@zappie/sdk 0.1.11 → 0.1.13

package/dist/internal.d.ts

@@ -1,5 +1,5 @@
 import { c as CartFulfilment, W as WireFulfilment } from './types-gQXU2gEA.js';
-export { v as validateConfig } from './client-DzUauU-b.js';
+export { v as validateConfig } from './client-CSOZOwQW.js';
 import './models-D__QbqEd.js';
 
 /**

package/dist/persist/catalogue.d.ts

@@ -1,3 +1,3 @@
-export { q as CATALOGUE_MAX_AGE_MS, r as CATALOGUE_MAX_BYTES, s as CatalogueScope, t as SavedCatalogue, u as catalogueDigest, w as catalogueKey, x as createCatalogueStorage, y as createSavedCatalogue } from '../client-DzUauU-b.js';
+export { q as CATALOGUE_MAX_AGE_MS, r as CATALOGUE_MAX_BYTES, s as CatalogueScope, t as SavedCatalogue, u as catalogueDigest, w as catalogueKey, x as createCatalogueStorage, y as createSavedCatalogue } from '../client-CSOZOwQW.js';
 import '../models-D__QbqEd.js';
 import '../types-gQXU2gEA.js';

package/dist/react/index.d.ts

@@ -1,6 +1,6 @@
 export { VERSION } from '../index.js';
+import { a as ZappieError, Z as Zappie } from '../client-CSOZOwQW.js';
 import { I as Item, a as Menu, S as Store, M as Money } from '../models-D__QbqEd.js';
-import { a as ZappieError, Z as Zappie } from '../client-DzUauU-b.js';
 import * as react from 'react';
 import { ReactNode } from 'react';
 import { d as CartModule, C as CartLine, c as CartFulfilment, e as CartState, f as CartIssue } from '../types-gQXU2gEA.js';

package/dist/redirect/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Return a same-origin redirect target, or a trusted fallback.
+ *
+ * The target must resolve to an HTTP(S) URL on the current origin and its
+ * returned path must begin with exactly one slash. On the server, only relative
+ * targets can match the sentinel origin because there is no request origin to
+ * compare.
+ *
+ * @param to - The untrusted redirect target, such as a query parameter.
+ * @param fallback - The trusted target to use when `to` is unsafe.
+ * @returns A same-origin relative target or `fallback`.
+ */
+declare function safeRedirect(to: string | null | undefined, fallback: string): string;
+
+export { safeRedirect };

package/dist/redirect/index.js

@@ -0,0 +1,22 @@
+// src/redirect/index.ts
+function safeRedirect(to, fallback) {
+  if (typeof to !== "string" || /[\u0000-\u0020\u007f\s\\]/u.test(to) || /%(?:0[\da-f]|1[\da-f]|20|7f)/iu.test(to)) {
+    return fallback;
+  }
+  try {
+    const browserOrigin = typeof location === "undefined" ? void 0 : location.origin;
+    if (browserOrigin === "null") {
+      return fallback;
+    }
+    const origin = browserOrigin ?? "https://safe-redirect.invalid";
+    const target = new URL(to, origin);
+    const path = `${target.pathname}${target.search}${target.hash}`;
+    return (target.protocol === "http:" || target.protocol === "https:") && target.origin === origin && /^\/(?!\/)/.test(path) ? path : fallback;
+  } catch {
+    return fallback;
+  }
+}
+export {
+  safeRedirect
+};
+//# sourceMappingURL=index.js.map

package/dist/redirect/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/redirect/index.ts"],
+  "sourcesContent": ["/**\n * Return a same-origin redirect target, or a trusted fallback.\n *\n * The target must resolve to an HTTP(S) URL on the current origin and its\n * returned path must begin with exactly one slash. On the server, only relative\n * targets can match the sentinel origin because there is no request origin to\n * compare.\n *\n * @param to - The untrusted redirect target, such as a query parameter.\n * @param fallback - The trusted target to use when `to` is unsafe.\n * @returns A same-origin relative target or `fallback`.\n */\nexport function safeRedirect(\n  to: string | null | undefined,\n  fallback: string,\n): string {\n  if (\n    typeof to !== \"string\" ||\n    /[\\u0000-\\u0020\\u007f\\s\\\\]/u.test(to) ||\n    /%(?:0[\\da-f]|1[\\da-f]|20|7f)/iu.test(to)\n  ) {\n    return fallback;\n  }\n  try {\n    const browserOrigin =\n      typeof location === \"undefined\" ? undefined : location.origin;\n    if (browserOrigin === \"null\") {\n      return fallback;\n    }\n    const origin = browserOrigin ?? \"https://safe-redirect.invalid\";\n    const target = new URL(to, origin);\n    const path = `${target.pathname}${target.search}${target.hash}`;\n    return (target.protocol === \"http:\" || target.protocol === \"https:\") &&\n      target.origin === origin &&\n      /^\\/(?!\\/)/.test(path)\n      ? path\n      : fallback;\n  } catch {\n    return fallback;\n  }\n}\n"],
+  "mappings": ";AAYO,SAAS,aACd,IACA,UACQ;AACR,MACE,OAAO,OAAO,YACd,6BAA6B,KAAK,EAAE,KACpC,iCAAiC,KAAK,EAAE,GACxC;AACA,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,gBACJ,OAAO,aAAa,cAAc,SAAY,SAAS;AACzD,QAAI,kBAAkB,QAAQ;AAC5B,aAAO;AAAA,IACT;AACA,UAAM,SAAS,iBAAiB;AAChC,UAAM,SAAS,IAAI,IAAI,IAAI,MAAM;AACjC,UAAM,OAAO,GAAG,OAAO,QAAQ,GAAG,OAAO,MAAM,GAAG,OAAO,IAAI;AAC7D,YAAQ,OAAO,aAAa,WAAW,OAAO,aAAa,aACzD,OAAO,WAAW,UAClB,YAAY,KAAK,IAAI,IACnB,OACA;AAAA,EACN,QAAQ;AACN,WAAO;AAAA,EACT;AACF;",
+  "names": []
+}

package/dist/server/index.d.ts

@@ -1,5 +1,5 @@
 import { a as Menu, F as Formatters, S as Store } from '../models-D__QbqEd.js';
-import { a as ZappieError, b as ZappieConfig, T as Transport, S as StorageLike, c as StoreResource, M as MenuResource, d as ZappieEvents, C as Cache } from '../client-DzUauU-b.js';
+import { a as ZappieError, b as ZappieConfig, T as Transport, S as StorageLike, c as StoreResource, M as MenuResource, d as ZappieEvents, C as Cache } from '../client-CSOZOwQW.js';
 export { VERSION } from '../index.js';
 import { d as CartModule, b as CartLineInput } from '../types-gQXU2gEA.js';
 
@@ -162,6 +162,91 @@ declare const parseStorefrontUrl: (input: StorefrontUrlInput, options?: Storefro
  */
 declare const storefrontRedirect: (input: StorefrontUrlInput, options?: StorefrontUrlOptions) => string | null;
 
+/**
+ * The store, theme and optional build policies you export from zappie.config.ts.
+ */
+type ZappieSiteConfig = {
+    store: string;
+    branches?: string[];
+    theme: string;
+    prerender?: string[];
+    menu?: {
+        hiddenCategories?: string[];
+    };
+    packages?: {
+        allow?: string[];
+    };
+    /** Time-bounded acknowledgements for advisories that have no fixed version. */
+    audit?: {
+        ignore?: {
+            id: string;
+            reason: string;
+            until: string;
+        }[];
+    };
+    outbound?: {
+        allow?: string[];
+    };
+    /** Add sources to the fixed storefront Content Security Policy. */
+    security?: {
+        csp?: {
+            imgSrc?: string[];
+            connectSrc?: string[];
+            fontSrc?: string[];
+            styleSrc?: string[];
+            frameSrc?: string[];
+        };
+    };
+    /** Each budget left out uses DEFAULT_BUDGETS. */
+    budgets?: {
+        jsKbGz?: number;
+        cssKbGz?: number;
+        lcpMs?: number;
+        override?: {
+            reason: string;
+        };
+    };
+    /** Records explained exceptions to storefront readiness checks. */
+    readiness?: {
+        /** Lets this site skip the initial route discovery requirement. */
+        routeDiscovery?: {
+            /** Explains why this site does not use initial route discovery. */
+            optOut: {
+                /** States the constraint that prevents initial route discovery. */
+                reason: string;
+            };
+        };
+    };
+    analytics?: {
+        forward?: {
+            ga4?: string;
+            metaPixel?: string;
+        };
+    };
+};
+
+/** Inputs for a storefront document's report-only security headers. */
+type SecurityHeadersOptions = {
+    /** A fresh value from createSecurityNonce for a server-rendered document. */
+    nonce?: string;
+    /** SHA-256 CSP source expressions for inline scripts in a prerendered document. */
+    scriptHashes?: string[];
+    /** The site configuration. Invalid CSP additions are ignored. */
+    config?: ZappieSiteConfig;
+    /** The configured ZAPPIE_API URL whose origin the browser may call. */
+    apiUrl?: string;
+    /** Existing response headers to extend. */
+    headers?: HeadersInit;
+    /** Hosted responses leave framing to Zappie's dispatch Worker. */
+    hosted?: boolean;
+};
+/** Create an unpredictable CSP nonce with Web Crypto in Node or a Worker. */
+declare function createSecurityNonce(): string;
+/** Compute CSP SHA-256 source expressions for inline scripts in prerendered HTML. */
+declare function inlineScriptHashes(html: string): Promise<string[]>;
+/** Build the report-only security headers for a storefront document response. */
+declare function securityHeaders(options?: SecurityHeadersOptions): Headers;
+
 /** Event names sent by the Zappie webhook API. */
 type WebhookEventType = "menu.updated" | "branch.hours_changed" | "store.updated" | "checkout.session.completed" | "checkout.session.expired" | "order.created" | "order.paid" | "order.status_changed" | "customer.signed_in" | "payout.initiated" | "payout.paid" | "payout.failed" | "payout_request.created" | "payout_request.approved" | "payout_request.rejected" | "payment.received";
 /** The event envelope sent in a Zappie webhook request. */
@@ -237,4 +322,4 @@ declare function createZappieServer({ secretKey, ...config }: ZappieServerConfig
     };
 }>;
 
-export { type EdgeSnapshotReader, STOREFRONT_QUERY_PARAMETERS, STOREFRONT_V1_QUERY_PARAMETERS, type StorefrontInstallation, type StorefrontPageState, type StorefrontQuery, type StorefrontRoute, type StorefrontUrlInput, type StorefrontUrlOptions, type VerifyWebhookOptions, type WebhookEvent, type WebhookEventType, type ZappieServerConfig, ZappieWebhookSignatureError, buildStorefrontUrl, createZappieServer, parseStorefrontUrl, storefrontRedirect, verifyWebhook };
+export { type EdgeSnapshotReader, STOREFRONT_QUERY_PARAMETERS, STOREFRONT_V1_QUERY_PARAMETERS, type SecurityHeadersOptions, type StorefrontInstallation, type StorefrontPageState, type StorefrontQuery, type StorefrontRoute, type StorefrontUrlInput, type StorefrontUrlOptions, type VerifyWebhookOptions, type WebhookEvent, type WebhookEventType, type ZappieServerConfig, ZappieWebhookSignatureError, buildStorefrontUrl, createSecurityNonce, createZappieServer, inlineScriptHashes, parseStorefrontUrl, securityHeaders, storefrontRedirect, verifyWebhook };

package/dist/server/index.js

@@ -8,6 +8,11 @@ import {
   STOREFRONT_V1_QUERY_PARAMETERS,
   storefrontRedirect
 } from "../url/index.js";
+import {
+  createSecurityNonce,
+  inlineScriptHashes,
+  securityHeaders
+} from "./security.js";
 import {
   verifyWebhook,
   ZappieWebhookSignatureError
@@ -24,8 +29,11 @@ export {
   VERSION,
   ZappieWebhookSignatureError,
   buildStorefrontUrl,
+  createSecurityNonce,
   createZappieServer,
+  inlineScriptHashes,
   parseStorefrontUrl,
+  securityHeaders,
   storefrontRedirect,
   verifyWebhook
 };

package/dist/server/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/server/index.ts"],
-  "sourcesContent": ["import { buildClient } from \"../client\";\nimport type { ZappieConfig } from \"../config\";\nimport type { Menu } from \"../models\";\nexport { VERSION } from \"../index\";\nexport {\n  buildStorefrontUrl,\n  parseStorefrontUrl,\n  STOREFRONT_QUERY_PARAMETERS,\n  STOREFRONT_V1_QUERY_PARAMETERS,\n  storefrontRedirect,\n  type StorefrontInstallation,\n  type StorefrontPageState,\n  type StorefrontQuery,\n  type StorefrontRoute,\n  type StorefrontUrlInput,\n  type StorefrontUrlOptions,\n} from \"../url/index\";\nexport {\n  verifyWebhook,\n  ZappieWebhookSignatureError,\n  type VerifyWebhookOptions,\n  type WebhookEvent,\n  type WebhookEventType,\n} from \"./webhook\";\n/** An edge reader that returns a Menu snapshot or null. */\nexport interface EdgeSnapshotReader {\n  getMenu(storeId: string, branchId: string): Promise<Menu | null>;\n}\n/** Settings for your server client. Keep secret keys out of browser bundles. */\nexport type ZappieServerConfig = Omit<ZappieConfig, \"key\"> & {\n  secretKey: string;\n};\n/** Create a server client with your secret key and configured transport. */\nexport function createZappieServer({\n  secretKey,\n  ...config\n}: ZappieServerConfig) {\n  return buildClient({ ...config, key: secretKey }, true);\n}\n"],
-  "mappings": ";AAAA,SAAS,mBAAmB;AAG5B,SAAS,eAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAOK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAIK;AAUA,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA,GAAG;AACL,GAAuB;AACrB,SAAO,YAAY,EAAE,GAAG,QAAQ,KAAK,UAAU,GAAG,IAAI;AACxD;",
+  "sourcesContent": ["import { buildClient } from \"../client\";\nimport type { ZappieConfig } from \"../config\";\nimport type { Menu } from \"../models\";\nexport { VERSION } from \"../index\";\nexport {\n  buildStorefrontUrl,\n  parseStorefrontUrl,\n  STOREFRONT_QUERY_PARAMETERS,\n  STOREFRONT_V1_QUERY_PARAMETERS,\n  storefrontRedirect,\n  type StorefrontInstallation,\n  type StorefrontPageState,\n  type StorefrontQuery,\n  type StorefrontRoute,\n  type StorefrontUrlInput,\n  type StorefrontUrlOptions,\n} from \"../url/index\";\nexport {\n  createSecurityNonce,\n  inlineScriptHashes,\n  securityHeaders,\n  type SecurityHeadersOptions,\n} from \"./security\";\nexport {\n  verifyWebhook,\n  ZappieWebhookSignatureError,\n  type VerifyWebhookOptions,\n  type WebhookEvent,\n  type WebhookEventType,\n} from \"./webhook\";\n/** An edge reader that returns a Menu snapshot or null. */\nexport interface EdgeSnapshotReader {\n  getMenu(storeId: string, branchId: string): Promise<Menu | null>;\n}\n/** Settings for your server client. Keep secret keys out of browser bundles. */\nexport type ZappieServerConfig = Omit<ZappieConfig, \"key\"> & {\n  secretKey: string;\n};\n/** Create a server client with your secret key and configured transport. */\nexport function createZappieServer({\n  secretKey,\n  ...config\n}: ZappieServerConfig) {\n  return buildClient({ ...config, key: secretKey }, true);\n}\n"],
+  "mappings": ";AAAA,SAAS,mBAAmB;AAG5B,SAAS,eAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAOK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAIK;AAUA,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA,GAAG;AACL,GAAuB;AACrB,SAAO,YAAY,EAAE,GAAG,QAAQ,KAAK,UAAU,GAAG,IAAI;AACxD;",
   "names": []
 }

package/dist/server/security.js

@@ -0,0 +1,136 @@
+// src/server/security.ts
+import { hostname, record } from "../site-config/helpers.js";
+var DEFAULT_SOURCES = {
+  "img-src": ["'self'", "data:", "https:"],
+  "connect-src": ["'self'"],
+  "font-src": ["'self'", "https://fonts.gstatic.com"],
+  "style-src": ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
+  "frame-src": [
+    "https://checkout.zappie.ai",
+    "https://elements.zappie.ai",
+    "https://accounts.zappie.ai"
+  ]
+};
+var sourceNames = {
+  imgSrc: "img-src",
+  connectSrc: "connect-src",
+  fontSrc: "font-src",
+  styleSrc: "style-src",
+  frameSrc: "frame-src"
+};
+var base64 = (bytes) => btoa(String.fromCharCode(...bytes));
+function createSecurityNonce() {
+  return base64(crypto.getRandomValues(new Uint8Array(18))).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+async function inlineScriptHashes(html) {
+  const hashes = await Promise.all(
+    [...html.matchAll(/<script\b([^>]*)>([\s\S]*?)<\/script>/gi)].filter(([, attributes = ""]) => !/(?:^|\s)src\s*=/i.test(attributes)).map(async ([, , source = ""]) => {
+      const digest = await crypto.subtle.digest(
+        "SHA-256",
+        new TextEncoder().encode(source)
+      );
+      return `'sha256-${base64(new Uint8Array(digest))}'`;
+    })
+  );
+  return [...new Set(hashes)];
+}
+function apiOrigin(value) {
+  if (value === void 0) {
+    return "https://storefront-api.zappie.ai";
+  }
+  try {
+    const url = new URL(value);
+    if (url.protocol === "https:" || url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)) {
+      return url.origin;
+    }
+  } catch {
+    return void 0;
+  }
+  return void 0;
+}
+function configuredSources(config) {
+  const configured = /* @__PURE__ */ new Map();
+  const csp = config?.security?.csp;
+  if (!record(csp)) {
+    return configured;
+  }
+  for (const [name, values] of Object.entries(csp)) {
+    const directive = sourceNames[name];
+    if (!directive || !Array.isArray(values)) {
+      continue;
+    }
+    const valid = values.filter(
+      (value) => typeof value === "string" && !/[;,\s]/.test(value) && hostname(value)
+    );
+    configured.set(
+      directive,
+      valid.map((host) => `https://${host}`)
+    );
+  }
+  return configured;
+}
+function securityHeaders(options = {}) {
+  if (!options.nonce && !options.scriptHashes?.length) {
+    throw new TypeError(
+      "securityHeaders needs a nonce or an inline script hash."
+    );
+  }
+  const sources = Object.fromEntries(
+    Object.entries(DEFAULT_SOURCES).map(([name, values]) => [
+      name,
+      [...values]
+    ])
+  );
+  const storefrontApiOrigin = apiOrigin(options.apiUrl);
+  if (storefrontApiOrigin) {
+    sources["connect-src"].push(storefrontApiOrigin);
+  }
+  for (const [name, values] of configuredSources(options.config)) {
+    sources[name].push(...values);
+  }
+  const outbound = options.config?.outbound?.allow;
+  if (Array.isArray(outbound)) {
+    sources["connect-src"].push(
+      ...outbound.filter(
+        (host) => typeof host === "string" && !/[;,\s]/.test(host) && hostname(host)
+      ).map((host) => `https://${host}`)
+    );
+  }
+  for (const values of Object.values(sources)) {
+    values.splice(0, values.length, ...new Set(values));
+  }
+  const scriptSources = [
+    "'self'",
+    ...options.nonce ? [`'nonce-${options.nonce}'`] : [],
+    ...options.scriptHashes ?? [],
+    "'strict-dynamic'"
+  ];
+  const directives = [
+    "default-src 'self'",
+    `script-src ${scriptSources.join(" ")}`,
+    ...Object.entries(sources).map(
+      ([name, values]) => `${name} ${values.join(" ")}`
+    ),
+    "form-action 'self' https://accounts.zappie.ai https://checkout.zappie.ai",
+    "base-uri 'self'",
+    "object-src 'none'",
+    ...!options.hosted ? ["frame-ancestors 'self'"] : [],
+    "report-uri /_zappie/csp"
+  ];
+  const headers = new Headers(options.headers);
+  headers.set("content-security-policy-report-only", directives.join("; "));
+  headers.set("strict-transport-security", "max-age=31536000");
+  headers.set("x-content-type-options", "nosniff");
+  headers.set("referrer-policy", "strict-origin-when-cross-origin");
+  headers.set(
+    "permissions-policy",
+    'camera=(), microphone=(), usb=(), geolocation=(self), payment=(self "https://checkout.zappie.ai")'
+  );
+  return headers;
+}
+export {
+  createSecurityNonce,
+  inlineScriptHashes,
+  securityHeaders
+};
+//# sourceMappingURL=security.js.map

package/dist/server/security.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/server/security.ts"],
+  "sourcesContent": ["import { hostname, record } from \"../site-config/helpers\";\nimport type { ZappieSiteConfig } from \"../site-config/types\";\n\nconst DEFAULT_SOURCES = {\n  \"img-src\": [\"'self'\", \"data:\", \"https:\"],\n  \"connect-src\": [\"'self'\"],\n  \"font-src\": [\"'self'\", \"https://fonts.gstatic.com\"],\n  \"style-src\": [\"'self'\", \"'unsafe-inline'\", \"https://fonts.googleapis.com\"],\n  \"frame-src\": [\n    \"https://checkout.zappie.ai\",\n    \"https://elements.zappie.ai\",\n    \"https://accounts.zappie.ai\",\n  ],\n} as const;\n\n/** Inputs for a storefront document's report-only security headers. */\nexport type SecurityHeadersOptions = {\n  /** A fresh value from createSecurityNonce for a server-rendered document. */\n  nonce?: string;\n  /** SHA-256 CSP source expressions for inline scripts in a prerendered document. */\n  scriptHashes?: string[];\n  /** The site configuration. Invalid CSP additions are ignored. */\n  config?: ZappieSiteConfig;\n  /** The configured ZAPPIE_API URL whose origin the browser may call. */\n  apiUrl?: string;\n  /** Existing response headers to extend. */\n  headers?: HeadersInit;\n  /** Hosted responses leave framing to Zappie's dispatch Worker. */\n  hosted?: boolean;\n};\n\nconst sourceNames = {\n  imgSrc: \"img-src\",\n  connectSrc: \"connect-src\",\n  fontSrc: \"font-src\",\n  styleSrc: \"style-src\",\n  frameSrc: \"frame-src\",\n} as const;\n\nconst base64 = (bytes: Uint8Array) => btoa(String.fromCharCode(...bytes));\n\n/** Create an unpredictable CSP nonce with Web Crypto in Node or a Worker. */\nexport function createSecurityNonce(): string {\n  return base64(crypto.getRandomValues(new Uint8Array(18)))\n    .replaceAll(\"+\", \"-\")\n    .replaceAll(\"/\", \"_\")\n    .replace(/=+$/, \"\");\n}\n\n/** Compute CSP SHA-256 source expressions for inline scripts in prerendered HTML. */\nexport async function inlineScriptHashes(html: string): Promise<string[]> {\n  const hashes = await Promise.all(\n    [...html.matchAll(/<script\\b([^>]*)>([\\s\\S]*?)<\\/script>/gi)]\n      .filter(([, attributes = \"\"]) => !/(?:^|\\s)src\\s*=/i.test(attributes))\n      .map(async ([, , source = \"\"]) => {\n        const digest = await crypto.subtle.digest(\n          \"SHA-256\",\n          new TextEncoder().encode(source),\n        );\n        return `'sha256-${base64(new Uint8Array(digest))}'`;\n      }),\n  );\n  return [...new Set(hashes)];\n}\n\nfunction apiOrigin(value: string | undefined) {\n  if (value === undefined) {\n    return \"https://storefront-api.zappie.ai\";\n  }\n  try {\n    const url = new URL(value);\n    if (\n      url.protocol === \"https:\" ||\n      (url.protocol === \"http:\" &&\n        [\"localhost\", \"127.0.0.1\", \"[::1]\"].includes(url.hostname))\n    ) {\n      return url.origin;\n    }\n  } catch {\n    return undefined;\n  }\n  return undefined;\n}\n\nfunction configuredSources(config: ZappieSiteConfig | undefined) {\n  const configured = new Map<string, string[]>();\n  const csp = config?.security?.csp as unknown;\n  if (!record(csp)) {\n    return configured;\n  }\n  for (const [name, values] of Object.entries(csp)) {\n    const directive = sourceNames[name as keyof typeof sourceNames];\n    if (!directive || !Array.isArray(values)) {\n      continue;\n    }\n    const valid = values.filter(\n      (value): value is string =>\n        typeof value === \"string\" && !/[;,\\s]/.test(value) && hostname(value),\n    );\n    configured.set(\n      directive,\n      valid.map((host) => `https://${host}`),\n    );\n  }\n  return configured;\n}\n\n/** Build the report-only security headers for a storefront document response. */\nexport function securityHeaders(options: SecurityHeadersOptions = {}): Headers {\n  if (!options.nonce && !options.scriptHashes?.length) {\n    throw new TypeError(\n      \"securityHeaders needs a nonce or an inline script hash.\",\n    );\n  }\n  const sources = Object.fromEntries(\n    Object.entries(DEFAULT_SOURCES).map(([name, values]) => [\n      name,\n      [...values],\n    ]),\n  ) as Record<(typeof sourceNames)[keyof typeof sourceNames], string[]>;\n  const storefrontApiOrigin = apiOrigin(options.apiUrl);\n  if (storefrontApiOrigin) {\n    sources[\"connect-src\"].push(storefrontApiOrigin);\n  }\n  for (const [name, values] of configuredSources(options.config)) {\n    sources[name as keyof typeof sources].push(...values);\n  }\n  const outbound = options.config?.outbound?.allow as unknown;\n  if (Array.isArray(outbound)) {\n    sources[\"connect-src\"].push(\n      ...outbound\n        .filter(\n          (host): host is string =>\n            typeof host === \"string\" && !/[;,\\s]/.test(host) && hostname(host),\n        )\n        .map((host) => `https://${host}`),\n    );\n  }\n  for (const values of Object.values(sources)) {\n    values.splice(0, values.length, ...new Set(values));\n  }\n  const scriptSources = [\n    \"'self'\",\n    ...(options.nonce ? [`'nonce-${options.nonce}'`] : []),\n    ...(options.scriptHashes ?? []),\n    \"'strict-dynamic'\",\n  ];\n  const directives = [\n    \"default-src 'self'\",\n    `script-src ${scriptSources.join(\" \")}`,\n    ...Object.entries(sources).map(\n      ([name, values]) => `${name} ${values.join(\" \")}`,\n    ),\n    \"form-action 'self' https://accounts.zappie.ai https://checkout.zappie.ai\",\n    \"base-uri 'self'\",\n    \"object-src 'none'\",\n    ...(!options.hosted ? [\"frame-ancestors 'self'\"] : []),\n    \"report-uri /_zappie/csp\",\n  ];\n  const headers = new Headers(options.headers);\n  headers.set(\"content-security-policy-report-only\", directives.join(\"; \"));\n  headers.set(\"strict-transport-security\", \"max-age=31536000\");\n  headers.set(\"x-content-type-options\", \"nosniff\");\n  headers.set(\"referrer-policy\", \"strict-origin-when-cross-origin\");\n  headers.set(\n    \"permissions-policy\",\n    'camera=(), microphone=(), usb=(), geolocation=(self), payment=(self \"https://checkout.zappie.ai\")',\n  );\n  return headers;\n}\n"],
+  "mappings": ";AAAA,SAAS,UAAU,cAAc;AAGjC,IAAM,kBAAkB;AAAA,EACtB,WAAW,CAAC,UAAU,SAAS,QAAQ;AAAA,EACvC,eAAe,CAAC,QAAQ;AAAA,EACxB,YAAY,CAAC,UAAU,2BAA2B;AAAA,EAClD,aAAa,CAAC,UAAU,mBAAmB,8BAA8B;AAAA,EACzE,aAAa;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAkBA,IAAM,cAAc;AAAA,EAClB,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,UAAU;AAAA,EACV,UAAU;AACZ;AAEA,IAAM,SAAS,CAAC,UAAsB,KAAK,OAAO,aAAa,GAAG,KAAK,CAAC;AAGjE,SAAS,sBAA8B;AAC5C,SAAO,OAAO,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,CAAC,EACrD,WAAW,KAAK,GAAG,EACnB,WAAW,KAAK,GAAG,EACnB,QAAQ,OAAO,EAAE;AACtB;AAGA,eAAsB,mBAAmB,MAAiC;AACxE,QAAM,SAAS,MAAM,QAAQ;AAAA,IAC3B,CAAC,GAAG,KAAK,SAAS,yCAAyC,CAAC,EACzD,OAAO,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,mBAAmB,KAAK,UAAU,CAAC,EACpE,IAAI,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM;AAChC,YAAM,SAAS,MAAM,OAAO,OAAO;AAAA,QACjC;AAAA,QACA,IAAI,YAAY,EAAE,OAAO,MAAM;AAAA,MACjC;AACA,aAAO,WAAW,OAAO,IAAI,WAAW,MAAM,CAAC,CAAC;AAAA,IAClD,CAAC;AAAA,EACL;AACA,SAAO,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC;AAC5B;AAEA,SAAS,UAAU,OAA2B;AAC5C,MAAI,UAAU,QAAW;AACvB,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QACE,IAAI,aAAa,YAChB,IAAI,aAAa,WAChB,CAAC,aAAa,aAAa,OAAO,EAAE,SAAS,IAAI,QAAQ,GAC3D;AACA,aAAO,IAAI;AAAA,IACb;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,QAAsC;AAC/D,QAAM,aAAa,oBAAI,IAAsB;AAC7C,QAAM,MAAM,QAAQ,UAAU;AAC9B,MAAI,CAAC,OAAO,GAAG,GAAG;AAChB,WAAO;AAAA,EACT;AACA,aAAW,CAAC,MAAM,MAAM,KAAK,OAAO,QAAQ,GAAG,GAAG;AAChD,UAAM,YAAY,YAAY,IAAgC;AAC9D,QAAI,CAAC,aAAa,CAAC,MAAM,QAAQ,MAAM,GAAG;AACxC;AAAA,IACF;AACA,UAAM,QAAQ,OAAO;AAAA,MACnB,CAAC,UACC,OAAO,UAAU,YAAY,CAAC,SAAS,KAAK,KAAK,KAAK,SAAS,KAAK;AAAA,IACxE;AACA,eAAW;AAAA,MACT;AAAA,MACA,MAAM,IAAI,CAAC,SAAS,WAAW,IAAI,EAAE;AAAA,IACvC;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,gBAAgB,UAAkC,CAAC,GAAY;AAC7E,MAAI,CAAC,QAAQ,SAAS,CAAC,QAAQ,cAAc,QAAQ;AACnD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,UAAU,OAAO;AAAA,IACrB,OAAO,QAAQ,eAAe,EAAE,IAAI,CAAC,CAAC,MAAM,MAAM,MAAM;AAAA,MACtD;AAAA,MACA,CAAC,GAAG,MAAM;AAAA,IACZ,CAAC;AAAA,EACH;AACA,QAAM,sBAAsB,UAAU,QAAQ,MAAM;AACpD,MAAI,qBAAqB;AACvB,YAAQ,aAAa,EAAE,KAAK,mBAAmB;AAAA,EACjD;AACA,aAAW,CAAC,MAAM,MAAM,KAAK,kBAAkB,QAAQ,MAAM,GAAG;AAC9D,YAAQ,IAA4B,EAAE,KAAK,GAAG,MAAM;AAAA,EACtD;AACA,QAAM,WAAW,QAAQ,QAAQ,UAAU;AAC3C,MAAI,MAAM,QAAQ,QAAQ,GAAG;AAC3B,YAAQ,aAAa,EAAE;AAAA,MACrB,GAAG,SACA;AAAA,QACC,CAAC,SACC,OAAO,SAAS,YAAY,CAAC,SAAS,KAAK,IAAI,KAAK,SAAS,IAAI;AAAA,MACrE,EACC,IAAI,CAAC,SAAS,WAAW,IAAI,EAAE;AAAA,IACpC;AAAA,EACF;AACA,aAAW,UAAU,OAAO,OAAO,OAAO,GAAG;AAC3C,WAAO,OAAO,GAAG,OAAO,QAAQ,GAAG,IAAI,IAAI,MAAM,CAAC;AAAA,EACpD;AACA,QAAM,gBAAgB;AAAA,IACpB;AAAA,IACA,GAAI,QAAQ,QAAQ,CAAC,UAAU,QAAQ,KAAK,GAAG,IAAI,CAAC;AAAA,IACpD,GAAI,QAAQ,gBAAgB,CAAC;AAAA,IAC7B;AAAA,EACF;AACA,QAAM,aAAa;AAAA,IACjB;AAAA,IACA,cAAc,cAAc,KAAK,GAAG,CAAC;AAAA,IACrC,GAAG,OAAO,QAAQ,OAAO,EAAE;AAAA,MACzB,CAAC,CAAC,MAAM,MAAM,MAAM,GAAG,IAAI,IAAI,OAAO,KAAK,GAAG,CAAC;AAAA,IACjD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,CAAC,QAAQ,SAAS,CAAC,wBAAwB,IAAI,CAAC;AAAA,IACpD;AAAA,EACF;AACA,QAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;AAC3C,UAAQ,IAAI,uCAAuC,WAAW,KAAK,IAAI,CAAC;AACxE,UAAQ,IAAI,6BAA6B,kBAAkB;AAC3D,UAAQ,IAAI,0BAA0B,SAAS;AAC/C,UAAQ,IAAI,mBAAmB,iCAAiC;AAChE,UAAQ;AAAA,IACN;AAAA,IACA;AAAA,EACF;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/server/storefront-url/parse-v2.js

@@ -1,4 +1,5 @@
 // src/server/storefront-url/parse-v2.ts
+import { sameOriginPath } from "../../internal/return-path.js";
 import { canonicalRoute } from "./canonical.js";
 import { normalizedPath, segment } from "./installation.js";
 import { parseV1 } from "./parse-v1.js";
@@ -24,13 +25,20 @@ var canonical = (url, state, business) => {
       ...common
     };
   }
-  if (pathname === "/checkout/return" || pathname === "/sign-in") {
-    const signIn = pathname === "/sign-in";
-    const value = url.searchParams.get(signIn ? "return" : "session");
+  if (pathname === "/checkout/return") {
+    const session = url.searchParams.get("session");
     return {
-      type: signIn ? "sign-in" : "checkout-return",
+      type: "checkout-return",
       ...common,
-      ...value !== null ? { [signIn ? "returnTo" : "session"]: value } : {}
+      ...session !== null ? { session } : {}
+    };
+  }
+  if (pathname === "/sign-in") {
+    const returnTo = sameOriginPath(url.searchParams.get("return"));
+    return {
+      type: "sign-in",
+      ...common,
+      ...returnTo !== void 0 ? { returnTo } : {}
     };
   }
   if (parts[0] === "pages" && parts[1] && parts.length === 2) {

package/dist/server/storefront-url/parse-v2.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/server/storefront-url/parse-v2.ts"],
-  "sourcesContent": ["import { canonicalRoute } from \"./canonical\";\nimport { normalizedPath, segment } from \"./installation\";\nimport { parseV1 } from \"./parse-v1\";\nimport type {\n  StorefrontInstallation,\n  StorefrontPageState,\n  StorefrontRoute,\n  StorefrontUrlInput,\n  StorefrontUrlOptions,\n} from \"./types\";\nimport { inputUrl, pageState } from \"./url\";\n\nconst canonical = (\n  url: URL,\n  state: StorefrontPageState,\n  business: string,\n): StorefrontRoute | null => {\n  const pathname = normalizedPath(url.pathname);\n  const parts = pathname.split(\"/\").filter(Boolean);\n  const branch = url.searchParams.get(\"branch\");\n  const common = { business, ...(branch !== null ? { branch } : {}), state };\n  if (pathname === \"/\") {\n    return { type: \"order-menu\", ...common };\n  }\n  if (parts[0] === \"item\" && parts[1] && parts.length === 2) {\n    return {\n      type: \"item\",\n      ...common,\n      item: segment(parts, 1),\n    };\n  }\n  if (pathname === \"/cart\" || pathname === \"/checkout\") {\n    return {\n      type: pathname === \"/cart\" ? \"cart\" : \"checkout\",\n      ...common,\n    };\n  }\n  if (pathname === \"/checkout/return\" || pathname === \"/sign-in\") {\n    const signIn = pathname === \"/sign-in\";\n    const value = url.searchParams.get(signIn ? \"return\" : \"session\");\n    return {\n      type: signIn ? \"sign-in\" : \"checkout-return\",\n      ...common,\n      ...(value !== null ? { [signIn ? \"returnTo\" : \"session\"]: value } : {}),\n    };\n  }\n  if (parts[0] === \"pages\" && parts[1] && parts.length === 2) {\n    return {\n      type: \"content-page\",\n      ...common,\n      slug: segment(parts, 1),\n    };\n  }\n  if (parts[0] === \"account\" && parts.length <= 2) {\n    const pages = {\n      \"payment-methods\": \"payment-methods\",\n      transactions: \"transactions\",\n      \"store-credit\": \"add-store-credit\",\n    } as const;\n    if (parts.length === 1) {\n      return { type: \"profile\", page: \"edit\", state };\n    }\n    const page = parts[1];\n    if (page && Object.hasOwn(pages, page)) {\n      return {\n        type: \"profile\",\n        page: pages[page as keyof typeof pages],\n        state,\n      };\n    }\n  }\n  return null;\n};\n\nexport const parseV2 = (\n  input: StorefrontUrlInput,\n  options: StorefrontUrlOptions & { installation: StorefrontInstallation },\n): StorefrontRoute => {\n  try {\n    const url = inputUrl(input);\n    const state = pageState(url);\n    const installation = options.installation;\n    const route = canonical(url, state, installation.business);\n    return canonicalRoute(route ?? parseV1(input, options), installation);\n  } catch {\n    return { type: \"unknown\", pathname: \"\", state: { query: {} } };\n  }\n};\n"],
-  "mappings": ";AAAA,SAAS,sBAAsB;AAC/B,SAAS,gBAAgB,eAAe;AACxC,SAAS,eAAe;AAQxB,SAAS,UAAU,iBAAiB;AAEpC,IAAM,YAAY,CAChB,KACA,OACA,aAC2B;AAC3B,QAAM,WAAW,eAAe,IAAI,QAAQ;AAC5C,QAAM,QAAQ,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO;AAChD,QAAM,SAAS,IAAI,aAAa,IAAI,QAAQ;AAC5C,QAAM,SAAS,EAAE,UAAU,GAAI,WAAW,OAAO,EAAE,OAAO,IAAI,CAAC,GAAI,MAAM;AACzE,MAAI,aAAa,KAAK;AACpB,WAAO,EAAE,MAAM,cAAc,GAAG,OAAO;AAAA,EACzC;AACA,MAAI,MAAM,CAAC,MAAM,UAAU,MAAM,CAAC,KAAK,MAAM,WAAW,GAAG;AACzD,WAAO;AAAA,MACL,MAAM;AAAA,MACN,GAAG;AAAA,MACH,MAAM,QAAQ,OAAO,CAAC;AAAA,IACxB;AAAA,EACF;AACA,MAAI,aAAa,WAAW,aAAa,aAAa;AACpD,WAAO;AAAA,MACL,MAAM,aAAa,UAAU,SAAS;AAAA,MACtC,GAAG;AAAA,IACL;AAAA,EACF;AACA,MAAI,aAAa,sBAAsB,aAAa,YAAY;AAC9D,UAAM,SAAS,aAAa;AAC5B,UAAM,QAAQ,IAAI,aAAa,IAAI,SAAS,WAAW,SAAS;AAChE,WAAO;AAAA,MACL,MAAM,SAAS,YAAY;AAAA,MAC3B,GAAG;AAAA,MACH,GAAI,UAAU,OAAO,EAAE,CAAC,SAAS,aAAa,SAAS,GAAG,MAAM,IAAI,CAAC;AAAA,IACvE;AAAA,EACF;AACA,MAAI,MAAM,CAAC,MAAM,WAAW,MAAM,CAAC,KAAK,MAAM,WAAW,GAAG;AAC1D,WAAO;AAAA,MACL,MAAM;AAAA,MACN,GAAG;AAAA,MACH,MAAM,QAAQ,OAAO,CAAC;AAAA,IACxB;AAAA,EACF;AACA,MAAI,MAAM,CAAC,MAAM,aAAa,MAAM,UAAU,GAAG;AAC/C,UAAM,QAAQ;AAAA,MACZ,mBAAmB;AAAA,MACnB,cAAc;AAAA,MACd,gBAAgB;AAAA,IAClB;AACA,QAAI,MAAM,WAAW,GAAG;AACtB,aAAO,EAAE,MAAM,WAAW,MAAM,QAAQ,MAAM;AAAA,IAChD;AACA,UAAM,OAAO,MAAM,CAAC;AACpB,QAAI,QAAQ,OAAO,OAAO,OAAO,IAAI,GAAG;AACtC,aAAO;AAAA,QACL,MAAM;AAAA,QACN,MAAM,MAAM,IAA0B;AAAA,QACtC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEO,IAAM,UAAU,CACrB,OACA,YACoB;AACpB,MAAI;AACF,UAAM,MAAM,SAAS,KAAK;AAC1B,UAAM,QAAQ,UAAU,GAAG;AAC3B,UAAM,eAAe,QAAQ;AAC7B,UAAM,QAAQ,UAAU,KAAK,OAAO,aAAa,QAAQ;AACzD,WAAO,eAAe,SAAS,QAAQ,OAAO,OAAO,GAAG,YAAY;AAAA,EACtE,QAAQ;AACN,WAAO,EAAE,MAAM,WAAW,UAAU,IAAI,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE;AAAA,EAC/D;AACF;",
+  "sourcesContent": ["import { sameOriginPath } from \"../../internal/return-path\";\nimport { canonicalRoute } from \"./canonical\";\nimport { normalizedPath, segment } from \"./installation\";\nimport { parseV1 } from \"./parse-v1\";\nimport type {\n  StorefrontInstallation,\n  StorefrontPageState,\n  StorefrontRoute,\n  StorefrontUrlInput,\n  StorefrontUrlOptions,\n} from \"./types\";\nimport { inputUrl, pageState } from \"./url\";\n\nconst canonical = (\n  url: URL,\n  state: StorefrontPageState,\n  business: string,\n): StorefrontRoute | null => {\n  const pathname = normalizedPath(url.pathname);\n  const parts = pathname.split(\"/\").filter(Boolean);\n  const branch = url.searchParams.get(\"branch\");\n  const common = { business, ...(branch !== null ? { branch } : {}), state };\n  if (pathname === \"/\") {\n    return { type: \"order-menu\", ...common };\n  }\n  if (parts[0] === \"item\" && parts[1] && parts.length === 2) {\n    return {\n      type: \"item\",\n      ...common,\n      item: segment(parts, 1),\n    };\n  }\n  if (pathname === \"/cart\" || pathname === \"/checkout\") {\n    return {\n      type: pathname === \"/cart\" ? \"cart\" : \"checkout\",\n      ...common,\n    };\n  }\n  if (pathname === \"/checkout/return\") {\n    const session = url.searchParams.get(\"session\");\n    return {\n      type: \"checkout-return\",\n      ...common,\n      ...(session !== null ? { session } : {}),\n    };\n  }\n  if (pathname === \"/sign-in\") {\n    // A return path that leaves the site is dropped, so a crafted link cannot redirect off it.\n    const returnTo = sameOriginPath(url.searchParams.get(\"return\"));\n    return {\n      type: \"sign-in\",\n      ...common,\n      ...(returnTo !== undefined ? { returnTo } : {}),\n    };\n  }\n  if (parts[0] === \"pages\" && parts[1] && parts.length === 2) {\n    return {\n      type: \"content-page\",\n      ...common,\n      slug: segment(parts, 1),\n    };\n  }\n  if (parts[0] === \"account\" && parts.length <= 2) {\n    const pages = {\n      \"payment-methods\": \"payment-methods\",\n      transactions: \"transactions\",\n      \"store-credit\": \"add-store-credit\",\n    } as const;\n    if (parts.length === 1) {\n      return { type: \"profile\", page: \"edit\", state };\n    }\n    const page = parts[1];\n    if (page && Object.hasOwn(pages, page)) {\n      return {\n        type: \"profile\",\n        page: pages[page as keyof typeof pages],\n        state,\n      };\n    }\n  }\n  return null;\n};\n\nexport const parseV2 = (\n  input: StorefrontUrlInput,\n  options: StorefrontUrlOptions & { installation: StorefrontInstallation },\n): StorefrontRoute => {\n  try {\n    const url = inputUrl(input);\n    const state = pageState(url);\n    const installation = options.installation;\n    const route = canonical(url, state, installation.business);\n    return canonicalRoute(route ?? parseV1(input, options), installation);\n  } catch {\n    return { type: \"unknown\", pathname: \"\", state: { query: {} } };\n  }\n};\n"],
+  "mappings": ";AAAA,SAAS,sBAAsB;AAC/B,SAAS,sBAAsB;AAC/B,SAAS,gBAAgB,eAAe;AACxC,SAAS,eAAe;AAQxB,SAAS,UAAU,iBAAiB;AAEpC,IAAM,YAAY,CAChB,KACA,OACA,aAC2B;AAC3B,QAAM,WAAW,eAAe,IAAI,QAAQ;AAC5C,QAAM,QAAQ,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO;AAChD,QAAM,SAAS,IAAI,aAAa,IAAI,QAAQ;AAC5C,QAAM,SAAS,EAAE,UAAU,GAAI,WAAW,OAAO,EAAE,OAAO,IAAI,CAAC,GAAI,MAAM;AACzE,MAAI,aAAa,KAAK;AACpB,WAAO,EAAE,MAAM,cAAc,GAAG,OAAO;AAAA,EACzC;AACA,MAAI,MAAM,CAAC,MAAM,UAAU,MAAM,CAAC,KAAK,MAAM,WAAW,GAAG;AACzD,WAAO;AAAA,MACL,MAAM;AAAA,MACN,GAAG;AAAA,MACH,MAAM,QAAQ,OAAO,CAAC;AAAA,IACxB;AAAA,EACF;AACA,MAAI,aAAa,WAAW,aAAa,aAAa;AACpD,WAAO;AAAA,MACL,MAAM,aAAa,UAAU,SAAS;AAAA,MACtC,GAAG;AAAA,IACL;AAAA,EACF;AACA,MAAI,aAAa,oBAAoB;AACnC,UAAM,UAAU,IAAI,aAAa,IAAI,SAAS;AAC9C,WAAO;AAAA,MACL,MAAM;AAAA,MACN,GAAG;AAAA,MACH,GAAI,YAAY,OAAO,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxC;AAAA,EACF;AACA,MAAI,aAAa,YAAY;AAE3B,UAAM,WAAW,eAAe,IAAI,aAAa,IAAI,QAAQ,CAAC;AAC9D,WAAO;AAAA,MACL,MAAM;AAAA,MACN,GAAG;AAAA,MACH,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,IAC/C;AAAA,EACF;AACA,MAAI,MAAM,CAAC,MAAM,WAAW,MAAM,CAAC,KAAK,MAAM,WAAW,GAAG;AAC1D,WAAO;AAAA,MACL,MAAM;AAAA,MACN,GAAG;AAAA,MACH,MAAM,QAAQ,OAAO,CAAC;AAAA,IACxB;AAAA,EACF;AACA,MAAI,MAAM,CAAC,MAAM,aAAa,MAAM,UAAU,GAAG;AAC/C,UAAM,QAAQ;AAAA,MACZ,mBAAmB;AAAA,MACnB,cAAc;AAAA,MACd,gBAAgB;AAAA,IAClB;AACA,QAAI,MAAM,WAAW,GAAG;AACtB,aAAO,EAAE,MAAM,WAAW,MAAM,QAAQ,MAAM;AAAA,IAChD;AACA,UAAM,OAAO,MAAM,CAAC;AACpB,QAAI,QAAQ,OAAO,OAAO,OAAO,IAAI,GAAG;AACtC,aAAO;AAAA,QACL,MAAM;AAAA,QACN,MAAM,MAAM,IAA0B;AAAA,QACtC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEO,IAAM,UAAU,CACrB,OACA,YACoB;AACpB,MAAI;AACF,UAAM,MAAM,SAAS,KAAK;AAC1B,UAAM,QAAQ,UAAU,GAAG;AAC3B,UAAM,eAAe,QAAQ;AAC7B,UAAM,QAAQ,UAAU,KAAK,OAAO,aAAa,QAAQ;AACzD,WAAO,eAAe,SAAS,QAAQ,OAAO,OAAO,GAAG,YAAY;AAAA,EACtE,QAAQ;AACN,WAAO,EAAE,MAAM,WAAW,UAAU,IAAI,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE;AAAA,EAC/D;AACF;",
   "names": []
 }

package/dist/server/storefront-url/url.js

@@ -20,7 +20,9 @@ var inputUrl = (input) => {
   const value = typeof input === "string" ? input : input.url;
   return new URL(value, FALLBACK_ORIGIN);
 };
-var isAttributionKey = (key) => /^utm_|^(ref|\w*c..?id|.?braid|li_fat_id)$/.test(key);
+var isAttributionKey = (key) => /^utm_|^(ref|(fb|g|d|tt|tw)clid|msclkid|[gw]braid|li_fat_id|ScCid)$/.test(
+  key
+);
 var queryRecord = (params, contract) => {
   const allowed = contract === "v2" ? STOREFRONT_QUERY_PARAMETERS : STOREFRONT_V1_QUERY_PARAMETERS;
   return Object.fromEntries(

package/dist/server/storefront-url/url.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/server/storefront-url/url.ts"],
-  "sourcesContent": ["import {\n  STOREFRONT_QUERY_PARAMETERS,\n  STOREFRONT_V1_QUERY_PARAMETERS,\n  type StorefrontPageState,\n  type StorefrontUrlInput,\n} from \"./types\";\n\nexport const FALLBACK_ORIGIN = \"https://storefront.invalid\";\nexport const ITEM_MODAL_PREFIX = \"product_\";\n\nexport const decode = (value: string) => {\n  try {\n    return decodeURIComponent(value);\n  } catch {\n    return value;\n  }\n};\n\nexport const encode = (value: string) => encodeURIComponent(value);\n\nexport const inputUrl = (input: StorefrontUrlInput) => {\n  if (input instanceof URL) {\n    return new URL(input.toString());\n  }\n  const value = typeof input === \"string\" ? input : input.url;\n  return new URL(value, FALLBACK_ORIGIN);\n};\n\nexport const isAttributionKey = (key: string) =>\n  /^utm_|^(ref|\\w*c..?id|.?braid|li_fat_id)$/.test(key);\n\nexport const queryRecord = (params: URLSearchParams, contract: \"v1\" | \"v2\") => {\n  const allowed: readonly string[] =\n    contract === \"v2\"\n      ? STOREFRONT_QUERY_PARAMETERS\n      : STOREFRONT_V1_QUERY_PARAMETERS;\n  return Object.fromEntries(\n    [...params].filter(\n      ([key]) => allowed.includes(key) || isAttributionKey(key),\n    ),\n  );\n};\n\nexport const STATE_FIELDS = {\n  menu_id: \"menuId\",\n  category_id: \"categoryId\",\n  menu_layout: \"menuLayout\",\n  modal_id: \"modalId\",\n  auth_modal_id: \"authModalId\",\n  payment_id: \"paymentId\",\n  lightbox: \"lightbox\",\n  catalogue_search: \"catalogueSearch\",\n  catalogue_categories: \"catalogueCategories\",\n} as const;\n\nexport const pageState = (\n  url: URL,\n  contract: \"v1\" | \"v2\" = \"v2\",\n): StorefrontPageState => {\n  const query = queryRecord(url.searchParams, contract);\n  const state: StorefrontPageState = { query };\n  for (const [key, field] of Object.entries(STATE_FIELDS)) {\n    const value = url.searchParams.get(key);\n    if (value !== null) {\n      state[field] = value;\n    }\n  }\n  const pickup = url.searchParams.get(\"pickup\");\n  if (pickup === \"true\" || pickup === \"false\") {\n    state.mode = pickup === \"true\" ? \"pickup\" : \"delivery\";\n  }\n  if (\n    state.categoryId === undefined &&\n    contract === \"v2\" &&\n    url.hash.startsWith(\"#c-\")\n  ) {\n    state.categoryId = decode(url.hash.slice(3));\n  }\n  return state;\n};\n"],
-  "mappings": ";AAAA;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAEA,IAAM,kBAAkB;AACxB,IAAM,oBAAoB;AAE1B,IAAM,SAAS,CAAC,UAAkB;AACvC,MAAI;AACF,WAAO,mBAAmB,KAAK;AAAA,EACjC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,IAAM,SAAS,CAAC,UAAkB,mBAAmB,KAAK;AAE1D,IAAM,WAAW,CAAC,UAA8B;AACrD,MAAI,iBAAiB,KAAK;AACxB,WAAO,IAAI,IAAI,MAAM,SAAS,CAAC;AAAA,EACjC;AACA,QAAM,QAAQ,OAAO,UAAU,WAAW,QAAQ,MAAM;AACxD,SAAO,IAAI,IAAI,OAAO,eAAe;AACvC;AAEO,IAAM,mBAAmB,CAAC,QAC/B,4CAA4C,KAAK,GAAG;AAE/C,IAAM,cAAc,CAAC,QAAyB,aAA0B;AAC7E,QAAM,UACJ,aAAa,OACT,8BACA;AACN,SAAO,OAAO;AAAA,IACZ,CAAC,GAAG,MAAM,EAAE;AAAA,MACV,CAAC,CAAC,GAAG,MAAM,QAAQ,SAAS,GAAG,KAAK,iBAAiB,GAAG;AAAA,IAC1D;AAAA,EACF;AACF;AAEO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,aAAa;AAAA,EACb,aAAa;AAAA,EACb,UAAU;AAAA,EACV,eAAe;AAAA,EACf,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,kBAAkB;AAAA,EAClB,sBAAsB;AACxB;AAEO,IAAM,YAAY,CACvB,KACA,WAAwB,SACA;AACxB,QAAM,QAAQ,YAAY,IAAI,cAAc,QAAQ;AACpD,QAAM,QAA6B,EAAE,MAAM;AAC3C,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,YAAY,GAAG;AACvD,UAAM,QAAQ,IAAI,aAAa,IAAI,GAAG;AACtC,QAAI,UAAU,MAAM;AAClB,YAAM,KAAK,IAAI;AAAA,IACjB;AAAA,EACF;AACA,QAAM,SAAS,IAAI,aAAa,IAAI,QAAQ;AAC5C,MAAI,WAAW,UAAU,WAAW,SAAS;AAC3C,UAAM,OAAO,WAAW,SAAS,WAAW;AAAA,EAC9C;AACA,MACE,MAAM,eAAe,UACrB,aAAa,QACb,IAAI,KAAK,WAAW,KAAK,GACzB;AACA,UAAM,aAAa,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC;AAAA,EAC7C;AACA,SAAO;AACT;",
+  "sourcesContent": ["import {\n  STOREFRONT_QUERY_PARAMETERS,\n  STOREFRONT_V1_QUERY_PARAMETERS,\n  type StorefrontPageState,\n  type StorefrontUrlInput,\n} from \"./types\";\n\nexport const FALLBACK_ORIGIN = \"https://storefront.invalid\";\nexport const ITEM_MODAL_PREFIX = \"product_\";\n\nexport const decode = (value: string) => {\n  try {\n    return decodeURIComponent(value);\n  } catch {\n    return value;\n  }\n};\n\nexport const encode = (value: string) => encodeURIComponent(value);\n\nexport const inputUrl = (input: StorefrontUrlInput) => {\n  if (input instanceof URL) {\n    return new URL(input.toString());\n  }\n  const value = typeof input === \"string\" ? input : input.url;\n  return new URL(value, FALLBACK_ORIGIN);\n};\n\n// The exact ad click IDs, so an ordinary key such as doc_id or src_id never passes.\nexport const isAttributionKey = (key: string) =>\n  /^utm_|^(ref|(fb|g|d|tt|tw)clid|msclkid|[gw]braid|li_fat_id|ScCid)$/.test(\n    key,\n  );\n\nexport const queryRecord = (params: URLSearchParams, contract: \"v1\" | \"v2\") => {\n  const allowed: readonly string[] =\n    contract === \"v2\"\n      ? STOREFRONT_QUERY_PARAMETERS\n      : STOREFRONT_V1_QUERY_PARAMETERS;\n  return Object.fromEntries(\n    [...params].filter(\n      ([key]) => allowed.includes(key) || isAttributionKey(key),\n    ),\n  );\n};\n\nexport const STATE_FIELDS = {\n  menu_id: \"menuId\",\n  category_id: \"categoryId\",\n  menu_layout: \"menuLayout\",\n  modal_id: \"modalId\",\n  auth_modal_id: \"authModalId\",\n  payment_id: \"paymentId\",\n  lightbox: \"lightbox\",\n  catalogue_search: \"catalogueSearch\",\n  catalogue_categories: \"catalogueCategories\",\n} as const;\n\nexport const pageState = (\n  url: URL,\n  contract: \"v1\" | \"v2\" = \"v2\",\n): StorefrontPageState => {\n  const query = queryRecord(url.searchParams, contract);\n  const state: StorefrontPageState = { query };\n  for (const [key, field] of Object.entries(STATE_FIELDS)) {\n    const value = url.searchParams.get(key);\n    if (value !== null) {\n      state[field] = value;\n    }\n  }\n  const pickup = url.searchParams.get(\"pickup\");\n  if (pickup === \"true\" || pickup === \"false\") {\n    state.mode = pickup === \"true\" ? \"pickup\" : \"delivery\";\n  }\n  if (\n    state.categoryId === undefined &&\n    contract === \"v2\" &&\n    url.hash.startsWith(\"#c-\")\n  ) {\n    state.categoryId = decode(url.hash.slice(3));\n  }\n  return state;\n};\n"],
+  "mappings": ";AAAA;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AAEA,IAAM,kBAAkB;AACxB,IAAM,oBAAoB;AAE1B,IAAM,SAAS,CAAC,UAAkB;AACvC,MAAI;AACF,WAAO,mBAAmB,KAAK;AAAA,EACjC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,IAAM,SAAS,CAAC,UAAkB,mBAAmB,KAAK;AAE1D,IAAM,WAAW,CAAC,UAA8B;AACrD,MAAI,iBAAiB,KAAK;AACxB,WAAO,IAAI,IAAI,MAAM,SAAS,CAAC;AAAA,EACjC;AACA,QAAM,QAAQ,OAAO,UAAU,WAAW,QAAQ,MAAM;AACxD,SAAO,IAAI,IAAI,OAAO,eAAe;AACvC;AAGO,IAAM,mBAAmB,CAAC,QAC/B,qEAAqE;AAAA,EACnE;AACF;AAEK,IAAM,cAAc,CAAC,QAAyB,aAA0B;AAC7E,QAAM,UACJ,aAAa,OACT,8BACA;AACN,SAAO,OAAO;AAAA,IACZ,CAAC,GAAG,MAAM,EAAE;AAAA,MACV,CAAC,CAAC,GAAG,MAAM,QAAQ,SAAS,GAAG,KAAK,iBAAiB,GAAG;AAAA,IAC1D;AAAA,EACF;AACF;AAEO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,aAAa;AAAA,EACb,aAAa;AAAA,EACb,UAAU;AAAA,EACV,eAAe;AAAA,EACf,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,kBAAkB;AAAA,EAClB,sBAAsB;AACxB;AAEO,IAAM,YAAY,CACvB,KACA,WAAwB,SACA;AACxB,QAAM,QAAQ,YAAY,IAAI,cAAc,QAAQ;AACpD,QAAM,QAA6B,EAAE,MAAM;AAC3C,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,YAAY,GAAG;AACvD,UAAM,QAAQ,IAAI,aAAa,IAAI,GAAG;AACtC,QAAI,UAAU,MAAM;AAClB,YAAM,KAAK,IAAI;AAAA,IACjB;AAAA,EACF;AACA,QAAM,SAAS,IAAI,aAAa,IAAI,QAAQ;AAC5C,MAAI,WAAW,UAAU,WAAW,SAAS;AAC3C,UAAM,OAAO,WAAW,SAAS,WAAW;AAAA,EAC9C;AACA,MACE,MAAM,eAAe,UACrB,aAAa,QACb,IAAI,KAAK,WAAW,KAAK,GACzB;AACA,UAAM,aAAa,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC;AAAA,EAC7C;AACA,SAAO;AACT;",
   "names": []
 }

package/dist/site-config/helpers.js

@@ -41,7 +41,7 @@ var globallyAllowed = (value) => GLOBAL_PACKAGE_ALLOWLIST.some(
 function hostname(value) {
   const wildcard = value.startsWith("*.");
   const host = wildcard ? value.slice(2) : value;
-  if (!host.includes(".") || /^\d+(?:\.\d+){3}$/.test(host) || host.length > 253 || host.includes("..")) {
+  if (!host.includes(".") || /^\d+(?:\.\d+){3}$/.test(host) || host.length > 253 || host.includes("..") || wildcard && /^(?:ac|co|com|edu|gov|net|org)\.[^.]+$/i.test(host)) {
     return false;
   }
   return host.split(".").every(

package/dist/site-config/helpers.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/site-config/helpers.ts"],
-  "sourcesContent": ["import { GLOBAL_PACKAGE_ALLOWLIST, type ConfigIssue } from \"./types\";\n\nexport const record = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\nfunction distance(left: string, right: string) {\n  let row = Array.from({ length: right.length + 1 }, (_, index) => index);\n  for (let leftIndex = 1; leftIndex <= left.length; leftIndex += 1) {\n    const next = [leftIndex];\n    for (let rightIndex = 1; rightIndex <= right.length; rightIndex += 1) {\n      next[rightIndex] = Math.min(\n        (next[rightIndex - 1] ?? 0) + 1,\n        (row[rightIndex] ?? 0) + 1,\n        (row[rightIndex - 1] ?? 0) +\n          (left[leftIndex - 1] === right[rightIndex - 1] ? 0 : 1),\n      );\n    }\n    row = next;\n  }\n  return row[right.length] ?? Infinity;\n}\n\nexport function unknownKeys(\n  value: Record<string, unknown>,\n  allowed: readonly string[],\n  path: string,\n  issue: (value: ConfigIssue) => void,\n) {\n  for (const key of Object.keys(value)) {\n    if (allowed.includes(key)) {\n      continue;\n    }\n    const closest = allowed\n      .map((candidate) => ({ candidate, score: distance(key, candidate) }))\n      .sort((left, right) => left.score - right.score)[0];\n    const hint = closest && closest.score <= 2 ? closest.candidate : undefined;\n    issue({\n      path: path ? `${path}.${key}` : key,\n      code: \"unknown_key\",\n      message: hint\n        ? `Unknown field \"${key}\". Rename it to \"${hint}\".`\n        : `Unknown field \"${key}\". Remove it from the configuration.`,\n      severity: \"error\",\n    });\n  }\n}\n\nexport const nonblank = (value: unknown): value is string =>\n  typeof value === \"string\" && value.trim().length > 0;\n\nexport const packageName = (value: string) =>\n  value.length <= 214 &&\n  /^(?:@[a-z0-9][a-z0-9._~-]*\\/[a-z0-9][a-z0-9._~-]*|[a-z0-9][a-z0-9._~-]*)$/.test(\n    value,\n  );\n\nexport const globallyAllowed = (value: string) =>\n  GLOBAL_PACKAGE_ALLOWLIST.some((allowed) =>\n    allowed.endsWith(\"/*\")\n      ? value.startsWith(allowed.slice(0, -1))\n      : value === allowed,\n  );\n\nexport function hostname(value: string) {\n  const wildcard = value.startsWith(\"*.\");\n  const host = wildcard ? value.slice(2) : value;\n  if (\n    !host.includes(\".\") ||\n    /^\\d+(?:\\.\\d+){3}$/.test(host) ||\n    host.length > 253 ||\n    host.includes(\"..\")\n  ) {\n    return false;\n  }\n  return host\n    .split(\".\")\n    .every(\n      (label) =>\n        label.length > 0 &&\n        label.length <= 63 &&\n        /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(label),\n    );\n}\n"],
-  "mappings": ";AAAA,SAAS,gCAAkD;AAEpD,IAAM,SAAS,CAAC,UACrB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAErE,SAAS,SAAS,MAAc,OAAe;AAC7C,MAAI,MAAM,MAAM,KAAK,EAAE,QAAQ,MAAM,SAAS,EAAE,GAAG,CAAC,GAAG,UAAU,KAAK;AACtE,WAAS,YAAY,GAAG,aAAa,KAAK,QAAQ,aAAa,GAAG;AAChE,UAAM,OAAO,CAAC,SAAS;AACvB,aAAS,aAAa,GAAG,cAAc,MAAM,QAAQ,cAAc,GAAG;AACpE,WAAK,UAAU,IAAI,KAAK;AAAA,SACrB,KAAK,aAAa,CAAC,KAAK,KAAK;AAAA,SAC7B,IAAI,UAAU,KAAK,KAAK;AAAA,SACxB,IAAI,aAAa,CAAC,KAAK,MACrB,KAAK,YAAY,CAAC,MAAM,MAAM,aAAa,CAAC,IAAI,IAAI;AAAA,MACzD;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACA,SAAO,IAAI,MAAM,MAAM,KAAK;AAC9B;AAEO,SAAS,YACd,OACA,SACA,MACA,OACA;AACA,aAAW,OAAO,OAAO,KAAK,KAAK,GAAG;AACpC,QAAI,QAAQ,SAAS,GAAG,GAAG;AACzB;AAAA,IACF;AACA,UAAM,UAAU,QACb,IAAI,CAAC,eAAe,EAAE,WAAW,OAAO,SAAS,KAAK,SAAS,EAAE,EAAE,EACnE,KAAK,CAAC,MAAM,UAAU,KAAK,QAAQ,MAAM,KAAK,EAAE,CAAC;AACpD,UAAM,OAAO,WAAW,QAAQ,SAAS,IAAI,QAAQ,YAAY;AACjE,UAAM;AAAA,MACJ,MAAM,OAAO,GAAG,IAAI,IAAI,GAAG,KAAK;AAAA,MAChC,MAAM;AAAA,MACN,SAAS,OACL,kBAAkB,GAAG,oBAAoB,IAAI,OAC7C,kBAAkB,GAAG;AAAA,MACzB,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACF;AAEO,IAAM,WAAW,CAAC,UACvB,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS;AAE9C,IAAM,cAAc,CAAC,UAC1B,MAAM,UAAU,OAChB,4EAA4E;AAAA,EAC1E;AACF;AAEK,IAAM,kBAAkB,CAAC,UAC9B,yBAAyB;AAAA,EAAK,CAAC,YAC7B,QAAQ,SAAS,IAAI,IACjB,MAAM,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC,IACrC,UAAU;AAChB;AAEK,SAAS,SAAS,OAAe;AACtC,QAAM,WAAW,MAAM,WAAW,IAAI;AACtC,QAAM,OAAO,WAAW,MAAM,MAAM,CAAC,IAAI;AACzC,MACE,CAAC,KAAK,SAAS,GAAG,KAClB,oBAAoB,KAAK,IAAI,KAC7B,KAAK,SAAS,OACd,KAAK,SAAS,IAAI,GAClB;AACA,WAAO;AAAA,EACT;AACA,SAAO,KACJ,MAAM,GAAG,EACT;AAAA,IACC,CAAC,UACC,MAAM,SAAS,KACf,MAAM,UAAU,MAChB,qCAAqC,KAAK,KAAK;AAAA,EACnD;AACJ;",
+  "sourcesContent": ["import { GLOBAL_PACKAGE_ALLOWLIST, type ConfigIssue } from \"./types\";\n\nexport const record = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\nfunction distance(left: string, right: string) {\n  let row = Array.from({ length: right.length + 1 }, (_, index) => index);\n  for (let leftIndex = 1; leftIndex <= left.length; leftIndex += 1) {\n    const next = [leftIndex];\n    for (let rightIndex = 1; rightIndex <= right.length; rightIndex += 1) {\n      next[rightIndex] = Math.min(\n        (next[rightIndex - 1] ?? 0) + 1,\n        (row[rightIndex] ?? 0) + 1,\n        (row[rightIndex - 1] ?? 0) +\n          (left[leftIndex - 1] === right[rightIndex - 1] ? 0 : 1),\n      );\n    }\n    row = next;\n  }\n  return row[right.length] ?? Infinity;\n}\n\nexport function unknownKeys(\n  value: Record<string, unknown>,\n  allowed: readonly string[],\n  path: string,\n  issue: (value: ConfigIssue) => void,\n) {\n  for (const key of Object.keys(value)) {\n    if (allowed.includes(key)) {\n      continue;\n    }\n    const closest = allowed\n      .map((candidate) => ({ candidate, score: distance(key, candidate) }))\n      .sort((left, right) => left.score - right.score)[0];\n    const hint = closest && closest.score <= 2 ? closest.candidate : undefined;\n    issue({\n      path: path ? `${path}.${key}` : key,\n      code: \"unknown_key\",\n      message: hint\n        ? `Unknown field \"${key}\". Rename it to \"${hint}\".`\n        : `Unknown field \"${key}\". Remove it from the configuration.`,\n      severity: \"error\",\n    });\n  }\n}\n\nexport const nonblank = (value: unknown): value is string =>\n  typeof value === \"string\" && value.trim().length > 0;\n\nexport const packageName = (value: string) =>\n  value.length <= 214 &&\n  /^(?:@[a-z0-9][a-z0-9._~-]*\\/[a-z0-9][a-z0-9._~-]*|[a-z0-9][a-z0-9._~-]*)$/.test(\n    value,\n  );\n\nexport const globallyAllowed = (value: string) =>\n  GLOBAL_PACKAGE_ALLOWLIST.some((allowed) =>\n    allowed.endsWith(\"/*\")\n      ? value.startsWith(allowed.slice(0, -1))\n      : value === allowed,\n  );\n\nexport function hostname(value: string) {\n  const wildcard = value.startsWith(\"*.\");\n  const host = wildcard ? value.slice(2) : value;\n  if (\n    !host.includes(\".\") ||\n    /^\\d+(?:\\.\\d+){3}$/.test(host) ||\n    host.length > 253 ||\n    host.includes(\"..\") ||\n    (wildcard && /^(?:ac|co|com|edu|gov|net|org)\\.[^.]+$/i.test(host))\n  ) {\n    return false;\n  }\n  return host\n    .split(\".\")\n    .every(\n      (label) =>\n        label.length > 0 &&\n        label.length <= 63 &&\n        /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(label),\n    );\n}\n"],
+  "mappings": ";AAAA,SAAS,gCAAkD;AAEpD,IAAM,SAAS,CAAC,UACrB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAErE,SAAS,SAAS,MAAc,OAAe;AAC7C,MAAI,MAAM,MAAM,KAAK,EAAE,QAAQ,MAAM,SAAS,EAAE,GAAG,CAAC,GAAG,UAAU,KAAK;AACtE,WAAS,YAAY,GAAG,aAAa,KAAK,QAAQ,aAAa,GAAG;AAChE,UAAM,OAAO,CAAC,SAAS;AACvB,aAAS,aAAa,GAAG,cAAc,MAAM,QAAQ,cAAc,GAAG;AACpE,WAAK,UAAU,IAAI,KAAK;AAAA,SACrB,KAAK,aAAa,CAAC,KAAK,KAAK;AAAA,SAC7B,IAAI,UAAU,KAAK,KAAK;AAAA,SACxB,IAAI,aAAa,CAAC,KAAK,MACrB,KAAK,YAAY,CAAC,MAAM,MAAM,aAAa,CAAC,IAAI,IAAI;AAAA,MACzD;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACA,SAAO,IAAI,MAAM,MAAM,KAAK;AAC9B;AAEO,SAAS,YACd,OACA,SACA,MACA,OACA;AACA,aAAW,OAAO,OAAO,KAAK,KAAK,GAAG;AACpC,QAAI,QAAQ,SAAS,GAAG,GAAG;AACzB;AAAA,IACF;AACA,UAAM,UAAU,QACb,IAAI,CAAC,eAAe,EAAE,WAAW,OAAO,SAAS,KAAK,SAAS,EAAE,EAAE,EACnE,KAAK,CAAC,MAAM,UAAU,KAAK,QAAQ,MAAM,KAAK,EAAE,CAAC;AACpD,UAAM,OAAO,WAAW,QAAQ,SAAS,IAAI,QAAQ,YAAY;AACjE,UAAM;AAAA,MACJ,MAAM,OAAO,GAAG,IAAI,IAAI,GAAG,KAAK;AAAA,MAChC,MAAM;AAAA,MACN,SAAS,OACL,kBAAkB,GAAG,oBAAoB,IAAI,OAC7C,kBAAkB,GAAG;AAAA,MACzB,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACF;AAEO,IAAM,WAAW,CAAC,UACvB,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS;AAE9C,IAAM,cAAc,CAAC,UAC1B,MAAM,UAAU,OAChB,4EAA4E;AAAA,EAC1E;AACF;AAEK,IAAM,kBAAkB,CAAC,UAC9B,yBAAyB;AAAA,EAAK,CAAC,YAC7B,QAAQ,SAAS,IAAI,IACjB,MAAM,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC,IACrC,UAAU;AAChB;AAEK,SAAS,SAAS,OAAe;AACtC,QAAM,WAAW,MAAM,WAAW,IAAI;AACtC,QAAM,OAAO,WAAW,MAAM,MAAM,CAAC,IAAI;AACzC,MACE,CAAC,KAAK,SAAS,GAAG,KAClB,oBAAoB,KAAK,IAAI,KAC7B,KAAK,SAAS,OACd,KAAK,SAAS,IAAI,KACjB,YAAY,0CAA0C,KAAK,IAAI,GAChE;AACA,WAAO;AAAA,EACT;AACA,SAAO,KACJ,MAAM,GAAG,EACT;AAAA,IACC,CAAC,UACC,MAAM,SAAS,KACf,MAAM,UAAU,MAChB,qCAAqC,KAAK,KAAK;AAAA,EACnD;AACJ;",
   "names": []
 }

package/dist/site-config/types.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/site-config/types.ts"],
-  "sourcesContent": ["/**\n * Default site budgets: 200 KB gzipped JavaScript, 50 KB gzipped CSS and 2500 ms LCP.\n */\nexport const DEFAULT_BUDGETS = {\n  jsKbGz: 200,\n  cssKbGz: 50,\n  lcpMs: 2500,\n} as const;\n\n/**\n * Package names and patterns allowed globally without a site-specific allowlist entry.\n */\nexport const GLOBAL_PACKAGE_ALLOWLIST = [\n  \"react\",\n  \"react-dom\",\n  \"react-router\",\n  \"@react-router/*\",\n  \"@zappie/*\",\n  \"tailwindcss\",\n  \"@tailwindcss/*\",\n  \"clsx\",\n  \"tailwind-merge\",\n  \"class-variance-authority\",\n  \"lucide-react\",\n  \"date-fns\",\n  \"embla-carousel-react\",\n  \"framer-motion/motion\",\n  \"zod\",\n  \"@radix-ui/*\",\n  \"sonner\",\n  \"vaul\",\n] as const;\n\n/**\n * The store, theme and optional build policies you export from zappie.config.ts.\n */\nexport type ZappieSiteConfig = {\n  store: string;\n  branches?: string[];\n  theme: string;\n  prerender?: string[];\n  menu?: { hiddenCategories?: string[] };\n  packages?: { allow?: string[] };\n  /** Time-bounded acknowledgements for advisories that have no fixed version. */\n  audit?: {\n    ignore?: { id: string; reason: string; until: string }[];\n  };\n  outbound?: { allow?: string[] };\n  /** Each budget left out uses DEFAULT_BUDGETS. */\n  budgets?: {\n    jsKbGz?: number;\n    cssKbGz?: number;\n    lcpMs?: number;\n    override?: { reason: string };\n  };\n  /** Records explained exceptions to storefront readiness checks. */\n  readiness?: {\n    /** Lets this site skip the initial route discovery requirement. */\n    routeDiscovery?: {\n      /** Explains why this site does not use initial route discovery. */\n      optOut: {\n        /** States the constraint that prevents initial route discovery. */\n        reason: string;\n      };\n    };\n  };\n  analytics?: { forward?: { ga4?: string; metaPixel?: string } };\n};\n\n/**\n * A configuration diagnostic with its field path, stable code, message and severity.\n */\nexport type ConfigIssue = {\n  path: string;\n  code:\n    | \"invalid_type\"\n    | \"missing_required\"\n    | \"unknown_key\"\n    | \"invalid_format\"\n    | \"duplicate\"\n    | \"redundant_allowlist\"\n    | \"budget_override\";\n  message: string;\n  severity: \"error\" | \"warning\";\n};\n\n/**\n * Configuration validation results. Warnings alone do not make valid false.\n */\nexport type ConfigValidation = { valid: boolean; issues: ConfigIssue[] };\n"],
+  "sourcesContent": ["/**\n * Default site budgets: 200 KB gzipped JavaScript, 50 KB gzipped CSS and 2500 ms LCP.\n */\nexport const DEFAULT_BUDGETS = {\n  jsKbGz: 200,\n  cssKbGz: 50,\n  lcpMs: 2500,\n} as const;\n\n/**\n * Package names and patterns allowed globally without a site-specific allowlist entry.\n */\nexport const GLOBAL_PACKAGE_ALLOWLIST = [\n  \"react\",\n  \"react-dom\",\n  \"react-router\",\n  \"@react-router/*\",\n  \"@zappie/*\",\n  \"tailwindcss\",\n  \"@tailwindcss/*\",\n  \"clsx\",\n  \"tailwind-merge\",\n  \"class-variance-authority\",\n  \"lucide-react\",\n  \"date-fns\",\n  \"embla-carousel-react\",\n  \"framer-motion/motion\",\n  \"zod\",\n  \"@radix-ui/*\",\n  \"sonner\",\n  \"vaul\",\n] as const;\n\n/**\n * The store, theme and optional build policies you export from zappie.config.ts.\n */\nexport type ZappieSiteConfig = {\n  store: string;\n  branches?: string[];\n  theme: string;\n  prerender?: string[];\n  menu?: { hiddenCategories?: string[] };\n  packages?: { allow?: string[] };\n  /** Time-bounded acknowledgements for advisories that have no fixed version. */\n  audit?: {\n    ignore?: { id: string; reason: string; until: string }[];\n  };\n  outbound?: { allow?: string[] };\n  /** Add sources to the fixed storefront Content Security Policy. */\n  security?: {\n    csp?: {\n      imgSrc?: string[];\n      connectSrc?: string[];\n      fontSrc?: string[];\n      styleSrc?: string[];\n      frameSrc?: string[];\n    };\n  };\n  /** Each budget left out uses DEFAULT_BUDGETS. */\n  budgets?: {\n    jsKbGz?: number;\n    cssKbGz?: number;\n    lcpMs?: number;\n    override?: { reason: string };\n  };\n  /** Records explained exceptions to storefront readiness checks. */\n  readiness?: {\n    /** Lets this site skip the initial route discovery requirement. */\n    routeDiscovery?: {\n      /** Explains why this site does not use initial route discovery. */\n      optOut: {\n        /** States the constraint that prevents initial route discovery. */\n        reason: string;\n      };\n    };\n  };\n  analytics?: { forward?: { ga4?: string; metaPixel?: string } };\n};\n\n/**\n * A configuration diagnostic with its field path, stable code, message and severity.\n */\nexport type ConfigIssue = {\n  path: string;\n  code:\n    | \"invalid_type\"\n    | \"missing_required\"\n    | \"unknown_key\"\n    | \"invalid_format\"\n    | \"duplicate\"\n    | \"redundant_allowlist\"\n    | \"budget_override\";\n  message: string;\n  severity: \"error\" | \"warning\";\n};\n\n/**\n * Configuration validation results. Warnings alone do not make valid false.\n */\nexport type ConfigValidation = { valid: boolean; issues: ConfigIssue[] };\n"],
   "mappings": ";AAGO,IAAM,kBAAkB;AAAA,EAC7B,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,OAAO;AACT;AAKO,IAAM,2BAA2B;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;",
   "names": []
 }

package/dist/site-config/validate.js

@@ -17,6 +17,7 @@ var rootKeys = [
   "packages",
   "audit",
   "outbound",
+  "security",
   "budgets",
   "readiness",
   "analytics"
@@ -70,16 +71,20 @@ function validateConfig(input) {
     });
   });
   nested(input.outbound, "outbound", ["allow"], issue, (value) => {
-    const allow = stringList(value.allow, "outbound.allow", error);
-    allow?.forEach((host, index) => {
-      if (!hostname(host)) {
-        error(
-          `outbound.allow[${index}]`,
-          "invalid_format",
-          "Expected a hostname or leading *. subdomain pattern without a scheme, path, port or IP. Use a value such as api.example.com."
-        );
+    hostList(value.allow, "outbound.allow", error);
+  });
+  nested(input.security, "security", ["csp"], issue, (security) => {
+    nested(
+      security.csp,
+      "security.csp",
+      ["imgSrc", "connectSrc", "fontSrc", "styleSrc", "frameSrc"],
+      issue,
+      (csp) => {
+        for (const [name, value] of Object.entries(csp)) {
+          hostList(value, `security.csp.${name}`, error);
+        }
       }
-    });
+    );
   });
   budgets(input.budgets, issue, error);
   nested(
@@ -180,6 +185,17 @@ function stringList(value, path, error, options = {}) {
   }
   return value;
 }
+function hostList(value, path, error) {
+  stringList(value, path, error)?.forEach((host, index) => {
+    if (!hostname(host)) {
+      error(
+        `${path}[${index}]`,
+        "invalid_format",
+        "Expected a hostname or leading *. subdomain pattern without a scheme, path, port or IP. Use a value such as api.example.com."
+      );
+    }
+  });
+}
 function paths(value, error) {
   const values = stringList(value, "prerender", error, { unique: true });
   values?.forEach((path, index) => {