@moonbase.sh/storefront-api 3.8.0 → 3.10.0

package/dist/index.js

@@ -20,6 +20,7 @@ __export(schemas_exports2, {
   offerConditionSchema: () => offerConditionSchema,
   offerScopeSchema: () => offerScopeSchema,
   storefrontBundleSchema: () => storefrontBundleSchema,
+  storefrontLicenseUpgradeSchema: () => storefrontLicenseUpgradeSchema,
   storefrontOfferSchema: () => storefrontOfferSchema,
   storefrontOfferTargetSchema: () => storefrontOfferTargetSchema,
   storefrontProductSchema: () => storefrontProductSchema,
@@ -154,6 +155,7 @@ var schemas_exports = {};
 __export(schemas_exports, {
   downloadSchema: () => downloadSchema,
   manifestSchema: () => manifestSchema,
+  productReleaseAccessSchema: () => productReleaseAccessSchema,
   productReleaseSchema: () => productReleaseSchema,
   productSummarySchema: () => productSummarySchema
 });
@@ -196,6 +198,21 @@ var downloadSchema = z2.object({
   path: z2.string().nullable(),
   manifest: manifestSchema.optional()
 });
+var productReleaseAccessSchema = z2.object({
+  // Releases published until then are covered, and every version while it has not passed.
+  updatesUntil: z2.coerce.date().nullish().catch(void 0),
+  // Every version whose major is at most this is covered.
+  upToMajor: z2.number().nullish().catch(void 0),
+  // Once updates have ended, the last version published before they did.
+  upToVersion: z2.string().nullish().catch(void 0),
+  // Whether the release this was resolved for (the one shown) is covered. Read as covered when
+  // unreadable, so a garbled answer never locks a download the API would hand out.
+  coversRelease: z2.boolean().catch(true),
+  // The newest published version the customer may download, when the shown one is not covered.
+  latestCoveredVersion: z2.string().nullish().catch(void 0),
+  // Where to buy the upgrade or renewal, while the product sells one.
+  upgradeUrl: z2.string().nullish().catch(void 0)
+});
 var productSummarySchema = z2.object({
   id: z2.string(),
   name: z2.string(),
@@ -219,7 +236,10 @@ var productSummarySchema = z2.object({
   // Whether this caller clears every requirement above, including the group membership the client
   // can't see for itself. False with none of them set means the merchant closed the release to everyone.
   downloadsAllowed: z2.boolean(),
-  downloads: z2.array(downloadSchema).optional()
+  downloads: z2.array(downloadSchema).optional(),
+  // Set only when the customer's licenses do not cover every release. `downloadsAllowed` already
+  // accounts for it; this says why a download is locked and where to upgrade.
+  releaseAccess: productReleaseAccessSchema.nullish().catch(void 0)
 });
 var productReleaseSchema = z2.object({
   version: z2.string(),
@@ -229,10 +249,33 @@ var productReleaseSchema = z2.object({
   // merchant can keep past releases to owners while the current one is open to anyone.
   downloadsAllowed: z2.boolean(),
   downloads: z2.array(downloadSchema),
-  properties: z2.record(rawPropertyValueSchema).nullish()
+  properties: z2.record(rawPropertyValueSchema).nullish(),
+  // True when the caller owns the product but none of their licenses covers this release, so it
+  // takes an upgrade rather than a sign-in to unlock. Absent otherwise.
+  releaseNotCovered: z2.boolean().nullish().catch(void 0)
 });
 
 // src/storefront/schemas.ts
+var storefrontLicenseUpgradeSchema = z3.object({
+  // The customer's licenses this entry prices. An entry without them is no use and is left out.
+  licenseIds: z3.string().array(),
+  // What those licenses cover now, which is how a cart tells the customer which of their licenses an
+  // upgrade is for. Read leniently, field by field: a backend that predates it leaves it out, and one
+  // this version cannot read reads as absent rather than costing the entry.
+  releaseAccess: z3.object({
+    // Releases published until then are covered, and every version while it has not passed.
+    updatesUntil: z3.coerce.date().nullish().catch(void 0),
+    // Every version whose major is at most this is covered.
+    upToMajor: z3.number().nullish().catch(void 0),
+    // Once updates have ended, the last version published before they did.
+    upToVersion: z3.string().nullish().catch(void 0)
+  }).nullish().catch(void 0),
+  variations: pricingVariationSchema.array()
+});
+var storefrontLicenseUpgradesSchema = z3.array(z3.unknown()).transform((upgrades) => upgrades.flatMap((upgrade) => {
+  const parsed = storefrontLicenseUpgradeSchema.safeParse(upgrade);
+  return parsed.success ? [parsed.data] : [];
+}));
 var storefrontProductSchema = z3.object({
   id: z3.string(),
   name: z3.string(),
@@ -246,7 +289,13 @@ var storefrontProductSchema = z3.object({
   defaultVariation: pricingVariationSchema.optional(),
   variations: pricingVariationSchema.array().optional(),
   properties: z3.record(rawPropertyValueSchema).nullish(),
-  type: z3.string().optional().default("Product").pipe(z3.literal("Product"))
+  type: z3.string().optional().default("Product").pipe(z3.literal("Product")),
+  // What upgrading or renewing the signed-in customer's licenses of the product that cover only
+  // some releases costs, one entry per group of licenses that cover the same, furthest behind first.
+  // Capped, so a customer with a great many licenses may find one in none of them. Absent for anyone
+  // else, and from a backend that predates per-license prices. A cart line naming one of these
+  // licenses (`targetLicenseId`) is priced from here: see `CartUtils.licenseUpgrade`.
+  licenseUpgrades: storefrontLicenseUpgradesSchema.nullish().catch(void 0)
 });
 var storefrontBundleSchema = z3.object({
   id: z3.string(),
@@ -420,7 +469,17 @@ var activationRequestSchema = z4.object({
     endless: z4.boolean().default(false)
   }).optional(),
   licenseEligibility: z4.object({
-    eligible: z4.boolean()
+    eligible: z4.boolean(),
+    // Set when the customer's licenses would take the device but none of them covers the version
+    // the app runs (`eligible` is then false), so the app's version needs an upgrade. Absent from
+    // a backend that predates release access, and read leniently so it can never fail the request.
+    releaseNotCovered: z4.object({
+      appVersion: z4.string().nullish().catch(void 0),
+      updatesUntil: z4.coerce.date().nullish().catch(void 0),
+      upToMajor: z4.number().nullish().catch(void 0),
+      upToVersion: z4.string().nullish().catch(void 0),
+      upgradeUrl: z4.string().nullish().catch(void 0)
+    }).nullish().catch(void 0)
   }).optional()
 });
 
@@ -499,7 +558,8 @@ var CommunicationsEndpoints = class {
         newsletter: (_b = input.newsletter) != null ? _b : true,
         productUpdates: (_c = input.productUpdates) != null ? _c : true,
         groupIds: normalizeGroupIds(input.groupIds)
-      }
+      },
+      headers: input.captchaToken ? { "X-MB-CAPTCHA": input.captchaToken } : void 0
     });
     return response.data;
   }
@@ -579,6 +639,15 @@ var NotAuthorizedError = class extends Error {
     this.message = "Not allowed";
   }
 };
+var ReleaseNotCoveredError = class extends NotAuthorizedError {
+  constructor(releaseAccess, upgradeUrl, detail) {
+    super();
+    this.releaseAccess = releaseAccess;
+    this.upgradeUrl = upgradeUrl;
+    this.name = "ReleaseNotCoveredError";
+    this.message = detail != null ? detail : "Your license doesn't cover this version";
+  }
+};
 var NotAuthenticatedError = class extends Error {
   constructor() {
     super();
@@ -621,6 +690,15 @@ var CaptchaRequiredError = class extends MoonbaseError {
     this.name = "CaptchaRequiredError";
   }
 };
+var PasswordSetupRequiredError = class extends MoonbaseError {
+  constructor(detail, title, status) {
+    super(title != null ? title : "Password setup required", detail, status);
+    this.name = "PasswordSetupRequiredError";
+  }
+};
+
+// src/utils/problemHandler.ts
+import { z as z8 } from "zod";
 
 // src/utils/problemDetails.ts
 import { z as z7 } from "zod";
@@ -635,6 +713,28 @@ var problemDetailsSchema = z7.object({
 });
 
 // src/utils/problemHandler.ts
+var releaseNotCoveredProblemSchema = z8.object({
+  errorType: z8.literal("ReleaseNotCovered"),
+  detail: z8.string().nullish().catch(void 0),
+  releaseAccess: productReleaseAccessSchema.nullish().catch(void 0),
+  upgradeUrl: z8.string().nullish().catch(void 0)
+});
+async function forbiddenError(response) {
+  var _a;
+  try {
+    const problem = releaseNotCoveredProblemSchema.safeParse(JSON.parse(await response.text()));
+    if (problem.success) {
+      const { releaseAccess, upgradeUrl, detail } = problem.data;
+      return new ReleaseNotCoveredError(
+        releaseAccess != null ? releaseAccess : void 0,
+        (_a = upgradeUrl != null ? upgradeUrl : releaseAccess == null ? void 0 : releaseAccess.upgradeUrl) != null ? _a : void 0,
+        detail != null ? detail : void 0
+      );
+    }
+  } catch (e) {
+  }
+  return new NotAuthorizedError();
+}
 function camelCase(str) {
   return str.split(".").map((word, index) => {
     let [firstLetter, ...restOfLetters] = word;
@@ -644,13 +744,14 @@ function camelCase(str) {
   }).join("");
 }
 async function handleResponseProblem(response, logger) {
+  var _a;
   if (response.status === 404)
     throw new NotFoundError();
   if (response.status === 401) {
     throw new NotAuthenticatedError();
   }
   if (response.status === 403) {
-    throw new NotAuthorizedError();
+    throw await forbiddenError(response);
   }
   let problemDetails;
   const body = await response.text();
@@ -665,6 +766,8 @@ async function handleResponseProblem(response, logger) {
     throw new StoreClosedError(problemDetails.detail);
   if (problemDetails.errorType === "CaptchaRequired")
     throw new CaptchaRequiredError(problemDetails.detail, problemDetails.title);
+  if (problemDetails.errorType === "PasswordSetupRequired")
+    throw new PasswordSetupRequiredError(problemDetails.detail, problemDetails.title, (_a = problemDetails.status) != null ? _a : response.status);
   throw new MoonbaseError(
     problemDetails.title,
     problemDetails.detail,
@@ -683,11 +786,12 @@ __export(schemas_exports5, {
   identitySchema: () => identitySchema,
   ilokConnectedAccountSchema: () => ilokConnectedAccountSchema,
   pendingActivationSchema: () => pendingActivationSchema,
+  pendingPasswordProblemSchema: () => pendingPasswordProblemSchema,
   userAccountConfirmedSchema: () => userAccountConfirmedSchema,
   userAccountConfirmedStatusSchema: () => userAccountConfirmedStatusSchema,
   userSchema: () => userSchema
 });
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 
 // src/identity/models.ts
 var ConnectableAccountProvider = /* @__PURE__ */ ((ConnectableAccountProvider2) => {
@@ -696,73 +800,78 @@ var ConnectableAccountProvider = /* @__PURE__ */ ((ConnectableAccountProvider2)
 })(ConnectableAccountProvider || {});
 
 // src/identity/schemas.ts
-var addressSchema = z8.object({
-  countryCode: z8.string(),
-  streetAddress1: z8.string(),
-  streetAddress2: z8.string().nullable(),
-  locality: z8.string().nullable(),
-  region: z8.string().nullable(),
-  postCode: z8.string().nullable()
-});
-var communicationPreferencesSchema = z8.object({
-  newsletterOptIn: z8.boolean(),
+var addressSchema = z9.object({
+  countryCode: z9.string(),
+  streetAddress1: z9.string(),
+  streetAddress2: z9.string().nullable(),
+  locality: z9.string().nullable(),
+  region: z9.string().nullable(),
+  postCode: z9.string().nullable()
+});
+var communicationPreferencesSchema = z9.object({
+  newsletterOptIn: z9.boolean(),
   // Default keeps older persisted identities (pre productUpdatesOptIn) parseable
   // during boot. The server-side value is hydrated by updateUser() right after.
-  productUpdatesOptIn: z8.boolean().default(false)
+  productUpdatesOptIn: z9.boolean().default(false)
 });
-var ilokConnectedAccountSchema = z8.object({
-  provider: z8.literal("iLok" /* iLok */),
-  isConnected: z8.boolean(),
-  pendingLicenseFulfillments: z8.boolean(),
-  accountId: z8.string().nullish()
+var ilokConnectedAccountSchema = z9.object({
+  provider: z9.literal("iLok" /* iLok */),
+  isConnected: z9.boolean(),
+  pendingLicenseFulfillments: z9.boolean(),
+  accountId: z9.string().nullish()
 });
-var connectedAccountSchema = z8.discriminatedUnion("provider", [
+var connectedAccountSchema = z9.discriminatedUnion("provider", [
   ilokConnectedAccountSchema
 ]);
-var connectionUrlSchema = z8.object({
-  url: z8.string()
+var connectionUrlSchema = z9.object({
+  url: z9.string()
 });
-var userSchema = z8.object({
-  id: z8.string(),
-  email: z8.string(),
+var userSchema = z9.object({
+  id: z9.string(),
+  email: z9.string(),
   // Nullable: customers created via import may have no name.
-  name: z8.string().nullable(),
-  tenantId: z8.string(),
+  name: z9.string().nullable(),
+  tenantId: z9.string(),
   address: addressSchema.optional(),
-  phone: z8.string().optional(),
+  phone: z9.string().optional(),
   communicationPreferences: communicationPreferencesSchema,
-  ownedProducts: z8.string().array().optional(),
-  subscribedProducts: z8.string().array().optional(),
-  confirmedAccount: z8.boolean().optional(),
-  hasProducts: z8.boolean().nullish(),
-  hasSubscriptions: z8.boolean().nullish(),
-  connectedAccounts: z8.array(connectedAccountSchema).default([])
-});
-var identitySchema = userSchema.and(z8.object({
-  accessToken: z8.string(),
-  refreshToken: z8.string()
+  ownedProducts: z9.string().array().optional(),
+  subscribedProducts: z9.string().array().optional(),
+  confirmedAccount: z9.boolean().optional(),
+  hasProducts: z9.boolean().nullish(),
+  hasSubscriptions: z9.boolean().nullish(),
+  connectedAccounts: z9.array(connectedAccountSchema).default([])
+});
+var identitySchema = userSchema.and(z9.object({
+  accessToken: z9.string(),
+  refreshToken: z9.string()
 }));
-var userAccountConfirmedStatusSchema = z8.enum([
+var userAccountConfirmedStatusSchema = z9.enum([
   "PasswordSetupRequired",
   "SignedIn"
 ]);
-var userAccountConfirmedSchema = userSchema.and(z8.object({
+var userAccountConfirmedSchema = userSchema.and(z9.object({
   status: userAccountConfirmedStatusSchema,
-  resetPasswordToken: z8.string().nullish(),
-  accessToken: z8.string().nullish(),
-  refreshToken: z8.string().nullish()
+  resetPasswordToken: z9.string().nullish(),
+  accessToken: z9.string().nullish(),
+  refreshToken: z9.string().nullish()
 }));
-var pendingActivationSchema = z8.object({
-  status: z8.literal("activation_pending"),
-  email: z8.string()
+var pendingActivationSchema = z9.object({
+  status: z9.literal("activation_pending"),
+  email: z9.string()
+});
+var pendingPasswordProblemSchema = z9.object({
+  errorType: z9.literal("PasswordSetupRequired"),
+  pendingPasswordToken: z9.string()
 });
 
 // src/identity/endpoints.ts
 var IdentityEndpoints = class {
-  constructor(api, tokenStore, logger) {
+  constructor(api, tokenStore, logger, pendingPasswords) {
     this.api = api;
     this.tokenStore = tokenStore;
     this.logger = logger;
+    this.pendingPasswords = pendingPasswords;
   }
   async get() {
     const response = await this.api.authenticatedFetch("/api/customer/meta/user", userSchema);
@@ -818,8 +927,11 @@ var IdentityEndpoints = class {
         groupIds: normalizeGroupIds(options == null ? void 0 : options.groupIds)
       })
     });
-    if (response.status >= 400)
+    if (response.status >= 400) {
+      if (response.status === 409)
+        await this.keepPendingPassword(email, response.clone());
       await handleResponseProblem(response, this.logger);
+    }
     const data = await response.json();
     if (response.status === 202) {
       const parsed = pendingActivationSchema.parse(data);
@@ -835,6 +947,19 @@ var IdentityEndpoints = class {
     this.tokenStore.setUser(identity);
     return { status: "signed-in", user: userSchema.parse(identity) };
   }
+  /**
+   * The address already has an account with no password, so the server emailed it a link and
+   * handed back the password just typed, sealed, for that link to set once it is opened here.
+   * Never thrown: the caller still gets the `PasswordSetupRequiredError` from the response.
+   */
+  async keepPendingPassword(email, response) {
+    try {
+      const problem = pendingPasswordProblemSchema.safeParse(await response.json());
+      if (problem.success)
+        this.pendingPasswords.set(email, problem.data.pendingPasswordToken);
+    } catch (e) {
+    }
+  }
   /**
    * Signs the buyer out here at once, and ends the session on the server so its refresh
    * token stops working too. Resolves once the server has answered, and never rejects:
@@ -886,7 +1011,13 @@ var IdentityEndpoints = class {
       await handleResponseProblem(response, this.logger);
   }
   async confirmAccount(email, code) {
-    const response = await this.api.fetch(`/api/customer/identity/confirm-account?email=${encodeURIComponent(email)}&code=${encodeURIComponent(code.replaceAll(" ", "+"))}&scheme=JWT`, userAccountConfirmedSchema, { method: "POST" });
+    const pendingPasswordToken = this.pendingPasswords.get(email);
+    const response = await this.api.fetch(`/api/customer/identity/confirm-account?email=${encodeURIComponent(email)}&code=${encodeURIComponent(code.replaceAll(" ", "+"))}&scheme=JWT`, userAccountConfirmedSchema, {
+      method: "POST",
+      body: pendingPasswordToken ? { pendingPasswordToken } : void 0
+    });
+    if (pendingPasswordToken)
+      this.pendingPasswords.remove(email);
     const result = response.data;
     if (result.status === "SignedIn") {
       if (!result.accessToken || !result.refreshToken) {
@@ -927,16 +1058,17 @@ var IdentityEndpoints = class {
 };
 
 // src/inventory/activation/endpoints.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 
 // src/inventory/licenses/schemas.ts
 var schemas_exports6 = {};
 __export(schemas_exports6, {
   activationSchema: () => activationSchema,
   externalLicenseContent: () => externalLicenseContent,
+  licenseReleaseAccessSchema: () => licenseReleaseAccessSchema,
   licenseSchema: () => licenseSchema
 });
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 
 // src/inventory/licenses/models.ts
 var LicenseStatus = /* @__PURE__ */ ((LicenseStatus2) => {
@@ -957,43 +1089,57 @@ var ActivationMethod = /* @__PURE__ */ ((ActivationMethod2) => {
 })(ActivationMethod || {});
 
 // src/inventory/licenses/schemas.ts
-var externalLicenseFileContent = z9.object({
-  type: z9.literal("file"),
-  fileName: z9.string(),
-  contentType: z9.string(),
-  data: z9.string()
-});
-var externalLicenseILokContent = z9.object({
-  type: z9.literal("iLok")
-});
-var externalLicenseContent = z9.union([
-  z9.string(),
-  z9.discriminatedUnion("type", [
+var externalLicenseFileContent = z10.object({
+  type: z10.literal("file"),
+  fileName: z10.string(),
+  contentType: z10.string(),
+  data: z10.string()
+});
+var externalLicenseILokContent = z10.object({
+  type: z10.literal("iLok")
+});
+var externalLicenseContent = z10.union([
+  z10.string(),
+  z10.discriminatedUnion("type", [
     externalLicenseFileContent,
     externalLicenseILokContent
   ])
 ]);
-var licenseSchema = z9.object({
-  id: z9.string(),
-  status: z9.nativeEnum(LicenseStatus),
+var licenseReleaseAccessSchema = z10.object({
+  // Releases published until then are covered, and every version while it has not passed.
+  updatesUntil: z10.coerce.date().nullish().catch(void 0),
+  // Every version whose major is at most this is covered.
+  upToMajor: z10.number().nullish().catch(void 0),
+  // Once updates have ended, the last version published before they did.
+  upToVersion: z10.string().nullish().catch(void 0),
+  // Whether the product's current release is covered, so whether to offer an upgrade. Read as
+  // covered when unreadable, so a garbled answer never pushes an upgrade nobody needs.
+  coversCurrentRelease: z10.boolean().catch(true),
+  // Where to buy the upgrade or renewal for this license, while the product sells one.
+  upgradeUrl: z10.string().nullish().catch(void 0)
+});
+var licenseSchema = z10.object({
+  id: z10.string(),
+  status: z10.nativeEnum(LicenseStatus),
   product: productSummarySchema,
-  activeNumberOfActivations: z9.number(),
-  maxNumberOfActivations: z9.number(),
+  activeNumberOfActivations: z10.number(),
+  maxNumberOfActivations: z10.number(),
   externalFulfillment: externalLicenseContent.optional(),
-  requiredConnectedAccount: z9.nativeEnum(ConnectableAccountProvider).nullish(),
-  fulfillmentMessage: z9.string().optional(),
-  properties: z9.record(rawPropertyValueSchema).nullish(),
-  expiresAt: z9.coerce.date().optional(),
-  createdAt: z9.coerce.date()
+  requiredConnectedAccount: z10.nativeEnum(ConnectableAccountProvider).nullish(),
+  fulfillmentMessage: z10.string().optional(),
+  properties: z10.record(rawPropertyValueSchema).nullish(),
+  expiresAt: z10.coerce.date().optional(),
+  createdAt: z10.coerce.date(),
+  releaseAccess: licenseReleaseAccessSchema.nullish().catch(void 0)
 });
-var activationSchema = z9.object({
-  id: z9.string(),
-  licenseId: z9.string(),
-  name: z9.string(),
-  status: z9.nativeEnum(ActivationStatus),
-  activationMethod: z9.nativeEnum(ActivationMethod),
-  firstValidatedAt: z9.coerce.date(),
-  lastValidatedAt: z9.coerce.date().nullable()
+var activationSchema = z10.object({
+  id: z10.string(),
+  licenseId: z10.string(),
+  name: z10.string(),
+  status: z10.nativeEnum(ActivationStatus),
+  activationMethod: z10.nativeEnum(ActivationMethod),
+  firstValidatedAt: z10.coerce.date(),
+  lastValidatedAt: z10.coerce.date().nullable()
 });
 
 // src/inventory/activation/endpoints.ts
@@ -1010,7 +1156,7 @@ var ActivationEndpoints = class {
     });
     return {
       license: response.data,
-      url: z10.string().parse(response.headers.location)
+      url: z11.string().parse(response.headers.location)
     };
   }
 };
@@ -1038,7 +1184,7 @@ var LicenseEndpoints = class {
 };
 
 // src/inventory/products/endpoints.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 var ProductEndpoints = class {
   constructor(api, configuration) {
     this.api = api;
@@ -1072,18 +1218,18 @@ var ProductEndpoints = class {
   async getDownloadUrl(path) {
     const url = new URL(path);
     url.searchParams.append("redirect", "false");
-    const response = await this.api.fetch(url.pathname + url.search, z11.object({
-      location: z11.string()
+    const response = await this.api.fetch(url.pathname + url.search, z12.object({
+      location: z12.string()
     }));
     return response.data.location;
   }
 };
 
 // src/inventory/subscriptions/endpoints.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 
 // package.json
-var version = "3.8.0";
+var version = "3.10.0";
 
 // src/utils/client.ts
 function buildClientHeader(sdk) {
@@ -1091,6 +1237,11 @@ function buildClientHeader(sdk) {
 }
 
 // src/utils/api.ts
+function loggableBody(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body))
+    return body;
+  return Object.fromEntries(Object.entries(body).map(([key, value]) => [key, /password|token/i.test(key) && value != null ? "[redacted]" : value]));
+}
 function objectToQuery(obj) {
   return Object.entries(obj != null ? obj : {}).filter(([_, value]) => value !== void 0).map(([key, value]) => `${key}=${encodeURIComponent(value instanceof Date ? value.toISOString() : value)}`).join("&");
 }
@@ -1112,7 +1263,7 @@ var MoonbaseApi = class {
     const contentType = (_a = options == null ? void 0 : options.contentType) != null ? _a : "application/json";
     this.logger.debug("Making request to Moonbase API...", {
       path,
-      body: options == null ? void 0 : options.body
+      body: loggableBody(options == null ? void 0 : options.body)
     });
     const startedAt = /* @__PURE__ */ new Date();
     const request = {
@@ -1125,7 +1276,8 @@ var MoonbaseApi = class {
         ...accessToken ? { Authorization: `Bearer ${accessToken}` } : {},
         // Force CORS on all calls
         "x-mb-cors": "1",
-        "x-mb-client": this.clientHeader
+        "x-mb-client": this.clientHeader,
+        ...options == null ? void 0 : options.headers
       },
       body: (options == null ? void 0 : options.body) ? contentType !== "application/json" ? options.body : JSON.stringify(options.body) : void 0,
       signal: options == null ? void 0 : options.abort,
@@ -1235,7 +1387,7 @@ __export(schemas_exports8, {
   milestoneProgressSchema: () => milestoneProgressSchema,
   subscriptionSchema: () => subscriptionSchema
 });
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 
 // src/orders/schemas.ts
 var schemas_exports7 = {};
@@ -1249,7 +1401,7 @@ __export(schemas_exports7, {
   orderSchema: () => orderSchema,
   orderTotalSchema: () => orderTotalSchema
 });
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 
 // src/orders/models.ts
 var OrderStatus = /* @__PURE__ */ ((OrderStatus2) => {
@@ -1262,18 +1414,18 @@ var OrderStatus = /* @__PURE__ */ ((OrderStatus2) => {
 })(OrderStatus || {});
 
 // src/orders/schemas.ts
-var couponSchema = z12.object({
-  code: z12.string(),
-  name: z12.string(),
-  description: z12.string()
-});
-var lineItemProductSchema = z12.object({
-  id: z12.string(),
-  name: z12.string(),
-  tagline: z12.string().nullish(),
-  iconUrl: z12.string().nullable()
-});
-var lineItemTotalSchema = z12.object({
+var couponSchema = z13.object({
+  code: z13.string(),
+  name: z13.string(),
+  description: z13.string()
+});
+var lineItemProductSchema = z13.object({
+  id: z13.string(),
+  name: z13.string(),
+  tagline: z13.string().nullish(),
+  iconUrl: z13.string().nullable()
+});
+var lineItemTotalSchema = z13.object({
   original: moneySchema,
   discount: moneySchema,
   subtotal: moneySchema,
@@ -1282,52 +1434,59 @@ var lineItemTotalSchema = z12.object({
   // for this item. Both are part of `discount`. Absent on orders priced before cart offers existed.
   cartOfferDiscount: moneySchema.optional()
 });
-var openProductLineItem = z12.object({
-  id: z12.string(),
-  type: z12.literal("Product"),
-  productId: z12.string(),
-  quantity: z12.number(),
-  variationId: z12.string(),
-  offerId: z12.string().optional(),
-  isDefaultVariation: z12.boolean().nullish(),
-  isSubcriptionPayment: z12.boolean().nullish(),
+var openProductLineItem = z13.object({
+  id: z13.string(),
+  type: z13.literal("Product"),
+  productId: z13.string(),
+  quantity: z13.number(),
+  variationId: z13.string(),
+  offerId: z13.string().optional(),
+  isDefaultVariation: z13.boolean().nullish(),
+  isSubcriptionPayment: z13.boolean().nullish(),
   price: priceCollectionSchema.optional(),
   variation: pricingVariationSchema.optional(),
   total: lineItemTotalSchema.nullish(),
   product: lineItemProductSchema.optional(),
-  appliedDiscount: discountSchema.optional()
+  appliedDiscount: discountSchema.optional(),
+  // The customer's license this line upgrades or renews, as the cart named it. Such a line is one
+  // license, so its quantity is always 1, and the line's `id` names the license too
+  // (`p/<productId>/<variationId>/<licenseId>`): upgrading two licenses takes two lines. A line
+  // without one issues new licenses. Part of the cart payload like `offerId`, so a push that leaves
+  // it out forgets it. Echoed on completed orders too. Absent from a backend that predates release
+  // access.
+  targetLicenseId: z13.string().nullish().catch(void 0)
 });
-var lineItemBundleSchema = z12.object({
-  id: z12.string(),
-  name: z12.string(),
-  tagline: z12.string().nullish(),
-  iconUrl: z12.string().nullable(),
-  products: lineItemProductSchema.and(z12.object({
-    included: z12.boolean().optional()
+var lineItemBundleSchema = z13.object({
+  id: z13.string(),
+  name: z13.string(),
+  tagline: z13.string().nullish(),
+  iconUrl: z13.string().nullable(),
+  products: lineItemProductSchema.and(z13.object({
+    included: z13.boolean().optional()
   })).array()
 });
-var openBundleLineItem = z12.object({
-  id: z12.string(),
-  type: z12.literal("Bundle"),
-  bundleId: z12.string(),
-  quantity: z12.number(),
-  variationId: z12.string(),
-  offerId: z12.string().optional(),
-  partial: z12.boolean().optional(),
-  replaced: z12.string().array().optional(),
-  isDefaultVariation: z12.boolean().nullish(),
-  isSubcriptionPayment: z12.boolean().nullish(),
+var openBundleLineItem = z13.object({
+  id: z13.string(),
+  type: z13.literal("Bundle"),
+  bundleId: z13.string(),
+  quantity: z13.number(),
+  variationId: z13.string(),
+  offerId: z13.string().optional(),
+  partial: z13.boolean().optional(),
+  replaced: z13.string().array().optional(),
+  isDefaultVariation: z13.boolean().nullish(),
+  isSubcriptionPayment: z13.boolean().nullish(),
   price: priceCollectionSchema.optional(),
   variation: pricingVariationSchema.optional(),
   total: lineItemTotalSchema.nullish(),
   bundle: lineItemBundleSchema.optional(),
   appliedDiscount: discountSchema.optional()
 });
-var openOrderLineItem = z12.discriminatedUnion("type", [
+var openOrderLineItem = z13.discriminatedUnion("type", [
   openProductLineItem,
   openBundleLineItem
 ]);
-var orderTotalSchema = z12.object({
+var orderTotalSchema = z13.object({
   original: moneySchema,
   discount: moneySchema,
   subtotal: moneySchema,
@@ -1337,52 +1496,52 @@ var orderTotalSchema = z12.object({
   // rather than a share on every line. Absent when no cart offer applied.
   cartOfferDiscount: moneySchema.optional()
 });
-var openOrderSchema = z12.object({
-  id: z12.string(),
-  currency: z12.string(),
+var openOrderSchema = z13.object({
+  id: z13.string(),
+  currency: z13.string(),
   total: orderTotalSchema.nullish(),
   items: openOrderLineItem.array(),
   couponsApplied: couponSchema.array(),
   // The cart offer on the order as a whole: the buyer's intent. It is part of the cart payload, so
   // a content push that leaves it out clears it. The API echoes it back even while the cart sits
   // below the offer's threshold.
-  offerId: z12.string().optional(),
+  offerId: z13.string().optional(),
   // The cart offer as actually applied: the result. Absent while the offer's condition doesn't hold.
   appliedOffer: discountSchema.optional(),
-  checkoutUrl: z12.string().optional(),
-  hostedCheckoutUrl: z12.string().optional(),
-  embeddedCheckoutUrl: z12.string().optional()
-});
-var customerSnapshotSchema = z12.object({
-  name: z12.string().nullable(),
-  businessName: z12.string().nullable(),
-  taxId: z12.string().nullable(),
-  email: z12.string().nullable(),
-  phone: z12.string().nullable(),
+  checkoutUrl: z13.string().optional(),
+  hostedCheckoutUrl: z13.string().optional(),
+  embeddedCheckoutUrl: z13.string().optional()
+});
+var customerSnapshotSchema = z13.object({
+  name: z13.string().nullable(),
+  businessName: z13.string().nullable(),
+  taxId: z13.string().nullable(),
+  email: z13.string().nullable(),
+  phone: z13.string().nullable(),
   address: addressSchema.nullable()
 });
-var completedOrderSchema = z12.object({
-  id: z12.string(),
-  status: z12.literal("Completed" /* Completed */),
-  currency: z12.string(),
+var completedOrderSchema = z13.object({
+  id: z13.string(),
+  status: z13.literal("Completed" /* Completed */),
+  currency: z13.string(),
   customer: customerSnapshotSchema,
   total: orderTotalSchema,
   items: openOrderLineItem.array(),
   couponsApplied: couponSchema.array(),
   appliedOffer: discountSchema.optional()
 });
-var orderSchema = z12.discriminatedUnion("status", [
+var orderSchema = z13.discriminatedUnion("status", [
   openOrderSchema.extend({
-    status: z12.literal("Open" /* Open */)
+    status: z13.literal("Open" /* Open */)
   }),
   openOrderSchema.extend({
-    status: z12.literal("PaymentProcessing" /* PaymentProcessing */)
+    status: z13.literal("PaymentProcessing" /* PaymentProcessing */)
   }),
   openOrderSchema.extend({
-    status: z12.literal("Paid" /* Paid */)
+    status: z13.literal("Paid" /* Paid */)
   }),
   openOrderSchema.extend({
-    status: z12.literal("Failed" /* Failed */)
+    status: z13.literal("Failed" /* Failed */)
   }),
   completedOrderSchema
 ]);
@@ -1406,58 +1565,58 @@ var SubscriptionCancellationReason = /* @__PURE__ */ ((SubscriptionCancellationR
 })(SubscriptionCancellationReason || {});
 
 // src/inventory/subscriptions/schemas.ts
-var baseMilestoneProgressEventSchema = z13.object({
-  milestoneId: z13.string(),
-  fulfilled: z13.boolean(),
-  afterCycleNumber: z13.number(),
-  afterNormalizedCycleNumber: z13.number(),
-  message: z13.string().optional()
-});
-var milestoneProgressEventSchema = z13.discriminatedUnion("type", [
+var baseMilestoneProgressEventSchema = z14.object({
+  milestoneId: z14.string(),
+  fulfilled: z14.boolean(),
+  afterCycleNumber: z14.number(),
+  afterNormalizedCycleNumber: z14.number(),
+  message: z14.string().optional()
+});
+var milestoneProgressEventSchema = z14.discriminatedUnion("type", [
   baseMilestoneProgressEventSchema.extend({
-    type: z13.literal("CouponCodeMilestone"),
-    code: z13.string().optional(),
-    redeemed: z13.boolean().optional()
+    type: z14.literal("CouponCodeMilestone"),
+    code: z14.string().optional(),
+    redeemed: z14.boolean().optional()
   }),
   baseMilestoneProgressEventSchema.extend({
-    type: z13.literal("PerpetualLicenseConversionMilestone")
+    type: z14.literal("PerpetualLicenseConversionMilestone")
   })
 ]);
-var milestoneProgressSchema = z13.object({
-  title: z13.string(),
-  description: z13.string().nullish(),
-  currentCycleNumber: z13.number(),
-  currentNormalizedCycleNumber: z13.number(),
-  currentCycleIsCompleted: z13.boolean(),
-  fromCycleNumber: z13.number(),
-  fromNormalizedCycleNumber: z13.number(),
-  toCycleNumber: z13.number(),
-  toNormalizedCycleNumber: z13.number(),
-  events: z13.record(z13.coerce.number(), milestoneProgressEventSchema.array())
-});
-var subscriptionSchema = z13.object({
-  id: z13.string(),
-  status: z13.nativeEnum(SubscriptionStatus),
-  hasPaymentMethod: z13.boolean(),
-  cancellable: z13.boolean(),
-  expiresAt: z13.coerce.date(),
-  renewedAt: z13.coerce.date().nullable(),
-  nextPaymentScheduledAt: z13.coerce.date().nullable(),
-  startedAt: z13.coerce.date(),
+var milestoneProgressSchema = z14.object({
+  title: z14.string(),
+  description: z14.string().nullish(),
+  currentCycleNumber: z14.number(),
+  currentNormalizedCycleNumber: z14.number(),
+  currentCycleIsCompleted: z14.boolean(),
+  fromCycleNumber: z14.number(),
+  fromNormalizedCycleNumber: z14.number(),
+  toCycleNumber: z14.number(),
+  toNormalizedCycleNumber: z14.number(),
+  events: z14.record(z14.coerce.number(), milestoneProgressEventSchema.array())
+});
+var subscriptionSchema = z14.object({
+  id: z14.string(),
+  status: z14.nativeEnum(SubscriptionStatus),
+  hasPaymentMethod: z14.boolean(),
+  cancellable: z14.boolean(),
+  expiresAt: z14.coerce.date(),
+  renewedAt: z14.coerce.date().nullable(),
+  nextPaymentScheduledAt: z14.coerce.date().nullable(),
+  startedAt: z14.coerce.date(),
   total: orderTotalSchema,
-  cycleLength: z13.nativeEnum(CycleLength),
-  paymentMethod: z13.string().optional(),
+  cycleLength: z14.nativeEnum(CycleLength),
+  paymentMethod: z14.string().optional(),
   milestoneProgress: milestoneProgressSchema.nullish(),
-  embeddedUpdatePaymentUrl: z13.string().optional(),
-  content: z13.discriminatedUnion("type", [
-    z13.object({
-      type: z13.literal("Product"),
-      quantity: z13.number(),
+  embeddedUpdatePaymentUrl: z14.string().optional(),
+  content: z14.discriminatedUnion("type", [
+    z14.object({
+      type: z14.literal("Product"),
+      quantity: z14.number(),
       product: storefrontProductSchema
     }),
-    z13.object({
-      type: z13.literal("Bundle"),
-      quantity: z13.number(),
+    z14.object({
+      type: z14.literal("Bundle"),
+      quantity: z14.number(),
       bundle: storefrontBundleSchema
     })
   ])
@@ -1493,8 +1652,8 @@ var SubscriptionEndpoints = class {
     return response.data;
   }
   async renew(subscriptionId, returnUrl, embedded) {
-    const response = await this.api.authenticatedFetch(`/api/customer/inventory/subscriptions/${subscriptionId}/renew?redirect=false&return=${returnUrl}&embedded=${embedded ? "true" : "false"}`, z14.object({
-      location: z14.string()
+    const response = await this.api.authenticatedFetch(`/api/customer/inventory/subscriptions/${subscriptionId}/renew?redirect=false&return=${returnUrl}&embedded=${embedded ? "true" : "false"}`, z15.object({
+      location: z15.string()
     }), { method: "POST" });
     return response.data;
   }
@@ -1761,6 +1920,50 @@ var InMemoryStore = class {
   }
 };
 
+// src/utils/pendingPasswords.ts
+var lifetime = 24 * 60 * 60 * 1e3;
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
+}
+var _PendingPasswordStore = class _PendingPasswordStore {
+  constructor(store) {
+    this.store = store != null ? store : isLocalStorageAvailable() ? new LocalStorageStore() : new InMemoryStore();
+  }
+  get(email) {
+    var _a, _b;
+    return (_b = (_a = this.read()[normalizeEmail(email)]) == null ? void 0 : _a.token) != null ? _b : null;
+  }
+  set(email, token) {
+    this.write({ ...this.read(), [normalizeEmail(email)]: { token, storedAt: Date.now() } });
+  }
+  remove(email) {
+    const entries = this.read();
+    delete entries[normalizeEmail(email)];
+    this.write(entries);
+  }
+  /** The entries still worth keeping. Drops the rest from storage as it goes. */
+  read() {
+    const stored = this.store.get(_PendingPasswordStore.storageKey);
+    if (!stored || typeof stored !== "object")
+      return {};
+    const now = Date.now();
+    const fresh = Object.fromEntries(Object.entries(stored).filter(
+      ([, entry]) => typeof (entry == null ? void 0 : entry.token) === "string" && typeof entry.storedAt === "number" && now - entry.storedAt < lifetime
+    ));
+    if (Object.keys(fresh).length !== Object.keys(stored).length)
+      this.write(fresh);
+    return fresh;
+  }
+  write(entries) {
+    if (Object.keys(entries).length > 0)
+      this.store.set(_PendingPasswordStore.storageKey, entries);
+    else
+      this.store.remove(_PendingPasswordStore.storageKey);
+  }
+};
+_PendingPasswordStore.storageKey = "moonbase_pending_passwords";
+var PendingPasswordStore = _PendingPasswordStore;
+
 // src/utils/tokenStore.ts
 var defaultAccessTokenLifetime = 15 * 60 * 1e3;
 var renewBeforeExpiry = 5 * 60 * 1e3;
@@ -1770,9 +1973,9 @@ function accessTokenLifetime(accessToken) {
   try {
     const payload = accessToken.split(".")[1].replaceAll("-", "+").replaceAll("_", "/");
     const claims = JSON.parse(atob(payload.padEnd(Math.ceil(payload.length / 4) * 4, "=")));
-    const lifetime = (Number(claims.exp) - Number(claims.iat)) * 1e3;
-    if (Number.isFinite(lifetime) && lifetime > 0 && lifetime <= 24 * 60 * 60 * 1e3)
-      return lifetime;
+    const lifetime2 = (Number(claims.exp) - Number(claims.iat)) * 1e3;
+    if (Number.isFinite(lifetime2) && lifetime2 > 0 && lifetime2 <= 24 * 60 * 60 * 1e3)
+      return lifetime2;
   } catch (e) {
   }
   return defaultAccessTokenLifetime;
@@ -2019,21 +2222,21 @@ __export(schemas_exports9, {
   vendorFeaturesSchema: () => vendorFeaturesSchema,
   vendorSchema: () => vendorSchema
 });
-import { z as z15 } from "zod";
-var vendorCaptchaSchema = z15.object({
-  url: z15.string()
+import { z as z16 } from "zod";
+var vendorCaptchaSchema = z16.object({
+  url: z16.string()
 });
-var vendorFeaturesSchema = z15.object({
-  customerPortal: z15.boolean().optional(),
-  phoneNumber: z15.boolean().optional(),
-  marketingConsent: z15.nativeEnum(MarketingConsentType).optional().catch(void 0),
+var vendorFeaturesSchema = z16.object({
+  customerPortal: z16.boolean().optional(),
+  phoneNumber: z16.boolean().optional(),
+  marketingConsent: z16.nativeEnum(MarketingConsentType).optional().catch(void 0),
   // Absent on backends from before captchas, which never ask for one.
   captcha: vendorCaptchaSchema.nullish()
 });
-var vendorSchema = z15.object({
-  id: z15.string(),
-  name: z15.string(),
-  logoUrl: z15.string().nullable(),
+var vendorSchema = z16.object({
+  id: z16.string(),
+  name: z16.string(),
+  logoUrl: z16.string().nullable(),
   features: vendorFeaturesSchema.optional()
 });
 
@@ -2053,16 +2256,16 @@ var schemas_exports10 = {};
 __export(schemas_exports10, {
   voucherSchema: () => voucherSchema
 });
-import { z as z16 } from "zod";
-var voucherSchema = z16.object({
-  id: z16.string(),
-  name: z16.string(),
-  description: z16.string(),
-  code: z16.string(),
-  redeemed: z16.boolean(),
+import { z as z17 } from "zod";
+var voucherSchema = z17.object({
+  id: z17.string(),
+  name: z17.string(),
+  description: z17.string(),
+  code: z17.string(),
+  redeemed: z17.boolean(),
   redeemsProducts: quantifiable(storefrontProductSchema).array(),
   redeemsBundles: quantifiable(storefrontBundleSchema).array(),
-  properties: z16.record(rawPropertyValueSchema).nullish()
+  properties: z17.record(rawPropertyValueSchema).nullish()
 });
 
 // src/vouchers/endpoints.ts
@@ -2263,11 +2466,48 @@ var OfferUtils = class _OfferUtils {
 // src/utils/cart.ts
 var _CartUtils = class _CartUtils {
   // The pricing variation a line item points at, falling back to the item's default variation when
-  // the variation id doesn't resolve, which is what the cart has always displayed.
+  // the variation id doesn't resolve, which is what the cart has always displayed. A line upgrading
+  // one of the customer's licenses is priced for that license, as the API prices it.
   static resolveVariation(catalog, item) {
-    var _a, _b;
-    const source = item.type === "Product" ? catalog.products.find((p) => p.id === item.productId) : catalog.bundles.find((b) => b.id === item.bundleId);
-    return (_b = (_a = source == null ? void 0 : source.variations) == null ? void 0 : _a.find((v) => v.id === item.variationId)) != null ? _b : source == null ? void 0 : source.defaultVariation;
+    var _a, _b, _c;
+    if (item.type === "Product") {
+      const product = catalog.products.find((p) => p.id === item.productId);
+      return (_a = _CartUtils.productLineVariation(product, item.variationId, item.targetLicenseId)) != null ? _a : product == null ? void 0 : product.defaultVariation;
+    }
+    const bundle = catalog.bundles.find((b) => b.id === item.bundleId);
+    return (_c = (_b = bundle == null ? void 0 : bundle.variations) == null ? void 0 : _b.find((v) => v.id === item.variationId)) != null ? _c : bundle == null ? void 0 : bundle.defaultVariation;
+  }
+  /**
+   * The storefront's entry for upgrading or renewing one of the signed-in customer's licenses of a
+   * product: what it covers now, and the variations that would upgrade it, priced for it. Licenses
+   * that cover the same share an entry. `undefined` when the storefront has none for it (the license
+   * is not theirs, covers every release, is past the cap on entries, or the customer is not signed in).
+   */
+  static licenseUpgrade(product, licenseId) {
+    var _a;
+    if (!product || !licenseId)
+      return void 0;
+    const wanted = licenseId.toLowerCase();
+    return (_a = product.licenseUpgrades) == null ? void 0 : _a.find((u) => u.licenseIds.some((id) => id.toLowerCase() === wanted));
+  }
+  /**
+   * The variations that would upgrade or renew one of the signed-in customer's licenses of a
+   * product, priced for that license, or `undefined` when the storefront has no price for it.
+   */
+  static licenseUpgradeVariations(product, licenseId) {
+    var _a;
+    return (_a = _CartUtils.licenseUpgrade(product, licenseId)) == null ? void 0 : _a.variations;
+  }
+  /**
+   * The variation a product line is priced at. A line naming one of the customer's licenses
+   * (`targetLicenseId`) upgrades that license, and an upgrade discount is judged per license, so its
+   * price comes from the product's `licenseUpgrades` for that license. Every other line, and an
+   * upgrade line the storefront has no price for, takes the product's own variation, which is what
+   * a new license costs.
+   */
+  static productLineVariation(product, variationId, targetLicenseId) {
+    var _a, _b, _c;
+    return (_c = (_a = _CartUtils.licenseUpgradeVariations(product, targetLicenseId)) == null ? void 0 : _a.find((v) => v.id === variationId)) != null ? _c : (_b = product == null ? void 0 : product.variations) == null ? void 0 : _b.find((v) => v.id === variationId);
   }
   // A line's unit price after its product discount and any pricing tier, and *before* any offer.
   // This is the basis the API measures cart total conditions on, which is why it reads the catalog
@@ -2714,7 +2954,7 @@ var MoonbaseClient = class {
     this.tokenStore = new TokenStore(configuration);
     this.api = new MoonbaseApi(this.configuration.endpoint, this.tokenStore, this.logger, this.configuration.sdk);
     this.storefront = new StorefrontEndpoints(this.api, this.configuration);
-    this.identity = new IdentityEndpoints(this.api, this.tokenStore, this.logger);
+    this.identity = new IdentityEndpoints(this.api, this.tokenStore, this.logger, new PendingPasswordStore(configuration.store));
     this.communications = new CommunicationsEndpoints(this.api);
     this.groups = new GroupEndpoints(this.api);
     this.vouchers = new VoucherEndpoints(this.api);
@@ -2751,7 +2991,9 @@ export {
   NotFoundError,
   OfferUtils,
   OrderStatus,
+  PasswordSetupRequiredError,
   Platform,
+  ReleaseNotCoveredError,
   StoreClosedError,
   SubscriptionCancellationReason,
   SubscriptionStatus,