@cimplify/sdk 0.65.0 → 0.67.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (53) hide show
  1. package/dist/advanced.d.mts +1 -1
  2. package/dist/advanced.d.ts +1 -1
  3. package/dist/advanced.js +20 -20
  4. package/dist/advanced.mjs +1 -1
  5. package/dist/{chunk-AVQL3TSJ.js → chunk-3QSW33RG.js} +389 -78
  6. package/dist/chunk-E6T5VJMG.mjs +156 -0
  7. package/dist/{chunk-WDTFIIY6.mjs → chunk-FNK6UZOE.mjs} +2 -2
  8. package/dist/{chunk-3G4QCENX.mjs → chunk-FVGVJ4TC.mjs} +12 -50
  9. package/dist/chunk-IQLJJW2H.js +168 -0
  10. package/dist/{chunk-PKYZBKZD.mjs → chunk-JAPCAZN4.mjs} +10 -29
  11. package/dist/{chunk-R6363CC7.mjs → chunk-QQMDEGAK.mjs} +382 -79
  12. package/dist/{chunk-VKID3QUE.js → chunk-SH6HJW4A.js} +4 -4
  13. package/dist/{chunk-VAMZPBA4.js → chunk-SSLFZPAI.js} +44 -63
  14. package/dist/{chunk-HCZTBWU4.js → chunk-SXGFJEME.js} +12 -50
  15. package/dist/{client-BS5lNWWH.d.mts → client-ByI_3jfL.d.mts} +33 -20
  16. package/dist/{client-p1Iofyc9.d.ts → client-CQlEWH5j.d.ts} +1 -1
  17. package/dist/{client-QTrsv6Gu.d.ts → client-DVFQoDtI.d.ts} +33 -20
  18. package/dist/{client-XoswXzib.d.mts → client-Dd82KQ_G.d.mts} +1 -1
  19. package/dist/index.d.mts +2 -2
  20. package/dist/index.d.ts +2 -2
  21. package/dist/index.js +80 -81
  22. package/dist/index.mjs +4 -5
  23. package/dist/mock/cli.mjs +12 -50
  24. package/dist/mock/library.js +12 -50
  25. package/dist/mock/library.mjs +12 -50
  26. package/dist/mock/msw.js +12 -50
  27. package/dist/mock/msw.mjs +12 -50
  28. package/dist/react.d.mts +4 -7
  29. package/dist/react.d.ts +4 -7
  30. package/dist/react.js +63 -71
  31. package/dist/react.mjs +5 -13
  32. package/dist/server.d.mts +18 -3
  33. package/dist/server.d.ts +18 -3
  34. package/dist/server.js +175 -29
  35. package/dist/server.mjs +167 -25
  36. package/dist/{sign-in-dr7m09nm.d.ts → sign-in-RFuWZOgF.d.mts} +6 -1
  37. package/dist/{sign-in-dr7m09nm.d.mts → sign-in-RFuWZOgF.d.ts} +6 -1
  38. package/dist/styles.css +1 -1
  39. package/dist/testing/msw.js +2 -2
  40. package/dist/testing/msw.mjs +1 -1
  41. package/dist/testing/suite.d.mts +2 -2
  42. package/dist/testing/suite.d.ts +2 -2
  43. package/dist/testing/suite.js +23 -23
  44. package/dist/testing/suite.mjs +4 -4
  45. package/dist/testing.d.mts +2 -2
  46. package/dist/testing.d.ts +2 -2
  47. package/dist/testing.js +79 -79
  48. package/dist/testing.mjs +5 -5
  49. package/package.json +1 -1
  50. package/dist/chunk-2AU263DK.mjs +0 -323
  51. package/dist/chunk-6DMHVQ42.js +0 -338
  52. package/dist/chunk-DKT62WQW.js +0 -53
  53. package/dist/chunk-XSOYJLMZ.mjs +0 -45
@@ -1756,8 +1756,20 @@ var LinkService = class {
1756
1756
  }
1757
1757
  async verifyOtp(input, opts) {
1758
1758
  const idempotencyKey = opts?.idempotencyKey ?? generateIdempotencyKey();
1759
+ const { business_id: _ignoredBusinessId, ...body } = input;
1759
1760
  const result = await safe(
1760
- this.client.linkPost("/v1/link/auth/verify-otp", input, { idempotencyKey })
1761
+ this.client.linkPost("/v1/link/auth/verify-otp", body, { idempotencyKey })
1762
+ );
1763
+ if (result.ok && result.value.session_token) {
1764
+ this.client.setAccessToken(result.value.session_token);
1765
+ }
1766
+ return result;
1767
+ }
1768
+ async refreshSession(sessionToken, opts) {
1769
+ const idempotencyKey = opts?.idempotencyKey ?? generateIdempotencyKey();
1770
+ const body = sessionToken ? { session_token: sessionToken } : {};
1771
+ const result = await safe(
1772
+ this.client.linkPost("/v1/link/auth/refresh", body, { idempotencyKey })
1761
1773
  );
1762
1774
  if (result.ok && result.value.session_token) {
1763
1775
  this.client.setAccessToken(result.value.session_token);
@@ -2239,20 +2251,19 @@ var MESSAGE_TYPES = {
2239
2251
  SET_TOKEN: "set_token",
2240
2252
  SET_CART: "set_cart",
2241
2253
  GET_DATA: "get_data",
2254
+ NAVIGATE: "navigate",
2242
2255
  REFRESH_TOKEN: "refresh_token",
2243
2256
  LOGOUT: "logout",
2244
2257
  PROCESS_CHECKOUT: "process_checkout",
2245
2258
  ABORT_CHECKOUT: "abort_checkout",
2246
2259
  READY: "ready",
2247
2260
  HEIGHT_CHANGE: "height_change",
2248
- AUTHENTICATED: "authenticated",
2249
- REQUIRES_OTP: "requires_otp",
2250
2261
  ERROR: "error",
2251
2262
  ADDRESS_CHANGED: "address_changed",
2252
2263
  ADDRESS_SELECTED: "address_selected",
2253
2264
  PAYMENT_METHOD_SELECTED: "payment_method_selected",
2254
- TOKEN_REFRESHED: "token_refreshed",
2255
2265
  LOGOUT_COMPLETE: "logout_complete",
2266
+ AUTH_REQUESTED: "auth_requested",
2256
2267
  CONTACT_PROVIDED: "contact_provided",
2257
2268
  CHECKOUT_STATUS: "checkout_status",
2258
2269
  CHECKOUT_COMPLETE: "checkout_complete",
@@ -2262,7 +2273,6 @@ var MESSAGE_TYPES = {
2262
2273
  var EVENT_TYPES = {
2263
2274
  READY: "ready",
2264
2275
  AUTHENTICATED: "authenticated",
2265
- REQUIRES_OTP: "requires_otp",
2266
2276
  ERROR: "error",
2267
2277
  CHANGE: "change",
2268
2278
  BLUR: "blur",
@@ -2271,6 +2281,227 @@ var EVENT_TYPES = {
2271
2281
  REQUEST_SUBMIT: "request_submit"
2272
2282
  };
2273
2283
 
2284
+ // src/internal/pkce.ts
2285
+ var VERIFIER_BYTES = 64;
2286
+ async function generatePkce() {
2287
+ const random = new Uint8Array(VERIFIER_BYTES);
2288
+ crypto.getRandomValues(random);
2289
+ const verifier = base64UrlEncode(random);
2290
+ const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
2291
+ const challenge = base64UrlEncode(new Uint8Array(digest));
2292
+ return { verifier, challenge, method: "S256" };
2293
+ }
2294
+ function generateState(byteLength = 16) {
2295
+ const buf = new Uint8Array(byteLength);
2296
+ crypto.getRandomValues(buf);
2297
+ return base64UrlEncode(buf);
2298
+ }
2299
+ function base64UrlEncode(bytes) {
2300
+ let str = "";
2301
+ for (const byte of bytes) str += String.fromCharCode(byte);
2302
+ return btoa(str).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
2303
+ }
2304
+
2305
+ // src/internal/pkce-cookie.ts
2306
+ var PKCE_COOKIE = "cimplify_pkce";
2307
+ var PKCE_COOKIE_PATH = "/auth";
2308
+ var PKCE_COOKIE_MAX_AGE_SECONDS = 600;
2309
+ function encodePkceState(state) {
2310
+ return encodeURIComponent(JSON.stringify(state));
2311
+ }
2312
+ function decodePkceState(raw) {
2313
+ try {
2314
+ const parsed = JSON.parse(decodeURIComponent(raw));
2315
+ if (typeof parsed?.verifier === "string" && typeof parsed.state === "string" && typeof parsed.returnTo === "string") {
2316
+ return { verifier: parsed.verifier, state: parsed.state, returnTo: parsed.returnTo };
2317
+ }
2318
+ } catch {
2319
+ }
2320
+ return null;
2321
+ }
2322
+
2323
+ // src/internal/discovery.ts
2324
+ var DEFAULT_ISSUER = "https://api.cimplify.io";
2325
+ var DEFAULT_AUTHORIZATION_ENDPOINT = "https://auth.cimplify.io/oauth/authorize";
2326
+ function fallbackAuthorizationEndpoint(issuerBase) {
2327
+ if (issuerBase === DEFAULT_ISSUER) return DEFAULT_AUTHORIZATION_ENDPOINT;
2328
+ throw new Error(
2329
+ `OIDC discovery for "${issuerBase}" is unreachable and no fallback authorize endpoint is known for it. Make discovery reachable (enable CORS) or pass authUrl.`
2330
+ );
2331
+ }
2332
+ var cache = /* @__PURE__ */ new Map();
2333
+ function fetchDiscovery(issuer) {
2334
+ const base = issuer.replace(/\/$/, "");
2335
+ let pending = cache.get(base);
2336
+ if (!pending) {
2337
+ pending = fetch(`${base}/.well-known/openid-configuration`).then((res) => {
2338
+ if (!res.ok) throw new Error(`oidc discovery failed: ${res.status}`);
2339
+ return res.json();
2340
+ });
2341
+ pending.catch(() => cache.delete(base));
2342
+ cache.set(base, pending);
2343
+ }
2344
+ return pending;
2345
+ }
2346
+ async function getAuthorizationEndpoint(issuer) {
2347
+ const base = issuer.replace(/\/$/, "");
2348
+ try {
2349
+ const doc = await fetchDiscovery(base);
2350
+ if (doc.authorization_endpoint) return doc.authorization_endpoint;
2351
+ } catch {
2352
+ }
2353
+ return fallbackAuthorizationEndpoint(base);
2354
+ }
2355
+
2356
+ // src/internal/modal-iframe.ts
2357
+ function openModalIframe(opts) {
2358
+ const overlay = document.createElement("div");
2359
+ overlay.dataset.cimplifyModal = "1";
2360
+ Object.assign(overlay.style, {
2361
+ position: "fixed",
2362
+ inset: "0",
2363
+ background: "rgba(15, 18, 24, 0.55)",
2364
+ zIndex: "2147483647",
2365
+ display: "grid",
2366
+ placeItems: "center",
2367
+ backdropFilter: "blur(2px)"
2368
+ });
2369
+ const card = document.createElement("div");
2370
+ Object.assign(card.style, {
2371
+ width: `${opts.width ?? 480}px`,
2372
+ maxWidth: "calc(100vw - 24px)",
2373
+ height: `${opts.height ?? 720}px`,
2374
+ maxHeight: "calc(100vh - 32px)"
2375
+ });
2376
+ const iframe = document.createElement("iframe");
2377
+ iframe.src = opts.src;
2378
+ iframe.style.width = "100%";
2379
+ iframe.style.height = "100%";
2380
+ iframe.style.border = "none";
2381
+ iframe.style.background = "transparent";
2382
+ iframe.setAttribute(
2383
+ "sandbox",
2384
+ opts.sandbox ?? "allow-scripts allow-same-origin allow-forms allow-popups"
2385
+ );
2386
+ iframe.setAttribute("allow", "publickey-credentials-get; publickey-credentials-create");
2387
+ card.appendChild(iframe);
2388
+ overlay.appendChild(card);
2389
+ document.body.appendChild(overlay);
2390
+ const close = () => {
2391
+ overlay.remove();
2392
+ document.removeEventListener("keydown", onKey);
2393
+ opts.onClose?.();
2394
+ };
2395
+ const onKey = (e) => {
2396
+ if (e.key === "Escape") close();
2397
+ };
2398
+ overlay.addEventListener("click", (e) => {
2399
+ if (e.target === overlay) close();
2400
+ });
2401
+ document.addEventListener("keydown", onKey);
2402
+ return { iframe, close };
2403
+ }
2404
+
2405
+ // src/sign-in.ts
2406
+ var DEFAULT_SCOPE = "openid email phone profile";
2407
+ function resolveAuthorizeEndpoint(opts) {
2408
+ if (opts.authUrl) {
2409
+ return Promise.resolve(`${opts.authUrl.replace(/\/$/, "")}/oauth/authorize`);
2410
+ }
2411
+ return getAuthorizationEndpoint(opts.issuer ?? DEFAULT_ISSUER);
2412
+ }
2413
+ async function startSignIn(opts) {
2414
+ const callbackUri = opts.callbackUri ?? "/auth/callback";
2415
+ const pkce = await generatePkce();
2416
+ const state = generateState();
2417
+ const authorizeEndpoint = await resolveAuthorizeEndpoint(opts);
2418
+ if ((opts.mode ?? "redirect") === "redirect") {
2419
+ startRedirectSignIn(opts, authorizeEndpoint, pkce, state);
2420
+ return;
2421
+ }
2422
+ const params = new URLSearchParams({
2423
+ response_type: "code",
2424
+ response_mode: "web_message",
2425
+ client_id: opts.clientId,
2426
+ redirect_uri: opts.redirectUri,
2427
+ scope: opts.scope ?? DEFAULT_SCOPE,
2428
+ state,
2429
+ code_challenge: pkce.challenge,
2430
+ code_challenge_method: pkce.method
2431
+ });
2432
+ if (opts.loginHint) params.set("login_hint", opts.loginHint);
2433
+ if (opts.prompt) params.set("prompt", opts.prompt);
2434
+ const src = `${authorizeEndpoint}?${params.toString()}`;
2435
+ const expectedOrigin = new URL(authorizeEndpoint).origin;
2436
+ const modal = openModalIframe({
2437
+ src,
2438
+ onClose: () => {
2439
+ window.removeEventListener("message", handler);
2440
+ }
2441
+ });
2442
+ const handler = async (event) => {
2443
+ if (event.origin !== expectedOrigin) return;
2444
+ const data = event.data;
2445
+ if (!data || typeof data !== "object" || data.type !== "authorization_response") return;
2446
+ const response = data.response;
2447
+ if (response.error) {
2448
+ modal.close();
2449
+ opts.onError?.({ error: response.error, description: response.error_description });
2450
+ return;
2451
+ }
2452
+ if (!response.code) return;
2453
+ if (response.state !== state) {
2454
+ modal.close();
2455
+ opts.onError?.({ error: "state_mismatch" });
2456
+ return;
2457
+ }
2458
+ try {
2459
+ const res = await fetch(callbackUri, {
2460
+ method: "POST",
2461
+ credentials: "include",
2462
+ headers: { "Content-Type": "application/json" },
2463
+ body: JSON.stringify({ code: response.code, codeVerifier: pkce.verifier, state })
2464
+ });
2465
+ if (!res.ok) {
2466
+ const body = await res.text().catch(() => "");
2467
+ opts.onError?.({ error: "callback_failed", description: body });
2468
+ modal.close();
2469
+ return;
2470
+ }
2471
+ const payload = await res.json().catch(() => ({}));
2472
+ modal.close();
2473
+ opts.onSuccess?.({
2474
+ accessToken: payload.accessToken ?? payload.access_token,
2475
+ expiresIn: payload.expiresIn ?? payload.expires_in,
2476
+ scope: payload.scope
2477
+ });
2478
+ } catch (e) {
2479
+ opts.onError?.({ error: "callback_exception", description: String(e) });
2480
+ modal.close();
2481
+ }
2482
+ };
2483
+ window.addEventListener("message", handler);
2484
+ }
2485
+ function startRedirectSignIn(opts, authorizeEndpoint, pkce, state) {
2486
+ const returnTo = opts.returnTo ?? window.location.pathname + window.location.search;
2487
+ const cookieValue = encodePkceState({ verifier: pkce.verifier, state, returnTo });
2488
+ const secure = window.location.protocol === "https:" ? "; Secure" : "";
2489
+ document.cookie = `${PKCE_COOKIE}=${cookieValue}; Path=${PKCE_COOKIE_PATH}; Max-Age=${PKCE_COOKIE_MAX_AGE_SECONDS}; SameSite=Lax${secure}`;
2490
+ const params = new URLSearchParams({
2491
+ response_type: "code",
2492
+ response_mode: "query",
2493
+ client_id: opts.clientId,
2494
+ redirect_uri: opts.redirectUri,
2495
+ scope: opts.scope ?? DEFAULT_SCOPE,
2496
+ state,
2497
+ code_challenge: pkce.challenge,
2498
+ code_challenge_method: pkce.method
2499
+ });
2500
+ if (opts.loginHint) params.set("login_hint", opts.loginHint);
2501
+ if (opts.prompt) params.set("prompt", opts.prompt);
2502
+ window.location.assign(`${authorizeEndpoint}?${params.toString()}`);
2503
+ }
2504
+
2274
2505
  // src/elements.ts
2275
2506
  function toCheckoutError(code, message, recoverable) {
2276
2507
  const hint = getErrorHint(code);
@@ -2292,6 +2523,27 @@ function generateNonce() {
2292
2523
  }
2293
2524
  return Math.random().toString(36).slice(2) + Math.random().toString(36).slice(2);
2294
2525
  }
2526
+ function readPublicEnv(name) {
2527
+ try {
2528
+ const processLike = globalThis.process;
2529
+ const value = processLike?.env?.[name];
2530
+ return value && value.trim() ? value : void 0;
2531
+ } catch {
2532
+ return void 0;
2533
+ }
2534
+ }
2535
+ function decodeJwtSub(token) {
2536
+ const [, payload] = token.split(".");
2537
+ if (!payload || typeof atob === "undefined") return "";
2538
+ try {
2539
+ const base64 = payload.replace(/-/g, "+").replace(/_/g, "/");
2540
+ const padded = base64.padEnd(base64.length + (4 - base64.length % 4) % 4, "=");
2541
+ const parsed = JSON.parse(atob(padded));
2542
+ return typeof parsed.sub === "string" ? parsed.sub : "";
2543
+ } catch {
2544
+ return "";
2545
+ }
2546
+ }
2295
2547
  function isAllowedOrigin(origin) {
2296
2548
  try {
2297
2549
  const url = new URL(origin);
@@ -2307,7 +2559,21 @@ function isAllowedOrigin(origin) {
2307
2559
  return false;
2308
2560
  }
2309
2561
  }
2310
- var KNOWN_IFRAME_TYPES = new Set(Object.values(MESSAGE_TYPES));
2562
+ var KNOWN_IFRAME_TYPES = /* @__PURE__ */ new Set([
2563
+ MESSAGE_TYPES.READY,
2564
+ MESSAGE_TYPES.HEIGHT_CHANGE,
2565
+ MESSAGE_TYPES.AUTH_REQUESTED,
2566
+ MESSAGE_TYPES.ERROR,
2567
+ MESSAGE_TYPES.ADDRESS_CHANGED,
2568
+ MESSAGE_TYPES.ADDRESS_SELECTED,
2569
+ MESSAGE_TYPES.PAYMENT_METHOD_SELECTED,
2570
+ MESSAGE_TYPES.CONTACT_PROVIDED,
2571
+ MESSAGE_TYPES.LOGOUT_COMPLETE,
2572
+ MESSAGE_TYPES.CHECKOUT_STATUS,
2573
+ MESSAGE_TYPES.CHECKOUT_COMPLETE,
2574
+ MESSAGE_TYPES.ORDER_TYPE_CHANGED,
2575
+ MESSAGE_TYPES.REQUEST_SUBMIT
2576
+ ]);
2311
2577
  function parseIframeMessage(data) {
2312
2578
  if (!data || typeof data !== "object") {
2313
2579
  return null;
@@ -2317,11 +2583,7 @@ function parseIframeMessage(data) {
2317
2583
  return null;
2318
2584
  }
2319
2585
  switch (record.type) {
2320
- case MESSAGE_TYPES.AUTHENTICATED:
2321
- if (typeof record.token !== "string") return null;
2322
- break;
2323
- case MESSAGE_TYPES.TOKEN_REFRESHED:
2324
- if (typeof record.token !== "string") return null;
2586
+ case MESSAGE_TYPES.AUTH_REQUESTED:
2325
2587
  break;
2326
2588
  case MESSAGE_TYPES.ADDRESS_CHANGED:
2327
2589
  case MESSAGE_TYPES.ADDRESS_SELECTED:
@@ -2339,13 +2601,13 @@ function parseIframeMessage(data) {
2339
2601
  case MESSAGE_TYPES.CHECKOUT_COMPLETE:
2340
2602
  if (typeof record.success !== "boolean") return null;
2341
2603
  break;
2604
+ case MESSAGE_TYPES.CHECKOUT_STATUS:
2605
+ if (typeof record.status !== "string" || !record.context || typeof record.context !== "object") return null;
2606
+ break;
2342
2607
  case MESSAGE_TYPES.READY:
2343
2608
  case MESSAGE_TYPES.HEIGHT_CHANGE:
2344
2609
  if (typeof record.height !== "number") return null;
2345
2610
  break;
2346
- case MESSAGE_TYPES.REQUIRES_OTP:
2347
- if (typeof record.contactMasked !== "string") return null;
2348
- break;
2349
2611
  case MESSAGE_TYPES.ORDER_TYPE_CHANGED:
2350
2612
  if (typeof record.orderType !== "string") return null;
2351
2613
  break;
@@ -2362,6 +2624,7 @@ var CimplifyElements = class {
2362
2624
  this.addressData = null;
2363
2625
  this.paymentData = null;
2364
2626
  this.checkoutInProgress = false;
2627
+ this.authInProgress = false;
2365
2628
  this.activeCheckoutAbort = null;
2366
2629
  this.businessIdResolvePromise = null;
2367
2630
  this.client = client;
@@ -2520,7 +2783,6 @@ var CimplifyElements = class {
2520
2783
  customer_id: this.customerId ?? void 0
2521
2784
  };
2522
2785
  const timeoutMs = options.timeout_ms ?? 18e4;
2523
- const paymentWindow = checkoutElement.getContentWindow();
2524
2786
  return new Promise((resolve) => {
2525
2787
  let settled = false;
2526
2788
  const cleanup = () => {
@@ -2556,18 +2818,7 @@ var CimplifyElements = class {
2556
2818
  if (!message) {
2557
2819
  return;
2558
2820
  }
2559
- if (message.type === MESSAGE_TYPES.LOGOUT_COMPLETE) {
2560
- checkoutElement.sendMessage({ type: MESSAGE_TYPES.ABORT_CHECKOUT });
2561
- settle(
2562
- toCheckoutError(
2563
- "AUTH_LOST",
2564
- "Authentication was cleared during checkout.",
2565
- true
2566
- )
2567
- );
2568
- return;
2569
- }
2570
- if (paymentWindow && event.source && event.source !== paymentWindow) {
2821
+ if (!checkoutElement._acceptsMessageEvent(event, message)) {
2571
2822
  return;
2572
2823
  }
2573
2824
  if (message.type === MESSAGE_TYPES.CHECKOUT_STATUS) {
@@ -2583,6 +2834,16 @@ var CimplifyElements = class {
2583
2834
  enrolled_in_link: message.enrolled_in_link
2584
2835
  });
2585
2836
  }
2837
+ if (message.type === MESSAGE_TYPES.LOGOUT_COMPLETE) {
2838
+ checkoutElement.sendMessage({ type: MESSAGE_TYPES.ABORT_CHECKOUT });
2839
+ settle(
2840
+ toCheckoutError(
2841
+ "AUTH_LOST",
2842
+ "Authentication was cleared during checkout.",
2843
+ true
2844
+ )
2845
+ );
2846
+ }
2586
2847
  };
2587
2848
  if (typeof window !== "undefined") {
2588
2849
  window.addEventListener("message", handleCheckoutMessage);
@@ -2642,12 +2903,7 @@ var CimplifyElements = class {
2642
2903
  return this.options.appearance;
2643
2904
  }
2644
2905
  async hydrateCustomerData() {
2645
- if (!this.accessToken || this.customerData) {
2646
- return;
2647
- }
2648
- if (!this.client.getAccessToken()) {
2649
- this.client.setAccessToken(this.accessToken);
2650
- }
2906
+ if (!this.accessToken || this.customerData) return;
2651
2907
  const linkDataResult = await this.client.link.getLinkData();
2652
2908
  if (!linkDataResult.ok || !linkDataResult.value?.customer) {
2653
2909
  return;
@@ -2658,6 +2914,81 @@ var CimplifyElements = class {
2658
2914
  email: customer.email || null,
2659
2915
  phone: customer.phone || null
2660
2916
  };
2917
+ this.customerId = customer.id;
2918
+ }
2919
+ sourceElementFor(event, message) {
2920
+ for (const element of this.elements.values()) {
2921
+ if (element._acceptsMessageEvent(event, message)) {
2922
+ return element;
2923
+ }
2924
+ }
2925
+ return null;
2926
+ }
2927
+ async applyAccessToken(token) {
2928
+ this.accessToken = token;
2929
+ this.accountId = decodeJwtSub(token);
2930
+ this.client.setAccessToken(token);
2931
+ await this.hydrateCustomerData();
2932
+ return {
2933
+ accountId: this.accountId ?? "",
2934
+ customerId: this.customerId ?? "",
2935
+ token,
2936
+ customer: this.customerData ?? { name: "", email: null, phone: null }
2937
+ };
2938
+ }
2939
+ broadcastAccessToken(token) {
2940
+ this.elements.forEach((element) => {
2941
+ element.sendMessage({ type: MESSAGE_TYPES.SET_TOKEN, token });
2942
+ });
2943
+ }
2944
+ startEmbeddedAuth(sourceElement) {
2945
+ if (this.authInProgress) return;
2946
+ const auth = this.options.auth ?? {};
2947
+ const clientId = auth.clientId ?? readPublicEnv("NEXT_PUBLIC_CIMPLIFY_CLIENT_ID");
2948
+ const redirectUri = auth.redirectUri ?? readPublicEnv("NEXT_PUBLIC_CIMPLIFY_REDIRECT_URI");
2949
+ if (!clientId || !redirectUri) {
2950
+ sourceElement._emitError({
2951
+ code: "AUTH_CONFIG_REQUIRED",
2952
+ message: "Cimplify OAuth clientId and redirectUri are required."
2953
+ });
2954
+ return;
2955
+ }
2956
+ this.authInProgress = true;
2957
+ void startSignIn({
2958
+ clientId,
2959
+ redirectUri,
2960
+ callbackUri: auth.callbackUri,
2961
+ scope: auth.scope,
2962
+ issuer: auth.issuer,
2963
+ authUrl: auth.authUrl,
2964
+ mode: "modal",
2965
+ onSuccess: async ({ accessToken }) => {
2966
+ this.authInProgress = false;
2967
+ if (!accessToken) {
2968
+ sourceElement._emitError({
2969
+ code: "AUTH_CALLBACK_MISSING_TOKEN",
2970
+ message: "Sign-in callback did not return an access token."
2971
+ });
2972
+ return;
2973
+ }
2974
+ const data = await this.applyAccessToken(accessToken);
2975
+ this.broadcastAccessToken(accessToken);
2976
+ sourceElement._emitAuthenticated(data);
2977
+ },
2978
+ onError: (err2) => {
2979
+ this.authInProgress = false;
2980
+ sourceElement._emitError({
2981
+ code: err2.error,
2982
+ message: err2.description ?? err2.error
2983
+ });
2984
+ }
2985
+ }).catch((error) => {
2986
+ this.authInProgress = false;
2987
+ sourceElement._emitError({
2988
+ code: "AUTH_START_FAILED",
2989
+ message: error instanceof Error ? error.message : "Unable to start sign-in."
2990
+ });
2991
+ });
2661
2992
  }
2662
2993
  handleMessage(event) {
2663
2994
  if (!isAllowedOrigin(event.origin)) {
@@ -2665,26 +2996,11 @@ var CimplifyElements = class {
2665
2996
  }
2666
2997
  const message = parseIframeMessage(event.data);
2667
2998
  if (!message) return;
2999
+ const sourceElement = this.sourceElementFor(event, message);
3000
+ if (!sourceElement) return;
2668
3001
  switch (message.type) {
2669
- case MESSAGE_TYPES.AUTHENTICATED:
2670
- const customer = message.customer ?? {
2671
- name: "",
2672
- email: null,
2673
- phone: null
2674
- };
2675
- this.accessToken = message.token;
2676
- this.accountId = message.accountId;
2677
- this.customerId = message.customerId;
2678
- this.customerData = customer;
2679
- this.client.setAccessToken(message.token);
2680
- this.elements.forEach((element, type) => {
2681
- if (type !== ELEMENT_TYPES.AUTH && type !== ELEMENT_TYPES.CHECKOUT) {
2682
- element.sendMessage({ type: MESSAGE_TYPES.SET_TOKEN, token: message.token });
2683
- }
2684
- });
2685
- break;
2686
- case MESSAGE_TYPES.TOKEN_REFRESHED:
2687
- this.accessToken = message.token;
3002
+ case MESSAGE_TYPES.AUTH_REQUESTED:
3003
+ this.startEmbeddedAuth(sourceElement);
2688
3004
  break;
2689
3005
  case MESSAGE_TYPES.ADDRESS_CHANGED:
2690
3006
  case MESSAGE_TYPES.ADDRESS_SELECTED:
@@ -2854,6 +3170,17 @@ var CimplifyElement = class {
2854
3170
  isMounted() {
2855
3171
  return this.mounted && Boolean(this.iframe) && this.iframe?.isConnected === true;
2856
3172
  }
3173
+ _acceptsMessageEvent(event, message) {
3174
+ const iframeWindow = this.iframe?.contentWindow;
3175
+ if (!iframeWindow || event.source !== iframeWindow) return false;
3176
+ return message.nonce === this.nonce;
3177
+ }
3178
+ _emitAuthenticated(data) {
3179
+ this.emit(EVENT_TYPES.AUTHENTICATED, data);
3180
+ }
3181
+ _emitError(error) {
3182
+ this.emit(EVENT_TYPES.ERROR, error);
3183
+ }
2857
3184
  async createIframe() {
2858
3185
  if (!this.container) return;
2859
3186
  const resolvedBusinessId = this.businessId ?? await this.parent.resolveBusinessId();
@@ -2897,17 +3224,9 @@ var CimplifyElement = class {
2897
3224
  if (!isAllowedOrigin(event.origin)) {
2898
3225
  return;
2899
3226
  }
2900
- const data = event.data;
2901
- if (data?.nonce) {
2902
- if (data.nonce !== this.nonce) return;
2903
- } else {
2904
- const iframeWindow = this.iframe?.contentWindow;
2905
- if (iframeWindow && event.source && event.source !== iframeWindow) {
2906
- return;
2907
- }
2908
- }
2909
3227
  const message = parseIframeMessage(event.data);
2910
3228
  if (!message) return;
3229
+ if (!this._acceptsMessageEvent(event, message)) return;
2911
3230
  switch (message.type) {
2912
3231
  case MESSAGE_TYPES.READY:
2913
3232
  this.ready = true;
@@ -2926,7 +3245,7 @@ var CimplifyElement = class {
2926
3245
  submitLabel: this.options.submitLabel
2927
3246
  });
2928
3247
  const token = this.parent.getAccessToken();
2929
- if (token && this.type !== ELEMENT_TYPES.AUTH) {
3248
+ if (token) {
2930
3249
  this.sendMessage({ type: MESSAGE_TYPES.SET_TOKEN, token });
2931
3250
  }
2932
3251
  this.pendingInit = null;
@@ -2937,22 +3256,6 @@ var CimplifyElement = class {
2937
3256
  case MESSAGE_TYPES.HEIGHT_CHANGE:
2938
3257
  if (this.iframe) this.iframe.style.height = `${message.height}px`;
2939
3258
  break;
2940
- case MESSAGE_TYPES.AUTHENTICATED:
2941
- const customer = message.customer ?? {
2942
- name: "",
2943
- email: null,
2944
- phone: null
2945
- };
2946
- this.emit(EVENT_TYPES.AUTHENTICATED, {
2947
- accountId: message.accountId,
2948
- customerId: message.customerId,
2949
- token: message.token,
2950
- customer
2951
- });
2952
- break;
2953
- case MESSAGE_TYPES.REQUIRES_OTP:
2954
- this.emit(EVENT_TYPES.REQUIRES_OTP, { contactMasked: message.contactMasked });
2955
- break;
2956
3259
  case MESSAGE_TYPES.ERROR:
2957
3260
  this.emit(EVENT_TYPES.ERROR, { code: message.code, message: message.message });
2958
3261
  break;
@@ -2993,4 +3296,4 @@ function createElements(client, businessId, options) {
2993
3296
  return new CimplifyElements(client, businessId, options);
2994
3297
  }
2995
3298
 
2996
- export { AUTHORIZATION_TYPE, AUTH_MUTATION, AuthService, BusinessService, CHECKOUT_MODE, CHECKOUT_MUTATION, CHECKOUT_STEP, CONTACT_TYPE, CartOperations, CatalogueQueries, CheckoutService, CimplifyElement, CimplifyElements, DEFAULT_COUNTRY, DEFAULT_CURRENCY, DEVICE_TYPE, ELEMENT_TYPES, EVENT_TYPES, FxService, InventoryService, LINK_MUTATION, LINK_QUERY, LinkService, LiteService, MESSAGE_TYPES, MOBILE_MONEY_PROVIDER, ORDER_MUTATION, ORDER_TYPE, OrderQueries, PAYMENT_METHOD, PAYMENT_MUTATION, PAYMENT_STATE, PICKUP_TIME_TYPE, SchedulingService, combine, combineObject, createElements, err, flatMap, fromPromise, generateIdempotencyKey, getOrElse, isErr, isOk, mapError, mapResult, ok, safe, toNullable, tryCatch, unwrap };
3299
+ export { AUTHORIZATION_TYPE, AUTH_MUTATION, AuthService, BusinessService, CHECKOUT_MODE, CHECKOUT_MUTATION, CHECKOUT_STEP, CONTACT_TYPE, CartOperations, CatalogueQueries, CheckoutService, CimplifyElement, CimplifyElements, DEFAULT_COUNTRY, DEFAULT_CURRENCY, DEFAULT_ISSUER, DEVICE_TYPE, ELEMENT_TYPES, EVENT_TYPES, FxService, InventoryService, LINK_MUTATION, LINK_QUERY, LinkService, LiteService, MESSAGE_TYPES, MOBILE_MONEY_PROVIDER, ORDER_MUTATION, ORDER_TYPE, OrderQueries, PAYMENT_METHOD, PAYMENT_MUTATION, PAYMENT_STATE, PICKUP_TIME_TYPE, PKCE_COOKIE, PKCE_COOKIE_PATH, SchedulingService, combine, combineObject, createElements, decodePkceState, err, flatMap, fromPromise, generateIdempotencyKey, generatePkce, generateState, getAuthorizationEndpoint, getOrElse, isErr, isOk, mapError, mapResult, ok, safe, startSignIn, toNullable, tryCatch, unwrap };
@@ -1,7 +1,7 @@
1
1
  'use strict';
2
2
 
3
- var chunkHCZTBWU4_js = require('./chunk-HCZTBWU4.js');
4
- var chunkVAMZPBA4_js = require('./chunk-VAMZPBA4.js');
3
+ var chunkSXGFJEME_js = require('./chunk-SXGFJEME.js');
4
+ var chunkSSLFZPAI_js = require('./chunk-SSLFZPAI.js');
5
5
  var zod = require('zod');
6
6
 
7
7
  var cimplifyRegistry = zod.z.registry();
@@ -595,7 +595,7 @@ async function toForwardedRequest(input, init) {
595
595
  };
596
596
  }
597
597
  function createTestClient(options = {}) {
598
- const mock = chunkHCZTBWU4_js.createMockApp(options);
598
+ const mock = chunkSXGFJEME_js.createMockApp(options);
599
599
  let sessionToken;
600
600
  const fetchImpl = async (input, init) => {
601
601
  const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
@@ -614,7 +614,7 @@ function createTestClient(options = {}) {
614
614
  if (echoed) sessionToken = echoed;
615
615
  return res;
616
616
  };
617
- const client = chunkVAMZPBA4_js.createCimplifyClient({
617
+ const client = chunkSSLFZPAI_js.createCimplifyClient({
618
618
  baseUrl: TEST_BASE_URL,
619
619
  // Link mock lives at /v1/link on the same Hono app, so point the SDK's
620
620
  // separate Link transport at the same TEST_BASE_URL.