
Security News
pnpm 11.5 Adds Support for Recognizing npm Staged Publishes
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.
@swell/storefront-app-sdk-core
Advanced tools
Framework-agnostic core for the Swell Storefront App SDK. Handles template state management, editor communication, visual overlays, translations, and storefront data.
Note: Most apps should install
@swell/storefront-app-sdk-reactinstead. This package is installed automatically as its dependency. Use this package directly only if you're building a custom framework adapter.
StorefrontApp (orchestrator)
├── TemplateEngine — Immer-based state for sections, blocks, settings
│ ├── MessageBus — postMessage protocol (editor ↔ preview)
│ ├── ColorSchemeManager — CSS custom property generation
│ ├── TranslationManager — t() function, locale switching
│ └── EditorOverlayManager — visual selection/hover overlays
├── UniversalRenderer — builds ComponentDescriptor tree from state
├── ComponentRegistry — schema metadata storage
└── Storefront — swell-js wrapper (menus, locales, currencies)
A framework adapter creates a StorefrontApp, subscribes to snapshots, and renders the descriptor tree using framework-specific components.
import {
StorefrontApp,
type AppSnapshot,
type ComponentDescriptor,
type ComponentRegistration,
type ThemeData,
} from "@swell/storefront-app-sdk-core";
// 1. Create the app
const app = new StorefrontApp({
themeData: { header, content, footer, settings, schemas, locales },
components: [
{ type: "section:hero_banner", schema: heroBannerSchema },
{ type: "block:button" },
],
});
// 2. Subscribe to state changes
app.subscribe((snapshot: AppSnapshot) => {
// snapshot.descriptor — ComponentDescriptor tree to render
// snapshot.storefrontData — menus, locales, currencies, ready flag
renderToFramework(snapshot);
});
// 3. Start loading storefront data (menus, locales, etc.)
const cancel = app.start();
// 4. After DOM update, notify the editor
app.notifyPageLoaded();
// 5. Cleanup
app.destroy();
constructor(options: StorefrontAppOptions)interface StorefrontAppOptions {
themeData: ThemeData; // Template data (regions, settings, schemas)
components: ComponentRegistration[]; // Registered component types + schemas
debug?: boolean; // Enable debug logging
}
start(): () => voidStarts async storefront loading (menus, locales, currencies). Returns a cancel function.
subscribe(listener: (snapshot: AppSnapshot) => void): () => voidSubscribe to snapshot changes. Called when template state or storefront data changes. Returns unsubscribe function.
getSnapshot(): AppSnapshotReturns current snapshot synchronously.
interface AppSnapshot {
descriptor: ComponentDescriptor; // Tree of components to render
storefrontData: StorefrontData; // Storefront runtime data
}
notifyPageLoaded(): voidCall after the framework has committed the descriptor to the DOM. Sends PAGE_LOADED to the editor so it can update overlays.
getStorefront(): StorefrontAccess the Storefront instance for setLocale(code) / setCurrency(code).
destroy(): voidCleanup all subscriptions, event listeners, and DOM elements (overlays).
The descriptor tree produced by UniversalRenderer:
interface ComponentDescriptor {
type: string; // "section:hero_banner", "block:button", or "__root__"
id: string; // Instance ID
props: Record<string, unknown>; // Resolved settings (with locale overrides applied)
children?: ComponentDescriptor[];
}
The adapter walks this tree and maps each type to a framework component.
The SDK handles editor communication automatically:
SET_THEME_DATA — editor sends updated template data → state updates → new snapshotSET_EDITOR_STATE — editor sends selection/hover state → overlay updatesOVERLAY_HOVER / OVERLAY_SELECT / OVERLAY_ADD_CLICK — SDK sends user interactions back to editorPAGE_READY / PAGE_LOADED — SDK notifies editor of render lifecycleComponents must render data-section-id / data-block-id attributes for overlays to work:
<section data-section-id="abc123">...</section>
<div data-block-id="xyz789">...</div>
// Theme data
SectionGroup, SectionConfig, BlockConfig,
ThemeSettings, ThemeData,
ComponentSchema, ComponentSchemas,
SchemaField, SchemaFieldType,
SettingsGroup, SettingsSchema,
// Storefront runtime
StorefrontData, Locale, Currency,
Menu, MenuItem, ResolvedMenu, ResolvedMenuItem,
LocaleData, LocalesMap,
// App orchestration
StorefrontApp, StorefrontAppOptions,
AppSnapshot, ComponentDescriptor, ComponentRegistration,
// Values
swell, // swell-js client instance
t, // translation function
FAQs
Framework-agnostic storefront app SDK core
We found that @swell/storefront-app-sdk-core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.

Security News
Federal audit finds NIST lacked a plan to clear the NVD backlog, wasted funds on duplicate work, and delayed use of CISA data.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.