@moonbase.sh/storefront-api 3.5.1 → 3.7.0

package/README.md

@@ -110,6 +110,68 @@ another tenant's) arrives as the same `NotFoundError`, so that a signed-in
 customer cannot use it to enumerate a merchant's group IDs. Joining twice
 succeeds and changes nothing.
 
+### Captchas on sign-up
+
+A merchant can ask customers to solve a captcha before they sign up. The vendor
+says whether this store does:
+
+```ts
+const vendor = await client.vendor.get()
+const captcha = vendor.features?.captcha // { url } when it does, null or undefined when not
+```
+
+`captcha.url` is a page on the store's own `<account-id>.moonbase.sh` that draws
+the challenge. Embed it in an iframe with `action=signup`, and it hands you the
+solution with `postMessage`:
+
+```ts
+const src = new URL(captcha.url)
+src.searchParams.set('action', 'signup') // optional: theme=light|dark|auto, size=normal|compact
+
+const frame = document.createElement('iframe')
+frame.src = src.href
+frame.title = 'Captcha'
+frame.style.cssText = 'border: none; color-scheme: normal; width: 300px; height: 65px'
+form.append(frame)
+
+let captchaToken: string | undefined
+window.addEventListener('message', (event) => {
+  if (event.source !== frame.contentWindow || event.origin !== src.origin || event.data?.source !== 'moonbase-captcha')
+    return
+  if (event.data.event === 'resize')
+    Object.assign(frame.style, { width: `${event.data.width}px`, height: `${event.data.height}px` })
+  else if (event.data.event === 'token')
+    captchaToken = event.data.token
+  else // 'expired', or 'error' with a `code` ('load-failed' when the challenge could not load)
+    captchaToken = undefined
+})
+```
+
+Then pass the solution along, and reset the frame after every attempt, since a
+solution is good for one:
+
+```ts
+try {
+  await client.identity.signUp('Jane', 'jane@example.com', 'password', null, true, true, true, {
+    captchaToken,
+  })
+}
+catch (err) {
+  if (err instanceof CaptchaRequiredError)
+    showError(err.message) // the API's own copy, safe to show
+  throw err
+}
+finally {
+  captchaToken = undefined
+  frame.contentWindow?.postMessage({ source: 'moonbase-captcha', command: 'reset' }, src.origin)
+}
+```
+
+Without a solution, or with one that is expired or already used, the sign-up is
+refused with `CaptchaRequiredError` (a `MoonbaseError`). A site with a
+Content-Security-Policy has to allow the store's `https://<account-id>.moonbase.sh`
+in `frame-src`.
+
 ## Inventory flow
 
 Most inventory endpoints require an authenticated user:

package/dist/index.cjs

@@ -25,6 +25,7 @@ __export(index_exports, {
   ActivationRequestStatus: () => ActivationRequestStatus,
   ActivationStatus: () => ActivationStatus,
   Architecture: () => Architecture,
+  CaptchaRequiredError: () => CaptchaRequiredError,
   CartUtils: () => CartUtils,
   ConnectableAccountProvider: () => ConnectableAccountProvider,
   ConsoleLogger: () => ConsoleLogger,
@@ -50,6 +51,7 @@ __export(index_exports, {
   SubscriptionCancellationReason: () => SubscriptionCancellationReason,
   SubscriptionStatus: () => SubscriptionStatus,
   TokenStore: () => TokenStore,
+  accessTokenLifetime: () => accessTokenLifetime,
   imageWidths: () => imageWidths,
   isLocalStorageAvailable: () => isLocalStorageAvailable,
   isPromotionDisplay: () => isPromotionDisplay,
@@ -459,7 +461,10 @@ var activationRequestSchema = import_zod4.z.object({
     requiresAccount: import_zod4.z.boolean(),
     requiresNewsletterOptIn: import_zod4.z.boolean(),
     numberOfDaysPerProduct: import_zod4.z.number(),
-    numberOfDaysRemaining: import_zod4.z.number()
+    numberOfDaysRemaining: import_zod4.z.number(),
+    // The trial never expires, so the day counts are not worth showing. Absent from a backend that
+    // predates endless trials.
+    endless: import_zod4.z.boolean().default(false)
   }).optional(),
   licenseEligibility: import_zod4.z.object({
     eligible: import_zod4.z.boolean()
@@ -657,6 +662,12 @@ var MoonbaseError = class extends Error {
     }
   }
 };
+var CaptchaRequiredError = class extends MoonbaseError {
+  constructor(detail, title) {
+    super(title != null ? title : "Captcha required", detail != null ? detail : "Please confirm you're not a robot.", 400);
+    this.name = "CaptchaRequiredError";
+  }
+};
 
 // src/utils/problemDetails.ts
 var import_zod7 = require("zod");
@@ -699,6 +710,8 @@ async function handleResponseProblem(response, logger) {
   logger.debug("The response indicates a problem", problemDetails);
   if (problemDetails.errorType === "StoreClosed")
     throw new StoreClosedError(problemDetails.detail);
+  if (problemDetails.errorType === "CaptchaRequired")
+    throw new CaptchaRequiredError(problemDetails.detail, problemDetails.title);
   throw new MoonbaseError(
     problemDetails.title,
     problemDetails.detail,
@@ -835,7 +848,8 @@ var IdentityEndpoints = class {
         "Accept": "application/json",
         "Content-Type": "application/json",
         "x-mb-cors": "1",
-        "x-mb-client": this.api.clientHeader
+        "x-mb-client": this.api.clientHeader,
+        ...(options == null ? void 0 : options.captchaToken) ? { "X-MB-CAPTCHA": options.captchaToken } : {}
       },
       body: JSON.stringify({
         name,
@@ -864,8 +878,13 @@ var IdentityEndpoints = class {
     this.tokenStore.setUser(identity);
     return { status: "signed-in", user: userSchema.parse(identity) };
   }
+  /**
+   * Signs the buyer out here at once, and ends the session on the server so its refresh
+   * token stops working too. Resolves once the server has answered, and never rejects:
+   * the buyer is signed out in this browser whatever happens to that request.
+   */
   async signOut() {
-    this.tokenStore.clear();
+    await this.tokenStore.signOut();
   }
   async update(name, email, emailConfirmationToken, communicationPreferences) {
     const response = await this.api.authenticatedFetch("/api/customer/identity", userSchema, {
@@ -1098,7 +1117,7 @@ var ProductEndpoints = class {
 var import_zod14 = require("zod");
 
 // package.json
-var version = "3.5.1";
+var version = "3.7.0";
 
 // src/utils/client.ts
 function buildClientHeader(sdk) {
@@ -1777,24 +1796,36 @@ var InMemoryStore = class {
 };
 
 // src/utils/tokenStore.ts
+var defaultAccessTokenLifetime = 15 * 60 * 1e3;
+var renewBeforeExpiry = 5 * 60 * 1e3;
+var expiryMargin = 30 * 1e3;
+var refreshLockName = "moonbase_auth_refresh";
+function accessTokenLifetime(accessToken) {
+  try {
+    const payload = accessToken.split(".")[1].replaceAll("-", "+").replaceAll("_", "/");
+    const claims = JSON.parse(atob(payload.padEnd(Math.ceil(payload.length / 4) * 4, "=")));
+    const lifetime = (Number(claims.exp) - Number(claims.iat)) * 1e3;
+    if (Number.isFinite(lifetime) && lifetime > 0 && lifetime <= 24 * 60 * 60 * 1e3)
+      return lifetime;
+  } catch (e) {
+  }
+  return defaultAccessTokenLifetime;
+}
 var _TokenStore = class _TokenStore {
   constructor(configuration) {
     this.configuration = configuration;
     this.tokens = null;
     this.refreshTimeoutId = null;
     this.refreshPromise = null;
+    this.waitingForVisibility = false;
+    this.sessionEndedListeners = [];
     var _a, _b;
     this.logger = (_a = configuration.logger) != null ? _a : new ConsoleLogger();
     this.store = (_b = configuration.store) != null ? _b : isLocalStorageAvailable() ? new LocalStorageStore((err) => this.warnAboutStorage(err)) : new InMemoryStore();
     if (typeof window !== "undefined" && !configuration.store && !(this.store instanceof LocalStorageStore))
       this.warnAboutStorage();
-    const storedToken = this.store.get(_TokenStore.storageKey);
-    if (storedToken) {
-      this.tokens = {
-        ...storedToken,
-        expiresAt: new Date(storedToken.expiresAt)
-      };
-    }
+    this.tokens = this.readStoredTokens();
+    this.scheduleRefresh();
     this.store.listen(_TokenStore.storageKey, (updatedTokens) => this.handleStorageUpdate(updatedTokens));
   }
   get user() {
@@ -1828,29 +1859,91 @@ var _TokenStore = class _TokenStore {
     } else {
       this.tokens = {
         ...identity,
-        // Hardcoded 15 minutes now, might want to check the JWT tho
-        expiresAt: new Date((/* @__PURE__ */ new Date()).getTime() + 15 * 60 * 1e3)
+        expiresAt: new Date(Date.now() + accessTokenLifetime(identity.accessToken))
       };
     }
     this.store.set(_TokenStore.storageKey, this.tokens);
-    if (typeof window !== "undefined") {
-      if (this.refreshTimeoutId != null)
-        window.clearTimeout(this.refreshTimeoutId);
-      this.refreshTimeoutId = window.setTimeout(() => {
-        this.startRefresh().catch((err) => this.logger.warn("Could not refresh access token", err));
-      }, 10 * 60 * 1e3);
-    }
+    this.scheduleRefresh();
     return this.tokens;
   }
   clear() {
     this.tokens = null;
     this.store.remove(_TokenStore.storageKey);
-    if (this.refreshTimeoutId != null && typeof window !== "undefined")
-      window.clearTimeout(this.refreshTimeoutId);
+    this.scheduleRefresh();
     return null;
   }
+  async signOut() {
+    const tokens = this.tokens;
+    this.clear();
+    if (!tokens)
+      return;
+    try {
+      await fetch(`${this.configuration.endpoint}/api/customer/identity/revoke?token=${encodeURIComponent(tokens.refreshToken)}`, {
+        method: "POST",
+        keepalive: true,
+        headers: {
+          "Accept": "application/json",
+          "Content-Type": "text/plain",
+          "x-mb-cors": "1",
+          "x-mb-client": buildClientHeader(this.configuration.sdk)
+        },
+        body: tokens.accessToken
+      });
+    } catch (err) {
+      this.logger.warn("Could not end the session on the server", err);
+    }
+  }
+  onSessionEnded(listener) {
+    this.sessionEndedListeners.push(listener);
+  }
   get isExpired() {
-    return this.tokens != null && this.tokens.expiresAt < /* @__PURE__ */ new Date();
+    return this.tokens != null && this.tokens.expiresAt.getTime() - expiryMargin < Date.now();
+  }
+  readStoredTokens() {
+    const stored = this.store.get(_TokenStore.storageKey);
+    return stored ? { ...stored, expiresAt: new Date(stored.expiresAt) } : null;
+  }
+  /**
+   * (Re)arms the timer that renews the access token shortly before it runs out, or disarms
+   * it when there is nothing to renew. Every tab arms one, and `refreshTokens` makes sure
+   * only one of them actually renews.
+   */
+  scheduleRefresh() {
+    if (typeof window === "undefined")
+      return;
+    if (this.refreshTimeoutId != null)
+      window.clearTimeout(this.refreshTimeoutId);
+    this.refreshTimeoutId = null;
+    if (!this.tokens)
+      return;
+    const delay = Math.max(0, this.renewalDueAt(this.tokens) - Date.now());
+    this.refreshTimeoutId = window.setTimeout(() => this.renewInBackground(), delay);
+  }
+  renewalDueAt(tokens) {
+    const lead = Math.min(renewBeforeExpiry, accessTokenLifetime(tokens.accessToken) / 3);
+    return tokens.expiresAt.getTime() - lead;
+  }
+  renewInBackground() {
+    var _a;
+    this.refreshTimeoutId = null;
+    if (!this.tokens)
+      return;
+    if (this.renewalDueAt(this.tokens) > Date.now()) {
+      this.scheduleRefresh();
+      return;
+    }
+    if (typeof document !== "undefined" && document.visibilityState === "hidden") {
+      if (!this.waitingForVisibility) {
+        this.waitingForVisibility = true;
+        document.addEventListener("visibilitychange", () => {
+          this.waitingForVisibility = false;
+          this.renewInBackground();
+        }, { once: true });
+      }
+      return;
+    }
+    const pending = (_a = this.refreshPromise) != null ? _a : this.startRefresh();
+    pending.catch((err) => this.logger.warn("Could not refresh access token", err));
   }
   /**
    * Start a refresh and hold it so concurrent callers join it rather than firing
@@ -1867,7 +1960,45 @@ var _TokenStore = class _TokenStore {
     this.refreshPromise = pending;
     return pending;
   }
+  /**
+   * A refresh token can be used once: the server answers a second use by revoking the
+   * session, taking it for a stolen token. So refreshes are serialised across every tab of
+   * the origin, and whoever gets the lock second takes up what the first one stored rather
+   * than spending the same refresh token again. The stored copy has to be read, not waited
+   * for: storage events never reach the document that wrote them, so a second client on
+   * the same page would not hear about it.
+   */
   async refreshTokens() {
+    var _a;
+    const spending = (_a = this.tokens) == null ? void 0 : _a.refreshToken;
+    const locks = typeof navigator !== "undefined" ? navigator.locks : void 0;
+    if (locks == null ? void 0 : locks.request) {
+      let held = false;
+      try {
+        return await locks.request(refreshLockName, () => {
+          held = true;
+          return this.refreshHoldingLock(spending);
+        });
+      } catch (err) {
+        if (held)
+          throw err;
+      }
+    }
+    return await this.refreshHoldingLock(spending);
+  }
+  /**
+   * @param spending The refresh token this refresh set out to use. If the session has moved
+   * on from it while we waited for the lock, someone else has renewed already.
+   */
+  async refreshHoldingLock(spending) {
+    var _a;
+    const stored = this.readStoredTokens();
+    if (stored && stored.refreshToken !== ((_a = this.tokens) == null ? void 0 : _a.refreshToken))
+      this.tokens = stored;
+    if (this.tokens && this.tokens.refreshToken !== spending && !this.isExpired) {
+      this.scheduleRefresh();
+      return this.tokens;
+    }
     if (!this.tokens)
       throw new Error("No tokens found to refresh");
     const response = await fetch(`${this.configuration.endpoint}/api/customer/identity/refresh?token=${encodeURIComponent(this.tokens.refreshToken)}`, {
@@ -1883,6 +2014,13 @@ var _TokenStore = class _TokenStore {
     if (response.status !== 200) {
       if (response.status === 403 || response.status === 404) {
         this.clear();
+        for (const listener of this.sessionEndedListeners) {
+          try {
+            listener();
+          } catch (err) {
+            this.logger.warn("A listener for the end of the session failed", err);
+          }
+        }
         return null;
       }
       throw new MoonbaseError("Unexpected result", `Could not refresh access token, status code ${response.status}`, response.status);
@@ -1893,11 +2031,10 @@ var _TokenStore = class _TokenStore {
   }
   handleStorageUpdate(updatedTokens) {
     this.tokens = updatedTokens;
-    if (this.refreshTimeoutId != null && typeof window !== "undefined")
-      window.clearTimeout(this.refreshTimeoutId);
     if (this.tokens) {
       this.tokens.expiresAt = new Date(this.tokens.expiresAt);
     }
+    this.scheduleRefresh();
   }
   warnAboutStorage(err) {
     this.logger.warn(
@@ -1912,13 +2049,26 @@ var TokenStore = _TokenStore;
 // src/vendor/schemas.ts
 var schemas_exports9 = {};
 __export(schemas_exports9, {
+  vendorCaptchaSchema: () => vendorCaptchaSchema,
+  vendorFeaturesSchema: () => vendorFeaturesSchema,
   vendorSchema: () => vendorSchema
 });
 var import_zod15 = require("zod");
+var vendorCaptchaSchema = import_zod15.z.object({
+  url: import_zod15.z.string()
+});
+var vendorFeaturesSchema = import_zod15.z.object({
+  customerPortal: import_zod15.z.boolean().optional(),
+  phoneNumber: import_zod15.z.boolean().optional(),
+  marketingConsent: import_zod15.z.nativeEnum(MarketingConsentType).optional().catch(void 0),
+  // Absent on backends from before captchas, which never ask for one.
+  captcha: vendorCaptchaSchema.nullish()
+});
 var vendorSchema = import_zod15.z.object({
   id: import_zod15.z.string(),
   name: import_zod15.z.string(),
-  logoUrl: import_zod15.z.string().nullable()
+  logoUrl: import_zod15.z.string().nullable(),
+  features: vendorFeaturesSchema.optional()
 });
 
 // src/vendor/endpoints.ts
@@ -2614,6 +2764,7 @@ var MoonbaseClient = class {
   ActivationRequestStatus,
   ActivationStatus,
   Architecture,
+  CaptchaRequiredError,
   CartUtils,
   ConnectableAccountProvider,
   ConsoleLogger,
@@ -2639,6 +2790,7 @@ var MoonbaseClient = class {
   SubscriptionCancellationReason,
   SubscriptionStatus,
   TokenStore,
+  accessTokenLifetime,
   imageWidths,
   isLocalStorageAvailable,
   isPromotionDisplay,

package/dist/index.d.cts

@@ -80,18 +80,28 @@ declare class InMemoryStore implements IStore {
 type IdentityWithExpiry = Identity & {
     expiresAt: Date;
 };
+/**
+ * How long the server issued an access token for, from its `iat` and `exp`. The lifetime rather than
+ * `exp` itself, measured against this browser's clock from the moment the token arrives: a clock that is
+ * minutes off would otherwise make every token look expired, or none.
+ */
+declare function accessTokenLifetime(accessToken: string): number;
 interface ITokenStore {
     get user(): User | null;
     get isPersistent(): boolean;
     getAccessToken: () => Promise<string | null>;
     setUser: (user: Identity | User) => User | null;
     clear: () => void;
+    signOut: () => Promise<void>;
+    onSessionEnded: (listener: () => void) => void;
 }
 declare class TokenStore implements ITokenStore {
     private configuration;
     private tokens;
     private refreshTimeoutId;
     private refreshPromise;
+    private waitingForVisibility;
+    private readonly sessionEndedListeners;
     private readonly store;
     private readonly logger;
     static readonly storageKey = "moonbase_auth";
@@ -101,7 +111,18 @@ declare class TokenStore implements ITokenStore {
     getAccessToken(): Promise<string | null>;
     setUser(user: Identity | User): IdentityWithExpiry | null;
     clear(): null;
+    signOut(): Promise<void>;
+    onSessionEnded(listener: () => void): void;
     private get isExpired();
+    private readStoredTokens;
+    /**
+     * (Re)arms the timer that renews the access token shortly before it runs out, or disarms
+     * it when there is nothing to renew. Every tab arms one, and `refreshTokens` makes sure
+     * only one of them actually renews.
+     */
+    private scheduleRefresh;
+    private renewalDueAt;
+    private renewInBackground;
     /**
      * Start a refresh and hold it so concurrent callers join it rather than firing
      * their own. The slot is cleared as soon as it settles: a retained promise
@@ -110,7 +131,20 @@ declare class TokenStore implements ITokenStore {
      * anonymous ones) for the rest of the session.
      */
     private startRefresh;
+    /**
+     * A refresh token can be used once: the server answers a second use by revoking the
+     * session, taking it for a stolen token. So refreshes are serialised across every tab of
+     * the origin, and whoever gets the lock second takes up what the first one stored rather
+     * than spending the same refresh token again. The stored copy has to be read, not waited
+     * for: storage events never reach the document that wrote them, so a second client on
+     * the same page would not hear about it.
+     */
     private refreshTokens;
+    /**
+     * @param spending The refresh token this refresh set out to use. If the session has moved
+     * on from it while we waited for the lock, someone else has renewed already.
+     */
+    private refreshHoldingLock;
     private handleStorageUpdate;
     private warnAboutStorage;
 }
@@ -797,6 +831,7 @@ declare const activationRequestSchema: z.ZodObject<{
         requiresNewsletterOptIn: z.ZodBoolean;
         numberOfDaysPerProduct: z.ZodNumber;
         numberOfDaysRemaining: z.ZodNumber;
+        endless: z.ZodDefault<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
         eligible: boolean;
         existing: boolean;
@@ -804,6 +839,7 @@ declare const activationRequestSchema: z.ZodObject<{
         requiresNewsletterOptIn: boolean;
         numberOfDaysPerProduct: number;
         numberOfDaysRemaining: number;
+        endless: boolean;
     }, {
         eligible: boolean;
         existing: boolean;
@@ -811,6 +847,7 @@ declare const activationRequestSchema: z.ZodObject<{
         requiresNewsletterOptIn: boolean;
         numberOfDaysPerProduct: number;
         numberOfDaysRemaining: number;
+        endless?: boolean | undefined;
     }>>;
     licenseEligibility: z.ZodOptional<z.ZodObject<{
         eligible: z.ZodBoolean;
@@ -937,6 +974,7 @@ declare const activationRequestSchema: z.ZodObject<{
         requiresNewsletterOptIn: boolean;
         numberOfDaysPerProduct: number;
         numberOfDaysRemaining: number;
+        endless: boolean;
     } | undefined;
     licenseEligibility?: {
         eligible: boolean;
@@ -1059,6 +1097,7 @@ declare const activationRequestSchema: z.ZodObject<{
         requiresNewsletterOptIn: boolean;
         numberOfDaysPerProduct: number;
         numberOfDaysRemaining: number;
+        endless?: boolean | undefined;
     } | undefined;
     licenseEligibility?: {
         eligible: boolean;
@@ -1677,6 +1716,15 @@ interface SignUpOptions {
      * ID left in a form can never fail a registration.
      */
     groupIds?: string[];
+    /**
+     * The customer's solution to the store's captcha, for stores that ask for one
+     * (`vendor.features.captcha`). Sent in the `X-MB-CAPTCHA` header.
+     *
+     * Without it (or with one that does not check out) such a store refuses the
+     * sign-up with a `CaptchaRequiredError`. Solutions are single-use and expire
+     * after about two minutes, so reset the captcha after every attempt.
+     */
+    captchaToken?: string;
 }
 
 declare class IdentityEndpoints {
@@ -1687,6 +1735,11 @@ declare class IdentityEndpoints {
     get(): Promise<User>;
     signIn(email: string, password: string): Promise<User>;
     signUp(name: string, email: string, password: string, address: Address | null | undefined, acceptedPrivacyPolicy: boolean, acceptedTermsAndConditions: boolean, communicationOptIn?: boolean, options?: SignUpOptions): Promise<SignUpResult>;
+    /**
+     * Signs the buyer out here at once, and ends the session on the server so its refresh
+     * token stops working too. Resolves once the server has answered, and never rejects:
+     * the buyer is signed out in this browser whatever happens to that request.
+     */
     signOut(): Promise<void>;
     update(name: string | null, email: string, emailConfirmationToken?: string, communicationPreferences?: CommunicationPreferences): Promise<{
         needsEmailConfirmationToken: boolean;
@@ -24989,26 +25042,110 @@ declare class StorefrontEndpoints {
     }>;
 }
 
+/**
+ * The captcha a store asks customers to solve before signing up and checking out. `url` is a
+ * page on the store's own `<account-id>.moonbase.sh` that draws the challenge: embed it in an
+ * iframe, and it hands the solution to its parent with `postMessage`.
+ */
+declare const vendorCaptchaSchema: z.ZodObject<{
+    url: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    url: string;
+}, {
+    url: string;
+}>;
+declare const vendorFeaturesSchema: z.ZodObject<{
+    customerPortal: z.ZodOptional<z.ZodBoolean>;
+    phoneNumber: z.ZodOptional<z.ZodBoolean>;
+    marketingConsent: z.ZodCatch<z.ZodOptional<z.ZodNativeEnum<typeof MarketingConsentType>>>;
+    captcha: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        url: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        url: string;
+    }, {
+        url: string;
+    }>>>;
+}, "strip", z.ZodTypeAny, {
+    customerPortal?: boolean | undefined;
+    phoneNumber?: boolean | undefined;
+    marketingConsent?: MarketingConsentType | undefined;
+    captcha?: {
+        url: string;
+    } | null | undefined;
+}, {
+    customerPortal?: boolean | undefined;
+    phoneNumber?: boolean | undefined;
+    marketingConsent?: unknown;
+    captcha?: {
+        url: string;
+    } | null | undefined;
+}>;
 declare const vendorSchema: z.ZodObject<{
     id: z.ZodString;
     name: z.ZodString;
     logoUrl: z.ZodNullable<z.ZodString>;
+    features: z.ZodOptional<z.ZodObject<{
+        customerPortal: z.ZodOptional<z.ZodBoolean>;
+        phoneNumber: z.ZodOptional<z.ZodBoolean>;
+        marketingConsent: z.ZodCatch<z.ZodOptional<z.ZodNativeEnum<typeof MarketingConsentType>>>;
+        captcha: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            url: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            url: string;
+        }, {
+            url: string;
+        }>>>;
+    }, "strip", z.ZodTypeAny, {
+        customerPortal?: boolean | undefined;
+        phoneNumber?: boolean | undefined;
+        marketingConsent?: MarketingConsentType | undefined;
+        captcha?: {
+            url: string;
+        } | null | undefined;
+    }, {
+        customerPortal?: boolean | undefined;
+        phoneNumber?: boolean | undefined;
+        marketingConsent?: unknown;
+        captcha?: {
+            url: string;
+        } | null | undefined;
+    }>>;
 }, "strip", z.ZodTypeAny, {
     id: string;
     name: string;
     logoUrl: string | null;
+    features?: {
+        customerPortal?: boolean | undefined;
+        phoneNumber?: boolean | undefined;
+        marketingConsent?: MarketingConsentType | undefined;
+        captcha?: {
+            url: string;
+        } | null | undefined;
+    } | undefined;
 }, {
     id: string;
     name: string;
     logoUrl: string | null;
+    features?: {
+        customerPortal?: boolean | undefined;
+        phoneNumber?: boolean | undefined;
+        marketingConsent?: unknown;
+        captcha?: {
+            url: string;
+        } | null | undefined;
+    } | undefined;
 }>;
 
+declare const schemas$4_vendorCaptchaSchema: typeof vendorCaptchaSchema;
+declare const schemas$4_vendorFeaturesSchema: typeof vendorFeaturesSchema;
 declare const schemas$4_vendorSchema: typeof vendorSchema;
 declare namespace schemas$4 {
-  export { schemas$4_vendorSchema as vendorSchema };
+  export { schemas$4_vendorCaptchaSchema as vendorCaptchaSchema, schemas$4_vendorFeaturesSchema as vendorFeaturesSchema, schemas$4_vendorSchema as vendorSchema };
 }
 
 type Vendor = z.infer<typeof vendorSchema>;
+type VendorFeatures = z.infer<typeof vendorFeaturesSchema>;
+type VendorCaptcha = z.infer<typeof vendorCaptchaSchema>;
 
 declare class VendorEndpoints {
     private api;
@@ -47026,6 +47163,17 @@ declare class MoonbaseError extends Error {
     readonly errors?: Record<string, string> | undefined;
     constructor(title: string, detail: string | undefined, status?: number | undefined, errors?: Record<string, string> | undefined);
 }
+/**
+ * The store asks customers to solve a captcha (see `Vendor.features.captcha`), and the request
+ * carried none, or one that did not check out: unsolved, expired, already used, or solved on a
+ * site that is not one of the store's. `message` is the API's own copy for the customer, safe to
+ * show as is. Solutions are single-use, so reset the captcha and let them try again.
+ *
+ * A `MoonbaseError` like any other refusal, so code that already handles those keeps working.
+ */
+declare class CaptchaRequiredError extends MoonbaseError {
+    constructor(detail?: string, title?: string);
+}
 
 /**
  * Cleans up merchant-authored group IDs before they go on the wire.
@@ -47206,4 +47354,4 @@ declare class MoonbaseClient {
     orders: OrderEndpoints;
 }
 
-export { type Activation, ActivationMethod, type ActivationRequest, ActivationRequestFulfillmentType, ActivationRequestStatus, ActivationStatus, type Address, Architecture, type BundleLineItem, type CartCatalog, type CartOrder, type CartTotal, type CartTotalCondition, CartUtils, type CommunicationPreferences, type CommunicationPreferencesInput, type CommunicationPreferencesView, type CompletedOrder, ConnectableAccountProvider, type ConnectedAccount, ConsoleLogger, CycleLength, type Discount, DiscountUtils, type Download, type DownloadManifest, type ILogger, type IRecurrence, type IStore, type ITokenStore, type Identity, type ImageFit, type ImageFormat, type ImageTransform, ImageUtils, InMemoryStore, type License, LicenseStatus, type LineItem, type LineItemTotal, LocalStorageStore, LogLevel, MarketingConsentType, type MilestoneProgress, type Money, type MoneyCollection, MoneyCollectionUtils, MoonbaseApi, MoonbaseClient, type MoonbaseConfiguration, MoonbaseError, NotAuthenticatedError, NotAuthorizedError, NotFoundError, type OfferCondition, type OfferConditionContext, type OfferProgress, type OfferScope, OfferUtils, type OpenOrder, type Order, OrderStatus, type OrderTotal, type OwnedProduct, type Page, Platform, type PricingTier, type PricingVariation, type ProblemDetails, type ProductLineItem, type PromotionDisplay, type Quantifiable, type RawPropertyArray, type RawPropertyObject, type RawPropertyValue, type SignUpOptions, type SignUpResult, type SingleOrMultiple, StoreClosedError, type Storefront, type StorefrontBundle, type StorefrontOffer, type StorefrontOfferTarget, type StorefrontProduct, type StorefrontPromotion, type StorefrontPromotionCta, type StorefrontPromotionTarget, type SubscribeInput, type SubscribeResponse, type Subscription, type SubscriptionCancellationFeedback, SubscriptionCancellationReason, SubscriptionStatus, type TaxEstimate, TokenStore, type UrchinTrackingModule, type User, type UserAccountConfirmed, type UserAccountConfirmedStatus, type Vendor, type Voucher, imageWidths, isLocalStorageAvailable, isPromotionDisplay, isTransformableImageUrl, maxImageDimension, normalizeGroupIds, objectToQuery, parseOffSiteReferrer, problemDetailsSchema, promotionDisplays, resolveUtm, schemas, utmToObject };
+export { type Activation, ActivationMethod, type ActivationRequest, ActivationRequestFulfillmentType, ActivationRequestStatus, ActivationStatus, type Address, Architecture, type BundleLineItem, CaptchaRequiredError, type CartCatalog, type CartOrder, type CartTotal, type CartTotalCondition, CartUtils, type CommunicationPreferences, type CommunicationPreferencesInput, type CommunicationPreferencesView, type CompletedOrder, ConnectableAccountProvider, type ConnectedAccount, ConsoleLogger, CycleLength, type Discount, DiscountUtils, type Download, type DownloadManifest, type ILogger, type IRecurrence, type IStore, type ITokenStore, type Identity, type ImageFit, type ImageFormat, type ImageTransform, ImageUtils, InMemoryStore, type License, LicenseStatus, type LineItem, type LineItemTotal, LocalStorageStore, LogLevel, MarketingConsentType, type MilestoneProgress, type Money, type MoneyCollection, MoneyCollectionUtils, MoonbaseApi, MoonbaseClient, type MoonbaseConfiguration, MoonbaseError, NotAuthenticatedError, NotAuthorizedError, NotFoundError, type OfferCondition, type OfferConditionContext, type OfferProgress, type OfferScope, OfferUtils, type OpenOrder, type Order, OrderStatus, type OrderTotal, type OwnedProduct, type Page, Platform, type PricingTier, type PricingVariation, type ProblemDetails, type ProductLineItem, type PromotionDisplay, type Quantifiable, type RawPropertyArray, type RawPropertyObject, type RawPropertyValue, type SignUpOptions, type SignUpResult, type SingleOrMultiple, StoreClosedError, type Storefront, type StorefrontBundle, type StorefrontOffer, type StorefrontOfferTarget, type StorefrontProduct, type StorefrontPromotion, type StorefrontPromotionCta, type StorefrontPromotionTarget, type SubscribeInput, type SubscribeResponse, type Subscription, type SubscriptionCancellationFeedback, SubscriptionCancellationReason, SubscriptionStatus, type TaxEstimate, TokenStore, type UrchinTrackingModule, type User, type UserAccountConfirmed, type UserAccountConfirmedStatus, type Vendor, type VendorCaptcha, type VendorFeatures, type Voucher, accessTokenLifetime, imageWidths, isLocalStorageAvailable, isPromotionDisplay, isTransformableImageUrl, maxImageDimension, normalizeGroupIds, objectToQuery, parseOffSiteReferrer, problemDetailsSchema, promotionDisplays, resolveUtm, schemas, utmToObject };

package/dist/index.d.ts

@@ -80,18 +80,28 @@ declare class InMemoryStore implements IStore {
 type IdentityWithExpiry = Identity & {
     expiresAt: Date;
 };
+/**
+ * How long the server issued an access token for, from its `iat` and `exp`. The lifetime rather than
+ * `exp` itself, measured against this browser's clock from the moment the token arrives: a clock that is
+ * minutes off would otherwise make every token look expired, or none.
+ */
+declare function accessTokenLifetime(accessToken: string): number;
 interface ITokenStore {
     get user(): User | null;
     get isPersistent(): boolean;
     getAccessToken: () => Promise<string | null>;
     setUser: (user: Identity | User) => User | null;
     clear: () => void;
+    signOut: () => Promise<void>;
+    onSessionEnded: (listener: () => void) => void;
 }
 declare class TokenStore implements ITokenStore {
     private configuration;
     private tokens;
     private refreshTimeoutId;
     private refreshPromise;
+    private waitingForVisibility;
+    private readonly sessionEndedListeners;
     private readonly store;
     private readonly logger;
     static readonly storageKey = "moonbase_auth";
@@ -101,7 +111,18 @@ declare class TokenStore implements ITokenStore {
     getAccessToken(): Promise<string | null>;
     setUser(user: Identity | User): IdentityWithExpiry | null;
     clear(): null;
+    signOut(): Promise<void>;
+    onSessionEnded(listener: () => void): void;
     private get isExpired();
+    private readStoredTokens;
+    /**
+     * (Re)arms the timer that renews the access token shortly before it runs out, or disarms
+     * it when there is nothing to renew. Every tab arms one, and `refreshTokens` makes sure
+     * only one of them actually renews.
+     */
+    private scheduleRefresh;
+    private renewalDueAt;
+    private renewInBackground;
     /**
      * Start a refresh and hold it so concurrent callers join it rather than firing
      * their own. The slot is cleared as soon as it settles: a retained promise
@@ -110,7 +131,20 @@ declare class TokenStore implements ITokenStore {
      * anonymous ones) for the rest of the session.
      */
     private startRefresh;
+    /**
+     * A refresh token can be used once: the server answers a second use by revoking the
+     * session, taking it for a stolen token. So refreshes are serialised across every tab of
+     * the origin, and whoever gets the lock second takes up what the first one stored rather
+     * than spending the same refresh token again. The stored copy has to be read, not waited
+     * for: storage events never reach the document that wrote them, so a second client on
+     * the same page would not hear about it.
+     */
     private refreshTokens;
+    /**
+     * @param spending The refresh token this refresh set out to use. If the session has moved
+     * on from it while we waited for the lock, someone else has renewed already.
+     */
+    private refreshHoldingLock;
     private handleStorageUpdate;
     private warnAboutStorage;
 }
@@ -797,6 +831,7 @@ declare const activationRequestSchema: z.ZodObject<{
         requiresNewsletterOptIn: z.ZodBoolean;
         numberOfDaysPerProduct: z.ZodNumber;
         numberOfDaysRemaining: z.ZodNumber;
+        endless: z.ZodDefault<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
         eligible: boolean;
         existing: boolean;
@@ -804,6 +839,7 @@ declare const activationRequestSchema: z.ZodObject<{
         requiresNewsletterOptIn: boolean;
         numberOfDaysPerProduct: number;
         numberOfDaysRemaining: number;
+        endless: boolean;
     }, {
         eligible: boolean;
         existing: boolean;
@@ -811,6 +847,7 @@ declare const activationRequestSchema: z.ZodObject<{
         requiresNewsletterOptIn: boolean;
         numberOfDaysPerProduct: number;
         numberOfDaysRemaining: number;
+        endless?: boolean | undefined;
     }>>;
     licenseEligibility: z.ZodOptional<z.ZodObject<{
         eligible: z.ZodBoolean;
@@ -937,6 +974,7 @@ declare const activationRequestSchema: z.ZodObject<{
         requiresNewsletterOptIn: boolean;
         numberOfDaysPerProduct: number;
         numberOfDaysRemaining: number;
+        endless: boolean;
     } | undefined;
     licenseEligibility?: {
         eligible: boolean;
@@ -1059,6 +1097,7 @@ declare const activationRequestSchema: z.ZodObject<{
         requiresNewsletterOptIn: boolean;
         numberOfDaysPerProduct: number;
         numberOfDaysRemaining: number;
+        endless?: boolean | undefined;
     } | undefined;
     licenseEligibility?: {
         eligible: boolean;
@@ -1677,6 +1716,15 @@ interface SignUpOptions {
      * ID left in a form can never fail a registration.
      */
     groupIds?: string[];
+    /**
+     * The customer's solution to the store's captcha, for stores that ask for one
+     * (`vendor.features.captcha`). Sent in the `X-MB-CAPTCHA` header.
+     *
+     * Without it (or with one that does not check out) such a store refuses the
+     * sign-up with a `CaptchaRequiredError`. Solutions are single-use and expire
+     * after about two minutes, so reset the captcha after every attempt.
+     */
+    captchaToken?: string;
 }
 
 declare class IdentityEndpoints {
@@ -1687,6 +1735,11 @@ declare class IdentityEndpoints {
     get(): Promise<User>;
     signIn(email: string, password: string): Promise<User>;
     signUp(name: string, email: string, password: string, address: Address | null | undefined, acceptedPrivacyPolicy: boolean, acceptedTermsAndConditions: boolean, communicationOptIn?: boolean, options?: SignUpOptions): Promise<SignUpResult>;
+    /**
+     * Signs the buyer out here at once, and ends the session on the server so its refresh
+     * token stops working too. Resolves once the server has answered, and never rejects:
+     * the buyer is signed out in this browser whatever happens to that request.
+     */
     signOut(): Promise<void>;
     update(name: string | null, email: string, emailConfirmationToken?: string, communicationPreferences?: CommunicationPreferences): Promise<{
         needsEmailConfirmationToken: boolean;
@@ -24989,26 +25042,110 @@ declare class StorefrontEndpoints {
     }>;
 }
 
+/**
+ * The captcha a store asks customers to solve before signing up and checking out. `url` is a
+ * page on the store's own `<account-id>.moonbase.sh` that draws the challenge: embed it in an
+ * iframe, and it hands the solution to its parent with `postMessage`.
+ */
+declare const vendorCaptchaSchema: z.ZodObject<{
+    url: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    url: string;
+}, {
+    url: string;
+}>;
+declare const vendorFeaturesSchema: z.ZodObject<{
+    customerPortal: z.ZodOptional<z.ZodBoolean>;
+    phoneNumber: z.ZodOptional<z.ZodBoolean>;
+    marketingConsent: z.ZodCatch<z.ZodOptional<z.ZodNativeEnum<typeof MarketingConsentType>>>;
+    captcha: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        url: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        url: string;
+    }, {
+        url: string;
+    }>>>;
+}, "strip", z.ZodTypeAny, {
+    customerPortal?: boolean | undefined;
+    phoneNumber?: boolean | undefined;
+    marketingConsent?: MarketingConsentType | undefined;
+    captcha?: {
+        url: string;
+    } | null | undefined;
+}, {
+    customerPortal?: boolean | undefined;
+    phoneNumber?: boolean | undefined;
+    marketingConsent?: unknown;
+    captcha?: {
+        url: string;
+    } | null | undefined;
+}>;
 declare const vendorSchema: z.ZodObject<{
     id: z.ZodString;
     name: z.ZodString;
     logoUrl: z.ZodNullable<z.ZodString>;
+    features: z.ZodOptional<z.ZodObject<{
+        customerPortal: z.ZodOptional<z.ZodBoolean>;
+        phoneNumber: z.ZodOptional<z.ZodBoolean>;
+        marketingConsent: z.ZodCatch<z.ZodOptional<z.ZodNativeEnum<typeof MarketingConsentType>>>;
+        captcha: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            url: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            url: string;
+        }, {
+            url: string;
+        }>>>;
+    }, "strip", z.ZodTypeAny, {
+        customerPortal?: boolean | undefined;
+        phoneNumber?: boolean | undefined;
+        marketingConsent?: MarketingConsentType | undefined;
+        captcha?: {
+            url: string;
+        } | null | undefined;
+    }, {
+        customerPortal?: boolean | undefined;
+        phoneNumber?: boolean | undefined;
+        marketingConsent?: unknown;
+        captcha?: {
+            url: string;
+        } | null | undefined;
+    }>>;
 }, "strip", z.ZodTypeAny, {
     id: string;
     name: string;
     logoUrl: string | null;
+    features?: {
+        customerPortal?: boolean | undefined;
+        phoneNumber?: boolean | undefined;
+        marketingConsent?: MarketingConsentType | undefined;
+        captcha?: {
+            url: string;
+        } | null | undefined;
+    } | undefined;
 }, {
     id: string;
     name: string;
     logoUrl: string | null;
+    features?: {
+        customerPortal?: boolean | undefined;
+        phoneNumber?: boolean | undefined;
+        marketingConsent?: unknown;
+        captcha?: {
+            url: string;
+        } | null | undefined;
+    } | undefined;
 }>;
 
+declare const schemas$4_vendorCaptchaSchema: typeof vendorCaptchaSchema;
+declare const schemas$4_vendorFeaturesSchema: typeof vendorFeaturesSchema;
 declare const schemas$4_vendorSchema: typeof vendorSchema;
 declare namespace schemas$4 {
-  export { schemas$4_vendorSchema as vendorSchema };
+  export { schemas$4_vendorCaptchaSchema as vendorCaptchaSchema, schemas$4_vendorFeaturesSchema as vendorFeaturesSchema, schemas$4_vendorSchema as vendorSchema };
 }
 
 type Vendor = z.infer<typeof vendorSchema>;
+type VendorFeatures = z.infer<typeof vendorFeaturesSchema>;
+type VendorCaptcha = z.infer<typeof vendorCaptchaSchema>;
 
 declare class VendorEndpoints {
     private api;
@@ -47026,6 +47163,17 @@ declare class MoonbaseError extends Error {
     readonly errors?: Record<string, string> | undefined;
     constructor(title: string, detail: string | undefined, status?: number | undefined, errors?: Record<string, string> | undefined);
 }
+/**
+ * The store asks customers to solve a captcha (see `Vendor.features.captcha`), and the request
+ * carried none, or one that did not check out: unsolved, expired, already used, or solved on a
+ * site that is not one of the store's. `message` is the API's own copy for the customer, safe to
+ * show as is. Solutions are single-use, so reset the captcha and let them try again.
+ *
+ * A `MoonbaseError` like any other refusal, so code that already handles those keeps working.
+ */
+declare class CaptchaRequiredError extends MoonbaseError {
+    constructor(detail?: string, title?: string);
+}
 
 /**
  * Cleans up merchant-authored group IDs before they go on the wire.
@@ -47206,4 +47354,4 @@ declare class MoonbaseClient {
     orders: OrderEndpoints;
 }
 
-export { type Activation, ActivationMethod, type ActivationRequest, ActivationRequestFulfillmentType, ActivationRequestStatus, ActivationStatus, type Address, Architecture, type BundleLineItem, type CartCatalog, type CartOrder, type CartTotal, type CartTotalCondition, CartUtils, type CommunicationPreferences, type CommunicationPreferencesInput, type CommunicationPreferencesView, type CompletedOrder, ConnectableAccountProvider, type ConnectedAccount, ConsoleLogger, CycleLength, type Discount, DiscountUtils, type Download, type DownloadManifest, type ILogger, type IRecurrence, type IStore, type ITokenStore, type Identity, type ImageFit, type ImageFormat, type ImageTransform, ImageUtils, InMemoryStore, type License, LicenseStatus, type LineItem, type LineItemTotal, LocalStorageStore, LogLevel, MarketingConsentType, type MilestoneProgress, type Money, type MoneyCollection, MoneyCollectionUtils, MoonbaseApi, MoonbaseClient, type MoonbaseConfiguration, MoonbaseError, NotAuthenticatedError, NotAuthorizedError, NotFoundError, type OfferCondition, type OfferConditionContext, type OfferProgress, type OfferScope, OfferUtils, type OpenOrder, type Order, OrderStatus, type OrderTotal, type OwnedProduct, type Page, Platform, type PricingTier, type PricingVariation, type ProblemDetails, type ProductLineItem, type PromotionDisplay, type Quantifiable, type RawPropertyArray, type RawPropertyObject, type RawPropertyValue, type SignUpOptions, type SignUpResult, type SingleOrMultiple, StoreClosedError, type Storefront, type StorefrontBundle, type StorefrontOffer, type StorefrontOfferTarget, type StorefrontProduct, type StorefrontPromotion, type StorefrontPromotionCta, type StorefrontPromotionTarget, type SubscribeInput, type SubscribeResponse, type Subscription, type SubscriptionCancellationFeedback, SubscriptionCancellationReason, SubscriptionStatus, type TaxEstimate, TokenStore, type UrchinTrackingModule, type User, type UserAccountConfirmed, type UserAccountConfirmedStatus, type Vendor, type Voucher, imageWidths, isLocalStorageAvailable, isPromotionDisplay, isTransformableImageUrl, maxImageDimension, normalizeGroupIds, objectToQuery, parseOffSiteReferrer, problemDetailsSchema, promotionDisplays, resolveUtm, schemas, utmToObject };
+export { type Activation, ActivationMethod, type ActivationRequest, ActivationRequestFulfillmentType, ActivationRequestStatus, ActivationStatus, type Address, Architecture, type BundleLineItem, CaptchaRequiredError, type CartCatalog, type CartOrder, type CartTotal, type CartTotalCondition, CartUtils, type CommunicationPreferences, type CommunicationPreferencesInput, type CommunicationPreferencesView, type CompletedOrder, ConnectableAccountProvider, type ConnectedAccount, ConsoleLogger, CycleLength, type Discount, DiscountUtils, type Download, type DownloadManifest, type ILogger, type IRecurrence, type IStore, type ITokenStore, type Identity, type ImageFit, type ImageFormat, type ImageTransform, ImageUtils, InMemoryStore, type License, LicenseStatus, type LineItem, type LineItemTotal, LocalStorageStore, LogLevel, MarketingConsentType, type MilestoneProgress, type Money, type MoneyCollection, MoneyCollectionUtils, MoonbaseApi, MoonbaseClient, type MoonbaseConfiguration, MoonbaseError, NotAuthenticatedError, NotAuthorizedError, NotFoundError, type OfferCondition, type OfferConditionContext, type OfferProgress, type OfferScope, OfferUtils, type OpenOrder, type Order, OrderStatus, type OrderTotal, type OwnedProduct, type Page, Platform, type PricingTier, type PricingVariation, type ProblemDetails, type ProductLineItem, type PromotionDisplay, type Quantifiable, type RawPropertyArray, type RawPropertyObject, type RawPropertyValue, type SignUpOptions, type SignUpResult, type SingleOrMultiple, StoreClosedError, type Storefront, type StorefrontBundle, type StorefrontOffer, type StorefrontOfferTarget, type StorefrontProduct, type StorefrontPromotion, type StorefrontPromotionCta, type StorefrontPromotionTarget, type SubscribeInput, type SubscribeResponse, type Subscription, type SubscriptionCancellationFeedback, SubscriptionCancellationReason, SubscriptionStatus, type TaxEstimate, TokenStore, type UrchinTrackingModule, type User, type UserAccountConfirmed, type UserAccountConfirmedStatus, type Vendor, type VendorCaptcha, type VendorFeatures, type Voucher, accessTokenLifetime, imageWidths, isLocalStorageAvailable, isPromotionDisplay, isTransformableImageUrl, maxImageDimension, normalizeGroupIds, objectToQuery, parseOffSiteReferrer, problemDetailsSchema, promotionDisplays, resolveUtm, schemas, utmToObject };

package/dist/index.js

@@ -397,7 +397,10 @@ var activationRequestSchema = z4.object({
     requiresAccount: z4.boolean(),
     requiresNewsletterOptIn: z4.boolean(),
     numberOfDaysPerProduct: z4.number(),
-    numberOfDaysRemaining: z4.number()
+    numberOfDaysRemaining: z4.number(),
+    // The trial never expires, so the day counts are not worth showing. Absent from a backend that
+    // predates endless trials.
+    endless: z4.boolean().default(false)
   }).optional(),
   licenseEligibility: z4.object({
     eligible: z4.boolean()
@@ -595,6 +598,12 @@ var MoonbaseError = class extends Error {
     }
   }
 };
+var CaptchaRequiredError = class extends MoonbaseError {
+  constructor(detail, title) {
+    super(title != null ? title : "Captcha required", detail != null ? detail : "Please confirm you're not a robot.", 400);
+    this.name = "CaptchaRequiredError";
+  }
+};
 
 // src/utils/problemDetails.ts
 import { z as z7 } from "zod";
@@ -637,6 +646,8 @@ async function handleResponseProblem(response, logger) {
   logger.debug("The response indicates a problem", problemDetails);
   if (problemDetails.errorType === "StoreClosed")
     throw new StoreClosedError(problemDetails.detail);
+  if (problemDetails.errorType === "CaptchaRequired")
+    throw new CaptchaRequiredError(problemDetails.detail, problemDetails.title);
   throw new MoonbaseError(
     problemDetails.title,
     problemDetails.detail,
@@ -773,7 +784,8 @@ var IdentityEndpoints = class {
         "Accept": "application/json",
         "Content-Type": "application/json",
         "x-mb-cors": "1",
-        "x-mb-client": this.api.clientHeader
+        "x-mb-client": this.api.clientHeader,
+        ...(options == null ? void 0 : options.captchaToken) ? { "X-MB-CAPTCHA": options.captchaToken } : {}
       },
       body: JSON.stringify({
         name,
@@ -802,8 +814,13 @@ var IdentityEndpoints = class {
     this.tokenStore.setUser(identity);
     return { status: "signed-in", user: userSchema.parse(identity) };
   }
+  /**
+   * Signs the buyer out here at once, and ends the session on the server so its refresh
+   * token stops working too. Resolves once the server has answered, and never rejects:
+   * the buyer is signed out in this browser whatever happens to that request.
+   */
   async signOut() {
-    this.tokenStore.clear();
+    await this.tokenStore.signOut();
   }
   async update(name, email, emailConfirmationToken, communicationPreferences) {
     const response = await this.api.authenticatedFetch("/api/customer/identity", userSchema, {
@@ -1036,7 +1053,7 @@ var ProductEndpoints = class {
 import { z as z14 } from "zod";
 
 // package.json
-var version = "3.5.1";
+var version = "3.7.0";
 
 // src/utils/client.ts
 function buildClientHeader(sdk) {
@@ -1715,24 +1732,36 @@ var InMemoryStore = class {
 };
 
 // src/utils/tokenStore.ts
+var defaultAccessTokenLifetime = 15 * 60 * 1e3;
+var renewBeforeExpiry = 5 * 60 * 1e3;
+var expiryMargin = 30 * 1e3;
+var refreshLockName = "moonbase_auth_refresh";
+function accessTokenLifetime(accessToken) {
+  try {
+    const payload = accessToken.split(".")[1].replaceAll("-", "+").replaceAll("_", "/");
+    const claims = JSON.parse(atob(payload.padEnd(Math.ceil(payload.length / 4) * 4, "=")));
+    const lifetime = (Number(claims.exp) - Number(claims.iat)) * 1e3;
+    if (Number.isFinite(lifetime) && lifetime > 0 && lifetime <= 24 * 60 * 60 * 1e3)
+      return lifetime;
+  } catch (e) {
+  }
+  return defaultAccessTokenLifetime;
+}
 var _TokenStore = class _TokenStore {
   constructor(configuration) {
     this.configuration = configuration;
     this.tokens = null;
     this.refreshTimeoutId = null;
     this.refreshPromise = null;
+    this.waitingForVisibility = false;
+    this.sessionEndedListeners = [];
     var _a, _b;
     this.logger = (_a = configuration.logger) != null ? _a : new ConsoleLogger();
     this.store = (_b = configuration.store) != null ? _b : isLocalStorageAvailable() ? new LocalStorageStore((err) => this.warnAboutStorage(err)) : new InMemoryStore();
     if (typeof window !== "undefined" && !configuration.store && !(this.store instanceof LocalStorageStore))
       this.warnAboutStorage();
-    const storedToken = this.store.get(_TokenStore.storageKey);
-    if (storedToken) {
-      this.tokens = {
-        ...storedToken,
-        expiresAt: new Date(storedToken.expiresAt)
-      };
-    }
+    this.tokens = this.readStoredTokens();
+    this.scheduleRefresh();
     this.store.listen(_TokenStore.storageKey, (updatedTokens) => this.handleStorageUpdate(updatedTokens));
   }
   get user() {
@@ -1766,29 +1795,91 @@ var _TokenStore = class _TokenStore {
     } else {
       this.tokens = {
         ...identity,
-        // Hardcoded 15 minutes now, might want to check the JWT tho
-        expiresAt: new Date((/* @__PURE__ */ new Date()).getTime() + 15 * 60 * 1e3)
+        expiresAt: new Date(Date.now() + accessTokenLifetime(identity.accessToken))
       };
     }
     this.store.set(_TokenStore.storageKey, this.tokens);
-    if (typeof window !== "undefined") {
-      if (this.refreshTimeoutId != null)
-        window.clearTimeout(this.refreshTimeoutId);
-      this.refreshTimeoutId = window.setTimeout(() => {
-        this.startRefresh().catch((err) => this.logger.warn("Could not refresh access token", err));
-      }, 10 * 60 * 1e3);
-    }
+    this.scheduleRefresh();
     return this.tokens;
   }
   clear() {
     this.tokens = null;
     this.store.remove(_TokenStore.storageKey);
-    if (this.refreshTimeoutId != null && typeof window !== "undefined")
-      window.clearTimeout(this.refreshTimeoutId);
+    this.scheduleRefresh();
     return null;
   }
+  async signOut() {
+    const tokens = this.tokens;
+    this.clear();
+    if (!tokens)
+      return;
+    try {
+      await fetch(`${this.configuration.endpoint}/api/customer/identity/revoke?token=${encodeURIComponent(tokens.refreshToken)}`, {
+        method: "POST",
+        keepalive: true,
+        headers: {
+          "Accept": "application/json",
+          "Content-Type": "text/plain",
+          "x-mb-cors": "1",
+          "x-mb-client": buildClientHeader(this.configuration.sdk)
+        },
+        body: tokens.accessToken
+      });
+    } catch (err) {
+      this.logger.warn("Could not end the session on the server", err);
+    }
+  }
+  onSessionEnded(listener) {
+    this.sessionEndedListeners.push(listener);
+  }
   get isExpired() {
-    return this.tokens != null && this.tokens.expiresAt < /* @__PURE__ */ new Date();
+    return this.tokens != null && this.tokens.expiresAt.getTime() - expiryMargin < Date.now();
+  }
+  readStoredTokens() {
+    const stored = this.store.get(_TokenStore.storageKey);
+    return stored ? { ...stored, expiresAt: new Date(stored.expiresAt) } : null;
+  }
+  /**
+   * (Re)arms the timer that renews the access token shortly before it runs out, or disarms
+   * it when there is nothing to renew. Every tab arms one, and `refreshTokens` makes sure
+   * only one of them actually renews.
+   */
+  scheduleRefresh() {
+    if (typeof window === "undefined")
+      return;
+    if (this.refreshTimeoutId != null)
+      window.clearTimeout(this.refreshTimeoutId);
+    this.refreshTimeoutId = null;
+    if (!this.tokens)
+      return;
+    const delay = Math.max(0, this.renewalDueAt(this.tokens) - Date.now());
+    this.refreshTimeoutId = window.setTimeout(() => this.renewInBackground(), delay);
+  }
+  renewalDueAt(tokens) {
+    const lead = Math.min(renewBeforeExpiry, accessTokenLifetime(tokens.accessToken) / 3);
+    return tokens.expiresAt.getTime() - lead;
+  }
+  renewInBackground() {
+    var _a;
+    this.refreshTimeoutId = null;
+    if (!this.tokens)
+      return;
+    if (this.renewalDueAt(this.tokens) > Date.now()) {
+      this.scheduleRefresh();
+      return;
+    }
+    if (typeof document !== "undefined" && document.visibilityState === "hidden") {
+      if (!this.waitingForVisibility) {
+        this.waitingForVisibility = true;
+        document.addEventListener("visibilitychange", () => {
+          this.waitingForVisibility = false;
+          this.renewInBackground();
+        }, { once: true });
+      }
+      return;
+    }
+    const pending = (_a = this.refreshPromise) != null ? _a : this.startRefresh();
+    pending.catch((err) => this.logger.warn("Could not refresh access token", err));
   }
   /**
    * Start a refresh and hold it so concurrent callers join it rather than firing
@@ -1805,7 +1896,45 @@ var _TokenStore = class _TokenStore {
     this.refreshPromise = pending;
     return pending;
   }
+  /**
+   * A refresh token can be used once: the server answers a second use by revoking the
+   * session, taking it for a stolen token. So refreshes are serialised across every tab of
+   * the origin, and whoever gets the lock second takes up what the first one stored rather
+   * than spending the same refresh token again. The stored copy has to be read, not waited
+   * for: storage events never reach the document that wrote them, so a second client on
+   * the same page would not hear about it.
+   */
   async refreshTokens() {
+    var _a;
+    const spending = (_a = this.tokens) == null ? void 0 : _a.refreshToken;
+    const locks = typeof navigator !== "undefined" ? navigator.locks : void 0;
+    if (locks == null ? void 0 : locks.request) {
+      let held = false;
+      try {
+        return await locks.request(refreshLockName, () => {
+          held = true;
+          return this.refreshHoldingLock(spending);
+        });
+      } catch (err) {
+        if (held)
+          throw err;
+      }
+    }
+    return await this.refreshHoldingLock(spending);
+  }
+  /**
+   * @param spending The refresh token this refresh set out to use. If the session has moved
+   * on from it while we waited for the lock, someone else has renewed already.
+   */
+  async refreshHoldingLock(spending) {
+    var _a;
+    const stored = this.readStoredTokens();
+    if (stored && stored.refreshToken !== ((_a = this.tokens) == null ? void 0 : _a.refreshToken))
+      this.tokens = stored;
+    if (this.tokens && this.tokens.refreshToken !== spending && !this.isExpired) {
+      this.scheduleRefresh();
+      return this.tokens;
+    }
     if (!this.tokens)
       throw new Error("No tokens found to refresh");
     const response = await fetch(`${this.configuration.endpoint}/api/customer/identity/refresh?token=${encodeURIComponent(this.tokens.refreshToken)}`, {
@@ -1821,6 +1950,13 @@ var _TokenStore = class _TokenStore {
     if (response.status !== 200) {
       if (response.status === 403 || response.status === 404) {
         this.clear();
+        for (const listener of this.sessionEndedListeners) {
+          try {
+            listener();
+          } catch (err) {
+            this.logger.warn("A listener for the end of the session failed", err);
+          }
+        }
         return null;
       }
       throw new MoonbaseError("Unexpected result", `Could not refresh access token, status code ${response.status}`, response.status);
@@ -1831,11 +1967,10 @@ var _TokenStore = class _TokenStore {
   }
   handleStorageUpdate(updatedTokens) {
     this.tokens = updatedTokens;
-    if (this.refreshTimeoutId != null && typeof window !== "undefined")
-      window.clearTimeout(this.refreshTimeoutId);
     if (this.tokens) {
       this.tokens.expiresAt = new Date(this.tokens.expiresAt);
     }
+    this.scheduleRefresh();
   }
   warnAboutStorage(err) {
     this.logger.warn(
@@ -1850,13 +1985,26 @@ var TokenStore = _TokenStore;
 // src/vendor/schemas.ts
 var schemas_exports9 = {};
 __export(schemas_exports9, {
+  vendorCaptchaSchema: () => vendorCaptchaSchema,
+  vendorFeaturesSchema: () => vendorFeaturesSchema,
   vendorSchema: () => vendorSchema
 });
 import { z as z15 } from "zod";
+var vendorCaptchaSchema = z15.object({
+  url: z15.string()
+});
+var vendorFeaturesSchema = z15.object({
+  customerPortal: z15.boolean().optional(),
+  phoneNumber: z15.boolean().optional(),
+  marketingConsent: z15.nativeEnum(MarketingConsentType).optional().catch(void 0),
+  // Absent on backends from before captchas, which never ask for one.
+  captcha: vendorCaptchaSchema.nullish()
+});
 var vendorSchema = z15.object({
   id: z15.string(),
   name: z15.string(),
-  logoUrl: z15.string().nullable()
+  logoUrl: z15.string().nullable(),
+  features: vendorFeaturesSchema.optional()
 });
 
 // src/vendor/endpoints.ts
@@ -2551,6 +2699,7 @@ export {
   ActivationRequestStatus,
   ActivationStatus,
   Architecture,
+  CaptchaRequiredError,
   CartUtils,
   ConnectableAccountProvider,
   ConsoleLogger,
@@ -2576,6 +2725,7 @@ export {
   SubscriptionCancellationReason,
   SubscriptionStatus,
   TokenStore,
+  accessTokenLifetime,
   imageWidths,
   isLocalStorageAvailable,
   isPromotionDisplay,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@moonbase.sh/storefront-api",
   "type": "module",
-  "version": "3.5.1",
+  "version": "3.7.0",
   "description": "Package to let you build storefronts with Moonbase.sh as payment and delivery provider",
   "author": "Tobias Lønnerød Madsen <m@dsen.tv>",
   "license": "MIT",