@cimplify/sdk 0.53.0 → 0.55.0

package/dist/server.d.ts

@@ -1,6 +1,7 @@
-import { ac as CimplifyClient } from './client-306peWZ0.js';
-export { J as CacheOptions, c7 as ReadRequestOptions, ct as Result } from './client-306peWZ0.js';
+import { ac as CimplifyClient } from './client-Dfg_hmkP.js';
+export { J as CacheOptions, c7 as ReadRequestOptions, ct as Result } from './client-Dfg_hmkP.js';
 export { Q as Category, T as CimplifyError, U as Collection, aX as Product, b9 as ProductWithDetails } from './product-B_kS4Oxa.js';
+import { JWTVerifyResult } from 'jose';
 import './payment-sn-yGL7v.js';
 
 interface ServerClientOptions {
@@ -145,26 +146,26 @@ type CacheLifeDefault = typeof CACHE_LIFE_DEFAULT;
 type CacheLifeProbe = typeof CACHE_LIFE_PROBE;
 
 /** Next 16 cacheLife profile — a built-in name (`'max'`/`'hours'`/…) or `{expire: secs}`. */
-type RevalidateProfile$1 = string | {
+type RevalidateProfile = string | {
     expire: number;
 };
-declare function revalidateProducts(profile?: RevalidateProfile$1): Promise<void>;
-declare function revalidateProduct(id: string, profile?: RevalidateProfile$1): Promise<void>;
-declare function revalidateCategories(profile?: RevalidateProfile$1): Promise<void>;
-declare function revalidateCategory(id: string, profile?: RevalidateProfile$1): Promise<void>;
-declare function revalidateCollections(profile?: RevalidateProfile$1): Promise<void>;
-declare function revalidateCollection(id: string, profile?: RevalidateProfile$1): Promise<void>;
-declare function revalidateBusiness(profile?: RevalidateProfile$1): Promise<void>;
-declare function revalidateBrand(profile?: RevalidateProfile$1): Promise<void>;
-declare function revalidateLocations(profile?: RevalidateProfile$1): Promise<void>;
-declare function revalidateLocation(id: string, profile?: RevalidateProfile$1): Promise<void>;
-declare function revalidatePricing(profile?: RevalidateProfile$1): Promise<void>;
-declare function revalidateAddOns(profile?: RevalidateProfile$1): Promise<void>;
-declare function revalidateAddOn(id: string, profile?: RevalidateProfile$1): Promise<void>;
-declare function revalidateSubscriptions(profile?: RevalidateProfile$1): Promise<void>;
-declare function revalidateSubscription(id: string, profile?: RevalidateProfile$1): Promise<void>;
-declare function revalidateStock(productId?: string, profile?: RevalidateProfile$1): Promise<void>;
-declare function revalidateByTag(tag: string, profile?: RevalidateProfile$1): Promise<void>;
+declare function revalidateProducts(profile?: RevalidateProfile): Promise<void>;
+declare function revalidateProduct(id: string, profile?: RevalidateProfile): Promise<void>;
+declare function revalidateCategories(profile?: RevalidateProfile): Promise<void>;
+declare function revalidateCategory(id: string, profile?: RevalidateProfile): Promise<void>;
+declare function revalidateCollections(profile?: RevalidateProfile): Promise<void>;
+declare function revalidateCollection(id: string, profile?: RevalidateProfile): Promise<void>;
+declare function revalidateBusiness(profile?: RevalidateProfile): Promise<void>;
+declare function revalidateBrand(profile?: RevalidateProfile): Promise<void>;
+declare function revalidateLocations(profile?: RevalidateProfile): Promise<void>;
+declare function revalidateLocation(id: string, profile?: RevalidateProfile): Promise<void>;
+declare function revalidatePricing(profile?: RevalidateProfile): Promise<void>;
+declare function revalidateAddOns(profile?: RevalidateProfile): Promise<void>;
+declare function revalidateAddOn(id: string, profile?: RevalidateProfile): Promise<void>;
+declare function revalidateSubscriptions(profile?: RevalidateProfile): Promise<void>;
+declare function revalidateSubscription(id: string, profile?: RevalidateProfile): Promise<void>;
+declare function revalidateStock(productId?: string, profile?: RevalidateProfile): Promise<void>;
+declare function revalidateByTag(tag: string, profile?: RevalidateProfile): Promise<void>;
 
 declare function updateProducts(): Promise<void>;
 declare function updateProduct(id: string): Promise<void>;
@@ -185,20 +186,43 @@ declare function updateStock(productId?: string): Promise<void>;
 declare function updateByTag(tag: string): Promise<void>;
 declare function refreshPage(): Promise<void>;
 
-/** Next 16 cacheLife profile — a built-in name (`'max'`/`'hours'`/…) or `{expire: secs}`. */
-type RevalidateProfile = string | {
-    expire: number;
-};
-interface RevalidateRouteOptions {
-    /** Defaults to `process.env.CIMPLIFY_REVALIDATE_SECRET`. */
-    secret?: string;
-    /** Defaults to a lazy import of `next/cache.revalidateTag`. Override for tests. */
-    revalidateTag?: (tag: string, profile: RevalidateProfile) => void;
-    /** Defaults to `Date.now`. Override for tests. */
-    now?: () => number;
-    /** Profile used when the request body doesn't include one. Defaults to `'max'`. */
-    defaultProfile?: RevalidateProfile;
+interface OidcConfig {
+    authUrl?: string;
+    clientId: string;
+    cookieName?: string;
+    cookieDomain?: string;
+}
+interface CimplifySession {
+    sub: string;
+    name?: string;
+    email?: string;
+    emailVerified?: boolean;
+    phoneNumber?: string;
+    phoneNumberVerified?: boolean;
+    exp: number;
+    iat: number;
+}
+interface CodeExchangeOptions extends OidcConfig {
+    code: string;
+    codeVerifier: string;
+    redirectUri: string;
+}
+interface CodeExchangeResult {
+    accessToken: string;
+    idToken?: string;
+    refreshToken?: string;
+    expiresIn: number;
+    scope: string;
+}
+declare function exchangeCode(opts: CodeExchangeOptions): Promise<CodeExchangeResult>;
+declare function verifyIdToken(cfg: OidcConfig, idToken: string): Promise<JWTVerifyResult>;
+declare function buildSessionCookie(cfg: OidcConfig, idToken: string, maxAgeSeconds: number): string;
+declare function buildSignoutCookie(cfg: OidcConfig): string;
+interface CallbackHandlerOptions extends OidcConfig {
+    redirectUri: string;
 }
-declare function revalidateRouteHandler(req: Request, options?: RevalidateRouteOptions): Promise<Response>;
+declare function handleOidcCallback(req: Request, opts: CallbackHandlerOptions): Promise<Response>;
+declare function handleSessionRequest(req: Request, cfg: OidcConfig): Promise<Response>;
+declare function getSessionFromCookieHeader(cfg: OidcConfig, cookieHeader: string | null | undefined): Promise<CimplifySession | null>;
 
-export { CACHE_LIFE_DEFAULT, CACHE_LIFE_PROBE, type CacheLifeDefault, type CacheLifeProbe, CimplifyClient, type RevalidateProfile$1 as RevalidateProfile, type RevalidateRouteOptions, type RevalidateProfile as RevalidateRouteProfile, type ServerClientOptions, getServerClient, refreshPage, revalidateAddOn, revalidateAddOns, revalidateBrand, revalidateBusiness, revalidateByTag, revalidateCategories, revalidateCategory, revalidateCollection, revalidateCollections, revalidateLocation, revalidateLocations, revalidatePricing, revalidateProduct, revalidateProducts, revalidateRouteHandler, revalidateStock, revalidateSubscription, revalidateSubscriptions, tags, updateAddOn, updateAddOns, updateBrand, updateBusiness, updateByTag, updateCategories, updateCategory, updateCollection, updateCollections, updateLocation, updateLocations, updatePricing, updateProduct, updateProducts, updateStock, updateSubscription, updateSubscriptions };
+export { CACHE_LIFE_DEFAULT, CACHE_LIFE_PROBE, type CacheLifeDefault, type CacheLifeProbe, type CallbackHandlerOptions, CimplifyClient, type CimplifySession, type CodeExchangeOptions, type CodeExchangeResult, type OidcConfig, type RevalidateProfile, type ServerClientOptions, buildSessionCookie, buildSignoutCookie, exchangeCode, getServerClient, getSessionFromCookieHeader, handleOidcCallback, handleSessionRequest, refreshPage, revalidateAddOn, revalidateAddOns, revalidateBrand, revalidateBusiness, revalidateByTag, revalidateCategories, revalidateCategory, revalidateCollection, revalidateCollections, revalidateLocation, revalidateLocations, revalidatePricing, revalidateProduct, revalidateProducts, revalidateStock, revalidateSubscription, revalidateSubscriptions, tags, updateAddOn, updateAddOns, updateBrand, updateBusiness, updateByTag, updateCategories, updateCategory, updateCollection, updateCollections, updateLocation, updateLocations, updatePricing, updateProduct, updateProducts, updateStock, updateSubscription, updateSubscriptions, verifyIdToken };

package/dist/server.js

@@ -1,11 +1,12 @@
 'use strict';
 
-var chunkIJ32BXKZ_js = require('./chunk-IJ32BXKZ.js');
-require('./chunk-YJLOOC3L.js');
+var chunkMW7ICTVK_js = require('./chunk-MW7ICTVK.js');
+require('./chunk-JGBDWEPJ.js');
 require('./chunk-7Y2O3E4D.js');
 var chunkXA3ZNR75_js = require('./chunk-XA3ZNR75.js');
 require('./chunk-OWW5GUSB.js');
 var react = require('react');
+var jose = require('jose');
 
 var DEFAULT_PROD_URL = "https://storefronts.cimplify.io";
 var DEFAULT_DEV_URL = "http://127.0.0.1:8787";
@@ -25,7 +26,7 @@ function readEnv(...keys) {
 var getServerClient = react.cache((opts = {}) => {
   const baseUrl = opts.apiUrl ?? readEnv("CIMPLIFY_API_URL", "NEXT_PUBLIC_CIMPLIFY_API_URL") ?? defaultBaseUrl();
   const publicKey = opts.secretKey ?? readEnv("CIMPLIFY_SECRET_KEY", "NEXT_PUBLIC_CIMPLIFY_PUBLIC_KEY") ?? "mock-dev";
-  const client = chunkIJ32BXKZ_js.createCimplifyClient({
+  const client = chunkMW7ICTVK_js.createCimplifyClient({
     baseUrl,
     publicKey,
     suppressPublicKeyWarning: true
@@ -233,90 +234,164 @@ async function refreshPage() {
   const fn = await getRefresh();
   fn();
 }
-
-// src/server/revalidate-route.ts
-var TIMESTAMP_HEADER = "x-cimplify-timestamp";
-var SIGNATURE_HEADER = "x-cimplify-signature";
-var SIGNATURE_PREFIX = "sha256=";
-var MAX_SKEW_MS = 5 * 60 * 1e3;
-var SECRET_ENV = "CIMPLIFY_REVALIDATE_SECRET";
-var DEFAULT_PROFILE2 = CACHE_LIFE_DEFAULT;
-async function revalidateRouteHandler(req, options = {}) {
-  const secret = options.secret ?? envSecret();
-  if (!secret) return text(`revalidate disabled: ${SECRET_ENV} not set`, 500);
-  const timestamp = req.headers.get(TIMESTAMP_HEADER);
-  const signature = req.headers.get(SIGNATURE_HEADER);
-  if (!timestamp || !signature) return text("missing auth headers", 401);
-  const ts = Number.parseInt(timestamp, 10);
-  const now = options.now ?? Date.now;
-  if (!Number.isFinite(ts) || Math.abs(now() - ts) > MAX_SKEW_MS) {
-    return text("stale or invalid timestamp", 401);
+var DEFAULT_AUTH_URL = "https://auth.cimplify.io";
+var SESSION_COOKIE = "cimplify_session";
+var discoveryCache = /* @__PURE__ */ new Map();
+var jwksCache = /* @__PURE__ */ new Map();
+function authUrl(cfg) {
+  return (cfg.authUrl ?? DEFAULT_AUTH_URL).replace(/\/$/, "");
+}
+function cookieName(cfg) {
+  return cfg.cookieName ?? SESSION_COOKIE;
+}
+async function discovery(cfg) {
+  const base = authUrl(cfg);
+  let p = discoveryCache.get(base);
+  if (!p) {
+    p = fetch(`${base}/.well-known/openid-configuration`, {
+      next: { revalidate: 3600 }
+    }).then((r) => {
+      if (!r.ok) throw new Error(`oidc discovery failed: ${r.status}`);
+      return r.json();
+    });
+    discoveryCache.set(base, p);
+  }
+  return p;
+}
+async function jwks(cfg) {
+  const doc = await discovery(cfg);
+  let set = jwksCache.get(doc.jwks_uri);
+  if (!set) {
+    set = jose.createRemoteJWKSet(new URL(doc.jwks_uri));
+    jwksCache.set(doc.jwks_uri, set);
   }
-  const body = await req.text();
-  if (!await verifyHmac(secret, `${timestamp}.${body}`, signature)) {
-    return text("invalid signature", 401);
+  return { set, issuer: doc.issuer };
+}
+async function exchangeCode(opts) {
+  const doc = await discovery(opts);
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code: opts.code,
+    code_verifier: opts.codeVerifier,
+    redirect_uri: opts.redirectUri,
+    client_id: opts.clientId
+  });
+  const res = await fetch(doc.token_endpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: body.toString()
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`token exchange failed (${res.status}): ${text}`);
   }
-  let parsed;
+  const payload = await res.json();
+  return {
+    accessToken: payload.access_token,
+    idToken: payload.id_token,
+    refreshToken: payload.refresh_token,
+    expiresIn: payload.expires_in,
+    scope: payload.scope
+  };
+}
+async function verifyIdToken(cfg, idToken) {
+  const { set, issuer } = await jwks(cfg);
+  return jose.jwtVerify(idToken, set, {
+    issuer,
+    audience: cfg.clientId
+  });
+}
+function payloadToSession(payload) {
+  return {
+    sub: String(payload.sub ?? ""),
+    name: payload.name,
+    email: payload.email,
+    emailVerified: payload.email_verified,
+    phoneNumber: payload.phone_number,
+    phoneNumberVerified: payload.phone_number_verified,
+    exp: Number(payload.exp ?? 0),
+    iat: Number(payload.iat ?? 0)
+  };
+}
+function buildSessionCookie(cfg, idToken, maxAgeSeconds) {
+  const name = cookieName(cfg);
+  const parts = [
+    `${name}=${idToken}`,
+    "Path=/",
+    "HttpOnly",
+    "Secure",
+    "SameSite=Lax",
+    `Max-Age=${maxAgeSeconds}`
+  ];
+  if (cfg.cookieDomain) parts.push(`Domain=${cfg.cookieDomain}`);
+  return parts.join("; ");
+}
+function buildSignoutCookie(cfg) {
+  const name = cookieName(cfg);
+  const parts = [`${name}=`, "Path=/", "HttpOnly", "Secure", "SameSite=Lax", "Max-Age=0"];
+  if (cfg.cookieDomain) parts.push(`Domain=${cfg.cookieDomain}`);
+  return parts.join("; ");
+}
+async function handleOidcCallback(req, opts) {
+  let body;
   try {
-    parsed = JSON.parse(body);
+    body = await req.json();
   } catch {
-    return text("invalid json", 400);
+    return Response.json({ error: "invalid_json" }, { status: 400 });
   }
-  const tags2 = Array.isArray(parsed.tags) ? parsed.tags.filter((t) => typeof t === "string" && t.length > 0) : [];
-  if (tags2.length === 0) return text("no tags", 400);
-  const profile = parseProfile(parsed.profile) ?? options.defaultProfile ?? DEFAULT_PROFILE2;
-  const revalidate2 = options.revalidateTag ?? await loadRevalidateTag();
-  for (const tag of tags2) revalidate2(tag, profile);
-  return Response.json({ ok: true, revalidated: tags2.length, profile });
-}
-function parseProfile(raw) {
-  if (typeof raw === "string" && raw.length > 0) return raw;
-  if (raw && typeof raw === "object" && "expire" in raw && typeof raw.expire === "number") {
-    return { expire: raw.expire };
+  if (!body.code || !body.codeVerifier) {
+    return Response.json({ error: "missing_code_or_verifier" }, { status: 400 });
   }
-  return void 0;
-}
-var cachedRevalidateTag = null;
-async function loadRevalidateTag() {
-  if (cachedRevalidateTag) return cachedRevalidateTag;
-  const specifier = "next/cache";
-  const mod = await import(
-    /* webpackIgnore: true */
-    /* @vite-ignore */
-    specifier
-  );
-  cachedRevalidateTag = mod.revalidateTag;
-  return cachedRevalidateTag;
-}
-async function verifyHmac(secret, payload, signatureHeader) {
-  if (!signatureHeader.startsWith(SIGNATURE_PREFIX)) return false;
-  const providedBytes = hexToBytes(signatureHeader.slice(SIGNATURE_PREFIX.length));
-  if (!providedBytes) return false;
-  const enc = new TextEncoder();
-  const key = await crypto.subtle.importKey(
-    "raw",
-    enc.encode(secret),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["verify"]
-  );
-  return crypto.subtle.verify("HMAC", key, providedBytes, enc.encode(payload));
-}
-function hexToBytes(hex) {
-  if (hex.length % 2 !== 0 || !/^[0-9a-f]+$/i.test(hex)) return null;
-  const buf = new ArrayBuffer(hex.length / 2);
-  const out = new Uint8Array(buf);
-  for (let i = 0; i < hex.length; i += 2) {
-    out[i / 2] = Number.parseInt(hex.slice(i, i + 2), 16);
+  let tokens;
+  try {
+    tokens = await exchangeCode({
+      ...opts,
+      code: body.code,
+      codeVerifier: body.codeVerifier
+    });
+  } catch (e) {
+    return Response.json({ error: "exchange_failed", detail: String(e) }, { status: 400 });
+  }
+  if (!tokens.idToken) {
+    return Response.json({ error: "missing_id_token" }, { status: 400 });
   }
-  return out;
+  try {
+    await verifyIdToken(opts, tokens.idToken);
+  } catch (e) {
+    return Response.json({ error: "id_token_invalid", detail: String(e) }, { status: 401 });
+  }
+  const cookie = buildSessionCookie(opts, tokens.idToken, tokens.expiresIn);
+  return new Response(JSON.stringify({ ok: true }), {
+    status: 200,
+    headers: { "Content-Type": "application/json", "Set-Cookie": cookie }
+  });
 }
-function envSecret() {
-  const proc = globalThis.process;
-  return proc?.env?.[SECRET_ENV];
+async function handleSessionRequest(req, cfg) {
+  const session = await getSessionFromCookieHeader(cfg, req.headers.get("cookie"));
+  if (!session) {
+    return new Response(JSON.stringify({ sub: null }), {
+      status: 200,
+      headers: { "Content-Type": "application/json", "Cache-Control": "no-store" }
+    });
+  }
+  return new Response(JSON.stringify(session), {
+    status: 200,
+    headers: { "Content-Type": "application/json", "Cache-Control": "no-store" }
+  });
 }
-function text(message, status) {
-  return new Response(message, { status, headers: { "content-type": "text/plain" } });
+async function getSessionFromCookieHeader(cfg, cookieHeader) {
+  if (!cookieHeader) return null;
+  const name = cookieName(cfg);
+  const match = cookieHeader.split(/;\s*/).find((p) => p.startsWith(`${name}=`));
+  if (!match) return null;
+  const token = match.slice(name.length + 1);
+  if (!token) return null;
+  try {
+    const { payload } = await verifyIdToken(cfg, token);
+    return payloadToSession(payload);
+  } catch {
+    return null;
+  }
 }
 
 Object.defineProperty(exports, "CimplifyError", {
@@ -325,7 +400,13 @@ Object.defineProperty(exports, "CimplifyError", {
 });
 exports.CACHE_LIFE_DEFAULT = CACHE_LIFE_DEFAULT;
 exports.CACHE_LIFE_PROBE = CACHE_LIFE_PROBE;
+exports.buildSessionCookie = buildSessionCookie;
+exports.buildSignoutCookie = buildSignoutCookie;
+exports.exchangeCode = exchangeCode;
 exports.getServerClient = getServerClient;
+exports.getSessionFromCookieHeader = getSessionFromCookieHeader;
+exports.handleOidcCallback = handleOidcCallback;
+exports.handleSessionRequest = handleSessionRequest;
 exports.refreshPage = refreshPage;
 exports.revalidateAddOn = revalidateAddOn;
 exports.revalidateAddOns = revalidateAddOns;
@@ -341,7 +422,6 @@ exports.revalidateLocations = revalidateLocations;
 exports.revalidatePricing = revalidatePricing;
 exports.revalidateProduct = revalidateProduct;
 exports.revalidateProducts = revalidateProducts;
-exports.revalidateRouteHandler = revalidateRouteHandler;
 exports.revalidateStock = revalidateStock;
 exports.revalidateSubscription = revalidateSubscription;
 exports.revalidateSubscriptions = revalidateSubscriptions;
@@ -363,3 +443,4 @@ exports.updateProducts = updateProducts;
 exports.updateStock = updateStock;
 exports.updateSubscription = updateSubscription;
 exports.updateSubscriptions = updateSubscriptions;
+exports.verifyIdToken = verifyIdToken;

package/dist/server.mjs

@@ -1,9 +1,10 @@
-import { createCimplifyClient } from './chunk-6QZQQRBB.mjs';
-import './chunk-B3Y4C4A7.mjs';
+import { createCimplifyClient } from './chunk-SQ7U3BWY.mjs';
+import './chunk-I4IXPQIX.mjs';
 import './chunk-TD3AY34U.mjs';
 export { CimplifyError } from './chunk-AMZXALF6.mjs';
 import './chunk-3G6RQLXK.mjs';
 import { cache } from 'react';
+import { jwtVerify, createRemoteJWKSet } from 'jose';
 
 var DEFAULT_PROD_URL = "https://storefronts.cimplify.io";
 var DEFAULT_DEV_URL = "http://127.0.0.1:8787";
@@ -231,90 +232,164 @@ async function refreshPage() {
   const fn = await getRefresh();
   fn();
 }
-
-// src/server/revalidate-route.ts
-var TIMESTAMP_HEADER = "x-cimplify-timestamp";
-var SIGNATURE_HEADER = "x-cimplify-signature";
-var SIGNATURE_PREFIX = "sha256=";
-var MAX_SKEW_MS = 5 * 60 * 1e3;
-var SECRET_ENV = "CIMPLIFY_REVALIDATE_SECRET";
-var DEFAULT_PROFILE2 = CACHE_LIFE_DEFAULT;
-async function revalidateRouteHandler(req, options = {}) {
-  const secret = options.secret ?? envSecret();
-  if (!secret) return text(`revalidate disabled: ${SECRET_ENV} not set`, 500);
-  const timestamp = req.headers.get(TIMESTAMP_HEADER);
-  const signature = req.headers.get(SIGNATURE_HEADER);
-  if (!timestamp || !signature) return text("missing auth headers", 401);
-  const ts = Number.parseInt(timestamp, 10);
-  const now = options.now ?? Date.now;
-  if (!Number.isFinite(ts) || Math.abs(now() - ts) > MAX_SKEW_MS) {
-    return text("stale or invalid timestamp", 401);
+var DEFAULT_AUTH_URL = "https://auth.cimplify.io";
+var SESSION_COOKIE = "cimplify_session";
+var discoveryCache = /* @__PURE__ */ new Map();
+var jwksCache = /* @__PURE__ */ new Map();
+function authUrl(cfg) {
+  return (cfg.authUrl ?? DEFAULT_AUTH_URL).replace(/\/$/, "");
+}
+function cookieName(cfg) {
+  return cfg.cookieName ?? SESSION_COOKIE;
+}
+async function discovery(cfg) {
+  const base = authUrl(cfg);
+  let p = discoveryCache.get(base);
+  if (!p) {
+    p = fetch(`${base}/.well-known/openid-configuration`, {
+      next: { revalidate: 3600 }
+    }).then((r) => {
+      if (!r.ok) throw new Error(`oidc discovery failed: ${r.status}`);
+      return r.json();
+    });
+    discoveryCache.set(base, p);
+  }
+  return p;
+}
+async function jwks(cfg) {
+  const doc = await discovery(cfg);
+  let set = jwksCache.get(doc.jwks_uri);
+  if (!set) {
+    set = createRemoteJWKSet(new URL(doc.jwks_uri));
+    jwksCache.set(doc.jwks_uri, set);
   }
-  const body = await req.text();
-  if (!await verifyHmac(secret, `${timestamp}.${body}`, signature)) {
-    return text("invalid signature", 401);
+  return { set, issuer: doc.issuer };
+}
+async function exchangeCode(opts) {
+  const doc = await discovery(opts);
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code: opts.code,
+    code_verifier: opts.codeVerifier,
+    redirect_uri: opts.redirectUri,
+    client_id: opts.clientId
+  });
+  const res = await fetch(doc.token_endpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: body.toString()
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`token exchange failed (${res.status}): ${text}`);
   }
-  let parsed;
+  const payload = await res.json();
+  return {
+    accessToken: payload.access_token,
+    idToken: payload.id_token,
+    refreshToken: payload.refresh_token,
+    expiresIn: payload.expires_in,
+    scope: payload.scope
+  };
+}
+async function verifyIdToken(cfg, idToken) {
+  const { set, issuer } = await jwks(cfg);
+  return jwtVerify(idToken, set, {
+    issuer,
+    audience: cfg.clientId
+  });
+}
+function payloadToSession(payload) {
+  return {
+    sub: String(payload.sub ?? ""),
+    name: payload.name,
+    email: payload.email,
+    emailVerified: payload.email_verified,
+    phoneNumber: payload.phone_number,
+    phoneNumberVerified: payload.phone_number_verified,
+    exp: Number(payload.exp ?? 0),
+    iat: Number(payload.iat ?? 0)
+  };
+}
+function buildSessionCookie(cfg, idToken, maxAgeSeconds) {
+  const name = cookieName(cfg);
+  const parts = [
+    `${name}=${idToken}`,
+    "Path=/",
+    "HttpOnly",
+    "Secure",
+    "SameSite=Lax",
+    `Max-Age=${maxAgeSeconds}`
+  ];
+  if (cfg.cookieDomain) parts.push(`Domain=${cfg.cookieDomain}`);
+  return parts.join("; ");
+}
+function buildSignoutCookie(cfg) {
+  const name = cookieName(cfg);
+  const parts = [`${name}=`, "Path=/", "HttpOnly", "Secure", "SameSite=Lax", "Max-Age=0"];
+  if (cfg.cookieDomain) parts.push(`Domain=${cfg.cookieDomain}`);
+  return parts.join("; ");
+}
+async function handleOidcCallback(req, opts) {
+  let body;
   try {
-    parsed = JSON.parse(body);
+    body = await req.json();
   } catch {
-    return text("invalid json", 400);
+    return Response.json({ error: "invalid_json" }, { status: 400 });
   }
-  const tags2 = Array.isArray(parsed.tags) ? parsed.tags.filter((t) => typeof t === "string" && t.length > 0) : [];
-  if (tags2.length === 0) return text("no tags", 400);
-  const profile = parseProfile(parsed.profile) ?? options.defaultProfile ?? DEFAULT_PROFILE2;
-  const revalidate2 = options.revalidateTag ?? await loadRevalidateTag();
-  for (const tag of tags2) revalidate2(tag, profile);
-  return Response.json({ ok: true, revalidated: tags2.length, profile });
-}
-function parseProfile(raw) {
-  if (typeof raw === "string" && raw.length > 0) return raw;
-  if (raw && typeof raw === "object" && "expire" in raw && typeof raw.expire === "number") {
-    return { expire: raw.expire };
+  if (!body.code || !body.codeVerifier) {
+    return Response.json({ error: "missing_code_or_verifier" }, { status: 400 });
   }
-  return void 0;
-}
-var cachedRevalidateTag = null;
-async function loadRevalidateTag() {
-  if (cachedRevalidateTag) return cachedRevalidateTag;
-  const specifier = "next/cache";
-  const mod = await import(
-    /* webpackIgnore: true */
-    /* @vite-ignore */
-    specifier
-  );
-  cachedRevalidateTag = mod.revalidateTag;
-  return cachedRevalidateTag;
-}
-async function verifyHmac(secret, payload, signatureHeader) {
-  if (!signatureHeader.startsWith(SIGNATURE_PREFIX)) return false;
-  const providedBytes = hexToBytes(signatureHeader.slice(SIGNATURE_PREFIX.length));
-  if (!providedBytes) return false;
-  const enc = new TextEncoder();
-  const key = await crypto.subtle.importKey(
-    "raw",
-    enc.encode(secret),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["verify"]
-  );
-  return crypto.subtle.verify("HMAC", key, providedBytes, enc.encode(payload));
-}
-function hexToBytes(hex) {
-  if (hex.length % 2 !== 0 || !/^[0-9a-f]+$/i.test(hex)) return null;
-  const buf = new ArrayBuffer(hex.length / 2);
-  const out = new Uint8Array(buf);
-  for (let i = 0; i < hex.length; i += 2) {
-    out[i / 2] = Number.parseInt(hex.slice(i, i + 2), 16);
+  let tokens;
+  try {
+    tokens = await exchangeCode({
+      ...opts,
+      code: body.code,
+      codeVerifier: body.codeVerifier
+    });
+  } catch (e) {
+    return Response.json({ error: "exchange_failed", detail: String(e) }, { status: 400 });
+  }
+  if (!tokens.idToken) {
+    return Response.json({ error: "missing_id_token" }, { status: 400 });
   }
-  return out;
+  try {
+    await verifyIdToken(opts, tokens.idToken);
+  } catch (e) {
+    return Response.json({ error: "id_token_invalid", detail: String(e) }, { status: 401 });
+  }
+  const cookie = buildSessionCookie(opts, tokens.idToken, tokens.expiresIn);
+  return new Response(JSON.stringify({ ok: true }), {
+    status: 200,
+    headers: { "Content-Type": "application/json", "Set-Cookie": cookie }
+  });
 }
-function envSecret() {
-  const proc = globalThis.process;
-  return proc?.env?.[SECRET_ENV];
+async function handleSessionRequest(req, cfg) {
+  const session = await getSessionFromCookieHeader(cfg, req.headers.get("cookie"));
+  if (!session) {
+    return new Response(JSON.stringify({ sub: null }), {
+      status: 200,
+      headers: { "Content-Type": "application/json", "Cache-Control": "no-store" }
+    });
+  }
+  return new Response(JSON.stringify(session), {
+    status: 200,
+    headers: { "Content-Type": "application/json", "Cache-Control": "no-store" }
+  });
 }
-function text(message, status) {
-  return new Response(message, { status, headers: { "content-type": "text/plain" } });
+async function getSessionFromCookieHeader(cfg, cookieHeader) {
+  if (!cookieHeader) return null;
+  const name = cookieName(cfg);
+  const match = cookieHeader.split(/;\s*/).find((p) => p.startsWith(`${name}=`));
+  if (!match) return null;
+  const token = match.slice(name.length + 1);
+  if (!token) return null;
+  try {
+    const { payload } = await verifyIdToken(cfg, token);
+    return payloadToSession(payload);
+  } catch {
+    return null;
+  }
 }
 
-export { CACHE_LIFE_DEFAULT, CACHE_LIFE_PROBE, getServerClient, refreshPage, revalidateAddOn, revalidateAddOns, revalidateBrand, revalidateBusiness, revalidateByTag, revalidateCategories, revalidateCategory, revalidateCollection, revalidateCollections, revalidateLocation, revalidateLocations, revalidatePricing, revalidateProduct, revalidateProducts, revalidateRouteHandler, revalidateStock, revalidateSubscription, revalidateSubscriptions, tags, updateAddOn, updateAddOns, updateBrand, updateBusiness, updateByTag, updateCategories, updateCategory, updateCollection, updateCollections, updateLocation, updateLocations, updatePricing, updateProduct, updateProducts, updateStock, updateSubscription, updateSubscriptions };
+export { CACHE_LIFE_DEFAULT, CACHE_LIFE_PROBE, buildSessionCookie, buildSignoutCookie, exchangeCode, getServerClient, getSessionFromCookieHeader, handleOidcCallback, handleSessionRequest, refreshPage, revalidateAddOn, revalidateAddOns, revalidateBrand, revalidateBusiness, revalidateByTag, revalidateCategories, revalidateCategory, revalidateCollection, revalidateCollections, revalidateLocation, revalidateLocations, revalidatePricing, revalidateProduct, revalidateProducts, revalidateStock, revalidateSubscription, revalidateSubscriptions, tags, updateAddOn, updateAddOns, updateBrand, updateBusiness, updateByTag, updateCategories, updateCategory, updateCollection, updateCollections, updateLocation, updateLocations, updatePricing, updateProduct, updateProducts, updateStock, updateSubscription, updateSubscriptions, verifyIdToken };