@curless/shopify-storefront 0.1.0

package/dist/__tests__/card-contract.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=card-contract.test.d.ts.map

package/dist/__tests__/card-contract.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"card-contract.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/card-contract.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/card-contract.test.js

@@ -0,0 +1,22 @@
+// Two places in the card have to agree with each other, and nothing in the type
+// system makes them. Both were found by a buyer, not by a test.
+import { readFileSync } from 'node:fs';
+import { describe, expect, test } from 'vitest';
+const CARD = readFileSync(new URL('../../widget/src/card.ts', import.meta.url), 'utf8');
+describe('the picker box every view must provide', () => {
+    // `optionsBox()` finds the box by id. The product view emitted class="opts"
+    // and a data attribute but NO id, so the lookup returned null, drawOptions
+    // returned on its second line, and a buyer who simply named a lens got a
+    // page with no prescriptions and no Buy. Nothing threw and nothing logged —
+    // the box was there, and empty.
+    test('every rendered `.opts` box carries id="opts"', () => {
+        const boxes = CARD.match(/<div class="opts"[^>]*>/g) ?? [];
+        expect(boxes.length, 'the card must still draw a picker box somewhere').toBeGreaterThan(0);
+        for (const box of boxes)
+            expect(box, box).toContain('id="opts"');
+    });
+    test('the lookup still goes by that id — if this changes, the assertion above must too', () => {
+        expect(CARD).toContain("document.getElementById('opts')");
+    });
+});
+//# sourceMappingURL=card-contract.test.js.map

package/dist/__tests__/card-contract.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"card-contract.test.js","sourceRoot":"","sources":["../../src/__tests__/card-contract.test.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,gEAAgE;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAEhD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;AAExF,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5E,gCAAgC;IAChC,IAAI,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,IAAI,EAAE,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,iDAAiD,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC3F,KAAK,MAAM,GAAG,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,kFAAkF,EAAE,GAAG,EAAE;QAC5F,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/catalog-registry.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=catalog-registry.test.d.ts.map

package/dist/__tests__/catalog-registry.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-registry.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/catalog-registry.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/catalog-registry.test.js

@@ -0,0 +1,109 @@
+import { describe, expect, test } from 'vitest';
+import { CatalogRegistry } from '../catalog-registry.js';
+// No shop is ever installed here: `resolveConfig` returning null is the honest
+// "not connected" state, and it keeps these tests about the REGISTRY rather
+// than about Shopify.
+const registry = (opts = {}) => {
+    let clock = 1_000_000;
+    const r = new CatalogRegistry(async () => null, {
+        refreshMs: 60_000,
+        now: () => clock,
+        ...opts,
+    });
+    const tick = (ms) => {
+        clock += ms;
+    };
+    return { r, tick };
+};
+describe('one catalogue per shop', () => {
+    test('the same shop gets the same instance, a different shop does not', () => {
+        const { r } = registry();
+        const a = r.for('a-shop.myshopify.com');
+        expect(r.for('a-shop.myshopify.com')).toBe(a);
+        expect(r.for('b-shop.myshopify.com')).not.toBe(a);
+        expect(r.size).toBe(2);
+    });
+    test('shop names differing only in case are one shop, not two', () => {
+        const { r } = registry();
+        expect(r.for('A-Shop.myshopify.com')).toBe(r.for('a-shop.myshopify.com'));
+        expect(r.size).toBe(1);
+    });
+});
+describe('a shop that leaves stops being polled', () => {
+    // The failure this prevents: an uninstalled merchant whose refresh timer
+    // keeps calling their Shopify with a token they revoked.
+    test('forget stops the catalogue and drops it', () => {
+        const { r } = registry();
+        const c = r.for('a-shop.myshopify.com');
+        let stopped = false;
+        const realStop = c.stop.bind(c);
+        c.stop = () => {
+            stopped = true;
+            realStop();
+        };
+        r.forget('a-shop.myshopify.com');
+        expect(stopped).toBe(true);
+        expect(r.size).toBe(0);
+    });
+    test('forgetting a shop that was never here is a no-op', () => {
+        const { r } = registry();
+        expect(() => r.forget('never.myshopify.com')).not.toThrow();
+        expect(r.size).toBe(0);
+    });
+    test('a shop asked for again after forget is built fresh', () => {
+        const { r } = registry();
+        const first = r.for('a-shop.myshopify.com');
+        r.forget('a-shop.myshopify.com');
+        expect(r.for('a-shop.myshopify.com')).not.toBe(first);
+    });
+});
+describe('memory does not grow without bound', () => {
+    test('an idle shop is swept, and its timer stopped with it', () => {
+        const { r, tick } = registry({ idleMs: 1000 });
+        const c = r.for('a-shop.myshopify.com');
+        let stopped = false;
+        c.stop = () => {
+            stopped = true;
+        };
+        tick(1001);
+        // The sweep runs on access, so touching another shop is what triggers it —
+        // a registry nobody uses should not wake up to notice it is idle.
+        r.for('b-shop.myshopify.com');
+        expect(stopped).toBe(true);
+        expect(r.size).toBe(1);
+    });
+    test('a shop still in use is not swept out from under its traffic', () => {
+        const { r, tick } = registry({ idleMs: 1000 });
+        const a = r.for('a-shop.myshopify.com');
+        tick(600);
+        expect(r.for('a-shop.myshopify.com')).toBe(a); // refreshes lastUsed
+        tick(600);
+        r.for('b-shop.myshopify.com');
+        expect(r.for('a-shop.myshopify.com')).toBe(a);
+    });
+    test('past the ceiling, the least recently used shop goes first', () => {
+        const { r, tick } = registry({ maxShops: 2 });
+        r.for('a-shop.myshopify.com');
+        tick(10);
+        const b = r.for('b-shop.myshopify.com');
+        tick(10);
+        r.for('c-shop.myshopify.com');
+        expect(r.size).toBe(2);
+        // a was the oldest, so a is gone — b survived and is still the same object.
+        expect(r.for('b-shop.myshopify.com')).toBe(b);
+    });
+});
+describe('shutdown', () => {
+    test('stopAll stops every resident catalogue', () => {
+        const { r } = registry();
+        const stopped = [];
+        for (const s of ['a', 'b', 'c']) {
+            const c = r.for(`${s}-shop.myshopify.com`);
+            c.stop = () => stopped.push(s);
+        }
+        r.stopAll();
+        expect(stopped.sort()).toEqual(['a', 'b', 'c']);
+        expect(r.size).toBe(0);
+    });
+});
+//# sourceMappingURL=catalog-registry.test.js.map

package/dist/__tests__/catalog-registry.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-registry.test.js","sourceRoot":"","sources":["../../src/__tests__/catalog-registry.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,+EAA+E;AAC/E,4EAA4E;AAC5E,sBAAsB;AACtB,MAAM,QAAQ,GAAG,CAAC,OAA+C,EAAE,EAAE,EAAE;IACrE,IAAI,KAAK,GAAG,SAAS,CAAC;IACtB,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE;QAC9C,SAAS,EAAE,MAAM;QACjB,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK;QAChB,GAAG,IAAI;KACR,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,EAAU,EAAQ,EAAE;QAChC,KAAK,IAAI,EAAE,CAAC;IACd,CAAC,CAAC;IACF,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;AACrB,CAAC,CAAC;AAEF,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,IAAI,CAAC,iEAAiE,EAAE,GAAG,EAAE;QAC3E,MAAM,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACnE,MAAM,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC1E,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,yEAAyE;IACzE,yDAAyD;IACzD,IAAI,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACnD,MAAM,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACxC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC,CAAC,IAAI,GAAG,GAAG,EAAE;YACZ,OAAO,GAAG,IAAI,CAAC;YACf,QAAQ,EAAE,CAAC;QACb,CAAC,CAAC;QACF,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACjC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC5D,MAAM,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC5D,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC9D,MAAM,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAC5C,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACjC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,IAAI,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAChE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACxC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,CAAC,CAAC,IAAI,GAAG,GAAG,EAAE;YACZ,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,CAAC;QACX,2EAA2E;QAC3E,kEAAkE;QAClE,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAC9B,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACvE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB;QACpE,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACrE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE,CAAC,CAAC;QACT,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACxC,IAAI,CAAC,EAAE,CAAC,CAAC;QACT,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,4EAA4E;QAC5E,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;IACxB,IAAI,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAClD,MAAM,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YAC3C,CAAC,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;QACD,CAAC,CAAC,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/challenge.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=challenge.test.d.ts.map

package/dist/__tests__/challenge.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/challenge.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/challenge.test.js

@@ -0,0 +1,46 @@
+// One token per ORIGIN, because that is how OpenAI issues them.
+//
+// Served from a single variable, verifying a SECOND hostname makes the first
+// start returning the second's token, and the app already verified there fails
+// its next re-check — with a symptom ("verification dropped") that points
+// nowhere near the change that caused it. A domain migration needs both hosts
+// verified at once, so this is the normal case, not the corner.
+import { describe, expect, test } from 'vitest';
+import { challengeFor, parseChallengeTokens } from '../challenge.js';
+const PER_HOST = 'mcp.moodylenses.com=NEWTOKEN,mcp.moodycosmetics.com=OLDTOKEN';
+describe('challengeFor', () => {
+    test('each host gets its own token', () => {
+        expect(challengeFor('mcp.moodylenses.com', PER_HOST, undefined)).toBe('NEWTOKEN');
+        expect(challengeFor('mcp.moodycosmetics.com', PER_HOST, undefined)).toBe('OLDTOKEN');
+    });
+    test('the Host header is matched case-insensitively', () => {
+        expect(challengeFor('MCP.MoodyLenses.com', PER_HOST, undefined)).toBe('NEWTOKEN');
+    });
+    // Every deployment that has only ever set the single variable must keep
+    // working with no config change at all.
+    test('an unlisted host falls back to the single-value variable', () => {
+        expect(challengeFor('other.example', PER_HOST, 'SINGLE')).toBe('SINGLE');
+        expect(challengeFor('anything', undefined, 'SINGLE')).toBe('SINGLE');
+    });
+    test('nothing configured serves nothing — the endpoint 404s', () => {
+        expect(challengeFor('mcp.moodylenses.com', undefined, undefined)).toBeUndefined();
+        expect(challengeFor(undefined, undefined, undefined)).toBeUndefined();
+    });
+});
+describe('parseChallengeTokens', () => {
+    // A token is base64url-ish and may legitimately contain '='. Splitting on
+    // every '=' would truncate it, and the endpoint would serve a token that is
+    // ALMOST right — which verifies as a mismatch and reads like a typo upstream.
+    test('only the first separator divides host from token', () => {
+        expect(parseChallengeTokens('h.example=abc=def==').get('h.example')).toBe('abc=def==');
+    });
+    test('whitespace around a pair is tolerated', () => {
+        expect(parseChallengeTokens(' a.example = T1 , b.example=T2 ').get('a.example')).toBe('T1');
+    });
+    test('a malformed pair is skipped, not fatal — one typo must not blank the rest', () => {
+        const m = parseChallengeTokens('broken,=nohost,a.example=T1');
+        expect(m.get('a.example')).toBe('T1');
+        expect(m.size).toBe(1);
+    });
+});
+//# sourceMappingURL=challenge.test.js.map

package/dist/__tests__/challenge.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.test.js","sourceRoot":"","sources":["../../src/__tests__/challenge.test.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,0EAA0E;AAC1E,8EAA8E;AAC9E,gEAAgE;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAErE,MAAM,QAAQ,GAAG,8DAA8D,CAAC;AAEhF,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,IAAI,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,YAAY,CAAC,qBAAqB,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClF,MAAM,CAAC,YAAY,CAAC,wBAAwB,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,YAAY,CAAC,qBAAqB,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,wCAAwC;IACxC,IAAI,CAAC,0DAA0D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,YAAY,CAAC,eAAe,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzE,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,uDAAuD,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,YAAY,CAAC,qBAAqB,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAClF,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,0EAA0E;IAC1E,4EAA4E;IAC5E,8EAA8E;IAC9E,IAAI,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,oBAAoB,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,uCAAuC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,oBAAoB,CAAC,iCAAiC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACrF,MAAM,CAAC,GAAG,oBAAoB,CAAC,6BAA6B,CAAC,CAAC;QAC9D,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/config.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=config.test.d.ts.map

package/dist/__tests__/config.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/config.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/config.test.js

@@ -0,0 +1,123 @@
+import { describe, expect, test } from 'vitest';
+import { resolveStorefront, toolNames } from '../config.js';
+const base = (over = {}) => ({
+    id: 'x',
+    server: { name: 'x', title: 'X' },
+    shopify: { mode: 'env', shopDomain: 'x.myshopify.com' },
+    urls: { appUrl: 'https://shopify.curless.ai/x' },
+    legal: {},
+    ...over,
+});
+describe('tool naming', () => {
+    /**
+     * The parity target. docs/baselines/moody-mcp-surface.json is what the live
+     * single-tenant connector answers today; if config-driven naming cannot
+     * reproduce those four names exactly, cutting moody over would silently
+     * rename its tools — and a host that has already learned them would stop
+     * finding them.
+     */
+    test('reproduces the live moody tool names exactly', () => {
+        const names = toolNames(base({ naming: { prefix: 'moody', noun: 'lens', nounPlural: 'lenses' } }));
+        expect(names).toEqual({
+            list: 'list_moody_lenses',
+            get: 'get_moody_lens',
+            checkout: 'create_moody_checkout',
+            lookupOrder: 'lookup_moody_order',
+        });
+    });
+    test('a prefix with no noun still reads as that merchant', () => {
+        expect(toolNames(base({ naming: { prefix: 'elspet' } }))).toEqual({
+            list: 'list_elspet_products',
+            get: 'get_elspet_product',
+            checkout: 'create_elspet_checkout',
+            lookupOrder: 'lookup_elspet_order',
+        });
+    });
+    /** The listed app: one install, one shop, and a capability list fixed at review time. */
+    test('no naming at all gives the generic public-app names', () => {
+        expect(toolNames(base())).toEqual({
+            list: 'list_products',
+            get: 'get_product',
+            checkout: 'create_checkout',
+            lookupOrder: 'lookup_order',
+        });
+    });
+    /**
+     * A merchant called "Els-Pet" must not fail to boot over a hyphen, and must
+     * not emit `list_els-pet_products` either — hosts reject tool names outside
+     * [a-z0-9_].
+     */
+    test('punctuation in a brand name is folded, not rejected', () => {
+        const names = toolNames(base({ naming: { prefix: 'Els-Pet', noun: 'Dog Bed', nounPlural: 'Dog Beds' } }));
+        expect(names.list).toBe('list_els_pet_dog_beds');
+        expect(names.get).toBe('get_els_pet_dog_bed');
+        for (const n of Object.values(names))
+            expect(n).toMatch(/^[a-z0-9_]+$/);
+    });
+});
+describe('resolution', () => {
+    test('the redirect uri is derived, never configured', () => {
+        // It is registered with Shopify by hand; a config that could disagree with
+        // what was registered would fail at install time, on a merchant's screen.
+        const r = resolveStorefront(base({ urls: { appUrl: 'https://shopify.curless.ai/elspet/' } }));
+        expect(r.redirectUri).toBe('https://shopify.curless.ai/elspet/auth/callback');
+        expect(r.appUrl).toBe('https://shopify.curless.ai/elspet');
+    });
+    test('publicUrl falls back to appUrl, and is kept when the merchant fronts it', () => {
+        expect(resolveStorefront(base()).publicUrl).toBe('https://shopify.curless.ai/x');
+        const fronted = resolveStorefront(base({
+            urls: {
+                appUrl: 'https://shopify.curless.ai/moody',
+                publicUrl: 'https://mcp.moodylenses.com/',
+            },
+        }));
+        expect(fronted.publicUrl).toBe('https://mcp.moodylenses.com');
+        // The redirect still belongs to the app URL — that is the one Shopify knows.
+        expect(fronted.redirectUri).toBe('https://shopify.curless.ai/moody/auth/callback');
+    });
+    test('token path and card uri are namespaced by id, so two tenants cannot collide', () => {
+        const a = resolveStorefront(base({ id: 'moody' }));
+        const b = resolveStorefront(base({ id: 'elspet' }));
+        expect(a.tokenPath).not.toBe(b.tokenPath);
+        expect(a.cardUriPrefix).toBe('ui://moody/');
+        expect(b.cardUriPrefix).toBe('ui://elspet/');
+    });
+});
+// Only `options` matters to the assertion below; the rest is the minimum a
+// ShopifyProduct needs to exist.
+const productWith = (title, options) => ({
+    id: 'gid://shopify/Product/1',
+    title,
+    handle: 'h',
+    url: 'https://example.com/products/h',
+    description: '',
+    productType: '',
+    options,
+    images: [],
+    variants: [],
+    tags: [],
+    currency: 'USD',
+    // biome-ignore lint/suspicious/noExplicitAny: minimal fixture for a shape assertion
+});
+describe('product shape does not invent axes the store lacks', () => {
+    // Regression: elspet sells litter boxes and every product came back with
+    // `eyes: 'unknown'` and `prescriptions: []` — inherited from the lens shop
+    // this package grew out of. Empty is not the same as absent: the first tells
+    // an assistant the axis exists and it failed to read it.
+    test('a store with no prescription option gets neither field', async () => {
+        const { productSummaryForTest } = await import('../tools.js');
+        const litter = productSummaryForTest(productWith('ELS PET Mixed Cat Litter', [{ name: 'Size', values: ['6L', '12L'] }]));
+        expect('eyes' in litter).toBe(false);
+        expect('prescriptions' in litter).toBe(false);
+    });
+    test('a store that does have one still reports both', async () => {
+        const { productSummaryForTest } = await import('../tools.js');
+        const lens = productSummaryForTest(productWith('Matcha Green', [
+            { name: 'Left prescription', values: ['-1.00', '-2.00'] },
+            { name: 'Right prescription', values: ['-1.00', '-2.00'] },
+        ]));
+        expect(lens.eyes).toBe('pair');
+        expect(lens.prescriptions).toEqual(['-1.00', '-2.00']);
+    });
+});
+//# sourceMappingURL=config.test.js.map

package/dist/__tests__/config.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.test.js","sourceRoot":"","sources":["../../src/__tests__/config.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAyB,iBAAiB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEnF,MAAM,IAAI,GAAG,CAAC,OAAkC,EAAE,EAAoB,EAAE,CAAC,CAAC;IACxE,EAAE,EAAE,GAAG;IACP,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE;IACjC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE;IACvD,IAAI,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE;IAChD,KAAK,EAAE,EAAE;IACT,GAAG,IAAI;CACR,CAAC,CAAC;AAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B;;;;;;OAMG;IACH,IAAI,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACxD,MAAM,KAAK,GAAG,SAAS,CACrB,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,CAAC,CAC1E,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;YACpB,IAAI,EAAE,mBAAmB;YACzB,GAAG,EAAE,gBAAgB;YACrB,QAAQ,EAAE,uBAAuB;YACjC,WAAW,EAAE,oBAAoB;SAClC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAChE,IAAI,EAAE,sBAAsB;YAC5B,GAAG,EAAE,oBAAoB;YACzB,QAAQ,EAAE,wBAAwB;YAClC,WAAW,EAAE,qBAAqB;SACnC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,yFAAyF;IACzF,IAAI,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAChC,IAAI,EAAE,eAAe;YACrB,GAAG,EAAE,aAAa;YAClB,QAAQ,EAAE,iBAAiB;YAC3B,WAAW,EAAE,cAAc;SAC5B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH;;;;OAIG;IACH,IAAI,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC/D,MAAM,KAAK,GAAG,SAAS,CACrB,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC,CACjF,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,IAAI,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACzD,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,oCAAoC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC9F,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QAC9E,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACnF,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,iBAAiB,CAC/B,IAAI,CAAC;YACH,IAAI,EAAE;gBACJ,MAAM,EAAE,kCAAkC;gBAC1C,SAAS,EAAE,8BAA8B;aAC1C;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC9D,6EAA6E;QAC7E,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACvF,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC5C,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,2EAA2E;AAC3E,iCAAiC;AACjC,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,OAAkD,EAAE,EAAE,CACxF,CAAC;IACC,EAAE,EAAE,yBAAyB;IAC7B,KAAK;IACL,MAAM,EAAE,GAAG;IACX,GAAG,EAAE,gCAAgC;IACrC,WAAW,EAAE,EAAE;IACf,WAAW,EAAE,EAAE;IACf,OAAO;IACP,MAAM,EAAE,EAAE;IACV,QAAQ,EAAE,EAAE;IACZ,IAAI,EAAE,EAAE;IACR,QAAQ,EAAE,KAAK;IACf,oFAAoF;CACrF,CAAQ,CAAC;AAEZ,QAAQ,CAAC,oDAAoD,EAAE,GAAG,EAAE;IAClE,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,yDAAyD;IACzD,IAAI,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,qBAAqB,CAClC,WAAW,CAAC,0BAA0B,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CACnF,CAAC;QACF,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,qBAAqB,CAChC,WAAW,CAAC,cAAc,EAAE;YAC1B,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE;YACzD,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE;SAC3D,CAAC,CACH,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/connection-state.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=connection-state.test.d.ts.map

package/dist/__tests__/connection-state.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-state.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/connection-state.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/connection-state.test.js

@@ -0,0 +1,40 @@
+// Three states, not two — and conflating two of them locked a merchant out of
+// fixing the third. See connection.ts for what happened.
+import { describe, expect, test } from 'vitest';
+import { credentialsRejected, needsAuth } from '../connection.js';
+describe('credentialsRejected', () => {
+    // 401 revoked or expired, 403 scoped out. Both mean "these credentials are no
+    // longer good", which is the merchant's problem to fix, not ours to retry.
+    test('a refused token is recognised from what Shopify actually said', () => {
+        expect(credentialsRejected('Shopify Admin API: HTTP 401')).toBe(true);
+        expect(credentialsRejected('Shopify Admin API: HTTP 403')).toBe(true);
+    });
+    // A store that is merely unreachable does NOT need reconnecting, and telling a
+    // merchant to reauthorise over a 500 sends them to do pointless work while the
+    // real fault is ours.
+    test('an outage is not a permissions problem', () => {
+        expect(credentialsRejected('Shopify Admin API: HTTP 500')).toBe(false);
+        expect(credentialsRejected('Shopify Admin API: HTTP 429')).toBe(false);
+        expect(credentialsRejected('shopify returned no products')).toBe(false);
+        expect(credentialsRejected(undefined)).toBe(false);
+    });
+    // 4013 is not 401 with a digit after it.
+    test('the status is matched as a whole, not as a prefix', () => {
+        expect(credentialsRejected('HTTP 4013')).toBe(false);
+    });
+});
+describe('needsAuth', () => {
+    test('no token at all', () => {
+        expect(needsAuth(false, undefined)).toBe(true);
+    });
+    // THE case. A token is present, so the old check said "connected" and offered
+    // the merchant nothing to press.
+    test('a token that Shopify refuses still needs the merchant to reconnect', () => {
+        expect(needsAuth(true, 'Shopify Admin API: HTTP 401')).toBe(true);
+    });
+    test('a working connection is left alone', () => {
+        expect(needsAuth(true, undefined)).toBe(false);
+        expect(needsAuth(true, 'Shopify Admin API: HTTP 500')).toBe(false);
+    });
+});
+//# sourceMappingURL=connection-state.test.js.map

package/dist/__tests__/connection-state.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-state.test.js","sourceRoot":"","sources":["../../src/__tests__/connection-state.test.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,yDAAyD;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElE,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,8EAA8E;IAC9E,2EAA2E;IAC3E,IAAI,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,mBAAmB,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtE,MAAM,CAAC,mBAAmB,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,+EAA+E;IAC/E,+EAA+E;IAC/E,sBAAsB;IACtB,IAAI,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,mBAAmB,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,CAAC,mBAAmB,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,CAAC,mBAAmB,CAAC,8BAA8B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxE,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,yCAAyC;IACzC,IAAI,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,IAAI,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC3B,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,iCAAiC;IACjC,IAAI,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC9E,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/multi-token-store.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=multi-token-store.test.d.ts.map

package/dist/__tests__/multi-token-store.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-token-store.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/multi-token-store.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/multi-token-store.test.js

@@ -0,0 +1,89 @@
+import { mkdtemp, readFile, readdir, stat } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { describe, expect, test } from 'vitest';
+import { MultiTokenStore, isStorableShop } from '../multi-token-store.js';
+const store = async () => new MultiTokenStore(await mkdtemp(join(tmpdir(), 'mts-')));
+const token = (shopDomain) => ({
+    shopDomain,
+    accessToken: `shpat_${shopDomain.split('.')[0]}`,
+    scope: 'read_products',
+    installedAt: '2026-08-17T00:00:00.000Z',
+});
+describe('shop names that become filenames', () => {
+    test('accepts what Shopify actually issues', () => {
+        expect(isStorableShop('els-pet-us.myshopify.com')).toBe(true);
+        expect(isStorableShop('ELS-PET-US.myshopify.com')).toBe(true);
+    });
+    // The shop arrives as a request parameter. Everything here would either
+    // escape the directory or name a host we have no business holding a token
+    // for, and a deny-list would have to anticipate each one.
+    test.each([
+        '../../etc/passwd',
+        '..%2f..%2fetc',
+        'shop.myshopify.com/../other',
+        'evil.example.com',
+        'shop.myshopify.com.evil.com',
+        '',
+        '.myshopify.com',
+        'a/b.myshopify.com',
+    ])('rejects %j', (bad) => {
+        expect(isStorableShop(bad)).toBe(false);
+    });
+    test('a rejected name throws on write rather than landing somewhere', async () => {
+        const s = await store();
+        await expect(s.set(token('../escape'))).rejects.toThrow(/refusing/);
+    });
+    test('a rejected name reads as not-installed, never as an error to the buyer', async () => {
+        const s = await store();
+        await expect(s.get('../escape')).resolves.toBeNull();
+    });
+});
+describe('many shops at once', () => {
+    test('each shop gets its own token back', async () => {
+        const s = await store();
+        await s.set(token('a-shop.myshopify.com'));
+        await s.set(token('b-shop.myshopify.com'));
+        expect((await s.get('a-shop.myshopify.com'))?.accessToken).toBe('shpat_a-shop');
+        expect((await s.get('b-shop.myshopify.com'))?.accessToken).toBe('shpat_b-shop');
+        expect(await s.get('c-shop.myshopify.com')).toBeNull();
+    });
+    test('a file whose body names a different shop is not served', async () => {
+        // Trust the filename, not the contents: handing back a token under a shop
+        // it does not belong to is how one merchant answers for another.
+        const dir = await mkdtemp(join(tmpdir(), 'mts-'));
+        const s = new MultiTokenStore(dir);
+        await s.set(token('a-shop.myshopify.com'));
+        const { writeFile } = await import('node:fs/promises');
+        await writeFile(join(dir, 'a-shop.myshopify.com.json'), JSON.stringify(token('b-shop.myshopify.com')));
+        const fresh = new MultiTokenStore(dir);
+        expect(await fresh.get('a-shop.myshopify.com')).toBeNull();
+    });
+    test('tokens are written 0600 — the file IS the credential', async () => {
+        const dir = await mkdtemp(join(tmpdir(), 'mts-'));
+        await new MultiTokenStore(dir).set(token('a-shop.myshopify.com'));
+        const names = await readdir(dir);
+        expect(names).toEqual(['a-shop.myshopify.com.json']);
+        expect((await stat(join(dir, names[0]))).mode & 0o777).toBe(0o600);
+    });
+    test('a half-written temp file never becomes the token', async () => {
+        const dir = await mkdtemp(join(tmpdir(), 'mts-'));
+        await new MultiTokenStore(dir).set(token('a-shop.myshopify.com'));
+        expect(await readdir(dir)).toEqual(['a-shop.myshopify.com.json']);
+        expect(JSON.parse(await readFile(join(dir, 'a-shop.myshopify.com.json'), 'utf8')).accessToken).toBe('shpat_a-shop');
+    });
+});
+describe('forget, for shop/redact and uninstall', () => {
+    test('drops the cache as well as the file, so a revoked token stops answering', async () => {
+        const s = await store();
+        await s.set(token('a-shop.myshopify.com'));
+        expect(await s.get('a-shop.myshopify.com')).not.toBeNull();
+        await s.forget('a-shop.myshopify.com');
+        expect(await s.get('a-shop.myshopify.com')).toBeNull();
+    });
+    test('forgetting a shop that was never here is not an error', async () => {
+        const s = await store();
+        await expect(s.forget('never.myshopify.com')).resolves.toBeUndefined();
+    });
+});
+//# sourceMappingURL=multi-token-store.test.js.map

package/dist/__tests__/multi-token-store.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-token-store.test.js","sourceRoot":"","sources":["../../src/__tests__/multi-token-store.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAE1E,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE,CAAC,IAAI,eAAe,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACrF,MAAM,KAAK,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,CAAC;IACrC,UAAU;IACV,WAAW,EAAE,SAAS,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;IAChD,KAAK,EAAE,eAAe;IACtB,WAAW,EAAE,0BAA0B;CACxC,CAAC,CAAC;AAEH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,IAAI,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,cAAc,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,CAAC,cAAc,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,wEAAwE;IACxE,0EAA0E;IAC1E,0DAA0D;IAC1D,IAAI,CAAC,IAAI,CAAC;QACR,kBAAkB;QAClB,eAAe;QACf,6BAA6B;QAC7B,kBAAkB;QAClB,6BAA6B;QAC7B,EAAE;QACF,gBAAgB;QAChB,mBAAmB;KACpB,CAAC,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE;QACvB,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,CAAC,GAAG,MAAM,KAAK,EAAE,CAAC;QACxB,MAAM,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,CAAC,GAAG,MAAM,KAAK,EAAE,CAAC;QACxB,MAAM,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,IAAI,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,CAAC,GAAG,MAAM,KAAK,EAAE,CAAC;QACxB,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChF,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChF,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACxE,0EAA0E;QAC1E,iEAAiE;QACjE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC3C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACvD,MAAM,SAAS,CACb,IAAI,CAAC,GAAG,EAAE,2BAA2B,CAAC,EACtC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAC9C,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAClD,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAClE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAW,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAClD,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC;QAClE,MAAM,CACJ,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,2BAA2B,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CACvF,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,IAAI,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,CAAC,GAAG,MAAM,KAAK,EAAE,CAAC;QACxB,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,CAAC,GAAG,MAAM,KAAK,EAAE,CAAC;QACxB,MAAM,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/oauth.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=oauth.test.d.ts.map

package/dist/__tests__/oauth.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/oauth.test.ts"],"names":[],"mappings":""}