Búsqueda semántica en Shopify con XEYE

// node export-shopify.mjs https://your-shop.com > products.json   (Node 18+)
const shop = process.argv[2]
const out = []

for (let page = 1; ; page++) {
  const response = await fetch(`${shop}/products.json?limit=250&page=${page}`)
  const { products } = await response.json()
  if (!products.length) break
  for (const product of products) {
    out.push({
      text: product.title,
      description: (product.body_html || '')
        .replace(/<[^>]+>/g, ' ')
        .replace(/\s+/g, ' ')
        .trim(),
      params: {
        id: product.id,
        handle: product.handle,
        url: `/products/${product.handle}`,
        sku: product.variants[0]?.sku,
        price: product.variants[0]?.price,
        image: product.images[0]?.src,
      },
    })
  }
}

console.log(JSON.stringify(out, null, 2))

// wrangler.jsonc
{
  "name": "xeye-proxy",
  "main": "src/index.js",
  "compatibility_date": "2026-10-01",
  "vars": { "ALLOWED_ORIGIN": "https://your-shop.com" }
}

// src/index.js
const json = (data, status, headers) =>
  new Response(JSON.stringify(data), {
    status,
    headers: { ...headers, 'Content-Type': 'application/json' },
  })

export default {
  async fetch(request, env) {
    const cors = {
      'Access-Control-Allow-Origin': env.ALLOWED_ORIGIN,
      'Access-Control-Allow-Methods': 'POST, OPTIONS',
      'Access-Control-Allow-Headers': 'Content-Type',
      'Access-Control-Max-Age': '86400',
      Vary: 'Origin',
    }
    // A JSON POST from the browser is always preceded by a preflight.
    if (request.method === 'OPTIONS') return new Response(null, { status: 204, headers: cors })
    if (request.method !== 'POST') return json({ error: 'method_not_allowed' }, 405, cors)
    if (request.headers.get('Origin') !== env.ALLOWED_ORIGIN) {
      return json({ error: 'forbidden' }, 403, cors)
    }

    let body
    try {
      body = await request.json()
    } catch {
      return json({ error: 'bad_json' }, 400, cors)
    }
    const q = typeof body?.q === 'string' ? body.q.trim() : ''
    if (q.length < 2 || q.length > 200) return json({ error: 'bad_query' }, 400, cors)
    const limit = Math.min(Math.max(parseInt(body.limit, 10) || 5, 1), 20)

    const upstream = await fetch('https://search.xeye.es/api/v1/search', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json', 'X-API-Key': env.XEYE_API_KEY },
      // The list name is fixed here: the browser cannot query other lists.
      body: JSON.stringify({ list_name: 'products', search_term: q, limit }),
    })
    if (!upstream.ok) return json({ error: 'search_unavailable' }, 502, cors)
    const data = await upstream.json()
    return json({ results: data.results }, 200, cors)
  },
}

npx wrangler secret put XEYE_API_KEY
npx wrangler deploy

{%- comment -%} sections/xeye-search.liquid {%- endcomment -%}
<input type="search" id="xeye-q" placeholder="Search products" autocomplete="off">
<ul id="xeye-results"></ul>

<script>
  (() => {
    // Your Worker URL, or '/apps/xeye' if you use an app proxy.
    const ENDPOINT = 'https://xeye-proxy.YOUR-ACCOUNT.workers.dev'
    const input = document.getElementById('xeye-q')
    const list = document.getElementById('xeye-results')
    let timer
    let controller

    input.addEventListener('input', () => {
      clearTimeout(timer)
      const q = input.value.trim()
      if (q.length < 2) {
        list.replaceChildren()
        return
      }
      // Wait until the user stops typing: one search, not one per keystroke.
      timer = setTimeout(async () => {
        controller?.abort()
        controller = new AbortController()
        try {
          const response = await fetch(ENDPOINT, {
            method: 'POST',
            headers: { 'Content-Type': 'application/json' },
            body: JSON.stringify({ q, limit: 5 }),
            signal: controller.signal,
          })
          const { results = [] } = await response.json()
          list.replaceChildren(
            ...results.map((result) => {
              const item = document.createElement('li')
              const link = document.createElement('a')
              link.href = result.params?.url || '#'
              link.textContent = result.item
              item.append(link)
              return item
            }),
          )
        } catch (error) {
          if (error.name !== 'AbortError') list.replaceChildren()
        }
      }, 300)
    })
  })()
</script>

{% schema %}
{ "name": "XEYE search", "settings": [], "presets": [{ "name": "XEYE search" }] }
{% endschema %}

// Replace the Origin check in the Worker with this signature check.
async function verifyShopifyProxy(requestUrl, secret) {
  const params = new URL(requestUrl).searchParams
  const signature = params.get('signature') || ''
  if (!/^[0-9a-f]{64}$/.test(signature)) return false

  // key=value pairs (repeated keys joined with ","), sorted and concatenated.
  const keys = [...new Set(params.keys())].filter((key) => key !== 'signature')
  const message = keys
    .map((key) => `${key}=${params.getAll(key).join(',')}`)
    .sort()
    .join('')

  const encoder = new TextEncoder()
  const key = await crypto.subtle.importKey(
    'raw',
    encoder.encode(secret),
    { name: 'HMAC', hash: 'SHA-256' },
    false,
    ['verify'],
  )
  const bytes = Uint8Array.from(signature.match(/../g), (hex) => parseInt(hex, 16))
  return crypto.subtle.verify('HMAC', key, bytes, encoder.encode(message))
}

// In fetch():
// if (!(await verifyShopifyProxy(request.url, env.SHOPIFY_APP_SECRET))) {
//   return json({ error: 'forbidden' }, 403, {})
// }