@zappie/sdk 0.1.16 → 0.1.17

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @zappie/sdk
 
+## 0.1.17
+
+### Patch Changes
+
+- a151b0b: `@zappie/sdk/server` adds the menu snapshot types and helpers that edge menu reads are built on. `MenuSnapshot` wraps the SDK `Menu` that `menu.get()` returns, with the store, the branch, the API's menu version and a `contentHash`. `StoreSnapshot` wraps the SDK `Store`, and `AvailabilityPatch` lists the items, variants and choices that sold out since the menu was built.
+
+  - `canonicalJson()` writes a value with sorted keys, so equal values give the same text. `snapshotHash()` returns the first 16 hex digits of its SHA-256.
+  - `createMenuSnapshot()` builds a snapshot from a complete menu and refuses a partial one. `menuSnapshotFromPayload()` maps the API's menu payload with the same mapper `menu.get()` uses.
+  - `createStoreSnapshot()` and `createAvailabilityPatch()` build the other two. A patch's ids are sorted and unique, so equal patches hash the same.
+  - `applyAvailability()` returns the snapshot's menu with a patch applied, and ignores a patch older than the snapshot.
+  - `isMenuSnapshot()` checks a value read back from storage, and `snapshotKeys` names the storage keys.
+
+- 195a5b8: `@zappie/sdk/server` adds the building blocks for signing customers in on a site you host yourself. They use Web Crypto only, so they run in Workers and Node 20 or later.
+
+  - `createPkce()` returns a PKCE verifier and its S256 challenge. `randomToken()` returns a random URL-safe value for state, nonces and ids.
+  - `sealValue()` and `openSealedValue()` keep a JSON value in an AES-GCM sealed string. Pass several secrets to rotate: the first seals and any of them opens. A `purpose` binds the value to one use. Without one, the format matches Zappie's hosted sign-in.
+  - `createTokenVerifier({ issuer, audience })` verifies RS256 and ES256 tokens against the issuer's keys at `<issuer>/.well-known/jwks.json`, or a `jwksUrl` you set. It caches the keys for an hour, reads them again once when a token names a new key, and keeps the last good keys while the issuer is down. While the issuer is down and no keys are cached, it reads them at most every 30 seconds, and a set with no usable keys never replaces good ones. It checks the issuer (a trailing slash on either side is ignored), the audience, the expiry with 60 seconds of leeway, `nbf`, `iat`, the nonce you pass and a required `cus_` subject. `verifyIdToken(token, { nonce })` needs the nonce and a subject, and refuses a token whose `typ` names another kind, such as an access token. A refused token throws `ZappieTokenError` with a `reason`.
+  - `SessionStore` is the interface every session store implements. `cookieSessionStore({ secret })` keeps the whole session sealed in the cookie for up to 30 days. It can't end sessions from the server, so its `deleteBySub` rejects, and signing out doesn't invalidate a copied cookie before it expires.
+
 ## 0.1.16
 
 ### Patch Changes

package/README.md

@@ -50,24 +50,50 @@ Prices always come from Zappie. The cart shows a local estimate while it waits,
 
 ## Entry points
 
-| Import                                       | For                                                                    |
-| -------------------------------------------- | ---------------------------------------------------------------------- |
-| `@zappie/sdk`                                | The client, the cart, money formatting and errors                      |
-| `@zappie/sdk/react`                          | `ZappieProvider` and hooks such as `useStore`, `useMenu` and `useCart` |
-| `@zappie/sdk/checkout`                       | Opening Zappie's hosted checkout and checking it completed             |
-| `@zappie/sdk/checkout-defaults`              | The phone, address, region and time a signed-in checkout starts from   |
-| `@zappie/sdk/customer` and `/customer/react` | Signed-in customers, their orders and saved addresses                  |
-| `@zappie/sdk/integrations`                   | Public integration IDs and browser keys                                |
-| `@zappie/sdk/places`                         | Address search and delivery-zone checks                                |
-| `@zappie/sdk/pricing`                        | An item's starting price and whether to show it as "From"              |
-| `@zappie/sdk/server`                         | Server-side reads, storefront URLs and `verifyWebhook()`               |
-| `@zappie/sdk/template` and `/template/react` | Template settings and responsive images for template authors           |
-| `@zappie/sdk/testing`                        | A mock client for your tests                                           |
-| `@zappie/sdk/url`                            | Storefront URL parsing and canonical redirects                         |
-| `@zappie/sdk/redirect`                       | Same-origin validation for untrusted redirect targets                  |
+| Import                                       | For                                                                                      |
+| -------------------------------------------- | ---------------------------------------------------------------------------------------- |
+| `@zappie/sdk`                                | The client, the cart, money formatting and errors                                        |
+| `@zappie/sdk/react`                          | `ZappieProvider` and hooks such as `useStore`, `useMenu` and `useCart`                   |
+| `@zappie/sdk/checkout`                       | Opening Zappie's hosted checkout and checking it completed                               |
+| `@zappie/sdk/checkout-defaults`              | The phone, address, region and time a signed-in checkout starts from                     |
+| `@zappie/sdk/customer` and `/customer/react` | Signed-in customers, their orders and saved addresses                                    |
+| `@zappie/sdk/integrations`                   | Public integration IDs and browser keys                                                  |
+| `@zappie/sdk/places`                         | Address search and delivery-zone checks                                                  |
+| `@zappie/sdk/pricing`                        | An item's starting price and whether to show it as "From"                                |
+| `@zappie/sdk/server`                         | Server-side reads, storefront URLs, `verifyWebhook()`, menu snapshots and sign-in crypto |
+| `@zappie/sdk/template` and `/template/react` | Template settings and responsive images for template authors                             |
+| `@zappie/sdk/testing`                        | A mock client for your tests                                                             |
+| `@zappie/sdk/url`                            | Storefront URL parsing and canonical redirects                                           |
+| `@zappie/sdk/redirect`                       | Same-origin validation for untrusted redirect targets                                    |
 
 Customer sign-in runs through Zappie's site host, so `@zappie/sdk/customer` works on sites Zappie hosts. Sign-in for a site you host yourself isn't available yet.
 
+A menu snapshot is the SDK `Menu` with the facts an edge cache needs: the
+store, the branch, the API's menu version and a content hash. Build one with
+`createMenuSnapshot()` or `menuSnapshotFromPayload()` from `@zappie/sdk/server`,
+and apply a sold-out patch to it with `applyAvailability()`.
+
+`@zappie/sdk/server` has the pieces that sign-in will be built from. They use Web Crypto only, so they run in Workers and Node 20 or later:
+
+- `createPkce()` and `randomToken()` for the code challenge, state and nonce;
+- `sealValue()` and `openSealedValue()` to keep a value in an AES-GCM cookie, with secret rotation;
+- `createTokenVerifier()` to check a token's signature against the issuer's published keys, and its issuer, audience, expiry and subject. `verifyIdToken()` also needs the sign-in's nonce and refuses an access token;
+- `SessionStore` and `cookieSessionStore()` to keep a signed-in session in a sealed cookie.
+
+Make each sealing secret at least 32 random bytes, such as a value from `randomToken()`. Don't use a password or a phrase. The secret is hashed once with no stretching, so anyone holding one sealed value can test guesses offline.
+
+`cookieSessionStore()` keeps the session in the cookie, not on your server. Signing out clears the cookie in that browser only. It doesn't invalidate a copied cookie, which still opens the session until it expires 30 days after sign-in. To end every session at once, rotate the secret. To end one session from the server, use a store that keeps sessions there.
+
+```ts
+import { createTokenVerifier } from "@zappie/sdk/server";
+
+const verifier = createTokenVerifier({
+  issuer: "https://accounts.zappie.ai",
+  audience: clientId,
+});
+const claims = await verifier.verifyIdToken(idToken, { nonce });
+```
+
 Pass any redirect target read from a query parameter through `safeRedirect`.
 It keeps same-origin relative paths and returns your trusted fallback for an
 external, malformed or unsupported target.

package/dist/debug.js

@@ -1,5 +1,5 @@
 // src/debug.ts
-var VERSION = true ? "0.1.16" : "0.0.0-development";
+var VERSION = true ? "0.1.17" : "0.0.0-development";
 function installDebug(client) {
   if (typeof window === "undefined" || client.mode !== "test") {
     return;

package/dist/index.js

@@ -10,7 +10,7 @@ import { ZappieError, isZappieError } from "./errors.js";
 export * from "./models.js";
 import { format, money } from "./money.js";
 import { RestTransport } from "./transport/rest.js";
-var VERSION = true ? "0.1.16" : "0.0.0-development";
+var VERSION = true ? "0.1.17" : "0.0.0-development";
 export {
   API_VERSION,
   RestTransport,

package/dist/server/auth/crypto.js

@@ -0,0 +1,106 @@
+// src/server/auth/crypto.ts
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+function base64UrlEncode(bytes) {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function base64UrlDecode(text) {
+  return /^[\w-]*$/.test(text) && text.length % 4 !== 1 ? Uint8Array.from(
+    atob(text.replaceAll("-", "+").replaceAll("_", "/")),
+    (c) => c.charCodeAt(0)
+  ) : null;
+}
+function randomToken(bytes = 32) {
+  if (!Number.isInteger(bytes) || bytes < 16 || bytes > 1024) {
+    throw new RangeError("randomToken takes between 16 and 1024 bytes.");
+  }
+  return base64UrlEncode(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+async function pkceChallenge(verifier) {
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    encoder.encode(verifier)
+  );
+  return base64UrlEncode(new Uint8Array(digest));
+}
+async function createPkce() {
+  const verifier = randomToken();
+  return { verifier, challenge: await pkceChallenge(verifier), method: "S256" };
+}
+function secretsOf(secret) {
+  const list = typeof secret === "string" ? [secret] : secret;
+  if (!list.length || list.some((value) => encoder.encode(value).length < 32)) {
+    throw new TypeError("Each sealing secret needs at least 32 bytes.");
+  }
+  return list;
+}
+var keys = /* @__PURE__ */ new Map();
+function keyFor(secret) {
+  if (!keys.has(secret)) {
+    if (keys.size >= 16) {
+      keys.clear();
+    }
+    keys.set(
+      secret,
+      crypto.subtle.digest("SHA-256", encoder.encode(secret)).then(
+        (digest) => crypto.subtle.importKey("raw", digest, "AES-GCM", false, [
+          "encrypt",
+          "decrypt"
+        ])
+      )
+    );
+  }
+  return keys.get(secret);
+}
+var params = (iv, purpose) => ({
+  name: "AES-GCM",
+  iv,
+  ...purpose === void 0 ? {} : { additionalData: encoder.encode(purpose) }
+});
+async function sealValue(value, { secret, purpose }) {
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const cipher = await crypto.subtle.encrypt(
+    params(iv, purpose),
+    await keyFor(secretsOf(secret)[0]),
+    encoder.encode(JSON.stringify(value))
+  );
+  return `${base64UrlEncode(iv)}.${base64UrlEncode(new Uint8Array(cipher))}`;
+}
+async function openSealedValue(sealed, { secret, purpose }) {
+  const list = secretsOf(secret);
+  const [ivText = "", cipherText = "", extra] = (sealed ?? "").split(".");
+  const iv = base64UrlDecode(ivText);
+  const cipher = base64UrlDecode(cipherText);
+  if (iv?.length !== 12 || !cipher?.length || extra !== void 0) {
+    return null;
+  }
+  for (const candidate of list) {
+    try {
+      const plain = await crypto.subtle.decrypt(
+        params(iv, purpose),
+        await keyFor(candidate),
+        cipher
+      );
+      return JSON.parse(decoder.decode(plain));
+    } catch {
+    }
+  }
+  return null;
+}
+export {
+  base64UrlDecode,
+  base64UrlEncode,
+  createPkce,
+  decoder,
+  encoder,
+  openSealedValue,
+  pkceChallenge,
+  randomToken,
+  sealValue,
+  secretsOf
+};
+//# sourceMappingURL=crypto.js.map

package/dist/server/auth/crypto.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/server/auth/crypto.ts"],
+  "sourcesContent": ["export const encoder = new TextEncoder();\nexport const decoder = new TextDecoder();\n\nexport function base64UrlEncode(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary)\n    .replaceAll(\"+\", \"-\")\n    .replaceAll(\"/\", \"_\")\n    .replace(/=+$/, \"\");\n}\n\n// Null for anything but unpadded base64url, so a forged segment is refused\n// as malformed rather than thrown as a DOMException.\nexport function base64UrlDecode(text: string): Uint8Array<ArrayBuffer> | null {\n  return /^[\\w-]*$/.test(text) && text.length % 4 !== 1\n    ? Uint8Array.from(\n        atob(text.replaceAll(\"-\", \"+\").replaceAll(\"_\", \"/\")),\n        (c) => c.charCodeAt(0),\n      )\n    : null;\n}\n\n/** A PKCE code verifier and its S256 challenge for one sign-in attempt. */\nexport type PkcePair = {\n  /** Keep this on the server and send it with the code exchange. */\n  verifier: string;\n  /** Send this to the authorize endpoint as `code_challenge`. */\n  challenge: string;\n  /** Send this as `code_challenge_method`. */\n  method: \"S256\";\n};\n\n/** One sealing secret, or several while you rotate them. The first one seals. */\nexport type SealSecret = string | readonly string[];\n\n/** Options for sealing a value into a cookie-safe string. */\nexport type SealOptions = {\n  /**\n   * At least 32 bytes each, from a random generator such as `randomToken()`,\n   * never a password or phrase. The key is the secret's SHA-256 with no\n   * stretching, so a guessable secret can be found offline from one sealed\n   * value. List the new secret first while you rotate.\n   */\n  secret: SealSecret;\n  /**\n   * Binds the sealed value to one use, such as `\"tx\"`, so it won't open for\n   * another. Leave it out to match the hosted sign-in Worker's format.\n   */\n  purpose?: string;\n};\n\n/** Create a random URL-safe token from `bytes` random bytes, for state, nonces and ids. */\nexport function randomToken(bytes = 32): string {\n  if (!Number.isInteger(bytes) || bytes < 16 || bytes > 1024) {\n    throw new RangeError(\"randomToken takes between 16 and 1024 bytes.\");\n  }\n  return base64UrlEncode(crypto.getRandomValues(new Uint8Array(bytes)));\n}\n\nexport async function pkceChallenge(verifier: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\n    \"SHA-256\",\n    encoder.encode(verifier),\n  );\n  return base64UrlEncode(new Uint8Array(digest));\n}\n\n/** Create a PKCE verifier and its S256 challenge. */\nexport async function createPkce(): Promise<PkcePair> {\n  const verifier = randomToken();\n  return { verifier, challenge: await pkceChallenge(verifier), method: \"S256\" };\n}\n\nexport function secretsOf(secret: SealSecret): readonly string[] {\n  const list = typeof secret === \"string\" ? [secret] : secret;\n  if (!list.length || list.some((value) => encoder.encode(value).length < 32)) {\n    throw new TypeError(\"Each sealing secret needs at least 32 bytes.\");\n  }\n  return list;\n}\n\nconst keys = new Map<string, Promise<CryptoKey>>();\n\n// The key is the SHA-256 of the secret, as in the hosted sign-in Worker, so a\n// value it sealed opens here with the same secret.\nfunction keyFor(secret: string) {\n  if (!keys.has(secret)) {\n    if (keys.size >= 16) {\n      keys.clear();\n    }\n    keys.set(\n      secret,\n      crypto.subtle\n        .digest(\"SHA-256\", encoder.encode(secret))\n        .then((digest) =>\n          crypto.subtle.importKey(\"raw\", digest, \"AES-GCM\", false, [\n            \"encrypt\",\n            \"decrypt\",\n          ]),\n        ),\n    );\n  }\n  return keys.get(secret) as Promise<CryptoKey>;\n}\n\nconst params = (iv: Uint8Array<ArrayBuffer>, purpose?: string) => ({\n  name: \"AES-GCM\",\n  iv,\n  ...(purpose === undefined ? {} : { additionalData: encoder.encode(purpose) }),\n});\n\n/** Encrypt a JSON value with AES-GCM into a cookie-safe string. */\nexport async function sealValue(\n  value: unknown,\n  { secret, purpose }: SealOptions,\n): Promise<string> {\n  const iv = crypto.getRandomValues(new Uint8Array(12));\n  const cipher = await crypto.subtle.encrypt(\n    params(iv, purpose),\n    await keyFor(secretsOf(secret)[0] as string),\n    encoder.encode(JSON.stringify(value)),\n  );\n  return `${base64UrlEncode(iv)}.${base64UrlEncode(new Uint8Array(cipher))}`;\n}\n\n/** Decrypt a sealed value with any listed secret. Returns null when none opens it. */\nexport async function openSealedValue<T = unknown>(\n  sealed: string | null | undefined,\n  { secret, purpose }: SealOptions,\n): Promise<T | null> {\n  const list = secretsOf(secret);\n  const [ivText = \"\", cipherText = \"\", extra] = (sealed ?? \"\").split(\".\");\n  const iv = base64UrlDecode(ivText);\n  const cipher = base64UrlDecode(cipherText);\n  if (iv?.length !== 12 || !cipher?.length || extra !== undefined) {\n    return null;\n  }\n  for (const candidate of list) {\n    try {\n      const plain = await crypto.subtle.decrypt(\n        params(iv, purpose),\n        await keyFor(candidate),\n        cipher,\n      );\n      return JSON.parse(decoder.decode(plain)) as T;\n    } catch {\n      // Try the next secret.\n    }\n  }\n  return null;\n}\n"],
+  "mappings": ";AAAO,IAAM,UAAU,IAAI,YAAY;AAChC,IAAM,UAAU,IAAI,YAAY;AAEhC,SAAS,gBAAgB,OAA2B;AACzD,MAAI,SAAS;AACb,aAAW,QAAQ,OAAO;AACxB,cAAU,OAAO,aAAa,IAAI;AAAA,EACpC;AACA,SAAO,KAAK,MAAM,EACf,WAAW,KAAK,GAAG,EACnB,WAAW,KAAK,GAAG,EACnB,QAAQ,OAAO,EAAE;AACtB;AAIO,SAAS,gBAAgB,MAA8C;AAC5E,SAAO,WAAW,KAAK,IAAI,KAAK,KAAK,SAAS,MAAM,IAChD,WAAW;AAAA,IACT,KAAK,KAAK,WAAW,KAAK,GAAG,EAAE,WAAW,KAAK,GAAG,CAAC;AAAA,IACnD,CAAC,MAAM,EAAE,WAAW,CAAC;AAAA,EACvB,IACA;AACN;AAgCO,SAAS,YAAY,QAAQ,IAAY;AAC9C,MAAI,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,MAAM,QAAQ,MAAM;AAC1D,UAAM,IAAI,WAAW,8CAA8C;AAAA,EACrE;AACA,SAAO,gBAAgB,OAAO,gBAAgB,IAAI,WAAW,KAAK,CAAC,CAAC;AACtE;AAEA,eAAsB,cAAc,UAAmC;AACrE,QAAM,SAAS,MAAM,OAAO,OAAO;AAAA,IACjC;AAAA,IACA,QAAQ,OAAO,QAAQ;AAAA,EACzB;AACA,SAAO,gBAAgB,IAAI,WAAW,MAAM,CAAC;AAC/C;AAGA,eAAsB,aAAgC;AACpD,QAAM,WAAW,YAAY;AAC7B,SAAO,EAAE,UAAU,WAAW,MAAM,cAAc,QAAQ,GAAG,QAAQ,OAAO;AAC9E;AAEO,SAAS,UAAU,QAAuC;AAC/D,QAAM,OAAO,OAAO,WAAW,WAAW,CAAC,MAAM,IAAI;AACrD,MAAI,CAAC,KAAK,UAAU,KAAK,KAAK,CAAC,UAAU,QAAQ,OAAO,KAAK,EAAE,SAAS,EAAE,GAAG;AAC3E,UAAM,IAAI,UAAU,8CAA8C;AAAA,EACpE;AACA,SAAO;AACT;AAEA,IAAM,OAAO,oBAAI,IAAgC;AAIjD,SAAS,OAAO,QAAgB;AAC9B,MAAI,CAAC,KAAK,IAAI,MAAM,GAAG;AACrB,QAAI,KAAK,QAAQ,IAAI;AACnB,WAAK,MAAM;AAAA,IACb;AACA,SAAK;AAAA,MACH;AAAA,MACA,OAAO,OACJ,OAAO,WAAW,QAAQ,OAAO,MAAM,CAAC,EACxC;AAAA,QAAK,CAAC,WACL,OAAO,OAAO,UAAU,OAAO,QAAQ,WAAW,OAAO;AAAA,UACvD;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACJ;AAAA,EACF;AACA,SAAO,KAAK,IAAI,MAAM;AACxB;AAEA,IAAM,SAAS,CAAC,IAA6B,aAAsB;AAAA,EACjE,MAAM;AAAA,EACN;AAAA,EACA,GAAI,YAAY,SAAY,CAAC,IAAI,EAAE,gBAAgB,QAAQ,OAAO,OAAO,EAAE;AAC7E;AAGA,eAAsB,UACpB,OACA,EAAE,QAAQ,QAAQ,GACD;AACjB,QAAM,KAAK,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACpD,QAAM,SAAS,MAAM,OAAO,OAAO;AAAA,IACjC,OAAO,IAAI,OAAO;AAAA,IAClB,MAAM,OAAO,UAAU,MAAM,EAAE,CAAC,CAAW;AAAA,IAC3C,QAAQ,OAAO,KAAK,UAAU,KAAK,CAAC;AAAA,EACtC;AACA,SAAO,GAAG,gBAAgB,EAAE,CAAC,IAAI,gBAAgB,IAAI,WAAW,MAAM,CAAC,CAAC;AAC1E;AAGA,eAAsB,gBACpB,QACA,EAAE,QAAQ,QAAQ,GACC;AACnB,QAAM,OAAO,UAAU,MAAM;AAC7B,QAAM,CAAC,SAAS,IAAI,aAAa,IAAI,KAAK,KAAK,UAAU,IAAI,MAAM,GAAG;AACtE,QAAM,KAAK,gBAAgB,MAAM;AACjC,QAAM,SAAS,gBAAgB,UAAU;AACzC,MAAI,IAAI,WAAW,MAAM,CAAC,QAAQ,UAAU,UAAU,QAAW;AAC/D,WAAO;AAAA,EACT;AACA,aAAW,aAAa,MAAM;AAC5B,QAAI;AACF,YAAM,QAAQ,MAAM,OAAO,OAAO;AAAA,QAChC,OAAO,IAAI,OAAO;AAAA,QAClB,MAAM,OAAO,SAAS;AAAA,QACtB;AAAA,MACF;AACA,aAAO,KAAK,MAAM,QAAQ,OAAO,KAAK,CAAC;AAAA,IACzC,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/server/auth/jwt.js

@@ -0,0 +1,204 @@
+// src/server/auth/jwt.ts
+import { ZappieError } from "../../errors.js";
+import { base64UrlDecode, decoder, encoder } from "./crypto.js";
+var messages = {
+  malformed: "The token isn't a signed JWT.",
+  unsupported_algorithm: "The token uses an algorithm this verifier refuses.",
+  unknown_key: "The token was signed with a key the issuer doesn't publish.",
+  invalid_signature: "The token's signature doesn't match.",
+  wrong_issuer: "The token comes from a different issuer.",
+  wrong_audience: "The token was issued for a different audience.",
+  wrong_nonce: "The token wasn't issued for this sign-in.",
+  wrong_subject: "The token's subject isn't a Zappie customer.",
+  wrong_type: "The token isn't an ID token.",
+  expired: "The token has expired.",
+  not_yet_valid: "The token isn't valid yet.",
+  keys_unavailable: "The identity issuer's signing keys couldn't be read."
+};
+var ZappieTokenError = class extends ZappieError {
+  constructor(reason, cause) {
+    super(
+      reason === "keys_unavailable" ? "network_error" : "unauthorized",
+      messages[reason],
+      cause === void 0 ? {} : { cause }
+    );
+    this.reason = reason;
+    this.name = "ZappieTokenError";
+  }
+};
+var specs = {
+  RS256: {
+    kty: "RSA",
+    jwk: (key) => ({ kty: "RSA", n: key.n, e: key.e }),
+    import: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+    verify: { name: "RSASSA-PKCS1-v1_5" }
+  },
+  ES256: {
+    kty: "EC",
+    jwk: (key) => ({ kty: "EC", crv: "P-256", x: key.x, y: key.y }),
+    import: { name: "ECDSA", namedCurve: "P-256" },
+    verify: { name: "ECDSA", hash: "SHA-256" }
+  }
+};
+var fail = (reason, cause) => {
+  throw new ZappieTokenError(reason, cause);
+};
+var numeric = (value) => typeof value === "number" && Number.isFinite(value);
+var trimSlash = (value) => value.replace(/\/+$/, "");
+var KEY_RETRY_MS = 3e4;
+function decodeJson(text) {
+  const bytes = base64UrlDecode(text) ?? fail("malformed");
+  let value;
+  try {
+    value = JSON.parse(decoder.decode(bytes));
+  } catch {
+  }
+  return value && typeof value === "object" && !Array.isArray(value) ? value : fail("malformed");
+}
+function createTokenVerifier(options) {
+  const issuer = trimSlash(options.issuer);
+  const allowed = options.algorithms ?? ["RS256", "ES256"];
+  const tolerance = options.clockToleranceSec ?? 60;
+  const ttl = (options.cacheTtlSec ?? 3600) * 1e3;
+  const prefix = options.subjectPrefix === void 0 ? "cus_" : options.subjectPrefix;
+  const now = options.now ?? Date.now;
+  const read = options.fetch ?? ((url, init) => fetch(url, init));
+  if (!issuer || !options.audience || !allowed.length || allowed.some((alg) => !(alg in specs)) || !numeric(tolerance) || tolerance < 0 || !numeric(ttl) || ttl < 0) {
+    throw new TypeError(
+      "createTokenVerifier needs an issuer, an audience, RS256 or ES256, and a clock tolerance and cache time of 0 or more."
+    );
+  }
+  let cached;
+  let pending;
+  let triedAt = Number.NEGATIVE_INFINITY;
+  let lastError;
+  const load = async () => {
+    try {
+      const response = await read(
+        options.jwksUrl ?? `${issuer}/.well-known/jwks.json`,
+        {
+          headers: { accept: "application/json" },
+          signal: AbortSignal.timeout(1e4)
+        }
+      );
+      const text = response.ok ? await response.text() : "";
+      if (!text || text.length > 1 << 20) {
+        throw new Error(`The key set answered ${response.status}.`);
+      }
+      const keys = /* @__PURE__ */ new Map();
+      const list = JSON.parse(text).keys;
+      for (const jwk of Array.isArray(list) ? list : []) {
+        for (const alg of allowed) {
+          const spec = specs[alg];
+          if (jwk.kty === spec.kty && (jwk.use ?? "sig") === "sig" && (jwk.alg ?? alg) === alg && (alg === "RS256" || jwk.crv === "P-256")) {
+            await crypto.subtle.importKey(
+              "jwk",
+              spec.jwk(jwk),
+              spec.import,
+              false,
+              ["verify"]
+            ).then((key) => keys.set(`${alg}:${String(jwk.kid ?? "")}`, key)).catch(() => void 0);
+          }
+        }
+      }
+      if (!keys.size) {
+        throw new Error("The key set has no keys this verifier can use.");
+      }
+      return cached = { keys, at: now() };
+    } catch (error) {
+      return fail("keys_unavailable", error);
+    }
+  };
+  const find = (set, kid, alg) => {
+    if (typeof kid === "string") {
+      return set.keys.get(`${alg}:${kid}`);
+    }
+    const fits = [...set.keys].filter(([id]) => id.startsWith(`${alg}:`));
+    return fits.length === 1 ? fits[0]?.[1] : void 0;
+  };
+  const keyFor = async (kid, alg) => {
+    if (!pending) {
+      const key = cached && find(cached, kid, alg);
+      if (key && cached && now() - cached.at < ttl) {
+        return key;
+      }
+      if (now() - triedAt < KEY_RETRY_MS) {
+        return cached ? key : fail("keys_unavailable", lastError);
+      }
+      triedAt = now();
+      pending = load().finally(() => pending = void 0);
+    }
+    try {
+      const set = await pending;
+      lastError = void 0;
+      return find(set, kid, alg);
+    } catch (error) {
+      lastError = error;
+      return (cached && find(cached, kid, alg)) ?? fail("keys_unavailable", error);
+    }
+  };
+  const check = async (token, checks, idToken) => {
+    const parts = typeof token === "string" && token.length < 16384 ? token.split(".") : [];
+    const [head = "", body = "", sig = ""] = parts.length === 3 ? parts : fail("malformed");
+    const header = decodeJson(head);
+    const claims = decodeJson(body);
+    const signature = base64UrlDecode(sig) ?? fail("malformed");
+    const alg = header.alg;
+    if (!allowed.includes(alg) || header.crit !== void 0) {
+      fail("unsupported_algorithm");
+    }
+    if (idToken && header.typ !== void 0 && (typeof header.typ !== "string" || header.typ.toLowerCase().replace(/^application\//, "") !== "jwt")) {
+      fail("wrong_type");
+    }
+    const key = await keyFor(header.kid, alg) ?? fail("unknown_key");
+    if (alg === "ES256" && signature.length !== 64 || !await crypto.subtle.verify(
+      specs[alg].verify,
+      key,
+      signature,
+      encoder.encode(`${head}.${body}`)
+    )) {
+      fail("invalid_signature");
+    }
+    const seconds = now() / 1e3;
+    const times = [claims.nbf, claims.iat];
+    const sub = claims.sub;
+    if (typeof claims.iss !== "string" || trimSlash(claims.iss) !== issuer) {
+      fail("wrong_issuer");
+    }
+    if (![claims.aud].flat().includes(checks.audience ?? options.audience)) {
+      fail("wrong_audience");
+    }
+    if (!numeric(claims.exp) || times.some((time) => time !== void 0 && !numeric(time))) {
+      fail("malformed");
+    }
+    if (seconds > claims.exp + tolerance) {
+      fail("expired");
+    }
+    if (times.some((time) => time > seconds + tolerance)) {
+      fail("not_yet_valid");
+    }
+    if (checks.nonce !== void 0 && claims.nonce !== checks.nonce) {
+      fail("wrong_nonce");
+    }
+    if ((prefix !== null || idToken) && (typeof sub !== "string" || !sub || prefix !== null && (!sub.startsWith(prefix) || sub.length === prefix.length))) {
+      fail("wrong_subject");
+    }
+    return claims;
+  };
+  return {
+    verify: (token, checks = {}) => check(token, checks, false),
+    async verifyIdToken(token, checks) {
+      if (typeof checks?.nonce !== "string" || !checks.nonce) {
+        throw new TypeError(
+          "verifyIdToken needs the nonce you sent with the sign-in."
+        );
+      }
+      return await check(token, checks, true);
+    }
+  };
+}
+export {
+  ZappieTokenError,
+  createTokenVerifier
+};
+//# sourceMappingURL=jwt.js.map

package/dist/server/auth/jwt.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/server/auth/jwt.ts"],
+  "sourcesContent": ["import { ZappieError } from \"../../errors\";\nimport { base64UrlDecode, decoder, encoder } from \"./crypto\";\n\n/** Signing algorithms Sign in with Zappie tokens can use. */\nexport type TokenAlgorithm = \"RS256\" | \"ES256\";\n\nconst messages = {\n  malformed: \"The token isn't a signed JWT.\",\n  unsupported_algorithm: \"The token uses an algorithm this verifier refuses.\",\n  unknown_key: \"The token was signed with a key the issuer doesn't publish.\",\n  invalid_signature: \"The token's signature doesn't match.\",\n  wrong_issuer: \"The token comes from a different issuer.\",\n  wrong_audience: \"The token was issued for a different audience.\",\n  wrong_nonce: \"The token wasn't issued for this sign-in.\",\n  wrong_subject: \"The token's subject isn't a Zappie customer.\",\n  wrong_type: \"The token isn't an ID token.\",\n  expired: \"The token has expired.\",\n  not_yet_valid: \"The token isn't valid yet.\",\n  keys_unavailable: \"The identity issuer's signing keys couldn't be read.\",\n};\n\n/** Why a token was refused. */\nexport type TokenErrorReason = keyof typeof messages;\n\n/** A token Zappie's identity issuer didn't sign for you, or one that is no longer valid. */\nexport class ZappieTokenError extends ZappieError {\n  constructor(\n    readonly reason: TokenErrorReason,\n    cause?: unknown,\n  ) {\n    super(\n      reason === \"keys_unavailable\" ? \"network_error\" : \"unauthorized\",\n      messages[reason],\n      cause === undefined ? {} : { cause },\n    );\n    this.name = \"ZappieTokenError\";\n  }\n}\n\n/** The verified claims of a token. Extra claims stay on the object. */\nexport type TokenClaims = {\n  iss: string;\n  aud: string | string[];\n  exp: number;\n  sub?: string;\n  iat?: number;\n  nbf?: number;\n  nonce?: string;\n  sid?: string;\n  [claim: string]: unknown;\n};\n\n/** Settings for verifying tokens from Zappie's identity issuer. */\nexport type TokenVerifierOptions = {\n  /** The issuer URL, such as `https://accounts.zappie.ai`. The token's `iss` must equal it. A trailing slash on either is ignored. */\n  issuer: string;\n  /** The audience the token must name: your site's client id for ID tokens, or the API audience for access tokens. */\n  audience: string;\n  /** Where to read the signing keys. Defaults to `<issuer>/.well-known/jwks.json`. */\n  jwksUrl?: string;\n  /** Allowed algorithms. Defaults to RS256 and ES256. */\n  algorithms?: readonly TokenAlgorithm[];\n  /** Seconds of clock skew allowed on `exp`, `nbf` and `iat`. Defaults to 60. */\n  clockToleranceSec?: number;\n  /** Seconds to keep the key set before reading it again, 0 or more. Defaults to one hour. */\n  cacheTtlSec?: number;\n  /** Prefix the `sub` claim must start with. Zappie customers are `cus_`. A token without `sub` is refused. Pass `null` to skip both checks. */\n  subjectPrefix?: string | null;\n  /** The fetch to read keys with. Defaults to the global fetch. */\n  fetch?: typeof fetch;\n  /** The current time in milliseconds. For tests. */\n  now?: () => number;\n};\n\n/** Per-call checks on top of the verifier's settings. */\nexport type VerifyTokenChecks = {\n  /** The nonce you sent with the sign-in. When you pass it, the token's `nonce` must equal it. */\n  nonce?: string;\n  /** Overrides the verifier's audience for this token. */\n  audience?: string;\n};\n\n/** Checks for an ID token from a sign-in. */\nexport type IdTokenChecks = {\n  /** The nonce you sent with this sign-in. The token's `nonce` must equal it. */\n  nonce: string;\n  /** Overrides the verifier's audience for this token. */\n  audience?: string;\n};\n\n/** The verified claims of an ID token. */\nexport type IdTokenClaims = TokenClaims & { sub: string; nonce: string };\n\n/** Verifies signed tokens against the issuer's published keys. */\nexport type TokenVerifier = {\n  /** Verify a token's signature and claims, and return its claims. */\n  verify(token: string, checks?: VerifyTokenChecks): Promise<TokenClaims>;\n  /**\n   * Verify the ID token from a sign-in. It needs the nonce you sent, a `sub`,\n   * and refuses a token whose `typ` header names another kind of token, such\n   * as an access token (`at+jwt`).\n   */\n  verifyIdToken(token: string, checks: IdTokenChecks): Promise<IdTokenClaims>;\n};\n\ntype Jwk = Record<string, unknown>;\ntype KeySet = { keys: Map<string, CryptoKey>; at: number };\n\nconst specs = {\n  RS256: {\n    kty: \"RSA\",\n    jwk: (key: Jwk) => ({ kty: \"RSA\", n: key.n, e: key.e }),\n    import: { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-256\" },\n    verify: { name: \"RSASSA-PKCS1-v1_5\" },\n  },\n  ES256: {\n    kty: \"EC\",\n    jwk: (key: Jwk) => ({ kty: \"EC\", crv: \"P-256\", x: key.x, y: key.y }),\n    import: { name: \"ECDSA\", namedCurve: \"P-256\" },\n    verify: { name: \"ECDSA\", hash: \"SHA-256\" },\n  },\n} as const;\n\nconst fail = (reason: TokenErrorReason, cause?: unknown): never => {\n  throw new ZappieTokenError(reason, cause);\n};\nconst numeric = (value: unknown): value is number =>\n  typeof value === \"number\" && Number.isFinite(value);\nconst trimSlash = (value: string) => value.replace(/\\/+$/, \"\");\nconst KEY_RETRY_MS = 30_000;\n\nfunction decodeJson(text: string): Record<string, unknown> {\n  const bytes = base64UrlDecode(text) ?? fail(\"malformed\");\n  let value: unknown;\n  try {\n    value = JSON.parse(decoder.decode(bytes));\n  } catch {\n    // Refused below.\n  }\n  return value && typeof value === \"object\" && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : fail(\"malformed\");\n}\n\n/**\n * Create a verifier for tokens from Zappie's identity issuer. It caches the\n * issuer's key set, reads it again when a token names an unknown key, and\n * keeps the last good set while the issuer is down. It uses Web Crypto only,\n * so it runs in Workers and Node 20 or later.\n */\nexport function createTokenVerifier(\n  options: TokenVerifierOptions,\n): TokenVerifier {\n  const issuer = trimSlash(options.issuer);\n  const allowed: readonly string[] = options.algorithms ?? [\"RS256\", \"ES256\"];\n  const tolerance = options.clockToleranceSec ?? 60;\n  const ttl = (options.cacheTtlSec ?? 3600) * 1000;\n  const prefix =\n    options.subjectPrefix === undefined ? \"cus_\" : options.subjectPrefix;\n  const now = options.now ?? Date.now;\n  const read = options.fetch ?? ((url, init) => fetch(url, init));\n  if (\n    !issuer ||\n    !options.audience ||\n    !allowed.length ||\n    allowed.some((alg) => !(alg in specs)) ||\n    !numeric(tolerance) ||\n    tolerance < 0 ||\n    !numeric(ttl) ||\n    ttl < 0\n  ) {\n    throw new TypeError(\n      \"createTokenVerifier needs an issuer, an audience, RS256 or ES256, and a clock tolerance and cache time of 0 or more.\",\n    );\n  }\n\n  let cached: KeySet | undefined;\n  let pending: Promise<KeySet> | undefined;\n  let triedAt = Number.NEGATIVE_INFINITY;\n  let lastError: unknown;\n\n  const load = async (): Promise<KeySet> => {\n    try {\n      const response = await read(\n        options.jwksUrl ?? `${issuer}/.well-known/jwks.json`,\n        {\n          headers: { accept: \"application/json\" },\n          signal: AbortSignal.timeout(10_000),\n        },\n      );\n      const text = response.ok ? await response.text() : \"\";\n      if (!text || text.length > 1 << 20) {\n        throw new Error(`The key set answered ${response.status}.`);\n      }\n      const keys = new Map<string, CryptoKey>();\n      const list = (JSON.parse(text) as { keys?: unknown }).keys;\n      for (const jwk of Array.isArray(list) ? (list as Jwk[]) : []) {\n        for (const alg of allowed as TokenAlgorithm[]) {\n          const spec = specs[alg];\n          if (\n            jwk.kty === spec.kty &&\n            (jwk.use ?? \"sig\") === \"sig\" &&\n            (jwk.alg ?? alg) === alg &&\n            (alg === \"RS256\" || jwk.crv === \"P-256\")\n          ) {\n            // A key this runtime can't import can't have signed a token we accept.\n            await crypto.subtle\n              .importKey(\n                \"jwk\",\n                spec.jwk(jwk) as JsonWebKey,\n                spec.import,\n                false,\n                [\"verify\"],\n              )\n              .then((key) => keys.set(`${alg}:${String(jwk.kid ?? \"\")}`, key))\n              .catch(() => undefined);\n          }\n        }\n      }\n      // An empty or unusable set is an issuer fault, not a rotation, so it\n      // never replaces the keys that verified tokens until now.\n      if (!keys.size) {\n        throw new Error(\"The key set has no keys this verifier can use.\");\n      }\n      return (cached = { keys, at: now() });\n    } catch (error) {\n      return fail(\"keys_unavailable\", error);\n    }\n  };\n\n  const find = (set: KeySet, kid: unknown, alg: string) => {\n    if (typeof kid === \"string\") {\n      return set.keys.get(`${alg}:${kid}`);\n    }\n    // Without a kid, only a key set with one key for the algorithm can answer.\n    const fits = [...set.keys].filter(([id]) => id.startsWith(`${alg}:`));\n    return fits.length === 1 ? fits[0]?.[1] : undefined;\n  };\n\n  // The key set is read at most every 30 seconds, whether a forged kid\n  // missed the cache or the issuer is down, so neither can make every\n  // request call the issuer.\n  const keyFor = async (kid: unknown, alg: string) => {\n    if (!pending) {\n      const key = cached && find(cached, kid, alg);\n      if (key && cached && now() - cached.at < ttl) {\n        return key;\n      }\n      if (now() - triedAt < KEY_RETRY_MS) {\n        return cached ? key : fail(\"keys_unavailable\", lastError);\n      }\n      triedAt = now();\n      pending = load().finally(() => (pending = undefined));\n    }\n    try {\n      const set = await pending;\n      lastError = undefined;\n      return find(set, kid, alg);\n    } catch (error) {\n      lastError = error;\n      return (\n        (cached && find(cached, kid, alg)) ?? fail(\"keys_unavailable\", error)\n      );\n    }\n  };\n\n  const check = async (\n    token: string,\n    checks: VerifyTokenChecks,\n    idToken: boolean,\n  ): Promise<TokenClaims> => {\n    const parts =\n      typeof token === \"string\" && token.length < 16_384\n        ? token.split(\".\")\n        : [];\n    const [head = \"\", body = \"\", sig = \"\"] =\n      parts.length === 3 ? parts : fail(\"malformed\");\n    const header = decodeJson(head);\n    const claims = decodeJson(body);\n    const signature = base64UrlDecode(sig) ?? fail(\"malformed\");\n    const alg = header.alg as TokenAlgorithm;\n    if (!allowed.includes(alg) || header.crit !== undefined) {\n      fail(\"unsupported_algorithm\");\n    }\n    if (\n      idToken &&\n      header.typ !== undefined &&\n      (typeof header.typ !== \"string\" ||\n        header.typ.toLowerCase().replace(/^application\\//, \"\") !== \"jwt\")\n    ) {\n      fail(\"wrong_type\");\n    }\n    const key = (await keyFor(header.kid, alg)) ?? fail(\"unknown_key\");\n    if (\n      (alg === \"ES256\" && signature.length !== 64) ||\n      !(await crypto.subtle.verify(\n        specs[alg].verify,\n        key,\n        signature,\n        encoder.encode(`${head}.${body}`),\n      ))\n    ) {\n      fail(\"invalid_signature\");\n    }\n\n    const seconds = now() / 1000;\n    const times = [claims.nbf, claims.iat];\n    const sub = claims.sub;\n    if (typeof claims.iss !== \"string\" || trimSlash(claims.iss) !== issuer) {\n      fail(\"wrong_issuer\");\n    }\n    if (![claims.aud].flat().includes(checks.audience ?? options.audience)) {\n      fail(\"wrong_audience\");\n    }\n    if (\n      !numeric(claims.exp) ||\n      times.some((time) => time !== undefined && !numeric(time))\n    ) {\n      fail(\"malformed\");\n    }\n    if (seconds > (claims.exp as number) + tolerance) {\n      fail(\"expired\");\n    }\n    if (times.some((time) => (time as number) > seconds + tolerance)) {\n      fail(\"not_yet_valid\");\n    }\n    if (checks.nonce !== undefined && claims.nonce !== checks.nonce) {\n      fail(\"wrong_nonce\");\n    }\n    if (\n      (prefix !== null || idToken) &&\n      (typeof sub !== \"string\" ||\n        !sub ||\n        (prefix !== null &&\n          (!sub.startsWith(prefix) || sub.length === prefix.length)))\n    ) {\n      fail(\"wrong_subject\");\n    }\n    return claims as TokenClaims;\n  };\n\n  return {\n    verify: (token, checks = {}) => check(token, checks, false),\n    async verifyIdToken(token, checks) {\n      if (typeof checks?.nonce !== \"string\" || !checks.nonce) {\n        throw new TypeError(\n          \"verifyIdToken needs the nonce you sent with the sign-in.\",\n        );\n      }\n      return (await check(token, checks, true)) as IdTokenClaims;\n    },\n  };\n}\n"],
+  "mappings": ";AAAA,SAAS,mBAAmB;AAC5B,SAAS,iBAAiB,SAAS,eAAe;AAKlD,IAAM,WAAW;AAAA,EACf,WAAW;AAAA,EACX,uBAAuB;AAAA,EACvB,aAAa;AAAA,EACb,mBAAmB;AAAA,EACnB,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,aAAa;AAAA,EACb,eAAe;AAAA,EACf,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,eAAe;AAAA,EACf,kBAAkB;AACpB;AAMO,IAAM,mBAAN,cAA+B,YAAY;AAAA,EAChD,YACW,QACT,OACA;AACA;AAAA,MACE,WAAW,qBAAqB,kBAAkB;AAAA,MAClD,SAAS,MAAM;AAAA,MACf,UAAU,SAAY,CAAC,IAAI,EAAE,MAAM;AAAA,IACrC;AAPS;AAQT,SAAK,OAAO;AAAA,EACd;AACF;AAuEA,IAAM,QAAQ;AAAA,EACZ,OAAO;AAAA,IACL,KAAK;AAAA,IACL,KAAK,CAAC,SAAc,EAAE,KAAK,OAAO,GAAG,IAAI,GAAG,GAAG,IAAI,EAAE;AAAA,IACrD,QAAQ,EAAE,MAAM,qBAAqB,MAAM,UAAU;AAAA,IACrD,QAAQ,EAAE,MAAM,oBAAoB;AAAA,EACtC;AAAA,EACA,OAAO;AAAA,IACL,KAAK;AAAA,IACL,KAAK,CAAC,SAAc,EAAE,KAAK,MAAM,KAAK,SAAS,GAAG,IAAI,GAAG,GAAG,IAAI,EAAE;AAAA,IAClE,QAAQ,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,IAC7C,QAAQ,EAAE,MAAM,SAAS,MAAM,UAAU;AAAA,EAC3C;AACF;AAEA,IAAM,OAAO,CAAC,QAA0B,UAA2B;AACjE,QAAM,IAAI,iBAAiB,QAAQ,KAAK;AAC1C;AACA,IAAM,UAAU,CAAC,UACf,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;AACpD,IAAM,YAAY,CAAC,UAAkB,MAAM,QAAQ,QAAQ,EAAE;AAC7D,IAAM,eAAe;AAErB,SAAS,WAAW,MAAuC;AACzD,QAAM,QAAQ,gBAAgB,IAAI,KAAK,KAAK,WAAW;AACvD,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,MAAM,QAAQ,OAAO,KAAK,CAAC;AAAA,EAC1C,QAAQ;AAAA,EAER;AACA,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAC5D,QACD,KAAK,WAAW;AACtB;AAQO,SAAS,oBACd,SACe;AACf,QAAM,SAAS,UAAU,QAAQ,MAAM;AACvC,QAAM,UAA6B,QAAQ,cAAc,CAAC,SAAS,OAAO;AAC1E,QAAM,YAAY,QAAQ,qBAAqB;AAC/C,QAAM,OAAO,QAAQ,eAAe,QAAQ;AAC5C,QAAM,SACJ,QAAQ,kBAAkB,SAAY,SAAS,QAAQ;AACzD,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,OAAO,QAAQ,UAAU,CAAC,KAAK,SAAS,MAAM,KAAK,IAAI;AAC7D,MACE,CAAC,UACD,CAAC,QAAQ,YACT,CAAC,QAAQ,UACT,QAAQ,KAAK,CAAC,QAAQ,EAAE,OAAO,MAAM,KACrC,CAAC,QAAQ,SAAS,KAClB,YAAY,KACZ,CAAC,QAAQ,GAAG,KACZ,MAAM,GACN;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACJ,MAAI,UAAU,OAAO;AACrB,MAAI;AAEJ,QAAM,OAAO,YAA6B;AACxC,QAAI;AACF,YAAM,WAAW,MAAM;AAAA,QACrB,QAAQ,WAAW,GAAG,MAAM;AAAA,QAC5B;AAAA,UACE,SAAS,EAAE,QAAQ,mBAAmB;AAAA,UACtC,QAAQ,YAAY,QAAQ,GAAM;AAAA,QACpC;AAAA,MACF;AACA,YAAM,OAAO,SAAS,KAAK,MAAM,SAAS,KAAK,IAAI;AACnD,UAAI,CAAC,QAAQ,KAAK,SAAS,KAAK,IAAI;AAClC,cAAM,IAAI,MAAM,wBAAwB,SAAS,MAAM,GAAG;AAAA,MAC5D;AACA,YAAM,OAAO,oBAAI,IAAuB;AACxC,YAAM,OAAQ,KAAK,MAAM,IAAI,EAAyB;AACtD,iBAAW,OAAO,MAAM,QAAQ,IAAI,IAAK,OAAiB,CAAC,GAAG;AAC5D,mBAAW,OAAO,SAA6B;AAC7C,gBAAM,OAAO,MAAM,GAAG;AACtB,cACE,IAAI,QAAQ,KAAK,QAChB,IAAI,OAAO,WAAW,UACtB,IAAI,OAAO,SAAS,QACpB,QAAQ,WAAW,IAAI,QAAQ,UAChC;AAEA,kBAAM,OAAO,OACV;AAAA,cACC;AAAA,cACA,KAAK,IAAI,GAAG;AAAA,cACZ,KAAK;AAAA,cACL;AAAA,cACA,CAAC,QAAQ;AAAA,YACX,EACC,KAAK,CAAC,QAAQ,KAAK,IAAI,GAAG,GAAG,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC,IAAI,GAAG,CAAC,EAC9D,MAAM,MAAM,MAAS;AAAA,UAC1B;AAAA,QACF;AAAA,MACF;AAGA,UAAI,CAAC,KAAK,MAAM;AACd,cAAM,IAAI,MAAM,gDAAgD;AAAA,MAClE;AACA,aAAQ,SAAS,EAAE,MAAM,IAAI,IAAI,EAAE;AAAA,IACrC,SAAS,OAAO;AACd,aAAO,KAAK,oBAAoB,KAAK;AAAA,IACvC;AAAA,EACF;AAEA,QAAM,OAAO,CAAC,KAAa,KAAc,QAAgB;AACvD,QAAI,OAAO,QAAQ,UAAU;AAC3B,aAAO,IAAI,KAAK,IAAI,GAAG,GAAG,IAAI,GAAG,EAAE;AAAA,IACrC;AAEA,UAAM,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,GAAG,WAAW,GAAG,GAAG,GAAG,CAAC;AACpE,WAAO,KAAK,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI;AAAA,EAC5C;AAKA,QAAM,SAAS,OAAO,KAAc,QAAgB;AAClD,QAAI,CAAC,SAAS;AACZ,YAAM,MAAM,UAAU,KAAK,QAAQ,KAAK,GAAG;AAC3C,UAAI,OAAO,UAAU,IAAI,IAAI,OAAO,KAAK,KAAK;AAC5C,eAAO;AAAA,MACT;AACA,UAAI,IAAI,IAAI,UAAU,cAAc;AAClC,eAAO,SAAS,MAAM,KAAK,oBAAoB,SAAS;AAAA,MAC1D;AACA,gBAAU,IAAI;AACd,gBAAU,KAAK,EAAE,QAAQ,MAAO,UAAU,MAAU;AAAA,IACtD;AACA,QAAI;AACF,YAAM,MAAM,MAAM;AAClB,kBAAY;AACZ,aAAO,KAAK,KAAK,KAAK,GAAG;AAAA,IAC3B,SAAS,OAAO;AACd,kBAAY;AACZ,cACG,UAAU,KAAK,QAAQ,KAAK,GAAG,MAAM,KAAK,oBAAoB,KAAK;AAAA,IAExE;AAAA,EACF;AAEA,QAAM,QAAQ,OACZ,OACA,QACA,YACyB;AACzB,UAAM,QACJ,OAAO,UAAU,YAAY,MAAM,SAAS,QACxC,MAAM,MAAM,GAAG,IACf,CAAC;AACP,UAAM,CAAC,OAAO,IAAI,OAAO,IAAI,MAAM,EAAE,IACnC,MAAM,WAAW,IAAI,QAAQ,KAAK,WAAW;AAC/C,UAAM,SAAS,WAAW,IAAI;AAC9B,UAAM,SAAS,WAAW,IAAI;AAC9B,UAAM,YAAY,gBAAgB,GAAG,KAAK,KAAK,WAAW;AAC1D,UAAM,MAAM,OAAO;AACnB,QAAI,CAAC,QAAQ,SAAS,GAAG,KAAK,OAAO,SAAS,QAAW;AACvD,WAAK,uBAAuB;AAAA,IAC9B;AACA,QACE,WACA,OAAO,QAAQ,WACd,OAAO,OAAO,QAAQ,YACrB,OAAO,IAAI,YAAY,EAAE,QAAQ,kBAAkB,EAAE,MAAM,QAC7D;AACA,WAAK,YAAY;AAAA,IACnB;AACA,UAAM,MAAO,MAAM,OAAO,OAAO,KAAK,GAAG,KAAM,KAAK,aAAa;AACjE,QACG,QAAQ,WAAW,UAAU,WAAW,MACzC,CAAE,MAAM,OAAO,OAAO;AAAA,MACpB,MAAM,GAAG,EAAE;AAAA,MACX;AAAA,MACA;AAAA,MACA,QAAQ,OAAO,GAAG,IAAI,IAAI,IAAI,EAAE;AAAA,IAClC,GACA;AACA,WAAK,mBAAmB;AAAA,IAC1B;AAEA,UAAM,UAAU,IAAI,IAAI;AACxB,UAAM,QAAQ,CAAC,OAAO,KAAK,OAAO,GAAG;AACrC,UAAM,MAAM,OAAO;AACnB,QAAI,OAAO,OAAO,QAAQ,YAAY,UAAU,OAAO,GAAG,MAAM,QAAQ;AACtE,WAAK,cAAc;AAAA,IACrB;AACA,QAAI,CAAC,CAAC,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,OAAO,YAAY,QAAQ,QAAQ,GAAG;AACtE,WAAK,gBAAgB;AAAA,IACvB;AACA,QACE,CAAC,QAAQ,OAAO,GAAG,KACnB,MAAM,KAAK,CAAC,SAAS,SAAS,UAAa,CAAC,QAAQ,IAAI,CAAC,GACzD;AACA,WAAK,WAAW;AAAA,IAClB;AACA,QAAI,UAAW,OAAO,MAAiB,WAAW;AAChD,WAAK,SAAS;AAAA,IAChB;AACA,QAAI,MAAM,KAAK,CAAC,SAAU,OAAkB,UAAU,SAAS,GAAG;AAChE,WAAK,eAAe;AAAA,IACtB;AACA,QAAI,OAAO,UAAU,UAAa,OAAO,UAAU,OAAO,OAAO;AAC/D,WAAK,aAAa;AAAA,IACpB;AACA,SACG,WAAW,QAAQ,aACnB,OAAO,QAAQ,YACd,CAAC,OACA,WAAW,SACT,CAAC,IAAI,WAAW,MAAM,KAAK,IAAI,WAAW,OAAO,UACtD;AACA,WAAK,eAAe;AAAA,IACtB;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,QAAQ,CAAC,OAAO,SAAS,CAAC,MAAM,MAAM,OAAO,QAAQ,KAAK;AAAA,IAC1D,MAAM,cAAc,OAAO,QAAQ;AACjC,UAAI,OAAO,QAAQ,UAAU,YAAY,CAAC,OAAO,OAAO;AACtD,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,aAAQ,MAAM,MAAM,OAAO,QAAQ,IAAI;AAAA,IACzC;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/server/auth/session-store.js

@@ -0,0 +1,46 @@
+// src/server/auth/session-store.ts
+import { ZappieError } from "../../errors.js";
+import {
+  openSealedValue,
+  sealValue,
+  secretsOf
+} from "./crypto.js";
+function cookieSessionStore(options) {
+  const maxAge = (options.maxAgeSec ?? 30 * 24 * 60 * 60) * 1e3;
+  const now = options.now ?? Date.now;
+  const sealing = { secret: options.secret, purpose: "zappie_session" };
+  secretsOf(options.secret);
+  if (!(maxAge > 0 && Number.isFinite(maxAge))) {
+    throw new TypeError("maxAgeSec must be a positive number of seconds.");
+  }
+  const refuse = (message) => {
+    throw new ZappieError("invalid_request", message);
+  };
+  const seal = async (envelope) => {
+    const sealed = await sealValue(envelope, sealing);
+    return sealed.length > 3800 ? refuse(
+      "This session is too large for a cookie. Use a session store that keeps sessions on the server."
+    ) : sealed;
+  };
+  const open = async (sid) => {
+    const envelope = await openSealedValue(sid, sealing);
+    return envelope?.v === 1 && envelope.exp > now() ? envelope : null;
+  };
+  return {
+    create: (data) => seal({ v: 1, exp: now() + maxAge, data }),
+    get: async (sid) => (await open(sid))?.data ?? null,
+    async update(sid, patch) {
+      const envelope = await open(sid);
+      return envelope ? seal({ ...envelope, data: { ...envelope.data, ...patch } }) : null;
+    },
+    // The session is the cookie, so clearing the cookie ends it.
+    delete: async () => void 0,
+    deleteBySub: async () => refuse(
+      "A cookie session store can't end sessions from the server. Use a session store that keeps sessions on the server for back-channel logout."
+    )
+  };
+}
+export {
+  cookieSessionStore
+};
+//# sourceMappingURL=session-store.js.map

package/dist/server/auth/session-store.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/server/auth/session-store.ts"],
+  "sourcesContent": ["import { ZappieError } from \"../../errors\";\nimport {\n  openSealedValue,\n  sealValue,\n  secretsOf,\n  type SealSecret,\n} from \"./crypto\";\n\n/** What a signed-in session holds on the server. Tokens never reach the browser. */\nexport type SessionData = {\n  /** The customer's subject, such as `cus_7Kd`. */\n  sub: string;\n  /** The OAuth client the session belongs to, your site's client id. */\n  clientId: string;\n  /** What the site may show about the customer. */\n  customer: { id: string; givenName?: string; phoneMasked: string };\n  accessToken: string;\n  /** When the access token expires, in epoch milliseconds. */\n  accessExp: number;\n  refreshToken: string;\n  /** The issuer's session id from the ID token, for back-channel logout. */\n  idTokenSid?: string;\n  scopes: string[];\n  /** Epoch milliseconds. */\n  createdAt: number;\n  /** Epoch milliseconds. */\n  lastSeenAt: number;\n  mode: \"test\" | \"live\";\n};\n\n/**\n * Where signed-in sessions live. The session id is what the browser's\n * session cookie holds.\n */\nexport interface SessionStore {\n  /** Save a new session and return its id. */\n  create(data: SessionData): Promise<string>;\n  /** Read a session, or null when it doesn't exist or has expired. */\n  get(sid: string): Promise<SessionData | null>;\n  /**\n   * Change a session and return the id to keep in the cookie, or null when\n   * the session no longer exists. Stores that keep sessions on the server\n   * return the same id. The cookie store returns a new one.\n   */\n  update(sid: string, patch: Partial<SessionData>): Promise<string | null>;\n  /** End one session. */\n  delete(sid: string): Promise<void>;\n  /** End every session for a customer and client, for back-channel logout. */\n  deleteBySub(sub: string, clientId: string): Promise<void>;\n}\n\n/** Settings for the encrypted-cookie session store. */\nexport type CookieSessionStoreOptions = {\n  /**\n   * At least 32 bytes each, from a random generator such as `randomToken()`,\n   * never a password or phrase. The key is the secret's SHA-256 with no\n   * stretching, so a guessable secret can be found offline from one sealed\n   * value. List the new secret first while you rotate.\n   */\n  secret: SealSecret;\n  /** How long a session lasts from sign-in, in seconds. Defaults to 30 days. */\n  maxAgeSec?: number;\n  /** The current time in milliseconds. For tests. */\n  now?: () => number;\n};\n\ntype Envelope = { v: 1; exp: number; data: SessionData };\n\n/**\n * Create a session store that keeps the whole session, sealed with AES-GCM,\n * in the cookie itself, so it needs no database. It can't end a session from\n * the server, so back-channel logout needs a store that keeps sessions there.\n * Signing out clears the cookie in that browser only. A copy of the cookie\n * still opens the session until it expires, 30 days after sign-in by\n * default, or until you rotate the secret out.\n */\nexport function cookieSessionStore(\n  options: CookieSessionStoreOptions,\n): SessionStore {\n  const maxAge = (options.maxAgeSec ?? 30 * 24 * 60 * 60) * 1000;\n  const now = options.now ?? Date.now;\n  const sealing = { secret: options.secret, purpose: \"zappie_session\" };\n  secretsOf(options.secret);\n  if (!(maxAge > 0 && Number.isFinite(maxAge))) {\n    throw new TypeError(\"maxAgeSec must be a positive number of seconds.\");\n  }\n  const refuse = (message: string) => {\n    throw new ZappieError(\"invalid_request\", message);\n  };\n  const seal = async (envelope: Envelope) => {\n    const sealed = await sealValue(envelope, sealing);\n    // Browsers drop a cookie over 4 KB without an error.\n    return sealed.length > 3800\n      ? refuse(\n          \"This session is too large for a cookie. Use a session store that keeps sessions on the server.\",\n        )\n      : sealed;\n  };\n  const open = async (sid: string) => {\n    const envelope = await openSealedValue<Envelope>(sid, sealing);\n    return envelope?.v === 1 && envelope.exp > now() ? envelope : null;\n  };\n\n  return {\n    create: (data) => seal({ v: 1, exp: now() + maxAge, data }),\n    get: async (sid) => (await open(sid))?.data ?? null,\n    async update(sid, patch) {\n      const envelope = await open(sid);\n      return envelope\n        ? seal({ ...envelope, data: { ...envelope.data, ...patch } })\n        : null;\n    },\n    // The session is the cookie, so clearing the cookie ends it.\n    delete: async () => undefined,\n    deleteBySub: async () =>\n      refuse(\n        \"A cookie session store can't end sessions from the server. Use a session store that keeps sessions on the server for back-channel logout.\",\n      ),\n  };\n}\n"],
+  "mappings": ";AAAA,SAAS,mBAAmB;AAC5B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAsEA,SAAS,mBACd,SACc;AACd,QAAM,UAAU,QAAQ,aAAa,KAAK,KAAK,KAAK,MAAM;AAC1D,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,UAAU,EAAE,QAAQ,QAAQ,QAAQ,SAAS,iBAAiB;AACpE,YAAU,QAAQ,MAAM;AACxB,MAAI,EAAE,SAAS,KAAK,OAAO,SAAS,MAAM,IAAI;AAC5C,UAAM,IAAI,UAAU,iDAAiD;AAAA,EACvE;AACA,QAAM,SAAS,CAAC,YAAoB;AAClC,UAAM,IAAI,YAAY,mBAAmB,OAAO;AAAA,EAClD;AACA,QAAM,OAAO,OAAO,aAAuB;AACzC,UAAM,SAAS,MAAM,UAAU,UAAU,OAAO;AAEhD,WAAO,OAAO,SAAS,OACnB;AAAA,MACE;AAAA,IACF,IACA;AAAA,EACN;AACA,QAAM,OAAO,OAAO,QAAgB;AAClC,UAAM,WAAW,MAAM,gBAA0B,KAAK,OAAO;AAC7D,WAAO,UAAU,MAAM,KAAK,SAAS,MAAM,IAAI,IAAI,WAAW;AAAA,EAChE;AAEA,SAAO;AAAA,IACL,QAAQ,CAAC,SAAS,KAAK,EAAE,GAAG,GAAG,KAAK,IAAI,IAAI,QAAQ,KAAK,CAAC;AAAA,IAC1D,KAAK,OAAO,SAAS,MAAM,KAAK,GAAG,IAAI,QAAQ;AAAA,IAC/C,MAAM,OAAO,KAAK,OAAO;AACvB,YAAM,WAAW,MAAM,KAAK,GAAG;AAC/B,aAAO,WACH,KAAK,EAAE,GAAG,UAAU,MAAM,EAAE,GAAG,SAAS,MAAM,GAAG,MAAM,EAAE,CAAC,IAC1D;AAAA,IACN;AAAA;AAAA,IAEA,QAAQ,YAAY;AAAA,IACpB,aAAa,YACX;AAAA,MACE;AAAA,IACF;AAAA,EACJ;AACF;",
+  "names": []
+}

package/dist/server/edge-snapshot.js

@@ -0,0 +1,200 @@
+// src/server/edge-snapshot.ts
+import { mapMenu } from "../transport/mappers.js";
+var snapshotKeys = {
+  /** `store:<storeId>` holds a StoreSnapshot. */
+  store: (storeId) => `store:${storeId}`,
+  /** `menu:<storeId>:<branchId>`, or `menu:<storeId>` for the default branch. */
+  menu: (storeId, branchId) => branchId === void 0 ? `menu:${storeId}` : `menu:${storeId}:${branchId}`,
+  /** `avail:<storeId>:<branchId>` holds an AvailabilityPatch. */
+  availability: (storeId, branchId) => `avail:${storeId}:${branchId}`,
+  /** `ver:<storeId>` holds a SnapshotVersionRecord. */
+  version: (storeId) => `ver:${storeId}`
+};
+function canonical(value, seen) {
+  if (value === null || typeof value === "boolean") {
+    return JSON.stringify(value);
+  }
+  if (typeof value === "string") {
+    return JSON.stringify(value);
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new TypeError("Canonical JSON can't hold a non-finite number.");
+    }
+    return JSON.stringify(value);
+  }
+  if (typeof value !== "object") {
+    throw new TypeError(`Canonical JSON can't hold a ${typeof value}.`);
+  }
+  if (seen.has(value)) {
+    throw new TypeError("Canonical JSON can't hold a cycle.");
+  }
+  seen.add(value);
+  let out;
+  if (Array.isArray(value)) {
+    out = `[${value.map((entry) => entry === void 0 ? "null" : canonical(entry, seen)).join(",")}]`;
+  } else {
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+      throw new TypeError("Canonical JSON holds plain objects only.");
+    }
+    out = `{${Object.keys(value).filter((key) => value[key] !== void 0).sort().map(
+      (key) => `${JSON.stringify(key)}:${canonical(value[key], seen)}`
+    ).join(",")}}`;
+  }
+  seen.delete(value);
+  return out;
+}
+function canonicalJson(value) {
+  return canonical(value, /* @__PURE__ */ new Set());
+}
+async function snapshotHash(value) {
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(canonicalJson(value))
+  );
+  return Array.from(
+    new Uint8Array(digest).slice(0, 8),
+    (byte) => byte.toString(16).padStart(2, "0")
+  ).join("");
+}
+var isoTime = (value) => {
+  const time = value === void 0 ? /* @__PURE__ */ new Date() : new Date(value);
+  if (Number.isNaN(time.getTime())) {
+    throw new TypeError("Snapshot times must be valid dates.");
+  }
+  return time.toISOString();
+};
+async function createMenuSnapshot({
+  storeId,
+  menu,
+  builtAt,
+  sourceUpdatedAt
+}) {
+  if (!storeId || !menu.branchId || !menu.version) {
+    throw new TypeError(
+      "A menu snapshot needs a store, a branch and a menu version."
+    );
+  }
+  if (menu.completeness === "partial") {
+    throw new TypeError("A partial menu can't become a snapshot.");
+  }
+  return {
+    v: 1,
+    storeId,
+    branchId: menu.branchId,
+    version: menu.version,
+    contentHash: await snapshotHash(menu),
+    builtAt: isoTime(builtAt),
+    ...sourceUpdatedAt === void 0 ? {} : { sourceUpdatedAt: isoTime(sourceUpdatedAt) },
+    menu
+  };
+}
+async function menuSnapshotFromPayload({
+  storeId,
+  branchId,
+  payload,
+  builtAt
+}) {
+  const menu = mapMenu(payload, branchId);
+  const updates = (Array.isArray(payload?.menus) ? payload.menus : []).map((source) => source?.updated_at).filter(
+    (value) => typeof value === "string" && !Number.isNaN(Date.parse(value))
+  ).sort((left, right) => Date.parse(right) - Date.parse(left));
+  return createMenuSnapshot({
+    storeId,
+    menu,
+    ...builtAt === void 0 ? {} : { builtAt },
+    ...updates[0] === void 0 ? {} : { sourceUpdatedAt: updates[0] }
+  });
+}
+async function createStoreSnapshot({
+  store,
+  builtAt
+}) {
+  if (!store.id) {
+    throw new TypeError("A store snapshot needs a store id.");
+  }
+  return {
+    v: 1,
+    storeId: store.id,
+    contentHash: await snapshotHash(store),
+    builtAt: isoTime(builtAt),
+    store
+  };
+}
+var ids = (values) => [...new Set(values ?? [])].sort();
+async function createAvailabilityPatch(input) {
+  if (!input.menuVersion) {
+    throw new TypeError("An availability patch needs the API's menu version.");
+  }
+  const content = {
+    v: 1,
+    menuVersion: input.menuVersion,
+    soldOutItems: ids(input.soldOutItems),
+    soldOutVariants: ids(input.soldOutVariants),
+    soldOutOptions: ids(input.soldOutOptions),
+    ...input.closedUntil === void 0 ? {} : { closedUntil: isoTime(input.closedUntil) }
+  };
+  return {
+    ...content,
+    version: await snapshotHash(content),
+    updatedAt: isoTime(input.updatedAt)
+  };
+}
+function applyAvailability(snapshot, patch) {
+  if (!patch || Date.parse(patch.updatedAt) < Date.parse(snapshot.builtAt)) {
+    return snapshot.menu;
+  }
+  const items = new Set(patch.soldOutItems);
+  const variants = new Set(patch.soldOutVariants);
+  const options = new Set(patch.soldOutOptions);
+  return {
+    ...snapshot.menu,
+    version: patch.menuVersion,
+    items: Object.fromEntries(
+      Object.entries(snapshot.menu.items).map(([id, item]) => {
+        const touched = item.variants.some(
+          (variant) => variants.has(variant.id)
+        );
+        const patched = item.variants.map(
+          (variant) => variants.has(variant.id) ? { ...variant, isAvailable: false } : variant
+        );
+        return [
+          id,
+          {
+            ...item,
+            // Selling out every variant sells out the item.
+            isAvailable: item.isAvailable && !items.has(id) && (!touched || patched.some((variant) => variant.isAvailable)),
+            variants: patched,
+            optionGroups: item.optionGroups.map((group) => ({
+              ...group,
+              choices: group.choices.map(
+                (choice) => options.has(choice.id) ? { ...choice, isAvailable: false } : choice
+              )
+            }))
+          }
+        ];
+      })
+    )
+  };
+}
+function isMenuSnapshot(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  const snapshot = value;
+  const menu = snapshot.menu;
+  return snapshot.v === 1 && typeof snapshot.storeId === "string" && typeof snapshot.branchId === "string" && typeof snapshot.version === "string" && typeof snapshot.contentHash === "string" && typeof snapshot.builtAt === "string" && !!menu && typeof menu === "object" && menu.branchId === snapshot.branchId && menu.version === snapshot.version && menu.completeness !== "partial" && Array.isArray(menu.categories) && !!menu.items && typeof menu.items === "object";
+}
+export {
+  applyAvailability,
+  canonicalJson,
+  createAvailabilityPatch,
+  createMenuSnapshot,
+  createStoreSnapshot,
+  isMenuSnapshot,
+  menuSnapshotFromPayload,
+  snapshotHash,
+  snapshotKeys
+};
+//# sourceMappingURL=edge-snapshot.js.map

package/dist/server/edge-snapshot.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/server/edge-snapshot.ts"],
+  "sourcesContent": ["import type { Menu, Store } from \"../models\";\nimport { mapMenu } from \"../transport/mappers\";\n\n/**\n * A branch catalogue as the edge keeps it: the SDK `Menu` that `menu.get()`\n * returns, with the facts a snapshot writer and reader need around it.\n */\nexport type MenuSnapshot = {\n  v: 1;\n  storeId: string;\n  branchId: string;\n  /** The API's menu version, the same value `GET /menus/version` returns. */\n  version: string;\n  /** The first 16 hex digits of the SHA-256 of the menu's canonical JSON. */\n  contentHash: string;\n  /** When the snapshot was built, as an ISO time. */\n  builtAt: string;\n  /** The latest change among the source menus, as an ISO time, when the API sends it. */\n  sourceUpdatedAt?: string;\n  /** A complete branch catalogue. Partial category pages never become snapshots. */\n  menu: Menu;\n};\n\n/** Store details as the edge keeps them: the SDK `Store` that `store.get()` returns. */\nexport type StoreSnapshot = {\n  v: 1;\n  storeId: string;\n  /** The first 16 hex digits of the SHA-256 of the store's canonical JSON. */\n  contentHash: string;\n  /** When the snapshot was built, as an ISO time. */\n  builtAt: string;\n  store: Store;\n};\n\n/**\n * What sold out since a branch's menu snapshot was built. It is small, so an\n * availability change rewrites about 1 KB instead of the whole menu.\n */\nexport type AvailabilityPatch = {\n  v: 1;\n  /** The first 16 hex digits of the SHA-256 of this patch's canonical JSON. */\n  version: string;\n  /** The API's menu version after this change. A patched menu reports it. */\n  menuVersion: string;\n  soldOutItems: string[];\n  soldOutVariants: string[];\n  /** Choice ids in option groups. */\n  soldOutOptions: string[];\n  /** When the branch reopens, as an ISO time, if it is closed for now. */\n  closedUntil?: string;\n  /** When the patch was built, as an ISO time. */\n  updatedAt: string;\n};\n\n/** The version record a writer saves last, so readers never see unwritten data. */\nexport type SnapshotVersionRecord = {\n  /** The default branch's menu version. */\n  version: string;\n  builtAt: string;\n  branches: Record<string, string>;\n};\n\n/** The edge key-value names for each snapshot. */\nexport const snapshotKeys = {\n  /** `store:<storeId>` holds a StoreSnapshot. */\n  store: (storeId: string) => `store:${storeId}`,\n  /** `menu:<storeId>:<branchId>`, or `menu:<storeId>` for the default branch. */\n  menu: (storeId: string, branchId?: string) =>\n    branchId === undefined ? `menu:${storeId}` : `menu:${storeId}:${branchId}`,\n  /** `avail:<storeId>:<branchId>` holds an AvailabilityPatch. */\n  availability: (storeId: string, branchId: string) =>\n    `avail:${storeId}:${branchId}`,\n  /** `ver:<storeId>` holds a SnapshotVersionRecord. */\n  version: (storeId: string) => `ver:${storeId}`,\n} as const;\n\nfunction canonical(value: unknown, seen: Set<object>): string {\n  if (value === null || typeof value === \"boolean\") {\n    return JSON.stringify(value);\n  }\n  if (typeof value === \"string\") {\n    return JSON.stringify(value);\n  }\n  if (typeof value === \"number\") {\n    if (!Number.isFinite(value)) {\n      throw new TypeError(\"Canonical JSON can't hold a non-finite number.\");\n    }\n    return JSON.stringify(value);\n  }\n  if (typeof value !== \"object\") {\n    throw new TypeError(`Canonical JSON can't hold a ${typeof value}.`);\n  }\n  if (seen.has(value)) {\n    throw new TypeError(\"Canonical JSON can't hold a cycle.\");\n  }\n  seen.add(value);\n  let out: string;\n  if (Array.isArray(value)) {\n    out = `[${value\n      .map((entry) => (entry === undefined ? \"null\" : canonical(entry, seen)))\n      .join(\",\")}]`;\n  } else {\n    const prototype = Object.getPrototypeOf(value) as unknown;\n    if (prototype !== Object.prototype && prototype !== null) {\n      throw new TypeError(\"Canonical JSON holds plain objects only.\");\n    }\n    out = `{${Object.keys(value)\n      .filter((key) => (value as Record<string, unknown>)[key] !== undefined)\n      .sort()\n      .map(\n        (key) =>\n          `${JSON.stringify(key)}:${canonical((value as Record<string, unknown>)[key], seen)}`,\n      )\n      .join(\",\")}}`;\n  }\n  seen.delete(value);\n  return out;\n}\n\n/**\n * Serialise a JSON value with object keys in sorted order and undefined\n * properties left out, so equal values always give the same text.\n */\nexport function canonicalJson(value: unknown): string {\n  return canonical(value, new Set());\n}\n\n/** Hash a JSON value: the first 16 hex digits of the SHA-256 of its canonical JSON. */\nexport async function snapshotHash(value: unknown): Promise<string> {\n  const digest = await crypto.subtle.digest(\n    \"SHA-256\",\n    new TextEncoder().encode(canonicalJson(value)),\n  );\n  return Array.from(new Uint8Array(digest).slice(0, 8), (byte) =>\n    byte.toString(16).padStart(2, \"0\"),\n  ).join(\"\");\n}\n\nconst isoTime = (value: Date | string | undefined) => {\n  const time = value === undefined ? new Date() : new Date(value);\n  if (Number.isNaN(time.getTime())) {\n    throw new TypeError(\"Snapshot times must be valid dates.\");\n  }\n  return time.toISOString();\n};\n\n/** Input for building a MenuSnapshot from an SDK menu. */\nexport type MenuSnapshotInput = {\n  storeId: string;\n  menu: Menu;\n  /** Defaults to now. */\n  builtAt?: Date | string;\n  sourceUpdatedAt?: Date | string;\n};\n\n/** Build a MenuSnapshot from a complete SDK menu. */\nexport async function createMenuSnapshot({\n  storeId,\n  menu,\n  builtAt,\n  sourceUpdatedAt,\n}: MenuSnapshotInput): Promise<MenuSnapshot> {\n  if (!storeId || !menu.branchId || !menu.version) {\n    throw new TypeError(\n      \"A menu snapshot needs a store, a branch and a menu version.\",\n    );\n  }\n  if (menu.completeness === \"partial\") {\n    throw new TypeError(\"A partial menu can't become a snapshot.\");\n  }\n  return {\n    v: 1,\n    storeId,\n    branchId: menu.branchId,\n    version: menu.version,\n    contentHash: await snapshotHash(menu),\n    builtAt: isoTime(builtAt),\n    ...(sourceUpdatedAt === undefined\n      ? {}\n      : { sourceUpdatedAt: isoTime(sourceUpdatedAt) }),\n    menu,\n  };\n}\n\n/** Input for building a MenuSnapshot from the API's menu payload. */\nexport type MenuSnapshotPayloadInput = {\n  storeId: string;\n  branchId: string;\n  /** The JSON body of the API's branch menu read. */\n  payload: unknown;\n  /** Defaults to now. */\n  builtAt?: Date | string;\n};\n\n/**\n * Build a MenuSnapshot from the API's branch menu payload. It maps the payload\n * with the same mapper `menu.get()` uses, so the snapshot's menu is exactly\n * what the client SDK returns.\n */\nexport async function menuSnapshotFromPayload({\n  storeId,\n  branchId,\n  payload,\n  builtAt,\n}: MenuSnapshotPayloadInput): Promise<MenuSnapshot> {\n  const menu = mapMenu(payload, branchId);\n  const updates = (\n    Array.isArray((payload as { menus?: unknown } | null)?.menus)\n      ? ((payload as { menus: unknown[] }).menus as { updated_at?: unknown }[])\n      : []\n  )\n    .map((source) => source?.updated_at)\n    .filter(\n      (value): value is string =>\n        typeof value === \"string\" && !Number.isNaN(Date.parse(value)),\n    )\n    .sort((left, right) => Date.parse(right) - Date.parse(left));\n  return createMenuSnapshot({\n    storeId,\n    menu,\n    ...(builtAt === undefined ? {} : { builtAt }),\n    ...(updates[0] === undefined ? {} : { sourceUpdatedAt: updates[0] }),\n  });\n}\n\n/** Build a StoreSnapshot from an SDK store. */\nexport async function createStoreSnapshot({\n  store,\n  builtAt,\n}: {\n  store: Store;\n  builtAt?: Date | string;\n}): Promise<StoreSnapshot> {\n  if (!store.id) {\n    throw new TypeError(\"A store snapshot needs a store id.\");\n  }\n  return {\n    v: 1,\n    storeId: store.id,\n    contentHash: await snapshotHash(store),\n    builtAt: isoTime(builtAt),\n    store,\n  };\n}\n\n/** Input for building an AvailabilityPatch. */\nexport type AvailabilityPatchInput = {\n  menuVersion: string;\n  soldOutItems?: readonly string[];\n  soldOutVariants?: readonly string[];\n  soldOutOptions?: readonly string[];\n  closedUntil?: Date | string;\n  /** Defaults to now. */\n  updatedAt?: Date | string;\n};\n\nconst ids = (values: readonly string[] | undefined) =>\n  [...new Set(values ?? [])].sort();\n\n/** Build an AvailabilityPatch with sorted, unique ids and its content hash. */\nexport async function createAvailabilityPatch(\n  input: AvailabilityPatchInput,\n): Promise<AvailabilityPatch> {\n  if (!input.menuVersion) {\n    throw new TypeError(\"An availability patch needs the API's menu version.\");\n  }\n  const content = {\n    v: 1 as const,\n    menuVersion: input.menuVersion,\n    soldOutItems: ids(input.soldOutItems),\n    soldOutVariants: ids(input.soldOutVariants),\n    soldOutOptions: ids(input.soldOutOptions),\n    ...(input.closedUntil === undefined\n      ? {}\n      : { closedUntil: isoTime(input.closedUntil) }),\n  };\n  return {\n    ...content,\n    version: await snapshotHash(content),\n    updatedAt: isoTime(input.updatedAt),\n  };\n}\n\n/**\n * Return the snapshot's menu with an availability patch applied. A patch\n * built before the snapshot is ignored, because the rebuilt menu already\n * holds newer availability. The result reports the patch's menu version.\n */\nexport function applyAvailability(\n  snapshot: MenuSnapshot,\n  patch: AvailabilityPatch | null | undefined,\n): Menu {\n  if (!patch || Date.parse(patch.updatedAt) < Date.parse(snapshot.builtAt)) {\n    return snapshot.menu;\n  }\n  const items = new Set(patch.soldOutItems);\n  const variants = new Set(patch.soldOutVariants);\n  const options = new Set(patch.soldOutOptions);\n  return {\n    ...snapshot.menu,\n    version: patch.menuVersion,\n    items: Object.fromEntries(\n      Object.entries(snapshot.menu.items).map(([id, item]) => {\n        const touched = item.variants.some((variant) =>\n          variants.has(variant.id),\n        );\n        const patched = item.variants.map((variant) =>\n          variants.has(variant.id)\n            ? { ...variant, isAvailable: false }\n            : variant,\n        ) as typeof item.variants;\n        return [\n          id,\n          {\n            ...item,\n            // Selling out every variant sells out the item.\n            isAvailable:\n              item.isAvailable &&\n              !items.has(id) &&\n              (!touched || patched.some((variant) => variant.isAvailable)),\n            variants: patched,\n            optionGroups: item.optionGroups.map((group) => ({\n              ...group,\n              choices: group.choices.map((choice) =>\n                options.has(choice.id)\n                  ? { ...choice, isAvailable: false }\n                  : choice,\n              ),\n            })),\n          },\n        ];\n      }),\n    ),\n  };\n}\n\n/** Check that a value read from the edge is a MenuSnapshot this SDK can use. */\nexport function isMenuSnapshot(value: unknown): value is MenuSnapshot {\n  if (!value || typeof value !== \"object\") {\n    return false;\n  }\n  const snapshot = value as Partial<MenuSnapshot>;\n  const menu = snapshot.menu as Partial<Menu> | undefined;\n  return (\n    snapshot.v === 1 &&\n    typeof snapshot.storeId === \"string\" &&\n    typeof snapshot.branchId === \"string\" &&\n    typeof snapshot.version === \"string\" &&\n    typeof snapshot.contentHash === \"string\" &&\n    typeof snapshot.builtAt === \"string\" &&\n    !!menu &&\n    typeof menu === \"object\" &&\n    menu.branchId === snapshot.branchId &&\n    menu.version === snapshot.version &&\n    menu.completeness !== \"partial\" &&\n    Array.isArray(menu.categories) &&\n    !!menu.items &&\n    typeof menu.items === \"object\"\n  );\n}\n"],
+  "mappings": ";AACA,SAAS,eAAe;AA8DjB,IAAM,eAAe;AAAA;AAAA,EAE1B,OAAO,CAAC,YAAoB,SAAS,OAAO;AAAA;AAAA,EAE5C,MAAM,CAAC,SAAiB,aACtB,aAAa,SAAY,QAAQ,OAAO,KAAK,QAAQ,OAAO,IAAI,QAAQ;AAAA;AAAA,EAE1E,cAAc,CAAC,SAAiB,aAC9B,SAAS,OAAO,IAAI,QAAQ;AAAA;AAAA,EAE9B,SAAS,CAAC,YAAoB,OAAO,OAAO;AAC9C;AAEA,SAAS,UAAU,OAAgB,MAA2B;AAC5D,MAAI,UAAU,QAAQ,OAAO,UAAU,WAAW;AAChD,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,YAAM,IAAI,UAAU,gDAAgD;AAAA,IACtE;AACA,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI,UAAU,+BAA+B,OAAO,KAAK,GAAG;AAAA,EACpE;AACA,MAAI,KAAK,IAAI,KAAK,GAAG;AACnB,UAAM,IAAI,UAAU,oCAAoC;AAAA,EAC1D;AACA,OAAK,IAAI,KAAK;AACd,MAAI;AACJ,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAM,IAAI,MACP,IAAI,CAAC,UAAW,UAAU,SAAY,SAAS,UAAU,OAAO,IAAI,CAAE,EACtE,KAAK,GAAG,CAAC;AAAA,EACd,OAAO;AACL,UAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,QAAI,cAAc,OAAO,aAAa,cAAc,MAAM;AACxD,YAAM,IAAI,UAAU,0CAA0C;AAAA,IAChE;AACA,UAAM,IAAI,OAAO,KAAK,KAAK,EACxB,OAAO,CAAC,QAAS,MAAkC,GAAG,MAAM,MAAS,EACrE,KAAK,EACL;AAAA,MACC,CAAC,QACC,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,UAAW,MAAkC,GAAG,GAAG,IAAI,CAAC;AAAA,IACtF,EACC,KAAK,GAAG,CAAC;AAAA,EACd;AACA,OAAK,OAAO,KAAK;AACjB,SAAO;AACT;AAMO,SAAS,cAAc,OAAwB;AACpD,SAAO,UAAU,OAAO,oBAAI,IAAI,CAAC;AACnC;AAGA,eAAsB,aAAa,OAAiC;AAClE,QAAM,SAAS,MAAM,OAAO,OAAO;AAAA,IACjC;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,cAAc,KAAK,CAAC;AAAA,EAC/C;AACA,SAAO,MAAM;AAAA,IAAK,IAAI,WAAW,MAAM,EAAE,MAAM,GAAG,CAAC;AAAA,IAAG,CAAC,SACrD,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAAA,EACnC,EAAE,KAAK,EAAE;AACX;AAEA,IAAM,UAAU,CAAC,UAAqC;AACpD,QAAM,OAAO,UAAU,SAAY,oBAAI,KAAK,IAAI,IAAI,KAAK,KAAK;AAC9D,MAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,GAAG;AAChC,UAAM,IAAI,UAAU,qCAAqC;AAAA,EAC3D;AACA,SAAO,KAAK,YAAY;AAC1B;AAYA,eAAsB,mBAAmB;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAA6C;AAC3C,MAAI,CAAC,WAAW,CAAC,KAAK,YAAY,CAAC,KAAK,SAAS;AAC/C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,KAAK,iBAAiB,WAAW;AACnC,UAAM,IAAI,UAAU,yCAAyC;AAAA,EAC/D;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA,UAAU,KAAK;AAAA,IACf,SAAS,KAAK;AAAA,IACd,aAAa,MAAM,aAAa,IAAI;AAAA,IACpC,SAAS,QAAQ,OAAO;AAAA,IACxB,GAAI,oBAAoB,SACpB,CAAC,IACD,EAAE,iBAAiB,QAAQ,eAAe,EAAE;AAAA,IAChD;AAAA,EACF;AACF;AAiBA,eAAsB,wBAAwB;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAoD;AAClD,QAAM,OAAO,QAAQ,SAAS,QAAQ;AACtC,QAAM,WACJ,MAAM,QAAS,SAAwC,KAAK,IACtD,QAAiC,QACnC,CAAC,GAEJ,IAAI,CAAC,WAAW,QAAQ,UAAU,EAClC;AAAA,IACC,CAAC,UACC,OAAO,UAAU,YAAY,CAAC,OAAO,MAAM,KAAK,MAAM,KAAK,CAAC;AAAA,EAChE,EACC,KAAK,CAAC,MAAM,UAAU,KAAK,MAAM,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;AAC7D,SAAO,mBAAmB;AAAA,IACxB;AAAA,IACA;AAAA,IACA,GAAI,YAAY,SAAY,CAAC,IAAI,EAAE,QAAQ;AAAA,IAC3C,GAAI,QAAQ,CAAC,MAAM,SAAY,CAAC,IAAI,EAAE,iBAAiB,QAAQ,CAAC,EAAE;AAAA,EACpE,CAAC;AACH;AAGA,eAAsB,oBAAoB;AAAA,EACxC;AAAA,EACA;AACF,GAG2B;AACzB,MAAI,CAAC,MAAM,IAAI;AACb,UAAM,IAAI,UAAU,oCAAoC;AAAA,EAC1D;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS,MAAM;AAAA,IACf,aAAa,MAAM,aAAa,KAAK;AAAA,IACrC,SAAS,QAAQ,OAAO;AAAA,IACxB;AAAA,EACF;AACF;AAaA,IAAM,MAAM,CAAC,WACX,CAAC,GAAG,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK;AAGlC,eAAsB,wBACpB,OAC4B;AAC5B,MAAI,CAAC,MAAM,aAAa;AACtB,UAAM,IAAI,UAAU,qDAAqD;AAAA,EAC3E;AACA,QAAM,UAAU;AAAA,IACd,GAAG;AAAA,IACH,aAAa,MAAM;AAAA,IACnB,cAAc,IAAI,MAAM,YAAY;AAAA,IACpC,iBAAiB,IAAI,MAAM,eAAe;AAAA,IAC1C,gBAAgB,IAAI,MAAM,cAAc;AAAA,IACxC,GAAI,MAAM,gBAAgB,SACtB,CAAC,IACD,EAAE,aAAa,QAAQ,MAAM,WAAW,EAAE;AAAA,EAChD;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS,MAAM,aAAa,OAAO;AAAA,IACnC,WAAW,QAAQ,MAAM,SAAS;AAAA,EACpC;AACF;AAOO,SAAS,kBACd,UACA,OACM;AACN,MAAI,CAAC,SAAS,KAAK,MAAM,MAAM,SAAS,IAAI,KAAK,MAAM,SAAS,OAAO,GAAG;AACxE,WAAO,SAAS;AAAA,EAClB;AACA,QAAM,QAAQ,IAAI,IAAI,MAAM,YAAY;AACxC,QAAM,WAAW,IAAI,IAAI,MAAM,eAAe;AAC9C,QAAM,UAAU,IAAI,IAAI,MAAM,cAAc;AAC5C,SAAO;AAAA,IACL,GAAG,SAAS;AAAA,IACZ,SAAS,MAAM;AAAA,IACf,OAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,SAAS,KAAK,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM;AACtD,cAAM,UAAU,KAAK,SAAS;AAAA,UAAK,CAAC,YAClC,SAAS,IAAI,QAAQ,EAAE;AAAA,QACzB;AACA,cAAM,UAAU,KAAK,SAAS;AAAA,UAAI,CAAC,YACjC,SAAS,IAAI,QAAQ,EAAE,IACnB,EAAE,GAAG,SAAS,aAAa,MAAM,IACjC;AAAA,QACN;AACA,eAAO;AAAA,UACL;AAAA,UACA;AAAA,YACE,GAAG;AAAA;AAAA,YAEH,aACE,KAAK,eACL,CAAC,MAAM,IAAI,EAAE,MACZ,CAAC,WAAW,QAAQ,KAAK,CAAC,YAAY,QAAQ,WAAW;AAAA,YAC5D,UAAU;AAAA,YACV,cAAc,KAAK,aAAa,IAAI,CAAC,WAAW;AAAA,cAC9C,GAAG;AAAA,cACH,SAAS,MAAM,QAAQ;AAAA,gBAAI,CAAC,WAC1B,QAAQ,IAAI,OAAO,EAAE,IACjB,EAAE,GAAG,QAAQ,aAAa,MAAM,IAChC;AAAA,cACN;AAAA,YACF,EAAE;AAAA,UACJ;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAGO,SAAS,eAAe,OAAuC;AACpE,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,WAAO;AAAA,EACT;AACA,QAAM,WAAW;AACjB,QAAM,OAAO,SAAS;AACtB,SACE,SAAS,MAAM,KACf,OAAO,SAAS,YAAY,YAC5B,OAAO,SAAS,aAAa,YAC7B,OAAO,SAAS,YAAY,YAC5B,OAAO,SAAS,gBAAgB,YAChC,OAAO,SAAS,YAAY,YAC5B,CAAC,CAAC,QACF,OAAO,SAAS,YAChB,KAAK,aAAa,SAAS,YAC3B,KAAK,YAAY,SAAS,WAC1B,KAAK,iBAAiB,aACtB,MAAM,QAAQ,KAAK,UAAU,KAC7B,CAAC,CAAC,KAAK,SACP,OAAO,KAAK,UAAU;AAE1B;",
+  "names": []
+}

package/dist/server/index.d.ts

@@ -1,4 +1,4 @@
-import { a as Menu, F as Formatters, S as Store } from '../models-D__QbqEd.js';
+import { a as Menu, S as Store, F as Formatters } from '../models-D__QbqEd.js';
 import { a as ZappieError, b as ZappieConfig, T as Transport, S as StorageLike, c as StoreResource, M as MenuResource, d as ZappieEvents, C as Cache } from '../client-CSOZOwQW.js';
 export { VERSION } from '../index.js';
 import { d as CartModule, b as CartLineInput } from '../types-gQXU2gEA.js';
@@ -162,6 +162,328 @@ declare const parseStorefrontUrl: (input: StorefrontUrlInput, options?: Storefro
  */
 declare const storefrontRedirect: (input: StorefrontUrlInput, options?: StorefrontUrlOptions) => string | null;
 
+/** A PKCE code verifier and its S256 challenge for one sign-in attempt. */
+type PkcePair = {
+    /** Keep this on the server and send it with the code exchange. */
+    verifier: string;
+    /** Send this to the authorize endpoint as `code_challenge`. */
+    challenge: string;
+    /** Send this as `code_challenge_method`. */
+    method: "S256";
+};
+/** One sealing secret, or several while you rotate them. The first one seals. */
+type SealSecret = string | readonly string[];
+/** Options for sealing a value into a cookie-safe string. */
+type SealOptions = {
+    /**
+     * At least 32 bytes each, from a random generator such as `randomToken()`,
+     * never a password or phrase. The key is the secret's SHA-256 with no
+     * stretching, so a guessable secret can be found offline from one sealed
+     * value. List the new secret first while you rotate.
+     */
+    secret: SealSecret;
+    /**
+     * Binds the sealed value to one use, such as `"tx"`, so it won't open for
+     * another. Leave it out to match the hosted sign-in Worker's format.
+     */
+    purpose?: string;
+};
+/** Create a random URL-safe token from `bytes` random bytes, for state, nonces and ids. */
+declare function randomToken(bytes?: number): string;
+/** Create a PKCE verifier and its S256 challenge. */
+declare function createPkce(): Promise<PkcePair>;
+/** Encrypt a JSON value with AES-GCM into a cookie-safe string. */
+declare function sealValue(value: unknown, { secret, purpose }: SealOptions): Promise<string>;
+/** Decrypt a sealed value with any listed secret. Returns null when none opens it. */
+declare function openSealedValue<T = unknown>(sealed: string | null | undefined, { secret, purpose }: SealOptions): Promise<T | null>;
+
+/** Signing algorithms Sign in with Zappie tokens can use. */
+type TokenAlgorithm = "RS256" | "ES256";
+declare const messages: {
+    malformed: string;
+    unsupported_algorithm: string;
+    unknown_key: string;
+    invalid_signature: string;
+    wrong_issuer: string;
+    wrong_audience: string;
+    wrong_nonce: string;
+    wrong_subject: string;
+    wrong_type: string;
+    expired: string;
+    not_yet_valid: string;
+    keys_unavailable: string;
+};
+/** Why a token was refused. */
+type TokenErrorReason = keyof typeof messages;
+/** A token Zappie's identity issuer didn't sign for you, or one that is no longer valid. */
+declare class ZappieTokenError extends ZappieError {
+    readonly reason: TokenErrorReason;
+    constructor(reason: TokenErrorReason, cause?: unknown);
+}
+/** The verified claims of a token. Extra claims stay on the object. */
+type TokenClaims = {
+    iss: string;
+    aud: string | string[];
+    exp: number;
+    sub?: string;
+    iat?: number;
+    nbf?: number;
+    nonce?: string;
+    sid?: string;
+    [claim: string]: unknown;
+};
+/** Settings for verifying tokens from Zappie's identity issuer. */
+type TokenVerifierOptions = {
+    /** The issuer URL, such as `https://accounts.zappie.ai`. The token's `iss` must equal it. A trailing slash on either is ignored. */
+    issuer: string;
+    /** The audience the token must name: your site's client id for ID tokens, or the API audience for access tokens. */
+    audience: string;
+    /** Where to read the signing keys. Defaults to `<issuer>/.well-known/jwks.json`. */
+    jwksUrl?: string;
+    /** Allowed algorithms. Defaults to RS256 and ES256. */
+    algorithms?: readonly TokenAlgorithm[];
+    /** Seconds of clock skew allowed on `exp`, `nbf` and `iat`. Defaults to 60. */
+    clockToleranceSec?: number;
+    /** Seconds to keep the key set before reading it again, 0 or more. Defaults to one hour. */
+    cacheTtlSec?: number;
+    /** Prefix the `sub` claim must start with. Zappie customers are `cus_`. A token without `sub` is refused. Pass `null` to skip both checks. */
+    subjectPrefix?: string | null;
+    /** The fetch to read keys with. Defaults to the global fetch. */
+    fetch?: typeof fetch;
+    /** The current time in milliseconds. For tests. */
+    now?: () => number;
+};
+/** Per-call checks on top of the verifier's settings. */
+type VerifyTokenChecks = {
+    /** The nonce you sent with the sign-in. When you pass it, the token's `nonce` must equal it. */
+    nonce?: string;
+    /** Overrides the verifier's audience for this token. */
+    audience?: string;
+};
+/** Checks for an ID token from a sign-in. */
+type IdTokenChecks = {
+    /** The nonce you sent with this sign-in. The token's `nonce` must equal it. */
+    nonce: string;
+    /** Overrides the verifier's audience for this token. */
+    audience?: string;
+};
+/** The verified claims of an ID token. */
+type IdTokenClaims = TokenClaims & {
+    sub: string;
+    nonce: string;
+};
+/** Verifies signed tokens against the issuer's published keys. */
+type TokenVerifier = {
+    /** Verify a token's signature and claims, and return its claims. */
+    verify(token: string, checks?: VerifyTokenChecks): Promise<TokenClaims>;
+    /**
+     * Verify the ID token from a sign-in. It needs the nonce you sent, a `sub`,
+     * and refuses a token whose `typ` header names another kind of token, such
+     * as an access token (`at+jwt`).
+     */
+    verifyIdToken(token: string, checks: IdTokenChecks): Promise<IdTokenClaims>;
+};
+/**
+ * Create a verifier for tokens from Zappie's identity issuer. It caches the
+ * issuer's key set, reads it again when a token names an unknown key, and
+ * keeps the last good set while the issuer is down. It uses Web Crypto only,
+ * so it runs in Workers and Node 20 or later.
+ */
+declare function createTokenVerifier(options: TokenVerifierOptions): TokenVerifier;
+
+/** What a signed-in session holds on the server. Tokens never reach the browser. */
+type SessionData = {
+    /** The customer's subject, such as `cus_7Kd`. */
+    sub: string;
+    /** The OAuth client the session belongs to, your site's client id. */
+    clientId: string;
+    /** What the site may show about the customer. */
+    customer: {
+        id: string;
+        givenName?: string;
+        phoneMasked: string;
+    };
+    accessToken: string;
+    /** When the access token expires, in epoch milliseconds. */
+    accessExp: number;
+    refreshToken: string;
+    /** The issuer's session id from the ID token, for back-channel logout. */
+    idTokenSid?: string;
+    scopes: string[];
+    /** Epoch milliseconds. */
+    createdAt: number;
+    /** Epoch milliseconds. */
+    lastSeenAt: number;
+    mode: "test" | "live";
+};
+/**
+ * Where signed-in sessions live. The session id is what the browser's
+ * session cookie holds.
+ */
+interface SessionStore {
+    /** Save a new session and return its id. */
+    create(data: SessionData): Promise<string>;
+    /** Read a session, or null when it doesn't exist or has expired. */
+    get(sid: string): Promise<SessionData | null>;
+    /**
+     * Change a session and return the id to keep in the cookie, or null when
+     * the session no longer exists. Stores that keep sessions on the server
+     * return the same id. The cookie store returns a new one.
+     */
+    update(sid: string, patch: Partial<SessionData>): Promise<string | null>;
+    /** End one session. */
+    delete(sid: string): Promise<void>;
+    /** End every session for a customer and client, for back-channel logout. */
+    deleteBySub(sub: string, clientId: string): Promise<void>;
+}
+/** Settings for the encrypted-cookie session store. */
+type CookieSessionStoreOptions = {
+    /**
+     * At least 32 bytes each, from a random generator such as `randomToken()`,
+     * never a password or phrase. The key is the secret's SHA-256 with no
+     * stretching, so a guessable secret can be found offline from one sealed
+     * value. List the new secret first while you rotate.
+     */
+    secret: SealSecret;
+    /** How long a session lasts from sign-in, in seconds. Defaults to 30 days. */
+    maxAgeSec?: number;
+    /** The current time in milliseconds. For tests. */
+    now?: () => number;
+};
+/**
+ * Create a session store that keeps the whole session, sealed with AES-GCM,
+ * in the cookie itself, so it needs no database. It can't end a session from
+ * the server, so back-channel logout needs a store that keeps sessions there.
+ * Signing out clears the cookie in that browser only. A copy of the cookie
+ * still opens the session until it expires, 30 days after sign-in by
+ * default, or until you rotate the secret out.
+ */
+declare function cookieSessionStore(options: CookieSessionStoreOptions): SessionStore;
+
+/**
+ * A branch catalogue as the edge keeps it: the SDK `Menu` that `menu.get()`
+ * returns, with the facts a snapshot writer and reader need around it.
+ */
+type MenuSnapshot = {
+    v: 1;
+    storeId: string;
+    branchId: string;
+    /** The API's menu version, the same value `GET /menus/version` returns. */
+    version: string;
+    /** The first 16 hex digits of the SHA-256 of the menu's canonical JSON. */
+    contentHash: string;
+    /** When the snapshot was built, as an ISO time. */
+    builtAt: string;
+    /** The latest change among the source menus, as an ISO time, when the API sends it. */
+    sourceUpdatedAt?: string;
+    /** A complete branch catalogue. Partial category pages never become snapshots. */
+    menu: Menu;
+};
+/** Store details as the edge keeps them: the SDK `Store` that `store.get()` returns. */
+type StoreSnapshot = {
+    v: 1;
+    storeId: string;
+    /** The first 16 hex digits of the SHA-256 of the store's canonical JSON. */
+    contentHash: string;
+    /** When the snapshot was built, as an ISO time. */
+    builtAt: string;
+    store: Store;
+};
+/**
+ * What sold out since a branch's menu snapshot was built. It is small, so an
+ * availability change rewrites about 1 KB instead of the whole menu.
+ */
+type AvailabilityPatch = {
+    v: 1;
+    /** The first 16 hex digits of the SHA-256 of this patch's canonical JSON. */
+    version: string;
+    /** The API's menu version after this change. A patched menu reports it. */
+    menuVersion: string;
+    soldOutItems: string[];
+    soldOutVariants: string[];
+    /** Choice ids in option groups. */
+    soldOutOptions: string[];
+    /** When the branch reopens, as an ISO time, if it is closed for now. */
+    closedUntil?: string;
+    /** When the patch was built, as an ISO time. */
+    updatedAt: string;
+};
+/** The version record a writer saves last, so readers never see unwritten data. */
+type SnapshotVersionRecord = {
+    /** The default branch's menu version. */
+    version: string;
+    builtAt: string;
+    branches: Record<string, string>;
+};
+/** The edge key-value names for each snapshot. */
+declare const snapshotKeys: {
+    /** `store:<storeId>` holds a StoreSnapshot. */
+    readonly store: (storeId: string) => string;
+    /** `menu:<storeId>:<branchId>`, or `menu:<storeId>` for the default branch. */
+    readonly menu: (storeId: string, branchId?: string) => string;
+    /** `avail:<storeId>:<branchId>` holds an AvailabilityPatch. */
+    readonly availability: (storeId: string, branchId: string) => string;
+    /** `ver:<storeId>` holds a SnapshotVersionRecord. */
+    readonly version: (storeId: string) => string;
+};
+/**
+ * Serialise a JSON value with object keys in sorted order and undefined
+ * properties left out, so equal values always give the same text.
+ */
+declare function canonicalJson(value: unknown): string;
+/** Hash a JSON value: the first 16 hex digits of the SHA-256 of its canonical JSON. */
+declare function snapshotHash(value: unknown): Promise<string>;
+/** Input for building a MenuSnapshot from an SDK menu. */
+type MenuSnapshotInput = {
+    storeId: string;
+    menu: Menu;
+    /** Defaults to now. */
+    builtAt?: Date | string;
+    sourceUpdatedAt?: Date | string;
+};
+/** Build a MenuSnapshot from a complete SDK menu. */
+declare function createMenuSnapshot({ storeId, menu, builtAt, sourceUpdatedAt, }: MenuSnapshotInput): Promise<MenuSnapshot>;
+/** Input for building a MenuSnapshot from the API's menu payload. */
+type MenuSnapshotPayloadInput = {
+    storeId: string;
+    branchId: string;
+    /** The JSON body of the API's branch menu read. */
+    payload: unknown;
+    /** Defaults to now. */
+    builtAt?: Date | string;
+};
+/**
+ * Build a MenuSnapshot from the API's branch menu payload. It maps the payload
+ * with the same mapper `menu.get()` uses, so the snapshot's menu is exactly
+ * what the client SDK returns.
+ */
+declare function menuSnapshotFromPayload({ storeId, branchId, payload, builtAt, }: MenuSnapshotPayloadInput): Promise<MenuSnapshot>;
+/** Build a StoreSnapshot from an SDK store. */
+declare function createStoreSnapshot({ store, builtAt, }: {
+    store: Store;
+    builtAt?: Date | string;
+}): Promise<StoreSnapshot>;
+/** Input for building an AvailabilityPatch. */
+type AvailabilityPatchInput = {
+    menuVersion: string;
+    soldOutItems?: readonly string[];
+    soldOutVariants?: readonly string[];
+    soldOutOptions?: readonly string[];
+    closedUntil?: Date | string;
+    /** Defaults to now. */
+    updatedAt?: Date | string;
+};
+/** Build an AvailabilityPatch with sorted, unique ids and its content hash. */
+declare function createAvailabilityPatch(input: AvailabilityPatchInput): Promise<AvailabilityPatch>;
+/**
+ * Return the snapshot's menu with an availability patch applied. A patch
+ * built before the snapshot is ignored, because the rebuilt menu already
+ * holds newer availability. The result reports the patch's menu version.
+ */
+declare function applyAvailability(snapshot: MenuSnapshot, patch: AvailabilityPatch | null | undefined): Menu;
+/** Check that a value read from the edge is a MenuSnapshot this SDK can use. */
+declare function isMenuSnapshot(value: unknown): value is MenuSnapshot;
+
 /**
  * The store, theme and optional build policies you export from zappie.config.ts.
  */
@@ -338,4 +660,4 @@ declare function createZappieServer({ secretKey, ...config }: ZappieServerConfig
     };
 }>;
 
-export { type EdgeSnapshotReader, STOREFRONT_QUERY_PARAMETERS, STOREFRONT_V1_QUERY_PARAMETERS, type SecurityHeadersOptions, type StorefrontInstallation, type StorefrontPageState, type StorefrontQuery, type StorefrontRoute, type StorefrontUrlInput, type StorefrontUrlOptions, type VerifyWebhookOptions, type WebhookEvent, type WebhookEventType, type ZappieServerConfig, ZappieWebhookSignatureError, buildStorefrontUrl, createSecurityNonce, createZappieServer, inlineScriptHashes, parseStorefrontUrl, securityHeaders, storefrontRedirect, verifyWebhook };
+export { type AvailabilityPatch, type AvailabilityPatchInput, type CookieSessionStoreOptions, type EdgeSnapshotReader, type IdTokenChecks, type IdTokenClaims, type MenuSnapshot, type MenuSnapshotInput, type MenuSnapshotPayloadInput, type PkcePair, STOREFRONT_QUERY_PARAMETERS, STOREFRONT_V1_QUERY_PARAMETERS, type SealOptions, type SealSecret, type SecurityHeadersOptions, type SessionData, type SessionStore, type SnapshotVersionRecord, type StoreSnapshot, type StorefrontInstallation, type StorefrontPageState, type StorefrontQuery, type StorefrontRoute, type StorefrontUrlInput, type StorefrontUrlOptions, type TokenAlgorithm, type TokenClaims, type TokenErrorReason, type TokenVerifier, type TokenVerifierOptions, type VerifyTokenChecks, type VerifyWebhookOptions, type WebhookEvent, type WebhookEventType, type ZappieServerConfig, ZappieTokenError, ZappieWebhookSignatureError, applyAvailability, buildStorefrontUrl, canonicalJson, cookieSessionStore, createAvailabilityPatch, createMenuSnapshot, createPkce, createSecurityNonce, createStoreSnapshot, createTokenVerifier, createZappieServer, inlineScriptHashes, isMenuSnapshot, menuSnapshotFromPayload, openSealedValue, parseStorefrontUrl, randomToken, sealValue, securityHeaders, snapshotHash, snapshotKeys, storefrontRedirect, verifyWebhook };

package/dist/server/index.js

@@ -8,6 +8,30 @@ import {
   STOREFRONT_V1_QUERY_PARAMETERS,
   storefrontRedirect
 } from "../url/index.js";
+import {
+  createPkce,
+  openSealedValue,
+  randomToken,
+  sealValue
+} from "./auth/crypto.js";
+import {
+  createTokenVerifier,
+  ZappieTokenError
+} from "./auth/jwt.js";
+import {
+  cookieSessionStore
+} from "./auth/session-store.js";
+import {
+  applyAvailability,
+  canonicalJson,
+  createAvailabilityPatch,
+  createMenuSnapshot,
+  createStoreSnapshot,
+  isMenuSnapshot,
+  menuSnapshotFromPayload,
+  snapshotHash,
+  snapshotKeys
+} from "./edge-snapshot.js";
 import {
   createSecurityNonce,
   inlineScriptHashes,
@@ -27,13 +51,29 @@ export {
   STOREFRONT_QUERY_PARAMETERS,
   STOREFRONT_V1_QUERY_PARAMETERS,
   VERSION,
+  ZappieTokenError,
   ZappieWebhookSignatureError,
+  applyAvailability,
   buildStorefrontUrl,
+  canonicalJson,
+  cookieSessionStore,
+  createAvailabilityPatch,
+  createMenuSnapshot,
+  createPkce,
   createSecurityNonce,
+  createStoreSnapshot,
+  createTokenVerifier,
   createZappieServer,
   inlineScriptHashes,
+  isMenuSnapshot,
+  menuSnapshotFromPayload,
+  openSealedValue,
   parseStorefrontUrl,
+  randomToken,
+  sealValue,
   securityHeaders,
+  snapshotHash,
+  snapshotKeys,
   storefrontRedirect,
   verifyWebhook
 };

package/dist/server/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/server/index.ts"],
-  "sourcesContent": ["import { buildClient } from \"../client\";\nimport type { ZappieConfig } from \"../config\";\nimport type { Menu } from \"../models\";\nexport { VERSION } from \"../index\";\nexport {\n  buildStorefrontUrl,\n  parseStorefrontUrl,\n  STOREFRONT_QUERY_PARAMETERS,\n  STOREFRONT_V1_QUERY_PARAMETERS,\n  storefrontRedirect,\n  type StorefrontInstallation,\n  type StorefrontPageState,\n  type StorefrontQuery,\n  type StorefrontRoute,\n  type StorefrontUrlInput,\n  type StorefrontUrlOptions,\n} from \"../url/index\";\nexport {\n  createSecurityNonce,\n  inlineScriptHashes,\n  securityHeaders,\n  type SecurityHeadersOptions,\n} from \"./security\";\nexport {\n  verifyWebhook,\n  ZappieWebhookSignatureError,\n  type VerifyWebhookOptions,\n  type WebhookEvent,\n  type WebhookEventType,\n} from \"./webhook\";\n/** An edge reader that returns a Menu snapshot or null. */\nexport interface EdgeSnapshotReader {\n  getMenu(storeId: string, branchId: string): Promise<Menu | null>;\n}\n/** Settings for your server client. Keep secret keys out of browser bundles. */\nexport type ZappieServerConfig = Omit<ZappieConfig, \"key\"> & {\n  secretKey: string;\n};\n/** Create a server client with your secret key and configured transport. */\nexport function createZappieServer({\n  secretKey,\n  ...config\n}: ZappieServerConfig) {\n  return buildClient({ ...config, key: secretKey }, true);\n}\n"],
-  "mappings": ";AAAA,SAAS,mBAAmB;AAG5B,SAAS,eAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAOK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAIK;AAUA,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA,GAAG;AACL,GAAuB;AACrB,SAAO,YAAY,EAAE,GAAG,QAAQ,KAAK,UAAU,GAAG,IAAI;AACxD;",
+  "sourcesContent": ["import { buildClient } from \"../client\";\nimport type { ZappieConfig } from \"../config\";\nimport type { Menu } from \"../models\";\nexport { VERSION } from \"../index\";\nexport {\n  buildStorefrontUrl,\n  parseStorefrontUrl,\n  STOREFRONT_QUERY_PARAMETERS,\n  STOREFRONT_V1_QUERY_PARAMETERS,\n  storefrontRedirect,\n  type StorefrontInstallation,\n  type StorefrontPageState,\n  type StorefrontQuery,\n  type StorefrontRoute,\n  type StorefrontUrlInput,\n  type StorefrontUrlOptions,\n} from \"../url/index\";\nexport {\n  createPkce,\n  openSealedValue,\n  randomToken,\n  sealValue,\n  type PkcePair,\n  type SealOptions,\n  type SealSecret,\n} from \"./auth/crypto\";\nexport {\n  createTokenVerifier,\n  ZappieTokenError,\n  type IdTokenChecks,\n  type IdTokenClaims,\n  type TokenAlgorithm,\n  type TokenClaims,\n  type TokenErrorReason,\n  type TokenVerifier,\n  type TokenVerifierOptions,\n  type VerifyTokenChecks,\n} from \"./auth/jwt\";\nexport {\n  cookieSessionStore,\n  type CookieSessionStoreOptions,\n  type SessionData,\n  type SessionStore,\n} from \"./auth/session-store\";\nexport {\n  applyAvailability,\n  canonicalJson,\n  createAvailabilityPatch,\n  createMenuSnapshot,\n  createStoreSnapshot,\n  isMenuSnapshot,\n  menuSnapshotFromPayload,\n  snapshotHash,\n  snapshotKeys,\n  type AvailabilityPatch,\n  type AvailabilityPatchInput,\n  type MenuSnapshot,\n  type MenuSnapshotInput,\n  type MenuSnapshotPayloadInput,\n  type SnapshotVersionRecord,\n  type StoreSnapshot,\n} from \"./edge-snapshot\";\nexport {\n  createSecurityNonce,\n  inlineScriptHashes,\n  securityHeaders,\n  type SecurityHeadersOptions,\n} from \"./security\";\nexport {\n  verifyWebhook,\n  ZappieWebhookSignatureError,\n  type VerifyWebhookOptions,\n  type WebhookEvent,\n  type WebhookEventType,\n} from \"./webhook\";\n/** An edge reader that returns a Menu snapshot or null. */\nexport interface EdgeSnapshotReader {\n  getMenu(storeId: string, branchId: string): Promise<Menu | null>;\n}\n/** Settings for your server client. Keep secret keys out of browser bundles. */\nexport type ZappieServerConfig = Omit<ZappieConfig, \"key\"> & {\n  secretKey: string;\n};\n/** Create a server client with your secret key and configured transport. */\nexport function createZappieServer({\n  secretKey,\n  ...config\n}: ZappieServerConfig) {\n  return buildClient({ ...config, key: secretKey }, true);\n}\n"],
+  "mappings": ";AAAA,SAAS,mBAAmB;AAG5B,SAAS,eAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAOK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OASK;AACP;AAAA,EACE;AAAA,OAIK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAQK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAIK;AAUA,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA,GAAG;AACL,GAAuB;AACrB,SAAO,YAAY,EAAE,GAAG,QAAQ,KAAK,UAAU,GAAG,IAAI;AACxD;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zappie/sdk",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "Typed, framework-agnostic client for Zappie menus, carts, checkout, auth and events.",
   "type": "module",
   "sideEffects": false,