@zappie/sdk 0.1.14 → 0.1.16

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md CHANGED
@@ -1,5 +1,17 @@
1
1
  # @zappie/sdk
2
2
 
3
+ ## 0.1.16
4
+
5
+ ### Patch Changes
6
+
7
+ - f980164: The template preview bridge talks only to an allowed Zappie editor. In draft and review mode, `TemplateSettingsProvider` posts `ready`, `route` and `scroll` to the origin of the editor framing the page instead of to every origin, and accepts `settings` only from that origin and window. The allowed editors are `EDITOR_ORIGINS`, exported from `@zappie/sdk/template` with the `editorOrigin` helper: the merchant and admin dashboards in production and staging, and their local dev servers. A page framed by anything else, or not framed at all, sends and accepts nothing. Settings messages with more than 200 values are dropped, as are keys over 100 characters, text over 10,000 characters and numbers that aren't finite. Live sites are unchanged.
8
+
9
+ ## 0.1.15
10
+
11
+ ### Patch Changes
12
+
13
+ - b0b2a59: Let a site raise V15's first-card tappable limit to 5000 ms with an explained site budget, and record the applied limit in the verify report. A site that adds `budgets.tappableMs` must upgrade `@zappie/check` and `@zappie/sdk` in the same change.
14
+
3
15
  ## 0.1.14
4
16
 
5
17
  ### Patch Changes
@@ -1,10 +1,11 @@
1
1
  /**
2
- * Default site budgets: 200 KB gzipped JavaScript, 50 KB gzipped CSS and 2500 ms LCP.
2
+ * Default site budgets: 200 KB gzipped JavaScript, 50 KB gzipped CSS, 2500 ms LCP and 3000 ms until the first product card is tappable.
3
3
  */
4
4
  declare const DEFAULT_BUDGETS: {
5
5
  readonly jsKbGz: 200;
6
6
  readonly cssKbGz: 50;
7
7
  readonly lcpMs: 2500;
8
+ readonly tappableMs: 3000;
8
9
  };
9
10
  /**
10
11
  * Package names and patterns allowed globally without a site-specific allowlist entry.
@@ -50,6 +51,8 @@ type ZappieSiteConfig = {
50
51
  jsKbGz?: number;
51
52
  cssKbGz?: number;
52
53
  lcpMs?: number;
54
+ /** V15's limit for the first product card to become tappable. Values below 3000 use 3000. */
55
+ tappableMs?: number;
53
56
  override?: {
54
57
  reason: string;
55
58
  };
@@ -73,7 +76,11 @@ type ZappieSiteConfig = {
73
76
  };
74
77
  /** Where `zappie verify` opens the storefront and finds each catalogue. */
75
78
  verify?: {
76
- /** The route verify opens as the menu, such as /menu. It must list items. Defaults to /. */
79
+ /**
80
+ * The route verify opens as the menu, such as /menu. It must list items. Defaults to /.
81
+ * `{menu}` stands for the first menu that holds items and `{branch}` for the default branch,
82
+ * such as `/menu?menu={menu}`.
83
+ */
77
84
  startPath?: string;
78
85
  /**
79
86
  * The page for each menu, with `{menu}` where its id goes and, optionally, `{branch}` for the
package/dist/debug.js CHANGED
@@ -1,5 +1,5 @@
1
1
  // src/debug.ts
2
- var VERSION = true ? "0.1.14" : "0.0.0-development";
2
+ var VERSION = true ? "0.1.16" : "0.0.0-development";
3
3
  function installDebug(client) {
4
4
  if (typeof window === "undefined" || client.mode !== "test") {
5
5
  return;
package/dist/index.js CHANGED
@@ -10,7 +10,7 @@ import { ZappieError, isZappieError } from "./errors.js";
10
10
  export * from "./models.js";
11
11
  import { format, money } from "./money.js";
12
12
  import { RestTransport } from "./transport/rest.js";
13
- var VERSION = true ? "0.1.14" : "0.0.0-development";
13
+ var VERSION = true ? "0.1.16" : "0.0.0-development";
14
14
  export {
15
15
  API_VERSION,
16
16
  RestTransport,
@@ -202,6 +202,8 @@ type ZappieSiteConfig = {
202
202
  jsKbGz?: number;
203
203
  cssKbGz?: number;
204
204
  lcpMs?: number;
205
+ /** V15's limit for the first product card to become tappable. Values below 3000 use 3000. */
206
+ tappableMs?: number;
205
207
  override?: {
206
208
  reason: string;
207
209
  };
@@ -225,7 +227,11 @@ type ZappieSiteConfig = {
225
227
  };
226
228
  /** Where `zappie verify` opens the storefront and finds each catalogue. */
227
229
  verify?: {
228
- /** The route verify opens as the menu, such as /menu. It must list items. Defaults to /. */
230
+ /**
231
+ * The route verify opens as the menu, such as /menu. It must list items. Defaults to /.
232
+ * `{menu}` stands for the first menu that holds items and `{branch}` for the default branch,
233
+ * such as `/menu?menu={menu}`.
234
+ */
229
235
  startPath?: string;
230
236
  /**
231
237
  * The page for each menu, with `{menu}` where its id goes and, optionally, `{branch}` for the
@@ -21,7 +21,7 @@ function budgets(value, issue, error) {
21
21
  nested(
22
22
  value,
23
23
  "budgets",
24
- ["jsKbGz", "cssKbGz", "lcpMs", "override"],
24
+ [...Object.keys(DEFAULT_BUDGETS), "override"],
25
25
  issue,
26
26
  (budget) => {
27
27
  nested(
@@ -39,28 +39,35 @@ function budgets(value, issue, error) {
39
39
  }
40
40
  }
41
41
  );
42
- for (const key of ["jsKbGz", "cssKbGz", "lcpMs"]) {
42
+ for (const key of Object.keys(DEFAULT_BUDGETS)) {
43
43
  const amount = budget[key];
44
+ const path = `budgets.${key}`;
44
45
  if (amount === void 0) {
45
46
  continue;
46
47
  }
47
48
  if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) {
48
49
  error(
49
- `budgets.${key}`,
50
+ path,
50
51
  "invalid_type",
51
- `Expected a positive finite number. Set budgets.${key} to a number greater than zero.`
52
+ `Expected a positive finite number. Set ${path} to a number greater than zero.`
53
+ );
54
+ } else if (key === "tappableMs" && amount > 5e3) {
55
+ error(
56
+ path,
57
+ "invalid_format",
58
+ "The tappableMs budget cannot exceed 5000. Set budgets.tappableMs to 5000 or less."
52
59
  );
53
60
  } else if (amount > DEFAULT_BUDGETS[key]) {
54
61
  const message = `The ${key} budget exceeds the ${DEFAULT_BUDGETS[key]} default.`;
55
62
  if (budget.override === void 0) {
56
63
  error(
57
- `budgets.${key}`,
64
+ path,
58
65
  "budget_override",
59
66
  `${message} Add budgets.override.reason to explain the increase.`
60
67
  );
61
68
  } else {
62
69
  issue({
63
- path: `budgets.${key}`,
70
+ path,
64
71
  code: "budget_override",
65
72
  message: `${message} Lower it to the default when the exception is no longer needed.`,
66
73
  severity: "warning"
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "version": 3,
3
3
  "sources": ["../../src/site-config/sections.ts"],
4
- "sourcesContent": ["import { record, unknownKeys } from \"./helpers\";\nimport { DEFAULT_BUDGETS, type ConfigIssue } from \"./types\";\n\ntype AddIssue = (value: ConfigIssue) => void;\ntype AddError = (\n path: string,\n code: ConfigIssue[\"code\"],\n message: string,\n) => void;\n\nexport function nested(\n value: unknown,\n path: string,\n keys: readonly string[],\n issue: AddIssue,\n validate: (value: Record<string, unknown>) => void,\n) {\n if (value === undefined) {\n return;\n }\n if (!record(value)) {\n issue({\n path,\n code: \"invalid_type\",\n message: `Expected an object. Set ${path} to an object or remove it.`,\n severity: \"error\",\n });\n return;\n }\n unknownKeys(value, keys, path, issue);\n validate(value);\n}\n\nexport function budgets(value: unknown, issue: AddIssue, error: AddError) {\n nested(\n value,\n \"budgets\",\n [\"jsKbGz\", \"cssKbGz\", \"lcpMs\", \"override\"],\n issue,\n (budget) => {\n nested(\n budget.override,\n \"budgets.override\",\n [\"reason\"],\n issue,\n (override) => {\n if (typeof override.reason !== \"string\" || !override.reason.trim()) {\n error(\n \"budgets.override.reason\",\n \"invalid_format\",\n \"Expected a non-blank reason. Explain why the default budget must be raised.\",\n );\n }\n },\n );\n for (const key of [\"jsKbGz\", \"cssKbGz\", \"lcpMs\"] as const) {\n const amount = budget[key];\n if (amount === undefined) {\n continue;\n }\n if (\n typeof amount !== \"number\" ||\n !Number.isFinite(amount) ||\n amount <= 0\n ) {\n error(\n `budgets.${key}`,\n \"invalid_type\",\n `Expected a positive finite number. Set budgets.${key} to a number greater than zero.`,\n );\n } else if (amount > DEFAULT_BUDGETS[key]) {\n const message = `The ${key} budget exceeds the ${DEFAULT_BUDGETS[key]} default.`;\n if (budget.override === undefined) {\n error(\n `budgets.${key}`,\n \"budget_override\",\n `${message} Add budgets.override.reason to explain the increase.`,\n );\n } else {\n issue({\n path: `budgets.${key}`,\n code: \"budget_override\",\n message: `${message} Lower it to the default when the exception is no longer needed.`,\n severity: \"warning\",\n });\n }\n }\n }\n },\n );\n}\n\nexport function analytics(value: unknown, issue: AddIssue, error: AddError) {\n nested(value, \"analytics\", [\"forward\"], issue, (analyticsValue) => {\n nested(\n analyticsValue.forward,\n \"analytics.forward\",\n [\"ga4\", \"metaPixel\"],\n issue,\n (forward) => {\n if (\n forward.ga4 !== undefined &&\n (typeof forward.ga4 !== \"string\" ||\n !/^G-[A-Z0-9]+$/.test(forward.ga4))\n ) {\n error(\n \"analytics.forward.ga4\",\n \"invalid_format\",\n \"Expected a GA4 measurement id beginning with G-. Use a value such as G-XXXXXXXXXX.\",\n );\n }\n if (\n forward.metaPixel !== undefined &&\n (typeof forward.metaPixel !== \"string\" ||\n !/^\\d+$/.test(forward.metaPixel))\n ) {\n error(\n \"analytics.forward.metaPixel\",\n \"invalid_format\",\n \"Expected a numeric Meta Pixel id. Use digits only.\",\n );\n }\n },\n );\n });\n}\n"],
5
- "mappings": ";AAAA,SAAS,QAAQ,mBAAmB;AACpC,SAAS,uBAAyC;AAS3C,SAAS,OACd,OACA,MACA,MACA,OACA,UACA;AACA,MAAI,UAAU,QAAW;AACvB;AAAA,EACF;AACA,MAAI,CAAC,OAAO,KAAK,GAAG;AAClB,UAAM;AAAA,MACJ;AAAA,MACA,MAAM;AAAA,MACN,SAAS,2BAA2B,IAAI;AAAA,MACxC,UAAU;AAAA,IACZ,CAAC;AACD;AAAA,EACF;AACA,cAAY,OAAO,MAAM,MAAM,KAAK;AACpC,WAAS,KAAK;AAChB;AAEO,SAAS,QAAQ,OAAgB,OAAiB,OAAiB;AACxE;AAAA,IACE;AAAA,IACA;AAAA,IACA,CAAC,UAAU,WAAW,SAAS,UAAU;AAAA,IACzC;AAAA,IACA,CAAC,WAAW;AACV;AAAA,QACE,OAAO;AAAA,QACP;AAAA,QACA,CAAC,QAAQ;AAAA,QACT;AAAA,QACA,CAAC,aAAa;AACZ,cAAI,OAAO,SAAS,WAAW,YAAY,CAAC,SAAS,OAAO,KAAK,GAAG;AAClE;AAAA,cACE;AAAA,cACA;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,iBAAW,OAAO,CAAC,UAAU,WAAW,OAAO,GAAY;AACzD,cAAM,SAAS,OAAO,GAAG;AACzB,YAAI,WAAW,QAAW;AACxB;AAAA,QACF;AACA,YACE,OAAO,WAAW,YAClB,CAAC,OAAO,SAAS,MAAM,KACvB,UAAU,GACV;AACA;AAAA,YACE,WAAW,GAAG;AAAA,YACd;AAAA,YACA,kDAAkD,GAAG;AAAA,UACvD;AAAA,QACF,WAAW,SAAS,gBAAgB,GAAG,GAAG;AACxC,gBAAM,UAAU,OAAO,GAAG,uBAAuB,gBAAgB,GAAG,CAAC;AACrE,cAAI,OAAO,aAAa,QAAW;AACjC;AAAA,cACE,WAAW,GAAG;AAAA,cACd;AAAA,cACA,GAAG,OAAO;AAAA,YACZ;AAAA,UACF,OAAO;AACL,kBAAM;AAAA,cACJ,MAAM,WAAW,GAAG;AAAA,cACpB,MAAM;AAAA,cACN,SAAS,GAAG,OAAO;AAAA,cACnB,UAAU;AAAA,YACZ,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,UAAU,OAAgB,OAAiB,OAAiB;AAC1E,SAAO,OAAO,aAAa,CAAC,SAAS,GAAG,OAAO,CAAC,mBAAmB;AACjE;AAAA,MACE,eAAe;AAAA,MACf;AAAA,MACA,CAAC,OAAO,WAAW;AAAA,MACnB;AAAA,MACA,CAAC,YAAY;AACX,YACE,QAAQ,QAAQ,WACf,OAAO,QAAQ,QAAQ,YACtB,CAAC,gBAAgB,KAAK,QAAQ,GAAG,IACnC;AACA;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AACA,YACE,QAAQ,cAAc,WACrB,OAAO,QAAQ,cAAc,YAC5B,CAAC,QAAQ,KAAK,QAAQ,SAAS,IACjC;AACA;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;",
4
+ "sourcesContent": ["import { record, unknownKeys } from \"./helpers\";\nimport { DEFAULT_BUDGETS, type ConfigIssue } from \"./types\";\n\ntype AddIssue = (value: ConfigIssue) => void;\ntype AddError = (\n path: string,\n code: ConfigIssue[\"code\"],\n message: string,\n) => void;\n\nexport function nested(\n value: unknown,\n path: string,\n keys: readonly string[],\n issue: AddIssue,\n validate: (value: Record<string, unknown>) => void,\n) {\n if (value === undefined) {\n return;\n }\n if (!record(value)) {\n issue({\n path,\n code: \"invalid_type\",\n message: `Expected an object. Set ${path} to an object or remove it.`,\n severity: \"error\",\n });\n return;\n }\n unknownKeys(value, keys, path, issue);\n validate(value);\n}\n\nexport function budgets(value: unknown, issue: AddIssue, error: AddError) {\n nested(\n value,\n \"budgets\",\n [...Object.keys(DEFAULT_BUDGETS), \"override\"],\n issue,\n (budget) => {\n nested(\n budget.override,\n \"budgets.override\",\n [\"reason\"],\n issue,\n (override) => {\n if (typeof override.reason !== \"string\" || !override.reason.trim()) {\n error(\n \"budgets.override.reason\",\n \"invalid_format\",\n \"Expected a non-blank reason. Explain why the default budget must be raised.\",\n );\n }\n },\n );\n for (const key of Object.keys(DEFAULT_BUDGETS) as Array<\n keyof typeof DEFAULT_BUDGETS\n >) {\n const amount = budget[key];\n const path = `budgets.${key}`;\n if (amount === undefined) {\n continue;\n }\n if (\n typeof amount !== \"number\" ||\n !Number.isFinite(amount) ||\n amount <= 0\n ) {\n error(\n path,\n \"invalid_type\",\n `Expected a positive finite number. Set ${path} to a number greater than zero.`,\n );\n } else if (key === \"tappableMs\" && amount > 5_000) {\n error(\n path,\n \"invalid_format\",\n \"The tappableMs budget cannot exceed 5000. Set budgets.tappableMs to 5000 or less.\",\n );\n } else if (amount > DEFAULT_BUDGETS[key]) {\n const message = `The ${key} budget exceeds the ${DEFAULT_BUDGETS[key]} default.`;\n if (budget.override === undefined) {\n error(\n path,\n \"budget_override\",\n `${message} Add budgets.override.reason to explain the increase.`,\n );\n } else {\n issue({\n path,\n code: \"budget_override\",\n message: `${message} Lower it to the default when the exception is no longer needed.`,\n severity: \"warning\",\n });\n }\n }\n }\n },\n );\n}\n\nexport function analytics(value: unknown, issue: AddIssue, error: AddError) {\n nested(value, \"analytics\", [\"forward\"], issue, (analyticsValue) => {\n nested(\n analyticsValue.forward,\n \"analytics.forward\",\n [\"ga4\", \"metaPixel\"],\n issue,\n (forward) => {\n if (\n forward.ga4 !== undefined &&\n (typeof forward.ga4 !== \"string\" ||\n !/^G-[A-Z0-9]+$/.test(forward.ga4))\n ) {\n error(\n \"analytics.forward.ga4\",\n \"invalid_format\",\n \"Expected a GA4 measurement id beginning with G-. Use a value such as G-XXXXXXXXXX.\",\n );\n }\n if (\n forward.metaPixel !== undefined &&\n (typeof forward.metaPixel !== \"string\" ||\n !/^\\d+$/.test(forward.metaPixel))\n ) {\n error(\n \"analytics.forward.metaPixel\",\n \"invalid_format\",\n \"Expected a numeric Meta Pixel id. Use digits only.\",\n );\n }\n },\n );\n });\n}\n"],
5
+ "mappings": ";AAAA,SAAS,QAAQ,mBAAmB;AACpC,SAAS,uBAAyC;AAS3C,SAAS,OACd,OACA,MACA,MACA,OACA,UACA;AACA,MAAI,UAAU,QAAW;AACvB;AAAA,EACF;AACA,MAAI,CAAC,OAAO,KAAK,GAAG;AAClB,UAAM;AAAA,MACJ;AAAA,MACA,MAAM;AAAA,MACN,SAAS,2BAA2B,IAAI;AAAA,MACxC,UAAU;AAAA,IACZ,CAAC;AACD;AAAA,EACF;AACA,cAAY,OAAO,MAAM,MAAM,KAAK;AACpC,WAAS,KAAK;AAChB;AAEO,SAAS,QAAQ,OAAgB,OAAiB,OAAiB;AACxE;AAAA,IACE;AAAA,IACA;AAAA,IACA,CAAC,GAAG,OAAO,KAAK,eAAe,GAAG,UAAU;AAAA,IAC5C;AAAA,IACA,CAAC,WAAW;AACV;AAAA,QACE,OAAO;AAAA,QACP;AAAA,QACA,CAAC,QAAQ;AAAA,QACT;AAAA,QACA,CAAC,aAAa;AACZ,cAAI,OAAO,SAAS,WAAW,YAAY,CAAC,SAAS,OAAO,KAAK,GAAG;AAClE;AAAA,cACE;AAAA,cACA;AAAA,cACA;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,iBAAW,OAAO,OAAO,KAAK,eAAe,GAE1C;AACD,cAAM,SAAS,OAAO,GAAG;AACzB,cAAM,OAAO,WAAW,GAAG;AAC3B,YAAI,WAAW,QAAW;AACxB;AAAA,QACF;AACA,YACE,OAAO,WAAW,YAClB,CAAC,OAAO,SAAS,MAAM,KACvB,UAAU,GACV;AACA;AAAA,YACE;AAAA,YACA;AAAA,YACA,0CAA0C,IAAI;AAAA,UAChD;AAAA,QACF,WAAW,QAAQ,gBAAgB,SAAS,KAAO;AACjD;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF,WAAW,SAAS,gBAAgB,GAAG,GAAG;AACxC,gBAAM,UAAU,OAAO,GAAG,uBAAuB,gBAAgB,GAAG,CAAC;AACrE,cAAI,OAAO,aAAa,QAAW;AACjC;AAAA,cACE;AAAA,cACA;AAAA,cACA,GAAG,OAAO;AAAA,YACZ;AAAA,UACF,OAAO;AACL,kBAAM;AAAA,cACJ;AAAA,cACA,MAAM;AAAA,cACN,SAAS,GAAG,OAAO;AAAA,cACnB,UAAU;AAAA,YACZ,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,UAAU,OAAgB,OAAiB,OAAiB;AAC1E,SAAO,OAAO,aAAa,CAAC,SAAS,GAAG,OAAO,CAAC,mBAAmB;AACjE;AAAA,MACE,eAAe;AAAA,MACf;AAAA,MACA,CAAC,OAAO,WAAW;AAAA,MACnB;AAAA,MACA,CAAC,YAAY;AACX,YACE,QAAQ,QAAQ,WACf,OAAO,QAAQ,QAAQ,YACtB,CAAC,gBAAgB,KAAK,QAAQ,GAAG,IACnC;AACA;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AACA,YACE,QAAQ,cAAc,WACrB,OAAO,QAAQ,cAAc,YAC5B,CAAC,QAAQ,KAAK,QAAQ,SAAS,IACjC;AACA;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;",
6
6
  "names": []
7
7
  }
@@ -2,7 +2,8 @@
2
2
  var DEFAULT_BUDGETS = {
3
3
  jsKbGz: 200,
4
4
  cssKbGz: 50,
5
- lcpMs: 2500
5
+ lcpMs: 2500,
6
+ tappableMs: 3e3
6
7
  };
7
8
  var GLOBAL_PACKAGE_ALLOWLIST = [
8
9
  "react",
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "version": 3,
3
3
  "sources": ["../../src/site-config/types.ts"],
4
- "sourcesContent": ["/**\n * Default site budgets: 200 KB gzipped JavaScript, 50 KB gzipped CSS and 2500 ms LCP.\n */\nexport const DEFAULT_BUDGETS = {\n jsKbGz: 200,\n cssKbGz: 50,\n lcpMs: 2500,\n} as const;\n\n/**\n * Package names and patterns allowed globally without a site-specific allowlist entry.\n */\nexport const GLOBAL_PACKAGE_ALLOWLIST = [\n \"react\",\n \"react-dom\",\n \"react-router\",\n \"@react-router/*\",\n \"@zappie/*\",\n \"tailwindcss\",\n \"@tailwindcss/*\",\n \"clsx\",\n \"tailwind-merge\",\n \"class-variance-authority\",\n \"lucide-react\",\n \"date-fns\",\n \"embla-carousel-react\",\n \"framer-motion/motion\",\n \"zod\",\n \"@radix-ui/*\",\n \"sonner\",\n \"vaul\",\n] as const;\n\n/**\n * The store, theme and optional build policies you export from zappie.config.ts.\n */\nexport type ZappieSiteConfig = {\n store: string;\n branches?: string[];\n theme: string;\n prerender?: string[];\n menu?: { hiddenCategories?: string[] };\n packages?: { allow?: string[] };\n /** Time-bounded acknowledgements for advisories that have no fixed version. */\n audit?: {\n ignore?: { id: string; reason: string; until: string }[];\n };\n outbound?: { allow?: string[] };\n /** Add sources to the fixed storefront Content Security Policy. */\n security?: {\n csp?: {\n imgSrc?: string[];\n connectSrc?: string[];\n fontSrc?: string[];\n styleSrc?: string[];\n frameSrc?: string[];\n };\n };\n /** Each budget left out uses DEFAULT_BUDGETS. */\n budgets?: {\n jsKbGz?: number;\n cssKbGz?: number;\n lcpMs?: number;\n override?: { reason: string };\n };\n /** Records explained exceptions to storefront readiness checks. */\n readiness?: {\n /** Lets this site skip the initial route discovery requirement. */\n routeDiscovery?: {\n /** Explains why this site does not use initial route discovery. */\n optOut: {\n /** States the constraint that prevents initial route discovery. */\n reason: string;\n };\n };\n };\n analytics?: { forward?: { ga4?: string; metaPixel?: string } };\n /** Where `zappie verify` opens the storefront and finds each catalogue. */\n verify?: {\n /** The route verify opens as the menu, such as /menu. It must list items. Defaults to /. */\n startPath?: string;\n /**\n * The page for each menu, with `{menu}` where its id goes and, optionally, `{branch}` for the\n * branch id, such as `/menu?menu={menu}`. Verify then judges each menu on its own page.\n */\n cataloguePath?: string;\n };\n};\n\n/**\n * A configuration diagnostic with its field path, stable code, message and severity.\n */\nexport type ConfigIssue = {\n path: string;\n code:\n | \"invalid_type\"\n | \"missing_required\"\n | \"unknown_key\"\n | \"invalid_format\"\n | \"duplicate\"\n | \"redundant_allowlist\"\n | \"budget_override\";\n message: string;\n severity: \"error\" | \"warning\";\n};\n\n/**\n * Configuration validation results. Warnings alone do not make valid false.\n */\nexport type ConfigValidation = { valid: boolean; issues: ConfigIssue[] };\n"],
5
- "mappings": ";AAGO,IAAM,kBAAkB;AAAA,EAC7B,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,OAAO;AACT;AAKO,IAAM,2BAA2B;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;",
4
+ "sourcesContent": ["/**\n * Default site budgets: 200 KB gzipped JavaScript, 50 KB gzipped CSS, 2500 ms LCP and 3000 ms until the first product card is tappable.\n */\nexport const DEFAULT_BUDGETS = {\n jsKbGz: 200,\n cssKbGz: 50,\n lcpMs: 2500,\n tappableMs: 3000,\n} as const;\n\n/**\n * Package names and patterns allowed globally without a site-specific allowlist entry.\n */\nexport const GLOBAL_PACKAGE_ALLOWLIST = [\n \"react\",\n \"react-dom\",\n \"react-router\",\n \"@react-router/*\",\n \"@zappie/*\",\n \"tailwindcss\",\n \"@tailwindcss/*\",\n \"clsx\",\n \"tailwind-merge\",\n \"class-variance-authority\",\n \"lucide-react\",\n \"date-fns\",\n \"embla-carousel-react\",\n \"framer-motion/motion\",\n \"zod\",\n \"@radix-ui/*\",\n \"sonner\",\n \"vaul\",\n] as const;\n\n/**\n * The store, theme and optional build policies you export from zappie.config.ts.\n */\nexport type ZappieSiteConfig = {\n store: string;\n branches?: string[];\n theme: string;\n prerender?: string[];\n menu?: { hiddenCategories?: string[] };\n packages?: { allow?: string[] };\n /** Time-bounded acknowledgements for advisories that have no fixed version. */\n audit?: {\n ignore?: { id: string; reason: string; until: string }[];\n };\n outbound?: { allow?: string[] };\n /** Add sources to the fixed storefront Content Security Policy. */\n security?: {\n csp?: {\n imgSrc?: string[];\n connectSrc?: string[];\n fontSrc?: string[];\n styleSrc?: string[];\n frameSrc?: string[];\n };\n };\n /** Each budget left out uses DEFAULT_BUDGETS. */\n budgets?: {\n jsKbGz?: number;\n cssKbGz?: number;\n lcpMs?: number;\n /** V15's limit for the first product card to become tappable. Values below 3000 use 3000. */\n tappableMs?: number;\n override?: { reason: string };\n };\n /** Records explained exceptions to storefront readiness checks. */\n readiness?: {\n /** Lets this site skip the initial route discovery requirement. */\n routeDiscovery?: {\n /** Explains why this site does not use initial route discovery. */\n optOut: {\n /** States the constraint that prevents initial route discovery. */\n reason: string;\n };\n };\n };\n analytics?: { forward?: { ga4?: string; metaPixel?: string } };\n /** Where `zappie verify` opens the storefront and finds each catalogue. */\n verify?: {\n /**\n * The route verify opens as the menu, such as /menu. It must list items. Defaults to /.\n * `{menu}` stands for the first menu that holds items and `{branch}` for the default branch,\n * such as `/menu?menu={menu}`.\n */\n startPath?: string;\n /**\n * The page for each menu, with `{menu}` where its id goes and, optionally, `{branch}` for the\n * branch id, such as `/menu?menu={menu}`. Verify then judges each menu on its own page.\n */\n cataloguePath?: string;\n };\n};\n\n/**\n * A configuration diagnostic with its field path, stable code, message and severity.\n */\nexport type ConfigIssue = {\n path: string;\n code:\n | \"invalid_type\"\n | \"missing_required\"\n | \"unknown_key\"\n | \"invalid_format\"\n | \"duplicate\"\n | \"redundant_allowlist\"\n | \"budget_override\";\n message: string;\n severity: \"error\" | \"warning\";\n};\n\n/**\n * Configuration validation results. Warnings alone do not make valid false.\n */\nexport type ConfigValidation = { valid: boolean; issues: ConfigIssue[] };\n"],
5
+ "mappings": ";AAGO,IAAM,kBAAkB;AAAA,EAC7B,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,OAAO;AAAA,EACP,YAAY;AACd;AAKO,IAAM,2BAA2B;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;",
6
6
  "names": []
7
7
  }
@@ -4,7 +4,18 @@ type TemplateSettingValue = string | number | boolean;
4
4
  type TemplateMode = "site" | "draft" | "review";
5
5
  /** Merge defaults, saved settings, and preview values for the current mode. */
6
6
  declare function templateSettings<T extends Record<string, unknown>>(defaults: T, saved: Record<string, TemplateSettingValue> | undefined, preview: Record<string, TemplateSettingValue> | null, mode: TemplateMode): T;
7
- /** Read primitive setting values from an editor message. */
7
+ /**
8
+ * The Zappie editors allowed to frame a draft or review preview and talk to it: the merchant
9
+ * dashboard (Studio), the admin dashboard (template review), and each one's local dev server.
10
+ * The preview bridge posts only to the editor framing it, and only when that editor is listed here.
11
+ */
12
+ declare const EDITOR_ORIGINS: readonly string[];
13
+ /**
14
+ * Find the origin of the editor framing this page. The browser's `ancestorOrigins` is used where
15
+ * it exists, and the referrer otherwise. Returns null unless that origin is in `EDITOR_ORIGINS`.
16
+ */
17
+ declare function editorOrigin(ancestorOrigins: ArrayLike<string> | null | undefined, referrer: string, allowed?: readonly string[]): string | null;
18
+ /** Read primitive setting values from an editor message. Oversized messages and values are dropped. */
8
19
  declare function settingsFromMessage(data: unknown): Record<string, TemplateSettingValue> | null;
9
20
  /** Cloudflare image widths shared by template sites. */
10
21
  declare const IMAGE_WIDTHS: readonly [320, 480, 640, 960, 1280, 1600];
@@ -13,4 +24,4 @@ declare function resized(src: string, width: number, quality?: number): string;
13
24
  /** Build the responsive Cloudflare image candidates used by a template. */
14
25
  declare function srcSet(src: string, quality?: number): string;
15
26
 
16
- export { IMAGE_WIDTHS, type TemplateMode, type TemplateSettingValue, resized, settingsFromMessage, srcSet, templateSettings };
27
+ export { EDITOR_ORIGINS, IMAGE_WIDTHS, type TemplateMode, type TemplateSettingValue, editorOrigin, resized, settingsFromMessage, srcSet, templateSettings };
@@ -8,6 +8,30 @@ function templateSettings(defaults, saved, preview, mode) {
8
8
  }
9
9
  return { ...defaults, ...saved };
10
10
  }
11
+ var EDITOR_ORIGINS = Object.freeze([
12
+ "https://dashboard.zappie.ai",
13
+ "https://dashboard.stg.zappie.ai",
14
+ "https://admin.zappie.ai",
15
+ "https://admin.stg.zappie.ai",
16
+ "http://localhost:5181",
17
+ "http://localhost:5180"
18
+ ]);
19
+ function editorOrigin(ancestorOrigins, referrer, allowed = EDITOR_ORIGINS) {
20
+ let origin = null;
21
+ if (ancestorOrigins && ancestorOrigins.length > 0) {
22
+ origin = ancestorOrigins[0] ?? null;
23
+ } else if (referrer) {
24
+ try {
25
+ origin = new URL(referrer).origin;
26
+ } catch {
27
+ origin = null;
28
+ }
29
+ }
30
+ return origin && allowed.includes(origin) ? origin : null;
31
+ }
32
+ var MAX_SETTINGS = 200;
33
+ var MAX_SETTING_KEY = 100;
34
+ var MAX_SETTING_TEXT = 1e4;
11
35
  function settingsFromMessage(data) {
12
36
  if (!data || typeof data !== "object") {
13
37
  return null;
@@ -16,9 +40,16 @@ function settingsFromMessage(data) {
16
40
  if (message.zappie !== "settings" || !message.values || typeof message.values !== "object" || Array.isArray(message.values)) {
17
41
  return null;
18
42
  }
43
+ const entries = Object.entries(message.values);
44
+ if (entries.length > MAX_SETTINGS) {
45
+ return null;
46
+ }
19
47
  const values = {};
20
- for (const [key, value] of Object.entries(message.values)) {
21
- if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
48
+ for (const [key, value] of entries) {
49
+ if (key.length > MAX_SETTING_KEY) {
50
+ continue;
51
+ }
52
+ if (typeof value === "string" && value.length <= MAX_SETTING_TEXT || typeof value === "number" && Number.isFinite(value) || typeof value === "boolean") {
22
53
  values[key] = value;
23
54
  }
24
55
  }
@@ -37,7 +68,9 @@ function srcSet(src, quality) {
37
68
  ).join(", ");
38
69
  }
39
70
  export {
71
+ EDITOR_ORIGINS,
40
72
  IMAGE_WIDTHS,
73
+ editorOrigin,
41
74
  resized,
42
75
  settingsFromMessage,
43
76
  srcSet,
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "version": 3,
3
3
  "sources": ["../../src/template/index.ts"],
4
- "sourcesContent": ["/** A value accepted by a template manifest and the live preview bridge. */\nexport type TemplateSettingValue = string | number | boolean;\n\n/** Where a template is running. Live sites never accept preview messages. */\nexport type TemplateMode = \"site\" | \"draft\" | \"review\";\n\n/** Merge defaults, saved settings, and preview values for the current mode. */\nexport function templateSettings<T extends Record<string, unknown>>(\n defaults: T,\n saved: Record<string, TemplateSettingValue> | undefined,\n preview: Record<string, TemplateSettingValue> | null,\n mode: TemplateMode,\n): T {\n if (mode === \"review\") {\n return { ...defaults, ...(preview ?? {}) };\n }\n if (mode === \"draft\") {\n return { ...defaults, ...saved, ...(preview ?? {}) };\n }\n return { ...defaults, ...saved };\n}\n\n/** Read primitive setting values from an editor message. */\nexport function settingsFromMessage(\n data: unknown,\n): Record<string, TemplateSettingValue> | null {\n if (!data || typeof data !== \"object\") {\n return null;\n }\n const message = data as { zappie?: unknown; values?: unknown };\n if (\n message.zappie !== \"settings\" ||\n !message.values ||\n typeof message.values !== \"object\" ||\n Array.isArray(message.values)\n ) {\n return null;\n }\n const values: Record<string, TemplateSettingValue> = {};\n for (const [key, value] of Object.entries(message.values)) {\n if (\n typeof value === \"string\" ||\n typeof value === \"number\" ||\n typeof value === \"boolean\"\n ) {\n values[key] = value;\n }\n }\n return values;\n}\n\n/** Cloudflare image widths shared by template sites. */\nexport const IMAGE_WIDTHS = [320, 480, 640, 960, 1280, 1600] as const;\n\n/** Build a same-origin Cloudflare resize URL for an external image. */\nexport function resized(src: string, width: number, quality = 80): string {\n if (!/^https?:\\/\\//.test(src)) {\n return src;\n }\n return `/cdn-cgi/image/width=${width},quality=${quality},format=auto,fit=scale-down/${src}`;\n}\n\n/** Build the responsive Cloudflare image candidates used by a template. */\nexport function srcSet(src: string, quality?: number): string {\n return IMAGE_WIDTHS.map(\n (width) => `${resized(src, width, quality)} ${width}w`,\n ).join(\", \");\n}\n"],
5
- "mappings": ";AAOO,SAAS,iBACd,UACA,OACA,SACA,MACG;AACH,MAAI,SAAS,UAAU;AACrB,WAAO,EAAE,GAAG,UAAU,GAAI,WAAW,CAAC,EAAG;AAAA,EAC3C;AACA,MAAI,SAAS,SAAS;AACpB,WAAO,EAAE,GAAG,UAAU,GAAG,OAAO,GAAI,WAAW,CAAC,EAAG;AAAA,EACrD;AACA,SAAO,EAAE,GAAG,UAAU,GAAG,MAAM;AACjC;AAGO,SAAS,oBACd,MAC6C;AAC7C,MAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;AACrC,WAAO;AAAA,EACT;AACA,QAAM,UAAU;AAChB,MACE,QAAQ,WAAW,cACnB,CAAC,QAAQ,UACT,OAAO,QAAQ,WAAW,YAC1B,MAAM,QAAQ,QAAQ,MAAM,GAC5B;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAA+C,CAAC;AACtD,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,MAAM,GAAG;AACzD,QACE,OAAO,UAAU,YACjB,OAAO,UAAU,YACjB,OAAO,UAAU,WACjB;AACA,aAAO,GAAG,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAGO,IAAM,eAAe,CAAC,KAAK,KAAK,KAAK,KAAK,MAAM,IAAI;AAGpD,SAAS,QAAQ,KAAa,OAAe,UAAU,IAAY;AACxE,MAAI,CAAC,eAAe,KAAK,GAAG,GAAG;AAC7B,WAAO;AAAA,EACT;AACA,SAAO,wBAAwB,KAAK,YAAY,OAAO,+BAA+B,GAAG;AAC3F;AAGO,SAAS,OAAO,KAAa,SAA0B;AAC5D,SAAO,aAAa;AAAA,IAClB,CAAC,UAAU,GAAG,QAAQ,KAAK,OAAO,OAAO,CAAC,IAAI,KAAK;AAAA,EACrD,EAAE,KAAK,IAAI;AACb;",
4
+ "sourcesContent": ["/** A value accepted by a template manifest and the live preview bridge. */\nexport type TemplateSettingValue = string | number | boolean;\n\n/** Where a template is running. Live sites never accept preview messages. */\nexport type TemplateMode = \"site\" | \"draft\" | \"review\";\n\n/** Merge defaults, saved settings, and preview values for the current mode. */\nexport function templateSettings<T extends Record<string, unknown>>(\n defaults: T,\n saved: Record<string, TemplateSettingValue> | undefined,\n preview: Record<string, TemplateSettingValue> | null,\n mode: TemplateMode,\n): T {\n if (mode === \"review\") {\n return { ...defaults, ...(preview ?? {}) };\n }\n if (mode === \"draft\") {\n return { ...defaults, ...saved, ...(preview ?? {}) };\n }\n return { ...defaults, ...saved };\n}\n\n/**\n * The Zappie editors allowed to frame a draft or review preview and talk to it: the merchant\n * dashboard (Studio), the admin dashboard (template review), and each one's local dev server.\n * The preview bridge posts only to the editor framing it, and only when that editor is listed here.\n */\nexport const EDITOR_ORIGINS: readonly string[] = Object.freeze([\n \"https://dashboard.zappie.ai\",\n \"https://dashboard.stg.zappie.ai\",\n \"https://admin.zappie.ai\",\n \"https://admin.stg.zappie.ai\",\n \"http://localhost:5181\",\n \"http://localhost:5180\",\n]);\n\n/**\n * Find the origin of the editor framing this page. The browser's `ancestorOrigins` is used where\n * it exists, and the referrer otherwise. Returns null unless that origin is in `EDITOR_ORIGINS`.\n */\nexport function editorOrigin(\n ancestorOrigins: ArrayLike<string> | null | undefined,\n referrer: string,\n allowed: readonly string[] = EDITOR_ORIGINS,\n): string | null {\n let origin: string | null = null;\n if (ancestorOrigins && ancestorOrigins.length > 0) {\n origin = ancestorOrigins[0] ?? null;\n } else if (referrer) {\n try {\n origin = new URL(referrer).origin;\n } catch {\n origin = null;\n }\n }\n return origin && allowed.includes(origin) ? origin : null;\n}\n\nconst MAX_SETTINGS = 200;\nconst MAX_SETTING_KEY = 100;\nconst MAX_SETTING_TEXT = 10_000;\n\n/** Read primitive setting values from an editor message. Oversized messages and values are dropped. */\nexport function settingsFromMessage(\n data: unknown,\n): Record<string, TemplateSettingValue> | null {\n if (!data || typeof data !== \"object\") {\n return null;\n }\n const message = data as { zappie?: unknown; values?: unknown };\n if (\n message.zappie !== \"settings\" ||\n !message.values ||\n typeof message.values !== \"object\" ||\n Array.isArray(message.values)\n ) {\n return null;\n }\n const entries = Object.entries(message.values);\n if (entries.length > MAX_SETTINGS) {\n return null;\n }\n const values: Record<string, TemplateSettingValue> = {};\n for (const [key, value] of entries) {\n if (key.length > MAX_SETTING_KEY) {\n continue;\n }\n if (\n (typeof value === \"string\" && value.length <= MAX_SETTING_TEXT) ||\n (typeof value === \"number\" && Number.isFinite(value)) ||\n typeof value === \"boolean\"\n ) {\n values[key] = value;\n }\n }\n return values;\n}\n\n/** Cloudflare image widths shared by template sites. */\nexport const IMAGE_WIDTHS = [320, 480, 640, 960, 1280, 1600] as const;\n\n/** Build a same-origin Cloudflare resize URL for an external image. */\nexport function resized(src: string, width: number, quality = 80): string {\n if (!/^https?:\\/\\//.test(src)) {\n return src;\n }\n return `/cdn-cgi/image/width=${width},quality=${quality},format=auto,fit=scale-down/${src}`;\n}\n\n/** Build the responsive Cloudflare image candidates used by a template. */\nexport function srcSet(src: string, quality?: number): string {\n return IMAGE_WIDTHS.map(\n (width) => `${resized(src, width, quality)} ${width}w`,\n ).join(\", \");\n}\n"],
5
+ "mappings": ";AAOO,SAAS,iBACd,UACA,OACA,SACA,MACG;AACH,MAAI,SAAS,UAAU;AACrB,WAAO,EAAE,GAAG,UAAU,GAAI,WAAW,CAAC,EAAG;AAAA,EAC3C;AACA,MAAI,SAAS,SAAS;AACpB,WAAO,EAAE,GAAG,UAAU,GAAG,OAAO,GAAI,WAAW,CAAC,EAAG;AAAA,EACrD;AACA,SAAO,EAAE,GAAG,UAAU,GAAG,MAAM;AACjC;AAOO,IAAM,iBAAoC,OAAO,OAAO;AAAA,EAC7D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMM,SAAS,aACd,iBACA,UACA,UAA6B,gBACd;AACf,MAAI,SAAwB;AAC5B,MAAI,mBAAmB,gBAAgB,SAAS,GAAG;AACjD,aAAS,gBAAgB,CAAC,KAAK;AAAA,EACjC,WAAW,UAAU;AACnB,QAAI;AACF,eAAS,IAAI,IAAI,QAAQ,EAAE;AAAA,IAC7B,QAAQ;AACN,eAAS;AAAA,IACX;AAAA,EACF;AACA,SAAO,UAAU,QAAQ,SAAS,MAAM,IAAI,SAAS;AACvD;AAEA,IAAM,eAAe;AACrB,IAAM,kBAAkB;AACxB,IAAM,mBAAmB;AAGlB,SAAS,oBACd,MAC6C;AAC7C,MAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;AACrC,WAAO;AAAA,EACT;AACA,QAAM,UAAU;AAChB,MACE,QAAQ,WAAW,cACnB,CAAC,QAAQ,UACT,OAAO,QAAQ,WAAW,YAC1B,MAAM,QAAQ,QAAQ,MAAM,GAC5B;AACA,WAAO;AAAA,EACT;AACA,QAAM,UAAU,OAAO,QAAQ,QAAQ,MAAM;AAC7C,MAAI,QAAQ,SAAS,cAAc;AACjC,WAAO;AAAA,EACT;AACA,QAAM,SAA+C,CAAC;AACtD,aAAW,CAAC,KAAK,KAAK,KAAK,SAAS;AAClC,QAAI,IAAI,SAAS,iBAAiB;AAChC;AAAA,IACF;AACA,QACG,OAAO,UAAU,YAAY,MAAM,UAAU,oBAC7C,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,KACnD,OAAO,UAAU,WACjB;AACA,aAAO,GAAG,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAGO,IAAM,eAAe,CAAC,KAAK,KAAK,KAAK,KAAK,MAAM,IAAI;AAGpD,SAAS,QAAQ,KAAa,OAAe,UAAU,IAAY;AACxE,MAAI,CAAC,eAAe,KAAK,GAAG,GAAG;AAC7B,WAAO;AAAA,EACT;AACA,SAAO,wBAAwB,KAAK,YAAY,OAAO,+BAA+B,GAAG;AAC3F;AAGO,SAAS,OAAO,KAAa,SAA0B;AAC5D,SAAO,aAAa;AAAA,IAClB,CAAC,UAAU,GAAG,QAAQ,KAAK,OAAO,OAAO,CAAC,IAAI,KAAK;AAAA,EACrD,EAAE,KAAK,IAAI;AACb;",
6
6
  "names": []
7
7
  }
@@ -3,6 +3,7 @@
3
3
  // src/template/react.tsx
4
4
  import { useStore } from "@zappie/sdk/react";
5
5
  import {
6
+ editorOrigin,
6
7
  settingsFromMessage,
7
8
  templateSettings
8
9
  } from "@zappie/sdk/template";
@@ -25,7 +26,14 @@ function TemplateSettingsProvider({
25
26
  if (mode === "site") {
26
27
  return;
27
28
  }
28
- const send = (message2) => window.parent.postMessage(message2, "*");
29
+ if (window.parent === window) {
30
+ return;
31
+ }
32
+ const parent = editorOrigin(location.ancestorOrigins, document.referrer);
33
+ if (!parent) {
34
+ return;
35
+ }
36
+ const send = (message2) => window.parent.postMessage(message2, parent);
29
37
  const route = () => send({ zappie: "route", path: location.pathname + location.search });
30
38
  const scroll = () => send({
31
39
  zappie: "scroll",
@@ -33,6 +41,9 @@ function TemplateSettingsProvider({
33
41
  height: document.documentElement.scrollHeight
34
42
  });
35
43
  const message = (event) => {
44
+ if (event.origin !== parent || event.source !== window.parent) {
45
+ return;
46
+ }
36
47
  const values = settingsFromMessage(event.data);
37
48
  if (values) {
38
49
  setPreview(values);
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "version": 3,
3
3
  "sources": ["../../src/template/react.tsx"],
4
- "sourcesContent": ["\"use client\";\nimport { useStore } from \"@zappie/sdk/react\";\nimport {\n settingsFromMessage,\n templateSettings,\n type TemplateMode,\n type TemplateSettingValue,\n} from \"@zappie/sdk/template\";\nimport {\n createContext,\n useContext,\n useEffect,\n useMemo,\n useState,\n type ReactNode,\n} from \"react\";\n\nconst Context = createContext<{\n mode: TemplateMode;\n preview: Record<string, TemplateSettingValue> | null;\n}>({ mode: \"site\", preview: null });\n\n/** Supply the host-controlled template mode and editor bridge to a storefront. */\nexport function TemplateSettingsProvider({\n mode,\n children,\n}: {\n mode: TemplateMode;\n children: ReactNode;\n}) {\n const [preview, setPreview] = useState<Record<\n string,\n TemplateSettingValue\n > | null>(null);\n useEffect(() => {\n setPreview(null);\n if (mode === \"site\") {\n return;\n }\n const send = (message: object) => window.parent.postMessage(message, \"*\");\n const route = () =>\n send({ zappie: \"route\", path: location.pathname + location.search });\n const scroll = () =>\n send({\n zappie: \"scroll\",\n y: window.scrollY,\n height: document.documentElement.scrollHeight,\n });\n const message = (event: MessageEvent) => {\n const values = settingsFromMessage(event.data);\n if (values) {\n setPreview(values);\n }\n };\n const pushState = history.pushState;\n const replaceState = history.replaceState;\n history.pushState = function (...args) {\n pushState.apply(this, args);\n route();\n };\n history.replaceState = function (...args) {\n replaceState.apply(this, args);\n route();\n };\n window.addEventListener(\"message\", message);\n window.addEventListener(\"popstate\", route);\n window.addEventListener(\"scroll\", scroll, { passive: true });\n send({ zappie: \"ready\" });\n route();\n scroll();\n return () => {\n window.removeEventListener(\"message\", message);\n window.removeEventListener(\"popstate\", route);\n window.removeEventListener(\"scroll\", scroll);\n history.pushState = pushState;\n history.replaceState = replaceState;\n };\n }, [mode]);\n const value = useMemo(() => ({ mode, preview }), [mode, preview]);\n return <Context.Provider value={value}>{children}</Context.Provider>;\n}\n\n/** Read effective merchant settings over the defaults declared by a template. */\nexport function useTemplateSettings<T extends Record<string, unknown>>(\n defaults: T,\n): T {\n const store = useStore();\n const { mode, preview } = useContext(Context);\n return templateSettings(\n defaults,\n store.data?.templateSettings,\n preview,\n mode,\n );\n}\n"],
5
- "mappings": ";;;AACA,SAAS,gBAAgB;AACzB;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAgEE;AA9DT,IAAM,UAAU,cAGb,EAAE,MAAM,QAAQ,SAAS,KAAK,CAAC;AAG3B,SAAS,yBAAyB;AAAA,EACvC;AAAA,EACA;AACF,GAGG;AACD,QAAM,CAAC,SAAS,UAAU,IAAI,SAGpB,IAAI;AACd,YAAU,MAAM;AACd,eAAW,IAAI;AACf,QAAI,SAAS,QAAQ;AACnB;AAAA,IACF;AACA,UAAM,OAAO,CAACA,aAAoB,OAAO,OAAO,YAAYA,UAAS,GAAG;AACxE,UAAM,QAAQ,MACZ,KAAK,EAAE,QAAQ,SAAS,MAAM,SAAS,WAAW,SAAS,OAAO,CAAC;AACrE,UAAM,SAAS,MACb,KAAK;AAAA,MACH,QAAQ;AAAA,MACR,GAAG,OAAO;AAAA,MACV,QAAQ,SAAS,gBAAgB;AAAA,IACnC,CAAC;AACH,UAAM,UAAU,CAAC,UAAwB;AACvC,YAAM,SAAS,oBAAoB,MAAM,IAAI;AAC7C,UAAI,QAAQ;AACV,mBAAW,MAAM;AAAA,MACnB;AAAA,IACF;AACA,UAAM,YAAY,QAAQ;AAC1B,UAAM,eAAe,QAAQ;AAC7B,YAAQ,YAAY,YAAa,MAAM;AACrC,gBAAU,MAAM,MAAM,IAAI;AAC1B,YAAM;AAAA,IACR;AACA,YAAQ,eAAe,YAAa,MAAM;AACxC,mBAAa,MAAM,MAAM,IAAI;AAC7B,YAAM;AAAA,IACR;AACA,WAAO,iBAAiB,WAAW,OAAO;AAC1C,WAAO,iBAAiB,YAAY,KAAK;AACzC,WAAO,iBAAiB,UAAU,QAAQ,EAAE,SAAS,KAAK,CAAC;AAC3D,SAAK,EAAE,QAAQ,QAAQ,CAAC;AACxB,UAAM;AACN,WAAO;AACP,WAAO,MAAM;AACX,aAAO,oBAAoB,WAAW,OAAO;AAC7C,aAAO,oBAAoB,YAAY,KAAK;AAC5C,aAAO,oBAAoB,UAAU,MAAM;AAC3C,cAAQ,YAAY;AACpB,cAAQ,eAAe;AAAA,IACzB;AAAA,EACF,GAAG,CAAC,IAAI,CAAC;AACT,QAAM,QAAQ,QAAQ,OAAO,EAAE,MAAM,QAAQ,IAAI,CAAC,MAAM,OAAO,CAAC;AAChE,SAAO,oBAAC,QAAQ,UAAR,EAAiB,OAAe,UAAS;AACnD;AAGO,SAAS,oBACd,UACG;AACH,QAAM,QAAQ,SAAS;AACvB,QAAM,EAAE,MAAM,QAAQ,IAAI,WAAW,OAAO;AAC5C,SAAO;AAAA,IACL;AAAA,IACA,MAAM,MAAM;AAAA,IACZ;AAAA,IACA;AAAA,EACF;AACF;",
4
+ "sourcesContent": ["\"use client\";\nimport { useStore } from \"@zappie/sdk/react\";\nimport {\n editorOrigin,\n settingsFromMessage,\n templateSettings,\n type TemplateMode,\n type TemplateSettingValue,\n} from \"@zappie/sdk/template\";\nimport {\n createContext,\n useContext,\n useEffect,\n useMemo,\n useState,\n type ReactNode,\n} from \"react\";\n\nconst Context = createContext<{\n mode: TemplateMode;\n preview: Record<string, TemplateSettingValue> | null;\n}>({ mode: \"site\", preview: null });\n\n/** Supply the host-controlled template mode and editor bridge to a storefront. */\nexport function TemplateSettingsProvider({\n mode,\n children,\n}: {\n mode: TemplateMode;\n children: ReactNode;\n}) {\n const [preview, setPreview] = useState<Record<\n string,\n TemplateSettingValue\n > | null>(null);\n useEffect(() => {\n setPreview(null);\n if (mode === \"site\") {\n return;\n }\n if (window.parent === window) {\n return;\n }\n // Talk only to an allowed Zappie editor framing this page. Anything else gets silence.\n const parent = editorOrigin(location.ancestorOrigins, document.referrer);\n if (!parent) {\n return;\n }\n const send = (message: object) =>\n window.parent.postMessage(message, parent);\n const route = () =>\n send({ zappie: \"route\", path: location.pathname + location.search });\n const scroll = () =>\n send({\n zappie: \"scroll\",\n y: window.scrollY,\n height: document.documentElement.scrollHeight,\n });\n const message = (event: MessageEvent) => {\n if (event.origin !== parent || event.source !== window.parent) {\n return;\n }\n const values = settingsFromMessage(event.data);\n if (values) {\n setPreview(values);\n }\n };\n const pushState = history.pushState;\n const replaceState = history.replaceState;\n history.pushState = function (...args) {\n pushState.apply(this, args);\n route();\n };\n history.replaceState = function (...args) {\n replaceState.apply(this, args);\n route();\n };\n window.addEventListener(\"message\", message);\n window.addEventListener(\"popstate\", route);\n window.addEventListener(\"scroll\", scroll, { passive: true });\n send({ zappie: \"ready\" });\n route();\n scroll();\n return () => {\n window.removeEventListener(\"message\", message);\n window.removeEventListener(\"popstate\", route);\n window.removeEventListener(\"scroll\", scroll);\n history.pushState = pushState;\n history.replaceState = replaceState;\n };\n }, [mode]);\n const value = useMemo(() => ({ mode, preview }), [mode, preview]);\n return <Context.Provider value={value}>{children}</Context.Provider>;\n}\n\n/** Read effective merchant settings over the defaults declared by a template. */\nexport function useTemplateSettings<T extends Record<string, unknown>>(\n defaults: T,\n): T {\n const store = useStore();\n const { mode, preview } = useContext(Context);\n return templateSettings(\n defaults,\n store.data?.templateSettings,\n preview,\n mode,\n );\n}\n"],
5
+ "mappings": ";;;AACA,SAAS,gBAAgB;AACzB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AA4EE;AA1ET,IAAM,UAAU,cAGb,EAAE,MAAM,QAAQ,SAAS,KAAK,CAAC;AAG3B,SAAS,yBAAyB;AAAA,EACvC;AAAA,EACA;AACF,GAGG;AACD,QAAM,CAAC,SAAS,UAAU,IAAI,SAGpB,IAAI;AACd,YAAU,MAAM;AACd,eAAW,IAAI;AACf,QAAI,SAAS,QAAQ;AACnB;AAAA,IACF;AACA,QAAI,OAAO,WAAW,QAAQ;AAC5B;AAAA,IACF;AAEA,UAAM,SAAS,aAAa,SAAS,iBAAiB,SAAS,QAAQ;AACvE,QAAI,CAAC,QAAQ;AACX;AAAA,IACF;AACA,UAAM,OAAO,CAACA,aACZ,OAAO,OAAO,YAAYA,UAAS,MAAM;AAC3C,UAAM,QAAQ,MACZ,KAAK,EAAE,QAAQ,SAAS,MAAM,SAAS,WAAW,SAAS,OAAO,CAAC;AACrE,UAAM,SAAS,MACb,KAAK;AAAA,MACH,QAAQ;AAAA,MACR,GAAG,OAAO;AAAA,MACV,QAAQ,SAAS,gBAAgB;AAAA,IACnC,CAAC;AACH,UAAM,UAAU,CAAC,UAAwB;AACvC,UAAI,MAAM,WAAW,UAAU,MAAM,WAAW,OAAO,QAAQ;AAC7D;AAAA,MACF;AACA,YAAM,SAAS,oBAAoB,MAAM,IAAI;AAC7C,UAAI,QAAQ;AACV,mBAAW,MAAM;AAAA,MACnB;AAAA,IACF;AACA,UAAM,YAAY,QAAQ;AAC1B,UAAM,eAAe,QAAQ;AAC7B,YAAQ,YAAY,YAAa,MAAM;AACrC,gBAAU,MAAM,MAAM,IAAI;AAC1B,YAAM;AAAA,IACR;AACA,YAAQ,eAAe,YAAa,MAAM;AACxC,mBAAa,MAAM,MAAM,IAAI;AAC7B,YAAM;AAAA,IACR;AACA,WAAO,iBAAiB,WAAW,OAAO;AAC1C,WAAO,iBAAiB,YAAY,KAAK;AACzC,WAAO,iBAAiB,UAAU,QAAQ,EAAE,SAAS,KAAK,CAAC;AAC3D,SAAK,EAAE,QAAQ,QAAQ,CAAC;AACxB,UAAM;AACN,WAAO;AACP,WAAO,MAAM;AACX,aAAO,oBAAoB,WAAW,OAAO;AAC7C,aAAO,oBAAoB,YAAY,KAAK;AAC5C,aAAO,oBAAoB,UAAU,MAAM;AAC3C,cAAQ,YAAY;AACpB,cAAQ,eAAe;AAAA,IACzB;AAAA,EACF,GAAG,CAAC,IAAI,CAAC;AACT,QAAM,QAAQ,QAAQ,OAAO,EAAE,MAAM,QAAQ,IAAI,CAAC,MAAM,OAAO,CAAC;AAChE,SAAO,oBAAC,QAAQ,UAAR,EAAiB,OAAe,UAAS;AACnD;AAGO,SAAS,oBACd,UACG;AACH,QAAM,QAAQ,SAAS;AACvB,QAAM,EAAE,MAAM,QAAQ,IAAI,WAAW,OAAO;AAC5C,SAAO;AAAA,IACL;AAAA,IACA,MAAM,MAAM;AAAA,IACZ;AAAA,IACA;AAAA,EACF;AACF;",
6
6
  "names": ["message"]
7
7
  }
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@zappie/sdk",
3
- "version": "0.1.14",
3
+ "version": "0.1.16",
4
4
  "description": "Typed, framework-agnostic client for Zappie menus, carts, checkout, auth and events.",
5
5
  "type": "module",
6
6
  "sideEffects": false,