@occluze/tether 0.6.7 → 0.6.8

package/dist/tether.account.js

@@ -1,3 +1,4 @@
+"use strict";
 (() => {
   var __defProp = Object.defineProperty;
   var __export = (target, all) => {
@@ -19,7 +20,7 @@
     mountAccount: () => mountAccount,
     order: () => order,
     orders: () => orders,
-    query: () => query,
+    query: () => query2,
     render: () => render,
     requestReturn: () => requestReturn,
     saveAddress: () => saveAddress,
@@ -30,7 +31,7 @@
 
   // tether-core:config.js
   var m = window.Tether.__core["config.js"];
-  var { DEFAULTS, cfg, configure, isConfigured, log, reportError, warn } = m;
+  var { DEFAULTS, cfg, configure, isConfigured, log, reportError, resolveConfig, toMetafieldIdentifier, warn } = m;
 
   // tether-core:client.js
   var m2 = window.Tether.__core["client.js"];
@@ -38,422 +39,751 @@
 
   // tether-core:dom.js
   var m3 = window.Tether.__core["dom.js"];
-  var { attr, busy, cdnUrl, dataKey, emit, formatDate, formatMoney, formatPercent, get, has, hasTemplate, imageUrl, notifyLayoutChanged, parseJSONAttr, productUrl, qsa, readText, repeat, repeatKeyed, sameImage, scoped, sel, setImage, setSelected, setText, setTextTracked, show, toAttributes, watchImages } = m3;
+  var { attr, busy, cdnUrl, emit, formatDate, formatMoney, formatPercent, get, has, hasTemplate, imageUrl, notifyLayoutChanged, parseJSONAttr, productUrl, qsa, repeat, repeatKeyed, sameImage, scoped, sel, setImage, setSelected, setStoreHtml, setText, setTextTracked, show, toAttributes, watchImages } = m3;
 
   // tether-core:cart.js
   var m4 = window.Tether.__core["cart.js"];
-  var { Cart, focusables, toLineInput } = m4;
+  var { Cart, trapFocus } = m4;
 
   // tether-core:lazy.js
   var m5 = window.Tether.__core["lazy.js"];
   var { coreModules, loadPart } = m5;
 
-  // src/account.js
-  var KEY = () => `${cfg.prefix}:account:${cfg.domain}`;
-  var PENDING = () => `${cfg.prefix}:account-login:${cfg.domain}`;
-  var store = () => cfg.account?.remember ? window.localStorage : window.sessionStorage;
-  var b64url = (bytes) => btoa(String.fromCharCode(...new Uint8Array(bytes))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-  var random = () => b64url(crypto.getRandomValues(new Uint8Array(32)));
-  var sha256 = async (s) => b64url(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(s)));
-  var go = (url) => (cfg.account?.navigate || ((u) => window.location.assign(u)))(url);
-  var read = (s, k) => {
+  // server/src/shared/account-documents.js
+  var MONEY = "amount currencyCode";
+  var CUSTOMER_QUERY = "query TetherCustomer { customer { id firstName lastName displayName emailAddress { emailAddress } defaultAddress { formatted } } }";
+  var ORDERS_QUERY = `query TetherOrders($first:Int!){customer{orders(first:$first,sortKey:PROCESSED_AT,reverse:true){nodes{id name processedAt financialStatus fulfillmentStatus statusPageUrl totalPrice{${MONEY}}lineItems(first:20){nodes{title variantTitle quantity image{url altText}}}}}}}`;
+
+  // server/src/shared/base64url.js
+  function toBase64Url(bytes) {
+    return btoa(String.fromCharCode(...new Uint8Array(bytes))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  }
+  function fromBase64Url(text) {
+    const base64 = text.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(text.length / 4) * 4, "=");
+    return Uint8Array.from(atob(base64), (char) => char.charCodeAt(0));
+  }
+  function randomToken(bytes = 32) {
+    return toBase64Url(crypto.getRandomValues(new Uint8Array(bytes)));
+  }
+
+  // src/account/shared.js
+  var sessionKey = () => `${cfg.prefix}:account:${cfg.domain}`;
+  var pendingLoginKey = () => `${cfg.prefix}:account-login:${cfg.domain}`;
+  var hintKey = () => `${cfg.prefix}:account-hint:${cfg.domain}`;
+  var sessionArea = () => cfg.account?.remember ? "local" : "session";
+  var storageOf = (area) => area === "local" ? window.localStorage : window.sessionStorage;
+  function readJsonIfAllowed(area, key) {
     try {
-      return JSON.parse(s.getItem(k) || "null");
+      return JSON.parse(storageOf(area).getItem(key) ?? "null");
     } catch {
       return null;
     }
-  };
-  var write = (s, k, v) => {
+  }
+  function writeJsonIfAllowed(area, key, value) {
     try {
-      if (v) s.setItem(k, JSON.stringify(v));
-      else s.removeItem(k);
+      if (value === null) storageOf(area).removeItem(key);
+      else storageOf(area).setItem(key, JSON.stringify(value));
     } catch {
     }
-  };
-  var discovery = null;
-  var session = null;
-  var refreshing = null;
-  var customerCache = null;
-  var server = () => cfg.account?.server ? new URL(String(cfg.account.server), window.location.href).href.replace(/\/$/, "") : "";
-  var HINT = () => `${cfg.prefix}:account-hint:${cfg.domain}`;
-  var serverState = null;
-  async function serverFetch(path, { method = "GET", body } = {}) {
-    const res = await fetch(`${server()}${path}`, {
-      method,
-      credentials: "include",
-      headers: method === "POST" ? { "Content-Type": "application/json", "X-Tether-Account": "1" } : {},
-      body: body ? JSON.stringify(body) : void 0
-    });
-    const data = await res.json().catch(() => ({}));
-    if (!res.ok && res.status !== 401) throw new TetherError(`Customer accounts: ${data.error || res.status}`, { status: res.status, userErrors: data.userErrors });
-    return data;
   }
-  async function serverMe() {
-    serverState || (serverState = await serverFetch("/me"));
+  function setLoginHint(loggedIn) {
+    writeJsonIfAllowed("local", hintKey(), loggedIn ? 1 : null);
+  }
+  var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+  var textOrNull = (value) => typeof value === "string" ? value : null;
+  async function readJsonObjectOrEmpty(response) {
+    let json;
     try {
-      if (serverState.loggedIn) window.localStorage.setItem(HINT(), "1");
-      else window.localStorage.removeItem(HINT());
+      json = await response.json();
     } catch {
+      return {};
     }
-    return serverState;
+    return isRecord(json) ? json : {};
   }
-  async function discover() {
-    if (discovery) return discovery;
+  function navigate(url) {
+    const replacement = cfg.account?.navigate;
+    if (replacement) replacement(url);
+    else window.location.assign(url);
+  }
+  var loginLanguage = (locale) => locale || cfg.account?.locale || (cfg.locale || "").split("-")[0] || "";
+  var loginCountry = () => cfg.country ? cfg.country.toUpperCase() : "";
+
+  // src/account/shopify-auth.js
+  var DEFAULT_TOKEN_SECONDS = 3600;
+  var endpoints = null;
+  async function wellKnown(document2) {
     const shop = cfg.account?.shopDomain || cfg.domain;
-    const get2 = (p) => fetch(`https://${shop}/.well-known/${p}`).then((r) => {
-      if (!r.ok) throw new TetherError(`Customer accounts: ${p} answered ${r.status}`, { status: r.status });
-      return r.json();
-    });
-    const [oidc, api] = await Promise.all([get2("openid-configuration"), get2("customer-account-api")]);
-    discovery = { ...oidc, graphql: api.graphql_api };
-    return discovery;
+    const response = await fetch(`https://${shop}/.well-known/${document2}`);
+    if (!response.ok) {
+      throw new TetherError(`Customer accounts: ${document2} answered ${response.status}`, { status: response.status });
+    }
+    const json = (
+      /** @type {unknown} */
+      await response.json()
+    );
+    return isRecord(json) ? json : {};
   }
-  var callbackUrl = () => cfg.account?.callbackUrl || `${window.location.origin}${window.location.pathname}`;
-  function isLoggedIn() {
-    return server() ? Boolean(serverState?.loggedIn) : Boolean(session?.refresh || session?.access && session.expiresAt > Date.now());
+  function endpointIn(json, name) {
+    const url = textOrNull(json[name]);
+    if (!url) throw new TetherError(`Customer accounts: Shopify named no ${name}`);
+    return url;
   }
-  async function login({ returnTo = window.location.href, locale } = {}) {
-    if (server()) {
-      const u2 = new URL(`${server()}/login`);
-      u2.searchParams.set("returnTo", returnTo);
-      const lang2 = locale || cfg.account.locale || (cfg.locale || "").split("-")[0];
-      if (lang2) u2.searchParams.set("locale", lang2);
-      if (cfg.country) u2.searchParams.set("country", String(cfg.country).toUpperCase());
-      go(u2.toString());
-      return;
+  async function discover() {
+    if (endpoints) return endpoints;
+    const [openid, api] = await Promise.all([wellKnown("openid-configuration"), wellKnown("customer-account-api")]);
+    endpoints = {
+      issuer: endpointIn(openid, "issuer"),
+      authorizationEndpoint: endpointIn(openid, "authorization_endpoint"),
+      tokenEndpoint: endpointIn(openid, "token_endpoint"),
+      endSessionEndpoint: endpointIn(openid, "end_session_endpoint"),
+      graphql: endpointIn(api, "graphql_api")
+    };
+    return endpoints;
+  }
+  async function requestToken(params) {
+    const { tokenEndpoint } = await discover();
+    const response = await fetch(cfg.account?.tokenUrl || tokenEndpoint, {
+      method: "POST",
+      body: new URLSearchParams(params)
+    });
+    const data = await readJsonObjectOrEmpty(response);
+    const access = textOrNull(data["access_token"]);
+    if (!response.ok || !access) {
+      const ended = response.status === 400 || response.status === 401;
+      throw new TetherError(`Customer accounts: token ${response.status} ${textOrNull(data["error"]) ?? ""}`.trim(), {
+        status: response.status,
+        code: ended ? "SESSION_ENDED" : "TOKEN_FAILED"
+      });
     }
-    if (!cfg.account?.clientId) throw new TetherError("Customer accounts: set account.clientId", { code: "NOT_CONFIGURED" });
-    const d = await discover();
-    const state = random();
-    const nonce = random();
-    const verifier = random();
-    const redirect = callbackUrl();
-    write(window.sessionStorage, PENDING(), { state, nonce, verifier, redirect, returnTo, at: Date.now() });
-    const u = new URL(d.authorization_endpoint);
-    const p = {
-      client_id: cfg.account.clientId,
-      scope: "openid email customer-account-api:full",
-      response_type: "code",
-      redirect_uri: redirect,
-      state,
-      nonce,
-      code_challenge: await sha256(verifier),
-      code_challenge_method: "S256"
+    return {
+      access,
+      refresh: textOrNull(data["refresh_token"]) || null,
+      idToken: textOrNull(data["id_token"]) || null,
+      expiresInSeconds: Number(data["expires_in"]) || DEFAULT_TOKEN_SECONDS
     };
-    const lang = locale || cfg.account.locale || (cfg.locale || "").split("-")[0];
-    if (lang) p.locale = lang;
-    if (cfg.country) p.region_country = String(cfg.country).toUpperCase();
-    Object.entries(p).forEach(([k, v]) => u.searchParams.set(k, v));
-    go(u.toString());
-  }
-  async function tokenRequest(params) {
-    const d = await discover();
-    const res = await fetch(cfg.account.tokenUrl || d.token_endpoint, { method: "POST", body: new URLSearchParams(params) });
-    const data = await res.json().catch(() => ({}));
-    if (!res.ok || !data.access_token) throw new TetherError(`Customer accounts: token ${res.status} ${data.error || ""}`.trim(), { status: res.status, code: res.status === 400 || res.status === 401 ? "SESSION_ENDED" : "TOKEN_FAILED" });
-    return data;
-  }
-  function decodeJwt(t) {
+  }
+  function idTokenClaims(idToken) {
+    const payload = idToken.split(".")[1];
+    if (!payload) return null;
+    let claims;
     try {
-      return JSON.parse(atob(t.split(".")[1].replace(/-/g, "+").replace(/_/g, "/")));
+      claims = JSON.parse(new TextDecoder().decode(fromBase64Url(payload)));
     } catch {
       return null;
     }
+    return isRecord(claims) ? claims : null;
+  }
+  function answersLogin(idToken, { nonce, issuer, client }) {
+    const claims = idToken ? idTokenClaims(idToken) : null;
+    if (!claims) return false;
+    const audience = claims["aud"];
+    const audiences = Array.isArray(audience) ? audience : [audience];
+    const expiresAt = claims["exp"];
+    return claims["nonce"] === nonce && claims["iss"] === issuer && audiences.includes(client) && typeof expiresAt === "number" && expiresAt * 1e3 >= Date.now();
+  }
+
+  // src/account/browser-session.js
+  var REFRESH_MARGIN_SECONDS = 120;
+  var LOGIN_TIMEOUT_MS = 10 * 60 * 1e3;
+  var session = null;
+  var customerProfile = null;
+  var refreshing = null;
+  function toSession(value) {
+    if (!isRecord(value)) return null;
+    const access = value["access"];
+    const expiresAt = value["expiresAt"];
+    if (typeof access !== "string" || typeof expiresAt !== "number") return null;
+    return { access, expiresAt, refresh: textOrNull(value["refresh"]), idToken: textOrNull(value["idToken"]) };
   }
-  function keep(data, previous = session) {
+  function toPendingLogin(value) {
+    if (!isRecord(value)) return null;
+    const { state, nonce, verifier, redirect, returnTo, at } = value;
+    if (typeof state !== "string" || typeof nonce !== "string" || typeof verifier !== "string") return null;
+    if (typeof redirect !== "string" || typeof returnTo !== "string" || typeof at !== "number") return null;
+    return { state, nonce, verifier, redirect, returnTo, at };
+  }
+  var currentSession = () => session ?? toSession(readJsonIfAllowed(sessionArea(), sessionKey()));
+  var accessToken = () => session?.access ?? null;
+  var hasBrowserLogin = () => Boolean(session && (session.refresh || session.access && session.expiresAt > Date.now()));
+  function clientId() {
+    const id = cfg.account?.clientId;
+    if (!id) throw new TetherError("Customer accounts: set account.clientId", { code: "NOT_CONFIGURED" });
+    return id;
+  }
+  var sha256 = async (text) => toBase64Url(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text)));
+  async function browserLoginRedirect({ returnTo, locale }) {
+    const client = clientId();
+    const endpoints2 = await discover();
+    const pending = {
+      state: randomToken(),
+      nonce: randomToken(),
+      verifier: randomToken(),
+      redirect: cfg.account?.callbackUrl || `${window.location.origin}${window.location.pathname}`,
+      returnTo,
+      at: Date.now()
+    };
+    writeJsonIfAllowed("session", pendingLoginKey(), pending);
+    const url = new URL(endpoints2.authorizationEndpoint);
+    const params = {
+      client_id: client,
+      scope: "openid email customer-account-api:full",
+      response_type: "code",
+      redirect_uri: pending.redirect,
+      state: pending.state,
+      nonce: pending.nonce,
+      code_challenge: await sha256(pending.verifier),
+      code_challenge_method: "S256"
+    };
+    const language = loginLanguage(locale);
+    if (language) params["locale"] = language;
+    const country = loginCountry();
+    if (country) params["region_country"] = country;
+    Object.entries(params).forEach(([name, value]) => {
+      url.searchParams.set(name, value);
+    });
+    navigate(url.toString());
+  }
+  function keep(answer, previous) {
     session = {
-      access: data.access_token,
-      expiresAt: Date.now() + Math.max(0, (Number(data.expires_in) || 3600) - 120) * 1e3,
-      refresh: data.refresh_token || previous?.refresh,
-      idToken: data.id_token || previous?.idToken
+      access: answer.access,
+      expiresAt: Date.now() + Math.max(0, answer.expiresInSeconds - REFRESH_MARGIN_SECONDS) * 1e3,
+      refresh: answer.refresh ?? previous?.refresh ?? null,
+      idToken: answer.idToken ?? previous?.idToken ?? null
     };
-    write(store(), KEY(), session);
+    writeJsonIfAllowed(sessionArea(), sessionKey(), session);
   }
   async function handleCallback() {
-    const q = new URLSearchParams(window.location.search);
-    const pending = read(window.sessionStorage, PENDING());
-    if (!pending || !q.has("code") && !q.has("error") || q.get("state") !== pending.state) return false;
-    write(window.sessionStorage, PENDING(), null);
+    const params = new URLSearchParams(window.location.search);
+    const pending = toPendingLogin(readJsonIfAllowed("session", pendingLoginKey()));
+    if (!pending || !params.has("code") && !params.has("error") || params.get("state") !== pending.state) return false;
+    writeJsonIfAllowed("session", pendingLoginKey(), null);
     const clean = new URL(window.location.href);
-    ["code", "state", "iss", "error", "error_description"].forEach((k) => clean.searchParams.delete(k));
+    ["code", "state", "iss", "error", "error_description"].forEach((name) => {
+      clean.searchParams.delete(name);
+    });
     window.history.replaceState(window.history.state, "", clean);
-    if (q.has("error")) {
-      emit("account-error", { error: q.get("error") });
+    const error = params.get("error");
+    if (error !== null) {
+      emit("account-error", { error });
       return false;
     }
-    if (Date.now() - pending.at > 10 * 6e4) throw new TetherError("Customer accounts: the login took too long, please try again");
-    const data = await tokenRequest({
+    if (Date.now() - pending.at > LOGIN_TIMEOUT_MS) {
+      throw new TetherError("Customer accounts: the login took too long, please try again");
+    }
+    const client = clientId();
+    const answer = await requestToken({
       grant_type: "authorization_code",
-      client_id: cfg.account.clientId,
+      client_id: client,
       redirect_uri: pending.redirect,
-      code: q.get("code"),
+      code: params.get("code") ?? "",
       code_verifier: pending.verifier
     });
-    const d = await discover();
-    const claims = decodeJwt(data.id_token || "");
-    const aud = [].concat(claims?.aud || []);
-    if (!claims || claims.nonce !== pending.nonce || claims.iss !== d.issuer || !aud.includes(cfg.account.clientId) || claims.exp * 1e3 < Date.now()) {
+    const { issuer } = await discover();
+    if (!answersLogin(answer.idToken, { nonce: pending.nonce, issuer, client })) {
       throw new TetherError("Customer accounts: the login answer did not check out (nonce/issuer/audience)");
     }
-    keep(data, null);
+    keep(answer, null);
     await linkCart();
     emit("account-login", {});
-    const back = pending.returnTo && new URL(pending.returnTo, window.location.href);
-    if (back && back.origin === window.location.origin && back.href !== clean.href) go(back.href);
+    const back = pending.returnTo ? new URL(pending.returnTo, window.location.href) : null;
+    if (back?.origin === window.location.origin && back.href !== clean.href) navigate(back.href);
     return true;
   }
+  function endSession() {
+    session = null;
+    customerProfile = null;
+    writeJsonIfAllowed(sessionArea(), sessionKey(), null);
+    Cart.setCustomer({ accessToken: null });
+  }
+  async function refresh(expired) {
+    try {
+      const answer = await requestToken({
+        grant_type: "refresh_token",
+        client_id: clientId(),
+        refresh_token: expired.refresh ?? ""
+      });
+      keep(answer, expired);
+      await linkCart();
+    } catch (error) {
+      if (error instanceof TetherError && error.code === "SESSION_ENDED") endSession();
+      else throw error;
+    }
+  }
   async function getToken() {
-    if (server()) return null;
-    if (!session) session = read(store(), KEY());
+    session = currentSession();
     if (!session) return null;
     if (session.access && session.expiresAt > Date.now()) return session.access;
     if (!session.refresh) {
       endSession();
       return null;
     }
-    refreshing || (refreshing = (async () => {
-      try {
-        keep(await tokenRequest({ grant_type: "refresh_token", client_id: cfg.account.clientId, refresh_token: session.refresh }));
-        await linkCart();
-      } catch (err) {
-        if (err.code === "SESSION_ENDED") endSession();
-        else throw err;
-      } finally {
-        refreshing = null;
-      }
-    })());
+    const expired = session;
+    refreshing ?? (refreshing = refresh(expired).finally(() => {
+      refreshing = null;
+    }));
     await refreshing;
-    return session?.access || null;
-  }
-  function endSession() {
-    session = null;
-    customerCache = null;
-    write(store(), KEY(), null);
-    Cart.customerAccessToken = null;
+    return accessToken();
   }
   async function linkCart() {
-    Cart.customerAccessToken = session?.access || null;
-    if (Cart.id() && session?.access) {
-      await Cart.setBuyerIdentity({ customerAccessToken: session.access }, { create: false }).catch((err) => reportError(err, "account cart"));
+    const token = accessToken();
+    Cart.setCustomer({ accessToken: token });
+    if (!Cart.id() || !token) return;
+    try {
+      await Cart.setBuyerIdentity({ customerAccessToken: token }, { create: false });
+    } catch (error) {
+      reportError(error, "account cart");
     }
   }
-  async function query(q, variables = {}) {
-    if (server()) throw new TetherError("Customer accounts in server mode only answer customer() and orders()", { code: "NOT_ALLOWED" });
+  async function unlinkCart() {
+    if (!Cart.id()) return;
+    try {
+      await Cart.setBuyerIdentity({ customerAccessToken: null }, { create: false });
+    } catch (error) {
+      reportError(error, "account cart unlink");
+      writeJsonIfAllowed("local", cfg.storageKey, null);
+    }
+  }
+  async function browserLogout(returnTo) {
+    const idToken = currentSession()?.idToken ?? null;
+    await unlinkCart();
+    endSession();
+    emit("account-logout", {});
+    if (!idToken) return "stayed";
+    const url = new URL((await discover()).endSessionEndpoint);
+    url.searchParams.set("id_token_hint", idToken);
+    url.searchParams.set("post_logout_redirect_uri", returnTo);
+    navigate(url.toString());
+    return "redirected";
+  }
+  async function query(document2, variables = {}) {
     const token = await getToken();
     if (!token) throw new TetherError("Not logged in", { code: "NOT_LOGGED_IN" });
-    const d = await discover();
-    const run = (t) => fetch(d.graphql, { method: "POST", headers: { "Content-Type": "application/json", Authorization: t }, body: JSON.stringify({ query: q, variables }) });
-    let res = await run(token);
-    if (res.status === 401 && session?.refresh) {
+    const { graphql } = await discover();
+    const send = (accessToken2) => fetch(graphql, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: accessToken2 },
+      body: JSON.stringify({ query: document2, variables })
+    });
+    let response = await send(token);
+    if (response.status === 401 && session?.refresh) {
       session.expiresAt = 0;
-      res = await run(await getToken());
+      response = await send(await getToken() ?? "");
+    }
+    const json = await readJsonObjectOrEmpty(response);
+    const errors = Array.isArray(json["errors"]) ? json["errors"] : [];
+    if (!response.ok || errors.length) {
+      const messages = errors.map((error) => isRecord(error) ? textOrNull(error["message"]) : null).filter(Boolean);
+      throw new TetherError(messages.join(" | ") || `Customer accounts: ${response.status}`, {
+        status: response.status
+      });
     }
-    const json = await res.json().catch(() => ({}));
-    if (!res.ok || json.errors?.length) throw new TetherError(json.errors?.map((e) => e.message).join(" | ") || `Customer accounts: ${res.status}`, { status: res.status });
-    return json.data;
+    return (
+      /** @type {T} */
+      json["data"]
+    );
   }
-  async function customer() {
-    if (server()) {
-      const me = await serverMe();
-      return me.loggedIn ? { ...me.customer, emailAddress: { emailAddress: me.customer.email }, defaultAddress: { formatted: me.customer.address } } : null;
+  async function browserCustomer() {
+    if (customerProfile) return customerProfile;
+    const data = await query(CUSTOMER_QUERY);
+    customerProfile = data.customer;
+    return customerProfile;
+  }
+  function forgetBrowserCustomer() {
+    customerProfile = null;
+  }
+
+  // src/account/server-client.js
+  var known = null;
+  function serverBase() {
+    const server = cfg.account?.server;
+    if (!server) return "";
+    return new URL(server, window.location.href).href.replace(/\/$/, "");
+  }
+  async function serverFetch(path, { method = "GET", body } = {}) {
+    const init = { method, credentials: "include" };
+    if (method === "POST") init.headers = { "Content-Type": "application/json", "X-Tether-Account": "1" };
+    if (body) init.body = JSON.stringify(body);
+    const response = await fetch(`${serverBase()}${path}`, init);
+    if (response.status === 401) return { kind: "logged-out" };
+    const data = await readJsonObjectOrEmpty(response);
+    if (!response.ok) {
+      const reason = textOrNull(data["error"]) ?? String(response.status);
+      const userErrors = Array.isArray(data["userErrors"]) ? (
+        // The Worker sends Shopify's own `userErrors` list unchanged.
+        /** @type {UserError[]} */
+        data["userErrors"]
+      ) : void 0;
+      throw new TetherError(`Customer accounts: ${reason}`, {
+        status: response.status,
+        ...userErrors && { userErrors }
+      });
     }
-    if (customerCache) return customerCache;
-    const data = await query(`query TetherCustomer{customer{id firstName lastName displayName emailAddress{emailAddress}defaultAddress{formatted}}}`);
-    customerCache = data.customer;
-    return customerCache;
+    return { kind: "answer", data };
   }
-  async function orders({ first = 10 } = {}) {
-    if (server()) return (await serverFetch(`/orders?first=${first}`)).orders || [];
-    const data = await query(`query TetherOrders($first:Int!){customer{orders(first:$first,sortKey:PROCESSED_AT,reverse:true){nodes{id name processedAt financialStatus fulfillmentStatus statusPageUrl totalPrice{amount currencyCode}lineItems(first:20){nodes{title variantTitle quantity image{url altText}}}}}}}`, { first });
-    return data.customer?.orders?.nodes || [];
+  function toServerCustomer(value) {
+    const customer2 = isRecord(value) ? value : {};
+    const address = customer2["address"];
+    return {
+      firstName: textOrNull(customer2["firstName"]),
+      lastName: textOrNull(customer2["lastName"]),
+      displayName: textOrNull(customer2["displayName"]),
+      email: textOrNull(customer2["email"]),
+      address: Array.isArray(address) ? address.filter((line) => typeof line === "string") : null
+    };
   }
-  async function logout({ returnTo = cfg.account?.logoutUrl || `${window.location.origin}/` } = {}) {
-    if (server()) {
-      const r = await serverFetch("/logout", { method: "POST", body: { returnTo, cartId: Cart.id() } });
-      serverState = { loggedIn: false };
-      try {
-        window.localStorage.removeItem(HINT());
-      } catch {
-      }
-      emit("account-logout", {});
-      if (r.logoutUrl) go(r.logoutUrl);
-      else render(document);
-      return;
+  async function serverLogin() {
+    if (!known) {
+      const answer = await serverFetch("/me");
+      known = answer.kind === "answer" && answer.data["loggedIn"] === true ? { loggedIn: true, customer: toServerCustomer(answer.data["customer"]) } : { loggedIn: false };
     }
-    const idToken = session?.idToken || read(store(), KEY())?.idToken;
-    if (Cart.id()) await Cart.setBuyerIdentity({ customerAccessToken: null }, { create: false }).catch(() => {
-    });
-    endSession();
+    setLoginHint(known.loggedIn);
+    return known;
+  }
+  var isServerLoggedIn = () => known?.loggedIn === true;
+  function forgetServerLogin() {
+    known = null;
+  }
+  function serverLoginRedirect({ returnTo, locale }) {
+    const url = new URL(`${serverBase()}/login`);
+    url.searchParams.set("returnTo", returnTo);
+    const language = loginLanguage(locale);
+    if (language) url.searchParams.set("locale", language);
+    const country = loginCountry();
+    if (country) url.searchParams.set("country", country);
+    navigate(url.toString());
+  }
+  async function serverCheckoutUrl() {
+    const cartId = Cart.id();
+    if (!(await serverLogin()).loggedIn || !cartId) return null;
+    const answer = await serverFetch("/cart", { method: "POST", body: { cartId } });
+    if (answer.kind === "logged-out") return null;
+    const url = textOrNull(answer.data["checkoutUrl"]);
+    if (!url) return null;
+    return `${url}${url.includes("?") ? "&" : "?"}logged_in=true`;
+  }
+  async function serverLogout(returnTo) {
+    const answer = await serverFetch("/logout", { method: "POST", body: { returnTo, cartId: Cart.id() } });
+    known = null;
+    setLoginHint(false);
     emit("account-logout", {});
-    if (!idToken) {
-      render(document);
-      return;
-    }
-    const d = await discover();
-    const u = new URL(d.end_session_endpoint);
-    u.searchParams.set("id_token_hint", idToken);
-    u.searchParams.set("post_logout_redirect_uri", returnTo);
-    go(u.toString());
+    const logoutUrl = answer.kind === "answer" ? textOrNull(answer.data["logoutUrl"]) : null;
+    if (!logoutUrl) return "stayed";
+    navigate(logoutUrl);
+    return "redirected";
   }
-  var https = (u) => {
+
+  // tether-core:shopify-values.js
+  var m6 = window.Tether.__core["shopify-values.js"];
+  var { STORE_ENV_NAMES, formatMoney: formatMoney2, isHttpsUrl, isSecretShopifyToken, productKey, productUrl: productUrl2 } = m6;
+
+  // src/account-links.js
+  function localDate(iso) {
     try {
-      return new URL(u).protocol === "https:";
-    } catch {
-      return false;
+      return new Date(iso).toLocaleDateString(cfg.locale);
+    } catch (error) {
+      if (error instanceof RangeError) return iso;
+      throw error;
     }
-  };
-  var date = (s) => {
-    try {
-      return new Date(s).toLocaleDateString(cfg.locale || void 0);
-    } catch {
-      return s;
+  }
+  function orderUrl(order2) {
+    const template = cfg.account?.orderUrl;
+    if (template) {
+      const numericId = order2.id.split("/").pop()?.split("?")[0] ?? "";
+      return template.replace("{id}", encodeURIComponent(numericId));
     }
-  };
-  async function render(root = document) {
-    const logged = server() ? Boolean((await serverMe().catch(() => ({ loggedIn: false }))).loggedIn) : isLoggedIn() || Boolean(await getToken().catch(() => null));
-    qsa(root, sel("show")).forEach((el) => {
-      const k = get(el, "show");
-      if (k === "logged-in") show(el, logged);
-      if (k === "logged-out") show(el, !logged);
-    });
-    qsa(root, sel("account-link")).forEach((a) => {
-      const k = get(a, "account-link");
-      const u = k === "payment" && (cfg.account?.paymentUrl || cfg.account?.subscriptionsUrl) || k === "subscriptions" && cfg.account?.subscriptionsUrl;
-      a.setAttribute("href", u || `https://${cfg.domain}/account`);
+    return isHttpsUrl(order2.statusPageUrl) ? order2.statusPageUrl ?? null : null;
+  }
+
+  // src/account/markup.js
+  function showIn(root, name, conditions) {
+    qsa(root, sel(name)).forEach((el) => {
+      const key = get(el, name) ?? "";
+      if (Object.hasOwn(conditions, key)) show(el, conditions[key] === true);
     });
-    if (!logged) return;
-    await bindCustomer(root);
-    await Promise.all([renderOrderList(root), PAGE_ATTRS.some((n) => qsa(root, sel(n)).length) ? pages().then((m6) => m6.renderPages(root)) : null]);
   }
-  async function renderOrderList(root) {
-    const lists = qsa(root, sel("orders"));
-    if (lists.length) {
-      const ordersShow = (loading, empty) => qsa(root, sel("show")).forEach((el) => {
-        const k = get(el, "show");
-        if (k === "orders-loading") show(el, loading);
-        if (k === "orders-empty") show(el, empty);
-      });
-      ordersShow(true, false);
-      let failed = false;
-      const list = await orders({ first: parseInt(get(lists[0], "limit") || "10", 10) }).catch((err) => {
-        reportError(err, "orders");
-        failed = true;
-        return [];
+  var bindsIn = (row, name) => qsa(row, sel(name)).concat(row.matches(sel(name)) ? [row] : []);
+  var ownValue = (values, key) => Object.hasOwn(values, key) ? values[key] : void 0;
+
+  // src/account/order-lines.js
+  var lineTexts = (line, returnable) => ({
+    title: line.title || line.name,
+    "variant-title": line.variantTitle || "",
+    quantity: String(line.quantity),
+    price: formatMoney(line.price),
+    total: formatMoney(line.totalPrice),
+    sku: line.sku || "",
+    returnable: returnable === null ? void 0 : String(returnable)
+  });
+  var isInput = (el) => el.tagName === "INPUT";
+  function fillReturnControls(row, line, returnable) {
+    showIn(row, "order-line-show", { returnable: returnable > 0 });
+    qsa(row, sel("return-quantity")).forEach((input) => {
+      if (!isInput(input)) return;
+      input.max = String(returnable);
+      input.min = "0";
+      if (!input.value) input.value = "0";
+      input.disabled = returnable < 1;
+    });
+    qsa(row, `select${sel("return-reason")}`).forEach((select) => {
+      if (select.dataset["tetherFilled"] === line.id) return;
+      select.dataset["tetherFilled"] = line.id;
+      (line.suggestedReturnReasonDefinitions?.nodes ?? []).forEach((reason) => {
+        select.appendChild(new Option(reason.name, reason.id));
       });
-      ordersShow(false, !failed && list.length === 0);
-      lists.forEach((c) => repeat(c, list, (node, o) => {
-        const items = o.lineItems?.nodes || [];
-        qsa(node, sel("order-bind")).forEach((el) => {
-          const k = get(el, "order-bind");
-          if (k === "url") {
-            const u = orderUrl(o);
-            if (u) el.setAttribute("href", u);
-            return;
-          }
-          if (k === "image") {
-            const im = items.find((l) => l.image)?.image;
-            if (im) setImage(el, im.url, im.altText || items[0]?.title || "");
-            return;
-          }
-          const v = { name: o.name, date: date(o.processedAt), total: formatMoney(o.totalPrice), status: o.financialStatus?.toLowerCase(), fulfillment: o.fulfillmentStatus?.toLowerCase(), items: items.map((l) => `${l.quantity}\xD7 ${l.title}`).join(", ") }[k];
-          if (v != null) setText(el, v);
-        });
-        qsa(node, sel("order-lines")).forEach((box) => fillLines(box, items));
-        if (get(node, "order-bind") === "url" && orderUrl(o)) node.setAttribute("href", orderUrl(o));
-      }));
-    }
+    });
   }
-  var nid = (g) => String(g || "").split("/").pop().split("?")[0];
-  function orderUrl(o) {
-    const t = cfg.account?.orderUrl;
-    if (t) return String(t).replace("{id}", encodeURIComponent(nid(o.id)));
-    return https(o.statusPageUrl) ? o.statusPageUrl : null;
-  }
-  function fillLines(box, items) {
-    repeat(box, items, (row, l) => {
-      qsa(row, sel("order-line")).concat(row.matches(sel("order-line")) ? [row] : []).forEach((el) => {
-        const k = get(el, "order-line");
-        if (k === "image") {
-          if (l.image) setImage(el, l.image.url, l.image.altText || l.title);
+  function fillLines(box, lines, returns) {
+    repeat(box, lines, (row, line) => {
+      const id = line.id;
+      const returnable = returns && id ? returns.get(id) ?? 0 : null;
+      if (id) row.dataset["tetherLine"] = id;
+      const texts = lineTexts(line, returnable);
+      bindsIn(row, "order-line").forEach((el) => {
+        const key = get(el, "order-line") ?? "";
+        if (key === "image") {
+          if (line.image) setImage(el, line.image.url, line.image.altText || line.title);
           return;
         }
-        const v = { title: l.title, "variant-title": l.variantTitle || "", quantity: String(l.quantity) }[k];
-        if (v != null) setText(el, v);
+        const text = ownValue(texts, key);
+        if (text !== void 0) setText(el, text);
       });
+      if (id && returnable !== null) fillReturnControls(row, { ...line, id }, returnable);
     });
   }
-  var PAGE_ATTRS = ["order", "addresses", "subscriptions", "profile-form", "address-form"];
-  var pagesPart = null;
+
+  // src/account/order-list.js
+  var DEFAULT_ORDER_COUNT = 10;
+  var orderTexts = (order2) => ({
+    name: order2.name,
+    date: localDate(order2.processedAt),
+    total: formatMoney(order2.totalPrice),
+    status: order2.financialStatus?.toLowerCase(),
+    fulfillment: order2.fulfillmentStatus?.toLowerCase(),
+    items: order2.lineItems.nodes.map((line) => `${line.quantity}\xD7 ${line.title}`).join(", ")
+  });
+  function fillOrder(node, order2) {
+    const lines = order2.lineItems.nodes;
+    const url = orderUrl(order2);
+    const texts = orderTexts(order2);
+    qsa(node, sel("order-bind")).forEach((el) => {
+      const key = get(el, "order-bind") ?? "";
+      if (key === "url") {
+        if (url) el.setAttribute("href", url);
+        return;
+      }
+      if (key === "image") {
+        const image = lines.find((line) => line.image)?.image;
+        if (image) setImage(el, image.url, image.altText || lines[0]?.title || "");
+        return;
+      }
+      const text = ownValue(texts, key);
+      if (text !== void 0) setText(el, text);
+    });
+    qsa(node, sel("order-lines")).forEach((box) => {
+      fillLines(box, lines, null);
+    });
+    if (get(node, "order-bind") === "url" && url) node.setAttribute("href", url);
+  }
+  async function renderOrderList(root, loadOrders) {
+    const lists = qsa(root, sel("orders"));
+    const first = lists[0];
+    if (!first) return;
+    showIn(root, "show", { "orders-loading": true, "orders-empty": false });
+    const limit = Number.parseInt(get(first, "limit") || String(DEFAULT_ORDER_COUNT), 10) || DEFAULT_ORDER_COUNT;
+    const orders2 = await loadOrders(limit).catch((error) => {
+      reportError(error, "orders");
+      return null;
+    });
+    showIn(root, "show", { "orders-loading": false, "orders-empty": orders2?.length === 0 });
+    lists.forEach((list) => {
+      repeat(list, orders2 ?? [], fillOrder);
+    });
+  }
+
+  // src/account.js
+  var PAGE_ATTRIBUTES = ["order", "addresses", "subscriptions", "profile-form", "address-form"];
+  function isLoggedIn() {
+    return serverBase() ? isServerLoggedIn() : hasBrowserLogin();
+  }
+  async function login({ returnTo = window.location.href, locale } = {}) {
+    if (serverBase()) serverLoginRedirect({ returnTo, locale });
+    else await browserLoginRedirect({ returnTo, locale });
+  }
+  async function query2(document2, variables = {}) {
+    if (serverBase()) {
+      throw new TetherError("Customer accounts in server mode only answer customer() and orders()", {
+        code: "NOT_ALLOWED"
+      });
+    }
+    return query(document2, variables);
+  }
+  async function customer() {
+    if (!serverBase()) return browserCustomer();
+    const me = await serverLogin();
+    if (!me.loggedIn) return null;
+    return {
+      ...me.customer,
+      emailAddress: { emailAddress: me.customer.email },
+      defaultAddress: { formatted: me.customer.address }
+    };
+  }
+  async function orders({ first = 10 } = {}) {
+    if (serverBase()) {
+      const answer = await serverFetch(`/orders?first=${first}`);
+      if (answer.kind === "logged-out") return [];
+      const list = answer.data["orders"];
+      return Array.isArray(list) ? (
+        /** @type {AccountOrder[]} */
+        list
+      ) : [];
+    }
+    const data = await query(ORDERS_QUERY, { first });
+    return data.customer?.orders.nodes ?? [];
+  }
+  async function logout({ returnTo = cfg.account?.logoutUrl || `${window.location.origin}/` } = {}) {
+    const outcome = serverBase() ? await serverLogout(returnTo) : await browserLogout(returnTo);
+    if (outcome === "stayed") await render(document);
+  }
+  async function loginState() {
+    try {
+      if (serverBase()) return (await serverLogin()).loggedIn ? { kind: "logged-in" } : { kind: "logged-out" };
+      if (hasBrowserLogin() || await getToken()) return { kind: "logged-in" };
+      return { kind: "logged-out" };
+    } catch (error) {
+      return { kind: "unknown", error };
+    }
+  }
+  var usesPages = (root) => PAGE_ATTRIBUTES.some((name) => qsa(root, sel(name)).length > 0);
+  function linkShopifyPages(root) {
+    const account = cfg.account;
+    qsa(root, sel("account-link")).forEach((link) => {
+      const page = get(link, "account-link");
+      const subscriptions2 = account?.subscriptionsUrl;
+      const url = page === "payment" && (account?.paymentUrl || subscriptions2) || page === "subscriptions" && subscriptions2;
+      link.setAttribute("href", url || `https://${cfg.domain}/account`);
+    });
+  }
+  async function render(root = document) {
+    const state = await loginState();
+    if (state.kind === "unknown") reportError(state.error, "account");
+    const loggedIn = state.kind === "logged-in";
+    qsa(root, sel("show")).forEach((el) => {
+      const condition = get(el, "show");
+      if (condition === "logged-in") show(el, loggedIn);
+      if (condition === "logged-out") show(el, !loggedIn);
+    });
+    linkShopifyPages(root);
+    if (state.kind === "unknown" && usesPages(root)) {
+      (await pages()).showUnavailable(root);
+      return;
+    }
+    if (!loggedIn) return;
+    await bindCustomer(root);
+    await Promise.all([
+      renderOrderList(root, (first) => orders({ first })),
+      usesPages(root) ? pages().then((part) => part.renderPages(root)) : null
+    ]);
+  }
   async function bindCustomer(root) {
     const binds = qsa(root, sel("account-bind"));
     if (!binds.length) return;
-    const c = await customer().catch((err) => {
-      reportError(err, "account");
+    const profile = await customer().catch((error) => {
+      reportError(error, "account");
       return null;
     });
+    const texts = {
+      "first-name": profile?.firstName,
+      "last-name": profile?.lastName,
+      name: profile?.displayName,
+      email: profile?.emailAddress?.emailAddress,
+      address: profile?.defaultAddress?.formatted?.join(", ")
+    };
     binds.forEach((el) => {
-      const v = { "first-name": c?.firstName, "last-name": c?.lastName, name: c?.displayName, email: c?.emailAddress?.emailAddress, address: c?.defaultAddress?.formatted?.join(", ") }[get(el, "account-bind")];
-      if (v != null) setText(el, v);
+      const text = ownValue(texts, get(el, "account-bind") ?? "");
+      if (text != null) setText(el, text);
     });
   }
+  var pagesPart = null;
   function pages() {
-    pagesPart || (pagesPart = loadPart("account-pages").then((m6) => {
-      m6.setup({ server, serverFetch, query, customer, bindCustomer, reset: () => {
-        customerCache = null;
-        serverState = null;
-      } });
-      return m6;
+    pagesPart ?? (pagesPart = loadPart("account-pages").then((part) => {
+      part.setup({
+        serverBase,
+        serverFetch,
+        query: query2,
+        customer,
+        bindCustomer,
+        reset: () => {
+          forgetBrowserCustomer();
+          forgetServerLogin();
+        }
+      });
+      return part;
     }));
     return pagesPart;
   }
-  var viaPages = (name) => (...a) => pages().then((m6) => m6[name](...a));
-  var order = viaPages("order");
-  var updateProfile = viaPages("updateProfile");
-  var addresses = viaPages("addresses");
-  var saveAddress = viaPages("saveAddress");
-  var deleteAddress = viaPages("deleteAddress");
-  var subscriptions = viaPages("subscriptions");
-  var subscriptionAction = viaPages("subscriptionAction");
-  var requestReturn = viaPages("requestReturn");
-  var bound = false;
-  async function mountAccount(root = document) {
-    if (!bound) {
-      bound = true;
-      document.addEventListener("click", (e) => {
-        const t = e.target;
-        if (t.closest?.(sel("account-login"))) {
-          e.preventDefault();
-          login().catch((err) => reportError(err, "login"));
-        } else if (t.closest?.(sel("account-logout"))) {
-          e.preventDefault();
-          logout().catch((err) => reportError(err, "logout"));
-        }
+  var order = (id) => pages().then((part) => part.order(id));
+  var updateProfile = (fields) => pages().then((part) => part.updateProfile(fields));
+  var addresses = () => pages().then((part) => part.addresses());
+  var saveAddress = (address, options) => pages().then((part) => part.saveAddress(address, options));
+  var deleteAddress = (id) => pages().then((part) => part.deleteAddress(id));
+  var subscriptions = () => pages().then((part) => part.subscriptions());
+  var subscriptionAction = (id, action) => pages().then((part) => part.subscriptionAction(id, action));
+  var requestReturn = (orderId, lines) => pages().then((part) => part.requestReturn(orderId, lines));
+  function onClick(event) {
+    const target = event.target;
+    if (!(target instanceof window.Element)) return;
+    if (target.closest(sel("account-login"))) {
+      event.preventDefault();
+      login().catch((error) => {
+        reportError(error, "login");
       });
-      if (server()) {
-        const u = new URL(window.location.href);
-        if (u.searchParams.get("account")) {
-          u.searchParams.delete("account");
-          window.history.replaceState(window.history.state, "", u);
-          emit("account-login", {});
-        }
-        Cart.beforeCheckout = async () => {
-          if (!(await serverMe()).loggedIn || !Cart.id()) return null;
-          const r = await serverFetch("/cart", { method: "POST", body: { cartId: Cart.id() } }).catch(() => null);
-          return r?.checkoutUrl ? `${r.checkoutUrl}${r.checkoutUrl.includes("?") ? "&" : "?"}logged_in=true` : null;
-        };
-      } else {
-        try {
-          await handleCallback();
-        } catch (err) {
-          reportError(err, "login");
-        }
-        if (!Cart.customerAccessToken && await getToken().catch(() => null)) Cart.customerAccessToken = session.access;
-      }
+    } else if (target.closest(sel("account-logout"))) {
+      event.preventDefault();
+      logout().catch((error) => {
+        reportError(error, "logout");
+      });
+    }
+  }
+  function startServerMode() {
+    const url = new URL(window.location.href);
+    if (url.searchParams.get("account")) {
+      url.searchParams.delete("account");
+      window.history.replaceState(window.history.state, "", url);
+      emit("account-login", {});
+    }
+    Cart.setCustomer({ beforeCheckout: serverCheckoutUrl });
+  }
+  async function startBrowserMode() {
+    try {
+      await handleCallback();
+    } catch (error) {
+      reportError(error, "login");
+    }
+    if (Cart.customerAccessToken) return;
+    try {
+      const accessToken2 = await getToken();
+      if (accessToken2) Cart.setCustomer({ accessToken: accessToken2 });
+    } catch (error) {
+      reportError(error, "account");
+    }
+  }
+  var started = false;
+  async function mountAccount(root = document) {
+    if (!started) {
+      started = true;
+      document.addEventListener("click", onClick);
+      if (serverBase()) startServerMode();
+      else await startBrowserMode();
       log("account", isLoggedIn() ? "logged in" : "logged out");
     }
     await render(root);
   }
 
   // src/parts/account.js
-  window.Tether.__parts.account = account_exports;
+  var { Tether } = (
+    /** @type {Window & { Tether?: { __parts: Record<string, unknown> } }} */
+    window
+  );
+  if (!Tether) throw new Error("tether.account.js runs after the Tether script, which loads it");
+  Tether.__parts["account"] = account_exports;
 })();