@usethrottle/auth 0.1.0 → 0.1.1

package/README.md

@@ -80,6 +80,41 @@ const profile = await account.getProfile();
 `auth.subscribe(fn)` + `auth.getSnapshot()` give you the same state a
 framework adapter would use to re-render.
 
+## API reference
+
+Every method on the `ThrottleAuth` returned by `createThrottleAuth()` (also
+reachable as `useAuth().auth` in React):
+
+| Method | Description |
+| ------ | ----------- |
+| `register(email: string, password: string): Promise<{ status: 'active' \| 'pending' }>` | Creates an account. `pending` means a verification email was sent and no session was issued yet. |
+| `signIn(email: string, password: string): Promise<void>` | Signs in and persists the session. |
+| `signOut(): Promise<void>` | Ends the current session, locally and on the server. |
+| `signOutEverywhere(): Promise<void>` | Revokes every session for this buyer, this device included. |
+| `stepUp(password: string): Promise<void>` | Re-proves the current password; used internally to retry a `step_up_required` call, but callable directly too. |
+| `restore(): Promise<void>` | Rehydrates a session from storage; called once by `<ThrottleAuthProvider>` on mount. |
+| `getSnapshot(): AuthSnapshot` | The current auth state (status, customer, emailVerified). |
+| `subscribe(fn: (s: AuthSnapshot) => void): () => void` | Subscribes to state changes; returns an unsubscribe function. |
+| `call<T = any>(method: string, path: string, body?: unknown): Promise<T>` | Authenticated fetch against `/v1/storefront/*`, with retry-once-on-401 and step-up handling already wired in. |
+| `verifyEmail(token: string): Promise<void>` | Consumes a one-time verification-link token. |
+| `resendVerification(): Promise<void>` | Sends a new verification email to the signed-in buyer. |
+| `forgotPassword(email: string): Promise<void>` | Always resolves; never reveals whether the address has an account. |
+| `resetPassword(token: string, password: string): Promise<void>` | Consumes a one-time reset-link token and sets a new password; revokes every session, this one included. |
+| `changePassword(password: string): Promise<void>` | Changes the signed-in buyer's password (requires step-up). |
+| `listSessions(): Promise<DeviceSession[]>` | Lists this buyer's active device sessions. |
+| `revokeSession(id: string): Promise<void>` | Revokes one device session by id (requires step-up); revoking the current session signs this device out. |
+
+```ts
+interface DeviceSession {
+  id: string;
+  userAgent: string | null;
+  ipPrefix: string | null;
+  createdAt: string;
+  lastUsedAt: string;
+  current: boolean;
+}
+```
+
 ## Account pages
 
 Six hooks, each a `{ data, isLoading, error, refetch }` resource plus the
@@ -211,6 +246,11 @@ vague by design.
 - Pass `storage: memoryStorage()` to `createThrottleAuth` /
   `<ThrottleAuthProvider>` to opt out of persistence entirely — the buyer is
   signed out on every page reload, useful for kiosk/shared-device contexts.
+  `<ThrottleAuthProvider>` reads `storage` (and `onStepUpRequired`) only once,
+  when it mounts, so pass a stable reference — a module-level constant or a
+  `useMemo` — rather than constructing `memoryStorage()` inline in JSX; an
+  inline value gets a new identity on every parent render, which the provider
+  won't pick up.
 - Refresh is single-flight (concurrent 401s share one refresh call) and
   cross-tab safe via the Web Locks API where available. Do not build your own
   refresh loop around the same publishable key; use `auth.call()` /

package/dist/{chunk-YHIGTY64.js → chunk-IJ3DNMNG.js}

@@ -1,7 +1,7 @@
 import {
   createAccount,
   createThrottleAuth
-} from "./chunk-NQU7HM23.js";
+} from "./chunk-OYNGTNOS.js";
 
 // src/react/context.tsx
 import { createContext, useContext, useEffect, useMemo, useRef, useSyncExternalStore } from "react";
@@ -12,7 +12,7 @@ function ThrottleAuthProvider(props) {
   const value = useMemo(() => {
     const auth = injected ?? createThrottleAuth({ publishableKey, baseUrl, storage, onStepUpRequired });
     return { auth, account: createAccount(auth) };
-  }, [injected, publishableKey, baseUrl, storage]);
+  }, [injected, publishableKey, baseUrl]);
   const restored = useRef(null);
   useEffect(() => {
     if (restored.current === value.auth) return;
@@ -46,4 +46,4 @@ export {
   useAuthContext,
   useAuth
 };
-//# sourceMappingURL=chunk-YHIGTY64.js.map
+//# sourceMappingURL=chunk-IJ3DNMNG.js.map

package/dist/chunk-IJ3DNMNG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/react/context.tsx"],"sourcesContent":["import { createContext, useContext, useEffect, useMemo, useRef, useSyncExternalStore } from 'react';\nimport type { ReactNode } from 'react';\nimport { createThrottleAuth, type ThrottleAuth } from '../client';\nimport { createAccount, type ThrottleAccount } from '../account';\nimport type { AuthSnapshot } from '../session';\nimport type { ThrottleAuthConfig } from '../types';\n\nexport interface ThrottleAuthProviderProps extends Partial<ThrottleAuthConfig> {\n  publishableKey: string;\n  /** Inject a pre-built client. Tests use it; merchants sharing one client across roots may too. */\n  auth?: ThrottleAuth;\n  children: ReactNode;\n}\n\ninterface ContextValue { auth: ThrottleAuth; account: ThrottleAccount }\n\nconst Ctx = createContext<ContextValue | null>(null);\n\nexport function ThrottleAuthProvider(props: ThrottleAuthProviderProps) {\n  const { auth: injected, publishableKey, baseUrl, storage, onStepUpRequired, children } = props;\n\n  // `storage` and `onStepUpRequired` are deliberately NOT dependencies: they are\n  // read once at mount. A merchant passing `storage={memoryStorage()}` inline —\n  // which the README suggests — would otherwise get a new client on every parent\n  // render, and with it a fresh empty SessionState that reads as signed out.\n  const value = useMemo<ContextValue>(() => {\n    const auth = injected ?? createThrottleAuth({ publishableKey, baseUrl, storage, onStepUpRequired });\n    return { auth, account: createAccount(auth) };\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [injected, publishableKey, baseUrl]);\n\n  const restored = useRef<ThrottleAuth | null>(null);\n  useEffect(() => {\n    // Once per client. StrictMode runs effects twice in development, and a\n    // second restore() would present the refresh token that the first one\n    // just rotated away.\n    if (restored.current === value.auth) return;\n    restored.current = value.auth;\n    void value.auth.restore();\n  }, [value]);\n\n  return <Ctx.Provider value={value}>{children}</Ctx.Provider>;\n}\n\nfunction useCtx(): ContextValue {\n  const ctx = useContext(Ctx);\n  if (!ctx) throw new Error('useAuth must be used inside a <ThrottleAuthProvider>');\n  return ctx;\n}\n\nexport function useAuthContext(): ContextValue { return useCtx(); }\n\nexport type UseAuthResult = AuthSnapshot & {\n  isLoading: boolean;\n  isAuthenticated: boolean;\n  auth: ThrottleAuth;\n  account: ThrottleAccount;\n};\n\nexport function useAuth(): UseAuthResult {\n  const { auth, account } = useCtx();\n  const snapshot = useSyncExternalStore(auth.subscribe, auth.getSnapshot, auth.getSnapshot);\n  return {\n    ...snapshot,\n    isLoading: snapshot.status === 'loading',\n    isAuthenticated: snapshot.status === 'authenticated',\n    auth,\n    account,\n  };\n}\n"],"mappings":";;;;;;AAAA,SAAS,eAAe,YAAY,WAAW,SAAS,QAAQ,4BAA4B;AAyCnF;AAzBT,IAAM,MAAM,cAAmC,IAAI;AAE5C,SAAS,qBAAqB,OAAkC;AACrE,QAAM,EAAE,MAAM,UAAU,gBAAgB,SAAS,SAAS,kBAAkB,SAAS,IAAI;AAMzF,QAAM,QAAQ,QAAsB,MAAM;AACxC,UAAM,OAAO,YAAY,mBAAmB,EAAE,gBAAgB,SAAS,SAAS,iBAAiB,CAAC;AAClG,WAAO,EAAE,MAAM,SAAS,cAAc,IAAI,EAAE;AAAA,EAE9C,GAAG,CAAC,UAAU,gBAAgB,OAAO,CAAC;AAEtC,QAAM,WAAW,OAA4B,IAAI;AACjD,YAAU,MAAM;AAId,QAAI,SAAS,YAAY,MAAM,KAAM;AACrC,aAAS,UAAU,MAAM;AACzB,SAAK,MAAM,KAAK,QAAQ;AAAA,EAC1B,GAAG,CAAC,KAAK,CAAC;AAEV,SAAO,oBAAC,IAAI,UAAJ,EAAa,OAAe,UAAS;AAC/C;AAEA,SAAS,SAAuB;AAC9B,QAAM,MAAM,WAAW,GAAG;AAC1B,MAAI,CAAC,IAAK,OAAM,IAAI,MAAM,sDAAsD;AAChF,SAAO;AACT;AAEO,SAAS,iBAA+B;AAAE,SAAO,OAAO;AAAG;AAS3D,SAAS,UAAyB;AACvC,QAAM,EAAE,MAAM,QAAQ,IAAI,OAAO;AACjC,QAAM,WAAW,qBAAqB,KAAK,WAAW,KAAK,aAAa,KAAK,WAAW;AACxF,SAAO;AAAA,IACL,GAAG;AAAA,IACH,WAAW,SAAS,WAAW;AAAA,IAC/B,iBAAiB,SAAS,WAAW;AAAA,IACrC;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-NQU7HM23.js → chunk-OYNGTNOS.js}

@@ -318,7 +318,10 @@ function createThrottleAuth(config) {
     },
     async changePassword(password) {
       await call("POST", "/me/change-password", { password });
-      await refresh();
+      try {
+        await refresh();
+      } catch {
+      }
     },
     async listSessions() {
       return call("GET", "/me/sessions");
@@ -375,4 +378,4 @@ export {
   createThrottleAuth,
   createAccount
 };
-//# sourceMappingURL=chunk-NQU7HM23.js.map
+//# sourceMappingURL=chunk-OYNGTNOS.js.map

package/dist/{chunk-NQU7HM23.js.map → chunk-OYNGTNOS.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../src/storage.ts","../src/request.ts","../src/session.ts","../src/client.ts","../src/account.ts"],"sourcesContent":["export class ThrottleAuthError extends Error {\n  readonly code: string;\n  readonly statusCode: number;\n  readonly retryAfter?: number;\n  readonly details?: unknown;\n\n  constructor(args: { code: string; message: string; statusCode: number; retryAfter?: number; details?: unknown }) {\n    super(args.message);\n    this.name = 'ThrottleAuthError';\n    this.code = args.code;\n    this.statusCode = args.statusCode;\n    this.retryAfter = args.retryAfter;\n    this.details = args.details;\n  }\n}\n","import type { AuthStorage } from './types';\n\nexport type { AuthStorage };\n\nexport function memoryStorage(): AuthStorage {\n  const map = new Map<string, string>();\n  return {\n    get: (k) => map.get(k) ?? null,\n    set: (k, v) => void map.set(k, v),\n    remove: (k) => void map.delete(k),\n  };\n}\n\n/**\n * localStorage when it works, memory when it does not. Safari private mode,\n * hardened browser settings and server-side rendering all make localStorage\n * either absent or throwing; none of them may take the storefront down.\n */\nexport function localStorageAdapter(): AuthStorage {\n  const fallback = memoryStorage();\n  const ls = (): Storage | null => {\n    try {\n      return typeof localStorage !== 'undefined' ? localStorage : null;\n    } catch {\n      return null;\n    }\n  };\n  return {\n    get(k) {\n      try {\n        const v = ls()?.getItem(k);\n        if (v != null) return v;\n      } catch { /* fall through */ }\n      return fallback.get(k);\n    },\n    set(k, v) {\n      fallback.set(k, v);\n      try { ls()?.setItem(k, v); } catch { /* memory-only this session */ }\n    },\n    remove(k) {\n      fallback.remove(k);\n      try { ls()?.removeItem(k); } catch { /* already gone */ }\n    },\n  };\n}\n","import { ThrottleAuthError } from './errors';\n\nexport interface RequestInput {\n  method: string;\n  path: string;\n  baseUrl: string;\n  publishableKey: string;\n  accessToken?: string;\n  stepUpToken?: string;\n  body?: unknown;\n}\n\n/** Returns the UNWRAPPED `data` from the `{ data: … }` envelope. Throws ThrottleAuthError otherwise. */\nexport async function request(input: RequestInput): Promise<any> {\n  const headers: Record<string, string> = { 'X-API-Key': input.publishableKey };\n  if (input.body !== undefined) headers['Content-Type'] = 'application/json';\n  if (input.accessToken) headers.Authorization = `Bearer ${input.accessToken}`;\n  if (input.stepUpToken) headers['X-Step-Up'] = input.stepUpToken;\n\n  const res = await fetch(`${input.baseUrl}/v1/storefront${input.path}`, {\n    method: input.method,\n    headers,\n    ...(input.body !== undefined ? { body: JSON.stringify(input.body) } : {}),\n  });\n\n  const text = await res.text();\n  let parsed: any = {};\n  try {\n    parsed = text ? JSON.parse(text) : {};\n  } catch {\n    // Non-JSON body — an HTML gateway page, say. Leave parsed empty so the\n    // branch below still throws a typed error rather than a raw SyntaxError.\n  }\n\n  if (!res.ok) {\n    const e = parsed?.error ?? {};\n    // `Retry-After` is server-controlled but not trusted: Number('soon') is\n    // NaN, and a NaN reaches the UI as \"wait NaN seconds\".\n    const ra = Number(res.headers.get('retry-after'));\n    throw new ThrottleAuthError({\n      code: e.code ?? 'request_failed',\n      message: e.message ?? `Request failed with ${res.status}`,\n      statusCode: res.status,\n      retryAfter: Number.isFinite(ra) && ra >= 0 ? ra : undefined,\n      details: e.details,\n    });\n  }\n\n  // `'data' in parsed`, not `parsed?.data ?? parsed`: a legitimate\n  // `{ \"data\": null }` is nullish, and `??` would fall through and hand the\n  // caller the whole envelope instead of the null the API actually sent.\n  return parsed && typeof parsed === 'object' && 'data' in parsed ? parsed.data : (parsed ?? {});\n}\n","import type { Customer, Session } from './types';\n\nexport type AuthStatus = 'loading' | 'authenticated' | 'unauthenticated';\n\nexport interface AuthSnapshot {\n  status: AuthStatus;\n  customer: Customer | null;\n  /**\n   * False here does NOT only mean \"we emailed them and they have not clicked\".\n   * While it is false the API may also be withholding pre-existing account\n   * data behind the claim cutoff — empty order lists and a 403 on `PATCH /me`\n   * are expected, not broken. See the plan header.\n   */\n  emailVerified: boolean;\n}\n\ntype Listener = (snapshot: AuthSnapshot) => void;\n\nexport class SessionState {\n  #snapshot: AuthSnapshot = { status: 'loading', customer: null, emailVerified: false };\n  #accessToken: string | null = null;\n  #expiresAt: number | null = null;\n  #listeners = new Set<Listener>();\n\n  get(): AuthSnapshot { return this.#snapshot; }\n  accessToken(): string | null { return this.#accessToken; }\n  expiresAt(): number | null { return this.#expiresAt; }\n\n  setSession(session: Session): void {\n    this.#accessToken = session.accessToken;\n    this.#expiresAt = Date.parse(session.expiresAt);\n    this.#publish({\n      status: 'authenticated',\n      customer: session.customer,\n      emailVerified: Boolean(session.customer?.emailVerified),\n    });\n  }\n\n  setStatus(status: AuthStatus): void {\n    this.#publish({ ...this.#snapshot, status });\n  }\n\n  clear(): void {\n    this.#accessToken = null;\n    this.#expiresAt = null;\n    this.#publish({ status: 'unauthenticated', customer: null, emailVerified: false });\n  }\n\n  subscribe(fn: Listener): () => void {\n    this.#listeners.add(fn);\n    return () => { this.#listeners.delete(fn); };\n  }\n\n  #publish(next: AuthSnapshot): void {\n    // Identity matters: React's useSyncExternalStore re-renders on reference\n    // change, and a token refresh every ten minutes must not re-render the\n    // whole account area when nothing visible changed.\n    const same =\n      next.status === this.#snapshot.status &&\n      next.emailVerified === this.#snapshot.emailVerified &&\n      customerEquals(next.customer, this.#snapshot.customer);\n    if (same) return;\n    this.#snapshot = next;\n    for (const fn of [...this.#listeners]) {\n      // A merchant's subscriber throwing must not stop the rest from hearing.\n      try { fn(next); } catch { /* merchant callback */ }\n    }\n  }\n}\n\nfunction customerEquals(a: Customer | null, b: Customer | null): boolean {\n  if (a === b) return true;\n  if (!a || !b) return false;\n  const keys = new Set([...Object.keys(a), ...Object.keys(b)]) as Set<keyof Customer>;\n  for (const k of keys) if (a[k] !== b[k]) return false;\n  return true;\n}\n","import { request } from './request';\nimport { ThrottleAuthError } from './errors';\nimport { SessionState, type AuthSnapshot } from './session';\nimport { localStorageAdapter, type AuthStorage } from './storage';\nimport type { Customer, Session, ThrottleAuthConfig } from './types';\n\nconst DEFAULT_BASE_URL = 'https://api.usethrottle.dev';\n/** Refresh this far before expiry so ordinary calls rarely see a 401 at all. */\nconst REFRESH_SKEW_MS = 30_000;\n\nexport interface DeviceSession {\n  id: string;\n  userAgent: string | null;\n  ipPrefix: string | null;\n  createdAt: string;\n  lastUsedAt: string;\n  current: boolean;\n}\n\nexport interface ThrottleAuth {\n  register(email: string, password: string): Promise<{ status: 'active' | 'pending' }>;\n  signIn(email: string, password: string): Promise<void>;\n  signOut(): Promise<void>;\n  signOutEverywhere(): Promise<void>;\n  restore(): Promise<void>;\n  getSnapshot(): AuthSnapshot;\n  subscribe(fn: (s: AuthSnapshot) => void): () => void;\n  stepUp(password: string): Promise<void>;\n  call<T = any>(method: string, path: string, body?: unknown): Promise<T>;\n  verifyEmail(token: string): Promise<void>;\n  resendVerification(): Promise<void>;\n  forgotPassword(email: string): Promise<void>;\n  resetPassword(token: string, password: string): Promise<void>;\n  changePassword(password: string): Promise<void>;\n  listSessions(): Promise<DeviceSession[]>;\n  revokeSession(id: string): Promise<void>;\n}\n\nexport function createThrottleAuth(config: ThrottleAuthConfig): ThrottleAuth {\n  const baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/$/, '');\n  const storage: AuthStorage = config.storage ?? localStorageAdapter();\n  // Namespaced by key so two Throttle applications on one origin cannot read\n  // each other's refresh token out of shared localStorage.\n  const storageKey = `throttle_auth_rt:${config.publishableKey}`;\n  const lockName = `throttle_auth_refresh:${config.publishableKey}`;\n\n  const state = new SessionState();\n  let refreshInFlight: Promise<void> | null = null;\n  let stepUpToken: string | null = null;\n  let stepUpExpiresAt = 0;\n\n  const base = { baseUrl, publishableKey: config.publishableKey };\n\n  async function persist(session: Session): Promise<void> {\n    state.setSession(session);\n    await storage.set(storageKey, session.refreshToken);\n  }\n\n  async function forget(): Promise<void> {\n    stepUpToken = null;\n    state.clear();\n    await storage.remove(storageKey);\n  }\n\n  /**\n   * Cross-tab single flight. Two tabs refreshing at once would each present the\n   * same stored token; the second is a replay, and the server kills the family.\n   * Web Locks serialises them; where it is unavailable the in-process guard\n   * below still covers the common single-tab case.\n   */\n  function withLock<T>(fn: () => Promise<T>): Promise<T> {\n    const locks = (globalThis as any).navigator?.locks;\n    return locks?.request ? locks.request(lockName, fn) : fn();\n  }\n\n  async function doRefresh(): Promise<void> {\n    await withLock(async () => {\n      // Re-read INSIDE the lock: another tab may have rotated while we waited,\n      // and presenting the token we read before the lock would be a replay.\n      const refreshToken = await storage.get(storageKey);\n      if (!refreshToken) {\n        await forget();\n        throw new ThrottleAuthError({ code: 'session_revoked', message: 'No session', statusCode: 401 });\n      }\n      try {\n        const data = await request({ ...base, method: 'POST', path: '/auth/refresh', body: { refreshToken } });\n        await persist(data as Session);\n      } catch (err) {\n        // Any refusal of a refresh token is terminal — there is nothing left to\n        // retry with. Drop it rather than letting a dead token sit in storage.\n        await forget();\n        throw err;\n      }\n    });\n  }\n\n  function refresh(): Promise<void> {\n    if (!refreshInFlight) {\n      refreshInFlight = doRefresh().finally(() => { refreshInFlight = null; });\n    }\n    return refreshInFlight;\n  }\n\n  async function accessToken(): Promise<string | null> {\n    const expires = state.expiresAt();\n    if (state.accessToken() && expires && expires - Date.now() > REFRESH_SKEW_MS) {\n      return state.accessToken();\n    }\n    if (await storage.get(storageKey)) {\n      await refresh();\n      return state.accessToken();\n    }\n    return state.accessToken();\n  }\n\n  async function ensureStepUp(): Promise<boolean> {\n    if (stepUpToken && stepUpExpiresAt > Date.now()) return true;\n    if (!config.onStepUpRequired) return false;\n    const password = await config.onStepUpRequired();\n    if (!password) return false;\n    await stepUp(password);\n    return true;\n  }\n\n  async function stepUp(password: string): Promise<void> {\n    const data = await request({\n      ...base, method: 'POST', path: '/auth/step-up',\n      accessToken: await accessToken() ?? undefined, body: { password },\n    });\n    stepUpToken = data.stepUpToken;\n    stepUpExpiresAt = Date.now() + (Number(data.expiresIn) || 300) * 1000 - 5_000;\n  }\n\n  async function call<T = any>(method: string, path: string, body?: unknown): Promise<T> {\n    let retriedAuth = false;\n    let retriedStepUp = false;\n\n    for (;;) {\n      const token = await accessToken();\n      try {\n        return await request({\n          ...base, method, path, body,\n          accessToken: token ?? undefined,\n          stepUpToken: stepUpToken ?? undefined,\n        });\n      } catch (err) {\n        const e = err as ThrottleAuthError;\n        // `session_revoked` belongs here too. The server returns it for a\n        // stale session EPOCH as well as for a genuinely dead session, and a\n        // changed password bumps the epoch while deliberately sparing the\n        // current session — so one refresh recovers it. When the session\n        // really is dead the refresh fails and forget() runs, which is the\n        // same outcome, one request later.\n        const expired = e.statusCode === 401 &&\n          (e.code === 'unauthorized' || e.code === 'token_expired' || e.code === 'session_revoked');\n        if (expired && !retriedAuth) {\n          retriedAuth = true;\n          await refresh();   // shared — ten callers here produce ONE request\n          continue;\n        }\n        if (e.code === 'step_up_required' && !retriedStepUp) {\n          retriedStepUp = true;\n          stepUpToken = null;\n          if (await ensureStepUp()) continue;\n        }\n        throw err;\n      }\n    }\n  }\n\n  return {\n    async register(email, password) {\n      const data = await request({ ...base, method: 'POST', path: '/auth/register', body: { email, password } });\n      if (data?.status === 'pending') return { status: 'pending' };\n      await persist(data as Session);\n      return { status: 'active' };\n    },\n\n    async signIn(email, password) {\n      const data = await request({ ...base, method: 'POST', path: '/auth/login', body: { email, password } });\n      await persist(data as Session);\n    },\n\n    async signOut() {\n      try { await call('POST', '/auth/logout'); } catch { /* local state still goes */ }\n      await forget();\n    },\n\n    async signOutEverywhere() {\n      try { await call('POST', '/auth/logout-all'); } catch { /* local state still goes */ }\n      await forget();\n    },\n\n    async restore() {\n      if (!(await storage.get(storageKey))) { state.setStatus('unauthenticated'); return; }\n      try { await refresh(); } catch { /* forget() already ran */ }\n    },\n\n    getSnapshot: () => state.get(),\n    subscribe: (fn) => state.subscribe(fn),\n    stepUp,\n    call,\n\n    async verifyEmail(token) {\n      await request({ ...base, method: 'POST', path: '/auth/verify-email', body: { token } });\n      // `ver` is a claim baked into the access token, and the claim cutoff is\n      // read from the session row. Without a new token the buyer stays gated —\n      // and their own order history stays hidden — for the rest of this\n      // token's ten minutes.\n      if (await storage.get(storageKey)) {\n        try { await refresh(); } catch { /* verification still succeeded */ }\n      }\n    },\n\n    async resendVerification() {\n      await call('POST', '/auth/verify-email/resend');\n    },\n\n    async forgotPassword(email) {\n      // Always 202, whether or not the address has an account. Do not infer\n      // anything from it and do not tell the buyer whether it existed.\n      await request({ ...base, method: 'POST', path: '/auth/forgot-password', body: { email } });\n    },\n\n    async resetPassword(token, password) {\n      await request({ ...base, method: 'POST', path: '/auth/reset-password', body: { token, password } });\n      // The server revokes every session on reset, this one included.\n      await forget();\n    },\n\n    async changePassword(password) {\n      await call('POST', '/me/change-password', { password });\n      // The change bumps the session epoch. This session was deliberately\n      // spared, but the access token in hand now carries a stale epoch and the\n      // next write would 401. Rotate now rather than on the buyer's next click.\n      await refresh();\n    },\n\n    async listSessions() {\n      return call<DeviceSession[]>('GET', '/me/sessions');\n    },\n\n    async revokeSession(id) {\n      const mine = await call<DeviceSession[]>('GET', '/me/sessions');\n      const current = mine.find((s) => s.current);\n      await call('DELETE', `/me/sessions/${encodeURIComponent(id)}`);\n      if (current?.id === id) await forget();\n    },\n  };\n}\n\nexport type { AuthSnapshot, Customer, Session, ThrottleAuthConfig };\n","import type { ThrottleAuth } from './client';\nimport type {\n  Address, AddressInput, Customer, Invoice, Order,\n  PaymentMethod, ProfilePatch, Subscription,\n} from './types';\n\nexport interface Page { cursor?: string; limit?: number }\n\nexport interface ThrottleAccount {\n  getProfile(): Promise<Customer>;\n  updateProfile(patch: ProfilePatch): Promise<Customer>;\n  listAddresses(): Promise<Address[]>;\n  createAddress(input: AddressInput): Promise<Address>;\n  updateAddress(id: string, patch: Partial<AddressInput>): Promise<Address>;\n  deleteAddress(id: string): Promise<void>;\n  listPaymentMethods(): Promise<PaymentMethod[]>;\n  setDefaultPaymentMethod(id: string): Promise<PaymentMethod>;\n  deletePaymentMethod(id: string): Promise<void>;\n  listOrders(page?: Page): Promise<Order[]>;\n  getOrder(id: string): Promise<Order>;\n  listInvoices(page?: Page): Promise<Invoice[]>;\n  getInvoice(id: string): Promise<Invoice>;\n  listSubscriptions(page?: Page): Promise<Subscription[]>;\n  getSubscription(id: string): Promise<Subscription>;\n  cancelSubscription(id: string, opts?: { atPeriodEnd?: boolean }): Promise<Subscription>;\n  pauseSubscription(id: string): Promise<Subscription>;\n  resumeSubscription(id: string): Promise<Subscription>;\n  claimCart(cartId: string): Promise<{ cartId: string; customerId: string }>;\n}\n\nconst seg = (v: string) => encodeURIComponent(v);\n\nfunction query(page?: Page): string {\n  const params = new URLSearchParams();\n  if (page?.cursor) params.set('cursor', page.cursor);\n  if (page?.limit != null) params.set('limit', String(page.limit));\n  const s = params.toString();\n  return s ? `?${s}` : '';\n}\n\nexport function createAccount(auth: ThrottleAuth): ThrottleAccount {\n  const { call } = auth;\n  return {\n    getProfile: () => call('GET', '/me'),\n    updateProfile: (patch) => call('PATCH', '/me', patch),\n\n    listAddresses: () => call('GET', '/me/addresses'),\n    createAddress: (input) => call('POST', '/me/addresses', input),\n    updateAddress: (id, patch) => call('PATCH', `/me/addresses/${seg(id)}`, patch),\n    deleteAddress: (id) => call('DELETE', `/me/addresses/${seg(id)}`),\n\n    listPaymentMethods: () => call('GET', '/me/payment-methods'),\n    // The platform has no \"change this subscription's card\" capability, so\n    // this is how a buyer changes what they are billed on: move the default.\n    setDefaultPaymentMethod: (id) => call('PATCH', `/me/payment-methods/${seg(id)}`, { isDefault: true }),\n    deletePaymentMethod: (id) => call('DELETE', `/me/payment-methods/${seg(id)}`),\n\n    listOrders: (page) => call('GET', `/me/orders${query(page)}`),\n    getOrder: (id) => call('GET', `/me/orders/${seg(id)}`),\n    listInvoices: (page) => call('GET', `/me/invoices${query(page)}`),\n    getInvoice: (id) => call('GET', `/me/invoices/${seg(id)}`),\n    listSubscriptions: (page) => call('GET', `/me/subscriptions${query(page)}`),\n    getSubscription: (id) => call('GET', `/me/subscriptions/${seg(id)}`),\n\n    cancelSubscription: (id, opts) => call('POST', `/me/subscriptions/${seg(id)}/cancel`, opts),\n    pauseSubscription: (id) => call('POST', `/me/subscriptions/${seg(id)}/pause`),\n    resumeSubscription: (id) => call('POST', `/me/subscriptions/${seg(id)}/resume`),\n\n    claimCart: (cartId) => call('POST', `/me/carts/${seg(cartId)}/claim`),\n  };\n}\n"],"mappings":";AAAO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAAqG;AAC/G,UAAM,KAAK,OAAO;AAClB,SAAK,OAAO;AACZ,SAAK,OAAO,KAAK;AACjB,SAAK,aAAa,KAAK;AACvB,SAAK,aAAa,KAAK;AACvB,SAAK,UAAU,KAAK;AAAA,EACtB;AACF;;;ACVO,SAAS,gBAA6B;AAC3C,QAAM,MAAM,oBAAI,IAAoB;AACpC,SAAO;AAAA,IACL,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK;AAAA,IAC1B,KAAK,CAAC,GAAG,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC;AAAA,IAChC,QAAQ,CAAC,MAAM,KAAK,IAAI,OAAO,CAAC;AAAA,EAClC;AACF;AAOO,SAAS,sBAAmC;AACjD,QAAM,WAAW,cAAc;AAC/B,QAAM,KAAK,MAAsB;AAC/B,QAAI;AACF,aAAO,OAAO,iBAAiB,cAAc,eAAe;AAAA,IAC9D,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AAAA,IACL,IAAI,GAAG;AACL,UAAI;AACF,cAAM,IAAI,GAAG,GAAG,QAAQ,CAAC;AACzB,YAAI,KAAK,KAAM,QAAO;AAAA,MACxB,QAAQ;AAAA,MAAqB;AAC7B,aAAO,SAAS,IAAI,CAAC;AAAA,IACvB;AAAA,IACA,IAAI,GAAG,GAAG;AACR,eAAS,IAAI,GAAG,CAAC;AACjB,UAAI;AAAE,WAAG,GAAG,QAAQ,GAAG,CAAC;AAAA,MAAG,QAAQ;AAAA,MAAiC;AAAA,IACtE;AAAA,IACA,OAAO,GAAG;AACR,eAAS,OAAO,CAAC;AACjB,UAAI;AAAE,WAAG,GAAG,WAAW,CAAC;AAAA,MAAG,QAAQ;AAAA,MAAqB;AAAA,IAC1D;AAAA,EACF;AACF;;;AC/BA,eAAsB,QAAQ,OAAmC;AAC/D,QAAM,UAAkC,EAAE,aAAa,MAAM,eAAe;AAC5E,MAAI,MAAM,SAAS,OAAW,SAAQ,cAAc,IAAI;AACxD,MAAI,MAAM,YAAa,SAAQ,gBAAgB,UAAU,MAAM,WAAW;AAC1E,MAAI,MAAM,YAAa,SAAQ,WAAW,IAAI,MAAM;AAEpD,QAAM,MAAM,MAAM,MAAM,GAAG,MAAM,OAAO,iBAAiB,MAAM,IAAI,IAAI;AAAA,IACrE,QAAQ,MAAM;AAAA,IACd;AAAA,IACA,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,KAAK,UAAU,MAAM,IAAI,EAAE,IAAI,CAAC;AAAA,EACzE,CAAC;AAED,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,MAAI,SAAc,CAAC;AACnB,MAAI;AACF,aAAS,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC;AAAA,EACtC,QAAQ;AAAA,EAGR;AAEA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,QAAQ,SAAS,CAAC;AAG5B,UAAM,KAAK,OAAO,IAAI,QAAQ,IAAI,aAAa,CAAC;AAChD,UAAM,IAAI,kBAAkB;AAAA,MAC1B,MAAM,EAAE,QAAQ;AAAA,MAChB,SAAS,EAAE,WAAW,uBAAuB,IAAI,MAAM;AAAA,MACvD,YAAY,IAAI;AAAA,MAChB,YAAY,OAAO,SAAS,EAAE,KAAK,MAAM,IAAI,KAAK;AAAA,MAClD,SAAS,EAAE;AAAA,IACb,CAAC;AAAA,EACH;AAKA,SAAO,UAAU,OAAO,WAAW,YAAY,UAAU,SAAS,OAAO,OAAQ,UAAU,CAAC;AAC9F;;;AClCO,IAAM,eAAN,MAAmB;AAAA,EACxB,YAA0B,EAAE,QAAQ,WAAW,UAAU,MAAM,eAAe,MAAM;AAAA,EACpF,eAA8B;AAAA,EAC9B,aAA4B;AAAA,EAC5B,aAAa,oBAAI,IAAc;AAAA,EAE/B,MAAoB;AAAE,WAAO,KAAK;AAAA,EAAW;AAAA,EAC7C,cAA6B;AAAE,WAAO,KAAK;AAAA,EAAc;AAAA,EACzD,YAA2B;AAAE,WAAO,KAAK;AAAA,EAAY;AAAA,EAErD,WAAW,SAAwB;AACjC,SAAK,eAAe,QAAQ;AAC5B,SAAK,aAAa,KAAK,MAAM,QAAQ,SAAS;AAC9C,SAAK,SAAS;AAAA,MACZ,QAAQ;AAAA,MACR,UAAU,QAAQ;AAAA,MAClB,eAAe,QAAQ,QAAQ,UAAU,aAAa;AAAA,IACxD,CAAC;AAAA,EACH;AAAA,EAEA,UAAU,QAA0B;AAClC,SAAK,SAAS,EAAE,GAAG,KAAK,WAAW,OAAO,CAAC;AAAA,EAC7C;AAAA,EAEA,QAAc;AACZ,SAAK,eAAe;AACpB,SAAK,aAAa;AAClB,SAAK,SAAS,EAAE,QAAQ,mBAAmB,UAAU,MAAM,eAAe,MAAM,CAAC;AAAA,EACnF;AAAA,EAEA,UAAU,IAA0B;AAClC,SAAK,WAAW,IAAI,EAAE;AACtB,WAAO,MAAM;AAAE,WAAK,WAAW,OAAO,EAAE;AAAA,IAAG;AAAA,EAC7C;AAAA,EAEA,SAAS,MAA0B;AAIjC,UAAM,OACJ,KAAK,WAAW,KAAK,UAAU,UAC/B,KAAK,kBAAkB,KAAK,UAAU,iBACtC,eAAe,KAAK,UAAU,KAAK,UAAU,QAAQ;AACvD,QAAI,KAAM;AACV,SAAK,YAAY;AACjB,eAAW,MAAM,CAAC,GAAG,KAAK,UAAU,GAAG;AAErC,UAAI;AAAE,WAAG,IAAI;AAAA,MAAG,QAAQ;AAAA,MAA0B;AAAA,IACpD;AAAA,EACF;AACF;AAEA,SAAS,eAAe,GAAoB,GAA6B;AACvE,MAAI,MAAM,EAAG,QAAO;AACpB,MAAI,CAAC,KAAK,CAAC,EAAG,QAAO;AACrB,QAAM,OAAO,oBAAI,IAAI,CAAC,GAAG,OAAO,KAAK,CAAC,GAAG,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC;AAC3D,aAAW,KAAK,KAAM,KAAI,EAAE,CAAC,MAAM,EAAE,CAAC,EAAG,QAAO;AAChD,SAAO;AACT;;;ACtEA,IAAM,mBAAmB;AAEzB,IAAM,kBAAkB;AA8BjB,SAAS,mBAAmB,QAA0C;AAC3E,QAAM,WAAW,OAAO,WAAW,kBAAkB,QAAQ,OAAO,EAAE;AACtE,QAAM,UAAuB,OAAO,WAAW,oBAAoB;AAGnE,QAAM,aAAa,oBAAoB,OAAO,cAAc;AAC5D,QAAM,WAAW,yBAAyB,OAAO,cAAc;AAE/D,QAAM,QAAQ,IAAI,aAAa;AAC/B,MAAI,kBAAwC;AAC5C,MAAI,cAA6B;AACjC,MAAI,kBAAkB;AAEtB,QAAM,OAAO,EAAE,SAAS,gBAAgB,OAAO,eAAe;AAE9D,iBAAe,QAAQ,SAAiC;AACtD,UAAM,WAAW,OAAO;AACxB,UAAM,QAAQ,IAAI,YAAY,QAAQ,YAAY;AAAA,EACpD;AAEA,iBAAe,SAAwB;AACrC,kBAAc;AACd,UAAM,MAAM;AACZ,UAAM,QAAQ,OAAO,UAAU;AAAA,EACjC;AAQA,WAAS,SAAY,IAAkC;AACrD,UAAM,QAAS,WAAmB,WAAW;AAC7C,WAAO,OAAO,UAAU,MAAM,QAAQ,UAAU,EAAE,IAAI,GAAG;AAAA,EAC3D;AAEA,iBAAe,YAA2B;AACxC,UAAM,SAAS,YAAY;AAGzB,YAAM,eAAe,MAAM,QAAQ,IAAI,UAAU;AACjD,UAAI,CAAC,cAAc;AACjB,cAAM,OAAO;AACb,cAAM,IAAI,kBAAkB,EAAE,MAAM,mBAAmB,SAAS,cAAc,YAAY,IAAI,CAAC;AAAA,MACjG;AACA,UAAI;AACF,cAAM,OAAO,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,iBAAiB,MAAM,EAAE,aAAa,EAAE,CAAC;AACrG,cAAM,QAAQ,IAAe;AAAA,MAC/B,SAAS,KAAK;AAGZ,cAAM,OAAO;AACb,cAAM;AAAA,MACR;AAAA,IACF,CAAC;AAAA,EACH;AAEA,WAAS,UAAyB;AAChC,QAAI,CAAC,iBAAiB;AACpB,wBAAkB,UAAU,EAAE,QAAQ,MAAM;AAAE,0BAAkB;AAAA,MAAM,CAAC;AAAA,IACzE;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,cAAsC;AACnD,UAAM,UAAU,MAAM,UAAU;AAChC,QAAI,MAAM,YAAY,KAAK,WAAW,UAAU,KAAK,IAAI,IAAI,iBAAiB;AAC5E,aAAO,MAAM,YAAY;AAAA,IAC3B;AACA,QAAI,MAAM,QAAQ,IAAI,UAAU,GAAG;AACjC,YAAM,QAAQ;AACd,aAAO,MAAM,YAAY;AAAA,IAC3B;AACA,WAAO,MAAM,YAAY;AAAA,EAC3B;AAEA,iBAAe,eAAiC;AAC9C,QAAI,eAAe,kBAAkB,KAAK,IAAI,EAAG,QAAO;AACxD,QAAI,CAAC,OAAO,iBAAkB,QAAO;AACrC,UAAM,WAAW,MAAM,OAAO,iBAAiB;AAC/C,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,OAAO,QAAQ;AACrB,WAAO;AAAA,EACT;AAEA,iBAAe,OAAO,UAAiC;AACrD,UAAM,OAAO,MAAM,QAAQ;AAAA,MACzB,GAAG;AAAA,MAAM,QAAQ;AAAA,MAAQ,MAAM;AAAA,MAC/B,aAAa,MAAM,YAAY,KAAK;AAAA,MAAW,MAAM,EAAE,SAAS;AAAA,IAClE,CAAC;AACD,kBAAc,KAAK;AACnB,sBAAkB,KAAK,IAAI,KAAK,OAAO,KAAK,SAAS,KAAK,OAAO,MAAO;AAAA,EAC1E;AAEA,iBAAe,KAAc,QAAgB,MAAc,MAA4B;AACrF,QAAI,cAAc;AAClB,QAAI,gBAAgB;AAEpB,eAAS;AACP,YAAM,QAAQ,MAAM,YAAY;AAChC,UAAI;AACF,eAAO,MAAM,QAAQ;AAAA,UACnB,GAAG;AAAA,UAAM;AAAA,UAAQ;AAAA,UAAM;AAAA,UACvB,aAAa,SAAS;AAAA,UACtB,aAAa,eAAe;AAAA,QAC9B,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,cAAM,IAAI;AAOV,cAAM,UAAU,EAAE,eAAe,QAC9B,EAAE,SAAS,kBAAkB,EAAE,SAAS,mBAAmB,EAAE,SAAS;AACzE,YAAI,WAAW,CAAC,aAAa;AAC3B,wBAAc;AACd,gBAAM,QAAQ;AACd;AAAA,QACF;AACA,YAAI,EAAE,SAAS,sBAAsB,CAAC,eAAe;AACnD,0BAAgB;AAChB,wBAAc;AACd,cAAI,MAAM,aAAa,EAAG;AAAA,QAC5B;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,SAAS,OAAO,UAAU;AAC9B,YAAM,OAAO,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,kBAAkB,MAAM,EAAE,OAAO,SAAS,EAAE,CAAC;AACzG,UAAI,MAAM,WAAW,UAAW,QAAO,EAAE,QAAQ,UAAU;AAC3D,YAAM,QAAQ,IAAe;AAC7B,aAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IAEA,MAAM,OAAO,OAAO,UAAU;AAC5B,YAAM,OAAO,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,eAAe,MAAM,EAAE,OAAO,SAAS,EAAE,CAAC;AACtG,YAAM,QAAQ,IAAe;AAAA,IAC/B;AAAA,IAEA,MAAM,UAAU;AACd,UAAI;AAAE,cAAM,KAAK,QAAQ,cAAc;AAAA,MAAG,QAAQ;AAAA,MAA+B;AACjF,YAAM,OAAO;AAAA,IACf;AAAA,IAEA,MAAM,oBAAoB;AACxB,UAAI;AAAE,cAAM,KAAK,QAAQ,kBAAkB;AAAA,MAAG,QAAQ;AAAA,MAA+B;AACrF,YAAM,OAAO;AAAA,IACf;AAAA,IAEA,MAAM,UAAU;AACd,UAAI,CAAE,MAAM,QAAQ,IAAI,UAAU,GAAI;AAAE,cAAM,UAAU,iBAAiB;AAAG;AAAA,MAAQ;AACpF,UAAI;AAAE,cAAM,QAAQ;AAAA,MAAG,QAAQ;AAAA,MAA6B;AAAA,IAC9D;AAAA,IAEA,aAAa,MAAM,MAAM,IAAI;AAAA,IAC7B,WAAW,CAAC,OAAO,MAAM,UAAU,EAAE;AAAA,IACrC;AAAA,IACA;AAAA,IAEA,MAAM,YAAY,OAAO;AACvB,YAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,sBAAsB,MAAM,EAAE,MAAM,EAAE,CAAC;AAKtF,UAAI,MAAM,QAAQ,IAAI,UAAU,GAAG;AACjC,YAAI;AAAE,gBAAM,QAAQ;AAAA,QAAG,QAAQ;AAAA,QAAqC;AAAA,MACtE;AAAA,IACF;AAAA,IAEA,MAAM,qBAAqB;AACzB,YAAM,KAAK,QAAQ,2BAA2B;AAAA,IAChD;AAAA,IAEA,MAAM,eAAe,OAAO;AAG1B,YAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,yBAAyB,MAAM,EAAE,MAAM,EAAE,CAAC;AAAA,IAC3F;AAAA,IAEA,MAAM,cAAc,OAAO,UAAU;AACnC,YAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,wBAAwB,MAAM,EAAE,OAAO,SAAS,EAAE,CAAC;AAElG,YAAM,OAAO;AAAA,IACf;AAAA,IAEA,MAAM,eAAe,UAAU;AAC7B,YAAM,KAAK,QAAQ,uBAAuB,EAAE,SAAS,CAAC;AAItD,YAAM,QAAQ;AAAA,IAChB;AAAA,IAEA,MAAM,eAAe;AACnB,aAAO,KAAsB,OAAO,cAAc;AAAA,IACpD;AAAA,IAEA,MAAM,cAAc,IAAI;AACtB,YAAM,OAAO,MAAM,KAAsB,OAAO,cAAc;AAC9D,YAAM,UAAU,KAAK,KAAK,CAAC,MAAM,EAAE,OAAO;AAC1C,YAAM,KAAK,UAAU,gBAAgB,mBAAmB,EAAE,CAAC,EAAE;AAC7D,UAAI,SAAS,OAAO,GAAI,OAAM,OAAO;AAAA,IACvC;AAAA,EACF;AACF;;;AC3NA,IAAM,MAAM,CAAC,MAAc,mBAAmB,CAAC;AAE/C,SAAS,MAAM,MAAqB;AAClC,QAAM,SAAS,IAAI,gBAAgB;AACnC,MAAI,MAAM,OAAQ,QAAO,IAAI,UAAU,KAAK,MAAM;AAClD,MAAI,MAAM,SAAS,KAAM,QAAO,IAAI,SAAS,OAAO,KAAK,KAAK,CAAC;AAC/D,QAAM,IAAI,OAAO,SAAS;AAC1B,SAAO,IAAI,IAAI,CAAC,KAAK;AACvB;AAEO,SAAS,cAAc,MAAqC;AACjE,QAAM,EAAE,KAAK,IAAI;AACjB,SAAO;AAAA,IACL,YAAY,MAAM,KAAK,OAAO,KAAK;AAAA,IACnC,eAAe,CAAC,UAAU,KAAK,SAAS,OAAO,KAAK;AAAA,IAEpD,eAAe,MAAM,KAAK,OAAO,eAAe;AAAA,IAChD,eAAe,CAAC,UAAU,KAAK,QAAQ,iBAAiB,KAAK;AAAA,IAC7D,eAAe,CAAC,IAAI,UAAU,KAAK,SAAS,iBAAiB,IAAI,EAAE,CAAC,IAAI,KAAK;AAAA,IAC7E,eAAe,CAAC,OAAO,KAAK,UAAU,iBAAiB,IAAI,EAAE,CAAC,EAAE;AAAA,IAEhE,oBAAoB,MAAM,KAAK,OAAO,qBAAqB;AAAA;AAAA;AAAA,IAG3D,yBAAyB,CAAC,OAAO,KAAK,SAAS,uBAAuB,IAAI,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,CAAC;AAAA,IACpG,qBAAqB,CAAC,OAAO,KAAK,UAAU,uBAAuB,IAAI,EAAE,CAAC,EAAE;AAAA,IAE5E,YAAY,CAAC,SAAS,KAAK,OAAO,aAAa,MAAM,IAAI,CAAC,EAAE;AAAA,IAC5D,UAAU,CAAC,OAAO,KAAK,OAAO,cAAc,IAAI,EAAE,CAAC,EAAE;AAAA,IACrD,cAAc,CAAC,SAAS,KAAK,OAAO,eAAe,MAAM,IAAI,CAAC,EAAE;AAAA,IAChE,YAAY,CAAC,OAAO,KAAK,OAAO,gBAAgB,IAAI,EAAE,CAAC,EAAE;AAAA,IACzD,mBAAmB,CAAC,SAAS,KAAK,OAAO,oBAAoB,MAAM,IAAI,CAAC,EAAE;AAAA,IAC1E,iBAAiB,CAAC,OAAO,KAAK,OAAO,qBAAqB,IAAI,EAAE,CAAC,EAAE;AAAA,IAEnE,oBAAoB,CAAC,IAAI,SAAS,KAAK,QAAQ,qBAAqB,IAAI,EAAE,CAAC,WAAW,IAAI;AAAA,IAC1F,mBAAmB,CAAC,OAAO,KAAK,QAAQ,qBAAqB,IAAI,EAAE,CAAC,QAAQ;AAAA,IAC5E,oBAAoB,CAAC,OAAO,KAAK,QAAQ,qBAAqB,IAAI,EAAE,CAAC,SAAS;AAAA,IAE9E,WAAW,CAAC,WAAW,KAAK,QAAQ,aAAa,IAAI,MAAM,CAAC,QAAQ;AAAA,EACtE;AACF;","names":[]}
+{"version":3,"sources":["../src/errors.ts","../src/storage.ts","../src/request.ts","../src/session.ts","../src/client.ts","../src/account.ts"],"sourcesContent":["export class ThrottleAuthError extends Error {\n  readonly code: string;\n  readonly statusCode: number;\n  readonly retryAfter?: number;\n  readonly details?: unknown;\n\n  constructor(args: { code: string; message: string; statusCode: number; retryAfter?: number; details?: unknown }) {\n    super(args.message);\n    this.name = 'ThrottleAuthError';\n    this.code = args.code;\n    this.statusCode = args.statusCode;\n    this.retryAfter = args.retryAfter;\n    this.details = args.details;\n  }\n}\n","import type { AuthStorage } from './types';\n\nexport type { AuthStorage };\n\nexport function memoryStorage(): AuthStorage {\n  const map = new Map<string, string>();\n  return {\n    get: (k) => map.get(k) ?? null,\n    set: (k, v) => void map.set(k, v),\n    remove: (k) => void map.delete(k),\n  };\n}\n\n/**\n * localStorage when it works, memory when it does not. Safari private mode,\n * hardened browser settings and server-side rendering all make localStorage\n * either absent or throwing; none of them may take the storefront down.\n */\nexport function localStorageAdapter(): AuthStorage {\n  const fallback = memoryStorage();\n  const ls = (): Storage | null => {\n    try {\n      return typeof localStorage !== 'undefined' ? localStorage : null;\n    } catch {\n      return null;\n    }\n  };\n  return {\n    get(k) {\n      try {\n        const v = ls()?.getItem(k);\n        if (v != null) return v;\n      } catch { /* fall through */ }\n      return fallback.get(k);\n    },\n    set(k, v) {\n      fallback.set(k, v);\n      try { ls()?.setItem(k, v); } catch { /* memory-only this session */ }\n    },\n    remove(k) {\n      fallback.remove(k);\n      try { ls()?.removeItem(k); } catch { /* already gone */ }\n    },\n  };\n}\n","import { ThrottleAuthError } from './errors';\n\nexport interface RequestInput {\n  method: string;\n  path: string;\n  baseUrl: string;\n  publishableKey: string;\n  accessToken?: string;\n  stepUpToken?: string;\n  body?: unknown;\n}\n\n/** Returns the UNWRAPPED `data` from the `{ data: … }` envelope. Throws ThrottleAuthError otherwise. */\nexport async function request(input: RequestInput): Promise<any> {\n  const headers: Record<string, string> = { 'X-API-Key': input.publishableKey };\n  if (input.body !== undefined) headers['Content-Type'] = 'application/json';\n  if (input.accessToken) headers.Authorization = `Bearer ${input.accessToken}`;\n  if (input.stepUpToken) headers['X-Step-Up'] = input.stepUpToken;\n\n  const res = await fetch(`${input.baseUrl}/v1/storefront${input.path}`, {\n    method: input.method,\n    headers,\n    ...(input.body !== undefined ? { body: JSON.stringify(input.body) } : {}),\n  });\n\n  const text = await res.text();\n  let parsed: any = {};\n  try {\n    parsed = text ? JSON.parse(text) : {};\n  } catch {\n    // Non-JSON body — an HTML gateway page, say. Leave parsed empty so the\n    // branch below still throws a typed error rather than a raw SyntaxError.\n  }\n\n  if (!res.ok) {\n    const e = parsed?.error ?? {};\n    // `Retry-After` is server-controlled but not trusted: Number('soon') is\n    // NaN, and a NaN reaches the UI as \"wait NaN seconds\".\n    const ra = Number(res.headers.get('retry-after'));\n    throw new ThrottleAuthError({\n      code: e.code ?? 'request_failed',\n      message: e.message ?? `Request failed with ${res.status}`,\n      statusCode: res.status,\n      retryAfter: Number.isFinite(ra) && ra >= 0 ? ra : undefined,\n      details: e.details,\n    });\n  }\n\n  // `'data' in parsed`, not `parsed?.data ?? parsed`: a legitimate\n  // `{ \"data\": null }` is nullish, and `??` would fall through and hand the\n  // caller the whole envelope instead of the null the API actually sent.\n  return parsed && typeof parsed === 'object' && 'data' in parsed ? parsed.data : (parsed ?? {});\n}\n","import type { Customer, Session } from './types';\n\nexport type AuthStatus = 'loading' | 'authenticated' | 'unauthenticated';\n\nexport interface AuthSnapshot {\n  status: AuthStatus;\n  customer: Customer | null;\n  /**\n   * False here does NOT only mean \"we emailed them and they have not clicked\".\n   * While it is false the API may also be withholding pre-existing account\n   * data behind the claim cutoff — empty order lists and a 403 on `PATCH /me`\n   * are expected, not broken. See the plan header.\n   */\n  emailVerified: boolean;\n}\n\ntype Listener = (snapshot: AuthSnapshot) => void;\n\nexport class SessionState {\n  #snapshot: AuthSnapshot = { status: 'loading', customer: null, emailVerified: false };\n  #accessToken: string | null = null;\n  #expiresAt: number | null = null;\n  #listeners = new Set<Listener>();\n\n  get(): AuthSnapshot { return this.#snapshot; }\n  accessToken(): string | null { return this.#accessToken; }\n  expiresAt(): number | null { return this.#expiresAt; }\n\n  setSession(session: Session): void {\n    this.#accessToken = session.accessToken;\n    this.#expiresAt = Date.parse(session.expiresAt);\n    this.#publish({\n      status: 'authenticated',\n      customer: session.customer,\n      emailVerified: Boolean(session.customer?.emailVerified),\n    });\n  }\n\n  setStatus(status: AuthStatus): void {\n    this.#publish({ ...this.#snapshot, status });\n  }\n\n  clear(): void {\n    this.#accessToken = null;\n    this.#expiresAt = null;\n    this.#publish({ status: 'unauthenticated', customer: null, emailVerified: false });\n  }\n\n  subscribe(fn: Listener): () => void {\n    this.#listeners.add(fn);\n    return () => { this.#listeners.delete(fn); };\n  }\n\n  #publish(next: AuthSnapshot): void {\n    // Identity matters: React's useSyncExternalStore re-renders on reference\n    // change, and a token refresh every ten minutes must not re-render the\n    // whole account area when nothing visible changed.\n    const same =\n      next.status === this.#snapshot.status &&\n      next.emailVerified === this.#snapshot.emailVerified &&\n      customerEquals(next.customer, this.#snapshot.customer);\n    if (same) return;\n    this.#snapshot = next;\n    for (const fn of [...this.#listeners]) {\n      // A merchant's subscriber throwing must not stop the rest from hearing.\n      try { fn(next); } catch { /* merchant callback */ }\n    }\n  }\n}\n\nfunction customerEquals(a: Customer | null, b: Customer | null): boolean {\n  if (a === b) return true;\n  if (!a || !b) return false;\n  const keys = new Set([...Object.keys(a), ...Object.keys(b)]) as Set<keyof Customer>;\n  for (const k of keys) if (a[k] !== b[k]) return false;\n  return true;\n}\n","import { request } from './request';\nimport { ThrottleAuthError } from './errors';\nimport { SessionState, type AuthSnapshot } from './session';\nimport { localStorageAdapter, type AuthStorage } from './storage';\nimport type { Customer, Session, ThrottleAuthConfig } from './types';\n\nconst DEFAULT_BASE_URL = 'https://api.usethrottle.dev';\n/** Refresh this far before expiry so ordinary calls rarely see a 401 at all. */\nconst REFRESH_SKEW_MS = 30_000;\n\nexport interface DeviceSession {\n  id: string;\n  userAgent: string | null;\n  ipPrefix: string | null;\n  createdAt: string;\n  lastUsedAt: string;\n  current: boolean;\n}\n\nexport interface ThrottleAuth {\n  register(email: string, password: string): Promise<{ status: 'active' | 'pending' }>;\n  signIn(email: string, password: string): Promise<void>;\n  signOut(): Promise<void>;\n  signOutEverywhere(): Promise<void>;\n  restore(): Promise<void>;\n  getSnapshot(): AuthSnapshot;\n  subscribe(fn: (s: AuthSnapshot) => void): () => void;\n  stepUp(password: string): Promise<void>;\n  call<T = any>(method: string, path: string, body?: unknown): Promise<T>;\n  verifyEmail(token: string): Promise<void>;\n  resendVerification(): Promise<void>;\n  forgotPassword(email: string): Promise<void>;\n  resetPassword(token: string, password: string): Promise<void>;\n  changePassword(password: string): Promise<void>;\n  listSessions(): Promise<DeviceSession[]>;\n  revokeSession(id: string): Promise<void>;\n}\n\nexport function createThrottleAuth(config: ThrottleAuthConfig): ThrottleAuth {\n  const baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/$/, '');\n  const storage: AuthStorage = config.storage ?? localStorageAdapter();\n  // Namespaced by key so two Throttle applications on one origin cannot read\n  // each other's refresh token out of shared localStorage.\n  const storageKey = `throttle_auth_rt:${config.publishableKey}`;\n  const lockName = `throttle_auth_refresh:${config.publishableKey}`;\n\n  const state = new SessionState();\n  let refreshInFlight: Promise<void> | null = null;\n  let stepUpToken: string | null = null;\n  let stepUpExpiresAt = 0;\n\n  const base = { baseUrl, publishableKey: config.publishableKey };\n\n  async function persist(session: Session): Promise<void> {\n    state.setSession(session);\n    await storage.set(storageKey, session.refreshToken);\n  }\n\n  async function forget(): Promise<void> {\n    stepUpToken = null;\n    state.clear();\n    await storage.remove(storageKey);\n  }\n\n  /**\n   * Cross-tab single flight. Two tabs refreshing at once would each present the\n   * same stored token; the second is a replay, and the server kills the family.\n   * Web Locks serialises them; where it is unavailable the in-process guard\n   * below still covers the common single-tab case.\n   */\n  function withLock<T>(fn: () => Promise<T>): Promise<T> {\n    const locks = (globalThis as any).navigator?.locks;\n    return locks?.request ? locks.request(lockName, fn) : fn();\n  }\n\n  async function doRefresh(): Promise<void> {\n    await withLock(async () => {\n      // Re-read INSIDE the lock: another tab may have rotated while we waited,\n      // and presenting the token we read before the lock would be a replay.\n      const refreshToken = await storage.get(storageKey);\n      if (!refreshToken) {\n        await forget();\n        throw new ThrottleAuthError({ code: 'session_revoked', message: 'No session', statusCode: 401 });\n      }\n      try {\n        const data = await request({ ...base, method: 'POST', path: '/auth/refresh', body: { refreshToken } });\n        await persist(data as Session);\n      } catch (err) {\n        // Any refusal of a refresh token is terminal — there is nothing left to\n        // retry with. Drop it rather than letting a dead token sit in storage.\n        await forget();\n        throw err;\n      }\n    });\n  }\n\n  function refresh(): Promise<void> {\n    if (!refreshInFlight) {\n      refreshInFlight = doRefresh().finally(() => { refreshInFlight = null; });\n    }\n    return refreshInFlight;\n  }\n\n  async function accessToken(): Promise<string | null> {\n    const expires = state.expiresAt();\n    if (state.accessToken() && expires && expires - Date.now() > REFRESH_SKEW_MS) {\n      return state.accessToken();\n    }\n    if (await storage.get(storageKey)) {\n      await refresh();\n      return state.accessToken();\n    }\n    return state.accessToken();\n  }\n\n  async function ensureStepUp(): Promise<boolean> {\n    if (stepUpToken && stepUpExpiresAt > Date.now()) return true;\n    if (!config.onStepUpRequired) return false;\n    const password = await config.onStepUpRequired();\n    if (!password) return false;\n    await stepUp(password);\n    return true;\n  }\n\n  async function stepUp(password: string): Promise<void> {\n    const data = await request({\n      ...base, method: 'POST', path: '/auth/step-up',\n      accessToken: await accessToken() ?? undefined, body: { password },\n    });\n    stepUpToken = data.stepUpToken;\n    stepUpExpiresAt = Date.now() + (Number(data.expiresIn) || 300) * 1000 - 5_000;\n  }\n\n  async function call<T = any>(method: string, path: string, body?: unknown): Promise<T> {\n    let retriedAuth = false;\n    let retriedStepUp = false;\n\n    for (;;) {\n      const token = await accessToken();\n      try {\n        return await request({\n          ...base, method, path, body,\n          accessToken: token ?? undefined,\n          stepUpToken: stepUpToken ?? undefined,\n        });\n      } catch (err) {\n        const e = err as ThrottleAuthError;\n        // `session_revoked` belongs here too. The server returns it for a\n        // stale session EPOCH as well as for a genuinely dead session, and a\n        // changed password bumps the epoch while deliberately sparing the\n        // current session — so one refresh recovers it. When the session\n        // really is dead the refresh fails and forget() runs, which is the\n        // same outcome, one request later.\n        const expired = e.statusCode === 401 &&\n          (e.code === 'unauthorized' || e.code === 'token_expired' || e.code === 'session_revoked');\n        if (expired && !retriedAuth) {\n          retriedAuth = true;\n          await refresh();   // shared — ten callers here produce ONE request\n          continue;\n        }\n        if (e.code === 'step_up_required' && !retriedStepUp) {\n          retriedStepUp = true;\n          stepUpToken = null;\n          if (await ensureStepUp()) continue;\n        }\n        throw err;\n      }\n    }\n  }\n\n  return {\n    async register(email, password) {\n      const data = await request({ ...base, method: 'POST', path: '/auth/register', body: { email, password } });\n      if (data?.status === 'pending') return { status: 'pending' };\n      await persist(data as Session);\n      return { status: 'active' };\n    },\n\n    async signIn(email, password) {\n      const data = await request({ ...base, method: 'POST', path: '/auth/login', body: { email, password } });\n      await persist(data as Session);\n    },\n\n    async signOut() {\n      try { await call('POST', '/auth/logout'); } catch { /* local state still goes */ }\n      await forget();\n    },\n\n    async signOutEverywhere() {\n      try { await call('POST', '/auth/logout-all'); } catch { /* local state still goes */ }\n      await forget();\n    },\n\n    async restore() {\n      if (!(await storage.get(storageKey))) { state.setStatus('unauthenticated'); return; }\n      try { await refresh(); } catch { /* forget() already ran */ }\n    },\n\n    getSnapshot: () => state.get(),\n    subscribe: (fn) => state.subscribe(fn),\n    stepUp,\n    call,\n\n    async verifyEmail(token) {\n      await request({ ...base, method: 'POST', path: '/auth/verify-email', body: { token } });\n      // `ver` is a claim baked into the access token, and the claim cutoff is\n      // read from the session row. Without a new token the buyer stays gated —\n      // and their own order history stays hidden — for the rest of this\n      // token's ten minutes.\n      if (await storage.get(storageKey)) {\n        try { await refresh(); } catch { /* verification still succeeded */ }\n      }\n    },\n\n    async resendVerification() {\n      await call('POST', '/auth/verify-email/resend');\n    },\n\n    async forgotPassword(email) {\n      // Always 202, whether or not the address has an account. Do not infer\n      // anything from it and do not tell the buyer whether it existed.\n      await request({ ...base, method: 'POST', path: '/auth/forgot-password', body: { email } });\n    },\n\n    async resetPassword(token, password) {\n      await request({ ...base, method: 'POST', path: '/auth/reset-password', body: { token, password } });\n      // The server revokes every session on reset, this one included.\n      await forget();\n    },\n\n    async changePassword(password) {\n      await call('POST', '/me/change-password', { password });\n      // The change bumps the session epoch. This session was deliberately\n      // spared, but the access token in hand now carries a stale epoch and the\n      // next write would 401. Rotate now rather than on the buyer's next click\n      // — and do not let a failed rotation report a change that already\n      // succeeded server-side as a failure.\n      try { await refresh(); } catch { /* the password change already succeeded */ }\n    },\n\n    async listSessions() {\n      return call<DeviceSession[]>('GET', '/me/sessions');\n    },\n\n    async revokeSession(id) {\n      const mine = await call<DeviceSession[]>('GET', '/me/sessions');\n      const current = mine.find((s) => s.current);\n      await call('DELETE', `/me/sessions/${encodeURIComponent(id)}`);\n      if (current?.id === id) await forget();\n    },\n  };\n}\n\nexport type { AuthSnapshot, Customer, Session, ThrottleAuthConfig };\n","import type { ThrottleAuth } from './client';\nimport type {\n  Address, AddressInput, Customer, Invoice, Order,\n  PaymentMethod, ProfilePatch, Subscription,\n} from './types';\n\nexport interface Page { cursor?: string; limit?: number }\n\nexport interface ThrottleAccount {\n  getProfile(): Promise<Customer>;\n  updateProfile(patch: ProfilePatch): Promise<Customer>;\n  listAddresses(): Promise<Address[]>;\n  createAddress(input: AddressInput): Promise<Address>;\n  updateAddress(id: string, patch: Partial<AddressInput>): Promise<Address>;\n  deleteAddress(id: string): Promise<void>;\n  listPaymentMethods(): Promise<PaymentMethod[]>;\n  setDefaultPaymentMethod(id: string): Promise<PaymentMethod>;\n  deletePaymentMethod(id: string): Promise<void>;\n  listOrders(page?: Page): Promise<Order[]>;\n  getOrder(id: string): Promise<Order>;\n  listInvoices(page?: Page): Promise<Invoice[]>;\n  getInvoice(id: string): Promise<Invoice>;\n  listSubscriptions(page?: Page): Promise<Subscription[]>;\n  getSubscription(id: string): Promise<Subscription>;\n  cancelSubscription(id: string, opts?: { atPeriodEnd?: boolean }): Promise<Subscription>;\n  pauseSubscription(id: string): Promise<Subscription>;\n  resumeSubscription(id: string): Promise<Subscription>;\n  claimCart(cartId: string): Promise<{ cartId: string; customerId: string }>;\n}\n\nconst seg = (v: string) => encodeURIComponent(v);\n\nfunction query(page?: Page): string {\n  const params = new URLSearchParams();\n  if (page?.cursor) params.set('cursor', page.cursor);\n  if (page?.limit != null) params.set('limit', String(page.limit));\n  const s = params.toString();\n  return s ? `?${s}` : '';\n}\n\nexport function createAccount(auth: ThrottleAuth): ThrottleAccount {\n  const { call } = auth;\n  return {\n    getProfile: () => call('GET', '/me'),\n    updateProfile: (patch) => call('PATCH', '/me', patch),\n\n    listAddresses: () => call('GET', '/me/addresses'),\n    createAddress: (input) => call('POST', '/me/addresses', input),\n    updateAddress: (id, patch) => call('PATCH', `/me/addresses/${seg(id)}`, patch),\n    deleteAddress: (id) => call('DELETE', `/me/addresses/${seg(id)}`),\n\n    listPaymentMethods: () => call('GET', '/me/payment-methods'),\n    // The platform has no \"change this subscription's card\" capability, so\n    // this is how a buyer changes what they are billed on: move the default.\n    setDefaultPaymentMethod: (id) => call('PATCH', `/me/payment-methods/${seg(id)}`, { isDefault: true }),\n    deletePaymentMethod: (id) => call('DELETE', `/me/payment-methods/${seg(id)}`),\n\n    listOrders: (page) => call('GET', `/me/orders${query(page)}`),\n    getOrder: (id) => call('GET', `/me/orders/${seg(id)}`),\n    listInvoices: (page) => call('GET', `/me/invoices${query(page)}`),\n    getInvoice: (id) => call('GET', `/me/invoices/${seg(id)}`),\n    listSubscriptions: (page) => call('GET', `/me/subscriptions${query(page)}`),\n    getSubscription: (id) => call('GET', `/me/subscriptions/${seg(id)}`),\n\n    cancelSubscription: (id, opts) => call('POST', `/me/subscriptions/${seg(id)}/cancel`, opts),\n    pauseSubscription: (id) => call('POST', `/me/subscriptions/${seg(id)}/pause`),\n    resumeSubscription: (id) => call('POST', `/me/subscriptions/${seg(id)}/resume`),\n\n    claimCart: (cartId) => call('POST', `/me/carts/${seg(cartId)}/claim`),\n  };\n}\n"],"mappings":";AAAO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAAqG;AAC/G,UAAM,KAAK,OAAO;AAClB,SAAK,OAAO;AACZ,SAAK,OAAO,KAAK;AACjB,SAAK,aAAa,KAAK;AACvB,SAAK,aAAa,KAAK;AACvB,SAAK,UAAU,KAAK;AAAA,EACtB;AACF;;;ACVO,SAAS,gBAA6B;AAC3C,QAAM,MAAM,oBAAI,IAAoB;AACpC,SAAO;AAAA,IACL,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK;AAAA,IAC1B,KAAK,CAAC,GAAG,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC;AAAA,IAChC,QAAQ,CAAC,MAAM,KAAK,IAAI,OAAO,CAAC;AAAA,EAClC;AACF;AAOO,SAAS,sBAAmC;AACjD,QAAM,WAAW,cAAc;AAC/B,QAAM,KAAK,MAAsB;AAC/B,QAAI;AACF,aAAO,OAAO,iBAAiB,cAAc,eAAe;AAAA,IAC9D,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AAAA,IACL,IAAI,GAAG;AACL,UAAI;AACF,cAAM,IAAI,GAAG,GAAG,QAAQ,CAAC;AACzB,YAAI,KAAK,KAAM,QAAO;AAAA,MACxB,QAAQ;AAAA,MAAqB;AAC7B,aAAO,SAAS,IAAI,CAAC;AAAA,IACvB;AAAA,IACA,IAAI,GAAG,GAAG;AACR,eAAS,IAAI,GAAG,CAAC;AACjB,UAAI;AAAE,WAAG,GAAG,QAAQ,GAAG,CAAC;AAAA,MAAG,QAAQ;AAAA,MAAiC;AAAA,IACtE;AAAA,IACA,OAAO,GAAG;AACR,eAAS,OAAO,CAAC;AACjB,UAAI;AAAE,WAAG,GAAG,WAAW,CAAC;AAAA,MAAG,QAAQ;AAAA,MAAqB;AAAA,IAC1D;AAAA,EACF;AACF;;;AC/BA,eAAsB,QAAQ,OAAmC;AAC/D,QAAM,UAAkC,EAAE,aAAa,MAAM,eAAe;AAC5E,MAAI,MAAM,SAAS,OAAW,SAAQ,cAAc,IAAI;AACxD,MAAI,MAAM,YAAa,SAAQ,gBAAgB,UAAU,MAAM,WAAW;AAC1E,MAAI,MAAM,YAAa,SAAQ,WAAW,IAAI,MAAM;AAEpD,QAAM,MAAM,MAAM,MAAM,GAAG,MAAM,OAAO,iBAAiB,MAAM,IAAI,IAAI;AAAA,IACrE,QAAQ,MAAM;AAAA,IACd;AAAA,IACA,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,KAAK,UAAU,MAAM,IAAI,EAAE,IAAI,CAAC;AAAA,EACzE,CAAC;AAED,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,MAAI,SAAc,CAAC;AACnB,MAAI;AACF,aAAS,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC;AAAA,EACtC,QAAQ;AAAA,EAGR;AAEA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,QAAQ,SAAS,CAAC;AAG5B,UAAM,KAAK,OAAO,IAAI,QAAQ,IAAI,aAAa,CAAC;AAChD,UAAM,IAAI,kBAAkB;AAAA,MAC1B,MAAM,EAAE,QAAQ;AAAA,MAChB,SAAS,EAAE,WAAW,uBAAuB,IAAI,MAAM;AAAA,MACvD,YAAY,IAAI;AAAA,MAChB,YAAY,OAAO,SAAS,EAAE,KAAK,MAAM,IAAI,KAAK;AAAA,MAClD,SAAS,EAAE;AAAA,IACb,CAAC;AAAA,EACH;AAKA,SAAO,UAAU,OAAO,WAAW,YAAY,UAAU,SAAS,OAAO,OAAQ,UAAU,CAAC;AAC9F;;;AClCO,IAAM,eAAN,MAAmB;AAAA,EACxB,YAA0B,EAAE,QAAQ,WAAW,UAAU,MAAM,eAAe,MAAM;AAAA,EACpF,eAA8B;AAAA,EAC9B,aAA4B;AAAA,EAC5B,aAAa,oBAAI,IAAc;AAAA,EAE/B,MAAoB;AAAE,WAAO,KAAK;AAAA,EAAW;AAAA,EAC7C,cAA6B;AAAE,WAAO,KAAK;AAAA,EAAc;AAAA,EACzD,YAA2B;AAAE,WAAO,KAAK;AAAA,EAAY;AAAA,EAErD,WAAW,SAAwB;AACjC,SAAK,eAAe,QAAQ;AAC5B,SAAK,aAAa,KAAK,MAAM,QAAQ,SAAS;AAC9C,SAAK,SAAS;AAAA,MACZ,QAAQ;AAAA,MACR,UAAU,QAAQ;AAAA,MAClB,eAAe,QAAQ,QAAQ,UAAU,aAAa;AAAA,IACxD,CAAC;AAAA,EACH;AAAA,EAEA,UAAU,QAA0B;AAClC,SAAK,SAAS,EAAE,GAAG,KAAK,WAAW,OAAO,CAAC;AAAA,EAC7C;AAAA,EAEA,QAAc;AACZ,SAAK,eAAe;AACpB,SAAK,aAAa;AAClB,SAAK,SAAS,EAAE,QAAQ,mBAAmB,UAAU,MAAM,eAAe,MAAM,CAAC;AAAA,EACnF;AAAA,EAEA,UAAU,IAA0B;AAClC,SAAK,WAAW,IAAI,EAAE;AACtB,WAAO,MAAM;AAAE,WAAK,WAAW,OAAO,EAAE;AAAA,IAAG;AAAA,EAC7C;AAAA,EAEA,SAAS,MAA0B;AAIjC,UAAM,OACJ,KAAK,WAAW,KAAK,UAAU,UAC/B,KAAK,kBAAkB,KAAK,UAAU,iBACtC,eAAe,KAAK,UAAU,KAAK,UAAU,QAAQ;AACvD,QAAI,KAAM;AACV,SAAK,YAAY;AACjB,eAAW,MAAM,CAAC,GAAG,KAAK,UAAU,GAAG;AAErC,UAAI;AAAE,WAAG,IAAI;AAAA,MAAG,QAAQ;AAAA,MAA0B;AAAA,IACpD;AAAA,EACF;AACF;AAEA,SAAS,eAAe,GAAoB,GAA6B;AACvE,MAAI,MAAM,EAAG,QAAO;AACpB,MAAI,CAAC,KAAK,CAAC,EAAG,QAAO;AACrB,QAAM,OAAO,oBAAI,IAAI,CAAC,GAAG,OAAO,KAAK,CAAC,GAAG,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC;AAC3D,aAAW,KAAK,KAAM,KAAI,EAAE,CAAC,MAAM,EAAE,CAAC,EAAG,QAAO;AAChD,SAAO;AACT;;;ACtEA,IAAM,mBAAmB;AAEzB,IAAM,kBAAkB;AA8BjB,SAAS,mBAAmB,QAA0C;AAC3E,QAAM,WAAW,OAAO,WAAW,kBAAkB,QAAQ,OAAO,EAAE;AACtE,QAAM,UAAuB,OAAO,WAAW,oBAAoB;AAGnE,QAAM,aAAa,oBAAoB,OAAO,cAAc;AAC5D,QAAM,WAAW,yBAAyB,OAAO,cAAc;AAE/D,QAAM,QAAQ,IAAI,aAAa;AAC/B,MAAI,kBAAwC;AAC5C,MAAI,cAA6B;AACjC,MAAI,kBAAkB;AAEtB,QAAM,OAAO,EAAE,SAAS,gBAAgB,OAAO,eAAe;AAE9D,iBAAe,QAAQ,SAAiC;AACtD,UAAM,WAAW,OAAO;AACxB,UAAM,QAAQ,IAAI,YAAY,QAAQ,YAAY;AAAA,EACpD;AAEA,iBAAe,SAAwB;AACrC,kBAAc;AACd,UAAM,MAAM;AACZ,UAAM,QAAQ,OAAO,UAAU;AAAA,EACjC;AAQA,WAAS,SAAY,IAAkC;AACrD,UAAM,QAAS,WAAmB,WAAW;AAC7C,WAAO,OAAO,UAAU,MAAM,QAAQ,UAAU,EAAE,IAAI,GAAG;AAAA,EAC3D;AAEA,iBAAe,YAA2B;AACxC,UAAM,SAAS,YAAY;AAGzB,YAAM,eAAe,MAAM,QAAQ,IAAI,UAAU;AACjD,UAAI,CAAC,cAAc;AACjB,cAAM,OAAO;AACb,cAAM,IAAI,kBAAkB,EAAE,MAAM,mBAAmB,SAAS,cAAc,YAAY,IAAI,CAAC;AAAA,MACjG;AACA,UAAI;AACF,cAAM,OAAO,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,iBAAiB,MAAM,EAAE,aAAa,EAAE,CAAC;AACrG,cAAM,QAAQ,IAAe;AAAA,MAC/B,SAAS,KAAK;AAGZ,cAAM,OAAO;AACb,cAAM;AAAA,MACR;AAAA,IACF,CAAC;AAAA,EACH;AAEA,WAAS,UAAyB;AAChC,QAAI,CAAC,iBAAiB;AACpB,wBAAkB,UAAU,EAAE,QAAQ,MAAM;AAAE,0BAAkB;AAAA,MAAM,CAAC;AAAA,IACzE;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,cAAsC;AACnD,UAAM,UAAU,MAAM,UAAU;AAChC,QAAI,MAAM,YAAY,KAAK,WAAW,UAAU,KAAK,IAAI,IAAI,iBAAiB;AAC5E,aAAO,MAAM,YAAY;AAAA,IAC3B;AACA,QAAI,MAAM,QAAQ,IAAI,UAAU,GAAG;AACjC,YAAM,QAAQ;AACd,aAAO,MAAM,YAAY;AAAA,IAC3B;AACA,WAAO,MAAM,YAAY;AAAA,EAC3B;AAEA,iBAAe,eAAiC;AAC9C,QAAI,eAAe,kBAAkB,KAAK,IAAI,EAAG,QAAO;AACxD,QAAI,CAAC,OAAO,iBAAkB,QAAO;AACrC,UAAM,WAAW,MAAM,OAAO,iBAAiB;AAC/C,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,OAAO,QAAQ;AACrB,WAAO;AAAA,EACT;AAEA,iBAAe,OAAO,UAAiC;AACrD,UAAM,OAAO,MAAM,QAAQ;AAAA,MACzB,GAAG;AAAA,MAAM,QAAQ;AAAA,MAAQ,MAAM;AAAA,MAC/B,aAAa,MAAM,YAAY,KAAK;AAAA,MAAW,MAAM,EAAE,SAAS;AAAA,IAClE,CAAC;AACD,kBAAc,KAAK;AACnB,sBAAkB,KAAK,IAAI,KAAK,OAAO,KAAK,SAAS,KAAK,OAAO,MAAO;AAAA,EAC1E;AAEA,iBAAe,KAAc,QAAgB,MAAc,MAA4B;AACrF,QAAI,cAAc;AAClB,QAAI,gBAAgB;AAEpB,eAAS;AACP,YAAM,QAAQ,MAAM,YAAY;AAChC,UAAI;AACF,eAAO,MAAM,QAAQ;AAAA,UACnB,GAAG;AAAA,UAAM;AAAA,UAAQ;AAAA,UAAM;AAAA,UACvB,aAAa,SAAS;AAAA,UACtB,aAAa,eAAe;AAAA,QAC9B,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,cAAM,IAAI;AAOV,cAAM,UAAU,EAAE,eAAe,QAC9B,EAAE,SAAS,kBAAkB,EAAE,SAAS,mBAAmB,EAAE,SAAS;AACzE,YAAI,WAAW,CAAC,aAAa;AAC3B,wBAAc;AACd,gBAAM,QAAQ;AACd;AAAA,QACF;AACA,YAAI,EAAE,SAAS,sBAAsB,CAAC,eAAe;AACnD,0BAAgB;AAChB,wBAAc;AACd,cAAI,MAAM,aAAa,EAAG;AAAA,QAC5B;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,SAAS,OAAO,UAAU;AAC9B,YAAM,OAAO,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,kBAAkB,MAAM,EAAE,OAAO,SAAS,EAAE,CAAC;AACzG,UAAI,MAAM,WAAW,UAAW,QAAO,EAAE,QAAQ,UAAU;AAC3D,YAAM,QAAQ,IAAe;AAC7B,aAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IAEA,MAAM,OAAO,OAAO,UAAU;AAC5B,YAAM,OAAO,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,eAAe,MAAM,EAAE,OAAO,SAAS,EAAE,CAAC;AACtG,YAAM,QAAQ,IAAe;AAAA,IAC/B;AAAA,IAEA,MAAM,UAAU;AACd,UAAI;AAAE,cAAM,KAAK,QAAQ,cAAc;AAAA,MAAG,QAAQ;AAAA,MAA+B;AACjF,YAAM,OAAO;AAAA,IACf;AAAA,IAEA,MAAM,oBAAoB;AACxB,UAAI;AAAE,cAAM,KAAK,QAAQ,kBAAkB;AAAA,MAAG,QAAQ;AAAA,MAA+B;AACrF,YAAM,OAAO;AAAA,IACf;AAAA,IAEA,MAAM,UAAU;AACd,UAAI,CAAE,MAAM,QAAQ,IAAI,UAAU,GAAI;AAAE,cAAM,UAAU,iBAAiB;AAAG;AAAA,MAAQ;AACpF,UAAI;AAAE,cAAM,QAAQ;AAAA,MAAG,QAAQ;AAAA,MAA6B;AAAA,IAC9D;AAAA,IAEA,aAAa,MAAM,MAAM,IAAI;AAAA,IAC7B,WAAW,CAAC,OAAO,MAAM,UAAU,EAAE;AAAA,IACrC;AAAA,IACA;AAAA,IAEA,MAAM,YAAY,OAAO;AACvB,YAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,sBAAsB,MAAM,EAAE,MAAM,EAAE,CAAC;AAKtF,UAAI,MAAM,QAAQ,IAAI,UAAU,GAAG;AACjC,YAAI;AAAE,gBAAM,QAAQ;AAAA,QAAG,QAAQ;AAAA,QAAqC;AAAA,MACtE;AAAA,IACF;AAAA,IAEA,MAAM,qBAAqB;AACzB,YAAM,KAAK,QAAQ,2BAA2B;AAAA,IAChD;AAAA,IAEA,MAAM,eAAe,OAAO;AAG1B,YAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,yBAAyB,MAAM,EAAE,MAAM,EAAE,CAAC;AAAA,IAC3F;AAAA,IAEA,MAAM,cAAc,OAAO,UAAU;AACnC,YAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,wBAAwB,MAAM,EAAE,OAAO,SAAS,EAAE,CAAC;AAElG,YAAM,OAAO;AAAA,IACf;AAAA,IAEA,MAAM,eAAe,UAAU;AAC7B,YAAM,KAAK,QAAQ,uBAAuB,EAAE,SAAS,CAAC;AAMtD,UAAI;AAAE,cAAM,QAAQ;AAAA,MAAG,QAAQ;AAAA,MAA8C;AAAA,IAC/E;AAAA,IAEA,MAAM,eAAe;AACnB,aAAO,KAAsB,OAAO,cAAc;AAAA,IACpD;AAAA,IAEA,MAAM,cAAc,IAAI;AACtB,YAAM,OAAO,MAAM,KAAsB,OAAO,cAAc;AAC9D,YAAM,UAAU,KAAK,KAAK,CAAC,MAAM,EAAE,OAAO;AAC1C,YAAM,KAAK,UAAU,gBAAgB,mBAAmB,EAAE,CAAC,EAAE;AAC7D,UAAI,SAAS,OAAO,GAAI,OAAM,OAAO;AAAA,IACvC;AAAA,EACF;AACF;;;AC7NA,IAAM,MAAM,CAAC,MAAc,mBAAmB,CAAC;AAE/C,SAAS,MAAM,MAAqB;AAClC,QAAM,SAAS,IAAI,gBAAgB;AACnC,MAAI,MAAM,OAAQ,QAAO,IAAI,UAAU,KAAK,MAAM;AAClD,MAAI,MAAM,SAAS,KAAM,QAAO,IAAI,SAAS,OAAO,KAAK,KAAK,CAAC;AAC/D,QAAM,IAAI,OAAO,SAAS;AAC1B,SAAO,IAAI,IAAI,CAAC,KAAK;AACvB;AAEO,SAAS,cAAc,MAAqC;AACjE,QAAM,EAAE,KAAK,IAAI;AACjB,SAAO;AAAA,IACL,YAAY,MAAM,KAAK,OAAO,KAAK;AAAA,IACnC,eAAe,CAAC,UAAU,KAAK,SAAS,OAAO,KAAK;AAAA,IAEpD,eAAe,MAAM,KAAK,OAAO,eAAe;AAAA,IAChD,eAAe,CAAC,UAAU,KAAK,QAAQ,iBAAiB,KAAK;AAAA,IAC7D,eAAe,CAAC,IAAI,UAAU,KAAK,SAAS,iBAAiB,IAAI,EAAE,CAAC,IAAI,KAAK;AAAA,IAC7E,eAAe,CAAC,OAAO,KAAK,UAAU,iBAAiB,IAAI,EAAE,CAAC,EAAE;AAAA,IAEhE,oBAAoB,MAAM,KAAK,OAAO,qBAAqB;AAAA;AAAA;AAAA,IAG3D,yBAAyB,CAAC,OAAO,KAAK,SAAS,uBAAuB,IAAI,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,CAAC;AAAA,IACpG,qBAAqB,CAAC,OAAO,KAAK,UAAU,uBAAuB,IAAI,EAAE,CAAC,EAAE;AAAA,IAE5E,YAAY,CAAC,SAAS,KAAK,OAAO,aAAa,MAAM,IAAI,CAAC,EAAE;AAAA,IAC5D,UAAU,CAAC,OAAO,KAAK,OAAO,cAAc,IAAI,EAAE,CAAC,EAAE;AAAA,IACrD,cAAc,CAAC,SAAS,KAAK,OAAO,eAAe,MAAM,IAAI,CAAC,EAAE;AAAA,IAChE,YAAY,CAAC,OAAO,KAAK,OAAO,gBAAgB,IAAI,EAAE,CAAC,EAAE;AAAA,IACzD,mBAAmB,CAAC,SAAS,KAAK,OAAO,oBAAoB,MAAM,IAAI,CAAC,EAAE;AAAA,IAC1E,iBAAiB,CAAC,OAAO,KAAK,OAAO,qBAAqB,IAAI,EAAE,CAAC,EAAE;AAAA,IAEnE,oBAAoB,CAAC,IAAI,SAAS,KAAK,QAAQ,qBAAqB,IAAI,EAAE,CAAC,WAAW,IAAI;AAAA,IAC1F,mBAAmB,CAAC,OAAO,KAAK,QAAQ,qBAAqB,IAAI,EAAE,CAAC,QAAQ;AAAA,IAC5E,oBAAoB,CAAC,OAAO,KAAK,QAAQ,qBAAqB,IAAI,EAAE,CAAC,SAAS;AAAA,IAE9E,WAAW,CAAC,WAAW,KAAK,QAAQ,aAAa,IAAI,MAAM,CAAC,QAAQ;AAAA,EACtE;AACF;","names":[]}

package/dist/index.cjs

@@ -348,7 +348,10 @@ function createThrottleAuth(config) {
     },
     async changePassword(password) {
       await call("POST", "/me/change-password", { password });
-      await refresh();
+      try {
+        await refresh();
+      } catch {
+      }
     },
     async listSessions() {
       return call("GET", "/me/sessions");

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/request.ts","../src/session.ts","../src/storage.ts","../src/client.ts","../src/account.ts"],"sourcesContent":["export { createThrottleAuth } from './client';\nexport type { ThrottleAuth, DeviceSession } from './client';\nexport { ThrottleAuthError } from './errors';\nexport { memoryStorage, localStorageAdapter } from './storage';\nexport type { AuthSnapshot, AuthStatus } from './session';\nexport type { AuthStorage, Customer, Session, ThrottleAuthConfig } from './types';\nexport { createAccount } from './account';\nexport type { ThrottleAccount, Page } from './account';\nexport type {\n  Address, AddressInput, Invoice, Order, PaymentMethod, ProfilePatch, Subscription,\n} from './types';\n","export class ThrottleAuthError extends Error {\n  readonly code: string;\n  readonly statusCode: number;\n  readonly retryAfter?: number;\n  readonly details?: unknown;\n\n  constructor(args: { code: string; message: string; statusCode: number; retryAfter?: number; details?: unknown }) {\n    super(args.message);\n    this.name = 'ThrottleAuthError';\n    this.code = args.code;\n    this.statusCode = args.statusCode;\n    this.retryAfter = args.retryAfter;\n    this.details = args.details;\n  }\n}\n","import { ThrottleAuthError } from './errors';\n\nexport interface RequestInput {\n  method: string;\n  path: string;\n  baseUrl: string;\n  publishableKey: string;\n  accessToken?: string;\n  stepUpToken?: string;\n  body?: unknown;\n}\n\n/** Returns the UNWRAPPED `data` from the `{ data: … }` envelope. Throws ThrottleAuthError otherwise. */\nexport async function request(input: RequestInput): Promise<any> {\n  const headers: Record<string, string> = { 'X-API-Key': input.publishableKey };\n  if (input.body !== undefined) headers['Content-Type'] = 'application/json';\n  if (input.accessToken) headers.Authorization = `Bearer ${input.accessToken}`;\n  if (input.stepUpToken) headers['X-Step-Up'] = input.stepUpToken;\n\n  const res = await fetch(`${input.baseUrl}/v1/storefront${input.path}`, {\n    method: input.method,\n    headers,\n    ...(input.body !== undefined ? { body: JSON.stringify(input.body) } : {}),\n  });\n\n  const text = await res.text();\n  let parsed: any = {};\n  try {\n    parsed = text ? JSON.parse(text) : {};\n  } catch {\n    // Non-JSON body — an HTML gateway page, say. Leave parsed empty so the\n    // branch below still throws a typed error rather than a raw SyntaxError.\n  }\n\n  if (!res.ok) {\n    const e = parsed?.error ?? {};\n    // `Retry-After` is server-controlled but not trusted: Number('soon') is\n    // NaN, and a NaN reaches the UI as \"wait NaN seconds\".\n    const ra = Number(res.headers.get('retry-after'));\n    throw new ThrottleAuthError({\n      code: e.code ?? 'request_failed',\n      message: e.message ?? `Request failed with ${res.status}`,\n      statusCode: res.status,\n      retryAfter: Number.isFinite(ra) && ra >= 0 ? ra : undefined,\n      details: e.details,\n    });\n  }\n\n  // `'data' in parsed`, not `parsed?.data ?? parsed`: a legitimate\n  // `{ \"data\": null }` is nullish, and `??` would fall through and hand the\n  // caller the whole envelope instead of the null the API actually sent.\n  return parsed && typeof parsed === 'object' && 'data' in parsed ? parsed.data : (parsed ?? {});\n}\n","import type { Customer, Session } from './types';\n\nexport type AuthStatus = 'loading' | 'authenticated' | 'unauthenticated';\n\nexport interface AuthSnapshot {\n  status: AuthStatus;\n  customer: Customer | null;\n  /**\n   * False here does NOT only mean \"we emailed them and they have not clicked\".\n   * While it is false the API may also be withholding pre-existing account\n   * data behind the claim cutoff — empty order lists and a 403 on `PATCH /me`\n   * are expected, not broken. See the plan header.\n   */\n  emailVerified: boolean;\n}\n\ntype Listener = (snapshot: AuthSnapshot) => void;\n\nexport class SessionState {\n  #snapshot: AuthSnapshot = { status: 'loading', customer: null, emailVerified: false };\n  #accessToken: string | null = null;\n  #expiresAt: number | null = null;\n  #listeners = new Set<Listener>();\n\n  get(): AuthSnapshot { return this.#snapshot; }\n  accessToken(): string | null { return this.#accessToken; }\n  expiresAt(): number | null { return this.#expiresAt; }\n\n  setSession(session: Session): void {\n    this.#accessToken = session.accessToken;\n    this.#expiresAt = Date.parse(session.expiresAt);\n    this.#publish({\n      status: 'authenticated',\n      customer: session.customer,\n      emailVerified: Boolean(session.customer?.emailVerified),\n    });\n  }\n\n  setStatus(status: AuthStatus): void {\n    this.#publish({ ...this.#snapshot, status });\n  }\n\n  clear(): void {\n    this.#accessToken = null;\n    this.#expiresAt = null;\n    this.#publish({ status: 'unauthenticated', customer: null, emailVerified: false });\n  }\n\n  subscribe(fn: Listener): () => void {\n    this.#listeners.add(fn);\n    return () => { this.#listeners.delete(fn); };\n  }\n\n  #publish(next: AuthSnapshot): void {\n    // Identity matters: React's useSyncExternalStore re-renders on reference\n    // change, and a token refresh every ten minutes must not re-render the\n    // whole account area when nothing visible changed.\n    const same =\n      next.status === this.#snapshot.status &&\n      next.emailVerified === this.#snapshot.emailVerified &&\n      customerEquals(next.customer, this.#snapshot.customer);\n    if (same) return;\n    this.#snapshot = next;\n    for (const fn of [...this.#listeners]) {\n      // A merchant's subscriber throwing must not stop the rest from hearing.\n      try { fn(next); } catch { /* merchant callback */ }\n    }\n  }\n}\n\nfunction customerEquals(a: Customer | null, b: Customer | null): boolean {\n  if (a === b) return true;\n  if (!a || !b) return false;\n  const keys = new Set([...Object.keys(a), ...Object.keys(b)]) as Set<keyof Customer>;\n  for (const k of keys) if (a[k] !== b[k]) return false;\n  return true;\n}\n","import type { AuthStorage } from './types';\n\nexport type { AuthStorage };\n\nexport function memoryStorage(): AuthStorage {\n  const map = new Map<string, string>();\n  return {\n    get: (k) => map.get(k) ?? null,\n    set: (k, v) => void map.set(k, v),\n    remove: (k) => void map.delete(k),\n  };\n}\n\n/**\n * localStorage when it works, memory when it does not. Safari private mode,\n * hardened browser settings and server-side rendering all make localStorage\n * either absent or throwing; none of them may take the storefront down.\n */\nexport function localStorageAdapter(): AuthStorage {\n  const fallback = memoryStorage();\n  const ls = (): Storage | null => {\n    try {\n      return typeof localStorage !== 'undefined' ? localStorage : null;\n    } catch {\n      return null;\n    }\n  };\n  return {\n    get(k) {\n      try {\n        const v = ls()?.getItem(k);\n        if (v != null) return v;\n      } catch { /* fall through */ }\n      return fallback.get(k);\n    },\n    set(k, v) {\n      fallback.set(k, v);\n      try { ls()?.setItem(k, v); } catch { /* memory-only this session */ }\n    },\n    remove(k) {\n      fallback.remove(k);\n      try { ls()?.removeItem(k); } catch { /* already gone */ }\n    },\n  };\n}\n","import { request } from './request';\nimport { ThrottleAuthError } from './errors';\nimport { SessionState, type AuthSnapshot } from './session';\nimport { localStorageAdapter, type AuthStorage } from './storage';\nimport type { Customer, Session, ThrottleAuthConfig } from './types';\n\nconst DEFAULT_BASE_URL = 'https://api.usethrottle.dev';\n/** Refresh this far before expiry so ordinary calls rarely see a 401 at all. */\nconst REFRESH_SKEW_MS = 30_000;\n\nexport interface DeviceSession {\n  id: string;\n  userAgent: string | null;\n  ipPrefix: string | null;\n  createdAt: string;\n  lastUsedAt: string;\n  current: boolean;\n}\n\nexport interface ThrottleAuth {\n  register(email: string, password: string): Promise<{ status: 'active' | 'pending' }>;\n  signIn(email: string, password: string): Promise<void>;\n  signOut(): Promise<void>;\n  signOutEverywhere(): Promise<void>;\n  restore(): Promise<void>;\n  getSnapshot(): AuthSnapshot;\n  subscribe(fn: (s: AuthSnapshot) => void): () => void;\n  stepUp(password: string): Promise<void>;\n  call<T = any>(method: string, path: string, body?: unknown): Promise<T>;\n  verifyEmail(token: string): Promise<void>;\n  resendVerification(): Promise<void>;\n  forgotPassword(email: string): Promise<void>;\n  resetPassword(token: string, password: string): Promise<void>;\n  changePassword(password: string): Promise<void>;\n  listSessions(): Promise<DeviceSession[]>;\n  revokeSession(id: string): Promise<void>;\n}\n\nexport function createThrottleAuth(config: ThrottleAuthConfig): ThrottleAuth {\n  const baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/$/, '');\n  const storage: AuthStorage = config.storage ?? localStorageAdapter();\n  // Namespaced by key so two Throttle applications on one origin cannot read\n  // each other's refresh token out of shared localStorage.\n  const storageKey = `throttle_auth_rt:${config.publishableKey}`;\n  const lockName = `throttle_auth_refresh:${config.publishableKey}`;\n\n  const state = new SessionState();\n  let refreshInFlight: Promise<void> | null = null;\n  let stepUpToken: string | null = null;\n  let stepUpExpiresAt = 0;\n\n  const base = { baseUrl, publishableKey: config.publishableKey };\n\n  async function persist(session: Session): Promise<void> {\n    state.setSession(session);\n    await storage.set(storageKey, session.refreshToken);\n  }\n\n  async function forget(): Promise<void> {\n    stepUpToken = null;\n    state.clear();\n    await storage.remove(storageKey);\n  }\n\n  /**\n   * Cross-tab single flight. Two tabs refreshing at once would each present the\n   * same stored token; the second is a replay, and the server kills the family.\n   * Web Locks serialises them; where it is unavailable the in-process guard\n   * below still covers the common single-tab case.\n   */\n  function withLock<T>(fn: () => Promise<T>): Promise<T> {\n    const locks = (globalThis as any).navigator?.locks;\n    return locks?.request ? locks.request(lockName, fn) : fn();\n  }\n\n  async function doRefresh(): Promise<void> {\n    await withLock(async () => {\n      // Re-read INSIDE the lock: another tab may have rotated while we waited,\n      // and presenting the token we read before the lock would be a replay.\n      const refreshToken = await storage.get(storageKey);\n      if (!refreshToken) {\n        await forget();\n        throw new ThrottleAuthError({ code: 'session_revoked', message: 'No session', statusCode: 401 });\n      }\n      try {\n        const data = await request({ ...base, method: 'POST', path: '/auth/refresh', body: { refreshToken } });\n        await persist(data as Session);\n      } catch (err) {\n        // Any refusal of a refresh token is terminal — there is nothing left to\n        // retry with. Drop it rather than letting a dead token sit in storage.\n        await forget();\n        throw err;\n      }\n    });\n  }\n\n  function refresh(): Promise<void> {\n    if (!refreshInFlight) {\n      refreshInFlight = doRefresh().finally(() => { refreshInFlight = null; });\n    }\n    return refreshInFlight;\n  }\n\n  async function accessToken(): Promise<string | null> {\n    const expires = state.expiresAt();\n    if (state.accessToken() && expires && expires - Date.now() > REFRESH_SKEW_MS) {\n      return state.accessToken();\n    }\n    if (await storage.get(storageKey)) {\n      await refresh();\n      return state.accessToken();\n    }\n    return state.accessToken();\n  }\n\n  async function ensureStepUp(): Promise<boolean> {\n    if (stepUpToken && stepUpExpiresAt > Date.now()) return true;\n    if (!config.onStepUpRequired) return false;\n    const password = await config.onStepUpRequired();\n    if (!password) return false;\n    await stepUp(password);\n    return true;\n  }\n\n  async function stepUp(password: string): Promise<void> {\n    const data = await request({\n      ...base, method: 'POST', path: '/auth/step-up',\n      accessToken: await accessToken() ?? undefined, body: { password },\n    });\n    stepUpToken = data.stepUpToken;\n    stepUpExpiresAt = Date.now() + (Number(data.expiresIn) || 300) * 1000 - 5_000;\n  }\n\n  async function call<T = any>(method: string, path: string, body?: unknown): Promise<T> {\n    let retriedAuth = false;\n    let retriedStepUp = false;\n\n    for (;;) {\n      const token = await accessToken();\n      try {\n        return await request({\n          ...base, method, path, body,\n          accessToken: token ?? undefined,\n          stepUpToken: stepUpToken ?? undefined,\n        });\n      } catch (err) {\n        const e = err as ThrottleAuthError;\n        // `session_revoked` belongs here too. The server returns it for a\n        // stale session EPOCH as well as for a genuinely dead session, and a\n        // changed password bumps the epoch while deliberately sparing the\n        // current session — so one refresh recovers it. When the session\n        // really is dead the refresh fails and forget() runs, which is the\n        // same outcome, one request later.\n        const expired = e.statusCode === 401 &&\n          (e.code === 'unauthorized' || e.code === 'token_expired' || e.code === 'session_revoked');\n        if (expired && !retriedAuth) {\n          retriedAuth = true;\n          await refresh();   // shared — ten callers here produce ONE request\n          continue;\n        }\n        if (e.code === 'step_up_required' && !retriedStepUp) {\n          retriedStepUp = true;\n          stepUpToken = null;\n          if (await ensureStepUp()) continue;\n        }\n        throw err;\n      }\n    }\n  }\n\n  return {\n    async register(email, password) {\n      const data = await request({ ...base, method: 'POST', path: '/auth/register', body: { email, password } });\n      if (data?.status === 'pending') return { status: 'pending' };\n      await persist(data as Session);\n      return { status: 'active' };\n    },\n\n    async signIn(email, password) {\n      const data = await request({ ...base, method: 'POST', path: '/auth/login', body: { email, password } });\n      await persist(data as Session);\n    },\n\n    async signOut() {\n      try { await call('POST', '/auth/logout'); } catch { /* local state still goes */ }\n      await forget();\n    },\n\n    async signOutEverywhere() {\n      try { await call('POST', '/auth/logout-all'); } catch { /* local state still goes */ }\n      await forget();\n    },\n\n    async restore() {\n      if (!(await storage.get(storageKey))) { state.setStatus('unauthenticated'); return; }\n      try { await refresh(); } catch { /* forget() already ran */ }\n    },\n\n    getSnapshot: () => state.get(),\n    subscribe: (fn) => state.subscribe(fn),\n    stepUp,\n    call,\n\n    async verifyEmail(token) {\n      await request({ ...base, method: 'POST', path: '/auth/verify-email', body: { token } });\n      // `ver` is a claim baked into the access token, and the claim cutoff is\n      // read from the session row. Without a new token the buyer stays gated —\n      // and their own order history stays hidden — for the rest of this\n      // token's ten minutes.\n      if (await storage.get(storageKey)) {\n        try { await refresh(); } catch { /* verification still succeeded */ }\n      }\n    },\n\n    async resendVerification() {\n      await call('POST', '/auth/verify-email/resend');\n    },\n\n    async forgotPassword(email) {\n      // Always 202, whether or not the address has an account. Do not infer\n      // anything from it and do not tell the buyer whether it existed.\n      await request({ ...base, method: 'POST', path: '/auth/forgot-password', body: { email } });\n    },\n\n    async resetPassword(token, password) {\n      await request({ ...base, method: 'POST', path: '/auth/reset-password', body: { token, password } });\n      // The server revokes every session on reset, this one included.\n      await forget();\n    },\n\n    async changePassword(password) {\n      await call('POST', '/me/change-password', { password });\n      // The change bumps the session epoch. This session was deliberately\n      // spared, but the access token in hand now carries a stale epoch and the\n      // next write would 401. Rotate now rather than on the buyer's next click.\n      await refresh();\n    },\n\n    async listSessions() {\n      return call<DeviceSession[]>('GET', '/me/sessions');\n    },\n\n    async revokeSession(id) {\n      const mine = await call<DeviceSession[]>('GET', '/me/sessions');\n      const current = mine.find((s) => s.current);\n      await call('DELETE', `/me/sessions/${encodeURIComponent(id)}`);\n      if (current?.id === id) await forget();\n    },\n  };\n}\n\nexport type { AuthSnapshot, Customer, Session, ThrottleAuthConfig };\n","import type { ThrottleAuth } from './client';\nimport type {\n  Address, AddressInput, Customer, Invoice, Order,\n  PaymentMethod, ProfilePatch, Subscription,\n} from './types';\n\nexport interface Page { cursor?: string; limit?: number }\n\nexport interface ThrottleAccount {\n  getProfile(): Promise<Customer>;\n  updateProfile(patch: ProfilePatch): Promise<Customer>;\n  listAddresses(): Promise<Address[]>;\n  createAddress(input: AddressInput): Promise<Address>;\n  updateAddress(id: string, patch: Partial<AddressInput>): Promise<Address>;\n  deleteAddress(id: string): Promise<void>;\n  listPaymentMethods(): Promise<PaymentMethod[]>;\n  setDefaultPaymentMethod(id: string): Promise<PaymentMethod>;\n  deletePaymentMethod(id: string): Promise<void>;\n  listOrders(page?: Page): Promise<Order[]>;\n  getOrder(id: string): Promise<Order>;\n  listInvoices(page?: Page): Promise<Invoice[]>;\n  getInvoice(id: string): Promise<Invoice>;\n  listSubscriptions(page?: Page): Promise<Subscription[]>;\n  getSubscription(id: string): Promise<Subscription>;\n  cancelSubscription(id: string, opts?: { atPeriodEnd?: boolean }): Promise<Subscription>;\n  pauseSubscription(id: string): Promise<Subscription>;\n  resumeSubscription(id: string): Promise<Subscription>;\n  claimCart(cartId: string): Promise<{ cartId: string; customerId: string }>;\n}\n\nconst seg = (v: string) => encodeURIComponent(v);\n\nfunction query(page?: Page): string {\n  const params = new URLSearchParams();\n  if (page?.cursor) params.set('cursor', page.cursor);\n  if (page?.limit != null) params.set('limit', String(page.limit));\n  const s = params.toString();\n  return s ? `?${s}` : '';\n}\n\nexport function createAccount(auth: ThrottleAuth): ThrottleAccount {\n  const { call } = auth;\n  return {\n    getProfile: () => call('GET', '/me'),\n    updateProfile: (patch) => call('PATCH', '/me', patch),\n\n    listAddresses: () => call('GET', '/me/addresses'),\n    createAddress: (input) => call('POST', '/me/addresses', input),\n    updateAddress: (id, patch) => call('PATCH', `/me/addresses/${seg(id)}`, patch),\n    deleteAddress: (id) => call('DELETE', `/me/addresses/${seg(id)}`),\n\n    listPaymentMethods: () => call('GET', '/me/payment-methods'),\n    // The platform has no \"change this subscription's card\" capability, so\n    // this is how a buyer changes what they are billed on: move the default.\n    setDefaultPaymentMethod: (id) => call('PATCH', `/me/payment-methods/${seg(id)}`, { isDefault: true }),\n    deletePaymentMethod: (id) => call('DELETE', `/me/payment-methods/${seg(id)}`),\n\n    listOrders: (page) => call('GET', `/me/orders${query(page)}`),\n    getOrder: (id) => call('GET', `/me/orders/${seg(id)}`),\n    listInvoices: (page) => call('GET', `/me/invoices${query(page)}`),\n    getInvoice: (id) => call('GET', `/me/invoices/${seg(id)}`),\n    listSubscriptions: (page) => call('GET', `/me/subscriptions${query(page)}`),\n    getSubscription: (id) => call('GET', `/me/subscriptions/${seg(id)}`),\n\n    cancelSubscription: (id, opts) => call('POST', `/me/subscriptions/${seg(id)}/cancel`, opts),\n    pauseSubscription: (id) => call('POST', `/me/subscriptions/${seg(id)}/pause`),\n    resumeSubscription: (id) => call('POST', `/me/subscriptions/${seg(id)}/resume`),\n\n    claimCart: (cartId) => call('POST', `/me/carts/${seg(cartId)}/claim`),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAAqG;AAC/G,UAAM,KAAK,OAAO;AAClB,SAAK,OAAO;AACZ,SAAK,OAAO,KAAK;AACjB,SAAK,aAAa,KAAK;AACvB,SAAK,aAAa,KAAK;AACvB,SAAK,UAAU,KAAK;AAAA,EACtB;AACF;;;ACDA,eAAsB,QAAQ,OAAmC;AAC/D,QAAM,UAAkC,EAAE,aAAa,MAAM,eAAe;AAC5E,MAAI,MAAM,SAAS,OAAW,SAAQ,cAAc,IAAI;AACxD,MAAI,MAAM,YAAa,SAAQ,gBAAgB,UAAU,MAAM,WAAW;AAC1E,MAAI,MAAM,YAAa,SAAQ,WAAW,IAAI,MAAM;AAEpD,QAAM,MAAM,MAAM,MAAM,GAAG,MAAM,OAAO,iBAAiB,MAAM,IAAI,IAAI;AAAA,IACrE,QAAQ,MAAM;AAAA,IACd;AAAA,IACA,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,KAAK,UAAU,MAAM,IAAI,EAAE,IAAI,CAAC;AAAA,EACzE,CAAC;AAED,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,MAAI,SAAc,CAAC;AACnB,MAAI;AACF,aAAS,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC;AAAA,EACtC,QAAQ;AAAA,EAGR;AAEA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,QAAQ,SAAS,CAAC;AAG5B,UAAM,KAAK,OAAO,IAAI,QAAQ,IAAI,aAAa,CAAC;AAChD,UAAM,IAAI,kBAAkB;AAAA,MAC1B,MAAM,EAAE,QAAQ;AAAA,MAChB,SAAS,EAAE,WAAW,uBAAuB,IAAI,MAAM;AAAA,MACvD,YAAY,IAAI;AAAA,MAChB,YAAY,OAAO,SAAS,EAAE,KAAK,MAAM,IAAI,KAAK;AAAA,MAClD,SAAS,EAAE;AAAA,IACb,CAAC;AAAA,EACH;AAKA,SAAO,UAAU,OAAO,WAAW,YAAY,UAAU,SAAS,OAAO,OAAQ,UAAU,CAAC;AAC9F;;;AClCO,IAAM,eAAN,MAAmB;AAAA,EACxB,YAA0B,EAAE,QAAQ,WAAW,UAAU,MAAM,eAAe,MAAM;AAAA,EACpF,eAA8B;AAAA,EAC9B,aAA4B;AAAA,EAC5B,aAAa,oBAAI,IAAc;AAAA,EAE/B,MAAoB;AAAE,WAAO,KAAK;AAAA,EAAW;AAAA,EAC7C,cAA6B;AAAE,WAAO,KAAK;AAAA,EAAc;AAAA,EACzD,YAA2B;AAAE,WAAO,KAAK;AAAA,EAAY;AAAA,EAErD,WAAW,SAAwB;AACjC,SAAK,eAAe,QAAQ;AAC5B,SAAK,aAAa,KAAK,MAAM,QAAQ,SAAS;AAC9C,SAAK,SAAS;AAAA,MACZ,QAAQ;AAAA,MACR,UAAU,QAAQ;AAAA,MAClB,eAAe,QAAQ,QAAQ,UAAU,aAAa;AAAA,IACxD,CAAC;AAAA,EACH;AAAA,EAEA,UAAU,QAA0B;AAClC,SAAK,SAAS,EAAE,GAAG,KAAK,WAAW,OAAO,CAAC;AAAA,EAC7C;AAAA,EAEA,QAAc;AACZ,SAAK,eAAe;AACpB,SAAK,aAAa;AAClB,SAAK,SAAS,EAAE,QAAQ,mBAAmB,UAAU,MAAM,eAAe,MAAM,CAAC;AAAA,EACnF;AAAA,EAEA,UAAU,IAA0B;AAClC,SAAK,WAAW,IAAI,EAAE;AACtB,WAAO,MAAM;AAAE,WAAK,WAAW,OAAO,EAAE;AAAA,IAAG;AAAA,EAC7C;AAAA,EAEA,SAAS,MAA0B;AAIjC,UAAM,OACJ,KAAK,WAAW,KAAK,UAAU,UAC/B,KAAK,kBAAkB,KAAK,UAAU,iBACtC,eAAe,KAAK,UAAU,KAAK,UAAU,QAAQ;AACvD,QAAI,KAAM;AACV,SAAK,YAAY;AACjB,eAAW,MAAM,CAAC,GAAG,KAAK,UAAU,GAAG;AAErC,UAAI;AAAE,WAAG,IAAI;AAAA,MAAG,QAAQ;AAAA,MAA0B;AAAA,IACpD;AAAA,EACF;AACF;AAEA,SAAS,eAAe,GAAoB,GAA6B;AACvE,MAAI,MAAM,EAAG,QAAO;AACpB,MAAI,CAAC,KAAK,CAAC,EAAG,QAAO;AACrB,QAAM,OAAO,oBAAI,IAAI,CAAC,GAAG,OAAO,KAAK,CAAC,GAAG,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC;AAC3D,aAAW,KAAK,KAAM,KAAI,EAAE,CAAC,MAAM,EAAE,CAAC,EAAG,QAAO;AAChD,SAAO;AACT;;;ACxEO,SAAS,gBAA6B;AAC3C,QAAM,MAAM,oBAAI,IAAoB;AACpC,SAAO;AAAA,IACL,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK;AAAA,IAC1B,KAAK,CAAC,GAAG,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC;AAAA,IAChC,QAAQ,CAAC,MAAM,KAAK,IAAI,OAAO,CAAC;AAAA,EAClC;AACF;AAOO,SAAS,sBAAmC;AACjD,QAAM,WAAW,cAAc;AAC/B,QAAM,KAAK,MAAsB;AAC/B,QAAI;AACF,aAAO,OAAO,iBAAiB,cAAc,eAAe;AAAA,IAC9D,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AAAA,IACL,IAAI,GAAG;AACL,UAAI;AACF,cAAM,IAAI,GAAG,GAAG,QAAQ,CAAC;AACzB,YAAI,KAAK,KAAM,QAAO;AAAA,MACxB,QAAQ;AAAA,MAAqB;AAC7B,aAAO,SAAS,IAAI,CAAC;AAAA,IACvB;AAAA,IACA,IAAI,GAAG,GAAG;AACR,eAAS,IAAI,GAAG,CAAC;AACjB,UAAI;AAAE,WAAG,GAAG,QAAQ,GAAG,CAAC;AAAA,MAAG,QAAQ;AAAA,MAAiC;AAAA,IACtE;AAAA,IACA,OAAO,GAAG;AACR,eAAS,OAAO,CAAC;AACjB,UAAI;AAAE,WAAG,GAAG,WAAW,CAAC;AAAA,MAAG,QAAQ;AAAA,MAAqB;AAAA,IAC1D;AAAA,EACF;AACF;;;ACtCA,IAAM,mBAAmB;AAEzB,IAAM,kBAAkB;AA8BjB,SAAS,mBAAmB,QAA0C;AAC3E,QAAM,WAAW,OAAO,WAAW,kBAAkB,QAAQ,OAAO,EAAE;AACtE,QAAM,UAAuB,OAAO,WAAW,oBAAoB;AAGnE,QAAM,aAAa,oBAAoB,OAAO,cAAc;AAC5D,QAAM,WAAW,yBAAyB,OAAO,cAAc;AAE/D,QAAM,QAAQ,IAAI,aAAa;AAC/B,MAAI,kBAAwC;AAC5C,MAAI,cAA6B;AACjC,MAAI,kBAAkB;AAEtB,QAAM,OAAO,EAAE,SAAS,gBAAgB,OAAO,eAAe;AAE9D,iBAAe,QAAQ,SAAiC;AACtD,UAAM,WAAW,OAAO;AACxB,UAAM,QAAQ,IAAI,YAAY,QAAQ,YAAY;AAAA,EACpD;AAEA,iBAAe,SAAwB;AACrC,kBAAc;AACd,UAAM,MAAM;AACZ,UAAM,QAAQ,OAAO,UAAU;AAAA,EACjC;AAQA,WAAS,SAAY,IAAkC;AACrD,UAAM,QAAS,WAAmB,WAAW;AAC7C,WAAO,OAAO,UAAU,MAAM,QAAQ,UAAU,EAAE,IAAI,GAAG;AAAA,EAC3D;AAEA,iBAAe,YAA2B;AACxC,UAAM,SAAS,YAAY;AAGzB,YAAM,eAAe,MAAM,QAAQ,IAAI,UAAU;AACjD,UAAI,CAAC,cAAc;AACjB,cAAM,OAAO;AACb,cAAM,IAAI,kBAAkB,EAAE,MAAM,mBAAmB,SAAS,cAAc,YAAY,IAAI,CAAC;AAAA,MACjG;AACA,UAAI;AACF,cAAM,OAAO,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,iBAAiB,MAAM,EAAE,aAAa,EAAE,CAAC;AACrG,cAAM,QAAQ,IAAe;AAAA,MAC/B,SAAS,KAAK;AAGZ,cAAM,OAAO;AACb,cAAM;AAAA,MACR;AAAA,IACF,CAAC;AAAA,EACH;AAEA,WAAS,UAAyB;AAChC,QAAI,CAAC,iBAAiB;AACpB,wBAAkB,UAAU,EAAE,QAAQ,MAAM;AAAE,0BAAkB;AAAA,MAAM,CAAC;AAAA,IACzE;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,cAAsC;AACnD,UAAM,UAAU,MAAM,UAAU;AAChC,QAAI,MAAM,YAAY,KAAK,WAAW,UAAU,KAAK,IAAI,IAAI,iBAAiB;AAC5E,aAAO,MAAM,YAAY;AAAA,IAC3B;AACA,QAAI,MAAM,QAAQ,IAAI,UAAU,GAAG;AACjC,YAAM,QAAQ;AACd,aAAO,MAAM,YAAY;AAAA,IAC3B;AACA,WAAO,MAAM,YAAY;AAAA,EAC3B;AAEA,iBAAe,eAAiC;AAC9C,QAAI,eAAe,kBAAkB,KAAK,IAAI,EAAG,QAAO;AACxD,QAAI,CAAC,OAAO,iBAAkB,QAAO;AACrC,UAAM,WAAW,MAAM,OAAO,iBAAiB;AAC/C,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,OAAO,QAAQ;AACrB,WAAO;AAAA,EACT;AAEA,iBAAe,OAAO,UAAiC;AACrD,UAAM,OAAO,MAAM,QAAQ;AAAA,MACzB,GAAG;AAAA,MAAM,QAAQ;AAAA,MAAQ,MAAM;AAAA,MAC/B,aAAa,MAAM,YAAY,KAAK;AAAA,MAAW,MAAM,EAAE,SAAS;AAAA,IAClE,CAAC;AACD,kBAAc,KAAK;AACnB,sBAAkB,KAAK,IAAI,KAAK,OAAO,KAAK,SAAS,KAAK,OAAO,MAAO;AAAA,EAC1E;AAEA,iBAAe,KAAc,QAAgB,MAAc,MAA4B;AACrF,QAAI,cAAc;AAClB,QAAI,gBAAgB;AAEpB,eAAS;AACP,YAAM,QAAQ,MAAM,YAAY;AAChC,UAAI;AACF,eAAO,MAAM,QAAQ;AAAA,UACnB,GAAG;AAAA,UAAM;AAAA,UAAQ;AAAA,UAAM;AAAA,UACvB,aAAa,SAAS;AAAA,UACtB,aAAa,eAAe;AAAA,QAC9B,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,cAAM,IAAI;AAOV,cAAM,UAAU,EAAE,eAAe,QAC9B,EAAE,SAAS,kBAAkB,EAAE,SAAS,mBAAmB,EAAE,SAAS;AACzE,YAAI,WAAW,CAAC,aAAa;AAC3B,wBAAc;AACd,gBAAM,QAAQ;AACd;AAAA,QACF;AACA,YAAI,EAAE,SAAS,sBAAsB,CAAC,eAAe;AACnD,0BAAgB;AAChB,wBAAc;AACd,cAAI,MAAM,aAAa,EAAG;AAAA,QAC5B;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,SAAS,OAAO,UAAU;AAC9B,YAAM,OAAO,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,kBAAkB,MAAM,EAAE,OAAO,SAAS,EAAE,CAAC;AACzG,UAAI,MAAM,WAAW,UAAW,QAAO,EAAE,QAAQ,UAAU;AAC3D,YAAM,QAAQ,IAAe;AAC7B,aAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IAEA,MAAM,OAAO,OAAO,UAAU;AAC5B,YAAM,OAAO,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,eAAe,MAAM,EAAE,OAAO,SAAS,EAAE,CAAC;AACtG,YAAM,QAAQ,IAAe;AAAA,IAC/B;AAAA,IAEA,MAAM,UAAU;AACd,UAAI;AAAE,cAAM,KAAK,QAAQ,cAAc;AAAA,MAAG,QAAQ;AAAA,MAA+B;AACjF,YAAM,OAAO;AAAA,IACf;AAAA,IAEA,MAAM,oBAAoB;AACxB,UAAI;AAAE,cAAM,KAAK,QAAQ,kBAAkB;AAAA,MAAG,QAAQ;AAAA,MAA+B;AACrF,YAAM,OAAO;AAAA,IACf;AAAA,IAEA,MAAM,UAAU;AACd,UAAI,CAAE,MAAM,QAAQ,IAAI,UAAU,GAAI;AAAE,cAAM,UAAU,iBAAiB;AAAG;AAAA,MAAQ;AACpF,UAAI;AAAE,cAAM,QAAQ;AAAA,MAAG,QAAQ;AAAA,MAA6B;AAAA,IAC9D;AAAA,IAEA,aAAa,MAAM,MAAM,IAAI;AAAA,IAC7B,WAAW,CAAC,OAAO,MAAM,UAAU,EAAE;AAAA,IACrC;AAAA,IACA;AAAA,IAEA,MAAM,YAAY,OAAO;AACvB,YAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,sBAAsB,MAAM,EAAE,MAAM,EAAE,CAAC;AAKtF,UAAI,MAAM,QAAQ,IAAI,UAAU,GAAG;AACjC,YAAI;AAAE,gBAAM,QAAQ;AAAA,QAAG,QAAQ;AAAA,QAAqC;AAAA,MACtE;AAAA,IACF;AAAA,IAEA,MAAM,qBAAqB;AACzB,YAAM,KAAK,QAAQ,2BAA2B;AAAA,IAChD;AAAA,IAEA,MAAM,eAAe,OAAO;AAG1B,YAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,yBAAyB,MAAM,EAAE,MAAM,EAAE,CAAC;AAAA,IAC3F;AAAA,IAEA,MAAM,cAAc,OAAO,UAAU;AACnC,YAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,wBAAwB,MAAM,EAAE,OAAO,SAAS,EAAE,CAAC;AAElG,YAAM,OAAO;AAAA,IACf;AAAA,IAEA,MAAM,eAAe,UAAU;AAC7B,YAAM,KAAK,QAAQ,uBAAuB,EAAE,SAAS,CAAC;AAItD,YAAM,QAAQ;AAAA,IAChB;AAAA,IAEA,MAAM,eAAe;AACnB,aAAO,KAAsB,OAAO,cAAc;AAAA,IACpD;AAAA,IAEA,MAAM,cAAc,IAAI;AACtB,YAAM,OAAO,MAAM,KAAsB,OAAO,cAAc;AAC9D,YAAM,UAAU,KAAK,KAAK,CAAC,MAAM,EAAE,OAAO;AAC1C,YAAM,KAAK,UAAU,gBAAgB,mBAAmB,EAAE,CAAC,EAAE;AAC7D,UAAI,SAAS,OAAO,GAAI,OAAM,OAAO;AAAA,IACvC;AAAA,EACF;AACF;;;AC3NA,IAAM,MAAM,CAAC,MAAc,mBAAmB,CAAC;AAE/C,SAAS,MAAM,MAAqB;AAClC,QAAM,SAAS,IAAI,gBAAgB;AACnC,MAAI,MAAM,OAAQ,QAAO,IAAI,UAAU,KAAK,MAAM;AAClD,MAAI,MAAM,SAAS,KAAM,QAAO,IAAI,SAAS,OAAO,KAAK,KAAK,CAAC;AAC/D,QAAM,IAAI,OAAO,SAAS;AAC1B,SAAO,IAAI,IAAI,CAAC,KAAK;AACvB;AAEO,SAAS,cAAc,MAAqC;AACjE,QAAM,EAAE,KAAK,IAAI;AACjB,SAAO;AAAA,IACL,YAAY,MAAM,KAAK,OAAO,KAAK;AAAA,IACnC,eAAe,CAAC,UAAU,KAAK,SAAS,OAAO,KAAK;AAAA,IAEpD,eAAe,MAAM,KAAK,OAAO,eAAe;AAAA,IAChD,eAAe,CAAC,UAAU,KAAK,QAAQ,iBAAiB,KAAK;AAAA,IAC7D,eAAe,CAAC,IAAI,UAAU,KAAK,SAAS,iBAAiB,IAAI,EAAE,CAAC,IAAI,KAAK;AAAA,IAC7E,eAAe,CAAC,OAAO,KAAK,UAAU,iBAAiB,IAAI,EAAE,CAAC,EAAE;AAAA,IAEhE,oBAAoB,MAAM,KAAK,OAAO,qBAAqB;AAAA;AAAA;AAAA,IAG3D,yBAAyB,CAAC,OAAO,KAAK,SAAS,uBAAuB,IAAI,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,CAAC;AAAA,IACpG,qBAAqB,CAAC,OAAO,KAAK,UAAU,uBAAuB,IAAI,EAAE,CAAC,EAAE;AAAA,IAE5E,YAAY,CAAC,SAAS,KAAK,OAAO,aAAa,MAAM,IAAI,CAAC,EAAE;AAAA,IAC5D,UAAU,CAAC,OAAO,KAAK,OAAO,cAAc,IAAI,EAAE,CAAC,EAAE;AAAA,IACrD,cAAc,CAAC,SAAS,KAAK,OAAO,eAAe,MAAM,IAAI,CAAC,EAAE;AAAA,IAChE,YAAY,CAAC,OAAO,KAAK,OAAO,gBAAgB,IAAI,EAAE,CAAC,EAAE;AAAA,IACzD,mBAAmB,CAAC,SAAS,KAAK,OAAO,oBAAoB,MAAM,IAAI,CAAC,EAAE;AAAA,IAC1E,iBAAiB,CAAC,OAAO,KAAK,OAAO,qBAAqB,IAAI,EAAE,CAAC,EAAE;AAAA,IAEnE,oBAAoB,CAAC,IAAI,SAAS,KAAK,QAAQ,qBAAqB,IAAI,EAAE,CAAC,WAAW,IAAI;AAAA,IAC1F,mBAAmB,CAAC,OAAO,KAAK,QAAQ,qBAAqB,IAAI,EAAE,CAAC,QAAQ;AAAA,IAC5E,oBAAoB,CAAC,OAAO,KAAK,QAAQ,qBAAqB,IAAI,EAAE,CAAC,SAAS;AAAA,IAE9E,WAAW,CAAC,WAAW,KAAK,QAAQ,aAAa,IAAI,MAAM,CAAC,QAAQ;AAAA,EACtE;AACF;","names":[]}
+{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/request.ts","../src/session.ts","../src/storage.ts","../src/client.ts","../src/account.ts"],"sourcesContent":["export { createThrottleAuth } from './client';\nexport type { ThrottleAuth, DeviceSession } from './client';\nexport { ThrottleAuthError } from './errors';\nexport { memoryStorage, localStorageAdapter } from './storage';\nexport type { AuthSnapshot, AuthStatus } from './session';\nexport type { AuthStorage, Customer, Session, ThrottleAuthConfig } from './types';\nexport { createAccount } from './account';\nexport type { ThrottleAccount, Page } from './account';\nexport type {\n  Address, AddressInput, Invoice, Order, PaymentMethod, ProfilePatch, Subscription,\n} from './types';\n","export class ThrottleAuthError extends Error {\n  readonly code: string;\n  readonly statusCode: number;\n  readonly retryAfter?: number;\n  readonly details?: unknown;\n\n  constructor(args: { code: string; message: string; statusCode: number; retryAfter?: number; details?: unknown }) {\n    super(args.message);\n    this.name = 'ThrottleAuthError';\n    this.code = args.code;\n    this.statusCode = args.statusCode;\n    this.retryAfter = args.retryAfter;\n    this.details = args.details;\n  }\n}\n","import { ThrottleAuthError } from './errors';\n\nexport interface RequestInput {\n  method: string;\n  path: string;\n  baseUrl: string;\n  publishableKey: string;\n  accessToken?: string;\n  stepUpToken?: string;\n  body?: unknown;\n}\n\n/** Returns the UNWRAPPED `data` from the `{ data: … }` envelope. Throws ThrottleAuthError otherwise. */\nexport async function request(input: RequestInput): Promise<any> {\n  const headers: Record<string, string> = { 'X-API-Key': input.publishableKey };\n  if (input.body !== undefined) headers['Content-Type'] = 'application/json';\n  if (input.accessToken) headers.Authorization = `Bearer ${input.accessToken}`;\n  if (input.stepUpToken) headers['X-Step-Up'] = input.stepUpToken;\n\n  const res = await fetch(`${input.baseUrl}/v1/storefront${input.path}`, {\n    method: input.method,\n    headers,\n    ...(input.body !== undefined ? { body: JSON.stringify(input.body) } : {}),\n  });\n\n  const text = await res.text();\n  let parsed: any = {};\n  try {\n    parsed = text ? JSON.parse(text) : {};\n  } catch {\n    // Non-JSON body — an HTML gateway page, say. Leave parsed empty so the\n    // branch below still throws a typed error rather than a raw SyntaxError.\n  }\n\n  if (!res.ok) {\n    const e = parsed?.error ?? {};\n    // `Retry-After` is server-controlled but not trusted: Number('soon') is\n    // NaN, and a NaN reaches the UI as \"wait NaN seconds\".\n    const ra = Number(res.headers.get('retry-after'));\n    throw new ThrottleAuthError({\n      code: e.code ?? 'request_failed',\n      message: e.message ?? `Request failed with ${res.status}`,\n      statusCode: res.status,\n      retryAfter: Number.isFinite(ra) && ra >= 0 ? ra : undefined,\n      details: e.details,\n    });\n  }\n\n  // `'data' in parsed`, not `parsed?.data ?? parsed`: a legitimate\n  // `{ \"data\": null }` is nullish, and `??` would fall through and hand the\n  // caller the whole envelope instead of the null the API actually sent.\n  return parsed && typeof parsed === 'object' && 'data' in parsed ? parsed.data : (parsed ?? {});\n}\n","import type { Customer, Session } from './types';\n\nexport type AuthStatus = 'loading' | 'authenticated' | 'unauthenticated';\n\nexport interface AuthSnapshot {\n  status: AuthStatus;\n  customer: Customer | null;\n  /**\n   * False here does NOT only mean \"we emailed them and they have not clicked\".\n   * While it is false the API may also be withholding pre-existing account\n   * data behind the claim cutoff — empty order lists and a 403 on `PATCH /me`\n   * are expected, not broken. See the plan header.\n   */\n  emailVerified: boolean;\n}\n\ntype Listener = (snapshot: AuthSnapshot) => void;\n\nexport class SessionState {\n  #snapshot: AuthSnapshot = { status: 'loading', customer: null, emailVerified: false };\n  #accessToken: string | null = null;\n  #expiresAt: number | null = null;\n  #listeners = new Set<Listener>();\n\n  get(): AuthSnapshot { return this.#snapshot; }\n  accessToken(): string | null { return this.#accessToken; }\n  expiresAt(): number | null { return this.#expiresAt; }\n\n  setSession(session: Session): void {\n    this.#accessToken = session.accessToken;\n    this.#expiresAt = Date.parse(session.expiresAt);\n    this.#publish({\n      status: 'authenticated',\n      customer: session.customer,\n      emailVerified: Boolean(session.customer?.emailVerified),\n    });\n  }\n\n  setStatus(status: AuthStatus): void {\n    this.#publish({ ...this.#snapshot, status });\n  }\n\n  clear(): void {\n    this.#accessToken = null;\n    this.#expiresAt = null;\n    this.#publish({ status: 'unauthenticated', customer: null, emailVerified: false });\n  }\n\n  subscribe(fn: Listener): () => void {\n    this.#listeners.add(fn);\n    return () => { this.#listeners.delete(fn); };\n  }\n\n  #publish(next: AuthSnapshot): void {\n    // Identity matters: React's useSyncExternalStore re-renders on reference\n    // change, and a token refresh every ten minutes must not re-render the\n    // whole account area when nothing visible changed.\n    const same =\n      next.status === this.#snapshot.status &&\n      next.emailVerified === this.#snapshot.emailVerified &&\n      customerEquals(next.customer, this.#snapshot.customer);\n    if (same) return;\n    this.#snapshot = next;\n    for (const fn of [...this.#listeners]) {\n      // A merchant's subscriber throwing must not stop the rest from hearing.\n      try { fn(next); } catch { /* merchant callback */ }\n    }\n  }\n}\n\nfunction customerEquals(a: Customer | null, b: Customer | null): boolean {\n  if (a === b) return true;\n  if (!a || !b) return false;\n  const keys = new Set([...Object.keys(a), ...Object.keys(b)]) as Set<keyof Customer>;\n  for (const k of keys) if (a[k] !== b[k]) return false;\n  return true;\n}\n","import type { AuthStorage } from './types';\n\nexport type { AuthStorage };\n\nexport function memoryStorage(): AuthStorage {\n  const map = new Map<string, string>();\n  return {\n    get: (k) => map.get(k) ?? null,\n    set: (k, v) => void map.set(k, v),\n    remove: (k) => void map.delete(k),\n  };\n}\n\n/**\n * localStorage when it works, memory when it does not. Safari private mode,\n * hardened browser settings and server-side rendering all make localStorage\n * either absent or throwing; none of them may take the storefront down.\n */\nexport function localStorageAdapter(): AuthStorage {\n  const fallback = memoryStorage();\n  const ls = (): Storage | null => {\n    try {\n      return typeof localStorage !== 'undefined' ? localStorage : null;\n    } catch {\n      return null;\n    }\n  };\n  return {\n    get(k) {\n      try {\n        const v = ls()?.getItem(k);\n        if (v != null) return v;\n      } catch { /* fall through */ }\n      return fallback.get(k);\n    },\n    set(k, v) {\n      fallback.set(k, v);\n      try { ls()?.setItem(k, v); } catch { /* memory-only this session */ }\n    },\n    remove(k) {\n      fallback.remove(k);\n      try { ls()?.removeItem(k); } catch { /* already gone */ }\n    },\n  };\n}\n","import { request } from './request';\nimport { ThrottleAuthError } from './errors';\nimport { SessionState, type AuthSnapshot } from './session';\nimport { localStorageAdapter, type AuthStorage } from './storage';\nimport type { Customer, Session, ThrottleAuthConfig } from './types';\n\nconst DEFAULT_BASE_URL = 'https://api.usethrottle.dev';\n/** Refresh this far before expiry so ordinary calls rarely see a 401 at all. */\nconst REFRESH_SKEW_MS = 30_000;\n\nexport interface DeviceSession {\n  id: string;\n  userAgent: string | null;\n  ipPrefix: string | null;\n  createdAt: string;\n  lastUsedAt: string;\n  current: boolean;\n}\n\nexport interface ThrottleAuth {\n  register(email: string, password: string): Promise<{ status: 'active' | 'pending' }>;\n  signIn(email: string, password: string): Promise<void>;\n  signOut(): Promise<void>;\n  signOutEverywhere(): Promise<void>;\n  restore(): Promise<void>;\n  getSnapshot(): AuthSnapshot;\n  subscribe(fn: (s: AuthSnapshot) => void): () => void;\n  stepUp(password: string): Promise<void>;\n  call<T = any>(method: string, path: string, body?: unknown): Promise<T>;\n  verifyEmail(token: string): Promise<void>;\n  resendVerification(): Promise<void>;\n  forgotPassword(email: string): Promise<void>;\n  resetPassword(token: string, password: string): Promise<void>;\n  changePassword(password: string): Promise<void>;\n  listSessions(): Promise<DeviceSession[]>;\n  revokeSession(id: string): Promise<void>;\n}\n\nexport function createThrottleAuth(config: ThrottleAuthConfig): ThrottleAuth {\n  const baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/$/, '');\n  const storage: AuthStorage = config.storage ?? localStorageAdapter();\n  // Namespaced by key so two Throttle applications on one origin cannot read\n  // each other's refresh token out of shared localStorage.\n  const storageKey = `throttle_auth_rt:${config.publishableKey}`;\n  const lockName = `throttle_auth_refresh:${config.publishableKey}`;\n\n  const state = new SessionState();\n  let refreshInFlight: Promise<void> | null = null;\n  let stepUpToken: string | null = null;\n  let stepUpExpiresAt = 0;\n\n  const base = { baseUrl, publishableKey: config.publishableKey };\n\n  async function persist(session: Session): Promise<void> {\n    state.setSession(session);\n    await storage.set(storageKey, session.refreshToken);\n  }\n\n  async function forget(): Promise<void> {\n    stepUpToken = null;\n    state.clear();\n    await storage.remove(storageKey);\n  }\n\n  /**\n   * Cross-tab single flight. Two tabs refreshing at once would each present the\n   * same stored token; the second is a replay, and the server kills the family.\n   * Web Locks serialises them; where it is unavailable the in-process guard\n   * below still covers the common single-tab case.\n   */\n  function withLock<T>(fn: () => Promise<T>): Promise<T> {\n    const locks = (globalThis as any).navigator?.locks;\n    return locks?.request ? locks.request(lockName, fn) : fn();\n  }\n\n  async function doRefresh(): Promise<void> {\n    await withLock(async () => {\n      // Re-read INSIDE the lock: another tab may have rotated while we waited,\n      // and presenting the token we read before the lock would be a replay.\n      const refreshToken = await storage.get(storageKey);\n      if (!refreshToken) {\n        await forget();\n        throw new ThrottleAuthError({ code: 'session_revoked', message: 'No session', statusCode: 401 });\n      }\n      try {\n        const data = await request({ ...base, method: 'POST', path: '/auth/refresh', body: { refreshToken } });\n        await persist(data as Session);\n      } catch (err) {\n        // Any refusal of a refresh token is terminal — there is nothing left to\n        // retry with. Drop it rather than letting a dead token sit in storage.\n        await forget();\n        throw err;\n      }\n    });\n  }\n\n  function refresh(): Promise<void> {\n    if (!refreshInFlight) {\n      refreshInFlight = doRefresh().finally(() => { refreshInFlight = null; });\n    }\n    return refreshInFlight;\n  }\n\n  async function accessToken(): Promise<string | null> {\n    const expires = state.expiresAt();\n    if (state.accessToken() && expires && expires - Date.now() > REFRESH_SKEW_MS) {\n      return state.accessToken();\n    }\n    if (await storage.get(storageKey)) {\n      await refresh();\n      return state.accessToken();\n    }\n    return state.accessToken();\n  }\n\n  async function ensureStepUp(): Promise<boolean> {\n    if (stepUpToken && stepUpExpiresAt > Date.now()) return true;\n    if (!config.onStepUpRequired) return false;\n    const password = await config.onStepUpRequired();\n    if (!password) return false;\n    await stepUp(password);\n    return true;\n  }\n\n  async function stepUp(password: string): Promise<void> {\n    const data = await request({\n      ...base, method: 'POST', path: '/auth/step-up',\n      accessToken: await accessToken() ?? undefined, body: { password },\n    });\n    stepUpToken = data.stepUpToken;\n    stepUpExpiresAt = Date.now() + (Number(data.expiresIn) || 300) * 1000 - 5_000;\n  }\n\n  async function call<T = any>(method: string, path: string, body?: unknown): Promise<T> {\n    let retriedAuth = false;\n    let retriedStepUp = false;\n\n    for (;;) {\n      const token = await accessToken();\n      try {\n        return await request({\n          ...base, method, path, body,\n          accessToken: token ?? undefined,\n          stepUpToken: stepUpToken ?? undefined,\n        });\n      } catch (err) {\n        const e = err as ThrottleAuthError;\n        // `session_revoked` belongs here too. The server returns it for a\n        // stale session EPOCH as well as for a genuinely dead session, and a\n        // changed password bumps the epoch while deliberately sparing the\n        // current session — so one refresh recovers it. When the session\n        // really is dead the refresh fails and forget() runs, which is the\n        // same outcome, one request later.\n        const expired = e.statusCode === 401 &&\n          (e.code === 'unauthorized' || e.code === 'token_expired' || e.code === 'session_revoked');\n        if (expired && !retriedAuth) {\n          retriedAuth = true;\n          await refresh();   // shared — ten callers here produce ONE request\n          continue;\n        }\n        if (e.code === 'step_up_required' && !retriedStepUp) {\n          retriedStepUp = true;\n          stepUpToken = null;\n          if (await ensureStepUp()) continue;\n        }\n        throw err;\n      }\n    }\n  }\n\n  return {\n    async register(email, password) {\n      const data = await request({ ...base, method: 'POST', path: '/auth/register', body: { email, password } });\n      if (data?.status === 'pending') return { status: 'pending' };\n      await persist(data as Session);\n      return { status: 'active' };\n    },\n\n    async signIn(email, password) {\n      const data = await request({ ...base, method: 'POST', path: '/auth/login', body: { email, password } });\n      await persist(data as Session);\n    },\n\n    async signOut() {\n      try { await call('POST', '/auth/logout'); } catch { /* local state still goes */ }\n      await forget();\n    },\n\n    async signOutEverywhere() {\n      try { await call('POST', '/auth/logout-all'); } catch { /* local state still goes */ }\n      await forget();\n    },\n\n    async restore() {\n      if (!(await storage.get(storageKey))) { state.setStatus('unauthenticated'); return; }\n      try { await refresh(); } catch { /* forget() already ran */ }\n    },\n\n    getSnapshot: () => state.get(),\n    subscribe: (fn) => state.subscribe(fn),\n    stepUp,\n    call,\n\n    async verifyEmail(token) {\n      await request({ ...base, method: 'POST', path: '/auth/verify-email', body: { token } });\n      // `ver` is a claim baked into the access token, and the claim cutoff is\n      // read from the session row. Without a new token the buyer stays gated —\n      // and their own order history stays hidden — for the rest of this\n      // token's ten minutes.\n      if (await storage.get(storageKey)) {\n        try { await refresh(); } catch { /* verification still succeeded */ }\n      }\n    },\n\n    async resendVerification() {\n      await call('POST', '/auth/verify-email/resend');\n    },\n\n    async forgotPassword(email) {\n      // Always 202, whether or not the address has an account. Do not infer\n      // anything from it and do not tell the buyer whether it existed.\n      await request({ ...base, method: 'POST', path: '/auth/forgot-password', body: { email } });\n    },\n\n    async resetPassword(token, password) {\n      await request({ ...base, method: 'POST', path: '/auth/reset-password', body: { token, password } });\n      // The server revokes every session on reset, this one included.\n      await forget();\n    },\n\n    async changePassword(password) {\n      await call('POST', '/me/change-password', { password });\n      // The change bumps the session epoch. This session was deliberately\n      // spared, but the access token in hand now carries a stale epoch and the\n      // next write would 401. Rotate now rather than on the buyer's next click\n      // — and do not let a failed rotation report a change that already\n      // succeeded server-side as a failure.\n      try { await refresh(); } catch { /* the password change already succeeded */ }\n    },\n\n    async listSessions() {\n      return call<DeviceSession[]>('GET', '/me/sessions');\n    },\n\n    async revokeSession(id) {\n      const mine = await call<DeviceSession[]>('GET', '/me/sessions');\n      const current = mine.find((s) => s.current);\n      await call('DELETE', `/me/sessions/${encodeURIComponent(id)}`);\n      if (current?.id === id) await forget();\n    },\n  };\n}\n\nexport type { AuthSnapshot, Customer, Session, ThrottleAuthConfig };\n","import type { ThrottleAuth } from './client';\nimport type {\n  Address, AddressInput, Customer, Invoice, Order,\n  PaymentMethod, ProfilePatch, Subscription,\n} from './types';\n\nexport interface Page { cursor?: string; limit?: number }\n\nexport interface ThrottleAccount {\n  getProfile(): Promise<Customer>;\n  updateProfile(patch: ProfilePatch): Promise<Customer>;\n  listAddresses(): Promise<Address[]>;\n  createAddress(input: AddressInput): Promise<Address>;\n  updateAddress(id: string, patch: Partial<AddressInput>): Promise<Address>;\n  deleteAddress(id: string): Promise<void>;\n  listPaymentMethods(): Promise<PaymentMethod[]>;\n  setDefaultPaymentMethod(id: string): Promise<PaymentMethod>;\n  deletePaymentMethod(id: string): Promise<void>;\n  listOrders(page?: Page): Promise<Order[]>;\n  getOrder(id: string): Promise<Order>;\n  listInvoices(page?: Page): Promise<Invoice[]>;\n  getInvoice(id: string): Promise<Invoice>;\n  listSubscriptions(page?: Page): Promise<Subscription[]>;\n  getSubscription(id: string): Promise<Subscription>;\n  cancelSubscription(id: string, opts?: { atPeriodEnd?: boolean }): Promise<Subscription>;\n  pauseSubscription(id: string): Promise<Subscription>;\n  resumeSubscription(id: string): Promise<Subscription>;\n  claimCart(cartId: string): Promise<{ cartId: string; customerId: string }>;\n}\n\nconst seg = (v: string) => encodeURIComponent(v);\n\nfunction query(page?: Page): string {\n  const params = new URLSearchParams();\n  if (page?.cursor) params.set('cursor', page.cursor);\n  if (page?.limit != null) params.set('limit', String(page.limit));\n  const s = params.toString();\n  return s ? `?${s}` : '';\n}\n\nexport function createAccount(auth: ThrottleAuth): ThrottleAccount {\n  const { call } = auth;\n  return {\n    getProfile: () => call('GET', '/me'),\n    updateProfile: (patch) => call('PATCH', '/me', patch),\n\n    listAddresses: () => call('GET', '/me/addresses'),\n    createAddress: (input) => call('POST', '/me/addresses', input),\n    updateAddress: (id, patch) => call('PATCH', `/me/addresses/${seg(id)}`, patch),\n    deleteAddress: (id) => call('DELETE', `/me/addresses/${seg(id)}`),\n\n    listPaymentMethods: () => call('GET', '/me/payment-methods'),\n    // The platform has no \"change this subscription's card\" capability, so\n    // this is how a buyer changes what they are billed on: move the default.\n    setDefaultPaymentMethod: (id) => call('PATCH', `/me/payment-methods/${seg(id)}`, { isDefault: true }),\n    deletePaymentMethod: (id) => call('DELETE', `/me/payment-methods/${seg(id)}`),\n\n    listOrders: (page) => call('GET', `/me/orders${query(page)}`),\n    getOrder: (id) => call('GET', `/me/orders/${seg(id)}`),\n    listInvoices: (page) => call('GET', `/me/invoices${query(page)}`),\n    getInvoice: (id) => call('GET', `/me/invoices/${seg(id)}`),\n    listSubscriptions: (page) => call('GET', `/me/subscriptions${query(page)}`),\n    getSubscription: (id) => call('GET', `/me/subscriptions/${seg(id)}`),\n\n    cancelSubscription: (id, opts) => call('POST', `/me/subscriptions/${seg(id)}/cancel`, opts),\n    pauseSubscription: (id) => call('POST', `/me/subscriptions/${seg(id)}/pause`),\n    resumeSubscription: (id) => call('POST', `/me/subscriptions/${seg(id)}/resume`),\n\n    claimCart: (cartId) => call('POST', `/me/carts/${seg(cartId)}/claim`),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAAqG;AAC/G,UAAM,KAAK,OAAO;AAClB,SAAK,OAAO;AACZ,SAAK,OAAO,KAAK;AACjB,SAAK,aAAa,KAAK;AACvB,SAAK,aAAa,KAAK;AACvB,SAAK,UAAU,KAAK;AAAA,EACtB;AACF;;;ACDA,eAAsB,QAAQ,OAAmC;AAC/D,QAAM,UAAkC,EAAE,aAAa,MAAM,eAAe;AAC5E,MAAI,MAAM,SAAS,OAAW,SAAQ,cAAc,IAAI;AACxD,MAAI,MAAM,YAAa,SAAQ,gBAAgB,UAAU,MAAM,WAAW;AAC1E,MAAI,MAAM,YAAa,SAAQ,WAAW,IAAI,MAAM;AAEpD,QAAM,MAAM,MAAM,MAAM,GAAG,MAAM,OAAO,iBAAiB,MAAM,IAAI,IAAI;AAAA,IACrE,QAAQ,MAAM;AAAA,IACd;AAAA,IACA,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,KAAK,UAAU,MAAM,IAAI,EAAE,IAAI,CAAC;AAAA,EACzE,CAAC;AAED,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,MAAI,SAAc,CAAC;AACnB,MAAI;AACF,aAAS,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC;AAAA,EACtC,QAAQ;AAAA,EAGR;AAEA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,QAAQ,SAAS,CAAC;AAG5B,UAAM,KAAK,OAAO,IAAI,QAAQ,IAAI,aAAa,CAAC;AAChD,UAAM,IAAI,kBAAkB;AAAA,MAC1B,MAAM,EAAE,QAAQ;AAAA,MAChB,SAAS,EAAE,WAAW,uBAAuB,IAAI,MAAM;AAAA,MACvD,YAAY,IAAI;AAAA,MAChB,YAAY,OAAO,SAAS,EAAE,KAAK,MAAM,IAAI,KAAK;AAAA,MAClD,SAAS,EAAE;AAAA,IACb,CAAC;AAAA,EACH;AAKA,SAAO,UAAU,OAAO,WAAW,YAAY,UAAU,SAAS,OAAO,OAAQ,UAAU,CAAC;AAC9F;;;AClCO,IAAM,eAAN,MAAmB;AAAA,EACxB,YAA0B,EAAE,QAAQ,WAAW,UAAU,MAAM,eAAe,MAAM;AAAA,EACpF,eAA8B;AAAA,EAC9B,aAA4B;AAAA,EAC5B,aAAa,oBAAI,IAAc;AAAA,EAE/B,MAAoB;AAAE,WAAO,KAAK;AAAA,EAAW;AAAA,EAC7C,cAA6B;AAAE,WAAO,KAAK;AAAA,EAAc;AAAA,EACzD,YAA2B;AAAE,WAAO,KAAK;AAAA,EAAY;AAAA,EAErD,WAAW,SAAwB;AACjC,SAAK,eAAe,QAAQ;AAC5B,SAAK,aAAa,KAAK,MAAM,QAAQ,SAAS;AAC9C,SAAK,SAAS;AAAA,MACZ,QAAQ;AAAA,MACR,UAAU,QAAQ;AAAA,MAClB,eAAe,QAAQ,QAAQ,UAAU,aAAa;AAAA,IACxD,CAAC;AAAA,EACH;AAAA,EAEA,UAAU,QAA0B;AAClC,SAAK,SAAS,EAAE,GAAG,KAAK,WAAW,OAAO,CAAC;AAAA,EAC7C;AAAA,EAEA,QAAc;AACZ,SAAK,eAAe;AACpB,SAAK,aAAa;AAClB,SAAK,SAAS,EAAE,QAAQ,mBAAmB,UAAU,MAAM,eAAe,MAAM,CAAC;AAAA,EACnF;AAAA,EAEA,UAAU,IAA0B;AAClC,SAAK,WAAW,IAAI,EAAE;AACtB,WAAO,MAAM;AAAE,WAAK,WAAW,OAAO,EAAE;AAAA,IAAG;AAAA,EAC7C;AAAA,EAEA,SAAS,MAA0B;AAIjC,UAAM,OACJ,KAAK,WAAW,KAAK,UAAU,UAC/B,KAAK,kBAAkB,KAAK,UAAU,iBACtC,eAAe,KAAK,UAAU,KAAK,UAAU,QAAQ;AACvD,QAAI,KAAM;AACV,SAAK,YAAY;AACjB,eAAW,MAAM,CAAC,GAAG,KAAK,UAAU,GAAG;AAErC,UAAI;AAAE,WAAG,IAAI;AAAA,MAAG,QAAQ;AAAA,MAA0B;AAAA,IACpD;AAAA,EACF;AACF;AAEA,SAAS,eAAe,GAAoB,GAA6B;AACvE,MAAI,MAAM,EAAG,QAAO;AACpB,MAAI,CAAC,KAAK,CAAC,EAAG,QAAO;AACrB,QAAM,OAAO,oBAAI,IAAI,CAAC,GAAG,OAAO,KAAK,CAAC,GAAG,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC;AAC3D,aAAW,KAAK,KAAM,KAAI,EAAE,CAAC,MAAM,EAAE,CAAC,EAAG,QAAO;AAChD,SAAO;AACT;;;ACxEO,SAAS,gBAA6B;AAC3C,QAAM,MAAM,oBAAI,IAAoB;AACpC,SAAO;AAAA,IACL,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK;AAAA,IAC1B,KAAK,CAAC,GAAG,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC;AAAA,IAChC,QAAQ,CAAC,MAAM,KAAK,IAAI,OAAO,CAAC;AAAA,EAClC;AACF;AAOO,SAAS,sBAAmC;AACjD,QAAM,WAAW,cAAc;AAC/B,QAAM,KAAK,MAAsB;AAC/B,QAAI;AACF,aAAO,OAAO,iBAAiB,cAAc,eAAe;AAAA,IAC9D,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AAAA,IACL,IAAI,GAAG;AACL,UAAI;AACF,cAAM,IAAI,GAAG,GAAG,QAAQ,CAAC;AACzB,YAAI,KAAK,KAAM,QAAO;AAAA,MACxB,QAAQ;AAAA,MAAqB;AAC7B,aAAO,SAAS,IAAI,CAAC;AAAA,IACvB;AAAA,IACA,IAAI,GAAG,GAAG;AACR,eAAS,IAAI,GAAG,CAAC;AACjB,UAAI;AAAE,WAAG,GAAG,QAAQ,GAAG,CAAC;AAAA,MAAG,QAAQ;AAAA,MAAiC;AAAA,IACtE;AAAA,IACA,OAAO,GAAG;AACR,eAAS,OAAO,CAAC;AACjB,UAAI;AAAE,WAAG,GAAG,WAAW,CAAC;AAAA,MAAG,QAAQ;AAAA,MAAqB;AAAA,IAC1D;AAAA,EACF;AACF;;;ACtCA,IAAM,mBAAmB;AAEzB,IAAM,kBAAkB;AA8BjB,SAAS,mBAAmB,QAA0C;AAC3E,QAAM,WAAW,OAAO,WAAW,kBAAkB,QAAQ,OAAO,EAAE;AACtE,QAAM,UAAuB,OAAO,WAAW,oBAAoB;AAGnE,QAAM,aAAa,oBAAoB,OAAO,cAAc;AAC5D,QAAM,WAAW,yBAAyB,OAAO,cAAc;AAE/D,QAAM,QAAQ,IAAI,aAAa;AAC/B,MAAI,kBAAwC;AAC5C,MAAI,cAA6B;AACjC,MAAI,kBAAkB;AAEtB,QAAM,OAAO,EAAE,SAAS,gBAAgB,OAAO,eAAe;AAE9D,iBAAe,QAAQ,SAAiC;AACtD,UAAM,WAAW,OAAO;AACxB,UAAM,QAAQ,IAAI,YAAY,QAAQ,YAAY;AAAA,EACpD;AAEA,iBAAe,SAAwB;AACrC,kBAAc;AACd,UAAM,MAAM;AACZ,UAAM,QAAQ,OAAO,UAAU;AAAA,EACjC;AAQA,WAAS,SAAY,IAAkC;AACrD,UAAM,QAAS,WAAmB,WAAW;AAC7C,WAAO,OAAO,UAAU,MAAM,QAAQ,UAAU,EAAE,IAAI,GAAG;AAAA,EAC3D;AAEA,iBAAe,YAA2B;AACxC,UAAM,SAAS,YAAY;AAGzB,YAAM,eAAe,MAAM,QAAQ,IAAI,UAAU;AACjD,UAAI,CAAC,cAAc;AACjB,cAAM,OAAO;AACb,cAAM,IAAI,kBAAkB,EAAE,MAAM,mBAAmB,SAAS,cAAc,YAAY,IAAI,CAAC;AAAA,MACjG;AACA,UAAI;AACF,cAAM,OAAO,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,iBAAiB,MAAM,EAAE,aAAa,EAAE,CAAC;AACrG,cAAM,QAAQ,IAAe;AAAA,MAC/B,SAAS,KAAK;AAGZ,cAAM,OAAO;AACb,cAAM;AAAA,MACR;AAAA,IACF,CAAC;AAAA,EACH;AAEA,WAAS,UAAyB;AAChC,QAAI,CAAC,iBAAiB;AACpB,wBAAkB,UAAU,EAAE,QAAQ,MAAM;AAAE,0BAAkB;AAAA,MAAM,CAAC;AAAA,IACzE;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,cAAsC;AACnD,UAAM,UAAU,MAAM,UAAU;AAChC,QAAI,MAAM,YAAY,KAAK,WAAW,UAAU,KAAK,IAAI,IAAI,iBAAiB;AAC5E,aAAO,MAAM,YAAY;AAAA,IAC3B;AACA,QAAI,MAAM,QAAQ,IAAI,UAAU,GAAG;AACjC,YAAM,QAAQ;AACd,aAAO,MAAM,YAAY;AAAA,IAC3B;AACA,WAAO,MAAM,YAAY;AAAA,EAC3B;AAEA,iBAAe,eAAiC;AAC9C,QAAI,eAAe,kBAAkB,KAAK,IAAI,EAAG,QAAO;AACxD,QAAI,CAAC,OAAO,iBAAkB,QAAO;AACrC,UAAM,WAAW,MAAM,OAAO,iBAAiB;AAC/C,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,OAAO,QAAQ;AACrB,WAAO;AAAA,EACT;AAEA,iBAAe,OAAO,UAAiC;AACrD,UAAM,OAAO,MAAM,QAAQ;AAAA,MACzB,GAAG;AAAA,MAAM,QAAQ;AAAA,MAAQ,MAAM;AAAA,MAC/B,aAAa,MAAM,YAAY,KAAK;AAAA,MAAW,MAAM,EAAE,SAAS;AAAA,IAClE,CAAC;AACD,kBAAc,KAAK;AACnB,sBAAkB,KAAK,IAAI,KAAK,OAAO,KAAK,SAAS,KAAK,OAAO,MAAO;AAAA,EAC1E;AAEA,iBAAe,KAAc,QAAgB,MAAc,MAA4B;AACrF,QAAI,cAAc;AAClB,QAAI,gBAAgB;AAEpB,eAAS;AACP,YAAM,QAAQ,MAAM,YAAY;AAChC,UAAI;AACF,eAAO,MAAM,QAAQ;AAAA,UACnB,GAAG;AAAA,UAAM;AAAA,UAAQ;AAAA,UAAM;AAAA,UACvB,aAAa,SAAS;AAAA,UACtB,aAAa,eAAe;AAAA,QAC9B,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,cAAM,IAAI;AAOV,cAAM,UAAU,EAAE,eAAe,QAC9B,EAAE,SAAS,kBAAkB,EAAE,SAAS,mBAAmB,EAAE,SAAS;AACzE,YAAI,WAAW,CAAC,aAAa;AAC3B,wBAAc;AACd,gBAAM,QAAQ;AACd;AAAA,QACF;AACA,YAAI,EAAE,SAAS,sBAAsB,CAAC,eAAe;AACnD,0BAAgB;AAChB,wBAAc;AACd,cAAI,MAAM,aAAa,EAAG;AAAA,QAC5B;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,SAAS,OAAO,UAAU;AAC9B,YAAM,OAAO,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,kBAAkB,MAAM,EAAE,OAAO,SAAS,EAAE,CAAC;AACzG,UAAI,MAAM,WAAW,UAAW,QAAO,EAAE,QAAQ,UAAU;AAC3D,YAAM,QAAQ,IAAe;AAC7B,aAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IAEA,MAAM,OAAO,OAAO,UAAU;AAC5B,YAAM,OAAO,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,eAAe,MAAM,EAAE,OAAO,SAAS,EAAE,CAAC;AACtG,YAAM,QAAQ,IAAe;AAAA,IAC/B;AAAA,IAEA,MAAM,UAAU;AACd,UAAI;AAAE,cAAM,KAAK,QAAQ,cAAc;AAAA,MAAG,QAAQ;AAAA,MAA+B;AACjF,YAAM,OAAO;AAAA,IACf;AAAA,IAEA,MAAM,oBAAoB;AACxB,UAAI;AAAE,cAAM,KAAK,QAAQ,kBAAkB;AAAA,MAAG,QAAQ;AAAA,MAA+B;AACrF,YAAM,OAAO;AAAA,IACf;AAAA,IAEA,MAAM,UAAU;AACd,UAAI,CAAE,MAAM,QAAQ,IAAI,UAAU,GAAI;AAAE,cAAM,UAAU,iBAAiB;AAAG;AAAA,MAAQ;AACpF,UAAI;AAAE,cAAM,QAAQ;AAAA,MAAG,QAAQ;AAAA,MAA6B;AAAA,IAC9D;AAAA,IAEA,aAAa,MAAM,MAAM,IAAI;AAAA,IAC7B,WAAW,CAAC,OAAO,MAAM,UAAU,EAAE;AAAA,IACrC;AAAA,IACA;AAAA,IAEA,MAAM,YAAY,OAAO;AACvB,YAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,sBAAsB,MAAM,EAAE,MAAM,EAAE,CAAC;AAKtF,UAAI,MAAM,QAAQ,IAAI,UAAU,GAAG;AACjC,YAAI;AAAE,gBAAM,QAAQ;AAAA,QAAG,QAAQ;AAAA,QAAqC;AAAA,MACtE;AAAA,IACF;AAAA,IAEA,MAAM,qBAAqB;AACzB,YAAM,KAAK,QAAQ,2BAA2B;AAAA,IAChD;AAAA,IAEA,MAAM,eAAe,OAAO;AAG1B,YAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,yBAAyB,MAAM,EAAE,MAAM,EAAE,CAAC;AAAA,IAC3F;AAAA,IAEA,MAAM,cAAc,OAAO,UAAU;AACnC,YAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,wBAAwB,MAAM,EAAE,OAAO,SAAS,EAAE,CAAC;AAElG,YAAM,OAAO;AAAA,IACf;AAAA,IAEA,MAAM,eAAe,UAAU;AAC7B,YAAM,KAAK,QAAQ,uBAAuB,EAAE,SAAS,CAAC;AAMtD,UAAI;AAAE,cAAM,QAAQ;AAAA,MAAG,QAAQ;AAAA,MAA8C;AAAA,IAC/E;AAAA,IAEA,MAAM,eAAe;AACnB,aAAO,KAAsB,OAAO,cAAc;AAAA,IACpD;AAAA,IAEA,MAAM,cAAc,IAAI;AACtB,YAAM,OAAO,MAAM,KAAsB,OAAO,cAAc;AAC9D,YAAM,UAAU,KAAK,KAAK,CAAC,MAAM,EAAE,OAAO;AAC1C,YAAM,KAAK,UAAU,gBAAgB,mBAAmB,EAAE,CAAC,EAAE;AAC7D,UAAI,SAAS,OAAO,GAAI,OAAM,OAAO;AAAA,IACvC;AAAA,EACF;AACF;;;AC7NA,IAAM,MAAM,CAAC,MAAc,mBAAmB,CAAC;AAE/C,SAAS,MAAM,MAAqB;AAClC,QAAM,SAAS,IAAI,gBAAgB;AACnC,MAAI,MAAM,OAAQ,QAAO,IAAI,UAAU,KAAK,MAAM;AAClD,MAAI,MAAM,SAAS,KAAM,QAAO,IAAI,SAAS,OAAO,KAAK,KAAK,CAAC;AAC/D,QAAM,IAAI,OAAO,SAAS;AAC1B,SAAO,IAAI,IAAI,CAAC,KAAK;AACvB;AAEO,SAAS,cAAc,MAAqC;AACjE,QAAM,EAAE,KAAK,IAAI;AACjB,SAAO;AAAA,IACL,YAAY,MAAM,KAAK,OAAO,KAAK;AAAA,IACnC,eAAe,CAAC,UAAU,KAAK,SAAS,OAAO,KAAK;AAAA,IAEpD,eAAe,MAAM,KAAK,OAAO,eAAe;AAAA,IAChD,eAAe,CAAC,UAAU,KAAK,QAAQ,iBAAiB,KAAK;AAAA,IAC7D,eAAe,CAAC,IAAI,UAAU,KAAK,SAAS,iBAAiB,IAAI,EAAE,CAAC,IAAI,KAAK;AAAA,IAC7E,eAAe,CAAC,OAAO,KAAK,UAAU,iBAAiB,IAAI,EAAE,CAAC,EAAE;AAAA,IAEhE,oBAAoB,MAAM,KAAK,OAAO,qBAAqB;AAAA;AAAA;AAAA,IAG3D,yBAAyB,CAAC,OAAO,KAAK,SAAS,uBAAuB,IAAI,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,CAAC;AAAA,IACpG,qBAAqB,CAAC,OAAO,KAAK,UAAU,uBAAuB,IAAI,EAAE,CAAC,EAAE;AAAA,IAE5E,YAAY,CAAC,SAAS,KAAK,OAAO,aAAa,MAAM,IAAI,CAAC,EAAE;AAAA,IAC5D,UAAU,CAAC,OAAO,KAAK,OAAO,cAAc,IAAI,EAAE,CAAC,EAAE;AAAA,IACrD,cAAc,CAAC,SAAS,KAAK,OAAO,eAAe,MAAM,IAAI,CAAC,EAAE;AAAA,IAChE,YAAY,CAAC,OAAO,KAAK,OAAO,gBAAgB,IAAI,EAAE,CAAC,EAAE;AAAA,IACzD,mBAAmB,CAAC,SAAS,KAAK,OAAO,oBAAoB,MAAM,IAAI,CAAC,EAAE;AAAA,IAC1E,iBAAiB,CAAC,OAAO,KAAK,OAAO,qBAAqB,IAAI,EAAE,CAAC,EAAE;AAAA,IAEnE,oBAAoB,CAAC,IAAI,SAAS,KAAK,QAAQ,qBAAqB,IAAI,EAAE,CAAC,WAAW,IAAI;AAAA,IAC1F,mBAAmB,CAAC,OAAO,KAAK,QAAQ,qBAAqB,IAAI,EAAE,CAAC,QAAQ;AAAA,IAC5E,oBAAoB,CAAC,OAAO,KAAK,QAAQ,qBAAqB,IAAI,EAAE,CAAC,SAAS;AAAA,IAE9E,WAAW,CAAC,WAAW,KAAK,QAAQ,aAAa,IAAI,MAAM,CAAC,QAAQ;AAAA,EACtE;AACF;","names":[]}

package/dist/index.js

@@ -5,7 +5,7 @@ import {
   createThrottleAuth,
   localStorageAdapter,
   memoryStorage
-} from "./chunk-NQU7HM23.js";
+} from "./chunk-OYNGTNOS.js";
 export {
   ThrottleAuthError,
   createAccount,

package/dist/react/forms/index.cjs

@@ -353,6 +353,7 @@ function VerifyEmailPanel(props) {
   const { auth, emailVerified } = useAuth();
   const { submitting, error, notice, run } = useFormAction();
   const attempted = (0, import_react7.useRef)(null);
+  const [verifiedLocally, setVerifiedLocally] = (0, import_react7.useState)(false);
   const l = {
     verifying: "Verifying your email\u2026",
     verified: "Your email address is verified.",
@@ -366,12 +367,13 @@ function VerifyEmailPanel(props) {
     attempted.current = props.token;
     void run(async () => {
       await auth.verifyEmail(props.token);
+      setVerifiedLocally(true);
       props.onVerified?.();
     });
   }, [props.token]);
   return /* @__PURE__ */ (0, import_jsx_runtime6.jsxs)("div", { "data-testid": "throttle-auth-verify", className: props.className ?? "throttle-auth-panel", children: [
     props.token && submitting && /* @__PURE__ */ (0, import_jsx_runtime6.jsx)("p", { className: "throttle-auth-notice", role: "status", children: l.verifying }),
-    emailVerified && /* @__PURE__ */ (0, import_jsx_runtime6.jsx)("p", { className: "throttle-auth-notice", role: "status", children: l.verified }),
+    (emailVerified || verifiedLocally) && /* @__PURE__ */ (0, import_jsx_runtime6.jsx)("p", { className: "throttle-auth-notice", role: "status", children: l.verified }),
     !emailVerified && !props.token && /* @__PURE__ */ (0, import_jsx_runtime6.jsx)("p", { className: "throttle-auth-prompt", children: l.prompt }),
     error && /* @__PURE__ */ (0, import_jsx_runtime6.jsx)("p", { className: "throttle-auth-error", role: "alert", children: error }),
     notice && /* @__PURE__ */ (0, import_jsx_runtime6.jsx)("p", { className: "throttle-auth-notice", role: "status", children: notice }),

package/dist/react/forms/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/react/forms/index.tsx","../../../src/react/forms/SignIn.tsx","../../../src/react/context.tsx","../../../src/react/forms/useFormAction.ts","../../../src/react/forms/messages.ts","../../../src/react/forms/SignUp.tsx","../../../src/react/forms/ForgotPassword.tsx","../../../src/react/forms/ResetPassword.tsx","../../../src/react/forms/VerifyEmail.tsx"],"sourcesContent":["export { SignInForm } from './SignIn';\nexport type { SignInFormProps } from './SignIn';\nexport { SignUpForm } from './SignUp';\nexport type { SignUpFormProps } from './SignUp';\nexport { ForgotPasswordForm } from './ForgotPassword';\nexport type { ForgotPasswordFormProps } from './ForgotPassword';\nexport { ResetPasswordForm } from './ResetPassword';\nexport type { ResetPasswordFormProps } from './ResetPassword';\nexport { VerifyEmailPanel } from './VerifyEmail';\nexport type { VerifyEmailPanelProps } from './VerifyEmail';\nexport { messageForError } from './messages';\n","import { useId, useState } from 'react';\nimport { useAuth } from '../context';\nimport { useFormAction } from './useFormAction';\n\nexport interface SignInFormProps {\n  onSuccess?: () => void;\n  onForgotPassword?: () => void;\n  className?: string;\n  labels?: Partial<{ email: string; password: string; submit: string; forgot: string }>;\n}\n\nexport function SignInForm(props: SignInFormProps) {\n  const { auth } = useAuth();\n  const { submitting, error, run } = useFormAction();\n  const [email, setEmail] = useState('');\n  const [password, setPassword] = useState('');\n  const ids = { email: `${useId()}-email`, password: `${useId()}-password` };\n  const l = { email: 'Email', password: 'Password', submit: 'Sign in', forgot: 'Forgot your password?', ...props.labels };\n\n  return (\n    <form\n      data-testid=\"throttle-auth-signin\"\n      className={props.className ?? 'throttle-auth-form'}\n      onSubmit={(e) => {\n        e.preventDefault();\n        void run(async () => { await auth.signIn(email, password); props.onSuccess?.(); });\n      }}\n    >\n      <label className=\"throttle-auth-label\" htmlFor={ids.email}>{l.email}</label>\n      <input className=\"throttle-auth-input\" id={ids.email} type=\"email\" autoComplete=\"email\"\n             value={email} onChange={(e) => setEmail(e.target.value)} required />\n\n      <label className=\"throttle-auth-label\" htmlFor={ids.password}>{l.password}</label>\n      <input className=\"throttle-auth-input\" id={ids.password} type=\"password\" autoComplete=\"current-password\"\n             value={password} onChange={(e) => setPassword(e.target.value)} required />\n\n      {error && <p className=\"throttle-auth-error\" role=\"alert\">{error}</p>}\n\n      <button className=\"throttle-auth-submit\" type=\"submit\" disabled={submitting}>\n        {submitting ? '…' : l.submit}\n      </button>\n\n      {props.onForgotPassword && (\n        <button className=\"throttle-auth-link\" type=\"button\" onClick={props.onForgotPassword}>{l.forgot}</button>\n      )}\n    </form>\n  );\n}\n","import { createContext, useContext, useEffect, useMemo, useRef, useSyncExternalStore } from 'react';\nimport type { ReactNode } from 'react';\nimport { createThrottleAuth, type ThrottleAuth } from '../client';\nimport { createAccount, type ThrottleAccount } from '../account';\nimport type { AuthSnapshot } from '../session';\nimport type { ThrottleAuthConfig } from '../types';\n\nexport interface ThrottleAuthProviderProps extends Partial<ThrottleAuthConfig> {\n  publishableKey: string;\n  /** Inject a pre-built client. Tests use it; merchants sharing one client across roots may too. */\n  auth?: ThrottleAuth;\n  children: ReactNode;\n}\n\ninterface ContextValue { auth: ThrottleAuth; account: ThrottleAccount }\n\nconst Ctx = createContext<ContextValue | null>(null);\n\nexport function ThrottleAuthProvider(props: ThrottleAuthProviderProps) {\n  const { auth: injected, publishableKey, baseUrl, storage, onStepUpRequired, children } = props;\n\n  const value = useMemo<ContextValue>(() => {\n    const auth = injected ?? createThrottleAuth({ publishableKey, baseUrl, storage, onStepUpRequired });\n    return { auth, account: createAccount(auth) };\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [injected, publishableKey, baseUrl, storage]);\n\n  const restored = useRef<ThrottleAuth | null>(null);\n  useEffect(() => {\n    // Once per client. StrictMode runs effects twice in development, and a\n    // second restore() would present the refresh token that the first one\n    // just rotated away.\n    if (restored.current === value.auth) return;\n    restored.current = value.auth;\n    void value.auth.restore();\n  }, [value]);\n\n  return <Ctx.Provider value={value}>{children}</Ctx.Provider>;\n}\n\nfunction useCtx(): ContextValue {\n  const ctx = useContext(Ctx);\n  if (!ctx) throw new Error('useAuth must be used inside a <ThrottleAuthProvider>');\n  return ctx;\n}\n\nexport function useAuthContext(): ContextValue { return useCtx(); }\n\nexport type UseAuthResult = AuthSnapshot & {\n  isLoading: boolean;\n  isAuthenticated: boolean;\n  auth: ThrottleAuth;\n  account: ThrottleAccount;\n};\n\nexport function useAuth(): UseAuthResult {\n  const { auth, account } = useCtx();\n  const snapshot = useSyncExternalStore(auth.subscribe, auth.getSnapshot, auth.getSnapshot);\n  return {\n    ...snapshot,\n    isLoading: snapshot.status === 'loading',\n    isAuthenticated: snapshot.status === 'authenticated',\n    auth,\n    account,\n  };\n}\n","import { useCallback, useRef, useState } from 'react';\nimport { messageForError } from './messages';\n\nexport interface FormAction {\n  submitting: boolean;\n  error: string | null;\n  notice: string | null;\n  run(fn: () => Promise<string | void>): Promise<void>;\n}\n\n/** Submit-once semantics plus mapped error copy, shared by all five forms. */\nexport function useFormAction(): FormAction {\n  const [submitting, setSubmitting] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n  const [notice, setNotice] = useState<string | null>(null);\n  const inFlight = useRef(false);\n\n  const run = useCallback(async (fn: () => Promise<string | void>) => {\n    if (inFlight.current) return;   // a double-click is one attempt, not two\n    inFlight.current = true;\n    setSubmitting(true);\n    setError(null);\n    setNotice(null);\n    try {\n      const message = await fn();\n      if (typeof message === 'string') setNotice(message);\n    } catch (err) {\n      setError(messageForError(err));\n    } finally {\n      inFlight.current = false;\n      setSubmitting(false);\n    }\n  }, []);\n\n  return { submitting, error, notice, run };\n}\n","import { ThrottleAuthError } from '../../errors';\n\nfunction waitCopy(seconds?: number): string {\n  if (!seconds || !Number.isFinite(seconds)) return 'Please wait a moment and try again.';\n  if (seconds < 60) return `Please wait ${Math.ceil(seconds)} seconds and try again.`;\n  const minutes = Math.ceil(seconds / 60);\n  return `Please wait ${minutes} ${minutes === 1 ? 'minute' : 'minutes'} and try again.`;\n}\n\n/**\n * Buyer-facing copy for every code the storefront API returns. Two codes are\n * deliberately NOT passed through from the server: `invalid_credentials` (the\n * server is vague on purpose — enumerating accounts through our own UI would\n * undo that) and anything unrecognised.\n */\nexport function messageForError(err: unknown): string {\n  const e = err as Partial<ThrottleAuthError> & { code?: string };\n  switch (e?.code) {\n    case 'invalid_credentials':\n      return 'That email or password is not correct.';\n    case 'weak_password':\n      // The server's message IS the policy reason (\"Use at least 12 characters\").\n      return e.message || 'Please choose a stronger password.';\n    case 'too_many_attempts':\n      return `Too many attempts. ${waitCopy(e.retryAfter)}`;\n    case 'verification_required':\n      return 'Please verify your email address to continue.';\n    case 'step_up_required':\n      return 'Please re-enter your password to continue.';\n    case 'session_revoked':\n      return 'Your session has ended. Please sign in again.';\n    case 'token_expired':\n    case 'token_invalid':\n    case 'token_already_used':\n      return 'That link is no longer valid. Please request a new link.';\n    case 'auth_unavailable':\n      return 'Accounts are briefly unavailable. Please try again shortly.';\n    case 'origin_not_allowed':\n    case 'auth_not_enabled':\n    case 'invalid_api_key':\n    case 'environment_mismatch':\n      // Merchant misconfiguration, not something the buyer can fix.\n      return 'Accounts are not available right now. Please contact support.';\n    case 'cart_already_claimed':\n      return 'That cart belongs to a different account.';\n    case 'not_found':\n      return 'We could not find that.';\n    default:\n      return 'Something went wrong. Please try again.';\n  }\n}\n","import { useId, useState } from 'react';\nimport { useAuth } from '../context';\nimport { useFormAction } from './useFormAction';\n\nexport interface SignUpFormProps {\n  onSuccess?: () => void;\n  /** Called for the 202 shape: the address already has credentials, so we sent an email instead. */\n  onPending?: () => void;\n  className?: string;\n  labels?: Partial<{ email: string; password: string; submit: string; pending: string }>;\n}\n\nexport function SignUpForm(props: SignUpFormProps) {\n  const { auth } = useAuth();\n  const { submitting, error, notice, run } = useFormAction();\n  const [email, setEmail] = useState('');\n  const [password, setPassword] = useState('');\n  const ids = { email: `${useId()}-email`, password: `${useId()}-password` };\n  const l = {\n    email: 'Email', password: 'Password', submit: 'Create account',\n    pending: 'Check your email — we sent you a link to finish signing in.',\n    ...props.labels,\n  };\n\n  return (\n    <form\n      data-testid=\"throttle-auth-signup\"\n      className={props.className ?? 'throttle-auth-form'}\n      onSubmit={(e) => {\n        e.preventDefault();\n        void run(async () => {\n          const result = await auth.register(email, password);\n          // 202: an account already exists for this address. There is no\n          // session — say so rather than routing to a signed-in page.\n          if (result.status === 'pending') { props.onPending?.(); return l.pending; }\n          props.onSuccess?.();\n        });\n      }}\n    >\n      <label className=\"throttle-auth-label\" htmlFor={ids.email}>{l.email}</label>\n      <input className=\"throttle-auth-input\" id={ids.email} type=\"email\" autoComplete=\"email\"\n             value={email} onChange={(e) => setEmail(e.target.value)} required />\n\n      <label className=\"throttle-auth-label\" htmlFor={ids.password}>{l.password}</label>\n      <input className=\"throttle-auth-input\" id={ids.password} type=\"password\" autoComplete=\"new-password\"\n             value={password} onChange={(e) => setPassword(e.target.value)} required />\n\n      {error && <p className=\"throttle-auth-error\" role=\"alert\">{error}</p>}\n      {notice && <p className=\"throttle-auth-notice\" role=\"status\">{notice}</p>}\n\n      <button className=\"throttle-auth-submit\" type=\"submit\" disabled={submitting}>\n        {submitting ? '…' : l.submit}\n      </button>\n    </form>\n  );\n}\n","import { useId, useState } from 'react';\nimport { useAuth } from '../context';\nimport { useFormAction } from './useFormAction';\n\nexport interface ForgotPasswordFormProps {\n  onSent?: () => void;\n  className?: string;\n  labels?: Partial<{ email: string; submit: string; sent: string }>;\n}\n\nexport function ForgotPasswordForm(props: ForgotPasswordFormProps) {\n  const { auth } = useAuth();\n  const { submitting, error, notice, run } = useFormAction();\n  const [email, setEmail] = useState('');\n  const id = `${useId()}-email`;\n  const l = {\n    email: 'Email', submit: 'Send reset link',\n    // Identical copy whether or not the address has an account — the API is\n    // deliberately silent on that and this form must be too.\n    sent: 'If an account exists for that address, we have sent a reset link.',\n    ...props.labels,\n  };\n\n  return (\n    <form\n      data-testid=\"throttle-auth-forgot\"\n      className={props.className ?? 'throttle-auth-form'}\n      onSubmit={(e) => {\n        e.preventDefault();\n        void run(async () => { await auth.forgotPassword(email); props.onSent?.(); return l.sent; });\n      }}\n    >\n      <label className=\"throttle-auth-label\" htmlFor={id}>{l.email}</label>\n      <input className=\"throttle-auth-input\" id={id} type=\"email\" autoComplete=\"email\"\n             value={email} onChange={(e) => setEmail(e.target.value)} required />\n\n      {error && <p className=\"throttle-auth-error\" role=\"alert\">{error}</p>}\n      {notice && <p className=\"throttle-auth-notice\" role=\"status\">{notice}</p>}\n\n      <button className=\"throttle-auth-submit\" type=\"submit\" disabled={submitting}>\n        {submitting ? '…' : l.submit}\n      </button>\n    </form>\n  );\n}\n","import { useId, useState } from 'react';\nimport { useAuth } from '../context';\nimport { useFormAction } from './useFormAction';\n\nexport interface ResetPasswordFormProps {\n  /** The token from the emailed link, e.g. `new URLSearchParams(location.search).get('token')`. */\n  token: string;\n  onSuccess?: () => void;\n  className?: string;\n  labels?: Partial<{ password: string; submit: string; done: string }>;\n}\n\nexport function ResetPasswordForm(props: ResetPasswordFormProps) {\n  const { auth } = useAuth();\n  const { submitting, error, notice, run } = useFormAction();\n  const [password, setPassword] = useState('');\n  const id = `${useId()}-new-password`;\n  const l = {\n    password: 'New password', submit: 'Set new password',\n    done: 'Your password has been reset. Please sign in with your new password.',\n    ...props.labels,\n  };\n\n  return (\n    <form\n      data-testid=\"throttle-auth-reset\"\n      className={props.className ?? 'throttle-auth-form'}\n      onSubmit={(e) => {\n        e.preventDefault();\n        void run(async () => {\n          await auth.resetPassword(props.token, password);\n          props.onSuccess?.();\n          // Every session died with the reset, this one included — the buyer\n          // signs in again rather than landing on an account page.\n          return l.done;\n        });\n      }}\n    >\n      <label className=\"throttle-auth-label\" htmlFor={id}>{l.password}</label>\n      <input className=\"throttle-auth-input\" id={id} type=\"password\" autoComplete=\"new-password\"\n             value={password} onChange={(e) => setPassword(e.target.value)} required />\n\n      {error && <p className=\"throttle-auth-error\" role=\"alert\">{error}</p>}\n      {notice && <p className=\"throttle-auth-notice\" role=\"status\">{notice}</p>}\n\n      <button className=\"throttle-auth-submit\" type=\"submit\" disabled={submitting}>\n        {submitting ? '…' : l.submit}\n      </button>\n    </form>\n  );\n}\n","import { useEffect, useRef } from 'react';\nimport { useAuth } from '../context';\nimport { useFormAction } from './useFormAction';\n\nexport interface VerifyEmailPanelProps {\n  /** Token from the emailed link. Omit to render the \"resend\" state instead. */\n  token?: string;\n  onVerified?: () => void;\n  className?: string;\n  labels?: Partial<{ verifying: string; verified: string; prompt: string; resend: string; resent: string }>;\n}\n\nexport function VerifyEmailPanel(props: VerifyEmailPanelProps) {\n  const { auth, emailVerified } = useAuth();\n  const { submitting, error, notice, run } = useFormAction();\n  const attempted = useRef<string | null>(null);\n  const l = {\n    verifying: 'Verifying your email…',\n    verified: 'Your email address is verified.',\n    prompt: 'Please verify your email address to unlock your full account.',\n    resend: 'Resend verification email',\n    resent: 'Sent. Check your inbox.',\n    ...props.labels,\n  };\n\n  useEffect(() => {\n    if (!props.token || attempted.current === props.token) return;\n    // Once per token. Re-running would burn the single-use token and report\n    // `token_already_used` to a buyer who did nothing wrong.\n    //\n    // useFormAction's `inFlight` flag happens to block the StrictMode\n    // double-invoke too, but that is a submit-debounce concern that belongs to\n    // form actions generally. Burning a single-use token is this panel's own\n    // invariant, and it should not depend on another layer's debounce\n    // semantics staying exactly as they are today.\n    attempted.current = props.token;\n    void run(async () => { await auth.verifyEmail(props.token!); props.onVerified?.(); });\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [props.token]);\n\n  return (\n    <div data-testid=\"throttle-auth-verify\" className={props.className ?? 'throttle-auth-panel'}>\n      {props.token && submitting && <p className=\"throttle-auth-notice\" role=\"status\">{l.verifying}</p>}\n      {emailVerified && <p className=\"throttle-auth-notice\" role=\"status\">{l.verified}</p>}\n      {!emailVerified && !props.token && <p className=\"throttle-auth-prompt\">{l.prompt}</p>}\n\n      {error && <p className=\"throttle-auth-error\" role=\"alert\">{error}</p>}\n      {notice && <p className=\"throttle-auth-notice\" role=\"status\">{notice}</p>}\n\n      {!emailVerified && !props.token && (\n        <button\n          className=\"throttle-auth-submit\" type=\"button\" disabled={submitting}\n          onClick={() => void run(async () => { await auth.resendVerification(); return l.resent; })}\n        >\n          {l.resend}\n        </button>\n      )}\n    </div>\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAA,gBAAgC;;;ACAhC,mBAA4F;AAqCnF;AArBT,IAAM,UAAM,4BAAmC,IAAI;AAwBnD,SAAS,SAAuB;AAC9B,QAAM,UAAM,yBAAW,GAAG;AAC1B,MAAI,CAAC,IAAK,OAAM,IAAI,MAAM,sDAAsD;AAChF,SAAO;AACT;AAWO,SAAS,UAAyB;AACvC,QAAM,EAAE,MAAM,QAAQ,IAAI,OAAO;AACjC,QAAM,eAAW,mCAAqB,KAAK,WAAW,KAAK,aAAa,KAAK,WAAW;AACxF,SAAO;AAAA,IACL,GAAG;AAAA,IACH,WAAW,SAAS,WAAW;AAAA,IAC/B,iBAAiB,SAAS,WAAW;AAAA,IACrC;AAAA,IACA;AAAA,EACF;AACF;;;ACjEA,IAAAC,gBAA8C;;;ACE9C,SAAS,SAAS,SAA0B;AAC1C,MAAI,CAAC,WAAW,CAAC,OAAO,SAAS,OAAO,EAAG,QAAO;AAClD,MAAI,UAAU,GAAI,QAAO,eAAe,KAAK,KAAK,OAAO,CAAC;AAC1D,QAAM,UAAU,KAAK,KAAK,UAAU,EAAE;AACtC,SAAO,eAAe,OAAO,IAAI,YAAY,IAAI,WAAW,SAAS;AACvE;AAQO,SAAS,gBAAgB,KAAsB;AACpD,QAAM,IAAI;AACV,UAAQ,GAAG,MAAM;AAAA,IACf,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAEH,aAAO,EAAE,WAAW;AAAA,IACtB,KAAK;AACH,aAAO,sBAAsB,SAAS,EAAE,UAAU,CAAC;AAAA,IACrD,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAEH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;;;ADvCO,SAAS,gBAA4B;AAC1C,QAAM,CAAC,YAAY,aAAa,QAAI,wBAAS,KAAK;AAClD,QAAM,CAAC,OAAO,QAAQ,QAAI,wBAAwB,IAAI;AACtD,QAAM,CAAC,QAAQ,SAAS,QAAI,wBAAwB,IAAI;AACxD,QAAM,eAAW,sBAAO,KAAK;AAE7B,QAAM,UAAM,2BAAY,OAAO,OAAqC;AAClE,QAAI,SAAS,QAAS;AACtB,aAAS,UAAU;AACnB,kBAAc,IAAI;AAClB,aAAS,IAAI;AACb,cAAU,IAAI;AACd,QAAI;AACF,YAAM,UAAU,MAAM,GAAG;AACzB,UAAI,OAAO,YAAY,SAAU,WAAU,OAAO;AAAA,IACpD,SAAS,KAAK;AACZ,eAAS,gBAAgB,GAAG,CAAC;AAAA,IAC/B,UAAE;AACA,eAAS,UAAU;AACnB,oBAAc,KAAK;AAAA,IACrB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SAAO,EAAE,YAAY,OAAO,QAAQ,IAAI;AAC1C;;;AFfI,IAAAC,sBAAA;AATG,SAAS,WAAW,OAAwB;AACjD,QAAM,EAAE,KAAK,IAAI,QAAQ;AACzB,QAAM,EAAE,YAAY,OAAO,IAAI,IAAI,cAAc;AACjD,QAAM,CAAC,OAAO,QAAQ,QAAI,wBAAS,EAAE;AACrC,QAAM,CAAC,UAAU,WAAW,QAAI,wBAAS,EAAE;AAC3C,QAAM,MAAM,EAAE,OAAO,OAAG,qBAAM,CAAC,UAAU,UAAU,OAAG,qBAAM,CAAC,YAAY;AACzE,QAAM,IAAI,EAAE,OAAO,SAAS,UAAU,YAAY,QAAQ,WAAW,QAAQ,yBAAyB,GAAG,MAAM,OAAO;AAEtH,SACE;AAAA,IAAC;AAAA;AAAA,MACC,eAAY;AAAA,MACZ,WAAW,MAAM,aAAa;AAAA,MAC9B,UAAU,CAAC,MAAM;AACf,UAAE,eAAe;AACjB,aAAK,IAAI,YAAY;AAAE,gBAAM,KAAK,OAAO,OAAO,QAAQ;AAAG,gBAAM,YAAY;AAAA,QAAG,CAAC;AAAA,MACnF;AAAA,MAEA;AAAA,qDAAC,WAAM,WAAU,uBAAsB,SAAS,IAAI,OAAQ,YAAE,OAAM;AAAA,QACpE;AAAA,UAAC;AAAA;AAAA,YAAM,WAAU;AAAA,YAAsB,IAAI,IAAI;AAAA,YAAO,MAAK;AAAA,YAAQ,cAAa;AAAA,YACzE,OAAO;AAAA,YAAO,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,YAAG,UAAQ;AAAA;AAAA,QAAC;AAAA,QAEzE,6CAAC,WAAM,WAAU,uBAAsB,SAAS,IAAI,UAAW,YAAE,UAAS;AAAA,QAC1E;AAAA,UAAC;AAAA;AAAA,YAAM,WAAU;AAAA,YAAsB,IAAI,IAAI;AAAA,YAAU,MAAK;AAAA,YAAW,cAAa;AAAA,YAC/E,OAAO;AAAA,YAAU,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK;AAAA,YAAG,UAAQ;AAAA;AAAA,QAAC;AAAA,QAE9E,SAAS,6CAAC,OAAE,WAAU,uBAAsB,MAAK,SAAS,iBAAM;AAAA,QAEjE,6CAAC,YAAO,WAAU,wBAAuB,MAAK,UAAS,UAAU,YAC9D,uBAAa,WAAM,EAAE,QACxB;AAAA,QAEC,MAAM,oBACL,6CAAC,YAAO,WAAU,sBAAqB,MAAK,UAAS,SAAS,MAAM,kBAAmB,YAAE,QAAO;AAAA;AAAA;AAAA,EAEpG;AAEJ;;;AI/CA,IAAAC,gBAAgC;AAyB5B,IAAAC,sBAAA;AAbG,SAAS,WAAW,OAAwB;AACjD,QAAM,EAAE,KAAK,IAAI,QAAQ;AACzB,QAAM,EAAE,YAAY,OAAO,QAAQ,IAAI,IAAI,cAAc;AACzD,QAAM,CAAC,OAAO,QAAQ,QAAI,wBAAS,EAAE;AACrC,QAAM,CAAC,UAAU,WAAW,QAAI,wBAAS,EAAE;AAC3C,QAAM,MAAM,EAAE,OAAO,OAAG,qBAAM,CAAC,UAAU,UAAU,OAAG,qBAAM,CAAC,YAAY;AACzE,QAAM,IAAI;AAAA,IACR,OAAO;AAAA,IAAS,UAAU;AAAA,IAAY,QAAQ;AAAA,IAC9C,SAAS;AAAA,IACT,GAAG,MAAM;AAAA,EACX;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,eAAY;AAAA,MACZ,WAAW,MAAM,aAAa;AAAA,MAC9B,UAAU,CAAC,MAAM;AACf,UAAE,eAAe;AACjB,aAAK,IAAI,YAAY;AACnB,gBAAM,SAAS,MAAM,KAAK,SAAS,OAAO,QAAQ;AAGlD,cAAI,OAAO,WAAW,WAAW;AAAE,kBAAM,YAAY;AAAG,mBAAO,EAAE;AAAA,UAAS;AAC1E,gBAAM,YAAY;AAAA,QACpB,CAAC;AAAA,MACH;AAAA,MAEA;AAAA,qDAAC,WAAM,WAAU,uBAAsB,SAAS,IAAI,OAAQ,YAAE,OAAM;AAAA,QACpE;AAAA,UAAC;AAAA;AAAA,YAAM,WAAU;AAAA,YAAsB,IAAI,IAAI;AAAA,YAAO,MAAK;AAAA,YAAQ,cAAa;AAAA,YACzE,OAAO;AAAA,YAAO,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,YAAG,UAAQ;AAAA;AAAA,QAAC;AAAA,QAEzE,6CAAC,WAAM,WAAU,uBAAsB,SAAS,IAAI,UAAW,YAAE,UAAS;AAAA,QAC1E;AAAA,UAAC;AAAA;AAAA,YAAM,WAAU;AAAA,YAAsB,IAAI,IAAI;AAAA,YAAU,MAAK;AAAA,YAAW,cAAa;AAAA,YAC/E,OAAO;AAAA,YAAU,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK;AAAA,YAAG,UAAQ;AAAA;AAAA,QAAC;AAAA,QAE9E,SAAS,6CAAC,OAAE,WAAU,uBAAsB,MAAK,SAAS,iBAAM;AAAA,QAChE,UAAU,6CAAC,OAAE,WAAU,wBAAuB,MAAK,UAAU,kBAAO;AAAA,QAErE,6CAAC,YAAO,WAAU,wBAAuB,MAAK,UAAS,UAAU,YAC9D,uBAAa,WAAM,EAAE,QACxB;AAAA;AAAA;AAAA,EACF;AAEJ;;;ACvDA,IAAAC,gBAAgC;AAwB5B,IAAAC,sBAAA;AAdG,SAAS,mBAAmB,OAAgC;AACjE,QAAM,EAAE,KAAK,IAAI,QAAQ;AACzB,QAAM,EAAE,YAAY,OAAO,QAAQ,IAAI,IAAI,cAAc;AACzD,QAAM,CAAC,OAAO,QAAQ,QAAI,wBAAS,EAAE;AACrC,QAAM,KAAK,OAAG,qBAAM,CAAC;AACrB,QAAM,IAAI;AAAA,IACR,OAAO;AAAA,IAAS,QAAQ;AAAA;AAAA;AAAA,IAGxB,MAAM;AAAA,IACN,GAAG,MAAM;AAAA,EACX;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,eAAY;AAAA,MACZ,WAAW,MAAM,aAAa;AAAA,MAC9B,UAAU,CAAC,MAAM;AACf,UAAE,eAAe;AACjB,aAAK,IAAI,YAAY;AAAE,gBAAM,KAAK,eAAe,KAAK;AAAG,gBAAM,SAAS;AAAG,iBAAO,EAAE;AAAA,QAAM,CAAC;AAAA,MAC7F;AAAA,MAEA;AAAA,qDAAC,WAAM,WAAU,uBAAsB,SAAS,IAAK,YAAE,OAAM;AAAA,QAC7D;AAAA,UAAC;AAAA;AAAA,YAAM,WAAU;AAAA,YAAsB;AAAA,YAAQ,MAAK;AAAA,YAAQ,cAAa;AAAA,YAClE,OAAO;AAAA,YAAO,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,YAAG,UAAQ;AAAA;AAAA,QAAC;AAAA,QAExE,SAAS,6CAAC,OAAE,WAAU,uBAAsB,MAAK,SAAS,iBAAM;AAAA,QAChE,UAAU,6CAAC,OAAE,WAAU,wBAAuB,MAAK,UAAU,kBAAO;AAAA,QAErE,6CAAC,YAAO,WAAU,wBAAuB,MAAK,UAAS,UAAU,YAC9D,uBAAa,WAAM,EAAE,QACxB;AAAA;AAAA;AAAA,EACF;AAEJ;;;AC5CA,IAAAC,gBAAgC;AAwB5B,IAAAC,sBAAA;AAZG,SAAS,kBAAkB,OAA+B;AAC/D,QAAM,EAAE,KAAK,IAAI,QAAQ;AACzB,QAAM,EAAE,YAAY,OAAO,QAAQ,IAAI,IAAI,cAAc;AACzD,QAAM,CAAC,UAAU,WAAW,QAAI,wBAAS,EAAE;AAC3C,QAAM,KAAK,OAAG,qBAAM,CAAC;AACrB,QAAM,IAAI;AAAA,IACR,UAAU;AAAA,IAAgB,QAAQ;AAAA,IAClC,MAAM;AAAA,IACN,GAAG,MAAM;AAAA,EACX;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,eAAY;AAAA,MACZ,WAAW,MAAM,aAAa;AAAA,MAC9B,UAAU,CAAC,MAAM;AACf,UAAE,eAAe;AACjB,aAAK,IAAI,YAAY;AACnB,gBAAM,KAAK,cAAc,MAAM,OAAO,QAAQ;AAC9C,gBAAM,YAAY;AAGlB,iBAAO,EAAE;AAAA,QACX,CAAC;AAAA,MACH;AAAA,MAEA;AAAA,qDAAC,WAAM,WAAU,uBAAsB,SAAS,IAAK,YAAE,UAAS;AAAA,QAChE;AAAA,UAAC;AAAA;AAAA,YAAM,WAAU;AAAA,YAAsB;AAAA,YAAQ,MAAK;AAAA,YAAW,cAAa;AAAA,YACrE,OAAO;AAAA,YAAU,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK;AAAA,YAAG,UAAQ;AAAA;AAAA,QAAC;AAAA,QAE9E,SAAS,6CAAC,OAAE,WAAU,uBAAsB,MAAK,SAAS,iBAAM;AAAA,QAChE,UAAU,6CAAC,OAAE,WAAU,wBAAuB,MAAK,UAAU,kBAAO;AAAA,QAErE,6CAAC,YAAO,WAAU,wBAAuB,MAAK,UAAS,UAAU,YAC9D,uBAAa,WAAM,EAAE,QACxB;AAAA;AAAA;AAAA,EACF;AAEJ;;;AClDA,IAAAC,gBAAkC;AAyC9B,IAAAC,sBAAA;AA7BG,SAAS,iBAAiB,OAA8B;AAC7D,QAAM,EAAE,MAAM,cAAc,IAAI,QAAQ;AACxC,QAAM,EAAE,YAAY,OAAO,QAAQ,IAAI,IAAI,cAAc;AACzD,QAAM,gBAAY,sBAAsB,IAAI;AAC5C,QAAM,IAAI;AAAA,IACR,WAAW;AAAA,IACX,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,GAAG,MAAM;AAAA,EACX;AAEA,+BAAU,MAAM;AACd,QAAI,CAAC,MAAM,SAAS,UAAU,YAAY,MAAM,MAAO;AASvD,cAAU,UAAU,MAAM;AAC1B,SAAK,IAAI,YAAY;AAAE,YAAM,KAAK,YAAY,MAAM,KAAM;AAAG,YAAM,aAAa;AAAA,IAAG,CAAC;AAAA,EAEtF,GAAG,CAAC,MAAM,KAAK,CAAC;AAEhB,SACE,8CAAC,SAAI,eAAY,wBAAuB,WAAW,MAAM,aAAa,uBACnE;AAAA,UAAM,SAAS,cAAc,6CAAC,OAAE,WAAU,wBAAuB,MAAK,UAAU,YAAE,WAAU;AAAA,IAC5F,iBAAiB,6CAAC,OAAE,WAAU,wBAAuB,MAAK,UAAU,YAAE,UAAS;AAAA,IAC/E,CAAC,iBAAiB,CAAC,MAAM,SAAS,6CAAC,OAAE,WAAU,wBAAwB,YAAE,QAAO;AAAA,IAEhF,SAAS,6CAAC,OAAE,WAAU,uBAAsB,MAAK,SAAS,iBAAM;AAAA,IAChE,UAAU,6CAAC,OAAE,WAAU,wBAAuB,MAAK,UAAU,kBAAO;AAAA,IAEpE,CAAC,iBAAiB,CAAC,MAAM,SACxB;AAAA,MAAC;AAAA;AAAA,QACC,WAAU;AAAA,QAAuB,MAAK;AAAA,QAAS,UAAU;AAAA,QACzD,SAAS,MAAM,KAAK,IAAI,YAAY;AAAE,gBAAM,KAAK,mBAAmB;AAAG,iBAAO,EAAE;AAAA,QAAQ,CAAC;AAAA,QAExF,YAAE;AAAA;AAAA,IACL;AAAA,KAEJ;AAEJ;","names":["import_react","import_react","import_jsx_runtime","import_react","import_jsx_runtime","import_react","import_jsx_runtime","import_react","import_jsx_runtime","import_react","import_jsx_runtime"]}
+{"version":3,"sources":["../../../src/react/forms/index.tsx","../../../src/react/forms/SignIn.tsx","../../../src/react/context.tsx","../../../src/react/forms/useFormAction.ts","../../../src/react/forms/messages.ts","../../../src/react/forms/SignUp.tsx","../../../src/react/forms/ForgotPassword.tsx","../../../src/react/forms/ResetPassword.tsx","../../../src/react/forms/VerifyEmail.tsx"],"sourcesContent":["export { SignInForm } from './SignIn';\nexport type { SignInFormProps } from './SignIn';\nexport { SignUpForm } from './SignUp';\nexport type { SignUpFormProps } from './SignUp';\nexport { ForgotPasswordForm } from './ForgotPassword';\nexport type { ForgotPasswordFormProps } from './ForgotPassword';\nexport { ResetPasswordForm } from './ResetPassword';\nexport type { ResetPasswordFormProps } from './ResetPassword';\nexport { VerifyEmailPanel } from './VerifyEmail';\nexport type { VerifyEmailPanelProps } from './VerifyEmail';\nexport { messageForError } from './messages';\n","import { useId, useState } from 'react';\nimport { useAuth } from '../context';\nimport { useFormAction } from './useFormAction';\n\nexport interface SignInFormProps {\n  onSuccess?: () => void;\n  onForgotPassword?: () => void;\n  className?: string;\n  labels?: Partial<{ email: string; password: string; submit: string; forgot: string }>;\n}\n\nexport function SignInForm(props: SignInFormProps) {\n  const { auth } = useAuth();\n  const { submitting, error, run } = useFormAction();\n  const [email, setEmail] = useState('');\n  const [password, setPassword] = useState('');\n  const ids = { email: `${useId()}-email`, password: `${useId()}-password` };\n  const l = { email: 'Email', password: 'Password', submit: 'Sign in', forgot: 'Forgot your password?', ...props.labels };\n\n  return (\n    <form\n      data-testid=\"throttle-auth-signin\"\n      className={props.className ?? 'throttle-auth-form'}\n      onSubmit={(e) => {\n        e.preventDefault();\n        void run(async () => { await auth.signIn(email, password); props.onSuccess?.(); });\n      }}\n    >\n      <label className=\"throttle-auth-label\" htmlFor={ids.email}>{l.email}</label>\n      <input className=\"throttle-auth-input\" id={ids.email} type=\"email\" autoComplete=\"email\"\n             value={email} onChange={(e) => setEmail(e.target.value)} required />\n\n      <label className=\"throttle-auth-label\" htmlFor={ids.password}>{l.password}</label>\n      <input className=\"throttle-auth-input\" id={ids.password} type=\"password\" autoComplete=\"current-password\"\n             value={password} onChange={(e) => setPassword(e.target.value)} required />\n\n      {error && <p className=\"throttle-auth-error\" role=\"alert\">{error}</p>}\n\n      <button className=\"throttle-auth-submit\" type=\"submit\" disabled={submitting}>\n        {submitting ? '…' : l.submit}\n      </button>\n\n      {props.onForgotPassword && (\n        <button className=\"throttle-auth-link\" type=\"button\" onClick={props.onForgotPassword}>{l.forgot}</button>\n      )}\n    </form>\n  );\n}\n","import { createContext, useContext, useEffect, useMemo, useRef, useSyncExternalStore } from 'react';\nimport type { ReactNode } from 'react';\nimport { createThrottleAuth, type ThrottleAuth } from '../client';\nimport { createAccount, type ThrottleAccount } from '../account';\nimport type { AuthSnapshot } from '../session';\nimport type { ThrottleAuthConfig } from '../types';\n\nexport interface ThrottleAuthProviderProps extends Partial<ThrottleAuthConfig> {\n  publishableKey: string;\n  /** Inject a pre-built client. Tests use it; merchants sharing one client across roots may too. */\n  auth?: ThrottleAuth;\n  children: ReactNode;\n}\n\ninterface ContextValue { auth: ThrottleAuth; account: ThrottleAccount }\n\nconst Ctx = createContext<ContextValue | null>(null);\n\nexport function ThrottleAuthProvider(props: ThrottleAuthProviderProps) {\n  const { auth: injected, publishableKey, baseUrl, storage, onStepUpRequired, children } = props;\n\n  // `storage` and `onStepUpRequired` are deliberately NOT dependencies: they are\n  // read once at mount. A merchant passing `storage={memoryStorage()}` inline —\n  // which the README suggests — would otherwise get a new client on every parent\n  // render, and with it a fresh empty SessionState that reads as signed out.\n  const value = useMemo<ContextValue>(() => {\n    const auth = injected ?? createThrottleAuth({ publishableKey, baseUrl, storage, onStepUpRequired });\n    return { auth, account: createAccount(auth) };\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [injected, publishableKey, baseUrl]);\n\n  const restored = useRef<ThrottleAuth | null>(null);\n  useEffect(() => {\n    // Once per client. StrictMode runs effects twice in development, and a\n    // second restore() would present the refresh token that the first one\n    // just rotated away.\n    if (restored.current === value.auth) return;\n    restored.current = value.auth;\n    void value.auth.restore();\n  }, [value]);\n\n  return <Ctx.Provider value={value}>{children}</Ctx.Provider>;\n}\n\nfunction useCtx(): ContextValue {\n  const ctx = useContext(Ctx);\n  if (!ctx) throw new Error('useAuth must be used inside a <ThrottleAuthProvider>');\n  return ctx;\n}\n\nexport function useAuthContext(): ContextValue { return useCtx(); }\n\nexport type UseAuthResult = AuthSnapshot & {\n  isLoading: boolean;\n  isAuthenticated: boolean;\n  auth: ThrottleAuth;\n  account: ThrottleAccount;\n};\n\nexport function useAuth(): UseAuthResult {\n  const { auth, account } = useCtx();\n  const snapshot = useSyncExternalStore(auth.subscribe, auth.getSnapshot, auth.getSnapshot);\n  return {\n    ...snapshot,\n    isLoading: snapshot.status === 'loading',\n    isAuthenticated: snapshot.status === 'authenticated',\n    auth,\n    account,\n  };\n}\n","import { useCallback, useRef, useState } from 'react';\nimport { messageForError } from './messages';\n\nexport interface FormAction {\n  submitting: boolean;\n  error: string | null;\n  notice: string | null;\n  run(fn: () => Promise<string | void>): Promise<void>;\n}\n\n/** Submit-once semantics plus mapped error copy, shared by all five forms. */\nexport function useFormAction(): FormAction {\n  const [submitting, setSubmitting] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n  const [notice, setNotice] = useState<string | null>(null);\n  const inFlight = useRef(false);\n\n  const run = useCallback(async (fn: () => Promise<string | void>) => {\n    if (inFlight.current) return;   // a double-click is one attempt, not two\n    inFlight.current = true;\n    setSubmitting(true);\n    setError(null);\n    setNotice(null);\n    try {\n      const message = await fn();\n      if (typeof message === 'string') setNotice(message);\n    } catch (err) {\n      setError(messageForError(err));\n    } finally {\n      inFlight.current = false;\n      setSubmitting(false);\n    }\n  }, []);\n\n  return { submitting, error, notice, run };\n}\n","import { ThrottleAuthError } from '../../errors';\n\nfunction waitCopy(seconds?: number): string {\n  if (!seconds || !Number.isFinite(seconds)) return 'Please wait a moment and try again.';\n  if (seconds < 60) return `Please wait ${Math.ceil(seconds)} seconds and try again.`;\n  const minutes = Math.ceil(seconds / 60);\n  return `Please wait ${minutes} ${minutes === 1 ? 'minute' : 'minutes'} and try again.`;\n}\n\n/**\n * Buyer-facing copy for every code the storefront API returns. Two codes are\n * deliberately NOT passed through from the server: `invalid_credentials` (the\n * server is vague on purpose — enumerating accounts through our own UI would\n * undo that) and anything unrecognised.\n */\nexport function messageForError(err: unknown): string {\n  const e = err as Partial<ThrottleAuthError> & { code?: string };\n  switch (e?.code) {\n    case 'invalid_credentials':\n      return 'That email or password is not correct.';\n    case 'weak_password':\n      // The server's message IS the policy reason (\"Use at least 12 characters\").\n      return e.message || 'Please choose a stronger password.';\n    case 'too_many_attempts':\n      return `Too many attempts. ${waitCopy(e.retryAfter)}`;\n    case 'verification_required':\n      return 'Please verify your email address to continue.';\n    case 'step_up_required':\n      return 'Please re-enter your password to continue.';\n    case 'session_revoked':\n      return 'Your session has ended. Please sign in again.';\n    case 'token_expired':\n    case 'token_invalid':\n    case 'token_already_used':\n      return 'That link is no longer valid. Please request a new link.';\n    case 'auth_unavailable':\n      return 'Accounts are briefly unavailable. Please try again shortly.';\n    case 'origin_not_allowed':\n    case 'auth_not_enabled':\n    case 'invalid_api_key':\n    case 'environment_mismatch':\n      // Merchant misconfiguration, not something the buyer can fix.\n      return 'Accounts are not available right now. Please contact support.';\n    case 'cart_already_claimed':\n      return 'That cart belongs to a different account.';\n    case 'not_found':\n      return 'We could not find that.';\n    default:\n      return 'Something went wrong. Please try again.';\n  }\n}\n","import { useId, useState } from 'react';\nimport { useAuth } from '../context';\nimport { useFormAction } from './useFormAction';\n\nexport interface SignUpFormProps {\n  onSuccess?: () => void;\n  /** Called for the 202 shape: the address already has credentials, so we sent an email instead. */\n  onPending?: () => void;\n  className?: string;\n  labels?: Partial<{ email: string; password: string; submit: string; pending: string }>;\n}\n\nexport function SignUpForm(props: SignUpFormProps) {\n  const { auth } = useAuth();\n  const { submitting, error, notice, run } = useFormAction();\n  const [email, setEmail] = useState('');\n  const [password, setPassword] = useState('');\n  const ids = { email: `${useId()}-email`, password: `${useId()}-password` };\n  const l = {\n    email: 'Email', password: 'Password', submit: 'Create account',\n    pending: 'Check your email — we sent you a link to finish signing in.',\n    ...props.labels,\n  };\n\n  return (\n    <form\n      data-testid=\"throttle-auth-signup\"\n      className={props.className ?? 'throttle-auth-form'}\n      onSubmit={(e) => {\n        e.preventDefault();\n        void run(async () => {\n          const result = await auth.register(email, password);\n          // 202: an account already exists for this address. There is no\n          // session — say so rather than routing to a signed-in page.\n          if (result.status === 'pending') { props.onPending?.(); return l.pending; }\n          props.onSuccess?.();\n        });\n      }}\n    >\n      <label className=\"throttle-auth-label\" htmlFor={ids.email}>{l.email}</label>\n      <input className=\"throttle-auth-input\" id={ids.email} type=\"email\" autoComplete=\"email\"\n             value={email} onChange={(e) => setEmail(e.target.value)} required />\n\n      <label className=\"throttle-auth-label\" htmlFor={ids.password}>{l.password}</label>\n      <input className=\"throttle-auth-input\" id={ids.password} type=\"password\" autoComplete=\"new-password\"\n             value={password} onChange={(e) => setPassword(e.target.value)} required />\n\n      {error && <p className=\"throttle-auth-error\" role=\"alert\">{error}</p>}\n      {notice && <p className=\"throttle-auth-notice\" role=\"status\">{notice}</p>}\n\n      <button className=\"throttle-auth-submit\" type=\"submit\" disabled={submitting}>\n        {submitting ? '…' : l.submit}\n      </button>\n    </form>\n  );\n}\n","import { useId, useState } from 'react';\nimport { useAuth } from '../context';\nimport { useFormAction } from './useFormAction';\n\nexport interface ForgotPasswordFormProps {\n  onSent?: () => void;\n  className?: string;\n  labels?: Partial<{ email: string; submit: string; sent: string }>;\n}\n\nexport function ForgotPasswordForm(props: ForgotPasswordFormProps) {\n  const { auth } = useAuth();\n  const { submitting, error, notice, run } = useFormAction();\n  const [email, setEmail] = useState('');\n  const id = `${useId()}-email`;\n  const l = {\n    email: 'Email', submit: 'Send reset link',\n    // Identical copy whether or not the address has an account — the API is\n    // deliberately silent on that and this form must be too.\n    sent: 'If an account exists for that address, we have sent a reset link.',\n    ...props.labels,\n  };\n\n  return (\n    <form\n      data-testid=\"throttle-auth-forgot\"\n      className={props.className ?? 'throttle-auth-form'}\n      onSubmit={(e) => {\n        e.preventDefault();\n        void run(async () => { await auth.forgotPassword(email); props.onSent?.(); return l.sent; });\n      }}\n    >\n      <label className=\"throttle-auth-label\" htmlFor={id}>{l.email}</label>\n      <input className=\"throttle-auth-input\" id={id} type=\"email\" autoComplete=\"email\"\n             value={email} onChange={(e) => setEmail(e.target.value)} required />\n\n      {error && <p className=\"throttle-auth-error\" role=\"alert\">{error}</p>}\n      {notice && <p className=\"throttle-auth-notice\" role=\"status\">{notice}</p>}\n\n      <button className=\"throttle-auth-submit\" type=\"submit\" disabled={submitting}>\n        {submitting ? '…' : l.submit}\n      </button>\n    </form>\n  );\n}\n","import { useId, useState } from 'react';\nimport { useAuth } from '../context';\nimport { useFormAction } from './useFormAction';\n\nexport interface ResetPasswordFormProps {\n  /** The token from the emailed link, e.g. `new URLSearchParams(location.search).get('token')`. */\n  token: string;\n  onSuccess?: () => void;\n  className?: string;\n  labels?: Partial<{ password: string; submit: string; done: string }>;\n}\n\nexport function ResetPasswordForm(props: ResetPasswordFormProps) {\n  const { auth } = useAuth();\n  const { submitting, error, notice, run } = useFormAction();\n  const [password, setPassword] = useState('');\n  const id = `${useId()}-new-password`;\n  const l = {\n    password: 'New password', submit: 'Set new password',\n    done: 'Your password has been reset. Please sign in with your new password.',\n    ...props.labels,\n  };\n\n  return (\n    <form\n      data-testid=\"throttle-auth-reset\"\n      className={props.className ?? 'throttle-auth-form'}\n      onSubmit={(e) => {\n        e.preventDefault();\n        void run(async () => {\n          await auth.resetPassword(props.token, password);\n          props.onSuccess?.();\n          // Every session died with the reset, this one included — the buyer\n          // signs in again rather than landing on an account page.\n          return l.done;\n        });\n      }}\n    >\n      <label className=\"throttle-auth-label\" htmlFor={id}>{l.password}</label>\n      <input className=\"throttle-auth-input\" id={id} type=\"password\" autoComplete=\"new-password\"\n             value={password} onChange={(e) => setPassword(e.target.value)} required />\n\n      {error && <p className=\"throttle-auth-error\" role=\"alert\">{error}</p>}\n      {notice && <p className=\"throttle-auth-notice\" role=\"status\">{notice}</p>}\n\n      <button className=\"throttle-auth-submit\" type=\"submit\" disabled={submitting}>\n        {submitting ? '…' : l.submit}\n      </button>\n    </form>\n  );\n}\n","import { useEffect, useRef, useState } from 'react';\nimport { useAuth } from '../context';\nimport { useFormAction } from './useFormAction';\n\nexport interface VerifyEmailPanelProps {\n  /** Token from the emailed link. Omit to render the \"resend\" state instead. */\n  token?: string;\n  onVerified?: () => void;\n  className?: string;\n  labels?: Partial<{ verifying: string; verified: string; prompt: string; resend: string; resent: string }>;\n}\n\nexport function VerifyEmailPanel(props: VerifyEmailPanelProps) {\n  const { auth, emailVerified } = useAuth();\n  const { submitting, error, notice, run } = useFormAction();\n  const attempted = useRef<string | null>(null);\n  const [verifiedLocally, setVerifiedLocally] = useState(false);\n  const l = {\n    verifying: 'Verifying your email…',\n    verified: 'Your email address is verified.',\n    prompt: 'Please verify your email address to unlock your full account.',\n    resend: 'Resend verification email',\n    resent: 'Sent. Check your inbox.',\n    ...props.labels,\n  };\n\n  useEffect(() => {\n    if (!props.token || attempted.current === props.token) return;\n    // Once per token. Re-running would burn the single-use token and report\n    // `token_already_used` to a buyer who did nothing wrong.\n    //\n    // useFormAction's `inFlight` flag happens to block the StrictMode\n    // double-invoke too, but that is a submit-debounce concern that belongs to\n    // form actions generally. Burning a single-use token is this panel's own\n    // invariant, and it should not depend on another layer's debounce\n    // semantics staying exactly as they are today.\n    attempted.current = props.token;\n    void run(async () => {\n      await auth.verifyEmail(props.token!);\n      setVerifiedLocally(true);\n      props.onVerified?.();\n    });\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [props.token]);\n\n  return (\n    <div data-testid=\"throttle-auth-verify\" className={props.className ?? 'throttle-auth-panel'}>\n      {props.token && submitting && <p className=\"throttle-auth-notice\" role=\"status\">{l.verifying}</p>}\n      {(emailVerified || verifiedLocally) && (\n        <p className=\"throttle-auth-notice\" role=\"status\">{l.verified}</p>\n      )}\n      {!emailVerified && !props.token && <p className=\"throttle-auth-prompt\">{l.prompt}</p>}\n\n      {error && <p className=\"throttle-auth-error\" role=\"alert\">{error}</p>}\n      {notice && <p className=\"throttle-auth-notice\" role=\"status\">{notice}</p>}\n\n      {!emailVerified && !props.token && (\n        <button\n          className=\"throttle-auth-submit\" type=\"button\" disabled={submitting}\n          onClick={() => void run(async () => { await auth.resendVerification(); return l.resent; })}\n        >\n          {l.resend}\n        </button>\n      )}\n    </div>\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,IAAAA,gBAAgC;;;ACAhC,mBAA4F;AAyCnF;AAzBT,IAAM,UAAM,4BAAmC,IAAI;AA4BnD,SAAS,SAAuB;AAC9B,QAAM,UAAM,yBAAW,GAAG;AAC1B,MAAI,CAAC,IAAK,OAAM,IAAI,MAAM,sDAAsD;AAChF,SAAO;AACT;AAWO,SAAS,UAAyB;AACvC,QAAM,EAAE,MAAM,QAAQ,IAAI,OAAO;AACjC,QAAM,eAAW,mCAAqB,KAAK,WAAW,KAAK,aAAa,KAAK,WAAW;AACxF,SAAO;AAAA,IACL,GAAG;AAAA,IACH,WAAW,SAAS,WAAW;AAAA,IAC/B,iBAAiB,SAAS,WAAW;AAAA,IACrC;AAAA,IACA;AAAA,EACF;AACF;;;ACrEA,IAAAC,gBAA8C;;;ACE9C,SAAS,SAAS,SAA0B;AAC1C,MAAI,CAAC,WAAW,CAAC,OAAO,SAAS,OAAO,EAAG,QAAO;AAClD,MAAI,UAAU,GAAI,QAAO,eAAe,KAAK,KAAK,OAAO,CAAC;AAC1D,QAAM,UAAU,KAAK,KAAK,UAAU,EAAE;AACtC,SAAO,eAAe,OAAO,IAAI,YAAY,IAAI,WAAW,SAAS;AACvE;AAQO,SAAS,gBAAgB,KAAsB;AACpD,QAAM,IAAI;AACV,UAAQ,GAAG,MAAM;AAAA,IACf,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAEH,aAAO,EAAE,WAAW;AAAA,IACtB,KAAK;AACH,aAAO,sBAAsB,SAAS,EAAE,UAAU,CAAC;AAAA,IACrD,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAEH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;;;ADvCO,SAAS,gBAA4B;AAC1C,QAAM,CAAC,YAAY,aAAa,QAAI,wBAAS,KAAK;AAClD,QAAM,CAAC,OAAO,QAAQ,QAAI,wBAAwB,IAAI;AACtD,QAAM,CAAC,QAAQ,SAAS,QAAI,wBAAwB,IAAI;AACxD,QAAM,eAAW,sBAAO,KAAK;AAE7B,QAAM,UAAM,2BAAY,OAAO,OAAqC;AAClE,QAAI,SAAS,QAAS;AACtB,aAAS,UAAU;AACnB,kBAAc,IAAI;AAClB,aAAS,IAAI;AACb,cAAU,IAAI;AACd,QAAI;AACF,YAAM,UAAU,MAAM,GAAG;AACzB,UAAI,OAAO,YAAY,SAAU,WAAU,OAAO;AAAA,IACpD,SAAS,KAAK;AACZ,eAAS,gBAAgB,GAAG,CAAC;AAAA,IAC/B,UAAE;AACA,eAAS,UAAU;AACnB,oBAAc,KAAK;AAAA,IACrB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SAAO,EAAE,YAAY,OAAO,QAAQ,IAAI;AAC1C;;;AFfI,IAAAC,sBAAA;AATG,SAAS,WAAW,OAAwB;AACjD,QAAM,EAAE,KAAK,IAAI,QAAQ;AACzB,QAAM,EAAE,YAAY,OAAO,IAAI,IAAI,cAAc;AACjD,QAAM,CAAC,OAAO,QAAQ,QAAI,wBAAS,EAAE;AACrC,QAAM,CAAC,UAAU,WAAW,QAAI,wBAAS,EAAE;AAC3C,QAAM,MAAM,EAAE,OAAO,OAAG,qBAAM,CAAC,UAAU,UAAU,OAAG,qBAAM,CAAC,YAAY;AACzE,QAAM,IAAI,EAAE,OAAO,SAAS,UAAU,YAAY,QAAQ,WAAW,QAAQ,yBAAyB,GAAG,MAAM,OAAO;AAEtH,SACE;AAAA,IAAC;AAAA;AAAA,MACC,eAAY;AAAA,MACZ,WAAW,MAAM,aAAa;AAAA,MAC9B,UAAU,CAAC,MAAM;AACf,UAAE,eAAe;AACjB,aAAK,IAAI,YAAY;AAAE,gBAAM,KAAK,OAAO,OAAO,QAAQ;AAAG,gBAAM,YAAY;AAAA,QAAG,CAAC;AAAA,MACnF;AAAA,MAEA;AAAA,qDAAC,WAAM,WAAU,uBAAsB,SAAS,IAAI,OAAQ,YAAE,OAAM;AAAA,QACpE;AAAA,UAAC;AAAA;AAAA,YAAM,WAAU;AAAA,YAAsB,IAAI,IAAI;AAAA,YAAO,MAAK;AAAA,YAAQ,cAAa;AAAA,YACzE,OAAO;AAAA,YAAO,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,YAAG,UAAQ;AAAA;AAAA,QAAC;AAAA,QAEzE,6CAAC,WAAM,WAAU,uBAAsB,SAAS,IAAI,UAAW,YAAE,UAAS;AAAA,QAC1E;AAAA,UAAC;AAAA;AAAA,YAAM,WAAU;AAAA,YAAsB,IAAI,IAAI;AAAA,YAAU,MAAK;AAAA,YAAW,cAAa;AAAA,YAC/E,OAAO;AAAA,YAAU,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK;AAAA,YAAG,UAAQ;AAAA;AAAA,QAAC;AAAA,QAE9E,SAAS,6CAAC,OAAE,WAAU,uBAAsB,MAAK,SAAS,iBAAM;AAAA,QAEjE,6CAAC,YAAO,WAAU,wBAAuB,MAAK,UAAS,UAAU,YAC9D,uBAAa,WAAM,EAAE,QACxB;AAAA,QAEC,MAAM,oBACL,6CAAC,YAAO,WAAU,sBAAqB,MAAK,UAAS,SAAS,MAAM,kBAAmB,YAAE,QAAO;AAAA;AAAA;AAAA,EAEpG;AAEJ;;;AI/CA,IAAAC,gBAAgC;AAyB5B,IAAAC,sBAAA;AAbG,SAAS,WAAW,OAAwB;AACjD,QAAM,EAAE,KAAK,IAAI,QAAQ;AACzB,QAAM,EAAE,YAAY,OAAO,QAAQ,IAAI,IAAI,cAAc;AACzD,QAAM,CAAC,OAAO,QAAQ,QAAI,wBAAS,EAAE;AACrC,QAAM,CAAC,UAAU,WAAW,QAAI,wBAAS,EAAE;AAC3C,QAAM,MAAM,EAAE,OAAO,OAAG,qBAAM,CAAC,UAAU,UAAU,OAAG,qBAAM,CAAC,YAAY;AACzE,QAAM,IAAI;AAAA,IACR,OAAO;AAAA,IAAS,UAAU;AAAA,IAAY,QAAQ;AAAA,IAC9C,SAAS;AAAA,IACT,GAAG,MAAM;AAAA,EACX;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,eAAY;AAAA,MACZ,WAAW,MAAM,aAAa;AAAA,MAC9B,UAAU,CAAC,MAAM;AACf,UAAE,eAAe;AACjB,aAAK,IAAI,YAAY;AACnB,gBAAM,SAAS,MAAM,KAAK,SAAS,OAAO,QAAQ;AAGlD,cAAI,OAAO,WAAW,WAAW;AAAE,kBAAM,YAAY;AAAG,mBAAO,EAAE;AAAA,UAAS;AAC1E,gBAAM,YAAY;AAAA,QACpB,CAAC;AAAA,MACH;AAAA,MAEA;AAAA,qDAAC,WAAM,WAAU,uBAAsB,SAAS,IAAI,OAAQ,YAAE,OAAM;AAAA,QACpE;AAAA,UAAC;AAAA;AAAA,YAAM,WAAU;AAAA,YAAsB,IAAI,IAAI;AAAA,YAAO,MAAK;AAAA,YAAQ,cAAa;AAAA,YACzE,OAAO;AAAA,YAAO,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,YAAG,UAAQ;AAAA;AAAA,QAAC;AAAA,QAEzE,6CAAC,WAAM,WAAU,uBAAsB,SAAS,IAAI,UAAW,YAAE,UAAS;AAAA,QAC1E;AAAA,UAAC;AAAA;AAAA,YAAM,WAAU;AAAA,YAAsB,IAAI,IAAI;AAAA,YAAU,MAAK;AAAA,YAAW,cAAa;AAAA,YAC/E,OAAO;AAAA,YAAU,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK;AAAA,YAAG,UAAQ;AAAA;AAAA,QAAC;AAAA,QAE9E,SAAS,6CAAC,OAAE,WAAU,uBAAsB,MAAK,SAAS,iBAAM;AAAA,QAChE,UAAU,6CAAC,OAAE,WAAU,wBAAuB,MAAK,UAAU,kBAAO;AAAA,QAErE,6CAAC,YAAO,WAAU,wBAAuB,MAAK,UAAS,UAAU,YAC9D,uBAAa,WAAM,EAAE,QACxB;AAAA;AAAA;AAAA,EACF;AAEJ;;;ACvDA,IAAAC,gBAAgC;AAwB5B,IAAAC,sBAAA;AAdG,SAAS,mBAAmB,OAAgC;AACjE,QAAM,EAAE,KAAK,IAAI,QAAQ;AACzB,QAAM,EAAE,YAAY,OAAO,QAAQ,IAAI,IAAI,cAAc;AACzD,QAAM,CAAC,OAAO,QAAQ,QAAI,wBAAS,EAAE;AACrC,QAAM,KAAK,OAAG,qBAAM,CAAC;AACrB,QAAM,IAAI;AAAA,IACR,OAAO;AAAA,IAAS,QAAQ;AAAA;AAAA;AAAA,IAGxB,MAAM;AAAA,IACN,GAAG,MAAM;AAAA,EACX;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,eAAY;AAAA,MACZ,WAAW,MAAM,aAAa;AAAA,MAC9B,UAAU,CAAC,MAAM;AACf,UAAE,eAAe;AACjB,aAAK,IAAI,YAAY;AAAE,gBAAM,KAAK,eAAe,KAAK;AAAG,gBAAM,SAAS;AAAG,iBAAO,EAAE;AAAA,QAAM,CAAC;AAAA,MAC7F;AAAA,MAEA;AAAA,qDAAC,WAAM,WAAU,uBAAsB,SAAS,IAAK,YAAE,OAAM;AAAA,QAC7D;AAAA,UAAC;AAAA;AAAA,YAAM,WAAU;AAAA,YAAsB;AAAA,YAAQ,MAAK;AAAA,YAAQ,cAAa;AAAA,YAClE,OAAO;AAAA,YAAO,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,YAAG,UAAQ;AAAA;AAAA,QAAC;AAAA,QAExE,SAAS,6CAAC,OAAE,WAAU,uBAAsB,MAAK,SAAS,iBAAM;AAAA,QAChE,UAAU,6CAAC,OAAE,WAAU,wBAAuB,MAAK,UAAU,kBAAO;AAAA,QAErE,6CAAC,YAAO,WAAU,wBAAuB,MAAK,UAAS,UAAU,YAC9D,uBAAa,WAAM,EAAE,QACxB;AAAA;AAAA;AAAA,EACF;AAEJ;;;AC5CA,IAAAC,gBAAgC;AAwB5B,IAAAC,sBAAA;AAZG,SAAS,kBAAkB,OAA+B;AAC/D,QAAM,EAAE,KAAK,IAAI,QAAQ;AACzB,QAAM,EAAE,YAAY,OAAO,QAAQ,IAAI,IAAI,cAAc;AACzD,QAAM,CAAC,UAAU,WAAW,QAAI,wBAAS,EAAE;AAC3C,QAAM,KAAK,OAAG,qBAAM,CAAC;AACrB,QAAM,IAAI;AAAA,IACR,UAAU;AAAA,IAAgB,QAAQ;AAAA,IAClC,MAAM;AAAA,IACN,GAAG,MAAM;AAAA,EACX;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,eAAY;AAAA,MACZ,WAAW,MAAM,aAAa;AAAA,MAC9B,UAAU,CAAC,MAAM;AACf,UAAE,eAAe;AACjB,aAAK,IAAI,YAAY;AACnB,gBAAM,KAAK,cAAc,MAAM,OAAO,QAAQ;AAC9C,gBAAM,YAAY;AAGlB,iBAAO,EAAE;AAAA,QACX,CAAC;AAAA,MACH;AAAA,MAEA;AAAA,qDAAC,WAAM,WAAU,uBAAsB,SAAS,IAAK,YAAE,UAAS;AAAA,QAChE;AAAA,UAAC;AAAA;AAAA,YAAM,WAAU;AAAA,YAAsB;AAAA,YAAQ,MAAK;AAAA,YAAW,cAAa;AAAA,YACrE,OAAO;AAAA,YAAU,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK;AAAA,YAAG,UAAQ;AAAA;AAAA,QAAC;AAAA,QAE9E,SAAS,6CAAC,OAAE,WAAU,uBAAsB,MAAK,SAAS,iBAAM;AAAA,QAChE,UAAU,6CAAC,OAAE,WAAU,wBAAuB,MAAK,UAAU,kBAAO;AAAA,QAErE,6CAAC,YAAO,WAAU,wBAAuB,MAAK,UAAS,UAAU,YAC9D,uBAAa,WAAM,EAAE,QACxB;AAAA;AAAA;AAAA,EACF;AAEJ;;;AClDA,IAAAC,gBAA4C;AA8CxC,IAAAC,sBAAA;AAlCG,SAAS,iBAAiB,OAA8B;AAC7D,QAAM,EAAE,MAAM,cAAc,IAAI,QAAQ;AACxC,QAAM,EAAE,YAAY,OAAO,QAAQ,IAAI,IAAI,cAAc;AACzD,QAAM,gBAAY,sBAAsB,IAAI;AAC5C,QAAM,CAAC,iBAAiB,kBAAkB,QAAI,wBAAS,KAAK;AAC5D,QAAM,IAAI;AAAA,IACR,WAAW;AAAA,IACX,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,GAAG,MAAM;AAAA,EACX;AAEA,+BAAU,MAAM;AACd,QAAI,CAAC,MAAM,SAAS,UAAU,YAAY,MAAM,MAAO;AASvD,cAAU,UAAU,MAAM;AAC1B,SAAK,IAAI,YAAY;AACnB,YAAM,KAAK,YAAY,MAAM,KAAM;AACnC,yBAAmB,IAAI;AACvB,YAAM,aAAa;AAAA,IACrB,CAAC;AAAA,EAEH,GAAG,CAAC,MAAM,KAAK,CAAC;AAEhB,SACE,8CAAC,SAAI,eAAY,wBAAuB,WAAW,MAAM,aAAa,uBACnE;AAAA,UAAM,SAAS,cAAc,6CAAC,OAAE,WAAU,wBAAuB,MAAK,UAAU,YAAE,WAAU;AAAA,KAC3F,iBAAiB,oBACjB,6CAAC,OAAE,WAAU,wBAAuB,MAAK,UAAU,YAAE,UAAS;AAAA,IAE/D,CAAC,iBAAiB,CAAC,MAAM,SAAS,6CAAC,OAAE,WAAU,wBAAwB,YAAE,QAAO;AAAA,IAEhF,SAAS,6CAAC,OAAE,WAAU,uBAAsB,MAAK,SAAS,iBAAM;AAAA,IAChE,UAAU,6CAAC,OAAE,WAAU,wBAAuB,MAAK,UAAU,kBAAO;AAAA,IAEpE,CAAC,iBAAiB,CAAC,MAAM,SACxB;AAAA,MAAC;AAAA;AAAA,QACC,WAAU;AAAA,QAAuB,MAAK;AAAA,QAAS,UAAU;AAAA,QACzD,SAAS,MAAM,KAAK,IAAI,YAAY;AAAE,gBAAM,KAAK,mBAAmB;AAAG,iBAAO,EAAE;AAAA,QAAQ,CAAC;AAAA,QAExF,YAAE;AAAA;AAAA,IACL;AAAA,KAEJ;AAEJ;","names":["import_react","import_react","import_jsx_runtime","import_react","import_jsx_runtime","import_react","import_jsx_runtime","import_react","import_jsx_runtime","import_react","import_jsx_runtime"]}

package/dist/react/forms/index.js

@@ -1,7 +1,7 @@
 import {
   useAuth
-} from "../../chunk-YHIGTY64.js";
-import "../../chunk-NQU7HM23.js";
+} from "../../chunk-IJ3DNMNG.js";
+import "../../chunk-OYNGTNOS.js";
 
 // src/react/forms/SignIn.tsx
 import { useId, useState as useState2 } from "react";
@@ -300,12 +300,13 @@ function ResetPasswordForm(props) {
 }
 
 // src/react/forms/VerifyEmail.tsx
-import { useEffect, useRef as useRef2 } from "react";
+import { useEffect, useRef as useRef2, useState as useState6 } from "react";
 import { jsx as jsx5, jsxs as jsxs5 } from "react/jsx-runtime";
 function VerifyEmailPanel(props) {
   const { auth, emailVerified } = useAuth();
   const { submitting, error, notice, run } = useFormAction();
   const attempted = useRef2(null);
+  const [verifiedLocally, setVerifiedLocally] = useState6(false);
   const l = {
     verifying: "Verifying your email\u2026",
     verified: "Your email address is verified.",
@@ -319,12 +320,13 @@ function VerifyEmailPanel(props) {
     attempted.current = props.token;
     void run(async () => {
       await auth.verifyEmail(props.token);
+      setVerifiedLocally(true);
       props.onVerified?.();
     });
   }, [props.token]);
   return /* @__PURE__ */ jsxs5("div", { "data-testid": "throttle-auth-verify", className: props.className ?? "throttle-auth-panel", children: [
     props.token && submitting && /* @__PURE__ */ jsx5("p", { className: "throttle-auth-notice", role: "status", children: l.verifying }),
-    emailVerified && /* @__PURE__ */ jsx5("p", { className: "throttle-auth-notice", role: "status", children: l.verified }),
+    (emailVerified || verifiedLocally) && /* @__PURE__ */ jsx5("p", { className: "throttle-auth-notice", role: "status", children: l.verified }),
     !emailVerified && !props.token && /* @__PURE__ */ jsx5("p", { className: "throttle-auth-prompt", children: l.prompt }),
     error && /* @__PURE__ */ jsx5("p", { className: "throttle-auth-error", role: "alert", children: error }),
     notice && /* @__PURE__ */ jsx5("p", { className: "throttle-auth-notice", role: "status", children: notice }),

package/dist/react/forms/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/react/forms/SignIn.tsx","../../../src/react/forms/useFormAction.ts","../../../src/react/forms/messages.ts","../../../src/react/forms/SignUp.tsx","../../../src/react/forms/ForgotPassword.tsx","../../../src/react/forms/ResetPassword.tsx","../../../src/react/forms/VerifyEmail.tsx"],"sourcesContent":["import { useId, useState } from 'react';\nimport { useAuth } from '../context';\nimport { useFormAction } from './useFormAction';\n\nexport interface SignInFormProps {\n  onSuccess?: () => void;\n  onForgotPassword?: () => void;\n  className?: string;\n  labels?: Partial<{ email: string; password: string; submit: string; forgot: string }>;\n}\n\nexport function SignInForm(props: SignInFormProps) {\n  const { auth } = useAuth();\n  const { submitting, error, run } = useFormAction();\n  const [email, setEmail] = useState('');\n  const [password, setPassword] = useState('');\n  const ids = { email: `${useId()}-email`, password: `${useId()}-password` };\n  const l = { email: 'Email', password: 'Password', submit: 'Sign in', forgot: 'Forgot your password?', ...props.labels };\n\n  return (\n    <form\n      data-testid=\"throttle-auth-signin\"\n      className={props.className ?? 'throttle-auth-form'}\n      onSubmit={(e) => {\n        e.preventDefault();\n        void run(async () => { await auth.signIn(email, password); props.onSuccess?.(); });\n      }}\n    >\n      <label className=\"throttle-auth-label\" htmlFor={ids.email}>{l.email}</label>\n      <input className=\"throttle-auth-input\" id={ids.email} type=\"email\" autoComplete=\"email\"\n             value={email} onChange={(e) => setEmail(e.target.value)} required />\n\n      <label className=\"throttle-auth-label\" htmlFor={ids.password}>{l.password}</label>\n      <input className=\"throttle-auth-input\" id={ids.password} type=\"password\" autoComplete=\"current-password\"\n             value={password} onChange={(e) => setPassword(e.target.value)} required />\n\n      {error && <p className=\"throttle-auth-error\" role=\"alert\">{error}</p>}\n\n      <button className=\"throttle-auth-submit\" type=\"submit\" disabled={submitting}>\n        {submitting ? '…' : l.submit}\n      </button>\n\n      {props.onForgotPassword && (\n        <button className=\"throttle-auth-link\" type=\"button\" onClick={props.onForgotPassword}>{l.forgot}</button>\n      )}\n    </form>\n  );\n}\n","import { useCallback, useRef, useState } from 'react';\nimport { messageForError } from './messages';\n\nexport interface FormAction {\n  submitting: boolean;\n  error: string | null;\n  notice: string | null;\n  run(fn: () => Promise<string | void>): Promise<void>;\n}\n\n/** Submit-once semantics plus mapped error copy, shared by all five forms. */\nexport function useFormAction(): FormAction {\n  const [submitting, setSubmitting] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n  const [notice, setNotice] = useState<string | null>(null);\n  const inFlight = useRef(false);\n\n  const run = useCallback(async (fn: () => Promise<string | void>) => {\n    if (inFlight.current) return;   // a double-click is one attempt, not two\n    inFlight.current = true;\n    setSubmitting(true);\n    setError(null);\n    setNotice(null);\n    try {\n      const message = await fn();\n      if (typeof message === 'string') setNotice(message);\n    } catch (err) {\n      setError(messageForError(err));\n    } finally {\n      inFlight.current = false;\n      setSubmitting(false);\n    }\n  }, []);\n\n  return { submitting, error, notice, run };\n}\n","import { ThrottleAuthError } from '../../errors';\n\nfunction waitCopy(seconds?: number): string {\n  if (!seconds || !Number.isFinite(seconds)) return 'Please wait a moment and try again.';\n  if (seconds < 60) return `Please wait ${Math.ceil(seconds)} seconds and try again.`;\n  const minutes = Math.ceil(seconds / 60);\n  return `Please wait ${minutes} ${minutes === 1 ? 'minute' : 'minutes'} and try again.`;\n}\n\n/**\n * Buyer-facing copy for every code the storefront API returns. Two codes are\n * deliberately NOT passed through from the server: `invalid_credentials` (the\n * server is vague on purpose — enumerating accounts through our own UI would\n * undo that) and anything unrecognised.\n */\nexport function messageForError(err: unknown): string {\n  const e = err as Partial<ThrottleAuthError> & { code?: string };\n  switch (e?.code) {\n    case 'invalid_credentials':\n      return 'That email or password is not correct.';\n    case 'weak_password':\n      // The server's message IS the policy reason (\"Use at least 12 characters\").\n      return e.message || 'Please choose a stronger password.';\n    case 'too_many_attempts':\n      return `Too many attempts. ${waitCopy(e.retryAfter)}`;\n    case 'verification_required':\n      return 'Please verify your email address to continue.';\n    case 'step_up_required':\n      return 'Please re-enter your password to continue.';\n    case 'session_revoked':\n      return 'Your session has ended. Please sign in again.';\n    case 'token_expired':\n    case 'token_invalid':\n    case 'token_already_used':\n      return 'That link is no longer valid. Please request a new link.';\n    case 'auth_unavailable':\n      return 'Accounts are briefly unavailable. Please try again shortly.';\n    case 'origin_not_allowed':\n    case 'auth_not_enabled':\n    case 'invalid_api_key':\n    case 'environment_mismatch':\n      // Merchant misconfiguration, not something the buyer can fix.\n      return 'Accounts are not available right now. Please contact support.';\n    case 'cart_already_claimed':\n      return 'That cart belongs to a different account.';\n    case 'not_found':\n      return 'We could not find that.';\n    default:\n      return 'Something went wrong. Please try again.';\n  }\n}\n","import { useId, useState } from 'react';\nimport { useAuth } from '../context';\nimport { useFormAction } from './useFormAction';\n\nexport interface SignUpFormProps {\n  onSuccess?: () => void;\n  /** Called for the 202 shape: the address already has credentials, so we sent an email instead. */\n  onPending?: () => void;\n  className?: string;\n  labels?: Partial<{ email: string; password: string; submit: string; pending: string }>;\n}\n\nexport function SignUpForm(props: SignUpFormProps) {\n  const { auth } = useAuth();\n  const { submitting, error, notice, run } = useFormAction();\n  const [email, setEmail] = useState('');\n  const [password, setPassword] = useState('');\n  const ids = { email: `${useId()}-email`, password: `${useId()}-password` };\n  const l = {\n    email: 'Email', password: 'Password', submit: 'Create account',\n    pending: 'Check your email — we sent you a link to finish signing in.',\n    ...props.labels,\n  };\n\n  return (\n    <form\n      data-testid=\"throttle-auth-signup\"\n      className={props.className ?? 'throttle-auth-form'}\n      onSubmit={(e) => {\n        e.preventDefault();\n        void run(async () => {\n          const result = await auth.register(email, password);\n          // 202: an account already exists for this address. There is no\n          // session — say so rather than routing to a signed-in page.\n          if (result.status === 'pending') { props.onPending?.(); return l.pending; }\n          props.onSuccess?.();\n        });\n      }}\n    >\n      <label className=\"throttle-auth-label\" htmlFor={ids.email}>{l.email}</label>\n      <input className=\"throttle-auth-input\" id={ids.email} type=\"email\" autoComplete=\"email\"\n             value={email} onChange={(e) => setEmail(e.target.value)} required />\n\n      <label className=\"throttle-auth-label\" htmlFor={ids.password}>{l.password}</label>\n      <input className=\"throttle-auth-input\" id={ids.password} type=\"password\" autoComplete=\"new-password\"\n             value={password} onChange={(e) => setPassword(e.target.value)} required />\n\n      {error && <p className=\"throttle-auth-error\" role=\"alert\">{error}</p>}\n      {notice && <p className=\"throttle-auth-notice\" role=\"status\">{notice}</p>}\n\n      <button className=\"throttle-auth-submit\" type=\"submit\" disabled={submitting}>\n        {submitting ? '…' : l.submit}\n      </button>\n    </form>\n  );\n}\n","import { useId, useState } from 'react';\nimport { useAuth } from '../context';\nimport { useFormAction } from './useFormAction';\n\nexport interface ForgotPasswordFormProps {\n  onSent?: () => void;\n  className?: string;\n  labels?: Partial<{ email: string; submit: string; sent: string }>;\n}\n\nexport function ForgotPasswordForm(props: ForgotPasswordFormProps) {\n  const { auth } = useAuth();\n  const { submitting, error, notice, run } = useFormAction();\n  const [email, setEmail] = useState('');\n  const id = `${useId()}-email`;\n  const l = {\n    email: 'Email', submit: 'Send reset link',\n    // Identical copy whether or not the address has an account — the API is\n    // deliberately silent on that and this form must be too.\n    sent: 'If an account exists for that address, we have sent a reset link.',\n    ...props.labels,\n  };\n\n  return (\n    <form\n      data-testid=\"throttle-auth-forgot\"\n      className={props.className ?? 'throttle-auth-form'}\n      onSubmit={(e) => {\n        e.preventDefault();\n        void run(async () => { await auth.forgotPassword(email); props.onSent?.(); return l.sent; });\n      }}\n    >\n      <label className=\"throttle-auth-label\" htmlFor={id}>{l.email}</label>\n      <input className=\"throttle-auth-input\" id={id} type=\"email\" autoComplete=\"email\"\n             value={email} onChange={(e) => setEmail(e.target.value)} required />\n\n      {error && <p className=\"throttle-auth-error\" role=\"alert\">{error}</p>}\n      {notice && <p className=\"throttle-auth-notice\" role=\"status\">{notice}</p>}\n\n      <button className=\"throttle-auth-submit\" type=\"submit\" disabled={submitting}>\n        {submitting ? '…' : l.submit}\n      </button>\n    </form>\n  );\n}\n","import { useId, useState } from 'react';\nimport { useAuth } from '../context';\nimport { useFormAction } from './useFormAction';\n\nexport interface ResetPasswordFormProps {\n  /** The token from the emailed link, e.g. `new URLSearchParams(location.search).get('token')`. */\n  token: string;\n  onSuccess?: () => void;\n  className?: string;\n  labels?: Partial<{ password: string; submit: string; done: string }>;\n}\n\nexport function ResetPasswordForm(props: ResetPasswordFormProps) {\n  const { auth } = useAuth();\n  const { submitting, error, notice, run } = useFormAction();\n  const [password, setPassword] = useState('');\n  const id = `${useId()}-new-password`;\n  const l = {\n    password: 'New password', submit: 'Set new password',\n    done: 'Your password has been reset. Please sign in with your new password.',\n    ...props.labels,\n  };\n\n  return (\n    <form\n      data-testid=\"throttle-auth-reset\"\n      className={props.className ?? 'throttle-auth-form'}\n      onSubmit={(e) => {\n        e.preventDefault();\n        void run(async () => {\n          await auth.resetPassword(props.token, password);\n          props.onSuccess?.();\n          // Every session died with the reset, this one included — the buyer\n          // signs in again rather than landing on an account page.\n          return l.done;\n        });\n      }}\n    >\n      <label className=\"throttle-auth-label\" htmlFor={id}>{l.password}</label>\n      <input className=\"throttle-auth-input\" id={id} type=\"password\" autoComplete=\"new-password\"\n             value={password} onChange={(e) => setPassword(e.target.value)} required />\n\n      {error && <p className=\"throttle-auth-error\" role=\"alert\">{error}</p>}\n      {notice && <p className=\"throttle-auth-notice\" role=\"status\">{notice}</p>}\n\n      <button className=\"throttle-auth-submit\" type=\"submit\" disabled={submitting}>\n        {submitting ? '…' : l.submit}\n      </button>\n    </form>\n  );\n}\n","import { useEffect, useRef } from 'react';\nimport { useAuth } from '../context';\nimport { useFormAction } from './useFormAction';\n\nexport interface VerifyEmailPanelProps {\n  /** Token from the emailed link. Omit to render the \"resend\" state instead. */\n  token?: string;\n  onVerified?: () => void;\n  className?: string;\n  labels?: Partial<{ verifying: string; verified: string; prompt: string; resend: string; resent: string }>;\n}\n\nexport function VerifyEmailPanel(props: VerifyEmailPanelProps) {\n  const { auth, emailVerified } = useAuth();\n  const { submitting, error, notice, run } = useFormAction();\n  const attempted = useRef<string | null>(null);\n  const l = {\n    verifying: 'Verifying your email…',\n    verified: 'Your email address is verified.',\n    prompt: 'Please verify your email address to unlock your full account.',\n    resend: 'Resend verification email',\n    resent: 'Sent. Check your inbox.',\n    ...props.labels,\n  };\n\n  useEffect(() => {\n    if (!props.token || attempted.current === props.token) return;\n    // Once per token. Re-running would burn the single-use token and report\n    // `token_already_used` to a buyer who did nothing wrong.\n    //\n    // useFormAction's `inFlight` flag happens to block the StrictMode\n    // double-invoke too, but that is a submit-debounce concern that belongs to\n    // form actions generally. Burning a single-use token is this panel's own\n    // invariant, and it should not depend on another layer's debounce\n    // semantics staying exactly as they are today.\n    attempted.current = props.token;\n    void run(async () => { await auth.verifyEmail(props.token!); props.onVerified?.(); });\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [props.token]);\n\n  return (\n    <div data-testid=\"throttle-auth-verify\" className={props.className ?? 'throttle-auth-panel'}>\n      {props.token && submitting && <p className=\"throttle-auth-notice\" role=\"status\">{l.verifying}</p>}\n      {emailVerified && <p className=\"throttle-auth-notice\" role=\"status\">{l.verified}</p>}\n      {!emailVerified && !props.token && <p className=\"throttle-auth-prompt\">{l.prompt}</p>}\n\n      {error && <p className=\"throttle-auth-error\" role=\"alert\">{error}</p>}\n      {notice && <p className=\"throttle-auth-notice\" role=\"status\">{notice}</p>}\n\n      {!emailVerified && !props.token && (\n        <button\n          className=\"throttle-auth-submit\" type=\"button\" disabled={submitting}\n          onClick={() => void run(async () => { await auth.resendVerification(); return l.resent; })}\n        >\n          {l.resend}\n        </button>\n      )}\n    </div>\n  );\n}\n"],"mappings":";;;;;;AAAA,SAAS,OAAO,YAAAA,iBAAgB;;;ACAhC,SAAS,aAAa,QAAQ,gBAAgB;;;ACE9C,SAAS,SAAS,SAA0B;AAC1C,MAAI,CAAC,WAAW,CAAC,OAAO,SAAS,OAAO,EAAG,QAAO;AAClD,MAAI,UAAU,GAAI,QAAO,eAAe,KAAK,KAAK,OAAO,CAAC;AAC1D,QAAM,UAAU,KAAK,KAAK,UAAU,EAAE;AACtC,SAAO,eAAe,OAAO,IAAI,YAAY,IAAI,WAAW,SAAS;AACvE;AAQO,SAAS,gBAAgB,KAAsB;AACpD,QAAM,IAAI;AACV,UAAQ,GAAG,MAAM;AAAA,IACf,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAEH,aAAO,EAAE,WAAW;AAAA,IACtB,KAAK;AACH,aAAO,sBAAsB,SAAS,EAAE,UAAU,CAAC;AAAA,IACrD,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAEH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;;;ADvCO,SAAS,gBAA4B;AAC1C,QAAM,CAAC,YAAY,aAAa,IAAI,SAAS,KAAK;AAClD,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,IAAI;AACtD,QAAM,CAAC,QAAQ,SAAS,IAAI,SAAwB,IAAI;AACxD,QAAM,WAAW,OAAO,KAAK;AAE7B,QAAM,MAAM,YAAY,OAAO,OAAqC;AAClE,QAAI,SAAS,QAAS;AACtB,aAAS,UAAU;AACnB,kBAAc,IAAI;AAClB,aAAS,IAAI;AACb,cAAU,IAAI;AACd,QAAI;AACF,YAAM,UAAU,MAAM,GAAG;AACzB,UAAI,OAAO,YAAY,SAAU,WAAU,OAAO;AAAA,IACpD,SAAS,KAAK;AACZ,eAAS,gBAAgB,GAAG,CAAC;AAAA,IAC/B,UAAE;AACA,eAAS,UAAU;AACnB,oBAAc,KAAK;AAAA,IACrB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SAAO,EAAE,YAAY,OAAO,QAAQ,IAAI;AAC1C;;;ADfI,SAQE,KARF;AATG,SAAS,WAAW,OAAwB;AACjD,QAAM,EAAE,KAAK,IAAI,QAAQ;AACzB,QAAM,EAAE,YAAY,OAAO,IAAI,IAAI,cAAc;AACjD,QAAM,CAAC,OAAO,QAAQ,IAAIC,UAAS,EAAE;AACrC,QAAM,CAAC,UAAU,WAAW,IAAIA,UAAS,EAAE;AAC3C,QAAM,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,UAAU,UAAU,GAAG,MAAM,CAAC,YAAY;AACzE,QAAM,IAAI,EAAE,OAAO,SAAS,UAAU,YAAY,QAAQ,WAAW,QAAQ,yBAAyB,GAAG,MAAM,OAAO;AAEtH,SACE;AAAA,IAAC;AAAA;AAAA,MACC,eAAY;AAAA,MACZ,WAAW,MAAM,aAAa;AAAA,MAC9B,UAAU,CAAC,MAAM;AACf,UAAE,eAAe;AACjB,aAAK,IAAI,YAAY;AAAE,gBAAM,KAAK,OAAO,OAAO,QAAQ;AAAG,gBAAM,YAAY;AAAA,QAAG,CAAC;AAAA,MACnF;AAAA,MAEA;AAAA,4BAAC,WAAM,WAAU,uBAAsB,SAAS,IAAI,OAAQ,YAAE,OAAM;AAAA,QACpE;AAAA,UAAC;AAAA;AAAA,YAAM,WAAU;AAAA,YAAsB,IAAI,IAAI;AAAA,YAAO,MAAK;AAAA,YAAQ,cAAa;AAAA,YACzE,OAAO;AAAA,YAAO,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,YAAG,UAAQ;AAAA;AAAA,QAAC;AAAA,QAEzE,oBAAC,WAAM,WAAU,uBAAsB,SAAS,IAAI,UAAW,YAAE,UAAS;AAAA,QAC1E;AAAA,UAAC;AAAA;AAAA,YAAM,WAAU;AAAA,YAAsB,IAAI,IAAI;AAAA,YAAU,MAAK;AAAA,YAAW,cAAa;AAAA,YAC/E,OAAO;AAAA,YAAU,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK;AAAA,YAAG,UAAQ;AAAA;AAAA,QAAC;AAAA,QAE9E,SAAS,oBAAC,OAAE,WAAU,uBAAsB,MAAK,SAAS,iBAAM;AAAA,QAEjE,oBAAC,YAAO,WAAU,wBAAuB,MAAK,UAAS,UAAU,YAC9D,uBAAa,WAAM,EAAE,QACxB;AAAA,QAEC,MAAM,oBACL,oBAAC,YAAO,WAAU,sBAAqB,MAAK,UAAS,SAAS,MAAM,kBAAmB,YAAE,QAAO;AAAA;AAAA;AAAA,EAEpG;AAEJ;;;AG/CA,SAAS,SAAAC,QAAO,YAAAC,iBAAgB;AAyB5B,SAcE,OAAAC,MAdF,QAAAC,aAAA;AAbG,SAAS,WAAW,OAAwB;AACjD,QAAM,EAAE,KAAK,IAAI,QAAQ;AACzB,QAAM,EAAE,YAAY,OAAO,QAAQ,IAAI,IAAI,cAAc;AACzD,QAAM,CAAC,OAAO,QAAQ,IAAIC,UAAS,EAAE;AACrC,QAAM,CAAC,UAAU,WAAW,IAAIA,UAAS,EAAE;AAC3C,QAAM,MAAM,EAAE,OAAO,GAAGC,OAAM,CAAC,UAAU,UAAU,GAAGA,OAAM,CAAC,YAAY;AACzE,QAAM,IAAI;AAAA,IACR,OAAO;AAAA,IAAS,UAAU;AAAA,IAAY,QAAQ;AAAA,IAC9C,SAAS;AAAA,IACT,GAAG,MAAM;AAAA,EACX;AAEA,SACE,gBAAAF;AAAA,IAAC;AAAA;AAAA,MACC,eAAY;AAAA,MACZ,WAAW,MAAM,aAAa;AAAA,MAC9B,UAAU,CAAC,MAAM;AACf,UAAE,eAAe;AACjB,aAAK,IAAI,YAAY;AACnB,gBAAM,SAAS,MAAM,KAAK,SAAS,OAAO,QAAQ;AAGlD,cAAI,OAAO,WAAW,WAAW;AAAE,kBAAM,YAAY;AAAG,mBAAO,EAAE;AAAA,UAAS;AAC1E,gBAAM,YAAY;AAAA,QACpB,CAAC;AAAA,MACH;AAAA,MAEA;AAAA,wBAAAD,KAAC,WAAM,WAAU,uBAAsB,SAAS,IAAI,OAAQ,YAAE,OAAM;AAAA,QACpE,gBAAAA;AAAA,UAAC;AAAA;AAAA,YAAM,WAAU;AAAA,YAAsB,IAAI,IAAI;AAAA,YAAO,MAAK;AAAA,YAAQ,cAAa;AAAA,YACzE,OAAO;AAAA,YAAO,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,YAAG,UAAQ;AAAA;AAAA,QAAC;AAAA,QAEzE,gBAAAA,KAAC,WAAM,WAAU,uBAAsB,SAAS,IAAI,UAAW,YAAE,UAAS;AAAA,QAC1E,gBAAAA;AAAA,UAAC;AAAA;AAAA,YAAM,WAAU;AAAA,YAAsB,IAAI,IAAI;AAAA,YAAU,MAAK;AAAA,YAAW,cAAa;AAAA,YAC/E,OAAO;AAAA,YAAU,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK;AAAA,YAAG,UAAQ;AAAA;AAAA,QAAC;AAAA,QAE9E,SAAS,gBAAAA,KAAC,OAAE,WAAU,uBAAsB,MAAK,SAAS,iBAAM;AAAA,QAChE,UAAU,gBAAAA,KAAC,OAAE,WAAU,wBAAuB,MAAK,UAAU,kBAAO;AAAA,QAErE,gBAAAA,KAAC,YAAO,WAAU,wBAAuB,MAAK,UAAS,UAAU,YAC9D,uBAAa,WAAM,EAAE,QACxB;AAAA;AAAA;AAAA,EACF;AAEJ;;;ACvDA,SAAS,SAAAI,QAAO,YAAAC,iBAAgB;AAwB5B,SAQE,OAAAC,MARF,QAAAC,aAAA;AAdG,SAAS,mBAAmB,OAAgC;AACjE,QAAM,EAAE,KAAK,IAAI,QAAQ;AACzB,QAAM,EAAE,YAAY,OAAO,QAAQ,IAAI,IAAI,cAAc;AACzD,QAAM,CAAC,OAAO,QAAQ,IAAIC,UAAS,EAAE;AACrC,QAAM,KAAK,GAAGC,OAAM,CAAC;AACrB,QAAM,IAAI;AAAA,IACR,OAAO;AAAA,IAAS,QAAQ;AAAA;AAAA;AAAA,IAGxB,MAAM;AAAA,IACN,GAAG,MAAM;AAAA,EACX;AAEA,SACE,gBAAAF;AAAA,IAAC;AAAA;AAAA,MACC,eAAY;AAAA,MACZ,WAAW,MAAM,aAAa;AAAA,MAC9B,UAAU,CAAC,MAAM;AACf,UAAE,eAAe;AACjB,aAAK,IAAI,YAAY;AAAE,gBAAM,KAAK,eAAe,KAAK;AAAG,gBAAM,SAAS;AAAG,iBAAO,EAAE;AAAA,QAAM,CAAC;AAAA,MAC7F;AAAA,MAEA;AAAA,wBAAAD,KAAC,WAAM,WAAU,uBAAsB,SAAS,IAAK,YAAE,OAAM;AAAA,QAC7D,gBAAAA;AAAA,UAAC;AAAA;AAAA,YAAM,WAAU;AAAA,YAAsB;AAAA,YAAQ,MAAK;AAAA,YAAQ,cAAa;AAAA,YAClE,OAAO;AAAA,YAAO,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,YAAG,UAAQ;AAAA;AAAA,QAAC;AAAA,QAExE,SAAS,gBAAAA,KAAC,OAAE,WAAU,uBAAsB,MAAK,SAAS,iBAAM;AAAA,QAChE,UAAU,gBAAAA,KAAC,OAAE,WAAU,wBAAuB,MAAK,UAAU,kBAAO;AAAA,QAErE,gBAAAA,KAAC,YAAO,WAAU,wBAAuB,MAAK,UAAS,UAAU,YAC9D,uBAAa,WAAM,EAAE,QACxB;AAAA;AAAA;AAAA,EACF;AAEJ;;;AC5CA,SAAS,SAAAI,QAAO,YAAAC,iBAAgB;AAwB5B,SAcE,OAAAC,MAdF,QAAAC,aAAA;AAZG,SAAS,kBAAkB,OAA+B;AAC/D,QAAM,EAAE,KAAK,IAAI,QAAQ;AACzB,QAAM,EAAE,YAAY,OAAO,QAAQ,IAAI,IAAI,cAAc;AACzD,QAAM,CAAC,UAAU,WAAW,IAAIC,UAAS,EAAE;AAC3C,QAAM,KAAK,GAAGC,OAAM,CAAC;AACrB,QAAM,IAAI;AAAA,IACR,UAAU;AAAA,IAAgB,QAAQ;AAAA,IAClC,MAAM;AAAA,IACN,GAAG,MAAM;AAAA,EACX;AAEA,SACE,gBAAAF;AAAA,IAAC;AAAA;AAAA,MACC,eAAY;AAAA,MACZ,WAAW,MAAM,aAAa;AAAA,MAC9B,UAAU,CAAC,MAAM;AACf,UAAE,eAAe;AACjB,aAAK,IAAI,YAAY;AACnB,gBAAM,KAAK,cAAc,MAAM,OAAO,QAAQ;AAC9C,gBAAM,YAAY;AAGlB,iBAAO,EAAE;AAAA,QACX,CAAC;AAAA,MACH;AAAA,MAEA;AAAA,wBAAAD,KAAC,WAAM,WAAU,uBAAsB,SAAS,IAAK,YAAE,UAAS;AAAA,QAChE,gBAAAA;AAAA,UAAC;AAAA;AAAA,YAAM,WAAU;AAAA,YAAsB;AAAA,YAAQ,MAAK;AAAA,YAAW,cAAa;AAAA,YACrE,OAAO;AAAA,YAAU,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK;AAAA,YAAG,UAAQ;AAAA;AAAA,QAAC;AAAA,QAE9E,SAAS,gBAAAA,KAAC,OAAE,WAAU,uBAAsB,MAAK,SAAS,iBAAM;AAAA,QAChE,UAAU,gBAAAA,KAAC,OAAE,WAAU,wBAAuB,MAAK,UAAU,kBAAO;AAAA,QAErE,gBAAAA,KAAC,YAAO,WAAU,wBAAuB,MAAK,UAAS,UAAU,YAC9D,uBAAa,WAAM,EAAE,QACxB;AAAA;AAAA;AAAA,EACF;AAEJ;;;AClDA,SAAS,WAAW,UAAAI,eAAc;AAyC9B,SACgC,OAAAC,MADhC,QAAAC,aAAA;AA7BG,SAAS,iBAAiB,OAA8B;AAC7D,QAAM,EAAE,MAAM,cAAc,IAAI,QAAQ;AACxC,QAAM,EAAE,YAAY,OAAO,QAAQ,IAAI,IAAI,cAAc;AACzD,QAAM,YAAYC,QAAsB,IAAI;AAC5C,QAAM,IAAI;AAAA,IACR,WAAW;AAAA,IACX,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,GAAG,MAAM;AAAA,EACX;AAEA,YAAU,MAAM;AACd,QAAI,CAAC,MAAM,SAAS,UAAU,YAAY,MAAM,MAAO;AASvD,cAAU,UAAU,MAAM;AAC1B,SAAK,IAAI,YAAY;AAAE,YAAM,KAAK,YAAY,MAAM,KAAM;AAAG,YAAM,aAAa;AAAA,IAAG,CAAC;AAAA,EAEtF,GAAG,CAAC,MAAM,KAAK,CAAC;AAEhB,SACE,gBAAAD,MAAC,SAAI,eAAY,wBAAuB,WAAW,MAAM,aAAa,uBACnE;AAAA,UAAM,SAAS,cAAc,gBAAAD,KAAC,OAAE,WAAU,wBAAuB,MAAK,UAAU,YAAE,WAAU;AAAA,IAC5F,iBAAiB,gBAAAA,KAAC,OAAE,WAAU,wBAAuB,MAAK,UAAU,YAAE,UAAS;AAAA,IAC/E,CAAC,iBAAiB,CAAC,MAAM,SAAS,gBAAAA,KAAC,OAAE,WAAU,wBAAwB,YAAE,QAAO;AAAA,IAEhF,SAAS,gBAAAA,KAAC,OAAE,WAAU,uBAAsB,MAAK,SAAS,iBAAM;AAAA,IAChE,UAAU,gBAAAA,KAAC,OAAE,WAAU,wBAAuB,MAAK,UAAU,kBAAO;AAAA,IAEpE,CAAC,iBAAiB,CAAC,MAAM,SACxB,gBAAAA;AAAA,MAAC;AAAA;AAAA,QACC,WAAU;AAAA,QAAuB,MAAK;AAAA,QAAS,UAAU;AAAA,QACzD,SAAS,MAAM,KAAK,IAAI,YAAY;AAAE,gBAAM,KAAK,mBAAmB;AAAG,iBAAO,EAAE;AAAA,QAAQ,CAAC;AAAA,QAExF,YAAE;AAAA;AAAA,IACL;AAAA,KAEJ;AAEJ;","names":["useState","useState","useId","useState","jsx","jsxs","useState","useId","useId","useState","jsx","jsxs","useState","useId","useId","useState","jsx","jsxs","useState","useId","useRef","jsx","jsxs","useRef"]}
+{"version":3,"sources":["../../../src/react/forms/SignIn.tsx","../../../src/react/forms/useFormAction.ts","../../../src/react/forms/messages.ts","../../../src/react/forms/SignUp.tsx","../../../src/react/forms/ForgotPassword.tsx","../../../src/react/forms/ResetPassword.tsx","../../../src/react/forms/VerifyEmail.tsx"],"sourcesContent":["import { useId, useState } from 'react';\nimport { useAuth } from '../context';\nimport { useFormAction } from './useFormAction';\n\nexport interface SignInFormProps {\n  onSuccess?: () => void;\n  onForgotPassword?: () => void;\n  className?: string;\n  labels?: Partial<{ email: string; password: string; submit: string; forgot: string }>;\n}\n\nexport function SignInForm(props: SignInFormProps) {\n  const { auth } = useAuth();\n  const { submitting, error, run } = useFormAction();\n  const [email, setEmail] = useState('');\n  const [password, setPassword] = useState('');\n  const ids = { email: `${useId()}-email`, password: `${useId()}-password` };\n  const l = { email: 'Email', password: 'Password', submit: 'Sign in', forgot: 'Forgot your password?', ...props.labels };\n\n  return (\n    <form\n      data-testid=\"throttle-auth-signin\"\n      className={props.className ?? 'throttle-auth-form'}\n      onSubmit={(e) => {\n        e.preventDefault();\n        void run(async () => { await auth.signIn(email, password); props.onSuccess?.(); });\n      }}\n    >\n      <label className=\"throttle-auth-label\" htmlFor={ids.email}>{l.email}</label>\n      <input className=\"throttle-auth-input\" id={ids.email} type=\"email\" autoComplete=\"email\"\n             value={email} onChange={(e) => setEmail(e.target.value)} required />\n\n      <label className=\"throttle-auth-label\" htmlFor={ids.password}>{l.password}</label>\n      <input className=\"throttle-auth-input\" id={ids.password} type=\"password\" autoComplete=\"current-password\"\n             value={password} onChange={(e) => setPassword(e.target.value)} required />\n\n      {error && <p className=\"throttle-auth-error\" role=\"alert\">{error}</p>}\n\n      <button className=\"throttle-auth-submit\" type=\"submit\" disabled={submitting}>\n        {submitting ? '…' : l.submit}\n      </button>\n\n      {props.onForgotPassword && (\n        <button className=\"throttle-auth-link\" type=\"button\" onClick={props.onForgotPassword}>{l.forgot}</button>\n      )}\n    </form>\n  );\n}\n","import { useCallback, useRef, useState } from 'react';\nimport { messageForError } from './messages';\n\nexport interface FormAction {\n  submitting: boolean;\n  error: string | null;\n  notice: string | null;\n  run(fn: () => Promise<string | void>): Promise<void>;\n}\n\n/** Submit-once semantics plus mapped error copy, shared by all five forms. */\nexport function useFormAction(): FormAction {\n  const [submitting, setSubmitting] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n  const [notice, setNotice] = useState<string | null>(null);\n  const inFlight = useRef(false);\n\n  const run = useCallback(async (fn: () => Promise<string | void>) => {\n    if (inFlight.current) return;   // a double-click is one attempt, not two\n    inFlight.current = true;\n    setSubmitting(true);\n    setError(null);\n    setNotice(null);\n    try {\n      const message = await fn();\n      if (typeof message === 'string') setNotice(message);\n    } catch (err) {\n      setError(messageForError(err));\n    } finally {\n      inFlight.current = false;\n      setSubmitting(false);\n    }\n  }, []);\n\n  return { submitting, error, notice, run };\n}\n","import { ThrottleAuthError } from '../../errors';\n\nfunction waitCopy(seconds?: number): string {\n  if (!seconds || !Number.isFinite(seconds)) return 'Please wait a moment and try again.';\n  if (seconds < 60) return `Please wait ${Math.ceil(seconds)} seconds and try again.`;\n  const minutes = Math.ceil(seconds / 60);\n  return `Please wait ${minutes} ${minutes === 1 ? 'minute' : 'minutes'} and try again.`;\n}\n\n/**\n * Buyer-facing copy for every code the storefront API returns. Two codes are\n * deliberately NOT passed through from the server: `invalid_credentials` (the\n * server is vague on purpose — enumerating accounts through our own UI would\n * undo that) and anything unrecognised.\n */\nexport function messageForError(err: unknown): string {\n  const e = err as Partial<ThrottleAuthError> & { code?: string };\n  switch (e?.code) {\n    case 'invalid_credentials':\n      return 'That email or password is not correct.';\n    case 'weak_password':\n      // The server's message IS the policy reason (\"Use at least 12 characters\").\n      return e.message || 'Please choose a stronger password.';\n    case 'too_many_attempts':\n      return `Too many attempts. ${waitCopy(e.retryAfter)}`;\n    case 'verification_required':\n      return 'Please verify your email address to continue.';\n    case 'step_up_required':\n      return 'Please re-enter your password to continue.';\n    case 'session_revoked':\n      return 'Your session has ended. Please sign in again.';\n    case 'token_expired':\n    case 'token_invalid':\n    case 'token_already_used':\n      return 'That link is no longer valid. Please request a new link.';\n    case 'auth_unavailable':\n      return 'Accounts are briefly unavailable. Please try again shortly.';\n    case 'origin_not_allowed':\n    case 'auth_not_enabled':\n    case 'invalid_api_key':\n    case 'environment_mismatch':\n      // Merchant misconfiguration, not something the buyer can fix.\n      return 'Accounts are not available right now. Please contact support.';\n    case 'cart_already_claimed':\n      return 'That cart belongs to a different account.';\n    case 'not_found':\n      return 'We could not find that.';\n    default:\n      return 'Something went wrong. Please try again.';\n  }\n}\n","import { useId, useState } from 'react';\nimport { useAuth } from '../context';\nimport { useFormAction } from './useFormAction';\n\nexport interface SignUpFormProps {\n  onSuccess?: () => void;\n  /** Called for the 202 shape: the address already has credentials, so we sent an email instead. */\n  onPending?: () => void;\n  className?: string;\n  labels?: Partial<{ email: string; password: string; submit: string; pending: string }>;\n}\n\nexport function SignUpForm(props: SignUpFormProps) {\n  const { auth } = useAuth();\n  const { submitting, error, notice, run } = useFormAction();\n  const [email, setEmail] = useState('');\n  const [password, setPassword] = useState('');\n  const ids = { email: `${useId()}-email`, password: `${useId()}-password` };\n  const l = {\n    email: 'Email', password: 'Password', submit: 'Create account',\n    pending: 'Check your email — we sent you a link to finish signing in.',\n    ...props.labels,\n  };\n\n  return (\n    <form\n      data-testid=\"throttle-auth-signup\"\n      className={props.className ?? 'throttle-auth-form'}\n      onSubmit={(e) => {\n        e.preventDefault();\n        void run(async () => {\n          const result = await auth.register(email, password);\n          // 202: an account already exists for this address. There is no\n          // session — say so rather than routing to a signed-in page.\n          if (result.status === 'pending') { props.onPending?.(); return l.pending; }\n          props.onSuccess?.();\n        });\n      }}\n    >\n      <label className=\"throttle-auth-label\" htmlFor={ids.email}>{l.email}</label>\n      <input className=\"throttle-auth-input\" id={ids.email} type=\"email\" autoComplete=\"email\"\n             value={email} onChange={(e) => setEmail(e.target.value)} required />\n\n      <label className=\"throttle-auth-label\" htmlFor={ids.password}>{l.password}</label>\n      <input className=\"throttle-auth-input\" id={ids.password} type=\"password\" autoComplete=\"new-password\"\n             value={password} onChange={(e) => setPassword(e.target.value)} required />\n\n      {error && <p className=\"throttle-auth-error\" role=\"alert\">{error}</p>}\n      {notice && <p className=\"throttle-auth-notice\" role=\"status\">{notice}</p>}\n\n      <button className=\"throttle-auth-submit\" type=\"submit\" disabled={submitting}>\n        {submitting ? '…' : l.submit}\n      </button>\n    </form>\n  );\n}\n","import { useId, useState } from 'react';\nimport { useAuth } from '../context';\nimport { useFormAction } from './useFormAction';\n\nexport interface ForgotPasswordFormProps {\n  onSent?: () => void;\n  className?: string;\n  labels?: Partial<{ email: string; submit: string; sent: string }>;\n}\n\nexport function ForgotPasswordForm(props: ForgotPasswordFormProps) {\n  const { auth } = useAuth();\n  const { submitting, error, notice, run } = useFormAction();\n  const [email, setEmail] = useState('');\n  const id = `${useId()}-email`;\n  const l = {\n    email: 'Email', submit: 'Send reset link',\n    // Identical copy whether or not the address has an account — the API is\n    // deliberately silent on that and this form must be too.\n    sent: 'If an account exists for that address, we have sent a reset link.',\n    ...props.labels,\n  };\n\n  return (\n    <form\n      data-testid=\"throttle-auth-forgot\"\n      className={props.className ?? 'throttle-auth-form'}\n      onSubmit={(e) => {\n        e.preventDefault();\n        void run(async () => { await auth.forgotPassword(email); props.onSent?.(); return l.sent; });\n      }}\n    >\n      <label className=\"throttle-auth-label\" htmlFor={id}>{l.email}</label>\n      <input className=\"throttle-auth-input\" id={id} type=\"email\" autoComplete=\"email\"\n             value={email} onChange={(e) => setEmail(e.target.value)} required />\n\n      {error && <p className=\"throttle-auth-error\" role=\"alert\">{error}</p>}\n      {notice && <p className=\"throttle-auth-notice\" role=\"status\">{notice}</p>}\n\n      <button className=\"throttle-auth-submit\" type=\"submit\" disabled={submitting}>\n        {submitting ? '…' : l.submit}\n      </button>\n    </form>\n  );\n}\n","import { useId, useState } from 'react';\nimport { useAuth } from '../context';\nimport { useFormAction } from './useFormAction';\n\nexport interface ResetPasswordFormProps {\n  /** The token from the emailed link, e.g. `new URLSearchParams(location.search).get('token')`. */\n  token: string;\n  onSuccess?: () => void;\n  className?: string;\n  labels?: Partial<{ password: string; submit: string; done: string }>;\n}\n\nexport function ResetPasswordForm(props: ResetPasswordFormProps) {\n  const { auth } = useAuth();\n  const { submitting, error, notice, run } = useFormAction();\n  const [password, setPassword] = useState('');\n  const id = `${useId()}-new-password`;\n  const l = {\n    password: 'New password', submit: 'Set new password',\n    done: 'Your password has been reset. Please sign in with your new password.',\n    ...props.labels,\n  };\n\n  return (\n    <form\n      data-testid=\"throttle-auth-reset\"\n      className={props.className ?? 'throttle-auth-form'}\n      onSubmit={(e) => {\n        e.preventDefault();\n        void run(async () => {\n          await auth.resetPassword(props.token, password);\n          props.onSuccess?.();\n          // Every session died with the reset, this one included — the buyer\n          // signs in again rather than landing on an account page.\n          return l.done;\n        });\n      }}\n    >\n      <label className=\"throttle-auth-label\" htmlFor={id}>{l.password}</label>\n      <input className=\"throttle-auth-input\" id={id} type=\"password\" autoComplete=\"new-password\"\n             value={password} onChange={(e) => setPassword(e.target.value)} required />\n\n      {error && <p className=\"throttle-auth-error\" role=\"alert\">{error}</p>}\n      {notice && <p className=\"throttle-auth-notice\" role=\"status\">{notice}</p>}\n\n      <button className=\"throttle-auth-submit\" type=\"submit\" disabled={submitting}>\n        {submitting ? '…' : l.submit}\n      </button>\n    </form>\n  );\n}\n","import { useEffect, useRef, useState } from 'react';\nimport { useAuth } from '../context';\nimport { useFormAction } from './useFormAction';\n\nexport interface VerifyEmailPanelProps {\n  /** Token from the emailed link. Omit to render the \"resend\" state instead. */\n  token?: string;\n  onVerified?: () => void;\n  className?: string;\n  labels?: Partial<{ verifying: string; verified: string; prompt: string; resend: string; resent: string }>;\n}\n\nexport function VerifyEmailPanel(props: VerifyEmailPanelProps) {\n  const { auth, emailVerified } = useAuth();\n  const { submitting, error, notice, run } = useFormAction();\n  const attempted = useRef<string | null>(null);\n  const [verifiedLocally, setVerifiedLocally] = useState(false);\n  const l = {\n    verifying: 'Verifying your email…',\n    verified: 'Your email address is verified.',\n    prompt: 'Please verify your email address to unlock your full account.',\n    resend: 'Resend verification email',\n    resent: 'Sent. Check your inbox.',\n    ...props.labels,\n  };\n\n  useEffect(() => {\n    if (!props.token || attempted.current === props.token) return;\n    // Once per token. Re-running would burn the single-use token and report\n    // `token_already_used` to a buyer who did nothing wrong.\n    //\n    // useFormAction's `inFlight` flag happens to block the StrictMode\n    // double-invoke too, but that is a submit-debounce concern that belongs to\n    // form actions generally. Burning a single-use token is this panel's own\n    // invariant, and it should not depend on another layer's debounce\n    // semantics staying exactly as they are today.\n    attempted.current = props.token;\n    void run(async () => {\n      await auth.verifyEmail(props.token!);\n      setVerifiedLocally(true);\n      props.onVerified?.();\n    });\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [props.token]);\n\n  return (\n    <div data-testid=\"throttle-auth-verify\" className={props.className ?? 'throttle-auth-panel'}>\n      {props.token && submitting && <p className=\"throttle-auth-notice\" role=\"status\">{l.verifying}</p>}\n      {(emailVerified || verifiedLocally) && (\n        <p className=\"throttle-auth-notice\" role=\"status\">{l.verified}</p>\n      )}\n      {!emailVerified && !props.token && <p className=\"throttle-auth-prompt\">{l.prompt}</p>}\n\n      {error && <p className=\"throttle-auth-error\" role=\"alert\">{error}</p>}\n      {notice && <p className=\"throttle-auth-notice\" role=\"status\">{notice}</p>}\n\n      {!emailVerified && !props.token && (\n        <button\n          className=\"throttle-auth-submit\" type=\"button\" disabled={submitting}\n          onClick={() => void run(async () => { await auth.resendVerification(); return l.resent; })}\n        >\n          {l.resend}\n        </button>\n      )}\n    </div>\n  );\n}\n"],"mappings":";;;;;;AAAA,SAAS,OAAO,YAAAA,iBAAgB;;;ACAhC,SAAS,aAAa,QAAQ,gBAAgB;;;ACE9C,SAAS,SAAS,SAA0B;AAC1C,MAAI,CAAC,WAAW,CAAC,OAAO,SAAS,OAAO,EAAG,QAAO;AAClD,MAAI,UAAU,GAAI,QAAO,eAAe,KAAK,KAAK,OAAO,CAAC;AAC1D,QAAM,UAAU,KAAK,KAAK,UAAU,EAAE;AACtC,SAAO,eAAe,OAAO,IAAI,YAAY,IAAI,WAAW,SAAS;AACvE;AAQO,SAAS,gBAAgB,KAAsB;AACpD,QAAM,IAAI;AACV,UAAQ,GAAG,MAAM;AAAA,IACf,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAEH,aAAO,EAAE,WAAW;AAAA,IACtB,KAAK;AACH,aAAO,sBAAsB,SAAS,EAAE,UAAU,CAAC;AAAA,IACrD,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAEH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;;;ADvCO,SAAS,gBAA4B;AAC1C,QAAM,CAAC,YAAY,aAAa,IAAI,SAAS,KAAK;AAClD,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,IAAI;AACtD,QAAM,CAAC,QAAQ,SAAS,IAAI,SAAwB,IAAI;AACxD,QAAM,WAAW,OAAO,KAAK;AAE7B,QAAM,MAAM,YAAY,OAAO,OAAqC;AAClE,QAAI,SAAS,QAAS;AACtB,aAAS,UAAU;AACnB,kBAAc,IAAI;AAClB,aAAS,IAAI;AACb,cAAU,IAAI;AACd,QAAI;AACF,YAAM,UAAU,MAAM,GAAG;AACzB,UAAI,OAAO,YAAY,SAAU,WAAU,OAAO;AAAA,IACpD,SAAS,KAAK;AACZ,eAAS,gBAAgB,GAAG,CAAC;AAAA,IAC/B,UAAE;AACA,eAAS,UAAU;AACnB,oBAAc,KAAK;AAAA,IACrB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SAAO,EAAE,YAAY,OAAO,QAAQ,IAAI;AAC1C;;;ADfI,SAQE,KARF;AATG,SAAS,WAAW,OAAwB;AACjD,QAAM,EAAE,KAAK,IAAI,QAAQ;AACzB,QAAM,EAAE,YAAY,OAAO,IAAI,IAAI,cAAc;AACjD,QAAM,CAAC,OAAO,QAAQ,IAAIC,UAAS,EAAE;AACrC,QAAM,CAAC,UAAU,WAAW,IAAIA,UAAS,EAAE;AAC3C,QAAM,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,UAAU,UAAU,GAAG,MAAM,CAAC,YAAY;AACzE,QAAM,IAAI,EAAE,OAAO,SAAS,UAAU,YAAY,QAAQ,WAAW,QAAQ,yBAAyB,GAAG,MAAM,OAAO;AAEtH,SACE;AAAA,IAAC;AAAA;AAAA,MACC,eAAY;AAAA,MACZ,WAAW,MAAM,aAAa;AAAA,MAC9B,UAAU,CAAC,MAAM;AACf,UAAE,eAAe;AACjB,aAAK,IAAI,YAAY;AAAE,gBAAM,KAAK,OAAO,OAAO,QAAQ;AAAG,gBAAM,YAAY;AAAA,QAAG,CAAC;AAAA,MACnF;AAAA,MAEA;AAAA,4BAAC,WAAM,WAAU,uBAAsB,SAAS,IAAI,OAAQ,YAAE,OAAM;AAAA,QACpE;AAAA,UAAC;AAAA;AAAA,YAAM,WAAU;AAAA,YAAsB,IAAI,IAAI;AAAA,YAAO,MAAK;AAAA,YAAQ,cAAa;AAAA,YACzE,OAAO;AAAA,YAAO,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,YAAG,UAAQ;AAAA;AAAA,QAAC;AAAA,QAEzE,oBAAC,WAAM,WAAU,uBAAsB,SAAS,IAAI,UAAW,YAAE,UAAS;AAAA,QAC1E;AAAA,UAAC;AAAA;AAAA,YAAM,WAAU;AAAA,YAAsB,IAAI,IAAI;AAAA,YAAU,MAAK;AAAA,YAAW,cAAa;AAAA,YAC/E,OAAO;AAAA,YAAU,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK;AAAA,YAAG,UAAQ;AAAA;AAAA,QAAC;AAAA,QAE9E,SAAS,oBAAC,OAAE,WAAU,uBAAsB,MAAK,SAAS,iBAAM;AAAA,QAEjE,oBAAC,YAAO,WAAU,wBAAuB,MAAK,UAAS,UAAU,YAC9D,uBAAa,WAAM,EAAE,QACxB;AAAA,QAEC,MAAM,oBACL,oBAAC,YAAO,WAAU,sBAAqB,MAAK,UAAS,SAAS,MAAM,kBAAmB,YAAE,QAAO;AAAA;AAAA;AAAA,EAEpG;AAEJ;;;AG/CA,SAAS,SAAAC,QAAO,YAAAC,iBAAgB;AAyB5B,SAcE,OAAAC,MAdF,QAAAC,aAAA;AAbG,SAAS,WAAW,OAAwB;AACjD,QAAM,EAAE,KAAK,IAAI,QAAQ;AACzB,QAAM,EAAE,YAAY,OAAO,QAAQ,IAAI,IAAI,cAAc;AACzD,QAAM,CAAC,OAAO,QAAQ,IAAIC,UAAS,EAAE;AACrC,QAAM,CAAC,UAAU,WAAW,IAAIA,UAAS,EAAE;AAC3C,QAAM,MAAM,EAAE,OAAO,GAAGC,OAAM,CAAC,UAAU,UAAU,GAAGA,OAAM,CAAC,YAAY;AACzE,QAAM,IAAI;AAAA,IACR,OAAO;AAAA,IAAS,UAAU;AAAA,IAAY,QAAQ;AAAA,IAC9C,SAAS;AAAA,IACT,GAAG,MAAM;AAAA,EACX;AAEA,SACE,gBAAAF;AAAA,IAAC;AAAA;AAAA,MACC,eAAY;AAAA,MACZ,WAAW,MAAM,aAAa;AAAA,MAC9B,UAAU,CAAC,MAAM;AACf,UAAE,eAAe;AACjB,aAAK,IAAI,YAAY;AACnB,gBAAM,SAAS,MAAM,KAAK,SAAS,OAAO,QAAQ;AAGlD,cAAI,OAAO,WAAW,WAAW;AAAE,kBAAM,YAAY;AAAG,mBAAO,EAAE;AAAA,UAAS;AAC1E,gBAAM,YAAY;AAAA,QACpB,CAAC;AAAA,MACH;AAAA,MAEA;AAAA,wBAAAD,KAAC,WAAM,WAAU,uBAAsB,SAAS,IAAI,OAAQ,YAAE,OAAM;AAAA,QACpE,gBAAAA;AAAA,UAAC;AAAA;AAAA,YAAM,WAAU;AAAA,YAAsB,IAAI,IAAI;AAAA,YAAO,MAAK;AAAA,YAAQ,cAAa;AAAA,YACzE,OAAO;AAAA,YAAO,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,YAAG,UAAQ;AAAA;AAAA,QAAC;AAAA,QAEzE,gBAAAA,KAAC,WAAM,WAAU,uBAAsB,SAAS,IAAI,UAAW,YAAE,UAAS;AAAA,QAC1E,gBAAAA;AAAA,UAAC;AAAA;AAAA,YAAM,WAAU;AAAA,YAAsB,IAAI,IAAI;AAAA,YAAU,MAAK;AAAA,YAAW,cAAa;AAAA,YAC/E,OAAO;AAAA,YAAU,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK;AAAA,YAAG,UAAQ;AAAA;AAAA,QAAC;AAAA,QAE9E,SAAS,gBAAAA,KAAC,OAAE,WAAU,uBAAsB,MAAK,SAAS,iBAAM;AAAA,QAChE,UAAU,gBAAAA,KAAC,OAAE,WAAU,wBAAuB,MAAK,UAAU,kBAAO;AAAA,QAErE,gBAAAA,KAAC,YAAO,WAAU,wBAAuB,MAAK,UAAS,UAAU,YAC9D,uBAAa,WAAM,EAAE,QACxB;AAAA;AAAA;AAAA,EACF;AAEJ;;;ACvDA,SAAS,SAAAI,QAAO,YAAAC,iBAAgB;AAwB5B,SAQE,OAAAC,MARF,QAAAC,aAAA;AAdG,SAAS,mBAAmB,OAAgC;AACjE,QAAM,EAAE,KAAK,IAAI,QAAQ;AACzB,QAAM,EAAE,YAAY,OAAO,QAAQ,IAAI,IAAI,cAAc;AACzD,QAAM,CAAC,OAAO,QAAQ,IAAIC,UAAS,EAAE;AACrC,QAAM,KAAK,GAAGC,OAAM,CAAC;AACrB,QAAM,IAAI;AAAA,IACR,OAAO;AAAA,IAAS,QAAQ;AAAA;AAAA;AAAA,IAGxB,MAAM;AAAA,IACN,GAAG,MAAM;AAAA,EACX;AAEA,SACE,gBAAAF;AAAA,IAAC;AAAA;AAAA,MACC,eAAY;AAAA,MACZ,WAAW,MAAM,aAAa;AAAA,MAC9B,UAAU,CAAC,MAAM;AACf,UAAE,eAAe;AACjB,aAAK,IAAI,YAAY;AAAE,gBAAM,KAAK,eAAe,KAAK;AAAG,gBAAM,SAAS;AAAG,iBAAO,EAAE;AAAA,QAAM,CAAC;AAAA,MAC7F;AAAA,MAEA;AAAA,wBAAAD,KAAC,WAAM,WAAU,uBAAsB,SAAS,IAAK,YAAE,OAAM;AAAA,QAC7D,gBAAAA;AAAA,UAAC;AAAA;AAAA,YAAM,WAAU;AAAA,YAAsB;AAAA,YAAQ,MAAK;AAAA,YAAQ,cAAa;AAAA,YAClE,OAAO;AAAA,YAAO,UAAU,CAAC,MAAM,SAAS,EAAE,OAAO,KAAK;AAAA,YAAG,UAAQ;AAAA;AAAA,QAAC;AAAA,QAExE,SAAS,gBAAAA,KAAC,OAAE,WAAU,uBAAsB,MAAK,SAAS,iBAAM;AAAA,QAChE,UAAU,gBAAAA,KAAC,OAAE,WAAU,wBAAuB,MAAK,UAAU,kBAAO;AAAA,QAErE,gBAAAA,KAAC,YAAO,WAAU,wBAAuB,MAAK,UAAS,UAAU,YAC9D,uBAAa,WAAM,EAAE,QACxB;AAAA;AAAA;AAAA,EACF;AAEJ;;;AC5CA,SAAS,SAAAI,QAAO,YAAAC,iBAAgB;AAwB5B,SAcE,OAAAC,MAdF,QAAAC,aAAA;AAZG,SAAS,kBAAkB,OAA+B;AAC/D,QAAM,EAAE,KAAK,IAAI,QAAQ;AACzB,QAAM,EAAE,YAAY,OAAO,QAAQ,IAAI,IAAI,cAAc;AACzD,QAAM,CAAC,UAAU,WAAW,IAAIC,UAAS,EAAE;AAC3C,QAAM,KAAK,GAAGC,OAAM,CAAC;AACrB,QAAM,IAAI;AAAA,IACR,UAAU;AAAA,IAAgB,QAAQ;AAAA,IAClC,MAAM;AAAA,IACN,GAAG,MAAM;AAAA,EACX;AAEA,SACE,gBAAAF;AAAA,IAAC;AAAA;AAAA,MACC,eAAY;AAAA,MACZ,WAAW,MAAM,aAAa;AAAA,MAC9B,UAAU,CAAC,MAAM;AACf,UAAE,eAAe;AACjB,aAAK,IAAI,YAAY;AACnB,gBAAM,KAAK,cAAc,MAAM,OAAO,QAAQ;AAC9C,gBAAM,YAAY;AAGlB,iBAAO,EAAE;AAAA,QACX,CAAC;AAAA,MACH;AAAA,MAEA;AAAA,wBAAAD,KAAC,WAAM,WAAU,uBAAsB,SAAS,IAAK,YAAE,UAAS;AAAA,QAChE,gBAAAA;AAAA,UAAC;AAAA;AAAA,YAAM,WAAU;AAAA,YAAsB;AAAA,YAAQ,MAAK;AAAA,YAAW,cAAa;AAAA,YACrE,OAAO;AAAA,YAAU,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK;AAAA,YAAG,UAAQ;AAAA;AAAA,QAAC;AAAA,QAE9E,SAAS,gBAAAA,KAAC,OAAE,WAAU,uBAAsB,MAAK,SAAS,iBAAM;AAAA,QAChE,UAAU,gBAAAA,KAAC,OAAE,WAAU,wBAAuB,MAAK,UAAU,kBAAO;AAAA,QAErE,gBAAAA,KAAC,YAAO,WAAU,wBAAuB,MAAK,UAAS,UAAU,YAC9D,uBAAa,WAAM,EAAE,QACxB;AAAA;AAAA;AAAA,EACF;AAEJ;;;AClDA,SAAS,WAAW,UAAAI,SAAQ,YAAAC,iBAAgB;AA8CxC,SACgC,OAAAC,MADhC,QAAAC,aAAA;AAlCG,SAAS,iBAAiB,OAA8B;AAC7D,QAAM,EAAE,MAAM,cAAc,IAAI,QAAQ;AACxC,QAAM,EAAE,YAAY,OAAO,QAAQ,IAAI,IAAI,cAAc;AACzD,QAAM,YAAYC,QAAsB,IAAI;AAC5C,QAAM,CAAC,iBAAiB,kBAAkB,IAAIC,UAAS,KAAK;AAC5D,QAAM,IAAI;AAAA,IACR,WAAW;AAAA,IACX,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,GAAG,MAAM;AAAA,EACX;AAEA,YAAU,MAAM;AACd,QAAI,CAAC,MAAM,SAAS,UAAU,YAAY,MAAM,MAAO;AASvD,cAAU,UAAU,MAAM;AAC1B,SAAK,IAAI,YAAY;AACnB,YAAM,KAAK,YAAY,MAAM,KAAM;AACnC,yBAAmB,IAAI;AACvB,YAAM,aAAa;AAAA,IACrB,CAAC;AAAA,EAEH,GAAG,CAAC,MAAM,KAAK,CAAC;AAEhB,SACE,gBAAAF,MAAC,SAAI,eAAY,wBAAuB,WAAW,MAAM,aAAa,uBACnE;AAAA,UAAM,SAAS,cAAc,gBAAAD,KAAC,OAAE,WAAU,wBAAuB,MAAK,UAAU,YAAE,WAAU;AAAA,KAC3F,iBAAiB,oBACjB,gBAAAA,KAAC,OAAE,WAAU,wBAAuB,MAAK,UAAU,YAAE,UAAS;AAAA,IAE/D,CAAC,iBAAiB,CAAC,MAAM,SAAS,gBAAAA,KAAC,OAAE,WAAU,wBAAwB,YAAE,QAAO;AAAA,IAEhF,SAAS,gBAAAA,KAAC,OAAE,WAAU,uBAAsB,MAAK,SAAS,iBAAM;AAAA,IAChE,UAAU,gBAAAA,KAAC,OAAE,WAAU,wBAAuB,MAAK,UAAU,kBAAO;AAAA,IAEpE,CAAC,iBAAiB,CAAC,MAAM,SACxB,gBAAAA;AAAA,MAAC;AAAA;AAAA,QACC,WAAU;AAAA,QAAuB,MAAK;AAAA,QAAS,UAAU;AAAA,QACzD,SAAS,MAAM,KAAK,IAAI,YAAY;AAAE,gBAAM,KAAK,mBAAmB;AAAG,iBAAO,EAAE;AAAA,QAAQ,CAAC;AAAA,QAExF,YAAE;AAAA;AAAA,IACL;AAAA,KAEJ;AAEJ;","names":["useState","useState","useId","useState","jsx","jsxs","useState","useId","useId","useState","jsx","jsxs","useState","useId","useId","useState","jsx","jsxs","useState","useId","useRef","useState","jsx","jsxs","useRef","useState"]}

package/dist/react/index.cjs

@@ -360,7 +360,10 @@ function createThrottleAuth(config) {
     },
     async changePassword(password) {
       await call("POST", "/me/change-password", { password });
-      await refresh();
+      try {
+        await refresh();
+      } catch {
+      }
     },
     async listSessions() {
       return call("GET", "/me/sessions");
@@ -418,7 +421,7 @@ function ThrottleAuthProvider(props) {
   const value = (0, import_react.useMemo)(() => {
     const auth = injected ?? createThrottleAuth({ publishableKey, baseUrl, storage, onStepUpRequired });
     return { auth, account: createAccount(auth) };
-  }, [injected, publishableKey, baseUrl, storage]);
+  }, [injected, publishableKey, baseUrl]);
   const restored = (0, import_react.useRef)(null);
   (0, import_react.useEffect)(() => {
     if (restored.current === value.auth) return;

package/dist/react/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/react/index.tsx","../../src/react/context.tsx","../../src/errors.ts","../../src/request.ts","../../src/session.ts","../../src/storage.ts","../../src/client.ts","../../src/account.ts","../../src/react/hooks.ts"],"sourcesContent":["export { ThrottleAuthProvider, useAuth, useAuthContext } from './context';\nexport type { ThrottleAuthProviderProps, UseAuthResult } from './context';\nexport { useCustomer, useAddresses, useSavedCards, useOrders, useInvoices, useSubscriptions } from './hooks';\nexport type { Resource } from './hooks';\nexport * from '../index';\n","import { createContext, useContext, useEffect, useMemo, useRef, useSyncExternalStore } from 'react';\nimport type { ReactNode } from 'react';\nimport { createThrottleAuth, type ThrottleAuth } from '../client';\nimport { createAccount, type ThrottleAccount } from '../account';\nimport type { AuthSnapshot } from '../session';\nimport type { ThrottleAuthConfig } from '../types';\n\nexport interface ThrottleAuthProviderProps extends Partial<ThrottleAuthConfig> {\n  publishableKey: string;\n  /** Inject a pre-built client. Tests use it; merchants sharing one client across roots may too. */\n  auth?: ThrottleAuth;\n  children: ReactNode;\n}\n\ninterface ContextValue { auth: ThrottleAuth; account: ThrottleAccount }\n\nconst Ctx = createContext<ContextValue | null>(null);\n\nexport function ThrottleAuthProvider(props: ThrottleAuthProviderProps) {\n  const { auth: injected, publishableKey, baseUrl, storage, onStepUpRequired, children } = props;\n\n  const value = useMemo<ContextValue>(() => {\n    const auth = injected ?? createThrottleAuth({ publishableKey, baseUrl, storage, onStepUpRequired });\n    return { auth, account: createAccount(auth) };\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [injected, publishableKey, baseUrl, storage]);\n\n  const restored = useRef<ThrottleAuth | null>(null);\n  useEffect(() => {\n    // Once per client. StrictMode runs effects twice in development, and a\n    // second restore() would present the refresh token that the first one\n    // just rotated away.\n    if (restored.current === value.auth) return;\n    restored.current = value.auth;\n    void value.auth.restore();\n  }, [value]);\n\n  return <Ctx.Provider value={value}>{children}</Ctx.Provider>;\n}\n\nfunction useCtx(): ContextValue {\n  const ctx = useContext(Ctx);\n  if (!ctx) throw new Error('useAuth must be used inside a <ThrottleAuthProvider>');\n  return ctx;\n}\n\nexport function useAuthContext(): ContextValue { return useCtx(); }\n\nexport type UseAuthResult = AuthSnapshot & {\n  isLoading: boolean;\n  isAuthenticated: boolean;\n  auth: ThrottleAuth;\n  account: ThrottleAccount;\n};\n\nexport function useAuth(): UseAuthResult {\n  const { auth, account } = useCtx();\n  const snapshot = useSyncExternalStore(auth.subscribe, auth.getSnapshot, auth.getSnapshot);\n  return {\n    ...snapshot,\n    isLoading: snapshot.status === 'loading',\n    isAuthenticated: snapshot.status === 'authenticated',\n    auth,\n    account,\n  };\n}\n","export class ThrottleAuthError extends Error {\n  readonly code: string;\n  readonly statusCode: number;\n  readonly retryAfter?: number;\n  readonly details?: unknown;\n\n  constructor(args: { code: string; message: string; statusCode: number; retryAfter?: number; details?: unknown }) {\n    super(args.message);\n    this.name = 'ThrottleAuthError';\n    this.code = args.code;\n    this.statusCode = args.statusCode;\n    this.retryAfter = args.retryAfter;\n    this.details = args.details;\n  }\n}\n","import { ThrottleAuthError } from './errors';\n\nexport interface RequestInput {\n  method: string;\n  path: string;\n  baseUrl: string;\n  publishableKey: string;\n  accessToken?: string;\n  stepUpToken?: string;\n  body?: unknown;\n}\n\n/** Returns the UNWRAPPED `data` from the `{ data: … }` envelope. Throws ThrottleAuthError otherwise. */\nexport async function request(input: RequestInput): Promise<any> {\n  const headers: Record<string, string> = { 'X-API-Key': input.publishableKey };\n  if (input.body !== undefined) headers['Content-Type'] = 'application/json';\n  if (input.accessToken) headers.Authorization = `Bearer ${input.accessToken}`;\n  if (input.stepUpToken) headers['X-Step-Up'] = input.stepUpToken;\n\n  const res = await fetch(`${input.baseUrl}/v1/storefront${input.path}`, {\n    method: input.method,\n    headers,\n    ...(input.body !== undefined ? { body: JSON.stringify(input.body) } : {}),\n  });\n\n  const text = await res.text();\n  let parsed: any = {};\n  try {\n    parsed = text ? JSON.parse(text) : {};\n  } catch {\n    // Non-JSON body — an HTML gateway page, say. Leave parsed empty so the\n    // branch below still throws a typed error rather than a raw SyntaxError.\n  }\n\n  if (!res.ok) {\n    const e = parsed?.error ?? {};\n    // `Retry-After` is server-controlled but not trusted: Number('soon') is\n    // NaN, and a NaN reaches the UI as \"wait NaN seconds\".\n    const ra = Number(res.headers.get('retry-after'));\n    throw new ThrottleAuthError({\n      code: e.code ?? 'request_failed',\n      message: e.message ?? `Request failed with ${res.status}`,\n      statusCode: res.status,\n      retryAfter: Number.isFinite(ra) && ra >= 0 ? ra : undefined,\n      details: e.details,\n    });\n  }\n\n  // `'data' in parsed`, not `parsed?.data ?? parsed`: a legitimate\n  // `{ \"data\": null }` is nullish, and `??` would fall through and hand the\n  // caller the whole envelope instead of the null the API actually sent.\n  return parsed && typeof parsed === 'object' && 'data' in parsed ? parsed.data : (parsed ?? {});\n}\n","import type { Customer, Session } from './types';\n\nexport type AuthStatus = 'loading' | 'authenticated' | 'unauthenticated';\n\nexport interface AuthSnapshot {\n  status: AuthStatus;\n  customer: Customer | null;\n  /**\n   * False here does NOT only mean \"we emailed them and they have not clicked\".\n   * While it is false the API may also be withholding pre-existing account\n   * data behind the claim cutoff — empty order lists and a 403 on `PATCH /me`\n   * are expected, not broken. See the plan header.\n   */\n  emailVerified: boolean;\n}\n\ntype Listener = (snapshot: AuthSnapshot) => void;\n\nexport class SessionState {\n  #snapshot: AuthSnapshot = { status: 'loading', customer: null, emailVerified: false };\n  #accessToken: string | null = null;\n  #expiresAt: number | null = null;\n  #listeners = new Set<Listener>();\n\n  get(): AuthSnapshot { return this.#snapshot; }\n  accessToken(): string | null { return this.#accessToken; }\n  expiresAt(): number | null { return this.#expiresAt; }\n\n  setSession(session: Session): void {\n    this.#accessToken = session.accessToken;\n    this.#expiresAt = Date.parse(session.expiresAt);\n    this.#publish({\n      status: 'authenticated',\n      customer: session.customer,\n      emailVerified: Boolean(session.customer?.emailVerified),\n    });\n  }\n\n  setStatus(status: AuthStatus): void {\n    this.#publish({ ...this.#snapshot, status });\n  }\n\n  clear(): void {\n    this.#accessToken = null;\n    this.#expiresAt = null;\n    this.#publish({ status: 'unauthenticated', customer: null, emailVerified: false });\n  }\n\n  subscribe(fn: Listener): () => void {\n    this.#listeners.add(fn);\n    return () => { this.#listeners.delete(fn); };\n  }\n\n  #publish(next: AuthSnapshot): void {\n    // Identity matters: React's useSyncExternalStore re-renders on reference\n    // change, and a token refresh every ten minutes must not re-render the\n    // whole account area when nothing visible changed.\n    const same =\n      next.status === this.#snapshot.status &&\n      next.emailVerified === this.#snapshot.emailVerified &&\n      customerEquals(next.customer, this.#snapshot.customer);\n    if (same) return;\n    this.#snapshot = next;\n    for (const fn of [...this.#listeners]) {\n      // A merchant's subscriber throwing must not stop the rest from hearing.\n      try { fn(next); } catch { /* merchant callback */ }\n    }\n  }\n}\n\nfunction customerEquals(a: Customer | null, b: Customer | null): boolean {\n  if (a === b) return true;\n  if (!a || !b) return false;\n  const keys = new Set([...Object.keys(a), ...Object.keys(b)]) as Set<keyof Customer>;\n  for (const k of keys) if (a[k] !== b[k]) return false;\n  return true;\n}\n","import type { AuthStorage } from './types';\n\nexport type { AuthStorage };\n\nexport function memoryStorage(): AuthStorage {\n  const map = new Map<string, string>();\n  return {\n    get: (k) => map.get(k) ?? null,\n    set: (k, v) => void map.set(k, v),\n    remove: (k) => void map.delete(k),\n  };\n}\n\n/**\n * localStorage when it works, memory when it does not. Safari private mode,\n * hardened browser settings and server-side rendering all make localStorage\n * either absent or throwing; none of them may take the storefront down.\n */\nexport function localStorageAdapter(): AuthStorage {\n  const fallback = memoryStorage();\n  const ls = (): Storage | null => {\n    try {\n      return typeof localStorage !== 'undefined' ? localStorage : null;\n    } catch {\n      return null;\n    }\n  };\n  return {\n    get(k) {\n      try {\n        const v = ls()?.getItem(k);\n        if (v != null) return v;\n      } catch { /* fall through */ }\n      return fallback.get(k);\n    },\n    set(k, v) {\n      fallback.set(k, v);\n      try { ls()?.setItem(k, v); } catch { /* memory-only this session */ }\n    },\n    remove(k) {\n      fallback.remove(k);\n      try { ls()?.removeItem(k); } catch { /* already gone */ }\n    },\n  };\n}\n","import { request } from './request';\nimport { ThrottleAuthError } from './errors';\nimport { SessionState, type AuthSnapshot } from './session';\nimport { localStorageAdapter, type AuthStorage } from './storage';\nimport type { Customer, Session, ThrottleAuthConfig } from './types';\n\nconst DEFAULT_BASE_URL = 'https://api.usethrottle.dev';\n/** Refresh this far before expiry so ordinary calls rarely see a 401 at all. */\nconst REFRESH_SKEW_MS = 30_000;\n\nexport interface DeviceSession {\n  id: string;\n  userAgent: string | null;\n  ipPrefix: string | null;\n  createdAt: string;\n  lastUsedAt: string;\n  current: boolean;\n}\n\nexport interface ThrottleAuth {\n  register(email: string, password: string): Promise<{ status: 'active' | 'pending' }>;\n  signIn(email: string, password: string): Promise<void>;\n  signOut(): Promise<void>;\n  signOutEverywhere(): Promise<void>;\n  restore(): Promise<void>;\n  getSnapshot(): AuthSnapshot;\n  subscribe(fn: (s: AuthSnapshot) => void): () => void;\n  stepUp(password: string): Promise<void>;\n  call<T = any>(method: string, path: string, body?: unknown): Promise<T>;\n  verifyEmail(token: string): Promise<void>;\n  resendVerification(): Promise<void>;\n  forgotPassword(email: string): Promise<void>;\n  resetPassword(token: string, password: string): Promise<void>;\n  changePassword(password: string): Promise<void>;\n  listSessions(): Promise<DeviceSession[]>;\n  revokeSession(id: string): Promise<void>;\n}\n\nexport function createThrottleAuth(config: ThrottleAuthConfig): ThrottleAuth {\n  const baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/$/, '');\n  const storage: AuthStorage = config.storage ?? localStorageAdapter();\n  // Namespaced by key so two Throttle applications on one origin cannot read\n  // each other's refresh token out of shared localStorage.\n  const storageKey = `throttle_auth_rt:${config.publishableKey}`;\n  const lockName = `throttle_auth_refresh:${config.publishableKey}`;\n\n  const state = new SessionState();\n  let refreshInFlight: Promise<void> | null = null;\n  let stepUpToken: string | null = null;\n  let stepUpExpiresAt = 0;\n\n  const base = { baseUrl, publishableKey: config.publishableKey };\n\n  async function persist(session: Session): Promise<void> {\n    state.setSession(session);\n    await storage.set(storageKey, session.refreshToken);\n  }\n\n  async function forget(): Promise<void> {\n    stepUpToken = null;\n    state.clear();\n    await storage.remove(storageKey);\n  }\n\n  /**\n   * Cross-tab single flight. Two tabs refreshing at once would each present the\n   * same stored token; the second is a replay, and the server kills the family.\n   * Web Locks serialises them; where it is unavailable the in-process guard\n   * below still covers the common single-tab case.\n   */\n  function withLock<T>(fn: () => Promise<T>): Promise<T> {\n    const locks = (globalThis as any).navigator?.locks;\n    return locks?.request ? locks.request(lockName, fn) : fn();\n  }\n\n  async function doRefresh(): Promise<void> {\n    await withLock(async () => {\n      // Re-read INSIDE the lock: another tab may have rotated while we waited,\n      // and presenting the token we read before the lock would be a replay.\n      const refreshToken = await storage.get(storageKey);\n      if (!refreshToken) {\n        await forget();\n        throw new ThrottleAuthError({ code: 'session_revoked', message: 'No session', statusCode: 401 });\n      }\n      try {\n        const data = await request({ ...base, method: 'POST', path: '/auth/refresh', body: { refreshToken } });\n        await persist(data as Session);\n      } catch (err) {\n        // Any refusal of a refresh token is terminal — there is nothing left to\n        // retry with. Drop it rather than letting a dead token sit in storage.\n        await forget();\n        throw err;\n      }\n    });\n  }\n\n  function refresh(): Promise<void> {\n    if (!refreshInFlight) {\n      refreshInFlight = doRefresh().finally(() => { refreshInFlight = null; });\n    }\n    return refreshInFlight;\n  }\n\n  async function accessToken(): Promise<string | null> {\n    const expires = state.expiresAt();\n    if (state.accessToken() && expires && expires - Date.now() > REFRESH_SKEW_MS) {\n      return state.accessToken();\n    }\n    if (await storage.get(storageKey)) {\n      await refresh();\n      return state.accessToken();\n    }\n    return state.accessToken();\n  }\n\n  async function ensureStepUp(): Promise<boolean> {\n    if (stepUpToken && stepUpExpiresAt > Date.now()) return true;\n    if (!config.onStepUpRequired) return false;\n    const password = await config.onStepUpRequired();\n    if (!password) return false;\n    await stepUp(password);\n    return true;\n  }\n\n  async function stepUp(password: string): Promise<void> {\n    const data = await request({\n      ...base, method: 'POST', path: '/auth/step-up',\n      accessToken: await accessToken() ?? undefined, body: { password },\n    });\n    stepUpToken = data.stepUpToken;\n    stepUpExpiresAt = Date.now() + (Number(data.expiresIn) || 300) * 1000 - 5_000;\n  }\n\n  async function call<T = any>(method: string, path: string, body?: unknown): Promise<T> {\n    let retriedAuth = false;\n    let retriedStepUp = false;\n\n    for (;;) {\n      const token = await accessToken();\n      try {\n        return await request({\n          ...base, method, path, body,\n          accessToken: token ?? undefined,\n          stepUpToken: stepUpToken ?? undefined,\n        });\n      } catch (err) {\n        const e = err as ThrottleAuthError;\n        // `session_revoked` belongs here too. The server returns it for a\n        // stale session EPOCH as well as for a genuinely dead session, and a\n        // changed password bumps the epoch while deliberately sparing the\n        // current session — so one refresh recovers it. When the session\n        // really is dead the refresh fails and forget() runs, which is the\n        // same outcome, one request later.\n        const expired = e.statusCode === 401 &&\n          (e.code === 'unauthorized' || e.code === 'token_expired' || e.code === 'session_revoked');\n        if (expired && !retriedAuth) {\n          retriedAuth = true;\n          await refresh();   // shared — ten callers here produce ONE request\n          continue;\n        }\n        if (e.code === 'step_up_required' && !retriedStepUp) {\n          retriedStepUp = true;\n          stepUpToken = null;\n          if (await ensureStepUp()) continue;\n        }\n        throw err;\n      }\n    }\n  }\n\n  return {\n    async register(email, password) {\n      const data = await request({ ...base, method: 'POST', path: '/auth/register', body: { email, password } });\n      if (data?.status === 'pending') return { status: 'pending' };\n      await persist(data as Session);\n      return { status: 'active' };\n    },\n\n    async signIn(email, password) {\n      const data = await request({ ...base, method: 'POST', path: '/auth/login', body: { email, password } });\n      await persist(data as Session);\n    },\n\n    async signOut() {\n      try { await call('POST', '/auth/logout'); } catch { /* local state still goes */ }\n      await forget();\n    },\n\n    async signOutEverywhere() {\n      try { await call('POST', '/auth/logout-all'); } catch { /* local state still goes */ }\n      await forget();\n    },\n\n    async restore() {\n      if (!(await storage.get(storageKey))) { state.setStatus('unauthenticated'); return; }\n      try { await refresh(); } catch { /* forget() already ran */ }\n    },\n\n    getSnapshot: () => state.get(),\n    subscribe: (fn) => state.subscribe(fn),\n    stepUp,\n    call,\n\n    async verifyEmail(token) {\n      await request({ ...base, method: 'POST', path: '/auth/verify-email', body: { token } });\n      // `ver` is a claim baked into the access token, and the claim cutoff is\n      // read from the session row. Without a new token the buyer stays gated —\n      // and their own order history stays hidden — for the rest of this\n      // token's ten minutes.\n      if (await storage.get(storageKey)) {\n        try { await refresh(); } catch { /* verification still succeeded */ }\n      }\n    },\n\n    async resendVerification() {\n      await call('POST', '/auth/verify-email/resend');\n    },\n\n    async forgotPassword(email) {\n      // Always 202, whether or not the address has an account. Do not infer\n      // anything from it and do not tell the buyer whether it existed.\n      await request({ ...base, method: 'POST', path: '/auth/forgot-password', body: { email } });\n    },\n\n    async resetPassword(token, password) {\n      await request({ ...base, method: 'POST', path: '/auth/reset-password', body: { token, password } });\n      // The server revokes every session on reset, this one included.\n      await forget();\n    },\n\n    async changePassword(password) {\n      await call('POST', '/me/change-password', { password });\n      // The change bumps the session epoch. This session was deliberately\n      // spared, but the access token in hand now carries a stale epoch and the\n      // next write would 401. Rotate now rather than on the buyer's next click.\n      await refresh();\n    },\n\n    async listSessions() {\n      return call<DeviceSession[]>('GET', '/me/sessions');\n    },\n\n    async revokeSession(id) {\n      const mine = await call<DeviceSession[]>('GET', '/me/sessions');\n      const current = mine.find((s) => s.current);\n      await call('DELETE', `/me/sessions/${encodeURIComponent(id)}`);\n      if (current?.id === id) await forget();\n    },\n  };\n}\n\nexport type { AuthSnapshot, Customer, Session, ThrottleAuthConfig };\n","import type { ThrottleAuth } from './client';\nimport type {\n  Address, AddressInput, Customer, Invoice, Order,\n  PaymentMethod, ProfilePatch, Subscription,\n} from './types';\n\nexport interface Page { cursor?: string; limit?: number }\n\nexport interface ThrottleAccount {\n  getProfile(): Promise<Customer>;\n  updateProfile(patch: ProfilePatch): Promise<Customer>;\n  listAddresses(): Promise<Address[]>;\n  createAddress(input: AddressInput): Promise<Address>;\n  updateAddress(id: string, patch: Partial<AddressInput>): Promise<Address>;\n  deleteAddress(id: string): Promise<void>;\n  listPaymentMethods(): Promise<PaymentMethod[]>;\n  setDefaultPaymentMethod(id: string): Promise<PaymentMethod>;\n  deletePaymentMethod(id: string): Promise<void>;\n  listOrders(page?: Page): Promise<Order[]>;\n  getOrder(id: string): Promise<Order>;\n  listInvoices(page?: Page): Promise<Invoice[]>;\n  getInvoice(id: string): Promise<Invoice>;\n  listSubscriptions(page?: Page): Promise<Subscription[]>;\n  getSubscription(id: string): Promise<Subscription>;\n  cancelSubscription(id: string, opts?: { atPeriodEnd?: boolean }): Promise<Subscription>;\n  pauseSubscription(id: string): Promise<Subscription>;\n  resumeSubscription(id: string): Promise<Subscription>;\n  claimCart(cartId: string): Promise<{ cartId: string; customerId: string }>;\n}\n\nconst seg = (v: string) => encodeURIComponent(v);\n\nfunction query(page?: Page): string {\n  const params = new URLSearchParams();\n  if (page?.cursor) params.set('cursor', page.cursor);\n  if (page?.limit != null) params.set('limit', String(page.limit));\n  const s = params.toString();\n  return s ? `?${s}` : '';\n}\n\nexport function createAccount(auth: ThrottleAuth): ThrottleAccount {\n  const { call } = auth;\n  return {\n    getProfile: () => call('GET', '/me'),\n    updateProfile: (patch) => call('PATCH', '/me', patch),\n\n    listAddresses: () => call('GET', '/me/addresses'),\n    createAddress: (input) => call('POST', '/me/addresses', input),\n    updateAddress: (id, patch) => call('PATCH', `/me/addresses/${seg(id)}`, patch),\n    deleteAddress: (id) => call('DELETE', `/me/addresses/${seg(id)}`),\n\n    listPaymentMethods: () => call('GET', '/me/payment-methods'),\n    // The platform has no \"change this subscription's card\" capability, so\n    // this is how a buyer changes what they are billed on: move the default.\n    setDefaultPaymentMethod: (id) => call('PATCH', `/me/payment-methods/${seg(id)}`, { isDefault: true }),\n    deletePaymentMethod: (id) => call('DELETE', `/me/payment-methods/${seg(id)}`),\n\n    listOrders: (page) => call('GET', `/me/orders${query(page)}`),\n    getOrder: (id) => call('GET', `/me/orders/${seg(id)}`),\n    listInvoices: (page) => call('GET', `/me/invoices${query(page)}`),\n    getInvoice: (id) => call('GET', `/me/invoices/${seg(id)}`),\n    listSubscriptions: (page) => call('GET', `/me/subscriptions${query(page)}`),\n    getSubscription: (id) => call('GET', `/me/subscriptions/${seg(id)}`),\n\n    cancelSubscription: (id, opts) => call('POST', `/me/subscriptions/${seg(id)}/cancel`, opts),\n    pauseSubscription: (id) => call('POST', `/me/subscriptions/${seg(id)}/pause`),\n    resumeSubscription: (id) => call('POST', `/me/subscriptions/${seg(id)}/resume`),\n\n    claimCart: (cartId) => call('POST', `/me/carts/${seg(cartId)}/claim`),\n  };\n}\n","import { useCallback, useEffect, useRef, useState } from 'react';\nimport { ThrottleAuthError } from '../errors';\nimport type { Address, AddressInput, Customer, Invoice, Order, PaymentMethod, ProfilePatch, Subscription } from '../types';\nimport type { Page } from '../account';\nimport { useAuth } from './context';\n\nexport interface Resource<T> {\n  data: T;\n  isLoading: boolean;\n  error: ThrottleAuthError | null;\n  refetch(): Promise<void>;\n}\n\nfunction asError(err: unknown): ThrottleAuthError {\n  if (err instanceof ThrottleAuthError) return err;\n  const anyErr = err as any;\n  return new ThrottleAuthError({\n    code: anyErr?.code ?? 'request_failed',\n    message: anyErr?.message ?? String(err),\n    statusCode: anyErr?.statusCode ?? 0,\n  });\n}\n\n/**\n * One fetch-on-auth-change primitive behind every resource hook. `emailVerified`\n * is a dependency on purpose: verifying lifts the claim cutoff, and lists that\n * were legitimately empty a moment ago are not empty any more.\n */\nfunction useResource<T>(empty: T, load: () => Promise<T>, deps: unknown[]): Resource<T> {\n  const { status, emailVerified } = useAuth();\n  const [data, setData] = useState<T>(empty);\n  const [isLoading, setIsLoading] = useState(status === 'loading');\n  const [error, setError] = useState<ThrottleAuthError | null>(null);\n  const gen = useRef(0);\n  const alive = useRef(true);\n\n  useEffect(() => {\n    // Set on mount, not only cleared on unmount: React StrictMode mounts,\n    // unmounts and remounts in development, and a ref that is only ever set\n    // to false would silently discard every response for the rest of the\n    // component's life.\n    alive.current = true;\n    return () => { alive.current = false; gen.current++; };\n  }, []);\n\n  const refetch = useCallback(async () => {\n    const mine = ++gen.current;\n    setIsLoading(true);\n    try {\n      const next = await load();\n      if (!alive.current || gen.current !== mine) return;\n      setData(next);\n      setError(null);\n    } catch (err) {\n      if (!alive.current || gen.current !== mine) return;\n      setError(asError(err));\n    } finally {\n      if (alive.current && gen.current === mine) setIsLoading(false);\n    }\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, deps);\n\n  useEffect(() => {\n    if (status !== 'authenticated') {\n      gen.current++;               // abandon anything in flight\n      setData(empty);\n      setError(null);\n      setIsLoading(status === 'loading');\n      return;\n    }\n    void refetch();\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [status, emailVerified, refetch]);\n\n  return { data, isLoading, error, refetch };\n}\n\nexport function useCustomer(): Resource<Customer | null> & { update(patch: ProfilePatch): Promise<void> } {\n  const { account } = useAuth();\n  const res = useResource<Customer | null>(null, () => account.getProfile(), [account]);\n  const update = useCallback(async (patch: ProfilePatch) => {\n    await account.updateProfile(patch);\n    await res.refetch();\n  }, [account, res]);\n  return { ...res, update };\n}\n\nexport function useAddresses(): Resource<Address[]> & {\n  create(input: AddressInput): Promise<void>;\n  update(id: string, patch: Partial<AddressInput>): Promise<void>;\n  remove(id: string): Promise<void>;\n} {\n  const { account } = useAuth();\n  const res = useResource<Address[]>([], () => account.listAddresses(), [account]);\n  const after = async (p: Promise<unknown>) => { await p; await res.refetch(); };\n  return {\n    ...res,\n    create: (input) => after(account.createAddress(input)),\n    update: (id, patch) => after(account.updateAddress(id, patch)),\n    remove: (id) => after(account.deleteAddress(id)),\n  };\n}\n\nexport function useSavedCards(): Resource<PaymentMethod[]> & {\n  setDefault(id: string): Promise<void>;\n  remove(id: string): Promise<void>;\n} {\n  const { account } = useAuth();\n  const res = useResource<PaymentMethod[]>([], () => account.listPaymentMethods(), [account]);\n  const after = async (p: Promise<unknown>) => { await p; await res.refetch(); };\n  return {\n    ...res,\n    setDefault: (id) => after(account.setDefaultPaymentMethod(id)),\n    remove: (id) => after(account.deletePaymentMethod(id)),\n  };\n}\n\nexport function useOrders(page?: Page): Resource<Order[]> {\n  const { account } = useAuth();\n  return useResource<Order[]>([], () => account.listOrders(page), [account, page?.cursor, page?.limit]);\n}\n\nexport function useInvoices(page?: Page): Resource<Invoice[]> {\n  const { account } = useAuth();\n  return useResource<Invoice[]>([], () => account.listInvoices(page), [account, page?.cursor, page?.limit]);\n}\n\nexport function useSubscriptions(page?: Page): Resource<Subscription[]> & {\n  cancel(id: string, opts?: { atPeriodEnd?: boolean }): Promise<void>;\n  pause(id: string): Promise<void>;\n  resume(id: string): Promise<void>;\n} {\n  const { account } = useAuth();\n  const res = useResource<Subscription[]>([], () => account.listSubscriptions(page),\n    [account, page?.cursor, page?.limit]);\n  const after = async (p: Promise<unknown>) => { await p; await res.refetch(); };\n  return {\n    ...res,\n    cancel: (id, opts) => after(account.cancelSubscription(id, opts)),\n    pause: (id) => after(account.pauseSubscription(id)),\n    resume: (id) => after(account.resumeSubscription(id)),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,mBAA4F;;;ACArF,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAAqG;AAC/G,UAAM,KAAK,OAAO;AAClB,SAAK,OAAO;AACZ,SAAK,OAAO,KAAK;AACjB,SAAK,aAAa,KAAK;AACvB,SAAK,aAAa,KAAK;AACvB,SAAK,UAAU,KAAK;AAAA,EACtB;AACF;;;ACDA,eAAsB,QAAQ,OAAmC;AAC/D,QAAM,UAAkC,EAAE,aAAa,MAAM,eAAe;AAC5E,MAAI,MAAM,SAAS,OAAW,SAAQ,cAAc,IAAI;AACxD,MAAI,MAAM,YAAa,SAAQ,gBAAgB,UAAU,MAAM,WAAW;AAC1E,MAAI,MAAM,YAAa,SAAQ,WAAW,IAAI,MAAM;AAEpD,QAAM,MAAM,MAAM,MAAM,GAAG,MAAM,OAAO,iBAAiB,MAAM,IAAI,IAAI;AAAA,IACrE,QAAQ,MAAM;AAAA,IACd;AAAA,IACA,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,KAAK,UAAU,MAAM,IAAI,EAAE,IAAI,CAAC;AAAA,EACzE,CAAC;AAED,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,MAAI,SAAc,CAAC;AACnB,MAAI;AACF,aAAS,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC;AAAA,EACtC,QAAQ;AAAA,EAGR;AAEA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,QAAQ,SAAS,CAAC;AAG5B,UAAM,KAAK,OAAO,IAAI,QAAQ,IAAI,aAAa,CAAC;AAChD,UAAM,IAAI,kBAAkB;AAAA,MAC1B,MAAM,EAAE,QAAQ;AAAA,MAChB,SAAS,EAAE,WAAW,uBAAuB,IAAI,MAAM;AAAA,MACvD,YAAY,IAAI;AAAA,MAChB,YAAY,OAAO,SAAS,EAAE,KAAK,MAAM,IAAI,KAAK;AAAA,MAClD,SAAS,EAAE;AAAA,IACb,CAAC;AAAA,EACH;AAKA,SAAO,UAAU,OAAO,WAAW,YAAY,UAAU,SAAS,OAAO,OAAQ,UAAU,CAAC;AAC9F;;;AClCO,IAAM,eAAN,MAAmB;AAAA,EACxB,YAA0B,EAAE,QAAQ,WAAW,UAAU,MAAM,eAAe,MAAM;AAAA,EACpF,eAA8B;AAAA,EAC9B,aAA4B;AAAA,EAC5B,aAAa,oBAAI,IAAc;AAAA,EAE/B,MAAoB;AAAE,WAAO,KAAK;AAAA,EAAW;AAAA,EAC7C,cAA6B;AAAE,WAAO,KAAK;AAAA,EAAc;AAAA,EACzD,YAA2B;AAAE,WAAO,KAAK;AAAA,EAAY;AAAA,EAErD,WAAW,SAAwB;AACjC,SAAK,eAAe,QAAQ;AAC5B,SAAK,aAAa,KAAK,MAAM,QAAQ,SAAS;AAC9C,SAAK,SAAS;AAAA,MACZ,QAAQ;AAAA,MACR,UAAU,QAAQ;AAAA,MAClB,eAAe,QAAQ,QAAQ,UAAU,aAAa;AAAA,IACxD,CAAC;AAAA,EACH;AAAA,EAEA,UAAU,QAA0B;AAClC,SAAK,SAAS,EAAE,GAAG,KAAK,WAAW,OAAO,CAAC;AAAA,EAC7C;AAAA,EAEA,QAAc;AACZ,SAAK,eAAe;AACpB,SAAK,aAAa;AAClB,SAAK,SAAS,EAAE,QAAQ,mBAAmB,UAAU,MAAM,eAAe,MAAM,CAAC;AAAA,EACnF;AAAA,EAEA,UAAU,IAA0B;AAClC,SAAK,WAAW,IAAI,EAAE;AACtB,WAAO,MAAM;AAAE,WAAK,WAAW,OAAO,EAAE;AAAA,IAAG;AAAA,EAC7C;AAAA,EAEA,SAAS,MAA0B;AAIjC,UAAM,OACJ,KAAK,WAAW,KAAK,UAAU,UAC/B,KAAK,kBAAkB,KAAK,UAAU,iBACtC,eAAe,KAAK,UAAU,KAAK,UAAU,QAAQ;AACvD,QAAI,KAAM;AACV,SAAK,YAAY;AACjB,eAAW,MAAM,CAAC,GAAG,KAAK,UAAU,GAAG;AAErC,UAAI;AAAE,WAAG,IAAI;AAAA,MAAG,QAAQ;AAAA,MAA0B;AAAA,IACpD;AAAA,EACF;AACF;AAEA,SAAS,eAAe,GAAoB,GAA6B;AACvE,MAAI,MAAM,EAAG,QAAO;AACpB,MAAI,CAAC,KAAK,CAAC,EAAG,QAAO;AACrB,QAAM,OAAO,oBAAI,IAAI,CAAC,GAAG,OAAO,KAAK,CAAC,GAAG,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC;AAC3D,aAAW,KAAK,KAAM,KAAI,EAAE,CAAC,MAAM,EAAE,CAAC,EAAG,QAAO;AAChD,SAAO;AACT;;;ACxEO,SAAS,gBAA6B;AAC3C,QAAM,MAAM,oBAAI,IAAoB;AACpC,SAAO;AAAA,IACL,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK;AAAA,IAC1B,KAAK,CAAC,GAAG,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC;AAAA,IAChC,QAAQ,CAAC,MAAM,KAAK,IAAI,OAAO,CAAC;AAAA,EAClC;AACF;AAOO,SAAS,sBAAmC;AACjD,QAAM,WAAW,cAAc;AAC/B,QAAM,KAAK,MAAsB;AAC/B,QAAI;AACF,aAAO,OAAO,iBAAiB,cAAc,eAAe;AAAA,IAC9D,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AAAA,IACL,IAAI,GAAG;AACL,UAAI;AACF,cAAM,IAAI,GAAG,GAAG,QAAQ,CAAC;AACzB,YAAI,KAAK,KAAM,QAAO;AAAA,MACxB,QAAQ;AAAA,MAAqB;AAC7B,aAAO,SAAS,IAAI,CAAC;AAAA,IACvB;AAAA,IACA,IAAI,GAAG,GAAG;AACR,eAAS,IAAI,GAAG,CAAC;AACjB,UAAI;AAAE,WAAG,GAAG,QAAQ,GAAG,CAAC;AAAA,MAAG,QAAQ;AAAA,MAAiC;AAAA,IACtE;AAAA,IACA,OAAO,GAAG;AACR,eAAS,OAAO,CAAC;AACjB,UAAI;AAAE,WAAG,GAAG,WAAW,CAAC;AAAA,MAAG,QAAQ;AAAA,MAAqB;AAAA,IAC1D;AAAA,EACF;AACF;;;ACtCA,IAAM,mBAAmB;AAEzB,IAAM,kBAAkB;AA8BjB,SAAS,mBAAmB,QAA0C;AAC3E,QAAM,WAAW,OAAO,WAAW,kBAAkB,QAAQ,OAAO,EAAE;AACtE,QAAM,UAAuB,OAAO,WAAW,oBAAoB;AAGnE,QAAM,aAAa,oBAAoB,OAAO,cAAc;AAC5D,QAAM,WAAW,yBAAyB,OAAO,cAAc;AAE/D,QAAM,QAAQ,IAAI,aAAa;AAC/B,MAAI,kBAAwC;AAC5C,MAAI,cAA6B;AACjC,MAAI,kBAAkB;AAEtB,QAAM,OAAO,EAAE,SAAS,gBAAgB,OAAO,eAAe;AAE9D,iBAAe,QAAQ,SAAiC;AACtD,UAAM,WAAW,OAAO;AACxB,UAAM,QAAQ,IAAI,YAAY,QAAQ,YAAY;AAAA,EACpD;AAEA,iBAAe,SAAwB;AACrC,kBAAc;AACd,UAAM,MAAM;AACZ,UAAM,QAAQ,OAAO,UAAU;AAAA,EACjC;AAQA,WAAS,SAAY,IAAkC;AACrD,UAAM,QAAS,WAAmB,WAAW;AAC7C,WAAO,OAAO,UAAU,MAAM,QAAQ,UAAU,EAAE,IAAI,GAAG;AAAA,EAC3D;AAEA,iBAAe,YAA2B;AACxC,UAAM,SAAS,YAAY;AAGzB,YAAM,eAAe,MAAM,QAAQ,IAAI,UAAU;AACjD,UAAI,CAAC,cAAc;AACjB,cAAM,OAAO;AACb,cAAM,IAAI,kBAAkB,EAAE,MAAM,mBAAmB,SAAS,cAAc,YAAY,IAAI,CAAC;AAAA,MACjG;AACA,UAAI;AACF,cAAM,OAAO,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,iBAAiB,MAAM,EAAE,aAAa,EAAE,CAAC;AACrG,cAAM,QAAQ,IAAe;AAAA,MAC/B,SAAS,KAAK;AAGZ,cAAM,OAAO;AACb,cAAM;AAAA,MACR;AAAA,IACF,CAAC;AAAA,EACH;AAEA,WAAS,UAAyB;AAChC,QAAI,CAAC,iBAAiB;AACpB,wBAAkB,UAAU,EAAE,QAAQ,MAAM;AAAE,0BAAkB;AAAA,MAAM,CAAC;AAAA,IACzE;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,cAAsC;AACnD,UAAM,UAAU,MAAM,UAAU;AAChC,QAAI,MAAM,YAAY,KAAK,WAAW,UAAU,KAAK,IAAI,IAAI,iBAAiB;AAC5E,aAAO,MAAM,YAAY;AAAA,IAC3B;AACA,QAAI,MAAM,QAAQ,IAAI,UAAU,GAAG;AACjC,YAAM,QAAQ;AACd,aAAO,MAAM,YAAY;AAAA,IAC3B;AACA,WAAO,MAAM,YAAY;AAAA,EAC3B;AAEA,iBAAe,eAAiC;AAC9C,QAAI,eAAe,kBAAkB,KAAK,IAAI,EAAG,QAAO;AACxD,QAAI,CAAC,OAAO,iBAAkB,QAAO;AACrC,UAAM,WAAW,MAAM,OAAO,iBAAiB;AAC/C,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,OAAO,QAAQ;AACrB,WAAO;AAAA,EACT;AAEA,iBAAe,OAAO,UAAiC;AACrD,UAAM,OAAO,MAAM,QAAQ;AAAA,MACzB,GAAG;AAAA,MAAM,QAAQ;AAAA,MAAQ,MAAM;AAAA,MAC/B,aAAa,MAAM,YAAY,KAAK;AAAA,MAAW,MAAM,EAAE,SAAS;AAAA,IAClE,CAAC;AACD,kBAAc,KAAK;AACnB,sBAAkB,KAAK,IAAI,KAAK,OAAO,KAAK,SAAS,KAAK,OAAO,MAAO;AAAA,EAC1E;AAEA,iBAAe,KAAc,QAAgB,MAAc,MAA4B;AACrF,QAAI,cAAc;AAClB,QAAI,gBAAgB;AAEpB,eAAS;AACP,YAAM,QAAQ,MAAM,YAAY;AAChC,UAAI;AACF,eAAO,MAAM,QAAQ;AAAA,UACnB,GAAG;AAAA,UAAM;AAAA,UAAQ;AAAA,UAAM;AAAA,UACvB,aAAa,SAAS;AAAA,UACtB,aAAa,eAAe;AAAA,QAC9B,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,cAAM,IAAI;AAOV,cAAM,UAAU,EAAE,eAAe,QAC9B,EAAE,SAAS,kBAAkB,EAAE,SAAS,mBAAmB,EAAE,SAAS;AACzE,YAAI,WAAW,CAAC,aAAa;AAC3B,wBAAc;AACd,gBAAM,QAAQ;AACd;AAAA,QACF;AACA,YAAI,EAAE,SAAS,sBAAsB,CAAC,eAAe;AACnD,0BAAgB;AAChB,wBAAc;AACd,cAAI,MAAM,aAAa,EAAG;AAAA,QAC5B;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,SAAS,OAAO,UAAU;AAC9B,YAAM,OAAO,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,kBAAkB,MAAM,EAAE,OAAO,SAAS,EAAE,CAAC;AACzG,UAAI,MAAM,WAAW,UAAW,QAAO,EAAE,QAAQ,UAAU;AAC3D,YAAM,QAAQ,IAAe;AAC7B,aAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IAEA,MAAM,OAAO,OAAO,UAAU;AAC5B,YAAM,OAAO,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,eAAe,MAAM,EAAE,OAAO,SAAS,EAAE,CAAC;AACtG,YAAM,QAAQ,IAAe;AAAA,IAC/B;AAAA,IAEA,MAAM,UAAU;AACd,UAAI;AAAE,cAAM,KAAK,QAAQ,cAAc;AAAA,MAAG,QAAQ;AAAA,MAA+B;AACjF,YAAM,OAAO;AAAA,IACf;AAAA,IAEA,MAAM,oBAAoB;AACxB,UAAI;AAAE,cAAM,KAAK,QAAQ,kBAAkB;AAAA,MAAG,QAAQ;AAAA,MAA+B;AACrF,YAAM,OAAO;AAAA,IACf;AAAA,IAEA,MAAM,UAAU;AACd,UAAI,CAAE,MAAM,QAAQ,IAAI,UAAU,GAAI;AAAE,cAAM,UAAU,iBAAiB;AAAG;AAAA,MAAQ;AACpF,UAAI;AAAE,cAAM,QAAQ;AAAA,MAAG,QAAQ;AAAA,MAA6B;AAAA,IAC9D;AAAA,IAEA,aAAa,MAAM,MAAM,IAAI;AAAA,IAC7B,WAAW,CAAC,OAAO,MAAM,UAAU,EAAE;AAAA,IACrC;AAAA,IACA;AAAA,IAEA,MAAM,YAAY,OAAO;AACvB,YAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,sBAAsB,MAAM,EAAE,MAAM,EAAE,CAAC;AAKtF,UAAI,MAAM,QAAQ,IAAI,UAAU,GAAG;AACjC,YAAI;AAAE,gBAAM,QAAQ;AAAA,QAAG,QAAQ;AAAA,QAAqC;AAAA,MACtE;AAAA,IACF;AAAA,IAEA,MAAM,qBAAqB;AACzB,YAAM,KAAK,QAAQ,2BAA2B;AAAA,IAChD;AAAA,IAEA,MAAM,eAAe,OAAO;AAG1B,YAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,yBAAyB,MAAM,EAAE,MAAM,EAAE,CAAC;AAAA,IAC3F;AAAA,IAEA,MAAM,cAAc,OAAO,UAAU;AACnC,YAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,wBAAwB,MAAM,EAAE,OAAO,SAAS,EAAE,CAAC;AAElG,YAAM,OAAO;AAAA,IACf;AAAA,IAEA,MAAM,eAAe,UAAU;AAC7B,YAAM,KAAK,QAAQ,uBAAuB,EAAE,SAAS,CAAC;AAItD,YAAM,QAAQ;AAAA,IAChB;AAAA,IAEA,MAAM,eAAe;AACnB,aAAO,KAAsB,OAAO,cAAc;AAAA,IACpD;AAAA,IAEA,MAAM,cAAc,IAAI;AACtB,YAAM,OAAO,MAAM,KAAsB,OAAO,cAAc;AAC9D,YAAM,UAAU,KAAK,KAAK,CAAC,MAAM,EAAE,OAAO;AAC1C,YAAM,KAAK,UAAU,gBAAgB,mBAAmB,EAAE,CAAC,EAAE;AAC7D,UAAI,SAAS,OAAO,GAAI,OAAM,OAAO;AAAA,IACvC;AAAA,EACF;AACF;;;AC3NA,IAAM,MAAM,CAAC,MAAc,mBAAmB,CAAC;AAE/C,SAAS,MAAM,MAAqB;AAClC,QAAM,SAAS,IAAI,gBAAgB;AACnC,MAAI,MAAM,OAAQ,QAAO,IAAI,UAAU,KAAK,MAAM;AAClD,MAAI,MAAM,SAAS,KAAM,QAAO,IAAI,SAAS,OAAO,KAAK,KAAK,CAAC;AAC/D,QAAM,IAAI,OAAO,SAAS;AAC1B,SAAO,IAAI,IAAI,CAAC,KAAK;AACvB;AAEO,SAAS,cAAc,MAAqC;AACjE,QAAM,EAAE,KAAK,IAAI;AACjB,SAAO;AAAA,IACL,YAAY,MAAM,KAAK,OAAO,KAAK;AAAA,IACnC,eAAe,CAAC,UAAU,KAAK,SAAS,OAAO,KAAK;AAAA,IAEpD,eAAe,MAAM,KAAK,OAAO,eAAe;AAAA,IAChD,eAAe,CAAC,UAAU,KAAK,QAAQ,iBAAiB,KAAK;AAAA,IAC7D,eAAe,CAAC,IAAI,UAAU,KAAK,SAAS,iBAAiB,IAAI,EAAE,CAAC,IAAI,KAAK;AAAA,IAC7E,eAAe,CAAC,OAAO,KAAK,UAAU,iBAAiB,IAAI,EAAE,CAAC,EAAE;AAAA,IAEhE,oBAAoB,MAAM,KAAK,OAAO,qBAAqB;AAAA;AAAA;AAAA,IAG3D,yBAAyB,CAAC,OAAO,KAAK,SAAS,uBAAuB,IAAI,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,CAAC;AAAA,IACpG,qBAAqB,CAAC,OAAO,KAAK,UAAU,uBAAuB,IAAI,EAAE,CAAC,EAAE;AAAA,IAE5E,YAAY,CAAC,SAAS,KAAK,OAAO,aAAa,MAAM,IAAI,CAAC,EAAE;AAAA,IAC5D,UAAU,CAAC,OAAO,KAAK,OAAO,cAAc,IAAI,EAAE,CAAC,EAAE;AAAA,IACrD,cAAc,CAAC,SAAS,KAAK,OAAO,eAAe,MAAM,IAAI,CAAC,EAAE;AAAA,IAChE,YAAY,CAAC,OAAO,KAAK,OAAO,gBAAgB,IAAI,EAAE,CAAC,EAAE;AAAA,IACzD,mBAAmB,CAAC,SAAS,KAAK,OAAO,oBAAoB,MAAM,IAAI,CAAC,EAAE;AAAA,IAC1E,iBAAiB,CAAC,OAAO,KAAK,OAAO,qBAAqB,IAAI,EAAE,CAAC,EAAE;AAAA,IAEnE,oBAAoB,CAAC,IAAI,SAAS,KAAK,QAAQ,qBAAqB,IAAI,EAAE,CAAC,WAAW,IAAI;AAAA,IAC1F,mBAAmB,CAAC,OAAO,KAAK,QAAQ,qBAAqB,IAAI,EAAE,CAAC,QAAQ;AAAA,IAC5E,oBAAoB,CAAC,OAAO,KAAK,QAAQ,qBAAqB,IAAI,EAAE,CAAC,SAAS;AAAA,IAE9E,WAAW,CAAC,WAAW,KAAK,QAAQ,aAAa,IAAI,MAAM,CAAC,QAAQ;AAAA,EACtE;AACF;;;ANjCS;AArBT,IAAM,UAAM,4BAAmC,IAAI;AAE5C,SAAS,qBAAqB,OAAkC;AACrE,QAAM,EAAE,MAAM,UAAU,gBAAgB,SAAS,SAAS,kBAAkB,SAAS,IAAI;AAEzF,QAAM,YAAQ,sBAAsB,MAAM;AACxC,UAAM,OAAO,YAAY,mBAAmB,EAAE,gBAAgB,SAAS,SAAS,iBAAiB,CAAC;AAClG,WAAO,EAAE,MAAM,SAAS,cAAc,IAAI,EAAE;AAAA,EAE9C,GAAG,CAAC,UAAU,gBAAgB,SAAS,OAAO,CAAC;AAE/C,QAAM,eAAW,qBAA4B,IAAI;AACjD,8BAAU,MAAM;AAId,QAAI,SAAS,YAAY,MAAM,KAAM;AACrC,aAAS,UAAU,MAAM;AACzB,SAAK,MAAM,KAAK,QAAQ;AAAA,EAC1B,GAAG,CAAC,KAAK,CAAC;AAEV,SAAO,4CAAC,IAAI,UAAJ,EAAa,OAAe,UAAS;AAC/C;AAEA,SAAS,SAAuB;AAC9B,QAAM,UAAM,yBAAW,GAAG;AAC1B,MAAI,CAAC,IAAK,OAAM,IAAI,MAAM,sDAAsD;AAChF,SAAO;AACT;AAEO,SAAS,iBAA+B;AAAE,SAAO,OAAO;AAAG;AAS3D,SAAS,UAAyB;AACvC,QAAM,EAAE,MAAM,QAAQ,IAAI,OAAO;AACjC,QAAM,eAAW,mCAAqB,KAAK,WAAW,KAAK,aAAa,KAAK,WAAW;AACxF,SAAO;AAAA,IACL,GAAG;AAAA,IACH,WAAW,SAAS,WAAW;AAAA,IAC/B,iBAAiB,SAAS,WAAW;AAAA,IACrC;AAAA,IACA;AAAA,EACF;AACF;;;AOjEA,IAAAA,gBAAyD;AAazD,SAAS,QAAQ,KAAiC;AAChD,MAAI,eAAe,kBAAmB,QAAO;AAC7C,QAAM,SAAS;AACf,SAAO,IAAI,kBAAkB;AAAA,IAC3B,MAAM,QAAQ,QAAQ;AAAA,IACtB,SAAS,QAAQ,WAAW,OAAO,GAAG;AAAA,IACtC,YAAY,QAAQ,cAAc;AAAA,EACpC,CAAC;AACH;AAOA,SAAS,YAAe,OAAU,MAAwB,MAA8B;AACtF,QAAM,EAAE,QAAQ,cAAc,IAAI,QAAQ;AAC1C,QAAM,CAAC,MAAM,OAAO,QAAI,wBAAY,KAAK;AACzC,QAAM,CAAC,WAAW,YAAY,QAAI,wBAAS,WAAW,SAAS;AAC/D,QAAM,CAAC,OAAO,QAAQ,QAAI,wBAAmC,IAAI;AACjE,QAAM,UAAM,sBAAO,CAAC;AACpB,QAAM,YAAQ,sBAAO,IAAI;AAEzB,+BAAU,MAAM;AAKd,UAAM,UAAU;AAChB,WAAO,MAAM;AAAE,YAAM,UAAU;AAAO,UAAI;AAAA,IAAW;AAAA,EACvD,GAAG,CAAC,CAAC;AAEL,QAAM,cAAU,2BAAY,YAAY;AACtC,UAAM,OAAO,EAAE,IAAI;AACnB,iBAAa,IAAI;AACjB,QAAI;AACF,YAAM,OAAO,MAAM,KAAK;AACxB,UAAI,CAAC,MAAM,WAAW,IAAI,YAAY,KAAM;AAC5C,cAAQ,IAAI;AACZ,eAAS,IAAI;AAAA,IACf,SAAS,KAAK;AACZ,UAAI,CAAC,MAAM,WAAW,IAAI,YAAY,KAAM;AAC5C,eAAS,QAAQ,GAAG,CAAC;AAAA,IACvB,UAAE;AACA,UAAI,MAAM,WAAW,IAAI,YAAY,KAAM,cAAa,KAAK;AAAA,IAC/D;AAAA,EAEF,GAAG,IAAI;AAEP,+BAAU,MAAM;AACd,QAAI,WAAW,iBAAiB;AAC9B,UAAI;AACJ,cAAQ,KAAK;AACb,eAAS,IAAI;AACb,mBAAa,WAAW,SAAS;AACjC;AAAA,IACF;AACA,SAAK,QAAQ;AAAA,EAEf,GAAG,CAAC,QAAQ,eAAe,OAAO,CAAC;AAEnC,SAAO,EAAE,MAAM,WAAW,OAAO,QAAQ;AAC3C;AAEO,SAAS,cAA0F;AACxG,QAAM,EAAE,QAAQ,IAAI,QAAQ;AAC5B,QAAM,MAAM,YAA6B,MAAM,MAAM,QAAQ,WAAW,GAAG,CAAC,OAAO,CAAC;AACpF,QAAM,aAAS,2BAAY,OAAO,UAAwB;AACxD,UAAM,QAAQ,cAAc,KAAK;AACjC,UAAM,IAAI,QAAQ;AAAA,EACpB,GAAG,CAAC,SAAS,GAAG,CAAC;AACjB,SAAO,EAAE,GAAG,KAAK,OAAO;AAC1B;AAEO,SAAS,eAId;AACA,QAAM,EAAE,QAAQ,IAAI,QAAQ;AAC5B,QAAM,MAAM,YAAuB,CAAC,GAAG,MAAM,QAAQ,cAAc,GAAG,CAAC,OAAO,CAAC;AAC/E,QAAM,QAAQ,OAAO,MAAwB;AAAE,UAAM;AAAG,UAAM,IAAI,QAAQ;AAAA,EAAG;AAC7E,SAAO;AAAA,IACL,GAAG;AAAA,IACH,QAAQ,CAAC,UAAU,MAAM,QAAQ,cAAc,KAAK,CAAC;AAAA,IACrD,QAAQ,CAAC,IAAI,UAAU,MAAM,QAAQ,cAAc,IAAI,KAAK,CAAC;AAAA,IAC7D,QAAQ,CAAC,OAAO,MAAM,QAAQ,cAAc,EAAE,CAAC;AAAA,EACjD;AACF;AAEO,SAAS,gBAGd;AACA,QAAM,EAAE,QAAQ,IAAI,QAAQ;AAC5B,QAAM,MAAM,YAA6B,CAAC,GAAG,MAAM,QAAQ,mBAAmB,GAAG,CAAC,OAAO,CAAC;AAC1F,QAAM,QAAQ,OAAO,MAAwB;AAAE,UAAM;AAAG,UAAM,IAAI,QAAQ;AAAA,EAAG;AAC7E,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY,CAAC,OAAO,MAAM,QAAQ,wBAAwB,EAAE,CAAC;AAAA,IAC7D,QAAQ,CAAC,OAAO,MAAM,QAAQ,oBAAoB,EAAE,CAAC;AAAA,EACvD;AACF;AAEO,SAAS,UAAU,MAAgC;AACxD,QAAM,EAAE,QAAQ,IAAI,QAAQ;AAC5B,SAAO,YAAqB,CAAC,GAAG,MAAM,QAAQ,WAAW,IAAI,GAAG,CAAC,SAAS,MAAM,QAAQ,MAAM,KAAK,CAAC;AACtG;AAEO,SAAS,YAAY,MAAkC;AAC5D,QAAM,EAAE,QAAQ,IAAI,QAAQ;AAC5B,SAAO,YAAuB,CAAC,GAAG,MAAM,QAAQ,aAAa,IAAI,GAAG,CAAC,SAAS,MAAM,QAAQ,MAAM,KAAK,CAAC;AAC1G;AAEO,SAAS,iBAAiB,MAI/B;AACA,QAAM,EAAE,QAAQ,IAAI,QAAQ;AAC5B,QAAM,MAAM;AAAA,IAA4B,CAAC;AAAA,IAAG,MAAM,QAAQ,kBAAkB,IAAI;AAAA,IAC9E,CAAC,SAAS,MAAM,QAAQ,MAAM,KAAK;AAAA,EAAC;AACtC,QAAM,QAAQ,OAAO,MAAwB;AAAE,UAAM;AAAG,UAAM,IAAI,QAAQ;AAAA,EAAG;AAC7E,SAAO;AAAA,IACL,GAAG;AAAA,IACH,QAAQ,CAAC,IAAI,SAAS,MAAM,QAAQ,mBAAmB,IAAI,IAAI,CAAC;AAAA,IAChE,OAAO,CAAC,OAAO,MAAM,QAAQ,kBAAkB,EAAE,CAAC;AAAA,IAClD,QAAQ,CAAC,OAAO,MAAM,QAAQ,mBAAmB,EAAE,CAAC;AAAA,EACtD;AACF;","names":["import_react"]}
+{"version":3,"sources":["../../src/react/index.tsx","../../src/react/context.tsx","../../src/errors.ts","../../src/request.ts","../../src/session.ts","../../src/storage.ts","../../src/client.ts","../../src/account.ts","../../src/react/hooks.ts"],"sourcesContent":["export { ThrottleAuthProvider, useAuth, useAuthContext } from './context';\nexport type { ThrottleAuthProviderProps, UseAuthResult } from './context';\nexport { useCustomer, useAddresses, useSavedCards, useOrders, useInvoices, useSubscriptions } from './hooks';\nexport type { Resource } from './hooks';\nexport * from '../index';\n","import { createContext, useContext, useEffect, useMemo, useRef, useSyncExternalStore } from 'react';\nimport type { ReactNode } from 'react';\nimport { createThrottleAuth, type ThrottleAuth } from '../client';\nimport { createAccount, type ThrottleAccount } from '../account';\nimport type { AuthSnapshot } from '../session';\nimport type { ThrottleAuthConfig } from '../types';\n\nexport interface ThrottleAuthProviderProps extends Partial<ThrottleAuthConfig> {\n  publishableKey: string;\n  /** Inject a pre-built client. Tests use it; merchants sharing one client across roots may too. */\n  auth?: ThrottleAuth;\n  children: ReactNode;\n}\n\ninterface ContextValue { auth: ThrottleAuth; account: ThrottleAccount }\n\nconst Ctx = createContext<ContextValue | null>(null);\n\nexport function ThrottleAuthProvider(props: ThrottleAuthProviderProps) {\n  const { auth: injected, publishableKey, baseUrl, storage, onStepUpRequired, children } = props;\n\n  // `storage` and `onStepUpRequired` are deliberately NOT dependencies: they are\n  // read once at mount. A merchant passing `storage={memoryStorage()}` inline —\n  // which the README suggests — would otherwise get a new client on every parent\n  // render, and with it a fresh empty SessionState that reads as signed out.\n  const value = useMemo<ContextValue>(() => {\n    const auth = injected ?? createThrottleAuth({ publishableKey, baseUrl, storage, onStepUpRequired });\n    return { auth, account: createAccount(auth) };\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [injected, publishableKey, baseUrl]);\n\n  const restored = useRef<ThrottleAuth | null>(null);\n  useEffect(() => {\n    // Once per client. StrictMode runs effects twice in development, and a\n    // second restore() would present the refresh token that the first one\n    // just rotated away.\n    if (restored.current === value.auth) return;\n    restored.current = value.auth;\n    void value.auth.restore();\n  }, [value]);\n\n  return <Ctx.Provider value={value}>{children}</Ctx.Provider>;\n}\n\nfunction useCtx(): ContextValue {\n  const ctx = useContext(Ctx);\n  if (!ctx) throw new Error('useAuth must be used inside a <ThrottleAuthProvider>');\n  return ctx;\n}\n\nexport function useAuthContext(): ContextValue { return useCtx(); }\n\nexport type UseAuthResult = AuthSnapshot & {\n  isLoading: boolean;\n  isAuthenticated: boolean;\n  auth: ThrottleAuth;\n  account: ThrottleAccount;\n};\n\nexport function useAuth(): UseAuthResult {\n  const { auth, account } = useCtx();\n  const snapshot = useSyncExternalStore(auth.subscribe, auth.getSnapshot, auth.getSnapshot);\n  return {\n    ...snapshot,\n    isLoading: snapshot.status === 'loading',\n    isAuthenticated: snapshot.status === 'authenticated',\n    auth,\n    account,\n  };\n}\n","export class ThrottleAuthError extends Error {\n  readonly code: string;\n  readonly statusCode: number;\n  readonly retryAfter?: number;\n  readonly details?: unknown;\n\n  constructor(args: { code: string; message: string; statusCode: number; retryAfter?: number; details?: unknown }) {\n    super(args.message);\n    this.name = 'ThrottleAuthError';\n    this.code = args.code;\n    this.statusCode = args.statusCode;\n    this.retryAfter = args.retryAfter;\n    this.details = args.details;\n  }\n}\n","import { ThrottleAuthError } from './errors';\n\nexport interface RequestInput {\n  method: string;\n  path: string;\n  baseUrl: string;\n  publishableKey: string;\n  accessToken?: string;\n  stepUpToken?: string;\n  body?: unknown;\n}\n\n/** Returns the UNWRAPPED `data` from the `{ data: … }` envelope. Throws ThrottleAuthError otherwise. */\nexport async function request(input: RequestInput): Promise<any> {\n  const headers: Record<string, string> = { 'X-API-Key': input.publishableKey };\n  if (input.body !== undefined) headers['Content-Type'] = 'application/json';\n  if (input.accessToken) headers.Authorization = `Bearer ${input.accessToken}`;\n  if (input.stepUpToken) headers['X-Step-Up'] = input.stepUpToken;\n\n  const res = await fetch(`${input.baseUrl}/v1/storefront${input.path}`, {\n    method: input.method,\n    headers,\n    ...(input.body !== undefined ? { body: JSON.stringify(input.body) } : {}),\n  });\n\n  const text = await res.text();\n  let parsed: any = {};\n  try {\n    parsed = text ? JSON.parse(text) : {};\n  } catch {\n    // Non-JSON body — an HTML gateway page, say. Leave parsed empty so the\n    // branch below still throws a typed error rather than a raw SyntaxError.\n  }\n\n  if (!res.ok) {\n    const e = parsed?.error ?? {};\n    // `Retry-After` is server-controlled but not trusted: Number('soon') is\n    // NaN, and a NaN reaches the UI as \"wait NaN seconds\".\n    const ra = Number(res.headers.get('retry-after'));\n    throw new ThrottleAuthError({\n      code: e.code ?? 'request_failed',\n      message: e.message ?? `Request failed with ${res.status}`,\n      statusCode: res.status,\n      retryAfter: Number.isFinite(ra) && ra >= 0 ? ra : undefined,\n      details: e.details,\n    });\n  }\n\n  // `'data' in parsed`, not `parsed?.data ?? parsed`: a legitimate\n  // `{ \"data\": null }` is nullish, and `??` would fall through and hand the\n  // caller the whole envelope instead of the null the API actually sent.\n  return parsed && typeof parsed === 'object' && 'data' in parsed ? parsed.data : (parsed ?? {});\n}\n","import type { Customer, Session } from './types';\n\nexport type AuthStatus = 'loading' | 'authenticated' | 'unauthenticated';\n\nexport interface AuthSnapshot {\n  status: AuthStatus;\n  customer: Customer | null;\n  /**\n   * False here does NOT only mean \"we emailed them and they have not clicked\".\n   * While it is false the API may also be withholding pre-existing account\n   * data behind the claim cutoff — empty order lists and a 403 on `PATCH /me`\n   * are expected, not broken. See the plan header.\n   */\n  emailVerified: boolean;\n}\n\ntype Listener = (snapshot: AuthSnapshot) => void;\n\nexport class SessionState {\n  #snapshot: AuthSnapshot = { status: 'loading', customer: null, emailVerified: false };\n  #accessToken: string | null = null;\n  #expiresAt: number | null = null;\n  #listeners = new Set<Listener>();\n\n  get(): AuthSnapshot { return this.#snapshot; }\n  accessToken(): string | null { return this.#accessToken; }\n  expiresAt(): number | null { return this.#expiresAt; }\n\n  setSession(session: Session): void {\n    this.#accessToken = session.accessToken;\n    this.#expiresAt = Date.parse(session.expiresAt);\n    this.#publish({\n      status: 'authenticated',\n      customer: session.customer,\n      emailVerified: Boolean(session.customer?.emailVerified),\n    });\n  }\n\n  setStatus(status: AuthStatus): void {\n    this.#publish({ ...this.#snapshot, status });\n  }\n\n  clear(): void {\n    this.#accessToken = null;\n    this.#expiresAt = null;\n    this.#publish({ status: 'unauthenticated', customer: null, emailVerified: false });\n  }\n\n  subscribe(fn: Listener): () => void {\n    this.#listeners.add(fn);\n    return () => { this.#listeners.delete(fn); };\n  }\n\n  #publish(next: AuthSnapshot): void {\n    // Identity matters: React's useSyncExternalStore re-renders on reference\n    // change, and a token refresh every ten minutes must not re-render the\n    // whole account area when nothing visible changed.\n    const same =\n      next.status === this.#snapshot.status &&\n      next.emailVerified === this.#snapshot.emailVerified &&\n      customerEquals(next.customer, this.#snapshot.customer);\n    if (same) return;\n    this.#snapshot = next;\n    for (const fn of [...this.#listeners]) {\n      // A merchant's subscriber throwing must not stop the rest from hearing.\n      try { fn(next); } catch { /* merchant callback */ }\n    }\n  }\n}\n\nfunction customerEquals(a: Customer | null, b: Customer | null): boolean {\n  if (a === b) return true;\n  if (!a || !b) return false;\n  const keys = new Set([...Object.keys(a), ...Object.keys(b)]) as Set<keyof Customer>;\n  for (const k of keys) if (a[k] !== b[k]) return false;\n  return true;\n}\n","import type { AuthStorage } from './types';\n\nexport type { AuthStorage };\n\nexport function memoryStorage(): AuthStorage {\n  const map = new Map<string, string>();\n  return {\n    get: (k) => map.get(k) ?? null,\n    set: (k, v) => void map.set(k, v),\n    remove: (k) => void map.delete(k),\n  };\n}\n\n/**\n * localStorage when it works, memory when it does not. Safari private mode,\n * hardened browser settings and server-side rendering all make localStorage\n * either absent or throwing; none of them may take the storefront down.\n */\nexport function localStorageAdapter(): AuthStorage {\n  const fallback = memoryStorage();\n  const ls = (): Storage | null => {\n    try {\n      return typeof localStorage !== 'undefined' ? localStorage : null;\n    } catch {\n      return null;\n    }\n  };\n  return {\n    get(k) {\n      try {\n        const v = ls()?.getItem(k);\n        if (v != null) return v;\n      } catch { /* fall through */ }\n      return fallback.get(k);\n    },\n    set(k, v) {\n      fallback.set(k, v);\n      try { ls()?.setItem(k, v); } catch { /* memory-only this session */ }\n    },\n    remove(k) {\n      fallback.remove(k);\n      try { ls()?.removeItem(k); } catch { /* already gone */ }\n    },\n  };\n}\n","import { request } from './request';\nimport { ThrottleAuthError } from './errors';\nimport { SessionState, type AuthSnapshot } from './session';\nimport { localStorageAdapter, type AuthStorage } from './storage';\nimport type { Customer, Session, ThrottleAuthConfig } from './types';\n\nconst DEFAULT_BASE_URL = 'https://api.usethrottle.dev';\n/** Refresh this far before expiry so ordinary calls rarely see a 401 at all. */\nconst REFRESH_SKEW_MS = 30_000;\n\nexport interface DeviceSession {\n  id: string;\n  userAgent: string | null;\n  ipPrefix: string | null;\n  createdAt: string;\n  lastUsedAt: string;\n  current: boolean;\n}\n\nexport interface ThrottleAuth {\n  register(email: string, password: string): Promise<{ status: 'active' | 'pending' }>;\n  signIn(email: string, password: string): Promise<void>;\n  signOut(): Promise<void>;\n  signOutEverywhere(): Promise<void>;\n  restore(): Promise<void>;\n  getSnapshot(): AuthSnapshot;\n  subscribe(fn: (s: AuthSnapshot) => void): () => void;\n  stepUp(password: string): Promise<void>;\n  call<T = any>(method: string, path: string, body?: unknown): Promise<T>;\n  verifyEmail(token: string): Promise<void>;\n  resendVerification(): Promise<void>;\n  forgotPassword(email: string): Promise<void>;\n  resetPassword(token: string, password: string): Promise<void>;\n  changePassword(password: string): Promise<void>;\n  listSessions(): Promise<DeviceSession[]>;\n  revokeSession(id: string): Promise<void>;\n}\n\nexport function createThrottleAuth(config: ThrottleAuthConfig): ThrottleAuth {\n  const baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/$/, '');\n  const storage: AuthStorage = config.storage ?? localStorageAdapter();\n  // Namespaced by key so two Throttle applications on one origin cannot read\n  // each other's refresh token out of shared localStorage.\n  const storageKey = `throttle_auth_rt:${config.publishableKey}`;\n  const lockName = `throttle_auth_refresh:${config.publishableKey}`;\n\n  const state = new SessionState();\n  let refreshInFlight: Promise<void> | null = null;\n  let stepUpToken: string | null = null;\n  let stepUpExpiresAt = 0;\n\n  const base = { baseUrl, publishableKey: config.publishableKey };\n\n  async function persist(session: Session): Promise<void> {\n    state.setSession(session);\n    await storage.set(storageKey, session.refreshToken);\n  }\n\n  async function forget(): Promise<void> {\n    stepUpToken = null;\n    state.clear();\n    await storage.remove(storageKey);\n  }\n\n  /**\n   * Cross-tab single flight. Two tabs refreshing at once would each present the\n   * same stored token; the second is a replay, and the server kills the family.\n   * Web Locks serialises them; where it is unavailable the in-process guard\n   * below still covers the common single-tab case.\n   */\n  function withLock<T>(fn: () => Promise<T>): Promise<T> {\n    const locks = (globalThis as any).navigator?.locks;\n    return locks?.request ? locks.request(lockName, fn) : fn();\n  }\n\n  async function doRefresh(): Promise<void> {\n    await withLock(async () => {\n      // Re-read INSIDE the lock: another tab may have rotated while we waited,\n      // and presenting the token we read before the lock would be a replay.\n      const refreshToken = await storage.get(storageKey);\n      if (!refreshToken) {\n        await forget();\n        throw new ThrottleAuthError({ code: 'session_revoked', message: 'No session', statusCode: 401 });\n      }\n      try {\n        const data = await request({ ...base, method: 'POST', path: '/auth/refresh', body: { refreshToken } });\n        await persist(data as Session);\n      } catch (err) {\n        // Any refusal of a refresh token is terminal — there is nothing left to\n        // retry with. Drop it rather than letting a dead token sit in storage.\n        await forget();\n        throw err;\n      }\n    });\n  }\n\n  function refresh(): Promise<void> {\n    if (!refreshInFlight) {\n      refreshInFlight = doRefresh().finally(() => { refreshInFlight = null; });\n    }\n    return refreshInFlight;\n  }\n\n  async function accessToken(): Promise<string | null> {\n    const expires = state.expiresAt();\n    if (state.accessToken() && expires && expires - Date.now() > REFRESH_SKEW_MS) {\n      return state.accessToken();\n    }\n    if (await storage.get(storageKey)) {\n      await refresh();\n      return state.accessToken();\n    }\n    return state.accessToken();\n  }\n\n  async function ensureStepUp(): Promise<boolean> {\n    if (stepUpToken && stepUpExpiresAt > Date.now()) return true;\n    if (!config.onStepUpRequired) return false;\n    const password = await config.onStepUpRequired();\n    if (!password) return false;\n    await stepUp(password);\n    return true;\n  }\n\n  async function stepUp(password: string): Promise<void> {\n    const data = await request({\n      ...base, method: 'POST', path: '/auth/step-up',\n      accessToken: await accessToken() ?? undefined, body: { password },\n    });\n    stepUpToken = data.stepUpToken;\n    stepUpExpiresAt = Date.now() + (Number(data.expiresIn) || 300) * 1000 - 5_000;\n  }\n\n  async function call<T = any>(method: string, path: string, body?: unknown): Promise<T> {\n    let retriedAuth = false;\n    let retriedStepUp = false;\n\n    for (;;) {\n      const token = await accessToken();\n      try {\n        return await request({\n          ...base, method, path, body,\n          accessToken: token ?? undefined,\n          stepUpToken: stepUpToken ?? undefined,\n        });\n      } catch (err) {\n        const e = err as ThrottleAuthError;\n        // `session_revoked` belongs here too. The server returns it for a\n        // stale session EPOCH as well as for a genuinely dead session, and a\n        // changed password bumps the epoch while deliberately sparing the\n        // current session — so one refresh recovers it. When the session\n        // really is dead the refresh fails and forget() runs, which is the\n        // same outcome, one request later.\n        const expired = e.statusCode === 401 &&\n          (e.code === 'unauthorized' || e.code === 'token_expired' || e.code === 'session_revoked');\n        if (expired && !retriedAuth) {\n          retriedAuth = true;\n          await refresh();   // shared — ten callers here produce ONE request\n          continue;\n        }\n        if (e.code === 'step_up_required' && !retriedStepUp) {\n          retriedStepUp = true;\n          stepUpToken = null;\n          if (await ensureStepUp()) continue;\n        }\n        throw err;\n      }\n    }\n  }\n\n  return {\n    async register(email, password) {\n      const data = await request({ ...base, method: 'POST', path: '/auth/register', body: { email, password } });\n      if (data?.status === 'pending') return { status: 'pending' };\n      await persist(data as Session);\n      return { status: 'active' };\n    },\n\n    async signIn(email, password) {\n      const data = await request({ ...base, method: 'POST', path: '/auth/login', body: { email, password } });\n      await persist(data as Session);\n    },\n\n    async signOut() {\n      try { await call('POST', '/auth/logout'); } catch { /* local state still goes */ }\n      await forget();\n    },\n\n    async signOutEverywhere() {\n      try { await call('POST', '/auth/logout-all'); } catch { /* local state still goes */ }\n      await forget();\n    },\n\n    async restore() {\n      if (!(await storage.get(storageKey))) { state.setStatus('unauthenticated'); return; }\n      try { await refresh(); } catch { /* forget() already ran */ }\n    },\n\n    getSnapshot: () => state.get(),\n    subscribe: (fn) => state.subscribe(fn),\n    stepUp,\n    call,\n\n    async verifyEmail(token) {\n      await request({ ...base, method: 'POST', path: '/auth/verify-email', body: { token } });\n      // `ver` is a claim baked into the access token, and the claim cutoff is\n      // read from the session row. Without a new token the buyer stays gated —\n      // and their own order history stays hidden — for the rest of this\n      // token's ten minutes.\n      if (await storage.get(storageKey)) {\n        try { await refresh(); } catch { /* verification still succeeded */ }\n      }\n    },\n\n    async resendVerification() {\n      await call('POST', '/auth/verify-email/resend');\n    },\n\n    async forgotPassword(email) {\n      // Always 202, whether or not the address has an account. Do not infer\n      // anything from it and do not tell the buyer whether it existed.\n      await request({ ...base, method: 'POST', path: '/auth/forgot-password', body: { email } });\n    },\n\n    async resetPassword(token, password) {\n      await request({ ...base, method: 'POST', path: '/auth/reset-password', body: { token, password } });\n      // The server revokes every session on reset, this one included.\n      await forget();\n    },\n\n    async changePassword(password) {\n      await call('POST', '/me/change-password', { password });\n      // The change bumps the session epoch. This session was deliberately\n      // spared, but the access token in hand now carries a stale epoch and the\n      // next write would 401. Rotate now rather than on the buyer's next click\n      // — and do not let a failed rotation report a change that already\n      // succeeded server-side as a failure.\n      try { await refresh(); } catch { /* the password change already succeeded */ }\n    },\n\n    async listSessions() {\n      return call<DeviceSession[]>('GET', '/me/sessions');\n    },\n\n    async revokeSession(id) {\n      const mine = await call<DeviceSession[]>('GET', '/me/sessions');\n      const current = mine.find((s) => s.current);\n      await call('DELETE', `/me/sessions/${encodeURIComponent(id)}`);\n      if (current?.id === id) await forget();\n    },\n  };\n}\n\nexport type { AuthSnapshot, Customer, Session, ThrottleAuthConfig };\n","import type { ThrottleAuth } from './client';\nimport type {\n  Address, AddressInput, Customer, Invoice, Order,\n  PaymentMethod, ProfilePatch, Subscription,\n} from './types';\n\nexport interface Page { cursor?: string; limit?: number }\n\nexport interface ThrottleAccount {\n  getProfile(): Promise<Customer>;\n  updateProfile(patch: ProfilePatch): Promise<Customer>;\n  listAddresses(): Promise<Address[]>;\n  createAddress(input: AddressInput): Promise<Address>;\n  updateAddress(id: string, patch: Partial<AddressInput>): Promise<Address>;\n  deleteAddress(id: string): Promise<void>;\n  listPaymentMethods(): Promise<PaymentMethod[]>;\n  setDefaultPaymentMethod(id: string): Promise<PaymentMethod>;\n  deletePaymentMethod(id: string): Promise<void>;\n  listOrders(page?: Page): Promise<Order[]>;\n  getOrder(id: string): Promise<Order>;\n  listInvoices(page?: Page): Promise<Invoice[]>;\n  getInvoice(id: string): Promise<Invoice>;\n  listSubscriptions(page?: Page): Promise<Subscription[]>;\n  getSubscription(id: string): Promise<Subscription>;\n  cancelSubscription(id: string, opts?: { atPeriodEnd?: boolean }): Promise<Subscription>;\n  pauseSubscription(id: string): Promise<Subscription>;\n  resumeSubscription(id: string): Promise<Subscription>;\n  claimCart(cartId: string): Promise<{ cartId: string; customerId: string }>;\n}\n\nconst seg = (v: string) => encodeURIComponent(v);\n\nfunction query(page?: Page): string {\n  const params = new URLSearchParams();\n  if (page?.cursor) params.set('cursor', page.cursor);\n  if (page?.limit != null) params.set('limit', String(page.limit));\n  const s = params.toString();\n  return s ? `?${s}` : '';\n}\n\nexport function createAccount(auth: ThrottleAuth): ThrottleAccount {\n  const { call } = auth;\n  return {\n    getProfile: () => call('GET', '/me'),\n    updateProfile: (patch) => call('PATCH', '/me', patch),\n\n    listAddresses: () => call('GET', '/me/addresses'),\n    createAddress: (input) => call('POST', '/me/addresses', input),\n    updateAddress: (id, patch) => call('PATCH', `/me/addresses/${seg(id)}`, patch),\n    deleteAddress: (id) => call('DELETE', `/me/addresses/${seg(id)}`),\n\n    listPaymentMethods: () => call('GET', '/me/payment-methods'),\n    // The platform has no \"change this subscription's card\" capability, so\n    // this is how a buyer changes what they are billed on: move the default.\n    setDefaultPaymentMethod: (id) => call('PATCH', `/me/payment-methods/${seg(id)}`, { isDefault: true }),\n    deletePaymentMethod: (id) => call('DELETE', `/me/payment-methods/${seg(id)}`),\n\n    listOrders: (page) => call('GET', `/me/orders${query(page)}`),\n    getOrder: (id) => call('GET', `/me/orders/${seg(id)}`),\n    listInvoices: (page) => call('GET', `/me/invoices${query(page)}`),\n    getInvoice: (id) => call('GET', `/me/invoices/${seg(id)}`),\n    listSubscriptions: (page) => call('GET', `/me/subscriptions${query(page)}`),\n    getSubscription: (id) => call('GET', `/me/subscriptions/${seg(id)}`),\n\n    cancelSubscription: (id, opts) => call('POST', `/me/subscriptions/${seg(id)}/cancel`, opts),\n    pauseSubscription: (id) => call('POST', `/me/subscriptions/${seg(id)}/pause`),\n    resumeSubscription: (id) => call('POST', `/me/subscriptions/${seg(id)}/resume`),\n\n    claimCart: (cartId) => call('POST', `/me/carts/${seg(cartId)}/claim`),\n  };\n}\n","import { useCallback, useEffect, useRef, useState } from 'react';\nimport { ThrottleAuthError } from '../errors';\nimport type { Address, AddressInput, Customer, Invoice, Order, PaymentMethod, ProfilePatch, Subscription } from '../types';\nimport type { Page } from '../account';\nimport { useAuth } from './context';\n\nexport interface Resource<T> {\n  data: T;\n  isLoading: boolean;\n  error: ThrottleAuthError | null;\n  refetch(): Promise<void>;\n}\n\nfunction asError(err: unknown): ThrottleAuthError {\n  if (err instanceof ThrottleAuthError) return err;\n  const anyErr = err as any;\n  return new ThrottleAuthError({\n    code: anyErr?.code ?? 'request_failed',\n    message: anyErr?.message ?? String(err),\n    statusCode: anyErr?.statusCode ?? 0,\n  });\n}\n\n/**\n * One fetch-on-auth-change primitive behind every resource hook. `emailVerified`\n * is a dependency on purpose: verifying lifts the claim cutoff, and lists that\n * were legitimately empty a moment ago are not empty any more.\n */\nfunction useResource<T>(empty: T, load: () => Promise<T>, deps: unknown[]): Resource<T> {\n  const { status, emailVerified } = useAuth();\n  const [data, setData] = useState<T>(empty);\n  const [isLoading, setIsLoading] = useState(status === 'loading');\n  const [error, setError] = useState<ThrottleAuthError | null>(null);\n  const gen = useRef(0);\n  const alive = useRef(true);\n\n  useEffect(() => {\n    // Set on mount, not only cleared on unmount: React StrictMode mounts,\n    // unmounts and remounts in development, and a ref that is only ever set\n    // to false would silently discard every response for the rest of the\n    // component's life.\n    alive.current = true;\n    return () => { alive.current = false; gen.current++; };\n  }, []);\n\n  const refetch = useCallback(async () => {\n    const mine = ++gen.current;\n    setIsLoading(true);\n    try {\n      const next = await load();\n      if (!alive.current || gen.current !== mine) return;\n      setData(next);\n      setError(null);\n    } catch (err) {\n      if (!alive.current || gen.current !== mine) return;\n      setError(asError(err));\n    } finally {\n      if (alive.current && gen.current === mine) setIsLoading(false);\n    }\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, deps);\n\n  useEffect(() => {\n    if (status !== 'authenticated') {\n      gen.current++;               // abandon anything in flight\n      setData(empty);\n      setError(null);\n      setIsLoading(status === 'loading');\n      return;\n    }\n    void refetch();\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [status, emailVerified, refetch]);\n\n  return { data, isLoading, error, refetch };\n}\n\nexport function useCustomer(): Resource<Customer | null> & { update(patch: ProfilePatch): Promise<void> } {\n  const { account } = useAuth();\n  const res = useResource<Customer | null>(null, () => account.getProfile(), [account]);\n  const update = useCallback(async (patch: ProfilePatch) => {\n    await account.updateProfile(patch);\n    await res.refetch();\n  }, [account, res]);\n  return { ...res, update };\n}\n\nexport function useAddresses(): Resource<Address[]> & {\n  create(input: AddressInput): Promise<void>;\n  update(id: string, patch: Partial<AddressInput>): Promise<void>;\n  remove(id: string): Promise<void>;\n} {\n  const { account } = useAuth();\n  const res = useResource<Address[]>([], () => account.listAddresses(), [account]);\n  const after = async (p: Promise<unknown>) => { await p; await res.refetch(); };\n  return {\n    ...res,\n    create: (input) => after(account.createAddress(input)),\n    update: (id, patch) => after(account.updateAddress(id, patch)),\n    remove: (id) => after(account.deleteAddress(id)),\n  };\n}\n\nexport function useSavedCards(): Resource<PaymentMethod[]> & {\n  setDefault(id: string): Promise<void>;\n  remove(id: string): Promise<void>;\n} {\n  const { account } = useAuth();\n  const res = useResource<PaymentMethod[]>([], () => account.listPaymentMethods(), [account]);\n  const after = async (p: Promise<unknown>) => { await p; await res.refetch(); };\n  return {\n    ...res,\n    setDefault: (id) => after(account.setDefaultPaymentMethod(id)),\n    remove: (id) => after(account.deletePaymentMethod(id)),\n  };\n}\n\nexport function useOrders(page?: Page): Resource<Order[]> {\n  const { account } = useAuth();\n  return useResource<Order[]>([], () => account.listOrders(page), [account, page?.cursor, page?.limit]);\n}\n\nexport function useInvoices(page?: Page): Resource<Invoice[]> {\n  const { account } = useAuth();\n  return useResource<Invoice[]>([], () => account.listInvoices(page), [account, page?.cursor, page?.limit]);\n}\n\nexport function useSubscriptions(page?: Page): Resource<Subscription[]> & {\n  cancel(id: string, opts?: { atPeriodEnd?: boolean }): Promise<void>;\n  pause(id: string): Promise<void>;\n  resume(id: string): Promise<void>;\n} {\n  const { account } = useAuth();\n  const res = useResource<Subscription[]>([], () => account.listSubscriptions(page),\n    [account, page?.cursor, page?.limit]);\n  const after = async (p: Promise<unknown>) => { await p; await res.refetch(); };\n  return {\n    ...res,\n    cancel: (id, opts) => after(account.cancelSubscription(id, opts)),\n    pause: (id) => after(account.pauseSubscription(id)),\n    resume: (id) => after(account.resumeSubscription(id)),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,mBAA4F;;;ACArF,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAAqG;AAC/G,UAAM,KAAK,OAAO;AAClB,SAAK,OAAO;AACZ,SAAK,OAAO,KAAK;AACjB,SAAK,aAAa,KAAK;AACvB,SAAK,aAAa,KAAK;AACvB,SAAK,UAAU,KAAK;AAAA,EACtB;AACF;;;ACDA,eAAsB,QAAQ,OAAmC;AAC/D,QAAM,UAAkC,EAAE,aAAa,MAAM,eAAe;AAC5E,MAAI,MAAM,SAAS,OAAW,SAAQ,cAAc,IAAI;AACxD,MAAI,MAAM,YAAa,SAAQ,gBAAgB,UAAU,MAAM,WAAW;AAC1E,MAAI,MAAM,YAAa,SAAQ,WAAW,IAAI,MAAM;AAEpD,QAAM,MAAM,MAAM,MAAM,GAAG,MAAM,OAAO,iBAAiB,MAAM,IAAI,IAAI;AAAA,IACrE,QAAQ,MAAM;AAAA,IACd;AAAA,IACA,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,KAAK,UAAU,MAAM,IAAI,EAAE,IAAI,CAAC;AAAA,EACzE,CAAC;AAED,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,MAAI,SAAc,CAAC;AACnB,MAAI;AACF,aAAS,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC;AAAA,EACtC,QAAQ;AAAA,EAGR;AAEA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,QAAQ,SAAS,CAAC;AAG5B,UAAM,KAAK,OAAO,IAAI,QAAQ,IAAI,aAAa,CAAC;AAChD,UAAM,IAAI,kBAAkB;AAAA,MAC1B,MAAM,EAAE,QAAQ;AAAA,MAChB,SAAS,EAAE,WAAW,uBAAuB,IAAI,MAAM;AAAA,MACvD,YAAY,IAAI;AAAA,MAChB,YAAY,OAAO,SAAS,EAAE,KAAK,MAAM,IAAI,KAAK;AAAA,MAClD,SAAS,EAAE;AAAA,IACb,CAAC;AAAA,EACH;AAKA,SAAO,UAAU,OAAO,WAAW,YAAY,UAAU,SAAS,OAAO,OAAQ,UAAU,CAAC;AAC9F;;;AClCO,IAAM,eAAN,MAAmB;AAAA,EACxB,YAA0B,EAAE,QAAQ,WAAW,UAAU,MAAM,eAAe,MAAM;AAAA,EACpF,eAA8B;AAAA,EAC9B,aAA4B;AAAA,EAC5B,aAAa,oBAAI,IAAc;AAAA,EAE/B,MAAoB;AAAE,WAAO,KAAK;AAAA,EAAW;AAAA,EAC7C,cAA6B;AAAE,WAAO,KAAK;AAAA,EAAc;AAAA,EACzD,YAA2B;AAAE,WAAO,KAAK;AAAA,EAAY;AAAA,EAErD,WAAW,SAAwB;AACjC,SAAK,eAAe,QAAQ;AAC5B,SAAK,aAAa,KAAK,MAAM,QAAQ,SAAS;AAC9C,SAAK,SAAS;AAAA,MACZ,QAAQ;AAAA,MACR,UAAU,QAAQ;AAAA,MAClB,eAAe,QAAQ,QAAQ,UAAU,aAAa;AAAA,IACxD,CAAC;AAAA,EACH;AAAA,EAEA,UAAU,QAA0B;AAClC,SAAK,SAAS,EAAE,GAAG,KAAK,WAAW,OAAO,CAAC;AAAA,EAC7C;AAAA,EAEA,QAAc;AACZ,SAAK,eAAe;AACpB,SAAK,aAAa;AAClB,SAAK,SAAS,EAAE,QAAQ,mBAAmB,UAAU,MAAM,eAAe,MAAM,CAAC;AAAA,EACnF;AAAA,EAEA,UAAU,IAA0B;AAClC,SAAK,WAAW,IAAI,EAAE;AACtB,WAAO,MAAM;AAAE,WAAK,WAAW,OAAO,EAAE;AAAA,IAAG;AAAA,EAC7C;AAAA,EAEA,SAAS,MAA0B;AAIjC,UAAM,OACJ,KAAK,WAAW,KAAK,UAAU,UAC/B,KAAK,kBAAkB,KAAK,UAAU,iBACtC,eAAe,KAAK,UAAU,KAAK,UAAU,QAAQ;AACvD,QAAI,KAAM;AACV,SAAK,YAAY;AACjB,eAAW,MAAM,CAAC,GAAG,KAAK,UAAU,GAAG;AAErC,UAAI;AAAE,WAAG,IAAI;AAAA,MAAG,QAAQ;AAAA,MAA0B;AAAA,IACpD;AAAA,EACF;AACF;AAEA,SAAS,eAAe,GAAoB,GAA6B;AACvE,MAAI,MAAM,EAAG,QAAO;AACpB,MAAI,CAAC,KAAK,CAAC,EAAG,QAAO;AACrB,QAAM,OAAO,oBAAI,IAAI,CAAC,GAAG,OAAO,KAAK,CAAC,GAAG,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC;AAC3D,aAAW,KAAK,KAAM,KAAI,EAAE,CAAC,MAAM,EAAE,CAAC,EAAG,QAAO;AAChD,SAAO;AACT;;;ACxEO,SAAS,gBAA6B;AAC3C,QAAM,MAAM,oBAAI,IAAoB;AACpC,SAAO;AAAA,IACL,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK;AAAA,IAC1B,KAAK,CAAC,GAAG,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC;AAAA,IAChC,QAAQ,CAAC,MAAM,KAAK,IAAI,OAAO,CAAC;AAAA,EAClC;AACF;AAOO,SAAS,sBAAmC;AACjD,QAAM,WAAW,cAAc;AAC/B,QAAM,KAAK,MAAsB;AAC/B,QAAI;AACF,aAAO,OAAO,iBAAiB,cAAc,eAAe;AAAA,IAC9D,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AAAA,IACL,IAAI,GAAG;AACL,UAAI;AACF,cAAM,IAAI,GAAG,GAAG,QAAQ,CAAC;AACzB,YAAI,KAAK,KAAM,QAAO;AAAA,MACxB,QAAQ;AAAA,MAAqB;AAC7B,aAAO,SAAS,IAAI,CAAC;AAAA,IACvB;AAAA,IACA,IAAI,GAAG,GAAG;AACR,eAAS,IAAI,GAAG,CAAC;AACjB,UAAI;AAAE,WAAG,GAAG,QAAQ,GAAG,CAAC;AAAA,MAAG,QAAQ;AAAA,MAAiC;AAAA,IACtE;AAAA,IACA,OAAO,GAAG;AACR,eAAS,OAAO,CAAC;AACjB,UAAI;AAAE,WAAG,GAAG,WAAW,CAAC;AAAA,MAAG,QAAQ;AAAA,MAAqB;AAAA,IAC1D;AAAA,EACF;AACF;;;ACtCA,IAAM,mBAAmB;AAEzB,IAAM,kBAAkB;AA8BjB,SAAS,mBAAmB,QAA0C;AAC3E,QAAM,WAAW,OAAO,WAAW,kBAAkB,QAAQ,OAAO,EAAE;AACtE,QAAM,UAAuB,OAAO,WAAW,oBAAoB;AAGnE,QAAM,aAAa,oBAAoB,OAAO,cAAc;AAC5D,QAAM,WAAW,yBAAyB,OAAO,cAAc;AAE/D,QAAM,QAAQ,IAAI,aAAa;AAC/B,MAAI,kBAAwC;AAC5C,MAAI,cAA6B;AACjC,MAAI,kBAAkB;AAEtB,QAAM,OAAO,EAAE,SAAS,gBAAgB,OAAO,eAAe;AAE9D,iBAAe,QAAQ,SAAiC;AACtD,UAAM,WAAW,OAAO;AACxB,UAAM,QAAQ,IAAI,YAAY,QAAQ,YAAY;AAAA,EACpD;AAEA,iBAAe,SAAwB;AACrC,kBAAc;AACd,UAAM,MAAM;AACZ,UAAM,QAAQ,OAAO,UAAU;AAAA,EACjC;AAQA,WAAS,SAAY,IAAkC;AACrD,UAAM,QAAS,WAAmB,WAAW;AAC7C,WAAO,OAAO,UAAU,MAAM,QAAQ,UAAU,EAAE,IAAI,GAAG;AAAA,EAC3D;AAEA,iBAAe,YAA2B;AACxC,UAAM,SAAS,YAAY;AAGzB,YAAM,eAAe,MAAM,QAAQ,IAAI,UAAU;AACjD,UAAI,CAAC,cAAc;AACjB,cAAM,OAAO;AACb,cAAM,IAAI,kBAAkB,EAAE,MAAM,mBAAmB,SAAS,cAAc,YAAY,IAAI,CAAC;AAAA,MACjG;AACA,UAAI;AACF,cAAM,OAAO,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,iBAAiB,MAAM,EAAE,aAAa,EAAE,CAAC;AACrG,cAAM,QAAQ,IAAe;AAAA,MAC/B,SAAS,KAAK;AAGZ,cAAM,OAAO;AACb,cAAM;AAAA,MACR;AAAA,IACF,CAAC;AAAA,EACH;AAEA,WAAS,UAAyB;AAChC,QAAI,CAAC,iBAAiB;AACpB,wBAAkB,UAAU,EAAE,QAAQ,MAAM;AAAE,0BAAkB;AAAA,MAAM,CAAC;AAAA,IACzE;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,cAAsC;AACnD,UAAM,UAAU,MAAM,UAAU;AAChC,QAAI,MAAM,YAAY,KAAK,WAAW,UAAU,KAAK,IAAI,IAAI,iBAAiB;AAC5E,aAAO,MAAM,YAAY;AAAA,IAC3B;AACA,QAAI,MAAM,QAAQ,IAAI,UAAU,GAAG;AACjC,YAAM,QAAQ;AACd,aAAO,MAAM,YAAY;AAAA,IAC3B;AACA,WAAO,MAAM,YAAY;AAAA,EAC3B;AAEA,iBAAe,eAAiC;AAC9C,QAAI,eAAe,kBAAkB,KAAK,IAAI,EAAG,QAAO;AACxD,QAAI,CAAC,OAAO,iBAAkB,QAAO;AACrC,UAAM,WAAW,MAAM,OAAO,iBAAiB;AAC/C,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,OAAO,QAAQ;AACrB,WAAO;AAAA,EACT;AAEA,iBAAe,OAAO,UAAiC;AACrD,UAAM,OAAO,MAAM,QAAQ;AAAA,MACzB,GAAG;AAAA,MAAM,QAAQ;AAAA,MAAQ,MAAM;AAAA,MAC/B,aAAa,MAAM,YAAY,KAAK;AAAA,MAAW,MAAM,EAAE,SAAS;AAAA,IAClE,CAAC;AACD,kBAAc,KAAK;AACnB,sBAAkB,KAAK,IAAI,KAAK,OAAO,KAAK,SAAS,KAAK,OAAO,MAAO;AAAA,EAC1E;AAEA,iBAAe,KAAc,QAAgB,MAAc,MAA4B;AACrF,QAAI,cAAc;AAClB,QAAI,gBAAgB;AAEpB,eAAS;AACP,YAAM,QAAQ,MAAM,YAAY;AAChC,UAAI;AACF,eAAO,MAAM,QAAQ;AAAA,UACnB,GAAG;AAAA,UAAM;AAAA,UAAQ;AAAA,UAAM;AAAA,UACvB,aAAa,SAAS;AAAA,UACtB,aAAa,eAAe;AAAA,QAC9B,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,cAAM,IAAI;AAOV,cAAM,UAAU,EAAE,eAAe,QAC9B,EAAE,SAAS,kBAAkB,EAAE,SAAS,mBAAmB,EAAE,SAAS;AACzE,YAAI,WAAW,CAAC,aAAa;AAC3B,wBAAc;AACd,gBAAM,QAAQ;AACd;AAAA,QACF;AACA,YAAI,EAAE,SAAS,sBAAsB,CAAC,eAAe;AACnD,0BAAgB;AAChB,wBAAc;AACd,cAAI,MAAM,aAAa,EAAG;AAAA,QAC5B;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,SAAS,OAAO,UAAU;AAC9B,YAAM,OAAO,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,kBAAkB,MAAM,EAAE,OAAO,SAAS,EAAE,CAAC;AACzG,UAAI,MAAM,WAAW,UAAW,QAAO,EAAE,QAAQ,UAAU;AAC3D,YAAM,QAAQ,IAAe;AAC7B,aAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IAEA,MAAM,OAAO,OAAO,UAAU;AAC5B,YAAM,OAAO,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,eAAe,MAAM,EAAE,OAAO,SAAS,EAAE,CAAC;AACtG,YAAM,QAAQ,IAAe;AAAA,IAC/B;AAAA,IAEA,MAAM,UAAU;AACd,UAAI;AAAE,cAAM,KAAK,QAAQ,cAAc;AAAA,MAAG,QAAQ;AAAA,MAA+B;AACjF,YAAM,OAAO;AAAA,IACf;AAAA,IAEA,MAAM,oBAAoB;AACxB,UAAI;AAAE,cAAM,KAAK,QAAQ,kBAAkB;AAAA,MAAG,QAAQ;AAAA,MAA+B;AACrF,YAAM,OAAO;AAAA,IACf;AAAA,IAEA,MAAM,UAAU;AACd,UAAI,CAAE,MAAM,QAAQ,IAAI,UAAU,GAAI;AAAE,cAAM,UAAU,iBAAiB;AAAG;AAAA,MAAQ;AACpF,UAAI;AAAE,cAAM,QAAQ;AAAA,MAAG,QAAQ;AAAA,MAA6B;AAAA,IAC9D;AAAA,IAEA,aAAa,MAAM,MAAM,IAAI;AAAA,IAC7B,WAAW,CAAC,OAAO,MAAM,UAAU,EAAE;AAAA,IACrC;AAAA,IACA;AAAA,IAEA,MAAM,YAAY,OAAO;AACvB,YAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,sBAAsB,MAAM,EAAE,MAAM,EAAE,CAAC;AAKtF,UAAI,MAAM,QAAQ,IAAI,UAAU,GAAG;AACjC,YAAI;AAAE,gBAAM,QAAQ;AAAA,QAAG,QAAQ;AAAA,QAAqC;AAAA,MACtE;AAAA,IACF;AAAA,IAEA,MAAM,qBAAqB;AACzB,YAAM,KAAK,QAAQ,2BAA2B;AAAA,IAChD;AAAA,IAEA,MAAM,eAAe,OAAO;AAG1B,YAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,yBAAyB,MAAM,EAAE,MAAM,EAAE,CAAC;AAAA,IAC3F;AAAA,IAEA,MAAM,cAAc,OAAO,UAAU;AACnC,YAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,wBAAwB,MAAM,EAAE,OAAO,SAAS,EAAE,CAAC;AAElG,YAAM,OAAO;AAAA,IACf;AAAA,IAEA,MAAM,eAAe,UAAU;AAC7B,YAAM,KAAK,QAAQ,uBAAuB,EAAE,SAAS,CAAC;AAMtD,UAAI;AAAE,cAAM,QAAQ;AAAA,MAAG,QAAQ;AAAA,MAA8C;AAAA,IAC/E;AAAA,IAEA,MAAM,eAAe;AACnB,aAAO,KAAsB,OAAO,cAAc;AAAA,IACpD;AAAA,IAEA,MAAM,cAAc,IAAI;AACtB,YAAM,OAAO,MAAM,KAAsB,OAAO,cAAc;AAC9D,YAAM,UAAU,KAAK,KAAK,CAAC,MAAM,EAAE,OAAO;AAC1C,YAAM,KAAK,UAAU,gBAAgB,mBAAmB,EAAE,CAAC,EAAE;AAC7D,UAAI,SAAS,OAAO,GAAI,OAAM,OAAO;AAAA,IACvC;AAAA,EACF;AACF;;;AC7NA,IAAM,MAAM,CAAC,MAAc,mBAAmB,CAAC;AAE/C,SAAS,MAAM,MAAqB;AAClC,QAAM,SAAS,IAAI,gBAAgB;AACnC,MAAI,MAAM,OAAQ,QAAO,IAAI,UAAU,KAAK,MAAM;AAClD,MAAI,MAAM,SAAS,KAAM,QAAO,IAAI,SAAS,OAAO,KAAK,KAAK,CAAC;AAC/D,QAAM,IAAI,OAAO,SAAS;AAC1B,SAAO,IAAI,IAAI,CAAC,KAAK;AACvB;AAEO,SAAS,cAAc,MAAqC;AACjE,QAAM,EAAE,KAAK,IAAI;AACjB,SAAO;AAAA,IACL,YAAY,MAAM,KAAK,OAAO,KAAK;AAAA,IACnC,eAAe,CAAC,UAAU,KAAK,SAAS,OAAO,KAAK;AAAA,IAEpD,eAAe,MAAM,KAAK,OAAO,eAAe;AAAA,IAChD,eAAe,CAAC,UAAU,KAAK,QAAQ,iBAAiB,KAAK;AAAA,IAC7D,eAAe,CAAC,IAAI,UAAU,KAAK,SAAS,iBAAiB,IAAI,EAAE,CAAC,IAAI,KAAK;AAAA,IAC7E,eAAe,CAAC,OAAO,KAAK,UAAU,iBAAiB,IAAI,EAAE,CAAC,EAAE;AAAA,IAEhE,oBAAoB,MAAM,KAAK,OAAO,qBAAqB;AAAA;AAAA;AAAA,IAG3D,yBAAyB,CAAC,OAAO,KAAK,SAAS,uBAAuB,IAAI,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,CAAC;AAAA,IACpG,qBAAqB,CAAC,OAAO,KAAK,UAAU,uBAAuB,IAAI,EAAE,CAAC,EAAE;AAAA,IAE5E,YAAY,CAAC,SAAS,KAAK,OAAO,aAAa,MAAM,IAAI,CAAC,EAAE;AAAA,IAC5D,UAAU,CAAC,OAAO,KAAK,OAAO,cAAc,IAAI,EAAE,CAAC,EAAE;AAAA,IACrD,cAAc,CAAC,SAAS,KAAK,OAAO,eAAe,MAAM,IAAI,CAAC,EAAE;AAAA,IAChE,YAAY,CAAC,OAAO,KAAK,OAAO,gBAAgB,IAAI,EAAE,CAAC,EAAE;AAAA,IACzD,mBAAmB,CAAC,SAAS,KAAK,OAAO,oBAAoB,MAAM,IAAI,CAAC,EAAE;AAAA,IAC1E,iBAAiB,CAAC,OAAO,KAAK,OAAO,qBAAqB,IAAI,EAAE,CAAC,EAAE;AAAA,IAEnE,oBAAoB,CAAC,IAAI,SAAS,KAAK,QAAQ,qBAAqB,IAAI,EAAE,CAAC,WAAW,IAAI;AAAA,IAC1F,mBAAmB,CAAC,OAAO,KAAK,QAAQ,qBAAqB,IAAI,EAAE,CAAC,QAAQ;AAAA,IAC5E,oBAAoB,CAAC,OAAO,KAAK,QAAQ,qBAAqB,IAAI,EAAE,CAAC,SAAS;AAAA,IAE9E,WAAW,CAAC,WAAW,KAAK,QAAQ,aAAa,IAAI,MAAM,CAAC,QAAQ;AAAA,EACtE;AACF;;;AN7BS;AAzBT,IAAM,UAAM,4BAAmC,IAAI;AAE5C,SAAS,qBAAqB,OAAkC;AACrE,QAAM,EAAE,MAAM,UAAU,gBAAgB,SAAS,SAAS,kBAAkB,SAAS,IAAI;AAMzF,QAAM,YAAQ,sBAAsB,MAAM;AACxC,UAAM,OAAO,YAAY,mBAAmB,EAAE,gBAAgB,SAAS,SAAS,iBAAiB,CAAC;AAClG,WAAO,EAAE,MAAM,SAAS,cAAc,IAAI,EAAE;AAAA,EAE9C,GAAG,CAAC,UAAU,gBAAgB,OAAO,CAAC;AAEtC,QAAM,eAAW,qBAA4B,IAAI;AACjD,8BAAU,MAAM;AAId,QAAI,SAAS,YAAY,MAAM,KAAM;AACrC,aAAS,UAAU,MAAM;AACzB,SAAK,MAAM,KAAK,QAAQ;AAAA,EAC1B,GAAG,CAAC,KAAK,CAAC;AAEV,SAAO,4CAAC,IAAI,UAAJ,EAAa,OAAe,UAAS;AAC/C;AAEA,SAAS,SAAuB;AAC9B,QAAM,UAAM,yBAAW,GAAG;AAC1B,MAAI,CAAC,IAAK,OAAM,IAAI,MAAM,sDAAsD;AAChF,SAAO;AACT;AAEO,SAAS,iBAA+B;AAAE,SAAO,OAAO;AAAG;AAS3D,SAAS,UAAyB;AACvC,QAAM,EAAE,MAAM,QAAQ,IAAI,OAAO;AACjC,QAAM,eAAW,mCAAqB,KAAK,WAAW,KAAK,aAAa,KAAK,WAAW;AACxF,SAAO;AAAA,IACL,GAAG;AAAA,IACH,WAAW,SAAS,WAAW;AAAA,IAC/B,iBAAiB,SAAS,WAAW;AAAA,IACrC;AAAA,IACA;AAAA,EACF;AACF;;;AOrEA,IAAAA,gBAAyD;AAazD,SAAS,QAAQ,KAAiC;AAChD,MAAI,eAAe,kBAAmB,QAAO;AAC7C,QAAM,SAAS;AACf,SAAO,IAAI,kBAAkB;AAAA,IAC3B,MAAM,QAAQ,QAAQ;AAAA,IACtB,SAAS,QAAQ,WAAW,OAAO,GAAG;AAAA,IACtC,YAAY,QAAQ,cAAc;AAAA,EACpC,CAAC;AACH;AAOA,SAAS,YAAe,OAAU,MAAwB,MAA8B;AACtF,QAAM,EAAE,QAAQ,cAAc,IAAI,QAAQ;AAC1C,QAAM,CAAC,MAAM,OAAO,QAAI,wBAAY,KAAK;AACzC,QAAM,CAAC,WAAW,YAAY,QAAI,wBAAS,WAAW,SAAS;AAC/D,QAAM,CAAC,OAAO,QAAQ,QAAI,wBAAmC,IAAI;AACjE,QAAM,UAAM,sBAAO,CAAC;AACpB,QAAM,YAAQ,sBAAO,IAAI;AAEzB,+BAAU,MAAM;AAKd,UAAM,UAAU;AAChB,WAAO,MAAM;AAAE,YAAM,UAAU;AAAO,UAAI;AAAA,IAAW;AAAA,EACvD,GAAG,CAAC,CAAC;AAEL,QAAM,cAAU,2BAAY,YAAY;AACtC,UAAM,OAAO,EAAE,IAAI;AACnB,iBAAa,IAAI;AACjB,QAAI;AACF,YAAM,OAAO,MAAM,KAAK;AACxB,UAAI,CAAC,MAAM,WAAW,IAAI,YAAY,KAAM;AAC5C,cAAQ,IAAI;AACZ,eAAS,IAAI;AAAA,IACf,SAAS,KAAK;AACZ,UAAI,CAAC,MAAM,WAAW,IAAI,YAAY,KAAM;AAC5C,eAAS,QAAQ,GAAG,CAAC;AAAA,IACvB,UAAE;AACA,UAAI,MAAM,WAAW,IAAI,YAAY,KAAM,cAAa,KAAK;AAAA,IAC/D;AAAA,EAEF,GAAG,IAAI;AAEP,+BAAU,MAAM;AACd,QAAI,WAAW,iBAAiB;AAC9B,UAAI;AACJ,cAAQ,KAAK;AACb,eAAS,IAAI;AACb,mBAAa,WAAW,SAAS;AACjC;AAAA,IACF;AACA,SAAK,QAAQ;AAAA,EAEf,GAAG,CAAC,QAAQ,eAAe,OAAO,CAAC;AAEnC,SAAO,EAAE,MAAM,WAAW,OAAO,QAAQ;AAC3C;AAEO,SAAS,cAA0F;AACxG,QAAM,EAAE,QAAQ,IAAI,QAAQ;AAC5B,QAAM,MAAM,YAA6B,MAAM,MAAM,QAAQ,WAAW,GAAG,CAAC,OAAO,CAAC;AACpF,QAAM,aAAS,2BAAY,OAAO,UAAwB;AACxD,UAAM,QAAQ,cAAc,KAAK;AACjC,UAAM,IAAI,QAAQ;AAAA,EACpB,GAAG,CAAC,SAAS,GAAG,CAAC;AACjB,SAAO,EAAE,GAAG,KAAK,OAAO;AAC1B;AAEO,SAAS,eAId;AACA,QAAM,EAAE,QAAQ,IAAI,QAAQ;AAC5B,QAAM,MAAM,YAAuB,CAAC,GAAG,MAAM,QAAQ,cAAc,GAAG,CAAC,OAAO,CAAC;AAC/E,QAAM,QAAQ,OAAO,MAAwB;AAAE,UAAM;AAAG,UAAM,IAAI,QAAQ;AAAA,EAAG;AAC7E,SAAO;AAAA,IACL,GAAG;AAAA,IACH,QAAQ,CAAC,UAAU,MAAM,QAAQ,cAAc,KAAK,CAAC;AAAA,IACrD,QAAQ,CAAC,IAAI,UAAU,MAAM,QAAQ,cAAc,IAAI,KAAK,CAAC;AAAA,IAC7D,QAAQ,CAAC,OAAO,MAAM,QAAQ,cAAc,EAAE,CAAC;AAAA,EACjD;AACF;AAEO,SAAS,gBAGd;AACA,QAAM,EAAE,QAAQ,IAAI,QAAQ;AAC5B,QAAM,MAAM,YAA6B,CAAC,GAAG,MAAM,QAAQ,mBAAmB,GAAG,CAAC,OAAO,CAAC;AAC1F,QAAM,QAAQ,OAAO,MAAwB;AAAE,UAAM;AAAG,UAAM,IAAI,QAAQ;AAAA,EAAG;AAC7E,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY,CAAC,OAAO,MAAM,QAAQ,wBAAwB,EAAE,CAAC;AAAA,IAC7D,QAAQ,CAAC,OAAO,MAAM,QAAQ,oBAAoB,EAAE,CAAC;AAAA,EACvD;AACF;AAEO,SAAS,UAAU,MAAgC;AACxD,QAAM,EAAE,QAAQ,IAAI,QAAQ;AAC5B,SAAO,YAAqB,CAAC,GAAG,MAAM,QAAQ,WAAW,IAAI,GAAG,CAAC,SAAS,MAAM,QAAQ,MAAM,KAAK,CAAC;AACtG;AAEO,SAAS,YAAY,MAAkC;AAC5D,QAAM,EAAE,QAAQ,IAAI,QAAQ;AAC5B,SAAO,YAAuB,CAAC,GAAG,MAAM,QAAQ,aAAa,IAAI,GAAG,CAAC,SAAS,MAAM,QAAQ,MAAM,KAAK,CAAC;AAC1G;AAEO,SAAS,iBAAiB,MAI/B;AACA,QAAM,EAAE,QAAQ,IAAI,QAAQ;AAC5B,QAAM,MAAM;AAAA,IAA4B,CAAC;AAAA,IAAG,MAAM,QAAQ,kBAAkB,IAAI;AAAA,IAC9E,CAAC,SAAS,MAAM,QAAQ,MAAM,KAAK;AAAA,EAAC;AACtC,QAAM,QAAQ,OAAO,MAAwB;AAAE,UAAM;AAAG,UAAM,IAAI,QAAQ;AAAA,EAAG;AAC7E,SAAO;AAAA,IACL,GAAG;AAAA,IACH,QAAQ,CAAC,IAAI,SAAS,MAAM,QAAQ,mBAAmB,IAAI,IAAI,CAAC;AAAA,IAChE,OAAO,CAAC,OAAO,MAAM,QAAQ,kBAAkB,EAAE,CAAC;AAAA,IAClD,QAAQ,CAAC,OAAO,MAAM,QAAQ,mBAAmB,EAAE,CAAC;AAAA,EACtD;AACF;","names":["import_react"]}

package/dist/react/index.js

@@ -3,14 +3,14 @@ import {
   ThrottleAuthProvider,
   useAuth,
   useAuthContext
-} from "../chunk-YHIGTY64.js";
+} from "../chunk-IJ3DNMNG.js";
 import {
   ThrottleAuthError,
   createAccount,
   createThrottleAuth,
   localStorageAdapter,
   memoryStorage
-} from "../chunk-NQU7HM23.js";
+} from "../chunk-OYNGTNOS.js";
 
 // src/react/hooks.ts
 import { useCallback, useEffect, useRef, useState } from "react";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usethrottle/auth",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Buyer authentication for Throttle storefronts — headless core, React hooks, and drop-in forms.",
   "type": "module",
   "main": "./dist/index.cjs",

package/dist/chunk-YHIGTY64.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/react/context.tsx"],"sourcesContent":["import { createContext, useContext, useEffect, useMemo, useRef, useSyncExternalStore } from 'react';\nimport type { ReactNode } from 'react';\nimport { createThrottleAuth, type ThrottleAuth } from '../client';\nimport { createAccount, type ThrottleAccount } from '../account';\nimport type { AuthSnapshot } from '../session';\nimport type { ThrottleAuthConfig } from '../types';\n\nexport interface ThrottleAuthProviderProps extends Partial<ThrottleAuthConfig> {\n  publishableKey: string;\n  /** Inject a pre-built client. Tests use it; merchants sharing one client across roots may too. */\n  auth?: ThrottleAuth;\n  children: ReactNode;\n}\n\ninterface ContextValue { auth: ThrottleAuth; account: ThrottleAccount }\n\nconst Ctx = createContext<ContextValue | null>(null);\n\nexport function ThrottleAuthProvider(props: ThrottleAuthProviderProps) {\n  const { auth: injected, publishableKey, baseUrl, storage, onStepUpRequired, children } = props;\n\n  const value = useMemo<ContextValue>(() => {\n    const auth = injected ?? createThrottleAuth({ publishableKey, baseUrl, storage, onStepUpRequired });\n    return { auth, account: createAccount(auth) };\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [injected, publishableKey, baseUrl, storage]);\n\n  const restored = useRef<ThrottleAuth | null>(null);\n  useEffect(() => {\n    // Once per client. StrictMode runs effects twice in development, and a\n    // second restore() would present the refresh token that the first one\n    // just rotated away.\n    if (restored.current === value.auth) return;\n    restored.current = value.auth;\n    void value.auth.restore();\n  }, [value]);\n\n  return <Ctx.Provider value={value}>{children}</Ctx.Provider>;\n}\n\nfunction useCtx(): ContextValue {\n  const ctx = useContext(Ctx);\n  if (!ctx) throw new Error('useAuth must be used inside a <ThrottleAuthProvider>');\n  return ctx;\n}\n\nexport function useAuthContext(): ContextValue { return useCtx(); }\n\nexport type UseAuthResult = AuthSnapshot & {\n  isLoading: boolean;\n  isAuthenticated: boolean;\n  auth: ThrottleAuth;\n  account: ThrottleAccount;\n};\n\nexport function useAuth(): UseAuthResult {\n  const { auth, account } = useCtx();\n  const snapshot = useSyncExternalStore(auth.subscribe, auth.getSnapshot, auth.getSnapshot);\n  return {\n    ...snapshot,\n    isLoading: snapshot.status === 'loading',\n    isAuthenticated: snapshot.status === 'authenticated',\n    auth,\n    account,\n  };\n}\n"],"mappings":";;;;;;AAAA,SAAS,eAAe,YAAY,WAAW,SAAS,QAAQ,4BAA4B;AAqCnF;AArBT,IAAM,MAAM,cAAmC,IAAI;AAE5C,SAAS,qBAAqB,OAAkC;AACrE,QAAM,EAAE,MAAM,UAAU,gBAAgB,SAAS,SAAS,kBAAkB,SAAS,IAAI;AAEzF,QAAM,QAAQ,QAAsB,MAAM;AACxC,UAAM,OAAO,YAAY,mBAAmB,EAAE,gBAAgB,SAAS,SAAS,iBAAiB,CAAC;AAClG,WAAO,EAAE,MAAM,SAAS,cAAc,IAAI,EAAE;AAAA,EAE9C,GAAG,CAAC,UAAU,gBAAgB,SAAS,OAAO,CAAC;AAE/C,QAAM,WAAW,OAA4B,IAAI;AACjD,YAAU,MAAM;AAId,QAAI,SAAS,YAAY,MAAM,KAAM;AACrC,aAAS,UAAU,MAAM;AACzB,SAAK,MAAM,KAAK,QAAQ;AAAA,EAC1B,GAAG,CAAC,KAAK,CAAC;AAEV,SAAO,oBAAC,IAAI,UAAJ,EAAa,OAAe,UAAS;AAC/C;AAEA,SAAS,SAAuB;AAC9B,QAAM,MAAM,WAAW,GAAG;AAC1B,MAAI,CAAC,IAAK,OAAM,IAAI,MAAM,sDAAsD;AAChF,SAAO;AACT;AAEO,SAAS,iBAA+B;AAAE,SAAO,OAAO;AAAG;AAS3D,SAAS,UAAyB;AACvC,QAAM,EAAE,MAAM,QAAQ,IAAI,OAAO;AACjC,QAAM,WAAW,qBAAqB,KAAK,WAAW,KAAK,aAAa,KAAK,WAAW;AACxF,SAAO;AAAA,IACL,GAAG;AAAA,IACH,WAAW,SAAS,WAAW;AAAA,IAC/B,iBAAiB,SAAS,WAAW;AAAA,IACrC;AAAA,IACA;AAAA,EACF;AACF;","names":[]}