@uniforge/platform-shopify 0.1.0-alpha.2

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/index.ts","../../src/auth/token-exchange.ts","../../src/auth/session.ts","../../src/auth/hmac.ts","../../src/auth/oauth.ts"],"sourcesContent":["/**\n * @uniforge/platform-shopify - Authentication\n *\n * Shopify-specific authentication implementation including\n * token exchange, session management, and OAuth flows.\n */\n\n// Token exchange\nexport {\n  extractSessionToken,\n  extractShop,\n  performTokenExchange,\n  createShopifyTokenExchangeFn,\n} from './token-exchange';\nexport type {\n  PerformTokenExchangeInput,\n  ShopifyTokenExchangeFn,\n} from './token-exchange';\n\n// Session manager\nexport { ShopifySessionManager } from './session';\nexport type {\n  ShopifyTokenRefreshFn,\n  ShopifySessionManagerOptions,\n} from './session';\n\n// HMAC validation\nexport { validateOAuthHmac } from './hmac';\n\n// OAuth flow\nexport { beginOAuth, handleOAuthCallback } from './oauth';\nexport type {\n  ShopifyOAuthBeginFn,\n  ShopifyOAuthCallbackFn,\n  BeginOAuthInput,\n  BeginOAuthResult,\n  HandleOAuthCallbackInput,\n  OAuthCallbackResult,\n} from './oauth';\n","/**\n * Session token extraction and Shopify token exchange.\n *\n * Extracts session tokens from embedded app requests and exchanges\n * them for access tokens via the Shopify API.\n */\n\nimport { randomUUID } from 'node:crypto';\nimport type {\n  AuthConfig,\n  AuthRequest,\n  Session,\n} from '@uniforge/platform-core/auth';\nimport { isValidShopDomain } from '@uniforge/platform-core/auth';\nimport { createAuthEvent } from '@uniforge/core/auth';\n\n/**\n * Extract the session token from the Authorization header.\n * Returns null if the header is missing or malformed.\n */\nexport function extractSessionToken(request: AuthRequest): string | null {\n  // Try both lower-case and capitalized header names\n  const authHeader =\n    request.headers['authorization'] ?? request.headers['Authorization'];\n\n  if (!authHeader || typeof authHeader !== 'string') {\n    return null;\n  }\n\n  if (!authHeader.startsWith('Bearer ')) {\n    return null;\n  }\n\n  const token = authHeader.slice('Bearer '.length).trim();\n  return token.length > 0 ? token : null;\n}\n\n/**\n * Extract the shop domain from the request.\n * Checks query parameter first, then x-shopify-shop-domain header.\n * Validates the domain format before returning.\n */\nexport function extractShop(request: AuthRequest): string | null {\n  // Prefer query parameter\n  const shopFromQuery = request.query['shop'];\n  if (shopFromQuery && isValidShopDomain(shopFromQuery)) {\n    return shopFromQuery;\n  }\n\n  // Fall back to header\n  const shopFromHeader = request.headers['x-shopify-shop-domain'];\n  if (\n    shopFromHeader &&\n    typeof shopFromHeader === 'string' &&\n    isValidShopDomain(shopFromHeader)\n  ) {\n    return shopFromHeader;\n  }\n\n  return null;\n}\n\n/**\n * Minimal interface for the Shopify token exchange function.\n * Allows mocking in tests without depending on the full Shopify API.\n */\nexport interface ShopifyTokenExchangeFn {\n  (params: {\n    sessionToken: string;\n    shop: string;\n    requestedTokenType: string;\n  }): Promise<{\n    session: {\n      id: string;\n      shop: string;\n      state: string;\n      isOnline: boolean;\n      scope?: string;\n      expires?: Date;\n      accessToken?: string;\n      refreshToken?: string;\n      onlineAccessInfo?: any;\n    };\n  }>;\n}\n\n/** Input parameters for performing a Shopify token exchange. */\nexport interface PerformTokenExchangeInput {\n  config: AuthConfig;\n  sessionToken: string;\n  shop: string;\n  tokenType: 'online' | 'offline';\n  /** Optional: provide a custom token exchange function (for testing). */\n  tokenExchangeFn?: ShopifyTokenExchangeFn;\n}\n\n/**\n * Create a Shopify API client and return its tokenExchange function.\n */\nexport async function createShopifyTokenExchangeFn(\n  config: AuthConfig,\n): Promise<ShopifyTokenExchangeFn> {\n  const { shopifyApi, LogSeverity } = await import('@shopify/shopify-api');\n  await import('@shopify/shopify-api/adapters/node');\n\n  const shopify = shopifyApi({\n    apiKey: config.apiKey,\n    apiSecretKey: config.apiSecretKey,\n    scopes: config.scopes,\n    hostName: config.hostName,\n    apiVersion: config.apiVersion as any,\n    isEmbeddedApp: config.isEmbeddedApp ?? true,\n    logger: { level: LogSeverity.Error },\n  });\n\n  return shopify.auth.tokenExchange as ShopifyTokenExchangeFn;\n}\n\n/**\n * Exchange a session token for an access token via Shopify API.\n *\n * Maps the Shopify Session result to UniForge's Session type.\n * Emits auth events on success/failure.\n */\nexport async function performTokenExchange(\n  input: PerformTokenExchangeInput,\n): Promise<Session> {\n  const { config, sessionToken, shop, tokenType } = input;\n\n  if (!sessionToken) {\n    throw new Error('Session token is required for token exchange.');\n  }\n\n  if (!isValidShopDomain(shop)) {\n    throw new Error(\n      `Invalid shop domain \"${shop}\". Expected format: example.myshopify.com`,\n    );\n  }\n\n  const tokenExchangeFn =\n    input.tokenExchangeFn ?? (await createShopifyTokenExchangeFn(config));\n\n  const requestedTokenType =\n    tokenType === 'online'\n      ? 'urn:shopify:params:oauth:token-type:online-access-token'\n      : 'urn:shopify:params:oauth:token-type:offline-access-token';\n\n  try {\n    const { session: shopifySession } = await tokenExchangeFn({\n      sessionToken,\n      shop,\n      requestedTokenType,\n    });\n\n    const now = new Date();\n    const session = mapShopifySession(shopifySession, shop, now);\n\n    if (config.eventHandler) {\n      const event = createAuthEvent({\n        type: 'token_exchange_success',\n        shopDomain: shop,\n        outcome: 'success',\n        sessionId: session.id,\n        metadata: {\n          tokenType,\n          sessionId: session.id,\n        },\n      });\n      await Promise.resolve(config.eventHandler.onAuthEvent(event));\n    }\n\n    return session;\n  } catch (error) {\n    if (config.eventHandler) {\n      const event = createAuthEvent({\n        type: 'token_exchange_failure',\n        shopDomain: shop,\n        outcome: 'failure',\n        metadata: {\n          tokenType,\n          error: error instanceof Error ? error.message : String(error),\n        },\n      });\n      await Promise.resolve(config.eventHandler.onAuthEvent(event));\n    }\n\n    throw error;\n  }\n}\n\n/**\n * Map a Shopify Session object to a UniForge Session.\n */\nfunction mapShopifySession(\n  shopifySession: {\n    id: string;\n    shop: string;\n    state: string;\n    isOnline: boolean;\n    scope?: string;\n    expires?: Date;\n    accessToken?: string;\n    refreshToken?: string;\n    onlineAccessInfo?: any;\n  },\n  shop: string,\n  now: Date,\n): Session {\n  const session: Session = {\n    id: shopifySession.id,\n    shop: shopifySession.shop || shop,\n    state: shopifySession.state || randomUUID(),\n    isOnline: shopifySession.isOnline,\n    scope: shopifySession.scope || '',\n    expires: shopifySession.expires ?? null,\n    createdAt: now,\n    updatedAt: now,\n  };\n\n  if (shopifySession.accessToken) {\n    (session as any).accessToken = shopifySession.accessToken;\n  }\n\n  if (shopifySession.refreshToken) {\n    (session as any).refreshToken = shopifySession.refreshToken;\n  }\n\n  if (shopifySession.onlineAccessInfo) {\n    const info = shopifySession.onlineAccessInfo;\n    (session as any).onlineAccessInfo = {\n      expiresIn: info.expires_in ?? info.expiresIn ?? 0,\n      associatedUserScope:\n        info.associated_user_scope ?? info.associatedUserScope ?? '',\n      associatedUser: info.associated_user\n        ? {\n            id: info.associated_user.id,\n            firstName: info.associated_user.first_name,\n            lastName: info.associated_user.last_name,\n            email: info.associated_user.email,\n            emailVerified: info.associated_user.email_verified,\n            accountOwner: info.associated_user.account_owner,\n            locale: info.associated_user.locale,\n            collaborator: info.associated_user.collaborator,\n          }\n        : info.associatedUser,\n    };\n  }\n\n  return session;\n}\n","/**\n * Shopify session manager for embedded app authentication.\n *\n * Manages the lifecycle of Shopify sessions: checks storage for\n * existing valid sessions, performs token exchange when needed,\n * refreshes expiring tokens, and stores results via encrypted\n * session storage.\n */\n\nimport type {\n  AuthConfig,\n  AuthRequest,\n  Session,\n} from '@uniforge/platform-core/auth';\nimport {\n  TokenEncryptionServiceImpl,\n  EncryptedSessionStorage,\n  createAuthEvent,\n} from '@uniforge/core/auth';\nimport {\n  extractSessionToken,\n  extractShop,\n  performTokenExchange,\n} from './token-exchange';\nimport type { ShopifyTokenExchangeFn } from './token-exchange';\n\n/**\n * Injectable function for refreshing a Shopify access token.\n * In production, wraps `shopify.auth.refreshToken()`.\n */\nexport interface ShopifyTokenRefreshFn {\n  (params: {\n    session: {\n      accessToken?: string;\n      refreshToken?: string;\n      shop: string;\n    };\n  }): Promise<{\n    session: {\n      id: string;\n      shop: string;\n      state: string;\n      isOnline: boolean;\n      scope?: string;\n      expires?: Date;\n      accessToken?: string;\n      refreshToken?: string;\n    };\n  }>;\n}\n\n/** Options for configuring the ShopifySessionManager with test doubles. */\nexport interface ShopifySessionManagerOptions {\n  /** Optional: provide a custom token exchange function (for testing). */\n  tokenExchangeFn?: ShopifyTokenExchangeFn;\n  /** Optional: provide a custom token refresh function (for testing). */\n  tokenRefreshFn?: ShopifyTokenRefreshFn;\n}\n\nexport class ShopifySessionManager {\n  private readonly encryptedStorage: EncryptedSessionStorage;\n  private readonly tokenExchangeFn?: ShopifyTokenExchangeFn;\n  private readonly tokenRefreshFn?: ShopifyTokenRefreshFn;\n\n  constructor(\n    private readonly config: AuthConfig,\n    options?: ShopifySessionManagerOptions,\n  ) {\n    const encryption = new TokenEncryptionServiceImpl(config.encryption);\n    this.encryptedStorage = new EncryptedSessionStorage(\n      config.sessionStorage,\n      encryption,\n    );\n    if (options?.tokenExchangeFn) {\n      this.tokenExchangeFn = options.tokenExchangeFn;\n    }\n    if (options?.tokenRefreshFn) {\n      this.tokenRefreshFn = options.tokenRefreshFn;\n    }\n  }\n\n  /**\n   * Get an existing valid session or create one via token exchange.\n   *\n   * For embedded apps, this:\n   * 1. Extracts the session token and shop from the request\n   * 2. Checks storage for an existing non-expired session\n   * 3. If no valid session, performs token exchange with Shopify\n   * 4. Stores the new session (encrypted) and returns it\n   */\n  async getOrCreateSession(request: AuthRequest): Promise<Session> {\n    const shop = extractShop(request);\n    if (!shop) {\n      throw new Error(\n        'Could not extract shop domain from request. Provide shop in query parameter or x-shopify-shop-domain header.',\n      );\n    }\n\n    const sessionToken = extractSessionToken(request);\n    if (!sessionToken) {\n      throw new Error(\n        'Could not extract session token from Authorization header. Expected: Authorization: Bearer <token>',\n      );\n    }\n\n    // Check for existing offline session\n    const sessionId = `offline_${shop}`;\n    const existingSession = await this.encryptedStorage.loadSession(sessionId);\n\n    if (existingSession && !this.isExpired(existingSession)) {\n      return existingSession;\n    }\n\n    // Perform token exchange\n    const exchangeInput: Parameters<typeof performTokenExchange>[0] = {\n      config: this.config,\n      sessionToken,\n      shop,\n      tokenType: 'offline',\n    };\n    if (this.tokenExchangeFn) {\n      exchangeInput.tokenExchangeFn = this.tokenExchangeFn;\n    }\n    const session = await performTokenExchange(exchangeInput);\n\n    // Store the session (encrypted)\n    await this.encryptedStorage.storeSession(session);\n\n    return session;\n  }\n\n  /**\n   * Get an existing valid online session or create one via token exchange.\n   */\n  async getOrCreateOnlineSession(\n    request: AuthRequest,\n  ): Promise<Session> {\n    const shop = extractShop(request);\n    if (!shop) {\n      throw new Error(\n        'Could not extract shop domain from request.',\n      );\n    }\n\n    const sessionToken = extractSessionToken(request);\n    if (!sessionToken) {\n      throw new Error(\n        'Could not extract session token from Authorization header.',\n      );\n    }\n\n    // Perform online token exchange\n    const onlineExchangeInput: Parameters<typeof performTokenExchange>[0] = {\n      config: this.config,\n      sessionToken,\n      shop,\n      tokenType: 'online',\n    };\n    if (this.tokenExchangeFn) {\n      onlineExchangeInput.tokenExchangeFn = this.tokenExchangeFn;\n    }\n    const session = await performTokenExchange(onlineExchangeInput);\n\n    // Store the session (encrypted)\n    await this.encryptedStorage.storeSession(session);\n\n    return session;\n  }\n\n  /**\n   * Refresh an expiring session token.\n   *\n   * Retries up to `config.tokenRefresh.maxRetries` on failure.\n   * On success, stores the refreshed session (encrypted) and emits\n   * a `token_refreshed` event. On final failure, emits\n   * `token_refresh_failed` and throws.\n   */\n  async refreshSessionToken(session: Session): Promise<Session> {\n    const maxRetries = this.config.tokenRefresh?.maxRetries ?? 3;\n    const refreshFn =\n      this.tokenRefreshFn ?? (await this.createDefaultRefreshFn());\n\n    let lastError: Error | undefined;\n\n    for (let attempt = 0; attempt < maxRetries; attempt++) {\n      try {\n        const refreshInput: {\n          accessToken?: string;\n          refreshToken?: string;\n          shop: string;\n        } = { shop: session.shop };\n        if (session.accessToken) {\n          refreshInput.accessToken = session.accessToken;\n        }\n        if (session.refreshToken) {\n          refreshInput.refreshToken = session.refreshToken;\n        }\n        const { session: refreshedShopifySession } = await refreshFn({\n          session: refreshInput,\n        });\n\n        const now = new Date();\n        const refreshedSession = this.mapRefreshedSession(\n          refreshedShopifySession,\n          session,\n          now,\n        );\n\n        // Store the refreshed session (encrypted)\n        await this.encryptedStorage.storeSession(refreshedSession);\n\n        if (this.config.eventHandler) {\n          const event = createAuthEvent({\n            type: 'token_refreshed',\n            shopDomain: session.shop,\n            outcome: 'success',\n            sessionId: session.id,\n            metadata: { attempt: String(attempt + 1) },\n          });\n          await Promise.resolve(\n            this.config.eventHandler.onAuthEvent(event),\n          );\n        }\n\n        return refreshedSession;\n      } catch (error) {\n        lastError =\n          error instanceof Error ? error : new Error(String(error));\n      }\n    }\n\n    // All retries exhausted\n    if (this.config.eventHandler) {\n      const event = createAuthEvent({\n        type: 'token_refresh_failed',\n        shopDomain: session.shop,\n        outcome: 'failure',\n        sessionId: session.id,\n        metadata: {\n          maxRetries: String(maxRetries),\n          error: lastError?.message ?? 'Unknown error',\n        },\n      });\n      await Promise.resolve(this.config.eventHandler.onAuthEvent(event));\n    }\n\n    throw lastError ?? new Error('Token refresh failed after all retries.');\n  }\n\n  /**\n   * Delete all sessions for a shop (e.g., on app uninstall).\n   *\n   * Finds all sessions via `findSessionsByShop`, deletes them,\n   * and emits `session_deleted` events.\n   */\n  async cleanupShopSessions(shop: string): Promise<void> {\n    const sessions =\n      await this.config.sessionStorage.findSessionsByShop(shop);\n\n    if (sessions.length === 0) {\n      return;\n    }\n\n    const sessionIds = sessions.map((s) => s.id);\n    await this.config.sessionStorage.deleteSessions(sessionIds);\n\n    if (this.config.eventHandler) {\n      for (const session of sessions) {\n        const event = createAuthEvent({\n          type: 'session_deleted',\n          shopDomain: shop,\n          outcome: 'success',\n          sessionId: session.id,\n          metadata: { reason: 'shop_cleanup' },\n        });\n        await Promise.resolve(\n          this.config.eventHandler.onAuthEvent(event),\n        );\n      }\n    }\n  }\n\n  private isExpired(session: Session): boolean {\n    if (!session.expires) {\n      return false; // Non-expiring offline session\n    }\n    return session.expires.getTime() <= Date.now();\n  }\n\n  private mapRefreshedSession(\n    refreshed: {\n      id: string;\n      shop: string;\n      state: string;\n      isOnline: boolean;\n      scope?: string;\n      expires?: Date;\n      accessToken?: string;\n      refreshToken?: string;\n    },\n    original: Session,\n    now: Date,\n  ): Session {\n    const session: Session = {\n      id: refreshed.id || original.id,\n      shop: refreshed.shop || original.shop,\n      state: refreshed.state || original.state,\n      isOnline: refreshed.isOnline,\n      scope: refreshed.scope || original.scope,\n      expires: refreshed.expires ?? original.expires,\n      createdAt: original.createdAt,\n      updatedAt: now,\n    };\n\n    if (refreshed.accessToken) {\n      (session as any).accessToken = refreshed.accessToken;\n    }\n\n    if (refreshed.refreshToken) {\n      (session as any).refreshToken = refreshed.refreshToken;\n    }\n\n    return session;\n  }\n\n  private async createDefaultRefreshFn(): Promise<ShopifyTokenRefreshFn> {\n    const { shopifyApi, LogSeverity } = await import('@shopify/shopify-api');\n    await import('@shopify/shopify-api/adapters/node');\n\n    const shopify = shopifyApi({\n      apiKey: this.config.apiKey,\n      apiSecretKey: this.config.apiSecretKey,\n      scopes: this.config.scopes,\n      hostName: this.config.hostName,\n      apiVersion: this.config.apiVersion as any,\n      isEmbeddedApp: this.config.isEmbeddedApp ?? true,\n      logger: { level: LogSeverity.Error },\n    });\n\n    return async (params) => {\n      const result = await (shopify.auth as any).refreshToken(params);\n      return result;\n    };\n  }\n}\n","/**\n * HMAC validation for Shopify OAuth callbacks.\n *\n * Validates the HMAC signature on OAuth callback query parameters\n * using timing-safe comparison to prevent timing attacks.\n */\n\nimport { createHmac, timingSafeEqual } from 'node:crypto';\n\n/**\n * Validate the HMAC signature on OAuth callback query parameters.\n *\n * Per Shopify's spec: remove the `hmac` parameter, sort remaining\n * params alphabetically, join as `key=value` with `&`, and compute\n * HMAC-SHA256 with the app's API secret key. Compare using\n * timing-safe equality.\n */\nexport function validateOAuthHmac(\n  query: Record<string, string>,\n  secret: string,\n): boolean {\n  const hmac = query['hmac'];\n  if (!hmac) {\n    return false;\n  }\n\n  const entries = Object.entries(query)\n    .filter(([key]) => key !== 'hmac')\n    .sort(([a], [b]) => a.localeCompare(b));\n\n  const message = entries\n    .map(([key, value]) => `${key}=${value}`)\n    .join('&');\n\n  const computed = createHmac('sha256', secret)\n    .update(message)\n    .digest('hex');\n\n  // Use timing-safe comparison to prevent timing attacks\n  if (computed.length !== hmac.length) {\n    return false;\n  }\n\n  return timingSafeEqual(\n    Buffer.from(computed, 'utf-8'),\n    Buffer.from(hmac, 'utf-8'),\n  );\n}\n","/**\n * OAuth authorization code flow for non-embedded Shopify apps.\n *\n * Implements the begin (redirect to Shopify) and callback\n * (exchange code for access token) phases of the OAuth flow.\n */\n\nimport { randomUUID } from 'node:crypto';\nimport type {\n  AuthConfig,\n  AuthRequest,\n  Session,\n} from '@uniforge/platform-core/auth';\nimport { isValidShopDomain } from '@uniforge/platform-core/auth';\nimport { createAuthEvent } from '@uniforge/core/auth';\nimport {\n  TokenEncryptionServiceImpl,\n  EncryptedSessionStorage,\n} from '@uniforge/core/auth';\nimport { validateOAuthHmac } from './hmac';\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/**\n * Injectable function for initiating OAuth.\n * In production, wraps `shopify.auth.begin()`.\n */\nexport interface ShopifyOAuthBeginFn {\n  (params: {\n    shop: string;\n    callbackPath: string;\n    isOnline: boolean;\n  }): Promise<{ redirectUrl: string }>;\n}\n\n/**\n * Injectable function for handling the OAuth callback.\n * In production, wraps `shopify.auth.callback()`.\n */\nexport interface ShopifyOAuthCallbackFn {\n  (params: {\n    query: Record<string, string>;\n  }): Promise<{\n    session: {\n      id: string;\n      shop: string;\n      state: string;\n      isOnline: boolean;\n      scope?: string;\n      expires?: Date;\n      accessToken?: string;\n      refreshToken?: string;\n    };\n  }>;\n}\n\n/** Input parameters for beginning the OAuth authorization flow. */\nexport interface BeginOAuthInput {\n  config: AuthConfig;\n  request: AuthRequest;\n  callbackPath: string;\n  isOnline?: boolean;\n  beginFn?: ShopifyOAuthBeginFn;\n}\n\n/** Result from beginning OAuth containing the authorization redirect URL. */\nexport interface BeginOAuthResult {\n  redirectUrl: string;\n}\n\n/** Input parameters for handling the OAuth callback from Shopify. */\nexport interface HandleOAuthCallbackInput {\n  config: AuthConfig;\n  request: AuthRequest;\n  callbackFn?: ShopifyOAuthCallbackFn;\n}\n\n/** Result from OAuth callback — either success with session or failure with error details. */\nexport type OAuthCallbackResult =\n  | { success: true; session: Session; redirectUrl: string }\n  | { success: false; error: { code: string; message: string; statusCode: number } };\n\n// ---------------------------------------------------------------------------\n// Begin OAuth\n// ---------------------------------------------------------------------------\n\n/**\n * Initiate OAuth by redirecting the merchant to Shopify's authorization page.\n */\nexport async function beginOAuth(\n  input: BeginOAuthInput,\n): Promise<BeginOAuthResult> {\n  const { config, request, callbackPath, isOnline } = input;\n\n  const shop = request.query['shop'];\n  if (!shop || !isValidShopDomain(shop)) {\n    throw new Error(\n      'Could not extract valid shop domain from request. Provide shop in query parameter.',\n    );\n  }\n\n  const beginFn = input.beginFn ?? (await createShopifyOAuthBeginFn(config));\n\n  const { redirectUrl } = await beginFn({\n    shop,\n    callbackPath,\n    isOnline: isOnline ?? false,\n  });\n\n  if (config.eventHandler) {\n    const event = createAuthEvent({\n      type: 'oauth_begin',\n      shopDomain: shop,\n      outcome: 'success',\n      metadata: { callbackPath },\n    });\n    await Promise.resolve(config.eventHandler.onAuthEvent(event));\n  }\n\n  return { redirectUrl };\n}\n\n// ---------------------------------------------------------------------------\n// Handle OAuth Callback\n// ---------------------------------------------------------------------------\n\n/**\n * Handle the OAuth callback from Shopify.\n *\n * Validates HMAC, checks for authorization denial, exchanges the code\n * for an access token, validates scopes, stores the session encrypted,\n * and emits events.\n */\nexport async function handleOAuthCallback(\n  input: HandleOAuthCallbackInput,\n): Promise<OAuthCallbackResult> {\n  const { config, request } = input;\n  const query = request.query;\n  const shop = query['shop'] ?? '';\n\n  // Check for authorization denial (Shopify sends error param)\n  if (query['error']) {\n    const errorDesc =\n      query['error_description'] ?? `Authorization ${query['error']}`;\n\n    if (config.eventHandler) {\n      const event = createAuthEvent({\n        type: 'oauth_callback_failure',\n        shopDomain: shop,\n        outcome: 'failure',\n        metadata: {\n          error: query['error'],\n          errorDescription: errorDesc,\n        },\n      });\n      await Promise.resolve(config.eventHandler.onAuthEvent(event));\n    }\n\n    return {\n      success: false,\n      error: {\n        code: 'ACCESS_DENIED',\n        message: errorDesc,\n        statusCode: 403,\n      },\n    };\n  }\n\n  // Validate HMAC\n  if (!validateOAuthHmac(query, config.apiSecretKey)) {\n    if (config.eventHandler) {\n      const event = createAuthEvent({\n        type: 'oauth_callback_failure',\n        shopDomain: shop,\n        outcome: 'failure',\n        metadata: { error: 'HMAC validation failed' },\n      });\n      await Promise.resolve(config.eventHandler.onAuthEvent(event));\n    }\n\n    return {\n      success: false,\n      error: {\n        code: 'HMAC_VALIDATION_FAILED',\n        message: 'HMAC validation failed on OAuth callback.',\n        statusCode: 403,\n      },\n    };\n  }\n\n  // Exchange the authorization code for an access token\n  try {\n    const callbackFn =\n      input.callbackFn ?? (await createShopifyOAuthCallbackFn(config));\n\n    const { session: shopifySession } = await callbackFn({ query });\n\n    const now = new Date();\n    const session = mapOAuthSession(shopifySession, shop, now);\n\n    // Validate scopes\n    const grantedScopes = new Set(\n      (session.scope || '').split(',').map((s) => s.trim()),\n    );\n    const requiredScopes = config.scopes;\n    const missingScopes = requiredScopes.filter(\n      (scope) => !grantedScopes.has(scope),\n    );\n\n    if (missingScopes.length > 0) {\n      if (config.eventHandler) {\n        const event = createAuthEvent({\n          type: 'oauth_callback_failure',\n          shopDomain: shop,\n          outcome: 'failure',\n          metadata: {\n            error: 'scope_mismatch',\n            missingScopes: missingScopes.join(','),\n          },\n        });\n        await Promise.resolve(config.eventHandler.onAuthEvent(event));\n      }\n\n      return {\n        success: false,\n        error: {\n          code: 'SCOPE_MISMATCH',\n          message: `Missing required scopes: ${missingScopes.join(', ')}. Granted: ${session.scope}`,\n          statusCode: 403,\n        },\n      };\n    }\n\n    // Store the session encrypted\n    const encryption = new TokenEncryptionServiceImpl(config.encryption);\n    const encryptedStorage = new EncryptedSessionStorage(\n      config.sessionStorage,\n      encryption,\n    );\n    await encryptedStorage.storeSession(session);\n\n    if (config.eventHandler) {\n      const event = createAuthEvent({\n        type: 'oauth_callback_success',\n        shopDomain: shop,\n        outcome: 'success',\n        sessionId: session.id,\n        metadata: { scope: session.scope },\n      });\n      await Promise.resolve(config.eventHandler.onAuthEvent(event));\n    }\n\n    return {\n      success: true,\n      session,\n      redirectUrl: `${config.hostName}/?shop=${shop}`,\n    };\n  } catch (error) {\n    if (config.eventHandler) {\n      const event = createAuthEvent({\n        type: 'oauth_callback_failure',\n        shopDomain: shop,\n        outcome: 'failure',\n        metadata: {\n          error: error instanceof Error ? error.message : String(error),\n        },\n      });\n      await Promise.resolve(config.eventHandler.onAuthEvent(event));\n    }\n\n    return {\n      success: false,\n      error: {\n        code: 'OAUTH_CALLBACK_FAILED',\n        message: error instanceof Error ? error.message : String(error),\n        statusCode: 500,\n      },\n    };\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Shopify API factory functions (production use)\n// ---------------------------------------------------------------------------\n\nasync function createShopifyOAuthBeginFn(\n  config: AuthConfig,\n): Promise<ShopifyOAuthBeginFn> {\n  // Construct the OAuth authorization URL using config values.\n  // The Shopify API's begin() method performs a redirect on the raw response,\n  // but our abstraction returns the URL instead so framework adapters can handle it.\n  return async (params) => {\n    const nonce = randomUUID();\n    const scopeString = config.scopes.join(',');\n    const redirectUri = `${config.hostName}${params.callbackPath}`;\n    const redirectUrl = `https://${params.shop}/admin/oauth/authorize?client_id=${config.apiKey}&scope=${encodeURIComponent(scopeString)}&redirect_uri=${encodeURIComponent(redirectUri)}&state=${nonce}`;\n    return { redirectUrl };\n  };\n}\n\nasync function createShopifyOAuthCallbackFn(\n  config: AuthConfig,\n): Promise<ShopifyOAuthCallbackFn> {\n  const { shopifyApi, LogSeverity } = await import('@shopify/shopify-api');\n  await import('@shopify/shopify-api/adapters/node');\n\n  const shopify = shopifyApi({\n    apiKey: config.apiKey,\n    apiSecretKey: config.apiSecretKey,\n    scopes: config.scopes,\n    hostName: config.hostName,\n    apiVersion: config.apiVersion as any,\n    isEmbeddedApp: config.isEmbeddedApp ?? false,\n    logger: { level: LogSeverity.Error },\n  });\n\n  return async (params) => {\n    const result = await (shopify.auth.callback as any)(params);\n    return result;\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Session mapping\n// ---------------------------------------------------------------------------\n\nfunction mapOAuthSession(\n  shopifySession: {\n    id: string;\n    shop: string;\n    state: string;\n    isOnline: boolean;\n    scope?: string;\n    expires?: Date;\n    accessToken?: string;\n    refreshToken?: string;\n  },\n  shop: string,\n  now: Date,\n): Session {\n  const session: Session = {\n    id: shopifySession.id,\n    shop: shopifySession.shop || shop,\n    state: shopifySession.state || randomUUID(),\n    isOnline: shopifySession.isOnline,\n    scope: shopifySession.scope || '',\n    expires: shopifySession.expires ?? null,\n    createdAt: now,\n    updatedAt: now,\n  };\n\n  if (shopifySession.accessToken) {\n    (session as any).accessToken = shopifySession.accessToken;\n  }\n\n  if (shopifySession.refreshToken) {\n    (session as any).refreshToken = shopifySession.refreshToken;\n  }\n\n  return session;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACOA,yBAA2B;AAM3B,kBAAkC;AAClC,IAAAA,eAAgC;AAMzB,SAAS,oBAAoB,SAAqC;AAEvE,QAAM,aACJ,QAAQ,QAAQ,eAAe,KAAK,QAAQ,QAAQ,eAAe;AAErE,MAAI,CAAC,cAAc,OAAO,eAAe,UAAU;AACjD,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,WAAW,WAAW,SAAS,GAAG;AACrC,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,WAAW,MAAM,UAAU,MAAM,EAAE,KAAK;AACtD,SAAO,MAAM,SAAS,IAAI,QAAQ;AACpC;AAOO,SAAS,YAAY,SAAqC;AAE/D,QAAM,gBAAgB,QAAQ,MAAM,MAAM;AAC1C,MAAI,qBAAiB,+BAAkB,aAAa,GAAG;AACrD,WAAO;AAAA,EACT;AAGA,QAAM,iBAAiB,QAAQ,QAAQ,uBAAuB;AAC9D,MACE,kBACA,OAAO,mBAAmB,gBAC1B,+BAAkB,cAAc,GAChC;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAuCA,eAAsB,6BACpB,QACiC;AACjC,QAAM,EAAE,YAAY,YAAY,IAAI,MAAM,OAAO,sBAAsB;AACvE,QAAM,OAAO,oCAAoC;AAEjD,QAAM,UAAU,WAAW;AAAA,IACzB,QAAQ,OAAO;AAAA,IACf,cAAc,OAAO;AAAA,IACrB,QAAQ,OAAO;AAAA,IACf,UAAU,OAAO;AAAA,IACjB,YAAY,OAAO;AAAA,IACnB,eAAe,OAAO,iBAAiB;AAAA,IACvC,QAAQ,EAAE,OAAO,YAAY,MAAM;AAAA,EACrC,CAAC;AAED,SAAO,QAAQ,KAAK;AACtB;AAQA,eAAsB,qBACpB,OACkB;AAClB,QAAM,EAAE,QAAQ,cAAc,MAAM,UAAU,IAAI;AAElD,MAAI,CAAC,cAAc;AACjB,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAEA,MAAI,KAAC,+BAAkB,IAAI,GAAG;AAC5B,UAAM,IAAI;AAAA,MACR,wBAAwB,IAAI;AAAA,IAC9B;AAAA,EACF;AAEA,QAAM,kBACJ,MAAM,mBAAoB,MAAM,6BAA6B,MAAM;AAErE,QAAM,qBACJ,cAAc,WACV,4DACA;AAEN,MAAI;AACF,UAAM,EAAE,SAAS,eAAe,IAAI,MAAM,gBAAgB;AAAA,MACxD;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,UAAU,kBAAkB,gBAAgB,MAAM,GAAG;AAE3D,QAAI,OAAO,cAAc;AACvB,YAAM,YAAQ,8BAAgB;AAAA,QAC5B,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,SAAS;AAAA,QACT,WAAW,QAAQ;AAAA,QACnB,UAAU;AAAA,UACR;AAAA,UACA,WAAW,QAAQ;AAAA,QACrB;AAAA,MACF,CAAC;AACD,YAAM,QAAQ,QAAQ,OAAO,aAAa,YAAY,KAAK,CAAC;AAAA,IAC9D;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,OAAO,cAAc;AACvB,YAAM,YAAQ,8BAAgB;AAAA,QAC5B,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,SAAS;AAAA,QACT,UAAU;AAAA,UACR;AAAA,UACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,QAC9D;AAAA,MACF,CAAC;AACD,YAAM,QAAQ,QAAQ,OAAO,aAAa,YAAY,KAAK,CAAC;AAAA,IAC9D;AAEA,UAAM;AAAA,EACR;AACF;AAKA,SAAS,kBACP,gBAWA,MACA,KACS;AACT,QAAM,UAAmB;AAAA,IACvB,IAAI,eAAe;AAAA,IACnB,MAAM,eAAe,QAAQ;AAAA,IAC7B,OAAO,eAAe,aAAS,+BAAW;AAAA,IAC1C,UAAU,eAAe;AAAA,IACzB,OAAO,eAAe,SAAS;AAAA,IAC/B,SAAS,eAAe,WAAW;AAAA,IACnC,WAAW;AAAA,IACX,WAAW;AAAA,EACb;AAEA,MAAI,eAAe,aAAa;AAC9B,IAAC,QAAgB,cAAc,eAAe;AAAA,EAChD;AAEA,MAAI,eAAe,cAAc;AAC/B,IAAC,QAAgB,eAAe,eAAe;AAAA,EACjD;AAEA,MAAI,eAAe,kBAAkB;AACnC,UAAM,OAAO,eAAe;AAC5B,IAAC,QAAgB,mBAAmB;AAAA,MAClC,WAAW,KAAK,cAAc,KAAK,aAAa;AAAA,MAChD,qBACE,KAAK,yBAAyB,KAAK,uBAAuB;AAAA,MAC5D,gBAAgB,KAAK,kBACjB;AAAA,QACE,IAAI,KAAK,gBAAgB;AAAA,QACzB,WAAW,KAAK,gBAAgB;AAAA,QAChC,UAAU,KAAK,gBAAgB;AAAA,QAC/B,OAAO,KAAK,gBAAgB;AAAA,QAC5B,eAAe,KAAK,gBAAgB;AAAA,QACpC,cAAc,KAAK,gBAAgB;AAAA,QACnC,QAAQ,KAAK,gBAAgB;AAAA,QAC7B,cAAc,KAAK,gBAAgB;AAAA,MACrC,IACA,KAAK;AAAA,IACX;AAAA,EACF;AAEA,SAAO;AACT;;;AC3OA,IAAAC,eAIO;AAyCA,IAAM,wBAAN,MAA4B;AAAA,EAKjC,YACmB,QACjB,SACA;AAFiB;AAGjB,UAAM,aAAa,IAAI,wCAA2B,OAAO,UAAU;AACnE,SAAK,mBAAmB,IAAI;AAAA,MAC1B,OAAO;AAAA,MACP;AAAA,IACF;AACA,QAAI,SAAS,iBAAiB;AAC5B,WAAK,kBAAkB,QAAQ;AAAA,IACjC;AACA,QAAI,SAAS,gBAAgB;AAC3B,WAAK,iBAAiB,QAAQ;AAAA,IAChC;AAAA,EACF;AAAA,EAnBiB;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4BjB,MAAM,mBAAmB,SAAwC;AAC/D,UAAM,OAAO,YAAY,OAAO;AAChC,QAAI,CAAC,MAAM;AACT,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,eAAe,oBAAoB,OAAO;AAChD,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAGA,UAAM,YAAY,WAAW,IAAI;AACjC,UAAM,kBAAkB,MAAM,KAAK,iBAAiB,YAAY,SAAS;AAEzE,QAAI,mBAAmB,CAAC,KAAK,UAAU,eAAe,GAAG;AACvD,aAAO;AAAA,IACT;AAGA,UAAM,gBAA4D;AAAA,MAChE,QAAQ,KAAK;AAAA,MACb;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb;AACA,QAAI,KAAK,iBAAiB;AACxB,oBAAc,kBAAkB,KAAK;AAAA,IACvC;AACA,UAAM,UAAU,MAAM,qBAAqB,aAAa;AAGxD,UAAM,KAAK,iBAAiB,aAAa,OAAO;AAEhD,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,yBACJ,SACkB;AAClB,UAAM,OAAO,YAAY,OAAO;AAChC,QAAI,CAAC,MAAM;AACT,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,eAAe,oBAAoB,OAAO;AAChD,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAGA,UAAM,sBAAkE;AAAA,MACtE,QAAQ,KAAK;AAAA,MACb;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb;AACA,QAAI,KAAK,iBAAiB;AACxB,0BAAoB,kBAAkB,KAAK;AAAA,IAC7C;AACA,UAAM,UAAU,MAAM,qBAAqB,mBAAmB;AAG9D,UAAM,KAAK,iBAAiB,aAAa,OAAO;AAEhD,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,oBAAoB,SAAoC;AAC5D,UAAM,aAAa,KAAK,OAAO,cAAc,cAAc;AAC3D,UAAM,YACJ,KAAK,kBAAmB,MAAM,KAAK,uBAAuB;AAE5D,QAAI;AAEJ,aAAS,UAAU,GAAG,UAAU,YAAY,WAAW;AACrD,UAAI;AACF,cAAM,eAIF,EAAE,MAAM,QAAQ,KAAK;AACzB,YAAI,QAAQ,aAAa;AACvB,uBAAa,cAAc,QAAQ;AAAA,QACrC;AACA,YAAI,QAAQ,cAAc;AACxB,uBAAa,eAAe,QAAQ;AAAA,QACtC;AACA,cAAM,EAAE,SAAS,wBAAwB,IAAI,MAAM,UAAU;AAAA,UAC3D,SAAS;AAAA,QACX,CAAC;AAED,cAAM,MAAM,oBAAI,KAAK;AACrB,cAAM,mBAAmB,KAAK;AAAA,UAC5B;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAGA,cAAM,KAAK,iBAAiB,aAAa,gBAAgB;AAEzD,YAAI,KAAK,OAAO,cAAc;AAC5B,gBAAM,YAAQ,8BAAgB;AAAA,YAC5B,MAAM;AAAA,YACN,YAAY,QAAQ;AAAA,YACpB,SAAS;AAAA,YACT,WAAW,QAAQ;AAAA,YACnB,UAAU,EAAE,SAAS,OAAO,UAAU,CAAC,EAAE;AAAA,UAC3C,CAAC;AACD,gBAAM,QAAQ;AAAA,YACZ,KAAK,OAAO,aAAa,YAAY,KAAK;AAAA,UAC5C;AAAA,QACF;AAEA,eAAO;AAAA,MACT,SAAS,OAAO;AACd,oBACE,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AAAA,MAC5D;AAAA,IACF;AAGA,QAAI,KAAK,OAAO,cAAc;AAC5B,YAAM,YAAQ,8BAAgB;AAAA,QAC5B,MAAM;AAAA,QACN,YAAY,QAAQ;AAAA,QACpB,SAAS;AAAA,QACT,WAAW,QAAQ;AAAA,QACnB,UAAU;AAAA,UACR,YAAY,OAAO,UAAU;AAAA,UAC7B,OAAO,WAAW,WAAW;AAAA,QAC/B;AAAA,MACF,CAAC;AACD,YAAM,QAAQ,QAAQ,KAAK,OAAO,aAAa,YAAY,KAAK,CAAC;AAAA,IACnE;AAEA,UAAM,aAAa,IAAI,MAAM,yCAAyC;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,oBAAoB,MAA6B;AACrD,UAAM,WACJ,MAAM,KAAK,OAAO,eAAe,mBAAmB,IAAI;AAE1D,QAAI,SAAS,WAAW,GAAG;AACzB;AAAA,IACF;AAEA,UAAM,aAAa,SAAS,IAAI,CAAC,MAAM,EAAE,EAAE;AAC3C,UAAM,KAAK,OAAO,eAAe,eAAe,UAAU;AAE1D,QAAI,KAAK,OAAO,cAAc;AAC5B,iBAAW,WAAW,UAAU;AAC9B,cAAM,YAAQ,8BAAgB;AAAA,UAC5B,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,SAAS;AAAA,UACT,WAAW,QAAQ;AAAA,UACnB,UAAU,EAAE,QAAQ,eAAe;AAAA,QACrC,CAAC;AACD,cAAM,QAAQ;AAAA,UACZ,KAAK,OAAO,aAAa,YAAY,KAAK;AAAA,QAC5C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,UAAU,SAA2B;AAC3C,QAAI,CAAC,QAAQ,SAAS;AACpB,aAAO;AAAA,IACT;AACA,WAAO,QAAQ,QAAQ,QAAQ,KAAK,KAAK,IAAI;AAAA,EAC/C;AAAA,EAEQ,oBACN,WAUA,UACA,KACS;AACT,UAAM,UAAmB;AAAA,MACvB,IAAI,UAAU,MAAM,SAAS;AAAA,MAC7B,MAAM,UAAU,QAAQ,SAAS;AAAA,MACjC,OAAO,UAAU,SAAS,SAAS;AAAA,MACnC,UAAU,UAAU;AAAA,MACpB,OAAO,UAAU,SAAS,SAAS;AAAA,MACnC,SAAS,UAAU,WAAW,SAAS;AAAA,MACvC,WAAW,SAAS;AAAA,MACpB,WAAW;AAAA,IACb;AAEA,QAAI,UAAU,aAAa;AACzB,MAAC,QAAgB,cAAc,UAAU;AAAA,IAC3C;AAEA,QAAI,UAAU,cAAc;AAC1B,MAAC,QAAgB,eAAe,UAAU;AAAA,IAC5C;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,yBAAyD;AACrE,UAAM,EAAE,YAAY,YAAY,IAAI,MAAM,OAAO,sBAAsB;AACvE,UAAM,OAAO,oCAAoC;AAEjD,UAAM,UAAU,WAAW;AAAA,MACzB,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc,KAAK,OAAO;AAAA,MAC1B,QAAQ,KAAK,OAAO;AAAA,MACpB,UAAU,KAAK,OAAO;AAAA,MACtB,YAAY,KAAK,OAAO;AAAA,MACxB,eAAe,KAAK,OAAO,iBAAiB;AAAA,MAC5C,QAAQ,EAAE,OAAO,YAAY,MAAM;AAAA,IACrC,CAAC;AAED,WAAO,OAAO,WAAW;AACvB,YAAM,SAAS,MAAO,QAAQ,KAAa,aAAa,MAAM;AAC9D,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;ACjVA,IAAAC,sBAA4C;AAUrC,SAAS,kBACd,OACA,QACS;AACT,QAAM,OAAO,MAAM,MAAM;AACzB,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,OAAO,QAAQ,KAAK,EACjC,OAAO,CAAC,CAAC,GAAG,MAAM,QAAQ,MAAM,EAChC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAExC,QAAM,UAAU,QACb,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,GAAG,GAAG,IAAI,KAAK,EAAE,EACvC,KAAK,GAAG;AAEX,QAAM,eAAW,gCAAW,UAAU,MAAM,EACzC,OAAO,OAAO,EACd,OAAO,KAAK;AAGf,MAAI,SAAS,WAAW,KAAK,QAAQ;AACnC,WAAO;AAAA,EACT;AAEA,aAAO;AAAA,IACL,OAAO,KAAK,UAAU,OAAO;AAAA,IAC7B,OAAO,KAAK,MAAM,OAAO;AAAA,EAC3B;AACF;;;ACxCA,IAAAC,sBAA2B;AAM3B,IAAAC,eAAkC;AAClC,IAAAA,eAAgC;AAChC,IAAAA,eAGO;AAyEP,eAAsB,WACpB,OAC2B;AAC3B,QAAM,EAAE,QAAQ,SAAS,cAAc,SAAS,IAAI;AAEpD,QAAM,OAAO,QAAQ,MAAM,MAAM;AACjC,MAAI,CAAC,QAAQ,KAAC,gCAAkB,IAAI,GAAG;AACrC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,WAAY,MAAM,0BAA0B,MAAM;AAExE,QAAM,EAAE,YAAY,IAAI,MAAM,QAAQ;AAAA,IACpC;AAAA,IACA;AAAA,IACA,UAAU,YAAY;AAAA,EACxB,CAAC;AAED,MAAI,OAAO,cAAc;AACvB,UAAM,YAAQ,8BAAgB;AAAA,MAC5B,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,SAAS;AAAA,MACT,UAAU,EAAE,aAAa;AAAA,IAC3B,CAAC;AACD,UAAM,QAAQ,QAAQ,OAAO,aAAa,YAAY,KAAK,CAAC;AAAA,EAC9D;AAEA,SAAO,EAAE,YAAY;AACvB;AAaA,eAAsB,oBACpB,OAC8B;AAC9B,QAAM,EAAE,QAAQ,QAAQ,IAAI;AAC5B,QAAM,QAAQ,QAAQ;AACtB,QAAM,OAAO,MAAM,MAAM,KAAK;AAG9B,MAAI,MAAM,OAAO,GAAG;AAClB,UAAM,YACJ,MAAM,mBAAmB,KAAK,iBAAiB,MAAM,OAAO,CAAC;AAE/D,QAAI,OAAO,cAAc;AACvB,YAAM,YAAQ,8BAAgB;AAAA,QAC5B,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,SAAS;AAAA,QACT,UAAU;AAAA,UACR,OAAO,MAAM,OAAO;AAAA,UACpB,kBAAkB;AAAA,QACpB;AAAA,MACF,CAAC;AACD,YAAM,QAAQ,QAAQ,OAAO,aAAa,YAAY,KAAK,CAAC;AAAA,IAC9D;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS;AAAA,QACT,YAAY;AAAA,MACd;AAAA,IACF;AAAA,EACF;AAGA,MAAI,CAAC,kBAAkB,OAAO,OAAO,YAAY,GAAG;AAClD,QAAI,OAAO,cAAc;AACvB,YAAM,YAAQ,8BAAgB;AAAA,QAC5B,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,SAAS;AAAA,QACT,UAAU,EAAE,OAAO,yBAAyB;AAAA,MAC9C,CAAC;AACD,YAAM,QAAQ,QAAQ,OAAO,aAAa,YAAY,KAAK,CAAC;AAAA,IAC9D;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS;AAAA,QACT,YAAY;AAAA,MACd;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AACF,UAAM,aACJ,MAAM,cAAe,MAAM,6BAA6B,MAAM;AAEhE,UAAM,EAAE,SAAS,eAAe,IAAI,MAAM,WAAW,EAAE,MAAM,CAAC;AAE9D,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,UAAU,gBAAgB,gBAAgB,MAAM,GAAG;AAGzD,UAAM,gBAAgB,IAAI;AAAA,OACvB,QAAQ,SAAS,IAAI,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;AAAA,IACtD;AACA,UAAM,iBAAiB,OAAO;AAC9B,UAAM,gBAAgB,eAAe;AAAA,MACnC,CAAC,UAAU,CAAC,cAAc,IAAI,KAAK;AAAA,IACrC;AAEA,QAAI,cAAc,SAAS,GAAG;AAC5B,UAAI,OAAO,cAAc;AACvB,cAAM,YAAQ,8BAAgB;AAAA,UAC5B,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,SAAS;AAAA,UACT,UAAU;AAAA,YACR,OAAO;AAAA,YACP,eAAe,cAAc,KAAK,GAAG;AAAA,UACvC;AAAA,QACF,CAAC;AACD,cAAM,QAAQ,QAAQ,OAAO,aAAa,YAAY,KAAK,CAAC;AAAA,MAC9D;AAEA,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO;AAAA,UACL,MAAM;AAAA,UACN,SAAS,4BAA4B,cAAc,KAAK,IAAI,CAAC,cAAc,QAAQ,KAAK;AAAA,UACxF,YAAY;AAAA,QACd;AAAA,MACF;AAAA,IACF;AAGA,UAAM,aAAa,IAAI,wCAA2B,OAAO,UAAU;AACnE,UAAM,mBAAmB,IAAI;AAAA,MAC3B,OAAO;AAAA,MACP;AAAA,IACF;AACA,UAAM,iBAAiB,aAAa,OAAO;AAE3C,QAAI,OAAO,cAAc;AACvB,YAAM,YAAQ,8BAAgB;AAAA,QAC5B,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,SAAS;AAAA,QACT,WAAW,QAAQ;AAAA,QACnB,UAAU,EAAE,OAAO,QAAQ,MAAM;AAAA,MACnC,CAAC;AACD,YAAM,QAAQ,QAAQ,OAAO,aAAa,YAAY,KAAK,CAAC;AAAA,IAC9D;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT;AAAA,MACA,aAAa,GAAG,OAAO,QAAQ,UAAU,IAAI;AAAA,IAC/C;AAAA,EACF,SAAS,OAAO;AACd,QAAI,OAAO,cAAc;AACvB,YAAM,YAAQ,8BAAgB;AAAA,QAC5B,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,SAAS;AAAA,QACT,UAAU;AAAA,UACR,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,QAC9D;AAAA,MACF,CAAC;AACD,YAAM,QAAQ,QAAQ,OAAO,aAAa,YAAY,KAAK,CAAC;AAAA,IAC9D;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,QAC9D,YAAY;AAAA,MACd;AAAA,IACF;AAAA,EACF;AACF;AAMA,eAAe,0BACb,QAC8B;AAI9B,SAAO,OAAO,WAAW;AACvB,UAAM,YAAQ,gCAAW;AACzB,UAAM,cAAc,OAAO,OAAO,KAAK,GAAG;AAC1C,UAAM,cAAc,GAAG,OAAO,QAAQ,GAAG,OAAO,YAAY;AAC5D,UAAM,cAAc,WAAW,OAAO,IAAI,oCAAoC,OAAO,MAAM,UAAU,mBAAmB,WAAW,CAAC,iBAAiB,mBAAmB,WAAW,CAAC,UAAU,KAAK;AACnM,WAAO,EAAE,YAAY;AAAA,EACvB;AACF;AAEA,eAAe,6BACb,QACiC;AACjC,QAAM,EAAE,YAAY,YAAY,IAAI,MAAM,OAAO,sBAAsB;AACvE,QAAM,OAAO,oCAAoC;AAEjD,QAAM,UAAU,WAAW;AAAA,IACzB,QAAQ,OAAO;AAAA,IACf,cAAc,OAAO;AAAA,IACrB,QAAQ,OAAO;AAAA,IACf,UAAU,OAAO;AAAA,IACjB,YAAY,OAAO;AAAA,IACnB,eAAe,OAAO,iBAAiB;AAAA,IACvC,QAAQ,EAAE,OAAO,YAAY,MAAM;AAAA,EACrC,CAAC;AAED,SAAO,OAAO,WAAW;AACvB,UAAM,SAAS,MAAO,QAAQ,KAAK,SAAiB,MAAM;AAC1D,WAAO;AAAA,EACT;AACF;AAMA,SAAS,gBACP,gBAUA,MACA,KACS;AACT,QAAM,UAAmB;AAAA,IACvB,IAAI,eAAe;AAAA,IACnB,MAAM,eAAe,QAAQ;AAAA,IAC7B,OAAO,eAAe,aAAS,gCAAW;AAAA,IAC1C,UAAU,eAAe;AAAA,IACzB,OAAO,eAAe,SAAS;AAAA,IAC/B,SAAS,eAAe,WAAW;AAAA,IACnC,WAAW;AAAA,IACX,WAAW;AAAA,EACb;AAEA,MAAI,eAAe,aAAa;AAC9B,IAAC,QAAgB,cAAc,eAAe;AAAA,EAChD;AAEA,MAAI,eAAe,cAAc;AAC/B,IAAC,QAAgB,eAAe,eAAe;AAAA,EACjD;AAEA,SAAO;AACT;","names":["import_auth","import_auth","import_node_crypto","import_node_crypto","import_auth"]}

package/dist/auth/index.mjs

@@ -0,0 +1,586 @@
+// src/auth/token-exchange.ts
+import { randomUUID } from "crypto";
+import { isValidShopDomain } from "@uniforge/platform-core/auth";
+import { createAuthEvent } from "@uniforge/core/auth";
+function extractSessionToken(request) {
+  const authHeader = request.headers["authorization"] ?? request.headers["Authorization"];
+  if (!authHeader || typeof authHeader !== "string") {
+    return null;
+  }
+  if (!authHeader.startsWith("Bearer ")) {
+    return null;
+  }
+  const token = authHeader.slice("Bearer ".length).trim();
+  return token.length > 0 ? token : null;
+}
+function extractShop(request) {
+  const shopFromQuery = request.query["shop"];
+  if (shopFromQuery && isValidShopDomain(shopFromQuery)) {
+    return shopFromQuery;
+  }
+  const shopFromHeader = request.headers["x-shopify-shop-domain"];
+  if (shopFromHeader && typeof shopFromHeader === "string" && isValidShopDomain(shopFromHeader)) {
+    return shopFromHeader;
+  }
+  return null;
+}
+async function createShopifyTokenExchangeFn(config) {
+  const { shopifyApi, LogSeverity } = await import("@shopify/shopify-api");
+  await import("@shopify/shopify-api/adapters/node");
+  const shopify = shopifyApi({
+    apiKey: config.apiKey,
+    apiSecretKey: config.apiSecretKey,
+    scopes: config.scopes,
+    hostName: config.hostName,
+    apiVersion: config.apiVersion,
+    isEmbeddedApp: config.isEmbeddedApp ?? true,
+    logger: { level: LogSeverity.Error }
+  });
+  return shopify.auth.tokenExchange;
+}
+async function performTokenExchange(input) {
+  const { config, sessionToken, shop, tokenType } = input;
+  if (!sessionToken) {
+    throw new Error("Session token is required for token exchange.");
+  }
+  if (!isValidShopDomain(shop)) {
+    throw new Error(
+      `Invalid shop domain "${shop}". Expected format: example.myshopify.com`
+    );
+  }
+  const tokenExchangeFn = input.tokenExchangeFn ?? await createShopifyTokenExchangeFn(config);
+  const requestedTokenType = tokenType === "online" ? "urn:shopify:params:oauth:token-type:online-access-token" : "urn:shopify:params:oauth:token-type:offline-access-token";
+  try {
+    const { session: shopifySession } = await tokenExchangeFn({
+      sessionToken,
+      shop,
+      requestedTokenType
+    });
+    const now = /* @__PURE__ */ new Date();
+    const session = mapShopifySession(shopifySession, shop, now);
+    if (config.eventHandler) {
+      const event = createAuthEvent({
+        type: "token_exchange_success",
+        shopDomain: shop,
+        outcome: "success",
+        sessionId: session.id,
+        metadata: {
+          tokenType,
+          sessionId: session.id
+        }
+      });
+      await Promise.resolve(config.eventHandler.onAuthEvent(event));
+    }
+    return session;
+  } catch (error) {
+    if (config.eventHandler) {
+      const event = createAuthEvent({
+        type: "token_exchange_failure",
+        shopDomain: shop,
+        outcome: "failure",
+        metadata: {
+          tokenType,
+          error: error instanceof Error ? error.message : String(error)
+        }
+      });
+      await Promise.resolve(config.eventHandler.onAuthEvent(event));
+    }
+    throw error;
+  }
+}
+function mapShopifySession(shopifySession, shop, now) {
+  const session = {
+    id: shopifySession.id,
+    shop: shopifySession.shop || shop,
+    state: shopifySession.state || randomUUID(),
+    isOnline: shopifySession.isOnline,
+    scope: shopifySession.scope || "",
+    expires: shopifySession.expires ?? null,
+    createdAt: now,
+    updatedAt: now
+  };
+  if (shopifySession.accessToken) {
+    session.accessToken = shopifySession.accessToken;
+  }
+  if (shopifySession.refreshToken) {
+    session.refreshToken = shopifySession.refreshToken;
+  }
+  if (shopifySession.onlineAccessInfo) {
+    const info = shopifySession.onlineAccessInfo;
+    session.onlineAccessInfo = {
+      expiresIn: info.expires_in ?? info.expiresIn ?? 0,
+      associatedUserScope: info.associated_user_scope ?? info.associatedUserScope ?? "",
+      associatedUser: info.associated_user ? {
+        id: info.associated_user.id,
+        firstName: info.associated_user.first_name,
+        lastName: info.associated_user.last_name,
+        email: info.associated_user.email,
+        emailVerified: info.associated_user.email_verified,
+        accountOwner: info.associated_user.account_owner,
+        locale: info.associated_user.locale,
+        collaborator: info.associated_user.collaborator
+      } : info.associatedUser
+    };
+  }
+  return session;
+}
+
+// src/auth/session.ts
+import {
+  TokenEncryptionServiceImpl,
+  EncryptedSessionStorage,
+  createAuthEvent as createAuthEvent2
+} from "@uniforge/core/auth";
+var ShopifySessionManager = class {
+  constructor(config, options) {
+    this.config = config;
+    const encryption = new TokenEncryptionServiceImpl(config.encryption);
+    this.encryptedStorage = new EncryptedSessionStorage(
+      config.sessionStorage,
+      encryption
+    );
+    if (options?.tokenExchangeFn) {
+      this.tokenExchangeFn = options.tokenExchangeFn;
+    }
+    if (options?.tokenRefreshFn) {
+      this.tokenRefreshFn = options.tokenRefreshFn;
+    }
+  }
+  encryptedStorage;
+  tokenExchangeFn;
+  tokenRefreshFn;
+  /**
+   * Get an existing valid session or create one via token exchange.
+   *
+   * For embedded apps, this:
+   * 1. Extracts the session token and shop from the request
+   * 2. Checks storage for an existing non-expired session
+   * 3. If no valid session, performs token exchange with Shopify
+   * 4. Stores the new session (encrypted) and returns it
+   */
+  async getOrCreateSession(request) {
+    const shop = extractShop(request);
+    if (!shop) {
+      throw new Error(
+        "Could not extract shop domain from request. Provide shop in query parameter or x-shopify-shop-domain header."
+      );
+    }
+    const sessionToken = extractSessionToken(request);
+    if (!sessionToken) {
+      throw new Error(
+        "Could not extract session token from Authorization header. Expected: Authorization: Bearer <token>"
+      );
+    }
+    const sessionId = `offline_${shop}`;
+    const existingSession = await this.encryptedStorage.loadSession(sessionId);
+    if (existingSession && !this.isExpired(existingSession)) {
+      return existingSession;
+    }
+    const exchangeInput = {
+      config: this.config,
+      sessionToken,
+      shop,
+      tokenType: "offline"
+    };
+    if (this.tokenExchangeFn) {
+      exchangeInput.tokenExchangeFn = this.tokenExchangeFn;
+    }
+    const session = await performTokenExchange(exchangeInput);
+    await this.encryptedStorage.storeSession(session);
+    return session;
+  }
+  /**
+   * Get an existing valid online session or create one via token exchange.
+   */
+  async getOrCreateOnlineSession(request) {
+    const shop = extractShop(request);
+    if (!shop) {
+      throw new Error(
+        "Could not extract shop domain from request."
+      );
+    }
+    const sessionToken = extractSessionToken(request);
+    if (!sessionToken) {
+      throw new Error(
+        "Could not extract session token from Authorization header."
+      );
+    }
+    const onlineExchangeInput = {
+      config: this.config,
+      sessionToken,
+      shop,
+      tokenType: "online"
+    };
+    if (this.tokenExchangeFn) {
+      onlineExchangeInput.tokenExchangeFn = this.tokenExchangeFn;
+    }
+    const session = await performTokenExchange(onlineExchangeInput);
+    await this.encryptedStorage.storeSession(session);
+    return session;
+  }
+  /**
+   * Refresh an expiring session token.
+   *
+   * Retries up to `config.tokenRefresh.maxRetries` on failure.
+   * On success, stores the refreshed session (encrypted) and emits
+   * a `token_refreshed` event. On final failure, emits
+   * `token_refresh_failed` and throws.
+   */
+  async refreshSessionToken(session) {
+    const maxRetries = this.config.tokenRefresh?.maxRetries ?? 3;
+    const refreshFn = this.tokenRefreshFn ?? await this.createDefaultRefreshFn();
+    let lastError;
+    for (let attempt = 0; attempt < maxRetries; attempt++) {
+      try {
+        const refreshInput = { shop: session.shop };
+        if (session.accessToken) {
+          refreshInput.accessToken = session.accessToken;
+        }
+        if (session.refreshToken) {
+          refreshInput.refreshToken = session.refreshToken;
+        }
+        const { session: refreshedShopifySession } = await refreshFn({
+          session: refreshInput
+        });
+        const now = /* @__PURE__ */ new Date();
+        const refreshedSession = this.mapRefreshedSession(
+          refreshedShopifySession,
+          session,
+          now
+        );
+        await this.encryptedStorage.storeSession(refreshedSession);
+        if (this.config.eventHandler) {
+          const event = createAuthEvent2({
+            type: "token_refreshed",
+            shopDomain: session.shop,
+            outcome: "success",
+            sessionId: session.id,
+            metadata: { attempt: String(attempt + 1) }
+          });
+          await Promise.resolve(
+            this.config.eventHandler.onAuthEvent(event)
+          );
+        }
+        return refreshedSession;
+      } catch (error) {
+        lastError = error instanceof Error ? error : new Error(String(error));
+      }
+    }
+    if (this.config.eventHandler) {
+      const event = createAuthEvent2({
+        type: "token_refresh_failed",
+        shopDomain: session.shop,
+        outcome: "failure",
+        sessionId: session.id,
+        metadata: {
+          maxRetries: String(maxRetries),
+          error: lastError?.message ?? "Unknown error"
+        }
+      });
+      await Promise.resolve(this.config.eventHandler.onAuthEvent(event));
+    }
+    throw lastError ?? new Error("Token refresh failed after all retries.");
+  }
+  /**
+   * Delete all sessions for a shop (e.g., on app uninstall).
+   *
+   * Finds all sessions via `findSessionsByShop`, deletes them,
+   * and emits `session_deleted` events.
+   */
+  async cleanupShopSessions(shop) {
+    const sessions = await this.config.sessionStorage.findSessionsByShop(shop);
+    if (sessions.length === 0) {
+      return;
+    }
+    const sessionIds = sessions.map((s) => s.id);
+    await this.config.sessionStorage.deleteSessions(sessionIds);
+    if (this.config.eventHandler) {
+      for (const session of sessions) {
+        const event = createAuthEvent2({
+          type: "session_deleted",
+          shopDomain: shop,
+          outcome: "success",
+          sessionId: session.id,
+          metadata: { reason: "shop_cleanup" }
+        });
+        await Promise.resolve(
+          this.config.eventHandler.onAuthEvent(event)
+        );
+      }
+    }
+  }
+  isExpired(session) {
+    if (!session.expires) {
+      return false;
+    }
+    return session.expires.getTime() <= Date.now();
+  }
+  mapRefreshedSession(refreshed, original, now) {
+    const session = {
+      id: refreshed.id || original.id,
+      shop: refreshed.shop || original.shop,
+      state: refreshed.state || original.state,
+      isOnline: refreshed.isOnline,
+      scope: refreshed.scope || original.scope,
+      expires: refreshed.expires ?? original.expires,
+      createdAt: original.createdAt,
+      updatedAt: now
+    };
+    if (refreshed.accessToken) {
+      session.accessToken = refreshed.accessToken;
+    }
+    if (refreshed.refreshToken) {
+      session.refreshToken = refreshed.refreshToken;
+    }
+    return session;
+  }
+  async createDefaultRefreshFn() {
+    const { shopifyApi, LogSeverity } = await import("@shopify/shopify-api");
+    await import("@shopify/shopify-api/adapters/node");
+    const shopify = shopifyApi({
+      apiKey: this.config.apiKey,
+      apiSecretKey: this.config.apiSecretKey,
+      scopes: this.config.scopes,
+      hostName: this.config.hostName,
+      apiVersion: this.config.apiVersion,
+      isEmbeddedApp: this.config.isEmbeddedApp ?? true,
+      logger: { level: LogSeverity.Error }
+    });
+    return async (params) => {
+      const result = await shopify.auth.refreshToken(params);
+      return result;
+    };
+  }
+};
+
+// src/auth/hmac.ts
+import { createHmac, timingSafeEqual } from "crypto";
+function validateOAuthHmac(query, secret) {
+  const hmac = query["hmac"];
+  if (!hmac) {
+    return false;
+  }
+  const entries = Object.entries(query).filter(([key]) => key !== "hmac").sort(([a], [b]) => a.localeCompare(b));
+  const message = entries.map(([key, value]) => `${key}=${value}`).join("&");
+  const computed = createHmac("sha256", secret).update(message).digest("hex");
+  if (computed.length !== hmac.length) {
+    return false;
+  }
+  return timingSafeEqual(
+    Buffer.from(computed, "utf-8"),
+    Buffer.from(hmac, "utf-8")
+  );
+}
+
+// src/auth/oauth.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { isValidShopDomain as isValidShopDomain2 } from "@uniforge/platform-core/auth";
+import { createAuthEvent as createAuthEvent3 } from "@uniforge/core/auth";
+import {
+  TokenEncryptionServiceImpl as TokenEncryptionServiceImpl2,
+  EncryptedSessionStorage as EncryptedSessionStorage2
+} from "@uniforge/core/auth";
+async function beginOAuth(input) {
+  const { config, request, callbackPath, isOnline } = input;
+  const shop = request.query["shop"];
+  if (!shop || !isValidShopDomain2(shop)) {
+    throw new Error(
+      "Could not extract valid shop domain from request. Provide shop in query parameter."
+    );
+  }
+  const beginFn = input.beginFn ?? await createShopifyOAuthBeginFn(config);
+  const { redirectUrl } = await beginFn({
+    shop,
+    callbackPath,
+    isOnline: isOnline ?? false
+  });
+  if (config.eventHandler) {
+    const event = createAuthEvent3({
+      type: "oauth_begin",
+      shopDomain: shop,
+      outcome: "success",
+      metadata: { callbackPath }
+    });
+    await Promise.resolve(config.eventHandler.onAuthEvent(event));
+  }
+  return { redirectUrl };
+}
+async function handleOAuthCallback(input) {
+  const { config, request } = input;
+  const query = request.query;
+  const shop = query["shop"] ?? "";
+  if (query["error"]) {
+    const errorDesc = query["error_description"] ?? `Authorization ${query["error"]}`;
+    if (config.eventHandler) {
+      const event = createAuthEvent3({
+        type: "oauth_callback_failure",
+        shopDomain: shop,
+        outcome: "failure",
+        metadata: {
+          error: query["error"],
+          errorDescription: errorDesc
+        }
+      });
+      await Promise.resolve(config.eventHandler.onAuthEvent(event));
+    }
+    return {
+      success: false,
+      error: {
+        code: "ACCESS_DENIED",
+        message: errorDesc,
+        statusCode: 403
+      }
+    };
+  }
+  if (!validateOAuthHmac(query, config.apiSecretKey)) {
+    if (config.eventHandler) {
+      const event = createAuthEvent3({
+        type: "oauth_callback_failure",
+        shopDomain: shop,
+        outcome: "failure",
+        metadata: { error: "HMAC validation failed" }
+      });
+      await Promise.resolve(config.eventHandler.onAuthEvent(event));
+    }
+    return {
+      success: false,
+      error: {
+        code: "HMAC_VALIDATION_FAILED",
+        message: "HMAC validation failed on OAuth callback.",
+        statusCode: 403
+      }
+    };
+  }
+  try {
+    const callbackFn = input.callbackFn ?? await createShopifyOAuthCallbackFn(config);
+    const { session: shopifySession } = await callbackFn({ query });
+    const now = /* @__PURE__ */ new Date();
+    const session = mapOAuthSession(shopifySession, shop, now);
+    const grantedScopes = new Set(
+      (session.scope || "").split(",").map((s) => s.trim())
+    );
+    const requiredScopes = config.scopes;
+    const missingScopes = requiredScopes.filter(
+      (scope) => !grantedScopes.has(scope)
+    );
+    if (missingScopes.length > 0) {
+      if (config.eventHandler) {
+        const event = createAuthEvent3({
+          type: "oauth_callback_failure",
+          shopDomain: shop,
+          outcome: "failure",
+          metadata: {
+            error: "scope_mismatch",
+            missingScopes: missingScopes.join(",")
+          }
+        });
+        await Promise.resolve(config.eventHandler.onAuthEvent(event));
+      }
+      return {
+        success: false,
+        error: {
+          code: "SCOPE_MISMATCH",
+          message: `Missing required scopes: ${missingScopes.join(", ")}. Granted: ${session.scope}`,
+          statusCode: 403
+        }
+      };
+    }
+    const encryption = new TokenEncryptionServiceImpl2(config.encryption);
+    const encryptedStorage = new EncryptedSessionStorage2(
+      config.sessionStorage,
+      encryption
+    );
+    await encryptedStorage.storeSession(session);
+    if (config.eventHandler) {
+      const event = createAuthEvent3({
+        type: "oauth_callback_success",
+        shopDomain: shop,
+        outcome: "success",
+        sessionId: session.id,
+        metadata: { scope: session.scope }
+      });
+      await Promise.resolve(config.eventHandler.onAuthEvent(event));
+    }
+    return {
+      success: true,
+      session,
+      redirectUrl: `${config.hostName}/?shop=${shop}`
+    };
+  } catch (error) {
+    if (config.eventHandler) {
+      const event = createAuthEvent3({
+        type: "oauth_callback_failure",
+        shopDomain: shop,
+        outcome: "failure",
+        metadata: {
+          error: error instanceof Error ? error.message : String(error)
+        }
+      });
+      await Promise.resolve(config.eventHandler.onAuthEvent(event));
+    }
+    return {
+      success: false,
+      error: {
+        code: "OAUTH_CALLBACK_FAILED",
+        message: error instanceof Error ? error.message : String(error),
+        statusCode: 500
+      }
+    };
+  }
+}
+async function createShopifyOAuthBeginFn(config) {
+  return async (params) => {
+    const nonce = randomUUID2();
+    const scopeString = config.scopes.join(",");
+    const redirectUri = `${config.hostName}${params.callbackPath}`;
+    const redirectUrl = `https://${params.shop}/admin/oauth/authorize?client_id=${config.apiKey}&scope=${encodeURIComponent(scopeString)}&redirect_uri=${encodeURIComponent(redirectUri)}&state=${nonce}`;
+    return { redirectUrl };
+  };
+}
+async function createShopifyOAuthCallbackFn(config) {
+  const { shopifyApi, LogSeverity } = await import("@shopify/shopify-api");
+  await import("@shopify/shopify-api/adapters/node");
+  const shopify = shopifyApi({
+    apiKey: config.apiKey,
+    apiSecretKey: config.apiSecretKey,
+    scopes: config.scopes,
+    hostName: config.hostName,
+    apiVersion: config.apiVersion,
+    isEmbeddedApp: config.isEmbeddedApp ?? false,
+    logger: { level: LogSeverity.Error }
+  });
+  return async (params) => {
+    const result = await shopify.auth.callback(params);
+    return result;
+  };
+}
+function mapOAuthSession(shopifySession, shop, now) {
+  const session = {
+    id: shopifySession.id,
+    shop: shopifySession.shop || shop,
+    state: shopifySession.state || randomUUID2(),
+    isOnline: shopifySession.isOnline,
+    scope: shopifySession.scope || "",
+    expires: shopifySession.expires ?? null,
+    createdAt: now,
+    updatedAt: now
+  };
+  if (shopifySession.accessToken) {
+    session.accessToken = shopifySession.accessToken;
+  }
+  if (shopifySession.refreshToken) {
+    session.refreshToken = shopifySession.refreshToken;
+  }
+  return session;
+}
+export {
+  ShopifySessionManager,
+  beginOAuth,
+  createShopifyTokenExchangeFn,
+  extractSessionToken,
+  extractShop,
+  handleOAuthCallback,
+  performTokenExchange,
+  validateOAuthHmac
+};
+//# sourceMappingURL=index.mjs.map