@agnostack/next-shopify 4.0.0-beta.1 → 4.0.0-canary.10

package/dist/esm/lib/handlers/api/auth.js

@@ -0,0 +1,69 @@
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+import { beginAuth, getCallback, getInitializedShopify, } from '../../utils/index.js';
+import { isTrue, stringEmpty, PAGE_ROUTE_NAMES, } from '../../../shared/index.js';
+// NOTE: typically handling: "/api/auth/online" and  "/api/auth/offline"
+/**
+ * @param {any} [serverRuntimeConfig]
+ * @param {any} [data]
+ */
+export const handleAuth = (serverRuntimeConfig, data) => {
+    const { PAGE_PATHS, API_PATHS, API_URLS, APP_CONFIG, } = serverRuntimeConfig;
+    const { returnResponse = true } = data !== null && data !== void 0 ? data : {};
+    /**
+     * @param {any} req
+     * @param {any} res
+     * @param {any} params
+     */
+    return async (req, res, params) => {
+        var _a;
+        const { isOnline } = params !== null && params !== void 0 ? params : {};
+        const _b = (_a = req.query) !== null && _a !== void 0 ? _a : {}, { reAuth: _reAuth } = _b, query = __rest(_b, ["reAuth"]);
+        const { embedded, state, host, shop: _shop } = query;
+        const reAuth = isTrue(_reAuth, 'undefined');
+        const shopify = getInitializedShopify(serverRuntimeConfig);
+        if (!shopify) {
+            throw new Error('Shopify API is not initialized');
+        }
+        const shop = shopify.utils.sanitizeShop(_shop);
+        /**
+         * @param {any} [body]
+         * @param {any} [statusCode]
+         */
+        const handleResponse = (body, statusCode = 307) => {
+            if (returnResponse) {
+                return res.redirect(statusCode, body);
+            }
+            return { statusCode, body };
+        };
+        if (stringEmpty(shop)) {
+            return handleResponse(`${PAGE_PATHS[PAGE_ROUTE_NAMES.ERROR]}?code=no_shop_provided&type=handleAuth`);
+        }
+        if (embedded === '1') {
+            const callbackUrl = getCallback(API_URLS, { reAuth, isOnline });
+            // TODO: explore objectToQuerystring
+            const redirectUriParams = new URLSearchParams(Object.assign({ shop,
+                host }, state && { state })).toString();
+            const queryParams = new URLSearchParams(Object.assign(Object.assign({}, query), { shop, redirectUri: `${callbackUrl}?${redirectUriParams}` })).toString();
+            return handleResponse(`${PAGE_PATHS[PAGE_ROUTE_NAMES.EXIT]}?${queryParams}`);
+        }
+        return beginAuth({
+            shop,
+            state,
+            isOnline,
+            callbackPath: getCallback(API_PATHS, { reAuth, isOnline }),
+            rawRequest: req,
+            rawResponse: res,
+            config: APP_CONFIG,
+        });
+    };
+};

package/dist/esm/lib/handlers/api/billing.js

@@ -0,0 +1,99 @@
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+import { ensureRawBody } from '@agnostack/verifyd';
+import { getShopifyHelpers } from '../../utils/index.js';
+import { ensureArray, stringEmpty, safeParse, APP_QUERY, BILLING_EVENT_TYPES, } from '../../../shared/index.js';
+const TERMINAL_STATUSES = [
+    'EXPIRED',
+    'DECLINED',
+    'CANCELLED'
+];
+// NOTE: typically handling: "/api/webhooks/app/billing"
+/**
+ * @param {any} [serverRuntimeConfig]
+ * @param {any} [data]
+ * @param {import('../../../shared/index.js').StorageOptions} [options]
+ */
+export const handleAppBilling = (serverRuntimeConfig, data, options) => {
+    const { returnResponse = true } = data !== null && data !== void 0 ? data : {};
+    /**
+     * @param {any} req
+     * @param {any} res
+     */
+    return async (req, res) => {
+        var _a, _b, _c, _d;
+        /**
+         * @param {any} [body]
+         * @param {any} [statusCode]
+         */
+        const handleResponse = (body, statusCode = 200) => {
+            if (returnResponse) {
+                return res.status(statusCode).json(body);
+            }
+            return { statusCode, body };
+        };
+        try {
+            const { 'x-shop-domain': shopDomain, 'x-shopify-shop-domain': shopifyShopDomain, 'x-shopify-shop': shop = shopifyShopDomain !== null && shopifyShopDomain !== void 0 ? shopifyShopDomain : shopDomain, } = (_a = req.headers) !== null && _a !== void 0 ? _a : {};
+            if (stringEmpty(shop)) {
+                return handleResponse({ handler: 'billing', error: 'Missing shop' });
+            }
+            const helpers = await getShopifyHelpers(serverRuntimeConfig, { shop }, options);
+            if (!helpers.shopify) {
+                throw new Error('Shopify API is not initialized');
+            }
+            const { shopify, loadSession, updateSession, getVerifiedClients } = helpers;
+            // TODO: explore getVerificationHelpers?
+            const rawBody = await ensureRawBody(req);
+            const _e = await shopify.webhooks.validate({
+                rawBody,
+                rawRequest: req,
+                rawResponse: res,
+            }), { valid } = _e, webhookCheck = __rest(_e, ["valid"]);
+            if (valid) {
+                try {
+                    let message = 'ignored';
+                    const [eventType, { status } = {}] = Object.entries(safeParse(rawBody || '{}'))[0];
+                    if ((eventType === BILLING_EVENT_TYPES.SUBSCRIPTION) && TERMINAL_STATUSES.includes(status)) {
+                        const { Graphql } = (_b = await getVerifiedClients()) !== null && _b !== void 0 ? _b : {};
+                        if (!Graphql) {
+                            throw new Error('Missing shop');
+                        }
+                        const installationSubscriptionsResponse = await Graphql.request(APP_QUERY.INSTALLATION_SUBSCRIPTIONS);
+                        const installationSubscriptions = (_d = (_c = installationSubscriptionsResponse === null || installationSubscriptionsResponse === void 0 ? void 0 : installationSubscriptionsResponse.data) === null || _c === void 0 ? void 0 : _c.currentAppInstallation) === null || _d === void 0 ? void 0 : _d.activeSubscriptions;
+                        // NOTE this ensure all subscriptions are cancelled when in terminal status
+                        await Promise.all(ensureArray(installationSubscriptions).map((subscription) => (Graphql.request(APP_QUERY.CANCEL_APP_SUBSCRIPTION, {
+                            variables: {
+                                id: subscription === null || subscription === void 0 ? void 0 : subscription.id,
+                            },
+                        }))));
+                        message = 'deleted';
+                    }
+                    if ((serverRuntimeConfig.SHOPIFY_RUN_MODE === 'review') && !TERMINAL_STATUSES.includes(status)) {
+                        const { id: sessionId } = await loadSession();
+                        // NOTE: billingStatus is a custom field we add when we're in review mode to handle reauth billing correctly
+                        await updateSession(sessionId, { billingStatus: status });
+                    }
+                    return handleResponse({ handler: 'billing', message });
+                }
+                catch (error) {
+                    return handleResponse({ handler: 'billing', error: error === null || error === void 0 ? void 0 : error.message });
+                }
+            }
+            console.warn('Unable to validate billing webhook', webhookCheck);
+            return handleResponse({ handler: 'billing', error: 'Unable to validate billing webhook' });
+        }
+        catch (error) {
+            console.error('Error handling billing', error);
+            return handleResponse({ handler: 'billing', error: 'Error handling billing' });
+        }
+    };
+};

package/dist/esm/lib/handlers/api/callback.js

@@ -0,0 +1,163 @@
+import { InvalidHmacError, InvalidOAuthError, GraphqlQueryError, CookieNotFound, BillingError, } from '@shopify/shopify-api';
+import { getPrepareWebhookHandlers, normalizeShopifyId, getShopifyHelpers, } from '../../utils/index.js';
+import { isTrue, appendQuery, stringEmpty, ensureArray, ensureString, stringNotEmpty, ensureLeadingSlash, PAGE_ROUTE_NAMES, API_ROUTE_NAMES, ERROR_CODES, } from '../../../shared/index.js';
+/* NOTE: typically handling:
+*  "/api/auth/online/callback"
+*  "/api/auth/offline/callback"
+*  "/api/auth/online/callback/reauth"
+*  "/api/auth/offline/callback/reauth"
+*/
+// TODO: delete this for legacy auth
+/**
+ * @param {any} [serverRuntimeConfig]
+ * @param {any} [data]
+ * @param {import('../../../shared/index.js').StorageOptions} [options]
+ */
+export const handleCallback = (serverRuntimeConfig, data, options) => {
+    const { API_PATHS, PAGE_PATHS, PAYMENT_CONFIG, } = serverRuntimeConfig;
+    const { returnResponse = true } = data !== null && data !== void 0 ? data : {};
+    const prepareWebhookHandlers = getPrepareWebhookHandlers(serverRuntimeConfig);
+    /**
+     * @param {any} req
+     * @param {any} res
+     * @param {any} params
+     */
+    return async (req, res, params) => {
+        var _a, _b;
+        const errorPath = PAGE_PATHS[PAGE_ROUTE_NAMES.ERROR];
+        const { isOnline, reAuth } = params !== null && params !== void 0 ? params : {};
+        const { shop, host, state } = (_a = req.query) !== null && _a !== void 0 ? _a : {};
+        const authPayload = { rawRequest: req, rawResponse: res };
+        /**
+         * @param {any} [body]
+         * @param {any} [statusCode]
+         */
+        const handleResponse = (body, statusCode = 307) => {
+            if (returnResponse) {
+                return res.redirect(statusCode, body);
+            }
+            return { statusCode, body };
+        };
+        if (stringEmpty(shop) || stringEmpty(host)) {
+            // HMMM: why is this a 303 (rather than a 302/307 or or anything)??
+            return handleResponse(`${errorPath}?code=${ERROR_CODES.INVALID_CALLBACK}`, 303);
+        }
+        let redirectUrl = `${errorPath}?code=invalid_callback_response`;
+        let shopify;
+        try {
+            const helpers = await getShopifyHelpers(serverRuntimeConfig, { shop }, options);
+            if (!helpers.shopify) {
+                throw new Error('Shopify API is not initialized');
+            }
+            const { shopify: _shopify, loadAppData, storeSession: encryptStoreSession, ensureBilling: handleEnsureBilling, } = helpers;
+            shopify = _shopify;
+            const { session: _session } = await shopify.auth.callback(authPayload);
+            const session = _session === null || _session === void 0 ? void 0 : _session.toObject();
+            const offlineAuthRoute = API_PATHS[API_ROUTE_NAMES.AUTH_OFFLINE];
+            const shouldProcessOfflineAuth = (isOnline && offlineAuthRoute);
+            const shouldRegisterWebhooks = (!isTrue(session === null || session === void 0 ? void 0 : session.isOnline) || !offlineAuthRoute);
+            const shouldCheckBilling = PAYMENT_CONFIG === null || PAYMENT_CONFIG === void 0 ? void 0 : PAYMENT_CONFIG.required;
+            // NOTE: handleEnsureBilling below handles calling encryptStoreSession for offline session when shouldCheckBilling
+            if (isOnline || !shouldCheckBilling) {
+                await encryptStoreSession(session);
+            }
+            // NOTE: return early to process offline auth & callback (as webhooks cannot use the online one to make API calls)
+            if (shouldProcessOfflineAuth) {
+                // TODO: explore objectToQuerystring
+                const queryParams = new URLSearchParams(/** @type {any} */ ({ host, shop, state, reAuth, isOnline: false })).toString();
+                return handleResponse(`${offlineAuthRoute}?${queryParams}`);
+            }
+            if (shouldRegisterWebhooks) {
+                let appId;
+                try {
+                    const { appInfo } = await loadAppData();
+                    appId = normalizeShopifyId(appInfo === null || appInfo === void 0 ? void 0 : appInfo.id).id;
+                    // eslint-disable-next-line no-empty
+                }
+                catch (_ignore) {
+                    console.info('Ignoring error loading appData', _ignore);
+                }
+                const webhookHandlers = prepareWebhookHandlers({ appId });
+                shopify.webhooks.addHandlers(webhookHandlers);
+                // NOTE: webhooks cannot use an online session to make API calls to Shopify (but not all webooks may be doing that for all apps)
+                await shopify.webhooks.register({ session: /** @type {any} */ (session) });
+            }
+            const embeddedAppUrl = await shopify.auth.getEmbeddedAppUrl(authPayload);
+            // NOTE this is the final/successful return URL
+            redirectUrl = `${embeddedAppUrl}${ensureLeadingSlash(PAGE_PATHS[PAGE_ROUTE_NAMES.SUCCESS])}`;
+            if (shouldCheckBilling) {
+                // NOTE: handleEnsureBilling handles calling encryptStoreSession for offline session when shouldCheckBilling
+                const confirmationUrl = await handleEnsureBilling(session, { reAuth });
+                if (stringNotEmpty(confirmationUrl)) {
+                    redirectUrl = `${confirmationUrl}`;
+                }
+            }
+            // NOTE confirm that state can be appended to the confirmationUrl,
+            // otherwise we can append to the redirectUrl above the billing check
+            redirectUrl = appendQuery(redirectUrl, new URLSearchParams({ state }).toString());
+        }
+        catch (error) {
+            console.error('Error handling callback route', error);
+            const errorMessage = 'Error handling callback route';
+            let baseErrorUrl = errorPath;
+            if (shopify) {
+                try {
+                    const embeddedAppUrl = await shopify.auth.getEmbeddedAppUrl(authPayload);
+                    if (stringNotEmpty(embeddedAppUrl)) {
+                        baseErrorUrl = `${embeddedAppUrl}${ensureLeadingSlash(errorPath)}`;
+                    }
+                    // eslint-disable-next-line no-empty
+                }
+                catch (_ignore) { }
+            }
+            switch (true) {
+                // TODO implement a custom SessionNotFound error
+                case error instanceof InvalidHmacError: {
+                    console.warn(`${errorMessage}. InvalidHmac Error ${error.message}`);
+                    // HMMMM: not sure
+                    const authOnlinePath = API_PATHS[API_ROUTE_NAMES.AUTH_ONLINE];
+                    const authPath = isOnline
+                        ? authOnlinePath
+                        : API_PATHS[API_ROUTE_NAMES.AUTH_OFFLINE] || authOnlinePath;
+                    // TODO: explore objectToQuerystring
+                    const queryParams = new URLSearchParams(Object.assign({ host, shop }, state && { state })).toString();
+                    redirectUrl = `${authPath}?${queryParams}`;
+                    break;
+                }
+                case error instanceof CookieNotFound: {
+                    console.warn(`${errorMessage}. This may occur if Cookie is already deleted. CookieNotFound Error ${error.message}`);
+                    // HMMMM: not sure
+                    const authOnlinePath = API_PATHS[API_ROUTE_NAMES.AUTH_ONLINE];
+                    const authPath = isOnline
+                        ? authOnlinePath
+                        : API_PATHS[API_ROUTE_NAMES.AUTH_OFFLINE] || authOnlinePath;
+                    // TODO: explore objectToQuerystring
+                    const queryParams = new URLSearchParams(Object.assign({ host, shop }, state && { state })).toString();
+                    redirectUrl = `${authPath}?${queryParams}`;
+                    break;
+                }
+                case error instanceof BillingError: {
+                    console.error(`${errorMessage}. Billing Error ${error.message}`, error.errorData);
+                    redirectUrl = `${baseErrorUrl}?code=${ERROR_CODES.BILLING}`;
+                    break;
+                }
+                case error instanceof GraphqlQueryError: {
+                    const errorMessages = ensureArray((_b = error.response) === null || _b === void 0 ? void 0 : _b.errors).map(({ message }) => ensureString(message));
+                    console.error(`${errorMessage}. GraphqlQuery Error ${errorMessages.join('. ')}`);
+                    redirectUrl = `${baseErrorUrl}?code=${ERROR_CODES.QUERY}`;
+                    break;
+                }
+                case error instanceof InvalidOAuthError: {
+                    console.error(`${errorMessage}. InvalidOAuth Error`, error);
+                    redirectUrl = `${baseErrorUrl}?code=${ERROR_CODES.OAUTH}`;
+                    break;
+                }
+                default: {
+                    console.error(errorMessage, error);
+                    redirectUrl = `${baseErrorUrl}?code=${ERROR_CODES.CALLBACK}`;
+                }
+            }
+        }
+        return handleResponse(redirectUrl);
+    };
+};

package/dist/esm/lib/handlers/api/index.js

@@ -0,0 +1,17 @@
+export * from './auth.js';
+export * from './billing.js';
+export * from './callback.js';
+export * from './uninstall.js';
+export * from './verifiable/index.js';
+export * from './webhook.js';
+// Next's build-time analyzer only accepts a literal for `export const config` — on next 15
+// any call/identifier/spread is a fatal "Unsupported node type" (next 12 only warned). The
+// one indirection it accepts is a named re-export, so consumers on next 15+ should use:
+//   export { API_CONFIG as config } from '@agnostack/next-shopify/lib'
+// Only runtime-read keys (api.*) belong here — static keys (runtime, maxDuration, amp)
+// would be silently ignored in that shape.
+export const API_CONFIG = Object.freeze({
+    api: Object.freeze({
+        bodyParser: false,
+    }),
+});

package/dist/esm/lib/handlers/api/uninstall.js

@@ -0,0 +1,76 @@
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+import { ensureRawBody } from '@agnostack/verifyd';
+import { getShopifyHelpers } from '../../utils/index.js';
+import { stringEmpty, arrayNotEmpty, } from '../../../shared/index.js';
+// NOTE: typically handling: "/api/webhooks/app/uninstalled"
+/**
+ * @param {any} [serverRuntimeConfig]
+ * @param {any} [data]
+ * @param {import('../../../shared/index.js').StorageOptions} [options]
+ */
+export const handleAppUninstalled = (serverRuntimeConfig, data, options) => {
+    const { returnResponse = true } = data !== null && data !== void 0 ? data : {};
+    /**
+     * @param {any} req
+     * @param {any} res
+     */
+    return async (req, res) => {
+        var _a;
+        /**
+         * @param {any} [body]
+         * @param {any} [statusCode]
+         */
+        const handleResponse = (body, statusCode = 200) => {
+            if (returnResponse) {
+                return res.status(statusCode).json(body);
+            }
+            return { statusCode, body };
+        };
+        try {
+            const { 'x-shop-domain': shopDomain, 'x-shopify-shop-domain': shopifyShopDomain, 'x-shopify-shop': shop = shopifyShopDomain !== null && shopifyShopDomain !== void 0 ? shopifyShopDomain : shopDomain, } = (_a = req.headers) !== null && _a !== void 0 ? _a : {};
+            if (stringEmpty(shop)) {
+                return handleResponse({ handler: 'uninstall', error: 'Missing shop' });
+            }
+            const { shopify, findSessionIds, deleteSessions } = await getShopifyHelpers(serverRuntimeConfig, { shop }, options);
+            if (!shopify) {
+                throw new Error('Shopify API is not initialized');
+            }
+            // TODO: explore getVerificationHelpers?
+            const rawBody = await ensureRawBody(req);
+            const _b = await shopify.webhooks.validate({
+                rawBody,
+                rawRequest: req,
+                rawResponse: res,
+            }), { valid } = _b, webhookCheck = __rest(_b, ["valid"]);
+            if (valid) {
+                try {
+                    const sessionsIds = await findSessionIds(shop);
+                    if (arrayNotEmpty(sessionsIds)) {
+                        await deleteSessions(sessionsIds);
+                    }
+                    return handleResponse({ handler: 'uninstall', message: 'success' });
+                }
+                catch (error) {
+                    console.error('Error handling uninstall', error);
+                    return handleResponse({ handler: 'uninstall', error: (error === null || error === void 0 ? void 0 : error.message) || 'Error handling uninstall' });
+                }
+            }
+            console.warn('Unable to validate uninstall webhook', webhookCheck);
+            return handleResponse({ handler: 'uninstall', error: 'Unable to validate uninstall webhook' });
+        }
+        catch (error) {
+            console.error('Error handling uninstall', error);
+            return handleResponse({ handler: 'uninstall', error: 'Error handling uninstall' });
+        }
+    };
+};

package/dist/esm/lib/handlers/api/verifiable/appInstallation.js

@@ -0,0 +1,38 @@
+import { stringEmpty, APP_QUERY, TRANSFORM } from '../../../../shared/index.js';
+import { handleGraph } from './graph.js';
+// NOTE: typically handling: "/api/admin/installation/[appId]" (called by getUseAppInstallation)
+/**
+ * @param {any} [serverRuntimeConfig]
+ * @param {any} [data]
+ * @param {import('../../../../shared/index.js').StorageOptions} [options]
+ */
+export const handleLoadAppInstallation = (serverRuntimeConfig, data, options) => {
+    const _handleGraph = handleGraph(serverRuntimeConfig, data, options);
+    const { returnResponse = true } = data !== null && data !== void 0 ? data : {};
+    /**
+     * @param {any} req
+     * @param {any} res
+     * @param {any} params
+     */
+    return async (req, res, params) => {
+        const { appId } = params !== null && params !== void 0 ? params : {};
+        /**
+         * @param {any} [body]
+         * @param {any} [statusCode]
+         */
+        const handleResponse = (body, statusCode = 200) => {
+            if (returnResponse) {
+                return res.status(statusCode).json(body);
+            }
+            return { statusCode, body };
+        };
+        if (stringEmpty(appId)) {
+            return handleResponse({ message: 'Missing required param' }, 412);
+        }
+        return _handleGraph(req, res, {
+            query: APP_QUERY.INSTALLATION,
+            variables: { namespace: `${appId}-metafields` },
+            transform: TRANSFORM.APP_QUERY,
+        });
+    };
+};

package/dist/esm/lib/handlers/api/verifiable/graph.js

@@ -0,0 +1,150 @@
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+import { BillingError, GraphqlQueryError } from '@shopify/shopify-api';
+import { getVerificationHelpers, VerificationError } from '@agnostack/verifyd';
+import { getShopifyHelpers, getAuthErrorResponse } from '../../../utils/index.js';
+import { isType, safeParse, stringEmpty, ensureString, ensureObject, ensureArray, arrayNotEmpty, objectNotEmpty, querystringToObject, ShopifyAuthenticationError, ShopifySessionAuthenticationError, } from '../../../../shared/index.js';
+/**
+ * @param {any} [serverRuntimeConfig]
+ * @param {any} [data]
+ * @param {import('../../../../shared/index.js').StorageOptions} [options]
+ */
+export const handleGraph = (serverRuntimeConfig, data, options) => {
+    const _getVerificationHelpers = getVerificationHelpers(serverRuntimeConfig);
+    const { returnResponse = true } = data !== null && data !== void 0 ? data : {};
+    /**
+     * @param {any} req
+     * @param {any} res
+     * @param {any} params
+     */
+    return async (req, res, params) => {
+        var _a, _b, _c;
+        /**
+         * @param {any} [body]
+         * @param {any} [statusCode]
+         */
+        const handleResponse = (body, statusCode = 200) => {
+            if (returnResponse) {
+                return res.status(statusCode).json(body);
+            }
+            return { statusCode, body };
+        };
+        let requestBody;
+        let processResponse;
+        try {
+            ({ requestBody, processResponse } = await _getVerificationHelpers(req));
+        }
+        catch (error) {
+            if (error instanceof VerificationError) {
+                return handleResponse(Object.assign({ message: error.message }, error.data), error.code);
+            }
+            return handleResponse({ message: 'Verification error' }, 403);
+        }
+        const _d = (_a = req.query) !== null && _a !== void 0 ? _a : {}, { shop, apiVersion } = _d, _query = __rest(_d, ["shop", "apiVersion"]);
+        const _e = params !== null && params !== void 0 ? params : safeParse(requestBody || '{}'), { isOnline, query: graphQuery, variables: graphVariables, transform = (/** @type {any} */ _data) => _data } = _e, graphParams = __rest(_e, ["isOnline", "query", "variables", "transform"]);
+        let query = _query;
+        if (isType(query, 'string')) {
+            query = querystringToObject(query);
+        }
+        if (stringEmpty(shop) || stringEmpty(graphQuery)) {
+            return handleResponse({ message: 'Invalid arguments' }, 400);
+        }
+        let statusCode;
+        let response;
+        let headers;
+        let message = 'Error handling query call';
+        try {
+            const helpers = await getShopifyHelpers(serverRuntimeConfig, { shop }, options);
+            if (!helpers.shopify) {
+                throw new Error('Shopify API is not initialized');
+            }
+            const { getVerifiedClients } = helpers;
+            const { Graphql } = (_b = await getVerifiedClients({ req, res, shop, apiVersion, isOnline })) !== null && _b !== void 0 ? _b : {};
+            if (!Graphql) {
+                throw new Error('Missing shop');
+            }
+            response = await Graphql.request(graphQuery, Object.assign(Object.assign(Object.assign({}, objectNotEmpty(graphVariables) && { variables: graphVariables }), objectNotEmpty(query) && { query }), graphParams));
+            statusCode = 200;
+        }
+        catch (error) {
+            statusCode = 500;
+            // TODO: clean up to share between rest and graph (pr at least keep in sync)
+            switch (true) {
+                case error instanceof ShopifySessionAuthenticationError: {
+                    console.error(`${message}. Authentication Error.`, error);
+                    statusCode = 401;
+                    message = 'Unauthorized';
+                    // HMMMM, should this be:
+                    // message = `${message}. Authentication Error -  ${errroResponse.message}.`
+                    headers = {
+                        // TODO ensure this is working once upgraded to AppBridge v4
+                        'X-Shopify-Retry-Invalid-Session-Request': '1',
+                    };
+                    break;
+                }
+                case error instanceof ShopifyAuthenticationError: {
+                    console.error(`${message}. Authentication Error.`, error);
+                    const errorResponse = getAuthErrorResponse(serverRuntimeConfig, { error, shop });
+                    statusCode = errorResponse.statusCode;
+                    message = errorResponse.message;
+                    // HMMMM, should this be:
+                    // message = `${message}. Authentication Error -  ${errroResponse.message}.`
+                    headers = errorResponse.headers;
+                    break;
+                }
+                case error instanceof BillingError: {
+                    // HMMMM, should this be:
+                    // message = `${message}. Billing Error - ${error.message}.`
+                    console.error(`${message}. Billing Error - ${error.message}.`, error.errorData);
+                    statusCode = 402;
+                    if (error === null || error === void 0 ? void 0 : error.message) {
+                        message = error.message;
+                    }
+                    break;
+                }
+                case error instanceof GraphqlQueryError: {
+                    const errorMessages = ensureArray((_c = error.response) === null || _c === void 0 ? void 0 : _c.errors).map(({ message }) => ensureString(message));
+                    console.error(`${message}. ${errorMessages.join('. ')}.`);
+                    // HMMMM, should this be:
+                    // message = `${message}. ${errorMessages.join('. ')}.`
+                    // TODO: why are these not sending back different error codes?
+                    break;
+                }
+                default: {
+                    console.error(`${message}. HandleGraph Error - ${error.message}.`);
+                    break;
+                }
+            }
+        }
+        try {
+            Object.entries(ensureObject(headers)).forEach(([key, value]) => {
+                res.setHeader(key, value);
+            });
+            if (!(response === null || response === void 0 ? void 0 : response.data)) {
+                return handleResponse({ message }, statusCode);
+            }
+            const responseBody = ensureObject(response.data);
+            const [_responseData] = Object.values(responseBody);
+            const _f = ensureObject(_responseData), { userErrors } = _f, responseData = __rest(_f, ["userErrors"]);
+            if (arrayNotEmpty(userErrors)) {
+                const errorMessages = ensureArray(userErrors).map(({ message }) => ensureString(message));
+                return handleResponse({ message: `${message}. ${errorMessages.join('. ')}.` }, 500);
+            }
+            // NOTE: sending in both to transform in case someone needs the userErrors and/or multi-value query
+            return handleResponse(await processResponse(transform(responseData, responseBody)), statusCode);
+        }
+        catch (error) {
+            console.error(`${message}. Transformation Error.`, error);
+            return handleResponse({ message }, 500);
+        }
+    };
+};

package/dist/esm/lib/handlers/api/verifiable/index.js

@@ -0,0 +1,4 @@
+export * from './appInstallation.js';
+export * from './graph.js';
+export * from './proxy.js';
+export * from './token.js';