@cimplify/sdk 0.106.2 → 0.107.0

package/dist/{chunk-B7JH5D3J.js → chunk-HKCB73AJ.js}

@@ -2407,7 +2407,7 @@ var LinkService = class {
       this.client.activity.refreshIdentity();
       return result;
     }
-    const claim = await this.client.support.claimConversation();
+    const claim = await this.client.session.claim();
     if (fence.generation !== this.activationGeneration || fence.publicKeyEpoch !== this.client.getPublicKeyEpoch() || this.client.getAccessToken() !== accessToken) {
       return this.supersededActivation();
     }
@@ -2631,7 +2631,7 @@ var AuthService = class {
     if (result.ok && result.value.session_token) {
       this.client.setAccessToken(result.value.session_token);
       this.client.activity.refreshIdentity();
-      this.client.autoClaimChatIdentity();
+      this.client.autoClaimSession();
     }
     return result;
   }
@@ -2924,13 +2924,10 @@ var ELEMENT_TYPES = {
 };
 var MESSAGE_TYPES = {
   INIT: "init",
-  SET_TOKEN: "set_token",
-  SET_SESSION: "set_session",
+  IDENTITY: "identity",
   SESSION_CLEARED: "session_cleared",
   SET_CART: "set_cart",
   GET_DATA: "get_data",
-  NAVIGATE: "navigate",
-  REFRESH_TOKEN: "refresh_token",
   LOGOUT: "logout",
   PROCESS_CHECKOUT: "process_checkout",
   ABORT_CHECKOUT: "abort_checkout",
@@ -2943,7 +2940,6 @@ var MESSAGE_TYPES = {
   LOGOUT_COMPLETE: "logout_complete",
   AUTH_REQUESTED: "auth_requested",
   SESSION_ESTABLISHED: "session_established",
-  SESSION_ESTABLISHMENT_FAILED: "session_establishment_failed",
   CONTINUE_WITHOUT_SAVED_DETAILS: "continue_without_saved_details",
   CONTACT_PROVIDED: "contact_provided",
   CHECKOUT_STATUS: "checkout_status",
@@ -3347,7 +3343,6 @@ function toCheckoutError(code, message, recoverable) {
   };
 }
 var DEFAULT_LINK_URL = "https://link.cimplify.io";
-var AUTH_ESTABLISHMENT_WAIT_MS = 8e3;
 var AUTH_CONTACT_TYPES = new Set(Object.values(ELEMENTS_AUTH_CONTACT_TYPES));
 var AUTH_MODES = new Set(Object.values(ELEMENTS_AUTH_MODES));
 var AUTH_PROMPTS = new Set(Object.values(ELEMENTS_AUTH_PROMPTS));
@@ -3378,6 +3373,11 @@ function decodeJwtSub(token) {
     return "";
   }
 }
+function isClaimedCustomer(value) {
+  if (!value || typeof value !== "object") return false;
+  const record = value;
+  return typeof record.id === "string" && typeof record.name === "string" && (record.email === null || typeof record.email === "string") && (record.phone === null || typeof record.phone === "string");
+}
 function isAllowedOrigin(origin) {
   try {
     const url = new URL(origin);
@@ -3434,8 +3434,10 @@ function parseIframeMessage(data) {
       }
       break;
     case MESSAGE_TYPES.SESSION_ESTABLISHED:
+      if (typeof record.sessionToken !== "string" || !record.sessionToken.trim()) return null;
       if (typeof record.accessToken !== "string" || !record.accessToken.trim()) return null;
       if (record.refreshToken !== void 0 && typeof record.refreshToken !== "string") return null;
+      if (!isClaimedCustomer(record.customer)) return null;
       break;
     case MESSAGE_TYPES.ADDRESS_CHANGED:
     case MESSAGE_TYPES.ADDRESS_SELECTED:
@@ -3486,7 +3488,6 @@ var CimplifyElements = class {
     this.paymentData = null;
     this.checkoutInProgress = false;
     this.authInProgress = false;
-    this.authEstablishmentInProgress = false;
     this.authGeneration = 0;
     this.activeCheckoutAbort = null;
     this.businessIdResolvePromise = null;
@@ -3501,7 +3502,7 @@ var CimplifyElements = class {
       window.addEventListener("message", this.boundHandleMessage);
     }
     this.stopSessionSync = client.events.on(SESSION_CLAIMED, () => {
-      if (!this.authInProgress && !this.authEstablishmentInProgress) this.syncHostSession();
+      if (!this.authInProgress) this._syncHostSession();
     });
     void this.restoreSession();
   }
@@ -3510,20 +3511,24 @@ var CimplifyElements = class {
       console.debug(...args);
     }
   }
-  syncHostSession(element) {
-    if (this.authEstablishmentInProgress) return;
+  _syncHostSession(element) {
     const sessionToken = this.client.getSessionToken();
-    const token = this.client.getAccessToken() ?? this.accessToken;
+    if (!sessionToken) return;
+    const identity = {
+      type: MESSAGE_TYPES.IDENTITY,
+      sessionToken,
+      accessToken: this.client.getAccessToken() ?? this.accessToken,
+      customer: this.identityCustomer()
+    };
     const targets = element ? [element] : Array.from(this.elements.values());
     for (const target of targets) {
-      if (sessionToken) {
-        target.sendMessage({ type: MESSAGE_TYPES.SET_SESSION, sessionToken });
-      }
-      if (token) {
-        target.sendMessage({ type: MESSAGE_TYPES.SET_TOKEN, token });
-      }
+      target.sendMessage(identity);
     }
   }
+  identityCustomer() {
+    if (!this.accessToken || !this.customerId || !this.customerData) return null;
+    return { id: this.customerId, ...this.customerData };
+  }
   create(type, options = {}) {
     const existing = this.elements.get(type);
     if (existing) return existing;
@@ -3542,11 +3547,7 @@ var CimplifyElements = class {
   }
   destroy() {
     this.authGeneration += 1;
-    if (this.authEstablishmentInProgress) {
-      this.client.setAccessToken(null);
-    }
     this.authInProgress = false;
-    this.authEstablishmentInProgress = false;
     this.stopSessionSync();
     this.stopSessionSync = () => {
     };
@@ -3606,17 +3607,6 @@ var CimplifyElements = class {
         );
       }
       this.checkoutInProgress = true;
-      if (this.authEstablishmentInProgress) {
-        await this.waitForAuthEstablishment(AUTH_ESTABLISHMENT_WAIT_MS);
-        if (this.authEstablishmentInProgress) {
-          this.checkoutInProgress = false;
-          return toCheckoutError(
-            chunkAVXA4F6G_js.ErrorCode.AUTH_INCOMPLETE,
-            "Authentication must finish establishing the checkout session.",
-            true
-          );
-        }
-      }
       if (!options.cart_id && !options.intent_id) {
         this.debug("[cimplify:checkout] BLOCKED: no cart_id or intent_id");
         this.checkoutInProgress = false;
@@ -3821,7 +3811,7 @@ var CimplifyElements = class {
           hasAddress: !!processMessage.address,
           isUnifiedCheckout
         });
-        this.syncHostSession(checkoutElement);
+        this._syncHostSession(checkoutElement);
         checkoutElement.sendMessage(processMessage);
         this.debug("[cimplify:checkout] postMessage sent, waiting for checkout_complete...");
       });
@@ -3932,7 +3922,6 @@ var CimplifyElements = class {
     this.customerData = null;
     this.addressData = null;
     this.paymentData = null;
-    this.authEstablishmentInProgress = false;
     this.client.clearSession();
     this.broadcastClearedSession();
   }
@@ -3968,73 +3957,73 @@ var CimplifyElements = class {
       this.broadcastClearedSession();
       return;
     }
-    if (application.kind !== "authenticated" || !this.broadcastAccessToken(result.value.session_token, generation)) {
-      return;
-    }
+    if (application.kind !== "authenticated") return;
+    this._syncHostSession();
     this.elements.forEach((element) => element._emitAuthenticated(application.data));
   }
   async applyAccessToken(token, generation) {
     if (this.authGeneration !== generation) return { kind: "incomplete" };
-    this.authEstablishmentInProgress = true;
-    try {
-      this.accessToken = null;
-      this.accountId = null;
-      this.customerId = null;
-      this.customerData = null;
-      this.addressData = null;
-      this.paymentData = null;
-      this.client.setAccessToken(token);
-      const claim = await this.client.support.claimConversation();
-      if (!this.isAuthGenerationCurrent(generation, token)) return { kind: "incomplete" };
-      if (!claim.ok && claim.error.code !== "already_claimed") {
-        if (this.client.hasClaimedSessionAuthority()) {
-          this.client.clearSession();
-        } else {
-          this.client.setAccessToken(null);
-        }
-        return {
-          kind: "claim_failed",
-          code: claim.error.code,
-          message: claim.error.userMessage
-        };
-      }
-      this.accessToken = token;
-      this.accountId = decodeJwtSub(token);
-      if (!await this.hydrateCustomerData(generation, token, true)) {
-        return { kind: "incomplete" };
+    this.accessToken = null;
+    this.accountId = null;
+    this.customerId = null;
+    this.customerData = null;
+    this.addressData = null;
+    this.paymentData = null;
+    this.client.setAccessToken(token);
+    const claim = await this.client.session.claim();
+    if (!this.isAuthGenerationCurrent(generation, token)) return { kind: "incomplete" };
+    if (!claim.ok && claim.error.code !== "already_claimed") {
+      if (this.client.hasClaimedSessionAuthority()) {
+        this.client.clearSession();
+      } else {
+        this.client.setAccessToken(null);
       }
-      if (!this.isAuthGenerationCurrent(generation, token)) return { kind: "incomplete" };
       return {
-        kind: "authenticated",
-        data: {
-          accountId: this.accountId ?? "",
-          customerId: this.customerId ?? "",
-          token,
-          customer: this.customerData ?? { name: "", email: null, phone: null }
-        }
+        kind: "claim_failed",
+        code: claim.error.code,
+        message: claim.error.userMessage
       };
-    } finally {
-      this.authEstablishmentInProgress = false;
-    }
-  }
-  async waitForAuthEstablishment(timeoutMs) {
-    const deadline = Date.now() + timeoutMs;
-    while (this.authEstablishmentInProgress && Date.now() < deadline) {
-      await new Promise((resolve) => setTimeout(resolve, 100));
     }
-  }
-  broadcastAccessToken(token, generation) {
-    if (!this.isAuthGenerationCurrent(generation, token) || this.accessToken !== token || this.authEstablishmentInProgress) {
-      return false;
+    this.accessToken = token;
+    this.accountId = decodeJwtSub(token);
+    if (!await this.hydrateCustomerData(generation, token, true)) {
+      return { kind: "incomplete" };
     }
-    const sessionToken = this.client.getSessionToken();
-    this.elements.forEach((element) => {
-      if (sessionToken) {
-        element.sendMessage({ type: MESSAGE_TYPES.SET_SESSION, sessionToken });
+    if (!this.isAuthGenerationCurrent(generation, token)) return { kind: "incomplete" };
+    return {
+      kind: "authenticated",
+      data: {
+        accountId: this.accountId ?? "",
+        customerId: this.customerId ?? "",
+        token,
+        customer: this.customerData ?? { name: "", email: null, phone: null }
       }
-      element.sendMessage({ type: MESSAGE_TYPES.SET_TOKEN, token });
+    };
+  }
+  adoptEstablishedSession(sourceElement, session) {
+    this.authGeneration += 1;
+    this.authInProgress = false;
+    const { id, ...customer } = session.customer;
+    this.accessToken = session.accessToken;
+    this.accountId = decodeJwtSub(session.accessToken);
+    this.customerId = id;
+    this.customerData = customer;
+    this.addressData = null;
+    this.paymentData = null;
+    this.client.setAccessToken(session.accessToken);
+    this.persistRefreshToken(session.refreshToken);
+    this.client.session.adopt(session.accessToken, {
+      sessionToken: session.sessionToken,
+      customerName: session.customer.name,
+      customer: session.customer,
+      cart: null
+    });
+    sourceElement._emitAuthenticated({
+      accountId: this.accountId,
+      customerId: id,
+      token: session.accessToken,
+      customer
     });
-    return true;
   }
   broadcastClearedSession() {
     const sessionToken = this.client.getSessionToken();
@@ -4081,7 +4070,8 @@ var CimplifyElements = class {
           return;
         }
         const application = await this.applyAccessToken(accessToken, generation);
-        if (application.kind === "authenticated" && this.broadcastAccessToken(accessToken, generation)) {
+        if (application.kind === "authenticated") {
+          this._syncHostSession();
           sourceElement._emitAuthenticated(application.data);
         } else if (application.kind === "claim_failed") {
           sourceElement._emitError({
@@ -4120,29 +4110,7 @@ var CimplifyElements = class {
         this.startEmbeddedAuth(sourceElement, message);
         break;
       case MESSAGE_TYPES.SESSION_ESTABLISHED:
-        {
-          this.authInProgress = false;
-          const generation = ++this.authGeneration;
-          void this.applyAccessToken(message.accessToken, generation).then((application) => {
-            if (this.authGeneration !== generation) return;
-            if (application.kind === "claim_failed") {
-              this.clearPersistedSession();
-              sourceElement.sendMessage({
-                type: MESSAGE_TYPES.SESSION_ESTABLISHMENT_FAILED,
-                accessToken: message.accessToken,
-                code: application.code,
-                message: application.message
-              });
-              this.broadcastClearedSession();
-              return;
-            }
-            if (application.kind !== "authenticated" || !this.broadcastAccessToken(message.accessToken, generation)) {
-              return;
-            }
-            this.persistRefreshToken(message.refreshToken);
-            sourceElement._emitAuthenticated(application.data);
-          });
-        }
+        this.adoptEstablishedSession(sourceElement, message);
         break;
       case MESSAGE_TYPES.ADDRESS_CHANGED:
       case MESSAGE_TYPES.ADDRESS_SELECTED:
@@ -4164,7 +4132,6 @@ var CimplifyElements = class {
       case MESSAGE_TYPES.CONTINUE_WITHOUT_SAVED_DETAILS: {
         this.authGeneration += 1;
         this.authInProgress = false;
-        this.authEstablishmentInProgress = false;
         const carriedIdentityAuthority = Boolean(this.client.getAccessToken()) || this.client.hasClaimedSessionAuthority();
         this.accessToken = null;
         this.accountId = null;
@@ -4189,7 +4156,6 @@ var CimplifyElements = class {
       case MESSAGE_TYPES.LOGOUT_COMPLETE:
         this.authGeneration += 1;
         this.authInProgress = false;
-        this.authEstablishmentInProgress = false;
         if (this.checkoutInProgress && this.activeCheckoutAbort) {
           this.activeCheckoutAbort();
         }
@@ -4438,14 +4404,7 @@ var CimplifyElement = class {
             hostedSessionId: this.options.hostedSessionId,
             initialTerms: this.options.initialTerms
           });
-          const token = this.parent.getAccessToken();
-          const sessionToken = this.parent.getSessionToken();
-          if (sessionToken) {
-            this.sendMessage({ type: MESSAGE_TYPES.SET_SESSION, sessionToken });
-          }
-          if (token) {
-            this.sendMessage({ type: MESSAGE_TYPES.SET_TOKEN, token });
-          }
+          this.parent._syncHostSession(this);
           this.pendingInit = null;
         }
         this.flushPending();

package/dist/{chunk-4VTFTLH7.mjs → chunk-IWZKCL3P.mjs}

@@ -1,5 +1,5 @@
-import { createMockApp } from './chunk-L4XKIMUO.mjs';
-import { createCimplifyClient } from './chunk-LJAZ7H4I.mjs';
+import { createMockApp } from './chunk-MKZXZDHE.mjs';
+import { createCimplifyClient } from './chunk-P4HYAV3L.mjs';
 import { PAYMENT_METHOD, ORDER_TYPE, AUTHORIZATION_TYPE, CHECKOUT_NEXT_ACTION } from './chunk-33VCYWVL.mjs';
 import { PURCHASE_INTENT_SOURCE_KIND, PURCHASE_INTENT_SELLABLE_KIND, PURCHASE_INTENT_OFFER_KIND, PURCHASE_INTENT_LINE_CONFIGURATION_KIND, PURCHASE_INTENT_PAYMENT_METHOD, PURCHASE_INTENT_MOBILE_MONEY_NETWORK, MOBILE_MONEY_TENDER_AUTHORITY_KIND, CHECKOUT_COMPLIANCE_REASON, CHECKOUT_COMPLIANCE_LANE, PURCHASE_SURFACE, PURCHASE_DISPOSITION, PAYMENT_INSTRUMENT_DISPLAY_KIND, CHECKOUT_PROTECTION_STATUS, PAYMENT_OPTION_NEXT_ACTION, PAYMENT_OPTION_STATUS, PURCHASE_INTENT_PAYMENT_PROVIDER, PAYMENT_COLLECTION_MODE, PURCHASING_PRINCIPAL_KIND, CHECKOUT_PURCHASE_SURFACE, NATIVE_PURCHASE_PLATFORM, PURCHASE_INTENT_STATUS, CHECKOUT_TERMS_COMPONENT, CHECKOUT_TERMS_DELTA_KIND, CHECKOUT_MATERIAL_TERMS_COMPONENT, PURCHASE_INTENT_CONFIRM_STATUS, CHECKOUT_INVALIDATION_REASON } from './chunk-NJYR6GGM.mjs';
 import { z } from 'zod';

package/dist/{chunk-L4XKIMUO.mjs → chunk-MKZXZDHE.mjs}

@@ -2907,6 +2907,23 @@ function buildV1(deps) {
     return tryRoute(c, () => deps.support.react(c.req.param("messageId"), body.emoji ?? ""));
   });
   app.post("/support/conversation/handoff", (c) => c.json({ data: { requested: true } }));
+  app.post("/auth/session/claim", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    if (!body.access_token) return c.json({ error: "access_token is required" }, 400);
+    const session = c.var.session;
+    return c.json({
+      data: {
+        session_token: session.token,
+        customer: {
+          id: session.customer_id ?? "cus_test",
+          name: session.customer_name ?? "Test User",
+          email: null,
+          phone: null
+        },
+        cart: null
+      }
+    });
+  });
   app.post("/support/conversation/claim", async (c) => {
     const body = await c.req.json().catch(() => ({}));
     if (!body.access_token) return c.json({ error: "access_token is required" }, 400);

package/dist/{chunk-NJK3THWT.js → chunk-NX5YBQZP.js}

@@ -2909,6 +2909,23 @@ function buildV1(deps) {
     return tryRoute(c, () => deps.support.react(c.req.param("messageId"), body.emoji ?? ""));
   });
   app.post("/support/conversation/handoff", (c) => c.json({ data: { requested: true } }));
+  app.post("/auth/session/claim", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    if (!body.access_token) return c.json({ error: "access_token is required" }, 400);
+    const session = c.var.session;
+    return c.json({
+      data: {
+        session_token: session.token,
+        customer: {
+          id: session.customer_id ?? "cus_test",
+          name: session.customer_name ?? "Test User",
+          email: null,
+          phone: null
+        },
+        cart: null
+      }
+    });
+  });
   app.post("/support/conversation/claim", async (c) => {
     const body = await c.req.json().catch(() => ({}));
     if (!body.access_token) return c.json({ error: "access_token is required" }, 400);

package/dist/{chunk-LJAZ7H4I.mjs → chunk-P4HYAV3L.mjs}

@@ -1,5 +1,5 @@
 import { messagePreview } from './chunk-U4MW6PYU.mjs';
-import { ok, err, safe, generateIdempotencyKey, SESSION_CLEARED, SESSION_CLAIMED, createClientEvents, createDefaultPaymentAuthorizationAdapterRegistry, AUTH_TOKEN_CHANGED, CatalogueQueries, CartOperations, CheckoutService, OrderQueries, LinkService, AuthService, BusinessService, InventoryService, SchedulingService, LiteService, FxService, createElements } from './chunk-T3MXI7JD.mjs';
+import { ok, err, safe, generateIdempotencyKey, SESSION_CLEARED, SESSION_CLAIMED, createClientEvents, createDefaultPaymentAuthorizationAdapterRegistry, AUTH_TOKEN_CHANGED, CatalogueQueries, CartOperations, CheckoutService, OrderQueries, LinkService, AuthService, BusinessService, InventoryService, SchedulingService, LiteService, FxService, createElements } from './chunk-2I6YKE6Q.mjs';
 import { PURCHASE_INTENT_RESOLVE_STATUS, PURCHASE_INTENT_CONFIRM_STATUS, PURCHASE_INTENT_RESOLUTION_KIND, PURCHASE_INTENT_ACTION_DECISION, CimplifyError, PURCHASE_INTENT_ERROR_CODE, ErrorCode, IdempotencyMismatchError, enrichError } from './chunk-NJYR6GGM.mjs';
 
 // src/types/observability.ts
@@ -1076,85 +1076,9 @@ function chatRealtimeUpdateFromWire(envelope) {
 }
 
 // src/support.ts
-var CLAIM_TIMEOUT_MS = 15e3;
 var SupportService = class {
   constructor(client) {
     this.client = client;
-    this.claimInFlight = null;
-    this.claimInFlightToken = null;
-    this.lastClaimedAccessToken = null;
-    this.claimedName = null;
-    this.client.events.on(SESSION_CLEARED, () => {
-      this.lastClaimedAccessToken = null;
-      this.claimedName = null;
-    });
-    this.client.events.on(SESSION_CLAIMED, (event) => {
-      if (event.customerName) this.claimedName = event.customerName;
-    });
-  }
-  /** The verified customer this session's conversation was claimed for, null while anonymous. */
-  get claimedCustomerName() {
-    return this.claimedName;
-  }
-  /**
-   * Claim the anonymous session for the verified Link identity: the server
-   * verifies the access token, rotates the session token (adopted here, so
-   * every subsequent request rides the bound session), folds the guest cart
-   * in, and opens or reuses the account's canonical direct Chat thread.
-   *
-   * Idempotent and single-flight: concurrent calls share one request, and a
-   * token already claimed by this instance short-circuits without a network
-   * round trip. A session already bound to another Link account is rejected
-   * rather than transferring that account's cart. Emits `session:claimed` on
-   * the client's event channel.
-   */
-  async claimConversation() {
-    const accessToken = this.client.getAccessToken();
-    if (!accessToken) {
-      return err(new CimplifyError("not_authenticated", "No access token to claim with"));
-    }
-    if (this.claimInFlight) {
-      if (this.claimInFlightToken === accessToken) return this.claimInFlight;
-      await this.claimInFlight;
-      return this.claimConversation();
-    }
-    if (this.lastClaimedAccessToken === accessToken) {
-      return err(new CimplifyError("already_claimed", "Session already claimed for this token"));
-    }
-    const epoch = this.client.getSessionEpoch();
-    this.claimInFlightToken = accessToken;
-    this.claimInFlight = (async () => {
-      const result = await safe(
-        this.client.post(
-          "/api/v1/support/conversation/claim",
-          { access_token: accessToken },
-          { timeoutMs: CLAIM_TIMEOUT_MS }
-        )
-      );
-      if (result.ok) {
-        if (this.client.getSessionEpoch() !== epoch) {
-          return err(
-            new CimplifyError("session_cleared", "Session was cleared during the claim")
-          );
-        }
-        this.lastClaimedAccessToken = accessToken;
-        this.claimedName = result.value.customer_name || null;
-        this.client.adoptSessionToken(result.value.session_token);
-        this.client.publishSessionClaimed(this.claimedName);
-        this.client.events.emit(SESSION_CLAIMED, {
-          sessionToken: result.value.session_token,
-          threadId: result.value.thread.id,
-          customerName: result.value.customer_name
-        });
-      }
-      return result;
-    })();
-    try {
-      return await this.claimInFlight;
-    } finally {
-      this.claimInFlight = null;
-      this.claimInFlightToken = null;
-    }
   }
   /**
    * Retry verified external-history discovery for the current storefront.
@@ -1270,6 +1194,95 @@ var SupportService = class {
   }
 };
 
+// src/session.ts
+var CLAIM_TIMEOUT_MS = 15e3;
+var CLAIM_PATH = "/api/v1/auth/session/claim";
+var SessionService = class {
+  constructor(client) {
+    this.client = client;
+    this.claimInFlight = null;
+    this.claimInFlightToken = null;
+    this.lastClaimedAccessToken = null;
+    this.claimedName = null;
+    this.client.events.on(SESSION_CLEARED, () => {
+      this.lastClaimedAccessToken = null;
+      this.claimedName = null;
+    });
+    this.client.events.on(SESSION_CLAIMED, (event) => {
+      if (event.customerName) this.claimedName = event.customerName;
+    });
+  }
+  /** The verified customer this session is bound to, null while anonymous. */
+  get claimedCustomerName() {
+    return this.claimedName;
+  }
+  /** Adopt a session another holder already bound for this bearer. */
+  adopt(accessToken, session) {
+    this.lastClaimedAccessToken = accessToken;
+    this.claimedName = session.customerName || null;
+    this.client.adoptSessionToken(session.sessionToken);
+    this.client.publishSessionClaimed(this.claimedName);
+    this.client.events.emit(SESSION_CLAIMED, session);
+  }
+  /**
+   * Bind the anonymous session to the verified Link identity in one server
+   * transaction: verify the bearer, rotate the session token (adopted here),
+   * fold the guest cart under the customer and re-price it. A repeat for the
+   * same account and session returns the same session.
+   *
+   * Idempotent and single-flight: concurrent calls share one request, and a
+   * token already claimed by this instance short-circuits without a network
+   * round trip. A session already bound to another Link account is rejected
+   * rather than transferring that account's cart. Emits `session:claimed` on
+   * the client's event channel.
+   */
+  async claim() {
+    const accessToken = this.client.getAccessToken();
+    if (!accessToken) {
+      return err(new CimplifyError("not_authenticated", "No access token to claim with"));
+    }
+    if (this.claimInFlight) {
+      if (this.claimInFlightToken === accessToken) return this.claimInFlight;
+      await this.claimInFlight;
+      return this.claim();
+    }
+    if (this.lastClaimedAccessToken === accessToken) {
+      return err(new CimplifyError("already_claimed", "Session already claimed for this token"));
+    }
+    const epoch = this.client.getSessionEpoch();
+    this.claimInFlightToken = accessToken;
+    this.claimInFlight = (async () => {
+      const result = await safe(
+        this.client.post(
+          CLAIM_PATH,
+          { access_token: accessToken },
+          { timeoutMs: CLAIM_TIMEOUT_MS }
+        )
+      );
+      if (result.ok) {
+        if (this.client.getSessionEpoch() !== epoch) {
+          return err(
+            new CimplifyError("session_cleared", "Session was cleared during the claim")
+          );
+        }
+        this.adopt(accessToken, {
+          sessionToken: result.value.session_token,
+          customerName: result.value.customer.name,
+          customer: result.value.customer,
+          cart: result.value.cart
+        });
+      }
+      return result;
+    })();
+    try {
+      return await this.claimInFlight;
+    } finally {
+      this.claimInFlight = null;
+      this.claimInFlightToken = null;
+    }
+  }
+};
+
 // src/internal/cross-tab-session.ts
 var CROSS_TAB_SESSION_HUB_KEY = /* @__PURE__ */ Symbol.for("@cimplify/sdk.cross-tab-session-hub");
 var SESSION_SYNC_STORAGE_KEY = "cimplify_session_sync";
@@ -1623,9 +1636,9 @@ var CimplifyClient = class {
    * merchant auth flows, never by the raw token setter. Global Link clients
    * have no storefront tenant and therefore activate without this step.
    */
-  autoClaimChatIdentity() {
+  autoClaimSession() {
     if (typeof window === "undefined" || !this.sessionToken || !this.accessToken) return;
-    void this.support.claimConversation();
+    void this.session.claim();
   }
   /**
    * Adopt a server-rotated session token (claim flow). The old token stays
@@ -1713,8 +1726,9 @@ var CimplifyClient = class {
       this.sessionEpoch++;
       this.events.emit(SESSION_CLAIMED, {
         sessionToken: payload.token,
-        threadId: null,
-        customerName: payload.name ?? ""
+        customerName: payload.name ?? "",
+        customer: null,
+        cart: null
       });
     } else {
       this.accessToken = null;
@@ -2371,6 +2385,12 @@ var CimplifyClient = class {
     }
     return this._support;
   }
+  get session() {
+    if (!this._session) {
+      this._session = new SessionService(this);
+    }
+    return this._session;
+  }
   buildWsUrl(path) {
     const protocol = this.baseUrl.startsWith("https") ? "wss:" : "ws:";
     const host = this.baseUrl.replace(/^https?:\/\//, "");
@@ -2391,4 +2411,4 @@ function createCimplifyClient(config = {}) {
   return new CimplifyClient(config);
 }
 
-export { ActivityService, CimplifyClient, DeliveryService, HostedPurchaseIntentService, PURCHASE_INTENT_ROUTE, PlacesService, PurchaseIntentResolver, PurchaseIntentService, SESSION_CHANGE_SOURCE, StoreCreditQueries, SubscriptionService, SupportService, UploadService, chatRealtimeUpdateFromWire, createCimplifyClient };
+export { ActivityService, CimplifyClient, DeliveryService, HostedPurchaseIntentService, PURCHASE_INTENT_ROUTE, PlacesService, PurchaseIntentResolver, PurchaseIntentService, SESSION_CHANGE_SOURCE, SessionService, StoreCreditQueries, SubscriptionService, SupportService, UploadService, chatRealtimeUpdateFromWire, createCimplifyClient };