem(tokenKey(clientId));\n    if (!raw) return;\n    client.auth.setTokens(JSON.parse(raw));\n  } catch {\n    try {\n      localStorage.removeItem(tokenKey(clientId));\n    } catch {\n      /* ignore */\n    }\n  }\n}\n\nfunction saveTokens(client: SdkClient, clientId: string): void {\n  try {\n    localStorage.setItem(\n      tokenKey(clientId),\n      JSON.stringify(client.auth.getTokens()),\n    );\n  } catch {\n    // privacy mode / quota — in-memory token still works for this session\n  }\n}\n\n/**\n * Build a `fetch`-shaped function pre-bound to the given Wix client id. The\n * returned value is drop-in compatible with any `fetchImpl` option\n * (`placementFetch`, `fetchContextualChips`, …).\n *\n * Each call loads cached tokens before the request, then saves the (possibly\n * refreshed) tokens after the response headers arrive — we deliberately do NOT\n * wait for the streaming body; the SDK's refresh runs alongside the stream and\n * the saved tokens benefit subsequent calls.\n */\nexport function createWixAuthFetch(clientId: string): typeof fetch {\n  if (!clientId) {\n    throw new Error('[web5-core] createWixAuthFetch: clientId is empty');\n  }\n  const client = createClient({\n    auth: OAuthStrategy({ clientId }),\n  }) as unknown as SdkClient;\n\n  return (async (input: RequestInfo | URL, init?: RequestInit) => {\n    loadTokens(client, clientId);\n    const res = await client.fetchWithAuth(input, init);\n    saveTokens(client, clientId);\n    return res;\n  }) as typeof fetch;\n}\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASA,YAAY,EAAEC,aAAa,QAAQ,UAAU;AAEtD,MAAMC,sBAAsB,GAAG,cAAc;AAU7C,SAASC,QAAQA,CAACC,QAAgB,EAAU;EAC1C,OAAO,GAAGF,sBAAsB,GAAGE,QAAQ,EAAE;AAC/C;AAEA,SAASC,UAAUA,CAACC,MAAiB,EAAEF,QAAgB,EAAQ;EAC7D,IAAI;IACF,MAAMG,GAAG,GAAGC,YAAY,CAACC,OAAO,CAACN,QAAQ,CAACC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAACG,GAAG,EAAE;IACVD,MAAM,CAACI,IAAI,CAACC,SAAS,CAACC,IAAI,CAACC,KAAK,CAACN,GAAG,CAAC,CAAC;EACxC,CAAC,CAAC,MAAM;IACN,IAAI;MACFC,YAAY,CAACM,UAAU,CAACX,QAAQ,CAACC,QAAQ,CAAC,CAAC;IAC7C,CAAC,CAAC,MAAM;MACN;IAAA;EAEJ;AACF;AAEA,SAASW,UAAUA,CAACT,MAAiB,EAAEF,QAAgB,EAAQ;EAC7D,IAAI;IACFI,YAAY,CAACQ,OAAO,CAClBb,QAAQ,CAACC,QAAQ,CAAC,EAClBQ,IAAI,CAACK,SAAS,CAACX,MAAM,CAACI,IAAI,CAACQ,SAAS,CAAC,CAAC,CACxC,CAAC;EACH,CAAC,CAAC,MAAM;IACN;EAAA;AAEJ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,kBAAkBA,CAACf,QAAgB,EAAgB;EACjE,IAAI,CAACA,QAAQ,EAAE;IACb,MAAM,IAAIgB,KAAK,CAAC,mDAAmD,CAAC;EACtE;EACA,MAAMd,MAAM,GAAGN,YAAY,CAAC;IAC1BU,IAAI,EAAET,aAAa,CAAC;MAAEG;IAAS,CAAC;EAClC,CAAC,CAAyB;EAE1B,OAAQ,OAAOiB,KAAwB,EAAEC,IAAkB,KAAK;IAC9DjB,UAAU,CAACC,MAAM,EAAEF,QAAQ,CAAC;IAC5B,MAAMmB,GAAG,GAAG,MAAMjB,MAAM,CAACkB,aAAa,CAACH,KAAK,EAAEC,IAAI,CAAC;IACnDP,UAAU,CAACT,MAAM,EAAEF,QAAQ,CAAC;IAC5B,OAAOmB,GAAG;EACZ,CAAC;AACH","ignoreList":[]}

package/dist/esm/clients.js

@@ -0,0 +1,11 @@
+export const CLIENT_IDS = {
+  CIRCANA_DEMO: '9efd0d80-5661-4497-8267-76a2bb075d80',
+  CIRCANA_PROD: '976944ca-fead-4d31-94db-2b3ac4c55ad5',
+  FEATURE_COM: '9ed0cd73-31e2-48f6-83cd-df96267a8471'
+};
+
+/** Petri / Conductor experiment IDs evaluated in the `web5-embed` scope. */
+export const EXPERIMENT_IDS = {
+  WEB5_CUSTOM: 'web5Custom'
+};
+//# sourceMappingURL=clients.js.map

package/dist/esm/clients.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["CLIENT_IDS","CIRCANA_DEMO","CIRCANA_PROD","FEATURE_COM","EXPERIMENT_IDS","WEB5_CUSTOM"],"sources":["../../src/clients.ts"],"sourcesContent":["export const CLIENT_IDS = {\n  CIRCANA_DEMO: '9efd0d80-5661-4497-8267-76a2bb075d80',\n  CIRCANA_PROD: '976944ca-fead-4d31-94db-2b3ac4c55ad5',\n  FEATURE_COM: '9ed0cd73-31e2-48f6-83cd-df96267a8471',\n} as const;\n\n/** Petri / Conductor experiment IDs evaluated in the `web5-embed` scope. */\nexport const EXPERIMENT_IDS = {\n  WEB5_CUSTOM: 'web5Custom',\n} as const;\n"],"mappings":"AAAA,OAAO,MAAMA,UAAU,GAAG;EACxBC,YAAY,EAAE,sCAAsC;EACpDC,YAAY,EAAE,sCAAsC;EACpDC,WAAW,EAAE;AACf,CAAU;;AAEV;AACA,OAAO,MAAMC,cAAc,GAAG;EAC5BC,WAAW,EAAE;AACf,CAAU","ignoreList":[]}

package/dist/esm/color/colorUtils.js

@@ -0,0 +1,118 @@
+export function rgbToHsl(_ref) {
+  let [r, g, b] = _ref;
+  r /= 255;
+  g /= 255;
+  b /= 255;
+  const max = Math.max(r, g, b),
+    min = Math.min(r, g, b);
+  let h = 0,
+    s = 0;
+  const l = (max + min) / 2;
+  if (max !== min) {
+    const d = max - min;
+    s = l > 0.5 ? d / (2 - max - min) : d / (max + min);
+    if (max === r) {
+      h = ((g - b) / d + (g < b ? 6 : 0)) / 6;
+    } else if (max === g) {
+      h = ((b - r) / d + 2) / 6;
+    } else {
+      h = ((r - g) / d + 4) / 6;
+    }
+  }
+  return [h * 360, s * 100, l * 100];
+}
+export function hslToRgb(_ref2) {
+  let [h, s, l] = _ref2;
+  h /= 360;
+  s /= 100;
+  l /= 100;
+  if (s === 0) {
+    const v = Math.round(l * 255);
+    return [v, v, v];
+  }
+  const hue2rgb = (p, q, t) => {
+    if (t < 0) {
+      t += 1;
+    }
+    if (t > 1) {
+      t -= 1;
+    }
+    if (t < 1 / 6) {
+      return p + (q - p) * 6 * t;
+    }
+    if (t < 1 / 2) {
+      return q;
+    }
+    if (t < 2 / 3) {
+      return p + (q - p) * (2 / 3 - t) * 6;
+    }
+    return p;
+  };
+  const q = l < 0.5 ? l * (1 + s) : l + s - l * s;
+  const p = 2 * l - q;
+  return [Math.round(hue2rgb(p, q, h + 1 / 3) * 255), Math.round(hue2rgb(p, q, h) * 255), Math.round(hue2rgb(p, q, h - 1 / 3) * 255)];
+}
+export function ensureMinLightness(rgb, minL) {
+  const [h, s, l] = rgbToHsl(rgb);
+  if (l >= minL) {
+    return rgb;
+  }
+  return hslToRgb([h, s, minL]);
+}
+export function toRgb(c) {
+  return `rgb(${c[0]}, ${c[1]}, ${c[2]})`;
+}
+export function deriveDarkColor(palette, minDarkness) {
+  if (!palette.length) {
+    return [0, 0, 0];
+  }
+  let darkest = palette[0];
+  let lowestL = rgbToHsl(palette[0])[2];
+  for (let i = 1; i < palette.length; i++) {
+    const l = rgbToHsl(palette[i])[2];
+    if (l < lowestL) {
+      lowestL = l;
+      darkest = palette[i];
+    }
+  }
+  const [h, s, l] = rgbToHsl(darkest);
+  const maxLightness = 100 - minDarkness;
+  if (l <= maxLightness) {
+    return darkest;
+  }
+  return hslToRgb([h, s, maxLightness]);
+}
+export function deriveDarkGradient(palette, minDarkness) {
+  if (!palette.length) {
+    return ['rgb(0, 0, 0)', 'rgb(0, 0, 0)'];
+  }
+  const sorted = [...palette].sort((a, b) => rgbToHsl(a)[2] - rgbToHsl(b)[2]);
+  const maxLightness = 100 - minDarkness;
+  const enforce = rgb => {
+    const [h, s, l] = rgbToHsl(rgb);
+    return l <= maxLightness ? rgb : hslToRgb([h, s, maxLightness]);
+  };
+  const stop1 = enforce(sorted[0]);
+  const stop2 = enforce(sorted.length > 1 ? sorted[1] : sorted[0]);
+  return [toRgb(stop1), toRgb(stop2)];
+}
+export function deriveLightColor(palette, minLightness) {
+  if (!palette.length) {
+    return [240, 240, 240];
+  }
+  let lightest = palette[0];
+  let highestL = rgbToHsl(palette[0])[2];
+  for (let i = 1; i < palette.length; i++) {
+    const l = rgbToHsl(palette[i])[2];
+    if (l > highestL) {
+      highestL = l;
+      lightest = palette[i];
+    }
+  }
+  const [h, s, l] = rgbToHsl(lightest);
+  if (l >= minLightness) {
+    return lightest;
+  }
+  return hslToRgb([h, s, minLightness]);
+}
+//# sourceMappingURL=colorUtils.js.map