@tiledev/sdk-shopify 0.9.1 → 0.10.0

package/dist/auth/session.js

@@ -0,0 +1,896 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RENEW_WITHIN_MS = exports.EXPIRY_SKEW_MS = exports.LEGACY_PASSWORD_TOKEN_KEY = exports.PASSWORD_SESSION_KEYS = exports.SHOPIFY_SESSION_KEYS = void 0;
+exports.customerAccountUrls = customerAccountUrls;
+exports.callbackParams = callbackParams;
+exports.toCustomer = toCustomer;
+exports.createCustomerSession = createCustomerSession;
+/**
+ * The shopper's session, for both ways of signing in (`AuthMethod`):
+ *
+ * - `password`: a Storefront `customerAccessToken` from email and password.
+ * - `shopify`: Shopify's web sign-in for new customer accounts, OAuth 2 authorization code with PKCE
+ *   against `shopify.com/authentication/<shopId>`, then the Customer Account API with that token.
+ *
+ * One session at a time; signing in one way ends a session of the other. Framework-free, so the
+ * base cases are tested without React (test/auth-*.test.mjs). `ShopifyProvider` holds one and mirrors
+ * its state into `useCustomer()`.
+ *
+ * Failure rules, the same for both:
+ * - The shopper's own answer (wrong password, a refused sign-in) resolves `false` and emits
+ *   `auth:loginFailed`. Backing out of the sign-in page resolves `false` and emits nothing.
+ * - The store being unreachable throws, and never ends a session: being offline is not being signed out.
+ * - A session Shopify no longer accepts ends: silently on app open, with `auth:sessionExpired` later.
+ */
+const shopify_1 = require("../shopify");
+const client_1 = require("../client");
+const errors_1 = require("../errors");
+const types_1 = require("../types");
+const pkce_1 = require("./pkce");
+/**
+ * Production Amber's keychain keys, so its signed-in shoppers stay signed in after updating to a
+ * Tile build. `expiresAt` is epoch milliseconds as a decimal string.
+ */
+exports.SHOPIFY_SESSION_KEYS = {
+    accessToken: 'auth.token',
+    refreshToken: 'auth.refreshToken',
+    expiresAt: 'auth.expiresAt',
+    /** Kept only to sign out with: Shopify's logout endpoint identifies the session by `id_token_hint`. */
+    idToken: 'auth.idToken',
+};
+/**
+ * The password session. Every key here is valid for expo-secure-store, which takes only letters,
+ * digits, `.`, `-` and `_`: a `:` makes it throw, so SDK 0.8's `shopify:customer-token:v1` can't
+ * be used in the keychain (it failed restore on an iPhone, 2026-10-02).
+ */
+exports.PASSWORD_SESSION_KEYS = {
+    accessToken: 'auth.storefrontToken',
+    expiresAt: 'auth.storefrontExpiresAt',
+};
+/** Where SDK 0.8 and earlier kept the password token, in the provider's `storage`. Moved on first read. */
+exports.LEGACY_PASSWORD_TOKEN_KEY = 'shopify:customer-token:v1';
+/** Refresh a little early, so a request in flight can't land on a token that just expired. */
+exports.EXPIRY_SKEW_MS = 60000;
+/** A password token is renewed on app open once it has less than this left. */
+exports.RENEW_WITHIN_MS = 7 * 24 * 60 * 60 * 1000;
+const DEFAULT_SCOPES = ['openid', 'email', 'customer-account-api:full'];
+const DEFAULT_CUSTOMER_ACCOUNT_API_VERSION = '2025-07';
+/** Shopify refused the grant (`invalid_grant` and kin): a final answer, unlike a network failure. */
+class TokenRejected extends Error {
+    constructor(code) {
+        super(`Shopify refused the token request: ${code}`);
+        this.code = code;
+        this.name = 'TokenRejected';
+    }
+}
+function customerAccountUrls(c, fallbackVersion) {
+    const auth = `https://shopify.com/authentication/${c.shopId}`;
+    const version = c.apiVersion || fallbackVersion || DEFAULT_CUSTOMER_ACCOUNT_API_VERSION;
+    return {
+        authorize: `${auth}/oauth/authorize`,
+        token: `${auth}/oauth/token`,
+        logout: `${auth}/logout`,
+        graphql: `https://shopify.com/${c.shopId}/account/customer/api/${version}/graphql`,
+        redirectUri: c.redirectUri || `shop.${c.shopId}.app://callback`,
+    };
+}
+/** `a=1&b=2`, by hand: React Native's `URLSearchParams` is incomplete. */
+function form(params) {
+    return Object.keys(params)
+        .map((k) => `${encodeURIComponent(k)}=${encodeURIComponent(params[k])}`)
+        .join('&');
+}
+/** The query and fragment parameters of a redirect URL. */
+function callbackParams(url) {
+    const out = {};
+    const q = url.indexOf('?');
+    const h = url.indexOf('#');
+    const parts = [q >= 0 ? url.slice(q + 1, h > q ? h : undefined) : '', h >= 0 ? url.slice(h + 1) : ''];
+    for (const part of parts) {
+        for (const pair of part.split('&')) {
+            if (!pair)
+                continue;
+            const eq = pair.indexOf('=');
+            const key = decodeURIComponent((eq < 0 ? pair : pair.slice(0, eq)).replace(/\+/g, ' '));
+            const value = eq < 0 ? '' : decodeURIComponent(pair.slice(eq + 1).replace(/\+/g, ' '));
+            if (!(key in out))
+                out[key] = value;
+        }
+    }
+    return out;
+}
+function jwtClaims(jwt) {
+    var _a;
+    try {
+        return JSON.parse((0, pkce_1.base64urlDecodeText)((_a = jwt.split('.')[1]) !== null && _a !== void 0 ? _a : ''));
+    }
+    catch {
+        return null;
+    }
+}
+const describe = (error) => (error instanceof Error ? error.message : String(error));
+const PROFILE_QUERY = /* GraphQL */ `
+  query CustomerProfile {
+    customer {
+      id
+      firstName
+      lastName
+      emailAddress { emailAddress marketingState }
+      phoneNumber { phoneNumber }
+      defaultAddress { id firstName lastName address1 address2 city province country zip phoneNumber }
+    }
+  }
+`;
+/** Names only: the Customer Account API's `CustomerUpdateInput` has no other field a shopper edits. */
+const NAME_UPDATE_MUTATION = /* GraphQL */ `
+  mutation CustomerNameUpdate($input: CustomerUpdateInput!) {
+    customerUpdate(input: $input) {
+      userErrors { field message code }
+    }
+  }
+`;
+/**
+ * Consent has a mutation per direction, each acting on the signed-in shopper with no arguments, so
+ * the wanted state picks the document.
+ */
+const MARKETING_SUBSCRIBE_MUTATION = /* GraphQL */ `
+  mutation CustomerEmailMarketingSubscribe {
+    customerEmailMarketingSubscribe {
+      emailAddress { marketingState }
+      userErrors { field message code }
+    }
+  }
+`;
+const MARKETING_UNSUBSCRIBE_MUTATION = /* GraphQL */ `
+  mutation CustomerEmailMarketingUnsubscribe {
+    customerEmailMarketingUnsubscribe {
+      emailAddress { marketingState }
+      userErrors { field message code }
+    }
+  }
+`;
+/**
+ * The fields of `changes` that differ from the loaded profile, so nothing Shopify already holds is
+ * written again. An unset name counts as `''`. With no profile loaded (offline on app open), every
+ * field given counts as changed.
+ */
+function changedProfileFields(current, changes) {
+    var _a, _b;
+    const changed = {};
+    if (changes.firstName !== undefined && (!current || ((_a = current.firstName) !== null && _a !== void 0 ? _a : '') !== changes.firstName)) {
+        changed.firstName = changes.firstName;
+    }
+    if (changes.lastName !== undefined && (!current || ((_b = current.lastName) !== null && _b !== void 0 ? _b : '') !== changes.lastName)) {
+        changed.lastName = changes.lastName;
+    }
+    if (changes.acceptsMarketing !== undefined && (!current || current.acceptsMarketing !== changes.acceptsMarketing)) {
+        changed.acceptsMarketing = changes.acceptsMarketing;
+    }
+    return changed;
+}
+/** A Customer Account API customer in the SDK's `Customer` shape, so screens don't care which sign-in it was. */
+function toCustomer(raw) {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p;
+    const a = raw.defaultAddress;
+    const address = a
+        ? {
+            id: a.id,
+            firstName: (_a = a.firstName) !== null && _a !== void 0 ? _a : undefined,
+            lastName: (_b = a.lastName) !== null && _b !== void 0 ? _b : undefined,
+            address1: (_c = a.address1) !== null && _c !== void 0 ? _c : '',
+            address2: (_d = a.address2) !== null && _d !== void 0 ? _d : undefined,
+            city: (_e = a.city) !== null && _e !== void 0 ? _e : '',
+            province: (_f = a.province) !== null && _f !== void 0 ? _f : undefined,
+            country: (_g = a.country) !== null && _g !== void 0 ? _g : '',
+            zip: (_h = a.zip) !== null && _h !== void 0 ? _h : '',
+            phone: (_j = a.phoneNumber) !== null && _j !== void 0 ? _j : undefined,
+        }
+        : null;
+    return {
+        id: raw.id,
+        email: (_l = (_k = raw.emailAddress) === null || _k === void 0 ? void 0 : _k.emailAddress) !== null && _l !== void 0 ? _l : '',
+        firstName: raw.firstName,
+        lastName: raw.lastName,
+        phone: (_o = (_m = raw.phoneNumber) === null || _m === void 0 ? void 0 : _m.phoneNumber) !== null && _o !== void 0 ? _o : null,
+        defaultAddress: address,
+        // Only SUBSCRIBED is consent; every other marketing state reads as opted out.
+        acceptsMarketing: ((_p = raw.emailAddress) === null || _p === void 0 ? void 0 : _p.marketingState) === 'SUBSCRIBED',
+    };
+}
+function defaultRandom() {
+    const c = globalThis.crypto;
+    if (!(c === null || c === void 0 ? void 0 : c.getRandomValues))
+        return null;
+    return (n) => c.getRandomValues(new Uint8Array(n));
+}
+function createCustomerSession(deps) {
+    var _a;
+    const now = (_a = deps.now) !== null && _a !== void 0 ? _a : (() => Date.now());
+    let state = { kind: null, customer: null, accessToken: null, loading: false, restoring: true };
+    const listeners = new Set();
+    let shopifyTokens = null;
+    let passwordToken = null;
+    /** Bumped whenever the session changes hands, so work started for an old one can't write over a new one. */
+    let generation = 0;
+    let refreshInFlight = null;
+    let latestAttempt = 0;
+    let busyCount = 0;
+    function set(patch) {
+        state = { ...state, ...patch };
+        listeners.forEach((listener) => listener());
+    }
+    async function busy(work) {
+        busyCount += 1;
+        if (busyCount === 1)
+            set({ loading: true });
+        try {
+            return await work();
+        }
+        finally {
+            busyCount -= 1;
+            if (busyCount === 0)
+                set({ loading: false });
+        }
+    }
+    function storage() {
+        const s = deps.storage();
+        if (!s)
+            throw new types_1.ShopifyError('ShopifyProvider: no storage for the customer session; pass auth.secureStorage');
+        return s;
+    }
+    async function read(key) {
+        var _a;
+        const s = deps.storage();
+        return s ? (_a = (await Promise.resolve(s.getItem(key)))) !== null && _a !== void 0 ? _a : null : null;
+    }
+    /** Per key and error-tolerant: the token must go even if another key's delete fails. */
+    async function removeKeys(keys) {
+        const s = deps.storage();
+        if (!s)
+            return;
+        await Promise.all(keys.map((key) => Promise.resolve().then(() => s.removeItem(key)).catch(() => undefined)));
+    }
+    function customerAccount() {
+        var _a;
+        const c = (_a = deps.options()) === null || _a === void 0 ? void 0 : _a.customerAccount;
+        if (!(c === null || c === void 0 ? void 0 : c.shopId) || !(c === null || c === void 0 ? void 0 : c.clientId)) {
+            throw new types_1.ShopifyError('ShopifyProvider: auth.customerAccount { shopId, clientId } is required for Shopify sign-in');
+        }
+        return c;
+    }
+    const urls = () => { var _a; return customerAccountUrls(customerAccount(), (_a = deps.apiVersion) === null || _a === void 0 ? void 0 : _a.call(deps)); };
+    // ── Storage ────────────────────────────────────────────────────────────────
+    async function saveShopifyTokens(tokens) {
+        const s = storage();
+        const k = exports.SHOPIFY_SESSION_KEYS;
+        await Promise.all([
+            s.setItem(k.accessToken, tokens.accessToken),
+            tokens.refreshToken ? s.setItem(k.refreshToken, tokens.refreshToken) : s.removeItem(k.refreshToken),
+            tokens.expiresAt !== null ? s.setItem(k.expiresAt, String(tokens.expiresAt)) : s.removeItem(k.expiresAt),
+            tokens.idToken ? s.setItem(k.idToken, tokens.idToken) : s.removeItem(k.idToken),
+        ]);
+        shopifyTokens = tokens;
+    }
+    async function savePasswordToken(token) {
+        const s = storage();
+        const expiresAt = Date.parse(token.expiresAt);
+        await Promise.all([
+            s.setItem(exports.PASSWORD_SESSION_KEYS.accessToken, token.accessToken),
+            Number.isFinite(expiresAt) ? s.setItem(exports.PASSWORD_SESSION_KEYS.expiresAt, String(expiresAt)) : s.removeItem(exports.PASSWORD_SESSION_KEYS.expiresAt),
+        ]);
+        passwordToken = { accessToken: token.accessToken, expiresAt: Number.isFinite(expiresAt) ? expiresAt : null };
+    }
+    async function readShopifyTokens() {
+        const k = exports.SHOPIFY_SESSION_KEYS;
+        const [accessToken, refreshToken, expiresAt, idToken] = await Promise.all([
+            read(k.accessToken), read(k.refreshToken), read(k.expiresAt), read(k.idToken),
+        ]);
+        if (!accessToken)
+            return null;
+        return { accessToken, refreshToken, expiresAt: expiresAt ? Number(expiresAt) : null, idToken };
+    }
+    async function readPasswordToken() {
+        var _a, _b, _c;
+        let accessToken = await read(exports.PASSWORD_SESSION_KEYS.accessToken);
+        const legacy = (_b = (_a = deps.legacyStorage) === null || _a === void 0 ? void 0 : _a.call(deps)) !== null && _b !== void 0 ? _b : null;
+        if (!accessToken && legacy) {
+            // Moved from its 0.8 key (plain storage) to the keychain key, once.
+            accessToken = (_c = (await Promise.resolve(legacy.getItem(exports.LEGACY_PASSWORD_TOKEN_KEY)))) !== null && _c !== void 0 ? _c : null;
+            if (accessToken) {
+                await Promise.resolve(storage().setItem(exports.PASSWORD_SESSION_KEYS.accessToken, accessToken));
+                await Promise.resolve(legacy.removeItem(exports.LEGACY_PASSWORD_TOKEN_KEY));
+            }
+        }
+        if (!accessToken)
+            return null;
+        const expiresAt = await read(exports.PASSWORD_SESSION_KEYS.expiresAt);
+        return { accessToken, expiresAt: expiresAt ? Number(expiresAt) : null };
+    }
+    /**
+     * Ends the session locally. `expired`: Shopify stopped accepting it, as opposed to the shopper
+     * signing out; it emits `auth:sessionExpired`, except on app open (see `restore`).
+     */
+    async function endSession(reason) {
+        var _a, _b;
+        const announce = reason === 'expired' && state.kind !== null && !state.restoring;
+        generation += 1;
+        shopifyTokens = null;
+        passwordToken = null;
+        await removeKeys([...Object.values(exports.SHOPIFY_SESSION_KEYS), ...Object.values(exports.PASSWORD_SESSION_KEYS)]);
+        const legacy = (_b = (_a = deps.legacyStorage) === null || _a === void 0 ? void 0 : _a.call(deps)) !== null && _b !== void 0 ? _b : null;
+        if (legacy)
+            await Promise.resolve().then(() => legacy.removeItem(exports.LEGACY_PASSWORD_TOKEN_KEY)).catch(() => undefined);
+        if (reason !== 'replaced')
+            set({ kind: null, customer: null, accessToken: null });
+        if (announce)
+            deps.emit('auth:sessionExpired');
+    }
+    // ── Shopify (new customer accounts) ───────────────────────────────────────
+    async function tokenRequest(params) {
+        let res;
+        try {
+            res = await fetch(urls().token, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+                body: form(params),
+            });
+        }
+        catch (error) {
+            throw new types_1.ShopifyError(`Customer Account token request failed: ${describe(error)}`);
+        }
+        let json = null;
+        try {
+            json = JSON.parse(await res.text());
+        }
+        catch {
+            json = null;
+        }
+        if (!res.ok) {
+            const code = typeof (json === null || json === void 0 ? void 0 : json.error) === 'string' ? json.error : '';
+            // 400/401 with an OAuth error code is Shopify's final answer; anything else (5xx, 429, a
+            // proxy's HTML page) may pass, so it's a failure to reach the store, not a rejection.
+            if ((res.status === 400 || res.status === 401) && code)
+                throw new TokenRejected(code);
+            throw new types_1.ShopifyError(`Customer Account token request: HTTP ${res.status}`);
+        }
+        if (!json || typeof json.access_token !== 'string') {
+            throw new types_1.ShopifyError('Customer Account token response had no access_token');
+        }
+        const expiresIn = typeof json.expires_in === 'number' ? json.expires_in : Number(json.expires_in);
+        return {
+            accessToken: json.access_token,
+            refreshToken: typeof json.refresh_token === 'string' ? json.refresh_token : null,
+            expiresAt: Number.isFinite(expiresIn) && expiresIn > 0 ? now() + expiresIn * 1000 : null,
+            idToken: typeof json.id_token === 'string' ? json.id_token : null,
+        };
+    }
+    /**
+     * Shopify rotates the refresh token on use, so a second refresh with the same token is refused, and
+     * a refused refresh ends the session. Every caller wanting a token at once shares one refresh.
+     */
+    function refreshShopify() {
+        if (refreshInFlight)
+            return refreshInFlight;
+        const started = generation;
+        const current = shopifyTokens;
+        const run = async () => {
+            var _a, _b;
+            if (!(current === null || current === void 0 ? void 0 : current.refreshToken)) {
+                await endSession('expired');
+                return null;
+            }
+            let next;
+            try {
+                next = await tokenRequest({
+                    grant_type: 'refresh_token',
+                    client_id: customerAccount().clientId,
+                    refresh_token: current.refreshToken,
+                });
+            }
+            catch (error) {
+                if (error instanceof TokenRejected) {
+                    if (started === generation)
+                        await endSession('expired');
+                    return null;
+                }
+                throw error;
+            }
+            // Signed out (or in again) while this was in flight: the result belongs to a session that's gone.
+            if (started !== generation)
+                return null;
+            // A refresh response doesn't always carry a new refresh or id token; keep the ones we have.
+            await saveShopifyTokens({
+                accessToken: next.accessToken,
+                refreshToken: (_a = next.refreshToken) !== null && _a !== void 0 ? _a : current.refreshToken,
+                expiresAt: next.expiresAt,
+                idToken: (_b = next.idToken) !== null && _b !== void 0 ? _b : current.idToken,
+            });
+            set({ accessToken: next.accessToken });
+            return next.accessToken;
+        };
+        const flight = run().finally(() => {
+            if (refreshInFlight === flight)
+                refreshInFlight = null;
+        });
+        refreshInFlight = flight;
+        return flight;
+    }
+    /** A usable access token, refreshed or renewed when needed; null when signed out or the session ended. */
+    async function getAccessToken() {
+        if (state.kind === 'shopify' && shopifyTokens) {
+            const { accessToken, expiresAt } = shopifyTokens;
+            if (expiresAt === null || expiresAt - exports.EXPIRY_SKEW_MS > now())
+                return accessToken;
+            return refreshShopify();
+        }
+        if (state.kind === 'password' && passwordToken) {
+            const { accessToken, expiresAt } = passwordToken;
+            if (expiresAt === null || expiresAt - exports.EXPIRY_SKEW_MS > now())
+                return accessToken;
+            // Classic tokens can only be renewed before they expire; past that, the shopper signs in again.
+            await endSession('expired');
+            return null;
+        }
+        return null;
+    }
+    /**
+     * A token renewed now, for a caller whose service just refused the current one (Tile Credit's 401).
+     * A Shopify session refreshes, sharing the one refresh in flight with every other caller; a password
+     * session can't be renewed early, so null. Never ends the session itself: only Shopify refusing the
+     * refresh does, as it would on the next Customer Account API call. Throws when offline.
+     */
+    async function renewAccessToken() {
+        if (state.kind === 'shopify' && shopifyTokens)
+            return refreshShopify();
+        return null;
+    }
+    /**
+     * One Customer Account API call. The token goes in `Authorization` bare, with no `Bearer`: that's
+     * what this API expects. A 401 refreshes once and retries.
+     */
+    async function customerAccountRequest(query, variables) {
+        var _a;
+        if (state.kind !== 'shopify')
+            throw new types_1.ShopifyError('Not signed in with Shopify (new customer accounts)');
+        const send = async (token) => {
+            try {
+                return await fetch(urls().graphql, {
+                    method: 'POST',
+                    headers: { Authorization: token, 'Content-Type': 'application/json', Accept: 'application/json' },
+                    body: JSON.stringify({ query, variables: variables !== null && variables !== void 0 ? variables : {} }),
+                });
+            }
+            catch (error) {
+                throw new types_1.ShopifyError(`Customer Account API request failed: ${describe(error)}`);
+            }
+        };
+        let token = await getAccessToken();
+        if (!token)
+            throw new types_1.ShopifyError('The customer session has ended');
+        let res = await send(token);
+        if (res.status === 401) {
+            // Shopify can revoke a token before its stated expiry (a password reset, an admin action).
+            token = await refreshShopify();
+            if (!token)
+                throw new types_1.ShopifyError('The customer session has ended');
+            res = await send(token);
+            if (res.status === 401) {
+                await endSession('expired');
+                throw new types_1.ShopifyError('The customer session has ended');
+            }
+        }
+        let json;
+        try {
+            json = JSON.parse(await res.text());
+        }
+        catch {
+            throw new types_1.ShopifyError(`Customer Account API HTTP ${res.status}: not JSON`);
+        }
+        if ((_a = json.errors) === null || _a === void 0 ? void 0 : _a.length)
+            throw new types_1.ShopifyError(`GraphQL error: ${json.errors.map((e) => e.message).join('; ')}`);
+        if (!json.data)
+            throw new types_1.ShopifyError(`Customer Account API HTTP ${res.status}: no data`);
+        return json.data;
+    }
+    async function loadShopifyProfile() {
+        const started = generation;
+        const data = await customerAccountRequest(PROFILE_QUERY);
+        if (started !== generation)
+            return null;
+        const customer = data.customer ? toCustomer(data.customer) : null;
+        set({ customer });
+        return customer;
+    }
+    function startSignIn() {
+        var _a, _b, _c;
+        const c = customerAccount();
+        const random = (_b = (_a = deps.options()) === null || _a === void 0 ? void 0 : _a.random) !== null && _b !== void 0 ? _b : defaultRandom();
+        if (!random)
+            throw new types_1.ShopifyError('ShopifyProvider: auth.random is required for Shopify sign-in on this engine (e.g. expo-crypto getRandomBytes)');
+        const pkce = (0, pkce_1.createPkce)(random);
+        const u = urls();
+        const id = ++latestAttempt;
+        let settled = false;
+        const params = {
+            client_id: c.clientId,
+            response_type: 'code',
+            redirect_uri: u.redirectUri,
+            scope: ((_c = c.scopes) !== null && _c !== void 0 ? _c : DEFAULT_SCOPES).join(' '),
+            state: pkce.state,
+            nonce: pkce.nonce,
+            code_challenge: pkce.challenge,
+            code_challenge_method: 'S256',
+        };
+        if (c.locale)
+            params.ui_locales = c.locale;
+        const isCallback = (url) => url === u.redirectUri || url.startsWith(`${u.redirectUri}?`) || url.startsWith(`${u.redirectUri}#`);
+        return {
+            url: `${u.authorize}?${form(params)}`,
+            redirectUri: u.redirectUri,
+            isCallback,
+            cancel: () => {
+                settled = true;
+            },
+            finish: async (callbackUrl) => {
+                // A second callback for the same attempt, or one for an attempt a newer sign-in replaced.
+                if (settled || id !== latestAttempt || !isCallback(callbackUrl))
+                    return false;
+                settled = true;
+                return busy(() => completeSignIn(callbackUrl, pkce));
+            },
+        };
+    }
+    async function completeSignIn(callbackUrl, pkce) {
+        var _a;
+        const q = callbackParams(callbackUrl);
+        if (q.error) {
+            // The shopper declined: their choice, like closing the page, not a failure to toast.
+            if (q.error === 'access_denied')
+                return false;
+            deps.emit('auth:loginFailed', new types_1.ShopifyError(`Shopify sign-in failed: ${q.error}${q.error_description ? ` (${q.error_description})` : ''}`));
+            return false;
+        }
+        if (q.state !== pkce.state || !q.code) {
+            // Not the redirect this app asked for: never exchange a code it didn't start.
+            deps.emit('auth:loginFailed', new types_1.ShopifyError('Shopify sign-in returned an unexpected redirect (state mismatch)'));
+            return false;
+        }
+        let tokens;
+        try {
+            tokens = await tokenRequest({
+                grant_type: 'authorization_code',
+                client_id: customerAccount().clientId,
+                redirect_uri: urls().redirectUri,
+                code: q.code,
+                code_verifier: pkce.verifier,
+            });
+        }
+        catch (error) {
+            if (!(error instanceof TokenRejected))
+                throw error;
+            deps.emit('auth:loginFailed', error);
+            return false;
+        }
+        // The id token comes straight from Shopify's token endpoint over TLS, so its signature needn't be
+        // checked here (OpenID Connect Core 3.1.3.7); the nonce still ties it to this sign-in.
+        if (tokens.idToken && ((_a = jwtClaims(tokens.idToken)) === null || _a === void 0 ? void 0 : _a.nonce) !== pkce.nonce) {
+            deps.emit('auth:loginFailed', new types_1.ShopifyError('Shopify sign-in returned an id token for another sign-in (nonce mismatch)'));
+            return false;
+        }
+        await endSession('replaced');
+        await saveShopifyTokens(tokens);
+        set({ kind: 'shopify', accessToken: tokens.accessToken, customer: null });
+        try {
+            await loadShopifyProfile();
+        }
+        catch (error) {
+            // Signed in; the profile loads on the next `refresh()`.
+            console.warn('[sdk-shopify] signed in, but the profile did not load', error);
+        }
+        deps.emit('auth:loginSuccess');
+        return true;
+    }
+    async function signIn() {
+        var _a;
+        const open = (_a = deps.options()) === null || _a === void 0 ? void 0 : _a.openAuthSession;
+        if (!open) {
+            throw new types_1.ShopifyError('ShopifyProvider: auth.openAuthSession is required for signIn(); an in-app web view uses startSignIn()');
+        }
+        const attempt = startSignIn();
+        const result = await open(attempt.url, attempt.redirectUri);
+        if (result.type !== 'success' || !result.url) {
+            attempt.cancel();
+            return false;
+        }
+        return attempt.finish(result.url);
+    }
+    // ── Password (classic customer accounts) ──────────────────────────────────
+    async function startPasswordSession(token, customer) {
+        await endSession('replaced');
+        await savePasswordToken(token);
+        set({ kind: 'password', accessToken: token.accessToken, customer });
+    }
+    async function login(email, password) {
+        return busy(async () => {
+            let token;
+            try {
+                token = await shopify_1.shopify.customer.login({ email, password });
+            }
+            catch (error) {
+                // Only a credential problem is the shopper's mistake; the store being unreachable throws.
+                if ((0, errors_1.classifyAuthFailure)(error) === 'unknown')
+                    throw error;
+                deps.emit('auth:loginFailed', error);
+                return false;
+            }
+            const customer = await shopify_1.shopify.customer.profile(token.accessToken);
+            await startPasswordSession(token, customer);
+            deps.emit('auth:loginSuccess');
+            return true;
+        });
+    }
+    async function signup(input) {
+        return busy(async () => {
+            let created;
+            try {
+                created = await shopify_1.shopify.customer.signup(input);
+            }
+            catch (error) {
+                if ((0, errors_1.classifyAuthFailure)(error) === 'unknown')
+                    throw error;
+                deps.emit('auth:loginFailed', error);
+                return false;
+            }
+            await startPasswordSession(created.accessToken, created.customer);
+            // Signup signs the shopper in, so both fire: a host that only toasts on loginSuccess still says the right thing.
+            deps.emit('auth:signup');
+            deps.emit('auth:loginSuccess');
+            return true;
+        });
+    }
+    async function recoverPassword(email) {
+        await busy(async () => {
+            await shopify_1.shopify.customer.recoverPassword(email);
+            deps.emit('auth:recoverSent');
+        });
+    }
+    // ── Both ──────────────────────────────────────────────────────────────────
+    /** Re-reads the profile. Null when signed out or the session ended; throws when offline. */
+    async function refresh() {
+        if (state.kind === 'shopify')
+            return loadShopifyProfile();
+        if (state.kind === 'password') {
+            const started = generation;
+            const token = await getAccessToken();
+            if (!token)
+                return null;
+            const customer = await shopify_1.shopify.customer.profile(token);
+            if (started !== generation)
+                return null;
+            if (!customer) {
+                await endSession('expired');
+                return null;
+            }
+            set({ customer });
+            return customer;
+        }
+        return null;
+    }
+    /**
+     * Password session: one Storefront `customerUpdate`. It returns the updated customer, which becomes
+     * `customer`, so no second request is needed.
+     */
+    async function updatePasswordProfile(changed) {
+        const started = generation;
+        const token = await getAccessToken();
+        if (!token)
+            throw new types_1.ShopifyError('The customer session has ended');
+        const updated = await shopify_1.shopify.customer.updateProfile(token, changed);
+        if (started === generation)
+            set({ customer: updated });
+    }
+    /**
+     * Shopify session: `customerUpdate` for the names, then the consent mutation, stopping at the first
+     * refusal. Whatever Shopify accepted is re-read even when a later change was refused, so `customer`
+     * never shows a value Shopify doesn't hold.
+     */
+    async function updateShopifyProfile(changed) {
+        var _a, _b;
+        const { acceptsMarketing: subscribe, ...names } = changed;
+        const accepted = {};
+        try {
+            if (Object.keys(names).length > 0) {
+                const data = await customerAccountRequest(NAME_UPDATE_MUTATION, { input: names });
+                (0, client_1.assertNoUserErrors)('customerUpdate', (_a = data.customerUpdate) === null || _a === void 0 ? void 0 : _a.userErrors);
+                Object.assign(accepted, names);
+            }
+            if (subscribe !== undefined) {
+                const data = await customerAccountRequest(subscribe ? MARKETING_SUBSCRIBE_MUTATION : MARKETING_UNSUBSCRIBE_MUTATION);
+                const payload = subscribe ? data.customerEmailMarketingSubscribe : data.customerEmailMarketingUnsubscribe;
+                // "Already subscribed" is the state the shopper asked for, not a failure. It happens when the
+                // loaded profile was out of date (subscribed on another device since).
+                const errors = ((_b = payload === null || payload === void 0 ? void 0 : payload.userErrors) !== null && _b !== void 0 ? _b : []).filter((e) => !(subscribe && e.code === 'CUSTOMER_ALREADY_SUBSCRIBED'));
+                (0, client_1.assertNoUserErrors)(subscribe ? 'customerEmailMarketingSubscribe' : 'customerEmailMarketingUnsubscribe', errors);
+                accepted.acceptsMarketing = subscribe;
+            }
+        }
+        finally {
+            if (Object.keys(accepted).length > 0)
+                await reloadAfterUpdate(accepted);
+        }
+    }
+    /**
+     * Re-reads the profile after a write Shopify accepted. If that read fails (offline the moment after
+     * saving), the accepted values are shown instead, so the screen doesn't fall back to the old ones.
+     * Never throws.
+     */
+    async function reloadAfterUpdate(accepted) {
+        const started = generation;
+        try {
+            await loadShopifyProfile();
+        }
+        catch (error) {
+            console.warn('[sdk-shopify] profile saved, but did not reload', error);
+            const current = state.customer;
+            if (started === generation && current)
+                set({ customer: { ...current, ...accepted } });
+        }
+    }
+    /**
+     * Changes the shopper's name and email marketing consent, for either kind of session. Sends only
+     * the fields that differ from `customer` (nothing to send resolves `true` at once). `true` once
+     * Shopify accepted every change, with `customer` showing the new values. `false` when signed out, or
+     * when Shopify refused a value or couldn't be reached; the reason goes to `console.warn`. Never
+     * throws, so a form only has to check the answer.
+     */
+    async function updateProfile(changes) {
+        try {
+            return await busy(async () => {
+                const kind = state.kind;
+                if (!kind)
+                    throw new types_1.ShopifyError('Not signed in');
+                const changed = changedProfileFields(state.customer, changes);
+                if (Object.keys(changed).length === 0)
+                    return true;
+                if (kind === 'password')
+                    await updatePasswordProfile(changed);
+                else
+                    await updateShopifyProfile(changed);
+                return true;
+            });
+        }
+        catch (error) {
+            console.warn('[sdk-shopify] profile update failed', error);
+            return false;
+        }
+    }
+    /**
+     * Local first, so nothing between the tap and being signed out can fail; then Shopify is told, and
+     * its answer doesn't matter. Always resolves.
+     */
+    async function logout() {
+        await busy(async () => {
+            var _a, _b;
+            const kind = state.kind;
+            const idToken = (_a = shopifyTokens === null || shopifyTokens === void 0 ? void 0 : shopifyTokens.idToken) !== null && _a !== void 0 ? _a : null;
+            const classicToken = (_b = passwordToken === null || passwordToken === void 0 ? void 0 : passwordToken.accessToken) !== null && _b !== void 0 ? _b : null;
+            let logoutUrl = null;
+            try {
+                if (kind === 'shopify' && idToken)
+                    logoutUrl = `${urls().logout}?id_token_hint=${encodeURIComponent(idToken)}`;
+            }
+            catch {
+                logoutUrl = null;
+            }
+            await endSession('signed-out');
+            if (logoutUrl) {
+                // Ends Shopify's session server-side. No `post_logout_redirect_uri`: Shopify would answer
+                // with a redirect to the app's scheme, which fetch can't follow. `manual`: only arriving matters.
+                void fetch(logoutUrl, { method: 'GET', redirect: 'manual' }).catch(() => undefined);
+            }
+            if (classicToken) {
+                try {
+                    await shopify_1.shopify.customer.logout(classicToken);
+                }
+                catch (error) {
+                    console.warn('[sdk-shopify] token delete failed; signed out locally', error);
+                }
+            }
+            deps.emit('auth:logout');
+        });
+    }
+    /**
+     * Reads a stored session on app open. A session Shopify no longer accepts is dropped silently: an
+     * expired login isn't a failed one, and a toast at a shopper who did nothing is noise. Offline
+     * keeps the session; the profile loads on the next `refresh()`.
+     */
+    async function restore() {
+        var _a;
+        const started = generation;
+        try {
+            const stored = await readShopifyTokens();
+            if (started !== generation)
+                return;
+            if (stored) {
+                shopifyTokens = stored;
+                set({ kind: 'shopify', accessToken: stored.accessToken });
+                const expired = stored.expiresAt !== null && stored.expiresAt - exports.EXPIRY_SKEW_MS <= now();
+                if (expired) {
+                    // Null when Shopify refused it (the session is gone); offline keeps the session as is.
+                    const token = await refreshShopify().catch((error) => {
+                        console.warn('[sdk-shopify] session refresh failed on app open; kept', error);
+                        return null;
+                    });
+                    if (!token)
+                        return;
+                }
+                await loadShopifyProfile().catch((error) => console.warn('[sdk-shopify] profile did not load on app open', error));
+                return;
+            }
+            const classic = await readPasswordToken();
+            if (started !== generation || !classic)
+                return;
+            if (classic.expiresAt !== null && classic.expiresAt - exports.EXPIRY_SKEW_MS <= now()) {
+                await endSession('expired');
+                return;
+            }
+            passwordToken = classic;
+            set({ kind: 'password', accessToken: classic.accessToken });
+            if (classic.expiresAt !== null && classic.expiresAt - now() < exports.RENEW_WITHIN_MS) {
+                try {
+                    const renewed = await shopify_1.shopify.customer.renew(classic.accessToken);
+                    if (started === generation) {
+                        await savePasswordToken(renewed);
+                        set({ accessToken: renewed.accessToken });
+                    }
+                }
+                catch (error) {
+                    // Still valid for now; it's tried again on the next app open.
+                    console.warn('[sdk-shopify] token renew failed; kept', error);
+                }
+            }
+            let customer;
+            try {
+                customer = await shopify_1.shopify.customer.profile((_a = passwordToken === null || passwordToken === void 0 ? void 0 : passwordToken.accessToken) !== null && _a !== void 0 ? _a : classic.accessToken);
+            }
+            catch (error) {
+                console.warn('[sdk-shopify] profile did not load on app open; session kept', error);
+                return;
+            }
+            if (started !== generation)
+                return;
+            if (!customer)
+                await endSession('expired');
+            else
+                set({ customer });
+        }
+        catch (error) {
+            console.warn('[sdk-shopify] session restore failed', error);
+        }
+        finally {
+            set({ restoring: false });
+        }
+    }
+    return {
+        getState: () => state,
+        subscribe(listener) {
+            listeners.add(listener);
+            return () => {
+                listeners.delete(listener);
+            };
+        },
+        restore,
+        login,
+        signup,
+        recoverPassword,
+        startSignIn,
+        signIn,
+        getAccessToken,
+        renewAccessToken,
+        customerAccountRequest,
+        refresh,
+        updateProfile,
+        logout,
+    };
+}
+//# sourceMappingURL=session.js.map