@usethrottle/auth 0.12.1 → 0.13.0

package/dist/chunk-PTREZIKS.js

@@ -0,0 +1,31 @@
+"use client";
+
+// src/index.ts
+import * as money from "@usethrottle/money";
+import {
+  formatMoney,
+  currencySymbol,
+  minorUnitsOf,
+  toDecimalString,
+  toMinor,
+  parseMoney,
+  moneyValue,
+  CURRENCIES,
+  isKnownCurrency,
+  UnknownCurrencyError
+} from "@usethrottle/money";
+
+export {
+  money,
+  formatMoney,
+  currencySymbol,
+  minorUnitsOf,
+  toDecimalString,
+  toMinor,
+  parseMoney,
+  moneyValue,
+  CURRENCIES,
+  isKnownCurrency,
+  UnknownCurrencyError
+};
+//# sourceMappingURL=chunk-PTREZIKS.js.map

package/dist/chunk-PTREZIKS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export { createThrottleAuth } from './client';\nexport type { ThrottleAuth, DeviceSession } from './client';\nexport { ThrottleAuthError } from './errors';\nexport { memoryStorage, localStorageAdapter } from './storage';\nexport type { AuthSnapshot, AuthStatus } from './session';\nexport type { AuthStorage, Customer, Session, ThrottleAuthConfig } from './types';\nexport { createAccount } from './account';\nexport type { ThrottleAccount, Page } from './account';\nexport type {\n  Address, AddressInput, Invoice, OpenCart, Order, PaymentMethod, ProfilePatch, Subscription,\n  SubscriptionShippingAddress,\n} from './types';\n// Money helpers (MC2-R34). This is money's two-argument `formatMoney`; the\n// `./components` entry keeps its own three-argument one (MC2-R48).\nexport * as money from '@usethrottle/money';\nexport {\n  formatMoney,\n  currencySymbol,\n  minorUnitsOf,\n  toDecimalString,\n  toMinor,\n  parseMoney,\n  moneyValue,\n  CURRENCIES,\n  isKnownCurrency,\n  UnknownCurrencyError,\n} from '@usethrottle/money';\nexport type { CurrencyCode, MoneyValue } from '@usethrottle/money';\n"],"mappings":";;;AAcA,YAAY,WAAW;AACvB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;","names":[]}

package/dist/{chunk-VDK23T6L.js → chunk-X4IZ7RC6.js}

@@ -1,7 +1,7 @@
 "use client";
 import {
   ThrottleUIContext
-} from "./chunk-RCNUWITB.js";
+} from "./chunk-YRJFGH6J.js";
 import {
   AuthModal,
   SignIn,
@@ -227,4 +227,4 @@ export {
   SignInPage,
   SignUpPage
 };
-//# sourceMappingURL=chunk-VDK23T6L.js.map
+//# sourceMappingURL=chunk-X4IZ7RC6.js.map

package/dist/{chunk-RCNUWITB.js → chunk-YRJFGH6J.js}

@@ -543,7 +543,7 @@ function useInjectStyles(enabled) {
 // src/react/components/provider.tsx
 import { jsx, jsxs } from "react/jsx-runtime";
 var loadAuthModal = () => import("./AuthModal-T2GYI6ZF.js").then((m) => ({ default: m.AuthModal }));
-var loadAccountModal = () => import("./AccountModal-KA54WUFW.js").then((m) => ({ default: m.AccountModal }));
+var loadAccountModal = () => import("./AccountModal-4GF7X5X4.js").then((m) => ({ default: m.AccountModal }));
 var AuthModal = lazy(loadAuthModal);
 var AccountModal = lazy(loadAccountModal);
 function resetModal(which) {
@@ -744,4 +744,4 @@ export {
   useThrottle,
   ThrottleProvider
 };
-//# sourceMappingURL=chunk-RCNUWITB.js.map
+//# sourceMappingURL=chunk-YRJFGH6J.js.map

package/dist/{client-7LVKfuXO.d.ts → client-BripyQad.d.ts}

@@ -1,3 +1,5 @@
+import { CurrencyCode } from '@usethrottle/money';
+
 interface Customer {
     id: string;
     email: string;
@@ -85,7 +87,7 @@ interface Order {
     status: string;
     type: string;
     paymentStatus: string;
-    currency: string;
+    currency: CurrencyCode;
     subtotal: number;
     taxTotal: number;
     discountTotal: number;
@@ -162,7 +164,7 @@ interface Invoice {
     id: string;
     number: string;
     status: string;
-    currency: string;
+    currency: CurrencyCode;
     subtotal: number;
     taxTotal: number;
     shippingTotal: number;
@@ -224,7 +226,7 @@ interface Subscription {
     nextPaymentAmount?: number | null;
     amount: number;
     quantity: number;
-    currency: string;
+    currency: CurrencyCode;
     currentPeriodStart: string;
     currentPeriodEnd: string;
     trialEnd: string | null;

package/dist/{hooks-DkpLrEiC.d.ts → hooks-q2sYQa7f.d.ts}

@@ -1,4 +1,4 @@
-import { C as Customer, g as ProfilePatch, A as Address, a as AddressInput, P as PaymentMethod, e as Order, f as OrderDetail, I as Invoice, h as Subscription, i as SubscriptionShippingAddress, O as OpenCart, T as ThrottleAuth } from './client-7LVKfuXO.js';
+import { C as Customer, g as ProfilePatch, A as Address, a as AddressInput, P as PaymentMethod, e as Order, f as OrderDetail, I as Invoice, h as Subscription, i as SubscriptionShippingAddress, O as OpenCart, T as ThrottleAuth } from './client-BripyQad.js';
 
 interface Page {
     cursor?: string;

package/dist/index.cjs

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,16 +17,35 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  CURRENCIES: () => import_money.CURRENCIES,
   ThrottleAuthError: () => ThrottleAuthError,
+  UnknownCurrencyError: () => import_money.UnknownCurrencyError,
   createAccount: () => createAccount,
   createThrottleAuth: () => createThrottleAuth,
+  currencySymbol: () => import_money.currencySymbol,
+  formatMoney: () => import_money.formatMoney,
+  isKnownCurrency: () => import_money.isKnownCurrency,
   localStorageAdapter: () => localStorageAdapter,
-  memoryStorage: () => memoryStorage
+  memoryStorage: () => memoryStorage,
+  minorUnitsOf: () => import_money.minorUnitsOf,
+  money: () => money,
+  moneyValue: () => import_money.moneyValue,
+  parseMoney: () => import_money.parseMoney,
+  toDecimalString: () => import_money.toDecimalString,
+  toMinor: () => import_money.toMinor
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -437,12 +458,27 @@ function createAccount(auth) {
     }
   };
 }
+
+// src/index.ts
+var money = __toESM(require("@usethrottle/money"), 1);
+var import_money = require("@usethrottle/money");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  CURRENCIES,
   ThrottleAuthError,
+  UnknownCurrencyError,
   createAccount,
   createThrottleAuth,
+  currencySymbol,
+  formatMoney,
+  isKnownCurrency,
   localStorageAdapter,
-  memoryStorage
+  memoryStorage,
+  minorUnitsOf,
+  money,
+  moneyValue,
+  parseMoney,
+  toDecimalString,
+  toMinor
 });
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/request.ts","../src/session.ts","../src/storage.ts","../src/client.ts","../src/account.ts"],"sourcesContent":["export { createThrottleAuth } from './client';\nexport type { ThrottleAuth, DeviceSession } from './client';\nexport { ThrottleAuthError } from './errors';\nexport { memoryStorage, localStorageAdapter } from './storage';\nexport type { AuthSnapshot, AuthStatus } from './session';\nexport type { AuthStorage, Customer, Session, ThrottleAuthConfig } from './types';\nexport { createAccount } from './account';\nexport type { ThrottleAccount, Page } from './account';\nexport type {\n  Address, AddressInput, Invoice, OpenCart, Order, PaymentMethod, ProfilePatch, Subscription,\n  SubscriptionShippingAddress,\n} from './types';\n","export class ThrottleAuthError extends Error {\n  readonly code: string;\n  readonly statusCode: number;\n  readonly retryAfter?: number;\n  readonly details?: unknown;\n\n  constructor(args: { code: string; message: string; statusCode: number; retryAfter?: number; details?: unknown }) {\n    super(args.message);\n    this.name = 'ThrottleAuthError';\n    this.code = args.code;\n    this.statusCode = args.statusCode;\n    this.retryAfter = args.retryAfter;\n    this.details = args.details;\n  }\n}\n","import { ThrottleAuthError } from './errors';\n\nexport interface RequestInput {\n  method: string;\n  path: string;\n  baseUrl: string;\n  publishableKey: string;\n  accessToken?: string;\n  stepUpToken?: string;\n  body?: unknown;\n}\n\n/** Returns the UNWRAPPED `data` from the `{ data: … }` envelope. Throws ThrottleAuthError otherwise. */\nexport async function request(input: RequestInput): Promise<any> {\n  const headers: Record<string, string> = { 'X-API-Key': input.publishableKey };\n  if (input.body !== undefined) headers['Content-Type'] = 'application/json';\n  if (input.accessToken) headers.Authorization = `Bearer ${input.accessToken}`;\n  if (input.stepUpToken) headers['X-Step-Up'] = input.stepUpToken;\n\n  const res = await fetch(`${input.baseUrl}/v1/storefront${input.path}`, {\n    method: input.method,\n    headers,\n    ...(input.body !== undefined ? { body: JSON.stringify(input.body) } : {}),\n  });\n\n  const text = await res.text();\n  let parsed: any = {};\n  try {\n    parsed = text ? JSON.parse(text) : {};\n  } catch {\n    // Non-JSON body — an HTML gateway page, say. Leave parsed empty so the\n    // branch below still throws a typed error rather than a raw SyntaxError.\n  }\n\n  if (!res.ok) {\n    const e = parsed?.error ?? {};\n    // `Retry-After` is server-controlled but not trusted: Number('soon') is\n    // NaN, and a NaN reaches the UI as \"wait NaN seconds\".\n    const ra = Number(res.headers.get('retry-after'));\n    throw new ThrottleAuthError({\n      code: e.code ?? 'request_failed',\n      message: e.message ?? `Request failed with ${res.status}`,\n      statusCode: res.status,\n      retryAfter: Number.isFinite(ra) && ra >= 0 ? ra : undefined,\n      details: e.details,\n    });\n  }\n\n  // `'data' in parsed`, not `parsed?.data ?? parsed`: a legitimate\n  // `{ \"data\": null }` is nullish, and `??` would fall through and hand the\n  // caller the whole envelope instead of the null the API actually sent.\n  return parsed && typeof parsed === 'object' && 'data' in parsed ? parsed.data : (parsed ?? {});\n}\n","import type { Customer, Session } from './types';\n\nexport type AuthStatus = 'loading' | 'authenticated' | 'unauthenticated';\n\nexport interface AuthSnapshot {\n  status: AuthStatus;\n  customer: Customer | null;\n  /**\n   * False here does NOT only mean \"we emailed them and they have not clicked\".\n   * While it is false the API may also be withholding pre-existing account\n   * data behind the claim cutoff — empty order lists and a 403 on `PATCH /me`\n   * are expected, not broken. See the plan header.\n   */\n  emailVerified: boolean;\n}\n\ntype Listener = (snapshot: AuthSnapshot) => void;\n\nexport class SessionState {\n  #snapshot: AuthSnapshot = { status: 'loading', customer: null, emailVerified: false };\n  #accessToken: string | null = null;\n  #expiresAt: number | null = null;\n  #listeners = new Set<Listener>();\n\n  get(): AuthSnapshot { return this.#snapshot; }\n  accessToken(): string | null { return this.#accessToken; }\n  expiresAt(): number | null { return this.#expiresAt; }\n\n  setSession(session: Session): void {\n    this.#accessToken = session.accessToken;\n    this.#expiresAt = Date.parse(session.expiresAt);\n    this.#publish({\n      status: 'authenticated',\n      customer: session.customer,\n      emailVerified: Boolean(session.customer?.emailVerified),\n    });\n  }\n\n  setStatus(status: AuthStatus): void {\n    this.#publish({ ...this.#snapshot, status });\n  }\n\n  clear(): void {\n    this.#accessToken = null;\n    this.#expiresAt = null;\n    this.#publish({ status: 'unauthenticated', customer: null, emailVerified: false });\n  }\n\n  subscribe(fn: Listener): () => void {\n    this.#listeners.add(fn);\n    return () => { this.#listeners.delete(fn); };\n  }\n\n  #publish(next: AuthSnapshot): void {\n    // Identity matters: React's useSyncExternalStore re-renders on reference\n    // change, and a token refresh every ten minutes must not re-render the\n    // whole account area when nothing visible changed.\n    const same =\n      next.status === this.#snapshot.status &&\n      next.emailVerified === this.#snapshot.emailVerified &&\n      customerEquals(next.customer, this.#snapshot.customer);\n    if (same) return;\n    this.#snapshot = next;\n    for (const fn of [...this.#listeners]) {\n      // A merchant's subscriber throwing must not stop the rest from hearing.\n      try { fn(next); } catch { /* merchant callback */ }\n    }\n  }\n}\n\nfunction customerEquals(a: Customer | null, b: Customer | null): boolean {\n  if (a === b) return true;\n  if (!a || !b) return false;\n  const keys = new Set([...Object.keys(a), ...Object.keys(b)]) as Set<keyof Customer>;\n  for (const k of keys) if (a[k] !== b[k]) return false;\n  return true;\n}\n","import type { AuthStorage } from './types';\n\nexport type { AuthStorage };\n\nexport function memoryStorage(): AuthStorage {\n  const map = new Map<string, string>();\n  return {\n    get: (k) => map.get(k) ?? null,\n    set: (k, v) => void map.set(k, v),\n    remove: (k) => void map.delete(k),\n  };\n}\n\n/**\n * localStorage when it works, memory when it does not. Safari private mode,\n * hardened browser settings and server-side rendering all make localStorage\n * either absent or throwing; none of them may take the storefront down.\n */\nexport function localStorageAdapter(): AuthStorage {\n  const fallback = memoryStorage();\n  const ls = (): Storage | null => {\n    try {\n      return typeof localStorage !== 'undefined' ? localStorage : null;\n    } catch {\n      return null;\n    }\n  };\n  return {\n    get(k) {\n      try {\n        const v = ls()?.getItem(k);\n        if (v != null) return v;\n      } catch { /* fall through */ }\n      return fallback.get(k);\n    },\n    set(k, v) {\n      fallback.set(k, v);\n      try { ls()?.setItem(k, v); } catch { /* memory-only this session */ }\n    },\n    remove(k) {\n      fallback.remove(k);\n      try { ls()?.removeItem(k); } catch { /* already gone */ }\n    },\n  };\n}\n","import { request } from './request';\nimport { ThrottleAuthError } from './errors';\nimport { SessionState, type AuthSnapshot } from './session';\nimport { localStorageAdapter, type AuthStorage } from './storage';\nimport type { Customer, Session, ThrottleAuthConfig } from './types';\n\nconst DEFAULT_BASE_URL = 'https://api.usethrottle.dev';\n/** Refresh this far before expiry so ordinary calls rarely see a 401 at all. */\nconst REFRESH_SKEW_MS = 30_000;\n\nexport interface DeviceSession {\n  id: string;\n  userAgent: string | null;\n  ipPrefix: string | null;\n  createdAt: string;\n  lastUsedAt: string;\n  current: boolean;\n}\n\nexport interface ThrottleAuth {\n  register(email: string, password: string): Promise<{ status: 'active' | 'pending' }>;\n  signIn(email: string, password: string): Promise<void>;\n  signOut(): Promise<void>;\n  signOutEverywhere(): Promise<void>;\n  restore(): Promise<void>;\n  getSnapshot(): AuthSnapshot;\n  /**\n   * The current access token, refreshed first when it is about to expire\n   * (single-flight, shared with every other caller), or null when signed out.\n   * Rejects when a refresh fails without ending the session (a 5xx, a 429 or\n   * a network error); the buyer stays signed in. `@usethrottle/catalog`\n   * treats a rejection as signed out for that request.\n   * Pass it to `@usethrottle/catalog`'s `customerToken`.\n   */\n  getAccessToken(): Promise<string | null>;\n  subscribe(fn: (s: AuthSnapshot) => void): () => void;\n  stepUp(password: string): Promise<void>;\n  call<T = any>(method: string, path: string, body?: unknown): Promise<T>;\n  verifyEmail(token: string): Promise<void>;\n  resendVerification(): Promise<void>;\n  forgotPassword(email: string): Promise<void>;\n  resetPassword(token: string, password: string): Promise<void>;\n  changePassword(password: string): Promise<void>;\n  listSessions(): Promise<DeviceSession[]>;\n  revokeSession(id: string): Promise<void>;\n  /**\n   * Resolves once any sign-in or registration claim in flight has settled.\n   * `createThrottleAuth` always supplies it (it resolves at once there);\n   * `ThrottleProvider` supplies one that tracks its cart claim. Optional so a\n   * hand-made `ThrottleAuth` written against 0.11 still compiles.\n   */\n  whenClaimSettled?(): Promise<void>;\n}\n\nexport function createThrottleAuth(\n  config: ThrottleAuthConfig,\n): ThrottleAuth & Required<Pick<ThrottleAuth, 'whenClaimSettled'>> {\n  const baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/$/, '');\n  const storage: AuthStorage = config.storage ?? localStorageAdapter();\n  // Namespaced by key so two Throttle applications on one origin cannot read\n  // each other's refresh token out of shared localStorage.\n  const storageKey = `throttle_auth_rt:${config.publishableKey}`;\n  const lockName = `throttle_auth_refresh:${config.publishableKey}`;\n\n  const state = new SessionState();\n  let refreshInFlight: Promise<void> | null = null;\n  let stepUpToken: string | null = null;\n  let stepUpExpiresAt = 0;\n\n  const base = { baseUrl, publishableKey: config.publishableKey };\n\n  async function persist(session: Session): Promise<void> {\n    state.setSession(session);\n    await storage.set(storageKey, session.refreshToken);\n  }\n\n  async function forget(): Promise<void> {\n    stepUpToken = null;\n    state.clear();\n    await storage.remove(storageKey);\n  }\n\n  /**\n   * Cross-tab single flight. Two tabs refreshing at once would each present the\n   * same stored token; the second is a replay, and the server kills the family.\n   * Web Locks serialises them; where it is unavailable the in-process guard\n   * below still covers the common single-tab case.\n   */\n  function withLock<T>(fn: () => Promise<T>): Promise<T> {\n    const locks = (globalThis as any).navigator?.locks;\n    return locks?.request ? locks.request(lockName, fn) : fn();\n  }\n\n  async function doRefresh(): Promise<void> {\n    await withLock(async () => {\n      // Re-read INSIDE the lock: another tab may have rotated while we waited,\n      // and presenting the token we read before the lock would be a replay.\n      const refreshToken = await storage.get(storageKey);\n      if (!refreshToken) {\n        await forget();\n        throw new ThrottleAuthError({ code: 'session_revoked', message: 'No session', statusCode: 401 });\n      }\n      try {\n        const data = await request({ ...base, method: 'POST', path: '/auth/refresh', body: { refreshToken } });\n        await persist(data as Session);\n      } catch (err) {\n        // Drop the stored token ONLY when the server actually refused the\n        // session: 401 session_revoked, or 403 environment_mismatch. Those are\n        // the two the refresh route returns, and there is nothing left to\n        // retry with in either case.\n        //\n        // Everything else keeps the token. `request()` throws a\n        // ThrottleAuthError for EVERY non-2xx, so testing the error class\n        // alone also caught a 502 with an HTML gateway body — a buyer whose\n        // tab refreshed during a rolling deploy was permanently signed out\n        // client-side even though their session was never invalidated. A 429\n        // is the same shape: \"try later\", not \"you are logged out\". And a\n        // fetch() that rejects outright never produces a ThrottleAuthError,\n        // so it was already handled.\n        const refused =\n          err instanceof ThrottleAuthError && (err.statusCode === 401 || err.statusCode === 403);\n        if (refused) await forget();\n        throw err;\n      }\n    });\n  }\n\n  function refresh(): Promise<void> {\n    if (!refreshInFlight) {\n      refreshInFlight = doRefresh().finally(() => { refreshInFlight = null; });\n    }\n    return refreshInFlight;\n  }\n\n  async function accessToken(): Promise<string | null> {\n    const expires = state.expiresAt();\n    if (state.accessToken() && expires && expires - Date.now() > REFRESH_SKEW_MS) {\n      return state.accessToken();\n    }\n    if (await storage.get(storageKey)) {\n      await refresh();\n      return state.accessToken();\n    }\n    return state.accessToken();\n  }\n\n  async function ensureStepUp(): Promise<boolean> {\n    if (stepUpToken && stepUpExpiresAt > Date.now()) return true;\n    if (!config.onStepUpRequired) return false;\n    const password = await config.onStepUpRequired();\n    if (!password) return false;\n    await stepUp(password);\n    return true;\n  }\n\n  async function stepUp(password: string): Promise<void> {\n    const data = await request({\n      ...base, method: 'POST', path: '/auth/step-up',\n      accessToken: await accessToken() ?? undefined, body: { password },\n    });\n    stepUpToken = data.stepUpToken;\n    stepUpExpiresAt = Date.now() + (Number(data.expiresIn) || 300) * 1000 - 5_000;\n  }\n\n  async function call<T = any>(method: string, path: string, body?: unknown): Promise<T> {\n    let retriedAuth = false;\n    let retriedStepUp = false;\n    // Only true on the retry that follows a `step_up_required` 403 — never\n    // attached speculatively. Sending an authorization-grade header on every\n    // request once minted meant it rode along on unrelated calls too, and\n    // cross-origin each of those then failed CORS preflight. The cost is one\n    // extra round trip per gated call, which is how the server signals\n    // step-up in the first place.\n    let sendStepUp = false;\n\n    for (;;) {\n      const token = await accessToken();\n      try {\n        return await request({\n          ...base, method, path, body,\n          accessToken: token ?? undefined,\n          stepUpToken: sendStepUp ? (stepUpToken ?? undefined) : undefined,\n        });\n      } catch (err) {\n        const e = err as ThrottleAuthError;\n        // `session_revoked` belongs here too. The server returns it for a\n        // stale session EPOCH as well as for a genuinely dead session, and a\n        // changed password bumps the epoch while deliberately sparing the\n        // current session — so one refresh recovers it. When the session\n        // really is dead the refresh fails and forget() runs, which is the\n        // same outcome, one request later.\n        const expired = e.statusCode === 401 &&\n          (e.code === 'unauthorized' || e.code === 'token_expired' || e.code === 'session_revoked');\n        if (expired && !retriedAuth) {\n          retriedAuth = true;\n          await refresh();   // shared — ten callers here produce ONE request\n          continue;\n        }\n        if (e.code === 'step_up_required' && !retriedStepUp) {\n          retriedStepUp = true;\n          // ensureStepUp() reuses the cached token when it's still within its\n          // 300s validity (no re-prompt); it was never sent above, so this is\n          // the first the server has seen of it for this call.\n          if (await ensureStepUp()) { sendStepUp = true; continue; }\n        }\n        throw err;\n      }\n    }\n  }\n\n  return {\n    async register(email, password) {\n      const data = await request({ ...base, method: 'POST', path: '/auth/register', body: { email, password } });\n      if (data?.status === 'pending') return { status: 'pending' };\n      await persist(data as Session);\n      return { status: 'active' };\n    },\n\n    async signIn(email, password) {\n      const data = await request({ ...base, method: 'POST', path: '/auth/login', body: { email, password } });\n      await persist(data as Session);\n    },\n\n    async signOut() {\n      try { await call('POST', '/auth/logout'); } catch { /* local state still goes */ }\n      await forget();\n    },\n\n    async signOutEverywhere() {\n      try { await call('POST', '/auth/logout-all'); } catch { /* local state still goes */ }\n      await forget();\n    },\n\n    async restore() {\n      if (!(await storage.get(storageKey))) { state.setStatus('unauthenticated'); return; }\n      try { await refresh(); } catch { /* forget() already ran */ }\n    },\n\n    getSnapshot: () => state.get(),\n\n    async getAccessToken() {\n      try {\n        return await accessToken();\n      } catch (err) {\n        // A refused refresh already ran forget(): the buyer is signed out.\n        // Anything else (a 502, a network error) keeps the session; rethrow.\n        if (state.get().status === 'unauthenticated') return null;\n        throw err;\n      }\n    },\n\n    subscribe: (fn) => state.subscribe(fn),\n    stepUp,\n    call,\n\n    async verifyEmail(token) {\n      await request({ ...base, method: 'POST', path: '/auth/verify-email', body: { token } });\n      // `ver` is a claim baked into the access token, and the claim cutoff is\n      // read from the session row. Without a new token the buyer stays gated —\n      // and their own order history stays hidden — for the rest of this\n      // token's ten minutes.\n      if (await storage.get(storageKey)) {\n        try { await refresh(); } catch { /* verification still succeeded */ }\n      }\n    },\n\n    async resendVerification() {\n      await call('POST', '/auth/verify-email/resend');\n    },\n\n    async forgotPassword(email) {\n      // Always 202, whether or not the address has an account. Do not infer\n      // anything from it and do not tell the buyer whether it existed.\n      await request({ ...base, method: 'POST', path: '/auth/forgot-password', body: { email } });\n    },\n\n    async resetPassword(token, password) {\n      await request({ ...base, method: 'POST', path: '/auth/reset-password', body: { token, password } });\n      // The server revokes every session on reset, this one included.\n      await forget();\n    },\n\n    async changePassword(password) {\n      await call('POST', '/me/change-password', { password });\n      // The change bumps the session epoch. This session was deliberately\n      // spared, but the access token in hand now carries a stale epoch and the\n      // next write would 401. Rotate now rather than on the buyer's next click\n      // — and do not let a failed rotation report a change that already\n      // succeeded server-side as a failure.\n      try { await refresh(); } catch { /* the password change already succeeded */ }\n    },\n\n    async listSessions() {\n      return call<DeviceSession[]>('GET', '/me/sessions');\n    },\n\n    async revokeSession(id) {\n      const mine = await call<DeviceSession[]>('GET', '/me/sessions');\n      const current = mine.find((s) => s.current);\n      await call('DELETE', `/me/sessions/${encodeURIComponent(id)}`);\n      if (current?.id === id) await forget();\n    },\n\n    // The core never claims a cart; `ThrottleProvider` overrides this with one\n    // that tracks its sign-in claim.\n    whenClaimSettled: () => Promise.resolve(),\n  };\n}\n\nexport type { AuthSnapshot, Customer, Session, ThrottleAuthConfig };\n","import type { ThrottleAuth } from './client';\nimport { ThrottleAuthError } from './errors';\nimport type {\n  Address, AddressInput, Customer, Invoice, OpenCart, Order, OrderDetail,\n  PaymentMethod, ProfilePatch, Subscription, SubscriptionShippingAddress,\n} from './types';\n\nexport interface Page { cursor?: string; limit?: number }\n\n/** What the payment widget needs to render a card form. Passed through from\n *  the processor — `buyerExternalIdentifier` in particular must reach the\n *  widget unchanged, because the session token pins it and the processor\n *  refuses a mismatch by rendering nothing at all. */\nexport interface CardSetupSession {\n  embedToken: string;\n  checkoutSessionId: string;\n  amount: number;\n  currency: string;\n  merchantAccountId?: string;\n  environment?: string;\n  buyerExternalIdentifier: string;\n  country: string;\n  /** A ready-made page that hosts the card form, if you would rather redirect\n   *  or iframe than embed the widget yourself. */\n  hostedUrl: string;\n  embedUrl: string;\n}\n\nexport interface ThrottleAccount {\n  getProfile(): Promise<Customer>;\n  updateProfile(patch: ProfilePatch): Promise<Customer>;\n  listAddresses(): Promise<Address[]>;\n  createAddress(input: AddressInput): Promise<Address>;\n  updateAddress(id: string, patch: Partial<AddressInput>): Promise<Address>;\n  deleteAddress(id: string): Promise<void>;\n  listPaymentMethods(): Promise<PaymentMethod[]>;\n  setDefaultPaymentMethod(id: string): Promise<PaymentMethod>;\n  deletePaymentMethod(id: string): Promise<void>;\n  /** Opens a processor-hosted session the buyer types their card into. The\n   *  returned values are handed straight to the payment widget. */\n  startCardSetup(): Promise<CardSetupSession>;\n  /** Records the card the widget just vaulted, identified by the transaction\n   *  the widget returns. Safe to call twice with the same id. */\n  confirmCardSetup(transactionId: string): Promise<PaymentMethod>;\n  listOrders(page?: Page): Promise<Order[]>;\n  getOrder(id: string): Promise<OrderDetail>;\n  listInvoices(page?: Page): Promise<Invoice[]>;\n  getInvoice(id: string): Promise<Invoice>;\n  /** A 600-second signed URL. Fetch it on click — it expires. */\n  getInvoicePdfUrl(id: string): Promise<{ url: string }>;\n  listSubscriptions(page?: Page): Promise<Subscription[]>;\n  getSubscription(id: string): Promise<Subscription>;\n  /**\n   * Voids an unpaid order. Refused once money has been captured — that is a\n   * return, not a cancellation, and only the merchant may move money back.\n   */\n  cancelOrder(id: string, opts?: { reason?: string }): Promise<Order>;\n  /** Opens an RMA the merchant approves. Changes no order state by itself. */\n  requestOrderReturn(\n    id: string,\n    input: { items: Array<{ lineItemId: string; quantity: number }>; reason?: string },\n  ): Promise<{ id: string; status: string }>;\n  cancelSubscription(id: string, opts?: { atPeriodEnd?: boolean }): Promise<Subscription>;\n  pauseSubscription(id: string): Promise<Subscription>;\n  resumeSubscription(id: string): Promise<Subscription>;\n  /**\n   * Where a physical subscription's box goes, from the next renewal. Needs a\n   * fresh sign-in (step-up), like cancelling. A subscription that ships\n   * nothing answers `subscription_not_physical`.\n   */\n  updateSubscriptionShippingAddress(id: string, address: SubscriptionShippingAddress): Promise<Subscription>;\n  claimCart(cartId: string): Promise<{ cartId: string; customerId: string }>;\n  /**\n   * The buyer's newest open or idle-abandoned cart in `currency` (see `status`), or null. Answers null as well\n   * when the API predates the route (404). Always present on the account that\n   * `createAccount` and `ThrottleProvider` build; optional here so a hand-made\n   * `ThrottleAccount` written against 0.11 still compiles.\n   */\n  getOpenCart?(input: { currency: string }): Promise<OpenCart | null>;\n}\n\nconst seg = (v: string) => encodeURIComponent(v);\n\nfunction query(page?: Page): string {\n  const params = new URLSearchParams();\n  if (page?.cursor) params.set('cursor', page.cursor);\n  if (page?.limit != null) params.set('limit', String(page.limit));\n  const s = params.toString();\n  return s ? `?${s}` : '';\n}\n\nexport function createAccount(\n  auth: ThrottleAuth,\n): ThrottleAccount & Required<Pick<ThrottleAccount, 'getOpenCart'>> {\n  const { call } = auth;\n  return {\n    getProfile: () => call('GET', '/me'),\n    updateProfile: (patch) => call('PATCH', '/me', patch),\n\n    listAddresses: () => call('GET', '/me/addresses'),\n    createAddress: (input) => call('POST', '/me/addresses', input),\n    updateAddress: (id, patch) => call('PATCH', `/me/addresses/${seg(id)}`, patch),\n    deleteAddress: (id) => call('DELETE', `/me/addresses/${seg(id)}`),\n\n    listPaymentMethods: () => call('GET', '/me/payment-methods'),\n    // The platform has no \"change this subscription's card\" capability, so\n    // this is how a buyer changes what they are billed on: move the default.\n    setDefaultPaymentMethod: (id) => call('PATCH', `/me/payment-methods/${seg(id)}`, { isDefault: true }),\n    deletePaymentMethod: (id) => call('DELETE', `/me/payment-methods/${seg(id)}`),\n\n    // Saving a card is two calls because the card number never reaches us: the\n    // first mints a processor-hosted embed session, the buyer types their card\n    // into that, and the second records what the processor vaulted. Everything\n    // about the saved card is read back from the processor, so nothing here\n    // trusts what the browser claims the card was.\n    startCardSetup: () => call('POST', '/me/payment-methods/embed-token'),\n    confirmCardSetup: (transactionId) =>\n      call('POST', '/me/payment-methods/confirm', { transactionId }),\n\n    listOrders: (page) => call('GET', `/me/orders${query(page)}`),\n    getOrder: (id) => call('GET', `/me/orders/${seg(id)}`),\n    listInvoices: (page) => call('GET', `/me/invoices${query(page)}`),\n    getInvoice: (id) => call('GET', `/me/invoices/${seg(id)}`),\n    getInvoicePdfUrl: (id) => call('GET', `/me/invoices/${seg(id)}/pdf`),\n    listSubscriptions: (page) => call('GET', `/me/subscriptions${query(page)}`),\n    getSubscription: (id) => call('GET', `/me/subscriptions/${seg(id)}`),\n\n    cancelOrder: (id, opts) => call('POST', `/me/orders/${seg(id)}/cancel`, opts),\n    requestOrderReturn: (id, input) => call('POST', `/me/orders/${seg(id)}/return-request`, input),\n    cancelSubscription: (id, opts) => call('POST', `/me/subscriptions/${seg(id)}/cancel`, opts),\n    pauseSubscription: (id) => call('POST', `/me/subscriptions/${seg(id)}/pause`),\n    resumeSubscription: (id) => call('POST', `/me/subscriptions/${seg(id)}/resume`),\n    updateSubscriptionShippingAddress: (id, address) =>\n      call('PATCH', `/me/subscriptions/${seg(id)}/shipping-address`, address),\n\n    claimCart: (cartId) => call('POST', `/me/carts/${seg(cartId)}/claim`),\n\n    async getOpenCart({ currency }) {\n      if (typeof currency !== 'string' || !/^[A-Za-z]{3}$/.test(currency)) {\n        throw new TypeError('getOpenCart: currency must be a 3-letter ISO code');\n      }\n      try {\n        return await call<OpenCart | null>('GET', `/me/cart?currency=${currency.toUpperCase()}`);\n      } catch (err) {\n        // An API that predates the route: no cart to follow, not a failure.\n        if (err instanceof ThrottleAuthError && err.statusCode === 404) return null;\n        throw err;\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAAqG;AAC/G,UAAM,KAAK,OAAO;AAClB,SAAK,OAAO;AACZ,SAAK,OAAO,KAAK;AACjB,SAAK,aAAa,KAAK;AACvB,SAAK,aAAa,KAAK;AACvB,SAAK,UAAU,KAAK;AAAA,EACtB;AACF;;;ACDA,eAAsB,QAAQ,OAAmC;AAC/D,QAAM,UAAkC,EAAE,aAAa,MAAM,eAAe;AAC5E,MAAI,MAAM,SAAS,OAAW,SAAQ,cAAc,IAAI;AACxD,MAAI,MAAM,YAAa,SAAQ,gBAAgB,UAAU,MAAM,WAAW;AAC1E,MAAI,MAAM,YAAa,SAAQ,WAAW,IAAI,MAAM;AAEpD,QAAM,MAAM,MAAM,MAAM,GAAG,MAAM,OAAO,iBAAiB,MAAM,IAAI,IAAI;AAAA,IACrE,QAAQ,MAAM;AAAA,IACd;AAAA,IACA,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,KAAK,UAAU,MAAM,IAAI,EAAE,IAAI,CAAC;AAAA,EACzE,CAAC;AAED,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,MAAI,SAAc,CAAC;AACnB,MAAI;AACF,aAAS,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC;AAAA,EACtC,QAAQ;AAAA,EAGR;AAEA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,QAAQ,SAAS,CAAC;AAG5B,UAAM,KAAK,OAAO,IAAI,QAAQ,IAAI,aAAa,CAAC;AAChD,UAAM,IAAI,kBAAkB;AAAA,MAC1B,MAAM,EAAE,QAAQ;AAAA,MAChB,SAAS,EAAE,WAAW,uBAAuB,IAAI,MAAM;AAAA,MACvD,YAAY,IAAI;AAAA,MAChB,YAAY,OAAO,SAAS,EAAE,KAAK,MAAM,IAAI,KAAK;AAAA,MAClD,SAAS,EAAE;AAAA,IACb,CAAC;AAAA,EACH;AAKA,SAAO,UAAU,OAAO,WAAW,YAAY,UAAU,SAAS,OAAO,OAAQ,UAAU,CAAC;AAC9F;;;AClCO,IAAM,eAAN,MAAmB;AAAA,EACxB,YAA0B,EAAE,QAAQ,WAAW,UAAU,MAAM,eAAe,MAAM;AAAA,EACpF,eAA8B;AAAA,EAC9B,aAA4B;AAAA,EAC5B,aAAa,oBAAI,IAAc;AAAA,EAE/B,MAAoB;AAAE,WAAO,KAAK;AAAA,EAAW;AAAA,EAC7C,cAA6B;AAAE,WAAO,KAAK;AAAA,EAAc;AAAA,EACzD,YAA2B;AAAE,WAAO,KAAK;AAAA,EAAY;AAAA,EAErD,WAAW,SAAwB;AACjC,SAAK,eAAe,QAAQ;AAC5B,SAAK,aAAa,KAAK,MAAM,QAAQ,SAAS;AAC9C,SAAK,SAAS;AAAA,MACZ,QAAQ;AAAA,MACR,UAAU,QAAQ;AAAA,MAClB,eAAe,QAAQ,QAAQ,UAAU,aAAa;AAAA,IACxD,CAAC;AAAA,EACH;AAAA,EAEA,UAAU,QAA0B;AAClC,SAAK,SAAS,EAAE,GAAG,KAAK,WAAW,OAAO,CAAC;AAAA,EAC7C;AAAA,EAEA,QAAc;AACZ,SAAK,eAAe;AACpB,SAAK,aAAa;AAClB,SAAK,SAAS,EAAE,QAAQ,mBAAmB,UAAU,MAAM,eAAe,MAAM,CAAC;AAAA,EACnF;AAAA,EAEA,UAAU,IAA0B;AAClC,SAAK,WAAW,IAAI,EAAE;AACtB,WAAO,MAAM;AAAE,WAAK,WAAW,OAAO,EAAE;AAAA,IAAG;AAAA,EAC7C;AAAA,EAEA,SAAS,MAA0B;AAIjC,UAAM,OACJ,KAAK,WAAW,KAAK,UAAU,UAC/B,KAAK,kBAAkB,KAAK,UAAU,iBACtC,eAAe,KAAK,UAAU,KAAK,UAAU,QAAQ;AACvD,QAAI,KAAM;AACV,SAAK,YAAY;AACjB,eAAW,MAAM,CAAC,GAAG,KAAK,UAAU,GAAG;AAErC,UAAI;AAAE,WAAG,IAAI;AAAA,MAAG,QAAQ;AAAA,MAA0B;AAAA,IACpD;AAAA,EACF;AACF;AAEA,SAAS,eAAe,GAAoB,GAA6B;AACvE,MAAI,MAAM,EAAG,QAAO;AACpB,MAAI,CAAC,KAAK,CAAC,EAAG,QAAO;AACrB,QAAM,OAAO,oBAAI,IAAI,CAAC,GAAG,OAAO,KAAK,CAAC,GAAG,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC;AAC3D,aAAW,KAAK,KAAM,KAAI,EAAE,CAAC,MAAM,EAAE,CAAC,EAAG,QAAO;AAChD,SAAO;AACT;;;ACxEO,SAAS,gBAA6B;AAC3C,QAAM,MAAM,oBAAI,IAAoB;AACpC,SAAO;AAAA,IACL,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK;AAAA,IAC1B,KAAK,CAAC,GAAG,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC;AAAA,IAChC,QAAQ,CAAC,MAAM,KAAK,IAAI,OAAO,CAAC;AAAA,EAClC;AACF;AAOO,SAAS,sBAAmC;AACjD,QAAM,WAAW,cAAc;AAC/B,QAAM,KAAK,MAAsB;AAC/B,QAAI;AACF,aAAO,OAAO,iBAAiB,cAAc,eAAe;AAAA,IAC9D,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AAAA,IACL,IAAI,GAAG;AACL,UAAI;AACF,cAAM,IAAI,GAAG,GAAG,QAAQ,CAAC;AACzB,YAAI,KAAK,KAAM,QAAO;AAAA,MACxB,QAAQ;AAAA,MAAqB;AAC7B,aAAO,SAAS,IAAI,CAAC;AAAA,IACvB;AAAA,IACA,IAAI,GAAG,GAAG;AACR,eAAS,IAAI,GAAG,CAAC;AACjB,UAAI;AAAE,WAAG,GAAG,QAAQ,GAAG,CAAC;AAAA,MAAG,QAAQ;AAAA,MAAiC;AAAA,IACtE;AAAA,IACA,OAAO,GAAG;AACR,eAAS,OAAO,CAAC;AACjB,UAAI;AAAE,WAAG,GAAG,WAAW,CAAC;AAAA,MAAG,QAAQ;AAAA,MAAqB;AAAA,IAC1D;AAAA,EACF;AACF;;;ACtCA,IAAM,mBAAmB;AAEzB,IAAM,kBAAkB;AA8CjB,SAAS,mBACd,QACiE;AACjE,QAAM,WAAW,OAAO,WAAW,kBAAkB,QAAQ,OAAO,EAAE;AACtE,QAAM,UAAuB,OAAO,WAAW,oBAAoB;AAGnE,QAAM,aAAa,oBAAoB,OAAO,cAAc;AAC5D,QAAM,WAAW,yBAAyB,OAAO,cAAc;AAE/D,QAAM,QAAQ,IAAI,aAAa;AAC/B,MAAI,kBAAwC;AAC5C,MAAI,cAA6B;AACjC,MAAI,kBAAkB;AAEtB,QAAM,OAAO,EAAE,SAAS,gBAAgB,OAAO,eAAe;AAE9D,iBAAe,QAAQ,SAAiC;AACtD,UAAM,WAAW,OAAO;AACxB,UAAM,QAAQ,IAAI,YAAY,QAAQ,YAAY;AAAA,EACpD;AAEA,iBAAe,SAAwB;AACrC,kBAAc;AACd,UAAM,MAAM;AACZ,UAAM,QAAQ,OAAO,UAAU;AAAA,EACjC;AAQA,WAAS,SAAY,IAAkC;AACrD,UAAM,QAAS,WAAmB,WAAW;AAC7C,WAAO,OAAO,UAAU,MAAM,QAAQ,UAAU,EAAE,IAAI,GAAG;AAAA,EAC3D;AAEA,iBAAe,YAA2B;AACxC,UAAM,SAAS,YAAY;AAGzB,YAAM,eAAe,MAAM,QAAQ,IAAI,UAAU;AACjD,UAAI,CAAC,cAAc;AACjB,cAAM,OAAO;AACb,cAAM,IAAI,kBAAkB,EAAE,MAAM,mBAAmB,SAAS,cAAc,YAAY,IAAI,CAAC;AAAA,MACjG;AACA,UAAI;AACF,cAAM,OAAO,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,iBAAiB,MAAM,EAAE,aAAa,EAAE,CAAC;AACrG,cAAM,QAAQ,IAAe;AAAA,MAC/B,SAAS,KAAK;AAcZ,cAAM,UACJ,eAAe,sBAAsB,IAAI,eAAe,OAAO,IAAI,eAAe;AACpF,YAAI,QAAS,OAAM,OAAO;AAC1B,cAAM;AAAA,MACR;AAAA,IACF,CAAC;AAAA,EACH;AAEA,WAAS,UAAyB;AAChC,QAAI,CAAC,iBAAiB;AACpB,wBAAkB,UAAU,EAAE,QAAQ,MAAM;AAAE,0BAAkB;AAAA,MAAM,CAAC;AAAA,IACzE;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,cAAsC;AACnD,UAAM,UAAU,MAAM,UAAU;AAChC,QAAI,MAAM,YAAY,KAAK,WAAW,UAAU,KAAK,IAAI,IAAI,iBAAiB;AAC5E,aAAO,MAAM,YAAY;AAAA,IAC3B;AACA,QAAI,MAAM,QAAQ,IAAI,UAAU,GAAG;AACjC,YAAM,QAAQ;AACd,aAAO,MAAM,YAAY;AAAA,IAC3B;AACA,WAAO,MAAM,YAAY;AAAA,EAC3B;AAEA,iBAAe,eAAiC;AAC9C,QAAI,eAAe,kBAAkB,KAAK,IAAI,EAAG,QAAO;AACxD,QAAI,CAAC,OAAO,iBAAkB,QAAO;AACrC,UAAM,WAAW,MAAM,OAAO,iBAAiB;AAC/C,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,OAAO,QAAQ;AACrB,WAAO;AAAA,EACT;AAEA,iBAAe,OAAO,UAAiC;AACrD,UAAM,OAAO,MAAM,QAAQ;AAAA,MACzB,GAAG;AAAA,MAAM,QAAQ;AAAA,MAAQ,MAAM;AAAA,MAC/B,aAAa,MAAM,YAAY,KAAK;AAAA,MAAW,MAAM,EAAE,SAAS;AAAA,IAClE,CAAC;AACD,kBAAc,KAAK;AACnB,sBAAkB,KAAK,IAAI,KAAK,OAAO,KAAK,SAAS,KAAK,OAAO,MAAO;AAAA,EAC1E;AAEA,iBAAe,KAAc,QAAgB,MAAc,MAA4B;AACrF,QAAI,cAAc;AAClB,QAAI,gBAAgB;AAOpB,QAAI,aAAa;AAEjB,eAAS;AACP,YAAM,QAAQ,MAAM,YAAY;AAChC,UAAI;AACF,eAAO,MAAM,QAAQ;AAAA,UACnB,GAAG;AAAA,UAAM;AAAA,UAAQ;AAAA,UAAM;AAAA,UACvB,aAAa,SAAS;AAAA,UACtB,aAAa,aAAc,eAAe,SAAa;AAAA,QACzD,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,cAAM,IAAI;AAOV,cAAM,UAAU,EAAE,eAAe,QAC9B,EAAE,SAAS,kBAAkB,EAAE,SAAS,mBAAmB,EAAE,SAAS;AACzE,YAAI,WAAW,CAAC,aAAa;AAC3B,wBAAc;AACd,gBAAM,QAAQ;AACd;AAAA,QACF;AACA,YAAI,EAAE,SAAS,sBAAsB,CAAC,eAAe;AACnD,0BAAgB;AAIhB,cAAI,MAAM,aAAa,GAAG;AAAE,yBAAa;AAAM;AAAA,UAAU;AAAA,QAC3D;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,SAAS,OAAO,UAAU;AAC9B,YAAM,OAAO,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,kBAAkB,MAAM,EAAE,OAAO,SAAS,EAAE,CAAC;AACzG,UAAI,MAAM,WAAW,UAAW,QAAO,EAAE,QAAQ,UAAU;AAC3D,YAAM,QAAQ,IAAe;AAC7B,aAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IAEA,MAAM,OAAO,OAAO,UAAU;AAC5B,YAAM,OAAO,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,eAAe,MAAM,EAAE,OAAO,SAAS,EAAE,CAAC;AACtG,YAAM,QAAQ,IAAe;AAAA,IAC/B;AAAA,IAEA,MAAM,UAAU;AACd,UAAI;AAAE,cAAM,KAAK,QAAQ,cAAc;AAAA,MAAG,QAAQ;AAAA,MAA+B;AACjF,YAAM,OAAO;AAAA,IACf;AAAA,IAEA,MAAM,oBAAoB;AACxB,UAAI;AAAE,cAAM,KAAK,QAAQ,kBAAkB;AAAA,MAAG,QAAQ;AAAA,MAA+B;AACrF,YAAM,OAAO;AAAA,IACf;AAAA,IAEA,MAAM,UAAU;AACd,UAAI,CAAE,MAAM,QAAQ,IAAI,UAAU,GAAI;AAAE,cAAM,UAAU,iBAAiB;AAAG;AAAA,MAAQ;AACpF,UAAI;AAAE,cAAM,QAAQ;AAAA,MAAG,QAAQ;AAAA,MAA6B;AAAA,IAC9D;AAAA,IAEA,aAAa,MAAM,MAAM,IAAI;AAAA,IAE7B,MAAM,iBAAiB;AACrB,UAAI;AACF,eAAO,MAAM,YAAY;AAAA,MAC3B,SAAS,KAAK;AAGZ,YAAI,MAAM,IAAI,EAAE,WAAW,kBAAmB,QAAO;AACrD,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IAEA,WAAW,CAAC,OAAO,MAAM,UAAU,EAAE;AAAA,IACrC;AAAA,IACA;AAAA,IAEA,MAAM,YAAY,OAAO;AACvB,YAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,sBAAsB,MAAM,EAAE,MAAM,EAAE,CAAC;AAKtF,UAAI,MAAM,QAAQ,IAAI,UAAU,GAAG;AACjC,YAAI;AAAE,gBAAM,QAAQ;AAAA,QAAG,QAAQ;AAAA,QAAqC;AAAA,MACtE;AAAA,IACF;AAAA,IAEA,MAAM,qBAAqB;AACzB,YAAM,KAAK,QAAQ,2BAA2B;AAAA,IAChD;AAAA,IAEA,MAAM,eAAe,OAAO;AAG1B,YAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,yBAAyB,MAAM,EAAE,MAAM,EAAE,CAAC;AAAA,IAC3F;AAAA,IAEA,MAAM,cAAc,OAAO,UAAU;AACnC,YAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,wBAAwB,MAAM,EAAE,OAAO,SAAS,EAAE,CAAC;AAElG,YAAM,OAAO;AAAA,IACf;AAAA,IAEA,MAAM,eAAe,UAAU;AAC7B,YAAM,KAAK,QAAQ,uBAAuB,EAAE,SAAS,CAAC;AAMtD,UAAI;AAAE,cAAM,QAAQ;AAAA,MAAG,QAAQ;AAAA,MAA8C;AAAA,IAC/E;AAAA,IAEA,MAAM,eAAe;AACnB,aAAO,KAAsB,OAAO,cAAc;AAAA,IACpD;AAAA,IAEA,MAAM,cAAc,IAAI;AACtB,YAAM,OAAO,MAAM,KAAsB,OAAO,cAAc;AAC9D,YAAM,UAAU,KAAK,KAAK,CAAC,MAAM,EAAE,OAAO;AAC1C,YAAM,KAAK,UAAU,gBAAgB,mBAAmB,EAAE,CAAC,EAAE;AAC7D,UAAI,SAAS,OAAO,GAAI,OAAM,OAAO;AAAA,IACvC;AAAA;AAAA;AAAA,IAIA,kBAAkB,MAAM,QAAQ,QAAQ;AAAA,EAC1C;AACF;;;AClOA,IAAM,MAAM,CAAC,MAAc,mBAAmB,CAAC;AAE/C,SAAS,MAAM,MAAqB;AAClC,QAAM,SAAS,IAAI,gBAAgB;AACnC,MAAI,MAAM,OAAQ,QAAO,IAAI,UAAU,KAAK,MAAM;AAClD,MAAI,MAAM,SAAS,KAAM,QAAO,IAAI,SAAS,OAAO,KAAK,KAAK,CAAC;AAC/D,QAAM,IAAI,OAAO,SAAS;AAC1B,SAAO,IAAI,IAAI,CAAC,KAAK;AACvB;AAEO,SAAS,cACd,MACkE;AAClE,QAAM,EAAE,KAAK,IAAI;AACjB,SAAO;AAAA,IACL,YAAY,MAAM,KAAK,OAAO,KAAK;AAAA,IACnC,eAAe,CAAC,UAAU,KAAK,SAAS,OAAO,KAAK;AAAA,IAEpD,eAAe,MAAM,KAAK,OAAO,eAAe;AAAA,IAChD,eAAe,CAAC,UAAU,KAAK,QAAQ,iBAAiB,KAAK;AAAA,IAC7D,eAAe,CAAC,IAAI,UAAU,KAAK,SAAS,iBAAiB,IAAI,EAAE,CAAC,IAAI,KAAK;AAAA,IAC7E,eAAe,CAAC,OAAO,KAAK,UAAU,iBAAiB,IAAI,EAAE,CAAC,EAAE;AAAA,IAEhE,oBAAoB,MAAM,KAAK,OAAO,qBAAqB;AAAA;AAAA;AAAA,IAG3D,yBAAyB,CAAC,OAAO,KAAK,SAAS,uBAAuB,IAAI,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,CAAC;AAAA,IACpG,qBAAqB,CAAC,OAAO,KAAK,UAAU,uBAAuB,IAAI,EAAE,CAAC,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAO5E,gBAAgB,MAAM,KAAK,QAAQ,iCAAiC;AAAA,IACpE,kBAAkB,CAAC,kBACjB,KAAK,QAAQ,+BAA+B,EAAE,cAAc,CAAC;AAAA,IAE/D,YAAY,CAAC,SAAS,KAAK,OAAO,aAAa,MAAM,IAAI,CAAC,EAAE;AAAA,IAC5D,UAAU,CAAC,OAAO,KAAK,OAAO,cAAc,IAAI,EAAE,CAAC,EAAE;AAAA,IACrD,cAAc,CAAC,SAAS,KAAK,OAAO,eAAe,MAAM,IAAI,CAAC,EAAE;AAAA,IAChE,YAAY,CAAC,OAAO,KAAK,OAAO,gBAAgB,IAAI,EAAE,CAAC,EAAE;AAAA,IACzD,kBAAkB,CAAC,OAAO,KAAK,OAAO,gBAAgB,IAAI,EAAE,CAAC,MAAM;AAAA,IACnE,mBAAmB,CAAC,SAAS,KAAK,OAAO,oBAAoB,MAAM,IAAI,CAAC,EAAE;AAAA,IAC1E,iBAAiB,CAAC,OAAO,KAAK,OAAO,qBAAqB,IAAI,EAAE,CAAC,EAAE;AAAA,IAEnE,aAAa,CAAC,IAAI,SAAS,KAAK,QAAQ,cAAc,IAAI,EAAE,CAAC,WAAW,IAAI;AAAA,IAC5E,oBAAoB,CAAC,IAAI,UAAU,KAAK,QAAQ,cAAc,IAAI,EAAE,CAAC,mBAAmB,KAAK;AAAA,IAC7F,oBAAoB,CAAC,IAAI,SAAS,KAAK,QAAQ,qBAAqB,IAAI,EAAE,CAAC,WAAW,IAAI;AAAA,IAC1F,mBAAmB,CAAC,OAAO,KAAK,QAAQ,qBAAqB,IAAI,EAAE,CAAC,QAAQ;AAAA,IAC5E,oBAAoB,CAAC,OAAO,KAAK,QAAQ,qBAAqB,IAAI,EAAE,CAAC,SAAS;AAAA,IAC9E,mCAAmC,CAAC,IAAI,YACtC,KAAK,SAAS,qBAAqB,IAAI,EAAE,CAAC,qBAAqB,OAAO;AAAA,IAExE,WAAW,CAAC,WAAW,KAAK,QAAQ,aAAa,IAAI,MAAM,CAAC,QAAQ;AAAA,IAEpE,MAAM,YAAY,EAAE,SAAS,GAAG;AAC9B,UAAI,OAAO,aAAa,YAAY,CAAC,gBAAgB,KAAK,QAAQ,GAAG;AACnE,cAAM,IAAI,UAAU,mDAAmD;AAAA,MACzE;AACA,UAAI;AACF,eAAO,MAAM,KAAsB,OAAO,qBAAqB,SAAS,YAAY,CAAC,EAAE;AAAA,MACzF,SAAS,KAAK;AAEZ,YAAI,eAAe,qBAAqB,IAAI,eAAe,IAAK,QAAO;AACvE,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/request.ts","../src/session.ts","../src/storage.ts","../src/client.ts","../src/account.ts"],"sourcesContent":["export { createThrottleAuth } from './client';\nexport type { ThrottleAuth, DeviceSession } from './client';\nexport { ThrottleAuthError } from './errors';\nexport { memoryStorage, localStorageAdapter } from './storage';\nexport type { AuthSnapshot, AuthStatus } from './session';\nexport type { AuthStorage, Customer, Session, ThrottleAuthConfig } from './types';\nexport { createAccount } from './account';\nexport type { ThrottleAccount, Page } from './account';\nexport type {\n  Address, AddressInput, Invoice, OpenCart, Order, PaymentMethod, ProfilePatch, Subscription,\n  SubscriptionShippingAddress,\n} from './types';\n// Money helpers (MC2-R34). This is money's two-argument `formatMoney`; the\n// `./components` entry keeps its own three-argument one (MC2-R48).\nexport * as money from '@usethrottle/money';\nexport {\n  formatMoney,\n  currencySymbol,\n  minorUnitsOf,\n  toDecimalString,\n  toMinor,\n  parseMoney,\n  moneyValue,\n  CURRENCIES,\n  isKnownCurrency,\n  UnknownCurrencyError,\n} from '@usethrottle/money';\nexport type { CurrencyCode, MoneyValue } from '@usethrottle/money';\n","export class ThrottleAuthError extends Error {\n  readonly code: string;\n  readonly statusCode: number;\n  readonly retryAfter?: number;\n  readonly details?: unknown;\n\n  constructor(args: { code: string; message: string; statusCode: number; retryAfter?: number; details?: unknown }) {\n    super(args.message);\n    this.name = 'ThrottleAuthError';\n    this.code = args.code;\n    this.statusCode = args.statusCode;\n    this.retryAfter = args.retryAfter;\n    this.details = args.details;\n  }\n}\n","import { ThrottleAuthError } from './errors';\n\nexport interface RequestInput {\n  method: string;\n  path: string;\n  baseUrl: string;\n  publishableKey: string;\n  accessToken?: string;\n  stepUpToken?: string;\n  body?: unknown;\n}\n\n/** Returns the UNWRAPPED `data` from the `{ data: … }` envelope. Throws ThrottleAuthError otherwise. */\nexport async function request(input: RequestInput): Promise<any> {\n  const headers: Record<string, string> = { 'X-API-Key': input.publishableKey };\n  if (input.body !== undefined) headers['Content-Type'] = 'application/json';\n  if (input.accessToken) headers.Authorization = `Bearer ${input.accessToken}`;\n  if (input.stepUpToken) headers['X-Step-Up'] = input.stepUpToken;\n\n  const res = await fetch(`${input.baseUrl}/v1/storefront${input.path}`, {\n    method: input.method,\n    headers,\n    ...(input.body !== undefined ? { body: JSON.stringify(input.body) } : {}),\n  });\n\n  const text = await res.text();\n  let parsed: any = {};\n  try {\n    parsed = text ? JSON.parse(text) : {};\n  } catch {\n    // Non-JSON body — an HTML gateway page, say. Leave parsed empty so the\n    // branch below still throws a typed error rather than a raw SyntaxError.\n  }\n\n  if (!res.ok) {\n    const e = parsed?.error ?? {};\n    // `Retry-After` is server-controlled but not trusted: Number('soon') is\n    // NaN, and a NaN reaches the UI as \"wait NaN seconds\".\n    const ra = Number(res.headers.get('retry-after'));\n    throw new ThrottleAuthError({\n      code: e.code ?? 'request_failed',\n      message: e.message ?? `Request failed with ${res.status}`,\n      statusCode: res.status,\n      retryAfter: Number.isFinite(ra) && ra >= 0 ? ra : undefined,\n      details: e.details,\n    });\n  }\n\n  // `'data' in parsed`, not `parsed?.data ?? parsed`: a legitimate\n  // `{ \"data\": null }` is nullish, and `??` would fall through and hand the\n  // caller the whole envelope instead of the null the API actually sent.\n  return parsed && typeof parsed === 'object' && 'data' in parsed ? parsed.data : (parsed ?? {});\n}\n","import type { Customer, Session } from './types';\n\nexport type AuthStatus = 'loading' | 'authenticated' | 'unauthenticated';\n\nexport interface AuthSnapshot {\n  status: AuthStatus;\n  customer: Customer | null;\n  /**\n   * False here does NOT only mean \"we emailed them and they have not clicked\".\n   * While it is false the API may also be withholding pre-existing account\n   * data behind the claim cutoff — empty order lists and a 403 on `PATCH /me`\n   * are expected, not broken. See the plan header.\n   */\n  emailVerified: boolean;\n}\n\ntype Listener = (snapshot: AuthSnapshot) => void;\n\nexport class SessionState {\n  #snapshot: AuthSnapshot = { status: 'loading', customer: null, emailVerified: false };\n  #accessToken: string | null = null;\n  #expiresAt: number | null = null;\n  #listeners = new Set<Listener>();\n\n  get(): AuthSnapshot { return this.#snapshot; }\n  accessToken(): string | null { return this.#accessToken; }\n  expiresAt(): number | null { return this.#expiresAt; }\n\n  setSession(session: Session): void {\n    this.#accessToken = session.accessToken;\n    this.#expiresAt = Date.parse(session.expiresAt);\n    this.#publish({\n      status: 'authenticated',\n      customer: session.customer,\n      emailVerified: Boolean(session.customer?.emailVerified),\n    });\n  }\n\n  setStatus(status: AuthStatus): void {\n    this.#publish({ ...this.#snapshot, status });\n  }\n\n  clear(): void {\n    this.#accessToken = null;\n    this.#expiresAt = null;\n    this.#publish({ status: 'unauthenticated', customer: null, emailVerified: false });\n  }\n\n  subscribe(fn: Listener): () => void {\n    this.#listeners.add(fn);\n    return () => { this.#listeners.delete(fn); };\n  }\n\n  #publish(next: AuthSnapshot): void {\n    // Identity matters: React's useSyncExternalStore re-renders on reference\n    // change, and a token refresh every ten minutes must not re-render the\n    // whole account area when nothing visible changed.\n    const same =\n      next.status === this.#snapshot.status &&\n      next.emailVerified === this.#snapshot.emailVerified &&\n      customerEquals(next.customer, this.#snapshot.customer);\n    if (same) return;\n    this.#snapshot = next;\n    for (const fn of [...this.#listeners]) {\n      // A merchant's subscriber throwing must not stop the rest from hearing.\n      try { fn(next); } catch { /* merchant callback */ }\n    }\n  }\n}\n\nfunction customerEquals(a: Customer | null, b: Customer | null): boolean {\n  if (a === b) return true;\n  if (!a || !b) return false;\n  const keys = new Set([...Object.keys(a), ...Object.keys(b)]) as Set<keyof Customer>;\n  for (const k of keys) if (a[k] !== b[k]) return false;\n  return true;\n}\n","import type { AuthStorage } from './types';\n\nexport type { AuthStorage };\n\nexport function memoryStorage(): AuthStorage {\n  const map = new Map<string, string>();\n  return {\n    get: (k) => map.get(k) ?? null,\n    set: (k, v) => void map.set(k, v),\n    remove: (k) => void map.delete(k),\n  };\n}\n\n/**\n * localStorage when it works, memory when it does not. Safari private mode,\n * hardened browser settings and server-side rendering all make localStorage\n * either absent or throwing; none of them may take the storefront down.\n */\nexport function localStorageAdapter(): AuthStorage {\n  const fallback = memoryStorage();\n  const ls = (): Storage | null => {\n    try {\n      return typeof localStorage !== 'undefined' ? localStorage : null;\n    } catch {\n      return null;\n    }\n  };\n  return {\n    get(k) {\n      try {\n        const v = ls()?.getItem(k);\n        if (v != null) return v;\n      } catch { /* fall through */ }\n      return fallback.get(k);\n    },\n    set(k, v) {\n      fallback.set(k, v);\n      try { ls()?.setItem(k, v); } catch { /* memory-only this session */ }\n    },\n    remove(k) {\n      fallback.remove(k);\n      try { ls()?.removeItem(k); } catch { /* already gone */ }\n    },\n  };\n}\n","import { request } from './request';\nimport { ThrottleAuthError } from './errors';\nimport { SessionState, type AuthSnapshot } from './session';\nimport { localStorageAdapter, type AuthStorage } from './storage';\nimport type { Customer, Session, ThrottleAuthConfig } from './types';\n\nconst DEFAULT_BASE_URL = 'https://api.usethrottle.dev';\n/** Refresh this far before expiry so ordinary calls rarely see a 401 at all. */\nconst REFRESH_SKEW_MS = 30_000;\n\nexport interface DeviceSession {\n  id: string;\n  userAgent: string | null;\n  ipPrefix: string | null;\n  createdAt: string;\n  lastUsedAt: string;\n  current: boolean;\n}\n\nexport interface ThrottleAuth {\n  register(email: string, password: string): Promise<{ status: 'active' | 'pending' }>;\n  signIn(email: string, password: string): Promise<void>;\n  signOut(): Promise<void>;\n  signOutEverywhere(): Promise<void>;\n  restore(): Promise<void>;\n  getSnapshot(): AuthSnapshot;\n  /**\n   * The current access token, refreshed first when it is about to expire\n   * (single-flight, shared with every other caller), or null when signed out.\n   * Rejects when a refresh fails without ending the session (a 5xx, a 429 or\n   * a network error); the buyer stays signed in. `@usethrottle/catalog`\n   * treats a rejection as signed out for that request.\n   * Pass it to `@usethrottle/catalog`'s `customerToken`.\n   */\n  getAccessToken(): Promise<string | null>;\n  subscribe(fn: (s: AuthSnapshot) => void): () => void;\n  stepUp(password: string): Promise<void>;\n  call<T = any>(method: string, path: string, body?: unknown): Promise<T>;\n  verifyEmail(token: string): Promise<void>;\n  resendVerification(): Promise<void>;\n  forgotPassword(email: string): Promise<void>;\n  resetPassword(token: string, password: string): Promise<void>;\n  changePassword(password: string): Promise<void>;\n  listSessions(): Promise<DeviceSession[]>;\n  revokeSession(id: string): Promise<void>;\n  /**\n   * Resolves once any sign-in or registration claim in flight has settled.\n   * `createThrottleAuth` always supplies it (it resolves at once there);\n   * `ThrottleProvider` supplies one that tracks its cart claim. Optional so a\n   * hand-made `ThrottleAuth` written against 0.11 still compiles.\n   */\n  whenClaimSettled?(): Promise<void>;\n}\n\nexport function createThrottleAuth(\n  config: ThrottleAuthConfig,\n): ThrottleAuth & Required<Pick<ThrottleAuth, 'whenClaimSettled'>> {\n  const baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\\/$/, '');\n  const storage: AuthStorage = config.storage ?? localStorageAdapter();\n  // Namespaced by key so two Throttle applications on one origin cannot read\n  // each other's refresh token out of shared localStorage.\n  const storageKey = `throttle_auth_rt:${config.publishableKey}`;\n  const lockName = `throttle_auth_refresh:${config.publishableKey}`;\n\n  const state = new SessionState();\n  let refreshInFlight: Promise<void> | null = null;\n  let stepUpToken: string | null = null;\n  let stepUpExpiresAt = 0;\n\n  const base = { baseUrl, publishableKey: config.publishableKey };\n\n  async function persist(session: Session): Promise<void> {\n    state.setSession(session);\n    await storage.set(storageKey, session.refreshToken);\n  }\n\n  async function forget(): Promise<void> {\n    stepUpToken = null;\n    state.clear();\n    await storage.remove(storageKey);\n  }\n\n  /**\n   * Cross-tab single flight. Two tabs refreshing at once would each present the\n   * same stored token; the second is a replay, and the server kills the family.\n   * Web Locks serialises them; where it is unavailable the in-process guard\n   * below still covers the common single-tab case.\n   */\n  function withLock<T>(fn: () => Promise<T>): Promise<T> {\n    const locks = (globalThis as any).navigator?.locks;\n    return locks?.request ? locks.request(lockName, fn) : fn();\n  }\n\n  async function doRefresh(): Promise<void> {\n    await withLock(async () => {\n      // Re-read INSIDE the lock: another tab may have rotated while we waited,\n      // and presenting the token we read before the lock would be a replay.\n      const refreshToken = await storage.get(storageKey);\n      if (!refreshToken) {\n        await forget();\n        throw new ThrottleAuthError({ code: 'session_revoked', message: 'No session', statusCode: 401 });\n      }\n      try {\n        const data = await request({ ...base, method: 'POST', path: '/auth/refresh', body: { refreshToken } });\n        await persist(data as Session);\n      } catch (err) {\n        // Drop the stored token ONLY when the server actually refused the\n        // session: 401 session_revoked, or 403 environment_mismatch. Those are\n        // the two the refresh route returns, and there is nothing left to\n        // retry with in either case.\n        //\n        // Everything else keeps the token. `request()` throws a\n        // ThrottleAuthError for EVERY non-2xx, so testing the error class\n        // alone also caught a 502 with an HTML gateway body — a buyer whose\n        // tab refreshed during a rolling deploy was permanently signed out\n        // client-side even though their session was never invalidated. A 429\n        // is the same shape: \"try later\", not \"you are logged out\". And a\n        // fetch() that rejects outright never produces a ThrottleAuthError,\n        // so it was already handled.\n        const refused =\n          err instanceof ThrottleAuthError && (err.statusCode === 401 || err.statusCode === 403);\n        if (refused) await forget();\n        throw err;\n      }\n    });\n  }\n\n  function refresh(): Promise<void> {\n    if (!refreshInFlight) {\n      refreshInFlight = doRefresh().finally(() => { refreshInFlight = null; });\n    }\n    return refreshInFlight;\n  }\n\n  async function accessToken(): Promise<string | null> {\n    const expires = state.expiresAt();\n    if (state.accessToken() && expires && expires - Date.now() > REFRESH_SKEW_MS) {\n      return state.accessToken();\n    }\n    if (await storage.get(storageKey)) {\n      await refresh();\n      return state.accessToken();\n    }\n    return state.accessToken();\n  }\n\n  async function ensureStepUp(): Promise<boolean> {\n    if (stepUpToken && stepUpExpiresAt > Date.now()) return true;\n    if (!config.onStepUpRequired) return false;\n    const password = await config.onStepUpRequired();\n    if (!password) return false;\n    await stepUp(password);\n    return true;\n  }\n\n  async function stepUp(password: string): Promise<void> {\n    const data = await request({\n      ...base, method: 'POST', path: '/auth/step-up',\n      accessToken: await accessToken() ?? undefined, body: { password },\n    });\n    stepUpToken = data.stepUpToken;\n    stepUpExpiresAt = Date.now() + (Number(data.expiresIn) || 300) * 1000 - 5_000;\n  }\n\n  async function call<T = any>(method: string, path: string, body?: unknown): Promise<T> {\n    let retriedAuth = false;\n    let retriedStepUp = false;\n    // Only true on the retry that follows a `step_up_required` 403 — never\n    // attached speculatively. Sending an authorization-grade header on every\n    // request once minted meant it rode along on unrelated calls too, and\n    // cross-origin each of those then failed CORS preflight. The cost is one\n    // extra round trip per gated call, which is how the server signals\n    // step-up in the first place.\n    let sendStepUp = false;\n\n    for (;;) {\n      const token = await accessToken();\n      try {\n        return await request({\n          ...base, method, path, body,\n          accessToken: token ?? undefined,\n          stepUpToken: sendStepUp ? (stepUpToken ?? undefined) : undefined,\n        });\n      } catch (err) {\n        const e = err as ThrottleAuthError;\n        // `session_revoked` belongs here too. The server returns it for a\n        // stale session EPOCH as well as for a genuinely dead session, and a\n        // changed password bumps the epoch while deliberately sparing the\n        // current session — so one refresh recovers it. When the session\n        // really is dead the refresh fails and forget() runs, which is the\n        // same outcome, one request later.\n        const expired = e.statusCode === 401 &&\n          (e.code === 'unauthorized' || e.code === 'token_expired' || e.code === 'session_revoked');\n        if (expired && !retriedAuth) {\n          retriedAuth = true;\n          await refresh();   // shared — ten callers here produce ONE request\n          continue;\n        }\n        if (e.code === 'step_up_required' && !retriedStepUp) {\n          retriedStepUp = true;\n          // ensureStepUp() reuses the cached token when it's still within its\n          // 300s validity (no re-prompt); it was never sent above, so this is\n          // the first the server has seen of it for this call.\n          if (await ensureStepUp()) { sendStepUp = true; continue; }\n        }\n        throw err;\n      }\n    }\n  }\n\n  return {\n    async register(email, password) {\n      const data = await request({ ...base, method: 'POST', path: '/auth/register', body: { email, password } });\n      if (data?.status === 'pending') return { status: 'pending' };\n      await persist(data as Session);\n      return { status: 'active' };\n    },\n\n    async signIn(email, password) {\n      const data = await request({ ...base, method: 'POST', path: '/auth/login', body: { email, password } });\n      await persist(data as Session);\n    },\n\n    async signOut() {\n      try { await call('POST', '/auth/logout'); } catch { /* local state still goes */ }\n      await forget();\n    },\n\n    async signOutEverywhere() {\n      try { await call('POST', '/auth/logout-all'); } catch { /* local state still goes */ }\n      await forget();\n    },\n\n    async restore() {\n      if (!(await storage.get(storageKey))) { state.setStatus('unauthenticated'); return; }\n      try { await refresh(); } catch { /* forget() already ran */ }\n    },\n\n    getSnapshot: () => state.get(),\n\n    async getAccessToken() {\n      try {\n        return await accessToken();\n      } catch (err) {\n        // A refused refresh already ran forget(): the buyer is signed out.\n        // Anything else (a 502, a network error) keeps the session; rethrow.\n        if (state.get().status === 'unauthenticated') return null;\n        throw err;\n      }\n    },\n\n    subscribe: (fn) => state.subscribe(fn),\n    stepUp,\n    call,\n\n    async verifyEmail(token) {\n      await request({ ...base, method: 'POST', path: '/auth/verify-email', body: { token } });\n      // `ver` is a claim baked into the access token, and the claim cutoff is\n      // read from the session row. Without a new token the buyer stays gated —\n      // and their own order history stays hidden — for the rest of this\n      // token's ten minutes.\n      if (await storage.get(storageKey)) {\n        try { await refresh(); } catch { /* verification still succeeded */ }\n      }\n    },\n\n    async resendVerification() {\n      await call('POST', '/auth/verify-email/resend');\n    },\n\n    async forgotPassword(email) {\n      // Always 202, whether or not the address has an account. Do not infer\n      // anything from it and do not tell the buyer whether it existed.\n      await request({ ...base, method: 'POST', path: '/auth/forgot-password', body: { email } });\n    },\n\n    async resetPassword(token, password) {\n      await request({ ...base, method: 'POST', path: '/auth/reset-password', body: { token, password } });\n      // The server revokes every session on reset, this one included.\n      await forget();\n    },\n\n    async changePassword(password) {\n      await call('POST', '/me/change-password', { password });\n      // The change bumps the session epoch. This session was deliberately\n      // spared, but the access token in hand now carries a stale epoch and the\n      // next write would 401. Rotate now rather than on the buyer's next click\n      // — and do not let a failed rotation report a change that already\n      // succeeded server-side as a failure.\n      try { await refresh(); } catch { /* the password change already succeeded */ }\n    },\n\n    async listSessions() {\n      return call<DeviceSession[]>('GET', '/me/sessions');\n    },\n\n    async revokeSession(id) {\n      const mine = await call<DeviceSession[]>('GET', '/me/sessions');\n      const current = mine.find((s) => s.current);\n      await call('DELETE', `/me/sessions/${encodeURIComponent(id)}`);\n      if (current?.id === id) await forget();\n    },\n\n    // The core never claims a cart; `ThrottleProvider` overrides this with one\n    // that tracks its sign-in claim.\n    whenClaimSettled: () => Promise.resolve(),\n  };\n}\n\nexport type { AuthSnapshot, Customer, Session, ThrottleAuthConfig };\n","import type { ThrottleAuth } from './client';\nimport { ThrottleAuthError } from './errors';\nimport type {\n  Address, AddressInput, Customer, Invoice, OpenCart, Order, OrderDetail,\n  PaymentMethod, ProfilePatch, Subscription, SubscriptionShippingAddress,\n} from './types';\n\nexport interface Page { cursor?: string; limit?: number }\n\n/** What the payment widget needs to render a card form. Passed through from\n *  the processor — `buyerExternalIdentifier` in particular must reach the\n *  widget unchanged, because the session token pins it and the processor\n *  refuses a mismatch by rendering nothing at all. */\nexport interface CardSetupSession {\n  embedToken: string;\n  checkoutSessionId: string;\n  amount: number;\n  currency: string;\n  merchantAccountId?: string;\n  environment?: string;\n  buyerExternalIdentifier: string;\n  country: string;\n  /** A ready-made page that hosts the card form, if you would rather redirect\n   *  or iframe than embed the widget yourself. */\n  hostedUrl: string;\n  embedUrl: string;\n}\n\nexport interface ThrottleAccount {\n  getProfile(): Promise<Customer>;\n  updateProfile(patch: ProfilePatch): Promise<Customer>;\n  listAddresses(): Promise<Address[]>;\n  createAddress(input: AddressInput): Promise<Address>;\n  updateAddress(id: string, patch: Partial<AddressInput>): Promise<Address>;\n  deleteAddress(id: string): Promise<void>;\n  listPaymentMethods(): Promise<PaymentMethod[]>;\n  setDefaultPaymentMethod(id: string): Promise<PaymentMethod>;\n  deletePaymentMethod(id: string): Promise<void>;\n  /** Opens a processor-hosted session the buyer types their card into. The\n   *  returned values are handed straight to the payment widget. */\n  startCardSetup(): Promise<CardSetupSession>;\n  /** Records the card the widget just vaulted, identified by the transaction\n   *  the widget returns. Safe to call twice with the same id. */\n  confirmCardSetup(transactionId: string): Promise<PaymentMethod>;\n  listOrders(page?: Page): Promise<Order[]>;\n  getOrder(id: string): Promise<OrderDetail>;\n  listInvoices(page?: Page): Promise<Invoice[]>;\n  getInvoice(id: string): Promise<Invoice>;\n  /** A 600-second signed URL. Fetch it on click — it expires. */\n  getInvoicePdfUrl(id: string): Promise<{ url: string }>;\n  listSubscriptions(page?: Page): Promise<Subscription[]>;\n  getSubscription(id: string): Promise<Subscription>;\n  /**\n   * Voids an unpaid order. Refused once money has been captured — that is a\n   * return, not a cancellation, and only the merchant may move money back.\n   */\n  cancelOrder(id: string, opts?: { reason?: string }): Promise<Order>;\n  /** Opens an RMA the merchant approves. Changes no order state by itself. */\n  requestOrderReturn(\n    id: string,\n    input: { items: Array<{ lineItemId: string; quantity: number }>; reason?: string },\n  ): Promise<{ id: string; status: string }>;\n  cancelSubscription(id: string, opts?: { atPeriodEnd?: boolean }): Promise<Subscription>;\n  pauseSubscription(id: string): Promise<Subscription>;\n  resumeSubscription(id: string): Promise<Subscription>;\n  /**\n   * Where a physical subscription's box goes, from the next renewal. Needs a\n   * fresh sign-in (step-up), like cancelling. A subscription that ships\n   * nothing answers `subscription_not_physical`.\n   */\n  updateSubscriptionShippingAddress(id: string, address: SubscriptionShippingAddress): Promise<Subscription>;\n  claimCart(cartId: string): Promise<{ cartId: string; customerId: string }>;\n  /**\n   * The buyer's newest open or idle-abandoned cart in `currency` (see `status`), or null. Answers null as well\n   * when the API predates the route (404). Always present on the account that\n   * `createAccount` and `ThrottleProvider` build; optional here so a hand-made\n   * `ThrottleAccount` written against 0.11 still compiles.\n   */\n  getOpenCart?(input: { currency: string }): Promise<OpenCart | null>;\n}\n\nconst seg = (v: string) => encodeURIComponent(v);\n\nfunction query(page?: Page): string {\n  const params = new URLSearchParams();\n  if (page?.cursor) params.set('cursor', page.cursor);\n  if (page?.limit != null) params.set('limit', String(page.limit));\n  const s = params.toString();\n  return s ? `?${s}` : '';\n}\n\nexport function createAccount(\n  auth: ThrottleAuth,\n): ThrottleAccount & Required<Pick<ThrottleAccount, 'getOpenCart'>> {\n  const { call } = auth;\n  return {\n    getProfile: () => call('GET', '/me'),\n    updateProfile: (patch) => call('PATCH', '/me', patch),\n\n    listAddresses: () => call('GET', '/me/addresses'),\n    createAddress: (input) => call('POST', '/me/addresses', input),\n    updateAddress: (id, patch) => call('PATCH', `/me/addresses/${seg(id)}`, patch),\n    deleteAddress: (id) => call('DELETE', `/me/addresses/${seg(id)}`),\n\n    listPaymentMethods: () => call('GET', '/me/payment-methods'),\n    // The platform has no \"change this subscription's card\" capability, so\n    // this is how a buyer changes what they are billed on: move the default.\n    setDefaultPaymentMethod: (id) => call('PATCH', `/me/payment-methods/${seg(id)}`, { isDefault: true }),\n    deletePaymentMethod: (id) => call('DELETE', `/me/payment-methods/${seg(id)}`),\n\n    // Saving a card is two calls because the card number never reaches us: the\n    // first mints a processor-hosted embed session, the buyer types their card\n    // into that, and the second records what the processor vaulted. Everything\n    // about the saved card is read back from the processor, so nothing here\n    // trusts what the browser claims the card was.\n    startCardSetup: () => call('POST', '/me/payment-methods/embed-token'),\n    confirmCardSetup: (transactionId) =>\n      call('POST', '/me/payment-methods/confirm', { transactionId }),\n\n    listOrders: (page) => call('GET', `/me/orders${query(page)}`),\n    getOrder: (id) => call('GET', `/me/orders/${seg(id)}`),\n    listInvoices: (page) => call('GET', `/me/invoices${query(page)}`),\n    getInvoice: (id) => call('GET', `/me/invoices/${seg(id)}`),\n    getInvoicePdfUrl: (id) => call('GET', `/me/invoices/${seg(id)}/pdf`),\n    listSubscriptions: (page) => call('GET', `/me/subscriptions${query(page)}`),\n    getSubscription: (id) => call('GET', `/me/subscriptions/${seg(id)}`),\n\n    cancelOrder: (id, opts) => call('POST', `/me/orders/${seg(id)}/cancel`, opts),\n    requestOrderReturn: (id, input) => call('POST', `/me/orders/${seg(id)}/return-request`, input),\n    cancelSubscription: (id, opts) => call('POST', `/me/subscriptions/${seg(id)}/cancel`, opts),\n    pauseSubscription: (id) => call('POST', `/me/subscriptions/${seg(id)}/pause`),\n    resumeSubscription: (id) => call('POST', `/me/subscriptions/${seg(id)}/resume`),\n    updateSubscriptionShippingAddress: (id, address) =>\n      call('PATCH', `/me/subscriptions/${seg(id)}/shipping-address`, address),\n\n    claimCart: (cartId) => call('POST', `/me/carts/${seg(cartId)}/claim`),\n\n    async getOpenCart({ currency }) {\n      if (typeof currency !== 'string' || !/^[A-Za-z]{3}$/.test(currency)) {\n        throw new TypeError('getOpenCart: currency must be a 3-letter ISO code');\n      }\n      try {\n        return await call<OpenCart | null>('GET', `/me/cart?currency=${currency.toUpperCase()}`);\n      } catch (err) {\n        // An API that predates the route: no cart to follow, not a failure.\n        if (err instanceof ThrottleAuthError && err.statusCode === 404) return null;\n        throw err;\n      }\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAAqG;AAC/G,UAAM,KAAK,OAAO;AAClB,SAAK,OAAO;AACZ,SAAK,OAAO,KAAK;AACjB,SAAK,aAAa,KAAK;AACvB,SAAK,aAAa,KAAK;AACvB,SAAK,UAAU,KAAK;AAAA,EACtB;AACF;;;ACDA,eAAsB,QAAQ,OAAmC;AAC/D,QAAM,UAAkC,EAAE,aAAa,MAAM,eAAe;AAC5E,MAAI,MAAM,SAAS,OAAW,SAAQ,cAAc,IAAI;AACxD,MAAI,MAAM,YAAa,SAAQ,gBAAgB,UAAU,MAAM,WAAW;AAC1E,MAAI,MAAM,YAAa,SAAQ,WAAW,IAAI,MAAM;AAEpD,QAAM,MAAM,MAAM,MAAM,GAAG,MAAM,OAAO,iBAAiB,MAAM,IAAI,IAAI;AAAA,IACrE,QAAQ,MAAM;AAAA,IACd;AAAA,IACA,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,KAAK,UAAU,MAAM,IAAI,EAAE,IAAI,CAAC;AAAA,EACzE,CAAC;AAED,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,MAAI,SAAc,CAAC;AACnB,MAAI;AACF,aAAS,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC;AAAA,EACtC,QAAQ;AAAA,EAGR;AAEA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI,QAAQ,SAAS,CAAC;AAG5B,UAAM,KAAK,OAAO,IAAI,QAAQ,IAAI,aAAa,CAAC;AAChD,UAAM,IAAI,kBAAkB;AAAA,MAC1B,MAAM,EAAE,QAAQ;AAAA,MAChB,SAAS,EAAE,WAAW,uBAAuB,IAAI,MAAM;AAAA,MACvD,YAAY,IAAI;AAAA,MAChB,YAAY,OAAO,SAAS,EAAE,KAAK,MAAM,IAAI,KAAK;AAAA,MAClD,SAAS,EAAE;AAAA,IACb,CAAC;AAAA,EACH;AAKA,SAAO,UAAU,OAAO,WAAW,YAAY,UAAU,SAAS,OAAO,OAAQ,UAAU,CAAC;AAC9F;;;AClCO,IAAM,eAAN,MAAmB;AAAA,EACxB,YAA0B,EAAE,QAAQ,WAAW,UAAU,MAAM,eAAe,MAAM;AAAA,EACpF,eAA8B;AAAA,EAC9B,aAA4B;AAAA,EAC5B,aAAa,oBAAI,IAAc;AAAA,EAE/B,MAAoB;AAAE,WAAO,KAAK;AAAA,EAAW;AAAA,EAC7C,cAA6B;AAAE,WAAO,KAAK;AAAA,EAAc;AAAA,EACzD,YAA2B;AAAE,WAAO,KAAK;AAAA,EAAY;AAAA,EAErD,WAAW,SAAwB;AACjC,SAAK,eAAe,QAAQ;AAC5B,SAAK,aAAa,KAAK,MAAM,QAAQ,SAAS;AAC9C,SAAK,SAAS;AAAA,MACZ,QAAQ;AAAA,MACR,UAAU,QAAQ;AAAA,MAClB,eAAe,QAAQ,QAAQ,UAAU,aAAa;AAAA,IACxD,CAAC;AAAA,EACH;AAAA,EAEA,UAAU,QAA0B;AAClC,SAAK,SAAS,EAAE,GAAG,KAAK,WAAW,OAAO,CAAC;AAAA,EAC7C;AAAA,EAEA,QAAc;AACZ,SAAK,eAAe;AACpB,SAAK,aAAa;AAClB,SAAK,SAAS,EAAE,QAAQ,mBAAmB,UAAU,MAAM,eAAe,MAAM,CAAC;AAAA,EACnF;AAAA,EAEA,UAAU,IAA0B;AAClC,SAAK,WAAW,IAAI,EAAE;AACtB,WAAO,MAAM;AAAE,WAAK,WAAW,OAAO,EAAE;AAAA,IAAG;AAAA,EAC7C;AAAA,EAEA,SAAS,MAA0B;AAIjC,UAAM,OACJ,KAAK,WAAW,KAAK,UAAU,UAC/B,KAAK,kBAAkB,KAAK,UAAU,iBACtC,eAAe,KAAK,UAAU,KAAK,UAAU,QAAQ;AACvD,QAAI,KAAM;AACV,SAAK,YAAY;AACjB,eAAW,MAAM,CAAC,GAAG,KAAK,UAAU,GAAG;AAErC,UAAI;AAAE,WAAG,IAAI;AAAA,MAAG,QAAQ;AAAA,MAA0B;AAAA,IACpD;AAAA,EACF;AACF;AAEA,SAAS,eAAe,GAAoB,GAA6B;AACvE,MAAI,MAAM,EAAG,QAAO;AACpB,MAAI,CAAC,KAAK,CAAC,EAAG,QAAO;AACrB,QAAM,OAAO,oBAAI,IAAI,CAAC,GAAG,OAAO,KAAK,CAAC,GAAG,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC;AAC3D,aAAW,KAAK,KAAM,KAAI,EAAE,CAAC,MAAM,EAAE,CAAC,EAAG,QAAO;AAChD,SAAO;AACT;;;ACxEO,SAAS,gBAA6B;AAC3C,QAAM,MAAM,oBAAI,IAAoB;AACpC,SAAO;AAAA,IACL,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK;AAAA,IAC1B,KAAK,CAAC,GAAG,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC;AAAA,IAChC,QAAQ,CAAC,MAAM,KAAK,IAAI,OAAO,CAAC;AAAA,EAClC;AACF;AAOO,SAAS,sBAAmC;AACjD,QAAM,WAAW,cAAc;AAC/B,QAAM,KAAK,MAAsB;AAC/B,QAAI;AACF,aAAO,OAAO,iBAAiB,cAAc,eAAe;AAAA,IAC9D,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AAAA,IACL,IAAI,GAAG;AACL,UAAI;AACF,cAAM,IAAI,GAAG,GAAG,QAAQ,CAAC;AACzB,YAAI,KAAK,KAAM,QAAO;AAAA,MACxB,QAAQ;AAAA,MAAqB;AAC7B,aAAO,SAAS,IAAI,CAAC;AAAA,IACvB;AAAA,IACA,IAAI,GAAG,GAAG;AACR,eAAS,IAAI,GAAG,CAAC;AACjB,UAAI;AAAE,WAAG,GAAG,QAAQ,GAAG,CAAC;AAAA,MAAG,QAAQ;AAAA,MAAiC;AAAA,IACtE;AAAA,IACA,OAAO,GAAG;AACR,eAAS,OAAO,CAAC;AACjB,UAAI;AAAE,WAAG,GAAG,WAAW,CAAC;AAAA,MAAG,QAAQ;AAAA,MAAqB;AAAA,IAC1D;AAAA,EACF;AACF;;;ACtCA,IAAM,mBAAmB;AAEzB,IAAM,kBAAkB;AA8CjB,SAAS,mBACd,QACiE;AACjE,QAAM,WAAW,OAAO,WAAW,kBAAkB,QAAQ,OAAO,EAAE;AACtE,QAAM,UAAuB,OAAO,WAAW,oBAAoB;AAGnE,QAAM,aAAa,oBAAoB,OAAO,cAAc;AAC5D,QAAM,WAAW,yBAAyB,OAAO,cAAc;AAE/D,QAAM,QAAQ,IAAI,aAAa;AAC/B,MAAI,kBAAwC;AAC5C,MAAI,cAA6B;AACjC,MAAI,kBAAkB;AAEtB,QAAM,OAAO,EAAE,SAAS,gBAAgB,OAAO,eAAe;AAE9D,iBAAe,QAAQ,SAAiC;AACtD,UAAM,WAAW,OAAO;AACxB,UAAM,QAAQ,IAAI,YAAY,QAAQ,YAAY;AAAA,EACpD;AAEA,iBAAe,SAAwB;AACrC,kBAAc;AACd,UAAM,MAAM;AACZ,UAAM,QAAQ,OAAO,UAAU;AAAA,EACjC;AAQA,WAAS,SAAY,IAAkC;AACrD,UAAM,QAAS,WAAmB,WAAW;AAC7C,WAAO,OAAO,UAAU,MAAM,QAAQ,UAAU,EAAE,IAAI,GAAG;AAAA,EAC3D;AAEA,iBAAe,YAA2B;AACxC,UAAM,SAAS,YAAY;AAGzB,YAAM,eAAe,MAAM,QAAQ,IAAI,UAAU;AACjD,UAAI,CAAC,cAAc;AACjB,cAAM,OAAO;AACb,cAAM,IAAI,kBAAkB,EAAE,MAAM,mBAAmB,SAAS,cAAc,YAAY,IAAI,CAAC;AAAA,MACjG;AACA,UAAI;AACF,cAAM,OAAO,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,iBAAiB,MAAM,EAAE,aAAa,EAAE,CAAC;AACrG,cAAM,QAAQ,IAAe;AAAA,MAC/B,SAAS,KAAK;AAcZ,cAAM,UACJ,eAAe,sBAAsB,IAAI,eAAe,OAAO,IAAI,eAAe;AACpF,YAAI,QAAS,OAAM,OAAO;AAC1B,cAAM;AAAA,MACR;AAAA,IACF,CAAC;AAAA,EACH;AAEA,WAAS,UAAyB;AAChC,QAAI,CAAC,iBAAiB;AACpB,wBAAkB,UAAU,EAAE,QAAQ,MAAM;AAAE,0BAAkB;AAAA,MAAM,CAAC;AAAA,IACzE;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,cAAsC;AACnD,UAAM,UAAU,MAAM,UAAU;AAChC,QAAI,MAAM,YAAY,KAAK,WAAW,UAAU,KAAK,IAAI,IAAI,iBAAiB;AAC5E,aAAO,MAAM,YAAY;AAAA,IAC3B;AACA,QAAI,MAAM,QAAQ,IAAI,UAAU,GAAG;AACjC,YAAM,QAAQ;AACd,aAAO,MAAM,YAAY;AAAA,IAC3B;AACA,WAAO,MAAM,YAAY;AAAA,EAC3B;AAEA,iBAAe,eAAiC;AAC9C,QAAI,eAAe,kBAAkB,KAAK,IAAI,EAAG,QAAO;AACxD,QAAI,CAAC,OAAO,iBAAkB,QAAO;AACrC,UAAM,WAAW,MAAM,OAAO,iBAAiB;AAC/C,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,OAAO,QAAQ;AACrB,WAAO;AAAA,EACT;AAEA,iBAAe,OAAO,UAAiC;AACrD,UAAM,OAAO,MAAM,QAAQ;AAAA,MACzB,GAAG;AAAA,MAAM,QAAQ;AAAA,MAAQ,MAAM;AAAA,MAC/B,aAAa,MAAM,YAAY,KAAK;AAAA,MAAW,MAAM,EAAE,SAAS;AAAA,IAClE,CAAC;AACD,kBAAc,KAAK;AACnB,sBAAkB,KAAK,IAAI,KAAK,OAAO,KAAK,SAAS,KAAK,OAAO,MAAO;AAAA,EAC1E;AAEA,iBAAe,KAAc,QAAgB,MAAc,MAA4B;AACrF,QAAI,cAAc;AAClB,QAAI,gBAAgB;AAOpB,QAAI,aAAa;AAEjB,eAAS;AACP,YAAM,QAAQ,MAAM,YAAY;AAChC,UAAI;AACF,eAAO,MAAM,QAAQ;AAAA,UACnB,GAAG;AAAA,UAAM;AAAA,UAAQ;AAAA,UAAM;AAAA,UACvB,aAAa,SAAS;AAAA,UACtB,aAAa,aAAc,eAAe,SAAa;AAAA,QACzD,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,cAAM,IAAI;AAOV,cAAM,UAAU,EAAE,eAAe,QAC9B,EAAE,SAAS,kBAAkB,EAAE,SAAS,mBAAmB,EAAE,SAAS;AACzE,YAAI,WAAW,CAAC,aAAa;AAC3B,wBAAc;AACd,gBAAM,QAAQ;AACd;AAAA,QACF;AACA,YAAI,EAAE,SAAS,sBAAsB,CAAC,eAAe;AACnD,0BAAgB;AAIhB,cAAI,MAAM,aAAa,GAAG;AAAE,yBAAa;AAAM;AAAA,UAAU;AAAA,QAC3D;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,SAAS,OAAO,UAAU;AAC9B,YAAM,OAAO,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,kBAAkB,MAAM,EAAE,OAAO,SAAS,EAAE,CAAC;AACzG,UAAI,MAAM,WAAW,UAAW,QAAO,EAAE,QAAQ,UAAU;AAC3D,YAAM,QAAQ,IAAe;AAC7B,aAAO,EAAE,QAAQ,SAAS;AAAA,IAC5B;AAAA,IAEA,MAAM,OAAO,OAAO,UAAU;AAC5B,YAAM,OAAO,MAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,eAAe,MAAM,EAAE,OAAO,SAAS,EAAE,CAAC;AACtG,YAAM,QAAQ,IAAe;AAAA,IAC/B;AAAA,IAEA,MAAM,UAAU;AACd,UAAI;AAAE,cAAM,KAAK,QAAQ,cAAc;AAAA,MAAG,QAAQ;AAAA,MAA+B;AACjF,YAAM,OAAO;AAAA,IACf;AAAA,IAEA,MAAM,oBAAoB;AACxB,UAAI;AAAE,cAAM,KAAK,QAAQ,kBAAkB;AAAA,MAAG,QAAQ;AAAA,MAA+B;AACrF,YAAM,OAAO;AAAA,IACf;AAAA,IAEA,MAAM,UAAU;AACd,UAAI,CAAE,MAAM,QAAQ,IAAI,UAAU,GAAI;AAAE,cAAM,UAAU,iBAAiB;AAAG;AAAA,MAAQ;AACpF,UAAI;AAAE,cAAM,QAAQ;AAAA,MAAG,QAAQ;AAAA,MAA6B;AAAA,IAC9D;AAAA,IAEA,aAAa,MAAM,MAAM,IAAI;AAAA,IAE7B,MAAM,iBAAiB;AACrB,UAAI;AACF,eAAO,MAAM,YAAY;AAAA,MAC3B,SAAS,KAAK;AAGZ,YAAI,MAAM,IAAI,EAAE,WAAW,kBAAmB,QAAO;AACrD,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IAEA,WAAW,CAAC,OAAO,MAAM,UAAU,EAAE;AAAA,IACrC;AAAA,IACA;AAAA,IAEA,MAAM,YAAY,OAAO;AACvB,YAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,sBAAsB,MAAM,EAAE,MAAM,EAAE,CAAC;AAKtF,UAAI,MAAM,QAAQ,IAAI,UAAU,GAAG;AACjC,YAAI;AAAE,gBAAM,QAAQ;AAAA,QAAG,QAAQ;AAAA,QAAqC;AAAA,MACtE;AAAA,IACF;AAAA,IAEA,MAAM,qBAAqB;AACzB,YAAM,KAAK,QAAQ,2BAA2B;AAAA,IAChD;AAAA,IAEA,MAAM,eAAe,OAAO;AAG1B,YAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,yBAAyB,MAAM,EAAE,MAAM,EAAE,CAAC;AAAA,IAC3F;AAAA,IAEA,MAAM,cAAc,OAAO,UAAU;AACnC,YAAM,QAAQ,EAAE,GAAG,MAAM,QAAQ,QAAQ,MAAM,wBAAwB,MAAM,EAAE,OAAO,SAAS,EAAE,CAAC;AAElG,YAAM,OAAO;AAAA,IACf;AAAA,IAEA,MAAM,eAAe,UAAU;AAC7B,YAAM,KAAK,QAAQ,uBAAuB,EAAE,SAAS,CAAC;AAMtD,UAAI;AAAE,cAAM,QAAQ;AAAA,MAAG,QAAQ;AAAA,MAA8C;AAAA,IAC/E;AAAA,IAEA,MAAM,eAAe;AACnB,aAAO,KAAsB,OAAO,cAAc;AAAA,IACpD;AAAA,IAEA,MAAM,cAAc,IAAI;AACtB,YAAM,OAAO,MAAM,KAAsB,OAAO,cAAc;AAC9D,YAAM,UAAU,KAAK,KAAK,CAAC,MAAM,EAAE,OAAO;AAC1C,YAAM,KAAK,UAAU,gBAAgB,mBAAmB,EAAE,CAAC,EAAE;AAC7D,UAAI,SAAS,OAAO,GAAI,OAAM,OAAO;AAAA,IACvC;AAAA;AAAA;AAAA,IAIA,kBAAkB,MAAM,QAAQ,QAAQ;AAAA,EAC1C;AACF;;;AClOA,IAAM,MAAM,CAAC,MAAc,mBAAmB,CAAC;AAE/C,SAAS,MAAM,MAAqB;AAClC,QAAM,SAAS,IAAI,gBAAgB;AACnC,MAAI,MAAM,OAAQ,QAAO,IAAI,UAAU,KAAK,MAAM;AAClD,MAAI,MAAM,SAAS,KAAM,QAAO,IAAI,SAAS,OAAO,KAAK,KAAK,CAAC;AAC/D,QAAM,IAAI,OAAO,SAAS;AAC1B,SAAO,IAAI,IAAI,CAAC,KAAK;AACvB;AAEO,SAAS,cACd,MACkE;AAClE,QAAM,EAAE,KAAK,IAAI;AACjB,SAAO;AAAA,IACL,YAAY,MAAM,KAAK,OAAO,KAAK;AAAA,IACnC,eAAe,CAAC,UAAU,KAAK,SAAS,OAAO,KAAK;AAAA,IAEpD,eAAe,MAAM,KAAK,OAAO,eAAe;AAAA,IAChD,eAAe,CAAC,UAAU,KAAK,QAAQ,iBAAiB,KAAK;AAAA,IAC7D,eAAe,CAAC,IAAI,UAAU,KAAK,SAAS,iBAAiB,IAAI,EAAE,CAAC,IAAI,KAAK;AAAA,IAC7E,eAAe,CAAC,OAAO,KAAK,UAAU,iBAAiB,IAAI,EAAE,CAAC,EAAE;AAAA,IAEhE,oBAAoB,MAAM,KAAK,OAAO,qBAAqB;AAAA;AAAA;AAAA,IAG3D,yBAAyB,CAAC,OAAO,KAAK,SAAS,uBAAuB,IAAI,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,CAAC;AAAA,IACpG,qBAAqB,CAAC,OAAO,KAAK,UAAU,uBAAuB,IAAI,EAAE,CAAC,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAO5E,gBAAgB,MAAM,KAAK,QAAQ,iCAAiC;AAAA,IACpE,kBAAkB,CAAC,kBACjB,KAAK,QAAQ,+BAA+B,EAAE,cAAc,CAAC;AAAA,IAE/D,YAAY,CAAC,SAAS,KAAK,OAAO,aAAa,MAAM,IAAI,CAAC,EAAE;AAAA,IAC5D,UAAU,CAAC,OAAO,KAAK,OAAO,cAAc,IAAI,EAAE,CAAC,EAAE;AAAA,IACrD,cAAc,CAAC,SAAS,KAAK,OAAO,eAAe,MAAM,IAAI,CAAC,EAAE;AAAA,IAChE,YAAY,CAAC,OAAO,KAAK,OAAO,gBAAgB,IAAI,EAAE,CAAC,EAAE;AAAA,IACzD,kBAAkB,CAAC,OAAO,KAAK,OAAO,gBAAgB,IAAI,EAAE,CAAC,MAAM;AAAA,IACnE,mBAAmB,CAAC,SAAS,KAAK,OAAO,oBAAoB,MAAM,IAAI,CAAC,EAAE;AAAA,IAC1E,iBAAiB,CAAC,OAAO,KAAK,OAAO,qBAAqB,IAAI,EAAE,CAAC,EAAE;AAAA,IAEnE,aAAa,CAAC,IAAI,SAAS,KAAK,QAAQ,cAAc,IAAI,EAAE,CAAC,WAAW,IAAI;AAAA,IAC5E,oBAAoB,CAAC,IAAI,UAAU,KAAK,QAAQ,cAAc,IAAI,EAAE,CAAC,mBAAmB,KAAK;AAAA,IAC7F,oBAAoB,CAAC,IAAI,SAAS,KAAK,QAAQ,qBAAqB,IAAI,EAAE,CAAC,WAAW,IAAI;AAAA,IAC1F,mBAAmB,CAAC,OAAO,KAAK,QAAQ,qBAAqB,IAAI,EAAE,CAAC,QAAQ;AAAA,IAC5E,oBAAoB,CAAC,OAAO,KAAK,QAAQ,qBAAqB,IAAI,EAAE,CAAC,SAAS;AAAA,IAC9E,mCAAmC,CAAC,IAAI,YACtC,KAAK,SAAS,qBAAqB,IAAI,EAAE,CAAC,qBAAqB,OAAO;AAAA,IAExE,WAAW,CAAC,WAAW,KAAK,QAAQ,aAAa,IAAI,MAAM,CAAC,QAAQ;AAAA,IAEpE,MAAM,YAAY,EAAE,SAAS,GAAG;AAC9B,UAAI,OAAO,aAAa,YAAY,CAAC,gBAAgB,KAAK,QAAQ,GAAG;AACnE,cAAM,IAAI,UAAU,mDAAmD;AAAA,MACzE;AACA,UAAI;AACF,eAAO,MAAM,KAAsB,OAAO,qBAAqB,SAAS,YAAY,CAAC,EAAE;AAAA,MACzF,SAAS,KAAK;AAEZ,YAAI,eAAe,qBAAqB,IAAI,eAAe,IAAK,QAAO;AACvE,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;;;ANxIA,YAAuB;AACvB,mBAWO;","names":[]}

package/dist/index.d.cts

@@ -1,3 +1,8 @@
+import { CurrencyCode } from '@usethrottle/money';
+import * as money from '@usethrottle/money';
+export { money };
+export { CURRENCIES, CurrencyCode, MoneyValue, UnknownCurrencyError, currencySymbol, formatMoney, isKnownCurrency, minorUnitsOf, moneyValue, parseMoney, toDecimalString, toMinor } from '@usethrottle/money';
+
 interface Customer {
     id: string;
     email: string;
@@ -85,7 +90,7 @@ interface Order {
     status: string;
     type: string;
     paymentStatus: string;
-    currency: string;
+    currency: CurrencyCode;
     subtotal: number;
     taxTotal: number;
     discountTotal: number;
@@ -162,7 +167,7 @@ interface Invoice {
     id: string;
     number: string;
     status: string;
-    currency: string;
+    currency: CurrencyCode;
     subtotal: number;
     taxTotal: number;
     shippingTotal: number;
@@ -224,7 +229,7 @@ interface Subscription {
     nextPaymentAmount?: number | null;
     amount: number;
     quantity: number;
-    currency: string;
+    currency: CurrencyCode;
     currentPeriodStart: string;
     currentPeriodEnd: string;
     trialEnd: string | null;

package/dist/index.d.ts

@@ -1,3 +1,8 @@
+import { CurrencyCode } from '@usethrottle/money';
+import * as money from '@usethrottle/money';
+export { money };
+export { CURRENCIES, CurrencyCode, MoneyValue, UnknownCurrencyError, currencySymbol, formatMoney, isKnownCurrency, minorUnitsOf, moneyValue, parseMoney, toDecimalString, toMinor } from '@usethrottle/money';
+
 interface Customer {
     id: string;
     email: string;
@@ -85,7 +90,7 @@ interface Order {
     status: string;
     type: string;
     paymentStatus: string;
-    currency: string;
+    currency: CurrencyCode;
     subtotal: number;
     taxTotal: number;
     discountTotal: number;
@@ -162,7 +167,7 @@ interface Invoice {
     id: string;
     number: string;
     status: string;
-    currency: string;
+    currency: CurrencyCode;
     subtotal: number;
     taxTotal: number;
     shippingTotal: number;
@@ -224,7 +229,7 @@ interface Subscription {
     nextPaymentAmount?: number | null;
     amount: number;
     quantity: number;
-    currency: string;
+    currency: CurrencyCode;
     currentPeriodStart: string;
     currentPeriodEnd: string;
     trialEnd: string | null;

package/dist/index.js

@@ -407,11 +407,37 @@ function createAccount(auth) {
     }
   };
 }
+
+// src/index.ts
+import * as money from "@usethrottle/money";
+import {
+  formatMoney,
+  currencySymbol,
+  minorUnitsOf,
+  toDecimalString,
+  toMinor,
+  parseMoney,
+  moneyValue,
+  CURRENCIES,
+  isKnownCurrency,
+  UnknownCurrencyError
+} from "@usethrottle/money";
 export {
+  CURRENCIES,
   ThrottleAuthError,
+  UnknownCurrencyError,
   createAccount,
   createThrottleAuth,
+  currencySymbol,
+  formatMoney,
+  isKnownCurrency,
   localStorageAdapter,
-  memoryStorage
+  memoryStorage,
+  minorUnitsOf,
+  money,
+  moneyValue,
+  parseMoney,
+  toDecimalString,
+  toMinor
 };
 //# sourceMappingURL=index.js.map