@catandbox/schrodinger-web-adapter 0.1.27 → 0.1.32

package/dist/client/ticket-list.js

@@ -1,5 +1,169 @@
 import { renderStatusBadge } from "./status-badge";
 import { setInnerHtml } from "./dom-utils";
+function loadThree() {
+    return new Promise((resolve, reject) => {
+        if (typeof THREE !== "undefined") {
+            resolve();
+            return;
+        }
+        const s = document.createElement("script");
+        s.src = "https://cdnjs.cloudflare.com/ajax/libs/three.js/r128/three.min.js";
+        s.onload = () => resolve();
+        s.onerror = reject;
+        document.head.appendChild(s);
+    });
+}
+function initHydrogenLogo(el) {
+    // Math helpers
+    function factorial(n) {
+        let r = 1;
+        for (let i = 2; i <= n; i++)
+            r *= i;
+        return r;
+    }
+    function assocLaguerre(p, q, x) {
+        if (p === 0)
+            return 1;
+        if (p === 1)
+            return 1 + q - x;
+        let lm2 = 1, lm1 = 1 + q - x, val = 0;
+        for (let k = 2; k <= p; k++) {
+            val = ((2 * k - 1 + q - x) * lm1 - (k - 1 + q) * lm2) / k;
+            lm2 = lm1;
+            lm1 = val;
+        }
+        return val;
+    }
+    function assocLegendre(l, m, x) {
+        let pmm = 1.0;
+        if (m > 0) {
+            const s = Math.sqrt((1 - x) * (1 + x));
+            let f = 1;
+            for (let i = 1; i <= m; i++) {
+                pmm *= -f * s;
+                f += 2;
+            }
+        }
+        if (l === m)
+            return pmm;
+        let pmmp1 = x * (2 * m + 1) * pmm;
+        if (l === m + 1)
+            return pmmp1;
+        let pll = 0;
+        for (let ll = m + 2; ll <= l; ll++) {
+            pll = (x * (2 * ll - 1) * pmmp1 - (ll + m - 1) * pmm) / (ll - m);
+            pmm = pmmp1;
+            pmmp1 = pll;
+        }
+        return pll;
+    }
+    function sphericalHarmonicReal(l, m, theta, phi) {
+        const absM = Math.abs(m);
+        const norm = Math.sqrt(((2 * l + 1) / (4 * Math.PI)) * (factorial(l - absM) / factorial(l + absM)));
+        const plm = assocLegendre(l, absM, Math.cos(theta));
+        if (m > 0)
+            return norm * plm * Math.cos(m * phi) * Math.SQRT2;
+        if (m < 0)
+            return norm * plm * Math.sin(absM * phi) * Math.SQRT2;
+        return norm * plm;
+    }
+    function radialWaveFunction(n, l, r) {
+        const rho = (2 * r) / n;
+        const norm = Math.sqrt(Math.pow(2 / n, 3) * factorial(n - l - 1) / (2 * n * Math.pow(factorial(n + l), 3)));
+        return norm * Math.exp(-rho / 2) * Math.pow(rho, l) * assocLaguerre(n - l - 1, 2 * l + 1, rho);
+    }
+    function psiProb(n, l, m, r, theta, phi) {
+        const R = radialWaveFunction(n, l, r);
+        const Y = sphericalHarmonicReal(l, m, theta, phi);
+        return R * R * Y * Y;
+    }
+    // Generate points via rejection sampling
+    const n = 4, l = 3, m = 1, maxR = 45, numPoints = 80000;
+    let maxProb = 0;
+    for (let i = 0; i < 5000; i++) {
+        const r = Math.random() * maxR;
+        const theta = Math.acos(2 * Math.random() - 1);
+        const phi = Math.random() * 2 * Math.PI;
+        const p = psiProb(n, l, m, r, theta, phi) * r * r;
+        if (p > maxProb)
+            maxProb = p;
+    }
+    const pts = [], cols = [], szs = [];
+    let accepted = 0;
+    const sc = 0.7;
+    for (let i = 0; i < numPoints * 30 && accepted < numPoints; i++) {
+        const r = Math.random() * maxR;
+        const theta = Math.acos(2 * Math.random() - 1);
+        const phi = Math.random() * 2 * Math.PI;
+        const prob = psiProb(n, l, m, r, theta, phi) * r * r;
+        const thr = prob / maxProb;
+        if (Math.random() < thr) {
+            pts.push(r * Math.sin(theta) * Math.cos(phi) * sc, r * Math.sin(theta) * Math.sin(phi) * sc, r * Math.cos(theta) * sc);
+            const t = r / maxR;
+            cols.push(0.3 + 0.6 * t, 0.5 * (1 - t) + 0.2 * t, 0.95 - 0.2 * t);
+            szs.push(0.08 + 0.15 * thr);
+            accepted++;
+        }
+    }
+    const scene = new THREE.Scene();
+    const camera = new THREE.PerspectiveCamera(50, 1, 0.1, 1000);
+    const renderer = new THREE.WebGLRenderer({ antialias: true, alpha: true });
+    renderer.setPixelRatio(Math.min(window.devicePixelRatio, 2));
+    renderer.setSize(80, 80);
+    renderer.setClearColor(0x08090d, 1);
+    el.appendChild(renderer.domElement);
+    const geometry = new THREE.BufferGeometry();
+    geometry.setAttribute("position", new THREE.Float32BufferAttribute(pts, 3));
+    geometry.setAttribute("color", new THREE.Float32BufferAttribute(cols, 3));
+    geometry.setAttribute("size", new THREE.Float32BufferAttribute(szs, 1));
+    const material = new THREE.ShaderMaterial({
+        vertexShader: `
+      attribute float size;
+      varying vec3 vColor;
+      void main() {
+        vColor = color;
+        vec4 mv = modelViewMatrix * vec4(position, 1.0);
+        gl_PointSize = size * (200.0 / -mv.z);
+        gl_Position = projectionMatrix * mv;
+      }
+    `,
+        fragmentShader: `
+      varying vec3 vColor;
+      void main() {
+        float d = length(gl_PointCoord - vec2(0.5));
+        if (d > 0.5) discard;
+        float a = smoothstep(0.5, 0.1, d) * 0.7;
+        gl_FragColor = vec4(vColor, a);
+      }
+    `,
+        vertexColors: true,
+        transparent: true,
+        depthWrite: false,
+        blending: THREE.AdditiveBlending,
+    });
+    scene.add(new THREE.Points(geometry, material));
+    const nucGeo = new THREE.SphereGeometry(0.25, 12, 12);
+    scene.add(new THREE.Mesh(nucGeo, new THREE.MeshBasicMaterial({ color: 0xffffff })));
+    let theta = 0;
+    const phi = 0.85, radius = 42;
+    function updateCam() {
+        camera.position.set(radius * Math.sin(phi) * Math.sin(theta), radius * Math.cos(phi), radius * Math.sin(phi) * Math.cos(theta));
+        camera.lookAt(0, 0, 0);
+    }
+    let rafId;
+    function animate() {
+        rafId = requestAnimationFrame(animate);
+        theta += 0.003;
+        updateCam();
+        renderer.render(scene, camera);
+    }
+    updateCam();
+    animate();
+    return () => {
+        cancelAnimationFrame(rafId);
+        renderer.dispose();
+    };
+}
 function formatDate(timestamp) {
     return new Date(timestamp * 1000).toLocaleDateString(undefined, {
         month: "short",
@@ -35,10 +199,11 @@ const ORDER_OPTIONS = [
     { value: "oldest", label: "Oldest first" }
 ];
 export async function renderTicketList(container, client, emitter) {
-    // Load tickets and categories in parallel
+    // Load tickets, categories and Three.js in parallel
     const [result, portalConfig] = await Promise.all([
         client.listTickets({}).catch(() => ({ items: [] })),
-        client.getPortalConfig().catch(() => ({ categories: [], aliases: [] }))
+        client.getPortalConfig().catch(() => ({ categories: [], aliases: [] })),
+        loadThree().catch(() => { })
     ]);
     const allTickets = result.items;
     const categories = portalConfig.categories;
@@ -57,10 +222,10 @@ export async function renderTicketList(container, client, emitter) {
       <s-box padding="large">
         <s-stack gap="large">
           <div style="display:flex; justify-content:space-between; align-items:center;">
-            <s-stack gap="extraTight">
-              <s-text variant="headingMd">Support Tickets</s-text>
-              <s-text variant="bodySm" tone="subdued">View and manage your support requests</s-text>
-            </s-stack>
+            <div style="display:flex; align-items:center; gap:12px;">
+              <div id="sch-logo-el" style="width:80px; height:80px; border-radius:8px; overflow:hidden; flex-shrink:0; background:#08090d;"></div>
+              <span style="font-size:18px; font-weight:700; color:#0f172a;">Schrödinger helpdesk by Cat and box</span>
+            </div>
             <s-button variant="primary" id="sch-new-ticket-btn">
               <span style="display:inline-flex; align-items:center; gap:4px;">
                 <svg width="16" height="16" viewBox="0 0 20 20" fill="currentColor"><path d="M10 3a1 1 0 0 1 1 1v5h5a1 1 0 1 1 0 2h-5v5a1 1 0 1 1-2 0v-5H4a1 1 0 1 1 0-2h5V4a1 1 0 0 1 1-1z"/></svg>
@@ -96,6 +261,11 @@ export async function renderTicketList(container, client, emitter) {
     container
         .querySelector("#sch-new-ticket-btn")
         ?.addEventListener("click", () => emitter.emit("ticket:create", undefined));
+    // Init hydrogen orbital logo
+    const logoEl = container.querySelector("#sch-logo-el");
+    if (logoEl && typeof THREE !== "undefined") {
+        initHydrogenLogo(logoEl);
+    }
     function getSelectValue(id) {
         const el = container.querySelector(`#${id}`);
         return el?.value ?? "";

package/dist/server/index.d.ts

@@ -1,6 +1,4 @@
-/**
- * Server-side exports — re-exported from the React adapter's server module.
- * These are already framework-agnostic (no React dependency).
- */
-export type { AdapterEnvironment, PrincipalContext, ProxyHandlerOptions, ShopifySessionVerificationOptions, WebhookForwardingOptions } from "@catandbox/schrodinger-shopify-adapter/server";
-export { ShopifyAuthError, createPrincipalContext, extractShopifySessionToken, verifyShopifySessionToken, verifyShopifyWebhookHmac, signSchrodingerRequest, createShopifyProxyHandler, createShopifyWebhookHandlers, handleAppUninstalledWebhook, handleCustomersDataRequestWebhook, handleCustomersRedactWebhook, handleShopRedactWebhook, parsePrefillRoute } from "@catandbox/schrodinger-shopify-adapter/server";
+export type { AdapterEnvironment, PrefillLengthCaps, PrefillParseOptions, PrefillState, PrincipalContext, ProxyHandlerOptions, ShopifySessionVerificationOptions, WebhookForwardingOptions } from "./types";
+export { ShopifyAuthError, createPrincipalContext, extractShopifySessionToken, verifyShopifySessionToken, verifyShopifyWebhookHmac } from "./shopifyAuth";
+export { signSchrodingerRequest } from "./signing";
+export { createShopifyProxyHandler, createShopifyWebhookHandlers, handleAppUninstalledWebhook, handleCustomersDataRequestWebhook, handleCustomersRedactWebhook, handleShopRedactWebhook, parsePrefillRoute } from "./routes";

package/dist/server/index.js

@@ -1 +1,3 @@
-export { ShopifyAuthError, createPrincipalContext, extractShopifySessionToken, verifyShopifySessionToken, verifyShopifyWebhookHmac, signSchrodingerRequest, createShopifyProxyHandler, createShopifyWebhookHandlers, handleAppUninstalledWebhook, handleCustomersDataRequestWebhook, handleCustomersRedactWebhook, handleShopRedactWebhook, parsePrefillRoute } from "@catandbox/schrodinger-shopify-adapter/server";
+export { ShopifyAuthError, createPrincipalContext, extractShopifySessionToken, verifyShopifySessionToken, verifyShopifyWebhookHmac } from "./shopifyAuth";
+export { signSchrodingerRequest } from "./signing";
+export { createShopifyProxyHandler, createShopifyWebhookHandlers, handleAppUninstalledWebhook, handleCustomersDataRequestWebhook, handleCustomersRedactWebhook, handleShopRedactWebhook, parsePrefillRoute } from "./routes";

package/dist/server/routes.d.ts

@@ -0,0 +1,15 @@
+import type { PrefillParseOptions, PrefillState, ProxyHandlerOptions, WebhookForwardingOptions } from "./types";
+export declare function createShopifyProxyHandler(options: ProxyHandlerOptions): (request: Request) => Promise<Response>;
+export declare function parsePrefillRoute(input: string | URL, options: PrefillParseOptions): PrefillState;
+interface ShopifyWebhookHandlers {
+    handleCustomersDataRequestWebhook: (request: Request) => Promise<Response>;
+    handleCustomersRedactWebhook: (request: Request) => Promise<Response>;
+    handleShopRedactWebhook: (request: Request) => Promise<Response>;
+    handleAppUninstalledWebhook: (request: Request) => Promise<Response>;
+}
+export declare function createShopifyWebhookHandlers(options: WebhookForwardingOptions): ShopifyWebhookHandlers;
+export declare function handleCustomersDataRequestWebhook(request: Request, options: WebhookForwardingOptions): Promise<Response>;
+export declare function handleCustomersRedactWebhook(request: Request, options: WebhookForwardingOptions): Promise<Response>;
+export declare function handleShopRedactWebhook(request: Request, options: WebhookForwardingOptions): Promise<Response>;
+export declare function handleAppUninstalledWebhook(request: Request, options: WebhookForwardingOptions): Promise<Response>;
+export {};

package/dist/server/routes.js

@@ -0,0 +1,353 @@
+import { signSchrodingerRequest } from "./signing";
+import { ShopifyAuthError, createPrincipalContext, verifyShopifyWebhookHmac } from "./shopifyAuth";
+const DEFAULT_BASE_PATH = "/support/api";
+const DEFAULT_PREFILL_CAPS = {
+    title: 120,
+    category: 80,
+    description: 10_000
+};
+export function createShopifyProxyHandler(options) {
+    const basePath = normalizePathPrefix(options.basePath ?? DEFAULT_BASE_PATH);
+    return async (request) => {
+        const requestId = request.headers.get("X-Request-Id") ?? options.requestIdFactory?.() ?? crypto.randomUUID();
+        const fetchImpl = options.fetchImpl ?? fetch;
+        try {
+            const url = new URL(request.url);
+            const relativePath = toRelativePath(url.pathname, basePath);
+            if (relativePath === null) {
+                return jsonError(404, "NOT_FOUND", "Route not found", requestId);
+            }
+            const principal = await createPrincipalContext(request, {
+                shopifyApiKey: options.shopifyApiKey,
+                shopifyApiSecret: options.shopifyApiSecret
+            });
+            const resolution = await resolveProxyRequest(request, relativePath, url.searchParams, principal);
+            const upstreamUrl = new URL(`${trimTrailingSlash(options.schApiBaseUrl)}${resolution.upstreamPath}`);
+            resolution.query.forEach((value, key) => {
+                upstreamUrl.searchParams.set(key, value);
+            });
+            const signed = await signSchrodingerRequest({
+                env: {
+                    schAppId: options.schAppId,
+                    schKeyId: options.schKeyId,
+                    schSecret: options.schSecret
+                },
+                method: request.method,
+                path: resolution.upstreamPath,
+                query: upstreamUrl.searchParams,
+                body: resolution.body
+            });
+            const upstreamHeaders = new Headers(signed.headers);
+            upstreamHeaders.set("X-Request-Id", requestId);
+            upstreamHeaders.set(options.principalContextHeaderName ?? "X-Sch-Principal-Context", JSON.stringify({
+                shopDomain: principal.shopDomain,
+                tenantExternalId: principal.tenantExternalId,
+                principalExternalId: principal.principalExternalId,
+                displayName: principal.displayName,
+                email: principal.email
+            }));
+            if (signed.rawBody) {
+                upstreamHeaders.set("content-type", "application/json");
+            }
+            const upstreamResponse = await fetchImpl(upstreamUrl, {
+                method: request.method,
+                headers: upstreamHeaders,
+                body: signed.rawBody || null
+            });
+            return await copyResponse(upstreamResponse, requestId);
+        }
+        catch (error) {
+            if (error instanceof ShopifyAuthError) {
+                return jsonError(error.status, error.code, error.message, requestId);
+            }
+            if (error instanceof ProxyRouteError) {
+                return jsonError(error.status, error.code, error.message, requestId);
+            }
+            return jsonError(500, "INTERNAL_ERROR", "Unexpected proxy error", requestId);
+        }
+    };
+}
+export function parsePrefillRoute(input, options) {
+    const url = typeof input === "string" ? new URL(input, "https://local.invalid") : input;
+    const caps = { ...DEFAULT_PREFILL_CAPS, ...(options.caps ?? {}) };
+    const errors = {};
+    const title = (url.searchParams.get("title") ?? "").trim();
+    const categoryRaw = (url.searchParams.get("category") ?? "").trim();
+    const description = (url.searchParams.get("description") ?? "").trim();
+    const boundedTitle = enforceLength("title", title, caps.title, errors);
+    const boundedCategory = enforceLength("category", categoryRaw, caps.category, errors);
+    const boundedDescription = enforceLength("description", description, caps.description, errors);
+    const categoryId = boundedCategory
+        ? options.categories.some((category) => category.id === boundedCategory)
+            ? boundedCategory
+            : null
+        : null;
+    if (boundedCategory && !categoryId) {
+        errors.category = "Prefill category is not available for this integration";
+    }
+    return {
+        title: boundedTitle,
+        categoryId,
+        description: boundedDescription,
+        errors,
+        isValid: Object.keys(errors).length === 0
+    };
+}
+export function createShopifyWebhookHandlers(options) {
+    return {
+        handleCustomersDataRequestWebhook: (request) => forwardWebhook(request, "customers/data_request", "/admin/gdpr/data-request", options),
+        handleCustomersRedactWebhook: (request) => forwardWebhook(request, "customers/redact", "/admin/gdpr/customer-redact", options),
+        handleShopRedactWebhook: (request) => forwardWebhook(request, "shop/redact", "/admin/gdpr/shop-redact", options),
+        handleAppUninstalledWebhook: (request) => forwardWebhook(request, "app/uninstalled", "/admin/gdpr/shop-redact", options, true)
+    };
+}
+export async function handleCustomersDataRequestWebhook(request, options) {
+    return forwardWebhook(request, "customers/data_request", "/admin/gdpr/data-request", options);
+}
+export async function handleCustomersRedactWebhook(request, options) {
+    return forwardWebhook(request, "customers/redact", "/admin/gdpr/customer-redact", options);
+}
+export async function handleShopRedactWebhook(request, options) {
+    return forwardWebhook(request, "shop/redact", "/admin/gdpr/shop-redact", options);
+}
+export async function handleAppUninstalledWebhook(request, options) {
+    return forwardWebhook(request, "app/uninstalled", "/admin/gdpr/shop-redact", options, true);
+}
+async function resolveProxyRequest(request, relativePath, requestQuery, principal) {
+    if (request.method === "GET" && relativePath === "/categories") {
+        return {
+            upstreamPath: "/v1/categories",
+            query: new URLSearchParams(requestQuery),
+            body: undefined
+        };
+    }
+    if (request.method === "GET" && relativePath === "/portal-config") {
+        return {
+            upstreamPath: "/v1/portal-config",
+            query: new URLSearchParams(requestQuery),
+            body: undefined
+        };
+    }
+    if (request.method === "GET" && relativePath === "/tickets") {
+        const query = new URLSearchParams(requestQuery);
+        query.set("tenantExternalId", principal.tenantExternalId);
+        return {
+            upstreamPath: "/v1/tickets",
+            query,
+            body: undefined
+        };
+    }
+    const ticketMatch = relativePath.match(/^\/tickets\/([^/]+)$/);
+    if (request.method === "GET" && ticketMatch) {
+        const query = new URLSearchParams(requestQuery);
+        query.set("tenantExternalId", principal.tenantExternalId);
+        return {
+            upstreamPath: `/v1/tickets/${encodeURIComponent(decodeURIComponent(ticketMatch[1] ?? ""))}`,
+            query,
+            body: undefined
+        };
+    }
+    if (request.method === "POST" && relativePath === "/tickets") {
+        const payload = await parseOptionalJsonBody(request);
+        return {
+            upstreamPath: "/v1/tickets",
+            query: new URLSearchParams(requestQuery),
+            body: {
+                ...payload,
+                tenantExternalId: principal.tenantExternalId,
+                principalExternalId: principal.principalExternalId
+            }
+        };
+    }
+    const messageMatch = relativePath.match(/^\/tickets\/([^/]+)\/messages$/);
+    if (request.method === "POST" && messageMatch) {
+        const payload = await parseOptionalJsonBody(request);
+        return {
+            upstreamPath: `/v1/tickets/${encodeURIComponent(decodeURIComponent(messageMatch[1] ?? ""))}/messages`,
+            query: new URLSearchParams(requestQuery),
+            body: {
+                ...payload,
+                tenantExternalId: principal.tenantExternalId,
+                principalExternalId: principal.principalExternalId
+            }
+        };
+    }
+    const actionMatch = relativePath.match(/^\/tickets\/([^/]+)\/(close|archive|reopen)$/);
+    if (request.method === "POST" && actionMatch) {
+        return {
+            upstreamPath: `/v1/tickets/${encodeURIComponent(decodeURIComponent(actionMatch[1] ?? ""))}/${actionMatch[2]}`,
+            query: new URLSearchParams(requestQuery),
+            body: {
+                tenantExternalId: principal.tenantExternalId
+            }
+        };
+    }
+    const ticketRatingMatch = relativePath.match(/^\/tickets\/([^/]+)\/ratings$/);
+    if (request.method === "POST" && ticketRatingMatch) {
+        const payload = await parseOptionalJsonBody(request);
+        return {
+            upstreamPath: `/v1/tickets/${encodeURIComponent(decodeURIComponent(ticketRatingMatch[1] ?? ""))}/ratings`,
+            query: new URLSearchParams(requestQuery),
+            body: {
+                ...payload,
+                tenantExternalId: principal.tenantExternalId,
+                principalExternalId: principal.principalExternalId
+            }
+        };
+    }
+    const messageRatingMatch = relativePath.match(/^\/messages\/([^/]+)\/ratings$/);
+    if (request.method === "POST" && messageRatingMatch) {
+        const payload = await parseOptionalJsonBody(request);
+        return {
+            upstreamPath: `/v1/messages/${encodeURIComponent(decodeURIComponent(messageRatingMatch[1] ?? ""))}/ratings`,
+            query: new URLSearchParams(requestQuery),
+            body: {
+                ...payload,
+                tenantExternalId: principal.tenantExternalId,
+                principalExternalId: principal.principalExternalId
+            }
+        };
+    }
+    if (request.method === "POST" && relativePath === "/uploads/init") {
+        const payload = await parseOptionalJsonBody(request);
+        return {
+            upstreamPath: "/v1/uploads/init",
+            query: new URLSearchParams(requestQuery),
+            body: {
+                ...payload,
+                tenantExternalId: principal.tenantExternalId,
+                principalExternalId: principal.principalExternalId
+            }
+        };
+    }
+    if (request.method === "POST" && relativePath === "/uploads/complete") {
+        const payload = await parseOptionalJsonBody(request);
+        return {
+            upstreamPath: "/v1/uploads/complete",
+            query: new URLSearchParams(requestQuery),
+            body: {
+                ...payload,
+                tenantExternalId: principal.tenantExternalId,
+                principalExternalId: principal.principalExternalId
+            }
+        };
+    }
+    throw new ProxyRouteError("NOT_FOUND", "Adapter route not found", 404);
+}
+async function forwardWebhook(request, topic, adminPath, options, disablePortalAccess = false) {
+    const requestId = request.headers.get("X-Request-Id") ?? options.requestIdFactory?.() ?? crypto.randomUUID();
+    const rawBody = await request.clone().text();
+    const hmacHeader = request.headers.get("X-Shopify-Hmac-Sha256") ?? request.headers.get("x-shopify-hmac-sha256");
+    const validHmac = await verifyShopifyWebhookHmac({
+        rawBody,
+        hmacHeader,
+        shopifyApiSecret: options.shopifyApiSecret
+    });
+    if (!validHmac) {
+        return jsonError(401, "INVALID_WEBHOOK_SIGNATURE", "Shopify webhook HMAC validation failed", requestId);
+    }
+    if (!options.schAdminApiToken) {
+        return jsonError(500, "MISSING_SCH_ADMIN_API_TOKEN", "schAdminApiToken is required for GDPR webhook forwarding", requestId);
+    }
+    const payload = parseWebhookPayload(rawBody, requestId);
+    if (payload instanceof Response) {
+        return payload;
+    }
+    if (disablePortalAccess) {
+        const shopDomain = inferWebhookShopDomain(payload);
+        if (!shopDomain) {
+            return jsonError(422, "INVALID_WEBHOOK_PAYLOAD", "Missing shop domain in uninstall webhook", requestId);
+        }
+        await options.disablePortalAccess?.({ shopDomain, payload, topic });
+    }
+    const url = new URL(`${trimTrailingSlash(options.schApiBaseUrl)}${adminPath}`);
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const upstream = await fetchImpl(url, {
+        method: "POST",
+        headers: {
+            Authorization: `Bearer ${options.schAdminApiToken}`,
+            "content-type": "application/json",
+            "X-Request-Id": requestId
+        },
+        body: rawBody
+    });
+    return await copyResponse(upstream, requestId);
+}
+async function parseOptionalJsonBody(request) {
+    const raw = await request.clone().text();
+    if (!raw.trim()) {
+        return {};
+    }
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        throw new ProxyRouteError("INVALID_JSON", "Request body must be valid JSON", 400);
+    }
+}
+function parseWebhookPayload(rawBody, requestId) {
+    try {
+        return JSON.parse(rawBody);
+    }
+    catch {
+        return jsonError(400, "INVALID_JSON", "Webhook payload must be valid JSON", requestId);
+    }
+}
+function inferWebhookShopDomain(payload) {
+    const candidate = payload.shop_domain ?? payload.myshopify_domain ?? payload.shopDomain;
+    return typeof candidate === "string" && candidate.trim() ? candidate.trim().toLowerCase() : null;
+}
+function normalizePathPrefix(path) {
+    const withSlash = path.startsWith("/") ? path : `/${path}`;
+    return withSlash.replace(/\/+$/, "");
+}
+function toRelativePath(pathname, basePath) {
+    if (pathname === basePath) {
+        return "/";
+    }
+    if (pathname.startsWith(`${basePath}/`)) {
+        return pathname.slice(basePath.length);
+    }
+    return null;
+}
+function trimTrailingSlash(value) {
+    return value.replace(/\/+$/, "");
+}
+async function copyResponse(response, requestId) {
+    const headers = new Headers(response.headers);
+    if (!headers.get("X-Request-Id")) {
+        headers.set("X-Request-Id", requestId);
+    }
+    const body = await response.arrayBuffer();
+    return new Response(body, { status: response.status, statusText: response.statusText, headers });
+}
+function jsonError(status, code, message, requestId) {
+    return new Response(JSON.stringify({
+        error: code,
+        message,
+        requestId
+    }), {
+        status,
+        headers: {
+            "content-type": "application/json; charset=utf-8",
+            "X-Request-Id": requestId
+        }
+    });
+}
+function enforceLength(field, value, maxLength, errors) {
+    if (value.length <= maxLength) {
+        return value;
+    }
+    errors[field] = `${field} exceeds ${maxLength} characters`;
+    return value.slice(0, maxLength);
+}
+class ProxyRouteError extends Error {
+    code;
+    status;
+    constructor(code, message, status) {
+        super(message);
+        this.name = "ProxyRouteError";
+        this.code = code;
+        this.status = status;
+    }
+}

package/dist/server/shopifyAuth.d.ts

@@ -0,0 +1,28 @@
+import type { PrincipalContext, ShopifySessionVerificationOptions } from "./types";
+interface ShopifySessionClaims {
+    aud?: string | string[];
+    dest?: string;
+    email?: string;
+    exp?: number;
+    iat?: number;
+    iss?: string;
+    nbf?: number;
+    sub?: string;
+    user_email?: string;
+    user_name?: string;
+    [key: string]: unknown;
+}
+export declare class ShopifyAuthError extends Error {
+    readonly code: string;
+    readonly status: number;
+    constructor(code: string, message: string, status?: number);
+}
+export declare function extractShopifySessionToken(request: Request): string | null;
+export declare function createPrincipalContext(request: Request, options: ShopifySessionVerificationOptions): Promise<PrincipalContext>;
+export declare function verifyShopifySessionToken(token: string, options: ShopifySessionVerificationOptions): Promise<ShopifySessionClaims>;
+export declare function verifyShopifyWebhookHmac(input: {
+    rawBody: string;
+    hmacHeader: string | null;
+    shopifyApiSecret: string;
+}): Promise<boolean>;
+export {};