@cimplify/sdk 0.58.0 → 0.60.0

package/dist/{chunk-W6FRIYYU.mjs → chunk-2AU263DK.mjs}

@@ -1,3 +1,5 @@
+import { encodePkceState, PKCE_COOKIE, PKCE_COOKIE_PATH, PKCE_COOKIE_MAX_AGE_SECONDS, getAuthorizationEndpoint, DEFAULT_ISSUER } from './chunk-XSOYJLMZ.mjs';
+
 // src/gallery.ts
 function dedupe(urls) {
   const seen = /* @__PURE__ */ new Set();
@@ -153,20 +155,17 @@ function openModalIframe(opts) {
   });
   const card = document.createElement("div");
   Object.assign(card.style, {
-    width: `${opts.width ?? 440}px`,
+    width: `${opts.width ?? 480}px`,
     maxWidth: "calc(100vw - 24px)",
-    height: `${opts.height ?? 620}px`,
-    maxHeight: "calc(100vh - 48px)",
-    background: "#fff",
-    borderRadius: "14px",
-    overflow: "hidden",
-    boxShadow: "0 24px 64px rgba(0,0,0,0.25)"
+    height: `${opts.height ?? 720}px`,
+    maxHeight: "calc(100vh - 32px)"
   });
   const iframe = document.createElement("iframe");
   iframe.src = opts.src;
   iframe.style.width = "100%";
   iframe.style.height = "100%";
   iframe.style.border = "none";
+  iframe.style.background = "transparent";
   iframe.setAttribute(
     "sandbox",
     opts.sandbox ?? "allow-scripts allow-same-origin allow-forms allow-popups"
@@ -191,13 +190,22 @@ function openModalIframe(opts) {
 }
 
 // src/sign-in.ts
-var DEFAULT_AUTH_URL = "https://auth.cimplify.io";
 var DEFAULT_SCOPE = "openid email phone profile";
+function resolveAuthorizeEndpoint(opts) {
+  if (opts.authUrl) {
+    return Promise.resolve(`${opts.authUrl.replace(/\/$/, "")}/oauth/authorize`);
+  }
+  return getAuthorizationEndpoint(opts.issuer ?? DEFAULT_ISSUER);
+}
 async function startSignIn(opts) {
-  const authUrl = (opts.authUrl ?? DEFAULT_AUTH_URL).replace(/\/$/, "");
   const callbackUri = opts.callbackUri ?? "/auth/callback";
   const pkce = await generatePkce();
   const state = generateState();
+  const authorizeEndpoint = await resolveAuthorizeEndpoint(opts);
+  if ((opts.mode ?? "redirect") === "redirect") {
+    startRedirectSignIn(opts, authorizeEndpoint, pkce, state);
+    return;
+  }
   const params = new URLSearchParams({
     response_type: "code",
     response_mode: "web_message",
@@ -210,8 +218,8 @@ async function startSignIn(opts) {
   });
   if (opts.loginHint) params.set("login_hint", opts.loginHint);
   if (opts.prompt) params.set("prompt", opts.prompt);
-  const src = `${authUrl}/oauth/authorize?${params.toString()}`;
-  const expectedOrigin = new URL(authUrl).origin;
+  const src = `${authorizeEndpoint}?${params.toString()}`;
+  const expectedOrigin = new URL(authorizeEndpoint).origin;
   const modal = openModalIframe({
     src,
     onClose: () => {
@@ -256,6 +264,25 @@ async function startSignIn(opts) {
   };
   window.addEventListener("message", handler);
 }
+function startRedirectSignIn(opts, authorizeEndpoint, pkce, state) {
+  const returnTo = opts.returnTo ?? window.location.pathname + window.location.search;
+  const cookieValue = encodePkceState({ verifier: pkce.verifier, state, returnTo });
+  const secure = window.location.protocol === "https:" ? "; Secure" : "";
+  document.cookie = `${PKCE_COOKIE}=${cookieValue}; Path=${PKCE_COOKIE_PATH}; Max-Age=${PKCE_COOKIE_MAX_AGE_SECONDS}; SameSite=Lax${secure}`;
+  const params = new URLSearchParams({
+    response_type: "code",
+    response_mode: "query",
+    client_id: opts.clientId,
+    redirect_uri: opts.redirectUri,
+    scope: opts.scope ?? DEFAULT_SCOPE,
+    state,
+    code_challenge: pkce.challenge,
+    code_challenge_method: pkce.method
+  });
+  if (opts.loginHint) params.set("login_hint", opts.loginHint);
+  if (opts.prompt) params.set("prompt", opts.prompt);
+  window.location.assign(`${authorizeEndpoint}?${params.toString()}`);
+}
 
 // src/assets/url.ts
 var DEFAULT_CDN_BASE_URL = "https://storefrontassetscdn.cimplify.io";

package/dist/{chunk-VV3GTDIP.js → chunk-6DMHVQ42.js}

@@ -1,5 +1,7 @@
 'use strict';
 
+var chunkDKT62WQW_js = require('./chunk-DKT62WQW.js');
+
 // src/gallery.ts
 function dedupe(urls) {
   const seen = /* @__PURE__ */ new Set();
@@ -155,20 +157,17 @@ function openModalIframe(opts) {
   });
   const card = document.createElement("div");
   Object.assign(card.style, {
-    width: `${opts.width ?? 440}px`,
+    width: `${opts.width ?? 480}px`,
     maxWidth: "calc(100vw - 24px)",
-    height: `${opts.height ?? 620}px`,
-    maxHeight: "calc(100vh - 48px)",
-    background: "#fff",
-    borderRadius: "14px",
-    overflow: "hidden",
-    boxShadow: "0 24px 64px rgba(0,0,0,0.25)"
+    height: `${opts.height ?? 720}px`,
+    maxHeight: "calc(100vh - 32px)"
   });
   const iframe = document.createElement("iframe");
   iframe.src = opts.src;
   iframe.style.width = "100%";
   iframe.style.height = "100%";
   iframe.style.border = "none";
+  iframe.style.background = "transparent";
   iframe.setAttribute(
     "sandbox",
     opts.sandbox ?? "allow-scripts allow-same-origin allow-forms allow-popups"
@@ -193,13 +192,22 @@ function openModalIframe(opts) {
 }
 
 // src/sign-in.ts
-var DEFAULT_AUTH_URL = "https://auth.cimplify.io";
 var DEFAULT_SCOPE = "openid email phone profile";
+function resolveAuthorizeEndpoint(opts) {
+  if (opts.authUrl) {
+    return Promise.resolve(`${opts.authUrl.replace(/\/$/, "")}/oauth/authorize`);
+  }
+  return chunkDKT62WQW_js.getAuthorizationEndpoint(opts.issuer ?? chunkDKT62WQW_js.DEFAULT_ISSUER);
+}
 async function startSignIn(opts) {
-  const authUrl = (opts.authUrl ?? DEFAULT_AUTH_URL).replace(/\/$/, "");
   const callbackUri = opts.callbackUri ?? "/auth/callback";
   const pkce = await generatePkce();
   const state = generateState();
+  const authorizeEndpoint = await resolveAuthorizeEndpoint(opts);
+  if ((opts.mode ?? "redirect") === "redirect") {
+    startRedirectSignIn(opts, authorizeEndpoint, pkce, state);
+    return;
+  }
   const params = new URLSearchParams({
     response_type: "code",
     response_mode: "web_message",
@@ -212,8 +220,8 @@ async function startSignIn(opts) {
   });
   if (opts.loginHint) params.set("login_hint", opts.loginHint);
   if (opts.prompt) params.set("prompt", opts.prompt);
-  const src = `${authUrl}/oauth/authorize?${params.toString()}`;
-  const expectedOrigin = new URL(authUrl).origin;
+  const src = `${authorizeEndpoint}?${params.toString()}`;
+  const expectedOrigin = new URL(authorizeEndpoint).origin;
   const modal = openModalIframe({
     src,
     onClose: () => {
@@ -258,6 +266,25 @@ async function startSignIn(opts) {
   };
   window.addEventListener("message", handler);
 }
+function startRedirectSignIn(opts, authorizeEndpoint, pkce, state) {
+  const returnTo = opts.returnTo ?? window.location.pathname + window.location.search;
+  const cookieValue = chunkDKT62WQW_js.encodePkceState({ verifier: pkce.verifier, state, returnTo });
+  const secure = window.location.protocol === "https:" ? "; Secure" : "";
+  document.cookie = `${chunkDKT62WQW_js.PKCE_COOKIE}=${cookieValue}; Path=${chunkDKT62WQW_js.PKCE_COOKIE_PATH}; Max-Age=${chunkDKT62WQW_js.PKCE_COOKIE_MAX_AGE_SECONDS}; SameSite=Lax${secure}`;
+  const params = new URLSearchParams({
+    response_type: "code",
+    response_mode: "query",
+    client_id: opts.clientId,
+    redirect_uri: opts.redirectUri,
+    scope: opts.scope ?? DEFAULT_SCOPE,
+    state,
+    code_challenge: pkce.challenge,
+    code_challenge_method: pkce.method
+  });
+  if (opts.loginHint) params.set("login_hint", opts.loginHint);
+  if (opts.prompt) params.set("prompt", opts.prompt);
+  window.location.assign(`${authorizeEndpoint}?${params.toString()}`);
+}
 
 // src/assets/url.ts
 var DEFAULT_CDN_BASE_URL = "https://storefrontassetscdn.cimplify.io";

package/dist/chunk-DKT62WQW.js

@@ -0,0 +1,53 @@
+'use strict';
+
+// src/internal/pkce-cookie.ts
+var PKCE_COOKIE = "cimplify_pkce";
+var PKCE_COOKIE_PATH = "/auth";
+var PKCE_COOKIE_MAX_AGE_SECONDS = 600;
+function encodePkceState(state) {
+  return encodeURIComponent(JSON.stringify(state));
+}
+function decodePkceState(raw) {
+  try {
+    const parsed = JSON.parse(decodeURIComponent(raw));
+    if (typeof parsed?.verifier === "string" && typeof parsed.state === "string" && typeof parsed.returnTo === "string") {
+      return { verifier: parsed.verifier, state: parsed.state, returnTo: parsed.returnTo };
+    }
+  } catch {
+  }
+  return null;
+}
+
+// src/internal/discovery.ts
+var DEFAULT_ISSUER = "https://api.cimplify.io";
+var FALLBACK_AUTHORIZATION_ENDPOINT = "https://auth.cimplify.io/oauth/authorize";
+var cache = /* @__PURE__ */ new Map();
+function fetchDiscovery(issuer) {
+  const base = issuer.replace(/\/$/, "");
+  let pending = cache.get(base);
+  if (!pending) {
+    pending = fetch(`${base}/.well-known/openid-configuration`).then((res) => {
+      if (!res.ok) throw new Error(`oidc discovery failed: ${res.status}`);
+      return res.json();
+    });
+    pending.catch(() => cache.delete(base));
+    cache.set(base, pending);
+  }
+  return pending;
+}
+async function getAuthorizationEndpoint(issuer) {
+  try {
+    const doc = await fetchDiscovery(issuer);
+    if (doc.authorization_endpoint) return doc.authorization_endpoint;
+  } catch {
+  }
+  return FALLBACK_AUTHORIZATION_ENDPOINT;
+}
+
+exports.DEFAULT_ISSUER = DEFAULT_ISSUER;
+exports.PKCE_COOKIE = PKCE_COOKIE;
+exports.PKCE_COOKIE_MAX_AGE_SECONDS = PKCE_COOKIE_MAX_AGE_SECONDS;
+exports.PKCE_COOKIE_PATH = PKCE_COOKIE_PATH;
+exports.decodePkceState = decodePkceState;
+exports.encodePkceState = encodePkceState;
+exports.getAuthorizationEndpoint = getAuthorizationEndpoint;

package/dist/chunk-XSOYJLMZ.mjs

@@ -0,0 +1,45 @@
+// src/internal/pkce-cookie.ts
+var PKCE_COOKIE = "cimplify_pkce";
+var PKCE_COOKIE_PATH = "/auth";
+var PKCE_COOKIE_MAX_AGE_SECONDS = 600;
+function encodePkceState(state) {
+  return encodeURIComponent(JSON.stringify(state));
+}
+function decodePkceState(raw) {
+  try {
+    const parsed = JSON.parse(decodeURIComponent(raw));
+    if (typeof parsed?.verifier === "string" && typeof parsed.state === "string" && typeof parsed.returnTo === "string") {
+      return { verifier: parsed.verifier, state: parsed.state, returnTo: parsed.returnTo };
+    }
+  } catch {
+  }
+  return null;
+}
+
+// src/internal/discovery.ts
+var DEFAULT_ISSUER = "https://api.cimplify.io";
+var FALLBACK_AUTHORIZATION_ENDPOINT = "https://auth.cimplify.io/oauth/authorize";
+var cache = /* @__PURE__ */ new Map();
+function fetchDiscovery(issuer) {
+  const base = issuer.replace(/\/$/, "");
+  let pending = cache.get(base);
+  if (!pending) {
+    pending = fetch(`${base}/.well-known/openid-configuration`).then((res) => {
+      if (!res.ok) throw new Error(`oidc discovery failed: ${res.status}`);
+      return res.json();
+    });
+    pending.catch(() => cache.delete(base));
+    cache.set(base, pending);
+  }
+  return pending;
+}
+async function getAuthorizationEndpoint(issuer) {
+  try {
+    const doc = await fetchDiscovery(issuer);
+    if (doc.authorization_endpoint) return doc.authorization_endpoint;
+  } catch {
+  }
+  return FALLBACK_AUTHORIZATION_ENDPOINT;
+}
+
+export { DEFAULT_ISSUER, PKCE_COOKIE, PKCE_COOKIE_MAX_AGE_SECONDS, PKCE_COOKIE_PATH, decodePkceState, encodePkceState, getAuthorizationEndpoint };

package/dist/index.d.mts

@@ -2,7 +2,7 @@ export { A as AUTHORIZATION_TYPE, a as AUTH_MUTATION, b as AbortablePromise, c a
 import { b9 as ProductWithDetails, j as ApiError } from './product-B_kS4Oxa.mjs';
 export { A as AddOn, a as AddOnDetails, b as AddOnGroupDetails, c as AddOnOption, d as AddOnOptionDetails, e as AddOnOptionPrice, f as AddOnWithOptions, g as AddToCartInput, h as AddressValue, i as AdjustmentType, k as AppliedDiscount, l as AttributeAppliesTo, m as AttributeType, n as AttributeValidationRules, o as AttributeVisibility, B as BenefitType, p as BillingFrequency, q as BillingMarkupType, r as BillingPlanType, s as Bundle, t as BundleComponentData, u as BundleComponentInfo, v as BundleComponentVariantView, w as BundleComponentView, x as BundlePriceType, y as BundleProduct, z as BundleSelectionData, C as BundleSelectionInput, D as BundleStoredSelection, E as BundleSummary, F as BundleWithDetails, G as Cart, H as CartAddOn, I as CartChannel, J as CartItem, K as CartItemDetails, L as CartMutationResult, M as CartNotice, N as CartStatus, O as CartSummary, P as CartTotals, Q as Category, R as CategorySummary, S as ChosenPrice, T as CimplifyError, U as Collection, V as CollectionProduct, W as CollectionSummary, X as ComponentGroup, Y as ComponentGroupWithComponents, Z as ComponentPriceBreakdown, _ as ComponentSchedulingData, $ as ComponentSelectionInput, a0 as ComponentSourceType, a1 as Composite, a2 as CompositeComponent, a3 as CompositeComponentView, a4 as CompositeGroupView, a5 as CompositePriceBreakdown, a6 as CompositePriceResult, a7 as CompositePricingMode, a8 as CompositeSelectionData, $ as CompositeSelectionInput, a9 as CompositeStoredSelection, aa as CompositeWithDetails, ab as CurrencyCode, ac as CustomAttributeDefinition, ad as CustomAttributeValue, ae as CustomerInputValue, af as DURATION_UNIT, ag as DateRangeValue, ah as Deal, ai as DealBenefitType, aj as DepositType, ak as DigitalProductType, al as DiscountBreakdown, am as DiscountDetails, an as DiscountValidation, ao as DisplayAddOn, ap as DisplayAddOnOption, aq as DisplayCart, ar as DisplayCartItem, as as DisplayMode, at as DurationUnit, au as ERROR_HINTS, av as EligiblePlansQuery, aw as ErrorCode, ax as ErrorCodeType, ay as ErrorHint, az as FacetValue, aA as FormattedPlanOption, aB as GroupPricingBehavior, aC as INPUT_FIELD_TYPE, aD as IdempotencyMismatchError, aE as InputFieldType, aF as InputFieldValidation, aG as InventoryType, aH as KnowledgeArticle, aI as LineConfiguration, aJ as LocationProductPrice, aK as LocationValue, aL as MeasurementValue, aM as Money, aN as PRODUCT_TYPE, aO as Pagination, aP as PaginationParams, aQ as PhoneValue, aR as Price, aS as PriceAdjustment, aT as PriceDecisionPath, aU as PriceEntryType, aV as PricePathTaxInfo, aW as PriceSource, aX as Product, aY as ProductAddOn, aZ as ProductAvailability, a_ as ProductAvailabilityNow, a$ as ProductBillingPlan, b0 as ProductDealInfo, b1 as ProductInputField, b2 as ProductProperty, b3 as ProductRenderHint, b4 as ProductTaxonomy, b5 as ProductTimeProfile, b6 as ProductType, b7 as ProductVariant, b8 as ProductVariantValue, ba as PropertyFacet, bb as PropertySource, bc as QuantityPricingTier, bd as RENDER_HINT, be as RelatedProductView, bf as SalesChannel, bg as SchedulingMode, bh as SelectedAddOnOption, bi as SemanticKind, bj as SignatureValue, bk as Subscription, bl as SubscriptionInvoice, bm as SubscriptionItem, bn as SubscriptionStatus, bo as SubscriptionWithDetails, bp as Tag, bq as TagsResponse, br as TaxPathComponent, bs as TaxonomyAttributeTemplate, bt as TaxonomyWithChildren, bu as UICart, bv as UICartBusiness, bw as UICartCustomer, bx as UICartLocation, by as UICartPricing, bz as UpdateCartItemInput, bA as VariantAxis, bB as VariantAxisSelection, bC as VariantAxisValue, bD as VariantAxisValueView, bE as VariantAxisView, bF as VariantAxisWithValues, bG as VariantDetails, bH as VariantDetailsDTO, bI as VariantDisplayAttribute, bJ as VariantLocationAvailability, bK as VariantStrategy, bL as VariantView, bM as ZERO, bN as currencyCode, bO as enrichError, bP as getErrorHint, bQ as isCimplifyError, bR as isIdempotencyMismatchError, bS as isQuoteConflictRequiringConsent, bT as isQuoteError, bU as isRetryableError, bV as isSupportedCurrency, bW as money, bX as moneyFromNumber } from './product-B_kS4Oxa.mjs';
 export { C as CURRENCY_SYMBOLS, M as MOBILE_MONEY_PROVIDERS, c as categorizePaymentError, d as detectMobileMoneyProvider, f as formatMoney, a as formatNumberCompact, b as formatPrice, e as formatPriceAdjustment, g as formatPriceCompact, h as formatPriceRange, i as formatPriceWithTax, j as formatProductPrice, k as getBasePrice, l as getCurrencySymbol, m as getDiscountPercentage, n as getDisplayPrice, o as getMarkupPercentage, p as getPriceRange, q as getProductCurrency, r as getTaxAmount, s as getUnitPriceAtQuantity, t as hasTaxInfo, u as isOnSale, v as isPaymentStatusFailure, w as isPaymentStatusRequiresAction, x as isPaymentStatusSuccess, y as isTaxInclusive, z as isValidPhoneForContext, A as normalizePaymentResponse, B as normalizePhoneToE164, D as normalizeStatusResponse, E as parsePrice, F as resolvePhoneCountryCode } from './index-D8vnKlOQ.mjs';
-export { A as AdConfig, a as AdContextValue, b as AdCreative, c as AdPosition, d as AdSlot, e as AdTheme, S as SignInOptions, g as getVariantDisplayName, s as startSignIn } from './sign-in-TL01-awQ.mjs';
+export { A as AdConfig, a as AdContextValue, b as AdCreative, c as AdPosition, d as AdSlot, e as AdTheme, S as SignInOptions, g as getVariantDisplayName, s as startSignIn } from './sign-in-dr7m09nm.mjs';
 export { A as AddressAuthorizationData, a as AuthorizationType, I as InitializePaymentResult, P as Payment, b as PaymentErrorDetails, c as PaymentMethod, d as PaymentMethodType, e as PaymentProcessingState, f as PaymentProvider, g as PaymentResponse, h as PaymentStatus, i as PaymentStatusResponse, S as SubmitAuthorizationInput } from './payment-DVS7ZUEp.mjs';
 export { F as FormatCompactOptions, a as FormatPriceOptions, P as ProductWithPrice } from './price-Cm0tU0V5.mjs';
 export { generateIdempotencyKey } from './advanced.mjs';
@@ -95,6 +95,9 @@ interface SilentSignInOptions {
     callbackUri?: string;
     sessionUri?: string;
     scope?: string;
+    /** OIDC issuer; the authorize host is resolved from discovery. Defaults to https://api.cimplify.io. */
+    issuer?: string;
+    /** @deprecated Pass `issuer`. If set, used directly as the authorize host. */
     authUrl?: string;
     timeoutMs?: number;
 }

package/dist/index.d.ts

@@ -2,7 +2,7 @@ export { A as AUTHORIZATION_TYPE, a as AUTH_MUTATION, b as AbortablePromise, c a
 import { b9 as ProductWithDetails, j as ApiError } from './product-B_kS4Oxa.js';
 export { A as AddOn, a as AddOnDetails, b as AddOnGroupDetails, c as AddOnOption, d as AddOnOptionDetails, e as AddOnOptionPrice, f as AddOnWithOptions, g as AddToCartInput, h as AddressValue, i as AdjustmentType, k as AppliedDiscount, l as AttributeAppliesTo, m as AttributeType, n as AttributeValidationRules, o as AttributeVisibility, B as BenefitType, p as BillingFrequency, q as BillingMarkupType, r as BillingPlanType, s as Bundle, t as BundleComponentData, u as BundleComponentInfo, v as BundleComponentVariantView, w as BundleComponentView, x as BundlePriceType, y as BundleProduct, z as BundleSelectionData, C as BundleSelectionInput, D as BundleStoredSelection, E as BundleSummary, F as BundleWithDetails, G as Cart, H as CartAddOn, I as CartChannel, J as CartItem, K as CartItemDetails, L as CartMutationResult, M as CartNotice, N as CartStatus, O as CartSummary, P as CartTotals, Q as Category, R as CategorySummary, S as ChosenPrice, T as CimplifyError, U as Collection, V as CollectionProduct, W as CollectionSummary, X as ComponentGroup, Y as ComponentGroupWithComponents, Z as ComponentPriceBreakdown, _ as ComponentSchedulingData, $ as ComponentSelectionInput, a0 as ComponentSourceType, a1 as Composite, a2 as CompositeComponent, a3 as CompositeComponentView, a4 as CompositeGroupView, a5 as CompositePriceBreakdown, a6 as CompositePriceResult, a7 as CompositePricingMode, a8 as CompositeSelectionData, $ as CompositeSelectionInput, a9 as CompositeStoredSelection, aa as CompositeWithDetails, ab as CurrencyCode, ac as CustomAttributeDefinition, ad as CustomAttributeValue, ae as CustomerInputValue, af as DURATION_UNIT, ag as DateRangeValue, ah as Deal, ai as DealBenefitType, aj as DepositType, ak as DigitalProductType, al as DiscountBreakdown, am as DiscountDetails, an as DiscountValidation, ao as DisplayAddOn, ap as DisplayAddOnOption, aq as DisplayCart, ar as DisplayCartItem, as as DisplayMode, at as DurationUnit, au as ERROR_HINTS, av as EligiblePlansQuery, aw as ErrorCode, ax as ErrorCodeType, ay as ErrorHint, az as FacetValue, aA as FormattedPlanOption, aB as GroupPricingBehavior, aC as INPUT_FIELD_TYPE, aD as IdempotencyMismatchError, aE as InputFieldType, aF as InputFieldValidation, aG as InventoryType, aH as KnowledgeArticle, aI as LineConfiguration, aJ as LocationProductPrice, aK as LocationValue, aL as MeasurementValue, aM as Money, aN as PRODUCT_TYPE, aO as Pagination, aP as PaginationParams, aQ as PhoneValue, aR as Price, aS as PriceAdjustment, aT as PriceDecisionPath, aU as PriceEntryType, aV as PricePathTaxInfo, aW as PriceSource, aX as Product, aY as ProductAddOn, aZ as ProductAvailability, a_ as ProductAvailabilityNow, a$ as ProductBillingPlan, b0 as ProductDealInfo, b1 as ProductInputField, b2 as ProductProperty, b3 as ProductRenderHint, b4 as ProductTaxonomy, b5 as ProductTimeProfile, b6 as ProductType, b7 as ProductVariant, b8 as ProductVariantValue, ba as PropertyFacet, bb as PropertySource, bc as QuantityPricingTier, bd as RENDER_HINT, be as RelatedProductView, bf as SalesChannel, bg as SchedulingMode, bh as SelectedAddOnOption, bi as SemanticKind, bj as SignatureValue, bk as Subscription, bl as SubscriptionInvoice, bm as SubscriptionItem, bn as SubscriptionStatus, bo as SubscriptionWithDetails, bp as Tag, bq as TagsResponse, br as TaxPathComponent, bs as TaxonomyAttributeTemplate, bt as TaxonomyWithChildren, bu as UICart, bv as UICartBusiness, bw as UICartCustomer, bx as UICartLocation, by as UICartPricing, bz as UpdateCartItemInput, bA as VariantAxis, bB as VariantAxisSelection, bC as VariantAxisValue, bD as VariantAxisValueView, bE as VariantAxisView, bF as VariantAxisWithValues, bG as VariantDetails, bH as VariantDetailsDTO, bI as VariantDisplayAttribute, bJ as VariantLocationAvailability, bK as VariantStrategy, bL as VariantView, bM as ZERO, bN as currencyCode, bO as enrichError, bP as getErrorHint, bQ as isCimplifyError, bR as isIdempotencyMismatchError, bS as isQuoteConflictRequiringConsent, bT as isQuoteError, bU as isRetryableError, bV as isSupportedCurrency, bW as money, bX as moneyFromNumber } from './product-B_kS4Oxa.js';
 export { C as CURRENCY_SYMBOLS, M as MOBILE_MONEY_PROVIDERS, c as categorizePaymentError, d as detectMobileMoneyProvider, f as formatMoney, a as formatNumberCompact, b as formatPrice, e as formatPriceAdjustment, g as formatPriceCompact, h as formatPriceRange, i as formatPriceWithTax, j as formatProductPrice, k as getBasePrice, l as getCurrencySymbol, m as getDiscountPercentage, n as getDisplayPrice, o as getMarkupPercentage, p as getPriceRange, q as getProductCurrency, r as getTaxAmount, s as getUnitPriceAtQuantity, t as hasTaxInfo, u as isOnSale, v as isPaymentStatusFailure, w as isPaymentStatusRequiresAction, x as isPaymentStatusSuccess, y as isTaxInclusive, z as isValidPhoneForContext, A as normalizePaymentResponse, B as normalizePhoneToE164, D as normalizeStatusResponse, E as parsePrice, F as resolvePhoneCountryCode } from './index-DIIlPUOC.js';
-export { A as AdConfig, a as AdContextValue, b as AdCreative, c as AdPosition, d as AdSlot, e as AdTheme, S as SignInOptions, g as getVariantDisplayName, s as startSignIn } from './sign-in-TL01-awQ.js';
+export { A as AdConfig, a as AdContextValue, b as AdCreative, c as AdPosition, d as AdSlot, e as AdTheme, S as SignInOptions, g as getVariantDisplayName, s as startSignIn } from './sign-in-dr7m09nm.js';
 export { A as AddressAuthorizationData, a as AuthorizationType, I as InitializePaymentResult, P as Payment, b as PaymentErrorDetails, c as PaymentMethod, d as PaymentMethodType, e as PaymentProcessingState, f as PaymentProvider, g as PaymentResponse, h as PaymentStatus, i as PaymentStatusResponse, S as SubmitAuthorizationInput } from './payment-sn-yGL7v.js';
 export { F as FormatCompactOptions, a as FormatPriceOptions, P as ProductWithPrice } from './price-9T1Y47oS.js';
 export { generateIdempotencyKey } from './advanced.js';
@@ -95,6 +95,9 @@ interface SilentSignInOptions {
     callbackUri?: string;
     sessionUri?: string;
     scope?: string;
+    /** OIDC issuer; the authorize host is resolved from discovery. Defaults to https://api.cimplify.io. */
+    issuer?: string;
+    /** @deprecated Pass `issuer`. If set, used directly as the authorize host. */
     authUrl?: string;
     timeoutMs?: number;
 }

package/dist/index.js

@@ -1,7 +1,8 @@
 'use strict';
 
-var chunkVV3GTDIP_js = require('./chunk-VV3GTDIP.js');
+var chunk6DMHVQ42_js = require('./chunk-6DMHVQ42.js');
 var chunkL5GKVQVJ_js = require('./chunk-L5GKVQVJ.js');
+var chunkDKT62WQW_js = require('./chunk-DKT62WQW.js');
 var chunkMW7ICTVK_js = require('./chunk-MW7ICTVK.js');
 var chunkJGBDWEPJ_js = require('./chunk-JGBDWEPJ.js');
 var chunk7Y2O3E4D_js = require('./chunk-7Y2O3E4D.js');
@@ -9,7 +10,6 @@ var chunkXA3ZNR75_js = require('./chunk-XA3ZNR75.js');
 require('./chunk-OWW5GUSB.js');
 
 // src/silent-sign-in.ts
-var DEFAULT_AUTH_URL = "https://auth.cimplify.io";
 var DEFAULT_SCOPE = "openid email phone profile";
 var DEFAULT_TIMEOUT_MS = 12e3;
 async function signInSilent(opts) {
@@ -22,10 +22,10 @@ async function signInSilent(opts) {
     }
   } catch {
   }
-  const authUrl = (opts.authUrl ?? DEFAULT_AUTH_URL).replace(/\/$/, "");
   const callbackUri = opts.callbackUri ?? "/auth/callback";
-  const pkce = await chunkVV3GTDIP_js.generatePkce();
-  const state = chunkVV3GTDIP_js.generateState();
+  const authorizeEndpoint = opts.authUrl ? `${opts.authUrl.replace(/\/$/, "")}/oauth/authorize` : await chunkDKT62WQW_js.getAuthorizationEndpoint(opts.issuer ?? chunkDKT62WQW_js.DEFAULT_ISSUER);
+  const pkce = await chunk6DMHVQ42_js.generatePkce();
+  const state = chunk6DMHVQ42_js.generateState();
   const params = new URLSearchParams({
     response_type: "code",
     response_mode: "web_message",
@@ -37,8 +37,8 @@ async function signInSilent(opts) {
     code_challenge: pkce.challenge,
     code_challenge_method: pkce.method
   });
-  const src = `${authUrl}/oauth/authorize?${params.toString()}`;
-  const expectedOrigin = new URL(authUrl).origin;
+  const src = `${authorizeEndpoint}?${params.toString()}`;
+  const expectedOrigin = new URL(authorizeEndpoint).origin;
   const iframe = document.createElement("iframe");
   iframe.style.display = "none";
   iframe.setAttribute("aria-hidden", "true");
@@ -95,51 +95,51 @@ async function signInSilent(opts) {
 
 Object.defineProperty(exports, "CIMPLIFY_CDN_HOSTS", {
   enumerable: true,
-  get: function () { return chunkVV3GTDIP_js.CIMPLIFY_CDN_HOSTS; }
+  get: function () { return chunk6DMHVQ42_js.CIMPLIFY_CDN_HOSTS; }
 });
 Object.defineProperty(exports, "DEFAULT_CDN_BASE_URL", {
   enumerable: true,
-  get: function () { return chunkVV3GTDIP_js.DEFAULT_CDN_BASE_URL; }
+  get: function () { return chunk6DMHVQ42_js.DEFAULT_CDN_BASE_URL; }
 });
 Object.defineProperty(exports, "DURATION_UNIT", {
   enumerable: true,
-  get: function () { return chunkVV3GTDIP_js.DURATION_UNIT; }
+  get: function () { return chunk6DMHVQ42_js.DURATION_UNIT; }
 });
 Object.defineProperty(exports, "INPUT_FIELD_TYPE", {
   enumerable: true,
-  get: function () { return chunkVV3GTDIP_js.INPUT_FIELD_TYPE; }
+  get: function () { return chunk6DMHVQ42_js.INPUT_FIELD_TYPE; }
 });
 Object.defineProperty(exports, "PRODUCT_TYPE", {
   enumerable: true,
-  get: function () { return chunkVV3GTDIP_js.PRODUCT_TYPE; }
+  get: function () { return chunk6DMHVQ42_js.PRODUCT_TYPE; }
 });
 Object.defineProperty(exports, "RENDER_HINT", {
   enumerable: true,
-  get: function () { return chunkVV3GTDIP_js.RENDER_HINT; }
+  get: function () { return chunk6DMHVQ42_js.RENDER_HINT; }
 });
 Object.defineProperty(exports, "allGalleryImages", {
   enumerable: true,
-  get: function () { return chunkVV3GTDIP_js.allGalleryImages; }
+  get: function () { return chunk6DMHVQ42_js.allGalleryImages; }
 });
 Object.defineProperty(exports, "assetUrl", {
   enumerable: true,
-  get: function () { return chunkVV3GTDIP_js.assetUrl; }
+  get: function () { return chunk6DMHVQ42_js.assetUrl; }
 });
 Object.defineProperty(exports, "getVariantDisplayName", {
   enumerable: true,
-  get: function () { return chunkVV3GTDIP_js.getVariantDisplayName; }
+  get: function () { return chunk6DMHVQ42_js.getVariantDisplayName; }
 });
 Object.defineProperty(exports, "isCimplifyAsset", {
   enumerable: true,
-  get: function () { return chunkVV3GTDIP_js.isCimplifyAsset; }
+  get: function () { return chunk6DMHVQ42_js.isCimplifyAsset; }
 });
 Object.defineProperty(exports, "resolveGallery", {
   enumerable: true,
-  get: function () { return chunkVV3GTDIP_js.resolveGallery; }
+  get: function () { return chunk6DMHVQ42_js.resolveGallery; }
 });
 Object.defineProperty(exports, "startSignIn", {
   enumerable: true,
-  get: function () { return chunkVV3GTDIP_js.startSignIn; }
+  get: function () { return chunk6DMHVQ42_js.startSignIn; }
 });
 Object.defineProperty(exports, "isValidPhoneForContext", {
   enumerable: true,

package/dist/index.mjs

@@ -1,6 +1,7 @@
-import { generatePkce, generateState } from './chunk-W6FRIYYU.mjs';
-export { CIMPLIFY_CDN_HOSTS, DEFAULT_CDN_BASE_URL, DURATION_UNIT, INPUT_FIELD_TYPE, PRODUCT_TYPE, RENDER_HINT, allGalleryImages, assetUrl, getVariantDisplayName, isCimplifyAsset, resolveGallery, startSignIn } from './chunk-W6FRIYYU.mjs';
+import { generatePkce, generateState } from './chunk-2AU263DK.mjs';
+export { CIMPLIFY_CDN_HOSTS, DEFAULT_CDN_BASE_URL, DURATION_UNIT, INPUT_FIELD_TYPE, PRODUCT_TYPE, RENDER_HINT, allGalleryImages, assetUrl, getVariantDisplayName, isCimplifyAsset, resolveGallery, startSignIn } from './chunk-2AU263DK.mjs';
 export { isValidPhoneForContext, normalizePhoneToE164, resolvePhoneCountryCode } from './chunk-YOIVZ6OA.mjs';
+import { getAuthorizationEndpoint, DEFAULT_ISSUER } from './chunk-XSOYJLMZ.mjs';
 export { ActivityService, CimplifyClient, DeliveryService, PlacesService, SubscriptionService, SupportService, UploadService, createCimplifyClient } from './chunk-SQ7U3BWY.mjs';
 export { AUTHORIZATION_TYPE, AUTH_MUTATION, AuthService, BusinessService, CHECKOUT_MODE, CHECKOUT_MUTATION, CHECKOUT_STEP, CONTACT_TYPE, CartOperations, CatalogueQueries, CheckoutService as CheckoutOperations, CheckoutService, CimplifyElement, CimplifyElements, DEFAULT_COUNTRY, DEFAULT_CURRENCY, DEVICE_TYPE, ELEMENT_TYPES, EVENT_TYPES, FxService, InventoryService, LINK_MUTATION, LINK_QUERY, LinkService, LiteService, MESSAGE_TYPES, MOBILE_MONEY_PROVIDER, ORDER_MUTATION, ORDER_TYPE, OrderQueries, PAYMENT_METHOD, PAYMENT_MUTATION, PAYMENT_STATE, PICKUP_TIME_TYPE, SchedulingService, combine, combineObject, createElements, err, flatMap, fromPromise, generateIdempotencyKey, getOrElse, isErr, isOk, mapError, mapResult, ok, toNullable, tryCatch, unwrap } from './chunk-I4IXPQIX.mjs';
 export { CURRENCY_SYMBOLS, MOBILE_MONEY_PROVIDERS, categorizePaymentError, detectMobileMoneyProvider, formatMoney, formatNumberCompact, formatPrice, formatPriceAdjustment, formatPriceCompact, formatPriceRange, formatPriceWithTax, formatProductPrice, getBasePrice, getCurrencySymbol, getDiscountPercentage, getDisplayPrice, getMarkupPercentage, getPriceRange, getProductCurrency, getTaxAmount, getUnitPriceAtQuantity, hasTaxInfo, isOnSale, isPaymentStatusFailure, isPaymentStatusRequiresAction, isPaymentStatusSuccess, isTaxInclusive, normalizePaymentResponse, normalizeStatusResponse, parsePrice } from './chunk-TD3AY34U.mjs';
@@ -8,7 +9,6 @@ export { CimplifyError, ERROR_HINTS, ErrorCode, IdempotencyMismatchError, ZERO,
 import './chunk-3G6RQLXK.mjs';
 
 // src/silent-sign-in.ts
-var DEFAULT_AUTH_URL = "https://auth.cimplify.io";
 var DEFAULT_SCOPE = "openid email phone profile";
 var DEFAULT_TIMEOUT_MS = 12e3;
 async function signInSilent(opts) {
@@ -21,8 +21,8 @@ async function signInSilent(opts) {
     }
   } catch {
   }
-  const authUrl = (opts.authUrl ?? DEFAULT_AUTH_URL).replace(/\/$/, "");
   const callbackUri = opts.callbackUri ?? "/auth/callback";
+  const authorizeEndpoint = opts.authUrl ? `${opts.authUrl.replace(/\/$/, "")}/oauth/authorize` : await getAuthorizationEndpoint(opts.issuer ?? DEFAULT_ISSUER);
   const pkce = await generatePkce();
   const state = generateState();
   const params = new URLSearchParams({
@@ -36,8 +36,8 @@ async function signInSilent(opts) {
     code_challenge: pkce.challenge,
     code_challenge_method: pkce.method
   });
-  const src = `${authUrl}/oauth/authorize?${params.toString()}`;
-  const expectedOrigin = new URL(authUrl).origin;
+  const src = `${authorizeEndpoint}?${params.toString()}`;
+  const expectedOrigin = new URL(authorizeEndpoint).origin;
   const iframe = document.createElement("iframe");
   iframe.style.display = "none";
   iframe.setAttribute("aria-hidden", "true");

package/dist/react.d.mts

@@ -1,6 +1,6 @@
 import React$1, { ReactNode } from 'react';
-import { d as AdSlot, c as AdPosition, a as AdContextValue, S as SignInOptions } from './sign-in-TL01-awQ.mjs';
-export { A as AdConfig, g as getVariantDisplayName } from './sign-in-TL01-awQ.mjs';
+import { d as AdSlot, c as AdPosition, a as AdContextValue, S as SignInOptions } from './sign-in-dr7m09nm.mjs';
+export { A as AdConfig, g as getVariantDisplayName } from './sign-in-dr7m09nm.mjs';
 import { ac as CimplifyClient, c0 as ProcessCheckoutResult, a9 as CheckoutStatus, aa as CheckoutStatusContext, w as Business, bd as Location, ch as ReorderResult, bK as OrderStatus, bt as Order, c2 as QuoteBundleSelectionInput, c3 as QuoteCompositeSelectionInput, bY as PriceQuote, c6 as QuoteUiMessage, cC as Service, r as AvailableSlot, au as DayAvailability, am as CustomerBooking, L as CancelBookingResult, f as ActivityStateResponse, cL as SessionMessage, c as ActivityRecommendation, aw as DeliveryFeeResponse, aX as FxRateResponse, cU as StorefrontBootstrap, X as ChatWidgetStarter, W as ChatMessage, h as AddressInfo, n as AuthenticatedData, aL as ElementsOptions, bS as PaymentMethodInfo, aJ as ElementsCheckoutResult, b$ as ProcessCheckoutOptions, af as CimplifyElements, b4 as LineItem, cO as Staff, cx as Room } from './client-DKg-5OWu.mjs';
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ab as CurrencyCode, aX as Product, aO as Pagination, T as CimplifyError, b9 as ProductWithDetails, Q as Category, aM as Money, C as BundleSelectionInput, $ as ComponentSelectionInput, z as BundleSelectionData, a8 as CompositeSelectionData, U as Collection, b4 as ProductTaxonomy, bt as TaxonomyWithChildren, b5 as ProductTimeProfile, ah as Deal, b0 as ProductDealInfo, an as DiscountValidation, E as BundleSummary, a6 as CompositePriceResult, bo as SubscriptionWithDetails, bn as SubscriptionStatus, bk as Subscription, ac as CustomAttributeDefinition, ba as PropertyFacet, a$ as ProductBillingPlan, bL as VariantView, bF as VariantAxisWithValues, f as AddOnWithOptions, w as BundleComponentView, x as BundlePriceType, a4 as CompositeGroupView, aq as DisplayCart, b1 as ProductInputField, bg as SchedulingMode, at as DurationUnit, ad as CustomAttributeValue, b2 as ProductProperty, bc as QuantityPricingTier } from './product-B_kS4Oxa.mjs';

package/dist/react.d.ts

@@ -1,6 +1,6 @@
 import React$1, { ReactNode } from 'react';
-import { d as AdSlot, c as AdPosition, a as AdContextValue, S as SignInOptions } from './sign-in-TL01-awQ.js';
-export { A as AdConfig, g as getVariantDisplayName } from './sign-in-TL01-awQ.js';
+import { d as AdSlot, c as AdPosition, a as AdContextValue, S as SignInOptions } from './sign-in-dr7m09nm.js';
+export { A as AdConfig, g as getVariantDisplayName } from './sign-in-dr7m09nm.js';
 import { ac as CimplifyClient, c0 as ProcessCheckoutResult, a9 as CheckoutStatus, aa as CheckoutStatusContext, w as Business, bd as Location, ch as ReorderResult, bK as OrderStatus, bt as Order, c2 as QuoteBundleSelectionInput, c3 as QuoteCompositeSelectionInput, bY as PriceQuote, c6 as QuoteUiMessage, cC as Service, r as AvailableSlot, au as DayAvailability, am as CustomerBooking, L as CancelBookingResult, f as ActivityStateResponse, cL as SessionMessage, c as ActivityRecommendation, aw as DeliveryFeeResponse, aX as FxRateResponse, cU as StorefrontBootstrap, X as ChatWidgetStarter, W as ChatMessage, h as AddressInfo, n as AuthenticatedData, aL as ElementsOptions, bS as PaymentMethodInfo, aJ as ElementsCheckoutResult, b$ as ProcessCheckoutOptions, af as CimplifyElements, b4 as LineItem, cO as Staff, cx as Room } from './client-Dfg_hmkP.js';
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import { ab as CurrencyCode, aX as Product, aO as Pagination, T as CimplifyError, b9 as ProductWithDetails, Q as Category, aM as Money, C as BundleSelectionInput, $ as ComponentSelectionInput, z as BundleSelectionData, a8 as CompositeSelectionData, U as Collection, b4 as ProductTaxonomy, bt as TaxonomyWithChildren, b5 as ProductTimeProfile, ah as Deal, b0 as ProductDealInfo, an as DiscountValidation, E as BundleSummary, a6 as CompositePriceResult, bo as SubscriptionWithDetails, bn as SubscriptionStatus, bk as Subscription, ac as CustomAttributeDefinition, ba as PropertyFacet, a$ as ProductBillingPlan, bL as VariantView, bF as VariantAxisWithValues, f as AddOnWithOptions, w as BundleComponentView, x as BundlePriceType, a4 as CompositeGroupView, aq as DisplayCart, b1 as ProductInputField, bg as SchedulingMode, at as DurationUnit, ad as CustomAttributeValue, b2 as ProductProperty, bc as QuantityPricingTier } from './product-B_kS4Oxa.js';

package/dist/react.js

@@ -1,7 +1,8 @@
 "use client";
 'use strict';
 
-var chunkVV3GTDIP_js = require('./chunk-VV3GTDIP.js');
+var chunk6DMHVQ42_js = require('./chunk-6DMHVQ42.js');
+require('./chunk-DKT62WQW.js');
 var chunkMW7ICTVK_js = require('./chunk-MW7ICTVK.js');
 var chunkJGBDWEPJ_js = require('./chunk-JGBDWEPJ.js');
 var chunk7Y2O3E4D_js = require('./chunk-7Y2O3E4D.js');
@@ -2714,7 +2715,7 @@ function CimplifySignInButton({
   const onClick = async () => {
     if (busy || disabled) return;
     setBusy(true);
-    await chunkVV3GTDIP_js.startSignIn({
+    await chunk6DMHVQ42_js.startSignIn({
       ...signInOpts,
       onSuccess: () => {
         setBusy(false);
@@ -5463,7 +5464,7 @@ function VariantSelector({
                   {
                     "data-cimplify-variant-name": true,
                     className: cn("flex-1 min-w-0 text-sm", classNames?.name),
-                    children: chunkVV3GTDIP_js.getVariantDisplayName(variant, productName)
+                    children: chunk6DMHVQ42_js.getVariantDisplayName(variant, productName)
                   }
                 ),
                 /* @__PURE__ */ jsxRuntime.jsxs("span", { "data-cimplify-variant-pricing": true, className: cn("text-sm text-muted-foreground", classNames?.pricing), children: [
@@ -6936,12 +6937,12 @@ function FieldInput({
     classNames?.input
   );
   switch (field.field_type) {
-    case chunkVV3GTDIP_js.INPUT_FIELD_TYPE.Text:
-    case chunkVV3GTDIP_js.INPUT_FIELD_TYPE.Url:
+    case chunk6DMHVQ42_js.INPUT_FIELD_TYPE.Text:
+    case chunk6DMHVQ42_js.INPUT_FIELD_TYPE.Url:
       return /* @__PURE__ */ jsxRuntime.jsx(
         "input",
         {
-          type: field.field_type === chunkVV3GTDIP_js.INPUT_FIELD_TYPE.Url ? "url" : "text",
+          type: field.field_type === chunk6DMHVQ42_js.INPUT_FIELD_TYPE.Url ? "url" : "text",
           value: typeof value === "string" ? value : "",
           onChange: (e) => onValueChange(e.target.value),
           placeholder: field.placeholder,
@@ -6950,7 +6951,7 @@ function FieldInput({
           className: inputClass
         }
       );
-    case chunkVV3GTDIP_js.INPUT_FIELD_TYPE.Textarea:
+    case chunk6DMHVQ42_js.INPUT_FIELD_TYPE.Textarea:
       return /* @__PURE__ */ jsxRuntime.jsx(
         "textarea",
         {
@@ -6963,7 +6964,7 @@ function FieldInput({
           className: cn(inputClass, "resize-none", classNames?.textarea)
         }
       );
-    case chunkVV3GTDIP_js.INPUT_FIELD_TYPE.Number:
+    case chunk6DMHVQ42_js.INPUT_FIELD_TYPE.Number:
       return /* @__PURE__ */ jsxRuntime.jsx(
         "input",
         {
@@ -6977,7 +6978,7 @@ function FieldInput({
           className: inputClass
         }
       );
-    case chunkVV3GTDIP_js.INPUT_FIELD_TYPE.Select:
+    case chunk6DMHVQ42_js.INPUT_FIELD_TYPE.Select:
       return /* @__PURE__ */ jsxRuntime.jsxs(
         "select",
         {
@@ -6991,7 +6992,7 @@ function FieldInput({
           ]
         }
       );
-    case chunkVV3GTDIP_js.INPUT_FIELD_TYPE.Radio:
+    case chunk6DMHVQ42_js.INPUT_FIELD_TYPE.Radio:
       return /* @__PURE__ */ jsxRuntime.jsx("div", { className: cn("space-y-2", classNames?.radioGroup), children: (field.options || []).map((opt) => /* @__PURE__ */ jsxRuntime.jsxs(
         "label",
         {
@@ -7016,7 +7017,7 @@ function FieldInput({
         },
         opt
       )) });
-    case chunkVV3GTDIP_js.INPUT_FIELD_TYPE.Checkbox:
+    case chunk6DMHVQ42_js.INPUT_FIELD_TYPE.Checkbox:
       return /* @__PURE__ */ jsxRuntime.jsxs("label", { className: cn("flex items-center gap-2 text-sm cursor-pointer", classNames?.checkboxLabel), children: [
         /* @__PURE__ */ jsxRuntime.jsx(
           "input",
@@ -7029,7 +7030,7 @@ function FieldInput({
         ),
         field.placeholder || field.name
       ] });
-    case chunkVV3GTDIP_js.INPUT_FIELD_TYPE.Color:
+    case chunk6DMHVQ42_js.INPUT_FIELD_TYPE.Color:
       return /* @__PURE__ */ jsxRuntime.jsx(
         "input",
         {
@@ -7039,7 +7040,7 @@ function FieldInput({
           className: cn("w-12 h-10 rounded-md border border-input cursor-pointer", classNames?.colorInput)
         }
       );
-    case chunkVV3GTDIP_js.INPUT_FIELD_TYPE.Date:
+    case chunk6DMHVQ42_js.INPUT_FIELD_TYPE.Date:
       return /* @__PURE__ */ jsxRuntime.jsx(
         DatePicker,
         {
@@ -7050,8 +7051,8 @@ function FieldInput({
           "aria-label": field.name
         }
       );
-    case chunkVV3GTDIP_js.INPUT_FIELD_TYPE.File:
-    case chunkVV3GTDIP_js.INPUT_FIELD_TYPE.Image:
+    case chunk6DMHVQ42_js.INPUT_FIELD_TYPE.File:
+    case chunk6DMHVQ42_js.INPUT_FIELD_TYPE.Image:
       return /* @__PURE__ */ jsxRuntime.jsx(
         FileUploadInput,
         {
@@ -7062,7 +7063,7 @@ function FieldInput({
           classNames
         }
       );
-    case chunkVV3GTDIP_js.INPUT_FIELD_TYPE.Email:
+    case chunk6DMHVQ42_js.INPUT_FIELD_TYPE.Email:
       return /* @__PURE__ */ jsxRuntime.jsx(
         "input",
         {
@@ -7074,7 +7075,7 @@ function FieldInput({
           className: inputClass
         }
       );
-    case chunkVV3GTDIP_js.INPUT_FIELD_TYPE.DateTime: {
+    case chunk6DMHVQ42_js.INPUT_FIELD_TYPE.DateTime: {
       const stringValue = typeof value === "string" ? value : "";
       const [datePart, timePartRaw] = stringValue.includes("T") ? stringValue.split("T", 2) : [stringValue, ""];
       const timePart = (timePartRaw ?? "").slice(0, 5);
@@ -7113,7 +7114,7 @@ function FieldInput({
         )
       ] });
     }
-    case chunkVV3GTDIP_js.INPUT_FIELD_TYPE.Time:
+    case chunk6DMHVQ42_js.INPUT_FIELD_TYPE.Time:
       return /* @__PURE__ */ jsxRuntime.jsx(
         TimePicker,
         {
@@ -7124,7 +7125,7 @@ function FieldInput({
           "aria-label": field.name
         }
       );
-    case chunkVV3GTDIP_js.INPUT_FIELD_TYPE.MultiSelect:
+    case chunk6DMHVQ42_js.INPUT_FIELD_TYPE.MultiSelect:
       return /* @__PURE__ */ jsxRuntime.jsx(
         MultiSelectInput,
         {
@@ -7134,7 +7135,7 @@ function FieldInput({
           classNames
         }
       );
-    case chunkVV3GTDIP_js.INPUT_FIELD_TYPE.DateRange:
+    case chunk6DMHVQ42_js.INPUT_FIELD_TYPE.DateRange:
       return /* @__PURE__ */ jsxRuntime.jsx(
         DateRangeInput,
         {
@@ -7144,7 +7145,7 @@ function FieldInput({
           classNames
         }
       );
-    case chunkVV3GTDIP_js.INPUT_FIELD_TYPE.Address:
+    case chunk6DMHVQ42_js.INPUT_FIELD_TYPE.Address:
       return /* @__PURE__ */ jsxRuntime.jsx(
         AddressInput,
         {
@@ -7155,7 +7156,7 @@ function FieldInput({
           inputClass
         }
       );
-    case chunkVV3GTDIP_js.INPUT_FIELD_TYPE.Location:
+    case chunk6DMHVQ42_js.INPUT_FIELD_TYPE.Location:
       return /* @__PURE__ */ jsxRuntime.jsx(
         LocationInput,
         {
@@ -7166,7 +7167,7 @@ function FieldInput({
           inputClass
         }
       );
-    case chunkVV3GTDIP_js.INPUT_FIELD_TYPE.Phone:
+    case chunk6DMHVQ42_js.INPUT_FIELD_TYPE.Phone:
       return /* @__PURE__ */ jsxRuntime.jsx(
         PhoneInput,
         {
@@ -7177,7 +7178,7 @@ function FieldInput({
           inputClass
         }
       );
-    case chunkVV3GTDIP_js.INPUT_FIELD_TYPE.Signature:
+    case chunk6DMHVQ42_js.INPUT_FIELD_TYPE.Signature:
       return /* @__PURE__ */ jsxRuntime.jsx(
         SignatureInput,
         {
@@ -7210,7 +7211,7 @@ function FileUploadInput({
   const [isUploading, setIsUploading] = React12__default.default.useState(false);
   const fileUrl = typeof value === "string" ? value : void 0;
   const acceptedFormats = field.validation?.accepted_formats;
-  const accept = acceptedFormats ? acceptedFormats.map((f) => `.${f}`).join(",") : field.field_type === chunkVV3GTDIP_js.INPUT_FIELD_TYPE.Image ? "image/*" : void 0;
+  const accept = acceptedFormats ? acceptedFormats.map((f) => `.${f}`).join(",") : field.field_type === chunk6DMHVQ42_js.INPUT_FIELD_TYPE.Image ? "image/*" : void 0;
   const handleFile = async (file) => {
     if (!onFileUpload) return;
     if (field.validation?.max_size_mb) {
@@ -7228,7 +7229,7 @@ function FileUploadInput({
     }
   };
   return /* @__PURE__ */ jsxRuntime.jsx("div", { className: cn("space-y-2", classNames?.fileInput), children: fileUrl ? /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "flex items-center gap-3", children: [
-    field.field_type === chunkVV3GTDIP_js.INPUT_FIELD_TYPE.Image && /* @__PURE__ */ jsxRuntime.jsx("img", { src: fileUrl, alt: "Uploaded", className: "w-16 h-16 object-cover rounded-md border border-border" }),
+    field.field_type === chunk6DMHVQ42_js.INPUT_FIELD_TYPE.Image && /* @__PURE__ */ jsxRuntime.jsx("img", { src: fileUrl, alt: "Uploaded", className: "w-16 h-16 object-cover rounded-md border border-border" }),
     /* @__PURE__ */ jsxRuntime.jsx("div", { className: "flex-1 min-w-0", children: /* @__PURE__ */ jsxRuntime.jsx("p", { className: "text-sm text-foreground truncate", children: fileUrl.split("/").pop() }) }),
     /* @__PURE__ */ jsxRuntime.jsx(
       "button",
@@ -7254,7 +7255,7 @@ function FileUploadInput({
       }
     ),
     isUploading ? /* @__PURE__ */ jsxRuntime.jsx("span", { className: "text-sm text-muted-foreground", children: "Uploading..." }) : /* @__PURE__ */ jsxRuntime.jsxs(jsxRuntime.Fragment, { children: [
-      /* @__PURE__ */ jsxRuntime.jsx("span", { className: "text-sm text-muted-foreground", children: field.placeholder || `Upload ${field.field_type === chunkVV3GTDIP_js.INPUT_FIELD_TYPE.Image ? "image" : "file"}` }),
+      /* @__PURE__ */ jsxRuntime.jsx("span", { className: "text-sm text-muted-foreground", children: field.placeholder || `Upload ${field.field_type === chunk6DMHVQ42_js.INPUT_FIELD_TYPE.Image ? "image" : "file"}` }),
       acceptedFormats && /* @__PURE__ */ jsxRuntime.jsxs("span", { className: "text-xs text-muted-foreground/60 mt-1", children: [
         acceptedFormats.map((f) => f.toUpperCase()).join(", "),
         field.validation?.max_size_mb && ` \xB7 Max ${field.validation.max_size_mb}MB`
@@ -8876,7 +8877,7 @@ function CartLineItemRow({
   const isOptimistic = item.isOptimistic === true;
   const lineTotal = chunk7Y2O3E4D_js.parsePrice(unitPrice) * item.quantity;
   const imageUrl = item.product.image_url;
-  const variantLabel = item.variant ? chunkVV3GTDIP_js.getVariantDisplayName(item.variant, item.product.name) : null;
+  const variantLabel = item.variant ? chunk6DMHVQ42_js.getVariantDisplayName(item.variant, item.product.name) : null;
   return /* @__PURE__ */ jsxRuntime.jsxs(
     "div",
     {
@@ -8976,7 +8977,7 @@ function CartLineItemRow({
               input.field_name,
               ":"
             ] }),
-            /* @__PURE__ */ jsxRuntime.jsx("dd", { "data-cimplify-cart-input-value": true, className: "text-foreground m-0 truncate", children: input.field_type === chunkVV3GTDIP_js.INPUT_FIELD_TYPE.File || input.field_type === chunkVV3GTDIP_js.INPUT_FIELD_TYPE.Image ? String(input.value).split("/").pop() || "Uploaded file" : String(input.value) })
+            /* @__PURE__ */ jsxRuntime.jsx("dd", { "data-cimplify-cart-input-value": true, className: "text-foreground m-0 truncate", children: input.field_type === chunk6DMHVQ42_js.INPUT_FIELD_TYPE.File || input.field_type === chunk6DMHVQ42_js.INPUT_FIELD_TYPE.Image ? String(input.value).split("/").pop() || "Uploaded file" : String(input.value) })
           ] }, input.field_id)) }),
           (item.lineType === "service" || item.product.type === "service") && item.scheduledStart && /* @__PURE__ */ jsxRuntime.jsxs("div", { "data-cimplify-cart-service-info": true, className: cn("mt-1.5 flex items-center gap-1.5 text-xs text-muted-foreground", classNames?.serviceInfo), children: [
             /* @__PURE__ */ jsxRuntime.jsx("svg", { className: "w-3.5 h-3.5 shrink-0", fill: "none", stroke: "currentColor", strokeWidth: "2", viewBox: "0 0 24 24", "aria-hidden": true, children: /* @__PURE__ */ jsxRuntime.jsx("path", { strokeLinecap: "round", strokeLinejoin: "round", d: "M8 7V3m8 4V3m-9 8h10M5 21h14a2 2 0 002-2V7a2 2 0 00-2-2H5a2 2 0 00-2 2v12a2 2 0 002 2z" }) }),
@@ -9532,7 +9533,7 @@ function FoodProductCard({
   const tags = product.tags || [];
   const isSignature = product.metadata?.is_signature === true;
   const isNew = product.metadata?.is_new === true;
-  const isComposite = product.type === chunkVV3GTDIP_js.PRODUCT_TYPE.Composite;
+  const isComposite = product.type === chunk6DMHVQ42_js.PRODUCT_TYPE.Composite;
   return /* @__PURE__ */ jsxRuntime.jsxs(CardShell, { product, renderLink, className, children: [
     /* @__PURE__ */ jsxRuntime.jsxs(CardImage, { src: image, alt: product.name, aspectRatio: "square", renderImage, children: [
       isSignature && /* @__PURE__ */ jsxRuntime.jsxs("span", { className: "absolute top-3 left-3 inline-flex items-center gap-1 text-[11px] font-semibold tracking-wide bg-amber-50 text-amber-700 border border-amber-200/60 px-2 py-0.5 rounded-md", children: [
@@ -10285,26 +10286,26 @@ var BUILT_IN_CARDS = {
   ["composite" /* Composite */]: CompositeProductCard,
   ["subscription" /* Subscription */]: SubscriptionCard
 };
-var RENTAL_UNITS = /* @__PURE__ */ new Set([chunkVV3GTDIP_js.DURATION_UNIT.Days, chunkVV3GTDIP_js.DURATION_UNIT.Hours]);
-var LEASE_UNITS = /* @__PURE__ */ new Set([chunkVV3GTDIP_js.DURATION_UNIT.Weeks, chunkVV3GTDIP_js.DURATION_UNIT.Months, chunkVV3GTDIP_js.DURATION_UNIT.Years]);
+var RENTAL_UNITS = /* @__PURE__ */ new Set([chunk6DMHVQ42_js.DURATION_UNIT.Days, chunk6DMHVQ42_js.DURATION_UNIT.Hours]);
+var LEASE_UNITS = /* @__PURE__ */ new Set([chunk6DMHVQ42_js.DURATION_UNIT.Weeks, chunk6DMHVQ42_js.DURATION_UNIT.Months, chunk6DMHVQ42_js.DURATION_UNIT.Years]);
 function resolveCardVariant(product) {
-  if (product.type === chunkVV3GTDIP_js.PRODUCT_TYPE.Bundle) {
+  if (product.type === chunk6DMHVQ42_js.PRODUCT_TYPE.Bundle) {
     return "bundle" /* Bundle */;
   }
-  if (product.type === chunkVV3GTDIP_js.PRODUCT_TYPE.Composite) {
+  if (product.type === chunk6DMHVQ42_js.PRODUCT_TYPE.Composite) {
     return "composite" /* Composite */;
   }
   if (product.quantity_pricing && product.quantity_pricing.length > 1) {
     return "wholesale" /* Wholesale */;
   }
-  if (product.type === chunkVV3GTDIP_js.PRODUCT_TYPE.Digital) {
+  if (product.type === chunk6DMHVQ42_js.PRODUCT_TYPE.Digital) {
     return "digital" /* Digital */;
   }
-  if (product.type === chunkVV3GTDIP_js.PRODUCT_TYPE.Service) {
+  if (product.type === chunk6DMHVQ42_js.PRODUCT_TYPE.Service) {
     if (product.duration_unit && RENTAL_UNITS.has(product.duration_unit)) {
       return "rental" /* Rental */;
     }
-    if (product.duration_unit === chunkVV3GTDIP_js.DURATION_UNIT.Nights) {
+    if (product.duration_unit === chunk6DMHVQ42_js.DURATION_UNIT.Nights) {
       return "accommodation" /* Accommodation */;
     }
     if (product.duration_unit && LEASE_UNITS.has(product.duration_unit)) {
@@ -10315,10 +10316,10 @@ function resolveCardVariant(product) {
     }
     return "standard" /* Standard */;
   }
-  if (product.render_hint === chunkVV3GTDIP_js.RENDER_HINT.Food) {
+  if (product.render_hint === chunk6DMHVQ42_js.RENDER_HINT.Food) {
     return "food" /* Food */;
   }
-  if (product.render_hint === chunkVV3GTDIP_js.RENDER_HINT.Physical) {
+  if (product.render_hint === chunk6DMHVQ42_js.RENDER_HINT.Physical) {
     return "retail" /* Retail */;
   }
   return "retail" /* Retail */;
@@ -12624,7 +12625,7 @@ function DefaultProductLayout({
   className
 }) {
   const [selectedVariantId, setSelectedVariantId] = React12__default.default.useState();
-  const images = chunkVV3GTDIP_js.resolveGallery(product, selectedVariantId);
+  const images = chunk6DMHVQ42_js.resolveGallery(product, selectedVariantId);
   const hasRange = product.quantity_pricing && product.quantity_pricing.length > 1 || product.variants && product.variants.length > 1;
   const onSale = chunk7Y2O3E4D_js.isOnSale(product);
   const hasPhysicalDetails = product.sku || product.vendor || product.material;
@@ -13260,25 +13261,25 @@ function resolveTemplateKey(product) {
   if (typeof metaTemplate === "string" && metaTemplate.trim()) {
     return metaTemplate.trim();
   }
-  if (product.type === chunkVV3GTDIP_js.PRODUCT_TYPE.Bundle) {
+  if (product.type === chunk6DMHVQ42_js.PRODUCT_TYPE.Bundle) {
     return "bundle" /* Bundle */;
   }
-  if (product.type === chunkVV3GTDIP_js.PRODUCT_TYPE.Composite) {
+  if (product.type === chunk6DMHVQ42_js.PRODUCT_TYPE.Composite) {
     return "composite" /* Composite */;
   }
   if (product.quantity_pricing && product.quantity_pricing.length > 1) {
     return "wholesale" /* Wholesale */;
   }
-  if (product.type === chunkVV3GTDIP_js.PRODUCT_TYPE.Service) {
+  if (product.type === chunk6DMHVQ42_js.PRODUCT_TYPE.Service) {
     return "service" /* Service */;
   }
-  if (product.type === chunkVV3GTDIP_js.PRODUCT_TYPE.Digital) {
+  if (product.type === chunk6DMHVQ42_js.PRODUCT_TYPE.Digital) {
     return "digital" /* Digital */;
   }
-  if (product.render_hint === chunkVV3GTDIP_js.RENDER_HINT.Food) {
+  if (product.render_hint === chunk6DMHVQ42_js.RENDER_HINT.Food) {
     return "food" /* Food */;
   }
-  if (product.render_hint === chunkVV3GTDIP_js.RENDER_HINT.Physical) {
+  if (product.render_hint === chunk6DMHVQ42_js.RENDER_HINT.Physical) {
     return "physical" /* Physical */;
   }
   return "default" /* Default */;
@@ -15504,7 +15505,7 @@ function SparkleIcon({ className }) {
 
 Object.defineProperty(exports, "getVariantDisplayName", {
   enumerable: true,
-  get: function () { return chunkVV3GTDIP_js.getVariantDisplayName; }
+  get: function () { return chunk6DMHVQ42_js.getVariantDisplayName; }
 });
 exports.AccommodationCard = AccommodationCard;
 exports.AccountContent = AccountContent;

package/dist/react.mjs

@@ -1,6 +1,7 @@
 "use client";
-import { DURATION_UNIT, getVariantDisplayName, INPUT_FIELD_TYPE, PRODUCT_TYPE, resolveGallery, startSignIn, RENDER_HINT } from './chunk-W6FRIYYU.mjs';
-export { getVariantDisplayName } from './chunk-W6FRIYYU.mjs';
+import { DURATION_UNIT, getVariantDisplayName, INPUT_FIELD_TYPE, PRODUCT_TYPE, resolveGallery, startSignIn, RENDER_HINT } from './chunk-2AU263DK.mjs';
+export { getVariantDisplayName } from './chunk-2AU263DK.mjs';
+import './chunk-XSOYJLMZ.mjs';
 import { createCimplifyClient } from './chunk-SQ7U3BWY.mjs';
 import { ELEMENT_TYPES, EVENT_TYPES } from './chunk-I4IXPQIX.mjs';
 import { formatPrice, parsePrice, getUnitPriceAtQuantity, isOnSale, getDiscountPercentage, getBasePrice, getPriceRange, formatPriceRange } from './chunk-TD3AY34U.mjs';

package/dist/server.d.mts

@@ -194,6 +194,10 @@ declare function updateByTag(tag: string): Promise<void>;
 declare function refreshPage(): Promise<void>;
 
 interface OidcConfig {
+    /** OIDC issuer — the discovery anchor. Every endpoint is read from its
+     *  /.well-known/openid-configuration. Defaults to https://api.cimplify.io. */
+    issuer?: string;
+    /** @deprecated Use `issuer`. Kept as an alias for one release. */
     authUrl?: string;
     clientId: string;
     cookieName?: string;
@@ -233,7 +237,18 @@ interface CallbackHandlerOptions extends OidcConfig {
     redirectUri: string;
 }
 declare function handleOidcCallback(req: Request, opts: CallbackHandlerOptions): Promise<Response>;
+interface RedirectCallbackOptions extends OidcConfig {
+    redirectUri: string;
+    defaultReturnTo?: string;
+}
+/**
+ * Completes the redirect sign-in flow. The browser lands here (a top-level GET
+ * to the storefront's registered redirect_uri) carrying ?code&state; the PKCE
+ * verifier rides along in the first-party cimplify_pkce cookie. Exchanges the
+ * code server-side, sets the session cookies, and 302s back to returnTo.
+ */
+declare function handleRedirectCallback(req: Request, opts: RedirectCallbackOptions): Promise<Response>;
 declare function handleSessionRequest(req: Request, cfg: OidcConfig): Promise<Response>;
 declare function getSessionFromCookieHeader(cfg: OidcConfig, cookieHeader: string | null | undefined): Promise<CimplifySession | null>;
 
-export { CACHE_LIFE_DEFAULT, CACHE_LIFE_PROBE, type CacheLifeDefault, type CacheLifeProbe, type CallbackHandlerOptions, CimplifyClient, type CimplifySession, type CodeExchangeOptions, type CodeExchangeResult, type OidcConfig, type RevalidateProfile, type ServerClientOptions, buildAccessTokenCookie, buildSessionCookie, buildSignoutCookie, buildSignoutCookies, exchangeCode, getAccessTokenFromCookieHeader, getServerClient, getSessionFromCookieHeader, handleOidcCallback, handleSessionRequest, refreshPage, revalidateAddOn, revalidateAddOns, revalidateBrand, revalidateBusiness, revalidateByTag, revalidateCategories, revalidateCategory, revalidateCollection, revalidateCollections, revalidateLocation, revalidateLocations, revalidatePricing, revalidateProduct, revalidateProducts, revalidateStock, revalidateSubscription, revalidateSubscriptions, tags, updateAddOn, updateAddOns, updateBrand, updateBusiness, updateByTag, updateCategories, updateCategory, updateCollection, updateCollections, updateLocation, updateLocations, updatePricing, updateProduct, updateProducts, updateStock, updateSubscription, updateSubscriptions, verifyIdToken };
+export { CACHE_LIFE_DEFAULT, CACHE_LIFE_PROBE, type CacheLifeDefault, type CacheLifeProbe, type CallbackHandlerOptions, CimplifyClient, type CimplifySession, type CodeExchangeOptions, type CodeExchangeResult, type OidcConfig, type RedirectCallbackOptions, type RevalidateProfile, type ServerClientOptions, buildAccessTokenCookie, buildSessionCookie, buildSignoutCookie, buildSignoutCookies, exchangeCode, getAccessTokenFromCookieHeader, getServerClient, getSessionFromCookieHeader, handleOidcCallback, handleRedirectCallback, handleSessionRequest, refreshPage, revalidateAddOn, revalidateAddOns, revalidateBrand, revalidateBusiness, revalidateByTag, revalidateCategories, revalidateCategory, revalidateCollection, revalidateCollections, revalidateLocation, revalidateLocations, revalidatePricing, revalidateProduct, revalidateProducts, revalidateStock, revalidateSubscription, revalidateSubscriptions, tags, updateAddOn, updateAddOns, updateBrand, updateBusiness, updateByTag, updateCategories, updateCategory, updateCollection, updateCollections, updateLocation, updateLocations, updatePricing, updateProduct, updateProducts, updateStock, updateSubscription, updateSubscriptions, verifyIdToken };

package/dist/server.d.ts

@@ -194,6 +194,10 @@ declare function updateByTag(tag: string): Promise<void>;
 declare function refreshPage(): Promise<void>;
 
 interface OidcConfig {
+    /** OIDC issuer — the discovery anchor. Every endpoint is read from its
+     *  /.well-known/openid-configuration. Defaults to https://api.cimplify.io. */
+    issuer?: string;
+    /** @deprecated Use `issuer`. Kept as an alias for one release. */
     authUrl?: string;
     clientId: string;
     cookieName?: string;
@@ -233,7 +237,18 @@ interface CallbackHandlerOptions extends OidcConfig {
     redirectUri: string;
 }
 declare function handleOidcCallback(req: Request, opts: CallbackHandlerOptions): Promise<Response>;
+interface RedirectCallbackOptions extends OidcConfig {
+    redirectUri: string;
+    defaultReturnTo?: string;
+}
+/**
+ * Completes the redirect sign-in flow. The browser lands here (a top-level GET
+ * to the storefront's registered redirect_uri) carrying ?code&state; the PKCE
+ * verifier rides along in the first-party cimplify_pkce cookie. Exchanges the
+ * code server-side, sets the session cookies, and 302s back to returnTo.
+ */
+declare function handleRedirectCallback(req: Request, opts: RedirectCallbackOptions): Promise<Response>;
 declare function handleSessionRequest(req: Request, cfg: OidcConfig): Promise<Response>;
 declare function getSessionFromCookieHeader(cfg: OidcConfig, cookieHeader: string | null | undefined): Promise<CimplifySession | null>;
 
-export { CACHE_LIFE_DEFAULT, CACHE_LIFE_PROBE, type CacheLifeDefault, type CacheLifeProbe, type CallbackHandlerOptions, CimplifyClient, type CimplifySession, type CodeExchangeOptions, type CodeExchangeResult, type OidcConfig, type RevalidateProfile, type ServerClientOptions, buildAccessTokenCookie, buildSessionCookie, buildSignoutCookie, buildSignoutCookies, exchangeCode, getAccessTokenFromCookieHeader, getServerClient, getSessionFromCookieHeader, handleOidcCallback, handleSessionRequest, refreshPage, revalidateAddOn, revalidateAddOns, revalidateBrand, revalidateBusiness, revalidateByTag, revalidateCategories, revalidateCategory, revalidateCollection, revalidateCollections, revalidateLocation, revalidateLocations, revalidatePricing, revalidateProduct, revalidateProducts, revalidateStock, revalidateSubscription, revalidateSubscriptions, tags, updateAddOn, updateAddOns, updateBrand, updateBusiness, updateByTag, updateCategories, updateCategory, updateCollection, updateCollections, updateLocation, updateLocations, updatePricing, updateProduct, updateProducts, updateStock, updateSubscription, updateSubscriptions, verifyIdToken };
+export { CACHE_LIFE_DEFAULT, CACHE_LIFE_PROBE, type CacheLifeDefault, type CacheLifeProbe, type CallbackHandlerOptions, CimplifyClient, type CimplifySession, type CodeExchangeOptions, type CodeExchangeResult, type OidcConfig, type RedirectCallbackOptions, type RevalidateProfile, type ServerClientOptions, buildAccessTokenCookie, buildSessionCookie, buildSignoutCookie, buildSignoutCookies, exchangeCode, getAccessTokenFromCookieHeader, getServerClient, getSessionFromCookieHeader, handleOidcCallback, handleRedirectCallback, handleSessionRequest, refreshPage, revalidateAddOn, revalidateAddOns, revalidateBrand, revalidateBusiness, revalidateByTag, revalidateCategories, revalidateCategory, revalidateCollection, revalidateCollections, revalidateLocation, revalidateLocations, revalidatePricing, revalidateProduct, revalidateProducts, revalidateStock, revalidateSubscription, revalidateSubscriptions, tags, updateAddOn, updateAddOns, updateBrand, updateBusiness, updateByTag, updateCategories, updateCategory, updateCollection, updateCollections, updateLocation, updateLocations, updatePricing, updateProduct, updateProducts, updateStock, updateSubscription, updateSubscriptions, verifyIdToken };

package/dist/server.js

@@ -1,5 +1,6 @@
 'use strict';
 
+var chunkDKT62WQW_js = require('./chunk-DKT62WQW.js');
 var chunkMW7ICTVK_js = require('./chunk-MW7ICTVK.js');
 require('./chunk-JGBDWEPJ.js');
 require('./chunk-7Y2O3E4D.js');
@@ -237,13 +238,17 @@ async function refreshPage() {
   const fn = await getRefresh();
   fn();
 }
-var DEFAULT_AUTH_URL = "https://auth.cimplify.io";
 var SESSION_COOKIE = "cimplify_session";
 var ACCESS_TOKEN_COOKIE = "cimplify_access";
+var HEADER_LOCATION = "Location";
+var PARAM_CODE = "code";
+var PARAM_STATE = "state";
+var PARAM_ERROR = "error";
+var QUERY_AUTH_ERROR = "cimplify_auth_error";
 var discoveryCache = /* @__PURE__ */ new Map();
 var jwksCache = /* @__PURE__ */ new Map();
-function authUrl(cfg) {
-  return (cfg.authUrl ?? DEFAULT_AUTH_URL).replace(/\/$/, "");
+function issuerBase(cfg) {
+  return (cfg.issuer ?? cfg.authUrl ?? chunkDKT62WQW_js.DEFAULT_ISSUER).replace(/\/$/, "");
 }
 function cookieName(cfg) {
   return cfg.cookieName ?? SESSION_COOKIE;
@@ -252,7 +257,7 @@ function accessTokenCookieName(cfg) {
   return cfg.accessTokenCookieName ?? ACCESS_TOKEN_COOKIE;
 }
 async function discovery(cfg) {
-  const base = authUrl(cfg);
+  const base = issuerBase(cfg);
   let p = discoveryCache.get(base);
   if (!p) {
     p = fetch(`${base}/.well-known/openid-configuration`, {
@@ -415,6 +420,56 @@ async function handleOidcCallback(req, opts) {
   headers.append("Set-Cookie", buildAccessTokenCookie(opts, tokens.accessToken, tokens.expiresIn));
   return new Response(JSON.stringify({ ok: true }), { status: 200, headers });
 }
+function readPkceCookie(cookieHeader) {
+  if (!cookieHeader) return null;
+  const match = cookieHeader.split(/;\s*/).find((p) => p.startsWith(`${chunkDKT62WQW_js.PKCE_COOKIE}=`));
+  if (!match) return null;
+  return chunkDKT62WQW_js.decodePkceState(match.slice(chunkDKT62WQW_js.PKCE_COOKIE.length + 1));
+}
+function buildPkceClearCookie() {
+  return `${chunkDKT62WQW_js.PKCE_COOKIE}=; Path=${chunkDKT62WQW_js.PKCE_COOKIE_PATH}; Max-Age=0; Secure; SameSite=Lax`;
+}
+function safeReturnPath(returnTo, fallback) {
+  if (returnTo && returnTo.startsWith("/") && !returnTo.startsWith("//")) return returnTo;
+  return fallback;
+}
+function withAuthError(path, reason) {
+  const sep = path.includes("?") ? "&" : "?";
+  return `${path}${sep}${QUERY_AUTH_ERROR}=${encodeURIComponent(reason)}`;
+}
+async function handleRedirectCallback(req, opts) {
+  const url = new URL(req.url);
+  const code = url.searchParams.get(PARAM_CODE);
+  const urlState = url.searchParams.get(PARAM_STATE);
+  const authError = url.searchParams.get(PARAM_ERROR);
+  const pkce = readPkceCookie(req.headers.get("cookie"));
+  const returnTo = safeReturnPath(pkce?.returnTo, opts.defaultReturnTo ?? "/");
+  const fail = (reason) => {
+    const headers2 = new Headers({ [HEADER_LOCATION]: withAuthError(returnTo, reason) });
+    headers2.append("Set-Cookie", buildPkceClearCookie());
+    return new Response(null, { status: 302, headers: headers2 });
+  };
+  if (authError) return fail(authError);
+  if (!code || !pkce) return fail("missing_code");
+  if (!urlState || urlState !== pkce.state) return fail("state_mismatch");
+  let tokens;
+  try {
+    tokens = await exchangeCode({ ...opts, code, codeVerifier: pkce.verifier });
+  } catch {
+    return fail("exchange_failed");
+  }
+  if (!tokens.idToken) return fail("missing_id_token");
+  try {
+    await verifyIdToken(opts, tokens.idToken);
+  } catch {
+    return fail("id_token_invalid");
+  }
+  const headers = new Headers({ [HEADER_LOCATION]: returnTo });
+  headers.append("Set-Cookie", buildSessionCookie(opts, tokens.idToken, tokens.expiresIn));
+  headers.append("Set-Cookie", buildAccessTokenCookie(opts, tokens.accessToken, tokens.expiresIn));
+  headers.append("Set-Cookie", buildPkceClearCookie());
+  return new Response(null, { status: 302, headers });
+}
 async function handleSessionRequest(req, cfg) {
   const session = await getSessionFromCookieHeader(cfg, req.headers.get("cookie"));
   if (!session) {
@@ -458,6 +513,7 @@ exports.getAccessTokenFromCookieHeader = getAccessTokenFromCookieHeader;
 exports.getServerClient = getServerClient;
 exports.getSessionFromCookieHeader = getSessionFromCookieHeader;
 exports.handleOidcCallback = handleOidcCallback;
+exports.handleRedirectCallback = handleRedirectCallback;
 exports.handleSessionRequest = handleSessionRequest;
 exports.refreshPage = refreshPage;
 exports.revalidateAddOn = revalidateAddOn;

package/dist/server.mjs

@@ -1,3 +1,4 @@
+import { PKCE_COOKIE, decodePkceState, PKCE_COOKIE_PATH, DEFAULT_ISSUER } from './chunk-XSOYJLMZ.mjs';
 import { createCimplifyClient } from './chunk-SQ7U3BWY.mjs';
 import './chunk-I4IXPQIX.mjs';
 import './chunk-TD3AY34U.mjs';
@@ -235,13 +236,17 @@ async function refreshPage() {
   const fn = await getRefresh();
   fn();
 }
-var DEFAULT_AUTH_URL = "https://auth.cimplify.io";
 var SESSION_COOKIE = "cimplify_session";
 var ACCESS_TOKEN_COOKIE = "cimplify_access";
+var HEADER_LOCATION = "Location";
+var PARAM_CODE = "code";
+var PARAM_STATE = "state";
+var PARAM_ERROR = "error";
+var QUERY_AUTH_ERROR = "cimplify_auth_error";
 var discoveryCache = /* @__PURE__ */ new Map();
 var jwksCache = /* @__PURE__ */ new Map();
-function authUrl(cfg) {
-  return (cfg.authUrl ?? DEFAULT_AUTH_URL).replace(/\/$/, "");
+function issuerBase(cfg) {
+  return (cfg.issuer ?? cfg.authUrl ?? DEFAULT_ISSUER).replace(/\/$/, "");
 }
 function cookieName(cfg) {
   return cfg.cookieName ?? SESSION_COOKIE;
@@ -250,7 +255,7 @@ function accessTokenCookieName(cfg) {
   return cfg.accessTokenCookieName ?? ACCESS_TOKEN_COOKIE;
 }
 async function discovery(cfg) {
-  const base = authUrl(cfg);
+  const base = issuerBase(cfg);
   let p = discoveryCache.get(base);
   if (!p) {
     p = fetch(`${base}/.well-known/openid-configuration`, {
@@ -413,6 +418,56 @@ async function handleOidcCallback(req, opts) {
   headers.append("Set-Cookie", buildAccessTokenCookie(opts, tokens.accessToken, tokens.expiresIn));
   return new Response(JSON.stringify({ ok: true }), { status: 200, headers });
 }
+function readPkceCookie(cookieHeader) {
+  if (!cookieHeader) return null;
+  const match = cookieHeader.split(/;\s*/).find((p) => p.startsWith(`${PKCE_COOKIE}=`));
+  if (!match) return null;
+  return decodePkceState(match.slice(PKCE_COOKIE.length + 1));
+}
+function buildPkceClearCookie() {
+  return `${PKCE_COOKIE}=; Path=${PKCE_COOKIE_PATH}; Max-Age=0; Secure; SameSite=Lax`;
+}
+function safeReturnPath(returnTo, fallback) {
+  if (returnTo && returnTo.startsWith("/") && !returnTo.startsWith("//")) return returnTo;
+  return fallback;
+}
+function withAuthError(path, reason) {
+  const sep = path.includes("?") ? "&" : "?";
+  return `${path}${sep}${QUERY_AUTH_ERROR}=${encodeURIComponent(reason)}`;
+}
+async function handleRedirectCallback(req, opts) {
+  const url = new URL(req.url);
+  const code = url.searchParams.get(PARAM_CODE);
+  const urlState = url.searchParams.get(PARAM_STATE);
+  const authError = url.searchParams.get(PARAM_ERROR);
+  const pkce = readPkceCookie(req.headers.get("cookie"));
+  const returnTo = safeReturnPath(pkce?.returnTo, opts.defaultReturnTo ?? "/");
+  const fail = (reason) => {
+    const headers2 = new Headers({ [HEADER_LOCATION]: withAuthError(returnTo, reason) });
+    headers2.append("Set-Cookie", buildPkceClearCookie());
+    return new Response(null, { status: 302, headers: headers2 });
+  };
+  if (authError) return fail(authError);
+  if (!code || !pkce) return fail("missing_code");
+  if (!urlState || urlState !== pkce.state) return fail("state_mismatch");
+  let tokens;
+  try {
+    tokens = await exchangeCode({ ...opts, code, codeVerifier: pkce.verifier });
+  } catch {
+    return fail("exchange_failed");
+  }
+  if (!tokens.idToken) return fail("missing_id_token");
+  try {
+    await verifyIdToken(opts, tokens.idToken);
+  } catch {
+    return fail("id_token_invalid");
+  }
+  const headers = new Headers({ [HEADER_LOCATION]: returnTo });
+  headers.append("Set-Cookie", buildSessionCookie(opts, tokens.idToken, tokens.expiresIn));
+  headers.append("Set-Cookie", buildAccessTokenCookie(opts, tokens.accessToken, tokens.expiresIn));
+  headers.append("Set-Cookie", buildPkceClearCookie());
+  return new Response(null, { status: 302, headers });
+}
 async function handleSessionRequest(req, cfg) {
   const session = await getSessionFromCookieHeader(cfg, req.headers.get("cookie"));
   if (!session) {
@@ -441,4 +496,4 @@ async function getSessionFromCookieHeader(cfg, cookieHeader) {
   }
 }
 
-export { CACHE_LIFE_DEFAULT, CACHE_LIFE_PROBE, buildAccessTokenCookie, buildSessionCookie, buildSignoutCookie, buildSignoutCookies, exchangeCode, getAccessTokenFromCookieHeader, getServerClient, getSessionFromCookieHeader, handleOidcCallback, handleSessionRequest, refreshPage, revalidateAddOn, revalidateAddOns, revalidateBrand, revalidateBusiness, revalidateByTag, revalidateCategories, revalidateCategory, revalidateCollection, revalidateCollections, revalidateLocation, revalidateLocations, revalidatePricing, revalidateProduct, revalidateProducts, revalidateStock, revalidateSubscription, revalidateSubscriptions, tags, updateAddOn, updateAddOns, updateBrand, updateBusiness, updateByTag, updateCategories, updateCategory, updateCollection, updateCollections, updateLocation, updateLocations, updatePricing, updateProduct, updateProducts, updateStock, updateSubscription, updateSubscriptions, verifyIdToken };
+export { CACHE_LIFE_DEFAULT, CACHE_LIFE_PROBE, buildAccessTokenCookie, buildSessionCookie, buildSignoutCookie, buildSignoutCookies, exchangeCode, getAccessTokenFromCookieHeader, getServerClient, getSessionFromCookieHeader, handleOidcCallback, handleRedirectCallback, handleSessionRequest, refreshPage, revalidateAddOn, revalidateAddOns, revalidateBrand, revalidateBusiness, revalidateByTag, revalidateCategories, revalidateCategory, revalidateCollection, revalidateCollections, revalidateLocation, revalidateLocations, revalidatePricing, revalidateProduct, revalidateProducts, revalidateStock, revalidateSubscription, revalidateSubscriptions, tags, updateAddOn, updateAddOns, updateBrand, updateBusiness, updateByTag, updateCategories, updateCategory, updateCollection, updateCollections, updateLocation, updateLocations, updatePricing, updateProduct, updateProducts, updateStock, updateSubscription, updateSubscriptions, verifyIdToken };

package/dist/{sign-in-TL01-awQ.d.mts → sign-in-dr7m09nm.d.mts}

@@ -30,9 +30,22 @@ interface SignInOptions {
     redirectUri: string;
     callbackUri?: string;
     scope?: string;
+    /** OIDC issuer. The authorize host is resolved from its discovery document.
+     *  Defaults to https://api.cimplify.io. */
+    issuer?: string;
+    /** @deprecated Pass `issuer`. If set, used directly as the authorize host. */
     authUrl?: string;
     loginHint?: string;
     prompt?: "none" | "login" | "consent";
+    /**
+     * "redirect" (default) navigates the top-level window to the IdP and back —
+     * works in every browser, on any domain, because the IdP is first-party
+     * during the hop. "modal" opens an iframe and only works where third-party
+     * cookies are allowed (Chrome today; not Safari/Firefox).
+     */
+    mode?: "redirect" | "modal";
+    /** Where to land after a successful redirect sign-in. Defaults to the current path. */
+    returnTo?: string;
     onError?: (err: {
         error: string;
         description?: string;

package/dist/{sign-in-TL01-awQ.d.ts → sign-in-dr7m09nm.d.ts}

@@ -30,9 +30,22 @@ interface SignInOptions {
     redirectUri: string;
     callbackUri?: string;
     scope?: string;
+    /** OIDC issuer. The authorize host is resolved from its discovery document.
+     *  Defaults to https://api.cimplify.io. */
+    issuer?: string;
+    /** @deprecated Pass `issuer`. If set, used directly as the authorize host. */
     authUrl?: string;
     loginHint?: string;
     prompt?: "none" | "login" | "consent";
+    /**
+     * "redirect" (default) navigates the top-level window to the IdP and back —
+     * works in every browser, on any domain, because the IdP is first-party
+     * during the hop. "modal" opens an iframe and only works where third-party
+     * cookies are allowed (Chrome today; not Safari/Firefox).
+     */
+    mode?: "redirect" | "modal";
+    /** Where to land after a successful redirect sign-in. Defaults to the current path. */
+    returnTo?: string;
     onError?: (err: {
         error: string;
         description?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cimplify/sdk",
-  "version": "0.58.0",
+  "version": "0.60.0",
   "description": "Cimplify Commerce SDK for storefronts",
   "keywords": [
     "cimplify",