@cimplify/sdk 0.108.0 → 0.110.2

package/dist/server.js

@@ -1,45 +1,34 @@
 'use strict';
 
-var chunkEDK3LNM6_js = require('./chunk-EDK3LNM6.js');
-require('./chunk-XREIZ56K.js');
-var chunkF7J3HK27_js = require('./chunk-F7J3HK27.js');
-require('./chunk-EV2EVOYS.js');
-require('./chunk-V32BCG7M.js');
-var chunkANT574FD_js = require('./chunk-ANT574FD.js');
-require('./chunk-OWW5GUSB.js');
+var chunkQ2Y3VMKH_js = require('./chunk-Q2Y3VMKH.js');
+require('./chunk-WOF3AD3J.js');
+var chunkOMTVH334_js = require('./chunk-OMTVH334.js');
+require('./chunk-GTJWQAGU.js');
+require('./chunk-DFZWHNRG.js');
+var chunkUCR5HRYM_js = require('./chunk-UCR5HRYM.js');
+require('./chunk-JGBCIKJV.js');
 var react = require('react');
 var jose = require('jose');
 
-var DEFAULT_PROD_URL = "https://storefronts.cimplify.io";
-var DEFAULT_DEV_URL = "http://127.0.0.1:8787";
+var DEFAULT_PROD_URL = "https://storefronts.cimplify.io", DEFAULT_DEV_URL = "http://127.0.0.1:8787";
 function defaultBaseUrl() {
-  const proc = globalThis.process;
-  return proc?.env?.NODE_ENV === "development" ? DEFAULT_DEV_URL : DEFAULT_PROD_URL;
+  return globalThis.process?.env?.NODE_ENV === "development" ? DEFAULT_DEV_URL : DEFAULT_PROD_URL;
 }
 function readEnv(...keys) {
-  const env = globalThis.process?.env;
-  if (!env) return void 0;
-  for (const k of keys) {
-    const v = env[k]?.trim();
-    if (v) return v;
-  }
-  return void 0;
+  let env = globalThis.process?.env;
+  if (env)
+    for (let k of keys) {
+      let v = env[k]?.trim();
+      if (v) return v;
+    }
 }
 var getServerClient = react.cache((opts = {}) => {
-  const baseUrl = opts.apiUrl ?? readEnv("CIMPLIFY_API_URL", "NEXT_PUBLIC_CIMPLIFY_API_URL") ?? defaultBaseUrl();
-  const publicKey = opts.secretKey ?? readEnv("CIMPLIFY_SECRET_KEY", "NEXT_PUBLIC_CIMPLIFY_PUBLIC_KEY") ?? "mock-dev";
-  const client = chunkEDK3LNM6_js.createCimplifyClient({
+  let baseUrl = opts.apiUrl ?? readEnv("CIMPLIFY_API_URL", "NEXT_PUBLIC_CIMPLIFY_API_URL") ?? defaultBaseUrl(), publicKey = opts.secretKey ?? readEnv("CIMPLIFY_SECRET_KEY", "NEXT_PUBLIC_CIMPLIFY_PUBLIC_KEY") ?? "mock-dev", client = chunkQ2Y3VMKH_js.createCimplifyClient({
     baseUrl,
     publicKey,
     suppressPublicKeyWarning: true
   });
-  if (opts.locationId) {
-    client.setLocationId(opts.locationId);
-  }
-  if (opts.accessToken) {
-    client.setAccessToken(opts.accessToken);
-  }
-  return client;
+  return opts.locationId && client.setLocationId(opts.locationId), opts.accessToken && client.setAccessToken(opts.accessToken), client;
 });
 
 // src/server/tags.ts
@@ -70,27 +59,68 @@ var tags = {
   order: (id) => `cimplify:order:${id}`
 };
 
+// src/server/purge.ts
+var PROJECT_ENV = "CIMPLIFY_PROJECT_ID", TOKEN_ENV = "CIMPLIFY_SITE_PURGE_TOKEN", API_URL_ENV = "CIMPLIFY_API_URL", DEFAULT_API_URL = "https://api.cimplify.io", PURGE_PATH_PREFIX = "/v1/pub/sites/", PURGE_PATH_SUFFIX = "/cache/purge", SITE_PURGE_MAX_TAGS = 64, SITE_PURGE_MAX_TAG_BYTES = 256, SitePurgeError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "SitePurgeError";
+  }
+};
+function readEnv2(key) {
+  let value = globalThis.process?.env?.[key]?.trim();
+  return value || void 0;
+}
+function printable(tag) {
+  if (tag.length === 0 || new TextEncoder().encode(tag).length > 256)
+    return false;
+  for (let char of tag) {
+    let code = char.codePointAt(0) ?? 0;
+    if (code <= 32 || code >= 127) return false;
+  }
+  return true;
+}
+async function purgeSiteCache(tags2, options = {}) {
+  let projectId = options.projectId ?? readEnv2(PROJECT_ENV), token = options.token ?? readEnv2(TOKEN_ENV);
+  if (!projectId || !token)
+    throw new SitePurgeError(
+      `purgeSiteCache needs ${PROJECT_ENV} and ${TOKEN_ENV}; Core binds both into every site it builds`
+    );
+  if (tags2.length === 0)
+    return { deployments: 0 };
+  if (tags2.length > 64)
+    throw new SitePurgeError("purgeSiteCache takes at most 64 tags");
+  let invalid = tags2.find((tag) => !printable(tag));
+  if (invalid !== void 0)
+    throw new SitePurgeError(`purgeSiteCache tag is not printable ASCII up to 256 bytes: ${invalid}`);
+  let apiUrl = (options.apiUrl ?? readEnv2(API_URL_ENV) ?? DEFAULT_API_URL).replace(/\/+$/, ""), response = await (options.fetch ?? fetch)(
+    `${apiUrl}${PURGE_PATH_PREFIX}${encodeURIComponent(projectId)}${PURGE_PATH_SUFFIX}`,
+    {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${token}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({ tags: tags2 })
+    }
+  );
+  if (!response.ok)
+    throw new SitePurgeError(`Core refused the site purge (${response.status})`, response.status);
+  let deployments = (await response.json()).data?.deployments;
+  return { deployments: typeof deployments == "number" ? deployments : 0 };
+}
+
 // src/server/cache-life.ts
-var CACHE_LIFE_DEFAULT = "max";
-var CACHE_LIFE_PROBE = "seconds";
+var CACHE_LIFE_DEFAULT = "max", CACHE_LIFE_PROBE = "seconds";
 
 // src/server/revalidate.ts
-var DEFAULT_PROFILE = CACHE_LIFE_DEFAULT;
-var _revalidateTag = null;
+var DEFAULT_PROFILE = "max", _revalidateTag = null;
 async function getRevalidateTag() {
-  if (_revalidateTag) return _revalidateTag;
-  const specifier = "next/cache";
-  const mod = await import(
-    /* webpackIgnore: true */
-    /* @vite-ignore */
-    specifier
-  );
-  _revalidateTag = mod.revalidateTag;
-  return _revalidateTag;
+  return _revalidateTag || (_revalidateTag = (await import('next/cache')).revalidateTag, _revalidateTag);
 }
 async function revalidate(profile, ...tagList) {
-  const fn = await getRevalidateTag();
-  for (const t of tagList) fn(t, profile);
+  let fn = await getRevalidateTag();
+  for (let t of tagList) fn(t, profile);
 }
 async function revalidateProducts(profile = DEFAULT_PROFILE) {
   return revalidate(profile, tags.products());
@@ -150,39 +180,24 @@ async function revalidateByTag(tag, profile = DEFAULT_PROFILE) {
 }
 
 // src/server/update.ts
-var _updateTag = null;
-var _refresh = null;
+var _updateTag = null, _refresh = null;
 async function getUpdateTag() {
   if (_updateTag) return _updateTag;
-  const specifier = "next/cache";
-  const mod = await import(
-    /* webpackIgnore: true */
-    /* @vite-ignore */
-    specifier
-  );
-  if (!mod.updateTag) {
+  let mod = await import('next/cache');
+  if (!mod.updateTag)
     throw new Error("updateTag is not exported from next/cache \u2014 requires Next 16+");
-  }
-  _updateTag = mod.updateTag;
-  return _updateTag;
+  return _updateTag = mod.updateTag, _updateTag;
 }
 async function getRefresh() {
   if (_refresh) return _refresh;
-  const specifier = "next/cache";
-  const mod = await import(
-    /* webpackIgnore: true */
-    /* @vite-ignore */
-    specifier
-  );
-  if (!mod.refresh) {
+  let mod = await import('next/cache');
+  if (!mod.refresh)
     throw new Error("refresh is not exported from next/cache \u2014 requires Next 16+");
-  }
-  _refresh = mod.refresh;
-  return _refresh;
+  return _refresh = mod.refresh, _refresh;
 }
 async function update(...tagList) {
-  const fn = await getUpdateTag();
-  for (const t of tagList) fn(t);
+  let fn = await getUpdateTag();
+  for (let t of tagList) fn(t);
 }
 async function updateProducts() {
   return update(tags.products());
@@ -236,23 +251,11 @@ async function updateByTag(tag) {
   return update(tag);
 }
 async function refreshPage() {
-  const fn = await getRefresh();
-  fn();
-}
-var SESSION_COOKIE = "cimplify_session";
-var ACCESS_TOKEN_COOKIE = "cimplify_access";
-var REFRESH_TOKEN_COOKIE = "cimplify_refresh";
-var REFRESH_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 30;
-var ACCESS_REFRESH_SKEW_SECONDS = 30;
-var HEADER_LOCATION = "Location";
-var PARAM_CODE = "code";
-var PARAM_STATE = "state";
-var PARAM_ERROR = "error";
-var QUERY_AUTH_ERROR = "cimplify_auth_error";
-var discoveryCache = /* @__PURE__ */ new Map();
-var jwksCache = /* @__PURE__ */ new Map();
+  (await getRefresh())();
+}
+var SESSION_COOKIE = "cimplify_session", ACCESS_TOKEN_COOKIE = "cimplify_access", REFRESH_TOKEN_COOKIE = "cimplify_refresh", REFRESH_COOKIE_MAX_AGE_SECONDS = 3600 * 24 * 30, ACCESS_REFRESH_SKEW_SECONDS = 30, HEADER_LOCATION = "Location", PARAM_CODE = "code", PARAM_STATE = "state", PARAM_ERROR = "error", QUERY_AUTH_ERROR = "cimplify_auth_error", discoveryCache = /* @__PURE__ */ new Map(), jwksCache = /* @__PURE__ */ new Map();
 function issuerBase(cfg) {
-  return (cfg.issuer ?? cfg.authUrl ?? chunkF7J3HK27_js.DEFAULT_ISSUER).replace(/\/$/, "");
+  return (cfg.issuer ?? cfg.authUrl ?? chunkOMTVH334_js.DEFAULT_ISSUER).replace(/\/$/, "");
 }
 function cookieName(cfg) {
   return cfg.cookieName ?? SESSION_COOKIE;
@@ -264,47 +267,35 @@ function refreshTokenCookieName(cfg) {
   return cfg.refreshTokenCookieName ?? REFRESH_TOKEN_COOKIE;
 }
 async function discovery(cfg) {
-  const base = issuerBase(cfg);
-  let p = discoveryCache.get(base);
-  if (!p) {
-    p = fetch(`${base}/.well-known/openid-configuration`, {
-      next: { revalidate: 3600 }
-    }).then((r) => {
-      if (!r.ok) throw new Error(`oidc discovery failed: ${r.status}`);
-      return r.json();
-    });
-    discoveryCache.set(base, p);
-  }
-  return p;
+  let base = issuerBase(cfg), p = discoveryCache.get(base);
+  return p || (p = fetch(`${base}/.well-known/openid-configuration`, {
+    next: { revalidate: 3600 }
+  }).then((r) => {
+    if (!r.ok) throw new Error(`oidc discovery failed: ${r.status}`);
+    return r.json();
+  }), discoveryCache.set(base, p)), p;
 }
 async function jwks(cfg) {
-  const doc = await discovery(cfg);
-  let set = jwksCache.get(doc.jwks_uri);
-  if (!set) {
-    set = jose.createRemoteJWKSet(new URL(doc.jwks_uri));
-    jwksCache.set(doc.jwks_uri, set);
-  }
-  return { set, issuer: doc.issuer };
+  let doc = await discovery(cfg), set = jwksCache.get(doc.jwks_uri);
+  return set || (set = jose.createRemoteJWKSet(new URL(doc.jwks_uri)), jwksCache.set(doc.jwks_uri, set)), { set, issuer: doc.issuer };
 }
 async function exchangeCode(opts) {
-  const doc = await discovery(opts);
-  const body = new URLSearchParams({
+  let doc = await discovery(opts), body = new URLSearchParams({
     grant_type: "authorization_code",
     code: opts.code,
     code_verifier: opts.codeVerifier,
     redirect_uri: opts.redirectUri,
     client_id: opts.clientId
-  });
-  const res = await fetch(doc.token_endpoint, {
+  }), res = await fetch(doc.token_endpoint, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body: body.toString()
   });
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
+    let text = await res.text().catch(() => "");
     throw new Error(`token exchange failed (${res.status}): ${text}`);
   }
-  const payload = await res.json();
+  let payload = await res.json();
   return {
     accessToken: payload.access_token,
     idToken: payload.id_token,
@@ -314,7 +305,7 @@ async function exchangeCode(opts) {
   };
 }
 async function verifyIdToken(cfg, idToken) {
-  const { set, issuer } = await jwks(cfg);
+  let { set, issuer } = await jwks(cfg);
   return jose.jwtVerify(idToken, set, {
     issuer,
     audience: cfg.clientId
@@ -333,26 +324,22 @@ function payloadToSession(payload) {
   };
 }
 function buildSessionCookie(cfg, idToken, maxAgeSeconds) {
-  const name = cookieName(cfg);
-  const parts = [
-    `${name}=${idToken}`,
+  let parts = [
+    `${cookieName(cfg)}=${idToken}`,
     "Path=/",
     "HttpOnly",
     "Secure",
     "SameSite=Lax",
     `Max-Age=${maxAgeSeconds}`
   ];
-  if (cfg.cookieDomain) parts.push(`Domain=${cfg.cookieDomain}`);
-  return parts.join("; ");
+  return cfg.cookieDomain && parts.push(`Domain=${cfg.cookieDomain}`), parts.join("; ");
 }
 function buildSignoutCookie(cfg) {
-  const name = cookieName(cfg);
-  const parts = [`${name}=`, "Path=/", "HttpOnly", "Secure", "SameSite=Lax", "Max-Age=0"];
-  if (cfg.cookieDomain) parts.push(`Domain=${cfg.cookieDomain}`);
-  return parts.join("; ");
+  let parts = [`${cookieName(cfg)}=`, "Path=/", "HttpOnly", "Secure", "SameSite=Lax", "Max-Age=0"];
+  return cfg.cookieDomain && parts.push(`Domain=${cfg.cookieDomain}`), parts.join("; ");
 }
 function buildAccessTokenCookie(cfg, accessToken, maxAgeSeconds) {
-  const parts = [
+  let parts = [
     `${accessTokenCookieName(cfg)}=${accessToken}`,
     "Path=/",
     "HttpOnly",
@@ -360,11 +347,10 @@ function buildAccessTokenCookie(cfg, accessToken, maxAgeSeconds) {
     "SameSite=Lax",
     `Max-Age=${maxAgeSeconds}`
   ];
-  if (cfg.cookieDomain) parts.push(`Domain=${cfg.cookieDomain}`);
-  return parts.join("; ");
+  return cfg.cookieDomain && parts.push(`Domain=${cfg.cookieDomain}`), parts.join("; ");
 }
 function buildRefreshTokenCookie(cfg, refreshToken, maxAgeSeconds) {
-  const parts = [
+  let parts = [
     `${refreshTokenCookieName(cfg)}=${refreshToken}`,
     "Path=/",
     "HttpOnly",
@@ -372,14 +358,12 @@ function buildRefreshTokenCookie(cfg, refreshToken, maxAgeSeconds) {
     "SameSite=Lax",
     `Max-Age=${maxAgeSeconds}`
   ];
-  if (cfg.cookieDomain) parts.push(`Domain=${cfg.cookieDomain}`);
-  return parts.join("; ");
+  return cfg.cookieDomain && parts.push(`Domain=${cfg.cookieDomain}`), parts.join("; ");
 }
 function buildSignoutCookies(cfg) {
-  const clear = (name) => {
-    const parts = [`${name}=`, "Path=/", "HttpOnly", "Secure", "SameSite=Lax", "Max-Age=0"];
-    if (cfg.cookieDomain) parts.push(`Domain=${cfg.cookieDomain}`);
-    return parts.join("; ");
+  let clear = (name) => {
+    let parts = [`${name}=`, "Path=/", "HttpOnly", "Secure", "SameSite=Lax", "Max-Age=0"];
+    return cfg.cookieDomain && parts.push(`Domain=${cfg.cookieDomain}`), parts.join("; ");
   };
   return [
     clear(cookieName(cfg)),
@@ -389,25 +373,21 @@ function buildSignoutCookies(cfg) {
 }
 function readCookie(name, cookieHeader) {
   if (!cookieHeader) return null;
-  const match = cookieHeader.split(/;\s*/).find((p) => p.startsWith(`${name}=`));
-  if (!match) return null;
-  return match.slice(name.length + 1) || null;
+  let match = cookieHeader.split(/;\s*/).find((p) => p.startsWith(`${name}=`));
+  return match && match.slice(name.length + 1) || null;
 }
 function getRefreshTokenFromCookieHeader(cfg, cookieHeader) {
   return readCookie(refreshTokenCookieName(cfg), cookieHeader);
 }
 function getAccessTokenFromCookieHeader(cfg, cookieHeader) {
   if (!cookieHeader) return null;
-  const name = accessTokenCookieName(cfg);
-  const match = cookieHeader.split(/;\s*/).find((p) => p.startsWith(`${name}=`));
-  if (!match) return null;
-  const token = match.slice(name.length + 1);
-  return token || null;
+  let name = accessTokenCookieName(cfg), match = cookieHeader.split(/;\s*/).find((p) => p.startsWith(`${name}=`));
+  return match && match.slice(name.length + 1) || null;
 }
 function isSameOriginCallback(req, redirectUri) {
-  const site = req.headers.get("sec-fetch-site");
+  let site = req.headers.get("sec-fetch-site");
   if (site) return site === "same-origin";
-  const origin = req.headers.get("origin");
+  let origin = req.headers.get("origin");
   if (!origin) return false;
   try {
     return origin === new URL(redirectUri).origin;
@@ -416,18 +396,16 @@ function isSameOriginCallback(req, redirectUri) {
   }
 }
 async function handleOidcCallback(req, opts) {
-  if (!isSameOriginCallback(req, opts.redirectUri)) {
+  if (!isSameOriginCallback(req, opts.redirectUri))
     return Response.json({ error: "forbidden_origin" }, { status: 403 });
-  }
   let body;
   try {
     body = await req.json();
   } catch {
     return Response.json({ error: "invalid_json" }, { status: 400 });
   }
-  if (!body.code || !body.codeVerifier) {
+  if (!body.code || !body.codeVerifier)
     return Response.json({ error: "missing_code_or_verifier" }, { status: 400 });
-  }
   let tokens;
   try {
     tokens = await exchangeCode({
@@ -438,24 +416,18 @@ async function handleOidcCallback(req, opts) {
   } catch {
     return Response.json({ error: "exchange_failed" }, { status: 400 });
   }
-  if (!tokens.idToken) {
+  if (!tokens.idToken)
     return Response.json({ error: "missing_id_token" }, { status: 400 });
-  }
   try {
     await verifyIdToken(opts, tokens.idToken);
   } catch {
     return Response.json({ error: "id_token_invalid" }, { status: 401 });
   }
-  const headers = new Headers({ "Content-Type": "application/json" });
-  headers.append("Set-Cookie", buildSessionCookie(opts, tokens.idToken, tokens.expiresIn));
-  headers.append("Set-Cookie", buildAccessTokenCookie(opts, tokens.accessToken, tokens.expiresIn));
-  if (tokens.refreshToken) {
-    headers.append(
-      "Set-Cookie",
-      buildRefreshTokenCookie(opts, tokens.refreshToken, REFRESH_COOKIE_MAX_AGE_SECONDS)
-    );
-  }
-  return new Response(
+  let headers = new Headers({ "Content-Type": "application/json" });
+  return headers.append("Set-Cookie", buildSessionCookie(opts, tokens.idToken, tokens.expiresIn)), headers.append("Set-Cookie", buildAccessTokenCookie(opts, tokens.accessToken, tokens.expiresIn)), tokens.refreshToken && headers.append(
+    "Set-Cookie",
+    buildRefreshTokenCookie(opts, tokens.refreshToken, REFRESH_COOKIE_MAX_AGE_SECONDS)
+  ), new Response(
     JSON.stringify({
       ok: true,
       accessToken: tokens.accessToken,
@@ -467,32 +439,23 @@ async function handleOidcCallback(req, opts) {
 }
 function readPkceCookie(cookieHeader) {
   if (!cookieHeader) return null;
-  const match = cookieHeader.split(/;\s*/).find((p) => p.startsWith(`${chunkF7J3HK27_js.PKCE_COOKIE}=`));
-  if (!match) return null;
-  return chunkF7J3HK27_js.decodePkceState(match.slice(chunkF7J3HK27_js.PKCE_COOKIE.length + 1));
+  let match = cookieHeader.split(/;\s*/).find((p) => p.startsWith(`${chunkOMTVH334_js.PKCE_COOKIE}=`));
+  return match ? chunkOMTVH334_js.decodePkceState(match.slice(chunkOMTVH334_js.PKCE_COOKIE.length + 1)) : null;
 }
 function buildPkceClearCookie() {
-  return `${chunkF7J3HK27_js.PKCE_COOKIE}=; Path=${chunkF7J3HK27_js.PKCE_COOKIE_PATH}; Max-Age=0; Secure; SameSite=Lax`;
+  return `${chunkOMTVH334_js.PKCE_COOKIE}=; Path=${chunkOMTVH334_js.PKCE_COOKIE_PATH}; Max-Age=0; Secure; SameSite=Lax`;
 }
 function safeReturnPath(returnTo, fallback) {
-  if (returnTo && returnTo.startsWith("/") && !returnTo.startsWith("//")) return returnTo;
-  return fallback;
+  return returnTo && returnTo.startsWith("/") && !returnTo.startsWith("//") ? returnTo : fallback;
 }
 function withAuthError(path, reason) {
-  const sep = path.includes("?") ? "&" : "?";
+  let sep = path.includes("?") ? "&" : "?";
   return `${path}${sep}${QUERY_AUTH_ERROR}=${encodeURIComponent(reason)}`;
 }
 async function handleRedirectCallback(req, opts) {
-  const url = new URL(req.url);
-  const code = url.searchParams.get(PARAM_CODE);
-  const urlState = url.searchParams.get(PARAM_STATE);
-  const authError = url.searchParams.get(PARAM_ERROR);
-  const pkce = readPkceCookie(req.headers.get("cookie"));
-  const returnTo = safeReturnPath(pkce?.returnTo, opts.defaultReturnTo ?? "/");
-  const fail = (reason) => {
-    const headers2 = new Headers({ [HEADER_LOCATION]: withAuthError(returnTo, reason) });
-    headers2.append("Set-Cookie", buildPkceClearCookie());
-    return new Response(null, { status: 302, headers: headers2 });
+  let url = new URL(req.url), code = url.searchParams.get(PARAM_CODE), urlState = url.searchParams.get(PARAM_STATE), authError = url.searchParams.get(PARAM_ERROR), pkce = readPkceCookie(req.headers.get("cookie")), returnTo = safeReturnPath(pkce?.returnTo, opts.defaultReturnTo ?? "/"), fail = (reason) => {
+    let headers2 = new Headers({ [HEADER_LOCATION]: withAuthError(returnTo, reason) });
+    return headers2.append("Set-Cookie", buildPkceClearCookie()), new Response(null, { status: 302, headers: headers2 });
   };
   if (authError) return fail(authError);
   if (!code || !pkce) return fail("missing_code");
@@ -509,62 +472,50 @@ async function handleRedirectCallback(req, opts) {
   } catch {
     return fail("id_token_invalid");
   }
-  const headers = new Headers({ [HEADER_LOCATION]: returnTo });
-  headers.append("Set-Cookie", buildSessionCookie(opts, tokens.idToken, tokens.expiresIn));
-  headers.append("Set-Cookie", buildAccessTokenCookie(opts, tokens.accessToken, tokens.expiresIn));
-  if (tokens.refreshToken) {
-    headers.append(
-      "Set-Cookie",
-      buildRefreshTokenCookie(opts, tokens.refreshToken, REFRESH_COOKIE_MAX_AGE_SECONDS)
-    );
-  }
-  headers.append("Set-Cookie", buildPkceClearCookie());
-  return new Response(null, { status: 302, headers });
+  let headers = new Headers({ [HEADER_LOCATION]: returnTo });
+  return headers.append("Set-Cookie", buildSessionCookie(opts, tokens.idToken, tokens.expiresIn)), headers.append("Set-Cookie", buildAccessTokenCookie(opts, tokens.accessToken, tokens.expiresIn)), tokens.refreshToken && headers.append(
+    "Set-Cookie",
+    buildRefreshTokenCookie(opts, tokens.refreshToken, REFRESH_COOKIE_MAX_AGE_SECONDS)
+  ), headers.append("Set-Cookie", buildPkceClearCookie()), new Response(null, { status: 302, headers });
 }
 async function handleSessionRequest(req, cfg) {
-  const session = await getSessionFromCookieHeader(cfg, req.headers.get("cookie"));
-  if (!session) {
-    return new Response(JSON.stringify({ sub: null }), {
-      status: 200,
-      headers: { "Content-Type": "application/json", "Cache-Control": "no-store" }
-    });
-  }
-  return new Response(JSON.stringify(session), {
+  let session = await getSessionFromCookieHeader(cfg, req.headers.get("cookie"));
+  return session ? new Response(JSON.stringify(session), {
+    status: 200,
+    headers: { "Content-Type": "application/json", "Cache-Control": "no-store" }
+  }) : new Response(JSON.stringify({ sub: null }), {
     status: 200,
     headers: { "Content-Type": "application/json", "Cache-Control": "no-store" }
   });
 }
 async function getSessionFromCookieHeader(cfg, cookieHeader) {
   if (!cookieHeader) return null;
-  const name = cookieName(cfg);
-  const match = cookieHeader.split(/;\s*/).find((p) => p.startsWith(`${name}=`));
+  let name = cookieName(cfg), match = cookieHeader.split(/;\s*/).find((p) => p.startsWith(`${name}=`));
   if (!match) return null;
-  const token = match.slice(name.length + 1);
+  let token = match.slice(name.length + 1);
   if (!token) return null;
   try {
-    const { payload } = await verifyIdToken(cfg, token);
+    let { payload } = await verifyIdToken(cfg, token);
     return payloadToSession(payload);
   } catch {
     return null;
   }
 }
 async function refreshTokens(cfg, refreshToken) {
-  const doc = await discovery(cfg);
-  const body = new URLSearchParams({
+  let doc = await discovery(cfg), body = new URLSearchParams({
     grant_type: "refresh_token",
     refresh_token: refreshToken,
     client_id: cfg.clientId
-  });
-  const res = await fetch(doc.token_endpoint, {
+  }), res = await fetch(doc.token_endpoint, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body: body.toString()
   });
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
+    let text = await res.text().catch(() => "");
     throw new Error(`token refresh failed (${res.status}): ${text}`);
   }
-  const payload = await res.json();
+  let payload = await res.json();
   return {
     accessToken: payload.access_token,
     idToken: payload.id_token,
@@ -574,28 +525,26 @@ async function refreshTokens(cfg, refreshToken) {
   };
 }
 function decodeBase64Url(segment) {
-  const b64 = segment.replace(/-/g, "+").replace(/_/g, "/");
-  const pad = b64.length % 4 ? "=".repeat(4 - b64.length % 4) : "";
+  let b64 = segment.replace(/-/g, "+").replace(/_/g, "/"), pad = b64.length % 4 ? "=".repeat(4 - b64.length % 4) : "";
   return atob(b64 + pad);
 }
 function accessTokenExpiry(token) {
   if (!token) return null;
-  const parts = token.split(".");
+  let parts = token.split(".");
   if (parts.length < 2) return null;
   try {
-    const payload = JSON.parse(decodeBase64Url(parts[1]));
-    return typeof payload.exp === "number" ? payload.exp : null;
+    let payload = JSON.parse(decodeBase64Url(parts[1]));
+    return typeof payload.exp == "number" ? payload.exp : null;
   } catch {
     return null;
   }
 }
 var refreshInflight = /* @__PURE__ */ new Map();
 function dedupedRefresh(cfg, refreshToken) {
-  const existing = refreshInflight.get(refreshToken);
+  let existing = refreshInflight.get(refreshToken);
   if (existing) return existing;
-  const p = refreshTokens(cfg, refreshToken).finally(() => refreshInflight.delete(refreshToken));
-  refreshInflight.set(refreshToken, p);
-  return p;
+  let p = refreshTokens(cfg, refreshToken).finally(() => refreshInflight.delete(refreshToken));
+  return refreshInflight.set(refreshToken, p), p;
 }
 function clearedResult(cfg) {
   return {
@@ -609,15 +558,11 @@ function clearedResult(cfg) {
   };
 }
 async function handleTokenRefresh(req, cfg) {
-  const cookieHeader = req.headers.get("cookie");
-  const refreshToken = getRefreshTokenFromCookieHeader(cfg, cookieHeader);
+  let cookieHeader = req.headers.get("cookie"), refreshToken = getRefreshTokenFromCookieHeader(cfg, cookieHeader);
   if (!refreshToken) return { outcome: "noop", setCookies: [], cookies: [] };
-  const access = getAccessTokenFromCookieHeader(cfg, cookieHeader);
-  const exp = accessTokenExpiry(access);
-  const now = Math.floor(Date.now() / 1e3);
-  if (access && exp !== null && exp - now > ACCESS_REFRESH_SKEW_SECONDS) {
+  let access = getAccessTokenFromCookieHeader(cfg, cookieHeader), exp = accessTokenExpiry(access), now = Math.floor(Date.now() / 1e3);
+  if (access && exp !== null && exp - now > (30))
     return { outcome: "noop", setCookies: [], cookies: [] };
-  }
   let tokens;
   try {
     tokens = await dedupedRefresh(cfg, refreshToken);
@@ -625,29 +570,27 @@ async function handleTokenRefresh(req, cfg) {
     return clearedResult(cfg);
   }
   if (!tokens.idToken) return clearedResult(cfg);
-  const setCookies = [
+  let setCookies = [
     buildSessionCookie(cfg, tokens.idToken, tokens.expiresIn),
     buildAccessTokenCookie(cfg, tokens.accessToken, tokens.expiresIn)
-  ];
-  const cookies = [
+  ], cookies = [
     { name: cookieName(cfg), value: tokens.idToken },
     { name: accessTokenCookieName(cfg), value: tokens.accessToken }
   ];
-  if (tokens.refreshToken) {
-    setCookies.push(
-      buildRefreshTokenCookie(cfg, tokens.refreshToken, REFRESH_COOKIE_MAX_AGE_SECONDS)
-    );
-    cookies.push({ name: refreshTokenCookieName(cfg), value: tokens.refreshToken });
-  }
-  return { outcome: "refreshed", setCookies, cookies };
+  return tokens.refreshToken && (setCookies.push(
+    buildRefreshTokenCookie(cfg, tokens.refreshToken, REFRESH_COOKIE_MAX_AGE_SECONDS)
+  ), cookies.push({ name: refreshTokenCookieName(cfg), value: tokens.refreshToken })), { outcome: "refreshed", setCookies, cookies };
 }
 
 Object.defineProperty(exports, "CimplifyError", {
   enumerable: true,
-  get: function () { return chunkANT574FD_js.CimplifyError; }
+  get: function () { return chunkUCR5HRYM_js.CimplifyError; }
 });
 exports.CACHE_LIFE_DEFAULT = CACHE_LIFE_DEFAULT;
 exports.CACHE_LIFE_PROBE = CACHE_LIFE_PROBE;
+exports.SITE_PURGE_MAX_TAGS = (64);
+exports.SITE_PURGE_MAX_TAG_BYTES = (256);
+exports.SitePurgeError = SitePurgeError;
 exports.buildAccessTokenCookie = buildAccessTokenCookie;
 exports.buildRefreshTokenCookie = buildRefreshTokenCookie;
 exports.buildSessionCookie = buildSessionCookie;
@@ -662,6 +605,7 @@ exports.handleOidcCallback = handleOidcCallback;
 exports.handleRedirectCallback = handleRedirectCallback;
 exports.handleSessionRequest = handleSessionRequest;
 exports.handleTokenRefresh = handleTokenRefresh;
+exports.purgeSiteCache = purgeSiteCache;
 exports.refreshPage = refreshPage;
 exports.refreshTokens = refreshTokens;
 exports.revalidateAddOn = revalidateAddOn;