@zenky/storefront-vue 0.10.4 → 0.10.6

package/CHANGELOG.md

@@ -4,6 +4,45 @@ All notable changes to this project are documented in this file. The format foll
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and releases follow
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## Unreleased
+
+### Added
+
+- `authStore.apiToken` — the single answer to "which token goes into an SDK call". It is
+  `undefined` unless the store holds a non-empty token, so an empty string can never reach
+  an `Authorization` header. Consumers should read it instead of deriving the rule from
+  `token` and `isAuthenticated` at each call site.
+
+## 0.10.5 - 2026-07-31
+
+### Changed
+
+- `config` is now an optional runtime port because the current core does not read it.
+- The framework-boundary gate now parses TypeScript syntax, so URLs and comment-like
+  text inside strings no longer hide violations or create false positives.
+- A runtime-context gate now rejects composable or Pinia-store resolution from deferred
+  helpers and store actions; those functions must use dependencies captured in setup.
+- Product restriction and delivery-time operations use public
+  `@zenky/storefront-api` resource methods instead of reaching through `sdk.client`.
+
+### Fixed
+
+- `authStore.initFromCookie()` now clears stale in-memory SDK credentials when the
+  current request has no auth cookies.
+- Payment selection reuses the setup-captured order total, so checkout with applied
+  bonuses no longer resolves a composable from a later event/checkout callback.
+- Cart delivery-method validation resolves the order-settings store once in the store
+  setup. Pinia already activates the owning instance for the duration of an action, so
+  this is consistency rather than a leak fix.
+- Runtime-context documentation now distinguishes Vue injection context, arbitrary
+  callbacks, `app.runWithContext()`, and Pinia's conditional global fallback.
+
+### Security
+
+- `logCartError` redaction now covers customer addresses, e-mail and phone numbers, and
+  checkout/payment/redirect URLs, in object keys, `key=value` assignments, and query
+  parameters alike. Cart and checkout failures previously logged these verbatim.
+
 ## 0.10.4 - 2026-07-29
 
 > **Breaking.** This release changes the runtime port contract and removes public

package/README.md

@@ -73,14 +73,71 @@ cart.itemCount.value // reactive
 cart.totalPrice.value
 ```
 
+### Call composables and stores synchronously in setup
+
+Composables read the runtime through `inject()`, which works while a component
+instance is active or while the owning Vue app is executing `app.runWithContext()`.
+The important cases behave differently:
+
+- **Top-level `await` in `<script setup>` is safe.** The SFC compiler wraps it in
+  `withAsyncContext()`, which restores the instance afterwards — so composables called
+  after `await bootstrap()` at the top level still resolve correctly.
+- **A lifecycle hook has context only in its synchronous prefix.** After its first
+  `await`, the component instance is no longer active.
+- **Event handlers, `watch` callbacks, timers, and `.then()` callbacks do not inherit
+  component injection context.** Resolve dependencies before registering the callback,
+  or deliberately re-enter the owning app with `app.runWithContext()`.
+- **A hand-written `async setup()` is not compiler-wrapped.** Resolve dependencies
+  before its first `await`.
+
+Resolve the composable up front and call the returned functions later.
+
+```ts
+// ✅ resolve in setup, call after the await
+const { dispatchCheck } = usePromotionsChecker()
+
+onMounted(async () => {
+  await initializeOrder()
+  dispatchCheck()
+})
+
+// ❌ resolving after an await — inject() has no instance to read from
+onMounted(async () => {
+  await initializeOrder()
+  const { dispatchCheck } = usePromotionsChecker()
+})
+```
+
+The same applies inside event handlers, `watch` callbacks, timers, and `.then()` blocks:
+resolve in `setup()`, keep the reference, call it from the callback. Watch for this
+inside `try` blocks in particular — the `catch` swallows the failure and reports it as
+whatever the surrounding operation was supposed to do, so the real cause never surfaces.
+
+**Stores fail differently, and worse.** The Pinia stores exported from
+`@zenky/storefront-vue/stores` read the runtime too, but a missed context does not throw:
+Pinia falls back to its module-level active instance. Under concurrent SSR that instance
+belongs to whichever request touched it last, so the lookup succeeds with another user's
+state instead of failing.
+
+Two cases behave differently, and the distinction is verified rather than assumed:
+
+- **Inside a store action — safe.** Pinia activates the action's own instance for the
+  duration of the call, so resolving another store there returns the right one.
+- **In a plain function after an `await`, outside any action and outside
+  `runWithContext()` — leaks.** This is the shape to watch for: it is silent, and it
+  crosses requests.
+
+Resolve core stores in `setup()` for the same reason you resolve composables there. A
+silent leak is far harder to notice than an exception.
+
 ## Runtime Ports
 
-`createStorefront(runtime)` takes one object. Six ports are required; the rest are optional — omit an optional port and the feature that needs it is simply skipped.
+`createStorefront(runtime)` takes one object. Five ports are required; the rest are optional — omit an optional port and the feature that needs it is simply skipped.
 
 | Port | Required | What the consumer provides |
 | --- | --- | --- |
 | `sdk` | yes | A `ZenkyStorefront` instance (`@zenky/storefront-api`). |
-| `config` | yes | `{ baseUrl, baseAuthUrl, salesChannelId? }`. |
+| `config` | no | Reserved consumer configuration; the current core does not read it. |
 | `storage` | yes | Key/value persistence — cookies, `localStorage`, memory. |
 | `notifier` | yes | Toasts: `error` / `success` / `warning` / `message`. |
 | `messages` | yes | Maps stable domain message keys to localized consumer copy. |
@@ -186,13 +243,15 @@ npm run test:coverage  # vitest + V8 coverage report
 npm run check          # format + lint + types + tests + build + exports
 npm run check:exports  # publint + are-the-types-wrong (esm-only profile)
 npm run check:boundaries # reject Nuxt/Unhead and consumer policy in src/
+npm run check:context  # reject ambient composables/stores in deferred helpers
 npm run check:runtime  # import all entries in SSR + reject Node-only output
 npm run check:size     # enforce gzip bundle budgets
 ```
 
 ### Local linking with yalc
 
-Until the package is published, link it into a consumer app with [yalc](https://github.com/wclr/yalc):
+To iterate on an unreleased change without cutting a version, link the package into a
+consumer app with [yalc](https://github.com/wclr/yalc):
 
 ```bash
 # in this package, after a build:
@@ -213,6 +272,7 @@ npm run build && npx yalc push
 - `typecheck` — type-only compile.
 - `check:exports` — validate the exports map and published types.
 - `check:boundaries` — reject Nuxt/Unhead APIs, routes, and tenant presets in core source.
+- `check:context` — reject deferred composable/store resolution outside composition setup.
 - `check:runtime` — verify Node SSR imports and browser/edge-safe ESM output.
 - `check:size` — enforce root/domain/all-output gzip budgets.
 - `check:ci` — quality gate with the V8 coverage ratchet.

package/dist/cart/index.js

@@ -1,10 +1,10 @@
-export { CASH_DENOMINATIONS_MAJOR, DEFAULT_ROUND_STEPS_MAJOR, ORDER_EVENTS, ORDER_WITH, buildCartLineKey, buildCashChangePresets, buildMainPaymentRequest, getCartErrorCode, getCartErrorHttpCode, getCartErrorMessage, getCashDenominationsMinor, getDefaultRoundStepsMinor, getValidationErrors, logCartError, normalizeAddress, useBonusesReconciliation, useCartAddressSync, useCartCustomerAttachment, useCartDeliveryAttachment, useCartInitialization, useCartMutation, useCartOperations, useCartQuantities, useCartRecalculation, useCartStockWatcher, useCheckoutFlow, useCheckoutSubmit, useCustomerAttach, useOnlinePaymentRetry, useOrderBonuses, useOrderChannel, useOrderDelivery, useOrderPromocode, useOrderSettings, useOrderTotal, usePaymentSelection, useRestrictedAddToCart, useRestrictionGate, useStorefrontCart, useVisibleCartVariants, variantLineKey } from '../chunk-YS5DXYYV.js';
-export { useCartCredentials } from '../chunk-YREGCQSB.js';
+export { CASH_DENOMINATIONS_MAJOR, DEFAULT_ROUND_STEPS_MAJOR, ORDER_EVENTS, ORDER_WITH, buildCartLineKey, buildCashChangePresets, buildMainPaymentRequest, getCartErrorCode, getCartErrorHttpCode, getCartErrorMessage, getCashDenominationsMinor, getDefaultRoundStepsMinor, getValidationErrors, logCartError, normalizeAddress, useBonusesReconciliation, useCartAddressSync, useCartCustomerAttachment, useCartDeliveryAttachment, useCartInitialization, useCartMutation, useCartOperations, useCartQuantities, useCartRecalculation, useCartStockWatcher, useCheckoutFlow, useCheckoutSubmit, useCustomerAttach, useOnlinePaymentRetry, useOrderBonuses, useOrderChannel, useOrderDelivery, useOrderPromocode, useOrderSettings, useOrderTotal, usePaymentSelection, useRestrictedAddToCart, useRestrictionGate, useStorefrontCart, useVisibleCartVariants, variantLineKey } from '../chunk-E4DUFN2M.js';
+export { useCartCredentials } from '../chunk-5YD4AIY2.js';
 import '../chunk-Z3IW4ODZ.js';
-import '../chunk-NIQFYJRP.js';
+import '../chunk-Z247QRDJ.js';
 import '../chunk-E3G7NGCH.js';
 import '../chunk-RO25KNM5.js';
 import '../chunk-5QCUH3FF.js';
-import '../chunk-TB5TBJ4U.js';
+import '../chunk-VFMVQR6Y.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/{chunk-YREGCQSB.js → chunk-5YD4AIY2.js}

@@ -1,5 +1,5 @@
-import { useCartStore, usePromotionsStore } from './chunk-NIQFYJRP.js';
-import { useRuntime, useAuthStore, useStoreProfileStore } from './chunk-TB5TBJ4U.js';
+import { useCartStore, usePromotionsStore } from './chunk-Z247QRDJ.js';
+import { useRuntime, useAuthStore, useStoreProfileStore } from './chunk-VFMVQR6Y.js';
 import { ref } from 'vue';
 
 var KEY_ORDER_ID = "zenky_order_id";
@@ -26,7 +26,7 @@ function useCartCredentials() {
     return profileStore.city.id;
   }
   function getApiToken() {
-    return authStore.isAuthenticated ? authStore.token ?? void 0 : void 0;
+    return authStore.apiToken;
   }
   function buildCredentials(orderId, orderToken) {
     const credentials = {
@@ -105,5 +105,5 @@ function usePromotionsChecker() {
 }
 
 export { useCartCredentials, usePromotionsChecker };
-//# sourceMappingURL=chunk-YREGCQSB.js.map
-//# sourceMappingURL=chunk-YREGCQSB.js.map
+//# sourceMappingURL=chunk-5YD4AIY2.js.map
+//# sourceMappingURL=chunk-5YD4AIY2.js.map

package/dist/chunk-5YD4AIY2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cart/useCartCredentials.ts","../src/promotions/usePromotionsChecker.ts"],"names":[],"mappings":";;;;AASA,IAAM,YAAA,GAAe,gBAAA;AACrB,IAAM,eAAA,GAAkB,mBAAA;AACxB,IAAM,YAAA,GAAe,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,CAAA;AAGpC,IAAM,oBAAA,GAAuB,SAAA;AAmBtB,SAAS,kBAAA,GAAsC;AAClD,EAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,UAAA,EAAW;AAC/B,EAAA,MAAM,YAAY,YAAA,EAAa;AAC/B,EAAA,MAAM,YAAY,YAAA,EAAa;AAC/B,EAAA,MAAM,eAAe,oBAAA,EAAqB;AAE1C,EAAA,MAAM,UAAA,GAAa,GAAA,CAAmB,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAC,CAAA;AAC/D,EAAA,MAAM,aAAA,GAAgB,GAAA,CAAmB,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAC,CAAA;AAErE,EAAA,SAAS,UAAA,GAAqB;AAC1B,IAAA,IAAI,CAAC,aAAa,KAAA,EAAO;AACrB,MAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAAA,IAC/C;AAEA,IAAA,OAAO,aAAa,KAAA,CAAM,EAAA;AAAA,EAC9B;AAEA,EAAA,SAAS,SAAA,GAAoB;AACzB,IAAA,IAAI,CAAC,aAAa,IAAA,EAAM;AACpB,MAAA,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAAA,IAC9C;AAEA,IAAA,OAAO,aAAa,IAAA,CAAK,EAAA;AAAA,EAC7B;AAEA,EAAA,SAAS,WAAA,GAAkC;AACvC,IAAA,OAAO,SAAA,CAAU,QAAA;AAAA,EACrB;AAEA,EAAA,SAAS,gBAAA,CAAiB,SAAiB,UAAA,EAAsC;AAC7E,IAAA,MAAM,WAAA,GAAgC;AAAA,MAClC,EAAA,EAAI,OAAA;AAAA,MACJ,KAAA,EAAO;AAAA,KACX;AAEA,IAAA,MAAM,WAAW,WAAA,EAAY;AAE7B,IAAA,IAAI,QAAA,EAAU;AACV,MAAA,WAAA,CAAY,SAAA,GAAY,QAAA;AAAA,IAC5B;AAEA,IAAA,OAAO,WAAA;AAAA,EACX;AAEA,EAAA,SAAS,cAAA,GAAmC;AACxC,IAAA,IAAI,CAAC,UAAU,WAAA,EAAa;AACxB,MAAA,MAAM,IAAI,MAAM,0BAA0B,CAAA;AAAA,IAC9C;AAEA,IAAA,OAAO,iBAAiB,SAAA,CAAU,WAAA,CAAY,EAAA,EAAI,SAAA,CAAU,YAAY,KAAK,CAAA;AAAA,EACjF;AAEA,EAAA,SAAS,mBAAmB,UAAA,EAAyB;AACjD,IAAA,UAAA,CAAW,QAAQ,UAAA,CAAW,EAAA;AAC9B,IAAA,aAAA,CAAc,QAAQ,UAAA,CAAW,KAAA;AACjC,IAAA,OAAA,CAAQ,IAAI,YAAA,EAAc,UAAA,CAAW,IAAI,EAAE,MAAA,EAAQ,cAAc,CAAA;AACjE,IAAA,OAAA,CAAQ,IAAI,eAAA,EAAiB,UAAA,CAAW,OAAO,EAAE,MAAA,EAAQ,cAAc,CAAA;AAAA,EAC3E;AAEA,EAAA,SAAS,yBAAA,GAAkC;AACvC,IAAA,UAAA,CAAW,KAAA,GAAQ,IAAA;AACnB,IAAA,aAAA,CAAc,KAAA,GAAQ,IAAA;AACtB,IAAA,OAAA,CAAQ,OAAO,YAAY,CAAA;AAC3B,IAAA,OAAA,CAAQ,OAAO,eAAe,CAAA;AAAA,EAClC;AAEA,EAAA,SAAS,cAAc,aAAA,EAA+B;AAClD,IAAA,IAAI,CAAC,aAAA,CAAc,MAAA,EAAQ,OAAO,IAAA;AAElC,IAAA,OAAO,MAAA,CAAO,aAAA,CAAc,MAAA,CAAO,IAAI,CAAA,KAAM,oBAAA;AAAA,EACjD;AAEA,EAAA,OAAO;AAAA,IACH,aAAA,EAAe,UAAA;AAAA,IACf,gBAAA,EAAkB,aAAA;AAAA,IAClB,UAAA;AAAA,IACA,SAAA;AAAA,IACA,WAAA;AAAA,IACA,gBAAA;AAAA,IACA,cAAA;AAAA,IACA,kBAAA;AAAA,IACA,yBAAA;AAAA,IACA;AAAA,GACJ;AACJ;;;AC1GA,IAAM,sBAAA,GAAyB,GAAA;AAmBxB,SAAS,oBAAA,GAA0C;AACtD,EAAA,MAAM,EAAE,GAAA,EAAK,MAAA,EAAO,GAAI,UAAA,EAAW;AACnC,EAAA,MAAM,YAAY,YAAA,EAAa;AAC/B,EAAA,MAAM,eAAe,oBAAA,EAAqB;AAC1C,EAAA,MAAM,kBAAkB,kBAAA,EAAmB;AAC3C,EAAA,MAAM,cAAc,kBAAA,EAAmB;AAEvC,EAAA,eAAe,aAAA,GAA+B;AAC1C,IAAA,IAAI,CAAC,SAAA,CAAU,QAAA,IAAY,eAAA,CAAgB,QAAA,EAAU;AAErD,IAAA,MAAM,OAAA,GAAU,aAAa,KAAA,EAAO,EAAA;AACpC,IAAA,IAAI,CAAC,OAAA,EAAS;AAEd,IAAA,eAAA,CAAgB,YAAY,IAAI,CAAA;AAChC,IAAA,eAAA,CAAgB,YAAA,EAAa;AAC7B,IAAA,MAAA,EAAQ,KAAI,EAAG,wBAAA,CAAyB,EAAE,KAAA,EAAO,SAAA,CAAU,OAAO,CAAA;AAElE,IAAA,IAAI;AACA,MAAA,MAAM,KAAA,GAAQ,YAAY,cAAA,EAAe;AACzC,MAAA,MAAM,GAAA,CAAI,MAAA,CAAO,yBAAA,CAA0B,OAAA,EAAS,KAAK,CAAA;AAEzD,MAAA,UAAA,CAAW,MAAM;AACb,QAAA,IAAI,eAAA,CAAgB,QAAA,EAAU,eAAA,CAAgB,WAAA,CAAY,KAAK,CAAA;AAAA,MACnE,GAAG,sBAAsB,CAAA;AAAA,IAC7B,SAAS,CAAA,EAAY;AACjB,MAAA,OAAA,CAAQ,KAAA,CAAM,6BAA6B,CAAC,CAAA;AAC5C,MAAA,eAAA,CAAgB,YAAY,KAAK,CAAA;AAAA,IACrC;AAAA,EACJ;AAEA,EAAA,OAAO,EAAE,aAAA,EAAc;AAC3B","file":"chunk-5YD4AIY2.js","sourcesContent":["import { ref, type Ref } from 'vue'\n\nimport type { Order, OrderCredentials } from '@zenky/storefront-api'\n\nimport { useRuntime } from '../ports/runtime'\nimport { useAuthStore } from '../stores/auth'\nimport { useCartStore } from '../stores/cart'\nimport { useStoreProfileStore } from '../stores/store-profile'\n\nconst KEY_ORDER_ID = 'zenky_order_id'\nconst KEY_ORDER_TOKEN = 'zenky_order_token'\nconst WEEK_SECONDS = 60 * 60 * 24 * 7\n\n// app-энум OrderStatusKind.Pending = 'pending'.\nconst ORDER_STATUS_PENDING = 'pending'\n\nexport interface CartCredentials {\n    orderIdCookie: Ref<string | null>\n    orderTokenCookie: Ref<string | null>\n    getStoreId: () => string\n    getCityId: () => string\n    getApiToken: () => string | undefined\n    buildCredentials: (orderId: string, orderToken: string) => OrderCredentials\n    getCredentials: () => OrderCredentials\n    persistCredentials: (savedOrder: Order) => void\n    clearPersistedCredentials: () => void\n    isOrderActive: (order: Order) => boolean\n}\n\n/**\n * Управление credentials заказа. Персистенс order-id/token — через порт `storage`\n * (ядро не знает про useCookie). Рефы инициализируются из storage, persist пишет в оба.\n */\nexport function useCartCredentials(): CartCredentials {\n    const { storage } = useRuntime()\n    const cartStore = useCartStore()\n    const authStore = useAuthStore()\n    const profileStore = useStoreProfileStore()\n\n    const orderIdRef = ref<string | null>(storage.get(KEY_ORDER_ID))\n    const orderTokenRef = ref<string | null>(storage.get(KEY_ORDER_TOKEN))\n\n    function getStoreId(): string {\n        if (!profileStore.store) {\n            throw new Error('Store is not initialized.')\n        }\n\n        return profileStore.store.id\n    }\n\n    function getCityId(): string {\n        if (!profileStore.city) {\n            throw new Error('City is not initialized.')\n        }\n\n        return profileStore.city.id\n    }\n\n    function getApiToken(): string | undefined {\n        return authStore.apiToken\n    }\n\n    function buildCredentials(orderId: string, orderToken: string): OrderCredentials {\n        const credentials: OrderCredentials = {\n            id: orderId,\n            token: orderToken,\n        }\n\n        const apiToken = getApiToken()\n\n        if (apiToken) {\n            credentials.api_token = apiToken\n        }\n\n        return credentials\n    }\n\n    function getCredentials(): OrderCredentials {\n        if (!cartStore.credentials) {\n            throw new Error('Cart has no credentials.')\n        }\n\n        return buildCredentials(cartStore.credentials.id, cartStore.credentials.token)\n    }\n\n    function persistCredentials(savedOrder: Order): void {\n        orderIdRef.value = savedOrder.id\n        orderTokenRef.value = savedOrder.token\n        storage.set(KEY_ORDER_ID, savedOrder.id, { maxAge: WEEK_SECONDS })\n        storage.set(KEY_ORDER_TOKEN, savedOrder.token, { maxAge: WEEK_SECONDS })\n    }\n\n    function clearPersistedCredentials(): void {\n        orderIdRef.value = null\n        orderTokenRef.value = null\n        storage.remove(KEY_ORDER_ID)\n        storage.remove(KEY_ORDER_TOKEN)\n    }\n\n    function isOrderActive(existingOrder: Order): boolean {\n        if (!existingOrder.status) return true\n\n        return String(existingOrder.status.kind) === ORDER_STATUS_PENDING\n    }\n\n    return {\n        orderIdCookie: orderIdRef,\n        orderTokenCookie: orderTokenRef,\n        getStoreId,\n        getCityId,\n        getApiToken,\n        buildCredentials,\n        getCredentials,\n        persistCredentials,\n        clearPersistedCredentials,\n        isOrderActive,\n    }\n}\n","import { useRuntime } from '../ports/runtime'\nimport { useCartCredentials } from '../cart/useCartCredentials'\nimport { useCartStore } from '../stores/cart'\nimport { usePromotionsStore } from '../stores/promotions'\nimport { useStoreProfileStore } from '../stores/store-profile'\n\nexport interface PromotionsChecker {\n    dispatchCheck: () => Promise<void>\n}\n\n/** Таймаут — если WS не ответил, сбросить флаг checking. */\nconst WS_RESPONSE_TIMEOUT_MS = 5000\n\n/**\n * Проверка промо-акций. Вызывает dispatchPromotionsChecker после изменения корзины.\n * Результат приходит через WebSocket (обрабатывается в useOrderChannel).\n *\n * Резолвить синхронно в setup, а после await вызывать только `dispatchCheck` — как и\n * любой композабл ядра, см. раздел «Call composables and stores synchronously in setup»\n * в README.\n *\n * ```ts\n * const { dispatchCheck } = usePromotionsChecker()\n *\n * async function addGift() {\n *     await addVariantToOrder()\n *     dispatchCheck()\n * }\n * ```\n */\nexport function usePromotionsChecker(): PromotionsChecker {\n    const { sdk, events } = useRuntime()\n    const cartStore = useCartStore()\n    const profileStore = useStoreProfileStore()\n    const promotionsStore = usePromotionsStore()\n    const credentials = useCartCredentials()\n\n    async function dispatchCheck(): Promise<void> {\n        if (!cartStore.hasOrder || promotionsStore.checking) return\n\n        const storeId = profileStore.store?.id\n        if (!storeId) return\n\n        promotionsStore.setChecking(true)\n        promotionsStore.clearRewards() // Очистить старые — WS заново наполнит актуальные\n        events?.get()?.promotionsCheckerStarted({ order: cartStore.order })\n\n        try {\n            const creds = credentials.getCredentials()\n            await sdk.orders.dispatchPromotionsChecker(storeId, creds)\n\n            setTimeout(() => {\n                if (promotionsStore.checking) promotionsStore.setChecking(false)\n            }, WS_RESPONSE_TIMEOUT_MS)\n        } catch (e: unknown) {\n            console.error('[promotions] check failed', e)\n            promotionsStore.setChecking(false)\n        }\n    }\n\n    return { dispatchCheck }\n}\n"]}

package/dist/{chunk-YS5DXYYV.js → chunk-E4DUFN2M.js}

@@ -1,10 +1,10 @@
-import { useCartCredentials, usePromotionsChecker } from './chunk-YREGCQSB.js';
+import { useCartCredentials, usePromotionsChecker } from './chunk-5YD4AIY2.js';
 import { useCatalogStore } from './chunk-Z3IW4ODZ.js';
-import { useCartStore, useOrderSettingsStore, usePromotionsStore } from './chunk-NIQFYJRP.js';
+import { useCartStore, useOrderSettingsStore, usePromotionsStore } from './chunk-Z247QRDJ.js';
 import { getRemoteCatalog } from './chunk-E3G7NGCH.js';
 import { minorToMajor, majorToMinor } from './chunk-RO25KNM5.js';
 import { createRuntimeState } from './chunk-5QCUH3FF.js';
-import { useRuntime, useStoreProfileStore, useAuthStore } from './chunk-TB5TBJ4U.js';
+import { useRuntime, useStoreProfileStore, useAuthStore } from './chunk-VFMVQR6Y.js';
 import { PaymentMethod, OrderAuthenticationMethod, DeliveryMethod, OrderCartCheckerResultAction, RecaptchaAction } from '@zenky/storefront-api';
 import { ref, computed, watch, watchEffect, getCurrentScope, onScopeDispose, toValue } from 'vue';
 import { storeToRefs } from 'pinia';
@@ -98,17 +98,24 @@ var MAX_LOG_DEPTH = 6;
 var MAX_ARRAY_ITEMS = 25;
 var MAX_OBJECT_KEYS = 50;
 var SENSITIVE_KEY_PARTS = [
+  "address",
   "authorization",
+  "checkouturl",
   "cookie",
   "credential",
+  "email",
   "password",
+  "paymentlink",
+  "paymentpageurl",
+  "phone",
   "recaptcha",
+  "redirecturl",
   "secret",
   "token"
 ];
 var SENSITIVE_EXACT_KEYS = /* @__PURE__ */ new Set(["cvc", "cvv", "otp", "pan", "pin"]);
-var SENSITIVE_ASSIGNMENT = /((?:authorization|cookie|password|recaptcha|secret|(?:api|access|auth|card|order|refresh)[_-]?token|token)\s*[=:]\s*["']?)([^\s,"';&}\]]+)/gi;
-var SENSITIVE_QUERY_PARAM = /([?&#](?:authorization|password|recaptcha|secret|(?:api|access|auth|card|order|refresh)[_-]?token|token)=)([^&#\s]+)/gi;
+var SENSITIVE_ASSIGNMENT = /((?:address|authorization|cookie|email|password|phone|recaptcha|secret|(?:checkout|redirect)[_-]?url|payment(?:[_-]?page)?[_-]?(?:link|url)|(?:api|access|auth|card|order|refresh)[_-]?token|token)\s*[=:]\s*["']?)([^\s,"';&}\]]+)/gi;
+var SENSITIVE_QUERY_PARAM = /([?&#](?:address|authorization|email|password|phone|recaptcha|secret|(?:checkout|redirect)[_-]?url|payment(?:[_-]?page)?[_-]?(?:link|url)|(?:api|access|auth|card|order|refresh)[_-]?token|token)=)([^&#\s]+)/gi;
 var BEARER_TOKEN = /(bearer\s+)[a-z0-9._~+/=-]+/gi;
 function isSensitiveKey(key) {
   const normalized = key.replace(/[^a-z0-9]/gi, "").toLowerCase();
@@ -636,7 +643,7 @@ function usePaymentSelection() {
   const credentials = useCartCredentials();
   const cartStore = useCartStore();
   const profileStore = useStoreProfileStore();
-  const { fetchTotal } = useOrderTotal();
+  const { fetchTotal, total } = useOrderTotal();
   const { run: runMutation } = useCartMutation();
   async function sendPayments(payments, debounce = PAYMENT_DEBOUNCE_MS) {
     const storeId = profileStore.store?.id;
@@ -687,7 +694,6 @@ function usePaymentSelection() {
   }
   function getCurrentBonusesPayment() {
     if (!cartStore.hasBonusesApplied) return null;
-    const { total } = useOrderTotal();
     const bonusPayment = total.value?.payments?.find(
       (p) => p.method === PaymentMethod.Bonuses
     );
@@ -1154,20 +1160,9 @@ function useOrderDelivery(deps = {}) {
       () => {
         const storeId = credentials.getStoreId();
         const orderCredentials = credentials.getCredentials();
-        if (typeof orderCredentials === "string") {
-          throw new Error("cart:no_credentials");
-        }
-        const path = sdk.client.getStoreUrl(
-          storeId,
-          `/orders/${orderCredentials.id}/checkout/delivery/time`,
-          { token: orderCredentials.token }
-        );
-        return sdk.client.request(
-          "POST",
-          path,
-          { deliver_at: deliverAt },
-          orderCredentials.api_token ?? null
-        );
+        return sdk.orders.setOrderDeliveryTime(storeId, orderCredentials, {
+          deliver_at: deliverAt
+        });
       },
       { deliverAt },
       options.awaitSettle ?? false
@@ -1979,12 +1974,10 @@ function useRestrictedAddToCart() {
     if (!storeId || !cityId) return true;
     let blocking = [];
     try {
-      const url = sdk.client.getStoreUrl(storeId, `/products/${product.id}/restrictions`, {
-        city_id: cityId,
-        stock_id: profileStore.stock?.id ?? void 0
+      const restrictions = await sdk.products.getProductRestrictions(storeId, product.id, {
+        city_id: cityId
       });
-      const response = await sdk.client.request("GET", url);
-      blocking = (response?.data ?? []).filter((item) => item.is_blocking);
+      blocking = (restrictions ?? []).filter((item) => item.is_blocking);
     } catch (error) {
       logCartError({ scope: "restrictions-check", context: { productId: product.id } }, error);
       return true;
@@ -2014,5 +2007,5 @@ function useVisibleCartVariants() {
 }
 
 export { CASH_DENOMINATIONS_MAJOR, DEFAULT_ROUND_STEPS_MAJOR, ORDER_EVENTS, ORDER_WITH, buildCartLineKey, buildCashChangePresets, buildMainPaymentRequest, getCartErrorCode, getCartErrorHttpCode, getCartErrorMessage, getCashDenominationsMinor, getDefaultRoundStepsMinor, getValidationErrors, logCartError, normalizeAddress, useBonusesReconciliation, useCartAddressSync, useCartCustomerAttachment, useCartDeliveryAttachment, useCartInitialization, useCartMutation, useCartOperations, useCartQuantities, useCartRecalculation, useCartStockWatcher, useCheckoutFlow, useCheckoutSubmit, useCustomerAttach, useOnlinePaymentRetry, useOrderBonuses, useOrderChannel, useOrderDelivery, useOrderPromocode, useOrderSettings, useOrderTotal, usePaymentSelection, useRestrictedAddToCart, useRestrictionGate, useStorefrontCart, useVisibleCartVariants, variantLineKey };
-//# sourceMappingURL=chunk-YS5DXYYV.js.map
-//# sourceMappingURL=chunk-YS5DXYYV.js.map
+//# sourceMappingURL=chunk-E4DUFN2M.js.map
+//# sourceMappingURL=chunk-E4DUFN2M.js.map