@cimplify/sdk 0.108.0 → 0.110.2

package/dist/server.mjs

@@ -1,43 +1,32 @@
-import { createCimplifyClient } from './chunk-SUCE7FWA.mjs';
-import './chunk-U4MW6PYU.mjs';
-import { PKCE_COOKIE, decodePkceState, PKCE_COOKIE_PATH, DEFAULT_ISSUER } from './chunk-U6ACF76H.mjs';
-import './chunk-33VCYWVL.mjs';
-import './chunk-JRGK3NXR.mjs';
-export { CimplifyError } from './chunk-KG3WT4PR.mjs';
-import './chunk-3G6RQLXK.mjs';
+import { createCimplifyClient } from './chunk-BTUSVHIE.mjs';
+import './chunk-SWX4SALA.mjs';
+import { PKCE_COOKIE, decodePkceState, PKCE_COOKIE_PATH, DEFAULT_ISSUER } from './chunk-A36JRXXH.mjs';
+import './chunk-E6QQKDNE.mjs';
+import './chunk-6ETDAU62.mjs';
+export { CimplifyError } from './chunk-GCKWKLZF.mjs';
+import './chunk-25T4JHEA.mjs';
 import { cache } from 'react';
 import { jwtVerify, createRemoteJWKSet } from 'jose';
 
-var DEFAULT_PROD_URL = "https://storefronts.cimplify.io";
-var DEFAULT_DEV_URL = "http://127.0.0.1:8787";
+var DEFAULT_PROD_URL = "https://storefronts.cimplify.io", DEFAULT_DEV_URL = "http://127.0.0.1:8787";
 function defaultBaseUrl() {
-  const proc = globalThis.process;
-  return proc?.env?.NODE_ENV === "development" ? DEFAULT_DEV_URL : DEFAULT_PROD_URL;
+  return globalThis.process?.env?.NODE_ENV === "development" ? DEFAULT_DEV_URL : DEFAULT_PROD_URL;
 }
 function readEnv(...keys) {
-  const env = globalThis.process?.env;
-  if (!env) return void 0;
-  for (const k of keys) {
-    const v = env[k]?.trim();
-    if (v) return v;
-  }
-  return void 0;
+  let env = globalThis.process?.env;
+  if (env)
+    for (let k of keys) {
+      let v = env[k]?.trim();
+      if (v) return v;
+    }
 }
 var getServerClient = cache((opts = {}) => {
-  const baseUrl = opts.apiUrl ?? readEnv("CIMPLIFY_API_URL", "NEXT_PUBLIC_CIMPLIFY_API_URL") ?? defaultBaseUrl();
-  const publicKey = opts.secretKey ?? readEnv("CIMPLIFY_SECRET_KEY", "NEXT_PUBLIC_CIMPLIFY_PUBLIC_KEY") ?? "mock-dev";
-  const client = createCimplifyClient({
+  let baseUrl = opts.apiUrl ?? readEnv("CIMPLIFY_API_URL", "NEXT_PUBLIC_CIMPLIFY_API_URL") ?? defaultBaseUrl(), publicKey = opts.secretKey ?? readEnv("CIMPLIFY_SECRET_KEY", "NEXT_PUBLIC_CIMPLIFY_PUBLIC_KEY") ?? "mock-dev", client = createCimplifyClient({
     baseUrl,
     publicKey,
     suppressPublicKeyWarning: true
   });
-  if (opts.locationId) {
-    client.setLocationId(opts.locationId);
-  }
-  if (opts.accessToken) {
-    client.setAccessToken(opts.accessToken);
-  }
-  return client;
+  return opts.locationId && client.setLocationId(opts.locationId), opts.accessToken && client.setAccessToken(opts.accessToken), client;
 });
 
 // src/server/tags.ts
@@ -68,27 +57,68 @@ var tags = {
   order: (id) => `cimplify:order:${id}`
 };
 
+// src/server/purge.ts
+var PROJECT_ENV = "CIMPLIFY_PROJECT_ID", TOKEN_ENV = "CIMPLIFY_SITE_PURGE_TOKEN", API_URL_ENV = "CIMPLIFY_API_URL", DEFAULT_API_URL = "https://api.cimplify.io", PURGE_PATH_PREFIX = "/v1/pub/sites/", PURGE_PATH_SUFFIX = "/cache/purge", SITE_PURGE_MAX_TAGS = 64, SITE_PURGE_MAX_TAG_BYTES = 256, SitePurgeError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "SitePurgeError";
+  }
+};
+function readEnv2(key) {
+  let value = globalThis.process?.env?.[key]?.trim();
+  return value || void 0;
+}
+function printable(tag) {
+  if (tag.length === 0 || new TextEncoder().encode(tag).length > 256)
+    return false;
+  for (let char of tag) {
+    let code = char.codePointAt(0) ?? 0;
+    if (code <= 32 || code >= 127) return false;
+  }
+  return true;
+}
+async function purgeSiteCache(tags2, options = {}) {
+  let projectId = options.projectId ?? readEnv2(PROJECT_ENV), token = options.token ?? readEnv2(TOKEN_ENV);
+  if (!projectId || !token)
+    throw new SitePurgeError(
+      `purgeSiteCache needs ${PROJECT_ENV} and ${TOKEN_ENV}; Core binds both into every site it builds`
+    );
+  if (tags2.length === 0)
+    return { deployments: 0 };
+  if (tags2.length > 64)
+    throw new SitePurgeError("purgeSiteCache takes at most 64 tags");
+  let invalid = tags2.find((tag) => !printable(tag));
+  if (invalid !== void 0)
+    throw new SitePurgeError(`purgeSiteCache tag is not printable ASCII up to 256 bytes: ${invalid}`);
+  let apiUrl = (options.apiUrl ?? readEnv2(API_URL_ENV) ?? DEFAULT_API_URL).replace(/\/+$/, ""), response = await (options.fetch ?? fetch)(
+    `${apiUrl}${PURGE_PATH_PREFIX}${encodeURIComponent(projectId)}${PURGE_PATH_SUFFIX}`,
+    {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${token}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({ tags: tags2 })
+    }
+  );
+  if (!response.ok)
+    throw new SitePurgeError(`Core refused the site purge (${response.status})`, response.status);
+  let deployments = (await response.json()).data?.deployments;
+  return { deployments: typeof deployments == "number" ? deployments : 0 };
+}
+
 // src/server/cache-life.ts
-var CACHE_LIFE_DEFAULT = "max";
-var CACHE_LIFE_PROBE = "seconds";
+var CACHE_LIFE_DEFAULT = "max", CACHE_LIFE_PROBE = "seconds";
 
 // src/server/revalidate.ts
-var DEFAULT_PROFILE = CACHE_LIFE_DEFAULT;
-var _revalidateTag = null;
+var DEFAULT_PROFILE = "max", _revalidateTag = null;
 async function getRevalidateTag() {
-  if (_revalidateTag) return _revalidateTag;
-  const specifier = "next/cache";
-  const mod = await import(
-    /* webpackIgnore: true */
-    /* @vite-ignore */
-    specifier
-  );
-  _revalidateTag = mod.revalidateTag;
-  return _revalidateTag;
+  return _revalidateTag || (_revalidateTag = (await import('next/cache')).revalidateTag, _revalidateTag);
 }
 async function revalidate(profile, ...tagList) {
-  const fn = await getRevalidateTag();
-  for (const t of tagList) fn(t, profile);
+  let fn = await getRevalidateTag();
+  for (let t of tagList) fn(t, profile);
 }
 async function revalidateProducts(profile = DEFAULT_PROFILE) {
   return revalidate(profile, tags.products());
@@ -148,39 +178,24 @@ async function revalidateByTag(tag, profile = DEFAULT_PROFILE) {
 }
 
 // src/server/update.ts
-var _updateTag = null;
-var _refresh = null;
+var _updateTag = null, _refresh = null;
 async function getUpdateTag() {
   if (_updateTag) return _updateTag;
-  const specifier = "next/cache";
-  const mod = await import(
-    /* webpackIgnore: true */
-    /* @vite-ignore */
-    specifier
-  );
-  if (!mod.updateTag) {
+  let mod = await import('next/cache');
+  if (!mod.updateTag)
     throw new Error("updateTag is not exported from next/cache \u2014 requires Next 16+");
-  }
-  _updateTag = mod.updateTag;
-  return _updateTag;
+  return _updateTag = mod.updateTag, _updateTag;
 }
 async function getRefresh() {
   if (_refresh) return _refresh;
-  const specifier = "next/cache";
-  const mod = await import(
-    /* webpackIgnore: true */
-    /* @vite-ignore */
-    specifier
-  );
-  if (!mod.refresh) {
+  let mod = await import('next/cache');
+  if (!mod.refresh)
     throw new Error("refresh is not exported from next/cache \u2014 requires Next 16+");
-  }
-  _refresh = mod.refresh;
-  return _refresh;
+  return _refresh = mod.refresh, _refresh;
 }
 async function update(...tagList) {
-  const fn = await getUpdateTag();
-  for (const t of tagList) fn(t);
+  let fn = await getUpdateTag();
+  for (let t of tagList) fn(t);
 }
 async function updateProducts() {
   return update(tags.products());
@@ -234,21 +249,9 @@ async function updateByTag(tag) {
   return update(tag);
 }
 async function refreshPage() {
-  const fn = await getRefresh();
-  fn();
-}
-var SESSION_COOKIE = "cimplify_session";
-var ACCESS_TOKEN_COOKIE = "cimplify_access";
-var REFRESH_TOKEN_COOKIE = "cimplify_refresh";
-var REFRESH_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 30;
-var ACCESS_REFRESH_SKEW_SECONDS = 30;
-var HEADER_LOCATION = "Location";
-var PARAM_CODE = "code";
-var PARAM_STATE = "state";
-var PARAM_ERROR = "error";
-var QUERY_AUTH_ERROR = "cimplify_auth_error";
-var discoveryCache = /* @__PURE__ */ new Map();
-var jwksCache = /* @__PURE__ */ new Map();
+  (await getRefresh())();
+}
+var SESSION_COOKIE = "cimplify_session", ACCESS_TOKEN_COOKIE = "cimplify_access", REFRESH_TOKEN_COOKIE = "cimplify_refresh", REFRESH_COOKIE_MAX_AGE_SECONDS = 3600 * 24 * 30, ACCESS_REFRESH_SKEW_SECONDS = 30, HEADER_LOCATION = "Location", PARAM_CODE = "code", PARAM_STATE = "state", PARAM_ERROR = "error", QUERY_AUTH_ERROR = "cimplify_auth_error", discoveryCache = /* @__PURE__ */ new Map(), jwksCache = /* @__PURE__ */ new Map();
 function issuerBase(cfg) {
   return (cfg.issuer ?? cfg.authUrl ?? DEFAULT_ISSUER).replace(/\/$/, "");
 }
@@ -262,47 +265,35 @@ function refreshTokenCookieName(cfg) {
   return cfg.refreshTokenCookieName ?? REFRESH_TOKEN_COOKIE;
 }
 async function discovery(cfg) {
-  const base = issuerBase(cfg);
-  let p = discoveryCache.get(base);
-  if (!p) {
-    p = fetch(`${base}/.well-known/openid-configuration`, {
-      next: { revalidate: 3600 }
-    }).then((r) => {
-      if (!r.ok) throw new Error(`oidc discovery failed: ${r.status}`);
-      return r.json();
-    });
-    discoveryCache.set(base, p);
-  }
-  return p;
+  let base = issuerBase(cfg), p = discoveryCache.get(base);
+  return p || (p = fetch(`${base}/.well-known/openid-configuration`, {
+    next: { revalidate: 3600 }
+  }).then((r) => {
+    if (!r.ok) throw new Error(`oidc discovery failed: ${r.status}`);
+    return r.json();
+  }), discoveryCache.set(base, p)), p;
 }
 async function jwks(cfg) {
-  const doc = await discovery(cfg);
-  let set = jwksCache.get(doc.jwks_uri);
-  if (!set) {
-    set = createRemoteJWKSet(new URL(doc.jwks_uri));
-    jwksCache.set(doc.jwks_uri, set);
-  }
-  return { set, issuer: doc.issuer };
+  let doc = await discovery(cfg), set = jwksCache.get(doc.jwks_uri);
+  return set || (set = createRemoteJWKSet(new URL(doc.jwks_uri)), jwksCache.set(doc.jwks_uri, set)), { set, issuer: doc.issuer };
 }
 async function exchangeCode(opts) {
-  const doc = await discovery(opts);
-  const body = new URLSearchParams({
+  let doc = await discovery(opts), body = new URLSearchParams({
     grant_type: "authorization_code",
     code: opts.code,
     code_verifier: opts.codeVerifier,
     redirect_uri: opts.redirectUri,
     client_id: opts.clientId
-  });
-  const res = await fetch(doc.token_endpoint, {
+  }), res = await fetch(doc.token_endpoint, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body: body.toString()
   });
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
+    let text = await res.text().catch(() => "");
     throw new Error(`token exchange failed (${res.status}): ${text}`);
   }
-  const payload = await res.json();
+  let payload = await res.json();
   return {
     accessToken: payload.access_token,
     idToken: payload.id_token,
@@ -312,7 +303,7 @@ async function exchangeCode(opts) {
   };
 }
 async function verifyIdToken(cfg, idToken) {
-  const { set, issuer } = await jwks(cfg);
+  let { set, issuer } = await jwks(cfg);
   return jwtVerify(idToken, set, {
     issuer,
     audience: cfg.clientId
@@ -331,26 +322,22 @@ function payloadToSession(payload) {
   };
 }
 function buildSessionCookie(cfg, idToken, maxAgeSeconds) {
-  const name = cookieName(cfg);
-  const parts = [
-    `${name}=${idToken}`,
+  let parts = [
+    `${cookieName(cfg)}=${idToken}`,
     "Path=/",
     "HttpOnly",
     "Secure",
     "SameSite=Lax",
     `Max-Age=${maxAgeSeconds}`
   ];
-  if (cfg.cookieDomain) parts.push(`Domain=${cfg.cookieDomain}`);
-  return parts.join("; ");
+  return cfg.cookieDomain && parts.push(`Domain=${cfg.cookieDomain}`), parts.join("; ");
 }
 function buildSignoutCookie(cfg) {
-  const name = cookieName(cfg);
-  const parts = [`${name}=`, "Path=/", "HttpOnly", "Secure", "SameSite=Lax", "Max-Age=0"];
-  if (cfg.cookieDomain) parts.push(`Domain=${cfg.cookieDomain}`);
-  return parts.join("; ");
+  let parts = [`${cookieName(cfg)}=`, "Path=/", "HttpOnly", "Secure", "SameSite=Lax", "Max-Age=0"];
+  return cfg.cookieDomain && parts.push(`Domain=${cfg.cookieDomain}`), parts.join("; ");
 }
 function buildAccessTokenCookie(cfg, accessToken, maxAgeSeconds) {
-  const parts = [
+  let parts = [
     `${accessTokenCookieName(cfg)}=${accessToken}`,
     "Path=/",
     "HttpOnly",
@@ -358,11 +345,10 @@ function buildAccessTokenCookie(cfg, accessToken, maxAgeSeconds) {
     "SameSite=Lax",
     `Max-Age=${maxAgeSeconds}`
   ];
-  if (cfg.cookieDomain) parts.push(`Domain=${cfg.cookieDomain}`);
-  return parts.join("; ");
+  return cfg.cookieDomain && parts.push(`Domain=${cfg.cookieDomain}`), parts.join("; ");
 }
 function buildRefreshTokenCookie(cfg, refreshToken, maxAgeSeconds) {
-  const parts = [
+  let parts = [
     `${refreshTokenCookieName(cfg)}=${refreshToken}`,
     "Path=/",
     "HttpOnly",
@@ -370,14 +356,12 @@ function buildRefreshTokenCookie(cfg, refreshToken, maxAgeSeconds) {
     "SameSite=Lax",
     `Max-Age=${maxAgeSeconds}`
   ];
-  if (cfg.cookieDomain) parts.push(`Domain=${cfg.cookieDomain}`);
-  return parts.join("; ");
+  return cfg.cookieDomain && parts.push(`Domain=${cfg.cookieDomain}`), parts.join("; ");
 }
 function buildSignoutCookies(cfg) {
-  const clear = (name) => {
-    const parts = [`${name}=`, "Path=/", "HttpOnly", "Secure", "SameSite=Lax", "Max-Age=0"];
-    if (cfg.cookieDomain) parts.push(`Domain=${cfg.cookieDomain}`);
-    return parts.join("; ");
+  let clear = (name) => {
+    let parts = [`${name}=`, "Path=/", "HttpOnly", "Secure", "SameSite=Lax", "Max-Age=0"];
+    return cfg.cookieDomain && parts.push(`Domain=${cfg.cookieDomain}`), parts.join("; ");
   };
   return [
     clear(cookieName(cfg)),
@@ -387,25 +371,21 @@ function buildSignoutCookies(cfg) {
 }
 function readCookie(name, cookieHeader) {
   if (!cookieHeader) return null;
-  const match = cookieHeader.split(/;\s*/).find((p) => p.startsWith(`${name}=`));
-  if (!match) return null;
-  return match.slice(name.length + 1) || null;
+  let match = cookieHeader.split(/;\s*/).find((p) => p.startsWith(`${name}=`));
+  return match && match.slice(name.length + 1) || null;
 }
 function getRefreshTokenFromCookieHeader(cfg, cookieHeader) {
   return readCookie(refreshTokenCookieName(cfg), cookieHeader);
 }
 function getAccessTokenFromCookieHeader(cfg, cookieHeader) {
   if (!cookieHeader) return null;
-  const name = accessTokenCookieName(cfg);
-  const match = cookieHeader.split(/;\s*/).find((p) => p.startsWith(`${name}=`));
-  if (!match) return null;
-  const token = match.slice(name.length + 1);
-  return token || null;
+  let name = accessTokenCookieName(cfg), match = cookieHeader.split(/;\s*/).find((p) => p.startsWith(`${name}=`));
+  return match && match.slice(name.length + 1) || null;
 }
 function isSameOriginCallback(req, redirectUri) {
-  const site = req.headers.get("sec-fetch-site");
+  let site = req.headers.get("sec-fetch-site");
   if (site) return site === "same-origin";
-  const origin = req.headers.get("origin");
+  let origin = req.headers.get("origin");
   if (!origin) return false;
   try {
     return origin === new URL(redirectUri).origin;
@@ -414,18 +394,16 @@ function isSameOriginCallback(req, redirectUri) {
   }
 }
 async function handleOidcCallback(req, opts) {
-  if (!isSameOriginCallback(req, opts.redirectUri)) {
+  if (!isSameOriginCallback(req, opts.redirectUri))
     return Response.json({ error: "forbidden_origin" }, { status: 403 });
-  }
   let body;
   try {
     body = await req.json();
   } catch {
     return Response.json({ error: "invalid_json" }, { status: 400 });
   }
-  if (!body.code || !body.codeVerifier) {
+  if (!body.code || !body.codeVerifier)
     return Response.json({ error: "missing_code_or_verifier" }, { status: 400 });
-  }
   let tokens;
   try {
     tokens = await exchangeCode({
@@ -436,24 +414,18 @@ async function handleOidcCallback(req, opts) {
   } catch {
     return Response.json({ error: "exchange_failed" }, { status: 400 });
   }
-  if (!tokens.idToken) {
+  if (!tokens.idToken)
     return Response.json({ error: "missing_id_token" }, { status: 400 });
-  }
   try {
     await verifyIdToken(opts, tokens.idToken);
   } catch {
     return Response.json({ error: "id_token_invalid" }, { status: 401 });
   }
-  const headers = new Headers({ "Content-Type": "application/json" });
-  headers.append("Set-Cookie", buildSessionCookie(opts, tokens.idToken, tokens.expiresIn));
-  headers.append("Set-Cookie", buildAccessTokenCookie(opts, tokens.accessToken, tokens.expiresIn));
-  if (tokens.refreshToken) {
-    headers.append(
-      "Set-Cookie",
-      buildRefreshTokenCookie(opts, tokens.refreshToken, REFRESH_COOKIE_MAX_AGE_SECONDS)
-    );
-  }
-  return new Response(
+  let headers = new Headers({ "Content-Type": "application/json" });
+  return headers.append("Set-Cookie", buildSessionCookie(opts, tokens.idToken, tokens.expiresIn)), headers.append("Set-Cookie", buildAccessTokenCookie(opts, tokens.accessToken, tokens.expiresIn)), tokens.refreshToken && headers.append(
+    "Set-Cookie",
+    buildRefreshTokenCookie(opts, tokens.refreshToken, REFRESH_COOKIE_MAX_AGE_SECONDS)
+  ), new Response(
     JSON.stringify({
       ok: true,
       accessToken: tokens.accessToken,
@@ -465,32 +437,23 @@ async function handleOidcCallback(req, opts) {
 }
 function readPkceCookie(cookieHeader) {
   if (!cookieHeader) return null;
-  const match = cookieHeader.split(/;\s*/).find((p) => p.startsWith(`${PKCE_COOKIE}=`));
-  if (!match) return null;
-  return decodePkceState(match.slice(PKCE_COOKIE.length + 1));
+  let match = cookieHeader.split(/;\s*/).find((p) => p.startsWith(`${PKCE_COOKIE}=`));
+  return match ? decodePkceState(match.slice(PKCE_COOKIE.length + 1)) : null;
 }
 function buildPkceClearCookie() {
   return `${PKCE_COOKIE}=; Path=${PKCE_COOKIE_PATH}; Max-Age=0; Secure; SameSite=Lax`;
 }
 function safeReturnPath(returnTo, fallback) {
-  if (returnTo && returnTo.startsWith("/") && !returnTo.startsWith("//")) return returnTo;
-  return fallback;
+  return returnTo && returnTo.startsWith("/") && !returnTo.startsWith("//") ? returnTo : fallback;
 }
 function withAuthError(path, reason) {
-  const sep = path.includes("?") ? "&" : "?";
+  let sep = path.includes("?") ? "&" : "?";
   return `${path}${sep}${QUERY_AUTH_ERROR}=${encodeURIComponent(reason)}`;
 }
 async function handleRedirectCallback(req, opts) {
-  const url = new URL(req.url);
-  const code = url.searchParams.get(PARAM_CODE);
-  const urlState = url.searchParams.get(PARAM_STATE);
-  const authError = url.searchParams.get(PARAM_ERROR);
-  const pkce = readPkceCookie(req.headers.get("cookie"));
-  const returnTo = safeReturnPath(pkce?.returnTo, opts.defaultReturnTo ?? "/");
-  const fail = (reason) => {
-    const headers2 = new Headers({ [HEADER_LOCATION]: withAuthError(returnTo, reason) });
-    headers2.append("Set-Cookie", buildPkceClearCookie());
-    return new Response(null, { status: 302, headers: headers2 });
+  let url = new URL(req.url), code = url.searchParams.get(PARAM_CODE), urlState = url.searchParams.get(PARAM_STATE), authError = url.searchParams.get(PARAM_ERROR), pkce = readPkceCookie(req.headers.get("cookie")), returnTo = safeReturnPath(pkce?.returnTo, opts.defaultReturnTo ?? "/"), fail = (reason) => {
+    let headers2 = new Headers({ [HEADER_LOCATION]: withAuthError(returnTo, reason) });
+    return headers2.append("Set-Cookie", buildPkceClearCookie()), new Response(null, { status: 302, headers: headers2 });
   };
   if (authError) return fail(authError);
   if (!code || !pkce) return fail("missing_code");
@@ -507,62 +470,50 @@ async function handleRedirectCallback(req, opts) {
   } catch {
     return fail("id_token_invalid");
   }
-  const headers = new Headers({ [HEADER_LOCATION]: returnTo });
-  headers.append("Set-Cookie", buildSessionCookie(opts, tokens.idToken, tokens.expiresIn));
-  headers.append("Set-Cookie", buildAccessTokenCookie(opts, tokens.accessToken, tokens.expiresIn));
-  if (tokens.refreshToken) {
-    headers.append(
-      "Set-Cookie",
-      buildRefreshTokenCookie(opts, tokens.refreshToken, REFRESH_COOKIE_MAX_AGE_SECONDS)
-    );
-  }
-  headers.append("Set-Cookie", buildPkceClearCookie());
-  return new Response(null, { status: 302, headers });
+  let headers = new Headers({ [HEADER_LOCATION]: returnTo });
+  return headers.append("Set-Cookie", buildSessionCookie(opts, tokens.idToken, tokens.expiresIn)), headers.append("Set-Cookie", buildAccessTokenCookie(opts, tokens.accessToken, tokens.expiresIn)), tokens.refreshToken && headers.append(
+    "Set-Cookie",
+    buildRefreshTokenCookie(opts, tokens.refreshToken, REFRESH_COOKIE_MAX_AGE_SECONDS)
+  ), headers.append("Set-Cookie", buildPkceClearCookie()), new Response(null, { status: 302, headers });
 }
 async function handleSessionRequest(req, cfg) {
-  const session = await getSessionFromCookieHeader(cfg, req.headers.get("cookie"));
-  if (!session) {
-    return new Response(JSON.stringify({ sub: null }), {
-      status: 200,
-      headers: { "Content-Type": "application/json", "Cache-Control": "no-store" }
-    });
-  }
-  return new Response(JSON.stringify(session), {
+  let session = await getSessionFromCookieHeader(cfg, req.headers.get("cookie"));
+  return session ? new Response(JSON.stringify(session), {
+    status: 200,
+    headers: { "Content-Type": "application/json", "Cache-Control": "no-store" }
+  }) : new Response(JSON.stringify({ sub: null }), {
     status: 200,
     headers: { "Content-Type": "application/json", "Cache-Control": "no-store" }
   });
 }
 async function getSessionFromCookieHeader(cfg, cookieHeader) {
   if (!cookieHeader) return null;
-  const name = cookieName(cfg);
-  const match = cookieHeader.split(/;\s*/).find((p) => p.startsWith(`${name}=`));
+  let name = cookieName(cfg), match = cookieHeader.split(/;\s*/).find((p) => p.startsWith(`${name}=`));
   if (!match) return null;
-  const token = match.slice(name.length + 1);
+  let token = match.slice(name.length + 1);
   if (!token) return null;
   try {
-    const { payload } = await verifyIdToken(cfg, token);
+    let { payload } = await verifyIdToken(cfg, token);
     return payloadToSession(payload);
   } catch {
     return null;
   }
 }
 async function refreshTokens(cfg, refreshToken) {
-  const doc = await discovery(cfg);
-  const body = new URLSearchParams({
+  let doc = await discovery(cfg), body = new URLSearchParams({
     grant_type: "refresh_token",
     refresh_token: refreshToken,
     client_id: cfg.clientId
-  });
-  const res = await fetch(doc.token_endpoint, {
+  }), res = await fetch(doc.token_endpoint, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded" },
     body: body.toString()
   });
   if (!res.ok) {
-    const text = await res.text().catch(() => "");
+    let text = await res.text().catch(() => "");
     throw new Error(`token refresh failed (${res.status}): ${text}`);
   }
-  const payload = await res.json();
+  let payload = await res.json();
   return {
     accessToken: payload.access_token,
     idToken: payload.id_token,
@@ -572,28 +523,26 @@ async function refreshTokens(cfg, refreshToken) {
   };
 }
 function decodeBase64Url(segment) {
-  const b64 = segment.replace(/-/g, "+").replace(/_/g, "/");
-  const pad = b64.length % 4 ? "=".repeat(4 - b64.length % 4) : "";
+  let b64 = segment.replace(/-/g, "+").replace(/_/g, "/"), pad = b64.length % 4 ? "=".repeat(4 - b64.length % 4) : "";
   return atob(b64 + pad);
 }
 function accessTokenExpiry(token) {
   if (!token) return null;
-  const parts = token.split(".");
+  let parts = token.split(".");
   if (parts.length < 2) return null;
   try {
-    const payload = JSON.parse(decodeBase64Url(parts[1]));
-    return typeof payload.exp === "number" ? payload.exp : null;
+    let payload = JSON.parse(decodeBase64Url(parts[1]));
+    return typeof payload.exp == "number" ? payload.exp : null;
   } catch {
     return null;
   }
 }
 var refreshInflight = /* @__PURE__ */ new Map();
 function dedupedRefresh(cfg, refreshToken) {
-  const existing = refreshInflight.get(refreshToken);
+  let existing = refreshInflight.get(refreshToken);
   if (existing) return existing;
-  const p = refreshTokens(cfg, refreshToken).finally(() => refreshInflight.delete(refreshToken));
-  refreshInflight.set(refreshToken, p);
-  return p;
+  let p = refreshTokens(cfg, refreshToken).finally(() => refreshInflight.delete(refreshToken));
+  return refreshInflight.set(refreshToken, p), p;
 }
 function clearedResult(cfg) {
   return {
@@ -607,15 +556,11 @@ function clearedResult(cfg) {
   };
 }
 async function handleTokenRefresh(req, cfg) {
-  const cookieHeader = req.headers.get("cookie");
-  const refreshToken = getRefreshTokenFromCookieHeader(cfg, cookieHeader);
+  let cookieHeader = req.headers.get("cookie"), refreshToken = getRefreshTokenFromCookieHeader(cfg, cookieHeader);
   if (!refreshToken) return { outcome: "noop", setCookies: [], cookies: [] };
-  const access = getAccessTokenFromCookieHeader(cfg, cookieHeader);
-  const exp = accessTokenExpiry(access);
-  const now = Math.floor(Date.now() / 1e3);
-  if (access && exp !== null && exp - now > ACCESS_REFRESH_SKEW_SECONDS) {
+  let access = getAccessTokenFromCookieHeader(cfg, cookieHeader), exp = accessTokenExpiry(access), now = Math.floor(Date.now() / 1e3);
+  if (access && exp !== null && exp - now > (30))
     return { outcome: "noop", setCookies: [], cookies: [] };
-  }
   let tokens;
   try {
     tokens = await dedupedRefresh(cfg, refreshToken);
@@ -623,21 +568,16 @@ async function handleTokenRefresh(req, cfg) {
     return clearedResult(cfg);
   }
   if (!tokens.idToken) return clearedResult(cfg);
-  const setCookies = [
+  let setCookies = [
     buildSessionCookie(cfg, tokens.idToken, tokens.expiresIn),
     buildAccessTokenCookie(cfg, tokens.accessToken, tokens.expiresIn)
-  ];
-  const cookies = [
+  ], cookies = [
     { name: cookieName(cfg), value: tokens.idToken },
     { name: accessTokenCookieName(cfg), value: tokens.accessToken }
   ];
-  if (tokens.refreshToken) {
-    setCookies.push(
-      buildRefreshTokenCookie(cfg, tokens.refreshToken, REFRESH_COOKIE_MAX_AGE_SECONDS)
-    );
-    cookies.push({ name: refreshTokenCookieName(cfg), value: tokens.refreshToken });
-  }
-  return { outcome: "refreshed", setCookies, cookies };
+  return tokens.refreshToken && (setCookies.push(
+    buildRefreshTokenCookie(cfg, tokens.refreshToken, REFRESH_COOKIE_MAX_AGE_SECONDS)
+  ), cookies.push({ name: refreshTokenCookieName(cfg), value: tokens.refreshToken })), { outcome: "refreshed", setCookies, cookies };
 }
 
-export { CACHE_LIFE_DEFAULT, CACHE_LIFE_PROBE, buildAccessTokenCookie, buildRefreshTokenCookie, buildSessionCookie, buildSignoutCookie, buildSignoutCookies, exchangeCode, getAccessTokenFromCookieHeader, getRefreshTokenFromCookieHeader, getServerClient, getSessionFromCookieHeader, handleOidcCallback, handleRedirectCallback, handleSessionRequest, handleTokenRefresh, refreshPage, refreshTokens, revalidateAddOn, revalidateAddOns, revalidateBrand, revalidateBusiness, revalidateByTag, revalidateCategories, revalidateCategory, revalidateCollection, revalidateCollections, revalidateLocation, revalidateLocations, revalidatePricing, revalidateProduct, revalidateProducts, revalidateStock, revalidateSubscription, revalidateSubscriptions, tags, updateAddOn, updateAddOns, updateBrand, updateBusiness, updateByTag, updateCategories, updateCategory, updateCollection, updateCollections, updateLocation, updateLocations, updatePricing, updateProduct, updateProducts, updateStock, updateSubscription, updateSubscriptions, verifyIdToken };
+export { CACHE_LIFE_DEFAULT, CACHE_LIFE_PROBE, SITE_PURGE_MAX_TAGS, SITE_PURGE_MAX_TAG_BYTES, SitePurgeError, buildAccessTokenCookie, buildRefreshTokenCookie, buildSessionCookie, buildSignoutCookie, buildSignoutCookies, exchangeCode, getAccessTokenFromCookieHeader, getRefreshTokenFromCookieHeader, getServerClient, getSessionFromCookieHeader, handleOidcCallback, handleRedirectCallback, handleSessionRequest, handleTokenRefresh, purgeSiteCache, refreshPage, refreshTokens, revalidateAddOn, revalidateAddOns, revalidateBrand, revalidateBusiness, revalidateByTag, revalidateCategories, revalidateCategory, revalidateCollection, revalidateCollections, revalidateLocation, revalidateLocations, revalidatePricing, revalidateProduct, revalidateProducts, revalidateStock, revalidateSubscription, revalidateSubscriptions, tags, updateAddOn, updateAddOns, updateBrand, updateBusiness, updateByTag, updateCategories, updateCategory, updateCollection, updateCollections, updateLocation, updateLocations, updatePricing, updateProduct, updateProducts, updateStock, updateSubscription, updateSubscriptions, verifyIdToken };

package/dist/session-grant-CJ27DwrT.d.mts

@@ -0,0 +1,19 @@
+type GameErrorCode = "capacity_exceeded" | "dead_entity" | "missing_component" | "unsupported_feature" | "shader_requires_translation" | "invalid_argument" | "not_initialized" | "asset_load_failed" | "unknown_resource" | "engine_mismatch";
+declare class GameError extends Error {
+    readonly code: GameErrorCode;
+    constructor(code: GameErrorCode, message: string);
+}
+
+type EngineSessionAudience = "player" | "ios" | "android" | "cli";
+interface EngineSessionGrant {
+    readonly token: string;
+    readonly audience: EngineSessionAudience;
+    readonly origin: string;
+}
+type EngineSessionRefusal = "missing" | "malformed" | "unknown_key" | "forged" | "expired" | "not_yet_valid" | "lifetime" | "audience" | "origin" | "unknown";
+declare class EngineSessionError extends GameError {
+    readonly refusal: EngineSessionRefusal;
+    constructor(code: number);
+}
+
+export { type EngineSessionAudience as E, GameError as G, EngineSessionError as a, type EngineSessionGrant as b, type EngineSessionRefusal as c, type GameErrorCode as d };