@pvh-afl/core 1.1.21 → 1.1.22

package/dist/auth/jwt.service.js

@@ -0,0 +1,185 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthTokenService = exports.TokenWrongTypeError = exports.TokenInvalidError = exports.TokenExpiredError = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const jwt_1 = require("@nestjs/jwt");
+const auth_types_1 = require("./auth.types");
+const utils_1 = require("./utils");
+/** Thrown when a token is well-formed and correctly signed but has expired. */
+class TokenExpiredError extends Error {
+}
+exports.TokenExpiredError = TokenExpiredError;
+/** Thrown when a token fails any other check. */
+class TokenInvalidError extends Error {
+}
+exports.TokenInvalidError = TokenInvalidError;
+/** Thrown when a refresh token is used as an access token, or the reverse. */
+class TokenWrongTypeError extends Error {
+}
+exports.TokenWrongTypeError = TokenWrongTypeError;
+const DEFAULT_TTL_SECONDS = 1800; // 30 minutes
+const DEFAULT_REFRESH_TTL_SECONDS = 604800; // 7 days
+/**
+ * Signs and verifies the authentication tokens this service issues.
+ *
+ * Two kinds, distinguished by a `typ` claim that is checked on every verify:
+ *
+ * - **access** (30 min) — sent on every protected request.
+ * - **refresh** (7 days) — sent only to `/auth/refresh`, to mint a new access
+ *   token without going back to Shopify.
+ *
+ * The refresh token carries the same identity claims as an access token, which is
+ * what lets renewal be a purely local operation: no Shopify call, so renewal
+ * costs nothing against Shopify's rate limit.
+ *
+ * Fixed to RS256, and the algorithm is pinned on verify rather than read from the
+ * token. That is deliberate: the JWT spec allows `alg: none`, and a verifier that
+ * trusts the token's own header can also be tricked into validating an RS256
+ * token as HS256 using the public key as the HMAC secret. Both attacks fail
+ * against an explicit allow-list of one algorithm.
+ */
+let AuthTokenService = class AuthTokenService {
+    jwt;
+    options;
+    ttlSeconds;
+    refreshTtlSeconds;
+    constructor(jwt, options) {
+        this.jwt = jwt;
+        this.options = options;
+        this.ttlSeconds = options.ttlSeconds ?? DEFAULT_TTL_SECONDS;
+        this.refreshTtlSeconds =
+            options.refreshTtlSeconds ?? DEFAULT_REFRESH_TTL_SECONDS;
+    }
+    /**
+     * Issue an access and refresh token for a customer whose identity Shopify has
+     * already confirmed.
+     *
+     * @param customerId - Shopify customer GID, taken from Shopify's response.
+     * @param phone - The customer's phone number as Shopify holds it, if any.
+     *   Stored as a hash so a `mobile` value in a later request can be checked
+     *   against it without the number appearing in the token.
+     * @param maxExpiresAt - Optional upper bound on both expiries, normally an
+     *   upstream credential's own expiry, so neither token outlives it.
+     */
+    async issuePair(customerId, phone, maxExpiresAt) {
+        const [access, refresh] = await Promise.all([
+            this.sign(auth_types_1.TokenType.ACCESS, customerId, phone, this.ttlSeconds, maxExpiresAt),
+            this.sign(auth_types_1.TokenType.REFRESH, customerId, phone, this.refreshTtlSeconds, maxExpiresAt),
+        ]);
+        return {
+            accessToken: access.token,
+            accessExpiresAt: access.expiresAt,
+            refreshToken: refresh.token,
+            refreshExpiresAt: refresh.expiresAt,
+        };
+    }
+    /**
+     * Issue a replacement access token from a verified refresh token.
+     *
+     * The refresh token itself is **not** replaced: its expiry is the absolute end
+     * of the session (see `refreshTtlSeconds`). The caller keeps using the same one
+     * until it expires, then logs in again.
+     */
+    async issueAccessToken(user, maxExpiresAt) {
+        return this.signFromHash(auth_types_1.TokenType.ACCESS, user.customerId, user.phoneHash, this.ttlSeconds, maxExpiresAt);
+    }
+    /**
+     * Verify an access token and return the caller it identifies.
+     *
+     * @throws {TokenExpiredError} past `exp` — the client should refresh and retry.
+     * @throws {TokenWrongTypeError} a refresh token was sent instead.
+     * @throws {TokenInvalidError} anything else.
+     */
+    async verifyAccess(token) {
+        return this.verify(token, auth_types_1.TokenType.ACCESS);
+    }
+    /**
+     * Verify a refresh token and return the caller it identifies.
+     *
+     * @throws {TokenExpiredError} the session has reached its absolute end; the
+     *   customer has to log in again.
+     * @throws {TokenWrongTypeError} an access token was sent instead.
+     * @throws {TokenInvalidError} anything else.
+     */
+    async verifyRefresh(token) {
+        return this.verify(token, auth_types_1.TokenType.REFRESH);
+    }
+    async verify(token, expected) {
+        let payload;
+        try {
+            payload = await this.jwt.verifyAsync(token, {
+                // Pinned here, never taken from the token header.
+                algorithms: ['RS256'],
+                publicKey: this.options.publicKey,
+                issuer: this.options.issuer,
+                audience: this.options.audience,
+            });
+        }
+        catch (error) {
+            // jsonwebtoken signals expiry with this name; treat it separately so the
+            // client knows to refresh rather than to send the user back to login.
+            if (error instanceof Error && error.name === 'TokenExpiredError') {
+                throw new TokenExpiredError('Token has expired');
+            }
+            throw new TokenInvalidError(error instanceof Error ? error.message : 'Token verification failed');
+        }
+        // Checked before anything else about the payload: a valid signature on the
+        // wrong kind of token is still the wrong token.
+        if (payload.typ !== expected) {
+            throw new TokenWrongTypeError(`Expected a ${expected} token but received ${payload.typ ?? 'none'}`);
+        }
+        // `sub` carries the identity, so an absent or non-string value means the
+        // token cannot authenticate anyone even though its signature is valid.
+        if (typeof payload.sub !== 'string' || payload.sub.trim() === '') {
+            throw new TokenInvalidError('Token has no subject');
+        }
+        return {
+            customerId: payload.sub,
+            phoneHash: typeof payload.phone_hash === 'string' ? payload.phone_hash : undefined,
+        };
+    }
+    sign(typ, customerId, phone, ttlSeconds, maxExpiresAt) {
+        return this.signFromHash(typ, customerId, phone ? (0, utils_1.hashPhone)(phone) : undefined, ttlSeconds, maxExpiresAt);
+    }
+    async signFromHash(typ, customerId, phoneHash, ttlSeconds, maxExpiresAt) {
+        const nowSeconds = Math.floor(Date.now() / 1000);
+        const exp = this.resolveExpiry(nowSeconds, ttlSeconds, maxExpiresAt);
+        const payload = {
+            iss: this.options.issuer,
+            aud: this.options.audience,
+            typ,
+            sub: customerId,
+            ...(phoneHash ? { phone_hash: phoneHash } : {}),
+            iat: nowSeconds,
+            exp,
+        };
+        const token = await this.jwt.signAsync(payload, {
+            algorithm: 'RS256',
+            privateKey: this.options.privateKey,
+            // iss/aud/iat/exp are already in the payload; signing them again via
+            // options would make jsonwebtoken reject the duplicate keys.
+        });
+        return { token, expiresAt: new Date(exp * 1000) };
+    }
+    /**
+     * Work out the `exp` claim: the given lifetime, shortened if an upstream
+     * credential expires sooner.
+     */
+    resolveExpiry(nowSeconds, ttlSeconds, maxExpiresAt) {
+        const ownExpiry = nowSeconds + ttlSeconds;
+        if (!maxExpiresAt)
+            return ownExpiry;
+        const upstream = new Date(maxExpiresAt).getTime();
+        if (Number.isNaN(upstream))
+            return ownExpiry;
+        return Math.min(ownExpiry, Math.floor(upstream / 1000));
+    }
+};
+exports.AuthTokenService = AuthTokenService;
+exports.AuthTokenService = AuthTokenService = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__param(1, (0, common_1.Inject)(auth_types_1.AUTH_OPTIONS)),
+    tslib_1.__metadata("design:paramtypes", [jwt_1.JwtService, Object])
+], AuthTokenService);
+//# sourceMappingURL=jwt.service.js.map

package/dist/auth/jwt.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.service.js","sourceRoot":"","sources":["../../src/auth/jwt.service.ts"],"names":[],"mappings":";;;;AAAA,2CAAoD;AACpD,qCAA2D;AAC3D,6CAMsB;AACtB,mCAAoC;AAEpC,+EAA+E;AAC/E,MAAa,iBAAkB,SAAQ,KAAK;CAAG;AAA/C,8CAA+C;AAE/C,iDAAiD;AACjD,MAAa,iBAAkB,SAAQ,KAAK;CAAG;AAA/C,8CAA+C;AAE/C,8EAA8E;AAC9E,MAAa,mBAAoB,SAAQ,KAAK;CAAG;AAAjD,kDAAiD;AAEjD,MAAM,mBAAmB,GAAG,IAAI,CAAC,CAAC,aAAa;AAC/C,MAAM,2BAA2B,GAAG,MAAM,CAAC,CAAC,SAAS;AAUrD;;;;;;;;;;;;;;;;;;GAkBG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAKR;IACsB;IALxB,UAAU,CAAS;IACnB,iBAAiB,CAAS;IAE3C,YACmB,GAAmB,EACG,OAA0B;QADhD,QAAG,GAAH,GAAG,CAAgB;QACG,YAAO,GAAP,OAAO,CAAmB;QAEjE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;QAC5D,IAAI,CAAC,iBAAiB;YACpB,OAAO,CAAC,iBAAiB,IAAI,2BAA2B,CAAC;IAC7D,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,SAAS,CACb,UAAkB,EAClB,KAAqB,EACrB,YAAmC;QAEnC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,sBAAS,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC;YAC7E,IAAI,CAAC,IAAI,CACP,sBAAS,CAAC,OAAO,EACjB,UAAU,EACV,KAAK,EACL,IAAI,CAAC,iBAAiB,EACtB,YAAY,CACb;SACF,CAAC,CAAC;QAEH,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,KAAK;YACzB,eAAe,EAAE,MAAM,CAAC,SAAS;YACjC,YAAY,EAAE,OAAO,CAAC,KAAK;YAC3B,gBAAgB,EAAE,OAAO,CAAC,SAAS;SACpC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CACpB,IAAc,EACd,YAAmC;QAEnC,OAAO,IAAI,CAAC,YAAY,CACtB,sBAAS,CAAC,MAAM,EAChB,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,UAAU,EACf,YAAY,CACb,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,sBAAS,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,sBAAS,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,QAAmB;QACrD,IAAI,OAA2B,CAAC;QAEhC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAqB,KAAK,EAAE;gBAC9D,kDAAkD;gBAClD,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;gBACjC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;gBAC3B,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;aAChC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,sEAAsE;YACtE,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBACjE,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,IAAI,iBAAiB,CACzB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CACrE,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,gDAAgD;QAChD,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,mBAAmB,CAC3B,cAAc,QAAQ,uBAAuB,OAAO,CAAC,GAAG,IAAI,MAAM,EAAE,CACrE,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,uEAAuE;QACvE,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACjE,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;QACtD,CAAC;QAED,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,GAAG;YACvB,SAAS,EACP,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;SAC1E,CAAC;IACJ,CAAC;IAEO,IAAI,CACV,GAAc,EACd,UAAkB,EAClB,KAAgC,EAChC,UAAkB,EAClB,YAAmC;QAEnC,OAAO,IAAI,CAAC,YAAY,CACtB,GAAG,EACH,UAAU,EACV,KAAK,CAAC,CAAC,CAAC,IAAA,iBAAS,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EACpC,UAAU,EACV,YAAY,CACb,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,GAAc,EACd,UAAkB,EAClB,SAA6B,EAC7B,UAAkB,EAClB,YAAmC;QAEnC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;QAErE,MAAM,OAAO,GAAuB;YAClC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YACxB,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC1B,GAAG;YACH,GAAG,EAAE,UAAU;YACf,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,EAAE,UAAU;YACf,GAAG;SACJ,CAAC;QAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE;YAC9C,SAAS,EAAE,OAAO;YAClB,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;YACnC,qEAAqE;YACrE,6DAA6D;SAC9D,CAAC,CAAC;QAEH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC;IACpD,CAAC;IAED;;;OAGG;IACK,aAAa,CACnB,UAAkB,EAClB,UAAkB,EAClB,YAAmC;QAEnC,MAAM,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;QAE1C,IAAI,CAAC,YAAY;YAAE,OAAO,SAAS,CAAC;QAEpC,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;QAClD,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC;QAE7C,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC;CACF,CAAA;AAtMY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;IAOR,mBAAA,IAAA,eAAM,EAAC,yBAAY,CAAC,CAAA;6CADC,gBAAc;GAL3B,gBAAgB,CAsM5B"}

package/dist/auth/optional-jwt-auth.guard.d.ts

@@ -0,0 +1,34 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { AuthTokenService } from './jwt.service';
+/**
+ * Attaches the caller when a token is supplied, and lets the request through when
+ * none is.
+ *
+ * For routes that legitimately serve both guests and signed-in customers — the
+ * wishlist, where a shopper builds a list before they have an account. Requiring a
+ * token there would break guest wishlists; ignoring tokens entirely would leave no
+ * way to tell the two apart.
+ *
+ * "Optional" means optional to *send*. A token that is present but unusable is still
+ * rejected, with the same error code {@link JwtAuthGuard} would give:
+ *
+ * - no token → treated as a guest, request proceeds with no `user`
+ * - valid token → caller attached to the request
+ * - expired or invalid token → 401, exactly as on a protected route
+ *
+ * Degrading a broken token to "guest" instead would hide two real problems: a client
+ * with an expired token would silently receive guest data rather than being told to
+ * refresh, and a genuine bug in token handling would look like ordinary guest
+ * traffic.
+ *
+ * Because a guest reaches the handler with no `user`, this must be paired with
+ * `assertOwnsClaimedCustomer` — otherwise a caller could simply name any customer
+ * and be served their data. The guard establishes *whether* there is a caller; that
+ * assertion enforces what an unproven claim is allowed to do.
+ */
+export declare class OptionalJwtAuthGuard implements CanActivate {
+    private readonly strict;
+    constructor(tokens: AuthTokenService);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}
+//# sourceMappingURL=optional-jwt-auth.guard.d.ts.map

package/dist/auth/optional-jwt-auth.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"optional-jwt-auth.guard.d.ts","sourceRoot":"","sources":["../../src/auth/optional-jwt-auth.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAc,MAAM,gBAAgB,CAAC;AAE3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGjD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBACa,oBAAqB,YAAW,WAAW;IACtD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;gBAE1B,MAAM,EAAE,gBAAgB;IAM9B,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAS/D"}

package/dist/auth/optional-jwt-auth.guard.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OptionalJwtAuthGuard = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const jwt_auth_guard_1 = require("./jwt-auth.guard");
+const jwt_service_1 = require("./jwt.service");
+const utils_1 = require("./utils");
+/**
+ * Attaches the caller when a token is supplied, and lets the request through when
+ * none is.
+ *
+ * For routes that legitimately serve both guests and signed-in customers — the
+ * wishlist, where a shopper builds a list before they have an account. Requiring a
+ * token there would break guest wishlists; ignoring tokens entirely would leave no
+ * way to tell the two apart.
+ *
+ * "Optional" means optional to *send*. A token that is present but unusable is still
+ * rejected, with the same error code {@link JwtAuthGuard} would give:
+ *
+ * - no token → treated as a guest, request proceeds with no `user`
+ * - valid token → caller attached to the request
+ * - expired or invalid token → 401, exactly as on a protected route
+ *
+ * Degrading a broken token to "guest" instead would hide two real problems: a client
+ * with an expired token would silently receive guest data rather than being told to
+ * refresh, and a genuine bug in token handling would look like ordinary guest
+ * traffic.
+ *
+ * Because a guest reaches the handler with no `user`, this must be paired with
+ * `assertOwnsClaimedCustomer` — otherwise a caller could simply name any customer
+ * and be served their data. The guard establishes *whether* there is a caller; that
+ * assertion enforces what an unproven claim is allowed to do.
+ */
+let OptionalJwtAuthGuard = class OptionalJwtAuthGuard {
+    strict;
+    constructor(tokens) {
+        // Delegate rather than duplicate, so the two guards cannot drift apart in how
+        // they verify a token or which error codes they return.
+        this.strict = new jwt_auth_guard_1.JwtAuthGuard(tokens);
+    }
+    async canActivate(context) {
+        const request = (0, utils_1.getRequest)(context);
+        if (!(0, utils_1.bearer)(request)) {
+            return true;
+        }
+        return this.strict.canActivate(context);
+    }
+};
+exports.OptionalJwtAuthGuard = OptionalJwtAuthGuard;
+exports.OptionalJwtAuthGuard = OptionalJwtAuthGuard = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [jwt_service_1.AuthTokenService])
+], OptionalJwtAuthGuard);
+//# sourceMappingURL=optional-jwt-auth.guard.js.map

package/dist/auth/optional-jwt-auth.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"optional-jwt-auth.guard.js","sourceRoot":"","sources":["../../src/auth/optional-jwt-auth.guard.ts"],"names":[],"mappings":";;;;AAAA,2CAA2E;AAC3E,qDAAgD;AAChD,+CAAiD;AACjD,mCAA6C;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IACd,MAAM,CAAe;IAEtC,YAAY,MAAwB;QAClC,8EAA8E;QAC9E,wDAAwD;QACxD,IAAI,CAAC,MAAM,GAAG,IAAI,6BAAY,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,IAAA,kBAAU,EAAC,OAAO,CAAC,CAAC;QAEpC,IAAI,CAAC,IAAA,cAAM,EAAC,OAAO,CAAC,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;CACF,CAAA;AAlBY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;6CAIS,8BAAgB;GAHzB,oBAAoB,CAkBhC"}

package/dist/auth/ownership.d.ts

@@ -0,0 +1,65 @@
+import { AuthUser } from './auth.types';
+/**
+ * Ownership assertions.
+ *
+ * `JwtAuthGuard` establishes *who* is calling. It cannot tell whether the
+ * records a request names belong to that caller — requests still carry
+ * `customerId`, `shopifyCustomerId` and `mobile` in their payloads, and a
+ * logged-in caller is free to put someone else's value there.
+ *
+ * These helpers close that gap: they compare a submitted value against the
+ * verified token and reject a mismatch. Call one at the top of every handler
+ * that accepts an identity value.
+ *
+ * A missing value is not a failure — many of these fields are optional, and
+ * "absent" means the handler has nothing to act on rather than an attempt to
+ * act on someone else. Validating that a required field is present stays the
+ * handler's own job.
+ */
+/**
+ * Assert that a submitted customer identifier is the caller's own.
+ *
+ * Accepts either form Shopify uses — `"7654321"` and
+ * `"gid://shopify/Customer/7654321"` refer to the same customer and both pass.
+ *
+ * @throws {ForbiddenException} when the value belongs to another customer.
+ */
+export declare function assertOwnsCustomer(user: AuthUser, submitted?: string | null): void;
+/**
+ * For routes reachable by both guests and signed-in customers: if the request names a
+ * customer, require proof that the caller is that customer.
+ *
+ * Pairs with {@link OptionalJwtAuthGuard}, which leaves `user` undefined for a guest.
+ * The rule this encodes:
+ *
+ * - names no customer → allowed; the handler falls back to the guest `sessionId`
+ * - names a customer, no verified caller → 401, because the claim is unproven
+ * - names a customer that is not the caller's → 403
+ *
+ * Without this, an unauthenticated caller on an optional-auth route could name any
+ * customer and be served their data — exactly the hole the guard alone leaves open.
+ *
+ * The two failure codes differ because the client's next move differs: 401 means
+ * "authenticate and try again", 403 means "this is not yours, stop".
+ *
+ * @throws {UnauthorizedException} a customer is named but the caller is not
+ *   authenticated.
+ * @throws {ForbiddenException} the named customer is somebody else.
+ */
+export declare function assertOwnsClaimedCustomer(user: AuthUser | undefined, submitted?: string | null): void;
+/**
+ * Assert that a submitted mobile number is the caller's own.
+ *
+ * Compares hashes, so the raw number never has to be held anywhere. Numbers are
+ * normalised first, so `"9876543210"`, `"+91 98765 43210"` and `"919876543210"`
+ * all match the same customer.
+ *
+ * A caller whose Shopify record has no phone number cannot pass this check —
+ * there is nothing to compare against, so any submitted number is rejected
+ * rather than waved through.
+ *
+ * @throws {ForbiddenException} when the number belongs to another customer, or
+ *   when the caller has no phone number on record.
+ */
+export declare function assertOwnsPhone(user: AuthUser, submitted?: string | null): void;
+//# sourceMappingURL=ownership.d.ts.map

package/dist/auth/ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../../src/auth/ownership.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGvD;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,QAAQ,EACd,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB,IAAI,CAaN;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,QAAQ,GAAG,SAAS,EAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB,IAAI,CAaN;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAwB/E"}

package/dist/auth/ownership.js

@@ -0,0 +1,117 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertOwnsCustomer = assertOwnsCustomer;
+exports.assertOwnsClaimedCustomer = assertOwnsClaimedCustomer;
+exports.assertOwnsPhone = assertOwnsPhone;
+const common_1 = require("@nestjs/common");
+const logger_1 = require("../common/logger");
+const auth_types_1 = require("./auth.types");
+const utils_1 = require("./utils");
+/**
+ * Ownership assertions.
+ *
+ * `JwtAuthGuard` establishes *who* is calling. It cannot tell whether the
+ * records a request names belong to that caller — requests still carry
+ * `customerId`, `shopifyCustomerId` and `mobile` in their payloads, and a
+ * logged-in caller is free to put someone else's value there.
+ *
+ * These helpers close that gap: they compare a submitted value against the
+ * verified token and reject a mismatch. Call one at the top of every handler
+ * that accepts an identity value.
+ *
+ * A missing value is not a failure — many of these fields are optional, and
+ * "absent" means the handler has nothing to act on rather than an attempt to
+ * act on someone else. Validating that a required field is present stays the
+ * handler's own job.
+ */
+/**
+ * Assert that a submitted customer identifier is the caller's own.
+ *
+ * Accepts either form Shopify uses — `"7654321"` and
+ * `"gid://shopify/Customer/7654321"` refer to the same customer and both pass.
+ *
+ * @throws {ForbiddenException} when the value belongs to another customer.
+ */
+function assertOwnsCustomer(user, submitted) {
+    if (submitted == null || submitted === '')
+        return;
+    if ((0, utils_1.normalizeGid)(submitted) !== (0, utils_1.normalizeGid)(user.customerId)) {
+        logger_1.logger.warn('Ownership check failed on customer id', {
+            callerCustomerId: user.customerId,
+        });
+        throw new common_1.ForbiddenException({
+            code: auth_types_1.AuthErrorCode.FORBIDDEN,
+            message: 'Not permitted',
+        });
+    }
+}
+/**
+ * For routes reachable by both guests and signed-in customers: if the request names a
+ * customer, require proof that the caller is that customer.
+ *
+ * Pairs with {@link OptionalJwtAuthGuard}, which leaves `user` undefined for a guest.
+ * The rule this encodes:
+ *
+ * - names no customer → allowed; the handler falls back to the guest `sessionId`
+ * - names a customer, no verified caller → 401, because the claim is unproven
+ * - names a customer that is not the caller's → 403
+ *
+ * Without this, an unauthenticated caller on an optional-auth route could name any
+ * customer and be served their data — exactly the hole the guard alone leaves open.
+ *
+ * The two failure codes differ because the client's next move differs: 401 means
+ * "authenticate and try again", 403 means "this is not yours, stop".
+ *
+ * @throws {UnauthorizedException} a customer is named but the caller is not
+ *   authenticated.
+ * @throws {ForbiddenException} the named customer is somebody else.
+ */
+function assertOwnsClaimedCustomer(user, submitted) {
+    if (submitted == null || submitted === '')
+        return;
+    if (!user) {
+        logger_1.logger.warn('Unauthenticated request named a customer id');
+        throw new common_1.UnauthorizedException({
+            code: auth_types_1.AuthErrorCode.TOKEN_MISSING,
+            message: 'Authentication required to act on a customer account',
+        });
+    }
+    assertOwnsCustomer(user, submitted);
+}
+/**
+ * Assert that a submitted mobile number is the caller's own.
+ *
+ * Compares hashes, so the raw number never has to be held anywhere. Numbers are
+ * normalised first, so `"9876543210"`, `"+91 98765 43210"` and `"919876543210"`
+ * all match the same customer.
+ *
+ * A caller whose Shopify record has no phone number cannot pass this check —
+ * there is nothing to compare against, so any submitted number is rejected
+ * rather than waved through.
+ *
+ * @throws {ForbiddenException} when the number belongs to another customer, or
+ *   when the caller has no phone number on record.
+ */
+function assertOwnsPhone(user, submitted) {
+    if (submitted == null || submitted === '')
+        return;
+    if (!user.phoneHash) {
+        logger_1.logger.warn('Ownership check failed: caller has no phone on record', {
+            callerCustomerId: user.customerId,
+        });
+        throw new common_1.ForbiddenException({
+            code: auth_types_1.AuthErrorCode.FORBIDDEN,
+            message: 'Not permitted',
+        });
+    }
+    if ((0, utils_1.hashPhone)(submitted) !== user.phoneHash) {
+        logger_1.logger.warn('Ownership check failed on mobile number', {
+            callerCustomerId: user.customerId,
+        });
+        throw new common_1.ForbiddenException({
+            code: auth_types_1.AuthErrorCode.FORBIDDEN,
+            message: 'Not permitted',
+        });
+    }
+}
+//# sourceMappingURL=ownership.js.map

package/dist/auth/ownership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership.js","sourceRoot":"","sources":["../../src/auth/ownership.ts"],"names":[],"mappings":";;AA+BA,gDAgBC;AAuBD,8DAgBC;AAgBD,0CAwBC;AA9HD,2CAA2E;AAC3E,6CAA0C;AAC1C,6CAAuD;AACvD,mCAAkD;AAElD;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;;GAOG;AACH,SAAgB,kBAAkB,CAChC,IAAc,EACd,SAAyB;IAEzB,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO;IAElD,IAAI,IAAA,oBAAY,EAAC,SAAS,CAAC,KAAK,IAAA,oBAAY,EAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,eAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE;YACnD,gBAAgB,EAAE,IAAI,CAAC,UAAU;SAClC,CAAC,CAAC;QAEH,MAAM,IAAI,2BAAkB,CAAC;YAC3B,IAAI,EAAE,0BAAa,CAAC,SAAS;YAC7B,OAAO,EAAE,eAAe;SACzB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAgB,yBAAyB,CACvC,IAA0B,EAC1B,SAAyB;IAEzB,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO;IAElD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,eAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAE3D,MAAM,IAAI,8BAAqB,CAAC;YAC9B,IAAI,EAAE,0BAAa,CAAC,aAAa;YACjC,OAAO,EAAE,sDAAsD;SAChE,CAAC,CAAC;IACL,CAAC;IAED,kBAAkB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAgB,eAAe,CAAC,IAAc,EAAE,SAAyB;IACvE,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO;IAElD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,eAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE;YACnE,gBAAgB,EAAE,IAAI,CAAC,UAAU;SAClC,CAAC,CAAC;QAEH,MAAM,IAAI,2BAAkB,CAAC;YAC3B,IAAI,EAAE,0BAAa,CAAC,SAAS;YAC7B,OAAO,EAAE,eAAe;SACzB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAA,iBAAS,EAAC,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5C,eAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE;YACrD,gBAAgB,EAAE,IAAI,CAAC,UAAU;SAClC,CAAC,CAAC;QAEH,MAAM,IAAI,2BAAkB,CAAC;YAC3B,IAAI,EAAE,0BAAa,CAAC,SAAS;YAC7B,OAAO,EAAE,eAAe;SACzB,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/auth/utils.d.ts

@@ -0,0 +1,53 @@
+import { ExecutionContext } from '@nestjs/common';
+/**
+ * Shape of the request object the guard reads from and writes to.
+ */
+export interface AuthRequest {
+    headers: Record<string, string | string[] | undefined>;
+    user?: unknown;
+    [key: string]: unknown;
+}
+/**
+ * Get the underlying request, whether the handler is a REST controller or a
+ * GraphQL resolver.
+ *
+ * This has to branch. In a GraphQL execution context the request is not where
+ * `switchToHttp()` looks, and in an HTTP context `GqlExecutionContext.create()`
+ * does not produce a usable one. Calling either unconditionally works for one
+ * transport and silently misbehaves on the other.
+ */
+export declare function getRequest(context: ExecutionContext): AuthRequest;
+/**
+ * Extract a Bearer token from the `Authorization` header.
+ *
+ * Returns undefined when the header is absent or is not a Bearer credential —
+ * the caller decides whether that is an error.
+ */
+export declare function bearer(request: AuthRequest): string | undefined;
+/**
+ * Reduce a Shopify customer identifier to its numeric part so the two forms
+ * compare equal.
+ *
+ * Callers send either `"7654321"` or `"gid://shopify/Customer/7654321"`, and
+ * both refer to the same customer. Comparing the raw strings would reject a
+ * legitimate request.
+ */
+export declare function normalizeGid(value: string): string;
+/**
+ * Normalise an Indian mobile number to `91XXXXXXXXXX`.
+ *
+ * Mirrors the logic in the Shopify webhook handler so a number hashed at login
+ * matches the same number submitted in a request, whichever way it was typed:
+ * `"9876543210"`, `"+91 98765 43210"` and `"919876543210"` all converge.
+ */
+export declare function normalizePhone(phone: string): string;
+/**
+ * SHA-256 as lowercase hex.
+ */
+export declare function sha256(value: string): string;
+/**
+ * Hash a mobile number for storage in a token: normalise first, then hash, so
+ * the same number always produces the same digest.
+ */
+export declare function hashPhone(phone: string): string;
+//# sourceMappingURL=utils.d.ts.map

package/dist/auth/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/auth/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAIlD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,gBAAgB,GAAG,WAAW,CAKjE;AAED;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAY/D;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIlD;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAYpD;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C"}

package/dist/auth/utils.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getRequest = getRequest;
+exports.bearer = bearer;
+exports.normalizeGid = normalizeGid;
+exports.normalizePhone = normalizePhone;
+exports.sha256 = sha256;
+exports.hashPhone = hashPhone;
+const graphql_1 = require("@nestjs/graphql");
+const crypto_1 = require("crypto");
+/**
+ * Get the underlying request, whether the handler is a REST controller or a
+ * GraphQL resolver.
+ *
+ * This has to branch. In a GraphQL execution context the request is not where
+ * `switchToHttp()` looks, and in an HTTP context `GqlExecutionContext.create()`
+ * does not produce a usable one. Calling either unconditionally works for one
+ * transport and silently misbehaves on the other.
+ */
+function getRequest(context) {
+    if (context.getType() === 'graphql') {
+        return graphql_1.GqlExecutionContext.create(context).getContext().req;
+    }
+    return context.switchToHttp().getRequest();
+}
+/**
+ * Extract a Bearer token from the `Authorization` header.
+ *
+ * Returns undefined when the header is absent or is not a Bearer credential —
+ * the caller decides whether that is an error.
+ */
+function bearer(request) {
+    const raw = request.headers?.authorization ?? request.headers?.Authorization;
+    const header = Array.isArray(raw) ? raw[0] : raw;
+    if (!header)
+        return undefined;
+    const [scheme, token] = header.split(' ');
+    if (!scheme || scheme.toLowerCase() !== 'bearer' || !token) {
+        return undefined;
+    }
+    return token.trim() || undefined;
+}
+/**
+ * Reduce a Shopify customer identifier to its numeric part so the two forms
+ * compare equal.
+ *
+ * Callers send either `"7654321"` or `"gid://shopify/Customer/7654321"`, and
+ * both refer to the same customer. Comparing the raw strings would reject a
+ * legitimate request.
+ */
+function normalizeGid(value) {
+    return String(value)
+        .trim()
+        .replace(/^gid:\/\/shopify\/Customer\//, '');
+}
+/**
+ * Normalise an Indian mobile number to `91XXXXXXXXXX`.
+ *
+ * Mirrors the logic in the Shopify webhook handler so a number hashed at login
+ * matches the same number submitted in a request, whichever way it was typed:
+ * `"9876543210"`, `"+91 98765 43210"` and `"919876543210"` all converge.
+ */
+function normalizePhone(phone) {
+    const digits = String(phone).replace(/\D/g, '');
+    if (digits.startsWith('91') && digits.length === 12) {
+        return digits;
+    }
+    if (digits.length === 10) {
+        return `91${digits}`;
+    }
+    return digits;
+}
+/**
+ * SHA-256 as lowercase hex.
+ */
+function sha256(value) {
+    return (0, crypto_1.createHash)('sha256').update(value, 'utf8').digest('hex');
+}
+/**
+ * Hash a mobile number for storage in a token: normalise first, then hash, so
+ * the same number always produces the same digest.
+ */
+function hashPhone(phone) {
+    return sha256(normalizePhone(phone));
+}
+//# sourceMappingURL=utils.js.map

package/dist/auth/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/auth/utils.ts"],"names":[],"mappings":";;AAsBA,gCAKC;AAQD,wBAYC;AAUD,oCAIC;AASD,wCAYC;AAKD,wBAEC;AAMD,8BAEC;AAhGD,6CAAsD;AACtD,mCAAoC;AAWpC;;;;;;;;GAQG;AACH,SAAgB,UAAU,CAAC,OAAyB;IAClD,IAAI,OAAO,CAAC,OAAO,EAAa,KAAK,SAAS,EAAE,CAAC;QAC/C,OAAO,6BAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,CAAC,GAAkB,CAAC;IAC7E,CAAC;IACD,OAAO,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAe,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,SAAgB,MAAM,CAAC,OAAoB;IACzC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,aAAa,IAAI,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC;IAC7E,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAEjD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,YAAY,CAAC,KAAa;IACxC,OAAO,MAAM,CAAC,KAAK,CAAC;SACjB,IAAI,EAAE;SACN,OAAO,CAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,cAAc,CAAC,KAAa;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEhD,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACzB,OAAO,KAAK,MAAM,EAAE,CAAC;IACvB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAgB,MAAM,CAAC,KAAa;IAClC,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,SAAgB,SAAS,CAAC,KAAa;IACrC,OAAO,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;AACvC,CAAC"}

package/dist/integrations/commerce/commerce.types.d.ts

@@ -214,6 +214,9 @@ export interface CartAttributeInput {
     key: string;
     value: string;
 }
+export interface CartCreateInput {
+    attributes?: CartAttributeInput[];
+}
 export interface CommerceAppliedGiftCard {
     id: string;
     lastCharacters: string;
@@ -313,7 +316,7 @@ export interface ICommerceService {
     getCollectionByHandle(handle: string, productsFirst?: number): Promise<IntegrationResponse<CommerceCollection | null>>;
     getMenu(handle: string): Promise<IntegrationResponse<CommerceMenu | null>>;
     getPage(handle: string): Promise<IntegrationResponse<CommercePage | null>>;
-    createCart(): Promise<IntegrationResponse<CommerceCart>>;
+    createCart(input?: CartCreateInput): Promise<IntegrationResponse<CommerceCart>>;
     getCart(cartId: string): Promise<IntegrationResponse<CommerceCart | null>>;
     addToCart(cartId: string, lines: CartLineInput[]): Promise<IntegrationResponse<CommerceCart>>;
     updateCartLines(cartId: string, lines: CartLineUpdateInput[]): Promise<IntegrationResponse<CommerceCart>>;