@zappie/sdk 0.1.24 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @zappie/sdk
 
+## 0.2.0
+
+### Minor Changes
+
+- ea37bcf: `redirectToCheckout` in `@zappie/sdk/redirect` sends a window to a checkout session's page and refuses any URL that isn't Zappie's checkout. `security.links` in `zappie.config.ts` lists the hosts a site's pages may link to.
+
+### Patch Changes
+
+- 8ea70dc: Document that a classic URL's site target is served as a permanent redirect (301).
+
 ## 0.1.24
 
 ### Patch Changes

package/README.md

@@ -156,8 +156,9 @@ The SDK does not load Maps scripts.
 ### Legacy redirects
 
 `storefrontRedirect(input, { installation })` from `@zappie/sdk/url` returns
-`string | null`. Callers choose the HTTP status when they serve the redirect.
-Zappie's templates use temporary redirects (302) for now.
+`string | null`. Serve the target as a permanent redirect (301): a classic
+URL has moved for good, so search engines carry its ranking to the site in one
+step.
 
 V2 URLs use `item_` and `ord_` public IDs, `menu=menu_<id>`, and category
 anchors `#c-cat_<id>`. Already-prefixed IDs stay unchanged. Legacy cart,

package/dist/config/index.d.ts

@@ -45,6 +45,8 @@ type ZappieSiteConfig = {
             styleSrc?: string[];
             frameSrc?: string[];
         };
+        /** Hosts outside Zappie that built pages may link to, such as the store's own domains. */
+        links?: string[];
     };
     /** Each budget left out uses DEFAULT_BUDGETS. */
     budgets?: {

package/dist/debug.js

@@ -1,5 +1,5 @@
 // src/debug.ts
-var VERSION = true ? "0.1.24" : "0.0.0-development";
+var VERSION = true ? "0.2.0" : "0.0.0-development";
 function installDebug(client) {
   if (typeof window === "undefined" || client.mode !== "test") {
     return;

package/dist/debug.js.map

@@ -2,6 +2,6 @@
   "version": 3,
   "sources": ["../src/debug.ts"],
   "sourcesContent": ["import type { StoredLine } from \"./cart/storage\";\nimport type { CartLineInput, Quote } from \"./cart/types\";\nimport type { Zappie } from \"./client\";\nimport type { Branch, Menu } from \"./models\";\n\n// Inline like VERSION in index.ts: tsup fills in the version from package.json.\ndeclare const __ZAPPIE_SDK_VERSION__: string | undefined;\nconst VERSION =\n  typeof __ZAPPIE_SDK_VERSION__ === \"string\"\n    ? __ZAPPIE_SDK_VERSION__\n    : \"0.0.0-development\";\n\nexport type DebugEvent = {\n  name: string;\n  detail: unknown;\n  at: string;\n};\n\nexport type ZappieDebug = {\n  version: string;\n  store: string;\n  /** Read this cart's branch and full menu through its client. */\n  catalogue(): Promise<{ menu: Menu; branch: Branch }>;\n  cart: (() => ReturnType<Zappie[\"cart\"][\"getSnapshot\"]>) & {\n    /**\n     * Save test cart lines for the next reload. Reload to reconcile them with today's menu.\n     * Your unitPrice is only a local estimate, like a price edited in browser storage.\n     * The server re-prices every line and never trusts this estimate.\n     */\n    inject(input: {\n      lines: (CartLineInput & Pick<StoredLine, \"unitPrice\">)[];\n    }): Promise<void>;\n  };\n  quote: () => Quote | undefined;\n  events: DebugEvent[];\n};\n\ndeclare global {\n  interface Window {\n    __zappie?: ZappieDebug;\n  }\n  // On globalThis so the lazy checkout and customer entries can reach it\n  // with the shortest possible call; in a browser it is window's.\n  var __zappieEmit: ((name: string, detail: unknown) => void) | undefined;\n}\n\nexport function installDebug(client: Zappie) {\n  if (typeof window === \"undefined\" || client.mode !== \"test\") {\n    return;\n  }\n  const events: DebugEvent[] = [];\n  let quote: Quote | undefined;\n  const emit = (name: string, detail: unknown) => {\n    const event = { name, detail, at: new Date().toISOString() };\n    events.push(event);\n    window.dispatchEvent(new CustomEvent(\"zappie:event\", { detail: event }));\n  };\n  globalThis.__zappieEmit = emit;\n  window.__zappie = {\n    version: VERSION,\n    store: client.config.store,\n    async catalogue() {\n      await client.cart.hydrate();\n      const branch = (await client.store.get()).branches.find(\n        (value) => value.id === client.cart.getSnapshot().branchId,\n      )!;\n      return { branch, menu: await client.menu.get({ branch: branch.id }) };\n    },\n    cart: Object.assign(() => client.cart.getSnapshot(), {\n      async inject(input: {\n        lines: (CartLineInput & Pick<StoredLine, \"unitPrice\">)[];\n      }) {\n        await client.cart.hydrate();\n        if (\n          input.lines.length > 100 ||\n          input.lines.some(\n            (line) =>\n              !Number.isInteger(line.quantity ?? 1) ||\n              (line.quantity ?? 1) < 1 ||\n              (line.quantity ?? 1) > 99,\n          )\n        ) {\n          throw new Error(\n            \"Use up to 100 cart lines with whole quantities from 1 to 99.\",\n          );\n        }\n        const snapshot = client.cart.getSnapshot();\n        const value = {\n          v: 1,\n          menuVersion: client._internal.cartCatalogue()!.version,\n          updatedAt: Date.now(),\n          fulfilment: snapshot.fulfilment,\n          promoCode: snapshot.promoCode,\n          lines: input.lines.map((line, index) => ({\n            ...line,\n            id: `debug_${index}`,\n            name: line.itemId,\n            quantity: line.quantity ?? 1,\n            choices: (line.choices ?? []).map((choice) => ({\n              ...choice,\n              quantity: choice.quantity ?? 1,\n            })),\n            inputs: line.inputs ?? {},\n            addedAt: new Date().toISOString(),\n          })),\n        };\n        const scope = client.config.cart?.storageScope;\n        (client.config.storage ?? window.localStorage).setItem(\n          `zappie:cart:v1:${client.config.store}:${snapshot.branchId}${scope ? `:${scope}` : \"\"}`,\n          JSON.stringify(value),\n        );\n      },\n    }),\n    quote: () => quote,\n    events,\n  };\n  client.on(\"add_to_cart\", (detail) => emit(\"add_to_cart\", detail));\n  client.cart.subscribe(() => {\n    const state = client.cart.state;\n    const next = \"quote\" in state ? state.quote : undefined;\n    if (next && next !== quote) {\n      quote = next;\n      emit(\"quote\", next);\n    }\n  });\n}\n"],
-  "mappings": ";AAOA,IAAM,UACJ,OACI,WACA;AAoCC,SAAS,aAAa,QAAgB;AAC3C,MAAI,OAAO,WAAW,eAAe,OAAO,SAAS,QAAQ;AAC3D;AAAA,EACF;AACA,QAAM,SAAuB,CAAC;AAC9B,MAAI;AACJ,QAAM,OAAO,CAAC,MAAc,WAAoB;AAC9C,UAAM,QAAQ,EAAE,MAAM,QAAQ,KAAI,oBAAI,KAAK,GAAE,YAAY,EAAE;AAC3D,WAAO,KAAK,KAAK;AACjB,WAAO,cAAc,IAAI,YAAY,gBAAgB,EAAE,QAAQ,MAAM,CAAC,CAAC;AAAA,EACzE;AACA,aAAW,eAAe;AAC1B,SAAO,WAAW;AAAA,IAChB,SAAS;AAAA,IACT,OAAO,OAAO,OAAO;AAAA,IACrB,MAAM,YAAY;AAChB,YAAM,OAAO,KAAK,QAAQ;AAC1B,YAAM,UAAU,MAAM,OAAO,MAAM,IAAI,GAAG,SAAS;AAAA,QACjD,CAAC,UAAU,MAAM,OAAO,OAAO,KAAK,YAAY,EAAE;AAAA,MACpD;AACA,aAAO,EAAE,QAAQ,MAAM,MAAM,OAAO,KAAK,IAAI,EAAE,QAAQ,OAAO,GAAG,CAAC,EAAE;AAAA,IACtE;AAAA,IACA,MAAM,OAAO,OAAO,MAAM,OAAO,KAAK,YAAY,GAAG;AAAA,MACnD,MAAM,OAAO,OAEV;AACD,cAAM,OAAO,KAAK,QAAQ;AAC1B,YACE,MAAM,MAAM,SAAS,OACrB,MAAM,MAAM;AAAA,UACV,CAAC,SACC,CAAC,OAAO,UAAU,KAAK,YAAY,CAAC,MACnC,KAAK,YAAY,KAAK,MACtB,KAAK,YAAY,KAAK;AAAA,QAC3B,GACA;AACA,gBAAM,IAAI;AAAA,YACR;AAAA,UACF;AAAA,QACF;AACA,cAAM,WAAW,OAAO,KAAK,YAAY;AACzC,cAAM,QAAQ;AAAA,UACZ,GAAG;AAAA,UACH,aAAa,OAAO,UAAU,cAAc,EAAG;AAAA,UAC/C,WAAW,KAAK,IAAI;AAAA,UACpB,YAAY,SAAS;AAAA,UACrB,WAAW,SAAS;AAAA,UACpB,OAAO,MAAM,MAAM,IAAI,CAAC,MAAM,WAAW;AAAA,YACvC,GAAG;AAAA,YACH,IAAI,SAAS,KAAK;AAAA,YAClB,MAAM,KAAK;AAAA,YACX,UAAU,KAAK,YAAY;AAAA,YAC3B,UAAU,KAAK,WAAW,CAAC,GAAG,IAAI,CAAC,YAAY;AAAA,cAC7C,GAAG;AAAA,cACH,UAAU,OAAO,YAAY;AAAA,YAC/B,EAAE;AAAA,YACF,QAAQ,KAAK,UAAU,CAAC;AAAA,YACxB,UAAS,oBAAI,KAAK,GAAE,YAAY;AAAA,UAClC,EAAE;AAAA,QACJ;AACA,cAAM,QAAQ,OAAO,OAAO,MAAM;AAClC,SAAC,OAAO,OAAO,WAAW,OAAO,cAAc;AAAA,UAC7C,kBAAkB,OAAO,OAAO,KAAK,IAAI,SAAS,QAAQ,GAAG,QAAQ,IAAI,KAAK,KAAK,EAAE;AAAA,UACrF,KAAK,UAAU,KAAK;AAAA,QACtB;AAAA,MACF;AAAA,IACF,CAAC;AAAA,IACD,OAAO,MAAM;AAAA,IACb;AAAA,EACF;AACA,SAAO,GAAG,eAAe,CAAC,WAAW,KAAK,eAAe,MAAM,CAAC;AAChE,SAAO,KAAK,UAAU,MAAM;AAC1B,UAAM,QAAQ,OAAO,KAAK;AAC1B,UAAM,OAAO,WAAW,QAAQ,MAAM,QAAQ;AAC9C,QAAI,QAAQ,SAAS,OAAO;AAC1B,cAAQ;AACR,WAAK,SAAS,IAAI;AAAA,IACpB;AAAA,EACF,CAAC;AACH;",
+  "mappings": ";AAOA,IAAM,UACJ,OACI,UACA;AAoCC,SAAS,aAAa,QAAgB;AAC3C,MAAI,OAAO,WAAW,eAAe,OAAO,SAAS,QAAQ;AAC3D;AAAA,EACF;AACA,QAAM,SAAuB,CAAC;AAC9B,MAAI;AACJ,QAAM,OAAO,CAAC,MAAc,WAAoB;AAC9C,UAAM,QAAQ,EAAE,MAAM,QAAQ,KAAI,oBAAI,KAAK,GAAE,YAAY,EAAE;AAC3D,WAAO,KAAK,KAAK;AACjB,WAAO,cAAc,IAAI,YAAY,gBAAgB,EAAE,QAAQ,MAAM,CAAC,CAAC;AAAA,EACzE;AACA,aAAW,eAAe;AAC1B,SAAO,WAAW;AAAA,IAChB,SAAS;AAAA,IACT,OAAO,OAAO,OAAO;AAAA,IACrB,MAAM,YAAY;AAChB,YAAM,OAAO,KAAK,QAAQ;AAC1B,YAAM,UAAU,MAAM,OAAO,MAAM,IAAI,GAAG,SAAS;AAAA,QACjD,CAAC,UAAU,MAAM,OAAO,OAAO,KAAK,YAAY,EAAE;AAAA,MACpD;AACA,aAAO,EAAE,QAAQ,MAAM,MAAM,OAAO,KAAK,IAAI,EAAE,QAAQ,OAAO,GAAG,CAAC,EAAE;AAAA,IACtE;AAAA,IACA,MAAM,OAAO,OAAO,MAAM,OAAO,KAAK,YAAY,GAAG;AAAA,MACnD,MAAM,OAAO,OAEV;AACD,cAAM,OAAO,KAAK,QAAQ;AAC1B,YACE,MAAM,MAAM,SAAS,OACrB,MAAM,MAAM;AAAA,UACV,CAAC,SACC,CAAC,OAAO,UAAU,KAAK,YAAY,CAAC,MACnC,KAAK,YAAY,KAAK,MACtB,KAAK,YAAY,KAAK;AAAA,QAC3B,GACA;AACA,gBAAM,IAAI;AAAA,YACR;AAAA,UACF;AAAA,QACF;AACA,cAAM,WAAW,OAAO,KAAK,YAAY;AACzC,cAAM,QAAQ;AAAA,UACZ,GAAG;AAAA,UACH,aAAa,OAAO,UAAU,cAAc,EAAG;AAAA,UAC/C,WAAW,KAAK,IAAI;AAAA,UACpB,YAAY,SAAS;AAAA,UACrB,WAAW,SAAS;AAAA,UACpB,OAAO,MAAM,MAAM,IAAI,CAAC,MAAM,WAAW;AAAA,YACvC,GAAG;AAAA,YACH,IAAI,SAAS,KAAK;AAAA,YAClB,MAAM,KAAK;AAAA,YACX,UAAU,KAAK,YAAY;AAAA,YAC3B,UAAU,KAAK,WAAW,CAAC,GAAG,IAAI,CAAC,YAAY;AAAA,cAC7C,GAAG;AAAA,cACH,UAAU,OAAO,YAAY;AAAA,YAC/B,EAAE;AAAA,YACF,QAAQ,KAAK,UAAU,CAAC;AAAA,YACxB,UAAS,oBAAI,KAAK,GAAE,YAAY;AAAA,UAClC,EAAE;AAAA,QACJ;AACA,cAAM,QAAQ,OAAO,OAAO,MAAM;AAClC,SAAC,OAAO,OAAO,WAAW,OAAO,cAAc;AAAA,UAC7C,kBAAkB,OAAO,OAAO,KAAK,IAAI,SAAS,QAAQ,GAAG,QAAQ,IAAI,KAAK,KAAK,EAAE;AAAA,UACrF,KAAK,UAAU,KAAK;AAAA,QACtB;AAAA,MACF;AAAA,IACF,CAAC;AAAA,IACD,OAAO,MAAM;AAAA,IACb;AAAA,EACF;AACA,SAAO,GAAG,eAAe,CAAC,WAAW,KAAK,eAAe,MAAM,CAAC;AAChE,SAAO,KAAK,UAAU,MAAM;AAC1B,UAAM,QAAQ,OAAO,KAAK;AAC1B,UAAM,OAAO,WAAW,QAAQ,MAAM,QAAQ;AAC9C,QAAI,QAAQ,SAAS,OAAO;AAC1B,cAAQ;AACR,WAAK,SAAS,IAAI;AAAA,IACpB;AAAA,EACF,CAAC;AACH;",
   "names": []
 }

package/dist/index.js

@@ -10,7 +10,7 @@ import { ZappieError, isZappieError } from "./errors.js";
 export * from "./models.js";
 import { format, money } from "./money.js";
 import { RestTransport } from "./transport/rest.js";
-var VERSION = true ? "0.1.24" : "0.0.0-development";
+var VERSION = true ? "0.2.0" : "0.0.0-development";
 export {
   API_VERSION,
   RestTransport,

package/dist/index.js.map

@@ -2,6 +2,6 @@
   "version": 3,
   "sources": ["../src/index.ts"],
   "sourcesContent": ["// tsup replaces __ZAPPIE_SDK_VERSION__ with package.json's version. Source run\n// without a build, as in a plain Node script, gets the development label.\n// Kept inline, not in a shared module, so the core chunks don't split differently.\ndeclare const __ZAPPIE_SDK_VERSION__: string | undefined;\n\n/** The installed @zappie/sdk version. */\nexport const VERSION: string =\n  typeof __ZAPPIE_SDK_VERSION__ === \"string\"\n    ? __ZAPPIE_SDK_VERSION__\n    : \"0.0.0-development\";\nexport { ZappieCartError } from \"./cart/errors\";\nexport { previewItem } from \"./cart/preview\";\nexport { estimateUnitPrice } from \"./cart/price\";\nexport { resolveSourceMenu } from \"./cart/source-menu\";\nexport type * from \"./cart/types\";\nexport { validateLine } from \"./cart/validate\";\nexport { createZappie } from \"./client\";\nexport type {\n  MenuFulfilment,\n  MenuReadOptions,\n  MenuResource,\n  ReadOptions,\n  StoreResource,\n  Zappie,\n  ZappieEvents,\n} from \"./client\";\nexport { API_VERSION } from \"./config\";\nexport type {\n  StorageLike,\n  ZappieConfig as ZappieClientOptions,\n  ZappieConfig,\n} from \"./config\";\nexport { ZappieError, isZappieError } from \"./errors\";\nexport type { ErrorDetails, ZappieErrorCode } from \"./errors\";\nexport * from \"./models\";\nexport { format, money } from \"./money\";\nexport type { Currency, Formatters, Money, MoneyFormatOptions } from \"./money\";\nexport { RestTransport } from \"./transport/rest\";\nexport type { RestTransportOptions } from \"./transport/rest\";\nexport type {\n  MenuResponse,\n  MenuVersion,\n  RequestCtx,\n  SearchPage,\n  SearchRequest,\n  Transport,\n} from \"./transport/types\";\n"],
-  "mappings": ";AAUA,SAAS,uBAAuB;AAChC,SAAS,mBAAmB;AAC5B,SAAS,yBAAyB;AAClC,SAAS,yBAAyB;AAElC,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAU7B,SAAS,mBAAmB;AAM5B,SAAS,aAAa,qBAAqB;AAE3C,cAAc;AACd,SAAS,QAAQ,aAAa;AAE9B,SAAS,qBAAqB;AA/BvB,IAAM,UACX,OACI,WACA;",
+  "mappings": ";AAUA,SAAS,uBAAuB;AAChC,SAAS,mBAAmB;AAC5B,SAAS,yBAAyB;AAClC,SAAS,yBAAyB;AAElC,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAU7B,SAAS,mBAAmB;AAM5B,SAAS,aAAa,qBAAqB;AAE3C,cAAc;AACd,SAAS,QAAQ,aAAa;AAE9B,SAAS,qBAAqB;AA/BvB,IAAM,UACX,OACI,UACA;",
   "names": []
 }

package/dist/redirect/index.d.ts

@@ -11,5 +11,7 @@
  * @returns A same-origin relative target or `fallback`.
  */
 declare function safeRedirect(to: string | null | undefined, fallback: string): string;
+/** Move a window, this one by default, to Zappie's checkout. Any other URL throws a TypeError. */
+declare function redirectToCheckout(url: string, target?: Window): void;
 
-export { safeRedirect };
+export { redirectToCheckout, safeRedirect };

package/dist/redirect/index.js

@@ -16,7 +16,16 @@ function safeRedirect(to, fallback) {
     return fallback;
   }
 }
+function redirectToCheckout(url, target) {
+  if (!/^(https:\/\/checkout(\.stg)?\.zappie\.ai|http:\/\/(localhost|127\.0\.0\.1)(:\d+)?)\//.test(
+    url
+  )) {
+    throw new TypeError("Not a Zappie checkout URL");
+  }
+  (target ?? globalThis).location.assign(url);
+}
 export {
+  redirectToCheckout,
   safeRedirect
 };
 //# sourceMappingURL=index.js.map

package/dist/redirect/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/redirect/index.ts"],
-  "sourcesContent": ["/**\n * Return a same-origin redirect target, or a trusted fallback.\n *\n * The target must resolve to an HTTP(S) URL on the current origin and its\n * returned path must begin with exactly one slash. On the server, only relative\n * targets can match the sentinel origin because there is no request origin to\n * compare.\n *\n * @param to - The untrusted redirect target, such as a query parameter.\n * @param fallback - The trusted target to use when `to` is unsafe.\n * @returns A same-origin relative target or `fallback`.\n */\nexport function safeRedirect(\n  to: string | null | undefined,\n  fallback: string,\n): string {\n  if (\n    typeof to !== \"string\" ||\n    /[\\u0000-\\u0020\\u007f\\s\\\\]/u.test(to) ||\n    /%(?:0[\\da-f]|1[\\da-f]|20|7f)/iu.test(to)\n  ) {\n    return fallback;\n  }\n  try {\n    const browserOrigin =\n      typeof location === \"undefined\" ? undefined : location.origin;\n    if (browserOrigin === \"null\") {\n      return fallback;\n    }\n    const origin = browserOrigin ?? \"https://safe-redirect.invalid\";\n    const target = new URL(to, origin);\n    const path = `${target.pathname}${target.search}${target.hash}`;\n    return (target.protocol === \"http:\" || target.protocol === \"https:\") &&\n      target.origin === origin &&\n      /^\\/(?!\\/)/.test(path)\n      ? path\n      : fallback;\n  } catch {\n    return fallback;\n  }\n}\n"],
-  "mappings": ";AAYO,SAAS,aACd,IACA,UACQ;AACR,MACE,OAAO,OAAO,YACd,6BAA6B,KAAK,EAAE,KACpC,iCAAiC,KAAK,EAAE,GACxC;AACA,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,gBACJ,OAAO,aAAa,cAAc,SAAY,SAAS;AACzD,QAAI,kBAAkB,QAAQ;AAC5B,aAAO;AAAA,IACT;AACA,UAAM,SAAS,iBAAiB;AAChC,UAAM,SAAS,IAAI,IAAI,IAAI,MAAM;AACjC,UAAM,OAAO,GAAG,OAAO,QAAQ,GAAG,OAAO,MAAM,GAAG,OAAO,IAAI;AAC7D,YAAQ,OAAO,aAAa,WAAW,OAAO,aAAa,aACzD,OAAO,WAAW,UAClB,YAAY,KAAK,IAAI,IACnB,OACA;AAAA,EACN,QAAQ;AACN,WAAO;AAAA,EACT;AACF;",
+  "sourcesContent": ["/**\n * Return a same-origin redirect target, or a trusted fallback.\n *\n * The target must resolve to an HTTP(S) URL on the current origin and its\n * returned path must begin with exactly one slash. On the server, only relative\n * targets can match the sentinel origin because there is no request origin to\n * compare.\n *\n * @param to - The untrusted redirect target, such as a query parameter.\n * @param fallback - The trusted target to use when `to` is unsafe.\n * @returns A same-origin relative target or `fallback`.\n */\nexport function safeRedirect(\n  to: string | null | undefined,\n  fallback: string,\n): string {\n  if (\n    typeof to !== \"string\" ||\n    /[\\u0000-\\u0020\\u007f\\s\\\\]/u.test(to) ||\n    /%(?:0[\\da-f]|1[\\da-f]|20|7f)/iu.test(to)\n  ) {\n    return fallback;\n  }\n  try {\n    const browserOrigin =\n      typeof location === \"undefined\" ? undefined : location.origin;\n    if (browserOrigin === \"null\") {\n      return fallback;\n    }\n    const origin = browserOrigin ?? \"https://safe-redirect.invalid\";\n    const target = new URL(to, origin);\n    const path = `${target.pathname}${target.search}${target.hash}`;\n    return (target.protocol === \"http:\" || target.protocol === \"https:\") &&\n      target.origin === origin &&\n      /^\\/(?!\\/)/.test(path)\n      ? path\n      : fallback;\n  } catch {\n    return fallback;\n  }\n}\n\n/** Move a window, this one by default, to Zappie's checkout. Any other URL throws a TypeError. */\nexport function redirectToCheckout(url: string, target?: Window): void {\n  // The slash after the host rules out look-alike hosts.\n  if (\n    !/^(https:\\/\\/checkout(\\.stg)?\\.zappie\\.ai|http:\\/\\/(localhost|127\\.0\\.0\\.1)(:\\d+)?)\\//.test(\n      url,\n    )\n  ) {\n    throw new TypeError(\"Not a Zappie checkout URL\");\n  }\n  (target ?? globalThis).location.assign(url);\n}\n"],
+  "mappings": ";AAYO,SAAS,aACd,IACA,UACQ;AACR,MACE,OAAO,OAAO,YACd,6BAA6B,KAAK,EAAE,KACpC,iCAAiC,KAAK,EAAE,GACxC;AACA,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,gBACJ,OAAO,aAAa,cAAc,SAAY,SAAS;AACzD,QAAI,kBAAkB,QAAQ;AAC5B,aAAO;AAAA,IACT;AACA,UAAM,SAAS,iBAAiB;AAChC,UAAM,SAAS,IAAI,IAAI,IAAI,MAAM;AACjC,UAAM,OAAO,GAAG,OAAO,QAAQ,GAAG,OAAO,MAAM,GAAG,OAAO,IAAI;AAC7D,YAAQ,OAAO,aAAa,WAAW,OAAO,aAAa,aACzD,OAAO,WAAW,UAClB,YAAY,KAAK,IAAI,IACnB,OACA;AAAA,EACN,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,mBAAmB,KAAa,QAAuB;AAErE,MACE,CAAC,uFAAuF;AAAA,IACtF;AAAA,EACF,GACA;AACA,UAAM,IAAI,UAAU,2BAA2B;AAAA,EACjD;AACA,GAAC,UAAU,YAAY,SAAS,OAAO,GAAG;AAC5C;",
   "names": []
 }

package/dist/server/index.d.ts

@@ -156,8 +156,8 @@ declare const parseStorefrontUrl: (input: StorefrontUrlInput, options?: Storefro
  * Find the canonical v2 URL for a recognized storefront route.
  * Compares normalized paths and sorted query parameters to avoid unnecessary redirects.
  *
- * Callers choose the HTTP status when serving the redirect.
- * Zappie templates use temporary redirects (302) for now.
+ * Serve the target as a permanent redirect (301). A classic URL has moved for
+ * good, so search engines carry its ranking to the site in one step.
  *
  * @returns A redirect target, or null for v1, an unknown route, a parse/build failure or an equivalent URL.
  */
@@ -519,6 +519,8 @@ type ZappieSiteConfig = {
             styleSrc?: string[];
             frameSrc?: string[];
         };
+        /** Hosts outside Zappie that built pages may link to, such as the store's own domains. */
+        links?: string[];
     };
     /** Each budget left out uses DEFAULT_BUDGETS. */
     budgets?: {

package/dist/server/storefront-url/redirect.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/server/storefront-url/redirect.ts"],
-  "sourcesContent": ["import { buildStorefrontUrl } from \"./build\";\nimport { usesV2 } from \"./contract\";\nimport { normalizedPath } from \"./installation\";\nimport { parseStorefrontUrl } from \"./parse\";\nimport type { StorefrontUrlInput, StorefrontUrlOptions } from \"./types\";\nimport { inputUrl, isAttributionKey } from \"./url\";\n\nconst comparable = (url: URL) => {\n  url.searchParams.sort();\n  return `${normalizedPath(url.pathname)}${url.search}${url.hash}`;\n};\n\n/**\n * Find the canonical v2 URL for a recognized storefront route.\n * Compares normalized paths and sorted query parameters to avoid unnecessary redirects.\n *\n * Callers choose the HTTP status when serving the redirect.\n * Zappie templates use temporary redirects (302) for now.\n *\n * @returns A redirect target, or null for v1, an unknown route, a parse/build failure or an equivalent URL.\n */\nexport const storefrontRedirect = (\n  input: StorefrontUrlInput,\n  options: StorefrontUrlOptions = {},\n): string | null => {\n  if (!usesV2(options)) {\n    return null;\n  }\n  try {\n    const route = parseStorefrontUrl(input, options);\n    if (route.type === \"unknown\") {\n      return null;\n    }\n    const targetUrl = inputUrl(buildStorefrontUrl(route, options));\n    const original = inputUrl(input);\n    for (const key of [...targetUrl.searchParams.keys()]) {\n      if (isAttributionKey(key)) {\n        targetUrl.searchParams.delete(key);\n      }\n    }\n    original.searchParams.forEach((value, key) => {\n      if (isAttributionKey(key)) {\n        targetUrl.searchParams.append(key, value);\n      }\n    });\n    const path = comparable(targetUrl);\n    if (comparable(original) === path) {\n      return null;\n    }\n    return options.origin ? targetUrl.href : path;\n  } catch {\n    return null;\n  }\n};\n"],
+  "sourcesContent": ["import { buildStorefrontUrl } from \"./build\";\nimport { usesV2 } from \"./contract\";\nimport { normalizedPath } from \"./installation\";\nimport { parseStorefrontUrl } from \"./parse\";\nimport type { StorefrontUrlInput, StorefrontUrlOptions } from \"./types\";\nimport { inputUrl, isAttributionKey } from \"./url\";\n\nconst comparable = (url: URL) => {\n  url.searchParams.sort();\n  return `${normalizedPath(url.pathname)}${url.search}${url.hash}`;\n};\n\n/**\n * Find the canonical v2 URL for a recognized storefront route.\n * Compares normalized paths and sorted query parameters to avoid unnecessary redirects.\n *\n * Serve the target as a permanent redirect (301). A classic URL has moved for\n * good, so search engines carry its ranking to the site in one step.\n *\n * @returns A redirect target, or null for v1, an unknown route, a parse/build failure or an equivalent URL.\n */\nexport const storefrontRedirect = (\n  input: StorefrontUrlInput,\n  options: StorefrontUrlOptions = {},\n): string | null => {\n  if (!usesV2(options)) {\n    return null;\n  }\n  try {\n    const route = parseStorefrontUrl(input, options);\n    if (route.type === \"unknown\") {\n      return null;\n    }\n    const targetUrl = inputUrl(buildStorefrontUrl(route, options));\n    const original = inputUrl(input);\n    for (const key of [...targetUrl.searchParams.keys()]) {\n      if (isAttributionKey(key)) {\n        targetUrl.searchParams.delete(key);\n      }\n    }\n    original.searchParams.forEach((value, key) => {\n      if (isAttributionKey(key)) {\n        targetUrl.searchParams.append(key, value);\n      }\n    });\n    const path = comparable(targetUrl);\n    if (comparable(original) === path) {\n      return null;\n    }\n    return options.origin ? targetUrl.href : path;\n  } catch {\n    return null;\n  }\n};\n"],
   "mappings": ";AAAA,SAAS,0BAA0B;AACnC,SAAS,cAAc;AACvB,SAAS,sBAAsB;AAC/B,SAAS,0BAA0B;AAEnC,SAAS,UAAU,wBAAwB;AAE3C,IAAM,aAAa,CAAC,QAAa;AAC/B,MAAI,aAAa,KAAK;AACtB,SAAO,GAAG,eAAe,IAAI,QAAQ,CAAC,GAAG,IAAI,MAAM,GAAG,IAAI,IAAI;AAChE;AAWO,IAAM,qBAAqB,CAChC,OACA,UAAgC,CAAC,MACf;AAClB,MAAI,CAAC,OAAO,OAAO,GAAG;AACpB,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,QAAQ,mBAAmB,OAAO,OAAO;AAC/C,QAAI,MAAM,SAAS,WAAW;AAC5B,aAAO;AAAA,IACT;AACA,UAAM,YAAY,SAAS,mBAAmB,OAAO,OAAO,CAAC;AAC7D,UAAM,WAAW,SAAS,KAAK;AAC/B,eAAW,OAAO,CAAC,GAAG,UAAU,aAAa,KAAK,CAAC,GAAG;AACpD,UAAI,iBAAiB,GAAG,GAAG;AACzB,kBAAU,aAAa,OAAO,GAAG;AAAA,MACnC;AAAA,IACF;AACA,aAAS,aAAa,QAAQ,CAAC,OAAO,QAAQ;AAC5C,UAAI,iBAAiB,GAAG,GAAG;AACzB,kBAAU,aAAa,OAAO,KAAK,KAAK;AAAA,MAC1C;AAAA,IACF,CAAC;AACD,UAAM,OAAO,WAAW,SAAS;AACjC,QAAI,WAAW,QAAQ,MAAM,MAAM;AACjC,aAAO;AAAA,IACT;AACA,WAAO,QAAQ,SAAS,UAAU,OAAO;AAAA,EAC3C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;",
   "names": []
 }

package/dist/site-config/types.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/site-config/types.ts"],
-  "sourcesContent": ["/**\n * Default site budgets: 200 KB gzipped JavaScript, 50 KB gzipped CSS, 2500 ms LCP and 3000 ms until the first product card is tappable.\n */\nexport const DEFAULT_BUDGETS = {\n  jsKbGz: 200,\n  cssKbGz: 50,\n  lcpMs: 2500,\n  tappableMs: 3000,\n} as const;\n\n/**\n * Package names and patterns allowed globally without a site-specific allowlist entry.\n */\nexport const GLOBAL_PACKAGE_ALLOWLIST = [\n  \"react\",\n  \"react-dom\",\n  \"react-router\",\n  \"@react-router/*\",\n  \"@zappie/*\",\n  \"tailwindcss\",\n  \"@tailwindcss/*\",\n  \"clsx\",\n  \"tailwind-merge\",\n  \"class-variance-authority\",\n  \"lucide-react\",\n  \"date-fns\",\n  \"embla-carousel-react\",\n  \"framer-motion/motion\",\n  \"zod\",\n  \"@radix-ui/*\",\n  \"sonner\",\n  \"vaul\",\n] as const;\n\n/**\n * The store, theme and optional build policies you export from zappie.config.ts.\n */\nexport type ZappieSiteConfig = {\n  store: string;\n  branches?: string[];\n  theme: string;\n  prerender?: string[];\n  menu?: { hiddenCategories?: string[] };\n  packages?: { allow?: string[] };\n  /** Time-bounded acknowledgements for advisories that have no fixed version. */\n  audit?: {\n    ignore?: { id: string; reason: string; until: string }[];\n  };\n  outbound?: { allow?: string[] };\n  /** Add sources to the fixed storefront Content Security Policy. */\n  security?: {\n    csp?: {\n      imgSrc?: string[];\n      connectSrc?: string[];\n      fontSrc?: string[];\n      styleSrc?: string[];\n      frameSrc?: string[];\n    };\n  };\n  /** Each budget left out uses DEFAULT_BUDGETS. */\n  budgets?: {\n    jsKbGz?: number;\n    cssKbGz?: number;\n    lcpMs?: number;\n    /** V15's limit for the first product card to become tappable. Values below 3000 use 3000. */\n    tappableMs?: number;\n    override?: { reason: string };\n  };\n  /** Records explained exceptions to storefront readiness checks. */\n  readiness?: {\n    /** Lets this site skip the initial route discovery requirement. */\n    routeDiscovery?: {\n      /** Explains why this site does not use initial route discovery. */\n      optOut: {\n        /** States the constraint that prevents initial route discovery. */\n        reason: string;\n      };\n    };\n  };\n  analytics?: { forward?: { ga4?: string; metaPixel?: string } };\n  /** Where `zappie verify` opens the storefront and finds each catalogue. */\n  verify?: {\n    /**\n     * The route verify opens as the menu, such as /menu. It must list items. Defaults to /.\n     * `{menu}` stands for the first menu that holds items and `{branch}` for the default branch,\n     * such as `/menu?menu={menu}`.\n     */\n    startPath?: string;\n    /**\n     * The page for each menu, with `{menu}` where its id goes and, optionally, `{branch}` for the\n     * branch id, such as `/menu?menu={menu}`. Verify then judges each menu on its own page.\n     */\n    cataloguePath?: string;\n  };\n};\n\n/**\n * A configuration diagnostic with its field path, stable code, message and severity.\n */\nexport type ConfigIssue = {\n  path: string;\n  code:\n    | \"invalid_type\"\n    | \"missing_required\"\n    | \"unknown_key\"\n    | \"invalid_format\"\n    | \"duplicate\"\n    | \"redundant_allowlist\"\n    | \"budget_override\";\n  message: string;\n  severity: \"error\" | \"warning\";\n};\n\n/**\n * Configuration validation results. Warnings alone do not make valid false.\n */\nexport type ConfigValidation = { valid: boolean; issues: ConfigIssue[] };\n"],
+  "sourcesContent": ["/**\n * Default site budgets: 200 KB gzipped JavaScript, 50 KB gzipped CSS, 2500 ms LCP and 3000 ms until the first product card is tappable.\n */\nexport const DEFAULT_BUDGETS = {\n  jsKbGz: 200,\n  cssKbGz: 50,\n  lcpMs: 2500,\n  tappableMs: 3000,\n} as const;\n\n/**\n * Package names and patterns allowed globally without a site-specific allowlist entry.\n */\nexport const GLOBAL_PACKAGE_ALLOWLIST = [\n  \"react\",\n  \"react-dom\",\n  \"react-router\",\n  \"@react-router/*\",\n  \"@zappie/*\",\n  \"tailwindcss\",\n  \"@tailwindcss/*\",\n  \"clsx\",\n  \"tailwind-merge\",\n  \"class-variance-authority\",\n  \"lucide-react\",\n  \"date-fns\",\n  \"embla-carousel-react\",\n  \"framer-motion/motion\",\n  \"zod\",\n  \"@radix-ui/*\",\n  \"sonner\",\n  \"vaul\",\n] as const;\n\n/**\n * The store, theme and optional build policies you export from zappie.config.ts.\n */\nexport type ZappieSiteConfig = {\n  store: string;\n  branches?: string[];\n  theme: string;\n  prerender?: string[];\n  menu?: { hiddenCategories?: string[] };\n  packages?: { allow?: string[] };\n  /** Time-bounded acknowledgements for advisories that have no fixed version. */\n  audit?: {\n    ignore?: { id: string; reason: string; until: string }[];\n  };\n  outbound?: { allow?: string[] };\n  /** Add sources to the fixed storefront Content Security Policy. */\n  security?: {\n    csp?: {\n      imgSrc?: string[];\n      connectSrc?: string[];\n      fontSrc?: string[];\n      styleSrc?: string[];\n      frameSrc?: string[];\n    };\n    /** Hosts outside Zappie that built pages may link to, such as the store's own domains. */\n    links?: string[];\n  };\n  /** Each budget left out uses DEFAULT_BUDGETS. */\n  budgets?: {\n    jsKbGz?: number;\n    cssKbGz?: number;\n    lcpMs?: number;\n    /** V15's limit for the first product card to become tappable. Values below 3000 use 3000. */\n    tappableMs?: number;\n    override?: { reason: string };\n  };\n  /** Records explained exceptions to storefront readiness checks. */\n  readiness?: {\n    /** Lets this site skip the initial route discovery requirement. */\n    routeDiscovery?: {\n      /** Explains why this site does not use initial route discovery. */\n      optOut: {\n        /** States the constraint that prevents initial route discovery. */\n        reason: string;\n      };\n    };\n  };\n  analytics?: { forward?: { ga4?: string; metaPixel?: string } };\n  /** Where `zappie verify` opens the storefront and finds each catalogue. */\n  verify?: {\n    /**\n     * The route verify opens as the menu, such as /menu. It must list items. Defaults to /.\n     * `{menu}` stands for the first menu that holds items and `{branch}` for the default branch,\n     * such as `/menu?menu={menu}`.\n     */\n    startPath?: string;\n    /**\n     * The page for each menu, with `{menu}` where its id goes and, optionally, `{branch}` for the\n     * branch id, such as `/menu?menu={menu}`. Verify then judges each menu on its own page.\n     */\n    cataloguePath?: string;\n  };\n};\n\n/**\n * A configuration diagnostic with its field path, stable code, message and severity.\n */\nexport type ConfigIssue = {\n  path: string;\n  code:\n    | \"invalid_type\"\n    | \"missing_required\"\n    | \"unknown_key\"\n    | \"invalid_format\"\n    | \"duplicate\"\n    | \"redundant_allowlist\"\n    | \"budget_override\";\n  message: string;\n  severity: \"error\" | \"warning\";\n};\n\n/**\n * Configuration validation results. Warnings alone do not make valid false.\n */\nexport type ConfigValidation = { valid: boolean; issues: ConfigIssue[] };\n"],
   "mappings": ";AAGO,IAAM,kBAAkB;AAAA,EAC7B,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,OAAO;AAAA,EACP,YAAY;AACd;AAKO,IAAM,2BAA2B;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;",
   "names": []
 }

package/dist/site-config/validate.js

@@ -90,7 +90,8 @@ function validateConfig(input) {
   nested(input.outbound, "outbound", ["allow"], issue, (value) => {
     hostList(value.allow, "outbound.allow", error);
   });
-  nested(input.security, "security", ["csp"], issue, (security) => {
+  nested(input.security, "security", ["csp", "links"], issue, (security) => {
+    hostList(security.links, "security.links", error);
     nested(
       security.csp,
       "security.csp",

package/dist/site-config/validate.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/site-config/validate.ts"],
-  "sourcesContent": ["import {\n  globallyAllowed,\n  hostname,\n  nonblank,\n  packageName,\n  record,\n  unknownKeys,\n} from \"./helpers\";\nimport { analytics, budgets, nested } from \"./sections\";\nimport type { ConfigIssue, ConfigValidation } from \"./types\";\n\nconst rootKeys = [\n  \"store\",\n  \"branches\",\n  \"theme\",\n  \"prerender\",\n  \"menu\",\n  \"packages\",\n  \"audit\",\n  \"outbound\",\n  \"security\",\n  \"budgets\",\n  \"readiness\",\n  \"analytics\",\n  \"verify\",\n] as const;\n\n/**\n * Validate a site configuration and collect errors and warnings without changing it.\n * Checks required fields, unknown keys, allowlists, budgets and analytics settings.\n *\n * @param input - The configuration value to inspect.\n * @returns Diagnostics and a valid flag that is true when there are no errors.\n */\nexport function validateConfig(input: unknown): ConfigValidation {\n  const issues: ConfigIssue[] = [];\n  const issue = (value: ConfigIssue) => issues.push(value);\n  const error = (path: string, code: ConfigIssue[\"code\"], message: string) =>\n    issue({ path, code, message, severity: \"error\" });\n  if (!record(input)) {\n    return {\n      valid: false,\n      issues: [\n        {\n          path: \"$\",\n          code: \"invalid_type\",\n          message:\n            \"Expected a configuration object. Export an object from zappie.config.ts.\",\n          severity: \"error\",\n        },\n      ],\n    };\n  }\n  unknownKeys(input, rootKeys, \"\", issue);\n  if (!nonblank(input.store)) {\n    error(\n      \"store\",\n      input.store === undefined ? \"missing_required\" : \"invalid_type\",\n      \"Expected a non-empty storefront slug. Set store to the slug used by createZappie().\",\n    );\n  }\n  theme(input.theme, error);\n  stringList(input.branches, \"branches\", error, {\n    nonempty: true,\n    unique: true,\n    slug: true,\n  });\n  stringList(input.prerender, \"prerender\", error, { unique: true })?.forEach(\n    (path, index) => {\n      if (!path.startsWith(\"/\")) {\n        error(\n          `prerender[${index}]`,\n          \"invalid_format\",\n          \"Expected a route starting with /. Prefix the route with /.\",\n        );\n      }\n    },\n  );\n  nested(input.menu, \"menu\", [\"hiddenCategories\"], issue, (value) => {\n    stringList(value.hiddenCategories, \"menu.hiddenCategories\", error);\n  });\n  nested(input.packages, \"packages\", [\"allow\"], issue, (value) => {\n    const allow = stringList(value.allow, \"packages.allow\", error);\n    allow?.forEach((name, index) => {\n      if (globallyAllowed(name)) {\n        issue({\n          path: `packages.allow[${index}]`,\n          code: \"redundant_allowlist\",\n          message: `${name} is already globally allowed. Remove it from packages.allow.`,\n          severity: \"warning\",\n        });\n      } else if (!packageName(name)) {\n        error(\n          `packages.allow[${index}]`,\n          \"invalid_format\",\n          \"Expected a lowercase npm package name. Use a package name such as lucide-react or @scope/name.\",\n        );\n      }\n    });\n  });\n  nested(input.outbound, \"outbound\", [\"allow\"], issue, (value) => {\n    hostList(value.allow, \"outbound.allow\", error);\n  });\n  nested(input.security, \"security\", [\"csp\"], issue, (security) => {\n    nested(\n      security.csp,\n      \"security.csp\",\n      [\"imgSrc\", \"connectSrc\", \"fontSrc\", \"styleSrc\", \"frameSrc\"],\n      issue,\n      (csp) => {\n        for (const [name, value] of Object.entries(csp)) {\n          hostList(value, `security.csp.${name}`, error);\n        }\n      },\n    );\n  });\n  budgets(input.budgets, issue, error);\n  nested(\n    input.readiness,\n    \"readiness\",\n    [\"routeDiscovery\"],\n    issue,\n    (readiness) => {\n      nested(\n        readiness.routeDiscovery,\n        \"readiness.routeDiscovery\",\n        [\"optOut\"],\n        issue,\n        (routeDiscovery) => {\n          nested(\n            routeDiscovery.optOut,\n            \"readiness.routeDiscovery.optOut\",\n            [\"reason\"],\n            issue,\n            (optOut) => {\n              if (typeof optOut.reason !== \"string\" || !optOut.reason.trim()) {\n                error(\n                  \"readiness.routeDiscovery.optOut.reason\",\n                  \"invalid_format\",\n                  \"Expected a non-blank reason. Explain why the site disables initial route discovery.\",\n                );\n              }\n            },\n          );\n        },\n      );\n    },\n  );\n  analytics(input.analytics, issue, error);\n  // Verify checks the routes themselves when it runs.\n  nested(\n    input.verify,\n    \"verify\",\n    [\"startPath\", \"cataloguePath\"],\n    issue,\n    () => {},\n  );\n  return {\n    valid: !issues.some((entry) => entry.severity === \"error\"),\n    issues,\n  };\n}\n\ntype AddError = (\n  path: string,\n  code: ConfigIssue[\"code\"],\n  message: string,\n) => void;\n\nfunction theme(value: unknown, error: AddError) {\n  if (typeof value !== \"string\") {\n    error(\n      \"theme\",\n      value === undefined ? \"missing_required\" : \"invalid_type\",\n      \"Expected a relative .json path. Set theme to a value such as ./theme.json.\",\n    );\n  } else if (\n    !/\\.json$/.test(value) ||\n    /^(?:[a-z][a-z\\d+.-]*:|\\/|\\\\)/i.test(value) ||\n    value.includes(\"\\\\\")\n  ) {\n    error(\n      \"theme\",\n      \"invalid_format\",\n      \"Expected a relative .json path. Use a value such as ./theme.json.\",\n    );\n  }\n}\n\nfunction stringList(\n  value: unknown,\n  path: string,\n  error: AddError,\n  options: { nonempty?: boolean; unique?: boolean; slug?: boolean } = {},\n) {\n  if (value === undefined) {\n    return undefined;\n  }\n  if (\n    !Array.isArray(value) ||\n    value.some((entry) => typeof entry !== \"string\")\n  ) {\n    error(\n      path,\n      \"invalid_type\",\n      `Expected an array of strings. Set ${path} to string values.`,\n    );\n    return undefined;\n  }\n  if (options.nonempty && value.length === 0) {\n    error(\n      path,\n      \"invalid_format\",\n      `Expected at least one value. Add a value to ${path} or remove the field.`,\n    );\n  }\n  value.forEach((entry, index) => {\n    if (options.slug && !nonblank(entry)) {\n      error(\n        `${path}[${index}]`,\n        \"invalid_format\",\n        \"Expected a non-empty branch slug. Remove the empty value or use a branch slug.\",\n      );\n    }\n  });\n  if (options.unique && new Set(value).size !== value.length) {\n    error(\n      path,\n      \"duplicate\",\n      `Expected unique values. Remove duplicates from ${path}.`,\n    );\n  }\n  return value;\n}\n\nfunction hostList(value: unknown, path: string, error: AddError) {\n  stringList(value, path, error)?.forEach((host, index) => {\n    if (!hostname(host)) {\n      error(\n        `${path}[${index}]`,\n        \"invalid_format\",\n        \"Expected a hostname or leading *. subdomain pattern without a scheme, path, port or IP. Use a value such as api.example.com.\",\n      );\n    }\n  });\n}\n"],
-  "mappings": ";AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,WAAW,SAAS,cAAc;AAG3C,IAAM,WAAW;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AASO,SAAS,eAAe,OAAkC;AAC/D,QAAM,SAAwB,CAAC;AAC/B,QAAM,QAAQ,CAAC,UAAuB,OAAO,KAAK,KAAK;AACvD,QAAM,QAAQ,CAAC,MAAc,MAA2B,YACtD,MAAM,EAAE,MAAM,MAAM,SAAS,UAAU,QAAQ,CAAC;AAClD,MAAI,CAAC,OAAO,KAAK,GAAG;AAClB,WAAO;AAAA,MACL,OAAO;AAAA,MACP,QAAQ;AAAA,QACN;AAAA,UACE,MAAM;AAAA,UACN,MAAM;AAAA,UACN,SACE;AAAA,UACF,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,cAAY,OAAO,UAAU,IAAI,KAAK;AACtC,MAAI,CAAC,SAAS,MAAM,KAAK,GAAG;AAC1B;AAAA,MACE;AAAA,MACA,MAAM,UAAU,SAAY,qBAAqB;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAM,OAAO,KAAK;AACxB,aAAW,MAAM,UAAU,YAAY,OAAO;AAAA,IAC5C,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AACD,aAAW,MAAM,WAAW,aAAa,OAAO,EAAE,QAAQ,KAAK,CAAC,GAAG;AAAA,IACjE,CAAC,MAAM,UAAU;AACf,UAAI,CAAC,KAAK,WAAW,GAAG,GAAG;AACzB;AAAA,UACE,aAAa,KAAK;AAAA,UAClB;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,MAAM,MAAM,QAAQ,CAAC,kBAAkB,GAAG,OAAO,CAAC,UAAU;AACjE,eAAW,MAAM,kBAAkB,yBAAyB,KAAK;AAAA,EACnE,CAAC;AACD,SAAO,MAAM,UAAU,YAAY,CAAC,OAAO,GAAG,OAAO,CAAC,UAAU;AAC9D,UAAM,QAAQ,WAAW,MAAM,OAAO,kBAAkB,KAAK;AAC7D,WAAO,QAAQ,CAAC,MAAM,UAAU;AAC9B,UAAI,gBAAgB,IAAI,GAAG;AACzB,cAAM;AAAA,UACJ,MAAM,kBAAkB,KAAK;AAAA,UAC7B,MAAM;AAAA,UACN,SAAS,GAAG,IAAI;AAAA,UAChB,UAAU;AAAA,QACZ,CAAC;AAAA,MACH,WAAW,CAAC,YAAY,IAAI,GAAG;AAC7B;AAAA,UACE,kBAAkB,KAAK;AAAA,UACvB;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACD,SAAO,MAAM,UAAU,YAAY,CAAC,OAAO,GAAG,OAAO,CAAC,UAAU;AAC9D,aAAS,MAAM,OAAO,kBAAkB,KAAK;AAAA,EAC/C,CAAC;AACD,SAAO,MAAM,UAAU,YAAY,CAAC,KAAK,GAAG,OAAO,CAAC,aAAa;AAC/D;AAAA,MACE,SAAS;AAAA,MACT;AAAA,MACA,CAAC,UAAU,cAAc,WAAW,YAAY,UAAU;AAAA,MAC1D;AAAA,MACA,CAAC,QAAQ;AACP,mBAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC/C,mBAAS,OAAO,gBAAgB,IAAI,IAAI,KAAK;AAAA,QAC/C;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACD,UAAQ,MAAM,SAAS,OAAO,KAAK;AACnC;AAAA,IACE,MAAM;AAAA,IACN;AAAA,IACA,CAAC,gBAAgB;AAAA,IACjB;AAAA,IACA,CAAC,cAAc;AACb;AAAA,QACE,UAAU;AAAA,QACV;AAAA,QACA,CAAC,QAAQ;AAAA,QACT;AAAA,QACA,CAAC,mBAAmB;AAClB;AAAA,YACE,eAAe;AAAA,YACf;AAAA,YACA,CAAC,QAAQ;AAAA,YACT;AAAA,YACA,CAAC,WAAW;AACV,kBAAI,OAAO,OAAO,WAAW,YAAY,CAAC,OAAO,OAAO,KAAK,GAAG;AAC9D;AAAA,kBACE;AAAA,kBACA;AAAA,kBACA;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,YAAU,MAAM,WAAW,OAAO,KAAK;AAEvC;AAAA,IACE,MAAM;AAAA,IACN;AAAA,IACA,CAAC,aAAa,eAAe;AAAA,IAC7B;AAAA,IACA,MAAM;AAAA,IAAC;AAAA,EACT;AACA,SAAO;AAAA,IACL,OAAO,CAAC,OAAO,KAAK,CAAC,UAAU,MAAM,aAAa,OAAO;AAAA,IACzD;AAAA,EACF;AACF;AAQA,SAAS,MAAM,OAAgB,OAAiB;AAC9C,MAAI,OAAO,UAAU,UAAU;AAC7B;AAAA,MACE;AAAA,MACA,UAAU,SAAY,qBAAqB;AAAA,MAC3C;AAAA,IACF;AAAA,EACF,WACE,CAAC,UAAU,KAAK,KAAK,KACrB,gCAAgC,KAAK,KAAK,KAC1C,MAAM,SAAS,IAAI,GACnB;AACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,WACP,OACA,MACA,OACA,UAAoE,CAAC,GACrE;AACA,MAAI,UAAU,QAAW;AACvB,WAAO;AAAA,EACT;AACA,MACE,CAAC,MAAM,QAAQ,KAAK,KACpB,MAAM,KAAK,CAAC,UAAU,OAAO,UAAU,QAAQ,GAC/C;AACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,qCAAqC,IAAI;AAAA,IAC3C;AACA,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,YAAY,MAAM,WAAW,GAAG;AAC1C;AAAA,MACE;AAAA,MACA;AAAA,MACA,+CAA+C,IAAI;AAAA,IACrD;AAAA,EACF;AACA,QAAM,QAAQ,CAAC,OAAO,UAAU;AAC9B,QAAI,QAAQ,QAAQ,CAAC,SAAS,KAAK,GAAG;AACpC;AAAA,QACE,GAAG,IAAI,IAAI,KAAK;AAAA,QAChB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACD,MAAI,QAAQ,UAAU,IAAI,IAAI,KAAK,EAAE,SAAS,MAAM,QAAQ;AAC1D;AAAA,MACE;AAAA,MACA;AAAA,MACA,kDAAkD,IAAI;AAAA,IACxD;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,SAAS,OAAgB,MAAc,OAAiB;AAC/D,aAAW,OAAO,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,UAAU;AACvD,QAAI,CAAC,SAAS,IAAI,GAAG;AACnB;AAAA,QACE,GAAG,IAAI,IAAI,KAAK;AAAA,QAChB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;",
+  "sourcesContent": ["import {\n  globallyAllowed,\n  hostname,\n  nonblank,\n  packageName,\n  record,\n  unknownKeys,\n} from \"./helpers\";\nimport { analytics, budgets, nested } from \"./sections\";\nimport type { ConfigIssue, ConfigValidation } from \"./types\";\n\nconst rootKeys = [\n  \"store\",\n  \"branches\",\n  \"theme\",\n  \"prerender\",\n  \"menu\",\n  \"packages\",\n  \"audit\",\n  \"outbound\",\n  \"security\",\n  \"budgets\",\n  \"readiness\",\n  \"analytics\",\n  \"verify\",\n] as const;\n\n/**\n * Validate a site configuration and collect errors and warnings without changing it.\n * Checks required fields, unknown keys, allowlists, budgets and analytics settings.\n *\n * @param input - The configuration value to inspect.\n * @returns Diagnostics and a valid flag that is true when there are no errors.\n */\nexport function validateConfig(input: unknown): ConfigValidation {\n  const issues: ConfigIssue[] = [];\n  const issue = (value: ConfigIssue) => issues.push(value);\n  const error = (path: string, code: ConfigIssue[\"code\"], message: string) =>\n    issue({ path, code, message, severity: \"error\" });\n  if (!record(input)) {\n    return {\n      valid: false,\n      issues: [\n        {\n          path: \"$\",\n          code: \"invalid_type\",\n          message:\n            \"Expected a configuration object. Export an object from zappie.config.ts.\",\n          severity: \"error\",\n        },\n      ],\n    };\n  }\n  unknownKeys(input, rootKeys, \"\", issue);\n  if (!nonblank(input.store)) {\n    error(\n      \"store\",\n      input.store === undefined ? \"missing_required\" : \"invalid_type\",\n      \"Expected a non-empty storefront slug. Set store to the slug used by createZappie().\",\n    );\n  }\n  theme(input.theme, error);\n  stringList(input.branches, \"branches\", error, {\n    nonempty: true,\n    unique: true,\n    slug: true,\n  });\n  stringList(input.prerender, \"prerender\", error, { unique: true })?.forEach(\n    (path, index) => {\n      if (!path.startsWith(\"/\")) {\n        error(\n          `prerender[${index}]`,\n          \"invalid_format\",\n          \"Expected a route starting with /. Prefix the route with /.\",\n        );\n      }\n    },\n  );\n  nested(input.menu, \"menu\", [\"hiddenCategories\"], issue, (value) => {\n    stringList(value.hiddenCategories, \"menu.hiddenCategories\", error);\n  });\n  nested(input.packages, \"packages\", [\"allow\"], issue, (value) => {\n    const allow = stringList(value.allow, \"packages.allow\", error);\n    allow?.forEach((name, index) => {\n      if (globallyAllowed(name)) {\n        issue({\n          path: `packages.allow[${index}]`,\n          code: \"redundant_allowlist\",\n          message: `${name} is already globally allowed. Remove it from packages.allow.`,\n          severity: \"warning\",\n        });\n      } else if (!packageName(name)) {\n        error(\n          `packages.allow[${index}]`,\n          \"invalid_format\",\n          \"Expected a lowercase npm package name. Use a package name such as lucide-react or @scope/name.\",\n        );\n      }\n    });\n  });\n  nested(input.outbound, \"outbound\", [\"allow\"], issue, (value) => {\n    hostList(value.allow, \"outbound.allow\", error);\n  });\n  nested(input.security, \"security\", [\"csp\", \"links\"], issue, (security) => {\n    hostList(security.links, \"security.links\", error);\n    nested(\n      security.csp,\n      \"security.csp\",\n      [\"imgSrc\", \"connectSrc\", \"fontSrc\", \"styleSrc\", \"frameSrc\"],\n      issue,\n      (csp) => {\n        for (const [name, value] of Object.entries(csp)) {\n          hostList(value, `security.csp.${name}`, error);\n        }\n      },\n    );\n  });\n  budgets(input.budgets, issue, error);\n  nested(\n    input.readiness,\n    \"readiness\",\n    [\"routeDiscovery\"],\n    issue,\n    (readiness) => {\n      nested(\n        readiness.routeDiscovery,\n        \"readiness.routeDiscovery\",\n        [\"optOut\"],\n        issue,\n        (routeDiscovery) => {\n          nested(\n            routeDiscovery.optOut,\n            \"readiness.routeDiscovery.optOut\",\n            [\"reason\"],\n            issue,\n            (optOut) => {\n              if (typeof optOut.reason !== \"string\" || !optOut.reason.trim()) {\n                error(\n                  \"readiness.routeDiscovery.optOut.reason\",\n                  \"invalid_format\",\n                  \"Expected a non-blank reason. Explain why the site disables initial route discovery.\",\n                );\n              }\n            },\n          );\n        },\n      );\n    },\n  );\n  analytics(input.analytics, issue, error);\n  // Verify checks the routes themselves when it runs.\n  nested(\n    input.verify,\n    \"verify\",\n    [\"startPath\", \"cataloguePath\"],\n    issue,\n    () => {},\n  );\n  return {\n    valid: !issues.some((entry) => entry.severity === \"error\"),\n    issues,\n  };\n}\n\ntype AddError = (\n  path: string,\n  code: ConfigIssue[\"code\"],\n  message: string,\n) => void;\n\nfunction theme(value: unknown, error: AddError) {\n  if (typeof value !== \"string\") {\n    error(\n      \"theme\",\n      value === undefined ? \"missing_required\" : \"invalid_type\",\n      \"Expected a relative .json path. Set theme to a value such as ./theme.json.\",\n    );\n  } else if (\n    !/\\.json$/.test(value) ||\n    /^(?:[a-z][a-z\\d+.-]*:|\\/|\\\\)/i.test(value) ||\n    value.includes(\"\\\\\")\n  ) {\n    error(\n      \"theme\",\n      \"invalid_format\",\n      \"Expected a relative .json path. Use a value such as ./theme.json.\",\n    );\n  }\n}\n\nfunction stringList(\n  value: unknown,\n  path: string,\n  error: AddError,\n  options: { nonempty?: boolean; unique?: boolean; slug?: boolean } = {},\n) {\n  if (value === undefined) {\n    return undefined;\n  }\n  if (\n    !Array.isArray(value) ||\n    value.some((entry) => typeof entry !== \"string\")\n  ) {\n    error(\n      path,\n      \"invalid_type\",\n      `Expected an array of strings. Set ${path} to string values.`,\n    );\n    return undefined;\n  }\n  if (options.nonempty && value.length === 0) {\n    error(\n      path,\n      \"invalid_format\",\n      `Expected at least one value. Add a value to ${path} or remove the field.`,\n    );\n  }\n  value.forEach((entry, index) => {\n    if (options.slug && !nonblank(entry)) {\n      error(\n        `${path}[${index}]`,\n        \"invalid_format\",\n        \"Expected a non-empty branch slug. Remove the empty value or use a branch slug.\",\n      );\n    }\n  });\n  if (options.unique && new Set(value).size !== value.length) {\n    error(\n      path,\n      \"duplicate\",\n      `Expected unique values. Remove duplicates from ${path}.`,\n    );\n  }\n  return value;\n}\n\nfunction hostList(value: unknown, path: string, error: AddError) {\n  stringList(value, path, error)?.forEach((host, index) => {\n    if (!hostname(host)) {\n      error(\n        `${path}[${index}]`,\n        \"invalid_format\",\n        \"Expected a hostname or leading *. subdomain pattern without a scheme, path, port or IP. Use a value such as api.example.com.\",\n      );\n    }\n  });\n}\n"],
+  "mappings": ";AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,WAAW,SAAS,cAAc;AAG3C,IAAM,WAAW;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AASO,SAAS,eAAe,OAAkC;AAC/D,QAAM,SAAwB,CAAC;AAC/B,QAAM,QAAQ,CAAC,UAAuB,OAAO,KAAK,KAAK;AACvD,QAAM,QAAQ,CAAC,MAAc,MAA2B,YACtD,MAAM,EAAE,MAAM,MAAM,SAAS,UAAU,QAAQ,CAAC;AAClD,MAAI,CAAC,OAAO,KAAK,GAAG;AAClB,WAAO;AAAA,MACL,OAAO;AAAA,MACP,QAAQ;AAAA,QACN;AAAA,UACE,MAAM;AAAA,UACN,MAAM;AAAA,UACN,SACE;AAAA,UACF,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,cAAY,OAAO,UAAU,IAAI,KAAK;AACtC,MAAI,CAAC,SAAS,MAAM,KAAK,GAAG;AAC1B;AAAA,MACE;AAAA,MACA,MAAM,UAAU,SAAY,qBAAqB;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AACA,QAAM,MAAM,OAAO,KAAK;AACxB,aAAW,MAAM,UAAU,YAAY,OAAO;AAAA,IAC5C,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AACD,aAAW,MAAM,WAAW,aAAa,OAAO,EAAE,QAAQ,KAAK,CAAC,GAAG;AAAA,IACjE,CAAC,MAAM,UAAU;AACf,UAAI,CAAC,KAAK,WAAW,GAAG,GAAG;AACzB;AAAA,UACE,aAAa,KAAK;AAAA,UAClB;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,MAAM,MAAM,QAAQ,CAAC,kBAAkB,GAAG,OAAO,CAAC,UAAU;AACjE,eAAW,MAAM,kBAAkB,yBAAyB,KAAK;AAAA,EACnE,CAAC;AACD,SAAO,MAAM,UAAU,YAAY,CAAC,OAAO,GAAG,OAAO,CAAC,UAAU;AAC9D,UAAM,QAAQ,WAAW,MAAM,OAAO,kBAAkB,KAAK;AAC7D,WAAO,QAAQ,CAAC,MAAM,UAAU;AAC9B,UAAI,gBAAgB,IAAI,GAAG;AACzB,cAAM;AAAA,UACJ,MAAM,kBAAkB,KAAK;AAAA,UAC7B,MAAM;AAAA,UACN,SAAS,GAAG,IAAI;AAAA,UAChB,UAAU;AAAA,QACZ,CAAC;AAAA,MACH,WAAW,CAAC,YAAY,IAAI,GAAG;AAC7B;AAAA,UACE,kBAAkB,KAAK;AAAA,UACvB;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACD,SAAO,MAAM,UAAU,YAAY,CAAC,OAAO,GAAG,OAAO,CAAC,UAAU;AAC9D,aAAS,MAAM,OAAO,kBAAkB,KAAK;AAAA,EAC/C,CAAC;AACD,SAAO,MAAM,UAAU,YAAY,CAAC,OAAO,OAAO,GAAG,OAAO,CAAC,aAAa;AACxE,aAAS,SAAS,OAAO,kBAAkB,KAAK;AAChD;AAAA,MACE,SAAS;AAAA,MACT;AAAA,MACA,CAAC,UAAU,cAAc,WAAW,YAAY,UAAU;AAAA,MAC1D;AAAA,MACA,CAAC,QAAQ;AACP,mBAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC/C,mBAAS,OAAO,gBAAgB,IAAI,IAAI,KAAK;AAAA,QAC/C;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACD,UAAQ,MAAM,SAAS,OAAO,KAAK;AACnC;AAAA,IACE,MAAM;AAAA,IACN;AAAA,IACA,CAAC,gBAAgB;AAAA,IACjB;AAAA,IACA,CAAC,cAAc;AACb;AAAA,QACE,UAAU;AAAA,QACV;AAAA,QACA,CAAC,QAAQ;AAAA,QACT;AAAA,QACA,CAAC,mBAAmB;AAClB;AAAA,YACE,eAAe;AAAA,YACf;AAAA,YACA,CAAC,QAAQ;AAAA,YACT;AAAA,YACA,CAAC,WAAW;AACV,kBAAI,OAAO,OAAO,WAAW,YAAY,CAAC,OAAO,OAAO,KAAK,GAAG;AAC9D;AAAA,kBACE;AAAA,kBACA;AAAA,kBACA;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,YAAU,MAAM,WAAW,OAAO,KAAK;AAEvC;AAAA,IACE,MAAM;AAAA,IACN;AAAA,IACA,CAAC,aAAa,eAAe;AAAA,IAC7B;AAAA,IACA,MAAM;AAAA,IAAC;AAAA,EACT;AACA,SAAO;AAAA,IACL,OAAO,CAAC,OAAO,KAAK,CAAC,UAAU,MAAM,aAAa,OAAO;AAAA,IACzD;AAAA,EACF;AACF;AAQA,SAAS,MAAM,OAAgB,OAAiB;AAC9C,MAAI,OAAO,UAAU,UAAU;AAC7B;AAAA,MACE;AAAA,MACA,UAAU,SAAY,qBAAqB;AAAA,MAC3C;AAAA,IACF;AAAA,EACF,WACE,CAAC,UAAU,KAAK,KAAK,KACrB,gCAAgC,KAAK,KAAK,KAC1C,MAAM,SAAS,IAAI,GACnB;AACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,WACP,OACA,MACA,OACA,UAAoE,CAAC,GACrE;AACA,MAAI,UAAU,QAAW;AACvB,WAAO;AAAA,EACT;AACA,MACE,CAAC,MAAM,QAAQ,KAAK,KACpB,MAAM,KAAK,CAAC,UAAU,OAAO,UAAU,QAAQ,GAC/C;AACA;AAAA,MACE;AAAA,MACA;AAAA,MACA,qCAAqC,IAAI;AAAA,IAC3C;AACA,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,YAAY,MAAM,WAAW,GAAG;AAC1C;AAAA,MACE;AAAA,MACA;AAAA,MACA,+CAA+C,IAAI;AAAA,IACrD;AAAA,EACF;AACA,QAAM,QAAQ,CAAC,OAAO,UAAU;AAC9B,QAAI,QAAQ,QAAQ,CAAC,SAAS,KAAK,GAAG;AACpC;AAAA,QACE,GAAG,IAAI,IAAI,KAAK;AAAA,QAChB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACD,MAAI,QAAQ,UAAU,IAAI,IAAI,KAAK,EAAE,SAAS,MAAM,QAAQ;AAC1D;AAAA,MACE;AAAA,MACA;AAAA,MACA,kDAAkD,IAAI;AAAA,IACxD;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,SAAS,OAAgB,MAAc,OAAiB;AAC/D,aAAW,OAAO,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,UAAU;AACvD,QAAI,CAAC,SAAS,IAAI,GAAG;AACnB;AAAA,QACE,GAAG,IAAI,IAAI,KAAK;AAAA,QAChB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;",
   "names": []
 }

package/dist/url/index.d.ts

@@ -150,8 +150,8 @@ declare const parseStorefrontUrl: (input: StorefrontUrlInput, options?: Storefro
  * Find the canonical v2 URL for a recognized storefront route.
  * Compares normalized paths and sorted query parameters to avoid unnecessary redirects.
  *
- * Callers choose the HTTP status when serving the redirect.
- * Zappie templates use temporary redirects (302) for now.
+ * Serve the target as a permanent redirect (301). A classic URL has moved for
+ * good, so search engines carry its ranking to the site in one step.
  *
  * @returns A redirect target, or null for v1, an unknown route, a parse/build failure or an equivalent URL.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zappie/sdk",
-  "version": "0.1.24",
+  "version": "0.2.0",
   "description": "Typed, framework-agnostic client for Zappie menus, carts, checkout, auth and events.",
   "type": "module",
   "sideEffects": false,