@moonbase.sh/storefront-api 3.8.0 → 3.10.0

package/dist/index.cjs

@@ -46,7 +46,9 @@ __export(index_exports, {
   NotFoundError: () => NotFoundError,
   OfferUtils: () => OfferUtils,
   OrderStatus: () => OrderStatus,
+  PasswordSetupRequiredError: () => PasswordSetupRequiredError,
   Platform: () => Platform,
+  ReleaseNotCoveredError: () => ReleaseNotCoveredError,
   StoreClosedError: () => StoreClosedError,
   SubscriptionCancellationReason: () => SubscriptionCancellationReason,
   SubscriptionStatus: () => SubscriptionStatus,
@@ -84,6 +86,7 @@ __export(schemas_exports2, {
   offerConditionSchema: () => offerConditionSchema,
   offerScopeSchema: () => offerScopeSchema,
   storefrontBundleSchema: () => storefrontBundleSchema,
+  storefrontLicenseUpgradeSchema: () => storefrontLicenseUpgradeSchema,
   storefrontOfferSchema: () => storefrontOfferSchema,
   storefrontOfferTargetSchema: () => storefrontOfferTargetSchema,
   storefrontProductSchema: () => storefrontProductSchema,
@@ -218,6 +221,7 @@ var schemas_exports = {};
 __export(schemas_exports, {
   downloadSchema: () => downloadSchema,
   manifestSchema: () => manifestSchema,
+  productReleaseAccessSchema: () => productReleaseAccessSchema,
   productReleaseSchema: () => productReleaseSchema,
   productSummarySchema: () => productSummarySchema
 });
@@ -260,6 +264,21 @@ var downloadSchema = import_zod2.z.object({
   path: import_zod2.z.string().nullable(),
   manifest: manifestSchema.optional()
 });
+var productReleaseAccessSchema = import_zod2.z.object({
+  // Releases published until then are covered, and every version while it has not passed.
+  updatesUntil: import_zod2.z.coerce.date().nullish().catch(void 0),
+  // Every version whose major is at most this is covered.
+  upToMajor: import_zod2.z.number().nullish().catch(void 0),
+  // Once updates have ended, the last version published before they did.
+  upToVersion: import_zod2.z.string().nullish().catch(void 0),
+  // Whether the release this was resolved for (the one shown) is covered. Read as covered when
+  // unreadable, so a garbled answer never locks a download the API would hand out.
+  coversRelease: import_zod2.z.boolean().catch(true),
+  // The newest published version the customer may download, when the shown one is not covered.
+  latestCoveredVersion: import_zod2.z.string().nullish().catch(void 0),
+  // Where to buy the upgrade or renewal, while the product sells one.
+  upgradeUrl: import_zod2.z.string().nullish().catch(void 0)
+});
 var productSummarySchema = import_zod2.z.object({
   id: import_zod2.z.string(),
   name: import_zod2.z.string(),
@@ -283,7 +302,10 @@ var productSummarySchema = import_zod2.z.object({
   // Whether this caller clears every requirement above, including the group membership the client
   // can't see for itself. False with none of them set means the merchant closed the release to everyone.
   downloadsAllowed: import_zod2.z.boolean(),
-  downloads: import_zod2.z.array(downloadSchema).optional()
+  downloads: import_zod2.z.array(downloadSchema).optional(),
+  // Set only when the customer's licenses do not cover every release. `downloadsAllowed` already
+  // accounts for it; this says why a download is locked and where to upgrade.
+  releaseAccess: productReleaseAccessSchema.nullish().catch(void 0)
 });
 var productReleaseSchema = import_zod2.z.object({
   version: import_zod2.z.string(),
@@ -293,10 +315,33 @@ var productReleaseSchema = import_zod2.z.object({
   // merchant can keep past releases to owners while the current one is open to anyone.
   downloadsAllowed: import_zod2.z.boolean(),
   downloads: import_zod2.z.array(downloadSchema),
-  properties: import_zod2.z.record(rawPropertyValueSchema).nullish()
+  properties: import_zod2.z.record(rawPropertyValueSchema).nullish(),
+  // True when the caller owns the product but none of their licenses covers this release, so it
+  // takes an upgrade rather than a sign-in to unlock. Absent otherwise.
+  releaseNotCovered: import_zod2.z.boolean().nullish().catch(void 0)
 });
 
 // src/storefront/schemas.ts
+var storefrontLicenseUpgradeSchema = import_zod3.z.object({
+  // The customer's licenses this entry prices. An entry without them is no use and is left out.
+  licenseIds: import_zod3.z.string().array(),
+  // What those licenses cover now, which is how a cart tells the customer which of their licenses an
+  // upgrade is for. Read leniently, field by field: a backend that predates it leaves it out, and one
+  // this version cannot read reads as absent rather than costing the entry.
+  releaseAccess: import_zod3.z.object({
+    // Releases published until then are covered, and every version while it has not passed.
+    updatesUntil: import_zod3.z.coerce.date().nullish().catch(void 0),
+    // Every version whose major is at most this is covered.
+    upToMajor: import_zod3.z.number().nullish().catch(void 0),
+    // Once updates have ended, the last version published before they did.
+    upToVersion: import_zod3.z.string().nullish().catch(void 0)
+  }).nullish().catch(void 0),
+  variations: pricingVariationSchema.array()
+});
+var storefrontLicenseUpgradesSchema = import_zod3.z.array(import_zod3.z.unknown()).transform((upgrades) => upgrades.flatMap((upgrade) => {
+  const parsed = storefrontLicenseUpgradeSchema.safeParse(upgrade);
+  return parsed.success ? [parsed.data] : [];
+}));
 var storefrontProductSchema = import_zod3.z.object({
   id: import_zod3.z.string(),
   name: import_zod3.z.string(),
@@ -310,7 +355,13 @@ var storefrontProductSchema = import_zod3.z.object({
   defaultVariation: pricingVariationSchema.optional(),
   variations: pricingVariationSchema.array().optional(),
   properties: import_zod3.z.record(rawPropertyValueSchema).nullish(),
-  type: import_zod3.z.string().optional().default("Product").pipe(import_zod3.z.literal("Product"))
+  type: import_zod3.z.string().optional().default("Product").pipe(import_zod3.z.literal("Product")),
+  // What upgrading or renewing the signed-in customer's licenses of the product that cover only
+  // some releases costs, one entry per group of licenses that cover the same, furthest behind first.
+  // Capped, so a customer with a great many licenses may find one in none of them. Absent for anyone
+  // else, and from a backend that predates per-license prices. A cart line naming one of these
+  // licenses (`targetLicenseId`) is priced from here: see `CartUtils.licenseUpgrade`.
+  licenseUpgrades: storefrontLicenseUpgradesSchema.nullish().catch(void 0)
 });
 var storefrontBundleSchema = import_zod3.z.object({
   id: import_zod3.z.string(),
@@ -484,7 +535,17 @@ var activationRequestSchema = import_zod4.z.object({
     endless: import_zod4.z.boolean().default(false)
   }).optional(),
   licenseEligibility: import_zod4.z.object({
-    eligible: import_zod4.z.boolean()
+    eligible: import_zod4.z.boolean(),
+    // Set when the customer's licenses would take the device but none of them covers the version
+    // the app runs (`eligible` is then false), so the app's version needs an upgrade. Absent from
+    // a backend that predates release access, and read leniently so it can never fail the request.
+    releaseNotCovered: import_zod4.z.object({
+      appVersion: import_zod4.z.string().nullish().catch(void 0),
+      updatesUntil: import_zod4.z.coerce.date().nullish().catch(void 0),
+      upToMajor: import_zod4.z.number().nullish().catch(void 0),
+      upToVersion: import_zod4.z.string().nullish().catch(void 0),
+      upgradeUrl: import_zod4.z.string().nullish().catch(void 0)
+    }).nullish().catch(void 0)
   }).optional()
 });
 
@@ -563,7 +624,8 @@ var CommunicationsEndpoints = class {
         newsletter: (_b = input.newsletter) != null ? _b : true,
         productUpdates: (_c = input.productUpdates) != null ? _c : true,
         groupIds: normalizeGroupIds(input.groupIds)
-      }
+      },
+      headers: input.captchaToken ? { "X-MB-CAPTCHA": input.captchaToken } : void 0
     });
     return response.data;
   }
@@ -643,6 +705,15 @@ var NotAuthorizedError = class extends Error {
     this.message = "Not allowed";
   }
 };
+var ReleaseNotCoveredError = class extends NotAuthorizedError {
+  constructor(releaseAccess, upgradeUrl, detail) {
+    super();
+    this.releaseAccess = releaseAccess;
+    this.upgradeUrl = upgradeUrl;
+    this.name = "ReleaseNotCoveredError";
+    this.message = detail != null ? detail : "Your license doesn't cover this version";
+  }
+};
 var NotAuthenticatedError = class extends Error {
   constructor() {
     super();
@@ -685,6 +756,15 @@ var CaptchaRequiredError = class extends MoonbaseError {
     this.name = "CaptchaRequiredError";
   }
 };
+var PasswordSetupRequiredError = class extends MoonbaseError {
+  constructor(detail, title, status) {
+    super(title != null ? title : "Password setup required", detail, status);
+    this.name = "PasswordSetupRequiredError";
+  }
+};
+
+// src/utils/problemHandler.ts
+var import_zod8 = require("zod");
 
 // src/utils/problemDetails.ts
 var import_zod7 = require("zod");
@@ -699,6 +779,28 @@ var problemDetailsSchema = import_zod7.z.object({
 });
 
 // src/utils/problemHandler.ts
+var releaseNotCoveredProblemSchema = import_zod8.z.object({
+  errorType: import_zod8.z.literal("ReleaseNotCovered"),
+  detail: import_zod8.z.string().nullish().catch(void 0),
+  releaseAccess: productReleaseAccessSchema.nullish().catch(void 0),
+  upgradeUrl: import_zod8.z.string().nullish().catch(void 0)
+});
+async function forbiddenError(response) {
+  var _a;
+  try {
+    const problem = releaseNotCoveredProblemSchema.safeParse(JSON.parse(await response.text()));
+    if (problem.success) {
+      const { releaseAccess, upgradeUrl, detail } = problem.data;
+      return new ReleaseNotCoveredError(
+        releaseAccess != null ? releaseAccess : void 0,
+        (_a = upgradeUrl != null ? upgradeUrl : releaseAccess == null ? void 0 : releaseAccess.upgradeUrl) != null ? _a : void 0,
+        detail != null ? detail : void 0
+      );
+    }
+  } catch (e) {
+  }
+  return new NotAuthorizedError();
+}
 function camelCase(str) {
   return str.split(".").map((word, index) => {
     let [firstLetter, ...restOfLetters] = word;
@@ -708,13 +810,14 @@ function camelCase(str) {
   }).join("");
 }
 async function handleResponseProblem(response, logger) {
+  var _a;
   if (response.status === 404)
     throw new NotFoundError();
   if (response.status === 401) {
     throw new NotAuthenticatedError();
   }
   if (response.status === 403) {
-    throw new NotAuthorizedError();
+    throw await forbiddenError(response);
   }
   let problemDetails;
   const body = await response.text();
@@ -729,6 +832,8 @@ async function handleResponseProblem(response, logger) {
     throw new StoreClosedError(problemDetails.detail);
   if (problemDetails.errorType === "CaptchaRequired")
     throw new CaptchaRequiredError(problemDetails.detail, problemDetails.title);
+  if (problemDetails.errorType === "PasswordSetupRequired")
+    throw new PasswordSetupRequiredError(problemDetails.detail, problemDetails.title, (_a = problemDetails.status) != null ? _a : response.status);
   throw new MoonbaseError(
     problemDetails.title,
     problemDetails.detail,
@@ -747,11 +852,12 @@ __export(schemas_exports5, {
   identitySchema: () => identitySchema,
   ilokConnectedAccountSchema: () => ilokConnectedAccountSchema,
   pendingActivationSchema: () => pendingActivationSchema,
+  pendingPasswordProblemSchema: () => pendingPasswordProblemSchema,
   userAccountConfirmedSchema: () => userAccountConfirmedSchema,
   userAccountConfirmedStatusSchema: () => userAccountConfirmedStatusSchema,
   userSchema: () => userSchema
 });
-var import_zod8 = require("zod");
+var import_zod9 = require("zod");
 
 // src/identity/models.ts
 var ConnectableAccountProvider = /* @__PURE__ */ ((ConnectableAccountProvider2) => {
@@ -760,73 +866,78 @@ var ConnectableAccountProvider = /* @__PURE__ */ ((ConnectableAccountProvider2)
 })(ConnectableAccountProvider || {});
 
 // src/identity/schemas.ts
-var addressSchema = import_zod8.z.object({
-  countryCode: import_zod8.z.string(),
-  streetAddress1: import_zod8.z.string(),
-  streetAddress2: import_zod8.z.string().nullable(),
-  locality: import_zod8.z.string().nullable(),
-  region: import_zod8.z.string().nullable(),
-  postCode: import_zod8.z.string().nullable()
-});
-var communicationPreferencesSchema = import_zod8.z.object({
-  newsletterOptIn: import_zod8.z.boolean(),
+var addressSchema = import_zod9.z.object({
+  countryCode: import_zod9.z.string(),
+  streetAddress1: import_zod9.z.string(),
+  streetAddress2: import_zod9.z.string().nullable(),
+  locality: import_zod9.z.string().nullable(),
+  region: import_zod9.z.string().nullable(),
+  postCode: import_zod9.z.string().nullable()
+});
+var communicationPreferencesSchema = import_zod9.z.object({
+  newsletterOptIn: import_zod9.z.boolean(),
   // Default keeps older persisted identities (pre productUpdatesOptIn) parseable
   // during boot. The server-side value is hydrated by updateUser() right after.
-  productUpdatesOptIn: import_zod8.z.boolean().default(false)
+  productUpdatesOptIn: import_zod9.z.boolean().default(false)
 });
-var ilokConnectedAccountSchema = import_zod8.z.object({
-  provider: import_zod8.z.literal("iLok" /* iLok */),
-  isConnected: import_zod8.z.boolean(),
-  pendingLicenseFulfillments: import_zod8.z.boolean(),
-  accountId: import_zod8.z.string().nullish()
+var ilokConnectedAccountSchema = import_zod9.z.object({
+  provider: import_zod9.z.literal("iLok" /* iLok */),
+  isConnected: import_zod9.z.boolean(),
+  pendingLicenseFulfillments: import_zod9.z.boolean(),
+  accountId: import_zod9.z.string().nullish()
 });
-var connectedAccountSchema = import_zod8.z.discriminatedUnion("provider", [
+var connectedAccountSchema = import_zod9.z.discriminatedUnion("provider", [
   ilokConnectedAccountSchema
 ]);
-var connectionUrlSchema = import_zod8.z.object({
-  url: import_zod8.z.string()
+var connectionUrlSchema = import_zod9.z.object({
+  url: import_zod9.z.string()
 });
-var userSchema = import_zod8.z.object({
-  id: import_zod8.z.string(),
-  email: import_zod8.z.string(),
+var userSchema = import_zod9.z.object({
+  id: import_zod9.z.string(),
+  email: import_zod9.z.string(),
   // Nullable: customers created via import may have no name.
-  name: import_zod8.z.string().nullable(),
-  tenantId: import_zod8.z.string(),
+  name: import_zod9.z.string().nullable(),
+  tenantId: import_zod9.z.string(),
   address: addressSchema.optional(),
-  phone: import_zod8.z.string().optional(),
+  phone: import_zod9.z.string().optional(),
   communicationPreferences: communicationPreferencesSchema,
-  ownedProducts: import_zod8.z.string().array().optional(),
-  subscribedProducts: import_zod8.z.string().array().optional(),
-  confirmedAccount: import_zod8.z.boolean().optional(),
-  hasProducts: import_zod8.z.boolean().nullish(),
-  hasSubscriptions: import_zod8.z.boolean().nullish(),
-  connectedAccounts: import_zod8.z.array(connectedAccountSchema).default([])
-});
-var identitySchema = userSchema.and(import_zod8.z.object({
-  accessToken: import_zod8.z.string(),
-  refreshToken: import_zod8.z.string()
+  ownedProducts: import_zod9.z.string().array().optional(),
+  subscribedProducts: import_zod9.z.string().array().optional(),
+  confirmedAccount: import_zod9.z.boolean().optional(),
+  hasProducts: import_zod9.z.boolean().nullish(),
+  hasSubscriptions: import_zod9.z.boolean().nullish(),
+  connectedAccounts: import_zod9.z.array(connectedAccountSchema).default([])
+});
+var identitySchema = userSchema.and(import_zod9.z.object({
+  accessToken: import_zod9.z.string(),
+  refreshToken: import_zod9.z.string()
 }));
-var userAccountConfirmedStatusSchema = import_zod8.z.enum([
+var userAccountConfirmedStatusSchema = import_zod9.z.enum([
   "PasswordSetupRequired",
   "SignedIn"
 ]);
-var userAccountConfirmedSchema = userSchema.and(import_zod8.z.object({
+var userAccountConfirmedSchema = userSchema.and(import_zod9.z.object({
   status: userAccountConfirmedStatusSchema,
-  resetPasswordToken: import_zod8.z.string().nullish(),
-  accessToken: import_zod8.z.string().nullish(),
-  refreshToken: import_zod8.z.string().nullish()
+  resetPasswordToken: import_zod9.z.string().nullish(),
+  accessToken: import_zod9.z.string().nullish(),
+  refreshToken: import_zod9.z.string().nullish()
 }));
-var pendingActivationSchema = import_zod8.z.object({
-  status: import_zod8.z.literal("activation_pending"),
-  email: import_zod8.z.string()
+var pendingActivationSchema = import_zod9.z.object({
+  status: import_zod9.z.literal("activation_pending"),
+  email: import_zod9.z.string()
+});
+var pendingPasswordProblemSchema = import_zod9.z.object({
+  errorType: import_zod9.z.literal("PasswordSetupRequired"),
+  pendingPasswordToken: import_zod9.z.string()
 });
 
 // src/identity/endpoints.ts
 var IdentityEndpoints = class {
-  constructor(api, tokenStore, logger) {
+  constructor(api, tokenStore, logger, pendingPasswords) {
     this.api = api;
     this.tokenStore = tokenStore;
     this.logger = logger;
+    this.pendingPasswords = pendingPasswords;
   }
   async get() {
     const response = await this.api.authenticatedFetch("/api/customer/meta/user", userSchema);
@@ -882,8 +993,11 @@ var IdentityEndpoints = class {
         groupIds: normalizeGroupIds(options == null ? void 0 : options.groupIds)
       })
     });
-    if (response.status >= 400)
+    if (response.status >= 400) {
+      if (response.status === 409)
+        await this.keepPendingPassword(email, response.clone());
       await handleResponseProblem(response, this.logger);
+    }
     const data = await response.json();
     if (response.status === 202) {
       const parsed = pendingActivationSchema.parse(data);
@@ -899,6 +1013,19 @@ var IdentityEndpoints = class {
     this.tokenStore.setUser(identity);
     return { status: "signed-in", user: userSchema.parse(identity) };
   }
+  /**
+   * The address already has an account with no password, so the server emailed it a link and
+   * handed back the password just typed, sealed, for that link to set once it is opened here.
+   * Never thrown: the caller still gets the `PasswordSetupRequiredError` from the response.
+   */
+  async keepPendingPassword(email, response) {
+    try {
+      const problem = pendingPasswordProblemSchema.safeParse(await response.json());
+      if (problem.success)
+        this.pendingPasswords.set(email, problem.data.pendingPasswordToken);
+    } catch (e) {
+    }
+  }
   /**
    * Signs the buyer out here at once, and ends the session on the server so its refresh
    * token stops working too. Resolves once the server has answered, and never rejects:
@@ -950,7 +1077,13 @@ var IdentityEndpoints = class {
       await handleResponseProblem(response, this.logger);
   }
   async confirmAccount(email, code) {
-    const response = await this.api.fetch(`/api/customer/identity/confirm-account?email=${encodeURIComponent(email)}&code=${encodeURIComponent(code.replaceAll(" ", "+"))}&scheme=JWT`, userAccountConfirmedSchema, { method: "POST" });
+    const pendingPasswordToken = this.pendingPasswords.get(email);
+    const response = await this.api.fetch(`/api/customer/identity/confirm-account?email=${encodeURIComponent(email)}&code=${encodeURIComponent(code.replaceAll(" ", "+"))}&scheme=JWT`, userAccountConfirmedSchema, {
+      method: "POST",
+      body: pendingPasswordToken ? { pendingPasswordToken } : void 0
+    });
+    if (pendingPasswordToken)
+      this.pendingPasswords.remove(email);
     const result = response.data;
     if (result.status === "SignedIn") {
       if (!result.accessToken || !result.refreshToken) {
@@ -991,16 +1124,17 @@ var IdentityEndpoints = class {
 };
 
 // src/inventory/activation/endpoints.ts
-var import_zod10 = require("zod");
+var import_zod11 = require("zod");
 
 // src/inventory/licenses/schemas.ts
 var schemas_exports6 = {};
 __export(schemas_exports6, {
   activationSchema: () => activationSchema,
   externalLicenseContent: () => externalLicenseContent,
+  licenseReleaseAccessSchema: () => licenseReleaseAccessSchema,
   licenseSchema: () => licenseSchema
 });
-var import_zod9 = require("zod");
+var import_zod10 = require("zod");
 
 // src/inventory/licenses/models.ts
 var LicenseStatus = /* @__PURE__ */ ((LicenseStatus2) => {
@@ -1021,43 +1155,57 @@ var ActivationMethod = /* @__PURE__ */ ((ActivationMethod2) => {
 })(ActivationMethod || {});
 
 // src/inventory/licenses/schemas.ts
-var externalLicenseFileContent = import_zod9.z.object({
-  type: import_zod9.z.literal("file"),
-  fileName: import_zod9.z.string(),
-  contentType: import_zod9.z.string(),
-  data: import_zod9.z.string()
-});
-var externalLicenseILokContent = import_zod9.z.object({
-  type: import_zod9.z.literal("iLok")
-});
-var externalLicenseContent = import_zod9.z.union([
-  import_zod9.z.string(),
-  import_zod9.z.discriminatedUnion("type", [
+var externalLicenseFileContent = import_zod10.z.object({
+  type: import_zod10.z.literal("file"),
+  fileName: import_zod10.z.string(),
+  contentType: import_zod10.z.string(),
+  data: import_zod10.z.string()
+});
+var externalLicenseILokContent = import_zod10.z.object({
+  type: import_zod10.z.literal("iLok")
+});
+var externalLicenseContent = import_zod10.z.union([
+  import_zod10.z.string(),
+  import_zod10.z.discriminatedUnion("type", [
     externalLicenseFileContent,
     externalLicenseILokContent
   ])
 ]);
-var licenseSchema = import_zod9.z.object({
-  id: import_zod9.z.string(),
-  status: import_zod9.z.nativeEnum(LicenseStatus),
+var licenseReleaseAccessSchema = import_zod10.z.object({
+  // Releases published until then are covered, and every version while it has not passed.
+  updatesUntil: import_zod10.z.coerce.date().nullish().catch(void 0),
+  // Every version whose major is at most this is covered.
+  upToMajor: import_zod10.z.number().nullish().catch(void 0),
+  // Once updates have ended, the last version published before they did.
+  upToVersion: import_zod10.z.string().nullish().catch(void 0),
+  // Whether the product's current release is covered, so whether to offer an upgrade. Read as
+  // covered when unreadable, so a garbled answer never pushes an upgrade nobody needs.
+  coversCurrentRelease: import_zod10.z.boolean().catch(true),
+  // Where to buy the upgrade or renewal for this license, while the product sells one.
+  upgradeUrl: import_zod10.z.string().nullish().catch(void 0)
+});
+var licenseSchema = import_zod10.z.object({
+  id: import_zod10.z.string(),
+  status: import_zod10.z.nativeEnum(LicenseStatus),
   product: productSummarySchema,
-  activeNumberOfActivations: import_zod9.z.number(),
-  maxNumberOfActivations: import_zod9.z.number(),
+  activeNumberOfActivations: import_zod10.z.number(),
+  maxNumberOfActivations: import_zod10.z.number(),
   externalFulfillment: externalLicenseContent.optional(),
-  requiredConnectedAccount: import_zod9.z.nativeEnum(ConnectableAccountProvider).nullish(),
-  fulfillmentMessage: import_zod9.z.string().optional(),
-  properties: import_zod9.z.record(rawPropertyValueSchema).nullish(),
-  expiresAt: import_zod9.z.coerce.date().optional(),
-  createdAt: import_zod9.z.coerce.date()
-});
-var activationSchema = import_zod9.z.object({
-  id: import_zod9.z.string(),
-  licenseId: import_zod9.z.string(),
-  name: import_zod9.z.string(),
-  status: import_zod9.z.nativeEnum(ActivationStatus),
-  activationMethod: import_zod9.z.nativeEnum(ActivationMethod),
-  firstValidatedAt: import_zod9.z.coerce.date(),
-  lastValidatedAt: import_zod9.z.coerce.date().nullable()
+  requiredConnectedAccount: import_zod10.z.nativeEnum(ConnectableAccountProvider).nullish(),
+  fulfillmentMessage: import_zod10.z.string().optional(),
+  properties: import_zod10.z.record(rawPropertyValueSchema).nullish(),
+  expiresAt: import_zod10.z.coerce.date().optional(),
+  createdAt: import_zod10.z.coerce.date(),
+  releaseAccess: licenseReleaseAccessSchema.nullish().catch(void 0)
+});
+var activationSchema = import_zod10.z.object({
+  id: import_zod10.z.string(),
+  licenseId: import_zod10.z.string(),
+  name: import_zod10.z.string(),
+  status: import_zod10.z.nativeEnum(ActivationStatus),
+  activationMethod: import_zod10.z.nativeEnum(ActivationMethod),
+  firstValidatedAt: import_zod10.z.coerce.date(),
+  lastValidatedAt: import_zod10.z.coerce.date().nullable()
 });
 
 // src/inventory/activation/endpoints.ts
@@ -1074,7 +1222,7 @@ var ActivationEndpoints = class {
     });
     return {
       license: response.data,
-      url: import_zod10.z.string().parse(response.headers.location)
+      url: import_zod11.z.string().parse(response.headers.location)
     };
   }
 };
@@ -1102,7 +1250,7 @@ var LicenseEndpoints = class {
 };
 
 // src/inventory/products/endpoints.ts
-var import_zod11 = require("zod");
+var import_zod12 = require("zod");
 var ProductEndpoints = class {
   constructor(api, configuration) {
     this.api = api;
@@ -1136,18 +1284,18 @@ var ProductEndpoints = class {
   async getDownloadUrl(path) {
     const url = new URL(path);
     url.searchParams.append("redirect", "false");
-    const response = await this.api.fetch(url.pathname + url.search, import_zod11.z.object({
-      location: import_zod11.z.string()
+    const response = await this.api.fetch(url.pathname + url.search, import_zod12.z.object({
+      location: import_zod12.z.string()
     }));
     return response.data.location;
   }
 };
 
 // src/inventory/subscriptions/endpoints.ts
-var import_zod14 = require("zod");
+var import_zod15 = require("zod");
 
 // package.json
-var version = "3.8.0";
+var version = "3.10.0";
 
 // src/utils/client.ts
 function buildClientHeader(sdk) {
@@ -1155,6 +1303,11 @@ function buildClientHeader(sdk) {
 }
 
 // src/utils/api.ts
+function loggableBody(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body))
+    return body;
+  return Object.fromEntries(Object.entries(body).map(([key, value]) => [key, /password|token/i.test(key) && value != null ? "[redacted]" : value]));
+}
 function objectToQuery(obj) {
   return Object.entries(obj != null ? obj : {}).filter(([_, value]) => value !== void 0).map(([key, value]) => `${key}=${encodeURIComponent(value instanceof Date ? value.toISOString() : value)}`).join("&");
 }
@@ -1176,7 +1329,7 @@ var MoonbaseApi = class {
     const contentType = (_a = options == null ? void 0 : options.contentType) != null ? _a : "application/json";
     this.logger.debug("Making request to Moonbase API...", {
       path,
-      body: options == null ? void 0 : options.body
+      body: loggableBody(options == null ? void 0 : options.body)
     });
     const startedAt = /* @__PURE__ */ new Date();
     const request = {
@@ -1189,7 +1342,8 @@ var MoonbaseApi = class {
         ...accessToken ? { Authorization: `Bearer ${accessToken}` } : {},
         // Force CORS on all calls
         "x-mb-cors": "1",
-        "x-mb-client": this.clientHeader
+        "x-mb-client": this.clientHeader,
+        ...options == null ? void 0 : options.headers
       },
       body: (options == null ? void 0 : options.body) ? contentType !== "application/json" ? options.body : JSON.stringify(options.body) : void 0,
       signal: options == null ? void 0 : options.abort,
@@ -1299,7 +1453,7 @@ __export(schemas_exports8, {
   milestoneProgressSchema: () => milestoneProgressSchema,
   subscriptionSchema: () => subscriptionSchema
 });
-var import_zod13 = require("zod");
+var import_zod14 = require("zod");
 
 // src/orders/schemas.ts
 var schemas_exports7 = {};
@@ -1313,7 +1467,7 @@ __export(schemas_exports7, {
   orderSchema: () => orderSchema,
   orderTotalSchema: () => orderTotalSchema
 });
-var import_zod12 = require("zod");
+var import_zod13 = require("zod");
 
 // src/orders/models.ts
 var OrderStatus = /* @__PURE__ */ ((OrderStatus2) => {
@@ -1326,18 +1480,18 @@ var OrderStatus = /* @__PURE__ */ ((OrderStatus2) => {
 })(OrderStatus || {});
 
 // src/orders/schemas.ts
-var couponSchema = import_zod12.z.object({
-  code: import_zod12.z.string(),
-  name: import_zod12.z.string(),
-  description: import_zod12.z.string()
-});
-var lineItemProductSchema = import_zod12.z.object({
-  id: import_zod12.z.string(),
-  name: import_zod12.z.string(),
-  tagline: import_zod12.z.string().nullish(),
-  iconUrl: import_zod12.z.string().nullable()
-});
-var lineItemTotalSchema = import_zod12.z.object({
+var couponSchema = import_zod13.z.object({
+  code: import_zod13.z.string(),
+  name: import_zod13.z.string(),
+  description: import_zod13.z.string()
+});
+var lineItemProductSchema = import_zod13.z.object({
+  id: import_zod13.z.string(),
+  name: import_zod13.z.string(),
+  tagline: import_zod13.z.string().nullish(),
+  iconUrl: import_zod13.z.string().nullable()
+});
+var lineItemTotalSchema = import_zod13.z.object({
   original: moneySchema,
   discount: moneySchema,
   subtotal: moneySchema,
@@ -1346,52 +1500,59 @@ var lineItemTotalSchema = import_zod12.z.object({
   // for this item. Both are part of `discount`. Absent on orders priced before cart offers existed.
   cartOfferDiscount: moneySchema.optional()
 });
-var openProductLineItem = import_zod12.z.object({
-  id: import_zod12.z.string(),
-  type: import_zod12.z.literal("Product"),
-  productId: import_zod12.z.string(),
-  quantity: import_zod12.z.number(),
-  variationId: import_zod12.z.string(),
-  offerId: import_zod12.z.string().optional(),
-  isDefaultVariation: import_zod12.z.boolean().nullish(),
-  isSubcriptionPayment: import_zod12.z.boolean().nullish(),
+var openProductLineItem = import_zod13.z.object({
+  id: import_zod13.z.string(),
+  type: import_zod13.z.literal("Product"),
+  productId: import_zod13.z.string(),
+  quantity: import_zod13.z.number(),
+  variationId: import_zod13.z.string(),
+  offerId: import_zod13.z.string().optional(),
+  isDefaultVariation: import_zod13.z.boolean().nullish(),
+  isSubcriptionPayment: import_zod13.z.boolean().nullish(),
   price: priceCollectionSchema.optional(),
   variation: pricingVariationSchema.optional(),
   total: lineItemTotalSchema.nullish(),
   product: lineItemProductSchema.optional(),
-  appliedDiscount: discountSchema.optional()
-});
-var lineItemBundleSchema = import_zod12.z.object({
-  id: import_zod12.z.string(),
-  name: import_zod12.z.string(),
-  tagline: import_zod12.z.string().nullish(),
-  iconUrl: import_zod12.z.string().nullable(),
-  products: lineItemProductSchema.and(import_zod12.z.object({
-    included: import_zod12.z.boolean().optional()
+  appliedDiscount: discountSchema.optional(),
+  // The customer's license this line upgrades or renews, as the cart named it. Such a line is one
+  // license, so its quantity is always 1, and the line's `id` names the license too
+  // (`p/<productId>/<variationId>/<licenseId>`): upgrading two licenses takes two lines. A line
+  // without one issues new licenses. Part of the cart payload like `offerId`, so a push that leaves
+  // it out forgets it. Echoed on completed orders too. Absent from a backend that predates release
+  // access.
+  targetLicenseId: import_zod13.z.string().nullish().catch(void 0)
+});
+var lineItemBundleSchema = import_zod13.z.object({
+  id: import_zod13.z.string(),
+  name: import_zod13.z.string(),
+  tagline: import_zod13.z.string().nullish(),
+  iconUrl: import_zod13.z.string().nullable(),
+  products: lineItemProductSchema.and(import_zod13.z.object({
+    included: import_zod13.z.boolean().optional()
   })).array()
 });
-var openBundleLineItem = import_zod12.z.object({
-  id: import_zod12.z.string(),
-  type: import_zod12.z.literal("Bundle"),
-  bundleId: import_zod12.z.string(),
-  quantity: import_zod12.z.number(),
-  variationId: import_zod12.z.string(),
-  offerId: import_zod12.z.string().optional(),
-  partial: import_zod12.z.boolean().optional(),
-  replaced: import_zod12.z.string().array().optional(),
-  isDefaultVariation: import_zod12.z.boolean().nullish(),
-  isSubcriptionPayment: import_zod12.z.boolean().nullish(),
+var openBundleLineItem = import_zod13.z.object({
+  id: import_zod13.z.string(),
+  type: import_zod13.z.literal("Bundle"),
+  bundleId: import_zod13.z.string(),
+  quantity: import_zod13.z.number(),
+  variationId: import_zod13.z.string(),
+  offerId: import_zod13.z.string().optional(),
+  partial: import_zod13.z.boolean().optional(),
+  replaced: import_zod13.z.string().array().optional(),
+  isDefaultVariation: import_zod13.z.boolean().nullish(),
+  isSubcriptionPayment: import_zod13.z.boolean().nullish(),
   price: priceCollectionSchema.optional(),
   variation: pricingVariationSchema.optional(),
   total: lineItemTotalSchema.nullish(),
   bundle: lineItemBundleSchema.optional(),
   appliedDiscount: discountSchema.optional()
 });
-var openOrderLineItem = import_zod12.z.discriminatedUnion("type", [
+var openOrderLineItem = import_zod13.z.discriminatedUnion("type", [
   openProductLineItem,
   openBundleLineItem
 ]);
-var orderTotalSchema = import_zod12.z.object({
+var orderTotalSchema = import_zod13.z.object({
   original: moneySchema,
   discount: moneySchema,
   subtotal: moneySchema,
@@ -1401,52 +1562,52 @@ var orderTotalSchema = import_zod12.z.object({
   // rather than a share on every line. Absent when no cart offer applied.
   cartOfferDiscount: moneySchema.optional()
 });
-var openOrderSchema = import_zod12.z.object({
-  id: import_zod12.z.string(),
-  currency: import_zod12.z.string(),
+var openOrderSchema = import_zod13.z.object({
+  id: import_zod13.z.string(),
+  currency: import_zod13.z.string(),
   total: orderTotalSchema.nullish(),
   items: openOrderLineItem.array(),
   couponsApplied: couponSchema.array(),
   // The cart offer on the order as a whole: the buyer's intent. It is part of the cart payload, so
   // a content push that leaves it out clears it. The API echoes it back even while the cart sits
   // below the offer's threshold.
-  offerId: import_zod12.z.string().optional(),
+  offerId: import_zod13.z.string().optional(),
   // The cart offer as actually applied: the result. Absent while the offer's condition doesn't hold.
   appliedOffer: discountSchema.optional(),
-  checkoutUrl: import_zod12.z.string().optional(),
-  hostedCheckoutUrl: import_zod12.z.string().optional(),
-  embeddedCheckoutUrl: import_zod12.z.string().optional()
-});
-var customerSnapshotSchema = import_zod12.z.object({
-  name: import_zod12.z.string().nullable(),
-  businessName: import_zod12.z.string().nullable(),
-  taxId: import_zod12.z.string().nullable(),
-  email: import_zod12.z.string().nullable(),
-  phone: import_zod12.z.string().nullable(),
+  checkoutUrl: import_zod13.z.string().optional(),
+  hostedCheckoutUrl: import_zod13.z.string().optional(),
+  embeddedCheckoutUrl: import_zod13.z.string().optional()
+});
+var customerSnapshotSchema = import_zod13.z.object({
+  name: import_zod13.z.string().nullable(),
+  businessName: import_zod13.z.string().nullable(),
+  taxId: import_zod13.z.string().nullable(),
+  email: import_zod13.z.string().nullable(),
+  phone: import_zod13.z.string().nullable(),
   address: addressSchema.nullable()
 });
-var completedOrderSchema = import_zod12.z.object({
-  id: import_zod12.z.string(),
-  status: import_zod12.z.literal("Completed" /* Completed */),
-  currency: import_zod12.z.string(),
+var completedOrderSchema = import_zod13.z.object({
+  id: import_zod13.z.string(),
+  status: import_zod13.z.literal("Completed" /* Completed */),
+  currency: import_zod13.z.string(),
   customer: customerSnapshotSchema,
   total: orderTotalSchema,
   items: openOrderLineItem.array(),
   couponsApplied: couponSchema.array(),
   appliedOffer: discountSchema.optional()
 });
-var orderSchema = import_zod12.z.discriminatedUnion("status", [
+var orderSchema = import_zod13.z.discriminatedUnion("status", [
   openOrderSchema.extend({
-    status: import_zod12.z.literal("Open" /* Open */)
+    status: import_zod13.z.literal("Open" /* Open */)
   }),
   openOrderSchema.extend({
-    status: import_zod12.z.literal("PaymentProcessing" /* PaymentProcessing */)
+    status: import_zod13.z.literal("PaymentProcessing" /* PaymentProcessing */)
   }),
   openOrderSchema.extend({
-    status: import_zod12.z.literal("Paid" /* Paid */)
+    status: import_zod13.z.literal("Paid" /* Paid */)
   }),
   openOrderSchema.extend({
-    status: import_zod12.z.literal("Failed" /* Failed */)
+    status: import_zod13.z.literal("Failed" /* Failed */)
   }),
   completedOrderSchema
 ]);
@@ -1470,58 +1631,58 @@ var SubscriptionCancellationReason = /* @__PURE__ */ ((SubscriptionCancellationR
 })(SubscriptionCancellationReason || {});
 
 // src/inventory/subscriptions/schemas.ts
-var baseMilestoneProgressEventSchema = import_zod13.z.object({
-  milestoneId: import_zod13.z.string(),
-  fulfilled: import_zod13.z.boolean(),
-  afterCycleNumber: import_zod13.z.number(),
-  afterNormalizedCycleNumber: import_zod13.z.number(),
-  message: import_zod13.z.string().optional()
-});
-var milestoneProgressEventSchema = import_zod13.z.discriminatedUnion("type", [
+var baseMilestoneProgressEventSchema = import_zod14.z.object({
+  milestoneId: import_zod14.z.string(),
+  fulfilled: import_zod14.z.boolean(),
+  afterCycleNumber: import_zod14.z.number(),
+  afterNormalizedCycleNumber: import_zod14.z.number(),
+  message: import_zod14.z.string().optional()
+});
+var milestoneProgressEventSchema = import_zod14.z.discriminatedUnion("type", [
   baseMilestoneProgressEventSchema.extend({
-    type: import_zod13.z.literal("CouponCodeMilestone"),
-    code: import_zod13.z.string().optional(),
-    redeemed: import_zod13.z.boolean().optional()
+    type: import_zod14.z.literal("CouponCodeMilestone"),
+    code: import_zod14.z.string().optional(),
+    redeemed: import_zod14.z.boolean().optional()
   }),
   baseMilestoneProgressEventSchema.extend({
-    type: import_zod13.z.literal("PerpetualLicenseConversionMilestone")
+    type: import_zod14.z.literal("PerpetualLicenseConversionMilestone")
   })
 ]);
-var milestoneProgressSchema = import_zod13.z.object({
-  title: import_zod13.z.string(),
-  description: import_zod13.z.string().nullish(),
-  currentCycleNumber: import_zod13.z.number(),
-  currentNormalizedCycleNumber: import_zod13.z.number(),
-  currentCycleIsCompleted: import_zod13.z.boolean(),
-  fromCycleNumber: import_zod13.z.number(),
-  fromNormalizedCycleNumber: import_zod13.z.number(),
-  toCycleNumber: import_zod13.z.number(),
-  toNormalizedCycleNumber: import_zod13.z.number(),
-  events: import_zod13.z.record(import_zod13.z.coerce.number(), milestoneProgressEventSchema.array())
-});
-var subscriptionSchema = import_zod13.z.object({
-  id: import_zod13.z.string(),
-  status: import_zod13.z.nativeEnum(SubscriptionStatus),
-  hasPaymentMethod: import_zod13.z.boolean(),
-  cancellable: import_zod13.z.boolean(),
-  expiresAt: import_zod13.z.coerce.date(),
-  renewedAt: import_zod13.z.coerce.date().nullable(),
-  nextPaymentScheduledAt: import_zod13.z.coerce.date().nullable(),
-  startedAt: import_zod13.z.coerce.date(),
+var milestoneProgressSchema = import_zod14.z.object({
+  title: import_zod14.z.string(),
+  description: import_zod14.z.string().nullish(),
+  currentCycleNumber: import_zod14.z.number(),
+  currentNormalizedCycleNumber: import_zod14.z.number(),
+  currentCycleIsCompleted: import_zod14.z.boolean(),
+  fromCycleNumber: import_zod14.z.number(),
+  fromNormalizedCycleNumber: import_zod14.z.number(),
+  toCycleNumber: import_zod14.z.number(),
+  toNormalizedCycleNumber: import_zod14.z.number(),
+  events: import_zod14.z.record(import_zod14.z.coerce.number(), milestoneProgressEventSchema.array())
+});
+var subscriptionSchema = import_zod14.z.object({
+  id: import_zod14.z.string(),
+  status: import_zod14.z.nativeEnum(SubscriptionStatus),
+  hasPaymentMethod: import_zod14.z.boolean(),
+  cancellable: import_zod14.z.boolean(),
+  expiresAt: import_zod14.z.coerce.date(),
+  renewedAt: import_zod14.z.coerce.date().nullable(),
+  nextPaymentScheduledAt: import_zod14.z.coerce.date().nullable(),
+  startedAt: import_zod14.z.coerce.date(),
   total: orderTotalSchema,
-  cycleLength: import_zod13.z.nativeEnum(CycleLength),
-  paymentMethod: import_zod13.z.string().optional(),
+  cycleLength: import_zod14.z.nativeEnum(CycleLength),
+  paymentMethod: import_zod14.z.string().optional(),
   milestoneProgress: milestoneProgressSchema.nullish(),
-  embeddedUpdatePaymentUrl: import_zod13.z.string().optional(),
-  content: import_zod13.z.discriminatedUnion("type", [
-    import_zod13.z.object({
-      type: import_zod13.z.literal("Product"),
-      quantity: import_zod13.z.number(),
+  embeddedUpdatePaymentUrl: import_zod14.z.string().optional(),
+  content: import_zod14.z.discriminatedUnion("type", [
+    import_zod14.z.object({
+      type: import_zod14.z.literal("Product"),
+      quantity: import_zod14.z.number(),
       product: storefrontProductSchema
     }),
-    import_zod13.z.object({
-      type: import_zod13.z.literal("Bundle"),
-      quantity: import_zod13.z.number(),
+    import_zod14.z.object({
+      type: import_zod14.z.literal("Bundle"),
+      quantity: import_zod14.z.number(),
       bundle: storefrontBundleSchema
     })
   ])
@@ -1557,8 +1718,8 @@ var SubscriptionEndpoints = class {
     return response.data;
   }
   async renew(subscriptionId, returnUrl, embedded) {
-    const response = await this.api.authenticatedFetch(`/api/customer/inventory/subscriptions/${subscriptionId}/renew?redirect=false&return=${returnUrl}&embedded=${embedded ? "true" : "false"}`, import_zod14.z.object({
-      location: import_zod14.z.string()
+    const response = await this.api.authenticatedFetch(`/api/customer/inventory/subscriptions/${subscriptionId}/renew?redirect=false&return=${returnUrl}&embedded=${embedded ? "true" : "false"}`, import_zod15.z.object({
+      location: import_zod15.z.string()
     }), { method: "POST" });
     return response.data;
   }
@@ -1825,6 +1986,50 @@ var InMemoryStore = class {
   }
 };
 
+// src/utils/pendingPasswords.ts
+var lifetime = 24 * 60 * 60 * 1e3;
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+var _PendingPasswordStore = class _PendingPasswordStore {
+  constructor(store) {
+    this.store = store != null ? store : isLocalStorageAvailable() ? new LocalStorageStore() : new InMemoryStore();
+  }
+  get(email) {
+    var _a, _b;
+    return (_b = (_a = this.read()[normalizeEmail(email)]) == null ? void 0 : _a.token) != null ? _b : null;
+  }
+  set(email, token) {
+    this.write({ ...this.read(), [normalizeEmail(email)]: { token, storedAt: Date.now() } });
+  }
+  remove(email) {
+    const entries = this.read();
+    delete entries[normalizeEmail(email)];
+    this.write(entries);
+  }
+  /** The entries still worth keeping. Drops the rest from storage as it goes. */
+  read() {
+    const stored = this.store.get(_PendingPasswordStore.storageKey);
+    if (!stored || typeof stored !== "object")
+      return {};
+    const now = Date.now();
+    const fresh = Object.fromEntries(Object.entries(stored).filter(
+      ([, entry]) => typeof (entry == null ? void 0 : entry.token) === "string" && typeof entry.storedAt === "number" && now - entry.storedAt < lifetime
+    ));
+    if (Object.keys(fresh).length !== Object.keys(stored).length)
+      this.write(fresh);
+    return fresh;
+  }
+  write(entries) {
+    if (Object.keys(entries).length > 0)
+      this.store.set(_PendingPasswordStore.storageKey, entries);
+    else
+      this.store.remove(_PendingPasswordStore.storageKey);
+  }
+};
+_PendingPasswordStore.storageKey = "moonbase_pending_passwords";
+var PendingPasswordStore = _PendingPasswordStore;
+
 // src/utils/tokenStore.ts
 var defaultAccessTokenLifetime = 15 * 60 * 1e3;
 var renewBeforeExpiry = 5 * 60 * 1e3;
@@ -1834,9 +2039,9 @@ function accessTokenLifetime(accessToken) {
   try {
     const payload = accessToken.split(".")[1].replaceAll("-", "+").replaceAll("_", "/");
     const claims = JSON.parse(atob(payload.padEnd(Math.ceil(payload.length / 4) * 4, "=")));
-    const lifetime = (Number(claims.exp) - Number(claims.iat)) * 1e3;
-    if (Number.isFinite(lifetime) && lifetime > 0 && lifetime <= 24 * 60 * 60 * 1e3)
-      return lifetime;
+    const lifetime2 = (Number(claims.exp) - Number(claims.iat)) * 1e3;
+    if (Number.isFinite(lifetime2) && lifetime2 > 0 && lifetime2 <= 24 * 60 * 60 * 1e3)
+      return lifetime2;
   } catch (e) {
   }
   return defaultAccessTokenLifetime;
@@ -2083,21 +2288,21 @@ __export(schemas_exports9, {
   vendorFeaturesSchema: () => vendorFeaturesSchema,
   vendorSchema: () => vendorSchema
 });
-var import_zod15 = require("zod");
-var vendorCaptchaSchema = import_zod15.z.object({
-  url: import_zod15.z.string()
+var import_zod16 = require("zod");
+var vendorCaptchaSchema = import_zod16.z.object({
+  url: import_zod16.z.string()
 });
-var vendorFeaturesSchema = import_zod15.z.object({
-  customerPortal: import_zod15.z.boolean().optional(),
-  phoneNumber: import_zod15.z.boolean().optional(),
-  marketingConsent: import_zod15.z.nativeEnum(MarketingConsentType).optional().catch(void 0),
+var vendorFeaturesSchema = import_zod16.z.object({
+  customerPortal: import_zod16.z.boolean().optional(),
+  phoneNumber: import_zod16.z.boolean().optional(),
+  marketingConsent: import_zod16.z.nativeEnum(MarketingConsentType).optional().catch(void 0),
   // Absent on backends from before captchas, which never ask for one.
   captcha: vendorCaptchaSchema.nullish()
 });
-var vendorSchema = import_zod15.z.object({
-  id: import_zod15.z.string(),
-  name: import_zod15.z.string(),
-  logoUrl: import_zod15.z.string().nullable(),
+var vendorSchema = import_zod16.z.object({
+  id: import_zod16.z.string(),
+  name: import_zod16.z.string(),
+  logoUrl: import_zod16.z.string().nullable(),
   features: vendorFeaturesSchema.optional()
 });
 
@@ -2117,16 +2322,16 @@ var schemas_exports10 = {};
 __export(schemas_exports10, {
   voucherSchema: () => voucherSchema
 });
-var import_zod16 = require("zod");
-var voucherSchema = import_zod16.z.object({
-  id: import_zod16.z.string(),
-  name: import_zod16.z.string(),
-  description: import_zod16.z.string(),
-  code: import_zod16.z.string(),
-  redeemed: import_zod16.z.boolean(),
+var import_zod17 = require("zod");
+var voucherSchema = import_zod17.z.object({
+  id: import_zod17.z.string(),
+  name: import_zod17.z.string(),
+  description: import_zod17.z.string(),
+  code: import_zod17.z.string(),
+  redeemed: import_zod17.z.boolean(),
   redeemsProducts: quantifiable(storefrontProductSchema).array(),
   redeemsBundles: quantifiable(storefrontBundleSchema).array(),
-  properties: import_zod16.z.record(rawPropertyValueSchema).nullish()
+  properties: import_zod17.z.record(rawPropertyValueSchema).nullish()
 });
 
 // src/vouchers/endpoints.ts
@@ -2327,11 +2532,48 @@ var OfferUtils = class _OfferUtils {
 // src/utils/cart.ts
 var _CartUtils = class _CartUtils {
   // The pricing variation a line item points at, falling back to the item's default variation when
-  // the variation id doesn't resolve, which is what the cart has always displayed.
+  // the variation id doesn't resolve, which is what the cart has always displayed. A line upgrading
+  // one of the customer's licenses is priced for that license, as the API prices it.
   static resolveVariation(catalog, item) {
-    var _a, _b;
-    const source = item.type === "Product" ? catalog.products.find((p) => p.id === item.productId) : catalog.bundles.find((b) => b.id === item.bundleId);
-    return (_b = (_a = source == null ? void 0 : source.variations) == null ? void 0 : _a.find((v) => v.id === item.variationId)) != null ? _b : source == null ? void 0 : source.defaultVariation;
+    var _a, _b, _c;
+    if (item.type === "Product") {
+      const product = catalog.products.find((p) => p.id === item.productId);
+      return (_a = _CartUtils.productLineVariation(product, item.variationId, item.targetLicenseId)) != null ? _a : product == null ? void 0 : product.defaultVariation;
+    }
+    const bundle = catalog.bundles.find((b) => b.id === item.bundleId);
+    return (_c = (_b = bundle == null ? void 0 : bundle.variations) == null ? void 0 : _b.find((v) => v.id === item.variationId)) != null ? _c : bundle == null ? void 0 : bundle.defaultVariation;
+  }
+  /**
+   * The storefront's entry for upgrading or renewing one of the signed-in customer's licenses of a
+   * product: what it covers now, and the variations that would upgrade it, priced for it. Licenses
+   * that cover the same share an entry. `undefined` when the storefront has none for it (the license
+   * is not theirs, covers every release, is past the cap on entries, or the customer is not signed in).
+   */
+  static licenseUpgrade(product, licenseId) {
+    var _a;
+    if (!product || !licenseId)
+      return void 0;
+    const wanted = licenseId.toLowerCase();
+    return (_a = product.licenseUpgrades) == null ? void 0 : _a.find((u) => u.licenseIds.some((id) => id.toLowerCase() === wanted));
+  }
+  /**
+   * The variations that would upgrade or renew one of the signed-in customer's licenses of a
+   * product, priced for that license, or `undefined` when the storefront has no price for it.
+   */
+  static licenseUpgradeVariations(product, licenseId) {
+    var _a;
+    return (_a = _CartUtils.licenseUpgrade(product, licenseId)) == null ? void 0 : _a.variations;
+  }
+  /**
+   * The variation a product line is priced at. A line naming one of the customer's licenses
+   * (`targetLicenseId`) upgrades that license, and an upgrade discount is judged per license, so its
+   * price comes from the product's `licenseUpgrades` for that license. Every other line, and an
+   * upgrade line the storefront has no price for, takes the product's own variation, which is what
+   * a new license costs.
+   */
+  static productLineVariation(product, variationId, targetLicenseId) {
+    var _a, _b, _c;
+    return (_c = (_a = _CartUtils.licenseUpgradeVariations(product, targetLicenseId)) == null ? void 0 : _a.find((v) => v.id === variationId)) != null ? _c : (_b = product == null ? void 0 : product.variations) == null ? void 0 : _b.find((v) => v.id === variationId);
   }
   // A line's unit price after its product discount and any pricing tier, and *before* any offer.
   // This is the basis the API measures cart total conditions on, which is why it reads the catalog
@@ -2778,7 +3020,7 @@ var MoonbaseClient = class {
     this.tokenStore = new TokenStore(configuration);
     this.api = new MoonbaseApi(this.configuration.endpoint, this.tokenStore, this.logger, this.configuration.sdk);
     this.storefront = new StorefrontEndpoints(this.api, this.configuration);
-    this.identity = new IdentityEndpoints(this.api, this.tokenStore, this.logger);
+    this.identity = new IdentityEndpoints(this.api, this.tokenStore, this.logger, new PendingPasswordStore(configuration.store));
     this.communications = new CommunicationsEndpoints(this.api);
     this.groups = new GroupEndpoints(this.api);
     this.vouchers = new VoucherEndpoints(this.api);
@@ -2816,7 +3058,9 @@ var MoonbaseClient = class {
   NotFoundError,
   OfferUtils,
   OrderStatus,
+  PasswordSetupRequiredError,
   Platform,
+  ReleaseNotCoveredError,
   StoreClosedError,
   SubscriptionCancellationReason,
   SubscriptionStatus,