platform-types 1.10.781 → 1.10.783

package/dist/basket.d.ts

@@ -99,4 +99,60 @@ export type BasketErrorCode = (typeof BASKET_ERROR_CODES)[number];
  */
 export declare const BASKET_RESUME_ERROR_CODES: readonly ["CART_RESUME_UNAVAILABLE", "CART_RESUME_INCOMPLETE"];
 export type BasketResumeErrorCode = (typeof BASKET_RESUME_ERROR_CODES)[number];
+/**
+ * The guest cart token's header, BOTH ways. A shopper with no account sends it
+ * on `GET`, `POST` and `DELETE /basket/guest`, and every successful guest
+ * `POST` answers a fresh one in the same header (exposed to browser JS through
+ * `Access-Control-Expose-Headers`). Keep the newest: each write slides the
+ * 30-day expiry. The first `POST`, sent without one, creates the cart and is
+ * the only way to obtain one. Never put it in a URL or a log.
+ */
+export declare const GUEST_CART_TOKEN_HEADER = "X-Guest-Cart-Token";
+/**
+ * The refusals the guest cart routes answer themselves, beside the cart
+ * resolver's `BasketErrorCode` refusals they forward unchanged.
+ *
+ * - GUEST_CART_TOKEN_INVALID (401): every reason the token cannot be honoured —
+ *   missing, tampered, expired, minted for another store or presented on
+ *   another store's host or `x-store`, revoked by a sign-in merge, or naming a
+ *   cart that is gone, belongs to an account, is held by a till, was checked
+ *   out or was swept as abandoned — with one identical body, so the token is
+ *   never an oracle. Drop the token and start a new guest cart.
+ * - GUEST_CHECKOUT_DISABLED (403): the shop does not sell to guests — it has not
+ *   switched guest checkout on, admits buyers only after approval, or hides
+ *   prices from anonymous visitors. Public `GET /store` reports the same verdict
+ *   as `ecommerce.config.guestCheckoutAvailable`.
+ * - GUEST_CHECKOUT_SIGNED_IN (409): the request carried an `Authorization`
+ *   header. A signed-in buyer is priced and policed as their account, so they
+ *   use `/basket`; nothing was read or written.
+ *
+ * A token-holding guest write must send the `version` it read; a stale one is
+ * `409 CART_CHANGED_SINCE_CONFIRM` with `data: { currentCartVersion }` (the
+ * storefront checkout's code) and writes nothing.
+ */
+export declare const GUEST_CART_ERROR_CODES: readonly ["GUEST_CART_TOKEN_INVALID", "GUEST_CHECKOUT_DISABLED", "GUEST_CHECKOUT_SIGNED_IN"];
+export type GuestCartErrorCode = (typeof GUEST_CART_ERROR_CODES)[number];
+declare global {
+    /**
+     * A guest cart write's body: exactly the `/basket` named-action envelope.
+     * `data` is the cart without buy prices or any server-owned revocation
+     * field. The re-issued token travels in the `X-Guest-Cart-Token` response
+     * header, never in the body.
+     */
+    type GuestCartResponse = CartActionResponse;
+    /**
+     * `POST /basket { mode: 'merge-guest' }` on the SIGNED-IN route: fold the
+     * guest cart the token names into the caller's own cart, re-priced at the
+     * account's terms (overflow in `droppedSkus`), and revoke the token in the
+     * same write that marks the guest cart `converted`. Answers the `/basket`
+     * named-action envelope; a replay of the same token is
+     * `401 GUEST_CART_TOKEN_INVALID`. `version` is the caller's OWN cart
+     * version, as on every other named action.
+     */
+    interface GuestCartMergeRequest {
+        mode: 'merge-guest';
+        guestCartToken: string;
+        version?: number;
+    }
+}
 export {};

package/dist/basket.js

@@ -68,3 +68,39 @@ export const BASKET_ERROR_CODES = [
  *   clear on retry.
  */
 export const BASKET_RESUME_ERROR_CODES = ['CART_RESUME_UNAVAILABLE', 'CART_RESUME_INCOMPLETE'];
+/**
+ * The guest cart token's header, BOTH ways. A shopper with no account sends it
+ * on `GET`, `POST` and `DELETE /basket/guest`, and every successful guest
+ * `POST` answers a fresh one in the same header (exposed to browser JS through
+ * `Access-Control-Expose-Headers`). Keep the newest: each write slides the
+ * 30-day expiry. The first `POST`, sent without one, creates the cart and is
+ * the only way to obtain one. Never put it in a URL or a log.
+ */
+export const GUEST_CART_TOKEN_HEADER = 'X-Guest-Cart-Token';
+/**
+ * The refusals the guest cart routes answer themselves, beside the cart
+ * resolver's `BasketErrorCode` refusals they forward unchanged.
+ *
+ * - GUEST_CART_TOKEN_INVALID (401): every reason the token cannot be honoured —
+ *   missing, tampered, expired, minted for another store or presented on
+ *   another store's host or `x-store`, revoked by a sign-in merge, or naming a
+ *   cart that is gone, belongs to an account, is held by a till, was checked
+ *   out or was swept as abandoned — with one identical body, so the token is
+ *   never an oracle. Drop the token and start a new guest cart.
+ * - GUEST_CHECKOUT_DISABLED (403): the shop does not sell to guests — it has not
+ *   switched guest checkout on, admits buyers only after approval, or hides
+ *   prices from anonymous visitors. Public `GET /store` reports the same verdict
+ *   as `ecommerce.config.guestCheckoutAvailable`.
+ * - GUEST_CHECKOUT_SIGNED_IN (409): the request carried an `Authorization`
+ *   header. A signed-in buyer is priced and policed as their account, so they
+ *   use `/basket`; nothing was read or written.
+ *
+ * A token-holding guest write must send the `version` it read; a stale one is
+ * `409 CART_CHANGED_SINCE_CONFIRM` with `data: { currentCartVersion }` (the
+ * storefront checkout's code) and writes nothing.
+ */
+export const GUEST_CART_ERROR_CODES = [
+    'GUEST_CART_TOKEN_INVALID',
+    'GUEST_CHECKOUT_DISABLED',
+    'GUEST_CHECKOUT_SIGNED_IN',
+];

package/dist/cart.d.ts

@@ -76,6 +76,22 @@ declare global {
          * `parkedAt` and to the POS un-park verb, which happens to share the word.
          */
         resumedAt?: number;
+        /**
+         * SERVER-OWNED, guest carts only: the revocation generation of the guest
+         * cart token. A token carries the generation it was minted at and is refused
+         * once this moves; absent reads as 0. The sign-in merge (`POST /basket
+         * { mode: 'merge-guest' }`) adds 1 in the same write that marks the cart
+         * `converted`. Never sent to a shopper; no client writes it.
+         */
+        guestTokenGeneration?: number;
+        /**
+         * SERVER-OWNED, guest carts only: the random value the write that CREATED
+         * the guest cart stamped, carried by every guest cart token minted for it.
+         * A token is honoured only on a row bearing its own nonce, so a row deleted
+         * and re-created under the same `cartId` never revives an old token. Never
+         * sent to a shopper or an operator; no client writes it.
+         */
+        guestTokenNonce?: string;
         parkedAt?: number;
         version?: number;
         lines: CartLine[];

package/dist/cjs/basket.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BASKET_RESUME_ERROR_CODES = exports.BASKET_ERROR_CODES = void 0;
+exports.GUEST_CART_ERROR_CODES = exports.GUEST_CART_TOKEN_HEADER = exports.BASKET_RESUME_ERROR_CODES = exports.BASKET_ERROR_CODES = void 0;
 /**
  * Domain refusals from POST /baskets (replacement, named actions and park/resume)
  * and GET /baskets?mode=review. Check GATING_ERROR_CODES separately for middleware
@@ -71,3 +71,39 @@ exports.BASKET_ERROR_CODES = [
  *   clear on retry.
  */
 exports.BASKET_RESUME_ERROR_CODES = ['CART_RESUME_UNAVAILABLE', 'CART_RESUME_INCOMPLETE'];
+/**
+ * The guest cart token's header, BOTH ways. A shopper with no account sends it
+ * on `GET`, `POST` and `DELETE /basket/guest`, and every successful guest
+ * `POST` answers a fresh one in the same header (exposed to browser JS through
+ * `Access-Control-Expose-Headers`). Keep the newest: each write slides the
+ * 30-day expiry. The first `POST`, sent without one, creates the cart and is
+ * the only way to obtain one. Never put it in a URL or a log.
+ */
+exports.GUEST_CART_TOKEN_HEADER = 'X-Guest-Cart-Token';
+/**
+ * The refusals the guest cart routes answer themselves, beside the cart
+ * resolver's `BasketErrorCode` refusals they forward unchanged.
+ *
+ * - GUEST_CART_TOKEN_INVALID (401): every reason the token cannot be honoured —
+ *   missing, tampered, expired, minted for another store or presented on
+ *   another store's host or `x-store`, revoked by a sign-in merge, or naming a
+ *   cart that is gone, belongs to an account, is held by a till, was checked
+ *   out or was swept as abandoned — with one identical body, so the token is
+ *   never an oracle. Drop the token and start a new guest cart.
+ * - GUEST_CHECKOUT_DISABLED (403): the shop does not sell to guests — it has not
+ *   switched guest checkout on, admits buyers only after approval, or hides
+ *   prices from anonymous visitors. Public `GET /store` reports the same verdict
+ *   as `ecommerce.config.guestCheckoutAvailable`.
+ * - GUEST_CHECKOUT_SIGNED_IN (409): the request carried an `Authorization`
+ *   header. A signed-in buyer is priced and policed as their account, so they
+ *   use `/basket`; nothing was read or written.
+ *
+ * A token-holding guest write must send the `version` it read; a stale one is
+ * `409 CART_CHANGED_SINCE_CONFIRM` with `data: { currentCartVersion }` (the
+ * storefront checkout's code) and writes nothing.
+ */
+exports.GUEST_CART_ERROR_CODES = [
+    'GUEST_CART_TOKEN_INVALID',
+    'GUEST_CHECKOUT_DISABLED',
+    'GUEST_CHECKOUT_SIGNED_IN',
+];

package/dist/cjs/storefrontDesign.js

@@ -3,6 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.STOREFRONT_PREVIEW_PROTOCOL_ERRORS = exports.STOREFRONT_PREVIEW_READ_OPERATIONS = exports.STOREFRONT_DESIGN_AUDIENCES = exports.STOREFRONT_BENEFIT_ICONS = exports.STOREFRONT_RESERVED_SLUGS = exports.STOREFRONT_CONTACT_FIELDS = exports.STOREFRONT_PROTECTED_BUILTIN_DESTINATIONS = exports.STOREFRONT_BUILTIN_DESTINATIONS = exports.STOREFRONT_REPEATABLE_SECTION_TYPES = exports.STOREFRONT_SECTION_TYPES = exports.isStorefrontPageSlug = exports.STOREFRONT_PAGE_SLUG_RE = exports.STOREFRONT_DESIGN_LIMITS = exports.STOREFRONT_SOCIAL_HOSTS = void 0;
 exports.createStorefrontDesignV1 = createStorefrontDesignV1;
 exports.parseStorefrontPreviewDocument = parseStorefrontPreviewDocument;
+exports.matchesStorefrontVisibility = matchesStorefrontVisibility;
+exports.projectStorefrontDocumentForAudience = projectStorefrontDocumentForAudience;
 exports.parseStorefrontPreviewMessage = parseStorefrontPreviewMessage;
 exports.acceptStorefrontPreviewMessage = acceptStorefrontPreviewMessage;
 /** The social kinds a contact may link, each to its own hosts; a contact links at most one per kind. */
@@ -253,7 +255,7 @@ function previewWithinBytes(value, maximum) {
 /**
  * A `visibility` rule kept on the transport only when well-formed: known audiences, and integer
  * price lists within the store cap. Anything else is left off rather than failing the frame — the
- * preview never filters by it, it only shows the rule the editor authored.
+ * parser never filters by it, it only carries the rule the editor authored.
  */
 function previewVisibility(input) {
     if (!previewRecord(input) || !Array.isArray(input.audiences))
@@ -362,6 +364,102 @@ function previewAnnouncement(input) {
     const { visibility, ...rest } = input;
     return { ...rest, ...previewVisibility(visibility) };
 }
+function audienceNamed(audiences, audience) {
+    return audiences.some((entry) => entry === audience);
+}
+/**
+ * The one audience rule: whether `caller` sees an item with this `visibility`. Absent means
+ * everyone. Otherwise any listed audience that matches, or the caller's list in `priceLists`:
+ * `guest` matches only a guest; `customer` any customer; `retail` / `wholesale` a customer of that
+ * class. A rule naming a list deleted since it was authored matches no one through it.
+ */
+function matchesStorefrontVisibility(visibility, caller) {
+    if (!visibility)
+        return true;
+    const audiences = Array.isArray(visibility.audiences) ? visibility.audiences : [];
+    if (caller.kind === 'guest')
+        return audienceNamed(audiences, 'guest');
+    if (audienceNamed(audiences, 'customer') || audienceNamed(audiences, caller.audienceClass))
+        return true;
+    return Array.isArray(visibility.priceLists) && visibility.priceLists.some((id) => id === caller.priceList);
+}
+const isAudienceNode = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const audienceNonEmpty = (value) => Array.isArray(value) && value.length > 0;
+function copyAudienceValue(value) {
+    if (Array.isArray(value))
+        return value.map(copyAudienceValue);
+    if (!isAudienceNode(value))
+        return value;
+    return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, copyAudienceValue(entry)]));
+}
+/**
+ * Filters `value` for `caller` into a NEW tree, or `undefined` when it goes. Every `visibility` key
+ * is dropped; an item kept because its rule matched gains `audienceScoped: true`. As a published
+ * reader drops a link whose target vanished, a link (or a section's action) to a page this caller
+ * does not see goes whole. A menu entry left with neither children nor a target, and a footer group
+ * left with no links, go too: they would render as dead labels.
+ */
+function scopeAudienceValue(value, caller, pages) {
+    if (Array.isArray(value))
+        return scopeAudienceArray(value, caller, pages);
+    if (!isAudienceNode(value))
+        return value;
+    if (value.kind === 'page')
+        return pages.has(String(value.id)) ? copyAudienceValue(value) : undefined;
+    const visibility = value.visibility;
+    if (!matchesStorefrontVisibility(visibility, caller))
+        return undefined;
+    const result = Object.fromEntries(scopedAudienceEntries(value, visibility, caller, pages));
+    return keepsAfterAudienceFilter(value, result) ? result : undefined;
+}
+/**
+ * A kept node's entries, filtered. Built as entries for `Object.fromEntries`, never by assignment:
+ * an own `__proto__` key stays a data key and never becomes the result's prototype. A rule-matched
+ * item's flag keeps its place, or comes last.
+ */
+function scopedAudienceEntries(value, visibility, caller, pages) {
+    const entries = [];
+    for (const [key, entry] of Object.entries(value)) {
+        if (key === 'visibility')
+            continue;
+        const scoped = key === 'audienceScoped' && visibility ? true : scopeAudienceValue(entry, caller, pages);
+        if (scoped !== undefined)
+            entries.push([key, scoped]);
+    }
+    if (visibility && !Object.hasOwn(value, 'audienceScoped'))
+        entries.push(['audienceScoped', true]);
+    return entries;
+}
+function scopeAudienceArray(items, caller, pages) {
+    return items.flatMap((item) => {
+        const scoped = scopeAudienceValue(item, caller, pages);
+        return scoped === undefined ? [] : [scoped];
+    });
+}
+/** Whether a node survives once its own parts are filtered, judged against what it had before. */
+function keepsAfterAudienceFilter(had, result) {
+    if (had.target !== undefined && result.target === undefined)
+        return false;
+    if (audienceNonEmpty(had.children) && !audienceNonEmpty(result.children) && result.target === undefined)
+        return false;
+    return !(audienceNonEmpty(had.links) && !audienceNonEmpty(result.links));
+}
+/**
+ * A storefront design document as `caller` may see it, built as a NEW tree (the input is never
+ * changed or shared): drops every section, page, navigation entry (top level or child), footer link
+ * and announcement bar `caller` does not match, and every link to a page it does not see; strips
+ * every `visibility`; marks an item kept through a rule `audienceScoped: true`. Web `GET /store`
+ * applies it to a publication, the preview to its draft for a grant fixture's caller, and a preview
+ * frame may apply it to a posted document with the caller its design read echoed.
+ */
+function projectStorefrontDocumentForAudience(document, caller) {
+    const root = document;
+    const pages = new Set((Array.isArray(root.pages) ? root.pages : [])
+        .filter(isAudienceNode)
+        .filter((page) => matchesStorefrontVisibility(page.visibility, caller))
+        .map((page) => String(page.id)));
+    return (scopeAudienceValue(root, caller, pages) ?? {});
+}
 /** The codes a preview frame may report in an `error` message; the parser accepts exactly these. */
 exports.STOREFRONT_PREVIEW_PROTOCOL_ERRORS = [
     'STOREFRONT_PREVIEW_EXPIRED',

package/dist/store.d.ts

@@ -158,6 +158,25 @@ declare global {
              * frame), so the storefront can offer the request.
              */
             wholesaleRequests?: boolean;
+            /**
+             * Whether the shop sells to shoppers without an account (server guest
+             * cart, guest checkout). Absent means OFF: a shop opts in. Honoured only
+             * while `registrationMode` is not `'approval'` and `showDefaultPriceList`
+             * is not `0` — a shop that vets every buyer, or hides prices from
+             * anonymous visitors, never sells to a guest whatever this says.
+             * Written by `PATCH /store` (ADMIN) and `PUT /platform/stores/{storeId}`
+             * (MANAGER). Never sent to shoppers as stored: they get
+             * `guestCheckoutAvailable`.
+             */
+            guestCheckout?: boolean;
+            /**
+             * SHOPPER-ONLY, never stored: present on web `GET /store` and the
+             * customer `stores` frame, `true` when the shop accepts guest carts and
+             * guest checkout right now — `guestCheckout` on AND registration open AND
+             * prices shown to anonymous visitors. The guest routes refuse
+             * `403 GUEST_CHECKOUT_DISABLED` whenever this is `false`.
+             */
+            guestCheckoutAvailable?: boolean;
             /**
              * How long a storefront online payment holds the order, in whole
              * minutes: the payment attempt's `expiresAt` and its Checkout Pro

package/dist/storefrontDesign.d.ts

@@ -268,12 +268,25 @@ declare global {
      * so the reference and identity walkers pass over it.
      *
      * Web `GET /store` filters by it and strips it, marking each item visible through a rule
-     * `audienceScoped: true`. The private preview is not filtered and carries it as authored.
+     * `audienceScoped: true`. The private preview carries it as authored, unless its grant names a
+     * fixture: then it is filtered exactly as web `GET /store` filters it for that fixture's caller.
      */
     interface StorefrontDesignVisibility {
         audiences: StorefrontDesignAudience[];
         priceLists?: number[];
     }
+    /**
+     * Who reads a storefront design, as {@link matchesStorefrontVisibility} judges a `visibility`
+     * rule: no approved customer (a guest, a pending or refused registrant included), or one approved
+     * customer with its effective list and that list's `audienceClass` (absent meaning `retail`).
+     */
+    type StorefrontAudienceCaller = {
+        kind: 'guest';
+    } | {
+        kind: 'customer';
+        priceList: number;
+        audienceClass: 'retail' | 'wholesale';
+    };
     /**
      * The one announcement bar a design carries above every page, never a second. `text` and
      * `subtitle` are plain text (no control characters; renderers escape markup); `text` is required
@@ -288,7 +301,7 @@ declare global {
      *
      * Every projection drops a disabled bar, as it drops a disabled section. Web `GET /store` also
      * drops one whose `visibility` the caller does not match; the private preview carries the rule
-     * as authored.
+     * as authored, unless its grant names a fixture, when it drops the bar as web `GET /store` would.
      */
     interface StorefrontDesignAnnouncement {
         id: string;
@@ -414,7 +427,8 @@ declare global {
      * An item that can carry `visibility` (section, page, navigation entry, footer link, the
      * announcement bar) may also
      * carry `audienceScoped: true`: web `GET /store` sets it on an item it returned because the
-     * caller matched that item's rule, and strips every `visibility`. The preview never sets it.
+     * caller matched that item's rule, and strips every `visibility`. The preview sets it only when
+     * its grant names a fixture, the same way.
      */
     type PublicStorefrontDesignValue<T> = T extends StorefrontDesignImagePlacement ? T & {
         url: string;
@@ -528,7 +542,27 @@ declare global {
     type StorefrontDesignDiscardInput = StorefrontDesignRevisionInput;
     interface StorefrontDesignPreviewInput {
         draftRevision: string;
+        /** Absent: the unfiltered preview at the default list. */
+        fixture?: StorefrontPreviewFixture;
     }
+    /**
+     * The audience a preview grant renders for — synthetic, never a real customer: no customer row,
+     * cart, order or balance is read. `guest` is a visitor without an account. `priceList` is an
+     * approved customer on that list of the store (its current `audienceClass` decides `retail` /
+     * `wholesale` rules), and every catalogue read prices at it; a list the store does not have is
+     * refused on issue, 400 `STOREFRONT_DESIGN_INVALID` with `UNKNOWN_PRICE_LIST` at
+     * `fixture.priceList`, and a list deleted after issue reads as a customer on it would (PUBLICO,
+     * list 1, with its class). `pending` is a registrant awaiting approval: the api answers it exactly as `guest`
+     * (content, methods and prices); the storefront may still show its in-review notices.
+     */
+    type StorefrontPreviewFixture = {
+        kind: 'guest';
+    } | {
+        kind: 'priceList';
+        priceList: number;
+    } | {
+        kind: 'pending';
+    };
     /**
      * GET draft answers a baseline built without copying the legacy logo, while POST init copies it,
      * so `document.branding.logo` can differ between them: clients rebase onto init's document.
@@ -649,11 +683,20 @@ declare global {
         grantId: string;
         iat: number;
         exp: number;
+        /** The issue body's fixture, signed in, so only the ADMIN-gated issue route can change it. */
+        fixture?: StorefrontPreviewFixture;
     }
     type StorefrontPreviewOperation = (typeof STOREFRONT_PREVIEW_READ_OPERATIONS)[number];
     /** GET query fields use their serialized string representation. Store scope comes only from the grant. */
     type StorefrontPreviewReadQuery = {
-        operation: 'design' | 'paymentMethods' | 'deliveryMethods';
+        operation: 'design';
+    }
+    /**
+     * The public method rows. With a grant fixture, only the rows that caller may use, as web
+     * `GET /store` and checkout judge a row's `availability`; without one, every row.
+     */
+     | {
+        operation: 'paymentMethods' | 'deliveryMethods';
     }
     /**
      * The shop's public web `GET /store` frame — the same allow-listed STORE
@@ -679,7 +722,8 @@ declare global {
     }
     /**
      * `bestSellers` is web `GET /products?mode=best-sellers`'s read and answer, priced as a
-     * guest. `recentlyBought` answers `{ data: [] }`: a preview has no buyer to read for.
+     * guest, or at a `priceList` fixture's list as every catalogue operation is.
+     * `recentlyBought` answers `{ data: [] }`: a preview has no buyer to read for.
      */
      | {
         operation: 'bestSellers' | 'recentlyBought';
@@ -769,6 +813,11 @@ declare global {
     interface StorefrontPreviewDesignResult {
         mode: 'preview';
         draftRevision: string;
+        /**
+         * Without a grant fixture, the draft with every `visibility` as authored. With one, the
+         * draft filtered for {@link StorefrontPreviewDesignResult.audience} by
+         * {@link projectStorefrontDocumentForAudience}, as web `GET /store` filters a publication.
+         */
         document: PublicStorefrontDesign;
         literalLayers: {
             scope: LiteralScope;
@@ -776,12 +825,19 @@ declare global {
         }[];
         effectiveSettings: StorefrontDesignSettings;
         defaultsVersion: string;
+        /**
+         * The caller the grant's fixture resolved to, present only when the grant names one: filter a
+         * posted `StorefrontPreviewDocument` with this same caller and the same walker.
+         */
+        audience?: StorefrontAudienceCaller;
     }
     /**
      * `operation=store`'s `data`: the fields web `GET /store` builds from the STORE
      * row, built by the same projector, and `storefrontDesign` from the pinned
      * draft. The contact is the draft's (`publicContact`, plus `email`/`phone`
-     * derived from it), as an adopted shop's comes from its publication.
+     * derived from it), as an adopted shop's comes from its publication. With a grant
+     * fixture, its method rows are only those that caller may use and its design is
+     * filtered for that caller, as web `GET /store` answers that caller.
      *
      * Never carries what only an open shop's public route knows — `publicStorefront`,
      * `maintenance` and `globals` — and never answers `STOREFRONT_UNAVAILABLE`: a
@@ -796,7 +852,11 @@ declare global {
         type: StorefrontDesignSectionType;
         enabled: boolean;
         content: Record<string, unknown>;
-        /** Carried as authored when well-formed, as navigation and footer entries carry theirs; never applied. */
+        /**
+         * Carried as authored when well-formed, as navigation and footer entries carry theirs; never
+         * applied by the parser. A frame whose design read echoed an `audience` should apply it
+         * with {@link projectStorefrontDocumentForAudience}.
+         */
         visibility?: StorefrontDesignVisibility;
     }
     interface StorefrontPreviewDocument {
@@ -824,7 +884,7 @@ declare global {
         contact: Record<string, unknown>;
         seo: object;
         literalOverrides: Record<string, unknown>;
-        /** Carried as sent when it is an object, its `visibility` kept only when well-formed; never applied. */
+        /** Carried as sent when it is an object, its `visibility` kept only when well-formed; never applied by the parser. */
         announcement?: object;
     }
     type StorefrontPreviewProtocolError = (typeof STOREFRONT_PREVIEW_PROTOCOL_ERRORS)[number];
@@ -931,6 +991,22 @@ declare global {
 export declare const STOREFRONT_PREVIEW_READ_OPERATIONS: readonly ["design", "store", "product", "productBySlug", "productsByIds", "bestSellers", "recentlyBought", "products", "incomes", "group", "related", "categories", "brands", "tags", "collection", "paymentMethods", "deliveryMethods", "asset"];
 /** Checks transport structure and UTF-8 size; unfamiliar section types are skipped, never rendered. */
 export declare function parseStorefrontPreviewDocument(input: unknown): StorefrontPreviewDocument | undefined;
+/**
+ * The one audience rule: whether `caller` sees an item with this `visibility`. Absent means
+ * everyone. Otherwise any listed audience that matches, or the caller's list in `priceLists`:
+ * `guest` matches only a guest; `customer` any customer; `retail` / `wholesale` a customer of that
+ * class. A rule naming a list deleted since it was authored matches no one through it.
+ */
+export declare function matchesStorefrontVisibility(visibility: StorefrontDesignVisibility | undefined, caller: StorefrontAudienceCaller): boolean;
+/**
+ * A storefront design document as `caller` may see it, built as a NEW tree (the input is never
+ * changed or shared): drops every section, page, navigation entry (top level or child), footer link
+ * and announcement bar `caller` does not match, and every link to a page it does not see; strips
+ * every `visibility`; marks an item kept through a rule `audienceScoped: true`. Web `GET /store`
+ * applies it to a publication, the preview to its draft for a grant fixture's caller, and a preview
+ * frame may apply it to a posted document with the caller its design read echoed.
+ */
+export declare function projectStorefrontDocumentForAudience<T extends object>(document: T, caller: StorefrontAudienceCaller): T;
 /** The codes a preview frame may report in an `error` message; the parser accepts exactly these. */
 export declare const STOREFRONT_PREVIEW_PROTOCOL_ERRORS: readonly ["STOREFRONT_PREVIEW_EXPIRED", "STOREFRONT_PREVIEW_REVOKED", "STOREFRONT_PREVIEW_FORBIDDEN", "STOREFRONT_PREVIEW_UNAVAILABLE", "STOREFRONT_DESIGN_INVALID", "STOREFRONT_SCHEMA_UNSUPPORTED"];
 /** Does not authenticate the grant. Keep it in memory and post only to the exact configured target origin. */

package/dist/storefrontDesign.js

@@ -245,7 +245,7 @@ function previewWithinBytes(value, maximum) {
 /**
  * A `visibility` rule kept on the transport only when well-formed: known audiences, and integer
  * price lists within the store cap. Anything else is left off rather than failing the frame — the
- * preview never filters by it, it only shows the rule the editor authored.
+ * parser never filters by it, it only carries the rule the editor authored.
  */
 function previewVisibility(input) {
     if (!previewRecord(input) || !Array.isArray(input.audiences))
@@ -354,6 +354,102 @@ function previewAnnouncement(input) {
     const { visibility, ...rest } = input;
     return { ...rest, ...previewVisibility(visibility) };
 }
+function audienceNamed(audiences, audience) {
+    return audiences.some((entry) => entry === audience);
+}
+/**
+ * The one audience rule: whether `caller` sees an item with this `visibility`. Absent means
+ * everyone. Otherwise any listed audience that matches, or the caller's list in `priceLists`:
+ * `guest` matches only a guest; `customer` any customer; `retail` / `wholesale` a customer of that
+ * class. A rule naming a list deleted since it was authored matches no one through it.
+ */
+export function matchesStorefrontVisibility(visibility, caller) {
+    if (!visibility)
+        return true;
+    const audiences = Array.isArray(visibility.audiences) ? visibility.audiences : [];
+    if (caller.kind === 'guest')
+        return audienceNamed(audiences, 'guest');
+    if (audienceNamed(audiences, 'customer') || audienceNamed(audiences, caller.audienceClass))
+        return true;
+    return Array.isArray(visibility.priceLists) && visibility.priceLists.some((id) => id === caller.priceList);
+}
+const isAudienceNode = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const audienceNonEmpty = (value) => Array.isArray(value) && value.length > 0;
+function copyAudienceValue(value) {
+    if (Array.isArray(value))
+        return value.map(copyAudienceValue);
+    if (!isAudienceNode(value))
+        return value;
+    return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, copyAudienceValue(entry)]));
+}
+/**
+ * Filters `value` for `caller` into a NEW tree, or `undefined` when it goes. Every `visibility` key
+ * is dropped; an item kept because its rule matched gains `audienceScoped: true`. As a published
+ * reader drops a link whose target vanished, a link (or a section's action) to a page this caller
+ * does not see goes whole. A menu entry left with neither children nor a target, and a footer group
+ * left with no links, go too: they would render as dead labels.
+ */
+function scopeAudienceValue(value, caller, pages) {
+    if (Array.isArray(value))
+        return scopeAudienceArray(value, caller, pages);
+    if (!isAudienceNode(value))
+        return value;
+    if (value.kind === 'page')
+        return pages.has(String(value.id)) ? copyAudienceValue(value) : undefined;
+    const visibility = value.visibility;
+    if (!matchesStorefrontVisibility(visibility, caller))
+        return undefined;
+    const result = Object.fromEntries(scopedAudienceEntries(value, visibility, caller, pages));
+    return keepsAfterAudienceFilter(value, result) ? result : undefined;
+}
+/**
+ * A kept node's entries, filtered. Built as entries for `Object.fromEntries`, never by assignment:
+ * an own `__proto__` key stays a data key and never becomes the result's prototype. A rule-matched
+ * item's flag keeps its place, or comes last.
+ */
+function scopedAudienceEntries(value, visibility, caller, pages) {
+    const entries = [];
+    for (const [key, entry] of Object.entries(value)) {
+        if (key === 'visibility')
+            continue;
+        const scoped = key === 'audienceScoped' && visibility ? true : scopeAudienceValue(entry, caller, pages);
+        if (scoped !== undefined)
+            entries.push([key, scoped]);
+    }
+    if (visibility && !Object.hasOwn(value, 'audienceScoped'))
+        entries.push(['audienceScoped', true]);
+    return entries;
+}
+function scopeAudienceArray(items, caller, pages) {
+    return items.flatMap((item) => {
+        const scoped = scopeAudienceValue(item, caller, pages);
+        return scoped === undefined ? [] : [scoped];
+    });
+}
+/** Whether a node survives once its own parts are filtered, judged against what it had before. */
+function keepsAfterAudienceFilter(had, result) {
+    if (had.target !== undefined && result.target === undefined)
+        return false;
+    if (audienceNonEmpty(had.children) && !audienceNonEmpty(result.children) && result.target === undefined)
+        return false;
+    return !(audienceNonEmpty(had.links) && !audienceNonEmpty(result.links));
+}
+/**
+ * A storefront design document as `caller` may see it, built as a NEW tree (the input is never
+ * changed or shared): drops every section, page, navigation entry (top level or child), footer link
+ * and announcement bar `caller` does not match, and every link to a page it does not see; strips
+ * every `visibility`; marks an item kept through a rule `audienceScoped: true`. Web `GET /store`
+ * applies it to a publication, the preview to its draft for a grant fixture's caller, and a preview
+ * frame may apply it to a posted document with the caller its design read echoed.
+ */
+export function projectStorefrontDocumentForAudience(document, caller) {
+    const root = document;
+    const pages = new Set((Array.isArray(root.pages) ? root.pages : [])
+        .filter(isAudienceNode)
+        .filter((page) => matchesStorefrontVisibility(page.visibility, caller))
+        .map((page) => String(page.id)));
+    return (scopeAudienceValue(root, caller, pages) ?? {});
+}
 /** The codes a preview frame may report in an `error` message; the parser accepts exactly these. */
 export const STOREFRONT_PREVIEW_PROTOCOL_ERRORS = [
     'STOREFRONT_PREVIEW_EXPIRED',

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "platform-types",
-	"version": "1.10.781",
+	"version": "1.10.783",
 	"description": "Shared wire and entity contracts for the platform.",
 	"type": "module",
 	"main": "dist/index.js",