fontdue-js 3.0.0-alpha8 → 3.0.0

package/dist/__tests__/preview.test.js

@@ -0,0 +1,217 @@
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { handlePreviewRequest, readPreviewToken, previewAuthHeaders, PREVIEW_TOKEN_COOKIE, PREVIEW_MARKER_COOKIE } from '../preview/index.js';
+import { setPreviewMarkerCookie, hasPreviewMarkerCookie, getPreviewExpiry } from '../preview/constants.js';
+function postPreview(token) {
+  let url = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : 'https://site.test/api/preview';
+  return handlePreviewRequest(new Request(url, {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json'
+    },
+    body: JSON.stringify({
+      token
+    })
+  }));
+}
+describe('handlePreviewRequest', () => {
+  it('enters preview: sets an httpOnly token cookie + a readable marker', async () => {
+    const before = Date.now();
+    const res = await postPreview('admin.tok.123');
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.ok).toBe(true);
+    expect(body.preview).toBe(true);
+    // No expiresAt in the body → defaults to now + the 1h TTL.
+    expect(body.expiresAt).toBeGreaterThanOrEqual(before + 60 * 60 * 1000 - 5_000);
+    const cookies = res.headers.getSetCookie();
+    const tokenCookie = cookies.find(c => c.startsWith(`${PREVIEW_TOKEN_COOKIE}=`));
+    const markerCookie = cookies.find(c => c.startsWith(`${PREVIEW_MARKER_COOKIE}=`));
+    expect(tokenCookie).toContain(`${PREVIEW_TOKEN_COOKIE}=admin.tok.123`);
+    expect(tokenCookie).toContain('HttpOnly');
+    expect(tokenCookie).toContain('SameSite=Lax');
+    expect(tokenCookie).toContain('Path=/');
+
+    // The marker now carries the token's expiry (epoch-ms), and outlives the
+    // token via a grace window so the toolbar can reach the "expired" warning.
+    expect(markerCookie).toContain(`${PREVIEW_MARKER_COOKIE}=${body.expiresAt}`);
+    expect(markerCookie).toMatch(/Max-Age=\d+/);
+    // The marker must be readable by the client toolbar.
+    expect(markerCookie).not.toContain('HttpOnly');
+  });
+  it('threads an explicit expiresAt (ISO + epoch-ms) into the marker + body', async () => {
+    const iso = '2030-01-01T00:00:00.000Z';
+    const epoch = Date.parse(iso);
+    const fromIso = await handlePreviewRequest(new Request('https://site.test/api/preview', {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json'
+      },
+      body: JSON.stringify({
+        token: 't',
+        expiresAt: iso
+      })
+    }));
+    expect((await fromIso.json()).expiresAt).toBe(epoch);
+    const fromEpoch = await handlePreviewRequest(new Request('https://site.test/api/preview', {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json'
+      },
+      body: JSON.stringify({
+        token: 't',
+        expiresAt: epoch
+      })
+    }));
+    expect((await fromEpoch.json()).expiresAt).toBe(epoch);
+    const marker = fromEpoch.headers.getSetCookie().find(c => c.startsWith(`${PREVIEW_MARKER_COOKIE}=`));
+    expect(marker).toContain(`${PREVIEW_MARKER_COOKIE}=${epoch}`);
+  });
+  it('marks cookies Secure on https and not on http (local dev)', async () => {
+    const httpsCookies = (await postPreview('t')).headers.getSetCookie();
+    expect(httpsCookies.every(c => c.includes('Secure'))).toBe(true);
+    const httpCookies = (await postPreview('t', 'http://localhost:4321/api/preview')).headers.getSetCookie();
+    expect(httpCookies.some(c => c.includes('Secure'))).toBe(false);
+  });
+  it('rejects a POST with no token', async () => {
+    const res = await postPreview('');
+    expect(res.status).toBe(400);
+    expect(res.headers.getSetCookie()).toHaveLength(0);
+  });
+  it('exits preview: clears both cookies', async () => {
+    const res = await handlePreviewRequest(new Request('https://site.test/api/preview', {
+      method: 'DELETE'
+    }));
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({
+      ok: true,
+      preview: false
+    });
+    const cookies = res.headers.getSetCookie();
+    expect(cookies).toHaveLength(2);
+    // Expiry via Max-Age=0 clears the cookie.
+    expect(cookies.every(c => c.includes('Max-Age=0'))).toBe(true);
+  });
+  it('rejects unsupported methods', async () => {
+    const res = await handlePreviewRequest(new Request('https://site.test/api/preview', {
+      method: 'GET'
+    }));
+    expect(res.status).toBe(405);
+  });
+  it('round-trips a token with cookie-unsafe characters', async () => {
+    const token = 'tok+en/with=specials';
+    const res = await postPreview(token);
+    const setCookie = res.headers.getSetCookie().find(c => c.startsWith(`${PREVIEW_TOKEN_COOKIE}=`));
+    // Reconstruct the Cookie header the browser would send back (name=value).
+    const cookieHeader = setCookie.split(';')[0];
+    expect(readPreviewToken(cookieHeader)).toBe(token);
+  });
+});
+describe('readPreviewToken', () => {
+  it('extracts the token from a multi-cookie header', () => {
+    expect(readPreviewToken(`a=1; ${PREVIEW_TOKEN_COOKIE}=abc; ${PREVIEW_MARKER_COOKIE}=1`)).toBe('abc');
+  });
+  it('returns undefined when there is no token cookie', () => {
+    expect(readPreviewToken('a=1; b=2')).toBeUndefined();
+    expect(readPreviewToken('')).toBeUndefined();
+    expect(readPreviewToken(null)).toBeUndefined();
+    expect(readPreviewToken(undefined)).toBeUndefined();
+  });
+});
+describe('setPreviewMarkerCookie (client-only embeds)', () => {
+  afterEach(() => vi.unstubAllGlobals());
+
+  // Captures the last `document.cookie = ...` write through a setter, the way
+  // the browser would receive it.
+  function stubBrowser(protocol) {
+    const state = {
+      written: ''
+    };
+    vi.stubGlobal('document', {
+      set cookie(value) {
+        state.written = value;
+      },
+      get cookie() {
+        return state.written;
+      }
+    });
+    vi.stubGlobal('location', {
+      protocol
+    });
+    return state;
+  }
+  it('is a no-op during server rendering (no document)', () => {
+    // The node test env has no `document`, so this must stay inert, not throw.
+    expect(() => setPreviewMarkerCookie(true)).not.toThrow();
+  });
+  it('sets a JS-readable marker carrying the expiry, Secure on https', () => {
+    const state = stubBrowser('https:');
+    const expiresAt = Date.now() + 60 * 60 * 1000;
+    setPreviewMarkerCookie(expiresAt);
+    expect(state.written).toContain(`${PREVIEW_MARKER_COOKIE}=${expiresAt}`);
+    expect(state.written).toContain('Path=/');
+    expect(state.written).toContain('SameSite=Lax');
+    expect(state.written).toContain('Secure');
+    // A positive Max-Age (not a clear) that outlives the token.
+    expect(state.written).toMatch(/Max-Age=\d+/);
+    expect(state.written).not.toContain('Max-Age=0');
+  });
+  it('defaults to the 1h TTL when passed a bare true', () => {
+    const state = stubBrowser('https:');
+    const before = Date.now();
+    setPreviewMarkerCookie(true);
+    const match = state.written.match(new RegExp(`${PREVIEW_MARKER_COOKIE}=(\\d+)`));
+    expect(match).not.toBeNull();
+    expect(Number(match[1])).toBeGreaterThanOrEqual(before + 60 * 60 * 1000 - 5_000);
+  });
+  it('omits Secure on http so it persists in local dev', () => {
+    const state = stubBrowser('http:');
+    setPreviewMarkerCookie(Date.now() + 60 * 60 * 1000);
+    expect(state.written).not.toContain('Secure');
+  });
+  it('clears the marker with Max-Age=0 on exit', () => {
+    const state = stubBrowser('https:');
+    setPreviewMarkerCookie(false);
+    expect(state.written).toContain(`${PREVIEW_MARKER_COOKIE}=`);
+    expect(state.written).toContain('Max-Age=0');
+  });
+});
+describe('previewAuthHeaders', () => {
+  it('builds a Bearer header when a token is present', () => {
+    expect(previewAuthHeaders('abc')).toEqual({
+      authorization: 'Bearer abc'
+    });
+  });
+  it('returns an empty object when there is no token (safe to spread)', () => {
+    expect(previewAuthHeaders(undefined)).toEqual({});
+    expect(previewAuthHeaders(null)).toEqual({});
+    expect(previewAuthHeaders('')).toEqual({});
+  });
+});
+describe('marker cookie readers (hasPreviewMarkerCookie / getPreviewExpiry)', () => {
+  afterEach(() => vi.unstubAllGlobals());
+  function stubCookies(cookie) {
+    vi.stubGlobal('document', {
+      cookie
+    });
+  }
+  it('reads presence + expiry from an expiry-encoded marker', () => {
+    stubCookies(`a=1; ${PREVIEW_MARKER_COOKIE}=1781700000000; b=2`);
+    expect(hasPreviewMarkerCookie()).toBe(true);
+    expect(getPreviewExpiry()).toBe(1781700000000);
+  });
+  it('treats a legacy `=1` marker as present, expiry 1ms (always expired)', () => {
+    stubCookies(`${PREVIEW_MARKER_COOKIE}=1`);
+    expect(hasPreviewMarkerCookie()).toBe(true);
+    expect(getPreviewExpiry()).toBe(1);
+  });
+  it('reports absent when the marker cookie is missing', () => {
+    stubCookies('a=1; b=2');
+    expect(hasPreviewMarkerCookie()).toBe(false);
+    expect(getPreviewExpiry()).toBeUndefined();
+  });
+  it('returns undefined expiry for a non-numeric marker value', () => {
+    stubCookies(`${PREVIEW_MARKER_COOKIE}=bogus`);
+    expect(hasPreviewMarkerCookie()).toBe(true);
+    expect(getPreviewExpiry()).toBeUndefined();
+  });
+});

package/dist/__tests__/previewServer.test.js

@@ -0,0 +1,118 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import { runWithPreview, isPreviewing, ambientPreviewHeaders } from '../preview/server.js';
+import { createFontdueFetch } from '../server/index.js';
+import { PREVIEW_TOKEN_COOKIE } from '../preview/constants.js';
+beforeEach(() => {
+  vi.unstubAllGlobals();
+});
+function req(token) {
+  return new Request('https://store.test/', {
+    headers: token ? {
+      cookie: `${PREVIEW_TOKEN_COOKIE}=${token}`
+    } : {}
+  });
+}
+describe('runWithPreview', () => {
+  it('passes public (no-token) requests through untouched and cacheable', async () => {
+    const response = await runWithPreview(req(), async () => {
+      expect(isPreviewing()).toBe(false);
+      return new Response('ok', {
+        headers: {
+          'Netlify-CDN-Cache-Control': 'public, durable, s-maxage=300'
+        }
+      });
+    });
+    expect(response.headers.get('Cache-Control')).toBeNull();
+    expect(response.headers.get('Netlify-CDN-Cache-Control')).toBe('public, durable, s-maxage=300');
+  });
+  it('exposes the token in ambient context while previewing', async () => {
+    await runWithPreview(req('tok123'), async () => {
+      expect(isPreviewing()).toBe(true);
+      expect(ambientPreviewHeaders()).toEqual({
+        authorization: 'Bearer tok123'
+      });
+      return new Response('ok');
+    });
+
+    // Context unwinds after the request.
+    expect(isPreviewing()).toBe(false);
+    expect(ambientPreviewHeaders()).toEqual({});
+  });
+  it('forces preview responses out of any shared/CDN cache', async () => {
+    const response = await runWithPreview(req('tok123'), async () => new Response('secret', {
+      headers: {
+        'Netlify-CDN-Cache-Control': 'public, durable, s-maxage=31536000',
+        'CDN-Cache-Control': 'public, s-maxage=300',
+        'Cache-Control': 'public, max-age=0, must-revalidate'
+      }
+    }));
+    expect(response.headers.get('Cache-Control')).toBe('private, no-store');
+    expect(response.headers.get('Netlify-CDN-Cache-Control')).toBeNull();
+    expect(response.headers.get('CDN-Cache-Control')).toBeNull();
+  });
+  it('isolates concurrent preview contexts (no cross-request leak)', async () => {
+    const seen = {};
+    await Promise.all([runWithPreview(req('tokA'), async () => {
+      await new Promise(r => setTimeout(r, 15));
+      seen.a = ambientPreviewHeaders().authorization;
+      return new Response('a');
+    }), runWithPreview(req('tokB'), async () => {
+      seen.b = ambientPreviewHeaders().authorization;
+      return new Response('b');
+    }), runWithPreview(req(), async () => {
+      seen.public = ambientPreviewHeaders().authorization;
+      return new Response('public');
+    })]);
+    expect(seen.a).toBe('Bearer tokA');
+    expect(seen.b).toBe('Bearer tokB');
+    expect(seen.public).toBeUndefined();
+  });
+});
+describe('createFontdueFetch + ambient preview', () => {
+  function mockFetch() {
+    const fetchMock = vi.fn(async () => ({
+      status: 200,
+      json: async () => ({
+        data: {}
+      })
+    }));
+    vi.stubGlobal('fetch', fetchMock);
+    return fetchMock;
+  }
+  it('a module-level fetcher forwards the ambient token, no per-call plumbing', async () => {
+    const fetchMock = mockFetch();
+    const fetchGraphql = createFontdueFetch({
+      url: 'https://acme.fontdue.com'
+    });
+    await runWithPreview(req('admin-tok'), async () => {
+      await fetchGraphql('Q', 'query Q { __typename }');
+      return new Response('ok');
+    });
+    const init = fetchMock.mock.calls[0][1];
+    expect(init.headers.authorization).toBe('Bearer admin-tok');
+  });
+  it('does not forward a token for public requests', async () => {
+    const fetchMock = mockFetch();
+    const fetchGraphql = createFontdueFetch({
+      url: 'https://acme.fontdue.com'
+    });
+    await fetchGraphql('Q', 'query Q { __typename }');
+    const init = fetchMock.mock.calls[0][1];
+    expect(init.headers.authorization).toBeUndefined();
+  });
+  it('explicit per-fetcher headers override the ambient context', async () => {
+    const fetchMock = mockFetch();
+    const fetchGraphql = createFontdueFetch({
+      url: 'https://acme.fontdue.com',
+      headers: {
+        authorization: 'Bearer explicit'
+      }
+    });
+    await runWithPreview(req('ambient-tok'), async () => {
+      await fetchGraphql('Q', 'query Q { __typename }');
+      return new Response('ok');
+    });
+    const init = fetchMock.mock.calls[0][1];
+    expect(init.headers.authorization).toBe('Bearer explicit');
+  });
+});

package/dist/__tests__/previewState.test.js

@@ -0,0 +1,63 @@
+import { describe, it, expect } from 'vitest';
+import { derivePreviewState, expiresAtFromTokenResult, isSessionExpiredError } from '../components/FontdueAdminToolbar/previewState.js';
+
+// The three-state derivation is the heart of the expired-preview fix, so it's
+// tested in isolation (the full toolbar needs a browser + Relay environment +
+// admin session to render, which isn't available here).
+describe('derivePreviewState', () => {
+  const NOW = 1_000_000;
+  it('is "off" with no marker cookie', () => {
+    expect(derivePreviewState(false, undefined, NOW)).toBe('off');
+    expect(derivePreviewState(false, NOW + 1000, NOW)).toBe('off');
+  });
+  it('is "active" while the marker is present and the token is still valid', () => {
+    expect(derivePreviewState(true, NOW + 1, NOW)).toBe('active');
+  });
+  it('is "expired" once now has reached the stored expiry', () => {
+    expect(derivePreviewState(true, NOW, NOW)).toBe('expired');
+    expect(derivePreviewState(true, NOW - 1, NOW)).toBe('expired');
+  });
+  it('is "expired" for a marker with no/garbled expiry (stale legacy cookie)', () => {
+    expect(derivePreviewState(true, undefined, NOW)).toBe('expired');
+  });
+});
+describe('expiresAtFromTokenResult', () => {
+  it('accepts an epoch-ms number', () => {
+    expect(expiresAtFromTokenResult({
+      expiresAt: 123_456
+    })).toBe(123_456);
+  });
+  it('accepts an ISO-8601 string', () => {
+    const iso = '2030-01-01T00:00:00.000Z';
+    expect(expiresAtFromTokenResult({
+      expiresAt: iso
+    })).toBe(Date.parse(iso));
+  });
+  it('accepts a numeric string', () => {
+    expect(expiresAtFromTokenResult({
+      expiresAt: '987654321'
+    })).toBe(987654321);
+  });
+  it('falls back to now + 1h TTL when the field is absent (backend not yet shipped)', () => {
+    const before = Date.now();
+    expect(expiresAtFromTokenResult({
+      token: 'abc'
+    })).toBeGreaterThanOrEqual(before + 60 * 60 * 1000 - 5_000);
+    expect(expiresAtFromTokenResult(null)).toBeGreaterThanOrEqual(before + 60 * 60 * 1000 - 5_000);
+  });
+});
+describe('isSessionExpiredError', () => {
+  it('matches the resolver’s "Not authorized" message', () => {
+    expect(isSessionExpiredError([{
+      message: 'Not authorized: you must be signed in as an admin.'
+    }])).toBe(true);
+  });
+  it('is false for unrelated errors and empty/absent error lists', () => {
+    expect(isSessionExpiredError([{
+      message: 'Something else failed'
+    }])).toBe(false);
+    expect(isSessionExpiredError([])).toBe(false);
+    expect(isSessionExpiredError(null)).toBe(false);
+    expect(isSessionExpiredError(undefined)).toBe(false);
+  });
+});

package/dist/__tests__/serverConfig.test.js

@@ -0,0 +1,62 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+
+// The render-scoped slot and the ambient resolver are anchored on globalThis so
+// they survive this module being bundled into more than one Next.js server
+// chunk (the app/provider chunk vs. a per-embed chunk), which would otherwise
+// give each chunk its own copy of the module-level state. Re-importing the
+// module after vi.resetModules() faithfully simulates that second chunk: a
+// fresh module instance with its own scope but the same globalThis.
+const STORE_KEY = '__fontdueServerConfigStore__';
+function clearStore() {
+  delete globalThis[STORE_KEY];
+}
+beforeEach(() => {
+  vi.resetModules();
+  clearStore();
+});
+afterEach(clearStore);
+describe('serverConfig store (chunk-duplication safety, FD-712)', () => {
+  it('shares the ambient resolver across module instances', async () => {
+    var _await$a$resolveFontd, _await$a$resolveFontd2, _await$b$resolveFontd, _await$b$resolveFontd2;
+    // First "chunk": register a resolver (what fontdue-js/next does when
+    // <FontdueProvider> mounts in single-tenant mode).
+    const a = await import("../relay/serverConfig.js");
+    a.registerAmbientConfigResolver(async () => ({
+      url: 'https://acme.fontdue.com',
+      headers: {
+        authorization: 'Bearer admin-tok'
+      }
+    }));
+    expect((_await$a$resolveFontd = await a.resolveFontdueServerConfig()) === null || _await$a$resolveFontd === void 0 ? void 0 : (_await$a$resolveFontd2 = _await$a$resolveFontd.headers) === null || _await$a$resolveFontd2 === void 0 ? void 0 : _await$a$resolveFontd2.authorization).toBe('Bearer admin-tok');
+
+    // Second "chunk": a fresh module instance. Before the fix its module-level
+    // `ambientResolver` was undefined here, so an embed preloading from this
+    // chunk fetched without the preview token and a hidden-font reveal failed.
+    vi.resetModules();
+    const b = await import("../relay/serverConfig.js");
+    expect(b).not.toBe(a); // genuinely a re-evaluated module
+    expect((_await$b$resolveFontd = await b.resolveFontdueServerConfig()) === null || _await$b$resolveFontd === void 0 ? void 0 : (_await$b$resolveFontd2 = _await$b$resolveFontd.headers) === null || _await$b$resolveFontd2 === void 0 ? void 0 : _await$b$resolveFontd2.authorization).toBe('Bearer admin-tok');
+  });
+  it('reuses one shared store object across re-imports', async () => {
+    const a = await import("../relay/serverConfig.js");
+    // The store is created lazily on first use, not on import.
+    a.registerAmbientConfigResolver(() => undefined);
+    const first = globalThis[STORE_KEY];
+    expect(first).toBeDefined();
+    vi.resetModules();
+    const b = await import("../relay/serverConfig.js");
+    await b.resolveFontdueServerConfig();
+    const second = globalThis[STORE_KEY];
+
+    // Same store (slot factory + resolver), not a per-instance copy — so the
+    // React.cache-backed slot multi-tenant uses (setFontdueServerConfig via
+    // __prepareFontdueRender) is one shared cell every chunk reads/writes.
+    expect(second).toBe(first);
+  });
+  it('starts with no resolver (resolution unchanged until something registers)', async () => {
+    const {
+      resolveFontdueServerConfig
+    } = await import("../relay/serverConfig.js");
+    expect(await resolveFontdueServerConfig()).toBeUndefined();
+  });
+});

package/dist/components/BuyButton/index.d.ts

@@ -1,7 +1,7 @@
 import React from 'react';
 import { BuyButtonIDQuery } from '../../__generated__/BuyButtonIDQuery.graphql.js';
 import { BuyButtonSlugQuery } from '../../__generated__/BuyButtonSlugQuery.graphql.js';
-import { SerializablePreloadedQuery } from '../../relay/loadSerializableQuery.js';
+import { SerializablePreloadedQuery, type LoadQueryOptions } from '../../relay/loadSerializableQuery.js';
 import { Config } from '../ConfigContext.js';
 export interface BuyButton_props {
     collectionName?: string;
@@ -15,7 +15,7 @@ export type LoadBuyButtonQueryVariables = {
     collectionId?: never;
     collectionSlug: string;
 };
-export declare function loadBuyButtonQuery(variables: LoadBuyButtonQueryVariables): Promise<BuyButtonPreloadedQuery>;
+export declare function loadBuyButtonQuery(variables: LoadBuyButtonQueryVariables, options?: LoadQueryOptions): Promise<BuyButtonPreloadedQuery>;
 export declare function BuyButtonPreloadedIDQueryRenderer({ preloadedQuery, ...rest }: BuyButton_props & {
     preloadedQuery: SerializablePreloadedQuery<BuyButtonIDQuery>;
 }): React.JSX.Element;

package/dist/components/BuyButton/index.js

@@ -57,16 +57,16 @@ function BuyButtonComponent(_ref) {
 }
 const idQuery = (_BuyButtonIDQuery.hash && _BuyButtonIDQuery.hash !== "4fbf1dbf9e6c530a5d38c697b174d8b0" && console.error("The definition of 'BuyButtonIDQuery' appears to have changed. Run `relay-compiler` to update the generated files to receive the expected data."), _BuyButtonIDQuery);
 const slugQuery = (_BuyButtonSlugQuery.hash && _BuyButtonSlugQuery.hash !== "6e750adea09698f7cb61f435cd88fd26" && console.error("The definition of 'BuyButtonSlugQuery' appears to have changed. Run `relay-compiler` to update the generated files to receive the expected data."), _BuyButtonSlugQuery);
-export async function loadBuyButtonQuery(variables) {
+export async function loadBuyButtonQuery(variables, options) {
   if (variables.collectionId) {
     return loadSerializableQuery(BuyButtonIDQueryNode, {
       collectionId: variables.collectionId
-    });
+    }, options);
   }
   if (variables.collectionSlug) {
     return loadSerializableQuery(BuyButtonSlugQueryNode, {
       collectionSlug: variables.collectionSlug
-    });
+    }, options);
   }
   throw new Error('loadBuyButtonQuery expected either a collectionId or collectionSlug');
 }

package/dist/components/Cart/CartOrder.js

@@ -4,7 +4,7 @@ import _CartOrderRemoveDiscountMutation from "../../__generated__/CartOrderRemov
 import _CartOrderUpdateMutation from "../../__generated__/CartOrderUpdateMutation.graphql.js";
 import _CartOrder_UpdateErrors from "../../__generated__/CartOrder_UpdateErrors.graphql.js";
 import _CartOrderCompleteOrderMutation from "../../__generated__/CartOrderCompleteOrderMutation.graphql.js";
-import React, { Fragment, useRef, useState } from 'react';
+import React, { Fragment, useEffect, useRef, useState } from 'react';
 import { commitMutation, graphql, useFragment, useRelayEnvironment } from 'react-relay';
 import Checkout from './Checkout.js';
 import CheckoutSteps from './CheckoutSteps.js';
@@ -21,6 +21,7 @@ import { textVariablesAllHaveText } from './utils.js';
 import { useStripe } from '@stripe/react-stripe-js';
 import { useDispatch } from 'react-redux';
 import CartState from './CartState.js';
+import { sendOrderTracking } from './orderTracking.js';
 
 // note here we're only updating the order (by id).
 // careful not to update the current customer's reference
@@ -44,6 +45,13 @@ const CartOrder = _ref => {
   const environment = useRelayEnvironment();
   const stripe = useStripe();
   const dispatch = useDispatch();
+
+  // Capture analytics consent + attribution on the order for the purchase
+  // event the server emits on completion (from a Stripe webhook, where no
+  // browser context exists).
+  useEffect(() => {
+    if (open) sendOrderTracking(environment);
+  }, [open, environment]);
   const order = useFragment((_CartOrder_order.hash && _CartOrder_order.hash !== "25ef000c40000c4f76f973ac6ac7f593" && console.error("The definition of 'CartOrder_order' appears to have changed. Run `relay-compiler` to update the generated files to receive the expected data."), _CartOrder_order), orderKey);
   const viewer = useFragment((_CartOrder_viewer.hash && _CartOrder_viewer.hash !== "8cf5ab5a33a474483a6c231cc44b0df1" && console.error("The definition of 'CartOrder_viewer' appears to have changed. Run `relay-compiler` to update the generated files to receive the expected data."), _CartOrder_viewer), viewerKey);
 

package/dist/components/Cart/orderTracking.js

@@ -1,13 +1,6 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.sendOrderTracking = sendOrderTracking;
-var _orderTrackingUpdateOrderTrackingMutation2 = _interopRequireDefault(require("../../__generated__/orderTrackingUpdateOrderTrackingMutation.graphql"));
-var _reactRelay = require("react-relay");
-var _consent = require("../ConsentBanner/consent");
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+import _orderTrackingUpdateOrderTrackingMutation from "../../__generated__/orderTrackingUpdateOrderTrackingMutation.graphql.js";
+import { commitMutation, graphql } from 'react-relay';
+import { hasConsent, getClientAnonymousId } from '../ConsentBanner/consent.js';
 function readCookie(name) {
   const match = document.cookie.match(new RegExp('(?:^|;\\s*)' + name + '=([^;]*)'));
   return match ? decodeURIComponent(match[1]) : undefined;
@@ -21,14 +14,14 @@ function readCookie(name) {
  *
  * Fire-and-forget: tracking must never break checkout.
  */
-function sendOrderTracking(environment) {
+export function sendOrderTracking(environment) {
   try {
-    (0, _reactRelay.commitMutation)(environment, {
-      mutation: (_orderTrackingUpdateOrderTrackingMutation2.default.hash && _orderTrackingUpdateOrderTrackingMutation2.default.hash !== "d59a127a7f140424f507ae549731bac7" && console.error("The definition of 'orderTrackingUpdateOrderTrackingMutation' appears to have changed. Run `relay-compiler` to update the generated files to receive the expected data."), _orderTrackingUpdateOrderTrackingMutation2.default),
+    commitMutation(environment, {
+      mutation: (_orderTrackingUpdateOrderTrackingMutation.hash && _orderTrackingUpdateOrderTrackingMutation.hash !== "d59a127a7f140424f507ae549731bac7" && console.error("The definition of 'orderTrackingUpdateOrderTrackingMutation' appears to have changed. Run `relay-compiler` to update the generated files to receive the expected data."), _orderTrackingUpdateOrderTrackingMutation),
       variables: {
         input: {
-          analyticsConsent: (0, _consent.hasConsent)('analytics'),
-          anonymousId: (0, _consent.getClientAnonymousId)(),
+          analyticsConsent: hasConsent('analytics'),
+          anonymousId: getClientAnonymousId(),
           fbp: readCookie('_fbp'),
           fbc: readCookie('_fbc'),
           url: window.location.href

package/dist/components/CharacterViewer/index.d.ts

@@ -1,5 +1,5 @@
 import React from 'react';
-import { SerializablePreloadedQuery } from '../../relay/loadSerializableQuery.js';
+import { SerializablePreloadedQuery, type LoadQueryOptions } from '../../relay/loadSerializableQuery.js';
 import { CharacterViewerIDQuery } from '../../__generated__/CharacterViewerIDQuery.graphql.js';
 import { CharacterViewerSlugQuery } from '../../__generated__/CharacterViewerSlugQuery.graphql.js';
 import { Config } from '../ConfigContext.js';
@@ -13,7 +13,7 @@ export type LoadCharacterViewerQueryVariables = {
     collectionId?: never;
     collectionSlug: string;
 };
-export declare function loadCharacterViewerQuery(variables: LoadCharacterViewerQueryVariables): Promise<CharacterViewerPreloadedQuery>;
+export declare function loadCharacterViewerQuery(variables: LoadCharacterViewerQueryVariables, options?: LoadQueryOptions): Promise<CharacterViewerPreloadedQuery>;
 export declare function CharacterViewerPreloadedIDQueryRenderer({ preloadedQuery, ...rest }: CharacterViewer_props & {
     preloadedQuery: SerializablePreloadedQuery<CharacterViewerIDQuery>;
 }): React.JSX.Element | null;

package/dist/components/CharacterViewer/index.js

@@ -6,7 +6,7 @@ import _CharacterViewerIDQuery from "../../__generated__/CharacterViewerIDQuery.
 import _CharacterViewer_style from "../../__generated__/CharacterViewer_style.graphql.js";
 import _CharacterViewer_collection from "../../__generated__/CharacterViewer_collection.graphql.js";
 import _CharacterViewer_family from "../../__generated__/CharacterViewer_family.graphql.js";
-import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';
+import React, { useCallback, useContext, useEffect, useMemo, useRef, useState } from 'react';
 import { fetchQuery, graphql, useFragment, useLazyLoadQuery, usePreloadedQuery, useRefetchableFragment, useRelayEnvironment } from 'react-relay';
 import useResizeObserver from '../../hooks/useResizeObserver.js';
 import retryImport from '../../retryImport.js';
@@ -20,6 +20,8 @@ import StyleSelect from './StyleSelect.js';
 import Checkbox from '../Checkbox/index.js';
 import CharacterViewerStyleRefetchQueryNode from '../../__generated__/CharacterViewerStyleRefetchQuery.graphql.js';
 import { EnsureFontdueContext } from '../FontdueContextProvider/index.js';
+import ConfigContext from '../ConfigContext.js';
+import { unicodeNamesUrl } from '../../data/unicodeNamesUrl.js';
 function useSize() {
   const ref = useRef(null);
   const [size, setSize] = React.useState();
@@ -74,20 +76,27 @@ function GlyphMeta(_ref) {
     onChange: e => setFeaturesChecked(e.target.checked)
   }), glyph.features.join(', ')))));
 }
+
+// Glyph unicode names (~1.2 MB) are fetched lazily from the Fontdue CDN rather
+// than bundled — see data/unicodeNamesUrl.ts. Purely cosmetic (the “Unicode
+// name” label), so a failed fetch degrades silently. `retryImport` is reused
+// here as a generic retry wrapper for transient network blips.
 function useUnicodeData() {
+  const config = useContext(ConfigContext);
+  const url = unicodeNamesUrl(config.cdnUrl);
   const [data, setData] = useState();
   useEffect(() => {
-    function fetchData() {
-      retryImport(() => import('../../data/unicodeData.js')).then(data => {
-        if (!ignore) setData(data.default);
-      }).catch(() => {});
-    }
     let ignore = false;
-    fetchData();
+    retryImport(() => fetch(url).then(res => {
+      if (!res.ok) throw new Error(`unicode names request failed: ${res.status}`);
+      return res.json();
+    })).then(json => {
+      if (!ignore) setData(json);
+    }).catch(() => {});
     return () => {
       ignore = true;
     };
-  }, []);
+  }, [url]);
   return data;
 }
 function compareGlyphs(a, b) {
@@ -416,16 +425,16 @@ function CharacterViewerComponent(_ref3) {
 }
 const idQuery = (_CharacterViewerIDQuery.hash && _CharacterViewerIDQuery.hash !== "f90b09a4df6d95307b0a5d5fda487cdc" && console.error("The definition of 'CharacterViewerIDQuery' appears to have changed. Run `relay-compiler` to update the generated files to receive the expected data."), _CharacterViewerIDQuery);
 const slugQuery = (_CharacterViewerSlugQuery.hash && _CharacterViewerSlugQuery.hash !== "afa08a8f050e0434308892fea6e3c267" && console.error("The definition of 'CharacterViewerSlugQuery' appears to have changed. Run `relay-compiler` to update the generated files to receive the expected data."), _CharacterViewerSlugQuery);
-export async function loadCharacterViewerQuery(variables) {
+export async function loadCharacterViewerQuery(variables, options) {
   if (variables.collectionId) {
     return loadSerializableQuery(CharacterViewerIDQueryNode, {
       collectionId: variables.collectionId
-    });
+    }, options);
   }
   if (variables.collectionSlug) {
     return loadSerializableQuery(CharacterViewerSlugQueryNode, {
       collectionSlug: variables.collectionSlug
-    });
+    }, options);
   }
   throw new Error('loadCharacterViewerQuery expected either collectionId or collectionSlug');
 }