@curless/shopify-storefront 0.4.1 → 0.6.2

package/dist/__tests__/listed-pages.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=listed-pages.test.d.ts.map

package/dist/__tests__/listed-pages.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"listed-pages.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/listed-pages.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/listed-pages.test.js

@@ -0,0 +1,88 @@
+// The listed app's merchant-facing pages.
+//
+// These went out wrong once, in the way that is hardest to notice from the
+// code: the server ran the SINGLE-shop status page for an app that has no shop,
+// so the address Shopify opens after an install said "This store is not
+// connected yet · Connect " — an empty shop name, behind a link that answered
+// 400. What is pinned here is therefore what the pages SAY, not that they
+// render: that the connected page names the MERCHANT's store rather than our
+// product, and that it carries the connector address, which is the only thing
+// on it a merchant can act on.
+import { describe, expect, test } from 'vitest';
+import { connectPage, connectedPage, connectorUrl, listedLandingPage, } from '../listed-pages.js';
+const ctx = {
+    appUrl: 'https://storefront.curless.ai',
+    productName: 'Curless Storefront',
+};
+const snap = (over = {}) => ({
+    products: [{ handle: 'a' }, { handle: 'b' }],
+    loadedAt: new Date('2026-09-10T12:34:56Z'),
+    discounts: [],
+    ...over,
+});
+describe('connectorUrl', () => {
+    test('is the shop-scoped MCP path under the app URL', () => {
+        expect(connectorUrl(ctx, 'curless-demo.myshopify.com')).toBe('https://storefront.curless.ai/s/curless-demo.myshopify.com/mcp');
+    });
+    test('a trailing slash on the app URL does not double up', () => {
+        expect(connectorUrl({ ...ctx, appUrl: 'https://storefront.curless.ai/' }, 'x.myshopify.com')).toBe('https://storefront.curless.ai/s/x.myshopify.com/mcp');
+    });
+    test('lowercases the shop — the path resolver keys on it', () => {
+        expect(connectorUrl(ctx, 'Curless-Demo.MyShopify.com')).toContain('/s/curless-demo.myshopify.com/mcp');
+    });
+});
+describe('connectedPage', () => {
+    const html = connectedPage(ctx, 'curless-demo.myshopify.com', snap());
+    test('names the MERCHANT store, not our product', () => {
+        expect(html).toContain('curless-demo.myshopify.com');
+        // The bug this replaces: the callback congratulated the merchant on
+        // "Curless Storefront is connected" — our own name, on their install.
+        expect(html).not.toContain('Curless Storefront is connected');
+    });
+    test('carries the connector address — the one thing the merchant must copy', () => {
+        expect(html).toContain('https://storefront.curless.ai/s/curless-demo.myshopify.com/mcp');
+    });
+    test('reports the catalogue that was actually read', () => {
+        expect(html).toContain('2 products readable');
+        expect(html).toContain('2026-09-10 12:34');
+    });
+    test('a store whose last sync failed is told so, and still gets the address', () => {
+        const failed = connectedPage(ctx, 'x.myshopify.com', snap({ lastError: 'HTTP 401' }));
+        expect(failed).toContain('HTTP 401');
+        expect(failed).toContain('/s/x.myshopify.com/mcp');
+    });
+    test('a catalogue that has never loaded says nothing about when it synced', () => {
+        expect(connectedPage(ctx, 'x.myshopify.com', snap({ products: [], loadedAt: null }))).not.toContain('last synced');
+    });
+});
+describe('connectPage', () => {
+    test('offers the install for THAT shop', () => {
+        expect(connectPage('curless-demo.myshopify.com')).toContain('href="/auth/install?shop=curless-demo.myshopify.com"');
+    });
+    test('is not the empty-shop page that shipped', () => {
+        // The regression, exactly: a button reading "Connect " with nothing after it.
+        expect(connectPage('curless-demo.myshopify.com')).not.toContain('Connect </a>');
+    });
+    test('a shop with markup in it cannot break out of the link or the text', () => {
+        const html = connectPage('evil".myshopify.com');
+        expect(html).not.toContain('evil".myshopify.com');
+        expect(html).toContain('evil&quot;.myshopify.com');
+        expect(html).toContain('shop=evil%22.myshopify.com');
+    });
+});
+describe('listedLandingPage', () => {
+    const html = listedLandingPage(ctx);
+    test('says what the app is without naming any merchant', () => {
+        expect(html).toContain('Curless Storefront');
+        expect(html).not.toContain('myshopify.com');
+    });
+    test('links the four pages a reviewer looks for', () => {
+        for (const href of ['/docs', '/privacy', '/terms', '/security']) {
+            expect(html).toContain(`href="${href}"`);
+        }
+    });
+    test('says it is read-only, which is the listing claim', () => {
+        expect(html).toContain('read-only');
+    });
+});
+//# sourceMappingURL=listed-pages.test.js.map

package/dist/__tests__/listed-pages.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"listed-pages.test.js","sourceRoot":"","sources":["../../src/__tests__/listed-pages.test.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,EAAE;AACF,2EAA2E;AAC3E,gFAAgF;AAChF,wEAAwE;AACxE,8EAA8E;AAC9E,0EAA0E;AAC1E,6EAA6E;AAC7E,8EAA8E;AAC9E,+BAA+B;AAC/B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAEhD,OAAO,EAEL,WAAW,EACX,aAAa,EACb,YAAY,EACZ,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,GAAG,GAAsB;IAC7B,MAAM,EAAE,+BAA+B;IACvC,WAAW,EAAE,oBAAoB;CAClC,CAAC;AAEF,MAAM,IAAI,GAAG,CAAC,OAAiC,EAAE,EAAmB,EAAE,CAAC,CAAC;IACtE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAgC;IAC3E,QAAQ,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC;IAC1C,SAAS,EAAE,EAAE;IACb,GAAG,IAAI;CACR,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,IAAI,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAC1D,gEAAgE,CACjE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC9D,MAAM,CACJ,YAAY,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,gCAAgC,EAAE,EAAE,iBAAiB,CAAC,CACtF,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC,CAAC,SAAS,CAC/D,mCAAmC,CACpC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC;IAEtE,IAAI,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QACrD,oEAAoE;QACpE,sEAAsE;QACtE,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAChF,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,gEAAgE,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,uEAAuE,EAAE,GAAG,EAAE;QACjF,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,iBAAiB,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;QACtF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC/E,MAAM,CACJ,aAAa,CAAC,GAAG,EAAE,iBAAiB,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAC9E,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,IAAI,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAAC,CAAC,SAAS,CACzD,sDAAsD,CACvD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACnD,8EAA8E;QAC9E,MAAM,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC7E,MAAM,IAAI,GAAG,WAAW,CAAC,qBAAqB,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAEpC,IAAI,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACrD,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;YAChE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/oauth.test.js

@@ -3,7 +3,7 @@
 // which is exactly why they need tests rather than a careful reading.
 import { createHmac } from 'node:crypto';
 import { describe, expect, test, vi } from 'vitest';
-import { exchangeCode, installUrl, isShopDomain, makeState, verifyCallbackHmac, verifyState, } from '../oauth.js';
+import { exchangeCode, installUrl, isShopDomain, makeState, refreshAccessToken, verifyCallbackHmac, verifyState, } from '../oauth.js';
 const CONFIG = {
     clientId: 'cid',
     clientSecret: 'shhh',
@@ -108,5 +108,54 @@ describe('code exchange', () => {
         await expect(exchangeCode(CONFIG, 'bad', f)).rejects.toThrow(/HTTP 400/);
         await expect(exchangeCode(CONFIG, 'bad', f)).rejects.not.toThrow(/reflected/);
     });
+    test('posts to the SHOP in the config, not to some default', async () => {
+        const f = vi.fn(async () => new Response(JSON.stringify({ access_token: 'shpat_x', scope: 'read_products' }), {
+            status: 200,
+            headers: { 'content-type': 'application/json' },
+        }));
+        await exchangeCode({ ...CONFIG, shopDomain: 'other.myshopify.com' }, 'code', f);
+        expect(vi.mocked(f).mock.calls[0]?.[0]).toBe('https://other.myshopify.com/admin/oauth/access_token');
+    });
+});
+// ⚠️ THE LISTED APP HAS NO SHOP OF ITS OWN — its module-level config holds `''`,
+// because the shop is a property of the REQUEST, not of the config. Every call
+// site therefore has to spread the real shop in, and on 2026-09-10 the callback
+// did not: it built `https:///admin/oauth/access_token`, undici answered
+// `fetch failed`, and a real install died looking exactly like a network fault.
+// An hour went into DNS and container egress before anyone looked at the host.
+//
+// These are the tests that would have caught it. Note that NONE of the 27 that
+// existed did: every one of them passed a config with a shop already in it.
+describe('an empty shop is refused out loud, not fetched', () => {
+    const NO_SHOP = { ...CONFIG, shopDomain: '' };
+    test('exchangeCode throws before it fetches anything', async () => {
+        const f = vi.fn();
+        await expect(exchangeCode(NO_SHOP, 'code', f)).rejects.toThrow(/no shop to talk to/);
+        // The point of failing early: nothing was sent to `https:///…`.
+        expect(vi.mocked(f)).not.toHaveBeenCalled();
+    });
+    test('refreshAccessToken throws before it fetches anything', async () => {
+        const f = vi.fn();
+        await expect(refreshAccessToken(NO_SHOP, 'rt', f)).rejects.toThrow(/no shop to talk to/);
+        expect(vi.mocked(f)).not.toHaveBeenCalled();
+    });
+    test('installUrl throws rather than returning https:///admin/oauth/authorize', () => {
+        expect(() => installUrl(NO_SHOP, 'st.at')).toThrow(/no shop to talk to/);
+    });
+    test('the error names the empty value, so the log says what is missing', async () => {
+        await expect(exchangeCode(NO_SHOP, 'code')).rejects.toThrow(/shopDomain is ""/);
+    });
+    test('a lookalike host is refused by the same door', async () => {
+        const evil = { ...CONFIG, shopDomain: 'shop.myshopify.com.evil.com' };
+        await expect(exchangeCode(evil, 'code')).rejects.toThrow(/no shop to talk to/);
+    });
+    test('spreading the request shop over the listed config is what works', async () => {
+        const f = vi.fn(async () => new Response(JSON.stringify({ access_token: 'shpat_x', scope: 'read_products' }), {
+            status: 200,
+            headers: { 'content-type': 'application/json' },
+        }));
+        await exchangeCode({ ...NO_SHOP, shopDomain: 'curless-demo.myshopify.com' }, 'code', f);
+        expect(vi.mocked(f).mock.calls[0]?.[0]).toBe('https://curless-demo.myshopify.com/admin/oauth/access_token');
+    });
 });
 //# sourceMappingURL=oauth.test.js.map

package/dist/__tests__/oauth.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.test.js","sourceRoot":"","sources":["../../src/__tests__/oauth.test.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,iFAAiF;AACjF,sEAAsE;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACpD,OAAO,EAEL,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,SAAS,EACT,kBAAkB,EAClB,WAAW,GACZ,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,GAAgB;IAC1B,QAAQ,EAAE,KAAK;IACf,YAAY,EAAE,MAAM;IACpB,UAAU,EAAE,2BAA2B;IACvC,MAAM,EAAE,8BAA8B;IACtC,MAAM,EAAE,2BAA2B;CACpC,CAAC;AAEF,0EAA0E;AAC1E,gDAAgD;AAChD,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,KAA6B,EAAU,EAAE;IAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SAC7B,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,EAAE,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChF,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;AAC5C,CAAC,CAAC;AAEF,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,YAAY,CAAC,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7D,sEAAsE;QACtE,MAAM,CAAC,YAAY,CAAC,oCAAoC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,CAAC,YAAY,CAAC,oCAAoC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAEnF,IAAI,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,IAAI,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACxC,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,6EAA6E;IAC7E,+EAA+E;IAC/E,iBAAiB;IACjB,IAAI,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC7D,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,IAAI,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,6EAA6E;IAC7E,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAChC,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC9B,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAClD,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC9B,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,IAAI,CAAC,gEAAgE,EAAE,GAAG,EAAE;QAC1E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACxE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAChG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,6EAA6E;QAC7E,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,IAAI,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CACb,KAAK,IAAI,EAAE,CACT,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAE;YAChF,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CACsB,CAAC;QAC7B,qEAAqE;QACrE,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC7D,WAAW,EAAE,SAAS;YACtB,KAAK,EAAE,eAAe;SACvB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CACb,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CACnD,CAAC;QAC7B,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACzE,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"oauth.test.js","sourceRoot":"","sources":["../../src/__tests__/oauth.test.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,iFAAiF;AACjF,sEAAsE;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACpD,OAAO,EAEL,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,GACZ,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,GAAgB;IAC1B,QAAQ,EAAE,KAAK;IACf,YAAY,EAAE,MAAM;IACpB,UAAU,EAAE,2BAA2B;IACvC,MAAM,EAAE,8BAA8B;IACtC,MAAM,EAAE,2BAA2B;CACpC,CAAC;AAEF,0EAA0E;AAC1E,gDAAgD;AAChD,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,KAA6B,EAAU,EAAE;IAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SAC7B,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,EAAE,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChF,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;AAC5C,CAAC,CAAC;AAEF,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,YAAY,CAAC,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7D,sEAAsE;QACtE,MAAM,CAAC,YAAY,CAAC,oCAAoC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,CAAC,YAAY,CAAC,oCAAoC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAEnF,IAAI,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,IAAI,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACxC,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,6EAA6E;IAC7E,+EAA+E;IAC/E,iBAAiB;IACjB,IAAI,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC7D,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,IAAI,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,6EAA6E;IAC7E,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAChC,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC9B,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAClD,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC9B,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,IAAI,CAAC,gEAAgE,EAAE,GAAG,EAAE;QAC1E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACxE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAChG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,6EAA6E;QAC7E,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,IAAI,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CACb,KAAK,IAAI,EAAE,CACT,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAE;YAChF,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CACsB,CAAC;QAC7B,qEAAqE;QACrE,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC7D,WAAW,EAAE,SAAS;YACtB,KAAK,EAAE,eAAe;SACvB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CACb,KAAK,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CACnD,CAAC;QAC7B,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACzE,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CACb,KAAK,IAAI,EAAE,CACT,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAE;YAChF,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CACsB,CAAC;QAC7B,MAAM,YAAY,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,qBAAqB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAChF,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC1C,sDAAsD,CACvD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,iFAAiF;AACjF,+EAA+E;AAC/E,gFAAgF;AAChF,yEAAyE;AACzE,gFAAgF;AAChF,+EAA+E;AAC/E,EAAE;AACF,+EAA+E;AAC/E,4EAA4E;AAC5E,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC9D,MAAM,OAAO,GAAgB,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAE3D,IAAI,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,EAA6B,CAAC;QAC7C,MAAM,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACrF,gEAAgE;QAChE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,EAA6B,CAAC;QAC7C,MAAM,MAAM,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACzF,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAClF,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,6BAA6B,EAAE,CAAC;QACtE,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CACb,KAAK,IAAI,EAAE,CACT,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAE;YAChF,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CACsB,CAAC;QAC7B,MAAM,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,4BAA4B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACxF,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC1C,6DAA6D,CAC9D,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/privacy-page.test.js

@@ -11,7 +11,7 @@ import { readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { describe, expect, test } from 'vitest';
-import { ORDER_FIELDS, docsPage, privacyPage } from '../legal.js';
+import { ORDER_FIELDS, docsPage, merchantTermsPage, privacyPage, securityPage, } from '../legal.js';
 const CTX = {
     merchantName: 'Moody Lenses',
     storefront: 'https://moodylenses.com',
@@ -126,6 +126,38 @@ describe('the listed app has no merchant to name', () => {
             expect(ours, `points a shop-policy link at us: ${ours.join(', ')}`).toHaveLength(0);
         }
     });
+    // ⚠️ /terms WAS THE SAME 404, found only after the privacy page was fixed:
+    // the redirect lives in index.ts, not in legal.ts, so fixing the pages left
+    // it pointing at `<our own app url>/policies/terms-of-service`.
+    //
+    // These two pages are also the answer to two questions on Shopify's
+    // protected-customer-data questionnaire — "do you have a data protection
+    // agreement with your merchants" and "do you have a data loss prevention
+    // strategy" — which were answered No on 2026-09-10 because nothing was
+    // written down, not because the controls were missing.
+    test('the listed app has merchant terms and a written data-protection page', () => {
+        const terms = merchantTermsPage(multi);
+        expect(terms).toContain('data-processing agreement');
+        expect(terms).toContain('processor');
+        const sec = securityPage(multi);
+        expect(sec).toContain('data loss');
+        // The strongest claim, and the one the code actually backs.
+        expect(sec).toContain('no shopper record');
+    });
+    test('neither new page links a /policies path on our own domain', () => {
+        for (const page of [merchantTermsPage(multi), securityPage(multi)]) {
+            const ours = page.match(/https:\/\/[^"']*curless[^"']*\/policies\/[a-z-]+/g) ?? [];
+            expect(ours).toHaveLength(0);
+        }
+    });
+    // ⚠️ Nothing here may promise more than the code keeps. These two were the
+    // tempting over-claims — an encrypted off-site backup we do not have, and a
+    // certification we have not been through.
+    test('claims nothing we cannot point at code for', () => {
+        const sec = securityPage(multi);
+        expect(sec).toContain('no third-party security certification');
+        expect(sec).toContain('keeps no shopper data');
+    });
     // A branded deployment must keep its links — the fix must not cost moody and
     // elspet the merchant policy links they are supposed to carry.
     test('a branded deployment still links the merchant’s own policies', () => {

package/dist/__tests__/privacy-page.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"privacy-page.test.js","sourceRoot":"","sources":["../../src/__tests__/privacy-page.test.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,8EAA8E;AAC9E,+EAA+E;AAC/E,iFAAiF;AACjF,WAAW;AACX,EAAE;AACF,iFAAiF;AACjF,6EAA6E;AAC7E,+EAA+E;AAE/E,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAqB,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAErF,MAAM,GAAG,GAAiB;IACxB,YAAY,EAAE,cAAc;IAC5B,UAAU,EAAE,yBAAyB;IACrC,QAAQ,EAAE,SAAS;IACnB,eAAe,EAAE,gBAAgB;IACjC,OAAO,EAAE,gBAAgB;IACzB,UAAU,EAAE,yBAAyB;IACrC,MAAM,EAAE,WAAW;IACnB,eAAe,EAAE,yBAAyB;IAC1C,WAAW,EAAE,EAAE;IACf,UAAU,EAAE,EAAE;IACd,KAAK,EAAE;QACL,IAAI,EAAE,mBAAmB;QACzB,GAAG,EAAE,gBAAgB;QACrB,QAAQ,EAAE,yBAAyB;QACnC,WAAW,EAAE,oBAAoB;KAClC;IACD,IAAI,EAAE,MAAM;IACZ,UAAU,EAAE,QAAQ;CACrB,CAAC;AAEF,yEAAyE;AACzE,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,WAAW,GAAG,IAAI,CACtB,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EACvC,8CAA8C,CAC/C,CAAC;AAEF,4EAA4E;AAC5E,MAAM,kBAAkB,GAAG,GAAa,EAAE;IACxC,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,sEAAsE,CAAC,IAAI,CACvF,GAAG,CACJ,EAAE,CAAC,CAAC,CAAC,CAAC;IACP,MAAM,KAAK,GAAG,iDAAiD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAE,EAAE,CACtC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC,CAAC;IAC3E,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;AACvF,CAAC,CAAC;AAEF,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,IAAI,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACxD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9B,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,EAAE,gCAAgC,KAAK,GAAG,CAAC,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,CAAC,uDAAuD,EAAE,GAAG,EAAE;QACjE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,MAAM,CACJ,MAAM,CAAC,MAAM,EACb,0DAA0D,CAC3D,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,oDAAoD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,+EAA+E;IAC/E,eAAe;IACf,IAAI,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,yBAAyB;IACzB,IAAI,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACtD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,GAAG,GAAG,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/D,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC5C,qDAAqD;QACrD,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACrE,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,2CAA2C,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,iDAAiD,CAAC,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,oEAAoE;AACpE,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,0EAA0E;AAC1E,yEAAyE;AACzE,8EAA8E;AAC9E,4EAA4E;AAC5E,sBAAsB;AACtB,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,uEAAuE;IACvE,wEAAwE;IACxE,sEAAsE;IACtE,8EAA8E;IAC9E,6EAA6E;IAC7E,sEAAsE;IACtE,4BAA4B;IAC5B,MAAM,KAAK,GAAG;QACZ,GAAG,GAAG;QACN,WAAW,EAAE,IAAI;QACjB,YAAY,EAAE,oBAAoB;QAClC,UAAU,EAAE,gCAAgC;KAC7C,CAAC;IAEF,IAAI,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACvD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iDAAiD,CAAC,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,IAAI,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACvD,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,mDAAmD,CAAC,IAAI,EAAE,CAAC;YACnF,MAAM,CAAC,IAAI,EAAE,oCAAoC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACtF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,+DAA+D;IAC/D,IAAI,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACxE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,6EAA6E;IAC7E,uCAAuC;IACvC,IAAI,CAAC,iDAAiD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC7E,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,SAAS,CACvE,gCAAgC,CACjC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"privacy-page.test.js","sourceRoot":"","sources":["../../src/__tests__/privacy-page.test.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,8EAA8E;AAC9E,+EAA+E;AAC/E,iFAAiF;AACjF,WAAW;AACX,EAAE;AACF,iFAAiF;AACjF,6EAA6E;AAC7E,+EAA+E;AAE/E,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAEL,YAAY,EACZ,QAAQ,EACR,iBAAiB,EACjB,WAAW,EACX,YAAY,GACb,MAAM,aAAa,CAAC;AAErB,MAAM,GAAG,GAAiB;IACxB,YAAY,EAAE,cAAc;IAC5B,UAAU,EAAE,yBAAyB;IACrC,QAAQ,EAAE,SAAS;IACnB,eAAe,EAAE,gBAAgB;IACjC,OAAO,EAAE,gBAAgB;IACzB,UAAU,EAAE,yBAAyB;IACrC,MAAM,EAAE,WAAW;IACnB,eAAe,EAAE,yBAAyB;IAC1C,WAAW,EAAE,EAAE;IACf,UAAU,EAAE,EAAE;IACd,KAAK,EAAE;QACL,IAAI,EAAE,mBAAmB;QACzB,GAAG,EAAE,gBAAgB;QACrB,QAAQ,EAAE,yBAAyB;QACnC,WAAW,EAAE,oBAAoB;KAClC;IACD,IAAI,EAAE,MAAM;IACZ,UAAU,EAAE,QAAQ;CACrB,CAAC;AAEF,yEAAyE;AACzE,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,WAAW,GAAG,IAAI,CACtB,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EACvC,8CAA8C,CAC/C,CAAC;AAEF,4EAA4E;AAC5E,MAAM,kBAAkB,GAAG,GAAa,EAAE;IACxC,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,sEAAsE,CAAC,IAAI,CACvF,GAAG,CACJ,EAAE,CAAC,CAAC,CAAC,CAAC;IACP,MAAM,KAAK,GAAG,iDAAiD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAE,EAAE,CACtC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC,CAAC;IAC3E,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;AACvF,CAAC,CAAC;AAEF,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,IAAI,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACxD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9B,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,EAAE,gCAAgC,KAAK,GAAG,CAAC,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,CAAC,uDAAuD,EAAE,GAAG,EAAE;QACjE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,MAAM,CACJ,MAAM,CAAC,MAAM,EACb,0DAA0D,CAC3D,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,oDAAoD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,+EAA+E;IAC/E,eAAe;IACf,IAAI,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,yBAAyB;IACzB,IAAI,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACtD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,GAAG,GAAG,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/D,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC5C,qDAAqD;QACrD,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACrE,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,2CAA2C,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,iDAAiD,CAAC,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,oEAAoE;AACpE,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,0EAA0E;AAC1E,yEAAyE;AACzE,8EAA8E;AAC9E,4EAA4E;AAC5E,sBAAsB;AACtB,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,uEAAuE;IACvE,wEAAwE;IACxE,sEAAsE;IACtE,8EAA8E;IAC9E,6EAA6E;IAC7E,sEAAsE;IACtE,4BAA4B;IAC5B,MAAM,KAAK,GAAG;QACZ,GAAG,GAAG;QACN,WAAW,EAAE,IAAI;QACjB,YAAY,EAAE,oBAAoB;QAClC,UAAU,EAAE,gCAAgC;KAC7C,CAAC;IAEF,IAAI,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACvD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iDAAiD,CAAC,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,IAAI,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACvD,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,mDAAmD,CAAC,IAAI,EAAE,CAAC;YACnF,MAAM,CAAC,IAAI,EAAE,oCAAoC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACtF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,4EAA4E;IAC5E,gEAAgE;IAChE,EAAE;IACF,oEAAoE;IACpE,yEAAyE;IACzE,yEAAyE;IACzE,uEAAuE;IACvE,uDAAuD;IACvD,IAAI,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAChF,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACrD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACnC,4DAA4D;QAC5D,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACrE,KAAK,MAAM,IAAI,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,mDAAmD,CAAC,IAAI,EAAE,CAAC;YACnF,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,4EAA4E;IAC5E,0CAA0C;IAC1C,IAAI,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACtD,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,+DAA+D;IAC/D,IAAI,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACxE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,6EAA6E;IAC7E,uCAAuC;IACvC,IAAI,CAAC,iDAAiD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC7E,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,SAAS,CACvE,gCAAgC,CACjC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/tenant.test.js

@@ -1,10 +1,22 @@
 import { describe, expect, test } from 'vitest';
 import { resolveStorefront } from '../config.js';
 import { explainNoTenant, multiShopResolver, singleShopResolver } from '../tenant.js';
-// The fakes are typed against the reader slices the resolvers declare, so a
-// required member added to either store fails HERE, at compile time, instead of
-// compiling fine and throwing once the suite runs.
-const fakeCatalog = (tag) => ({ tag });
+const fakeCatalog = (tag, opts = {}) => {
+    const snap = { products: [], loadedAt: opts.loaded ? new Date() : null };
+    return {
+        tag,
+        get current() {
+            return snap;
+        },
+        refresh: async () => {
+            opts.refreshes?.push(tag);
+            if (opts.loadTakes)
+                await new Promise((r) => setTimeout(r, opts.loadTakes));
+            snap.products = [{ handle: 'loaded-by-the-wait' }];
+            snap.loadedAt = new Date();
+        },
+    };
+};
 const token = (shopDomain = 'rqxbft-fw.myshopify.com') => ({
     shopDomain,
     accessToken: 'x',
@@ -19,22 +31,23 @@ const single = (opts) => singleShopResolver({
         urls: { appUrl: 'https://shopify.curless.ai/moody' },
         legal: {},
     }),
-    catalog: fakeCatalog('single'),
+    catalog: fakeCatalog('single', { loaded: true }),
     tokens: { get: async () => (opts.installed ? token() : null) },
 });
-const multi = (installed) => {
+const multi = (installed, opts = {}) => {
     const started = [];
+    const refreshes = [];
     const registry = {
         for: (s) => {
             started.push(s);
-            return fakeCatalog(s);
+            return fakeCatalog(s, { loaded: !opts.cold, loadTakes: opts.loadTakes, refreshes });
         },
     };
     const tokens = {
         get: async (s) => (installed.includes(s) ? token(s) : null),
     };
-    const resolve = multiShopResolver({ registry, tokens });
-    return { resolve, started };
+    const resolve = multiShopResolver({ registry, tokens, coldStartWaitMs: 50 });
+    return { resolve, started, refreshes };
 };
 describe('branded deployment', () => {
     test('a request naming nothing gets the one shop it serves', async () => {
@@ -102,4 +115,54 @@ describe('what the buyer is told', () => {
         expect(explainNoTenant({ reason: 'not-installed', shop: 'a.myshopify.com' })).toMatch(/has not installed/i);
     });
 });
+// ⚠️ THE FIRST QUESTION EVER ASKED OF A SHOP.
+//
+// `registry.for` creates the catalogue and starts its first load; the resolver
+// used to hand that empty catalogue straight to the tool, which answered "the
+// catalog is not loaded yet". Verified in production on 2026-09-10, one minute
+// after a real install on the dev store: ask once, get the error card; ask
+// again, get 15 products. A Shopify reviewer's step 4 is exactly that first ask.
+describe('a catalogue that has never loaded', () => {
+    test('is waited for, so the first request answers with products', async () => {
+        const { resolve } = multi(['rqxbft-fw.myshopify.com'], { cold: true });
+        const r = await resolve('rqxbft-fw.myshopify.com');
+        expect(r.ok).toBe(true);
+        expect(r.ok && r.tenant.catalog.current.loadedAt).not.toBeNull();
+        expect(r.ok && r.tenant.catalog.current.products).toHaveLength(1);
+    });
+    test('a WARM catalogue is not refreshed on the way past', async () => {
+        const { resolve, refreshes } = multi(['rqxbft-fw.myshopify.com']);
+        await resolve('rqxbft-fw.myshopify.com');
+        expect(refreshes).toEqual([]);
+    });
+    test('the wait is BOUNDED — a load that hangs still answers', async () => {
+        // Nothing between the catalogue and Shopify sets a timeout, so an unbounded
+        // await here would hand a buyer's request to whatever Shopify does with it.
+        const { resolve } = multi(['rqxbft-fw.myshopify.com'], { cold: true, loadTakes: 5_000 });
+        const started = Date.now();
+        const r = await resolve('rqxbft-fw.myshopify.com');
+        expect(Date.now() - started).toBeLessThan(1_000);
+        // Answered anyway, with the empty snapshot — the old behaviour, but only
+        // after actually waiting for the load rather than instead of waiting.
+        expect(r.ok && r.tenant.catalog.current.loadedAt).toBeNull();
+    });
+    test('the branded resolver gets the same wait', async () => {
+        const refreshes = [];
+        const resolve = singleShopResolver({
+            store: resolveStorefront({
+                id: 'moody',
+                server: { name: 'moody', title: 'Moody' },
+                shopify: { mode: 'env', shopDomain: 'rqxbft-fw.myshopify.com' },
+                urls: { appUrl: 'https://shopify.curless.ai/moody' },
+                legal: {},
+            }),
+            catalog: fakeCatalog('cold', { refreshes }),
+            tokens: { get: async () => token() },
+            coldStartWaitMs: 50,
+        });
+        const r = await resolve();
+        expect(refreshes).toEqual(['cold']);
+        expect(r.ok && r.tenant.catalog.current.loadedAt).not.toBeNull();
+    });
+});
 //# sourceMappingURL=tenant.test.js.map

package/dist/__tests__/tenant.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.test.js","sourceRoot":"","sources":["../../src/__tests__/tenant.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGtF,4EAA4E;AAC5E,gFAAgF;AAChF,mDAAmD;AACnD,MAAM,WAAW,GAAG,CAAC,GAAW,EAAE,EAAE,CAClC,CAAC,EAAE,GAAG,EAAE,CAAmE,CAAC;AAE9E,MAAM,KAAK,GAAG,CAAC,UAAU,GAAG,yBAAyB,EAAe,EAAE,CAAC,CAAC;IACtE,UAAU;IACV,WAAW,EAAE,GAAG;IAChB,KAAK,EAAE,eAAe;IACtB,WAAW,EAAE,0BAA0B;CACxC,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,IAA4B,EAAE,EAAE,CAC9C,kBAAkB,CAAC;IACjB,KAAK,EAAE,iBAAiB,CAAC;QACvB,EAAE,EAAE,OAAO;QACX,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE;QACzC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,yBAAyB,EAAE;QAC/D,IAAI,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE;QACpD,KAAK,EAAE,EAAE;KACV,CAAC;IACF,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC;IAC9B,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAwB;CACrF,CAAC,CAAC;AAEL,MAAM,KAAK,GAAG,CAAC,SAAmB,EAAE,EAAE;IACpC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAkB;QAC9B,GAAG,EAAE,CAAC,CAAS,EAAE,EAAE;YACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;KACF,CAAC;IACF,MAAM,MAAM,GAAqB;QAC/B,GAAG,EAAE,KAAK,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;KACpE,CAAC;IACF,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACxD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC,CAAC;AAEF,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,IAAI,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,yBAAyB,CAAC,CAAC;QACvE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,wEAAwE;IACxE,kEAAkE;IAClE,IAAI,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,4BAA4B,CAAC,CAAC;QAC1E,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,IAAI,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC3E,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC3C,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACvE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC5C,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpD,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC3C,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACzD,qEAAqE;QACrE,+CAA+C;QAC/C,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,IAAI,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC3E,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACnF,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,OAAO,CACnF,oBAAoB,CACrB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"tenant.test.js","sourceRoot":"","sources":["../../src/__tests__/tenant.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAWtF,MAAM,WAAW,GAAG,CAClB,GAAW,EACX,OAAuE,EAAE,EAC5D,EAAE;IACf,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,EAAe,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtF,OAAO;QACL,GAAG;QACH,IAAI,OAAO;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAC5E,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,CAAC;KACwB,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,KAAK,GAAG,CAAC,UAAU,GAAG,yBAAyB,EAAe,EAAE,CAAC,CAAC;IACtE,UAAU;IACV,WAAW,EAAE,GAAG;IAChB,KAAK,EAAE,eAAe;IACtB,WAAW,EAAE,0BAA0B;CACxC,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,IAA4B,EAAE,EAAE,CAC9C,kBAAkB,CAAC;IACjB,KAAK,EAAE,iBAAiB,CAAC;QACvB,EAAE,EAAE,OAAO;QACX,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE;QACzC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,yBAAyB,EAAE;QAC/D,IAAI,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE;QACpD,KAAK,EAAE,EAAE;KACV,CAAC;IACF,OAAO,EAAE,WAAW,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAChD,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAwB;CACrF,CAAC,CAAC;AAEL,MAAM,KAAK,GAAG,CAAC,SAAmB,EAAE,OAA+C,EAAE,EAAE,EAAE;IACvF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAkB;QAC9B,GAAG,EAAE,CAAC,CAAS,EAAE,EAAE;YACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO,WAAW,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QACtF,CAAC;KACF,CAAC;IACF,MAAM,MAAM,GAAqB;QAC/B,GAAG,EAAE,KAAK,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;KACpE,CAAC;IACF,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7E,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACzC,CAAC,CAAC;AAEF,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,IAAI,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,yBAAyB,CAAC,CAAC;QACvE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,wEAAwE;IACxE,kEAAkE;IAClE,IAAI,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,4BAA4B,CAAC,CAAC;QAC1E,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,IAAI,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC3E,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC3C,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,0EAA0E;IAC1E,IAAI,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACvE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC5C,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpD,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC3C,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACzD,qEAAqE;QACrE,+CAA+C;QAC/C,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,IAAI,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC3E,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACnF,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,OAAO,CACnF,oBAAoB,CACrB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,8CAA8C;AAC9C,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,2EAA2E;AAC3E,iFAAiF;AACjF,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,IAAI,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,yBAAyB,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,yBAAyB,CAAC,CAAC;QACnD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAClE,MAAM,OAAO,CAAC,yBAAyB,CAAC,CAAC;QACzC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACvE,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC,yBAAyB,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACzF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,yBAAyB,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACjD,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,kBAAkB,CAAC;YACjC,KAAK,EAAE,iBAAiB,CAAC;gBACvB,EAAE,EAAE,OAAO;gBACX,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE;gBACzC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,yBAAyB,EAAE;gBAC/D,IAAI,EAAE,EAAE,MAAM,EAAE,kCAAkC,EAAE;gBACpD,KAAK,EAAE,EAAE;aACV,CAAC;YACF,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC;YAC3C,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,EAAE,EAAwB;YAC1D,eAAe,EAAE,EAAE;SACpB,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/index.js

@@ -54,7 +54,8 @@ import { Catalog } from './catalog.js';
 import { challengeFor } from './challenge.js';
 import { resolveStorefront } from './config.js';
 import { credentialsRejected, needsAuth } from './connection.js';
-import { docsPage, privacyPage } from './legal.js';
+import { docsPage, merchantTermsPage, privacyPage, securityPage, } from './legal.js';
+import { connectPage, connectedPage, escapeHtml, listedLandingPage, } from './listed-pages.js';
 import { loadStorefrontConfig } from './load-config.js';
 import { MultiTokenStore, isStorableShop } from './multi-token-store.js';
 import { exchangeCode, installUrl, isShopDomain, makeState, verifyCallbackHmac, verifyState, } from './oauth.js';
@@ -271,6 +272,10 @@ const brandAsset = (rel) => {
 const ICON_PNG = brandAsset(STORE.config.server.iconFile);
 const LOGO_PNG = brandAsset(STORE.config.server.logoFile);
 const MULTI = STORE.config.shopify.mode === 'oauth-install';
+// What the listed app's own pages say it is. Its `server.title` is OUR product's
+// name — the branded deployments put a merchant's there, which is exactly the
+// confusion the connected page must not repeat.
+const LISTED = { appUrl: APP_URL, productName: MERCHANT_NAME };
 /**
  * The shop a request is about.
  *
@@ -389,7 +394,23 @@ app.get('/docs', (c) => c.html(docsPage({ ...LEGAL, storefront: storefrontUrl()
 // Curless was rejected over three times, the answer has to be pointed at this
 // page; a store policy cannot answer it. See docs/moody-connector-listing.md.
 app.get('/privacy', (c) => c.html(privacyPage({ ...LEGAL, storefront: storefrontUrl() })));
-app.get('/terms', (c) => c.redirect(`${storefrontUrl()}/policies/terms-of-service`, 301));
+// ⚠️ TWO DIFFERENT THINGS, and the split is the same one the privacy page makes.
+//
+// A branded connector redirects to the MERCHANT's terms of sale: the shopper is
+// buying from them, and a second set from us would be a second answer to one
+// question. The listed app has no merchant to redirect to — that redirect
+// resolved to `<our own app url>/policies/terms-of-service`, verified 404 in
+// production on 2026-09-10 — and it is also the deployment that needs terms of
+// its own: Shopify's protected-customer-data questionnaire asks whether we have
+// a data-processing agreement with our merchants, and this page is it.
+// The written data-protection strategy. Only where there are merchants to make
+// it to — a branded connector's merchant has their own.
+if (MULTI) {
+    app.get('/security', (c) => c.html(securityPage({ ...LEGAL, storefront: storefrontUrl() })));
+}
+app.get('/terms', (c) => MULTI
+    ? c.html(merchantTermsPage({ ...LEGAL, storefront: storefrontUrl() }))
+    : c.redirect(`${storefrontUrl()}/policies/terms-of-service`, 301));
 // Product images, re-served from OUR origin.
 //
 // The card is drawn in a sandboxed iframe whose CSP the host sets, and Claude's
@@ -468,6 +489,26 @@ app.get('/img', async (c) => {
     }
 });
 app.get('/healthz', async (c) => {
+    // ⚠️ The listed app has no single shop, and answering as if it did made this
+    // endpoint report `not-installed` with an empty shop domain forever — a health
+    // check that is wrong in precisely the state it exists to detect.
+    //
+    // What can actually be wrong here is a token that stopped renewing: this is
+    // the first deployment whose tokens expire, and a refresh that has been
+    // failing shows up as a deadline in the past long before a merchant notices
+    // their assistant has gone quiet.
+    if (MULTI) {
+        const shops = await multiTokens.list();
+        const now = Date.now();
+        const stale = shops.filter((t) => t.expiresAt !== undefined && Date.parse(t.expiresAt) < now).length;
+        return c.json({
+            status: stale > 0 ? 'degraded' : 'ok',
+            mode: 'listed',
+            shops: shops.length,
+            staleTokens: stale,
+            residentCatalogs: registry.size,
+        });
+    }
     const snap = catalog.current;
     const connected = (await shopifyConfig()) !== null;
     return c.json({
@@ -521,6 +562,44 @@ app.get('/', async (c) => {
        <p class="muted">No sign-in, and no payment happens here — checkout is on
        ${escapeHtml(MERCHANT_NAME)}' own page. <a href="/docs">What this connector can reach</a>.</p>`);
     }
+    // ⚠️ EVERYTHING BELOW ASSUMES ONE SHOP. `catalog`, `shopifyConfig()` and
+    // SHOP_DOMAIN are the branded deployment's single tenant. The listed app has
+    // no shop of its own, and running that code anyway is what put "Connect " —
+    // an empty shop name, behind a link that 400s — on the page a merchant lands
+    // on the moment they finish installing.
+    //
+    // Three states, decided by the shop in the query:
+    //   • no shop        — what this is. Nothing tenant-specific, and no list of
+    //                      who has installed it.
+    //   • shop, no token — offer the install, and start it outright when the
+    //                      query is Shopify's own (HMAC and all), so a merchant
+    //                      who just clicked Install is not asked to click Connect.
+    //   • shop + token   — connected, and THE ADDRESS THEY NEED: nothing else in
+    //                      the product tells a merchant what to paste into
+    //                      ChatGPT or Claude.
+    if (MULTI) {
+        const named = (c.req.query('shop') ?? '').trim().toLowerCase();
+        if (!named)
+            return c.html(listedLandingPage(LISTED));
+        // The same allow-list the token store keys on. `shop` decides where the
+        // button below sends someone, so a lookalike domain must not reach it.
+        if (!isStorableShop(named))
+            return c.text('that is not a Shopify store domain', 400);
+        if (await multiTokens.get(named)) {
+            const cat = registry.for(named);
+            // First view after an install: the catalogue was created a moment ago and
+            // its boot fetch is still in flight. `refresh()` joins that one rather
+            // than starting a second, so this waits for the load instead of telling a
+            // merchant with a full store that it has no products.
+            if (cat.current.loadedAt === null)
+                await cat.refresh();
+            return c.html(connectedPage(LISTED, named, cat.current));
+        }
+        if (CLIENT_SECRET && verifyCallbackHmac(CLIENT_SECRET, new URL(c.req.url).search)) {
+            return c.redirect(installUrl({ ...oauth, shopDomain: named }, makeState(CLIENT_SECRET)));
+        }
+        return c.html(connectPage(named));
+    }
     const snap = catalog.current;
     const connected = (await shopifyConfig()) !== null;
     // Shopify sends the merchant HERE after a legacy-flow install, with ?shop=…
@@ -680,7 +759,14 @@ app.get('/auth/callback', async (c) => {
     if (!code)
         return c.text('missing code', 400);
     try {
-        const { accessToken, scope, refreshToken, expiresAt } = await exchangeCode(oauth, code);
+        // ⚠️ THE SHOP COMES FROM THE CALLBACK, NOT FROM THE CONFIG. `oauth` carries
+        // the BRANDED deployment's single shop; the listed app's is `''`, because
+        // its shop is whoever is installing. Passing `oauth` here built
+        // `https:///admin/oauth/access_token` and every install on the listed app
+        // died with `fetch failed` — the install route already spreads the shop in,
+        // and this one, three hundred lines away, did not. `shopEndpoint` now
+        // refuses an empty shop out loud so the next one cannot be silent.
+        const { accessToken, scope, refreshToken, expiresAt } = await exchangeCode({ ...oauth, shopDomain: shop }, code);
         // Per-shop in the listed app, single-file in a branded one. The record is
         // the same; where it lands is the whole difference between serving one
         // merchant and serving many.
@@ -701,6 +787,16 @@ app.get('/auth/callback', async (c) => {
             await tokens.set(record);
         console.log(`[oauth] installed on ${shop} (scopes: ${scope})`);
         // The catalog is empty until now; fill it before the merchant looks.
+        //
+        // ⚠️ THE RIGHT ONE. `catalog` is the branded deployment's single tenant, and
+        // in the listed app it belongs to no shop at all — so an install refreshed
+        // nothing, and then told the merchant that "Curless Storefront is
+        // connected", which is OUR product's name rather than their store's.
+        if (MULTI) {
+            const cat = registry.for(shop);
+            await cat.refresh();
+            return c.html(connectedPage(LISTED, shop.toLowerCase(), cat.current));
+        }
         void catalog.refresh();
         return c.html(`<!doctype html><meta charset="utf-8"><link rel="icon" href="./icon.png"><title>Connected</title>
        <body style="font-family:system-ui;padding:40px;max-width:32rem">
@@ -734,18 +830,6 @@ app.get('/.well-known/openai-apps-challenge', (c) => {
         return c.notFound();
     return c.text(token);
 });
-// Anything interpolated into the page below comes from our own env, but escape
-// it anyway: the day one of these becomes merchant-supplied, the page should not
-// be the thing that has to be remembered.
-const escapeHtml = (s) => s.replace(/[&<>"']/g, (ch) => ch === '&'
-    ? '&amp;'
-    : ch === '<'
-        ? '&lt;'
-        : ch === '>'
-            ? '&gt;'
-            : ch === '"'
-                ? '&quot;'
-                : '&#39;');
 // The MCP Apps card. Declared on the tools AND on their results — a host reads
 // it from either — and served over resources/read. Version the URI: hosts cache
 // by it, and a stale card is worse than no card because it looks current.