@platform-x/shp-auth-client 0.0.1

package/dist/extract-site-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract-site-name.js","sourceRoot":"","sources":["../src/extract-site-name.ts"],"names":[],"mappings":";;AAQA,0CAUC;AAOD,sCAEC;AAzBD;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,GAAY;IAC1C,MAAM,UAAU,GACb,GAAG,CAAC,OAAO,CAAC,UAAU,CAAY;QAClC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAY;QACnC,GAAG,CAAC,QAAQ,CAAC;IAEf,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE7B,6BAA6B;IAC7B,OAAO,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,QAAgB,EAAE,QAAgB,EAAE,GAAW;IAC3E,OAAO,GAAG,QAAQ,IAAI,QAAQ,IAAI,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;AACxD,CAAC"}

package/dist/graphql-client.d.ts

@@ -0,0 +1,14 @@
+import './tls-trust';
+import { GraphQLClient, gql, ClientError } from 'graphql-request';
+type ClientType = 'admin' | 'storefront';
+/**
+ * Returns a cached GraphQL client for the given tenant and API type.
+ * admin    → Shopify Admin API (uses adminApiAccessToken)
+ * storefront → Shopify Storefront API (uses storefrontPrivateToken)
+ */
+export declare function getGraphQLClient(siteName: string, type?: ClientType): Promise<GraphQLClient>;
+/** Clears cached GraphQL clients (call after tenant config changes). */
+export declare function clearGraphQLClientCache(siteName?: string): void;
+/** Re-exports for convenience */
+export { gql, ClientError };
+//# sourceMappingURL=graphql-client.d.ts.map

package/dist/graphql-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graphql-client.d.ts","sourceRoot":"","sources":["../src/graphql-client.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAC;AACrB,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAIlE,KAAK,UAAU,GAAG,OAAO,GAAG,YAAY,CAAC;AAQzC;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,UAAoB,GACzB,OAAO,CAAC,aAAa,CAAC,CAyBxB;AAED,wEAAwE;AACxE,wBAAgB,uBAAuB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAO/D;AAED,iCAAiC;AACjC,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC"}

package/dist/graphql-client.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientError = exports.gql = void 0;
+exports.getGraphQLClient = getGraphQLClient;
+exports.clearGraphQLClientCache = clearGraphQLClientCache;
+require("./tls-trust");
+const graphql_request_1 = require("graphql-request");
+Object.defineProperty(exports, "gql", { enumerable: true, get: function () { return graphql_request_1.gql; } });
+Object.defineProperty(exports, "ClientError", { enumerable: true, get: function () { return graphql_request_1.ClientError; } });
+const tenant_config_1 = require("./tenant-config");
+const clientCache = new Map();
+function clientKey(siteName, type) {
+    return `${siteName}:${type}`;
+}
+/**
+ * Returns a cached GraphQL client for the given tenant and API type.
+ * admin    → Shopify Admin API (uses adminApiAccessToken)
+ * storefront → Shopify Storefront API (uses storefrontPrivateToken)
+ */
+async function getGraphQLClient(siteName, type = 'admin') {
+    const key = clientKey(siteName, type);
+    if (clientCache.has(key))
+        return clientCache.get(key);
+    const config = await (0, tenant_config_1.getTenantConfig)(siteName);
+    const { storeDomain, storefrontApiVersion, adminApiAccessToken, storefrontPrivateToken } = config.shopify;
+    let url;
+    let headers;
+    if (type === 'admin') {
+        url = `https://${storeDomain}/admin/api/${storefrontApiVersion}/graphql.json`;
+        headers = { 'X-Shopify-Access-Token': adminApiAccessToken };
+    }
+    else {
+        url = `https://${storeDomain}/api/${storefrontApiVersion}/graphql.json`;
+        // KIWI_SHOPIFY_STOREFRONT_PRIVATE_TOKEN is a private (server-side) Storefront
+        // token, which Shopify authenticates via this header — NOT the public-token
+        // header (`X-Shopify-Storefront-Access-Token`), which returns 401 for it.
+        headers = { 'Shopify-Storefront-Private-Token': storefrontPrivateToken };
+    }
+    const client = new graphql_request_1.GraphQLClient(url, { headers });
+    clientCache.set(key, client);
+    return client;
+}
+/** Clears cached GraphQL clients (call after tenant config changes). */
+function clearGraphQLClientCache(siteName) {
+    if (siteName) {
+        clientCache.delete(clientKey(siteName, 'admin'));
+        clientCache.delete(clientKey(siteName, 'storefront'));
+    }
+    else {
+        clientCache.clear();
+    }
+}
+//# sourceMappingURL=graphql-client.js.map

package/dist/graphql-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graphql-client.js","sourceRoot":"","sources":["../src/graphql-client.ts"],"names":[],"mappings":";;;AAkBA,4CA4BC;AAGD,0DAOC;AAxDD,uBAAqB;AACrB,qDAAkE;AA0DzD,oFA1De,qBAAG,OA0Df;AAAE,4FA1De,6BAAW,OA0Df;AAxDzB,mDAAkD;AAIlD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAC;AAErD,SAAS,SAAS,CAAC,QAAgB,EAAE,IAAgB;IACnD,OAAO,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,OAAmB,OAAO;IAE1B,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACtC,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,WAAW,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;IAEvD,MAAM,MAAM,GAAG,MAAM,IAAA,+BAAe,EAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,EAAE,WAAW,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,GACtF,MAAM,CAAC,OAAO,CAAC;IAEjB,IAAI,GAAW,CAAC;IAChB,IAAI,OAA+B,CAAC;IAEpC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,GAAG,GAAG,WAAW,WAAW,cAAc,oBAAoB,eAAe,CAAC;QAC9E,OAAO,GAAG,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,CAAC;IAC9D,CAAC;SAAM,CAAC;QACN,GAAG,GAAG,WAAW,WAAW,QAAQ,oBAAoB,eAAe,CAAC;QACxE,8EAA8E;QAC9E,4EAA4E;QAC5E,0EAA0E;QAC1E,OAAO,GAAG,EAAE,kCAAkC,EAAE,sBAAsB,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,+BAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACnD,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wEAAwE;AACxE,SAAgB,uBAAuB,CAAC,QAAiB;IACvD,IAAI,QAAQ,EAAE,CAAC;QACb,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;IACxD,CAAC;SAAM,CAAC;QACN,WAAW,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/hep-secret-provider.d.ts

@@ -0,0 +1,18 @@
+import type { ConfigProvider } from './types';
+/**
+ * Wraps hep-secret-access's secretManager() behind our ConfigProvider
+ * interface (see hep-delivery-service's secret_key.services.ts for the
+ * reference usage). secretManager() itself picks env | gsm | csi based on
+ * process.env.SECRET_MODE at construction time — constructed once here and
+ * reused, so its underlying client (e.g. GCP Secret Manager) isn't rebuilt
+ * on every read.
+ *
+ * hep-secret-access's own EnvProvider returns '' on a missing key rather than
+ * throwing; we throw instead, so a misconfigured secret fails loudly here
+ * too, regardless of which mode is active.
+ */
+export declare class HepSecretProvider implements ConfigProvider {
+    private readonly provider;
+    get(secretId: string): Promise<string>;
+}
+//# sourceMappingURL=hep-secret-provider.d.ts.map

package/dist/hep-secret-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hep-secret-provider.d.ts","sourceRoot":"","sources":["../src/hep-secret-provider.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C;;;;;;;;;;;GAWG;AACH,qBAAa,iBAAkB,YAAW,cAAc;IACtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmB;IAEtC,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAO7C"}

package/dist/hep-secret-provider.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HepSecretProvider = void 0;
+const hep_secret_access_1 = require("hep-secret-access");
+const errors_1 = require("./errors");
+/**
+ * Wraps hep-secret-access's secretManager() behind our ConfigProvider
+ * interface (see hep-delivery-service's secret_key.services.ts for the
+ * reference usage). secretManager() itself picks env | gsm | csi based on
+ * process.env.SECRET_MODE at construction time — constructed once here and
+ * reused, so its underlying client (e.g. GCP Secret Manager) isn't rebuilt
+ * on every read.
+ *
+ * hep-secret-access's own EnvProvider returns '' on a missing key rather than
+ * throwing; we throw instead, so a misconfigured secret fails loudly here
+ * too, regardless of which mode is active.
+ */
+class HepSecretProvider {
+    constructor() {
+        this.provider = (0, hep_secret_access_1.secretManager)();
+    }
+    async get(secretId) {
+        const value = await this.provider.read(secretId);
+        if (!value) {
+            throw new errors_1.SecretNotFoundError(secretId);
+        }
+        return value;
+    }
+}
+exports.HepSecretProvider = HepSecretProvider;
+//# sourceMappingURL=hep-secret-provider.js.map

package/dist/hep-secret-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hep-secret-provider.js","sourceRoot":"","sources":["../src/hep-secret-provider.ts"],"names":[],"mappings":";;;AAAA,yDAAkD;AAElD,qCAA+C;AAG/C;;;;;;;;;;;GAWG;AACH,MAAa,iBAAiB;IAA9B;QACmB,aAAQ,GAAG,IAAA,iCAAa,GAAE,CAAC;IAS9C,CAAC;IAPC,KAAK,CAAC,GAAG,CAAC,QAAgB;QACxB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,4BAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAVD,8CAUC"}

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+export { getTenantConfig, clearTenantCache, setConfigProvider, getClientTenantDetails } from './tenant-config';
+export { extractSiteName, buildSecretId } from './extract-site-name';
+export { generateKeycloakSecrets } from './keycloak-secrets-provisioner';
+export type { KeycloakSecretsInput, KeycloakSecretsResult } from './keycloak-secrets-provisioner';
+export { createConfigProvider } from './config-provider';
+export type { ProviderMode } from './config-provider';
+export { HepSecretProvider } from './hep-secret-provider';
+export { TTLCache } from './cache';
+export { getGraphQLClient, clearGraphQLClientCache, gql, ClientError } from './graphql-client';
+export { withRetry, withTimeout, CircuitBreaker } from './resilience';
+export { TenantNotFoundError, SecretNotFoundError, TokenExpiredError, TokenInvalidError, UnauthorizedError, CrossTenantAccessError, ForbiddenError, ShopifyApiError, ShopifyUserError, TimeoutError, CircuitOpenError, globalErrorHandler, } from './errors';
+export type { TenantConfig, ShopifyConfig, KeycloakConfig, ConfigProvider, TenantAuthInfo } from './types';
+export { extractBearer, verifyKeycloakToken, keycloakConfigForTenant, requireKeycloakAuth, } from './keycloak-auth';
+export type { KeycloakTokenPayload, KeycloakVerifyConfig } from './keycloak-auth';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC/G,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAClG,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EACL,mBAAmB,EAAE,mBAAmB,EACxC,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EACvD,sBAAsB,EAAE,cAAc,EACtC,eAAe,EAAE,gBAAgB,EACjC,YAAY,EAAE,gBAAgB,EAC9B,kBAAkB,GACnB,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC3G,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/index.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireKeycloakAuth = exports.keycloakConfigForTenant = exports.verifyKeycloakToken = exports.extractBearer = exports.globalErrorHandler = exports.CircuitOpenError = exports.TimeoutError = exports.ShopifyUserError = exports.ShopifyApiError = exports.ForbiddenError = exports.CrossTenantAccessError = exports.UnauthorizedError = exports.TokenInvalidError = exports.TokenExpiredError = exports.SecretNotFoundError = exports.TenantNotFoundError = exports.CircuitBreaker = exports.withTimeout = exports.withRetry = exports.ClientError = exports.gql = exports.clearGraphQLClientCache = exports.getGraphQLClient = exports.TTLCache = exports.HepSecretProvider = exports.createConfigProvider = exports.generateKeycloakSecrets = exports.buildSecretId = exports.extractSiteName = exports.getClientTenantDetails = exports.setConfigProvider = exports.clearTenantCache = exports.getTenantConfig = void 0;
+var tenant_config_1 = require("./tenant-config");
+Object.defineProperty(exports, "getTenantConfig", { enumerable: true, get: function () { return tenant_config_1.getTenantConfig; } });
+Object.defineProperty(exports, "clearTenantCache", { enumerable: true, get: function () { return tenant_config_1.clearTenantCache; } });
+Object.defineProperty(exports, "setConfigProvider", { enumerable: true, get: function () { return tenant_config_1.setConfigProvider; } });
+Object.defineProperty(exports, "getClientTenantDetails", { enumerable: true, get: function () { return tenant_config_1.getClientTenantDetails; } });
+var extract_site_name_1 = require("./extract-site-name");
+Object.defineProperty(exports, "extractSiteName", { enumerable: true, get: function () { return extract_site_name_1.extractSiteName; } });
+Object.defineProperty(exports, "buildSecretId", { enumerable: true, get: function () { return extract_site_name_1.buildSecretId; } });
+var keycloak_secrets_provisioner_1 = require("./keycloak-secrets-provisioner");
+Object.defineProperty(exports, "generateKeycloakSecrets", { enumerable: true, get: function () { return keycloak_secrets_provisioner_1.generateKeycloakSecrets; } });
+var config_provider_1 = require("./config-provider");
+Object.defineProperty(exports, "createConfigProvider", { enumerable: true, get: function () { return config_provider_1.createConfigProvider; } });
+var hep_secret_provider_1 = require("./hep-secret-provider");
+Object.defineProperty(exports, "HepSecretProvider", { enumerable: true, get: function () { return hep_secret_provider_1.HepSecretProvider; } });
+var cache_1 = require("./cache");
+Object.defineProperty(exports, "TTLCache", { enumerable: true, get: function () { return cache_1.TTLCache; } });
+var graphql_client_1 = require("./graphql-client");
+Object.defineProperty(exports, "getGraphQLClient", { enumerable: true, get: function () { return graphql_client_1.getGraphQLClient; } });
+Object.defineProperty(exports, "clearGraphQLClientCache", { enumerable: true, get: function () { return graphql_client_1.clearGraphQLClientCache; } });
+Object.defineProperty(exports, "gql", { enumerable: true, get: function () { return graphql_client_1.gql; } });
+Object.defineProperty(exports, "ClientError", { enumerable: true, get: function () { return graphql_client_1.ClientError; } });
+var resilience_1 = require("./resilience");
+Object.defineProperty(exports, "withRetry", { enumerable: true, get: function () { return resilience_1.withRetry; } });
+Object.defineProperty(exports, "withTimeout", { enumerable: true, get: function () { return resilience_1.withTimeout; } });
+Object.defineProperty(exports, "CircuitBreaker", { enumerable: true, get: function () { return resilience_1.CircuitBreaker; } });
+var errors_1 = require("./errors");
+Object.defineProperty(exports, "TenantNotFoundError", { enumerable: true, get: function () { return errors_1.TenantNotFoundError; } });
+Object.defineProperty(exports, "SecretNotFoundError", { enumerable: true, get: function () { return errors_1.SecretNotFoundError; } });
+Object.defineProperty(exports, "TokenExpiredError", { enumerable: true, get: function () { return errors_1.TokenExpiredError; } });
+Object.defineProperty(exports, "TokenInvalidError", { enumerable: true, get: function () { return errors_1.TokenInvalidError; } });
+Object.defineProperty(exports, "UnauthorizedError", { enumerable: true, get: function () { return errors_1.UnauthorizedError; } });
+Object.defineProperty(exports, "CrossTenantAccessError", { enumerable: true, get: function () { return errors_1.CrossTenantAccessError; } });
+Object.defineProperty(exports, "ForbiddenError", { enumerable: true, get: function () { return errors_1.ForbiddenError; } });
+Object.defineProperty(exports, "ShopifyApiError", { enumerable: true, get: function () { return errors_1.ShopifyApiError; } });
+Object.defineProperty(exports, "ShopifyUserError", { enumerable: true, get: function () { return errors_1.ShopifyUserError; } });
+Object.defineProperty(exports, "TimeoutError", { enumerable: true, get: function () { return errors_1.TimeoutError; } });
+Object.defineProperty(exports, "CircuitOpenError", { enumerable: true, get: function () { return errors_1.CircuitOpenError; } });
+Object.defineProperty(exports, "globalErrorHandler", { enumerable: true, get: function () { return errors_1.globalErrorHandler; } });
+var keycloak_auth_1 = require("./keycloak-auth");
+Object.defineProperty(exports, "extractBearer", { enumerable: true, get: function () { return keycloak_auth_1.extractBearer; } });
+Object.defineProperty(exports, "verifyKeycloakToken", { enumerable: true, get: function () { return keycloak_auth_1.verifyKeycloakToken; } });
+Object.defineProperty(exports, "keycloakConfigForTenant", { enumerable: true, get: function () { return keycloak_auth_1.keycloakConfigForTenant; } });
+Object.defineProperty(exports, "requireKeycloakAuth", { enumerable: true, get: function () { return keycloak_auth_1.requireKeycloakAuth; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,iDAA+G;AAAtG,gHAAA,eAAe,OAAA;AAAE,iHAAA,gBAAgB,OAAA;AAAE,kHAAA,iBAAiB,OAAA;AAAE,uHAAA,sBAAsB,OAAA;AACrF,yDAAqE;AAA5D,oHAAA,eAAe,OAAA;AAAE,kHAAA,aAAa,OAAA;AACvC,+EAAyE;AAAhE,uIAAA,uBAAuB,OAAA;AAEhC,qDAAyD;AAAhD,uHAAA,oBAAoB,OAAA;AAE7B,6DAA0D;AAAjD,wHAAA,iBAAiB,OAAA;AAC1B,iCAAmC;AAA1B,iGAAA,QAAQ,OAAA;AACjB,mDAA+F;AAAtF,kHAAA,gBAAgB,OAAA;AAAE,yHAAA,uBAAuB,OAAA;AAAE,qGAAA,GAAG,OAAA;AAAE,6GAAA,WAAW,OAAA;AACpE,2CAAsE;AAA7D,uGAAA,SAAS,OAAA;AAAE,yGAAA,WAAW,OAAA;AAAE,4GAAA,cAAc,OAAA;AAC/C,mCAOkB;AANhB,6GAAA,mBAAmB,OAAA;AAAE,6GAAA,mBAAmB,OAAA;AACxC,2GAAA,iBAAiB,OAAA;AAAE,2GAAA,iBAAiB,OAAA;AAAE,2GAAA,iBAAiB,OAAA;AACvD,gHAAA,sBAAsB,OAAA;AAAE,wGAAA,cAAc,OAAA;AACtC,yGAAA,eAAe,OAAA;AAAE,0GAAA,gBAAgB,OAAA;AACjC,sGAAA,YAAY,OAAA;AAAE,0GAAA,gBAAgB,OAAA;AAC9B,4GAAA,kBAAkB,OAAA;AAGpB,iDAKyB;AAJvB,8GAAA,aAAa,OAAA;AACb,oHAAA,mBAAmB,OAAA;AACnB,wHAAA,uBAAuB,OAAA;AACvB,oHAAA,mBAAmB,OAAA"}

package/dist/keycloak-auth.d.ts

@@ -0,0 +1,50 @@
+import type { NextFunction, Request, Response } from 'express';
+export interface KeycloakTokenPayload {
+    sub: string;
+    preferred_username?: string;
+    email?: string;
+    realm_access?: {
+        roles: string[];
+    };
+    [claim: string]: unknown;
+}
+export interface KeycloakVerifyConfig {
+    issuer: string;
+    jwksUri: string;
+    /** Restrict verification to tokens whose `aud` matches. Omit to accept any audience. */
+    audience?: string;
+}
+/** Extracts the bearer token from an `Authorization` header. Throws `UnauthorizedError` if missing/malformed. */
+export declare function extractBearer(authorization?: string): string;
+/**
+ * Verifies a Keycloak-issued access token: RS256 signature (resolved against
+ * `config.jwksUri`), issuer, and — if given — audience. Throws
+ * `TokenExpiredError` / `TokenInvalidError` on failure.
+ */
+export declare function verifyKeycloakToken(token: string, config: KeycloakVerifyConfig): Promise<KeycloakTokenPayload>;
+/**
+ * Builds a `KeycloakVerifyConfig` from a tenant's resolved config (see
+ * `getTenantConfig`). `audience` is passed through as-is — it isn't part of
+ * `KeycloakConfig` since it's a per-caller restriction, not a per-tenant secret.
+ */
+export declare function keycloakConfigForTenant(siteName: string, audience?: string): Promise<KeycloakVerifyConfig>;
+/**
+ * Express middleware factory. Verifies the request's bearer token and
+ * attaches `{ sub, role }` to `req.user`, and the full decoded payload to
+ * `req.keycloakUser`. `config` may be a static `KeycloakVerifyConfig` (a
+ * service with its own fixed issuer/JWKS env vars), or a function — sync or
+ * async — to resolve one per request, e.g. `() => keycloakConfigForTenant('KIWI')`.
+ */
+export declare function requireKeycloakAuth(config: KeycloakVerifyConfig | ((req: Request) => KeycloakVerifyConfig | Promise<KeycloakVerifyConfig>)): (req: Request, _res: Response, next: NextFunction) => void;
+declare global {
+    namespace Express {
+        interface Request {
+            user?: {
+                sub: string;
+                role?: string;
+            };
+            keycloakUser?: KeycloakTokenPayload;
+        }
+    }
+}
+//# sourceMappingURL=keycloak-auth.d.ts.map

package/dist/keycloak-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keycloak-auth.d.ts","sourceRoot":"","sources":["../src/keycloak-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAO/D,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACnC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,wFAAwF;IACxF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAeD,iHAAiH;AACjH,wBAAgB,aAAa,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAK5D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA8B9G;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAGhH;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,oBAAoB,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC,IAE/F,KAAK,OAAO,EAAE,MAAM,QAAQ,EAAE,MAAM,YAAY,KAAG,IAAI,CAYhE;AAED,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,IAAI,CAAC,EAAE;gBAAE,GAAG,EAAE,MAAM,CAAC;gBAAC,IAAI,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC;YACtC,YAAY,CAAC,EAAE,oBAAoB,CAAC;SACrC;KACF;CACF"}

package/dist/keycloak-auth.js

@@ -0,0 +1,92 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractBearer = extractBearer;
+exports.verifyKeycloakToken = verifyKeycloakToken;
+exports.keycloakConfigForTenant = keycloakConfigForTenant;
+exports.requireKeycloakAuth = requireKeycloakAuth;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const jwks_rsa_1 = __importDefault(require("jwks-rsa"));
+const errors_1 = require("./errors");
+const tenant_config_1 = require("./tenant-config");
+// One jwks-rsa client per distinct JWKS URI, reused across calls/requests —
+// it has its own internal signing-key cache + rate limiter.
+const jwksClients = new Map();
+function getJwksClient(jwksUri) {
+    let client = jwksClients.get(jwksUri);
+    if (!client) {
+        client = (0, jwks_rsa_1.default)({ jwksUri, cache: true, rateLimit: true });
+        jwksClients.set(jwksUri, client);
+    }
+    return client;
+}
+/** Extracts the bearer token from an `Authorization` header. Throws `UnauthorizedError` if missing/malformed. */
+function extractBearer(authorization) {
+    if (!authorization?.startsWith('Bearer ')) {
+        throw new errors_1.UnauthorizedError('Missing or malformed Authorization header');
+    }
+    return authorization.slice('Bearer '.length);
+}
+/**
+ * Verifies a Keycloak-issued access token: RS256 signature (resolved against
+ * `config.jwksUri`), issuer, and — if given — audience. Throws
+ * `TokenExpiredError` / `TokenInvalidError` on failure.
+ */
+function verifyKeycloakToken(token, config) {
+    const client = getJwksClient(config.jwksUri);
+    const getSigningKey = (header, callback) => {
+        client.getSigningKey(header.kid, (err, key) => {
+            if (err || !key) {
+                callback(err ?? new Error('Unable to resolve signing key'));
+                return;
+            }
+            callback(null, key.getPublicKey());
+        });
+    };
+    return new Promise((resolve, reject) => {
+        jsonwebtoken_1.default.verify(token, getSigningKey, { algorithms: ['RS256'], issuer: config.issuer, audience: config.audience }, (err, decoded) => {
+            if (err) {
+                reject(err.name === 'TokenExpiredError' ? new errors_1.TokenExpiredError() : new errors_1.TokenInvalidError(err.message));
+                return;
+            }
+            if (!decoded || typeof decoded !== 'object') {
+                reject(new errors_1.TokenInvalidError());
+                return;
+            }
+            resolve(decoded);
+        });
+    });
+}
+/**
+ * Builds a `KeycloakVerifyConfig` from a tenant's resolved config (see
+ * `getTenantConfig`). `audience` is passed through as-is — it isn't part of
+ * `KeycloakConfig` since it's a per-caller restriction, not a per-tenant secret.
+ */
+async function keycloakConfigForTenant(siteName, audience) {
+    const { keycloak } = await (0, tenant_config_1.getTenantConfig)(siteName);
+    return { issuer: keycloak.issuer, jwksUri: keycloak.jwksUri, audience };
+}
+/**
+ * Express middleware factory. Verifies the request's bearer token and
+ * attaches `{ sub, role }` to `req.user`, and the full decoded payload to
+ * `req.keycloakUser`. `config` may be a static `KeycloakVerifyConfig` (a
+ * service with its own fixed issuer/JWKS env vars), or a function — sync or
+ * async — to resolve one per request, e.g. `() => keycloakConfigForTenant('KIWI')`.
+ */
+function requireKeycloakAuth(config) {
+    return (req, _res, next) => {
+        Promise.resolve()
+            .then(async () => {
+            const token = extractBearer(req.header('authorization'));
+            const resolvedConfig = typeof config === 'function' ? await config(req) : config;
+            const payload = await verifyKeycloakToken(token, resolvedConfig);
+            req.user = { sub: payload.sub, role: payload.realm_access?.roles?.[0] };
+            req.keycloakUser = payload;
+        })
+            .then(() => next())
+            .catch(next);
+    };
+}
+//# sourceMappingURL=keycloak-auth.js.map

package/dist/keycloak-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keycloak-auth.js","sourceRoot":"","sources":["../src/keycloak-auth.ts"],"names":[],"mappings":";;;;;AAoCA,sCAKC;AAOD,kDA8BC;AAOD,0DAGC;AASD,kDAeC;AA/GD,gEAA4E;AAC5E,wDAAuD;AAEvD,qCAAmF;AACnF,mDAAkD;AAiBlD,4EAA4E;AAC5E,4DAA4D;AAC5D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAsB,CAAC;AAElD,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,IAAA,kBAAU,EAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iHAAiH;AACjH,SAAgB,aAAa,CAAC,aAAsB;IAClD,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,0BAAiB,CAAC,2CAA2C,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,KAAa,EAAE,MAA4B;IAC7E,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,aAAa,GAAG,CAAC,MAAiB,EAAE,QAA4B,EAAQ,EAAE;QAC9E,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAChB,QAAQ,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC;gBAC5D,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,sBAAG,CAAC,MAAM,CACR,KAAK,EACL,aAAa,EACb,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAC3E,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;YACf,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,IAAI,0BAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,0BAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBACxG,OAAO;YACT,CAAC;YACD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC5C,MAAM,CAAC,IAAI,0BAAiB,EAAE,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,OAAO,CAAC,OAA+B,CAAC,CAAC;QAC3C,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,uBAAuB,CAAC,QAAgB,EAAE,QAAiB;IAC/E,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAA,+BAAe,EAAC,QAAQ,CAAC,CAAC;IACrD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,mBAAmB,CACjC,MAAuG;IAEvG,OAAO,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAQ,EAAE;QAChE,OAAO,CAAC,OAAO,EAAE;aACd,IAAI,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;YACzD,MAAM,cAAc,GAAG,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YACjF,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;YACjE,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC;QAC7B,CAAC,CAAC;aACD,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;aAClB,KAAK,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC"}

package/dist/keycloak-secrets-provisioner.d.ts

@@ -0,0 +1,44 @@
+export interface KeycloakSecretsInput {
+    /** Tenant site name, e.g. 'KIWI'. Uppercased/lowercased as needed internally. */
+    siteName: string;
+    /** Keycloak server origin, e.g. 'https://dev.idp.hcl-x.com' (no trailing slash needed). */
+    idpBaseUrl: string;
+    /** Shopify's external-IdP OAuth callback URL for this store (app-specific, not part of the Keycloak realm). */
+    callbackUrl: string;
+    /** Shopify's post-logout redirect URL for this store (app-specific, not part of the Keycloak realm). */
+    postLogoutRedirectUri: string;
+}
+export interface KeycloakSecretsResult {
+    siteName: string;
+    /** Secret ids that were created/updated — never the values, so callers don't accidentally log them. */
+    secretIds: string[];
+}
+/**
+ * Creates/updates the 7 `${SITENAME}_KEYCLOAK_*` secrets (BASE_URL, REALM,
+ * CLIENT_ID, CLIENT_SECRET, DISCOVERY_URL, JWKS_URI, ISSUER) plus the 2
+ * `${SITENAME}_SHOPIFY_*` redirect-url secrets (CALLBACK_URL,
+ * POST_LOGOUT_REDIRECT_URI) that `getTenantConfig`'s `fetchKeycloakConfig`
+ * reads.
+ *
+ * `@platform-x/hep-authentication-provider`'s `AuthenticationManager` (the
+ * same package + version hep-prelem-registration depends on) is used to
+ * verify the site is a real, authenticatable tenant before writing anything —
+ * `iamAuthenticator` throws/returns falsy for a site missing from
+ * AUTH_TENANTS_INFO or with an unsupported auth_provider. It requires
+ * `initIAMSecrets` to have registered a secret-key service first (this
+ * function does so itself, scoped to just AUTH_TENANTS_INFO). Its public API
+ * doesn't expose the resolved realm/client_id/client_secret though (they're
+ * private fields on the KeyClockEndUserConnector it builds), so those values
+ * are read the same way `getClientTenantDetails` already does — straight from
+ * the AUTH_TENANTS_INFO secret, which is the one source both draw from.
+ *
+ * The remaining fields are either derived from Keycloak's standard endpoint
+ * layout (DISCOVERY_URL/JWKS_URI/ISSUER — same templates
+ * hep-authentication-provider and shp-auth-service's env.ts already use for
+ * the `kiwi` realm) or supplied by the caller (CALLBACK_URL/
+ * POST_LOGOUT_REDIRECT_URI — Shopify-side external-IdP redirect URLs, not
+ * Keycloak realm data, so they're written under the `SHOPIFY` provider
+ * segment instead and can't be resolved automatically).
+ */
+export declare function generateKeycloakSecrets(input: KeycloakSecretsInput): Promise<KeycloakSecretsResult>;
+//# sourceMappingURL=keycloak-secrets-provisioner.d.ts.map

package/dist/keycloak-secrets-provisioner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keycloak-secrets-provisioner.d.ts","sourceRoot":"","sources":["../src/keycloak-secrets-provisioner.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,oBAAoB;IACnC,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB,2FAA2F;IAC3F,UAAU,EAAE,MAAM,CAAC;IACnB,+GAA+G;IAC/G,WAAW,EAAE,MAAM,CAAC;IACpB,wGAAwG;IACxG,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,uGAAuG;IACvG,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA+DzG"}

package/dist/keycloak-secrets-provisioner.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateKeycloakSecrets = generateKeycloakSecrets;
+const hep_authentication_provider_1 = require("@platform-x/hep-authentication-provider");
+const hep_secret_access_1 = require("hep-secret-access");
+const errors_1 = require("./errors");
+const extract_site_name_1 = require("./extract-site-name");
+const tenant_config_1 = require("./tenant-config");
+/**
+ * Creates/updates the 7 `${SITENAME}_KEYCLOAK_*` secrets (BASE_URL, REALM,
+ * CLIENT_ID, CLIENT_SECRET, DISCOVERY_URL, JWKS_URI, ISSUER) plus the 2
+ * `${SITENAME}_SHOPIFY_*` redirect-url secrets (CALLBACK_URL,
+ * POST_LOGOUT_REDIRECT_URI) that `getTenantConfig`'s `fetchKeycloakConfig`
+ * reads.
+ *
+ * `@platform-x/hep-authentication-provider`'s `AuthenticationManager` (the
+ * same package + version hep-prelem-registration depends on) is used to
+ * verify the site is a real, authenticatable tenant before writing anything —
+ * `iamAuthenticator` throws/returns falsy for a site missing from
+ * AUTH_TENANTS_INFO or with an unsupported auth_provider. It requires
+ * `initIAMSecrets` to have registered a secret-key service first (this
+ * function does so itself, scoped to just AUTH_TENANTS_INFO). Its public API
+ * doesn't expose the resolved realm/client_id/client_secret though (they're
+ * private fields on the KeyClockEndUserConnector it builds), so those values
+ * are read the same way `getClientTenantDetails` already does — straight from
+ * the AUTH_TENANTS_INFO secret, which is the one source both draw from.
+ *
+ * The remaining fields are either derived from Keycloak's standard endpoint
+ * layout (DISCOVERY_URL/JWKS_URI/ISSUER — same templates
+ * hep-authentication-provider and shp-auth-service's env.ts already use for
+ * the `kiwi` realm) or supplied by the caller (CALLBACK_URL/
+ * POST_LOGOUT_REDIRECT_URI — Shopify-side external-IdP redirect URLs, not
+ * Keycloak realm data, so they're written under the `SHOPIFY` provider
+ * segment instead and can't be resolved automatically).
+ */
+async function generateKeycloakSecrets(input) {
+    const siteName = input.siteName.toUpperCase();
+    const gsm = (0, hep_secret_access_1.secretManager)();
+    // iamAuthenticator() reads AUTH_TENANTS_INFO through a process-global secret
+    // service the consuming app must register once via initIAMSecrets (see
+    // hep-prelem-registration's secreteKeys.services.ts) — without it, it throws
+    // "IAM secrets not initialized" rather than resolving the tenant. Register a
+    // minimal one here, scoped to just the one secret iamAuthenticator reads,
+    // rather than hep-prelem-registration's readAllSecrets() (which lists every
+    // secret in the project — broader than this package's per-key philosophy;
+    // see README).
+    const rawAuthTenantsInfo = await gsm.read('AUTH_TENANTS_INFO');
+    (0, hep_authentication_provider_1.initIAMSecrets)({ getSecretKeys: () => Promise.resolve({ AUTH_TENANTS_INFO: rawAuthTenantsInfo }) });
+    const authManager = new hep_authentication_provider_1.AuthenticationManager();
+    // iamAuthenticator's return type is `any` upstream; treat it as unknown and
+    // only ever check truthiness — never read fields off it (see doc comment above).
+    const connector = await authManager.iamAuthenticator(siteName, true);
+    if (!connector) {
+        throw new errors_1.TenantNotFoundError(siteName);
+    }
+    const tenantInfo = await (0, tenant_config_1.getClientTenantDetails)(siteName);
+    const realm = tenantInfo?.tenant;
+    const clientInfo = tenantInfo?.clients?.[0];
+    if (!realm || !clientInfo?.client_id || !clientInfo?.client_secret) {
+        throw new errors_1.SecretNotFoundError(`AUTH_TENANTS_INFO entry for ${siteName} is missing tenant/client data`);
+    }
+    const baseUrl = input.idpBaseUrl.replace(/\/+$/, '');
+    const keycloakValues = {
+        BASE_URL: baseUrl,
+        REALM: realm,
+        CLIENT_ID: clientInfo.client_id,
+        CLIENT_SECRET: clientInfo.client_secret,
+        DISCOVERY_URL: `${baseUrl}/realms/${realm}/.well-known/openid-configuration`,
+        JWKS_URI: `${baseUrl}/realms/${realm}/protocol/openid-connect/certs`,
+        ISSUER: `${baseUrl}/realms/${realm}`,
+    };
+    // Shopify-side external-IdP redirect URLs — not Keycloak realm data, so
+    // written under the SHOPIFY provider segment (matches fetchKeycloakConfig).
+    const shopifyValues = {
+        CALLBACK_URL: input.callbackUrl,
+        POST_LOGOUT_REDIRECT_URI: input.postLogoutRedirectUri,
+    };
+    const secretIds = [];
+    for (const [key, value] of Object.entries(keycloakValues)) {
+        const secretId = (0, extract_site_name_1.buildSecretId)(siteName, 'KEYCLOAK', key);
+        await gsm.ensureSecret(secretId, { sitename: siteName.toLowerCase(), provider: 'keycloak' });
+        await gsm.addVersion(secretId, value);
+        secretIds.push(secretId);
+    }
+    for (const [key, value] of Object.entries(shopifyValues)) {
+        const secretId = (0, extract_site_name_1.buildSecretId)(siteName, 'SHOPIFY', key);
+        await gsm.ensureSecret(secretId, { sitename: siteName.toLowerCase(), provider: 'shopify' });
+        await gsm.addVersion(secretId, value);
+        secretIds.push(secretId);
+    }
+    (0, tenant_config_1.clearTenantCache)(siteName);
+    return { siteName, secretIds };
+}
+//# sourceMappingURL=keycloak-secrets-provisioner.js.map

package/dist/keycloak-secrets-provisioner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keycloak-secrets-provisioner.js","sourceRoot":"","sources":["../src/keycloak-secrets-provisioner.ts"],"names":[],"mappings":";;AAiEA,0DA+DC;AAhID,yFAAgG;AAChG,yDAAkD;AAElD,qCAAoE;AACpE,2DAAoD;AACpD,mDAA2E;AAiC3E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACI,KAAK,UAAU,uBAAuB,CAAC,KAA2B;IACvE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAA,iCAAa,GAAwC,CAAC;IAElE,6EAA6E;IAC7E,uEAAuE;IACvE,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,eAAe;IACf,MAAM,kBAAkB,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC/D,IAAA,4CAAc,EAAC,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC,CAAC;IAEpG,MAAM,WAAW,GAAG,IAAI,mDAAqB,EAAE,CAAC;IAChD,4EAA4E;IAC5E,iFAAiF;IACjF,MAAM,SAAS,GAAY,MAAM,WAAW,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC9E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,4BAAmB,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,IAAA,sCAAsB,EAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,UAAU,EAAE,MAA4B,CAAC;IACvD,MAAM,UAAU,GAAI,UAAU,EAAE,OAA6E,EAAE,CAAC,CAAC,CAAC,CAAC;IACnH,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,SAAS,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,CAAC;QACnE,MAAM,IAAI,4BAAmB,CAAC,+BAA+B,QAAQ,gCAAgC,CAAC,CAAC;IACzG,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,cAAc,GAA2B;QAC7C,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,KAAK;QACZ,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,aAAa,EAAE,GAAG,OAAO,WAAW,KAAK,mCAAmC;QAC5E,QAAQ,EAAE,GAAG,OAAO,WAAW,KAAK,gCAAgC;QACpE,MAAM,EAAE,GAAG,OAAO,WAAW,KAAK,EAAE;KACrC,CAAC;IACF,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,aAAa,GAA2B;QAC5C,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,wBAAwB,EAAE,KAAK,CAAC,qBAAqB;KACtD,CAAC;IAEF,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAA,iCAAa,EAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;QAC1D,MAAM,GAAG,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QAC7F,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACtC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAA,iCAAa,EAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QACzD,MAAM,GAAG,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5F,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACtC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IAED,IAAA,gCAAgB,EAAC,QAAQ,CAAC,CAAC;IAC3B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC"}

package/dist/resilience.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Retries an async operation with exponential back-off.
+ *
+ * @param fn        - Async function to execute
+ * @param retries   - Maximum retry attempts (default 3)
+ * @param baseMs    - Initial delay in ms (default 200); doubles each attempt
+ * @param shouldRetry - Optional predicate; returning false stops retrying early
+ */
+export declare function withRetry<T>(fn: () => Promise<T>, retries?: number, baseMs?: number, shouldRetry?: (err: unknown) => boolean): Promise<T>;
+/** Wraps an async function with a timeout. Throws if it takes longer than ms. */
+export declare function withTimeout<T>(fn: () => Promise<T>, ms?: number): Promise<T>;
+/**
+ * Simple circuit breaker. Opens after `failureThreshold` consecutive failures
+ * and resets after `resetAfterMs`.
+ */
+export declare class CircuitBreaker {
+    private readonly failureThreshold;
+    private readonly resetAfterMs;
+    private failures;
+    private openSince;
+    constructor(failureThreshold?: number, resetAfterMs?: number);
+    isOpen(): boolean;
+    call<T>(fn: () => Promise<T>): Promise<T>;
+    reset(): void;
+}
+//# sourceMappingURL=resilience.d.ts.map

package/dist/resilience.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resilience.d.ts","sourceRoot":"","sources":["../src/resilience.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAC/B,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,OAAO,SAAI,EACX,MAAM,SAAM,EACZ,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,GACtC,OAAO,CAAC,CAAC,CAAC,CAaZ;AAED,iFAAiF;AACjF,wBAAsB,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAOhF;AAED;;;GAGG;AACH,qBAAa,cAAc;IAKvB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAL/B,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,SAAS,CAAuB;gBAGrB,gBAAgB,SAAI,EACpB,YAAY,SAAS;IAGxC,MAAM,IAAI,OAAO;IAUX,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAa/C,KAAK,IAAI,IAAI;CAId"}