@agnostack/next-shopify 4.0.0-canary.8 → 4.0.0

package/dist/lib/handlers/ssr/protect.js

@@ -32,8 +32,9 @@ const processRedirect = (url, params, permanent = false) => ({
 /**
  * @param {any} [serverRuntimeConfig]
  * @param {any} [_props]
+ * @param {import('../../../shared/index.js').StorageOptions} [options]
  */
-const protectRoute = (serverRuntimeConfig, _props) => {
+const protectRoute = (serverRuntimeConfig, _props, options) => {
     const { PAGE_PATHS, API_PATHS, APP_CONFIG, PAYMENT_CONFIG } = serverRuntimeConfig;
     const { isSessionTokenEnabled } = APP_CONFIG;
     const exitPath = PAGE_PATHS[index_js_2.PAGE_ROUTE_NAMES.EXIT];
@@ -53,7 +54,7 @@ const protectRoute = (serverRuntimeConfig, _props) => {
             console.info(`${chalk_1.default.yellowBright('next-shopify')} - [${chalk_1.default.bold('protectRoute')}]: ${`Bypassing local protect - should ONLY happen when running in next to test non-shopify functionality!`}`);
             return { props };
         }
-        const helpers = await (0, index_js_1.getShopifyHelpers)(serverRuntimeConfig, { shop });
+        const helpers = await (0, index_js_1.getShopifyHelpers)(serverRuntimeConfig, { shop }, options);
         // NOTE: unreachable — allowLocalBypass returned above, and getInitializedShopify makes the same call
         if (!helpers.shopify) {
             throw new Error('Shopify API is not initialized');

package/dist/lib/index.d.ts

@@ -1,4 +1,3 @@
 export * from '../shared/index.js';
 export * from './handlers/index.js';
-export * from '../storage/index.js';
 export { getShopifyHelpers, prepareHeaders } from './utils/index.js';

package/dist/lib/index.js

@@ -17,7 +17,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.prepareHeaders = exports.getShopifyHelpers = void 0;
 __exportStar(require("../shared/index.js"), exports);
 __exportStar(require("./handlers/index.js"), exports);
-__exportStar(require("../storage/index.js"), exports);
 var index_js_1 = require("./utils/index.js");
 Object.defineProperty(exports, "getShopifyHelpers", { enumerable: true, get: function () { return index_js_1.getShopifyHelpers; } });
 Object.defineProperty(exports, "prepareHeaders", { enumerable: true, get: function () { return index_js_1.prepareHeaders; } });

package/dist/lib/utils/session.d.ts

@@ -13,7 +13,5 @@ export function normalizeShopifyId(shopifyData?: any): {
     entity_type?: string | undefined;
     id?: string | undefined;
 };
-export function getShopifyHelpers(serverRuntimeConfig?: any, config?: any, { storage: _storage }?: {
-    storage?: import("../../storage/index.js").SessionStorage;
-}): Promise<import("./types.js").ShopifyHelpers>;
-export function prepareHeaders(serverRuntimeConfig?: any): ({ generateReplacements, appData, shop, appId, headers: _headers, }?: any) => Promise<any>;
+export function getShopifyHelpers(serverRuntimeConfig?: any, config?: any, { storage: _storage }?: import("../../shared/index.js").StorageOptions): Promise<import("./types.js").ShopifyHelpers>;
+export function prepareHeaders(serverRuntimeConfig?: any, options?: import("../../shared/index.js").StorageOptions): ({ generateReplacements, appData, shop, appId, headers: _headers, }?: any) => Promise<any>;

package/dist/lib/utils/session.js

@@ -15,7 +15,7 @@ exports.prepareHeaders = exports.getShopifyHelpers = exports.normalizeShopifyId
 const js_base64_1 = require("js-base64");
 const shopify_api_1 = require("@shopify/shopify-api");
 const index_js_1 = require("../../shared/index.js");
-const index_js_2 = require("../../storage/index.js");
+const index_js_2 = require("../../shared/index.js");
 const billing_js_1 = require("./billing.js");
 const headers_js_1 = require("./headers.js");
 const shopify_js_1 = require("./shopify.js");
@@ -78,39 +78,26 @@ const prepareSessionPayload = (session) => {
     const _b = _onlineAccessInfo !== null && _onlineAccessInfo !== void 0 ? _onlineAccessInfo : {}, { associated_user } = _b, onlineAccessInfo = __rest(_b, ["associated_user"]);
     return Object.assign({ onlineAccessInfo }, sessionData);
 };
-// NOTE: imported lazily so an app that supplies its own storage never loads firebase-admin,
-// even though it is still the default. PR 4 removes this branch and the peer with it.
-/**
- * @param {any} firebaseConfig
- * @param {any} options
- */
-const createDefaultStorage = async (firebaseConfig, options) => {
-    const { createFirestoreStorage } = await import('../../storage/firestore/index.js');
-    return createFirestoreStorage(firebaseConfig, options);
-};
 // TODO: move to curry??
 /**
  * @param {any} [serverRuntimeConfig]
  * @param {any} [config]
- * @param {{ storage?: import('../../storage/index.js').SessionStorage }} [options]
- *   `storage` defaults to the Firestore implementation, which is the only reason this package
- *   still declares firebase-admin.
+ * @param {import('../../shared/index.js').StorageOptions} options
+ *   ⚠️ `storage` is REQUIRED. There is no bundled implementation to fall back to, so omitting it
+ *   throws here rather than quietly writing sessions somewhere this app does not own.
  * @returns {Promise<import('./types.js').ShopifyHelpers>}
  */
 const getShopifyHelpers = async (serverRuntimeConfig, config, { storage: _storage } = {}) => {
     var _a, _b;
     const shopify = (0, shopify_js_1.getInitializedShopify)(serverRuntimeConfig);
-    const { APP_ID, FB_CONFIG, FB_ROOT_COLLECTION, SHOPIFY_RUN_MODE, SESSION_CONFIG, PAYMENT_CONFIG, } = serverRuntimeConfig;
+    const { SHOPIFY_RUN_MODE, SESSION_CONFIG, PAYMENT_CONFIG, } = serverRuntimeConfig;
     const { shop } = config !== null && config !== void 0 ? config : {};
     const isReviewMode = (0, index_js_1.isTrue)((SHOPIFY_RUN_MODE === 'review') &&
         (PAYMENT_CONFIG === null || PAYMENT_CONFIG === void 0 ? void 0 : PAYMENT_CONFIG.required));
     // TODO: should this use our helper instead (and/or as a fallback)??
     const shopId = (_b = (_a = shopify === null || shopify === void 0 ? void 0 : shopify.utils) === null || _a === void 0 ? void 0 : _a.sanitizeShop) === null || _b === void 0 ? void 0 : _b.call(_a, shop);
     const cryptoHandler = crypto_js_1.CryptoHandler.getInstance(SESSION_CONFIG);
-    const storage = (0, index_js_2.ensureStorage)(_storage !== null && _storage !== void 0 ? _storage : await createDefaultStorage(FB_CONFIG, {
-        collection: FB_ROOT_COLLECTION,
-        configurationId: APP_ID,
-    }));
+    const storage = (0, index_js_2.ensureStorage)(_storage);
     // NOTE: this should handle running in next to test non-shopify functionality
     if (!shopify) {
         return {
@@ -236,6 +223,9 @@ const getShopifyHelpers = async (serverRuntimeConfig, config, { storage: _storag
             rawRequest: req,
             rawResponse: res,
         });
+        // NOTE: the core is the only thing allowed to interpret a stored session. The contract types
+        // these payloads as `unknown` so an implementation cannot read them, which makes this the one
+        // deliberate exception rather than a hole left open for everyone.
         // eslint-disable-next-line @typescript-eslint/no-unused-vars
         const _c = (_b = (await storage.loadSession(shopId, sessionId))) !== null && _b !== void 0 ? _b : {}, { accessToken: encryptedOnlineAccessToken } = _c, storedOnlineSession = __rest(_c, ["accessToken"]);
         let session = storedOnlineSession;
@@ -263,6 +253,9 @@ const getShopifyHelpers = async (serverRuntimeConfig, config, { storage: _storag
     const verifyOfflineSession = async () => {
         var _a;
         const sessionId = shopify.session.getOfflineId(shop);
+        // NOTE: the core is the only thing allowed to interpret a stored session. The contract types
+        // these payloads as `unknown` so an implementation cannot read them, which makes this the one
+        // deliberate exception rather than a hole left open for everyone.
         const _b = (_a = (await storage.loadSession(shopId, sessionId))) !== null && _a !== void 0 ? _a : {}, { accessToken: encryptedOfflineAccessToken } = _b, offlineSession = __rest(_b, ["accessToken"]);
         return {
             sessionId,
@@ -448,14 +441,17 @@ const extendAppHeaders = (headers, appData) => {
         [`x-shopify-app-metafield-${metafieldKey}`]: value,
     })), headers);
 };
-/** @param {any} [serverRuntimeConfig] */
-const prepareHeaders = (serverRuntimeConfig) => async ({ generateReplacements, appData, shop, appId, headers: _headers, } = /** @type {any} */ ({})) => {
+/**
+ * @param {any} [serverRuntimeConfig]
+ * @param {import('../../shared/index.js').StorageOptions} [options]
+ */
+const prepareHeaders = (serverRuntimeConfig, options) => async ({ generateReplacements, appData, shop, appId, headers: _headers, } = /** @type {any} */ ({})) => {
     const headers = (0, index_js_1.cleanObject)(_headers, false, index_js_1.stringEmptyOnly);
     if ((0, index_js_1.objectEmpty)(headers) || !generateReplacements) {
         return headers;
     }
     if (!appData) {
-        const { loadAppData } = await (0, exports.getShopifyHelpers)(serverRuntimeConfig, { shop });
+        const { loadAppData } = await (0, exports.getShopifyHelpers)(serverRuntimeConfig, { shop }, options);
         appData = await loadAppData({ appId }); // NOTE: this handles even if no appId
     }
     if (!appData) {

package/dist/lib/utils/types.d.ts

@@ -1,8 +1,12 @@
 import type { GraphqlClient, Session, Shopify } from '@shopify/shopify-api';
+import type { ShopId, StoredState } from '../../shared/types.js';
+export type SessionData = {
+    id: string;
+} & Record<string, unknown>;
 export interface AppData {
-    appMetafields: any;
-    appInfo: any;
-    appInstallation: any;
+    appInstallation: Record<string, unknown>;
+    appMetafields: Record<string, unknown>;
+    appInfo: Record<string, unknown>;
 }
 export interface ShopifyHelpersBypassed {
     shopify: undefined;
@@ -40,19 +44,19 @@ export interface ShopifyHelpersActive {
             session: Session;
         };
     }>;
-    encryptData: (value?: unknown) => any;
-    decryptData: (encrypted: unknown, params?: unknown) => any;
+    encryptData: (value?: unknown) => string;
+    decryptData: (encrypted: unknown, params?: unknown) => unknown;
     loadAppData: (params?: unknown) => Promise<AppData>;
-    loadData: () => Promise<any>;
-    loadSecureData: () => Promise<any>;
-    loadSession: (params?: unknown) => Promise<any>;
-    storeSession: (session?: unknown) => Promise<any>;
-    ensureBilling: (session: unknown, params?: unknown) => Promise<any>;
-    loadState: () => Promise<any>;
-    storeState: (state: unknown) => Promise<any>;
-    deleteState: () => Promise<any>;
-    updateSession: (sessionId: unknown, data: unknown) => Promise<any>;
-    deleteSessions: (sessionIds: unknown) => Promise<any[]>;
-    findSessionIds: (shop: unknown) => Promise<string[]>;
+    loadData: () => Promise<SessionData>;
+    loadSecureData: () => Promise<SessionData>;
+    loadSession: (params?: unknown) => Promise<SessionData>;
+    storeSession: (session?: unknown) => Promise<unknown>;
+    ensureBilling: (session: unknown, params?: unknown) => Promise<string | undefined>;
+    loadState: () => Promise<StoredState | undefined>;
+    storeState: (state: StoredState) => Promise<unknown>;
+    deleteState: () => Promise<unknown>;
+    updateSession: (sessionId: string, data?: Record<string, unknown>) => Promise<unknown>;
+    deleteSessions: (sessionIds: string[]) => Promise<unknown>;
+    findSessionIds: (shop: ShopId) => Promise<string[]>;
 }
 export type ShopifyHelpers = ShopifyHelpersBypassed | ShopifyHelpersActive;

package/dist/shared/index.d.ts

@@ -5,5 +5,7 @@ export * from './errors.js';
 export * from './graph.js';
 export * from './match.js';
 export * from './shopify.js';
+export * from './storage.js';
+export * from './types.js';
 export * from './theme.js';
 export * from './uuid.js';

package/dist/shared/index.js

@@ -21,5 +21,7 @@ __exportStar(require("./errors.js"), exports);
 __exportStar(require("./graph.js"), exports);
 __exportStar(require("./match.js"), exports);
 __exportStar(require("./shopify.js"), exports);
+__exportStar(require("./storage.js"), exports);
+__exportStar(require("./types.js"), exports);
 __exportStar(require("./theme.js"), exports);
 __exportStar(require("./uuid.js"), exports);

package/dist/shared/storage.d.ts

@@ -0,0 +1,2 @@
+export const STORAGE_METHODS: string[];
+export function ensureStorage(storage: unknown): import("./types.js").SessionStorage;

package/dist/shared/storage.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureStorage = exports.STORAGE_METHODS = void 0;
+const display_js_1 = require("./display.js");
+exports.STORAGE_METHODS = [
+    'loadState',
+    'storeState',
+    'deleteState',
+    'loadSession',
+    'updateSession',
+    'deleteSessions',
+    'findSessionIds'
+];
+/**
+ * Fails at composition rather than at the first OAuth round-trip. Nothing automated covers the
+ * Shopify auth flow, so a missing method would otherwise surface as a runtime TypeError in a
+ * callback that needs a real dev store to reach.
+ *
+ * ⚠️ Takes `unknown` on purpose. Whether this is a SessionStorage is what the function decides,
+ * so the argument cannot be typed as one, and `any` would let the body use it before checking.
+ *
+ * @param {unknown} storage
+ * @returns {import('./types.js').SessionStorage}
+ */
+const ensureStorage = (storage) => {
+    const candidate = /** @type {Record<string, unknown> | null | undefined} */ (storage);
+    // ⚠️ the upgrade path, called out separately: this package used to bundle a firestore store and
+    // fall back to it. Listing all seven methods as missing would be true and would not explain why.
+    if (!candidate) {
+        throw new Error('No session storage supplied. Pass one as `storage` - this package no longer bundles a default.');
+    }
+    const missing = (0, display_js_1.ensureArray)(exports.STORAGE_METHODS).filter((method) => (typeof (candidate === null || candidate === void 0 ? void 0 : candidate[method]) !== 'function'));
+    if (missing.length) {
+        throw new Error(`Invalid session storage, missing: ${missing.join(', ')}`);
+    }
+    // the one place the assertion is earned: every method is present, so it is a SessionStorage
+    return /** @type {import('./types.js').SessionStorage} */ (storage);
+};
+exports.ensureStorage = ensureStorage;

package/dist/shared/types.d.ts

@@ -1 +1,72 @@
-export {};
+/**
+ * Shop and session ids are nullable: `sanitizeShop` returns null for anything it does not
+ * recognise, and the core forwards that rather than guarding.
+ */
+export type ShopId = string | null | undefined;
+/** A session id, as shopify's own `getCurrentId` and `getOfflineId` produce it. */
+export type SessionId = string | null | undefined;
+/**
+ * A stored session as it comes back out. Every value is opaque: it is whatever was persisted,
+ * still encrypted, and only the core knows how to read it.
+ */
+export type StoredSession = Record<string, unknown>;
+/**
+ * A session going in. Addressed by `id`, which is the only field an implementation may read;
+ * everything else is opaque payload.
+ */
+export type SessionRecord = {
+    id: string;
+} & Record<string, unknown>;
+/**
+ * Consumer-owned state, stored verbatim.
+ *
+ * ⚠️ Opaque to an IMPLEMENTATION, which must persist and return it untouched, but not opaque to
+ * the consumer, who wrote it and reads its fields back. That is why this is a record of unknowns
+ * rather than `unknown`: the property access is theirs to make, the interpretation is not ours.
+ *
+ * A record rather than anything at all because every store here writes it as a document. A string
+ * or a number would compile and then fail at the driver.
+ */
+export type StoredState = Record<string, unknown>;
+/**
+ * What the session layer needs from a store. Two entities, sessions and state, both scoped to a
+ * shop. This package ships no implementation: an app owns where its sessions live and passes
+ * one in.
+ *
+ * ⚠️ Values arrive ALREADY ENCRYPTED and already stripped of anything that must not be persisted.
+ * An implementation stores and returns what it is handed - it must not inspect, reshape or
+ * re-encrypt, or the core's crypto and DPA guarantees stop holding. That is why the payloads are
+ * `unknown` rather than `any`: `unknown` is the type that refuses to be read without a cast, so
+ * the contract is the annotation rather than a comment beside it.
+ *
+ * ⚠️ The four writes return `unknown` because no caller in the core reads them. Returning the
+ * stored document is welcome, but nothing may depend on it. The two reads are typed, because
+ * their results are the point of calling them.
+ */
+export interface SessionStorage {
+    /** `undefined` for a session that is not there, which is ordinary rather than exceptional. */
+    loadSession: (shopId: ShopId, sessionId: SessionId) => Promise<StoredSession | undefined>;
+    /**
+     * MERGES into the stored session. The core writes partial sessions, so a replacing write would
+     * silently drop fields it did not send.
+     */
+    updateSession: (shopId: ShopId, session: SessionRecord) => Promise<unknown>;
+    deleteSessions: (shopId: ShopId, sessionIds: string[]) => Promise<unknown>;
+    /** `[]` rather than an error for an unknown shop - that is what an initial install looks like. */
+    findSessionIds: (shopId: ShopId) => Promise<string[]>;
+    /** `undefined` for a shop with no state, which is ordinary rather than exceptional. */
+    loadState: (shop: ShopId) => Promise<StoredState | undefined>;
+    storeState: (shop: ShopId, state: StoredState) => Promise<unknown>;
+    deleteState: (shop: ShopId) => Promise<unknown>;
+}
+/**
+ * The trailing options every handler factory takes. `storage` defaults to the bundled Firestore
+ * implementation, so an app that passes nothing keeps today's behaviour.
+ *
+ * ⚠️ This cannot travel through `serverRuntimeConfig`. Next serialises that bag to
+ * `run-config.json` at build time and the Netlify runtime re-stringifies it into
+ * `__NEXT_PRIVATE_STANDALONE_CONFIG`, so a function on it is dropped without an error.
+ */
+export interface StorageOptions {
+    storage?: SessionStorage;
+}

package/dist/shared/types.js

@@ -1,2 +1,4 @@
 "use strict";
+// The session-storage contract. Types rather than JSDoc typedefs because that is nearly all this
+// is, and because tsc preserves JSDoc into the emitted JavaScript, where none of it belongs.
 Object.defineProperty(exports, "__esModule", { value: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agnostack/next-shopify",
-  "version": "4.0.0-canary.8",
+  "version": "4.0.0",
   "author": "agnoStack Dev <developers@agnostack.com> (https://agnostack.com)",
   "owner": "agnoStack",
   "description": "Please contact agnoStack via info@agnostack.com for any questions",
@@ -39,28 +39,6 @@
       "import": "./dist/esm/lib/index.js",
       "default": "./dist/esm/lib/index.js"
     },
-    "./storage": {
-      "types": "./dist/storage/index.d.ts",
-      "require": "./dist/storage/index.js",
-      "import": "./dist/storage/index.js",
-      "default": "./dist/storage/index.js"
-    },
-    "./storage/esm": {
-      "types": "./dist/storage/index.d.ts",
-      "import": "./dist/esm/storage/index.js",
-      "default": "./dist/esm/storage/index.js"
-    },
-    "./storage/firestore": {
-      "types": "./dist/storage/firestore/index.d.ts",
-      "require": "./dist/storage/firestore/index.js",
-      "import": "./dist/storage/firestore/index.js",
-      "default": "./dist/storage/firestore/index.js"
-    },
-    "./storage/firestore/esm": {
-      "types": "./dist/storage/firestore/index.d.ts",
-      "import": "./dist/esm/storage/firestore/index.js",
-      "default": "./dist/esm/storage/firestore/index.js"
-    },
     "./runtime": {
       "types": "./dist/runtime/index.d.ts",
       "require": "./dist/runtime/index.js",
@@ -134,9 +112,9 @@
     "uuid": "11.1.1"
   },
   "devDependencies": {
-    "@agnostack/env": "canary",
-    "@agnostack/next-plugins": "canary",
-    "@agnostack/verifyd": "canary",
+    "@agnostack/env": "latest",
+    "@agnostack/next-plugins": "latest",
+    "@agnostack/verifyd": "latest",
     "@commitlint/cli": "21.x",
     "@commitlint/config-conventional": "21.x",
     "@eslint/js": "9.x",
@@ -152,7 +130,6 @@
     "@typescript-eslint/parser": "8.x",
     "eslint": "9.x",
     "eslint-plugin-import": "2.x",
-    "firebase-admin": "14.x",
     "globals": "16.x",
     "http-proxy": "1.18.x",
     "husky": "9.x",
@@ -166,7 +143,6 @@
     "@agnostack/env": "*",
     "@agnostack/next-plugins": "*",
     "@agnostack/verifyd": "*",
-    "firebase-admin": ">=10.0.0",
     "http-proxy": ">=1.18.1",
     "next": ">=15.0.0",
     "react": ">=18.0.0",
@@ -175,9 +151,6 @@
     "prompts": ">=2.4.0"
   },
   "peerDependenciesMeta": {
-    "firebase-admin": {
-      "optional": true
-    },
     "next": {
       "optional": true
     },

package/dist/esm/storage/firestore/index.js

@@ -1,77 +0,0 @@
-import { cert, getApp, getApps, initializeApp } from 'firebase-admin/app';
-import { getFirestore } from 'firebase-admin/firestore';
-import { ensureArray, stringEmpty, objectNotEmpty, COLLECTION_ROOT, STATE_PREFIX, } from '../../shared/index.js';
-// firebase-admin allows one app per process, so an existing one is reused rather than replaced.
-// NOTE: the retired handler also passed `databaseURL`, which configures the Realtime Database.
-// Nothing here has ever used it - no `getDatabase`, no `firebase-admin/database` import.
-/** @param {any} firebaseConfig */
-const initializeFirebaseApp = (firebaseConfig) => (getApps().length
-    ? getApp()
-    : initializeApp({ credential: cert(firebaseConfig) }));
-/**
- * The Firestore implementation of the session-storage contract, kept here so the core never
- * imports firebase-admin. Sessions and state share one collection per shop; state is a single
- * document per shop, prefixed so it cannot collide with a session id.
- *
- * @param {any} firebaseConfig  a firebase service-account config
- * @param {{ collection?: string, configurationId: string }} options
- * @returns {import('../index.js').SessionStorage}
- */
-export const createFirestoreStorage = (firebaseConfig, { collection = COLLECTION_ROOT, configurationId }) => {
-    if (!objectNotEmpty(firebaseConfig)) {
-        throw new Error('createFirestoreStorage requires a firebase service-account config');
-    }
-    const firestore = getFirestore(initializeFirebaseApp(firebaseConfig));
-    /** @param {any} shop */
-    const shopCollection = (shop) => (firestore
-        .collection(collection)
-        .doc(shop)
-        .collection(configurationId));
-    /** @param {any} shop */
-    const stateRef = (shop) => shopCollection(shop).doc(`${STATE_PREFIX}${shop}`);
-    /** @param {any} docRef */
-    const readDocument = async (docRef) => {
-        const document = await docRef.get();
-        return document.exists ? document.data() : undefined;
-    };
-    /** @type {import('../index.js').SessionStorage} */
-    const storage = {
-        loadSession: async (shopId, sessionId) => (stringEmpty(sessionId)
-            ? undefined
-            : readDocument(shopCollection(shopId).doc(`${sessionId}`))),
-        // NOTE: merge rather than replace. The core writes partial sessions - a billing status
-        // update carries no access token - and a replacing write would drop the rest.
-        updateSession: async (shopId, session) => {
-            const docRef = shopCollection(shopId).doc(session.id);
-            await docRef.set(session, { merge: true });
-            return readDocument(docRef);
-        },
-        deleteSessions: async (shopId, sessionIds) => {
-            const collectionRef = shopCollection(shopId);
-            return Promise.all(ensureArray(sessionIds).map((sessionId) => collectionRef.doc(sessionId).delete()));
-        },
-        findSessionIds: async (shopId) => {
-            // NOTE: empty rather than an error - this is the state on an initial install
-            if (stringEmpty(shopId)) {
-                return [];
-            }
-            const documents = await shopCollection(shopId).get();
-            return documents.docs.map((/** @type {any} */ { id }) => id);
-        },
-        loadState: async (shop) => (stringEmpty(shop)
-            ? undefined
-            : readDocument(stateRef(shop))),
-        storeState: async (shop, state) => {
-            if (stringEmpty(shop)) {
-                return undefined;
-            }
-            const docRef = stateRef(shop);
-            await docRef.set(state);
-            return readDocument(docRef);
-        },
-        deleteState: async (shop) => (stringEmpty(shop)
-            ? undefined
-            : stateRef(shop).delete()),
-    };
-    return storage;
-};

package/dist/esm/storage/index.js

@@ -1,54 +0,0 @@
-import { ensureArray } from '../shared/index.js';
-/**
- * Shop and session ids are nullable: `sanitizeShop` returns null for anything it does not
- * recognise, and the core forwards that rather than guarding.
- *
- * @typedef {string | null | undefined} ShopId
- */
-/**
- * What the session layer needs from a store. Two entities, sessions and state, both scoped to a
- * shop. Nothing here is Firestore-specific: `@agnostack/next-shopify/firestore` is one
- * implementation, and an app can supply its own.
- *
- * ⚠️ Values arrive ALREADY ENCRYPTED and already stripped of anything that must not be persisted.
- * An implementation stores and returns what it is handed - it must not inspect, reshape or
- * re-encrypt, or the core's crypto and DPA guarantees stop holding.
- *
- * ⚠️ `findSessionIds` returns `[]` rather than erroring for an unknown shop - that is what an
- * initial install looks like.
- *
- * @typedef {object} SessionStorage
- * @property {(shopId: ShopId, sessionId: ShopId) => Promise<any>} loadSession
- * @property {(shopId: ShopId, session: any) => Promise<any>} updateSession
- *   MERGES into the stored session. The core writes partial sessions, so a replacing write
- *   would silently drop fields it did not send.
- * @property {(shopId: ShopId, sessionIds: any) => Promise<any>} deleteSessions
- * @property {(shopId: ShopId) => Promise<string[]>} findSessionIds
- * @property {(shop: ShopId) => Promise<any>} loadState
- * @property {(shop: ShopId, state: any) => Promise<any>} storeState
- * @property {(shop: ShopId) => Promise<any>} deleteState
- */
-export const STORAGE_METHODS = [
-    'loadState',
-    'storeState',
-    'deleteState',
-    'loadSession',
-    'updateSession',
-    'deleteSessions',
-    'findSessionIds'
-];
-/**
- * Fails at composition rather than at the first OAuth round-trip. Nothing automated covers the
- * Shopify auth flow, so a missing method would otherwise surface as a runtime TypeError in a
- * callback that needs a real dev store to reach.
- *
- * @param {any} storage
- * @returns {SessionStorage}
- */
-export const ensureStorage = (storage) => {
-    const missing = ensureArray(STORAGE_METHODS).filter((method) => (typeof (storage === null || storage === void 0 ? void 0 : storage[method]) !== 'function'));
-    if (missing.length) {
-        throw new Error(`Invalid session storage, missing: ${missing.join(', ')}`);
-    }
-    return storage;
-};

package/dist/storage/firestore/index.d.ts

@@ -1,4 +0,0 @@
-export function createFirestoreStorage(firebaseConfig: any, { collection, configurationId }: {
-    collection?: string;
-    configurationId: string;
-}): import("../index.js").SessionStorage;

package/dist/storage/firestore/index.js

@@ -1,81 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createFirestoreStorage = void 0;
-const app_1 = require("firebase-admin/app");
-const firestore_1 = require("firebase-admin/firestore");
-const index_js_1 = require("../../shared/index.js");
-// firebase-admin allows one app per process, so an existing one is reused rather than replaced.
-// NOTE: the retired handler also passed `databaseURL`, which configures the Realtime Database.
-// Nothing here has ever used it - no `getDatabase`, no `firebase-admin/database` import.
-/** @param {any} firebaseConfig */
-const initializeFirebaseApp = (firebaseConfig) => ((0, app_1.getApps)().length
-    ? (0, app_1.getApp)()
-    : (0, app_1.initializeApp)({ credential: (0, app_1.cert)(firebaseConfig) }));
-/**
- * The Firestore implementation of the session-storage contract, kept here so the core never
- * imports firebase-admin. Sessions and state share one collection per shop; state is a single
- * document per shop, prefixed so it cannot collide with a session id.
- *
- * @param {any} firebaseConfig  a firebase service-account config
- * @param {{ collection?: string, configurationId: string }} options
- * @returns {import('../index.js').SessionStorage}
- */
-const createFirestoreStorage = (firebaseConfig, { collection = index_js_1.COLLECTION_ROOT, configurationId }) => {
-    if (!(0, index_js_1.objectNotEmpty)(firebaseConfig)) {
-        throw new Error('createFirestoreStorage requires a firebase service-account config');
-    }
-    const firestore = (0, firestore_1.getFirestore)(initializeFirebaseApp(firebaseConfig));
-    /** @param {any} shop */
-    const shopCollection = (shop) => (firestore
-        .collection(collection)
-        .doc(shop)
-        .collection(configurationId));
-    /** @param {any} shop */
-    const stateRef = (shop) => shopCollection(shop).doc(`${index_js_1.STATE_PREFIX}${shop}`);
-    /** @param {any} docRef */
-    const readDocument = async (docRef) => {
-        const document = await docRef.get();
-        return document.exists ? document.data() : undefined;
-    };
-    /** @type {import('../index.js').SessionStorage} */
-    const storage = {
-        loadSession: async (shopId, sessionId) => ((0, index_js_1.stringEmpty)(sessionId)
-            ? undefined
-            : readDocument(shopCollection(shopId).doc(`${sessionId}`))),
-        // NOTE: merge rather than replace. The core writes partial sessions - a billing status
-        // update carries no access token - and a replacing write would drop the rest.
-        updateSession: async (shopId, session) => {
-            const docRef = shopCollection(shopId).doc(session.id);
-            await docRef.set(session, { merge: true });
-            return readDocument(docRef);
-        },
-        deleteSessions: async (shopId, sessionIds) => {
-            const collectionRef = shopCollection(shopId);
-            return Promise.all((0, index_js_1.ensureArray)(sessionIds).map((sessionId) => collectionRef.doc(sessionId).delete()));
-        },
-        findSessionIds: async (shopId) => {
-            // NOTE: empty rather than an error - this is the state on an initial install
-            if ((0, index_js_1.stringEmpty)(shopId)) {
-                return [];
-            }
-            const documents = await shopCollection(shopId).get();
-            return documents.docs.map((/** @type {any} */ { id }) => id);
-        },
-        loadState: async (shop) => ((0, index_js_1.stringEmpty)(shop)
-            ? undefined
-            : readDocument(stateRef(shop))),
-        storeState: async (shop, state) => {
-            if ((0, index_js_1.stringEmpty)(shop)) {
-                return undefined;
-            }
-            const docRef = stateRef(shop);
-            await docRef.set(state);
-            return readDocument(docRef);
-        },
-        deleteState: async (shop) => ((0, index_js_1.stringEmpty)(shop)
-            ? undefined
-            : stateRef(shop).delete()),
-    };
-    return storage;
-};
-exports.createFirestoreStorage = createFirestoreStorage;