@hiclimba/client 0.0.2 → 0.0.3

package/README.md

@@ -17,7 +17,6 @@ const toasty = new ToastyClient({
   appId: process.env.TOASTY_APP_ID!,
   keyId: process.env.TOASTY_KEY_ID!,
   secret: process.env.TOASTY_SECRET!,
-  apiUrl: process.env.TOASTY_API_URL!,
 });
 
 const identified = await toasty.identify({
@@ -26,10 +25,29 @@ const identified = await toasty.identify({
 });
 ```
 
+The default API URL is `https://api.hiclimba.com`. Pass `apiUrl` only when you
+need to target a local, staging, or private API deployment.
+
 `identify()` returns `customerApiToken`. It is a random Toasty app-installation
 lookup token. It is not signed, encrypted, expiring, rotatable, privileged app
 auth, or any kind of Shopify token.
 
+If your backend already has a Shopify Admin delegate token for a known
+installation, server mode can push it to Toasty:
+
+```ts
+await toasty.pushShopifyAdminDelegateToken({
+  shop: 'merchant.myshopify.com',
+  delegateToken: '<shopify-admin-delegate-token>',
+  expiresAt: '2026-07-02T12:00:00.000Z',
+  accessScopes: ['read_products']
+});
+```
+
+Toasty validates the token against Shopify with a minimal Admin GraphQL request
+before storing it encrypted on the existing installation. The pushed token is
+server-side only and must never be sent from browser code.
+
 ## Customer Mode
 
 Customer mode uses the Toasty app ID plus the `customerApiToken` returned by
@@ -39,7 +57,6 @@ Customer mode uses the Toasty app ID plus the `customerApiToken` returned by
 const toasty = new ToastyClient({
   appId: '<toasty-app-id>',
   customerApiToken: '<customer-api-token>',
-  apiUrl: 'https://api.toasty.dev',
 });
 
 const customer = await toasty.getCustomer();
@@ -60,6 +77,7 @@ Authorization: Bearer custok_...
 ## Top-Level Methods
 
 - `identify`
+- `pushShopifyAdminDelegateToken`
 - `getCustomer`
 - `evaluateFeature`
 - `isFeatureEnabled`

package/lib/toasty-client.d.ts

@@ -1,4 +1,5 @@
-import type { ICancelSubscriptionInput, ICancelSubscriptionResponse, ICreateOneTimeChargeInput, ICreateOneTimeChargeResponse, ICreateSubscriptionInput, ICreateSubscriptionResponse, IGetCustomerResponse, IGetUsageMetricReportInput, IGetUsageMetricReportResponse, IIdentifyInput, IIdentifyResponse, IPublicCustomerDto, IPublicCustomerFeatureDto, IPublicCustomerPlanDto, IPublicCustomerSubscriptionDto, IPublicCustomerUsageMetricDto, ITrackUsageEventBatchInput, ITrackUsageEventBatchResponse, ITrackUsageEventInput, ITrackUsageEventResponse, IUpdateSubscriptionInput, IUpdateSubscriptionResponse, IPlanDiscount } from './toasty-client.types.js';
+import type { ICancelSubscriptionInput, ICancelSubscriptionResponse, ICreateOneTimeChargeInput, ICreateOneTimeChargeResponse, ICreateSubscriptionInput, ICreateSubscriptionResponse, IGetCustomerResponse, IGetUsageMetricReportInput, IGetUsageMetricReportResponse, IIdentifyInput, IIdentifyResponse, IPublicCustomerDto, IPublicCustomerFeatureDto, IPublicCustomerPlanDto, IPublicCustomerSubscriptionDto, IPublicCustomerUsageMetricDto, ITrackUsageEventBatchInput, ITrackUsageEventBatchResponse, ITrackUsageEventInput, ITrackUsageEventResponse, IUpdateSubscriptionInput, IUpdateSubscriptionResponse, IPushShopifyAdminDelegateTokenInput, IPushShopifyAdminDelegateTokenResponse, IPlanDiscount } from './toasty-client.types.js';
+export declare const DEFAULT_API_URL = "https://api.hiclimba.com";
 export type Customer = IPublicCustomerDto;
 export type Plan = IPublicCustomerPlanDto;
 export type Subscription = IPublicCustomerSubscriptionDto;
@@ -13,14 +14,14 @@ export interface IToastyServerClientConfig {
     appId: string;
     keyId: string;
     secret: string;
-    apiUrl: string;
+    apiUrl?: string;
     fetch?: typeof fetch;
     allowBrowserServerCredentials?: boolean;
 }
 export interface IToastyCustomerClientConfig {
     appId: string;
     customerApiToken: string;
-    apiUrl: string;
+    apiUrl?: string;
     fetch?: typeof fetch;
 }
 export type IToastyClientConfig = IToastyServerClientConfig | IToastyCustomerClientConfig;
@@ -68,6 +69,7 @@ export declare class ToastyClient {
     private readonly fetchImpl;
     constructor(config: IToastyClientConfig);
     identify(input: IIdentifyInput): ToastyResult<IIdentifyResponse>;
+    pushShopifyAdminDelegateToken(input: IPushShopifyAdminDelegateTokenInput): ToastyResult<IPushShopifyAdminDelegateTokenResponse>;
     getCustomer(input?: {
         customerId?: string;
     }): ToastyResult<IGetCustomerResponse>;

package/lib/toasty-client.js

@@ -1,4 +1,5 @@
 import { createHash, createHmac, hkdfSync } from 'node:crypto';
+export const DEFAULT_API_URL = 'https://api.hiclimba.com';
 const HMAC_SIGNATURE_PREFIX = 'v1=';
 const SIGNING_KEY_INFO = 'toasty-hmac-signing-key-v1';
 export function sha256HexRawBody(rawBody) {
@@ -60,7 +61,8 @@ export class ToastyClient {
     fetchImpl;
     constructor(config) {
         assertConfigValue('appId', config.appId);
-        assertConfigValue('apiUrl', config.apiUrl);
+        const apiUrl = config.apiUrl ?? DEFAULT_API_URL;
+        assertConfigValue('apiUrl', apiUrl);
         if (isServerConfig(config)) {
             assertConfigValue('keyId', config.keyId);
             assertConfigValue('secret', config.secret);
@@ -72,7 +74,7 @@ export class ToastyClient {
             assertConfigValue('customerApiToken', config.customerApiToken);
         }
         this.config = config;
-        this.apiUrl = normalizeApiUrl(config.apiUrl);
+        this.apiUrl = normalizeApiUrl(apiUrl);
         this.fetchImpl = config.fetch ?? fetch;
     }
     identify(input) {
@@ -80,6 +82,10 @@ export class ToastyClient {
         assertNoShopifyTokenFields(input);
         return this.post('/v1/identify', input);
     }
+    pushShopifyAdminDelegateToken(input) {
+        this.assertServerMode('pushShopifyAdminDelegateToken');
+        return this.post('/v1/shopify-admin/delegate-token', input);
+    }
     getCustomer(input = {}) {
         if (isServerConfig(this.config)) {
             if (!input.customerId) {

package/lib/toasty-client.types.d.ts

@@ -183,6 +183,20 @@ export interface IIdentifyResponse {
     customerApiToken: string;
     customer: IPublicCustomerDto;
 }
+export interface IPushShopifyAdminDelegateTokenInput {
+    shop: string;
+    delegateToken: string;
+    expiresAt?: string;
+    expiresInSeconds?: number;
+    accessScopes?: string[];
+}
+export interface IPushShopifyAdminDelegateTokenResponse {
+    ok: true;
+    installationId: string;
+    myshopifyDomain: string;
+    shopifyShopId?: string;
+    expiresAt?: string;
+}
 export interface ICreateSubscriptionInput {
     shop?: string;
     returnUrl: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hiclimba/client",
-  "version": "0.0.2",
+  "version": "0.0.3",
   "description": "Node SDK for Toasty product backends and customer-scoped API access.",
   "license": "MIT",
   "private": false,