@zappie/sdk 0.1.13 → 0.1.14

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @zappie/sdk
 
+## 0.1.14
+
+### Patch Changes
+
+- 5a2bce9: Verify can start somewhere other than `/`, for a site whose root is a directory of its menus. Set `verify.startPath` in `zappie.config.ts`, or pass `startPath` to `verify()` or `verifyProject()`. Every check that opened `/` as the menu opens that route instead. Set `verify.cataloguePath`, such as `/menu?menu={menu}`, when each menu has its own page: V03 then needs 95% of each menu's available items on that menu's page, instead of 95% of the branch's items on one page, and the checks that use an item open the page of a menu that holds it. A route must start with one `/` and contain no backslash. A site that sets neither runs as before. The report's `environment` records `startPath`, and `cataloguePath` when it is set. When `--store` is passed and `zappie.config.ts` exists but can't be read, the report's `warnings` says its verify settings were ignored. The `@zappie/sdk` site config and `zappie check` accept the `verify` settings, so a site that adds them needs `@zappie/sdk` 0.1.14 and `@zappie/check` 0.2.4 in the same change. This is a minor release, so a regression comparison doesn't compare these reports with reports from 0.2.
+
 ## 0.1.13
 
 ### Patch Changes

package/dist/config/index.d.ts

@@ -71,6 +71,16 @@ type ZappieSiteConfig = {
             metaPixel?: string;
         };
     };
+    /** Where `zappie verify` opens the storefront and finds each catalogue. */
+    verify?: {
+        /** The route verify opens as the menu, such as /menu. It must list items. Defaults to /. */
+        startPath?: string;
+        /**
+         * The page for each menu, with `{menu}` where its id goes and, optionally, `{branch}` for the
+         * branch id, such as `/menu?menu={menu}`. Verify then judges each menu on its own page.
+         */
+        cataloguePath?: string;
+    };
 };
 /**
  * A configuration diagnostic with its field path, stable code, message and severity.

package/dist/debug.js

@@ -1,5 +1,5 @@
 // src/debug.ts
-var VERSION = true ? "0.1.13" : "0.0.0-development";
+var VERSION = true ? "0.1.14" : "0.0.0-development";
 function installDebug(client) {
   if (typeof window === "undefined" || client.mode !== "test") {
     return;

package/dist/index.js

@@ -10,7 +10,7 @@ import { ZappieError, isZappieError } from "./errors.js";
 export * from "./models.js";
 import { format, money } from "./money.js";
 import { RestTransport } from "./transport/rest.js";
-var VERSION = true ? "0.1.13" : "0.0.0-development";
+var VERSION = true ? "0.1.14" : "0.0.0-development";
 export {
   API_VERSION,
   RestTransport,

package/dist/server/index.d.ts

@@ -223,6 +223,16 @@ type ZappieSiteConfig = {
             metaPixel?: string;
         };
     };
+    /** Where `zappie verify` opens the storefront and finds each catalogue. */
+    verify?: {
+        /** The route verify opens as the menu, such as /menu. It must list items. Defaults to /. */
+        startPath?: string;
+        /**
+         * The page for each menu, with `{menu}` where its id goes and, optionally, `{branch}` for the
+         * branch id, such as `/menu?menu={menu}`. Verify then judges each menu on its own page.
+         */
+        cataloguePath?: string;
+    };
 };
 
 /** Inputs for a storefront document's report-only security headers. */

package/dist/site-config/types.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/site-config/types.ts"],
-  "sourcesContent": ["/**\n * Default site budgets: 200 KB gzipped JavaScript, 50 KB gzipped CSS and 2500 ms LCP.\n */\nexport const DEFAULT_BUDGETS = {\n  jsKbGz: 200,\n  cssKbGz: 50,\n  lcpMs: 2500,\n} as const;\n\n/**\n * Package names and patterns allowed globally without a site-specific allowlist entry.\n */\nexport const GLOBAL_PACKAGE_ALLOWLIST = [\n  \"react\",\n  \"react-dom\",\n  \"react-router\",\n  \"@react-router/*\",\n  \"@zappie/*\",\n  \"tailwindcss\",\n  \"@tailwindcss/*\",\n  \"clsx\",\n  \"tailwind-merge\",\n  \"class-variance-authority\",\n  \"lucide-react\",\n  \"date-fns\",\n  \"embla-carousel-react\",\n  \"framer-motion/motion\",\n  \"zod\",\n  \"@radix-ui/*\",\n  \"sonner\",\n  \"vaul\",\n] as const;\n\n/**\n * The store, theme and optional build policies you export from zappie.config.ts.\n */\nexport type ZappieSiteConfig = {\n  store: string;\n  branches?: string[];\n  theme: string;\n  prerender?: string[];\n  menu?: { hiddenCategories?: string[] };\n  packages?: { allow?: string[] };\n  /** Time-bounded acknowledgements for advisories that have no fixed version. */\n  audit?: {\n    ignore?: { id: string; reason: string; until: string }[];\n  };\n  outbound?: { allow?: string[] };\n  /** Add sources to the fixed storefront Content Security Policy. */\n  security?: {\n    csp?: {\n      imgSrc?: string[];\n      connectSrc?: string[];\n      fontSrc?: string[];\n      styleSrc?: string[];\n      frameSrc?: string[];\n    };\n  };\n  /** Each budget left out uses DEFAULT_BUDGETS. */\n  budgets?: {\n    jsKbGz?: number;\n    cssKbGz?: number;\n    lcpMs?: number;\n    override?: { reason: string };\n  };\n  /** Records explained exceptions to storefront readiness checks. */\n  readiness?: {\n    /** Lets this site skip the initial route discovery requirement. */\n    routeDiscovery?: {\n      /** Explains why this site does not use initial route discovery. */\n      optOut: {\n        /** States the constraint that prevents initial route discovery. */\n        reason: string;\n      };\n    };\n  };\n  analytics?: { forward?: { ga4?: string; metaPixel?: string } };\n};\n\n/**\n * A configuration diagnostic with its field path, stable code, message and severity.\n */\nexport type ConfigIssue = {\n  path: string;\n  code:\n    | \"invalid_type\"\n    | \"missing_required\"\n    | \"unknown_key\"\n    | \"invalid_format\"\n    | \"duplicate\"\n    | \"redundant_allowlist\"\n    | \"budget_override\";\n  message: string;\n  severity: \"error\" | \"warning\";\n};\n\n/**\n * Configuration validation results. Warnings alone do not make valid false.\n */\nexport type ConfigValidation = { valid: boolean; issues: ConfigIssue[] };\n"],
+  "sourcesContent": ["/**\n * Default site budgets: 200 KB gzipped JavaScript, 50 KB gzipped CSS and 2500 ms LCP.\n */\nexport const DEFAULT_BUDGETS = {\n  jsKbGz: 200,\n  cssKbGz: 50,\n  lcpMs: 2500,\n} as const;\n\n/**\n * Package names and patterns allowed globally without a site-specific allowlist entry.\n */\nexport const GLOBAL_PACKAGE_ALLOWLIST = [\n  \"react\",\n  \"react-dom\",\n  \"react-router\",\n  \"@react-router/*\",\n  \"@zappie/*\",\n  \"tailwindcss\",\n  \"@tailwindcss/*\",\n  \"clsx\",\n  \"tailwind-merge\",\n  \"class-variance-authority\",\n  \"lucide-react\",\n  \"date-fns\",\n  \"embla-carousel-react\",\n  \"framer-motion/motion\",\n  \"zod\",\n  \"@radix-ui/*\",\n  \"sonner\",\n  \"vaul\",\n] as const;\n\n/**\n * The store, theme and optional build policies you export from zappie.config.ts.\n */\nexport type ZappieSiteConfig = {\n  store: string;\n  branches?: string[];\n  theme: string;\n  prerender?: string[];\n  menu?: { hiddenCategories?: string[] };\n  packages?: { allow?: string[] };\n  /** Time-bounded acknowledgements for advisories that have no fixed version. */\n  audit?: {\n    ignore?: { id: string; reason: string; until: string }[];\n  };\n  outbound?: { allow?: string[] };\n  /** Add sources to the fixed storefront Content Security Policy. */\n  security?: {\n    csp?: {\n      imgSrc?: string[];\n      connectSrc?: string[];\n      fontSrc?: string[];\n      styleSrc?: string[];\n      frameSrc?: string[];\n    };\n  };\n  /** Each budget left out uses DEFAULT_BUDGETS. */\n  budgets?: {\n    jsKbGz?: number;\n    cssKbGz?: number;\n    lcpMs?: number;\n    override?: { reason: string };\n  };\n  /** Records explained exceptions to storefront readiness checks. */\n  readiness?: {\n    /** Lets this site skip the initial route discovery requirement. */\n    routeDiscovery?: {\n      /** Explains why this site does not use initial route discovery. */\n      optOut: {\n        /** States the constraint that prevents initial route discovery. */\n        reason: string;\n      };\n    };\n  };\n  analytics?: { forward?: { ga4?: string; metaPixel?: string } };\n  /** Where `zappie verify` opens the storefront and finds each catalogue. */\n  verify?: {\n    /** The route verify opens as the menu, such as /menu. It must list items. Defaults to /. */\n    startPath?: string;\n    /**\n     * The page for each menu, with `{menu}` where its id goes and, optionally, `{branch}` for the\n     * branch id, such as `/menu?menu={menu}`. Verify then judges each menu on its own page.\n     */\n    cataloguePath?: string;\n  };\n};\n\n/**\n * A configuration diagnostic with its field path, stable code, message and severity.\n */\nexport type ConfigIssue = {\n  path: string;\n  code:\n    | \"invalid_type\"\n    | \"missing_required\"\n    | \"unknown_key\"\n    | \"invalid_format\"\n    | \"duplicate\"\n    | \"redundant_allowlist\"\n    | \"budget_override\";\n  message: string;\n  severity: \"error\" | \"warning\";\n};\n\n/**\n * Configuration validation results. Warnings alone do not make valid false.\n */\nexport type ConfigValidation = { valid: boolean; issues: ConfigIssue[] };\n"],
   "mappings": ";AAGO,IAAM,kBAAkB;AAAA,EAC7B,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,OAAO;AACT;AAKO,IAAM,2BAA2B;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;",
   "names": []
 }

package/dist/site-config/validate.js

@@ -20,7 +20,8 @@ var rootKeys = [
   "security",
   "budgets",
   "readiness",
-  "analytics"
+  "analytics",
+  "verify"
 ];
 function validateConfig(input) {
   const issues = [];
@@ -40,14 +41,30 @@ function validateConfig(input) {
     };
   }
   unknownKeys(input, rootKeys, "", issue);
-  requiredSlug(input.store, "store", error);
+  if (!nonblank(input.store)) {
+    error(
+      "store",
+      input.store === void 0 ? "missing_required" : "invalid_type",
+      "Expected a non-empty storefront slug. Set store to the slug used by createZappie()."
+    );
+  }
   theme(input.theme, error);
   stringList(input.branches, "branches", error, {
     nonempty: true,
     unique: true,
     slug: true
   });
-  paths(input.prerender, error);
+  stringList(input.prerender, "prerender", error, { unique: true })?.forEach(
+    (path, index) => {
+      if (!path.startsWith("/")) {
+        error(
+          `prerender[${index}]`,
+          "invalid_format",
+          "Expected a route starting with /. Prefix the route with /."
+        );
+      }
+    }
+  );
   nested(input.menu, "menu", ["hiddenCategories"], issue, (value) => {
     stringList(value.hiddenCategories, "menu.hiddenCategories", error);
   });
@@ -119,20 +136,19 @@ function validateConfig(input) {
     }
   );
   analytics(input.analytics, issue, error);
+  nested(
+    input.verify,
+    "verify",
+    ["startPath", "cataloguePath"],
+    issue,
+    () => {
+    }
+  );
   return {
     valid: !issues.some((entry) => entry.severity === "error"),
     issues
   };
 }
-function requiredSlug(value, path, error) {
-  if (!nonblank(value)) {
-    error(
-      path,
-      value === void 0 ? "missing_required" : "invalid_type",
-      `Expected a non-empty storefront slug. Set ${path} to the slug used by createZappie().`
-    );
-  }
-}
 function theme(value, error) {
   if (typeof value !== "string") {
     error(
@@ -196,18 +212,6 @@ function hostList(value, path, error) {
     }
   });
 }
-function paths(value, error) {
-  const values = stringList(value, "prerender", error, { unique: true });
-  values?.forEach((path, index) => {
-    if (!path.startsWith("/")) {
-      error(
-        `prerender[${index}]`,
-        "invalid_format",
-        "Expected a route starting with /. Prefix the route with /."
-      );
-    }
-  });
-}
 export {
   validateConfig
 };

package/dist/site-config/validate.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/site-config/validate.ts"],
-  "sourcesContent": ["import {\n  globallyAllowed,\n  hostname,\n  nonblank,\n  packageName,\n  record,\n  unknownKeys,\n} from \"./helpers\";\nimport { analytics, budgets, nested } from \"./sections\";\nimport type { ConfigIssue, ConfigValidation } from \"./types\";\n\nconst rootKeys = [\n  \"store\",\n  \"branches\",\n  \"theme\",\n  \"prerender\",\n  \"menu\",\n  \"packages\",\n  \"audit\",\n  \"outbound\",\n  \"security\",\n  \"budgets\",\n  \"readiness\",\n  \"analytics\",\n] as const;\n\n/**\n * Validate a site configuration and collect errors and warnings without changing it.\n * Checks required fields, unknown keys, allowlists, budgets and analytics settings.\n *\n * @param input - The configuration value to inspect.\n * @returns Diagnostics and a valid flag that is true when there are no errors.\n */\nexport function validateConfig(input: unknown): ConfigValidation {\n  const issues: ConfigIssue[] = [];\n  const issue = (value: ConfigIssue) => issues.push(value);\n  const error = (path: string, code: ConfigIssue[\"code\"], message: string) =>\n    issue({ path, code, message, severity: \"error\" });\n  if (!record(input)) {\n    return {\n      valid: false,\n      issues: [\n        {\n          path: \"$\",\n          code: \"invalid_type\",\n          message:\n            \"Expected a configuration object. Export an object from zappie.config.ts.\",\n          severity: \"error\",\n        },\n      ],\n    };\n  }\n  unknownKeys(input, rootKeys, \"\", issue);\n  requiredSlug(input.store, \"store\", error);\n  theme(input.theme, error);\n  stringList(input.branches, \"branches\", error, {\n    nonempty: true,\n    unique: true,\n    slug: true,\n  });\n  paths(input.prerender, error);\n  nested(input.menu, \"menu\", [\"hiddenCategories\"], issue, (value) => {\n    stringList(value.hiddenCategories, \"menu.hiddenCategories\", error);\n  });\n  nested(input.packages, \"packages\", [\"allow\"], issue, (value) => {\n    const allow = stringList(value.allow, \"packages.allow\", error);\n    allow?.forEach((name, index) => {\n      if (globallyAllowed(name)) {\n        issue({\n          path: `packages.allow[${index}]`,\n          code: \"redundant_allowlist\",\n          message: `${name} is already globally allowed. Remove it from packages.allow.`,\n          severity: \"warning\",\n        });\n      } else if (!packageName(name)) {\n        error(\n          `packages.allow[${index}]`,\n          \"invalid_format\",\n          \"Expected a lowercase npm package name. Use a package name such as lucide-react or @scope/name.\",\n        );\n      }\n    });\n  });\n  nested(input.outbound, \"outbound\", [\"allow\"], issue, (value) => {\n    hostList(value.allow, \"outbound.allow\", error);\n  });\n  nested(input.security, \"security\", [\"csp\"], issue, (security) => {\n    nested(\n      security.csp,\n      \"security.csp\",\n      [\"imgSrc\", \"connectSrc\", \"fontSrc\", \"styleSrc\", \"frameSrc\"],\n      issue,\n      (csp) => {\n        for (const [name, value] of Object.entries(csp)) {\n          hostList(value, `security.csp.${name}`, error);\n        }\n      },\n    );\n  });\n  budgets(input.budgets, issue, error);\n  nested(\n    input.readiness,\n    \"readiness\",\n    [\"routeDiscovery\"],\n    issue,\n    (readiness) => {\n      nested(\n        readiness.routeDiscovery,\n        \"readiness.routeDiscovery\",\n        [\"optOut\"],\n        issue,\n        (routeDiscovery) => {\n          nested(\n            routeDiscovery.optOut,\n            \"readiness.routeDiscovery.optOut\",\n            [\"reason\"],\n            issue,\n            (optOut) => {\n              if (typeof optOut.reason !== \"string\" || !optOut.reason.trim()) {\n                error(\n                  \"readiness.routeDiscovery.optOut.reason\",\n                  \"invalid_format\",\n                  \"Expected a non-blank reason. Explain why the site disables initial route discovery.\",\n                );\n              }\n            },\n          );\n        },\n      );\n    },\n  );\n  analytics(input.analytics, issue, error);\n  return {\n    valid: !issues.some((entry) => entry.severity === \"error\"),\n    issues,\n  };\n}\n\ntype AddError = (\n  path: string,\n  code: ConfigIssue[\"code\"],\n  message: string,\n) => void;\n\nfunction requiredSlug(value: unknown, path: string, error: AddError) {\n  if (!nonblank(value)) {\n    error(\n      path,\n      value === undefined ? \"missing_required\" : \"invalid_type\",\n      `Expected a non-empty storefront slug. Set ${path} to the slug used by createZappie().`,\n    );\n  }\n}\n\nfunction theme(value: unknown, error: AddError) {\n  if (typeof value !== \"string\") {\n    error(\n      \"theme\",\n      value === undefined ? \"missing_required\" : \"invalid_type\",\n      \"Expected a relative .json path. Set theme to a value such as ./theme.json.\",\n    );\n  } else if (\n    !/\\.json$/.test(value) ||\n    /^(?:[a-z][a-z\\d+.-]*:|\\/|\\\\)/i.test(value) ||\n    value.includes(\"\\\\\")\n  ) {\n    error(\n      \"theme\",\n      \"invalid_format\",\n      \"Expected a relative .json path. Use a value such as ./theme.json.\",\n    );\n  }\n}\n\nfunction stringList(\n  value: unknown,\n  path: string,\n  error: AddError,\n  options: { nonempty?: boolean; unique?: boolean; slug?: boolean } = {},\n) {\n  if (value === undefined) {\n    return undefined;\n  }\n  if (\n    !Array.isArray(value) ||\n    value.some((entry) => typeof entry !== \"string\")\n  ) {\n    error(\n      path,\n      \"invalid_type\",\n      `Expected an array of strings. Set ${path} to string values.`,\n    );\n    return undefined;\n  }\n  if (options.nonempty && value.length === 0) {\n    error(\n      path,\n      \"invalid_format\",\n      `Expected at least one value. Add a value to ${path} or remove the field.`,\n    );\n  }\n  value.forEach((entry, index) => {\n    if (options.slug && !nonblank(entry)) {\n      error(\n        `${path}[${index}]`,\n        \"invalid_format\",\n        \"Expected a non-empty branch slug. Remove the empty value or use a branch slug.\",\n      );\n    }\n  });\n  if (options.unique && new Set(value).size !== value.length) {\n    error(\n      path,\n      \"duplicate\",\n      `Expected unique values. Remove duplicates from ${path}.`,\n    );\n  }\n  return value;\n}\n\nfunction hostList(value: unknown, path: string, error: AddError) {\n  stringList(value, path, error)?.forEach((host, index) => {\n    if (!hostname(host)) {\n      error(\n        `${path}[${index}]`,\n        \"invalid_format\",\n        \"Expected a hostname or leading *. subdomain pattern without a scheme, path, port or IP. Use a value such as api.example.com.\",\n      );\n    }\n  });\n}\n\nfunction paths(value: unknown, error: AddError) {\n  const values = stringList(value, \"prerender\", error, { unique: true });\n  values?.forEach((path, index) => {\n    if (!path.startsWith(\"/\")) {\n      error(\n        `prerender[${index}]`,\n        \"invalid_format\",\n        \"Expected a route starting with /. Prefix the route with /.\",\n      );\n    }\n  });\n}\n"],
-  "mappings": ";AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,WAAW,SAAS,cAAc;AAG3C,IAAM,WAAW;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AASO,SAAS,eAAe,OAAkC;AAC/D,QAAM,SAAwB,CAAC;AAC/B,QAAM,QAAQ,CAAC,UAAuB,OAAO,KAAK,KAAK;AACvD,QAAM,QAAQ,CAAC,MAAc,MAA2B,YACtD,MAAM,EAAE,MAAM,MAAM,SAAS,UAAU,QAAQ,CAAC;AAClD,MAAI,CAAC,OAAO,KAAK,GAAG;AAClB,WAAO;AAAA,MACL,OAAO;AAAA,MACP,QAAQ;AAAA,QACN;AAAA,UACE,MAAM;AAAA,UACN,MAAM;AAAA,UACN,SACE;AAAA,UACF,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,cAAY,OAAO,UAAU,IAAI,KAAK;AACtC,eAAa,MAAM,OAAO,SAAS,KAAK;AACxC,QAAM,MAAM,OAAO,KAAK;AACxB,aAAW,MAAM,UAAU,YAAY,OAAO;AAAA,IAC5C,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AACD,QAAM,MAAM,WAAW,KAAK;AAC5B,SAAO,MAAM,MAAM,QAAQ,CAAC,kBAAkB,GAAG,OAAO,CAAC,UAAU;AACjE,eAAW,MAAM,kBAAkB,yBAAyB,KAAK;AAAA,EACnE,CAAC;AACD,SAAO,MAAM,UAAU,YAAY,CAAC,OAAO,GAAG,OAAO,CAAC,UAAU;AAC9D,UAAM,QAAQ,WAAW,MAAM,OAAO,kBAAkB,KAAK;AAC7D,WAAO,QAAQ,CAAC,MAAM,UAAU;AAC9B,UAAI,gBAAgB,IAAI,GAAG;AACzB,cAAM;AAAA,UACJ,MAAM,kBAAkB,KAAK;AAAA,UAC7B,MAAM;AAAA,UACN,SAAS,GAAG,IAAI;AAAA,UAChB,UAAU;AAAA,QACZ,CAAC;AAAA,MACH,WAAW,CAAC,YAAY,IAAI,GAAG;AAC7B;AAAA,UACE,kBAAkB,KAAK;AAAA,UACvB;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACD,SAAO,MAAM,UAAU,YAAY,CAAC,OAAO,GAAG,OAAO,CAAC,UAAU;AAC9D,aAAS,MAAM,OAAO,kBAAkB,KAAK;AAAA,EAC/C,CAAC;AACD,SAAO,MAAM,UAAU,YAAY,CAAC,KAAK,GAAG,OAAO,CAAC,aAAa;AAC/D;AAAA,MACE,SAAS;AAAA,MACT;AAAA,MACA,CAAC,UAAU,cAAc,WAAW,YAAY,UAAU;AAAA,MAC1D;AAAA,MACA,CAAC,QAAQ;AACP,mBAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC/C,mBAAS,OAAO,gBAAgB,IAAI,IAAI,KAAK;AAAA,QAC/C;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACD,UAAQ,MAAM,SAAS,OAAO,KAAK;AACnC;AAAA,IACE,MAAM;AAAA,IACN;AAAA,IACA,CAAC,gBAAgB;AAAA,IACjB;AAAA,IACA,CAAC,cAAc;AACb;AAAA,QACE,UAAU;AAAA,QACV;AAAA,QACA,CAAC,QAAQ;AAAA,QACT;AAAA,QACA,CAAC,mBAAmB;AAClB;AAAA,YACE,eAAe;AAAA,YACf;AAAA,YACA,CAAC,QAAQ;AAAA,YACT;AAAA,YACA,CAAC,WAAW;AACV,kBAAI,OAAO,OAAO,WAAW,YAAY,CAAC,OAAO,OAAO,KAAK,GAAG;AAC9D;AAAA,kBACE;AAAA,kBACA;AAAA,kBACA;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,YAAU,MAAM,WAAW,OAAO,KAAK;AACvC,SAAO;AAAA,IACL,OAAO,CAAC,OAAO,KAAK,CAAC,UAAU,MAAM,aAAa,OAAO;AAAA,IACzD;AAAA,EACF;AACF;AAQA,SAAS,aAAa,OAAgB,MAAc,OAAiB;AACnE,MAAI,CAAC,SAAS,KAAK,GAAG;AACpB;AAAA,MACE;AAAA,MACA,UAAU,SAAY,qBAAqB;AAAA,MAC3C,6CAA6C,IAAI;AAAA,IACnD;AAAA,EACF;AACF;AAEA,SAAS,MAAM,OAAgB,OAAiB;AAC9C,MAAI,OAAO,UAAU,UAAU;AAC7B;AAAA,MACE;AAAA,MACA,UAAU,SAAY,qBAAqB;AAAA,MAC3C;AAAA,IACF;AAAA,EACF,WACE,CAAC,UAAU,KAAK,KAAK,KACrB,gCAAgC,KAAK,KAAK,KAC1C,MAAM,SAAS,IAAI,GACnB;AACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,WACP,OACA,MACA,OACA,UAAoE,CAAC,GACrE;AACA,MAAI,UAAU,QAAW;AACvB,WAAO;AAAA,EACT;AACA,MACE,CAAC,MAAM,QAAQ,KAAK,KACpB,MAAM,KAAK,CAAC,UAAU,OAAO,UAAU,QAAQ,GAC/C;AACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,qCAAqC,IAAI;AAAA,IAC3C;AACA,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,YAAY,MAAM,WAAW,GAAG;AAC1C;AAAA,MACE;AAAA,MACA;AAAA,MACA,+CAA+C,IAAI;AAAA,IACrD;AAAA,EACF;AACA,QAAM,QAAQ,CAAC,OAAO,UAAU;AAC9B,QAAI,QAAQ,QAAQ,CAAC,SAAS,KAAK,GAAG;AACpC;AAAA,QACE,GAAG,IAAI,IAAI,KAAK;AAAA,QAChB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACD,MAAI,QAAQ,UAAU,IAAI,IAAI,KAAK,EAAE,SAAS,MAAM,QAAQ;AAC1D;AAAA,MACE;AAAA,MACA;AAAA,MACA,kDAAkD,IAAI;AAAA,IACxD;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,SAAS,OAAgB,MAAc,OAAiB;AAC/D,aAAW,OAAO,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,UAAU;AACvD,QAAI,CAAC,SAAS,IAAI,GAAG;AACnB;AAAA,QACE,GAAG,IAAI,IAAI,KAAK;AAAA,QAChB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,SAAS,MAAM,OAAgB,OAAiB;AAC9C,QAAM,SAAS,WAAW,OAAO,aAAa,OAAO,EAAE,QAAQ,KAAK,CAAC;AACrE,UAAQ,QAAQ,CAAC,MAAM,UAAU;AAC/B,QAAI,CAAC,KAAK,WAAW,GAAG,GAAG;AACzB;AAAA,QACE,aAAa,KAAK;AAAA,QAClB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;",
+  "sourcesContent": ["import {\n  globallyAllowed,\n  hostname,\n  nonblank,\n  packageName,\n  record,\n  unknownKeys,\n} from \"./helpers\";\nimport { analytics, budgets, nested } from \"./sections\";\nimport type { ConfigIssue, ConfigValidation } from \"./types\";\n\nconst rootKeys = [\n  \"store\",\n  \"branches\",\n  \"theme\",\n  \"prerender\",\n  \"menu\",\n  \"packages\",\n  \"audit\",\n  \"outbound\",\n  \"security\",\n  \"budgets\",\n  \"readiness\",\n  \"analytics\",\n  \"verify\",\n] as const;\n\n/**\n * Validate a site configuration and collect errors and warnings without changing it.\n * Checks required fields, unknown keys, allowlists, budgets and analytics settings.\n *\n * @param input - The configuration value to inspect.\n * @returns Diagnostics and a valid flag that is true when there are no errors.\n */\nexport function validateConfig(input: unknown): ConfigValidation {\n  const issues: ConfigIssue[] = [];\n  const issue = (value: ConfigIssue) => issues.push(value);\n  const error = (path: string, code: ConfigIssue[\"code\"], message: string) =>\n    issue({ path, code, message, severity: \"error\" });\n  if (!record(input)) {\n    return {\n      valid: false,\n      issues: [\n        {\n          path: \"$\",\n          code: \"invalid_type\",\n          message:\n            \"Expected a configuration object. Export an object from zappie.config.ts.\",\n          severity: \"error\",\n        },\n      ],\n    };\n  }\n  unknownKeys(input, rootKeys, \"\", issue);\n  if (!nonblank(input.store)) {\n    error(\n      \"store\",\n      input.store === undefined ? \"missing_required\" : \"invalid_type\",\n      \"Expected a non-empty storefront slug. Set store to the slug used by createZappie().\",\n    );\n  }\n  theme(input.theme, error);\n  stringList(input.branches, \"branches\", error, {\n    nonempty: true,\n    unique: true,\n    slug: true,\n  });\n  stringList(input.prerender, \"prerender\", error, { unique: true })?.forEach(\n    (path, index) => {\n      if (!path.startsWith(\"/\")) {\n        error(\n          `prerender[${index}]`,\n          \"invalid_format\",\n          \"Expected a route starting with /. Prefix the route with /.\",\n        );\n      }\n    },\n  );\n  nested(input.menu, \"menu\", [\"hiddenCategories\"], issue, (value) => {\n    stringList(value.hiddenCategories, \"menu.hiddenCategories\", error);\n  });\n  nested(input.packages, \"packages\", [\"allow\"], issue, (value) => {\n    const allow = stringList(value.allow, \"packages.allow\", error);\n    allow?.forEach((name, index) => {\n      if (globallyAllowed(name)) {\n        issue({\n          path: `packages.allow[${index}]`,\n          code: \"redundant_allowlist\",\n          message: `${name} is already globally allowed. Remove it from packages.allow.`,\n          severity: \"warning\",\n        });\n      } else if (!packageName(name)) {\n        error(\n          `packages.allow[${index}]`,\n          \"invalid_format\",\n          \"Expected a lowercase npm package name. Use a package name such as lucide-react or @scope/name.\",\n        );\n      }\n    });\n  });\n  nested(input.outbound, \"outbound\", [\"allow\"], issue, (value) => {\n    hostList(value.allow, \"outbound.allow\", error);\n  });\n  nested(input.security, \"security\", [\"csp\"], issue, (security) => {\n    nested(\n      security.csp,\n      \"security.csp\",\n      [\"imgSrc\", \"connectSrc\", \"fontSrc\", \"styleSrc\", \"frameSrc\"],\n      issue,\n      (csp) => {\n        for (const [name, value] of Object.entries(csp)) {\n          hostList(value, `security.csp.${name}`, error);\n        }\n      },\n    );\n  });\n  budgets(input.budgets, issue, error);\n  nested(\n    input.readiness,\n    \"readiness\",\n    [\"routeDiscovery\"],\n    issue,\n    (readiness) => {\n      nested(\n        readiness.routeDiscovery,\n        \"readiness.routeDiscovery\",\n        [\"optOut\"],\n        issue,\n        (routeDiscovery) => {\n          nested(\n            routeDiscovery.optOut,\n            \"readiness.routeDiscovery.optOut\",\n            [\"reason\"],\n            issue,\n            (optOut) => {\n              if (typeof optOut.reason !== \"string\" || !optOut.reason.trim()) {\n                error(\n                  \"readiness.routeDiscovery.optOut.reason\",\n                  \"invalid_format\",\n                  \"Expected a non-blank reason. Explain why the site disables initial route discovery.\",\n                );\n              }\n            },\n          );\n        },\n      );\n    },\n  );\n  analytics(input.analytics, issue, error);\n  // Verify checks the routes themselves when it runs.\n  nested(\n    input.verify,\n    \"verify\",\n    [\"startPath\", \"cataloguePath\"],\n    issue,\n    () => {},\n  );\n  return {\n    valid: !issues.some((entry) => entry.severity === \"error\"),\n    issues,\n  };\n}\n\ntype AddError = (\n  path: string,\n  code: ConfigIssue[\"code\"],\n  message: string,\n) => void;\n\nfunction theme(value: unknown, error: AddError) {\n  if (typeof value !== \"string\") {\n    error(\n      \"theme\",\n      value === undefined ? \"missing_required\" : \"invalid_type\",\n      \"Expected a relative .json path. Set theme to a value such as ./theme.json.\",\n    );\n  } else if (\n    !/\\.json$/.test(value) ||\n    /^(?:[a-z][a-z\\d+.-]*:|\\/|\\\\)/i.test(value) ||\n    value.includes(\"\\\\\")\n  ) {\n    error(\n      \"theme\",\n      \"invalid_format\",\n      \"Expected a relative .json path. Use a value such as ./theme.json.\",\n    );\n  }\n}\n\nfunction stringList(\n  value: unknown,\n  path: string,\n  error: AddError,\n  options: { nonempty?: boolean; unique?: boolean; slug?: boolean } = {},\n) {\n  if (value === undefined) {\n    return undefined;\n  }\n  if (\n    !Array.isArray(value) ||\n    value.some((entry) => typeof entry !== \"string\")\n  ) {\n    error(\n      path,\n      \"invalid_type\",\n      `Expected an array of strings. Set ${path} to string values.`,\n    );\n    return undefined;\n  }\n  if (options.nonempty && value.length === 0) {\n    error(\n      path,\n      \"invalid_format\",\n      `Expected at least one value. Add a value to ${path} or remove the field.`,\n    );\n  }\n  value.forEach((entry, index) => {\n    if (options.slug && !nonblank(entry)) {\n      error(\n        `${path}[${index}]`,\n        \"invalid_format\",\n        \"Expected a non-empty branch slug. Remove the empty value or use a branch slug.\",\n      );\n    }\n  });\n  if (options.unique && new Set(value).size !== value.length) {\n    error(\n      path,\n      \"duplicate\",\n      `Expected unique values. Remove duplicates from ${path}.`,\n    );\n  }\n  return value;\n}\n\nfunction hostList(value: unknown, path: string, error: AddError) {\n  stringList(value, path, error)?.forEach((host, index) => {\n    if (!hostname(host)) {\n      error(\n        `${path}[${index}]`,\n        \"invalid_format\",\n        \"Expected a hostname or leading *. subdomain pattern without a scheme, path, port or IP. Use a value such as api.example.com.\",\n      );\n    }\n  });\n}\n"],
+  "mappings": ";AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,WAAW,SAAS,cAAc;AAG3C,IAAM,WAAW;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AASO,SAAS,eAAe,OAAkC;AAC/D,QAAM,SAAwB,CAAC;AAC/B,QAAM,QAAQ,CAAC,UAAuB,OAAO,KAAK,KAAK;AACvD,QAAM,QAAQ,CAAC,MAAc,MAA2B,YACtD,MAAM,EAAE,MAAM,MAAM,SAAS,UAAU,QAAQ,CAAC;AAClD,MAAI,CAAC,OAAO,KAAK,GAAG;AAClB,WAAO;AAAA,MACL,OAAO;AAAA,MACP,QAAQ;AAAA,QACN;AAAA,UACE,MAAM;AAAA,UACN,MAAM;AAAA,UACN,SACE;AAAA,UACF,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,cAAY,OAAO,UAAU,IAAI,KAAK;AACtC,MAAI,CAAC,SAAS,MAAM,KAAK,GAAG;AAC1B;AAAA,MACE;AAAA,MACA,MAAM,UAAU,SAAY,qBAAqB;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAM,OAAO,KAAK;AACxB,aAAW,MAAM,UAAU,YAAY,OAAO;AAAA,IAC5C,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AACD,aAAW,MAAM,WAAW,aAAa,OAAO,EAAE,QAAQ,KAAK,CAAC,GAAG;AAAA,IACjE,CAAC,MAAM,UAAU;AACf,UAAI,CAAC,KAAK,WAAW,GAAG,GAAG;AACzB;AAAA,UACE,aAAa,KAAK;AAAA,UAClB;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,MAAM,MAAM,QAAQ,CAAC,kBAAkB,GAAG,OAAO,CAAC,UAAU;AACjE,eAAW,MAAM,kBAAkB,yBAAyB,KAAK;AAAA,EACnE,CAAC;AACD,SAAO,MAAM,UAAU,YAAY,CAAC,OAAO,GAAG,OAAO,CAAC,UAAU;AAC9D,UAAM,QAAQ,WAAW,MAAM,OAAO,kBAAkB,KAAK;AAC7D,WAAO,QAAQ,CAAC,MAAM,UAAU;AAC9B,UAAI,gBAAgB,IAAI,GAAG;AACzB,cAAM;AAAA,UACJ,MAAM,kBAAkB,KAAK;AAAA,UAC7B,MAAM;AAAA,UACN,SAAS,GAAG,IAAI;AAAA,UAChB,UAAU;AAAA,QACZ,CAAC;AAAA,MACH,WAAW,CAAC,YAAY,IAAI,GAAG;AAC7B;AAAA,UACE,kBAAkB,KAAK;AAAA,UACvB;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACD,SAAO,MAAM,UAAU,YAAY,CAAC,OAAO,GAAG,OAAO,CAAC,UAAU;AAC9D,aAAS,MAAM,OAAO,kBAAkB,KAAK;AAAA,EAC/C,CAAC;AACD,SAAO,MAAM,UAAU,YAAY,CAAC,KAAK,GAAG,OAAO,CAAC,aAAa;AAC/D;AAAA,MACE,SAAS;AAAA,MACT;AAAA,MACA,CAAC,UAAU,cAAc,WAAW,YAAY,UAAU;AAAA,MAC1D;AAAA,MACA,CAAC,QAAQ;AACP,mBAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC/C,mBAAS,OAAO,gBAAgB,IAAI,IAAI,KAAK;AAAA,QAC/C;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACD,UAAQ,MAAM,SAAS,OAAO,KAAK;AACnC;AAAA,IACE,MAAM;AAAA,IACN;AAAA,IACA,CAAC,gBAAgB;AAAA,IACjB;AAAA,IACA,CAAC,cAAc;AACb;AAAA,QACE,UAAU;AAAA,QACV;AAAA,QACA,CAAC,QAAQ;AAAA,QACT;AAAA,QACA,CAAC,mBAAmB;AAClB;AAAA,YACE,eAAe;AAAA,YACf;AAAA,YACA,CAAC,QAAQ;AAAA,YACT;AAAA,YACA,CAAC,WAAW;AACV,kBAAI,OAAO,OAAO,WAAW,YAAY,CAAC,OAAO,OAAO,KAAK,GAAG;AAC9D;AAAA,kBACE;AAAA,kBACA;AAAA,kBACA;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,YAAU,MAAM,WAAW,OAAO,KAAK;AAEvC;AAAA,IACE,MAAM;AAAA,IACN;AAAA,IACA,CAAC,aAAa,eAAe;AAAA,IAC7B;AAAA,IACA,MAAM;AAAA,IAAC;AAAA,EACT;AACA,SAAO;AAAA,IACL,OAAO,CAAC,OAAO,KAAK,CAAC,UAAU,MAAM,aAAa,OAAO;AAAA,IACzD;AAAA,EACF;AACF;AAQA,SAAS,MAAM,OAAgB,OAAiB;AAC9C,MAAI,OAAO,UAAU,UAAU;AAC7B;AAAA,MACE;AAAA,MACA,UAAU,SAAY,qBAAqB;AAAA,MAC3C;AAAA,IACF;AAAA,EACF,WACE,CAAC,UAAU,KAAK,KAAK,KACrB,gCAAgC,KAAK,KAAK,KAC1C,MAAM,SAAS,IAAI,GACnB;AACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,WACP,OACA,MACA,OACA,UAAoE,CAAC,GACrE;AACA,MAAI,UAAU,QAAW;AACvB,WAAO;AAAA,EACT;AACA,MACE,CAAC,MAAM,QAAQ,KAAK,KACpB,MAAM,KAAK,CAAC,UAAU,OAAO,UAAU,QAAQ,GAC/C;AACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,qCAAqC,IAAI;AAAA,IAC3C;AACA,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,YAAY,MAAM,WAAW,GAAG;AAC1C;AAAA,MACE;AAAA,MACA;AAAA,MACA,+CAA+C,IAAI;AAAA,IACrD;AAAA,EACF;AACA,QAAM,QAAQ,CAAC,OAAO,UAAU;AAC9B,QAAI,QAAQ,QAAQ,CAAC,SAAS,KAAK,GAAG;AACpC;AAAA,QACE,GAAG,IAAI,IAAI,KAAK;AAAA,QAChB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACD,MAAI,QAAQ,UAAU,IAAI,IAAI,KAAK,EAAE,SAAS,MAAM,QAAQ;AAC1D;AAAA,MACE;AAAA,MACA;AAAA,MACA,kDAAkD,IAAI;AAAA,IACxD;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,SAAS,OAAgB,MAAc,OAAiB;AAC/D,aAAW,OAAO,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,UAAU;AACvD,QAAI,CAAC,SAAS,IAAI,GAAG;AACnB;AAAA,QACE,GAAG,IAAI,IAAI,KAAK;AAAA,QAChB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zappie/sdk",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "Typed, framework-agnostic client for Zappie menus, carts, checkout, auth and events.",
   "type": "module",
   "sideEffects": false,