@zappie/sdk 0.1.15 → 0.1.17

package/dist/server/edge-snapshot.js

@@ -0,0 +1,200 @@
+// src/server/edge-snapshot.ts
+import { mapMenu } from "../transport/mappers.js";
+var snapshotKeys = {
+  /** `store:<storeId>` holds a StoreSnapshot. */
+  store: (storeId) => `store:${storeId}`,
+  /** `menu:<storeId>:<branchId>`, or `menu:<storeId>` for the default branch. */
+  menu: (storeId, branchId) => branchId === void 0 ? `menu:${storeId}` : `menu:${storeId}:${branchId}`,
+  /** `avail:<storeId>:<branchId>` holds an AvailabilityPatch. */
+  availability: (storeId, branchId) => `avail:${storeId}:${branchId}`,
+  /** `ver:<storeId>` holds a SnapshotVersionRecord. */
+  version: (storeId) => `ver:${storeId}`
+};
+function canonical(value, seen) {
+  if (value === null || typeof value === "boolean") {
+    return JSON.stringify(value);
+  }
+  if (typeof value === "string") {
+    return JSON.stringify(value);
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new TypeError("Canonical JSON can't hold a non-finite number.");
+    }
+    return JSON.stringify(value);
+  }
+  if (typeof value !== "object") {
+    throw new TypeError(`Canonical JSON can't hold a ${typeof value}.`);
+  }
+  if (seen.has(value)) {
+    throw new TypeError("Canonical JSON can't hold a cycle.");
+  }
+  seen.add(value);
+  let out;
+  if (Array.isArray(value)) {
+    out = `[${value.map((entry) => entry === void 0 ? "null" : canonical(entry, seen)).join(",")}]`;
+  } else {
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+      throw new TypeError("Canonical JSON holds plain objects only.");
+    }
+    out = `{${Object.keys(value).filter((key) => value[key] !== void 0).sort().map(
+      (key) => `${JSON.stringify(key)}:${canonical(value[key], seen)}`
+    ).join(",")}}`;
+  }
+  seen.delete(value);
+  return out;
+}
+function canonicalJson(value) {
+  return canonical(value, /* @__PURE__ */ new Set());
+}
+async function snapshotHash(value) {
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(canonicalJson(value))
+  );
+  return Array.from(
+    new Uint8Array(digest).slice(0, 8),
+    (byte) => byte.toString(16).padStart(2, "0")
+  ).join("");
+}
+var isoTime = (value) => {
+  const time = value === void 0 ? /* @__PURE__ */ new Date() : new Date(value);
+  if (Number.isNaN(time.getTime())) {
+    throw new TypeError("Snapshot times must be valid dates.");
+  }
+  return time.toISOString();
+};
+async function createMenuSnapshot({
+  storeId,
+  menu,
+  builtAt,
+  sourceUpdatedAt
+}) {
+  if (!storeId || !menu.branchId || !menu.version) {
+    throw new TypeError(
+      "A menu snapshot needs a store, a branch and a menu version."
+    );
+  }
+  if (menu.completeness === "partial") {
+    throw new TypeError("A partial menu can't become a snapshot.");
+  }
+  return {
+    v: 1,
+    storeId,
+    branchId: menu.branchId,
+    version: menu.version,
+    contentHash: await snapshotHash(menu),
+    builtAt: isoTime(builtAt),
+    ...sourceUpdatedAt === void 0 ? {} : { sourceUpdatedAt: isoTime(sourceUpdatedAt) },
+    menu
+  };
+}
+async function menuSnapshotFromPayload({
+  storeId,
+  branchId,
+  payload,
+  builtAt
+}) {
+  const menu = mapMenu(payload, branchId);
+  const updates = (Array.isArray(payload?.menus) ? payload.menus : []).map((source) => source?.updated_at).filter(
+    (value) => typeof value === "string" && !Number.isNaN(Date.parse(value))
+  ).sort((left, right) => Date.parse(right) - Date.parse(left));
+  return createMenuSnapshot({
+    storeId,
+    menu,
+    ...builtAt === void 0 ? {} : { builtAt },
+    ...updates[0] === void 0 ? {} : { sourceUpdatedAt: updates[0] }
+  });
+}
+async function createStoreSnapshot({
+  store,
+  builtAt
+}) {
+  if (!store.id) {
+    throw new TypeError("A store snapshot needs a store id.");
+  }
+  return {
+    v: 1,
+    storeId: store.id,
+    contentHash: await snapshotHash(store),
+    builtAt: isoTime(builtAt),
+    store
+  };
+}
+var ids = (values) => [...new Set(values ?? [])].sort();
+async function createAvailabilityPatch(input) {
+  if (!input.menuVersion) {
+    throw new TypeError("An availability patch needs the API's menu version.");
+  }
+  const content = {
+    v: 1,
+    menuVersion: input.menuVersion,
+    soldOutItems: ids(input.soldOutItems),
+    soldOutVariants: ids(input.soldOutVariants),
+    soldOutOptions: ids(input.soldOutOptions),
+    ...input.closedUntil === void 0 ? {} : { closedUntil: isoTime(input.closedUntil) }
+  };
+  return {
+    ...content,
+    version: await snapshotHash(content),
+    updatedAt: isoTime(input.updatedAt)
+  };
+}
+function applyAvailability(snapshot, patch) {
+  if (!patch || Date.parse(patch.updatedAt) < Date.parse(snapshot.builtAt)) {
+    return snapshot.menu;
+  }
+  const items = new Set(patch.soldOutItems);
+  const variants = new Set(patch.soldOutVariants);
+  const options = new Set(patch.soldOutOptions);
+  return {
+    ...snapshot.menu,
+    version: patch.menuVersion,
+    items: Object.fromEntries(
+      Object.entries(snapshot.menu.items).map(([id, item]) => {
+        const touched = item.variants.some(
+          (variant) => variants.has(variant.id)
+        );
+        const patched = item.variants.map(
+          (variant) => variants.has(variant.id) ? { ...variant, isAvailable: false } : variant
+        );
+        return [
+          id,
+          {
+            ...item,
+            // Selling out every variant sells out the item.
+            isAvailable: item.isAvailable && !items.has(id) && (!touched || patched.some((variant) => variant.isAvailable)),
+            variants: patched,
+            optionGroups: item.optionGroups.map((group) => ({
+              ...group,
+              choices: group.choices.map(
+                (choice) => options.has(choice.id) ? { ...choice, isAvailable: false } : choice
+              )
+            }))
+          }
+        ];
+      })
+    )
+  };
+}
+function isMenuSnapshot(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  const snapshot = value;
+  const menu = snapshot.menu;
+  return snapshot.v === 1 && typeof snapshot.storeId === "string" && typeof snapshot.branchId === "string" && typeof snapshot.version === "string" && typeof snapshot.contentHash === "string" && typeof snapshot.builtAt === "string" && !!menu && typeof menu === "object" && menu.branchId === snapshot.branchId && menu.version === snapshot.version && menu.completeness !== "partial" && Array.isArray(menu.categories) && !!menu.items && typeof menu.items === "object";
+}
+export {
+  applyAvailability,
+  canonicalJson,
+  createAvailabilityPatch,
+  createMenuSnapshot,
+  createStoreSnapshot,
+  isMenuSnapshot,
+  menuSnapshotFromPayload,
+  snapshotHash,
+  snapshotKeys
+};
+//# sourceMappingURL=edge-snapshot.js.map

package/dist/server/edge-snapshot.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/server/edge-snapshot.ts"],
+  "sourcesContent": ["import type { Menu, Store } from \"../models\";\nimport { mapMenu } from \"../transport/mappers\";\n\n/**\n * A branch catalogue as the edge keeps it: the SDK `Menu` that `menu.get()`\n * returns, with the facts a snapshot writer and reader need around it.\n */\nexport type MenuSnapshot = {\n  v: 1;\n  storeId: string;\n  branchId: string;\n  /** The API's menu version, the same value `GET /menus/version` returns. */\n  version: string;\n  /** The first 16 hex digits of the SHA-256 of the menu's canonical JSON. */\n  contentHash: string;\n  /** When the snapshot was built, as an ISO time. */\n  builtAt: string;\n  /** The latest change among the source menus, as an ISO time, when the API sends it. */\n  sourceUpdatedAt?: string;\n  /** A complete branch catalogue. Partial category pages never become snapshots. */\n  menu: Menu;\n};\n\n/** Store details as the edge keeps them: the SDK `Store` that `store.get()` returns. */\nexport type StoreSnapshot = {\n  v: 1;\n  storeId: string;\n  /** The first 16 hex digits of the SHA-256 of the store's canonical JSON. */\n  contentHash: string;\n  /** When the snapshot was built, as an ISO time. */\n  builtAt: string;\n  store: Store;\n};\n\n/**\n * What sold out since a branch's menu snapshot was built. It is small, so an\n * availability change rewrites about 1 KB instead of the whole menu.\n */\nexport type AvailabilityPatch = {\n  v: 1;\n  /** The first 16 hex digits of the SHA-256 of this patch's canonical JSON. */\n  version: string;\n  /** The API's menu version after this change. A patched menu reports it. */\n  menuVersion: string;\n  soldOutItems: string[];\n  soldOutVariants: string[];\n  /** Choice ids in option groups. */\n  soldOutOptions: string[];\n  /** When the branch reopens, as an ISO time, if it is closed for now. */\n  closedUntil?: string;\n  /** When the patch was built, as an ISO time. */\n  updatedAt: string;\n};\n\n/** The version record a writer saves last, so readers never see unwritten data. */\nexport type SnapshotVersionRecord = {\n  /** The default branch's menu version. */\n  version: string;\n  builtAt: string;\n  branches: Record<string, string>;\n};\n\n/** The edge key-value names for each snapshot. */\nexport const snapshotKeys = {\n  /** `store:<storeId>` holds a StoreSnapshot. */\n  store: (storeId: string) => `store:${storeId}`,\n  /** `menu:<storeId>:<branchId>`, or `menu:<storeId>` for the default branch. */\n  menu: (storeId: string, branchId?: string) =>\n    branchId === undefined ? `menu:${storeId}` : `menu:${storeId}:${branchId}`,\n  /** `avail:<storeId>:<branchId>` holds an AvailabilityPatch. */\n  availability: (storeId: string, branchId: string) =>\n    `avail:${storeId}:${branchId}`,\n  /** `ver:<storeId>` holds a SnapshotVersionRecord. */\n  version: (storeId: string) => `ver:${storeId}`,\n} as const;\n\nfunction canonical(value: unknown, seen: Set<object>): string {\n  if (value === null || typeof value === \"boolean\") {\n    return JSON.stringify(value);\n  }\n  if (typeof value === \"string\") {\n    return JSON.stringify(value);\n  }\n  if (typeof value === \"number\") {\n    if (!Number.isFinite(value)) {\n      throw new TypeError(\"Canonical JSON can't hold a non-finite number.\");\n    }\n    return JSON.stringify(value);\n  }\n  if (typeof value !== \"object\") {\n    throw new TypeError(`Canonical JSON can't hold a ${typeof value}.`);\n  }\n  if (seen.has(value)) {\n    throw new TypeError(\"Canonical JSON can't hold a cycle.\");\n  }\n  seen.add(value);\n  let out: string;\n  if (Array.isArray(value)) {\n    out = `[${value\n      .map((entry) => (entry === undefined ? \"null\" : canonical(entry, seen)))\n      .join(\",\")}]`;\n  } else {\n    const prototype = Object.getPrototypeOf(value) as unknown;\n    if (prototype !== Object.prototype && prototype !== null) {\n      throw new TypeError(\"Canonical JSON holds plain objects only.\");\n    }\n    out = `{${Object.keys(value)\n      .filter((key) => (value as Record<string, unknown>)[key] !== undefined)\n      .sort()\n      .map(\n        (key) =>\n          `${JSON.stringify(key)}:${canonical((value as Record<string, unknown>)[key], seen)}`,\n      )\n      .join(\",\")}}`;\n  }\n  seen.delete(value);\n  return out;\n}\n\n/**\n * Serialise a JSON value with object keys in sorted order and undefined\n * properties left out, so equal values always give the same text.\n */\nexport function canonicalJson(value: unknown): string {\n  return canonical(value, new Set());\n}\n\n/** Hash a JSON value: the first 16 hex digits of the SHA-256 of its canonical JSON. */\nexport async function snapshotHash(value: unknown): Promise<string> {\n  const digest = await crypto.subtle.digest(\n    \"SHA-256\",\n    new TextEncoder().encode(canonicalJson(value)),\n  );\n  return Array.from(new Uint8Array(digest).slice(0, 8), (byte) =>\n    byte.toString(16).padStart(2, \"0\"),\n  ).join(\"\");\n}\n\nconst isoTime = (value: Date | string | undefined) => {\n  const time = value === undefined ? new Date() : new Date(value);\n  if (Number.isNaN(time.getTime())) {\n    throw new TypeError(\"Snapshot times must be valid dates.\");\n  }\n  return time.toISOString();\n};\n\n/** Input for building a MenuSnapshot from an SDK menu. */\nexport type MenuSnapshotInput = {\n  storeId: string;\n  menu: Menu;\n  /** Defaults to now. */\n  builtAt?: Date | string;\n  sourceUpdatedAt?: Date | string;\n};\n\n/** Build a MenuSnapshot from a complete SDK menu. */\nexport async function createMenuSnapshot({\n  storeId,\n  menu,\n  builtAt,\n  sourceUpdatedAt,\n}: MenuSnapshotInput): Promise<MenuSnapshot> {\n  if (!storeId || !menu.branchId || !menu.version) {\n    throw new TypeError(\n      \"A menu snapshot needs a store, a branch and a menu version.\",\n    );\n  }\n  if (menu.completeness === \"partial\") {\n    throw new TypeError(\"A partial menu can't become a snapshot.\");\n  }\n  return {\n    v: 1,\n    storeId,\n    branchId: menu.branchId,\n    version: menu.version,\n    contentHash: await snapshotHash(menu),\n    builtAt: isoTime(builtAt),\n    ...(sourceUpdatedAt === undefined\n      ? {}\n      : { sourceUpdatedAt: isoTime(sourceUpdatedAt) }),\n    menu,\n  };\n}\n\n/** Input for building a MenuSnapshot from the API's menu payload. */\nexport type MenuSnapshotPayloadInput = {\n  storeId: string;\n  branchId: string;\n  /** The JSON body of the API's branch menu read. */\n  payload: unknown;\n  /** Defaults to now. */\n  builtAt?: Date | string;\n};\n\n/**\n * Build a MenuSnapshot from the API's branch menu payload. It maps the payload\n * with the same mapper `menu.get()` uses, so the snapshot's menu is exactly\n * what the client SDK returns.\n */\nexport async function menuSnapshotFromPayload({\n  storeId,\n  branchId,\n  payload,\n  builtAt,\n}: MenuSnapshotPayloadInput): Promise<MenuSnapshot> {\n  const menu = mapMenu(payload, branchId);\n  const updates = (\n    Array.isArray((payload as { menus?: unknown } | null)?.menus)\n      ? ((payload as { menus: unknown[] }).menus as { updated_at?: unknown }[])\n      : []\n  )\n    .map((source) => source?.updated_at)\n    .filter(\n      (value): value is string =>\n        typeof value === \"string\" && !Number.isNaN(Date.parse(value)),\n    )\n    .sort((left, right) => Date.parse(right) - Date.parse(left));\n  return createMenuSnapshot({\n    storeId,\n    menu,\n    ...(builtAt === undefined ? {} : { builtAt }),\n    ...(updates[0] === undefined ? {} : { sourceUpdatedAt: updates[0] }),\n  });\n}\n\n/** Build a StoreSnapshot from an SDK store. */\nexport async function createStoreSnapshot({\n  store,\n  builtAt,\n}: {\n  store: Store;\n  builtAt?: Date | string;\n}): Promise<StoreSnapshot> {\n  if (!store.id) {\n    throw new TypeError(\"A store snapshot needs a store id.\");\n  }\n  return {\n    v: 1,\n    storeId: store.id,\n    contentHash: await snapshotHash(store),\n    builtAt: isoTime(builtAt),\n    store,\n  };\n}\n\n/** Input for building an AvailabilityPatch. */\nexport type AvailabilityPatchInput = {\n  menuVersion: string;\n  soldOutItems?: readonly string[];\n  soldOutVariants?: readonly string[];\n  soldOutOptions?: readonly string[];\n  closedUntil?: Date | string;\n  /** Defaults to now. */\n  updatedAt?: Date | string;\n};\n\nconst ids = (values: readonly string[] | undefined) =>\n  [...new Set(values ?? [])].sort();\n\n/** Build an AvailabilityPatch with sorted, unique ids and its content hash. */\nexport async function createAvailabilityPatch(\n  input: AvailabilityPatchInput,\n): Promise<AvailabilityPatch> {\n  if (!input.menuVersion) {\n    throw new TypeError(\"An availability patch needs the API's menu version.\");\n  }\n  const content = {\n    v: 1 as const,\n    menuVersion: input.menuVersion,\n    soldOutItems: ids(input.soldOutItems),\n    soldOutVariants: ids(input.soldOutVariants),\n    soldOutOptions: ids(input.soldOutOptions),\n    ...(input.closedUntil === undefined\n      ? {}\n      : { closedUntil: isoTime(input.closedUntil) }),\n  };\n  return {\n    ...content,\n    version: await snapshotHash(content),\n    updatedAt: isoTime(input.updatedAt),\n  };\n}\n\n/**\n * Return the snapshot's menu with an availability patch applied. A patch\n * built before the snapshot is ignored, because the rebuilt menu already\n * holds newer availability. The result reports the patch's menu version.\n */\nexport function applyAvailability(\n  snapshot: MenuSnapshot,\n  patch: AvailabilityPatch | null | undefined,\n): Menu {\n  if (!patch || Date.parse(patch.updatedAt) < Date.parse(snapshot.builtAt)) {\n    return snapshot.menu;\n  }\n  const items = new Set(patch.soldOutItems);\n  const variants = new Set(patch.soldOutVariants);\n  const options = new Set(patch.soldOutOptions);\n  return {\n    ...snapshot.menu,\n    version: patch.menuVersion,\n    items: Object.fromEntries(\n      Object.entries(snapshot.menu.items).map(([id, item]) => {\n        const touched = item.variants.some((variant) =>\n          variants.has(variant.id),\n        );\n        const patched = item.variants.map((variant) =>\n          variants.has(variant.id)\n            ? { ...variant, isAvailable: false }\n            : variant,\n        ) as typeof item.variants;\n        return [\n          id,\n          {\n            ...item,\n            // Selling out every variant sells out the item.\n            isAvailable:\n              item.isAvailable &&\n              !items.has(id) &&\n              (!touched || patched.some((variant) => variant.isAvailable)),\n            variants: patched,\n            optionGroups: item.optionGroups.map((group) => ({\n              ...group,\n              choices: group.choices.map((choice) =>\n                options.has(choice.id)\n                  ? { ...choice, isAvailable: false }\n                  : choice,\n              ),\n            })),\n          },\n        ];\n      }),\n    ),\n  };\n}\n\n/** Check that a value read from the edge is a MenuSnapshot this SDK can use. */\nexport function isMenuSnapshot(value: unknown): value is MenuSnapshot {\n  if (!value || typeof value !== \"object\") {\n    return false;\n  }\n  const snapshot = value as Partial<MenuSnapshot>;\n  const menu = snapshot.menu as Partial<Menu> | undefined;\n  return (\n    snapshot.v === 1 &&\n    typeof snapshot.storeId === \"string\" &&\n    typeof snapshot.branchId === \"string\" &&\n    typeof snapshot.version === \"string\" &&\n    typeof snapshot.contentHash === \"string\" &&\n    typeof snapshot.builtAt === \"string\" &&\n    !!menu &&\n    typeof menu === \"object\" &&\n    menu.branchId === snapshot.branchId &&\n    menu.version === snapshot.version &&\n    menu.completeness !== \"partial\" &&\n    Array.isArray(menu.categories) &&\n    !!menu.items &&\n    typeof menu.items === \"object\"\n  );\n}\n"],
+  "mappings": ";AACA,SAAS,eAAe;AA8DjB,IAAM,eAAe;AAAA;AAAA,EAE1B,OAAO,CAAC,YAAoB,SAAS,OAAO;AAAA;AAAA,EAE5C,MAAM,CAAC,SAAiB,aACtB,aAAa,SAAY,QAAQ,OAAO,KAAK,QAAQ,OAAO,IAAI,QAAQ;AAAA;AAAA,EAE1E,cAAc,CAAC,SAAiB,aAC9B,SAAS,OAAO,IAAI,QAAQ;AAAA;AAAA,EAE9B,SAAS,CAAC,YAAoB,OAAO,OAAO;AAC9C;AAEA,SAAS,UAAU,OAAgB,MAA2B;AAC5D,MAAI,UAAU,QAAQ,OAAO,UAAU,WAAW;AAChD,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,YAAM,IAAI,UAAU,gDAAgD;AAAA,IACtE;AACA,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI,UAAU,+BAA+B,OAAO,KAAK,GAAG;AAAA,EACpE;AACA,MAAI,KAAK,IAAI,KAAK,GAAG;AACnB,UAAM,IAAI,UAAU,oCAAoC;AAAA,EAC1D;AACA,OAAK,IAAI,KAAK;AACd,MAAI;AACJ,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAM,IAAI,MACP,IAAI,CAAC,UAAW,UAAU,SAAY,SAAS,UAAU,OAAO,IAAI,CAAE,EACtE,KAAK,GAAG,CAAC;AAAA,EACd,OAAO;AACL,UAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,QAAI,cAAc,OAAO,aAAa,cAAc,MAAM;AACxD,YAAM,IAAI,UAAU,0CAA0C;AAAA,IAChE;AACA,UAAM,IAAI,OAAO,KAAK,KAAK,EACxB,OAAO,CAAC,QAAS,MAAkC,GAAG,MAAM,MAAS,EACrE,KAAK,EACL;AAAA,MACC,CAAC,QACC,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,UAAW,MAAkC,GAAG,GAAG,IAAI,CAAC;AAAA,IACtF,EACC,KAAK,GAAG,CAAC;AAAA,EACd;AACA,OAAK,OAAO,KAAK;AACjB,SAAO;AACT;AAMO,SAAS,cAAc,OAAwB;AACpD,SAAO,UAAU,OAAO,oBAAI,IAAI,CAAC;AACnC;AAGA,eAAsB,aAAa,OAAiC;AAClE,QAAM,SAAS,MAAM,OAAO,OAAO;AAAA,IACjC;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,cAAc,KAAK,CAAC;AAAA,EAC/C;AACA,SAAO,MAAM;AAAA,IAAK,IAAI,WAAW,MAAM,EAAE,MAAM,GAAG,CAAC;AAAA,IAAG,CAAC,SACrD,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAAA,EACnC,EAAE,KAAK,EAAE;AACX;AAEA,IAAM,UAAU,CAAC,UAAqC;AACpD,QAAM,OAAO,UAAU,SAAY,oBAAI,KAAK,IAAI,IAAI,KAAK,KAAK;AAC9D,MAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,GAAG;AAChC,UAAM,IAAI,UAAU,qCAAqC;AAAA,EAC3D;AACA,SAAO,KAAK,YAAY;AAC1B;AAYA,eAAsB,mBAAmB;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAA6C;AAC3C,MAAI,CAAC,WAAW,CAAC,KAAK,YAAY,CAAC,KAAK,SAAS;AAC/C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,KAAK,iBAAiB,WAAW;AACnC,UAAM,IAAI,UAAU,yCAAyC;AAAA,EAC/D;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,UAAU,KAAK;AAAA,IACf,SAAS,KAAK;AAAA,IACd,aAAa,MAAM,aAAa,IAAI;AAAA,IACpC,SAAS,QAAQ,OAAO;AAAA,IACxB,GAAI,oBAAoB,SACpB,CAAC,IACD,EAAE,iBAAiB,QAAQ,eAAe,EAAE;AAAA,IAChD;AAAA,EACF;AACF;AAiBA,eAAsB,wBAAwB;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAoD;AAClD,QAAM,OAAO,QAAQ,SAAS,QAAQ;AACtC,QAAM,WACJ,MAAM,QAAS,SAAwC,KAAK,IACtD,QAAiC,QACnC,CAAC,GAEJ,IAAI,CAAC,WAAW,QAAQ,UAAU,EAClC;AAAA,IACC,CAAC,UACC,OAAO,UAAU,YAAY,CAAC,OAAO,MAAM,KAAK,MAAM,KAAK,CAAC;AAAA,EAChE,EACC,KAAK,CAAC,MAAM,UAAU,KAAK,MAAM,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;AAC7D,SAAO,mBAAmB;AAAA,IACxB;AAAA,IACA;AAAA,IACA,GAAI,YAAY,SAAY,CAAC,IAAI,EAAE,QAAQ;AAAA,IAC3C,GAAI,QAAQ,CAAC,MAAM,SAAY,CAAC,IAAI,EAAE,iBAAiB,QAAQ,CAAC,EAAE;AAAA,EACpE,CAAC;AACH;AAGA,eAAsB,oBAAoB;AAAA,EACxC;AAAA,EACA;AACF,GAG2B;AACzB,MAAI,CAAC,MAAM,IAAI;AACb,UAAM,IAAI,UAAU,oCAAoC;AAAA,EAC1D;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS,MAAM;AAAA,IACf,aAAa,MAAM,aAAa,KAAK;AAAA,IACrC,SAAS,QAAQ,OAAO;AAAA,IACxB;AAAA,EACF;AACF;AAaA,IAAM,MAAM,CAAC,WACX,CAAC,GAAG,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK;AAGlC,eAAsB,wBACpB,OAC4B;AAC5B,MAAI,CAAC,MAAM,aAAa;AACtB,UAAM,IAAI,UAAU,qDAAqD;AAAA,EAC3E;AACA,QAAM,UAAU;AAAA,IACd,GAAG;AAAA,IACH,aAAa,MAAM;AAAA,IACnB,cAAc,IAAI,MAAM,YAAY;AAAA,IACpC,iBAAiB,IAAI,MAAM,eAAe;AAAA,IAC1C,gBAAgB,IAAI,MAAM,cAAc;AAAA,IACxC,GAAI,MAAM,gBAAgB,SACtB,CAAC,IACD,EAAE,aAAa,QAAQ,MAAM,WAAW,EAAE;AAAA,EAChD;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS,MAAM,aAAa,OAAO;AAAA,IACnC,WAAW,QAAQ,MAAM,SAAS;AAAA,EACpC;AACF;AAOO,SAAS,kBACd,UACA,OACM;AACN,MAAI,CAAC,SAAS,KAAK,MAAM,MAAM,SAAS,IAAI,KAAK,MAAM,SAAS,OAAO,GAAG;AACxE,WAAO,SAAS;AAAA,EAClB;AACA,QAAM,QAAQ,IAAI,IAAI,MAAM,YAAY;AACxC,QAAM,WAAW,IAAI,IAAI,MAAM,eAAe;AAC9C,QAAM,UAAU,IAAI,IAAI,MAAM,cAAc;AAC5C,SAAO;AAAA,IACL,GAAG,SAAS;AAAA,IACZ,SAAS,MAAM;AAAA,IACf,OAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,SAAS,KAAK,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM;AACtD,cAAM,UAAU,KAAK,SAAS;AAAA,UAAK,CAAC,YAClC,SAAS,IAAI,QAAQ,EAAE;AAAA,QACzB;AACA,cAAM,UAAU,KAAK,SAAS;AAAA,UAAI,CAAC,YACjC,SAAS,IAAI,QAAQ,EAAE,IACnB,EAAE,GAAG,SAAS,aAAa,MAAM,IACjC;AAAA,QACN;AACA,eAAO;AAAA,UACL;AAAA,UACA;AAAA,YACE,GAAG;AAAA;AAAA,YAEH,aACE,KAAK,eACL,CAAC,MAAM,IAAI,EAAE,MACZ,CAAC,WAAW,QAAQ,KAAK,CAAC,YAAY,QAAQ,WAAW;AAAA,YAC5D,UAAU;AAAA,YACV,cAAc,KAAK,aAAa,IAAI,CAAC,WAAW;AAAA,cAC9C,GAAG;AAAA,cACH,SAAS,MAAM,QAAQ;AAAA,gBAAI,CAAC,WAC1B,QAAQ,IAAI,OAAO,EAAE,IACjB,EAAE,GAAG,QAAQ,aAAa,MAAM,IAChC;AAAA,cACN;AAAA,YACF,EAAE;AAAA,UACJ;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAGO,SAAS,eAAe,OAAuC;AACpE,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,WAAO;AAAA,EACT;AACA,QAAM,WAAW;AACjB,QAAM,OAAO,SAAS;AACtB,SACE,SAAS,MAAM,KACf,OAAO,SAAS,YAAY,YAC5B,OAAO,SAAS,aAAa,YAC7B,OAAO,SAAS,YAAY,YAC5B,OAAO,SAAS,gBAAgB,YAChC,OAAO,SAAS,YAAY,YAC5B,CAAC,CAAC,QACF,OAAO,SAAS,YAChB,KAAK,aAAa,SAAS,YAC3B,KAAK,YAAY,SAAS,WAC1B,KAAK,iBAAiB,aACtB,MAAM,QAAQ,KAAK,UAAU,KAC7B,CAAC,CAAC,KAAK,SACP,OAAO,KAAK,UAAU;AAE1B;",
+  "names": []
+}

package/dist/server/index.d.ts

@@ -1,4 +1,4 @@
-import { a as Menu, F as Formatters, S as Store } from '../models-D__QbqEd.js';
+import { a as Menu, S as Store, F as Formatters } from '../models-D__QbqEd.js';
 import { a as ZappieError, b as ZappieConfig, T as Transport, S as StorageLike, c as StoreResource, M as MenuResource, d as ZappieEvents, C as Cache } from '../client-CSOZOwQW.js';
 export { VERSION } from '../index.js';
 import { d as CartModule, b as CartLineInput } from '../types-gQXU2gEA.js';
@@ -162,6 +162,328 @@ declare const parseStorefrontUrl: (input: StorefrontUrlInput, options?: Storefro
  */
 declare const storefrontRedirect: (input: StorefrontUrlInput, options?: StorefrontUrlOptions) => string | null;
 
+/** A PKCE code verifier and its S256 challenge for one sign-in attempt. */
+type PkcePair = {
+    /** Keep this on the server and send it with the code exchange. */
+    verifier: string;
+    /** Send this to the authorize endpoint as `code_challenge`. */
+    challenge: string;
+    /** Send this as `code_challenge_method`. */
+    method: "S256";
+};
+/** One sealing secret, or several while you rotate them. The first one seals. */
+type SealSecret = string | readonly string[];
+/** Options for sealing a value into a cookie-safe string. */
+type SealOptions = {
+    /**
+     * At least 32 bytes each, from a random generator such as `randomToken()`,
+     * never a password or phrase. The key is the secret's SHA-256 with no
+     * stretching, so a guessable secret can be found offline from one sealed
+     * value. List the new secret first while you rotate.
+     */
+    secret: SealSecret;
+    /**
+     * Binds the sealed value to one use, such as `"tx"`, so it won't open for
+     * another. Leave it out to match the hosted sign-in Worker's format.
+     */
+    purpose?: string;
+};
+/** Create a random URL-safe token from `bytes` random bytes, for state, nonces and ids. */
+declare function randomToken(bytes?: number): string;
+/** Create a PKCE verifier and its S256 challenge. */
+declare function createPkce(): Promise<PkcePair>;
+/** Encrypt a JSON value with AES-GCM into a cookie-safe string. */
+declare function sealValue(value: unknown, { secret, purpose }: SealOptions): Promise<string>;
+/** Decrypt a sealed value with any listed secret. Returns null when none opens it. */
+declare function openSealedValue<T = unknown>(sealed: string | null | undefined, { secret, purpose }: SealOptions): Promise<T | null>;
+
+/** Signing algorithms Sign in with Zappie tokens can use. */
+type TokenAlgorithm = "RS256" | "ES256";
+declare const messages: {
+    malformed: string;
+    unsupported_algorithm: string;
+    unknown_key: string;
+    invalid_signature: string;
+    wrong_issuer: string;
+    wrong_audience: string;
+    wrong_nonce: string;
+    wrong_subject: string;
+    wrong_type: string;
+    expired: string;
+    not_yet_valid: string;
+    keys_unavailable: string;
+};
+/** Why a token was refused. */
+type TokenErrorReason = keyof typeof messages;
+/** A token Zappie's identity issuer didn't sign for you, or one that is no longer valid. */
+declare class ZappieTokenError extends ZappieError {
+    readonly reason: TokenErrorReason;
+    constructor(reason: TokenErrorReason, cause?: unknown);
+}
+/** The verified claims of a token. Extra claims stay on the object. */
+type TokenClaims = {
+    iss: string;
+    aud: string | string[];
+    exp: number;
+    sub?: string;
+    iat?: number;
+    nbf?: number;
+    nonce?: string;
+    sid?: string;
+    [claim: string]: unknown;
+};
+/** Settings for verifying tokens from Zappie's identity issuer. */
+type TokenVerifierOptions = {
+    /** The issuer URL, such as `https://accounts.zappie.ai`. The token's `iss` must equal it. A trailing slash on either is ignored. */
+    issuer: string;
+    /** The audience the token must name: your site's client id for ID tokens, or the API audience for access tokens. */
+    audience: string;
+    /** Where to read the signing keys. Defaults to `<issuer>/.well-known/jwks.json`. */
+    jwksUrl?: string;
+    /** Allowed algorithms. Defaults to RS256 and ES256. */
+    algorithms?: readonly TokenAlgorithm[];
+    /** Seconds of clock skew allowed on `exp`, `nbf` and `iat`. Defaults to 60. */
+    clockToleranceSec?: number;
+    /** Seconds to keep the key set before reading it again, 0 or more. Defaults to one hour. */
+    cacheTtlSec?: number;
+    /** Prefix the `sub` claim must start with. Zappie customers are `cus_`. A token without `sub` is refused. Pass `null` to skip both checks. */
+    subjectPrefix?: string | null;
+    /** The fetch to read keys with. Defaults to the global fetch. */
+    fetch?: typeof fetch;
+    /** The current time in milliseconds. For tests. */
+    now?: () => number;
+};
+/** Per-call checks on top of the verifier's settings. */
+type VerifyTokenChecks = {
+    /** The nonce you sent with the sign-in. When you pass it, the token's `nonce` must equal it. */
+    nonce?: string;
+    /** Overrides the verifier's audience for this token. */
+    audience?: string;
+};
+/** Checks for an ID token from a sign-in. */
+type IdTokenChecks = {
+    /** The nonce you sent with this sign-in. The token's `nonce` must equal it. */
+    nonce: string;
+    /** Overrides the verifier's audience for this token. */
+    audience?: string;
+};
+/** The verified claims of an ID token. */
+type IdTokenClaims = TokenClaims & {
+    sub: string;
+    nonce: string;
+};
+/** Verifies signed tokens against the issuer's published keys. */
+type TokenVerifier = {
+    /** Verify a token's signature and claims, and return its claims. */
+    verify(token: string, checks?: VerifyTokenChecks): Promise<TokenClaims>;
+    /**
+     * Verify the ID token from a sign-in. It needs the nonce you sent, a `sub`,
+     * and refuses a token whose `typ` header names another kind of token, such
+     * as an access token (`at+jwt`).
+     */
+    verifyIdToken(token: string, checks: IdTokenChecks): Promise<IdTokenClaims>;
+};
+/**
+ * Create a verifier for tokens from Zappie's identity issuer. It caches the
+ * issuer's key set, reads it again when a token names an unknown key, and
+ * keeps the last good set while the issuer is down. It uses Web Crypto only,
+ * so it runs in Workers and Node 20 or later.
+ */
+declare function createTokenVerifier(options: TokenVerifierOptions): TokenVerifier;
+
+/** What a signed-in session holds on the server. Tokens never reach the browser. */
+type SessionData = {
+    /** The customer's subject, such as `cus_7Kd`. */
+    sub: string;
+    /** The OAuth client the session belongs to, your site's client id. */
+    clientId: string;
+    /** What the site may show about the customer. */
+    customer: {
+        id: string;
+        givenName?: string;
+        phoneMasked: string;
+    };
+    accessToken: string;
+    /** When the access token expires, in epoch milliseconds. */
+    accessExp: number;
+    refreshToken: string;
+    /** The issuer's session id from the ID token, for back-channel logout. */
+    idTokenSid?: string;
+    scopes: string[];
+    /** Epoch milliseconds. */
+    createdAt: number;
+    /** Epoch milliseconds. */
+    lastSeenAt: number;
+    mode: "test" | "live";
+};
+/**
+ * Where signed-in sessions live. The session id is what the browser's
+ * session cookie holds.
+ */
+interface SessionStore {
+    /** Save a new session and return its id. */
+    create(data: SessionData): Promise<string>;
+    /** Read a session, or null when it doesn't exist or has expired. */
+    get(sid: string): Promise<SessionData | null>;
+    /**
+     * Change a session and return the id to keep in the cookie, or null when
+     * the session no longer exists. Stores that keep sessions on the server
+     * return the same id. The cookie store returns a new one.
+     */
+    update(sid: string, patch: Partial<SessionData>): Promise<string | null>;
+    /** End one session. */
+    delete(sid: string): Promise<void>;
+    /** End every session for a customer and client, for back-channel logout. */
+    deleteBySub(sub: string, clientId: string): Promise<void>;
+}
+/** Settings for the encrypted-cookie session store. */
+type CookieSessionStoreOptions = {
+    /**
+     * At least 32 bytes each, from a random generator such as `randomToken()`,
+     * never a password or phrase. The key is the secret's SHA-256 with no
+     * stretching, so a guessable secret can be found offline from one sealed
+     * value. List the new secret first while you rotate.
+     */
+    secret: SealSecret;
+    /** How long a session lasts from sign-in, in seconds. Defaults to 30 days. */
+    maxAgeSec?: number;
+    /** The current time in milliseconds. For tests. */
+    now?: () => number;
+};
+/**
+ * Create a session store that keeps the whole session, sealed with AES-GCM,
+ * in the cookie itself, so it needs no database. It can't end a session from
+ * the server, so back-channel logout needs a store that keeps sessions there.
+ * Signing out clears the cookie in that browser only. A copy of the cookie
+ * still opens the session until it expires, 30 days after sign-in by
+ * default, or until you rotate the secret out.
+ */
+declare function cookieSessionStore(options: CookieSessionStoreOptions): SessionStore;
+
+/**
+ * A branch catalogue as the edge keeps it: the SDK `Menu` that `menu.get()`
+ * returns, with the facts a snapshot writer and reader need around it.
+ */
+type MenuSnapshot = {
+    v: 1;
+    storeId: string;
+    branchId: string;
+    /** The API's menu version, the same value `GET /menus/version` returns. */
+    version: string;
+    /** The first 16 hex digits of the SHA-256 of the menu's canonical JSON. */
+    contentHash: string;
+    /** When the snapshot was built, as an ISO time. */
+    builtAt: string;
+    /** The latest change among the source menus, as an ISO time, when the API sends it. */
+    sourceUpdatedAt?: string;
+    /** A complete branch catalogue. Partial category pages never become snapshots. */
+    menu: Menu;
+};
+/** Store details as the edge keeps them: the SDK `Store` that `store.get()` returns. */
+type StoreSnapshot = {
+    v: 1;
+    storeId: string;
+    /** The first 16 hex digits of the SHA-256 of the store's canonical JSON. */
+    contentHash: string;
+    /** When the snapshot was built, as an ISO time. */
+    builtAt: string;
+    store: Store;
+};
+/**
+ * What sold out since a branch's menu snapshot was built. It is small, so an
+ * availability change rewrites about 1 KB instead of the whole menu.
+ */
+type AvailabilityPatch = {
+    v: 1;
+    /** The first 16 hex digits of the SHA-256 of this patch's canonical JSON. */
+    version: string;
+    /** The API's menu version after this change. A patched menu reports it. */
+    menuVersion: string;
+    soldOutItems: string[];
+    soldOutVariants: string[];
+    /** Choice ids in option groups. */
+    soldOutOptions: string[];
+    /** When the branch reopens, as an ISO time, if it is closed for now. */
+    closedUntil?: string;
+    /** When the patch was built, as an ISO time. */
+    updatedAt: string;
+};
+/** The version record a writer saves last, so readers never see unwritten data. */
+type SnapshotVersionRecord = {
+    /** The default branch's menu version. */
+    version: string;
+    builtAt: string;
+    branches: Record<string, string>;
+};
+/** The edge key-value names for each snapshot. */
+declare const snapshotKeys: {
+    /** `store:<storeId>` holds a StoreSnapshot. */
+    readonly store: (storeId: string) => string;
+    /** `menu:<storeId>:<branchId>`, or `menu:<storeId>` for the default branch. */
+    readonly menu: (storeId: string, branchId?: string) => string;
+    /** `avail:<storeId>:<branchId>` holds an AvailabilityPatch. */
+    readonly availability: (storeId: string, branchId: string) => string;
+    /** `ver:<storeId>` holds a SnapshotVersionRecord. */
+    readonly version: (storeId: string) => string;
+};
+/**
+ * Serialise a JSON value with object keys in sorted order and undefined
+ * properties left out, so equal values always give the same text.
+ */
+declare function canonicalJson(value: unknown): string;
+/** Hash a JSON value: the first 16 hex digits of the SHA-256 of its canonical JSON. */
+declare function snapshotHash(value: unknown): Promise<string>;
+/** Input for building a MenuSnapshot from an SDK menu. */
+type MenuSnapshotInput = {
+    storeId: string;
+    menu: Menu;
+    /** Defaults to now. */
+    builtAt?: Date | string;
+    sourceUpdatedAt?: Date | string;
+};
+/** Build a MenuSnapshot from a complete SDK menu. */
+declare function createMenuSnapshot({ storeId, menu, builtAt, sourceUpdatedAt, }: MenuSnapshotInput): Promise<MenuSnapshot>;
+/** Input for building a MenuSnapshot from the API's menu payload. */
+type MenuSnapshotPayloadInput = {
+    storeId: string;
+    branchId: string;
+    /** The JSON body of the API's branch menu read. */
+    payload: unknown;
+    /** Defaults to now. */
+    builtAt?: Date | string;
+};
+/**
+ * Build a MenuSnapshot from the API's branch menu payload. It maps the payload
+ * with the same mapper `menu.get()` uses, so the snapshot's menu is exactly
+ * what the client SDK returns.
+ */
+declare function menuSnapshotFromPayload({ storeId, branchId, payload, builtAt, }: MenuSnapshotPayloadInput): Promise<MenuSnapshot>;
+/** Build a StoreSnapshot from an SDK store. */
+declare function createStoreSnapshot({ store, builtAt, }: {
+    store: Store;
+    builtAt?: Date | string;
+}): Promise<StoreSnapshot>;
+/** Input for building an AvailabilityPatch. */
+type AvailabilityPatchInput = {
+    menuVersion: string;
+    soldOutItems?: readonly string[];
+    soldOutVariants?: readonly string[];
+    soldOutOptions?: readonly string[];
+    closedUntil?: Date | string;
+    /** Defaults to now. */
+    updatedAt?: Date | string;
+};
+/** Build an AvailabilityPatch with sorted, unique ids and its content hash. */
+declare function createAvailabilityPatch(input: AvailabilityPatchInput): Promise<AvailabilityPatch>;
+/**
+ * Return the snapshot's menu with an availability patch applied. A patch
+ * built before the snapshot is ignored, because the rebuilt menu already
+ * holds newer availability. The result reports the patch's menu version.
+ */
+declare function applyAvailability(snapshot: MenuSnapshot, patch: AvailabilityPatch | null | undefined): Menu;
+/** Check that a value read from the edge is a MenuSnapshot this SDK can use. */
+declare function isMenuSnapshot(value: unknown): value is MenuSnapshot;
+
 /**
  * The store, theme and optional build policies you export from zappie.config.ts.
  */
@@ -338,4 +660,4 @@ declare function createZappieServer({ secretKey, ...config }: ZappieServerConfig
     };
 }>;
 
-export { type EdgeSnapshotReader, STOREFRONT_QUERY_PARAMETERS, STOREFRONT_V1_QUERY_PARAMETERS, type SecurityHeadersOptions, type StorefrontInstallation, type StorefrontPageState, type StorefrontQuery, type StorefrontRoute, type StorefrontUrlInput, type StorefrontUrlOptions, type VerifyWebhookOptions, type WebhookEvent, type WebhookEventType, type ZappieServerConfig, ZappieWebhookSignatureError, buildStorefrontUrl, createSecurityNonce, createZappieServer, inlineScriptHashes, parseStorefrontUrl, securityHeaders, storefrontRedirect, verifyWebhook };
+export { type AvailabilityPatch, type AvailabilityPatchInput, type CookieSessionStoreOptions, type EdgeSnapshotReader, type IdTokenChecks, type IdTokenClaims, type MenuSnapshot, type MenuSnapshotInput, type MenuSnapshotPayloadInput, type PkcePair, STOREFRONT_QUERY_PARAMETERS, STOREFRONT_V1_QUERY_PARAMETERS, type SealOptions, type SealSecret, type SecurityHeadersOptions, type SessionData, type SessionStore, type SnapshotVersionRecord, type StoreSnapshot, type StorefrontInstallation, type StorefrontPageState, type StorefrontQuery, type StorefrontRoute, type StorefrontUrlInput, type StorefrontUrlOptions, type TokenAlgorithm, type TokenClaims, type TokenErrorReason, type TokenVerifier, type TokenVerifierOptions, type VerifyTokenChecks, type VerifyWebhookOptions, type WebhookEvent, type WebhookEventType, type ZappieServerConfig, ZappieTokenError, ZappieWebhookSignatureError, applyAvailability, buildStorefrontUrl, canonicalJson, cookieSessionStore, createAvailabilityPatch, createMenuSnapshot, createPkce, createSecurityNonce, createStoreSnapshot, createTokenVerifier, createZappieServer, inlineScriptHashes, isMenuSnapshot, menuSnapshotFromPayload, openSealedValue, parseStorefrontUrl, randomToken, sealValue, securityHeaders, snapshotHash, snapshotKeys, storefrontRedirect, verifyWebhook };

package/dist/server/index.js

@@ -8,6 +8,30 @@ import {
   STOREFRONT_V1_QUERY_PARAMETERS,
   storefrontRedirect
 } from "../url/index.js";
+import {
+  createPkce,
+  openSealedValue,
+  randomToken,
+  sealValue
+} from "./auth/crypto.js";
+import {
+  createTokenVerifier,
+  ZappieTokenError
+} from "./auth/jwt.js";
+import {
+  cookieSessionStore
+} from "./auth/session-store.js";
+import {
+  applyAvailability,
+  canonicalJson,
+  createAvailabilityPatch,
+  createMenuSnapshot,
+  createStoreSnapshot,
+  isMenuSnapshot,
+  menuSnapshotFromPayload,
+  snapshotHash,
+  snapshotKeys
+} from "./edge-snapshot.js";
 import {
   createSecurityNonce,
   inlineScriptHashes,
@@ -27,13 +51,29 @@ export {
   STOREFRONT_QUERY_PARAMETERS,
   STOREFRONT_V1_QUERY_PARAMETERS,
   VERSION,
+  ZappieTokenError,
   ZappieWebhookSignatureError,
+  applyAvailability,
   buildStorefrontUrl,
+  canonicalJson,
+  cookieSessionStore,
+  createAvailabilityPatch,
+  createMenuSnapshot,
+  createPkce,
   createSecurityNonce,
+  createStoreSnapshot,
+  createTokenVerifier,
   createZappieServer,
   inlineScriptHashes,
+  isMenuSnapshot,
+  menuSnapshotFromPayload,
+  openSealedValue,
   parseStorefrontUrl,
+  randomToken,
+  sealValue,
   securityHeaders,
+  snapshotHash,
+  snapshotKeys,
   storefrontRedirect,
   verifyWebhook
 };

package/dist/server/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/server/index.ts"],
-  "sourcesContent": ["import { buildClient } from \"../client\";\nimport type { ZappieConfig } from \"../config\";\nimport type { Menu } from \"../models\";\nexport { VERSION } from \"../index\";\nexport {\n  buildStorefrontUrl,\n  parseStorefrontUrl,\n  STOREFRONT_QUERY_PARAMETERS,\n  STOREFRONT_V1_QUERY_PARAMETERS,\n  storefrontRedirect,\n  type StorefrontInstallation,\n  type StorefrontPageState,\n  type StorefrontQuery,\n  type StorefrontRoute,\n  type StorefrontUrlInput,\n  type StorefrontUrlOptions,\n} from \"../url/index\";\nexport {\n  createSecurityNonce,\n  inlineScriptHashes,\n  securityHeaders,\n  type SecurityHeadersOptions,\n} from \"./security\";\nexport {\n  verifyWebhook,\n  ZappieWebhookSignatureError,\n  type VerifyWebhookOptions,\n  type WebhookEvent,\n  type WebhookEventType,\n} from \"./webhook\";\n/** An edge reader that returns a Menu snapshot or null. */\nexport interface EdgeSnapshotReader {\n  getMenu(storeId: string, branchId: string): Promise<Menu | null>;\n}\n/** Settings for your server client. Keep secret keys out of browser bundles. */\nexport type ZappieServerConfig = Omit<ZappieConfig, \"key\"> & {\n  secretKey: string;\n};\n/** Create a server client with your secret key and configured transport. */\nexport function createZappieServer({\n  secretKey,\n  ...config\n}: ZappieServerConfig) {\n  return buildClient({ ...config, key: secretKey }, true);\n}\n"],
-  "mappings": ";AAAA,SAAS,mBAAmB;AAG5B,SAAS,eAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAOK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAIK;AAUA,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA,GAAG;AACL,GAAuB;AACrB,SAAO,YAAY,EAAE,GAAG,QAAQ,KAAK,UAAU,GAAG,IAAI;AACxD;",
+  "sourcesContent": ["import { buildClient } from \"../client\";\nimport type { ZappieConfig } from \"../config\";\nimport type { Menu } from \"../models\";\nexport { VERSION } from \"../index\";\nexport {\n  buildStorefrontUrl,\n  parseStorefrontUrl,\n  STOREFRONT_QUERY_PARAMETERS,\n  STOREFRONT_V1_QUERY_PARAMETERS,\n  storefrontRedirect,\n  type StorefrontInstallation,\n  type StorefrontPageState,\n  type StorefrontQuery,\n  type StorefrontRoute,\n  type StorefrontUrlInput,\n  type StorefrontUrlOptions,\n} from \"../url/index\";\nexport {\n  createPkce,\n  openSealedValue,\n  randomToken,\n  sealValue,\n  type PkcePair,\n  type SealOptions,\n  type SealSecret,\n} from \"./auth/crypto\";\nexport {\n  createTokenVerifier,\n  ZappieTokenError,\n  type IdTokenChecks,\n  type IdTokenClaims,\n  type TokenAlgorithm,\n  type TokenClaims,\n  type TokenErrorReason,\n  type TokenVerifier,\n  type TokenVerifierOptions,\n  type VerifyTokenChecks,\n} from \"./auth/jwt\";\nexport {\n  cookieSessionStore,\n  type CookieSessionStoreOptions,\n  type SessionData,\n  type SessionStore,\n} from \"./auth/session-store\";\nexport {\n  applyAvailability,\n  canonicalJson,\n  createAvailabilityPatch,\n  createMenuSnapshot,\n  createStoreSnapshot,\n  isMenuSnapshot,\n  menuSnapshotFromPayload,\n  snapshotHash,\n  snapshotKeys,\n  type AvailabilityPatch,\n  type AvailabilityPatchInput,\n  type MenuSnapshot,\n  type MenuSnapshotInput,\n  type MenuSnapshotPayloadInput,\n  type SnapshotVersionRecord,\n  type StoreSnapshot,\n} from \"./edge-snapshot\";\nexport {\n  createSecurityNonce,\n  inlineScriptHashes,\n  securityHeaders,\n  type SecurityHeadersOptions,\n} from \"./security\";\nexport {\n  verifyWebhook,\n  ZappieWebhookSignatureError,\n  type VerifyWebhookOptions,\n  type WebhookEvent,\n  type WebhookEventType,\n} from \"./webhook\";\n/** An edge reader that returns a Menu snapshot or null. */\nexport interface EdgeSnapshotReader {\n  getMenu(storeId: string, branchId: string): Promise<Menu | null>;\n}\n/** Settings for your server client. Keep secret keys out of browser bundles. */\nexport type ZappieServerConfig = Omit<ZappieConfig, \"key\"> & {\n  secretKey: string;\n};\n/** Create a server client with your secret key and configured transport. */\nexport function createZappieServer({\n  secretKey,\n  ...config\n}: ZappieServerConfig) {\n  return buildClient({ ...config, key: secretKey }, true);\n}\n"],
+  "mappings": ";AAAA,SAAS,mBAAmB;AAG5B,SAAS,eAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAOK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OASK;AACP;AAAA,EACE;AAAA,OAIK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAQK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAIK;AAUA,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA,GAAG;AACL,GAAuB;AACrB,SAAO,YAAY,EAAE,GAAG,QAAQ,KAAK,UAAU,GAAG,IAAI;AACxD;",
   "names": []
 }