platform-types 1.10.692 → 1.10.693

package/dist/cjs/index.js

@@ -104,6 +104,7 @@ __exportStar(require("./storeNetwork.js"), exports);
 __exportStar(require("./storefrontAssets.js"), exports);
 __exportStar(require("./storefrontEvent.js"), exports);
 __exportStar(require("./storefrontSeo.js"), exports);
+__exportStar(require("./storefrontProductMeta.js"), exports);
 __exportStar(require("./storefrontWebLiteralKeys.js"), exports);
 __exportStar(require("./subscription.js"), exports);
 __exportStar(require("./support.js"), exports);

package/dist/cjs/literals.js

@@ -1,5 +1,5 @@
 "use strict";
-// The `GET /literals` wire contract — the surface union and both response
+// Literal read and catalog-seed wire contracts — the surface union and response
 // envelopes, so a native client has something to import instead of hand-pinning
 // strings it cannot be told about when they change.
 //

package/dist/cjs/storefrontProductMeta.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.storefrontProductMetaDescription = exports.storefrontProductName = exports.storefrontDisplayName = exports.PRODUCT_DESCRIPTION_MAX = void 0;
+/** The supplied product description's maximum code points, including the trailing ellipsis. */
+exports.PRODUCT_DESCRIPTION_MAX = 200;
+/** The edge and SPA's store name: keep a nonblank name verbatim, else the platform fallback. */
+const storefrontDisplayName = (name) => typeof name === 'string' && name.trim() !== '' ? name : 'Tienda online';
+exports.storefrontDisplayName = storefrontDisplayName;
+/** A product's display name: a nonblank name verbatim, else its id — the head's title and the fallback description share it. */
+const storefrontProductName = (product) => typeof product.name === 'string' && product.name.trim() ? product.name : String(product.productId);
+exports.storefrontProductName = storefrontProductName;
+/** Every `<…>` tag as a space, in one linear pass (a tag regex backtracks on an unclosed `<`). */
+const withoutTags = (text) => {
+    let out = '';
+    let inTag = false;
+    for (const char of text) {
+        if (char === '<')
+            inTag = true;
+        if (!inTag)
+            out += char;
+        if (char === '>' && inTag) {
+            inTag = false;
+            out += ' ';
+        }
+    }
+    return out;
+};
+/**
+ * Raw text for a product's description meta tags. Strip tags, preserve literal
+ * entities, collapse whitespace and cut supplied text on a code-point boundary.
+ * Blank or non-string descriptions use the name (else the id) and display store
+ * name verbatim; that fallback sentence is neither stripped nor capped.
+ * HTML renderers must escape the returned text when writing an attribute.
+ */
+const storefrontProductMetaDescription = (product, storeName) => {
+    const text = typeof product.description === 'string' ? withoutTags(product.description).replaceAll(/\s+/g, ' ').trim() : '';
+    if (!text)
+        return `${(0, exports.storefrontProductName)(product)} en ${(0, exports.storefrontDisplayName)(storeName)}.`;
+    const chars = [...text];
+    return chars.length <= exports.PRODUCT_DESCRIPTION_MAX ? text : `${chars.slice(0, exports.PRODUCT_DESCRIPTION_MAX - 1).join('')}…`;
+};
+exports.storefrontProductMetaDescription = storefrontProductMetaDescription;

package/dist/cjs/storefrontWebLiteralKeys.js

@@ -103,6 +103,7 @@ exports.STOREFRONT_WEB_LITERAL_KEYS = Object.freeze([
     'AUTH_LOGIN_ERROR_WRONG_CREDENTIALS',
     'AUTH_LOGIN_FORGOT_LINK',
     'AUTH_LOGIN_META_DESCRIPTION',
+    'AUTH_LOGIN_PAGE_TITLE',
     'AUTH_LOGIN_PASSWORD',
     'AUTH_LOGIN_PASSWORD_MIN',
     'AUTH_LOGIN_PASSWORD_REQUIRED',
@@ -305,6 +306,7 @@ exports.STOREFRONT_WEB_LITERAL_KEYS = Object.freeze([
     'BASKET_TITLE',
     'BASKET_TOTAL',
     'BRANDS_TITLE',
+    'CHECKOUT_ACCOUNT_DISABLED',
     'CHECKOUT_BACK_BUTTON',
     'CHECKOUT_COL_PRODUCT',
     'CHECKOUT_COL_QUANTITY',
@@ -341,6 +343,7 @@ exports.STOREFRONT_WEB_LITERAL_KEYS = Object.freeze([
     'CHECKOUT_DELIVERY_DETAILS_TITLE',
     'CHECKOUT_DELIVERY_FULLNAME_LABEL',
     'CHECKOUT_DELIVERY_METHOD_LABEL',
+    'CHECKOUT_DELIVERY_METHOD_UNAVAILABLE',
     'CHECKOUT_DELIVERY_NO_DATA',
     'CHECKOUT_DELIVERY_PHONE_LABEL',
     'CHECKOUT_DELIVERY_POSTAL_CODE_LABEL',
@@ -358,18 +361,23 @@ exports.STOREFRONT_WEB_LITERAL_KEYS = Object.freeze([
     'CHECKOUT_DNI_REQUIRED_DIALOG',
     'CHECKOUT_DNI_REQUIRED_MESSAGE',
     'CHECKOUT_DNI_REQUIRED_MESSAGE_NO_THRESHOLD',
+    'CHECKOUT_EMAIL_VERIFICATION_REQUIRED',
     'CHECKOUT_EMPTY_BASKET',
     'CHECKOUT_FX_NOTICE_PAYING',
     'CHECKOUT_FX_NOTICE_PREFERRED',
     'CHECKOUT_FX_NOTICE_STORE_HINT',
     'CHECKOUT_INITIAL_NO_INVOICE',
+    'CHECKOUT_INVALID_CART',
     'CHECKOUT_INVOICING_LABEL',
     'CHECKOUT_MIN_BUY_ALERT',
     'CHECKOUT_MIN_BUY_ERROR',
+    'CHECKOUT_MIN_BUY_REFUSED',
     'CHECKOUT_NO_INVOICE',
     'CHECKOUT_ORDER_CREATED',
     'CHECKOUT_ORDER_CREATION_ERROR',
+    'CHECKOUT_PAYMENT_METHODS_NOT_CONFIGURED',
     'CHECKOUT_PAYMENT_METHOD_LABEL',
+    'CHECKOUT_PAYMENT_METHOD_UNAVAILABLE',
     'CHECKOUT_PRICES_CHANGED',
     'CHECKOUT_PROMOTION_APPLIED',
     'CHECKOUT_PROMOTION_APPLY',
@@ -612,9 +620,6 @@ exports.STOREFRONT_WEB_LITERAL_KEYS = Object.freeze([
     'HOME_QUICK_ADD',
     'HOME_SUBTITLE',
     'HOME_TITLE',
-    'HOME_WHATSAPP_CTA',
-    'HOME_WHATSAPP_LOGIN_REQUIRED',
-    'HOME_WHATSAPP_PHONE',
     'HOME_WHATSAPP_TITLE',
     'IMAGE_CROP_WARNING',
     'INCOMES_DATE_FROM',
@@ -857,6 +862,21 @@ exports.STOREFRONT_WEB_LITERAL_KEYS = Object.freeze([
     'PAYMENT_METHOD_SANTANDER_CBU',
     'PAYMENT_METHOD_SANTANDER_NAME',
     'PAYMENT_METHOD_SANTANDER_TYPE',
+    'PREVIEW_BACK',
+    'PREVIEW_DISABLED',
+    'PREVIEW_EXPIRED',
+    'PREVIEW_FAILED',
+    'PREVIEW_HOME',
+    'PREVIEW_LOADING',
+    'PREVIEW_READ_FAILED',
+    'PREVIEW_READ_ONLY',
+    'PREVIEW_RESTART',
+    'PREVIEW_RETRY',
+    'PREVIEW_TITLE',
+    'PREVIEW_UNAVAILABLE',
+    'PREVIEW_UNAVAILABLE_ACTION',
+    'PREVIEW_VARIANTS',
+    'PREVIEW_WAITING',
     'PRICING_TIER_CHIP',
     'PRICING_TIER_FROM',
     'PRICING_TIER_UNITS',
@@ -1093,6 +1113,32 @@ exports.STOREFRONT_WEB_LITERAL_KEYS = Object.freeze([
     'SETTINGS_SUCCESS_MESSAGE',
     'SETTINGS_THEME_DARK',
     'SETTINGS_TITLE',
+    'STOREFRONT_CATALOGUE',
+    'STOREFRONT_CONTACT_ADDRESS',
+    'STOREFRONT_CONTACT_EMAIL',
+    'STOREFRONT_CONTACT_HOURS',
+    'STOREFRONT_CONTACT_PHONE',
+    'STOREFRONT_CONTACT_SOCIALS',
+    'STOREFRONT_CONTACT_WHATSAPP',
+    'STOREFRONT_DAY_FRIDAY',
+    'STOREFRONT_DAY_MONDAY',
+    'STOREFRONT_DAY_SATURDAY',
+    'STOREFRONT_DAY_SUNDAY',
+    'STOREFRONT_DAY_THURSDAY',
+    'STOREFRONT_DAY_TUESDAY',
+    'STOREFRONT_DAY_WEDNESDAY',
+    'STOREFRONT_FOOTER_NAV_ARIA',
+    'STOREFRONT_MERCHANT_NAV_ARIA',
+    'STOREFRONT_NAV_GROUP_FALLBACK',
+    'STOREFRONT_PLATFORM_NAV_ARIA',
+    'STOREFRONT_SEARCH',
+    'STOREFRONT_SOCIAL_FACEBOOK',
+    'STOREFRONT_SOCIAL_INSTAGRAM',
+    'STOREFRONT_SOCIAL_LINKEDIN',
+    'STOREFRONT_SOCIAL_TIKTOK',
+    'STOREFRONT_SOCIAL_X',
+    'STOREFRONT_SOCIAL_YOUTUBE',
+    'STOREFRONT_TAXONOMY_FAILED',
     'STORE_NAME_FALLBACK',
     'SURVEY_COMMENT_PLACEHOLDER',
     'SURVEY_RATING_BAD',
@@ -1117,14 +1163,14 @@ exports.isStorefrontLiteralKey = isStorefrontLiteralKey;
 const STOREFRONT_NAVIGATE_LITERAL_PREFIX = 'NAVIGATE_';
 /**
  * A same-origin path: a leading `/`, a second character that is neither `/` nor `\`
- * (`//host` and `/\host` are protocol-relative to a browser), and no whitespace or
- * backslash anywhere — a browser strips tab and newline before parsing, so `/\t/host`
- * becomes `//host`. A value with a scheme cannot start with `/`.
- *
- * The storefront is to apply this identical pattern in `src/app/slices/literals.ts`
- * `resolveLayer` (its change is pending there); keep the two the same.
+ * (`//host` and `/\host` are protocol-relative to a browser), and no whitespace,
+ * backslash, control character (`\p{Cc}`) or invisible format character (`\p{Cf}`: every
+ * bidi mark including U+061C, zero-width characters, the soft hyphen, tag characters)
+ * anywhere. Browsers strip tab and newline before parsing, so `/\t/host` becomes `//host`;
+ * invisible and directional characters can also disguise the link target. A scheme
+ * cannot start with `/`.
  */
-const STOREFRONT_SAME_ORIGIN_PATH_RE = /^\/(?![/\\])[^\s\\]*$/;
+const STOREFRONT_SAME_ORIGIN_PATH_RE = /^\/(?![/\\])[^\s\\\p{Cc}\p{Cf}]*$/u;
 /**
  * Whether `value` may be stored, published or served for `key`. A `NAVIGATE_*` key is
  * rendered as a link, so it must be a same-origin path — otherwise an override could

package/dist/index.d.ts

@@ -80,6 +80,7 @@ export * from './storeNetwork.ts';
 export * from './storefrontAssets.ts';
 export * from './storefrontEvent.ts';
 export * from './storefrontSeo.ts';
+export * from './storefrontProductMeta.ts';
 export * from './storefrontWebLiteralKeys.ts';
 export * from './subscription.ts';
 export * from './support.ts';

package/dist/index.js

@@ -88,6 +88,7 @@ export * from "./storeNetwork.js";
 export * from "./storefrontAssets.js";
 export * from "./storefrontEvent.js";
 export * from "./storefrontSeo.js";
+export * from "./storefrontProductMeta.js";
 export * from "./storefrontWebLiteralKeys.js";
 export * from "./subscription.js";
 export * from "./support.js";

package/dist/literals.d.ts

@@ -1,4 +1,9 @@
 declare global {
+    interface SeedWebLiteralsResult {
+        seeded: string[];
+        skipped: string[];
+        total: number;
+    }
     /**
      * One scope's literals, unmerged.
      *

package/dist/literals.js

@@ -1,4 +1,4 @@
-// The `GET /literals` wire contract — the surface union and both response
+// Literal read and catalog-seed wire contracts — the surface union and response
 // envelopes, so a native client has something to import instead of hand-pinning
 // strings it cannot be told about when they change.
 //

package/dist/platform.d.ts

@@ -851,9 +851,10 @@ export interface TenantBillingRollupRow {
 /**
  * Why a plan's marketing copy disagrees with the entitlements actually backing
  * that tier. Advisory only — `PATCH /platform/billing/plans/{tier}` reports
- * these and still applies the write. It never blocks: tiers are hand-tuned
+ * these and still applies the write. It never blocks: plan copy is hand-tuned
  * between pricing decisions, so a mismatch is routinely the intended
- * intermediate state rather than an error.
+ * intermediate state rather than an error. The entitlements themselves come
+ * from the code matrix; that route refuses `features`.
  *
  * - `NUMERIC_MISMATCH` — a bullet advertises a number that differs from the
  *   numeric entitlement it maps to.
@@ -864,12 +865,11 @@ export interface TenantBillingRollupRow {
  *   `status: 'live'` and `enabled: true` for.
  * - `MISSING_FEATURE_ROW` — a bullet states a LIMIT for an entitlement the tier
  *   has no row for at all. Distinct from `UNBACKED_CAPABILITY` on purpose: that
- *   one means "the row exists but is not live/enabled", a state an operator
- *   fixes by flipping two flags, whereas this one means the row is absent —
- *   what deleting or renaming a key through
- *   `PATCH /platform/billing/plans/{tier}` produces — and is fixed by
- *   re-creating it. Collapsing them (as the API briefly did) hides the more
- *   severe of the two behind the more common one.
+ *   one means "the row exists but is not live/enabled in the matrix", whereas
+ *   this one means the supplied catalogue lacks the backing row — a template
+ *   PATCH cannot add it; the repair is the copy or a matrix change. Collapsing
+ *   them (as the API briefly did) hides the more severe of the two behind the
+ *   more common one.
  */
 export type CatalogWarningCode = 'NUMERIC_MISMATCH' | 'UNLIMITED_ADVERTISED_AS_CAPPED' | 'UNBACKED_CAPABILITY' | 'MISSING_FEATURE_ROW';
 /**

package/dist/storefrontProductMeta.d.ts

@@ -0,0 +1,21 @@
+/** The supplied product description's maximum code points, including the trailing ellipsis. */
+export declare const PRODUCT_DESCRIPTION_MAX = 200;
+/** The edge and SPA's store name: keep a nonblank name verbatim, else the platform fallback. */
+export declare const storefrontDisplayName: (name: unknown) => string;
+/** A product's display name: a nonblank name verbatim, else its id — the head's title and the fallback description share it. */
+export declare const storefrontProductName: (product: {
+    name?: unknown;
+    productId?: unknown;
+}) => string;
+/**
+ * Raw text for a product's description meta tags. Strip tags, preserve literal
+ * entities, collapse whitespace and cut supplied text on a code-point boundary.
+ * Blank or non-string descriptions use the name (else the id) and display store
+ * name verbatim; that fallback sentence is neither stripped nor capped.
+ * HTML renderers must escape the returned text when writing an attribute.
+ */
+export declare const storefrontProductMetaDescription: (product: {
+    name?: unknown;
+    productId?: unknown;
+    description?: unknown;
+}, storeName: unknown) => string;

package/dist/storefrontProductMeta.js

@@ -0,0 +1,36 @@
+/** The supplied product description's maximum code points, including the trailing ellipsis. */
+export const PRODUCT_DESCRIPTION_MAX = 200;
+/** The edge and SPA's store name: keep a nonblank name verbatim, else the platform fallback. */
+export const storefrontDisplayName = (name) => typeof name === 'string' && name.trim() !== '' ? name : 'Tienda online';
+/** A product's display name: a nonblank name verbatim, else its id — the head's title and the fallback description share it. */
+export const storefrontProductName = (product) => typeof product.name === 'string' && product.name.trim() ? product.name : String(product.productId);
+/** Every `<…>` tag as a space, in one linear pass (a tag regex backtracks on an unclosed `<`). */
+const withoutTags = (text) => {
+    let out = '';
+    let inTag = false;
+    for (const char of text) {
+        if (char === '<')
+            inTag = true;
+        if (!inTag)
+            out += char;
+        if (char === '>' && inTag) {
+            inTag = false;
+            out += ' ';
+        }
+    }
+    return out;
+};
+/**
+ * Raw text for a product's description meta tags. Strip tags, preserve literal
+ * entities, collapse whitespace and cut supplied text on a code-point boundary.
+ * Blank or non-string descriptions use the name (else the id) and display store
+ * name verbatim; that fallback sentence is neither stripped nor capped.
+ * HTML renderers must escape the returned text when writing an attribute.
+ */
+export const storefrontProductMetaDescription = (product, storeName) => {
+    const text = typeof product.description === 'string' ? withoutTags(product.description).replaceAll(/\s+/g, ' ').trim() : '';
+    if (!text)
+        return `${storefrontProductName(product)} en ${storefrontDisplayName(storeName)}.`;
+    const chars = [...text];
+    return chars.length <= PRODUCT_DESCRIPTION_MAX ? text : `${chars.slice(0, PRODUCT_DESCRIPTION_MAX - 1).join('')}…`;
+};

package/dist/storefrontWebLiteralKeys.js

@@ -100,6 +100,7 @@ export const STOREFRONT_WEB_LITERAL_KEYS = Object.freeze([
     'AUTH_LOGIN_ERROR_WRONG_CREDENTIALS',
     'AUTH_LOGIN_FORGOT_LINK',
     'AUTH_LOGIN_META_DESCRIPTION',
+    'AUTH_LOGIN_PAGE_TITLE',
     'AUTH_LOGIN_PASSWORD',
     'AUTH_LOGIN_PASSWORD_MIN',
     'AUTH_LOGIN_PASSWORD_REQUIRED',
@@ -302,6 +303,7 @@ export const STOREFRONT_WEB_LITERAL_KEYS = Object.freeze([
     'BASKET_TITLE',
     'BASKET_TOTAL',
     'BRANDS_TITLE',
+    'CHECKOUT_ACCOUNT_DISABLED',
     'CHECKOUT_BACK_BUTTON',
     'CHECKOUT_COL_PRODUCT',
     'CHECKOUT_COL_QUANTITY',
@@ -338,6 +340,7 @@ export const STOREFRONT_WEB_LITERAL_KEYS = Object.freeze([
     'CHECKOUT_DELIVERY_DETAILS_TITLE',
     'CHECKOUT_DELIVERY_FULLNAME_LABEL',
     'CHECKOUT_DELIVERY_METHOD_LABEL',
+    'CHECKOUT_DELIVERY_METHOD_UNAVAILABLE',
     'CHECKOUT_DELIVERY_NO_DATA',
     'CHECKOUT_DELIVERY_PHONE_LABEL',
     'CHECKOUT_DELIVERY_POSTAL_CODE_LABEL',
@@ -355,18 +358,23 @@ export const STOREFRONT_WEB_LITERAL_KEYS = Object.freeze([
     'CHECKOUT_DNI_REQUIRED_DIALOG',
     'CHECKOUT_DNI_REQUIRED_MESSAGE',
     'CHECKOUT_DNI_REQUIRED_MESSAGE_NO_THRESHOLD',
+    'CHECKOUT_EMAIL_VERIFICATION_REQUIRED',
     'CHECKOUT_EMPTY_BASKET',
     'CHECKOUT_FX_NOTICE_PAYING',
     'CHECKOUT_FX_NOTICE_PREFERRED',
     'CHECKOUT_FX_NOTICE_STORE_HINT',
     'CHECKOUT_INITIAL_NO_INVOICE',
+    'CHECKOUT_INVALID_CART',
     'CHECKOUT_INVOICING_LABEL',
     'CHECKOUT_MIN_BUY_ALERT',
     'CHECKOUT_MIN_BUY_ERROR',
+    'CHECKOUT_MIN_BUY_REFUSED',
     'CHECKOUT_NO_INVOICE',
     'CHECKOUT_ORDER_CREATED',
     'CHECKOUT_ORDER_CREATION_ERROR',
+    'CHECKOUT_PAYMENT_METHODS_NOT_CONFIGURED',
     'CHECKOUT_PAYMENT_METHOD_LABEL',
+    'CHECKOUT_PAYMENT_METHOD_UNAVAILABLE',
     'CHECKOUT_PRICES_CHANGED',
     'CHECKOUT_PROMOTION_APPLIED',
     'CHECKOUT_PROMOTION_APPLY',
@@ -609,9 +617,6 @@ export const STOREFRONT_WEB_LITERAL_KEYS = Object.freeze([
     'HOME_QUICK_ADD',
     'HOME_SUBTITLE',
     'HOME_TITLE',
-    'HOME_WHATSAPP_CTA',
-    'HOME_WHATSAPP_LOGIN_REQUIRED',
-    'HOME_WHATSAPP_PHONE',
     'HOME_WHATSAPP_TITLE',
     'IMAGE_CROP_WARNING',
     'INCOMES_DATE_FROM',
@@ -854,6 +859,21 @@ export const STOREFRONT_WEB_LITERAL_KEYS = Object.freeze([
     'PAYMENT_METHOD_SANTANDER_CBU',
     'PAYMENT_METHOD_SANTANDER_NAME',
     'PAYMENT_METHOD_SANTANDER_TYPE',
+    'PREVIEW_BACK',
+    'PREVIEW_DISABLED',
+    'PREVIEW_EXPIRED',
+    'PREVIEW_FAILED',
+    'PREVIEW_HOME',
+    'PREVIEW_LOADING',
+    'PREVIEW_READ_FAILED',
+    'PREVIEW_READ_ONLY',
+    'PREVIEW_RESTART',
+    'PREVIEW_RETRY',
+    'PREVIEW_TITLE',
+    'PREVIEW_UNAVAILABLE',
+    'PREVIEW_UNAVAILABLE_ACTION',
+    'PREVIEW_VARIANTS',
+    'PREVIEW_WAITING',
     'PRICING_TIER_CHIP',
     'PRICING_TIER_FROM',
     'PRICING_TIER_UNITS',
@@ -1090,6 +1110,32 @@ export const STOREFRONT_WEB_LITERAL_KEYS = Object.freeze([
     'SETTINGS_SUCCESS_MESSAGE',
     'SETTINGS_THEME_DARK',
     'SETTINGS_TITLE',
+    'STOREFRONT_CATALOGUE',
+    'STOREFRONT_CONTACT_ADDRESS',
+    'STOREFRONT_CONTACT_EMAIL',
+    'STOREFRONT_CONTACT_HOURS',
+    'STOREFRONT_CONTACT_PHONE',
+    'STOREFRONT_CONTACT_SOCIALS',
+    'STOREFRONT_CONTACT_WHATSAPP',
+    'STOREFRONT_DAY_FRIDAY',
+    'STOREFRONT_DAY_MONDAY',
+    'STOREFRONT_DAY_SATURDAY',
+    'STOREFRONT_DAY_SUNDAY',
+    'STOREFRONT_DAY_THURSDAY',
+    'STOREFRONT_DAY_TUESDAY',
+    'STOREFRONT_DAY_WEDNESDAY',
+    'STOREFRONT_FOOTER_NAV_ARIA',
+    'STOREFRONT_MERCHANT_NAV_ARIA',
+    'STOREFRONT_NAV_GROUP_FALLBACK',
+    'STOREFRONT_PLATFORM_NAV_ARIA',
+    'STOREFRONT_SEARCH',
+    'STOREFRONT_SOCIAL_FACEBOOK',
+    'STOREFRONT_SOCIAL_INSTAGRAM',
+    'STOREFRONT_SOCIAL_LINKEDIN',
+    'STOREFRONT_SOCIAL_TIKTOK',
+    'STOREFRONT_SOCIAL_X',
+    'STOREFRONT_SOCIAL_YOUTUBE',
+    'STOREFRONT_TAXONOMY_FAILED',
     'STORE_NAME_FALLBACK',
     'SURVEY_COMMENT_PLACEHOLDER',
     'SURVEY_RATING_BAD',
@@ -1113,14 +1159,14 @@ export const isStorefrontLiteralKey = (key) => STOREFRONT_WEB_LITERAL_KEY_SET.ha
 const STOREFRONT_NAVIGATE_LITERAL_PREFIX = 'NAVIGATE_';
 /**
  * A same-origin path: a leading `/`, a second character that is neither `/` nor `\`
- * (`//host` and `/\host` are protocol-relative to a browser), and no whitespace or
- * backslash anywhere — a browser strips tab and newline before parsing, so `/\t/host`
- * becomes `//host`. A value with a scheme cannot start with `/`.
- *
- * The storefront is to apply this identical pattern in `src/app/slices/literals.ts`
- * `resolveLayer` (its change is pending there); keep the two the same.
+ * (`//host` and `/\host` are protocol-relative to a browser), and no whitespace,
+ * backslash, control character (`\p{Cc}`) or invisible format character (`\p{Cf}`: every
+ * bidi mark including U+061C, zero-width characters, the soft hyphen, tag characters)
+ * anywhere. Browsers strip tab and newline before parsing, so `/\t/host` becomes `//host`;
+ * invisible and directional characters can also disguise the link target. A scheme
+ * cannot start with `/`.
  */
-const STOREFRONT_SAME_ORIGIN_PATH_RE = /^\/(?![/\\])[^\s\\]*$/;
+const STOREFRONT_SAME_ORIGIN_PATH_RE = /^\/(?![/\\])[^\s\\\p{Cc}\p{Cf}]*$/u;
 /**
  * Whether `value` may be stored, published or served for `key`. A `NAVIGATE_*` key is
  * rendered as a link, so it must be a same-origin path — otherwise an override could

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "platform-types",
-	"version": "1.10.692",
+	"version": "1.10.693",
 	"description": "Shared wire and entity contracts for the platform.",
 	"type": "module",
 	"main": "dist/index.js",