@zenky/storefront-vue 0.10.9 → 0.10.11

package/CHANGELOG.md

@@ -8,11 +8,173 @@ All notable changes to this project are documented in this file. The format foll
 
 ### Added
 
+- `groupScheduleDays` (`/utils`) — collapses consecutive days that share the same hours
+  into one row, so a location prints "пн — пт: 10:00-19:00" instead of five identical
+  lines; a page listing a chain's pickup points would otherwise print seven day-rows per
+  location. Day abbreviations come from `Intl`, not from slicing the long name — Russian
+  "понедельник" abbreviates to "пн", not "по" — and are returned in the locale's own
+  casing, since capitalizing them here corrupts scripts such as Georgian. Intl formatters
+  are memoized: constructing one is the expensive part, and a seven-location page built
+  roughly a hundred of them.
+- `catalogItemEntity` / `isRenderableCatalogItem` (`/catalog`) — resolve a static catalog
+  item to a discriminated `category | collection` entity, with `id` and `name` lifted out
+  so a consumer can key, title, and scroll-spy a section without branching. Manual
+  catalogs can now contain product collections, which ship a `products_collection` object
+  instead of `category`. The entity is resolved by which object is present rather than by
+  `type`, because the payload (`products_collection`) and `@zenky/storefront-api@1.0.2`
+  (`collection`) disagree on the discriminator; both spellings are read. Items whose
+  entity has no id are treated as malformed and resolve to `null`.
+- `StaticCatalogItem` / `StaticRemoteCatalog` (`/catalog`) — the catalog shapes as the
+  payload actually ships them. The SDK types predate manual catalogs: they omit
+  `products_collection` and `catalog_id`, the latter already returned by the live store
+  profile (`null` for automatic catalogs, filled for manual ones).
+- `buildCollectionSchemas` (`/seo`) — JSON-LD for a products collection page.
 - `useProductList` — fetches a page of products for a category or collection, with the
   include list that keeps per-stock pricing working (`variants.prices`). Three call sites
   in the consuming app built this fetch by hand and had drifted apart; one of them was
   missing `variants.prices` and silently showed every product's store-wide price instead
   of the price of the stock the customer was actually browsing.
+- `authFlow` store (`zenky-auth-flow`, new `/auth` subpath) — the registration/login/
+  password-reset step machine (`checkPhone`/`login`/`register`/`confirmRegistration`/
+  `resendCode`/`dispatchReset`/`resetPassword`), moved out of the consuming app, with
+  confirmation-channel selection added on top (SMS/Telegram/WhatsApp). `register`/
+  `resendCode`/`dispatchReset` gate on a channel picker when the store has 2+ channels
+  enabled (`store.settings.authentication`), retry on `auth.otp_request.failed` by
+  falling back to another enabled channel — the failed channel is exposed as
+  `lastFailedChannel` so the UI can hide/disable it on the retry. `SelectableConfirmationChannel`
+  (`ConfirmationChannel` minus the response-only `call`) types everything the user can
+  actually pick — `availableChannels`, `selectChannel`, `lastFailedChannel`. Requires
+  `@zenky/storefront-api@^1.1.0` for `ConfirmationMethod.Telegram/WhatsApp` and
+  `RequestedConfirmationMethod`. Recaptcha is a parameter on every action that dispatches
+  an OTP, including `checkPhone`/`login`'s internal auto-resend
+  (`RecaptchaPayloadProvider`, reused from `cart/useCheckoutSubmit` — not a new port,
+  same pattern as checkout submission). All user-facing error copy goes through the
+  `messages` port instead of hardcoded Russian strings — 8 new `StorefrontMessageKey`
+  entries (`auth.checkPhoneFailed`, `auth.invalidPassword`, `auth.registerFailed`,
+  `auth.invalidCode`, `auth.resendCodeFailed`, `auth.dispatchResetFailed`,
+  `auth.resetPasswordFailed`, `auth.otpUnavailable`). `handleAuthError` now takes a
+  `StorefrontMessageKey` fallback instead of a ready-made string, so the core makes no
+  assumption about locale — text and translation stay entirely on the consumer's side.
+  Every action is guarded against out-of-order responses with an operation-revision
+  counter: each top-level call (`checkPhone`, `login`, `register`, `confirmRegistration`,
+  `resendCode`, `dispatchReset`, `resetPassword`, `selectChannel`) opens a new revision
+  that a later call — a fresh attempt, `reset()`, any `goTo*` navigation including
+  `Back`, or `changeChannel()` — invalidates; after every `await` (recaptcha included)
+  the store checks its revision is still current before touching
+  `currentStep`/`error`/`loading`/etc., so a slow response from an abandoned attempt can
+  no longer land on top of a newer one. A nested call that's a continuation of the same
+  user attempt (`checkPhone`/`login`'s auto-resend, `register`'s 0-channel `login`
+  fallback, `selectChannel`'s dispatch) receives the parent's revision instead of
+  opening its own, so it isn't invalidated by its own caller. Invalidation isn't limited
+  to explicit actions: `phone`/`countryCode` invalidate on direct assignment too (a
+  `customRef`, transparent to `v-model`), since both are typically bound straight to an
+  input — a user can edit the field without re-submitting while a request for the old
+  value is still in flight. Every value read after an `await` (`phone`, `country`,
+  recaptcha action, the channel a failed OTP dispatch is attributed to) is a snapshot
+  taken before the first `await`, not a live read, so a value the user changes while a
+  request is in flight can't leak into how its response is handled. Both invalidating
+  helpers — `beginOperation()` for a fresh top-level attempt, `cancelPendingOperation()`
+  where nothing new replaces what's cancelled (`Back`, `reset()`, `changeChannel()`) —
+  clear `loading` themselves rather than assuming "the next line" will: for most actions
+  the next line isn't `loading.value = true` but a channel gate or a `storeId` check
+  that can `return` first, and the request's own `finally` has just lost the right to
+  clear `loading` by the same guard. An action that does reach its request sets
+  `loading` back to `true` a few lines later, in the same synchronous stretch, so this
+  reads as one transition, not a flicker.
+
+  Covered by 14 dedicated tests: a stale response losing to a newer one; a stale
+  `finally` not clearing a newer call's `loading`; the same class of bug in two more
+  shapes — every `goTo*`/`changeChannel()` invalidating the revision without clearing
+  `loading`, and a fresh action doing the same on its own early return, both leaving
+  `loading` stuck since the cancelled request's `finally` had already lost the right to
+  touch it; a stale recaptcha not overriding a channel picked after it; `Back` during a
+  dispatch neither landing the user back on `Code` nor leaving `loading` stuck; editing
+  `phone` without resubmitting neither applying a stale response nor letting a nested
+  auto-resend fire against the new number; a directly-assigned `confirmationMethod` (no
+  `customRef` on it — the legitimate paths already invalidate) not corrupting
+  `lastFailedChannel` on an OTP failure; and firing every remaining top-level action
+  twice to confirm the `loading` guard holds everywhere, not just where it was first
+  found broken.
+
+### Changed
+
+- `useCatalogStore` (`catalog`, `initCatalog`), `findProductInCatalog`, and the
+  `catalogItem` on `CatalogProductMatch` are typed `StaticCatalogItem` instead of the
+  SDK's `CatalogItem`, so the collection fields are visible on what the store holds.
+  `CatalogItem` values remain assignable, so passing catalog data in is unaffected; a
+  consumer that annotates a value read back out of the store as `CatalogItem[]` needs to
+  widen that annotation.
+- `getRemoteCatalog` returns `StaticRemoteCatalog`, so `catalog_id` is typed.
+
+### Fixed
+
+- `authFlow.goToReset()` no longer confuses the resend timer between phone numbers.
+  `resendTimerEndsAt`/`codeContext` are shared, request-scoped refs, and were only
+  cleared by a full `reset()` — checking a second phone number after abandoning a
+  password-reset flow for a first one could land the second number straight on the
+  confirmation-code step for a code that was never actually sent to it. `checkPhone()`
+  now clears both at the start of every phone check, and `goToReset()` only trusts the
+  timer when `codeContext` is already `Reset`.
+- `authFlow` error messages for non-`ZenkyError` failures (network drop, CORS, an
+  ad-blocker) no longer leak the raw `Error.message` to the user — they fall through to
+  the localized `fallback` string, same as `cart`'s error handling already did.
+- `authFlow.selectChannel()` no longer clears `channelIntent` before the dispatch it
+  triggers actually succeeds. Any failure other than `auth.otp_request.failed`
+  (validation, network) left `currentStep` on `Channel` with `channelIntent` already
+  `null` — picking a channel again silently did nothing, and `goToChannelBack()` sent
+  the user to `Phone` instead of back to `Register`/`Code`/`Reset`. `channelIntent` is
+  now cleared by `register`/`resendCode`/`dispatchReset` themselves, only on real
+  success.
+- `authFlow.resendCode()` now transitions to `AUTH_STEP.Code` itself when the dispatch it
+  just ran was reached via the channel picker — previously it never advanced past
+  `Channel` on that path (only `checkPhone`/`login`'s direct calls advanced the step),
+  so picking a channel for a resend silently left the user stuck on the picker after a
+  successful send.
+- `authFlow.checkPhone()`/`login()`'s internal auto-resend (registered-but-unconfirmed,
+  and the `ConfirmationRequired` branch of `login`) no longer dispatches the OTP with a
+  no-op recaptcha provider. Both now take `getRecaptchaPayload` and forward it — for
+  stores with 2+ channels this was invisible (the real provider arrives later via
+  `selectChannel`), but for a single-channel store the request went out with no
+  recaptcha token at all.
+- `authFlow.checkPhone()` now clears the full phone-scoped state (`confirmationMethod`,
+  `pendingPassword`, `channelIntent`, `resetCode`, `registerCode` — previously only
+  `codeContext`/`resendTimerEndsAt`) at the start of every check. Backing out of a flow
+  for one phone number and checking a different one could otherwise carry over the
+  first number's selected channel or pending password.
+- `authFlow.channelIntent` is now part of the store's public `$state` (returned from
+  `defineStore`'s setup, per the dts rule) instead of a closure-local ref. Pinia setup
+  stores only serialize/hydrate what's returned — if the server happened to render with
+  `currentStep === 'channel'`, the client would hydrate that step with `channelIntent`
+  reset to `null`, making the picker a no-op and `goToChannelBack()` misroute.
+- `handleOtpDispatchError()` no longer force-casts `confirmationMethod.value` into
+  `lastFailedChannel`. The cast assumed the value was always the channel *just
+  requested*, which holds right after an explicit `selectChannel()` pick but not when
+  `confirmationMethod` was inherited from an *earlier* successful dispatch whose
+  response (`AuthConfirmationStatus.method`, the SDK's full `ConfirmationMethod`, not
+  the request-only `RequestedConfirmationMethod`) came back as the legacy `Call` value —
+  a real backend fallback (dial in, code is the caller ID's last 4 digits), not a
+  hypothetical. A later failed attempt would then have silently stored `'call'` into a
+  field typed to exclude it, making the "hide the channel that just failed" UX a no-op
+  for that case. Now a runtime check keeps `Call` out instead of asserting it away.
+- `authFlow.changeChannel()` now invalidates the pending operation revision. Without it,
+  a dispatch still in flight when the user resets their channel choice could resolve
+  afterward and resurrect the very channel they just backed out of (its success handler
+  writes `confirmationMethod` from the response, unconditionally).
+
+### Security
+
+- `authFlow.pendingPassword` is cleared immediately after a successful `register`
+  (0-channel edge case) or `confirmRegistration`, instead of lingering until the next
+  full `reset()`. It's a raw, publicly-exposed `Ref<string>` on the store — leaving a
+  plaintext password in reactive state after auth succeeds was an unnecessary window,
+  particularly for an SSR consumer where Pinia state can end up in the hydration
+  payload.
+- `authFlow.register()`'s 0-channel edge case (`confirmation_required: false`) no longer
+  reports success while writing an empty string as the auth token.
+  `AuthConfirmationStatus` (register's response) never carries a token — `authStore`
+  treats an empty token as unauthenticated — so a caller that closed the auth UI on
+  `register()` returning `true` left the user believing they were signed in when they
+  weren't. This path now performs a real `login()` with the same password instead.
 
 ## 0.10.7 - 2026-08-02
 

package/README.md

@@ -181,7 +181,7 @@ import { buildProductSchema, buildOgTags } from '@zenky/storefront-vue/seo'
 import { usePaginatedList } from '@zenky/storefront-vue/pagination'
 ```
 
-Available subpaths: `ports`, `money`, `utils`, `theme`, `stores`, `products`, `catalog`, `cart`, `order`, `promotions`, `seo`, `pagination`, `snippets`, `website-settings`.
+Available subpaths: `ports`, `money`, `utils`, `theme`, `stores`, `products`, `catalog`, `cart`, `order`, `promotions`, `seo`, `pagination`, `snippets`, `website-settings`, `auth`.
 
 Routing, tenant theme presets, localized copy, header/footer composition, and conversion to
 framework-specific head records belong to the consumer. Core SEO builders return plain

package/dist/auth/index.d.ts

@@ -0,0 +1,14 @@
+import { S as SelectableConfirmationChannel } from '../types-CXm2F6Hz.js';
+export { A as AUTH_STEP, a as AuthStep, C as CHANNEL_INTENT, b as CODE_CONTEXT, c as CONFIRMATION_CHANNEL, d as CONFIRMATION_CHANNEL_ORDER, e as ChannelIntent, f as CodeContext, g as ConfirmationChannel, t as toConfirmationChannel, h as toRequestedMethod } from '../types-CXm2F6Hz.js';
+import { ComputedRef } from 'vue';
+import '@zenky/storefront-api';
+
+/**
+ * Доступные каналы подтверждения для текущего магазина, в порядке показа
+ * (Telegram, WhatsApp, SMS). Источник — `store.settings.authentication`.
+ * Логика "≥2 → показать выбор, 1 → использовать сразу, 0 → method не передаём" —
+ * в вызывающем коде, эта функция отдаёт только список.
+ */
+declare function useAvailableConfirmationChannels(): ComputedRef<SelectableConfirmationChannel[]>;
+
+export { SelectableConfirmationChannel, useAvailableConfirmationChannels };

package/dist/auth/index.js

@@ -0,0 +1,4 @@
+export { AUTH_STEP, CHANNEL_INTENT, CODE_CONTEXT, CONFIRMATION_CHANNEL, CONFIRMATION_CHANNEL_ORDER, toConfirmationChannel, toRequestedMethod, useAvailableConfirmationChannels } from '../chunk-AK4276ND.js';
+import '../chunk-IOYYCA75.js';
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js"}

package/dist/cart/index.d.ts

@@ -1,6 +1,7 @@
-import { ProductModifiersRequest, OrderProductVariant, PaymentMethod, OrderPaymentMethodRequest, OrderAuthenticationMethod, OrderCredentials, Order, OrderCheckoutTotal, OrderSettings, OrderPaymentMethod, OrderDeliveryMethod, InclusionRequest, ZenkyStorefront, SetOrderCustomerRequest, SetOrderDeliveryRequest, OrderPromocode, RecommendationsBlock, OrderCheckoutResult, RecaptchaAction, EvaluatedRestriction, Media, Product } from '@zenky/storefront-api';
+import { ProductModifiersRequest, OrderProductVariant, PaymentMethod, OrderPaymentMethodRequest, OrderAuthenticationMethod, OrderCredentials, Order, OrderCheckoutTotal, OrderSettings, OrderPaymentMethod, OrderDeliveryMethod, InclusionRequest, ZenkyStorefront, SetOrderCustomerRequest, SetOrderDeliveryRequest, OrderPromocode, RecommendationsBlock, EvaluatedRestriction, Media, Product } from '@zenky/storefront-api';
 import { ComputedRef, MaybeRefOrGetter, Ref } from 'vue';
 import { ActivityReporter, Notifier, Result } from '../ports/index.js';
+export { C as CheckoutSubmitComposable, R as RecaptchaPayloadProvider, u as useCheckoutSubmit } from '../useCheckoutSubmit-Be-lQd60.js';
 import '@zenky/integrations-sdk';
 
 /** WebSocket events for the order channel */
@@ -513,32 +514,6 @@ interface CartOperations {
 }
 declare function useCartOperations(credentials: CartCredentials, initialization: CartInitialization, sdk: ZenkyStorefront, deps: CartDependencies): CartOperations;
 
-/** reCAPTCHA payload provider (implemented by the consumer app — Google reCAPTCHA v3). */
-type RecaptchaPayloadProvider = (action: RecaptchaAction) => Promise<{
-    token: string;
-} | undefined>;
-interface CheckoutSubmitComposable {
-    /** Last `checkoutOrder` result — needed by the UI (ConfirmationModal / online redirect) */
-    result: Ref<OrderCheckoutResult | null>;
-    submitting: Ref<boolean>;
-    /**
-     * Collects `OrderCheckoutRequest` from `cartStore` (notes + persons_count).
-     * Returns `OrderCheckoutResult` with confirmation/online_payment flags.
-     */
-    submit: () => Promise<OrderCheckoutResult | null>;
-    /** Confirm the SMS code (after checkoutOrder returned confirmation.required) */
-    confirm: (code: string) => Promise<boolean>;
-    /** Resend the code (with backoff — the UI is responsible for that) */
-    resendCode: () => Promise<boolean>;
-    cancel: () => Promise<boolean>;
-}
-/**
- * Final order submit + SMS confirmation.
- *
- * @param getRecaptchaPayload reCAPTCHA token provider (app-specific, injected).
- */
-declare function useCheckoutSubmit(getRecaptchaPayload: RecaptchaPayloadProvider): CheckoutSubmitComposable;
-
 declare function useOrderChannel(): void;
 
 interface StorefrontCart {
@@ -592,4 +567,4 @@ declare function useRestrictedAddToCart(): RestrictedAddToCart;
  */
 declare function useVisibleCartVariants(): ComputedRef<OrderProductVariant[]>;
 
-export { type AttachedCustomerCache, type BonusesReconciliation, type BonusesReconciliationDeps, CASH_DENOMINATIONS_MAJOR, type CachedCustomerView, type CartCredentials, type CartDependencies, type CartErrorScope, type CartInitialization, type CartItemRequest, type CartLineKeyParams, type CartMutationComposable, type CartOperations, type CartQuantities, type CartRecalculation, type CartRecalculationDeps, type CartStockWatcher, type CashChangePresetsOptions, type CheckoutFlowFlags, type CheckoutSubmitComposable, type CustomerAttachComposable, DEFAULT_ROUND_STEPS_MAJOR, type MainPaymentRequestParams, type MutationKind, type MutationOptions, ORDER_EVENTS, ORDER_WITH, type OrderBonusesComposable, type OrderBonusesDeps, type OrderCredentialsLike, type OrderDelivery, type OrderDeliveryDeps, type OrderPromocodeComposable, type OrderPromocodeDeps, type OrderSettingsComposable, type OrderTotal, type PaymentSelection, type PaymentSelectionComposable, type RecaptchaPayloadProvider, type RestrictedAddToCart, type RestrictionGate, type RestrictionGateProduct, type RetryOptions, type StorefrontCart, buildCartLineKey, buildCashChangePresets, buildMainPaymentRequest, getCartErrorCode, getCartErrorHttpCode, getCartErrorMessage, getCashDenominationsMinor, getDefaultRoundStepsMinor, getValidationErrors, logCartError, normalizeAddress, useBonusesReconciliation, useCartAddressSync, useCartCredentials, useCartCustomerAttachment, useCartDeliveryAttachment, useCartInitialization, useCartMutation, useCartOperations, useCartQuantities, useCartRecalculation, useCartStockWatcher, useCheckoutFlow, useCheckoutSubmit, useCustomerAttach, useOnlinePaymentRetry, useOrderBonuses, useOrderChannel, useOrderDelivery, useOrderPromocode, useOrderSettings, useOrderTotal, usePaymentSelection, useRestrictedAddToCart, useRestrictionGate, useStorefrontCart, useVisibleCartVariants, variantLineKey };
+export { type AttachedCustomerCache, type BonusesReconciliation, type BonusesReconciliationDeps, CASH_DENOMINATIONS_MAJOR, type CachedCustomerView, type CartCredentials, type CartDependencies, type CartErrorScope, type CartInitialization, type CartItemRequest, type CartLineKeyParams, type CartMutationComposable, type CartOperations, type CartQuantities, type CartRecalculation, type CartRecalculationDeps, type CartStockWatcher, type CashChangePresetsOptions, type CheckoutFlowFlags, type CustomerAttachComposable, DEFAULT_ROUND_STEPS_MAJOR, type MainPaymentRequestParams, type MutationKind, type MutationOptions, ORDER_EVENTS, ORDER_WITH, type OrderBonusesComposable, type OrderBonusesDeps, type OrderCredentialsLike, type OrderDelivery, type OrderDeliveryDeps, type OrderPromocodeComposable, type OrderPromocodeDeps, type OrderSettingsComposable, type OrderTotal, type PaymentSelection, type PaymentSelectionComposable, type RestrictedAddToCart, type RestrictionGate, type RestrictionGateProduct, type RetryOptions, type StorefrontCart, buildCartLineKey, buildCashChangePresets, buildMainPaymentRequest, getCartErrorCode, getCartErrorHttpCode, getCartErrorMessage, getCashDenominationsMinor, getDefaultRoundStepsMinor, getValidationErrors, logCartError, normalizeAddress, useBonusesReconciliation, useCartAddressSync, useCartCredentials, useCartCustomerAttachment, useCartDeliveryAttachment, useCartInitialization, useCartMutation, useCartOperations, useCartQuantities, useCartRecalculation, useCartStockWatcher, useCheckoutFlow, useCustomerAttach, useOnlinePaymentRetry, useOrderBonuses, useOrderChannel, useOrderDelivery, useOrderPromocode, useOrderSettings, useOrderTotal, usePaymentSelection, useRestrictedAddToCart, useRestrictionGate, useStorefrontCart, useVisibleCartVariants, variantLineKey };

package/dist/cart/index.js

@@ -1,10 +1,12 @@
-export { CASH_DENOMINATIONS_MAJOR, DEFAULT_ROUND_STEPS_MAJOR, ORDER_EVENTS, ORDER_WITH, buildCartLineKey, buildCashChangePresets, buildMainPaymentRequest, getCartErrorCode, getCartErrorHttpCode, getCartErrorMessage, getCashDenominationsMinor, getDefaultRoundStepsMinor, getValidationErrors, logCartError, normalizeAddress, useBonusesReconciliation, useCartAddressSync, useCartCustomerAttachment, useCartDeliveryAttachment, useCartInitialization, useCartMutation, useCartOperations, useCartQuantities, useCartRecalculation, useCartStockWatcher, useCheckoutFlow, useCheckoutSubmit, useCustomerAttach, useOnlinePaymentRetry, useOrderBonuses, useOrderChannel, useOrderDelivery, useOrderPromocode, useOrderSettings, useOrderTotal, usePaymentSelection, useRestrictedAddToCart, useRestrictionGate, useStorefrontCart, useVisibleCartVariants, variantLineKey } from '../chunk-AVES4WJZ.js';
-export { useCartCredentials } from '../chunk-46FNHMWC.js';
-import '../chunk-XULHV6SS.js';
-import '../chunk-KFCO46RB.js';
-import '../chunk-2Y6QTHXI.js';
+export { CASH_DENOMINATIONS_MAJOR, DEFAULT_ROUND_STEPS_MAJOR, ORDER_EVENTS, ORDER_WITH, buildCartLineKey, buildCashChangePresets, buildMainPaymentRequest, getCashDenominationsMinor, getDefaultRoundStepsMinor, normalizeAddress, useBonusesReconciliation, useCartAddressSync, useCartCustomerAttachment, useCartDeliveryAttachment, useCartInitialization, useCartMutation, useCartOperations, useCartQuantities, useCartRecalculation, useCartStockWatcher, useCheckoutFlow, useCheckoutSubmit, useCustomerAttach, useOnlinePaymentRetry, useOrderBonuses, useOrderChannel, useOrderDelivery, useOrderPromocode, useOrderSettings, useOrderTotal, usePaymentSelection, useRestrictedAddToCart, useRestrictionGate, useStorefrontCart, useVisibleCartVariants, variantLineKey } from '../chunk-5CNL24PI.js';
+export { useCartCredentials } from '../chunk-W43D7JYV.js';
 import '../chunk-5QCUH3FF.js';
-import '../chunk-6QCFHSLX.js';
-import '../chunk-QZ3S3NN3.js';
+export { getCartErrorCode, getCartErrorHttpCode, getCartErrorMessage, getValidationErrors, logCartError } from '../chunk-TE42OCFK.js';
+import '../chunk-TE2QPH74.js';
+import '../chunk-NSOIL7PW.js';
+import '../chunk-WTZXTBF6.js';
+import '../chunk-IOYYCA75.js';
+import '../chunk-FS2UNPTY.js';
+import '../chunk-2Y6QTHXI.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/catalog/index.d.ts

@@ -1,4 +1,6 @@
-import { NestedCategory, Product, Store, City, Stock, RemoteCatalog, ZenkyStorefront, CollectionsListRequest, ProductsCollection } from '@zenky/storefront-api';
+import { NestedCategory, Product, Store, City, Stock, ZenkyStorefront, CollectionsListRequest, ProductsCollection } from '@zenky/storefront-api';
+import { a as StaticRemoteCatalog } from '../catalogEntity-DgrPsJpf.js';
+export { C as CatalogEntity, S as StaticCatalogItem, c as catalogItemEntity, i as isRenderableCatalogItem } from '../catalogEntity-DgrPsJpf.js';
 
 /**
  * Recursively searches the category tree by `short_id`.
@@ -44,7 +46,7 @@ declare function groupProductsBySubcategory(rootCategory: NestedCategory, produc
 
 declare function getCity(store: Store, cityId?: string | null): City | null;
 declare function getStock(city: City, stockId?: string | null): Stock | null;
-declare function getRemoteCatalog(store: Store, city: City, stock: Stock | null): RemoteCatalog | null;
+declare function getRemoteCatalog(store: Store, city: City, stock: Stock | null): StaticRemoteCatalog | null;
 
 /**
  * Pure composable — the SDK is passed in as a parameter (DI), no Nuxt needed.
@@ -57,4 +59,4 @@ declare function useCollections(sdk: ZenkyStorefront): {
     loadCollections: (storeId: string, request?: CollectionsListRequest) => Promise<ProductsCollection[]>;
 };
 
-export { type GroupedProducts, type SubcategoryGroup, collectDescendantIds, findCategoryById, findCategoryByShortId, findRootAncestor, getCategoryPath, getCity, getRemoteCatalog, getStock, groupProductsBySubcategory, useCollections };
+export { type GroupedProducts, StaticRemoteCatalog, type SubcategoryGroup, collectDescendantIds, findCategoryById, findCategoryByShortId, findRootAncestor, getCategoryPath, getCity, getRemoteCatalog, getStock, groupProductsBySubcategory, useCollections };

package/dist/catalog/index.js

@@ -1,4 +1,4 @@
-export { collectDescendantIds, findCategoryById, findCategoryByShortId, findRootAncestor, getCategoryPath, groupProductsBySubcategory, useCollections } from '../chunk-RK5CGOM7.js';
-export { getCity, getRemoteCatalog, getStock } from '../chunk-KFCO46RB.js';
+export { catalogItemEntity, collectDescendantIds, findCategoryById, findCategoryByShortId, findRootAncestor, getCategoryPath, groupProductsBySubcategory, isRenderableCatalogItem, useCollections } from '../chunk-OBNMXLJO.js';
+export { getCity, getRemoteCatalog, getStock } from '../chunk-FS2UNPTY.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/catalogEntity-DgrPsJpf.d.ts

@@ -0,0 +1,44 @@
+import { Category, ProductsCollection, CatalogItem, RemoteCatalog } from '@zenky/storefront-api';
+
+/**
+ * Static catalog item. `@zenky/storefront-api@1.0.2` predates manual catalogs: it
+ * spells the collection `collection` and types `type` as `'category' | 'collection'`,
+ * while the payload uses `products_collection`. Both spellings are declared here, and
+ * the fields are re-declared rather than inherited so a later SDK release that adds
+ * them cannot conflict with this narrowing.
+ */
+interface StaticCatalogItem extends Omit<CatalogItem, 'type' | 'collection' | 'products_collection'> {
+    type: 'category' | 'collection' | 'products_collection';
+    collection?: ProductsCollection | null;
+    products_collection?: ProductsCollection | null;
+}
+/**
+ * Store profile catalog entry. `catalog_id` is filled for manual catalogs only, and
+ * is optional because the SDK type omits it — test it with `!= null`, since `undefined`
+ * means "SDK-typed value", not "automatic catalog".
+ */
+interface StaticRemoteCatalog extends Omit<RemoteCatalog, 'catalog_id'> {
+    catalog_id?: string | null;
+}
+/** What a catalog section represents; `id` and `name` are lifted so callers needn't branch. */
+type CatalogEntity = {
+    kind: 'category';
+    id: string;
+    name: string;
+    category: Category;
+} | {
+    kind: 'collection';
+    id: string;
+    name: string;
+    collection: ProductsCollection;
+};
+/**
+ * Resolve what a catalog section is about, or null for a malformed item. Keyed off
+ * which entity object is present, not off `type`: the payload and the SDK type
+ * disagree on the discriminator's value, but presence holds under both.
+ */
+declare function catalogItemEntity(item: StaticCatalogItem): CatalogEntity | null;
+/** Sections worth rendering: a known entity and at least one product. */
+declare function isRenderableCatalogItem(item: StaticCatalogItem): boolean;
+
+export { type CatalogEntity as C, type StaticCatalogItem as S, type StaticRemoteCatalog as a, catalogItemEntity as c, isRenderableCatalogItem as i };

package/dist/{chunk-AVES4WJZ.js → chunk-5CNL24PI.js}

@@ -1,10 +1,12 @@
-import { useCartCredentials, usePromotionsChecker } from './chunk-46FNHMWC.js';
-import { useCartStore, useOrderSettingsStore, usePromotionsStore } from './chunk-XULHV6SS.js';
-import { getRemoteCatalog } from './chunk-KFCO46RB.js';
-import { minorToMajor, majorToMinor } from './chunk-2Y6QTHXI.js';
+import { useCartCredentials, usePromotionsChecker } from './chunk-W43D7JYV.js';
 import { createRuntimeState } from './chunk-5QCUH3FF.js';
-import { useCatalogStore } from './chunk-6QCFHSLX.js';
-import { useRuntime, useStoreProfileStore, useAuthStore } from './chunk-QZ3S3NN3.js';
+import { logCartError, getCartErrorCode, getCartErrorMessage } from './chunk-TE42OCFK.js';
+import { useCartStore, useOrderSettingsStore, usePromotionsStore } from './chunk-TE2QPH74.js';
+import { useCatalogStore } from './chunk-NSOIL7PW.js';
+import { useRuntime, useAuthStore } from './chunk-WTZXTBF6.js';
+import { useStoreProfileStore } from './chunk-IOYYCA75.js';
+import { getRemoteCatalog } from './chunk-FS2UNPTY.js';
+import { minorToMajor, majorToMinor } from './chunk-2Y6QTHXI.js';
 import { PaymentMethod, OrderAuthenticationMethod, DeliveryMethod, OrderCartCheckerResultAction, RecaptchaAction } from '@zenky/storefront-api';
 import { ref, computed, watch, watchEffect, getCurrentScope, onScopeDispose, toValue } from 'vue';
 import { storeToRefs } from 'pinia';
@@ -92,105 +94,6 @@ function buildCashChangePresets({
   return [...candidates].sort((a, b) => a - b);
 }
 
-// src/cart/logCartError.ts
-var REDACTED = "[REDACTED]";
-var MAX_LOG_DEPTH = 6;
-var MAX_ARRAY_ITEMS = 25;
-var MAX_OBJECT_KEYS = 50;
-var SENSITIVE_KEY_PARTS = [
-  "address",
-  "authorization",
-  "checkouturl",
-  "cookie",
-  "credential",
-  "email",
-  "password",
-  "paymentlink",
-  "paymentpageurl",
-  "phone",
-  "recaptcha",
-  "redirecturl",
-  "secret",
-  "token"
-];
-var SENSITIVE_EXACT_KEYS = /* @__PURE__ */ new Set(["cvc", "cvv", "otp", "pan", "pin"]);
-var SENSITIVE_ASSIGNMENT = /((?:address|authorization|cookie|email|password|phone|recaptcha|secret|(?:checkout|redirect)[_-]?url|payment(?:[_-]?page)?[_-]?(?:link|url)|(?:api|access|auth|card|order|refresh)[_-]?token|token)\s*[=:]\s*["']?)([^\s,"';&}\]]+)/gi;
-var SENSITIVE_QUERY_PARAM = /([?&#](?:address|authorization|email|password|phone|recaptcha|secret|(?:checkout|redirect)[_-]?url|payment(?:[_-]?page)?[_-]?(?:link|url)|(?:api|access|auth|card|order|refresh)[_-]?token|token)=)([^&#\s]+)/gi;
-var BEARER_TOKEN = /(bearer\s+)[a-z0-9._~+/=-]+/gi;
-function isSensitiveKey(key) {
-  const normalized = key.replace(/[^a-z0-9]/gi, "").toLowerCase();
-  return SENSITIVE_EXACT_KEYS.has(normalized) || normalized.includes("confirmationcode") || normalized.includes("verificationcode") || SENSITIVE_KEY_PARTS.some((part) => normalized.includes(part));
-}
-function sanitizeString(value) {
-  return value.replace(BEARER_TOKEN, `$1${REDACTED}`).replace(SENSITIVE_QUERY_PARAM, `$1${REDACTED}`).replace(SENSITIVE_ASSIGNMENT, `$1${REDACTED}`);
-}
-function sanitizeLogValue(value, depth = 0, seen = /* @__PURE__ */ new WeakSet()) {
-  if (typeof value === "string") return sanitizeString(value);
-  if (value === null || typeof value !== "object") return value;
-  if (depth >= MAX_LOG_DEPTH) return "[TRUNCATED]";
-  if (seen.has(value)) return "[CIRCULAR]";
-  seen.add(value);
-  if (Array.isArray(value)) {
-    const sanitized = value.slice(0, MAX_ARRAY_ITEMS).map((item) => sanitizeLogValue(item, depth + 1, seen));
-    if (value.length > MAX_ARRAY_ITEMS) sanitized.push("[TRUNCATED]");
-    return sanitized;
-  }
-  const result = {};
-  if (value instanceof Error) {
-    result.name = sanitizeString(value.name);
-    result.message = sanitizeString(value.message);
-  }
-  let allEntries;
-  try {
-    allEntries = Object.entries(value);
-  } catch {
-    return "[UNSERIALIZABLE]";
-  }
-  const entries = allEntries.slice(0, MAX_OBJECT_KEYS);
-  for (const [key, nestedValue] of entries) {
-    if (key === "name" || key === "message") continue;
-    result[key] = isSensitiveKey(key) ? REDACTED : sanitizeLogValue(nestedValue, depth + 1, seen);
-  }
-  if (allEntries.length > MAX_OBJECT_KEYS) result.__truncated__ = true;
-  return result;
-}
-function logCartError({ scope, context }, e) {
-  const err = e?.err;
-  const safeContext = sanitizeLogValue(context);
-  console.error(`[${scope}] failed`, {
-    ...safeContext ?? {},
-    httpCode: err?.http_code,
-    errorCode: err?.error_code,
-    message: sanitizeLogValue(err?.message),
-    meta: sanitizeLogValue(err?.meta),
-    error: sanitizeLogValue(e)
-  });
-}
-function getCartErrorCode(e) {
-  return e?.err?.error_code;
-}
-function getCartErrorHttpCode(e) {
-  return e?.err?.http_code;
-}
-function getValidationErrors(e) {
-  const err = e?.err;
-  if (err?.error_code !== "validation") return {};
-  const meta = err.meta;
-  return meta?.errors ?? {};
-}
-function getCartErrorMessage(e, fallback) {
-  const err = e?.err;
-  if (!err) return fallback;
-  if (err.error_code === "validation") {
-    const errors = err.meta?.errors;
-    if (errors) {
-      const messages = Object.values(errors).flat().filter(Boolean);
-      if (messages.length > 0) return messages.join(" ");
-    }
-  }
-  return err.message ?? fallback;
-}
-
 // src/cart/useCartMutation.ts
 var getMutationState = createRuntimeState(() => ({
   versions: /* @__PURE__ */ new Map()
@@ -2010,6 +1913,6 @@ function useVisibleCartVariants() {
   );
 }
 
-export { CASH_DENOMINATIONS_MAJOR, DEFAULT_ROUND_STEPS_MAJOR, ORDER_EVENTS, ORDER_WITH, buildCartLineKey, buildCashChangePresets, buildMainPaymentRequest, getCartErrorCode, getCartErrorHttpCode, getCartErrorMessage, getCashDenominationsMinor, getDefaultRoundStepsMinor, getValidationErrors, logCartError, normalizeAddress, useBonusesReconciliation, useCartAddressSync, useCartCustomerAttachment, useCartDeliveryAttachment, useCartInitialization, useCartMutation, useCartOperations, useCartQuantities, useCartRecalculation, useCartStockWatcher, useCheckoutFlow, useCheckoutSubmit, useCustomerAttach, useOnlinePaymentRetry, useOrderBonuses, useOrderChannel, useOrderDelivery, useOrderPromocode, useOrderSettings, useOrderTotal, usePaymentSelection, useRestrictedAddToCart, useRestrictionGate, useStorefrontCart, useVisibleCartVariants, variantLineKey };
-//# sourceMappingURL=chunk-AVES4WJZ.js.map
-//# sourceMappingURL=chunk-AVES4WJZ.js.map
+export { CASH_DENOMINATIONS_MAJOR, DEFAULT_ROUND_STEPS_MAJOR, ORDER_EVENTS, ORDER_WITH, buildCartLineKey, buildCashChangePresets, buildMainPaymentRequest, getCashDenominationsMinor, getDefaultRoundStepsMinor, normalizeAddress, useBonusesReconciliation, useCartAddressSync, useCartCustomerAttachment, useCartDeliveryAttachment, useCartInitialization, useCartMutation, useCartOperations, useCartQuantities, useCartRecalculation, useCartStockWatcher, useCheckoutFlow, useCheckoutSubmit, useCustomerAttach, useOnlinePaymentRetry, useOrderBonuses, useOrderChannel, useOrderDelivery, useOrderPromocode, useOrderSettings, useOrderTotal, usePaymentSelection, useRestrictedAddToCart, useRestrictionGate, useStorefrontCart, useVisibleCartVariants, variantLineKey };
+//# sourceMappingURL=chunk-5CNL24PI.js.map
+//# sourceMappingURL=chunk-5CNL24PI.js.map