@foir/sdk 0.11.0 → 0.12.0

package/dist/graphql/client.d.ts

@@ -6,7 +6,7 @@
  * Consumers that bring their own GraphQL client (Apollo/urql/react-query) use
  * the generated `TypedDocumentNode`s directly and replicate those two headers.
  */
-export { foirRequest, isFoirPreview, absolutiseFoirMediaUrl, FOIR_CDN_BASE, FoirRequestError, } from './foir-request';
+export { foirRequest, isFoirPreview, absolutiseFoirMediaUrl, FOIR_CDN_BASE, FoirRequestError, FoirAuthDowngradedError, FoirSessionExpiredError, } from './foir-request';
 export type { FoirEnv, FoirRequestOptions } from './foir-request';
 /**
  * Failure classification. Branch on these rather than on `err.message`: the

package/dist/graphql/foir-request.d.ts

@@ -24,7 +24,7 @@
  */
 import type { TypedDocumentNode } from '@graphql-typed-document-node/core';
 import { type FoirEnv, type FoirRequestOptions } from '../transport/foir-http';
-export { FoirRequestError, isFoirPreview, isFoirRateLimited, isFoirUnauthenticated, isFoirForbidden, isFoirNotFound, readFoirRateLimit, type FoirEnv, type FoirErrorCode, type FoirErrorExtensions, type FoirGraphQLErrorItem, type FoirRateLimitSnapshot, type FoirRequestOptions, type FoirAuthDowngrade, } from '../transport/foir-http';
+export { FoirRequestError, FoirAuthDowngradedError, FoirSessionExpiredError, isFoirPreview, isFoirRateLimited, isFoirUnauthenticated, isFoirForbidden, isFoirNotFound, readFoirRateLimit, type FoirEnv, type FoirErrorCode, type FoirErrorExtensions, type FoirGraphQLErrorItem, type FoirRateLimitSnapshot, type FoirRequestOptions, type FoirAuthDowngrade, } from '../transport/foir-http';
 export { withFoirRetry, foirRetryDelayMs, type FoirRetryPolicy, } from '../transport/retry';
 /** Default Foir CDN origin used to absolutise relative media URLs. */
 export declare const FOIR_CDN_BASE = "https://cdn.foir.dev/";

package/dist/next.js

@@ -87,7 +87,12 @@ var FoirRequestError = class extends Error {
    * failed on the first attempt for an hour.
    */
   get retryable() {
-    if (this.status === void 0) return true;
+    if (this.status === void 0) {
+      if (this.graphQLErrors?.length || this.prunedSelections?.length) {
+        return this.code === "RATE_LIMITED" || this.code === "UNAVAILABLE" || this.code === "TIMEOUT";
+      }
+      return true;
+    }
     if (this.status === 429 || this.code === "RATE_LIMITED") return true;
     if (this.status >= 500) return true;
     return this.code === "UNAVAILABLE" || this.code === "TIMEOUT";
@@ -117,6 +122,7 @@ function refuseCredentialHeaders(extra) {
     }
   }
 }
+var FOIR_VISITOR_IP_HEADER = "X-Foir-Visitor-IP";
 function buildFoirHeaders(input) {
   const headers = {
     "Content-Type": "application/json"
@@ -141,6 +147,9 @@ function buildFoirHeaders(input) {
     if (input.orgUrl) {
       headers["X-Org-Url"] = input.orgUrl;
     }
+    if (input.visitorAddress) {
+      headers[FOIR_VISITOR_IP_HEADER] = input.visitorAddress;
+    }
   }
   if (input.extra) {
     for (const [key, value] of Object.entries(input.extra)) {
@@ -156,6 +165,26 @@ function foirApiEndpoint(apiUrl, path) {
   }
   return base + path;
 }
+var FoirAuthDowngradedError = class extends FoirRequestError {
+  downgrade;
+  constructor(downgrade) {
+    super(
+      `[foir] your customer token was ${downgrade.customerToken} (${downgrade.reason}), so the request was served as ${downgrade.servedAs}`,
+      { graphQLErrors: [{ message: "customer token rejected", extensions: { code: "AUTH_DOWNGRADED" } }] }
+    );
+    this.name = "FoirAuthDowngradedError";
+    this.downgrade = downgrade;
+  }
+};
+var FoirSessionExpiredError = class extends FoirRequestError {
+  constructor(options) {
+    super("[foir] the customer session has expired and could not be refreshed: sign in again", {
+      cause: options?.cause,
+      graphQLErrors: [{ message: "session expired", extensions: { code: "SESSION_EXPIRED" } }]
+    });
+    this.name = "FoirSessionExpiredError";
+  }
+};
 var warnedDowngrade = null;
 function reportAuthDowngrade(envelope) {
   const downgrade = envelope.extensions?.auth;
@@ -188,6 +217,9 @@ function answeredAnything(data) {
   return typeof data === "object" && data !== null && Object.values(data).some((value) => value !== null && value !== void 0);
 }
 function readFoirEnvelope(json, options) {
+  if (options?.rejectDowngrade && json.extensions?.auth) {
+    throw new FoirAuthDowngradedError(json.extensions.auth);
+  }
   reportAuthDowngrade(json);
   refusePrunedDocument(json, options);
   if (json.errors?.length) {
@@ -706,6 +738,12 @@ function operationName(scope, op) {
 function foirDataEndpoint(apiUrl, path) {
   return foirApiEndpoint(apiUrl, path);
 }
+async function resolveVisitorAddress(config) {
+  const source = config.visitor;
+  const value = typeof source === "function" ? await source() : source;
+  const address = value?.trim();
+  return address ? address : void 0;
+}
 async function resolveBearerToken(config) {
   const source = config.bearerToken;
   if (typeof source === "function") return await source() ?? void 0;
@@ -738,6 +776,7 @@ async function resolveFoirAuth(config) {
       bearerToken,
       orgId: config.orgId,
       orgUrl: config.orgUrl,
+      visitorAddress: await resolveVisitorAddress(config),
       extra: config.headers
     }),
     key: { apiKey: config.apiKey, bearerToken }
@@ -761,7 +800,33 @@ async function executeFoirDocument(config, plan) {
   }
   return data[plan.rootField];
 }
+var renewing = /* @__PURE__ */ new WeakMap();
+function renewBearerOnce(refresh) {
+  const running = renewing.get(refresh);
+  if (running) return running;
+  const next = refresh().finally(() => renewing.delete(refresh));
+  renewing.set(refresh, next);
+  return next;
+}
 async function runFoirDocument(config, document, mutation, variables, options) {
+  try {
+    return await sendFoirDocument(config, document, mutation, variables, options);
+  } catch (err) {
+    const refresh = config.refreshBearer;
+    if (!(err instanceof FoirAuthDowngradedError) || !refresh || err.downgrade.reason === "wrong_project") {
+      throw err;
+    }
+    const token = err.downgrade.reason === "expired" ? await renewBearerOnce(refresh) : null;
+    if (!token) throw new FoirSessionExpiredError({ cause: err });
+    try {
+      return await sendFoirDocument({ ...config, bearerToken: token }, document, mutation, variables, options);
+    } catch (again) {
+      if (again instanceof FoirAuthDowngradedError) throw new FoirSessionExpiredError({ cause: again });
+      throw again;
+    }
+  }
+}
+async function sendFoirDocument(config, document, mutation, variables, options) {
   const doFetch = config.fetch ?? globalThis.fetch;
   const endpoint = foirDataEndpoint(config.apiUrl, "/graphql");
   const { headers, key } = await resolveFoirAuth(config);
@@ -810,7 +875,7 @@ async function runFoirDocument(config, document, mutation, variables, options) {
     });
   }
   const json = await res.json();
-  return readFoirEnvelope(json, options);
+  return readFoirEnvelope(json, { ...options, rejectDowngrade: Boolean(key?.bearerToken) });
 }
 async function readErrorBody(res) {
   try {
@@ -964,6 +1029,9 @@ async function customerProviderCallback(env, input) {
 async function saveSession(adapter, result) {
   await adapter.set(TOKEN_KEY, result.token);
   await adapter.set(REFRESH_KEY, result.refreshToken);
+  if (!result.customerId) {
+    return await getSessionCustomer(adapter) ?? { id: "", email: "" };
+  }
   await adapter.set(CUSTOMER_ID_KEY, result.customerId);
   await adapter.set(EMAIL_KEY, result.email);
   return { id: result.customerId, email: result.email };

package/dist/placement/index.d.ts

@@ -0,0 +1,129 @@
+/**
+ * `@foir/sdk/placement`: your app's own admin console, shown inside Foir's.
+ *
+ * A full-page placement is loaded in a frame on the Foir console. No cookie
+ * reaches a cross-site frame, so the console hands the page a short-lived token
+ * instead, by message, to your placement's origin only. The token is the
+ * operator looking at the page, acting through your app at the level your app
+ * is installed at, carrying the scopes your placement declares that this
+ * operator holds. Your page runs no login of its own.
+ *
+ * ```ts
+ * import { connectPlacement, FOIR_CONSOLE_ORIGINS } from '@foir/sdk/placement';
+ *
+ * const session = await connectPlacement({
+ *   apiUrl: 'https://api.foir.dev',
+ *   consoleOrigins: FOIR_CONSOLE_ORIGINS.production,
+ * });
+ * if (session.can('records:write:preorder')) showEditButtons();
+ * const data = await session.request('{ preorders { items { id } } }');
+ * ```
+ *
+ * The browser shows the page blank, however well it is authenticated, unless
+ * the page allows the console as a frame ancestor. Hydrogen and many other
+ * frameworks send `frame-ancestors 'none'` by default. `placementFrameAncestors`
+ * builds the header value; the console and the install preview list the origins
+ * your project needs.
+ */
+/** The messages the console and an embedded page exchange. */
+export declare const PLACEMENT_MESSAGE: {
+    /** Page to console: the page is listening and wants a token. */
+    readonly ready: "foir:placement:ready";
+    /** Console to page: a token. */
+    readonly token: "foir:placement:token";
+    /** Page to console: the token is about to lapse; a fresh one, please. */
+    readonly refresh: "foir:placement:refresh";
+    /** Console to page: no token, and why. */
+    readonly refused: "foir:placement:refused";
+    /** Console to page: the operator signed out. */
+    readonly signedOut: "foir:placement:signed-out";
+};
+/** What the console hands an embedded page. */
+export interface PlacementGrant {
+    /** The bearer for Foir's API. */
+    accessToken: string;
+    /** When it lapses, RFC 3339. The session asks for a fresh one before then. */
+    expiresAt: string;
+    /** The organisation the page acts at: your app's install. Empty for the project. */
+    orgId: string;
+    /** What the token carries. */
+    grantedScopes: string[];
+    /** What your placement declares that this operator does not hold, and why. */
+    withheld: {
+        scope: string;
+        reason: string;
+    }[];
+}
+/** A message the console sends an embedded page. */
+export type PlacementHostMessage = {
+    type: typeof PLACEMENT_MESSAGE.token;
+    grant: PlacementGrant;
+} | {
+    type: typeof PLACEMENT_MESSAGE.refused;
+    reason: string;
+} | {
+    type: typeof PLACEMENT_MESSAGE.signedOut;
+};
+/** A message an embedded page sends the console. */
+export type PlacementPageMessage = {
+    type: typeof PLACEMENT_MESSAGE.ready;
+} | {
+    type: typeof PLACEMENT_MESSAGE.refresh;
+};
+/**
+ * The Foir consoles, per environment. A project that serves the console on its
+ * own verified admin domain adds that origin too: the install preview lists it.
+ */
+export declare const FOIR_CONSOLE_ORIGINS: {
+    readonly production: readonly ["https://app.foir.io"];
+    readonly dev: readonly ["https://app-dev.foir.io"];
+};
+/**
+ * The `Content-Security-Policy` value that lets these consoles show your page:
+ * `frame-ancestors https://app.foir.io`. Set it on every response the
+ * placement's page serves.
+ */
+export declare function placementFrameAncestors(origins: readonly string[]): string;
+/** Why the console would not give the page a token. */
+export declare class PlacementRefused extends Error {
+    constructor(reason: string);
+}
+export interface ConnectPlacementOptions {
+    /** Foir's API, e.g. `https://api.foir.dev`. */
+    apiUrl: string;
+    /**
+     * The consoles your page accepts a token from. A message from any other
+     * origin is ignored, so a page framed elsewhere never receives one.
+     */
+    consoleOrigins: readonly string[];
+    /** How long to wait for the first token. Default 10 seconds. */
+    timeoutMs?: number;
+    /** How long before expiry to ask for a fresh token. Default 60 seconds. */
+    refreshBeforeMs?: number;
+    /** The page's window. Default the global one; tests pass their own. */
+    window?: Window;
+    /** The fetch the session's requests use. Default the global one. */
+    fetch?: typeof fetch;
+}
+/** An embedded page's connection to the console that showed it. */
+export interface PlacementSession {
+    /** The grant in force now. Replaced as the session refreshes. */
+    readonly grant: PlacementGrant;
+    /** Whether the token carries this scope, to hide or grey out what the operator cannot do. */
+    can(scope: string): boolean;
+    /** A GraphQL request to Foir's API as the operator, through your app. */
+    request<TResult = unknown>(document: string | {
+        toString(): string;
+    }, variables?: Record<string, unknown>): Promise<TResult>;
+    /** Called when the operator signs out; the session holds no token from then on. */
+    onSignedOut(listener: () => void): () => void;
+    /** Stop listening and refreshing. */
+    close(): void;
+}
+/**
+ * Connect an embedded page to the console showing it: tell the console the page
+ * is listening, wait for its token, and keep the token fresh while the page is
+ * open. Resolves with the session, or rejects with `PlacementRefused` when the
+ * console gives no token, or when none arrives in time.
+ */
+export declare function connectPlacement(options: ConnectPlacementOptions): Promise<PlacementSession>;

package/dist/placement.js

@@ -0,0 +1,144 @@
+// src/placement/index.ts
+var PLACEMENT_MESSAGE = {
+  /** Page to console: the page is listening and wants a token. */
+  ready: "foir:placement:ready",
+  /** Console to page: a token. */
+  token: "foir:placement:token",
+  /** Page to console: the token is about to lapse; a fresh one, please. */
+  refresh: "foir:placement:refresh",
+  /** Console to page: no token, and why. */
+  refused: "foir:placement:refused",
+  /** Console to page: the operator signed out. */
+  signedOut: "foir:placement:signed-out"
+};
+var FOIR_CONSOLE_ORIGINS = {
+  production: ["https://app.foir.io"],
+  dev: ["https://app-dev.foir.io"]
+};
+function placementFrameAncestors(origins) {
+  if (origins.length === 0) {
+    throw new Error("[foir] placementFrameAncestors needs at least one console origin");
+  }
+  for (const o of origins) {
+    let u;
+    try {
+      u = new URL(o);
+    } catch {
+      throw new Error(`[foir] placementFrameAncestors: ${JSON.stringify(o)} is not an origin`);
+    }
+    if (u.protocol !== "https:" || u.origin !== o) {
+      throw new Error(`[foir] placementFrameAncestors: ${JSON.stringify(o)} must be an https origin, such as https://app.foir.io`);
+    }
+  }
+  return `frame-ancestors ${origins.join(" ")}`;
+}
+var PlacementRefused = class extends Error {
+  constructor(reason) {
+    super(reason);
+    this.name = "PlacementRefused";
+  }
+};
+function isHostMessage(data) {
+  if (typeof data !== "object" || data === null) return false;
+  const t = data.type;
+  return t === PLACEMENT_MESSAGE.token || t === PLACEMENT_MESSAGE.refused || t === PLACEMENT_MESSAGE.signedOut;
+}
+function connectPlacement(options) {
+  const win = options.window ?? window;
+  const doFetch = options.fetch ?? fetch;
+  const timeoutMs = options.timeoutMs ?? 1e4;
+  const refreshBeforeMs = options.refreshBeforeMs ?? 6e4;
+  const allowed = new Set(options.consoleOrigins);
+  const apiUrl = options.apiUrl.replace(/\/+$/, "");
+  if (win.parent === win) {
+    return Promise.reject(new PlacementRefused("this page is not inside the Foir console, so there is no console to give it a token"));
+  }
+  return new Promise((resolve, reject) => {
+    let grant = null;
+    let settled = false;
+    let refreshTimer;
+    const signedOut = /* @__PURE__ */ new Set();
+    const post = (message) => {
+      win.parent.postMessage(message, "*");
+    };
+    const scheduleRefresh = () => {
+      clearTimeout(refreshTimer);
+      if (!grant) return;
+      const due = Date.parse(grant.expiresAt) - Date.now() - refreshBeforeMs;
+      refreshTimer = setTimeout(() => post({ type: PLACEMENT_MESSAGE.refresh }), Math.max(0, due));
+    };
+    const close = () => {
+      clearTimeout(refreshTimer);
+      clearTimeout(timeout);
+      win.removeEventListener("message", onMessage);
+    };
+    const session = {
+      get grant() {
+        if (!grant) throw new PlacementRefused("the operator has signed out");
+        return grant;
+      },
+      can: (scope) => grant?.grantedScopes.includes(scope) ?? false,
+      async request(document, variables) {
+        if (!grant) throw new PlacementRefused("the operator has signed out");
+        const res = await doFetch(`${apiUrl}/graphql`, {
+          method: "POST",
+          headers: { "content-type": "application/json", authorization: `Bearer ${grant.accessToken}` },
+          body: JSON.stringify({ query: String(document), variables: variables ?? {} })
+        });
+        const body = await res.json().catch(() => ({}));
+        if (!res.ok || body.errors && body.errors.length > 0) {
+          const messages = body.errors?.map((e) => e.message).join("; ") || `HTTP ${res.status}`;
+          throw new Error(`[foir] placement request failed: ${messages}`);
+        }
+        return body.data;
+      },
+      onSignedOut(listener) {
+        signedOut.add(listener);
+        return () => signedOut.delete(listener);
+      },
+      close
+    };
+    function onMessage(event) {
+      if (event.source !== win.parent || !allowed.has(event.origin) || !isHostMessage(event.data)) return;
+      const msg = event.data;
+      switch (msg.type) {
+        case PLACEMENT_MESSAGE.token:
+          grant = msg.grant;
+          scheduleRefresh();
+          if (!settled) {
+            settled = true;
+            clearTimeout(timeout);
+            resolve(session);
+          }
+          return;
+        case PLACEMENT_MESSAGE.refused:
+          if (!settled) {
+            settled = true;
+            close();
+            reject(new PlacementRefused(msg.reason));
+          }
+          return;
+        case PLACEMENT_MESSAGE.signedOut:
+          grant = null;
+          close();
+          for (const l of signedOut) l();
+          return;
+      }
+    }
+    const timeout = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      close();
+      reject(new PlacementRefused(`no token arrived from the Foir console within ${timeoutMs} ms`));
+    }, timeoutMs);
+    win.addEventListener("message", onMessage);
+    post({ type: PLACEMENT_MESSAGE.ready });
+  });
+}
+export {
+  FOIR_CONSOLE_ORIGINS,
+  PLACEMENT_MESSAGE,
+  PlacementRefused,
+  connectPlacement,
+  placementFrameAncestors
+};

package/dist/push.js

@@ -68,7 +68,12 @@ var FoirRequestError = class extends Error {
    * failed on the first attempt for an hour.
    */
   get retryable() {
-    if (this.status === void 0) return true;
+    if (this.status === void 0) {
+      if (this.graphQLErrors?.length || this.prunedSelections?.length) {
+        return this.code === "RATE_LIMITED" || this.code === "UNAVAILABLE" || this.code === "TIMEOUT";
+      }
+      return true;
+    }
     if (this.status === 429 || this.code === "RATE_LIMITED") return true;
     if (this.status >= 500) return true;
     return this.code === "UNAVAILABLE" || this.code === "TIMEOUT";
@@ -119,6 +124,7 @@ function refuseCredentialHeaders(extra) {
     }
   }
 }
+var FOIR_VISITOR_IP_HEADER = "X-Foir-Visitor-IP";
 function buildFoirHeaders(input) {
   const headers = {
     "Content-Type": "application/json"
@@ -143,6 +149,9 @@ function buildFoirHeaders(input) {
     if (input.orgUrl) {
       headers["X-Org-Url"] = input.orgUrl;
     }
+    if (input.visitorAddress) {
+      headers[FOIR_VISITOR_IP_HEADER] = input.visitorAddress;
+    }
   }
   if (input.extra) {
     for (const [key, value] of Object.entries(input.extra)) {
@@ -158,6 +167,26 @@ function foirApiEndpoint(apiUrl, path) {
   }
   return base + path;
 }
+var FoirAuthDowngradedError = class extends FoirRequestError {
+  downgrade;
+  constructor(downgrade) {
+    super(
+      `[foir] your customer token was ${downgrade.customerToken} (${downgrade.reason}), so the request was served as ${downgrade.servedAs}`,
+      { graphQLErrors: [{ message: "customer token rejected", extensions: { code: "AUTH_DOWNGRADED" } }] }
+    );
+    this.name = "FoirAuthDowngradedError";
+    this.downgrade = downgrade;
+  }
+};
+var FoirSessionExpiredError = class extends FoirRequestError {
+  constructor(options) {
+    super("[foir] the customer session has expired and could not be refreshed: sign in again", {
+      cause: options?.cause,
+      graphQLErrors: [{ message: "session expired", extensions: { code: "SESSION_EXPIRED" } }]
+    });
+    this.name = "FoirSessionExpiredError";
+  }
+};
 var warnedDowngrade = null;
 function reportAuthDowngrade(envelope) {
   const downgrade = envelope.extensions?.auth;
@@ -190,6 +219,9 @@ function answeredAnything(data) {
   return typeof data === "object" && data !== null && Object.values(data).some((value) => value !== null && value !== void 0);
 }
 function readFoirEnvelope(json, options) {
+  if (options?.rejectDowngrade && json.extensions?.auth) {
+    throw new FoirAuthDowngradedError(json.extensions.auth);
+  }
   reportAuthDowngrade(json);
   refusePrunedDocument(json, options);
   if (json.errors?.length) {
@@ -314,7 +346,7 @@ async function foirRequest(env, document, variables, options) {
     );
   }
   const json = await res.json();
-  return readFoirEnvelope(json);
+  return readFoirEnvelope(json, { rejectDowngrade: options?.rejectDowngrade });
 }
 async function readErrorEnvelope(res) {
   let errors;
@@ -819,6 +851,12 @@ function operationName(scope, op) {
 function foirDataEndpoint(apiUrl, path) {
   return foirApiEndpoint(apiUrl, path);
 }
+async function resolveVisitorAddress(config) {
+  const source = config.visitor;
+  const value = typeof source === "function" ? await source() : source;
+  const address = value?.trim();
+  return address ? address : void 0;
+}
 async function resolveBearerToken(config) {
   const source = config.bearerToken;
   if (typeof source === "function") return await source() ?? void 0;
@@ -851,6 +889,7 @@ async function resolveFoirAuth(config) {
       bearerToken,
       orgId: config.orgId,
       orgUrl: config.orgUrl,
+      visitorAddress: await resolveVisitorAddress(config),
       extra: config.headers
     }),
     key: { apiKey: config.apiKey, bearerToken }
@@ -874,7 +913,33 @@ async function executeFoirDocument(config, plan) {
   }
   return data[plan.rootField];
 }
+var renewing = /* @__PURE__ */ new WeakMap();
+function renewBearerOnce(refresh) {
+  const running = renewing.get(refresh);
+  if (running) return running;
+  const next = refresh().finally(() => renewing.delete(refresh));
+  renewing.set(refresh, next);
+  return next;
+}
 async function runFoirDocument(config, document, mutation, variables, options) {
+  try {
+    return await sendFoirDocument(config, document, mutation, variables, options);
+  } catch (err) {
+    const refresh = config.refreshBearer;
+    if (!(err instanceof FoirAuthDowngradedError) || !refresh || err.downgrade.reason === "wrong_project") {
+      throw err;
+    }
+    const token = err.downgrade.reason === "expired" ? await renewBearerOnce(refresh) : null;
+    if (!token) throw new FoirSessionExpiredError({ cause: err });
+    try {
+      return await sendFoirDocument({ ...config, bearerToken: token }, document, mutation, variables, options);
+    } catch (again) {
+      if (again instanceof FoirAuthDowngradedError) throw new FoirSessionExpiredError({ cause: again });
+      throw again;
+    }
+  }
+}
+async function sendFoirDocument(config, document, mutation, variables, options) {
   const doFetch = config.fetch ?? globalThis.fetch;
   const endpoint = foirDataEndpoint(config.apiUrl, "/graphql");
   const { headers, key } = await resolveFoirAuth(config);
@@ -923,7 +988,7 @@ async function runFoirDocument(config, document, mutation, variables, options) {
     });
   }
   const json = await res.json();
-  return readFoirEnvelope(json, options);
+  return readFoirEnvelope(json, { ...options, rejectDowngrade: Boolean(key?.bearerToken) });
 }
 async function readErrorBody(res) {
   try {
@@ -1068,6 +1133,9 @@ async function customerRefreshToken(env, refreshToken) {
 async function saveSession(adapter, result) {
   await adapter.set(TOKEN_KEY, result.token);
   await adapter.set(REFRESH_KEY, result.refreshToken);
+  if (!result.customerId) {
+    return await getSessionCustomer(adapter) ?? { id: "", email: "" };
+  }
   await adapter.set(CUSTOMER_ID_KEY, result.customerId);
   await adapter.set(EMAIL_KEY, result.email);
   return { id: result.customerId, email: result.email };
@@ -1081,6 +1149,12 @@ async function clearSession(adapter) {
 async function getSessionToken(adapter) {
   return await adapter.get(TOKEN_KEY) ?? null;
 }
+async function getSessionCustomer(adapter) {
+  const id = await adapter.get(CUSTOMER_ID_KEY) ?? null;
+  const email = await adapter.get(EMAIL_KEY) ?? null;
+  if (!id) return null;
+  return { id, email: email ?? "" };
+}
 async function refreshSession(adapter, env) {
   const refreshToken = await adapter.get(REFRESH_KEY) ?? null;
   if (!refreshToken) return null;
@@ -1100,21 +1174,55 @@ function isAuthExpiredError(err) {
     (e) => /authentication required/i.test(e.message)
   );
 }
-async function authedRequest(adapter, env, document, variables) {
+var refreshing = /* @__PURE__ */ new WeakMap();
+function refreshSessionOnce(adapter, env) {
+  const running = refreshing.get(adapter);
+  if (running) return running;
+  const next = refreshSession(adapter, env).finally(() => refreshing.delete(adapter));
+  refreshing.set(adapter, next);
+  return next;
+}
+function sessionLapse(err) {
+  if (err instanceof FoirAuthDowngradedError) {
+    switch (err.downgrade.reason) {
+      case "expired":
+        return "refresh";
+      case "invalid":
+        return "expired";
+      default:
+        return null;
+    }
+  }
+  return isAuthExpiredError(err) ? "refresh" : null;
+}
+async function withSessionRefresh(adapter, env, run) {
   const token = await getSessionToken(adapter);
   try {
-    return await foirRequest(env, document, variables, {
-      bearerToken: token ?? void 0
-    });
+    return await run(token ?? void 0);
   } catch (err) {
-    if (!isAuthExpiredError(err)) throw err;
-    const refreshed = await refreshSession(adapter, env);
-    if (!refreshed) throw err;
-    return foirRequest(env, document, variables, {
-      bearerToken: refreshed.token
-    });
+    const lapse = sessionLapse(err);
+    if (!lapse) throw err;
+    if (lapse === "expired") throw new FoirSessionExpiredError({ cause: err });
+    const refreshed = await refreshSessionOnce(adapter, env);
+    if (!refreshed) {
+      if (err instanceof FoirAuthDowngradedError) throw new FoirSessionExpiredError({ cause: err });
+      throw err;
+    }
+    try {
+      return await run(refreshed.token);
+    } catch (again) {
+      if (again instanceof FoirAuthDowngradedError) throw new FoirSessionExpiredError({ cause: again });
+      throw again;
+    }
   }
 }
+async function authedRequest(adapter, env, document, variables) {
+  return withSessionRefresh(
+    adapter,
+    env,
+    (bearerToken) => foirRequest(env, document, variables, { bearerToken, rejectDowngrade: true })
+  );
+}
 
 // src/push/operations.ts
 import { parse } from "graphql";