@spree/next 0.10.1 → 0.10.2

package/dist/actions/gift-cards.js

@@ -1,12 +1,11 @@
 "use server";
-
-// src/auth-helpers.ts
-import { SpreeError } from "@spree/sdk";
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
 
 // src/config.ts
 import { createClient } from "@spree/sdk";
-var _client = null;
-var _config = null;
 function initSpreeNext(config) {
   _config = config;
   _client = createClient({
@@ -34,8 +33,21 @@ function getConfig() {
   }
   return _config;
 }
+var _client, _config;
+var init_config = __esm({
+  "src/config.ts"() {
+    "use strict";
+    _client = null;
+    _config = null;
+  }
+});
+
+// src/auth-helpers.ts
+init_config();
+import { SpreeError } from "@spree/sdk";
 
 // src/cookies.ts
+init_config();
 import { cookies } from "next/headers";
 var DEFAULT_ACCESS_TOKEN_COOKIE = "_spree_jwt";
 var CART_TOKEN_MAX_AGE = 60 * 60 * 24 * 30;
@@ -114,6 +126,7 @@ async function withAuthRefresh(fn) {
 }
 
 // src/actions/gift-cards.ts
+init_config();
 async function listGiftCards() {
   return withAuthRefresh(async (options) => {
     return getClient().customer.giftCards.list(void 0, options);

package/dist/actions/gift-cards.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth-helpers.ts","../../src/config.ts","../../src/cookies.ts","../../src/actions/gift-cards.ts"],"sourcesContent":["import { SpreeError } from '@spree/sdk';\nimport type { RequestOptions } from '@spree/sdk';\nimport { getClient } from './config';\nimport { getAccessToken, setAccessToken, clearAccessToken } from './cookies';\n\n/**\n * Get auth request options from the current JWT token.\n * Proactively refreshes the token if it expires within 1 hour.\n */\nexport async function getAuthOptions(): Promise<RequestOptions> {\n  const token = await getAccessToken();\n  if (!token) {\n    return {};\n  }\n\n  // Check if token is close to expiry by decoding JWT payload\n  try {\n    const payload = JSON.parse(atob(token.split('.')[1]));\n    const exp = payload.exp;\n    const now = Math.floor(Date.now() / 1000);\n\n    // Refresh if token expires in less than 1 hour\n    if (exp && exp - now < 3600) {\n      try {\n        const refreshed = await getClient().auth.refresh({ token });\n        await setAccessToken(refreshed.token);\n        return { token: refreshed.token };\n      } catch {\n        // Refresh failed — use existing token, it might still work\n      }\n    }\n  } catch {\n    // Can't decode JWT — use it as-is, the server will reject if invalid\n  }\n\n  return { token };\n}\n\n/**\n * Execute an authenticated request with automatic token refresh on 401.\n * @param fn - Function that takes RequestOptions and returns a promise\n * @returns The result of the function\n * @throws SpreeError if auth fails after refresh attempt\n */\nexport async function withAuthRefresh<T>(\n  fn: (options: RequestOptions) => Promise<T>\n): Promise<T> {\n  const options = await getAuthOptions();\n\n  if (!options.token) {\n    throw new Error('Not authenticated');\n  }\n\n  try {\n    return await fn(options);\n  } catch (error: unknown) {\n    // If 401, try refreshing the token once\n    if (error instanceof SpreeError && error.status === 401) {\n      try {\n        const refreshed = await getClient().auth.refresh({ token: options.token });\n        await setAccessToken(refreshed.token);\n        return await fn({ token: refreshed.token });\n      } catch {\n        // Refresh failed — clear token and rethrow\n        await clearAccessToken();\n        throw error;\n      }\n    }\n    throw error;\n  }\n}\n","import { createClient, type Client } from '@spree/sdk';\nimport type { SpreeNextConfig } from './types';\n\nlet _client: Client | null = null;\nlet _config: SpreeNextConfig | null = null;\n\n/**\n * Initialize the Spree Next.js integration.\n * Call this once in your app (e.g., in `lib/storefront.ts`).\n * If not called, the client will auto-initialize from SPREE_API_URL and SPREE_PUBLISHABLE_KEY env vars.\n */\nexport function initSpreeNext(config: SpreeNextConfig): void {\n  _config = config;\n  _client = createClient({\n    baseUrl: config.baseUrl,\n    publishableKey: config.publishableKey,\n  });\n}\n\n/**\n * Get the Client instance. Auto-initializes from env vars if needed.\n * @internal\n */\nexport function getClient(): Client {\n  if (!_client) {\n    const baseUrl = process.env.SPREE_API_URL;\n    const publishableKey = process.env.SPREE_PUBLISHABLE_KEY;\n    if (baseUrl && publishableKey) {\n      initSpreeNext({ baseUrl, publishableKey });\n    } else {\n      throw new Error(\n        '@spree/next is not configured. Either call initSpreeNext() or set SPREE_API_URL and SPREE_PUBLISHABLE_KEY environment variables.'\n      );\n    }\n  }\n  return _client!;\n}\n\n/**\n * Get the current config. Auto-initializes from env vars if needed.\n * @internal\n */\nexport function getConfig(): SpreeNextConfig {\n  if (!_config) {\n    getClient(); // triggers auto-init\n  }\n  return _config!;\n}\n\n/**\n * Reset the client (useful for testing).\n * @internal\n */\nexport function resetClient(): void {\n  _client = null;\n  _config = null;\n}\n","import { cookies } from 'next/headers';\nimport { getConfig } from './config';\n\nconst DEFAULT_CART_COOKIE = '_spree_cart_token';\nconst DEFAULT_ACCESS_TOKEN_COOKIE = '_spree_jwt';\nconst CART_TOKEN_MAX_AGE = 60 * 60 * 24 * 30; // 30 days\nconst ACCESS_TOKEN_MAX_AGE = 60 * 60 * 24 * 7; // 7 days\n\nfunction getCartCookieName(): string {\n  try {\n    return getConfig().cartCookieName ?? DEFAULT_CART_COOKIE;\n  } catch {\n    return DEFAULT_CART_COOKIE;\n  }\n}\n\nfunction getCartIdCookieName(): string {\n  return `${getCartCookieName()}_id`;\n}\n\nfunction getAccessTokenCookieName(): string {\n  try {\n    return getConfig().accessTokenCookieName ?? DEFAULT_ACCESS_TOKEN_COOKIE;\n  } catch {\n    return DEFAULT_ACCESS_TOKEN_COOKIE;\n  }\n}\n\n// --- Cart Token ---\n\nexport async function getCartToken(): Promise<string | undefined> {\n  const cookieStore = await cookies();\n  return cookieStore.get(getCartCookieName())?.value;\n}\n\nexport async function setCartToken(token: string): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getCartCookieName(), token, {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    path: '/',\n    maxAge: CART_TOKEN_MAX_AGE,\n  });\n}\n\nexport async function clearCartToken(): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getCartCookieName(), '', {\n    maxAge: -1,\n    path: '/',\n  });\n}\n\n// --- Cart ID (prefixed ID stored alongside token for REST API) ---\n\nexport async function getCartId(): Promise<string | undefined> {\n  const cookieStore = await cookies();\n  return cookieStore.get(getCartIdCookieName())?.value;\n}\n\nexport async function setCartId(id: string): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getCartIdCookieName(), id, {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    path: '/',\n    maxAge: CART_TOKEN_MAX_AGE,\n  });\n}\n\nexport async function clearCartId(): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getCartIdCookieName(), '', {\n    maxAge: -1,\n    path: '/',\n  });\n}\n\n// --- Access Token (JWT) ---\n\nexport async function getAccessToken(): Promise<string | undefined> {\n  const cookieStore = await cookies();\n  return cookieStore.get(getAccessTokenCookieName())?.value;\n}\n\nexport async function setAccessToken(token: string): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getAccessTokenCookieName(), token, {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    path: '/',\n    maxAge: ACCESS_TOKEN_MAX_AGE,\n  });\n}\n\nexport async function clearAccessToken(): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getAccessTokenCookieName(), '', {\n    maxAge: -1,\n    path: '/',\n  });\n}\n\n// --- Cart Options (combined cart + access tokens for cart/checkout/payment actions) ---\n\nexport async function getCartOptions(): Promise<{\n  spreeToken: string | undefined;\n  token: string | undefined;\n}> {\n  const spreeToken = await getCartToken();\n  const token = await getAccessToken();\n  return { spreeToken, token };\n}\n\n// --- Cart ID (required) ---\n\nexport async function requireCartId(): Promise<string> {\n  const cartId = await getCartId();\n  if (!cartId) throw new Error('No cart found');\n  return cartId;\n}\n","'use server';\n\nimport type { GiftCard } from '@spree/sdk';\nimport { withAuthRefresh } from '../auth-helpers';\nimport { getClient } from '../config';\n\n/**\n * List the authenticated customer's gift cards.\n */\nexport async function listGiftCards(): Promise<{ data: GiftCard[] }> {\n  return withAuthRefresh(async (options) => {\n    return getClient().customer.giftCards.list(undefined, options);\n  });\n}\n\n/**\n * Get a single gift card by ID.\n */\nexport async function getGiftCard(id: string): Promise<GiftCard> {\n  return withAuthRefresh(async (options) => {\n    return getClient().customer.giftCards.get(id, options);\n  });\n}\n"],"mappings":";;;AAAA,SAAS,kBAAkB;;;ACA3B,SAAS,oBAAiC;AAG1C,IAAI,UAAyB;AAC7B,IAAI,UAAkC;AAO/B,SAAS,cAAc,QAA+B;AAC3D,YAAU;AACV,YAAU,aAAa;AAAA,IACrB,SAAS,OAAO;AAAA,IAChB,gBAAgB,OAAO;AAAA,EACzB,CAAC;AACH;AAMO,SAAS,YAAoB;AAClC,MAAI,CAAC,SAAS;AACZ,UAAM,UAAU,QAAQ,IAAI;AAC5B,UAAM,iBAAiB,QAAQ,IAAI;AACnC,QAAI,WAAW,gBAAgB;AAC7B,oBAAc,EAAE,SAAS,eAAe,CAAC;AAAA,IAC3C,OAAO;AACL,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAMO,SAAS,YAA6B;AAC3C,MAAI,CAAC,SAAS;AACZ,cAAU;AAAA,EACZ;AACA,SAAO;AACT;;;AC/CA,SAAS,eAAe;AAIxB,IAAM,8BAA8B;AACpC,IAAM,qBAAqB,KAAK,KAAK,KAAK;AAC1C,IAAM,uBAAuB,KAAK,KAAK,KAAK;AAc5C,SAAS,2BAAmC;AAC1C,MAAI;AACF,WAAO,UAAU,EAAE,yBAAyB;AAAA,EAC9C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAwDA,eAAsB,iBAA8C;AAClE,QAAM,cAAc,MAAM,QAAQ;AAClC,SAAO,YAAY,IAAI,yBAAyB,CAAC,GAAG;AACtD;AAEA,eAAsB,eAAe,OAA8B;AACjE,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,IAAI,yBAAyB,GAAG,OAAO;AAAA,IACjD,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ;AAAA,EACV,CAAC;AACH;AAEA,eAAsB,mBAAkC;AACtD,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,IAAI,yBAAyB,GAAG,IAAI;AAAA,IAC9C,QAAQ;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AACH;;;AF/FA,eAAsB,iBAA0C;AAC9D,QAAM,QAAQ,MAAM,eAAe;AACnC,MAAI,CAAC,OAAO;AACV,WAAO,CAAC;AAAA,EACV;AAGA,MAAI;AACF,UAAM,UAAU,KAAK,MAAM,KAAK,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;AACpD,UAAM,MAAM,QAAQ;AACpB,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAGxC,QAAI,OAAO,MAAM,MAAM,MAAM;AAC3B,UAAI;AACF,cAAM,YAAY,MAAM,UAAU,EAAE,KAAK,QAAQ,EAAE,MAAM,CAAC;AAC1D,cAAM,eAAe,UAAU,KAAK;AACpC,eAAO,EAAE,OAAO,UAAU,MAAM;AAAA,MAClC,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,SAAO,EAAE,MAAM;AACjB;AAQA,eAAsB,gBACpB,IACY;AACZ,QAAM,UAAU,MAAM,eAAe;AAErC,MAAI,CAAC,QAAQ,OAAO;AAClB,UAAM,IAAI,MAAM,mBAAmB;AAAA,EACrC;AAEA,MAAI;AACF,WAAO,MAAM,GAAG,OAAO;AAAA,EACzB,SAAS,OAAgB;AAEvB,QAAI,iBAAiB,cAAc,MAAM,WAAW,KAAK;AACvD,UAAI;AACF,cAAM,YAAY,MAAM,UAAU,EAAE,KAAK,QAAQ,EAAE,OAAO,QAAQ,MAAM,CAAC;AACzE,cAAM,eAAe,UAAU,KAAK;AACpC,eAAO,MAAM,GAAG,EAAE,OAAO,UAAU,MAAM,CAAC;AAAA,MAC5C,QAAQ;AAEN,cAAM,iBAAiB;AACvB,cAAM;AAAA,MACR;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;;;AG7DA,eAAsB,gBAA+C;AACnE,SAAO,gBAAgB,OAAO,YAAY;AACxC,WAAO,UAAU,EAAE,SAAS,UAAU,KAAK,QAAW,OAAO;AAAA,EAC/D,CAAC;AACH;AAKA,eAAsB,YAAY,IAA+B;AAC/D,SAAO,gBAAgB,OAAO,YAAY;AACxC,WAAO,UAAU,EAAE,SAAS,UAAU,IAAI,IAAI,OAAO;AAAA,EACvD,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../../src/config.ts","../../src/auth-helpers.ts","../../src/cookies.ts","../../src/actions/gift-cards.ts"],"sourcesContent":["import { createClient, type Client } from '@spree/sdk';\nimport type { SpreeNextConfig } from './types';\n\nlet _client: Client | null = null;\nlet _config: SpreeNextConfig | null = null;\n\n/**\n * Initialize the Spree Next.js integration.\n * Call this once in your app (e.g., in `lib/storefront.ts`).\n * If not called, the client will auto-initialize from SPREE_API_URL and SPREE_PUBLISHABLE_KEY env vars.\n */\nexport function initSpreeNext(config: SpreeNextConfig): void {\n  _config = config;\n  _client = createClient({\n    baseUrl: config.baseUrl,\n    publishableKey: config.publishableKey,\n  });\n}\n\n/**\n * Get the Client instance. Auto-initializes from env vars if needed.\n * @internal\n */\nexport function getClient(): Client {\n  if (!_client) {\n    const baseUrl = process.env.SPREE_API_URL;\n    const publishableKey = process.env.SPREE_PUBLISHABLE_KEY;\n    if (baseUrl && publishableKey) {\n      initSpreeNext({ baseUrl, publishableKey });\n    } else {\n      throw new Error(\n        '@spree/next is not configured. Either call initSpreeNext() or set SPREE_API_URL and SPREE_PUBLISHABLE_KEY environment variables.'\n      );\n    }\n  }\n  return _client!;\n}\n\n/**\n * Get the current config. Auto-initializes from env vars if needed.\n * @internal\n */\nexport function getConfig(): SpreeNextConfig {\n  if (!_config) {\n    getClient(); // triggers auto-init\n  }\n  return _config!;\n}\n\n/**\n * Reset the client (useful for testing).\n * @internal\n */\nexport function resetClient(): void {\n  _client = null;\n  _config = null;\n}\n","import { SpreeError } from '@spree/sdk';\nimport type { RequestOptions } from '@spree/sdk';\nimport { getClient } from './config';\nimport { getAccessToken, setAccessToken, clearAccessToken } from './cookies';\n\n/**\n * Get auth request options from the current JWT token.\n * Proactively refreshes the token if it expires within 1 hour.\n */\nexport async function getAuthOptions(): Promise<RequestOptions> {\n  const token = await getAccessToken();\n  if (!token) {\n    return {};\n  }\n\n  // Check if token is close to expiry by decoding JWT payload\n  try {\n    const payload = JSON.parse(atob(token.split('.')[1]));\n    const exp = payload.exp;\n    const now = Math.floor(Date.now() / 1000);\n\n    // Refresh if token expires in less than 1 hour\n    if (exp && exp - now < 3600) {\n      try {\n        const refreshed = await getClient().auth.refresh({ token });\n        await setAccessToken(refreshed.token);\n        return { token: refreshed.token };\n      } catch {\n        // Refresh failed — use existing token, it might still work\n      }\n    }\n  } catch {\n    // Can't decode JWT — use it as-is, the server will reject if invalid\n  }\n\n  return { token };\n}\n\n/**\n * Execute an authenticated request with automatic token refresh on 401.\n * @param fn - Function that takes RequestOptions and returns a promise\n * @returns The result of the function\n * @throws SpreeError if auth fails after refresh attempt\n */\nexport async function withAuthRefresh<T>(\n  fn: (options: RequestOptions) => Promise<T>\n): Promise<T> {\n  const options = await getAuthOptions();\n\n  if (!options.token) {\n    throw new Error('Not authenticated');\n  }\n\n  try {\n    return await fn(options);\n  } catch (error: unknown) {\n    // If 401, try refreshing the token once\n    if (error instanceof SpreeError && error.status === 401) {\n      try {\n        const refreshed = await getClient().auth.refresh({ token: options.token });\n        await setAccessToken(refreshed.token);\n        return await fn({ token: refreshed.token });\n      } catch {\n        // Refresh failed — clear token and rethrow\n        await clearAccessToken();\n        throw error;\n      }\n    }\n    throw error;\n  }\n}\n","import { cookies } from 'next/headers';\nimport { getConfig } from './config';\n\nconst DEFAULT_CART_COOKIE = '_spree_cart_token';\nconst DEFAULT_ACCESS_TOKEN_COOKIE = '_spree_jwt';\nconst CART_TOKEN_MAX_AGE = 60 * 60 * 24 * 30; // 30 days\nconst ACCESS_TOKEN_MAX_AGE = 60 * 60 * 24 * 7; // 7 days\n\nfunction getCartCookieName(): string {\n  try {\n    return getConfig().cartCookieName ?? DEFAULT_CART_COOKIE;\n  } catch {\n    return DEFAULT_CART_COOKIE;\n  }\n}\n\nfunction getCartIdCookieName(): string {\n  return `${getCartCookieName()}_id`;\n}\n\nfunction getAccessTokenCookieName(): string {\n  try {\n    return getConfig().accessTokenCookieName ?? DEFAULT_ACCESS_TOKEN_COOKIE;\n  } catch {\n    return DEFAULT_ACCESS_TOKEN_COOKIE;\n  }\n}\n\n// --- Cart Cookies (token + ID always managed together) ---\n\nexport async function getCartToken(): Promise<string | undefined> {\n  const cookieStore = await cookies();\n  return cookieStore.get(getCartCookieName())?.value;\n}\n\nexport async function getCartId(): Promise<string | undefined> {\n  const cookieStore = await cookies();\n  return cookieStore.get(getCartIdCookieName())?.value;\n}\n\nexport async function setCartCookies(id: string, token?: string): Promise<void> {\n  const cookieStore = await cookies();\n  const opts = {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax' as const,\n    path: '/',\n    maxAge: CART_TOKEN_MAX_AGE,\n  };\n\n  cookieStore.set(getCartIdCookieName(), id, opts);\n  if (token) {\n    cookieStore.set(getCartCookieName(), token, opts);\n  }\n}\n\nexport async function clearCartCookies(): Promise<void> {\n  const cookieStore = await cookies();\n  const opts = { maxAge: -1, path: '/' };\n  cookieStore.set(getCartCookieName(), '', opts);\n  cookieStore.set(getCartIdCookieName(), '', opts);\n}\n\n// --- Access Token (JWT) ---\n\nexport async function getAccessToken(): Promise<string | undefined> {\n  const cookieStore = await cookies();\n  return cookieStore.get(getAccessTokenCookieName())?.value;\n}\n\nexport async function setAccessToken(token: string): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getAccessTokenCookieName(), token, {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    path: '/',\n    maxAge: ACCESS_TOKEN_MAX_AGE,\n  });\n}\n\nexport async function clearAccessToken(): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getAccessTokenCookieName(), '', {\n    maxAge: -1,\n    path: '/',\n  });\n}\n\n// --- Cart Options (combined cart + access tokens for cart/checkout/payment actions) ---\n\nexport async function getCartOptions(): Promise<{\n  spreeToken: string | undefined;\n  token: string | undefined;\n}> {\n  const spreeToken = await getCartToken();\n  const token = await getAccessToken();\n  return { spreeToken, token };\n}\n\n// --- Cart ID (required) ---\n\nexport async function requireCartId(): Promise<string> {\n  const cartId = await getCartId();\n  if (cartId) return cartId;\n\n  // Authenticated user without cart ID cookie — resolve via carts.list()\n  const token = await getAccessToken();\n  if (token) {\n    const { getClient } = await import('./config');\n    const response = await getClient().carts.list({ token });\n    if (response.data.length > 0) {\n      const cart = response.data[0];\n      await setCartCookies(cart.id, cart.token);\n      return cart.id;\n    }\n  }\n\n  throw new Error('No cart found');\n}\n","'use server';\n\nimport type { GiftCard } from '@spree/sdk';\nimport { withAuthRefresh } from '../auth-helpers';\nimport { getClient } from '../config';\n\n/**\n * List the authenticated customer's gift cards.\n */\nexport async function listGiftCards(): Promise<{ data: GiftCard[] }> {\n  return withAuthRefresh(async (options) => {\n    return getClient().customer.giftCards.list(undefined, options);\n  });\n}\n\n/**\n * Get a single gift card by ID.\n */\nexport async function getGiftCard(id: string): Promise<GiftCard> {\n  return withAuthRefresh(async (options) => {\n    return getClient().customer.giftCards.get(id, options);\n  });\n}\n"],"mappings":";;;;;;;AAAA,SAAS,oBAAiC;AAWnC,SAAS,cAAc,QAA+B;AAC3D,YAAU;AACV,YAAU,aAAa;AAAA,IACrB,SAAS,OAAO;AAAA,IAChB,gBAAgB,OAAO;AAAA,EACzB,CAAC;AACH;AAMO,SAAS,YAAoB;AAClC,MAAI,CAAC,SAAS;AACZ,UAAM,UAAU,QAAQ,IAAI;AAC5B,UAAM,iBAAiB,QAAQ,IAAI;AACnC,QAAI,WAAW,gBAAgB;AAC7B,oBAAc,EAAE,SAAS,eAAe,CAAC;AAAA,IAC3C,OAAO;AACL,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAMO,SAAS,YAA6B;AAC3C,MAAI,CAAC,SAAS;AACZ,cAAU;AAAA,EACZ;AACA,SAAO;AACT;AA/CA,IAGI,SACA;AAJJ;AAAA;AAAA;AAGA,IAAI,UAAyB;AAC7B,IAAI,UAAkC;AAAA;AAAA;;;ACFtC;AAFA,SAAS,kBAAkB;;;ACC3B;AADA,SAAS,eAAe;AAIxB,IAAM,8BAA8B;AACpC,IAAM,qBAAqB,KAAK,KAAK,KAAK;AAC1C,IAAM,uBAAuB,KAAK,KAAK,KAAK;AAc5C,SAAS,2BAAmC;AAC1C,MAAI;AACF,WAAO,UAAU,EAAE,yBAAyB;AAAA,EAC9C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAuCA,eAAsB,iBAA8C;AAClE,QAAM,cAAc,MAAM,QAAQ;AAClC,SAAO,YAAY,IAAI,yBAAyB,CAAC,GAAG;AACtD;AAEA,eAAsB,eAAe,OAA8B;AACjE,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,IAAI,yBAAyB,GAAG,OAAO;AAAA,IACjD,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ;AAAA,EACV,CAAC;AACH;AAEA,eAAsB,mBAAkC;AACtD,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,IAAI,yBAAyB,GAAG,IAAI;AAAA,IAC9C,QAAQ;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AACH;;;AD9EA,eAAsB,iBAA0C;AAC9D,QAAM,QAAQ,MAAM,eAAe;AACnC,MAAI,CAAC,OAAO;AACV,WAAO,CAAC;AAAA,EACV;AAGA,MAAI;AACF,UAAM,UAAU,KAAK,MAAM,KAAK,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;AACpD,UAAM,MAAM,QAAQ;AACpB,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAGxC,QAAI,OAAO,MAAM,MAAM,MAAM;AAC3B,UAAI;AACF,cAAM,YAAY,MAAM,UAAU,EAAE,KAAK,QAAQ,EAAE,MAAM,CAAC;AAC1D,cAAM,eAAe,UAAU,KAAK;AACpC,eAAO,EAAE,OAAO,UAAU,MAAM;AAAA,MAClC,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,SAAO,EAAE,MAAM;AACjB;AAQA,eAAsB,gBACpB,IACY;AACZ,QAAM,UAAU,MAAM,eAAe;AAErC,MAAI,CAAC,QAAQ,OAAO;AAClB,UAAM,IAAI,MAAM,mBAAmB;AAAA,EACrC;AAEA,MAAI;AACF,WAAO,MAAM,GAAG,OAAO;AAAA,EACzB,SAAS,OAAgB;AAEvB,QAAI,iBAAiB,cAAc,MAAM,WAAW,KAAK;AACvD,UAAI;AACF,cAAM,YAAY,MAAM,UAAU,EAAE,KAAK,QAAQ,EAAE,OAAO,QAAQ,MAAM,CAAC;AACzE,cAAM,eAAe,UAAU,KAAK;AACpC,eAAO,MAAM,GAAG,EAAE,OAAO,UAAU,MAAM,CAAC;AAAA,MAC5C,QAAQ;AAEN,cAAM,iBAAiB;AACvB,cAAM;AAAA,MACR;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;;;AElEA;AAKA,eAAsB,gBAA+C;AACnE,SAAO,gBAAgB,OAAO,YAAY;AACxC,WAAO,UAAU,EAAE,SAAS,UAAU,KAAK,QAAW,OAAO;AAAA,EAC/D,CAAC;AACH;AAKA,eAAsB,YAAY,IAA+B;AAC/D,SAAO,gBAAgB,OAAO,YAAY;AACxC,WAAO,UAAU,EAAE,SAAS,UAAU,IAAI,IAAI,OAAO;AAAA,EACvD,CAAC;AACH;","names":[]}

package/dist/actions/orders.js

@@ -1,12 +1,11 @@
 "use server";
-
-// src/auth-helpers.ts
-import { SpreeError } from "@spree/sdk";
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
 
 // src/config.ts
 import { createClient } from "@spree/sdk";
-var _client = null;
-var _config = null;
 function initSpreeNext(config) {
   _config = config;
   _client = createClient({
@@ -34,8 +33,21 @@ function getConfig() {
   }
   return _config;
 }
+var _client, _config;
+var init_config = __esm({
+  "src/config.ts"() {
+    "use strict";
+    _client = null;
+    _config = null;
+  }
+});
+
+// src/auth-helpers.ts
+init_config();
+import { SpreeError } from "@spree/sdk";
 
 // src/cookies.ts
+init_config();
 import { cookies } from "next/headers";
 var DEFAULT_CART_COOKIE = "_spree_cart_token";
 var DEFAULT_ACCESS_TOKEN_COOKIE = "_spree_jwt";
@@ -131,6 +143,7 @@ async function withAuthRefresh(fn) {
 }
 
 // src/actions/orders.ts
+init_config();
 async function listOrders(params) {
   return withAuthRefresh(async (options) => {
     return getClient().customer.orders.list(params, options);

package/dist/actions/orders.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth-helpers.ts","../../src/config.ts","../../src/cookies.ts","../../src/actions/orders.ts"],"sourcesContent":["import { SpreeError } from '@spree/sdk';\nimport type { RequestOptions } from '@spree/sdk';\nimport { getClient } from './config';\nimport { getAccessToken, setAccessToken, clearAccessToken } from './cookies';\n\n/**\n * Get auth request options from the current JWT token.\n * Proactively refreshes the token if it expires within 1 hour.\n */\nexport async function getAuthOptions(): Promise<RequestOptions> {\n  const token = await getAccessToken();\n  if (!token) {\n    return {};\n  }\n\n  // Check if token is close to expiry by decoding JWT payload\n  try {\n    const payload = JSON.parse(atob(token.split('.')[1]));\n    const exp = payload.exp;\n    const now = Math.floor(Date.now() / 1000);\n\n    // Refresh if token expires in less than 1 hour\n    if (exp && exp - now < 3600) {\n      try {\n        const refreshed = await getClient().auth.refresh({ token });\n        await setAccessToken(refreshed.token);\n        return { token: refreshed.token };\n      } catch {\n        // Refresh failed — use existing token, it might still work\n      }\n    }\n  } catch {\n    // Can't decode JWT — use it as-is, the server will reject if invalid\n  }\n\n  return { token };\n}\n\n/**\n * Execute an authenticated request with automatic token refresh on 401.\n * @param fn - Function that takes RequestOptions and returns a promise\n * @returns The result of the function\n * @throws SpreeError if auth fails after refresh attempt\n */\nexport async function withAuthRefresh<T>(\n  fn: (options: RequestOptions) => Promise<T>\n): Promise<T> {\n  const options = await getAuthOptions();\n\n  if (!options.token) {\n    throw new Error('Not authenticated');\n  }\n\n  try {\n    return await fn(options);\n  } catch (error: unknown) {\n    // If 401, try refreshing the token once\n    if (error instanceof SpreeError && error.status === 401) {\n      try {\n        const refreshed = await getClient().auth.refresh({ token: options.token });\n        await setAccessToken(refreshed.token);\n        return await fn({ token: refreshed.token });\n      } catch {\n        // Refresh failed — clear token and rethrow\n        await clearAccessToken();\n        throw error;\n      }\n    }\n    throw error;\n  }\n}\n","import { createClient, type Client } from '@spree/sdk';\nimport type { SpreeNextConfig } from './types';\n\nlet _client: Client | null = null;\nlet _config: SpreeNextConfig | null = null;\n\n/**\n * Initialize the Spree Next.js integration.\n * Call this once in your app (e.g., in `lib/storefront.ts`).\n * If not called, the client will auto-initialize from SPREE_API_URL and SPREE_PUBLISHABLE_KEY env vars.\n */\nexport function initSpreeNext(config: SpreeNextConfig): void {\n  _config = config;\n  _client = createClient({\n    baseUrl: config.baseUrl,\n    publishableKey: config.publishableKey,\n  });\n}\n\n/**\n * Get the Client instance. Auto-initializes from env vars if needed.\n * @internal\n */\nexport function getClient(): Client {\n  if (!_client) {\n    const baseUrl = process.env.SPREE_API_URL;\n    const publishableKey = process.env.SPREE_PUBLISHABLE_KEY;\n    if (baseUrl && publishableKey) {\n      initSpreeNext({ baseUrl, publishableKey });\n    } else {\n      throw new Error(\n        '@spree/next is not configured. Either call initSpreeNext() or set SPREE_API_URL and SPREE_PUBLISHABLE_KEY environment variables.'\n      );\n    }\n  }\n  return _client!;\n}\n\n/**\n * Get the current config. Auto-initializes from env vars if needed.\n * @internal\n */\nexport function getConfig(): SpreeNextConfig {\n  if (!_config) {\n    getClient(); // triggers auto-init\n  }\n  return _config!;\n}\n\n/**\n * Reset the client (useful for testing).\n * @internal\n */\nexport function resetClient(): void {\n  _client = null;\n  _config = null;\n}\n","import { cookies } from 'next/headers';\nimport { getConfig } from './config';\n\nconst DEFAULT_CART_COOKIE = '_spree_cart_token';\nconst DEFAULT_ACCESS_TOKEN_COOKIE = '_spree_jwt';\nconst CART_TOKEN_MAX_AGE = 60 * 60 * 24 * 30; // 30 days\nconst ACCESS_TOKEN_MAX_AGE = 60 * 60 * 24 * 7; // 7 days\n\nfunction getCartCookieName(): string {\n  try {\n    return getConfig().cartCookieName ?? DEFAULT_CART_COOKIE;\n  } catch {\n    return DEFAULT_CART_COOKIE;\n  }\n}\n\nfunction getCartIdCookieName(): string {\n  return `${getCartCookieName()}_id`;\n}\n\nfunction getAccessTokenCookieName(): string {\n  try {\n    return getConfig().accessTokenCookieName ?? DEFAULT_ACCESS_TOKEN_COOKIE;\n  } catch {\n    return DEFAULT_ACCESS_TOKEN_COOKIE;\n  }\n}\n\n// --- Cart Token ---\n\nexport async function getCartToken(): Promise<string | undefined> {\n  const cookieStore = await cookies();\n  return cookieStore.get(getCartCookieName())?.value;\n}\n\nexport async function setCartToken(token: string): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getCartCookieName(), token, {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    path: '/',\n    maxAge: CART_TOKEN_MAX_AGE,\n  });\n}\n\nexport async function clearCartToken(): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getCartCookieName(), '', {\n    maxAge: -1,\n    path: '/',\n  });\n}\n\n// --- Cart ID (prefixed ID stored alongside token for REST API) ---\n\nexport async function getCartId(): Promise<string | undefined> {\n  const cookieStore = await cookies();\n  return cookieStore.get(getCartIdCookieName())?.value;\n}\n\nexport async function setCartId(id: string): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getCartIdCookieName(), id, {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    path: '/',\n    maxAge: CART_TOKEN_MAX_AGE,\n  });\n}\n\nexport async function clearCartId(): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getCartIdCookieName(), '', {\n    maxAge: -1,\n    path: '/',\n  });\n}\n\n// --- Access Token (JWT) ---\n\nexport async function getAccessToken(): Promise<string | undefined> {\n  const cookieStore = await cookies();\n  return cookieStore.get(getAccessTokenCookieName())?.value;\n}\n\nexport async function setAccessToken(token: string): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getAccessTokenCookieName(), token, {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    path: '/',\n    maxAge: ACCESS_TOKEN_MAX_AGE,\n  });\n}\n\nexport async function clearAccessToken(): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getAccessTokenCookieName(), '', {\n    maxAge: -1,\n    path: '/',\n  });\n}\n\n// --- Cart Options (combined cart + access tokens for cart/checkout/payment actions) ---\n\nexport async function getCartOptions(): Promise<{\n  spreeToken: string | undefined;\n  token: string | undefined;\n}> {\n  const spreeToken = await getCartToken();\n  const token = await getAccessToken();\n  return { spreeToken, token };\n}\n\n// --- Cart ID (required) ---\n\nexport async function requireCartId(): Promise<string> {\n  const cartId = await getCartId();\n  if (!cartId) throw new Error('No cart found');\n  return cartId;\n}\n","'use server';\n\nimport type { Order, PaginatedResponse, OrderListParams } from '@spree/sdk';\nimport { withAuthRefresh } from '../auth-helpers';\nimport { getClient } from '../config';\nimport { getCartOptions } from '../cookies';\n\n/**\n * List the authenticated customer's orders.\n */\nexport async function listOrders(\n  params?: OrderListParams\n): Promise<PaginatedResponse<Order>> {\n  return withAuthRefresh(async (options) => {\n    return getClient().customer.orders.list(params, options);\n  });\n}\n\n/**\n * Get a single order by ID or number.\n * Works for both authenticated users (JWT) and guests (spreeToken).\n */\nexport async function getOrder(\n  idOrNumber: string,\n  params?: Record<string, unknown>\n): Promise<Order> {\n  const options = await getCartOptions();\n  return getClient().orders.get(idOrNumber, params, options);\n}\n"],"mappings":";;;AAAA,SAAS,kBAAkB;;;ACA3B,SAAS,oBAAiC;AAG1C,IAAI,UAAyB;AAC7B,IAAI,UAAkC;AAO/B,SAAS,cAAc,QAA+B;AAC3D,YAAU;AACV,YAAU,aAAa;AAAA,IACrB,SAAS,OAAO;AAAA,IAChB,gBAAgB,OAAO;AAAA,EACzB,CAAC;AACH;AAMO,SAAS,YAAoB;AAClC,MAAI,CAAC,SAAS;AACZ,UAAM,UAAU,QAAQ,IAAI;AAC5B,UAAM,iBAAiB,QAAQ,IAAI;AACnC,QAAI,WAAW,gBAAgB;AAC7B,oBAAc,EAAE,SAAS,eAAe,CAAC;AAAA,IAC3C,OAAO;AACL,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAMO,SAAS,YAA6B;AAC3C,MAAI,CAAC,SAAS;AACZ,cAAU;AAAA,EACZ;AACA,SAAO;AACT;;;AC/CA,SAAS,eAAe;AAGxB,IAAM,sBAAsB;AAC5B,IAAM,8BAA8B;AACpC,IAAM,qBAAqB,KAAK,KAAK,KAAK;AAC1C,IAAM,uBAAuB,KAAK,KAAK,KAAK;AAE5C,SAAS,oBAA4B;AACnC,MAAI;AACF,WAAO,UAAU,EAAE,kBAAkB;AAAA,EACvC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,SAAS,2BAAmC;AAC1C,MAAI;AACF,WAAO,UAAU,EAAE,yBAAyB;AAAA,EAC9C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,eAAsB,eAA4C;AAChE,QAAM,cAAc,MAAM,QAAQ;AAClC,SAAO,YAAY,IAAI,kBAAkB,CAAC,GAAG;AAC/C;AAiDA,eAAsB,iBAA8C;AAClE,QAAM,cAAc,MAAM,QAAQ;AAClC,SAAO,YAAY,IAAI,yBAAyB,CAAC,GAAG;AACtD;AAEA,eAAsB,eAAe,OAA8B;AACjE,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,IAAI,yBAAyB,GAAG,OAAO;AAAA,IACjD,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ;AAAA,EACV,CAAC;AACH;AAEA,eAAsB,mBAAkC;AACtD,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,IAAI,yBAAyB,GAAG,IAAI;AAAA,IAC9C,QAAQ;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AACH;AAIA,eAAsB,iBAGnB;AACD,QAAM,aAAa,MAAM,aAAa;AACtC,QAAM,QAAQ,MAAM,eAAe;AACnC,SAAO,EAAE,YAAY,MAAM;AAC7B;;;AF1GA,eAAsB,iBAA0C;AAC9D,QAAM,QAAQ,MAAM,eAAe;AACnC,MAAI,CAAC,OAAO;AACV,WAAO,CAAC;AAAA,EACV;AAGA,MAAI;AACF,UAAM,UAAU,KAAK,MAAM,KAAK,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;AACpD,UAAM,MAAM,QAAQ;AACpB,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAGxC,QAAI,OAAO,MAAM,MAAM,MAAM;AAC3B,UAAI;AACF,cAAM,YAAY,MAAM,UAAU,EAAE,KAAK,QAAQ,EAAE,MAAM,CAAC;AAC1D,cAAM,eAAe,UAAU,KAAK;AACpC,eAAO,EAAE,OAAO,UAAU,MAAM;AAAA,MAClC,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,SAAO,EAAE,MAAM;AACjB;AAQA,eAAsB,gBACpB,IACY;AACZ,QAAM,UAAU,MAAM,eAAe;AAErC,MAAI,CAAC,QAAQ,OAAO;AAClB,UAAM,IAAI,MAAM,mBAAmB;AAAA,EACrC;AAEA,MAAI;AACF,WAAO,MAAM,GAAG,OAAO;AAAA,EACzB,SAAS,OAAgB;AAEvB,QAAI,iBAAiB,cAAc,MAAM,WAAW,KAAK;AACvD,UAAI;AACF,cAAM,YAAY,MAAM,UAAU,EAAE,KAAK,QAAQ,EAAE,OAAO,QAAQ,MAAM,CAAC;AACzE,cAAM,eAAe,UAAU,KAAK;AACpC,eAAO,MAAM,GAAG,EAAE,OAAO,UAAU,MAAM,CAAC;AAAA,MAC5C,QAAQ;AAEN,cAAM,iBAAiB;AACvB,cAAM;AAAA,MACR;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;;;AG5DA,eAAsB,WACpB,QACmC;AACnC,SAAO,gBAAgB,OAAO,YAAY;AACxC,WAAO,UAAU,EAAE,SAAS,OAAO,KAAK,QAAQ,OAAO;AAAA,EACzD,CAAC;AACH;AAMA,eAAsB,SACpB,YACA,QACgB;AAChB,QAAM,UAAU,MAAM,eAAe;AACrC,SAAO,UAAU,EAAE,OAAO,IAAI,YAAY,QAAQ,OAAO;AAC3D;","names":[]}
+{"version":3,"sources":["../../src/config.ts","../../src/auth-helpers.ts","../../src/cookies.ts","../../src/actions/orders.ts"],"sourcesContent":["import { createClient, type Client } from '@spree/sdk';\nimport type { SpreeNextConfig } from './types';\n\nlet _client: Client | null = null;\nlet _config: SpreeNextConfig | null = null;\n\n/**\n * Initialize the Spree Next.js integration.\n * Call this once in your app (e.g., in `lib/storefront.ts`).\n * If not called, the client will auto-initialize from SPREE_API_URL and SPREE_PUBLISHABLE_KEY env vars.\n */\nexport function initSpreeNext(config: SpreeNextConfig): void {\n  _config = config;\n  _client = createClient({\n    baseUrl: config.baseUrl,\n    publishableKey: config.publishableKey,\n  });\n}\n\n/**\n * Get the Client instance. Auto-initializes from env vars if needed.\n * @internal\n */\nexport function getClient(): Client {\n  if (!_client) {\n    const baseUrl = process.env.SPREE_API_URL;\n    const publishableKey = process.env.SPREE_PUBLISHABLE_KEY;\n    if (baseUrl && publishableKey) {\n      initSpreeNext({ baseUrl, publishableKey });\n    } else {\n      throw new Error(\n        '@spree/next is not configured. Either call initSpreeNext() or set SPREE_API_URL and SPREE_PUBLISHABLE_KEY environment variables.'\n      );\n    }\n  }\n  return _client!;\n}\n\n/**\n * Get the current config. Auto-initializes from env vars if needed.\n * @internal\n */\nexport function getConfig(): SpreeNextConfig {\n  if (!_config) {\n    getClient(); // triggers auto-init\n  }\n  return _config!;\n}\n\n/**\n * Reset the client (useful for testing).\n * @internal\n */\nexport function resetClient(): void {\n  _client = null;\n  _config = null;\n}\n","import { SpreeError } from '@spree/sdk';\nimport type { RequestOptions } from '@spree/sdk';\nimport { getClient } from './config';\nimport { getAccessToken, setAccessToken, clearAccessToken } from './cookies';\n\n/**\n * Get auth request options from the current JWT token.\n * Proactively refreshes the token if it expires within 1 hour.\n */\nexport async function getAuthOptions(): Promise<RequestOptions> {\n  const token = await getAccessToken();\n  if (!token) {\n    return {};\n  }\n\n  // Check if token is close to expiry by decoding JWT payload\n  try {\n    const payload = JSON.parse(atob(token.split('.')[1]));\n    const exp = payload.exp;\n    const now = Math.floor(Date.now() / 1000);\n\n    // Refresh if token expires in less than 1 hour\n    if (exp && exp - now < 3600) {\n      try {\n        const refreshed = await getClient().auth.refresh({ token });\n        await setAccessToken(refreshed.token);\n        return { token: refreshed.token };\n      } catch {\n        // Refresh failed — use existing token, it might still work\n      }\n    }\n  } catch {\n    // Can't decode JWT — use it as-is, the server will reject if invalid\n  }\n\n  return { token };\n}\n\n/**\n * Execute an authenticated request with automatic token refresh on 401.\n * @param fn - Function that takes RequestOptions and returns a promise\n * @returns The result of the function\n * @throws SpreeError if auth fails after refresh attempt\n */\nexport async function withAuthRefresh<T>(\n  fn: (options: RequestOptions) => Promise<T>\n): Promise<T> {\n  const options = await getAuthOptions();\n\n  if (!options.token) {\n    throw new Error('Not authenticated');\n  }\n\n  try {\n    return await fn(options);\n  } catch (error: unknown) {\n    // If 401, try refreshing the token once\n    if (error instanceof SpreeError && error.status === 401) {\n      try {\n        const refreshed = await getClient().auth.refresh({ token: options.token });\n        await setAccessToken(refreshed.token);\n        return await fn({ token: refreshed.token });\n      } catch {\n        // Refresh failed — clear token and rethrow\n        await clearAccessToken();\n        throw error;\n      }\n    }\n    throw error;\n  }\n}\n","import { cookies } from 'next/headers';\nimport { getConfig } from './config';\n\nconst DEFAULT_CART_COOKIE = '_spree_cart_token';\nconst DEFAULT_ACCESS_TOKEN_COOKIE = '_spree_jwt';\nconst CART_TOKEN_MAX_AGE = 60 * 60 * 24 * 30; // 30 days\nconst ACCESS_TOKEN_MAX_AGE = 60 * 60 * 24 * 7; // 7 days\n\nfunction getCartCookieName(): string {\n  try {\n    return getConfig().cartCookieName ?? DEFAULT_CART_COOKIE;\n  } catch {\n    return DEFAULT_CART_COOKIE;\n  }\n}\n\nfunction getCartIdCookieName(): string {\n  return `${getCartCookieName()}_id`;\n}\n\nfunction getAccessTokenCookieName(): string {\n  try {\n    return getConfig().accessTokenCookieName ?? DEFAULT_ACCESS_TOKEN_COOKIE;\n  } catch {\n    return DEFAULT_ACCESS_TOKEN_COOKIE;\n  }\n}\n\n// --- Cart Cookies (token + ID always managed together) ---\n\nexport async function getCartToken(): Promise<string | undefined> {\n  const cookieStore = await cookies();\n  return cookieStore.get(getCartCookieName())?.value;\n}\n\nexport async function getCartId(): Promise<string | undefined> {\n  const cookieStore = await cookies();\n  return cookieStore.get(getCartIdCookieName())?.value;\n}\n\nexport async function setCartCookies(id: string, token?: string): Promise<void> {\n  const cookieStore = await cookies();\n  const opts = {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax' as const,\n    path: '/',\n    maxAge: CART_TOKEN_MAX_AGE,\n  };\n\n  cookieStore.set(getCartIdCookieName(), id, opts);\n  if (token) {\n    cookieStore.set(getCartCookieName(), token, opts);\n  }\n}\n\nexport async function clearCartCookies(): Promise<void> {\n  const cookieStore = await cookies();\n  const opts = { maxAge: -1, path: '/' };\n  cookieStore.set(getCartCookieName(), '', opts);\n  cookieStore.set(getCartIdCookieName(), '', opts);\n}\n\n// --- Access Token (JWT) ---\n\nexport async function getAccessToken(): Promise<string | undefined> {\n  const cookieStore = await cookies();\n  return cookieStore.get(getAccessTokenCookieName())?.value;\n}\n\nexport async function setAccessToken(token: string): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getAccessTokenCookieName(), token, {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    path: '/',\n    maxAge: ACCESS_TOKEN_MAX_AGE,\n  });\n}\n\nexport async function clearAccessToken(): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getAccessTokenCookieName(), '', {\n    maxAge: -1,\n    path: '/',\n  });\n}\n\n// --- Cart Options (combined cart + access tokens for cart/checkout/payment actions) ---\n\nexport async function getCartOptions(): Promise<{\n  spreeToken: string | undefined;\n  token: string | undefined;\n}> {\n  const spreeToken = await getCartToken();\n  const token = await getAccessToken();\n  return { spreeToken, token };\n}\n\n// --- Cart ID (required) ---\n\nexport async function requireCartId(): Promise<string> {\n  const cartId = await getCartId();\n  if (cartId) return cartId;\n\n  // Authenticated user without cart ID cookie — resolve via carts.list()\n  const token = await getAccessToken();\n  if (token) {\n    const { getClient } = await import('./config');\n    const response = await getClient().carts.list({ token });\n    if (response.data.length > 0) {\n      const cart = response.data[0];\n      await setCartCookies(cart.id, cart.token);\n      return cart.id;\n    }\n  }\n\n  throw new Error('No cart found');\n}\n","'use server';\n\nimport type { Order, PaginatedResponse, OrderListParams } from '@spree/sdk';\nimport { withAuthRefresh } from '../auth-helpers';\nimport { getClient } from '../config';\nimport { getCartOptions } from '../cookies';\n\n/**\n * List the authenticated customer's orders.\n */\nexport async function listOrders(\n  params?: OrderListParams\n): Promise<PaginatedResponse<Order>> {\n  return withAuthRefresh(async (options) => {\n    return getClient().customer.orders.list(params, options);\n  });\n}\n\n/**\n * Get a single order by ID or number.\n * Works for both authenticated users (JWT) and guests (spreeToken).\n */\nexport async function getOrder(\n  idOrNumber: string,\n  params?: Record<string, unknown>\n): Promise<Order> {\n  const options = await getCartOptions();\n  return getClient().orders.get(idOrNumber, params, options);\n}\n"],"mappings":";;;;;;;AAAA,SAAS,oBAAiC;AAWnC,SAAS,cAAc,QAA+B;AAC3D,YAAU;AACV,YAAU,aAAa;AAAA,IACrB,SAAS,OAAO;AAAA,IAChB,gBAAgB,OAAO;AAAA,EACzB,CAAC;AACH;AAMO,SAAS,YAAoB;AAClC,MAAI,CAAC,SAAS;AACZ,UAAM,UAAU,QAAQ,IAAI;AAC5B,UAAM,iBAAiB,QAAQ,IAAI;AACnC,QAAI,WAAW,gBAAgB;AAC7B,oBAAc,EAAE,SAAS,eAAe,CAAC;AAAA,IAC3C,OAAO;AACL,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAMO,SAAS,YAA6B;AAC3C,MAAI,CAAC,SAAS;AACZ,cAAU;AAAA,EACZ;AACA,SAAO;AACT;AA/CA,IAGI,SACA;AAJJ;AAAA;AAAA;AAGA,IAAI,UAAyB;AAC7B,IAAI,UAAkC;AAAA;AAAA;;;ACFtC;AAFA,SAAS,kBAAkB;;;ACC3B;AADA,SAAS,eAAe;AAGxB,IAAM,sBAAsB;AAC5B,IAAM,8BAA8B;AACpC,IAAM,qBAAqB,KAAK,KAAK,KAAK;AAC1C,IAAM,uBAAuB,KAAK,KAAK,KAAK;AAE5C,SAAS,oBAA4B;AACnC,MAAI;AACF,WAAO,UAAU,EAAE,kBAAkB;AAAA,EACvC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,SAAS,2BAAmC;AAC1C,MAAI;AACF,WAAO,UAAU,EAAE,yBAAyB;AAAA,EAC9C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,eAAsB,eAA4C;AAChE,QAAM,cAAc,MAAM,QAAQ;AAClC,SAAO,YAAY,IAAI,kBAAkB,CAAC,GAAG;AAC/C;AAgCA,eAAsB,iBAA8C;AAClE,QAAM,cAAc,MAAM,QAAQ;AAClC,SAAO,YAAY,IAAI,yBAAyB,CAAC,GAAG;AACtD;AAEA,eAAsB,eAAe,OAA8B;AACjE,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,IAAI,yBAAyB,GAAG,OAAO;AAAA,IACjD,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ;AAAA,EACV,CAAC;AACH;AAEA,eAAsB,mBAAkC;AACtD,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,IAAI,yBAAyB,GAAG,IAAI;AAAA,IAC9C,QAAQ;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AACH;AAIA,eAAsB,iBAGnB;AACD,QAAM,aAAa,MAAM,aAAa;AACtC,QAAM,QAAQ,MAAM,eAAe;AACnC,SAAO,EAAE,YAAY,MAAM;AAC7B;;;ADzFA,eAAsB,iBAA0C;AAC9D,QAAM,QAAQ,MAAM,eAAe;AACnC,MAAI,CAAC,OAAO;AACV,WAAO,CAAC;AAAA,EACV;AAGA,MAAI;AACF,UAAM,UAAU,KAAK,MAAM,KAAK,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;AACpD,UAAM,MAAM,QAAQ;AACpB,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAGxC,QAAI,OAAO,MAAM,MAAM,MAAM;AAC3B,UAAI;AACF,cAAM,YAAY,MAAM,UAAU,EAAE,KAAK,QAAQ,EAAE,MAAM,CAAC;AAC1D,cAAM,eAAe,UAAU,KAAK;AACpC,eAAO,EAAE,OAAO,UAAU,MAAM;AAAA,MAClC,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,SAAO,EAAE,MAAM;AACjB;AAQA,eAAsB,gBACpB,IACY;AACZ,QAAM,UAAU,MAAM,eAAe;AAErC,MAAI,CAAC,QAAQ,OAAO;AAClB,UAAM,IAAI,MAAM,mBAAmB;AAAA,EACrC;AAEA,MAAI;AACF,WAAO,MAAM,GAAG,OAAO;AAAA,EACzB,SAAS,OAAgB;AAEvB,QAAI,iBAAiB,cAAc,MAAM,WAAW,KAAK;AACvD,UAAI;AACF,cAAM,YAAY,MAAM,UAAU,EAAE,KAAK,QAAQ,EAAE,OAAO,QAAQ,MAAM,CAAC;AACzE,cAAM,eAAe,UAAU,KAAK;AACpC,eAAO,MAAM,GAAG,EAAE,OAAO,UAAU,MAAM,CAAC;AAAA,MAC5C,QAAQ;AAEN,cAAM,iBAAiB;AACvB,cAAM;AAAA,MACR;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;;;AElEA;AAMA,eAAsB,WACpB,QACmC;AACnC,SAAO,gBAAgB,OAAO,YAAY;AACxC,WAAO,UAAU,EAAE,SAAS,OAAO,KAAK,QAAQ,OAAO;AAAA,EACzD,CAAC;AACH;AAMA,eAAsB,SACpB,YACA,QACgB;AAChB,QAAM,UAAU,MAAM,eAAe;AACrC,SAAO,UAAU,EAAE,OAAO,IAAI,YAAY,QAAQ,OAAO;AAC3D;","names":[]}

package/dist/actions/payment-sessions.js

@@ -1,12 +1,23 @@
 "use server";
-
-// src/actions/payment-sessions.ts
-import { revalidateTag } from "next/cache";
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 
 // src/config.ts
+var config_exports = {};
+__export(config_exports, {
+  getClient: () => getClient,
+  getConfig: () => getConfig,
+  initSpreeNext: () => initSpreeNext,
+  resetClient: () => resetClient
+});
 import { createClient } from "@spree/sdk";
-var _client = null;
-var _config = null;
 function initSpreeNext(config) {
   _config = config;
   _client = createClient({
@@ -34,8 +45,25 @@ function getConfig() {
   }
   return _config;
 }
+function resetClient() {
+  _client = null;
+  _config = null;
+}
+var _client, _config;
+var init_config = __esm({
+  "src/config.ts"() {
+    "use strict";
+    _client = null;
+    _config = null;
+  }
+});
+
+// src/actions/payment-sessions.ts
+init_config();
+import { revalidateTag } from "next/cache";
 
 // src/cookies.ts
+init_config();
 import { cookies } from "next/headers";
 var DEFAULT_CART_COOKIE = "_spree_cart_token";
 var DEFAULT_ACCESS_TOKEN_COOKIE = "_spree_jwt";
@@ -66,6 +94,20 @@ async function getCartId() {
   const cookieStore = await cookies();
   return cookieStore.get(getCartIdCookieName())?.value;
 }
+async function setCartCookies(id, token) {
+  const cookieStore = await cookies();
+  const opts = {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    path: "/",
+    maxAge: CART_TOKEN_MAX_AGE
+  };
+  cookieStore.set(getCartIdCookieName(), id, opts);
+  if (token) {
+    cookieStore.set(getCartCookieName(), token, opts);
+  }
+}
 async function getAccessToken() {
   const cookieStore = await cookies();
   return cookieStore.get(getAccessTokenCookieName())?.value;
@@ -77,8 +119,18 @@ async function getCartOptions() {
 }
 async function requireCartId() {
   const cartId = await getCartId();
-  if (!cartId) throw new Error("No cart found");
-  return cartId;
+  if (cartId) return cartId;
+  const token = await getAccessToken();
+  if (token) {
+    const { getClient: getClient2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+    const response = await getClient2().carts.list({ token });
+    if (response.data.length > 0) {
+      const cart = response.data[0];
+      await setCartCookies(cart.id, cart.token);
+      return cart.id;
+    }
+  }
+  throw new Error("No cart found");
 }
 
 // src/actions/payment-sessions.ts

package/dist/actions/payment-sessions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/actions/payment-sessions.ts","../../src/config.ts","../../src/cookies.ts"],"sourcesContent":["'use server';\n\nimport { revalidateTag } from 'next/cache';\nimport type {\n  PaymentSession,\n  CreatePaymentSessionParams,\n  UpdatePaymentSessionParams,\n  CompletePaymentSessionParams,\n} from '@spree/sdk';\nimport { getClient } from '../config';\nimport { getCartOptions, requireCartId } from '../cookies';\n\n/**\n * Create a payment session for the current cart.\n * Delegates to the payment gateway to initialize a provider-specific session.\n */\nexport async function createPaymentSession(\n  params: CreatePaymentSessionParams\n): Promise<PaymentSession> {\n  const options = await getCartOptions();\n  const cartId = await requireCartId();\n  const result = await getClient().carts.paymentSessions.create(cartId, params, options);\n  revalidateTag('checkout');\n  return result;\n}\n\n/**\n * Get a payment session by ID.\n */\nexport async function getPaymentSession(\n  sessionId: string\n): Promise<PaymentSession> {\n  const options = await getCartOptions();\n  const cartId = await requireCartId();\n  return getClient().carts.paymentSessions.get(cartId, sessionId, options);\n}\n\n/**\n * Update a payment session.\n * Delegates to the payment gateway to sync changes with the provider.\n */\nexport async function updatePaymentSession(\n  sessionId: string,\n  params: UpdatePaymentSessionParams\n): Promise<PaymentSession> {\n  const options = await getCartOptions();\n  const cartId = await requireCartId();\n  const result = await getClient().carts.paymentSessions.update(cartId, sessionId, params, options);\n  revalidateTag('checkout');\n  return result;\n}\n\n/**\n * Complete a payment session.\n * Confirms the payment with the provider, triggering capture/authorization.\n */\nexport async function completePaymentSession(\n  sessionId: string,\n  params?: CompletePaymentSessionParams\n): Promise<PaymentSession> {\n  const options = await getCartOptions();\n  const cartId = await requireCartId();\n  const result = await getClient().carts.paymentSessions.complete(cartId, sessionId, params, options);\n  revalidateTag('checkout');\n  return result;\n}\n","import { createClient, type Client } from '@spree/sdk';\nimport type { SpreeNextConfig } from './types';\n\nlet _client: Client | null = null;\nlet _config: SpreeNextConfig | null = null;\n\n/**\n * Initialize the Spree Next.js integration.\n * Call this once in your app (e.g., in `lib/storefront.ts`).\n * If not called, the client will auto-initialize from SPREE_API_URL and SPREE_PUBLISHABLE_KEY env vars.\n */\nexport function initSpreeNext(config: SpreeNextConfig): void {\n  _config = config;\n  _client = createClient({\n    baseUrl: config.baseUrl,\n    publishableKey: config.publishableKey,\n  });\n}\n\n/**\n * Get the Client instance. Auto-initializes from env vars if needed.\n * @internal\n */\nexport function getClient(): Client {\n  if (!_client) {\n    const baseUrl = process.env.SPREE_API_URL;\n    const publishableKey = process.env.SPREE_PUBLISHABLE_KEY;\n    if (baseUrl && publishableKey) {\n      initSpreeNext({ baseUrl, publishableKey });\n    } else {\n      throw new Error(\n        '@spree/next is not configured. Either call initSpreeNext() or set SPREE_API_URL and SPREE_PUBLISHABLE_KEY environment variables.'\n      );\n    }\n  }\n  return _client!;\n}\n\n/**\n * Get the current config. Auto-initializes from env vars if needed.\n * @internal\n */\nexport function getConfig(): SpreeNextConfig {\n  if (!_config) {\n    getClient(); // triggers auto-init\n  }\n  return _config!;\n}\n\n/**\n * Reset the client (useful for testing).\n * @internal\n */\nexport function resetClient(): void {\n  _client = null;\n  _config = null;\n}\n","import { cookies } from 'next/headers';\nimport { getConfig } from './config';\n\nconst DEFAULT_CART_COOKIE = '_spree_cart_token';\nconst DEFAULT_ACCESS_TOKEN_COOKIE = '_spree_jwt';\nconst CART_TOKEN_MAX_AGE = 60 * 60 * 24 * 30; // 30 days\nconst ACCESS_TOKEN_MAX_AGE = 60 * 60 * 24 * 7; // 7 days\n\nfunction getCartCookieName(): string {\n  try {\n    return getConfig().cartCookieName ?? DEFAULT_CART_COOKIE;\n  } catch {\n    return DEFAULT_CART_COOKIE;\n  }\n}\n\nfunction getCartIdCookieName(): string {\n  return `${getCartCookieName()}_id`;\n}\n\nfunction getAccessTokenCookieName(): string {\n  try {\n    return getConfig().accessTokenCookieName ?? DEFAULT_ACCESS_TOKEN_COOKIE;\n  } catch {\n    return DEFAULT_ACCESS_TOKEN_COOKIE;\n  }\n}\n\n// --- Cart Token ---\n\nexport async function getCartToken(): Promise<string | undefined> {\n  const cookieStore = await cookies();\n  return cookieStore.get(getCartCookieName())?.value;\n}\n\nexport async function setCartToken(token: string): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getCartCookieName(), token, {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    path: '/',\n    maxAge: CART_TOKEN_MAX_AGE,\n  });\n}\n\nexport async function clearCartToken(): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getCartCookieName(), '', {\n    maxAge: -1,\n    path: '/',\n  });\n}\n\n// --- Cart ID (prefixed ID stored alongside token for REST API) ---\n\nexport async function getCartId(): Promise<string | undefined> {\n  const cookieStore = await cookies();\n  return cookieStore.get(getCartIdCookieName())?.value;\n}\n\nexport async function setCartId(id: string): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getCartIdCookieName(), id, {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    path: '/',\n    maxAge: CART_TOKEN_MAX_AGE,\n  });\n}\n\nexport async function clearCartId(): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getCartIdCookieName(), '', {\n    maxAge: -1,\n    path: '/',\n  });\n}\n\n// --- Access Token (JWT) ---\n\nexport async function getAccessToken(): Promise<string | undefined> {\n  const cookieStore = await cookies();\n  return cookieStore.get(getAccessTokenCookieName())?.value;\n}\n\nexport async function setAccessToken(token: string): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getAccessTokenCookieName(), token, {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    path: '/',\n    maxAge: ACCESS_TOKEN_MAX_AGE,\n  });\n}\n\nexport async function clearAccessToken(): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getAccessTokenCookieName(), '', {\n    maxAge: -1,\n    path: '/',\n  });\n}\n\n// --- Cart Options (combined cart + access tokens for cart/checkout/payment actions) ---\n\nexport async function getCartOptions(): Promise<{\n  spreeToken: string | undefined;\n  token: string | undefined;\n}> {\n  const spreeToken = await getCartToken();\n  const token = await getAccessToken();\n  return { spreeToken, token };\n}\n\n// --- Cart ID (required) ---\n\nexport async function requireCartId(): Promise<string> {\n  const cartId = await getCartId();\n  if (!cartId) throw new Error('No cart found');\n  return cartId;\n}\n"],"mappings":";;;AAEA,SAAS,qBAAqB;;;ACF9B,SAAS,oBAAiC;AAG1C,IAAI,UAAyB;AAC7B,IAAI,UAAkC;AAO/B,SAAS,cAAc,QAA+B;AAC3D,YAAU;AACV,YAAU,aAAa;AAAA,IACrB,SAAS,OAAO;AAAA,IAChB,gBAAgB,OAAO;AAAA,EACzB,CAAC;AACH;AAMO,SAAS,YAAoB;AAClC,MAAI,CAAC,SAAS;AACZ,UAAM,UAAU,QAAQ,IAAI;AAC5B,UAAM,iBAAiB,QAAQ,IAAI;AACnC,QAAI,WAAW,gBAAgB;AAC7B,oBAAc,EAAE,SAAS,eAAe,CAAC;AAAA,IAC3C,OAAO;AACL,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAMO,SAAS,YAA6B;AAC3C,MAAI,CAAC,SAAS;AACZ,cAAU;AAAA,EACZ;AACA,SAAO;AACT;;;AC/CA,SAAS,eAAe;AAGxB,IAAM,sBAAsB;AAC5B,IAAM,8BAA8B;AACpC,IAAM,qBAAqB,KAAK,KAAK,KAAK;AAC1C,IAAM,uBAAuB,KAAK,KAAK,KAAK;AAE5C,SAAS,oBAA4B;AACnC,MAAI;AACF,WAAO,UAAU,EAAE,kBAAkB;AAAA,EACvC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,sBAA8B;AACrC,SAAO,GAAG,kBAAkB,CAAC;AAC/B;AAEA,SAAS,2BAAmC;AAC1C,MAAI;AACF,WAAO,UAAU,EAAE,yBAAyB;AAAA,EAC9C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,eAAsB,eAA4C;AAChE,QAAM,cAAc,MAAM,QAAQ;AAClC,SAAO,YAAY,IAAI,kBAAkB,CAAC,GAAG;AAC/C;AAuBA,eAAsB,YAAyC;AAC7D,QAAM,cAAc,MAAM,QAAQ;AAClC,SAAO,YAAY,IAAI,oBAAoB,CAAC,GAAG;AACjD;AAuBA,eAAsB,iBAA8C;AAClE,QAAM,cAAc,MAAM,QAAQ;AAClC,SAAO,YAAY,IAAI,yBAAyB,CAAC,GAAG;AACtD;AAuBA,eAAsB,iBAGnB;AACD,QAAM,aAAa,MAAM,aAAa;AACtC,QAAM,QAAQ,MAAM,eAAe;AACnC,SAAO,EAAE,YAAY,MAAM;AAC7B;AAIA,eAAsB,gBAAiC;AACrD,QAAM,SAAS,MAAM,UAAU;AAC/B,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,eAAe;AAC5C,SAAO;AACT;;;AF3GA,eAAsB,qBACpB,QACyB;AACzB,QAAM,UAAU,MAAM,eAAe;AACrC,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,SAAS,MAAM,UAAU,EAAE,MAAM,gBAAgB,OAAO,QAAQ,QAAQ,OAAO;AACrF,gBAAc,UAAU;AACxB,SAAO;AACT;AAKA,eAAsB,kBACpB,WACyB;AACzB,QAAM,UAAU,MAAM,eAAe;AACrC,QAAM,SAAS,MAAM,cAAc;AACnC,SAAO,UAAU,EAAE,MAAM,gBAAgB,IAAI,QAAQ,WAAW,OAAO;AACzE;AAMA,eAAsB,qBACpB,WACA,QACyB;AACzB,QAAM,UAAU,MAAM,eAAe;AACrC,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,SAAS,MAAM,UAAU,EAAE,MAAM,gBAAgB,OAAO,QAAQ,WAAW,QAAQ,OAAO;AAChG,gBAAc,UAAU;AACxB,SAAO;AACT;AAMA,eAAsB,uBACpB,WACA,QACyB;AACzB,QAAM,UAAU,MAAM,eAAe;AACrC,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,SAAS,MAAM,UAAU,EAAE,MAAM,gBAAgB,SAAS,QAAQ,WAAW,QAAQ,OAAO;AAClG,gBAAc,UAAU;AACxB,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/config.ts","../../src/actions/payment-sessions.ts","../../src/cookies.ts"],"sourcesContent":["import { createClient, type Client } from '@spree/sdk';\nimport type { SpreeNextConfig } from './types';\n\nlet _client: Client | null = null;\nlet _config: SpreeNextConfig | null = null;\n\n/**\n * Initialize the Spree Next.js integration.\n * Call this once in your app (e.g., in `lib/storefront.ts`).\n * If not called, the client will auto-initialize from SPREE_API_URL and SPREE_PUBLISHABLE_KEY env vars.\n */\nexport function initSpreeNext(config: SpreeNextConfig): void {\n  _config = config;\n  _client = createClient({\n    baseUrl: config.baseUrl,\n    publishableKey: config.publishableKey,\n  });\n}\n\n/**\n * Get the Client instance. Auto-initializes from env vars if needed.\n * @internal\n */\nexport function getClient(): Client {\n  if (!_client) {\n    const baseUrl = process.env.SPREE_API_URL;\n    const publishableKey = process.env.SPREE_PUBLISHABLE_KEY;\n    if (baseUrl && publishableKey) {\n      initSpreeNext({ baseUrl, publishableKey });\n    } else {\n      throw new Error(\n        '@spree/next is not configured. Either call initSpreeNext() or set SPREE_API_URL and SPREE_PUBLISHABLE_KEY environment variables.'\n      );\n    }\n  }\n  return _client!;\n}\n\n/**\n * Get the current config. Auto-initializes from env vars if needed.\n * @internal\n */\nexport function getConfig(): SpreeNextConfig {\n  if (!_config) {\n    getClient(); // triggers auto-init\n  }\n  return _config!;\n}\n\n/**\n * Reset the client (useful for testing).\n * @internal\n */\nexport function resetClient(): void {\n  _client = null;\n  _config = null;\n}\n","'use server';\n\nimport { revalidateTag } from 'next/cache';\nimport type {\n  PaymentSession,\n  CreatePaymentSessionParams,\n  UpdatePaymentSessionParams,\n  CompletePaymentSessionParams,\n} from '@spree/sdk';\nimport { getClient } from '../config';\nimport { getCartOptions, requireCartId } from '../cookies';\n\n/**\n * Create a payment session for the current cart.\n * Delegates to the payment gateway to initialize a provider-specific session.\n */\nexport async function createPaymentSession(\n  params: CreatePaymentSessionParams\n): Promise<PaymentSession> {\n  const options = await getCartOptions();\n  const cartId = await requireCartId();\n  const result = await getClient().carts.paymentSessions.create(cartId, params, options);\n  revalidateTag('checkout');\n  return result;\n}\n\n/**\n * Get a payment session by ID.\n */\nexport async function getPaymentSession(\n  sessionId: string\n): Promise<PaymentSession> {\n  const options = await getCartOptions();\n  const cartId = await requireCartId();\n  return getClient().carts.paymentSessions.get(cartId, sessionId, options);\n}\n\n/**\n * Update a payment session.\n * Delegates to the payment gateway to sync changes with the provider.\n */\nexport async function updatePaymentSession(\n  sessionId: string,\n  params: UpdatePaymentSessionParams\n): Promise<PaymentSession> {\n  const options = await getCartOptions();\n  const cartId = await requireCartId();\n  const result = await getClient().carts.paymentSessions.update(cartId, sessionId, params, options);\n  revalidateTag('checkout');\n  return result;\n}\n\n/**\n * Complete a payment session.\n * Confirms the payment with the provider, triggering capture/authorization.\n */\nexport async function completePaymentSession(\n  sessionId: string,\n  params?: CompletePaymentSessionParams\n): Promise<PaymentSession> {\n  const options = await getCartOptions();\n  const cartId = await requireCartId();\n  const result = await getClient().carts.paymentSessions.complete(cartId, sessionId, params, options);\n  revalidateTag('checkout');\n  return result;\n}\n","import { cookies } from 'next/headers';\nimport { getConfig } from './config';\n\nconst DEFAULT_CART_COOKIE = '_spree_cart_token';\nconst DEFAULT_ACCESS_TOKEN_COOKIE = '_spree_jwt';\nconst CART_TOKEN_MAX_AGE = 60 * 60 * 24 * 30; // 30 days\nconst ACCESS_TOKEN_MAX_AGE = 60 * 60 * 24 * 7; // 7 days\n\nfunction getCartCookieName(): string {\n  try {\n    return getConfig().cartCookieName ?? DEFAULT_CART_COOKIE;\n  } catch {\n    return DEFAULT_CART_COOKIE;\n  }\n}\n\nfunction getCartIdCookieName(): string {\n  return `${getCartCookieName()}_id`;\n}\n\nfunction getAccessTokenCookieName(): string {\n  try {\n    return getConfig().accessTokenCookieName ?? DEFAULT_ACCESS_TOKEN_COOKIE;\n  } catch {\n    return DEFAULT_ACCESS_TOKEN_COOKIE;\n  }\n}\n\n// --- Cart Cookies (token + ID always managed together) ---\n\nexport async function getCartToken(): Promise<string | undefined> {\n  const cookieStore = await cookies();\n  return cookieStore.get(getCartCookieName())?.value;\n}\n\nexport async function getCartId(): Promise<string | undefined> {\n  const cookieStore = await cookies();\n  return cookieStore.get(getCartIdCookieName())?.value;\n}\n\nexport async function setCartCookies(id: string, token?: string): Promise<void> {\n  const cookieStore = await cookies();\n  const opts = {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax' as const,\n    path: '/',\n    maxAge: CART_TOKEN_MAX_AGE,\n  };\n\n  cookieStore.set(getCartIdCookieName(), id, opts);\n  if (token) {\n    cookieStore.set(getCartCookieName(), token, opts);\n  }\n}\n\nexport async function clearCartCookies(): Promise<void> {\n  const cookieStore = await cookies();\n  const opts = { maxAge: -1, path: '/' };\n  cookieStore.set(getCartCookieName(), '', opts);\n  cookieStore.set(getCartIdCookieName(), '', opts);\n}\n\n// --- Access Token (JWT) ---\n\nexport async function getAccessToken(): Promise<string | undefined> {\n  const cookieStore = await cookies();\n  return cookieStore.get(getAccessTokenCookieName())?.value;\n}\n\nexport async function setAccessToken(token: string): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getAccessTokenCookieName(), token, {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    path: '/',\n    maxAge: ACCESS_TOKEN_MAX_AGE,\n  });\n}\n\nexport async function clearAccessToken(): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getAccessTokenCookieName(), '', {\n    maxAge: -1,\n    path: '/',\n  });\n}\n\n// --- Cart Options (combined cart + access tokens for cart/checkout/payment actions) ---\n\nexport async function getCartOptions(): Promise<{\n  spreeToken: string | undefined;\n  token: string | undefined;\n}> {\n  const spreeToken = await getCartToken();\n  const token = await getAccessToken();\n  return { spreeToken, token };\n}\n\n// --- Cart ID (required) ---\n\nexport async function requireCartId(): Promise<string> {\n  const cartId = await getCartId();\n  if (cartId) return cartId;\n\n  // Authenticated user without cart ID cookie — resolve via carts.list()\n  const token = await getAccessToken();\n  if (token) {\n    const { getClient } = await import('./config');\n    const response = await getClient().carts.list({ token });\n    if (response.data.length > 0) {\n      const cart = response.data[0];\n      await setCartCookies(cart.id, cart.token);\n      return cart.id;\n    }\n  }\n\n  throw new Error('No cart found');\n}\n"],"mappings":";;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAAS,oBAAiC;AAWnC,SAAS,cAAc,QAA+B;AAC3D,YAAU;AACV,YAAU,aAAa;AAAA,IACrB,SAAS,OAAO;AAAA,IAChB,gBAAgB,OAAO;AAAA,EACzB,CAAC;AACH;AAMO,SAAS,YAAoB;AAClC,MAAI,CAAC,SAAS;AACZ,UAAM,UAAU,QAAQ,IAAI;AAC5B,UAAM,iBAAiB,QAAQ,IAAI;AACnC,QAAI,WAAW,gBAAgB;AAC7B,oBAAc,EAAE,SAAS,eAAe,CAAC;AAAA,IAC3C,OAAO;AACL,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAMO,SAAS,YAA6B;AAC3C,MAAI,CAAC,SAAS;AACZ,cAAU;AAAA,EACZ;AACA,SAAO;AACT;AAMO,SAAS,cAAoB;AAClC,YAAU;AACV,YAAU;AACZ;AAxDA,IAGI,SACA;AAJJ;AAAA;AAAA;AAGA,IAAI,UAAyB;AAC7B,IAAI,UAAkC;AAAA;AAAA;;;ACKtC;AAPA,SAAS,qBAAqB;;;ACD9B;AADA,SAAS,eAAe;AAGxB,IAAM,sBAAsB;AAC5B,IAAM,8BAA8B;AACpC,IAAM,qBAAqB,KAAK,KAAK,KAAK;AAC1C,IAAM,uBAAuB,KAAK,KAAK,KAAK;AAE5C,SAAS,oBAA4B;AACnC,MAAI;AACF,WAAO,UAAU,EAAE,kBAAkB;AAAA,EACvC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,sBAA8B;AACrC,SAAO,GAAG,kBAAkB,CAAC;AAC/B;AAEA,SAAS,2BAAmC;AAC1C,MAAI;AACF,WAAO,UAAU,EAAE,yBAAyB;AAAA,EAC9C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,eAAsB,eAA4C;AAChE,QAAM,cAAc,MAAM,QAAQ;AAClC,SAAO,YAAY,IAAI,kBAAkB,CAAC,GAAG;AAC/C;AAEA,eAAsB,YAAyC;AAC7D,QAAM,cAAc,MAAM,QAAQ;AAClC,SAAO,YAAY,IAAI,oBAAoB,CAAC,GAAG;AACjD;AAEA,eAAsB,eAAe,IAAY,OAA+B;AAC9E,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,OAAO;AAAA,IACX,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ;AAAA,EACV;AAEA,cAAY,IAAI,oBAAoB,GAAG,IAAI,IAAI;AAC/C,MAAI,OAAO;AACT,gBAAY,IAAI,kBAAkB,GAAG,OAAO,IAAI;AAAA,EAClD;AACF;AAWA,eAAsB,iBAA8C;AAClE,QAAM,cAAc,MAAM,QAAQ;AAClC,SAAO,YAAY,IAAI,yBAAyB,CAAC,GAAG;AACtD;AAuBA,eAAsB,iBAGnB;AACD,QAAM,aAAa,MAAM,aAAa;AACtC,QAAM,QAAQ,MAAM,eAAe;AACnC,SAAO,EAAE,YAAY,MAAM;AAC7B;AAIA,eAAsB,gBAAiC;AACrD,QAAM,SAAS,MAAM,UAAU;AAC/B,MAAI,OAAQ,QAAO;AAGnB,QAAM,QAAQ,MAAM,eAAe;AACnC,MAAI,OAAO;AACT,UAAM,EAAE,WAAAA,WAAU,IAAI,MAAM;AAC5B,UAAM,WAAW,MAAMA,WAAU,EAAE,MAAM,KAAK,EAAE,MAAM,CAAC;AACvD,QAAI,SAAS,KAAK,SAAS,GAAG;AAC5B,YAAM,OAAO,SAAS,KAAK,CAAC;AAC5B,YAAM,eAAe,KAAK,IAAI,KAAK,KAAK;AACxC,aAAO,KAAK;AAAA,IACd;AAAA,EACF;AAEA,QAAM,IAAI,MAAM,eAAe;AACjC;;;ADvGA,eAAsB,qBACpB,QACyB;AACzB,QAAM,UAAU,MAAM,eAAe;AACrC,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,SAAS,MAAM,UAAU,EAAE,MAAM,gBAAgB,OAAO,QAAQ,QAAQ,OAAO;AACrF,gBAAc,UAAU;AACxB,SAAO;AACT;AAKA,eAAsB,kBACpB,WACyB;AACzB,QAAM,UAAU,MAAM,eAAe;AACrC,QAAM,SAAS,MAAM,cAAc;AACnC,SAAO,UAAU,EAAE,MAAM,gBAAgB,IAAI,QAAQ,WAAW,OAAO;AACzE;AAMA,eAAsB,qBACpB,WACA,QACyB;AACzB,QAAM,UAAU,MAAM,eAAe;AACrC,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,SAAS,MAAM,UAAU,EAAE,MAAM,gBAAgB,OAAO,QAAQ,WAAW,QAAQ,OAAO;AAChG,gBAAc,UAAU;AACxB,SAAO;AACT;AAMA,eAAsB,uBACpB,WACA,QACyB;AACzB,QAAM,UAAU,MAAM,eAAe;AACrC,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,SAAS,MAAM,UAAU,EAAE,MAAM,gBAAgB,SAAS,QAAQ,WAAW,QAAQ,OAAO;AAClG,gBAAc,UAAU;AACxB,SAAO;AACT;","names":["getClient"]}

package/dist/actions/payment-setup-sessions.js

@@ -1,12 +1,11 @@
 "use server";
-
-// src/auth-helpers.ts
-import { SpreeError } from "@spree/sdk";
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
 
 // src/config.ts
 import { createClient } from "@spree/sdk";
-var _client = null;
-var _config = null;
 function initSpreeNext(config) {
   _config = config;
   _client = createClient({
@@ -34,8 +33,21 @@ function getConfig() {
   }
   return _config;
 }
+var _client, _config;
+var init_config = __esm({
+  "src/config.ts"() {
+    "use strict";
+    _client = null;
+    _config = null;
+  }
+});
+
+// src/auth-helpers.ts
+init_config();
+import { SpreeError } from "@spree/sdk";
 
 // src/cookies.ts
+init_config();
 import { cookies } from "next/headers";
 var DEFAULT_ACCESS_TOKEN_COOKIE = "_spree_jwt";
 var CART_TOKEN_MAX_AGE = 60 * 60 * 24 * 30;
@@ -114,6 +126,7 @@ async function withAuthRefresh(fn) {
 }
 
 // src/actions/payment-setup-sessions.ts
+init_config();
 async function createPaymentSetupSession(params) {
   return withAuthRefresh(async (options) => {
     return getClient().customer.paymentSetupSessions.create(params, options);

package/dist/actions/payment-setup-sessions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth-helpers.ts","../../src/config.ts","../../src/cookies.ts","../../src/actions/payment-setup-sessions.ts"],"sourcesContent":["import { SpreeError } from '@spree/sdk';\nimport type { RequestOptions } from '@spree/sdk';\nimport { getClient } from './config';\nimport { getAccessToken, setAccessToken, clearAccessToken } from './cookies';\n\n/**\n * Get auth request options from the current JWT token.\n * Proactively refreshes the token if it expires within 1 hour.\n */\nexport async function getAuthOptions(): Promise<RequestOptions> {\n  const token = await getAccessToken();\n  if (!token) {\n    return {};\n  }\n\n  // Check if token is close to expiry by decoding JWT payload\n  try {\n    const payload = JSON.parse(atob(token.split('.')[1]));\n    const exp = payload.exp;\n    const now = Math.floor(Date.now() / 1000);\n\n    // Refresh if token expires in less than 1 hour\n    if (exp && exp - now < 3600) {\n      try {\n        const refreshed = await getClient().auth.refresh({ token });\n        await setAccessToken(refreshed.token);\n        return { token: refreshed.token };\n      } catch {\n        // Refresh failed — use existing token, it might still work\n      }\n    }\n  } catch {\n    // Can't decode JWT — use it as-is, the server will reject if invalid\n  }\n\n  return { token };\n}\n\n/**\n * Execute an authenticated request with automatic token refresh on 401.\n * @param fn - Function that takes RequestOptions and returns a promise\n * @returns The result of the function\n * @throws SpreeError if auth fails after refresh attempt\n */\nexport async function withAuthRefresh<T>(\n  fn: (options: RequestOptions) => Promise<T>\n): Promise<T> {\n  const options = await getAuthOptions();\n\n  if (!options.token) {\n    throw new Error('Not authenticated');\n  }\n\n  try {\n    return await fn(options);\n  } catch (error: unknown) {\n    // If 401, try refreshing the token once\n    if (error instanceof SpreeError && error.status === 401) {\n      try {\n        const refreshed = await getClient().auth.refresh({ token: options.token });\n        await setAccessToken(refreshed.token);\n        return await fn({ token: refreshed.token });\n      } catch {\n        // Refresh failed — clear token and rethrow\n        await clearAccessToken();\n        throw error;\n      }\n    }\n    throw error;\n  }\n}\n","import { createClient, type Client } from '@spree/sdk';\nimport type { SpreeNextConfig } from './types';\n\nlet _client: Client | null = null;\nlet _config: SpreeNextConfig | null = null;\n\n/**\n * Initialize the Spree Next.js integration.\n * Call this once in your app (e.g., in `lib/storefront.ts`).\n * If not called, the client will auto-initialize from SPREE_API_URL and SPREE_PUBLISHABLE_KEY env vars.\n */\nexport function initSpreeNext(config: SpreeNextConfig): void {\n  _config = config;\n  _client = createClient({\n    baseUrl: config.baseUrl,\n    publishableKey: config.publishableKey,\n  });\n}\n\n/**\n * Get the Client instance. Auto-initializes from env vars if needed.\n * @internal\n */\nexport function getClient(): Client {\n  if (!_client) {\n    const baseUrl = process.env.SPREE_API_URL;\n    const publishableKey = process.env.SPREE_PUBLISHABLE_KEY;\n    if (baseUrl && publishableKey) {\n      initSpreeNext({ baseUrl, publishableKey });\n    } else {\n      throw new Error(\n        '@spree/next is not configured. Either call initSpreeNext() or set SPREE_API_URL and SPREE_PUBLISHABLE_KEY environment variables.'\n      );\n    }\n  }\n  return _client!;\n}\n\n/**\n * Get the current config. Auto-initializes from env vars if needed.\n * @internal\n */\nexport function getConfig(): SpreeNextConfig {\n  if (!_config) {\n    getClient(); // triggers auto-init\n  }\n  return _config!;\n}\n\n/**\n * Reset the client (useful for testing).\n * @internal\n */\nexport function resetClient(): void {\n  _client = null;\n  _config = null;\n}\n","import { cookies } from 'next/headers';\nimport { getConfig } from './config';\n\nconst DEFAULT_CART_COOKIE = '_spree_cart_token';\nconst DEFAULT_ACCESS_TOKEN_COOKIE = '_spree_jwt';\nconst CART_TOKEN_MAX_AGE = 60 * 60 * 24 * 30; // 30 days\nconst ACCESS_TOKEN_MAX_AGE = 60 * 60 * 24 * 7; // 7 days\n\nfunction getCartCookieName(): string {\n  try {\n    return getConfig().cartCookieName ?? DEFAULT_CART_COOKIE;\n  } catch {\n    return DEFAULT_CART_COOKIE;\n  }\n}\n\nfunction getCartIdCookieName(): string {\n  return `${getCartCookieName()}_id`;\n}\n\nfunction getAccessTokenCookieName(): string {\n  try {\n    return getConfig().accessTokenCookieName ?? DEFAULT_ACCESS_TOKEN_COOKIE;\n  } catch {\n    return DEFAULT_ACCESS_TOKEN_COOKIE;\n  }\n}\n\n// --- Cart Token ---\n\nexport async function getCartToken(): Promise<string | undefined> {\n  const cookieStore = await cookies();\n  return cookieStore.get(getCartCookieName())?.value;\n}\n\nexport async function setCartToken(token: string): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getCartCookieName(), token, {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    path: '/',\n    maxAge: CART_TOKEN_MAX_AGE,\n  });\n}\n\nexport async function clearCartToken(): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getCartCookieName(), '', {\n    maxAge: -1,\n    path: '/',\n  });\n}\n\n// --- Cart ID (prefixed ID stored alongside token for REST API) ---\n\nexport async function getCartId(): Promise<string | undefined> {\n  const cookieStore = await cookies();\n  return cookieStore.get(getCartIdCookieName())?.value;\n}\n\nexport async function setCartId(id: string): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getCartIdCookieName(), id, {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    path: '/',\n    maxAge: CART_TOKEN_MAX_AGE,\n  });\n}\n\nexport async function clearCartId(): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getCartIdCookieName(), '', {\n    maxAge: -1,\n    path: '/',\n  });\n}\n\n// --- Access Token (JWT) ---\n\nexport async function getAccessToken(): Promise<string | undefined> {\n  const cookieStore = await cookies();\n  return cookieStore.get(getAccessTokenCookieName())?.value;\n}\n\nexport async function setAccessToken(token: string): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getAccessTokenCookieName(), token, {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    path: '/',\n    maxAge: ACCESS_TOKEN_MAX_AGE,\n  });\n}\n\nexport async function clearAccessToken(): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getAccessTokenCookieName(), '', {\n    maxAge: -1,\n    path: '/',\n  });\n}\n\n// --- Cart Options (combined cart + access tokens for cart/checkout/payment actions) ---\n\nexport async function getCartOptions(): Promise<{\n  spreeToken: string | undefined;\n  token: string | undefined;\n}> {\n  const spreeToken = await getCartToken();\n  const token = await getAccessToken();\n  return { spreeToken, token };\n}\n\n// --- Cart ID (required) ---\n\nexport async function requireCartId(): Promise<string> {\n  const cartId = await getCartId();\n  if (!cartId) throw new Error('No cart found');\n  return cartId;\n}\n","'use server';\n\nimport type {\n  PaymentSetupSession,\n  CreatePaymentSetupSessionParams,\n  CompletePaymentSetupSessionParams,\n} from '@spree/sdk';\nimport { withAuthRefresh } from '../auth-helpers';\nimport { getClient } from '../config';\n\n/**\n * Create a payment setup session for saving a payment method.\n * Delegates to the payment gateway to initialize a setup flow.\n */\nexport async function createPaymentSetupSession(\n  params: CreatePaymentSetupSessionParams\n): Promise<PaymentSetupSession> {\n  return withAuthRefresh(async (options) => {\n    return getClient().customer.paymentSetupSessions.create(params, options);\n  });\n}\n\n/**\n * Get a payment setup session by ID.\n */\nexport async function getPaymentSetupSession(\n  id: string\n): Promise<PaymentSetupSession> {\n  return withAuthRefresh(async (options) => {\n    return getClient().customer.paymentSetupSessions.get(id, options);\n  });\n}\n\n/**\n * Complete a payment setup session.\n * Confirms the setup with the provider, resulting in a saved payment method.\n */\nexport async function completePaymentSetupSession(\n  id: string,\n  params?: CompletePaymentSetupSessionParams\n): Promise<PaymentSetupSession> {\n  return withAuthRefresh(async (options) => {\n    return getClient().customer.paymentSetupSessions.complete(id, params, options);\n  });\n}\n"],"mappings":";;;AAAA,SAAS,kBAAkB;;;ACA3B,SAAS,oBAAiC;AAG1C,IAAI,UAAyB;AAC7B,IAAI,UAAkC;AAO/B,SAAS,cAAc,QAA+B;AAC3D,YAAU;AACV,YAAU,aAAa;AAAA,IACrB,SAAS,OAAO;AAAA,IAChB,gBAAgB,OAAO;AAAA,EACzB,CAAC;AACH;AAMO,SAAS,YAAoB;AAClC,MAAI,CAAC,SAAS;AACZ,UAAM,UAAU,QAAQ,IAAI;AAC5B,UAAM,iBAAiB,QAAQ,IAAI;AACnC,QAAI,WAAW,gBAAgB;AAC7B,oBAAc,EAAE,SAAS,eAAe,CAAC;AAAA,IAC3C,OAAO;AACL,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAMO,SAAS,YAA6B;AAC3C,MAAI,CAAC,SAAS;AACZ,cAAU;AAAA,EACZ;AACA,SAAO;AACT;;;AC/CA,SAAS,eAAe;AAIxB,IAAM,8BAA8B;AACpC,IAAM,qBAAqB,KAAK,KAAK,KAAK;AAC1C,IAAM,uBAAuB,KAAK,KAAK,KAAK;AAc5C,SAAS,2BAAmC;AAC1C,MAAI;AACF,WAAO,UAAU,EAAE,yBAAyB;AAAA,EAC9C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAwDA,eAAsB,iBAA8C;AAClE,QAAM,cAAc,MAAM,QAAQ;AAClC,SAAO,YAAY,IAAI,yBAAyB,CAAC,GAAG;AACtD;AAEA,eAAsB,eAAe,OAA8B;AACjE,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,IAAI,yBAAyB,GAAG,OAAO;AAAA,IACjD,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ;AAAA,EACV,CAAC;AACH;AAEA,eAAsB,mBAAkC;AACtD,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,IAAI,yBAAyB,GAAG,IAAI;AAAA,IAC9C,QAAQ;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AACH;;;AF/FA,eAAsB,iBAA0C;AAC9D,QAAM,QAAQ,MAAM,eAAe;AACnC,MAAI,CAAC,OAAO;AACV,WAAO,CAAC;AAAA,EACV;AAGA,MAAI;AACF,UAAM,UAAU,KAAK,MAAM,KAAK,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;AACpD,UAAM,MAAM,QAAQ;AACpB,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAGxC,QAAI,OAAO,MAAM,MAAM,MAAM;AAC3B,UAAI;AACF,cAAM,YAAY,MAAM,UAAU,EAAE,KAAK,QAAQ,EAAE,MAAM,CAAC;AAC1D,cAAM,eAAe,UAAU,KAAK;AACpC,eAAO,EAAE,OAAO,UAAU,MAAM;AAAA,MAClC,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,SAAO,EAAE,MAAM;AACjB;AAQA,eAAsB,gBACpB,IACY;AACZ,QAAM,UAAU,MAAM,eAAe;AAErC,MAAI,CAAC,QAAQ,OAAO;AAClB,UAAM,IAAI,MAAM,mBAAmB;AAAA,EACrC;AAEA,MAAI;AACF,WAAO,MAAM,GAAG,OAAO;AAAA,EACzB,SAAS,OAAgB;AAEvB,QAAI,iBAAiB,cAAc,MAAM,WAAW,KAAK;AACvD,UAAI;AACF,cAAM,YAAY,MAAM,UAAU,EAAE,KAAK,QAAQ,EAAE,OAAO,QAAQ,MAAM,CAAC;AACzE,cAAM,eAAe,UAAU,KAAK;AACpC,eAAO,MAAM,GAAG,EAAE,OAAO,UAAU,MAAM,CAAC;AAAA,MAC5C,QAAQ;AAEN,cAAM,iBAAiB;AACvB,cAAM;AAAA,MACR;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;;;AGxDA,eAAsB,0BACpB,QAC8B;AAC9B,SAAO,gBAAgB,OAAO,YAAY;AACxC,WAAO,UAAU,EAAE,SAAS,qBAAqB,OAAO,QAAQ,OAAO;AAAA,EACzE,CAAC;AACH;AAKA,eAAsB,uBACpB,IAC8B;AAC9B,SAAO,gBAAgB,OAAO,YAAY;AACxC,WAAO,UAAU,EAAE,SAAS,qBAAqB,IAAI,IAAI,OAAO;AAAA,EAClE,CAAC;AACH;AAMA,eAAsB,4BACpB,IACA,QAC8B;AAC9B,SAAO,gBAAgB,OAAO,YAAY;AACxC,WAAO,UAAU,EAAE,SAAS,qBAAqB,SAAS,IAAI,QAAQ,OAAO;AAAA,EAC/E,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../../src/config.ts","../../src/auth-helpers.ts","../../src/cookies.ts","../../src/actions/payment-setup-sessions.ts"],"sourcesContent":["import { createClient, type Client } from '@spree/sdk';\nimport type { SpreeNextConfig } from './types';\n\nlet _client: Client | null = null;\nlet _config: SpreeNextConfig | null = null;\n\n/**\n * Initialize the Spree Next.js integration.\n * Call this once in your app (e.g., in `lib/storefront.ts`).\n * If not called, the client will auto-initialize from SPREE_API_URL and SPREE_PUBLISHABLE_KEY env vars.\n */\nexport function initSpreeNext(config: SpreeNextConfig): void {\n  _config = config;\n  _client = createClient({\n    baseUrl: config.baseUrl,\n    publishableKey: config.publishableKey,\n  });\n}\n\n/**\n * Get the Client instance. Auto-initializes from env vars if needed.\n * @internal\n */\nexport function getClient(): Client {\n  if (!_client) {\n    const baseUrl = process.env.SPREE_API_URL;\n    const publishableKey = process.env.SPREE_PUBLISHABLE_KEY;\n    if (baseUrl && publishableKey) {\n      initSpreeNext({ baseUrl, publishableKey });\n    } else {\n      throw new Error(\n        '@spree/next is not configured. Either call initSpreeNext() or set SPREE_API_URL and SPREE_PUBLISHABLE_KEY environment variables.'\n      );\n    }\n  }\n  return _client!;\n}\n\n/**\n * Get the current config. Auto-initializes from env vars if needed.\n * @internal\n */\nexport function getConfig(): SpreeNextConfig {\n  if (!_config) {\n    getClient(); // triggers auto-init\n  }\n  return _config!;\n}\n\n/**\n * Reset the client (useful for testing).\n * @internal\n */\nexport function resetClient(): void {\n  _client = null;\n  _config = null;\n}\n","import { SpreeError } from '@spree/sdk';\nimport type { RequestOptions } from '@spree/sdk';\nimport { getClient } from './config';\nimport { getAccessToken, setAccessToken, clearAccessToken } from './cookies';\n\n/**\n * Get auth request options from the current JWT token.\n * Proactively refreshes the token if it expires within 1 hour.\n */\nexport async function getAuthOptions(): Promise<RequestOptions> {\n  const token = await getAccessToken();\n  if (!token) {\n    return {};\n  }\n\n  // Check if token is close to expiry by decoding JWT payload\n  try {\n    const payload = JSON.parse(atob(token.split('.')[1]));\n    const exp = payload.exp;\n    const now = Math.floor(Date.now() / 1000);\n\n    // Refresh if token expires in less than 1 hour\n    if (exp && exp - now < 3600) {\n      try {\n        const refreshed = await getClient().auth.refresh({ token });\n        await setAccessToken(refreshed.token);\n        return { token: refreshed.token };\n      } catch {\n        // Refresh failed — use existing token, it might still work\n      }\n    }\n  } catch {\n    // Can't decode JWT — use it as-is, the server will reject if invalid\n  }\n\n  return { token };\n}\n\n/**\n * Execute an authenticated request with automatic token refresh on 401.\n * @param fn - Function that takes RequestOptions and returns a promise\n * @returns The result of the function\n * @throws SpreeError if auth fails after refresh attempt\n */\nexport async function withAuthRefresh<T>(\n  fn: (options: RequestOptions) => Promise<T>\n): Promise<T> {\n  const options = await getAuthOptions();\n\n  if (!options.token) {\n    throw new Error('Not authenticated');\n  }\n\n  try {\n    return await fn(options);\n  } catch (error: unknown) {\n    // If 401, try refreshing the token once\n    if (error instanceof SpreeError && error.status === 401) {\n      try {\n        const refreshed = await getClient().auth.refresh({ token: options.token });\n        await setAccessToken(refreshed.token);\n        return await fn({ token: refreshed.token });\n      } catch {\n        // Refresh failed — clear token and rethrow\n        await clearAccessToken();\n        throw error;\n      }\n    }\n    throw error;\n  }\n}\n","import { cookies } from 'next/headers';\nimport { getConfig } from './config';\n\nconst DEFAULT_CART_COOKIE = '_spree_cart_token';\nconst DEFAULT_ACCESS_TOKEN_COOKIE = '_spree_jwt';\nconst CART_TOKEN_MAX_AGE = 60 * 60 * 24 * 30; // 30 days\nconst ACCESS_TOKEN_MAX_AGE = 60 * 60 * 24 * 7; // 7 days\n\nfunction getCartCookieName(): string {\n  try {\n    return getConfig().cartCookieName ?? DEFAULT_CART_COOKIE;\n  } catch {\n    return DEFAULT_CART_COOKIE;\n  }\n}\n\nfunction getCartIdCookieName(): string {\n  return `${getCartCookieName()}_id`;\n}\n\nfunction getAccessTokenCookieName(): string {\n  try {\n    return getConfig().accessTokenCookieName ?? DEFAULT_ACCESS_TOKEN_COOKIE;\n  } catch {\n    return DEFAULT_ACCESS_TOKEN_COOKIE;\n  }\n}\n\n// --- Cart Cookies (token + ID always managed together) ---\n\nexport async function getCartToken(): Promise<string | undefined> {\n  const cookieStore = await cookies();\n  return cookieStore.get(getCartCookieName())?.value;\n}\n\nexport async function getCartId(): Promise<string | undefined> {\n  const cookieStore = await cookies();\n  return cookieStore.get(getCartIdCookieName())?.value;\n}\n\nexport async function setCartCookies(id: string, token?: string): Promise<void> {\n  const cookieStore = await cookies();\n  const opts = {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax' as const,\n    path: '/',\n    maxAge: CART_TOKEN_MAX_AGE,\n  };\n\n  cookieStore.set(getCartIdCookieName(), id, opts);\n  if (token) {\n    cookieStore.set(getCartCookieName(), token, opts);\n  }\n}\n\nexport async function clearCartCookies(): Promise<void> {\n  const cookieStore = await cookies();\n  const opts = { maxAge: -1, path: '/' };\n  cookieStore.set(getCartCookieName(), '', opts);\n  cookieStore.set(getCartIdCookieName(), '', opts);\n}\n\n// --- Access Token (JWT) ---\n\nexport async function getAccessToken(): Promise<string | undefined> {\n  const cookieStore = await cookies();\n  return cookieStore.get(getAccessTokenCookieName())?.value;\n}\n\nexport async function setAccessToken(token: string): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getAccessTokenCookieName(), token, {\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'lax',\n    path: '/',\n    maxAge: ACCESS_TOKEN_MAX_AGE,\n  });\n}\n\nexport async function clearAccessToken(): Promise<void> {\n  const cookieStore = await cookies();\n  cookieStore.set(getAccessTokenCookieName(), '', {\n    maxAge: -1,\n    path: '/',\n  });\n}\n\n// --- Cart Options (combined cart + access tokens for cart/checkout/payment actions) ---\n\nexport async function getCartOptions(): Promise<{\n  spreeToken: string | undefined;\n  token: string | undefined;\n}> {\n  const spreeToken = await getCartToken();\n  const token = await getAccessToken();\n  return { spreeToken, token };\n}\n\n// --- Cart ID (required) ---\n\nexport async function requireCartId(): Promise<string> {\n  const cartId = await getCartId();\n  if (cartId) return cartId;\n\n  // Authenticated user without cart ID cookie — resolve via carts.list()\n  const token = await getAccessToken();\n  if (token) {\n    const { getClient } = await import('./config');\n    const response = await getClient().carts.list({ token });\n    if (response.data.length > 0) {\n      const cart = response.data[0];\n      await setCartCookies(cart.id, cart.token);\n      return cart.id;\n    }\n  }\n\n  throw new Error('No cart found');\n}\n","'use server';\n\nimport type {\n  PaymentSetupSession,\n  CreatePaymentSetupSessionParams,\n  CompletePaymentSetupSessionParams,\n} from '@spree/sdk';\nimport { withAuthRefresh } from '../auth-helpers';\nimport { getClient } from '../config';\n\n/**\n * Create a payment setup session for saving a payment method.\n * Delegates to the payment gateway to initialize a setup flow.\n */\nexport async function createPaymentSetupSession(\n  params: CreatePaymentSetupSessionParams\n): Promise<PaymentSetupSession> {\n  return withAuthRefresh(async (options) => {\n    return getClient().customer.paymentSetupSessions.create(params, options);\n  });\n}\n\n/**\n * Get a payment setup session by ID.\n */\nexport async function getPaymentSetupSession(\n  id: string\n): Promise<PaymentSetupSession> {\n  return withAuthRefresh(async (options) => {\n    return getClient().customer.paymentSetupSessions.get(id, options);\n  });\n}\n\n/**\n * Complete a payment setup session.\n * Confirms the setup with the provider, resulting in a saved payment method.\n */\nexport async function completePaymentSetupSession(\n  id: string,\n  params?: CompletePaymentSetupSessionParams\n): Promise<PaymentSetupSession> {\n  return withAuthRefresh(async (options) => {\n    return getClient().customer.paymentSetupSessions.complete(id, params, options);\n  });\n}\n"],"mappings":";;;;;;;AAAA,SAAS,oBAAiC;AAWnC,SAAS,cAAc,QAA+B;AAC3D,YAAU;AACV,YAAU,aAAa;AAAA,IACrB,SAAS,OAAO;AAAA,IAChB,gBAAgB,OAAO;AAAA,EACzB,CAAC;AACH;AAMO,SAAS,YAAoB;AAClC,MAAI,CAAC,SAAS;AACZ,UAAM,UAAU,QAAQ,IAAI;AAC5B,UAAM,iBAAiB,QAAQ,IAAI;AACnC,QAAI,WAAW,gBAAgB;AAC7B,oBAAc,EAAE,SAAS,eAAe,CAAC;AAAA,IAC3C,OAAO;AACL,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAMO,SAAS,YAA6B;AAC3C,MAAI,CAAC,SAAS;AACZ,cAAU;AAAA,EACZ;AACA,SAAO;AACT;AA/CA,IAGI,SACA;AAJJ;AAAA;AAAA;AAGA,IAAI,UAAyB;AAC7B,IAAI,UAAkC;AAAA;AAAA;;;ACFtC;AAFA,SAAS,kBAAkB;;;ACC3B;AADA,SAAS,eAAe;AAIxB,IAAM,8BAA8B;AACpC,IAAM,qBAAqB,KAAK,KAAK,KAAK;AAC1C,IAAM,uBAAuB,KAAK,KAAK,KAAK;AAc5C,SAAS,2BAAmC;AAC1C,MAAI;AACF,WAAO,UAAU,EAAE,yBAAyB;AAAA,EAC9C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAuCA,eAAsB,iBAA8C;AAClE,QAAM,cAAc,MAAM,QAAQ;AAClC,SAAO,YAAY,IAAI,yBAAyB,CAAC,GAAG;AACtD;AAEA,eAAsB,eAAe,OAA8B;AACjE,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,IAAI,yBAAyB,GAAG,OAAO;AAAA,IACjD,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,QAAQ;AAAA,EACV,CAAC;AACH;AAEA,eAAsB,mBAAkC;AACtD,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,IAAI,yBAAyB,GAAG,IAAI;AAAA,IAC9C,QAAQ;AAAA,IACR,MAAM;AAAA,EACR,CAAC;AACH;;;AD9EA,eAAsB,iBAA0C;AAC9D,QAAM,QAAQ,MAAM,eAAe;AACnC,MAAI,CAAC,OAAO;AACV,WAAO,CAAC;AAAA,EACV;AAGA,MAAI;AACF,UAAM,UAAU,KAAK,MAAM,KAAK,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;AACpD,UAAM,MAAM,QAAQ;AACpB,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAGxC,QAAI,OAAO,MAAM,MAAM,MAAM;AAC3B,UAAI;AACF,cAAM,YAAY,MAAM,UAAU,EAAE,KAAK,QAAQ,EAAE,MAAM,CAAC;AAC1D,cAAM,eAAe,UAAU,KAAK;AACpC,eAAO,EAAE,OAAO,UAAU,MAAM;AAAA,MAClC,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,SAAO,EAAE,MAAM;AACjB;AAQA,eAAsB,gBACpB,IACY;AACZ,QAAM,UAAU,MAAM,eAAe;AAErC,MAAI,CAAC,QAAQ,OAAO;AAClB,UAAM,IAAI,MAAM,mBAAmB;AAAA,EACrC;AAEA,MAAI;AACF,WAAO,MAAM,GAAG,OAAO;AAAA,EACzB,SAAS,OAAgB;AAEvB,QAAI,iBAAiB,cAAc,MAAM,WAAW,KAAK;AACvD,UAAI;AACF,cAAM,YAAY,MAAM,UAAU,EAAE,KAAK,QAAQ,EAAE,OAAO,QAAQ,MAAM,CAAC;AACzE,cAAM,eAAe,UAAU,KAAK;AACpC,eAAO,MAAM,GAAG,EAAE,OAAO,UAAU,MAAM,CAAC;AAAA,MAC5C,QAAQ;AAEN,cAAM,iBAAiB;AACvB,cAAM;AAAA,MACR;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;;;AE9DA;AAMA,eAAsB,0BACpB,QAC8B;AAC9B,SAAO,gBAAgB,OAAO,YAAY;AACxC,WAAO,UAAU,EAAE,SAAS,qBAAqB,OAAO,QAAQ,OAAO;AAAA,EACzE,CAAC;AACH;AAKA,eAAsB,uBACpB,IAC8B;AAC9B,SAAO,gBAAgB,OAAO,YAAY;AACxC,WAAO,UAAU,EAAE,SAAS,qBAAqB,IAAI,IAAI,OAAO;AAAA,EAClE,CAAC;AACH;AAMA,eAAsB,4BACpB,IACA,QAC8B;AAC9B,SAAO,gBAAgB,OAAO,YAAY;AACxC,WAAO,UAAU,EAAE,SAAS,qBAAqB,SAAS,IAAI,QAAQ,OAAO;AAAA,EAC/E,CAAC;AACH;","names":[]}

package/dist/index.d.ts

@@ -110,6 +110,8 @@ declare function register(params: {
 }>;
 /**
  * Logout the current user.
+ * Clears all auth and cart cookies to prevent the next guest session
+ * from seeing/modifying the previous user's cart.
  */
 declare function logout(): Promise<void>;
 /**