react-shopwave-connect 0.1.2 → 0.3.0

package/dist/server/index.js

@@ -0,0 +1,650 @@
+//#region src/server/errors.ts
+var ShopwaveAuthError = class extends Error {
+	code;
+	status;
+	/** Raw response body from the auth server, if any. Never contains our secret. */
+	body;
+	constructor(code, message, details = {}) {
+		super(message, details.cause !== void 0 ? { cause: details.cause } : void 0);
+		this.name = "ShopwaveAuthError";
+		this.code = code;
+		this.status = details.status;
+		this.body = details.body;
+	}
+	/**
+	* True when the auth server rejected the grant itself (bad/expired code or
+	* refresh token) rather than failing for a transient reason. Callers should
+	* treat the user as logged out.
+	*/
+	get isInvalidGrant() {
+		return (this.code === "token_exchange_failed" || this.code === "token_refresh_failed") && this.status !== void 0 && this.status >= 400 && this.status < 500;
+	}
+};
+
+//#endregion
+//#region src/server/token.ts
+/** Shopwave API error id meaning "access token expired / invalid". */
+const SHOPWAVE_TOKEN_EXPIRED_ERROR_ID = 908;
+/**
+* Converts a token-endpoint response into a {@link ShopwaveToken}.
+* Returns `null` when the response has no access token.
+*
+* @param previous  the token being refreshed; its refresh token is kept when
+*                  the server doesn't send a new one.
+*/
+function tokenFromResponse(response, previous, now = Date.now()) {
+	if (!response || typeof response.access_token !== "string" || !response.access_token) return null;
+	const expiresIn = Number(response.expires_in);
+	return {
+		accessToken: response.access_token,
+		refreshToken: typeof response.refresh_token === "string" && response.refresh_token || previous?.refreshToken,
+		tokenType: typeof response.token_type === "string" && response.token_type || "OAuth",
+		expiresAt: Number.isFinite(expiresIn) && expiresIn > 0 ? now + expiresIn * 1e3 : void 0
+	};
+}
+/**
+* Reads a token from session storage. Accepts both the current shape and the
+* legacy raw response that older apps (e.g. AdminUI ≤ 0.1) stored directly in
+* the session, so existing sessions survive an upgrade.
+*/
+function normalizeStoredToken(raw) {
+	if (!raw || typeof raw !== "object") return null;
+	const t = raw;
+	if (typeof t.accessToken === "string" && t.accessToken) return {
+		accessToken: t.accessToken,
+		refreshToken: typeof t.refreshToken === "string" ? t.refreshToken : void 0,
+		tokenType: typeof t.tokenType === "string" && t.tokenType ? t.tokenType : "OAuth",
+		expiresAt: typeof t.expiresAt === "number" ? t.expiresAt : void 0
+	};
+	if (typeof t.access_token === "string" && t.access_token) return {
+		accessToken: t.access_token,
+		refreshToken: typeof t.refresh_token === "string" ? t.refresh_token : void 0,
+		tokenType: typeof t.token_type === "string" && t.token_type ? t.token_type : "OAuth"
+	};
+	return null;
+}
+/**
+* True when the token has passed its expiry (minus `skewSeconds`).
+* Tokens without a known expiry are treated as valid.
+*
+* Shopwave only issues a new access token once the old one has actually
+* expired, so the default skew is 0 — refreshing early just returns the same
+* token.
+*/
+function isTokenExpired(token, { skewSeconds = 0, now = Date.now() } = {}) {
+	if (token.expiresAt === void 0) return false;
+	return now >= token.expiresAt - skewSeconds * 1e3;
+}
+/** `Authorization` header value, e.g. `OAuth 111ad…`. */
+function authorizationHeader(token) {
+	return `${token.tokenType || "OAuth"} ${token.accessToken}`;
+}
+/**
+* True when a Shopwave API response means "your access token is no longer
+* valid": HTTP 401, or the API error 908 in the response envelope.
+* Use it to trigger a forced refresh + a single retry.
+*/
+function isExpiredTokenResponse(status, body) {
+	if (status === 401) return true;
+	const message = body?.api?.message;
+	const errors = message?.errors ?? message?.error;
+	if (!errors || typeof errors !== "object") return false;
+	return Object.entries(errors).some(([key, value]) => key === String(SHOPWAVE_TOKEN_EXPIRED_ERROR_ID) || Number(value?.id) === SHOPWAVE_TOKEN_EXPIRED_ERROR_ID);
+}
+
+//#endregion
+//#region src/server/oauth.ts
+const REQUIRED_KEYS = [
+	"authServerUrl",
+	"clientId",
+	"clientSecret",
+	"redirectUri"
+];
+/** Throws a readable error when required settings are missing. */
+function assertOAuthConfig(config) {
+	const missing = REQUIRED_KEYS.filter((k) => !config?.[k]);
+	if (missing.length > 0) throw new ShopwaveAuthError("config_invalid", `Shopwave auth is missing required settings: ${missing.join(", ")}`);
+}
+function trimSlash(url) {
+	return url.replace(/\/+$/, "");
+}
+/**
+* Creates a framework-agnostic Shopwave OAuth client (authorization-code flow
+* with a client secret — the Shopwave auth server does not support PKCE, so
+* this must run on a server).
+*
+* Config is validated lazily on first use, so creating the client at module
+* scope doesn't break builds where env vars aren't present.
+*/
+function createShopwaveOAuth(config) {
+	const endpoints = {
+		login: config.endpoints?.login ?? "/login",
+		token: config.endpoints?.token ?? "/oauth/token",
+		logout: config.endpoints?.logout ?? "/logout"
+	};
+	const base = () => {
+		assertOAuthConfig(config);
+		return trimSlash(config.authServerUrl);
+	};
+	const commonParams = (redirectUri) => new URLSearchParams({
+		access_type: config.accessType ?? "online",
+		redirect_uri: redirectUri,
+		response_type: "code",
+		client_id: config.clientId,
+		scope: config.scope ?? "application"
+	});
+	async function postToken(fields, errorCode) {
+		const url = `${base()}${endpoints.token}`;
+		const doFetch = config.fetch ?? globalThis.fetch;
+		let body;
+		if (config.tokenRequestFormat === "multipart") {
+			const fd = new FormData();
+			for (const [k, v] of Object.entries(fields)) fd.append(k, v);
+			body = fd;
+		} else body = new URLSearchParams(fields);
+		let response;
+		try {
+			response = await doFetch(url, {
+				method: "POST",
+				body,
+				headers: { Accept: "application/json" },
+				cache: "no-store"
+			});
+		} catch (cause) {
+			throw new ShopwaveAuthError("network_error", `Could not reach the Shopwave auth server`, { cause });
+		}
+		const text = await response.text();
+		if (!response.ok) throw new ShopwaveAuthError(errorCode, `Shopwave auth server returned ${response.status} for ${fields.grant_type}`, {
+			status: response.status,
+			body: text.slice(0, 2e3)
+		});
+		try {
+			return JSON.parse(text);
+		} catch (cause) {
+			throw new ShopwaveAuthError("token_response_invalid", "Token response was not JSON", {
+				status: response.status,
+				body: text.slice(0, 2e3),
+				cause
+			});
+		}
+	}
+	return {
+		config,
+		buildLoginUrl({ state } = {}) {
+			const params = commonParams(config.redirectUri);
+			if (state) params.set("state", state);
+			return `${base()}${endpoints.login}?${params.toString()}`;
+		},
+		buildLogoutUrl({ redirectUri } = {}) {
+			const params = commonParams(redirectUri ?? config.postLogoutRedirectUri ?? config.redirectUri);
+			return `${base()}${endpoints.logout}?${params.toString()}`;
+		},
+		async exchangeCode(code) {
+			if (!code) throw new ShopwaveAuthError("token_exchange_failed", "Missing authorization code");
+			const token = tokenFromResponse(await postToken({
+				code,
+				redirect_uri: config.redirectUri,
+				client_id: config.clientId,
+				client_secret: config.clientSecret,
+				scope: config.scope ?? "application",
+				grant_type: "authorization_code"
+			}, "token_exchange_failed"));
+			if (!token) throw new ShopwaveAuthError("token_response_invalid", "Token response had no access_token");
+			return token;
+		},
+		async refreshToken(tokenOrRefreshToken) {
+			const previous = typeof tokenOrRefreshToken === "string" ? {
+				accessToken: "",
+				refreshToken: tokenOrRefreshToken,
+				tokenType: "OAuth"
+			} : tokenOrRefreshToken;
+			if (!previous.refreshToken) throw new ShopwaveAuthError("token_refresh_failed", "No refresh token available", { status: 400 });
+			const token = tokenFromResponse(await postToken({
+				refresh_token: previous.refreshToken,
+				redirect_uri: config.redirectUri,
+				client_id: config.clientId,
+				client_secret: config.clientSecret,
+				grant_type: "refresh_token"
+			}, "token_refresh_failed"), previous);
+			if (!token) throw new ShopwaveAuthError("token_response_invalid", "Refresh response had no access_token");
+			return token;
+		}
+	};
+}
+
+//#endregion
+//#region src/server/returnTo.ts
+/**
+* Helpers for the round trip through the auth server.
+*/
+/**
+* Only allows same-origin relative paths ("/products?tab=1"). Anything that
+* could send the user to another site after login — absolute URLs,
+* protocol-relative "//evil.com", backslash tricks, control characters —
+* falls back to `fallback`.
+*/
+function sanitizeReturnTo(value, fallback = "/") {
+	if (typeof value !== "string" || value.length === 0 || value.length > 2048) return fallback;
+	if (!/^\/(?![/\\])/.test(value)) return fallback;
+	if (/[\u0000-\u001f\u007f]/.test(value)) return fallback;
+	if (value.includes("\\")) return fallback;
+	return value;
+}
+/** Random, URL-safe value for the OAuth `state` parameter (128 bits, hex). */
+function createState() {
+	const bytes = new Uint8Array(16);
+	globalThis.crypto.getRandomValues(bytes);
+	return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+/** Constant-time string comparison for state values. */
+function safeEqual(a, b) {
+	if (typeof a !== "string" || typeof b !== "string" || a.length !== b.length) return false;
+	let diff = 0;
+	for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+	return diff === 0;
+}
+
+//#endregion
+//#region src/core/entities.ts
+/**
+* Addressing per entity, following the Shopwave API reference
+* (https://developer.merchantstack.com/api-reference.html) and checked against
+* the live API where noted:
+* - category/product/store: GET filtered by `<x>Ids`, POST upsert, DELETE with `<x>Id` → 205.
+* - promotion: no DELETE; "deleting" a promotion ends it by setting `endDate` to now.
+* - employee: POST updates `roleId`, `joinedDate`, `exitDate` (names can't be
+*   changed); no DELETE (live API: "Cannot DELETE /employee") → retired via `exitDate`.
+* - consumer: read-only (`GET` with `ids`, comma-separated); live POST → 404.
+*/
+const SHOPWAVE_ENTITIES = Object.freeze({
+	product: {
+		route: "products",
+		collection: "products",
+		upstream: "product",
+		idsHeader: "productIds",
+		idHeader: "productId",
+		writable: true,
+		deleteMode: "delete"
+	},
+	category: {
+		route: "categories",
+		collection: "categories",
+		upstream: "category",
+		idsHeader: "categoryIds",
+		idHeader: "categoryId",
+		writable: true,
+		deleteMode: "delete"
+	},
+	store: {
+		route: "stores",
+		collection: "stores",
+		upstream: "store",
+		idsHeader: "storeIds",
+		idHeader: "storeId",
+		writable: true,
+		deleteMode: "delete"
+	},
+	promotion: {
+		route: "promotions",
+		collection: "promotions",
+		upstream: "promotion",
+		idsHeader: "promotionIds",
+		idHeader: "promotionId",
+		writable: true,
+		deleteMode: "retire",
+		retireField: "endDate"
+	},
+	employee: {
+		route: "employees",
+		collection: "employees",
+		upstream: "employee",
+		idsHeader: "employeeIds",
+		idHeader: "employeeId",
+		writable: true,
+		deleteMode: "retire",
+		retireField: "exitDate"
+	},
+	consumer: {
+		route: "consumer",
+		collection: "consumers",
+		upstream: "consumer",
+		idsHeader: "ids",
+		idHeader: "consumerId",
+		writable: false,
+		deleteMode: "none"
+	}
+});
+
+//#endregion
+//#region src/server/api.ts
+/**
+* The OAuth token a caller sent with the request, without its scheme, or `null`.
+*
+* Reads, in order: `Authorization: OAuth|Bearer <token>` (what the SDK sends
+* from 0.3), the `token` header (SDK ≤ 0.2 writes), and `extras.token`
+* (SDK ≤ 0.2 reads).
+*/
+function readRequestToken(request) {
+	const authz = request.headers.get("authorization");
+	if (authz) {
+		const match = /^(?:oauth|bearer)\s+(\S+)\s*$/i.exec(authz);
+		if (match) return match[1];
+	}
+	const legacyHeader = request.headers.get("token");
+	if (legacyHeader && legacyHeader.trim()) return legacyHeader.trim();
+	const extras = request.headers.get("extras");
+	if (extras) try {
+		const token = JSON.parse(extras)?.token;
+		if (typeof token === "string" && token.trim()) return token.trim();
+	} catch {}
+	return null;
+}
+/**
+* `extras` keys that are never forwarded upstream (case-insensitive).
+* `Content-Type` is allowed (SDK clients have always sent `application/json`
+* on reads) but is replaced by the form content type on writes.
+*/
+const BLOCKED_EXTRAS = new Set([
+	"authorization",
+	"token",
+	"cookie",
+	"host",
+	"x-accept-version",
+	"content-length",
+	"connection",
+	"transfer-encoding",
+	"te",
+	"upgrade",
+	"expect",
+	"keep-alive",
+	"proxy-authorization",
+	"forwarded"
+]);
+const HEADER_NAME = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
+function headerValue(value) {
+	if (value == null) return null;
+	let text;
+	if (Array.isArray(value)) text = value.map((v) => v != null && typeof v === "object" ? JSON.stringify(v) : String(v)).join(",");
+	else if (typeof value === "object") text = JSON.stringify(value);
+	else text = String(value);
+	return /[\r\n\0]/.test(text) ? null : text;
+}
+/**
+* Parses the `extras` request header into upstream headers.
+* Returns `null` when the header isn't a JSON object.
+*/
+function parseExtras(raw, blocked = BLOCKED_EXTRAS) {
+	if (!raw) return {};
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return null;
+	}
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+	const headers = {};
+	for (const [key, value] of Object.entries(parsed)) {
+		const lower = key.toLowerCase();
+		if (!HEADER_NAME.test(key) || blocked.has(lower) || lower.startsWith("x-forwarded-") || lower.startsWith("proxy-")) continue;
+		const text = headerValue(value);
+		if (text !== null) headers[key] = text;
+	}
+	return headers;
+}
+var RequestBodyError = class extends Error {};
+function isPlainObject(value) {
+	return !!value && typeof value === "object" && !Array.isArray(value);
+}
+/**
+* Normalises a write request body into the Shopwave envelope
+* `{ <collection>: { <ref>: entity, … } }`.
+*
+* Accepts:
+*  - the SDK ≥ 0.3 shape `{ <collection>: { "0": {...}, "1": {...} } }` (refs kept),
+*  - the older AdminUI shapes `{ <collection>: { new: {...} } }` / `{ updated: {...} }`,
+*  - a bare entity object `{ title: … }`.
+*
+* With `forcedId` (item routes) exactly one entity is allowed and its `id` is
+* set from the URL.
+*/
+function normalizeWriteBody(def, body, forcedId) {
+	if (!isPlainObject(body)) throw new RequestBodyError("Request body must be a JSON object");
+	let refs;
+	const wrapped = body[def.collection];
+	if (wrapped !== void 0) {
+		if (!isPlainObject(wrapped)) throw new RequestBodyError(`"${def.collection}" must be an object keyed by ref`);
+		const keys = Object.keys(wrapped);
+		const entries = keys.length === 1 && (keys[0] === "new" || keys[0] === "updated") ? [["0", wrapped[keys[0]]]] : Object.entries(wrapped);
+		refs = {};
+		for (const [ref, entity] of entries) {
+			if (!isPlainObject(entity)) throw new RequestBodyError(`"${def.collection}.${ref}" must be an object`);
+			refs[ref] = { ...entity };
+		}
+	} else refs = { "0": { ...body } };
+	const count = Object.keys(refs).length;
+	if (count === 0) throw new RequestBodyError(`No ${def.collection} to save`);
+	if (forcedId !== void 0) {
+		if (count !== 1) throw new RequestBodyError("Only one entity can be saved at an id route");
+		const only = refs[Object.keys(refs)[0]];
+		only.id = /^\d+$/.test(forcedId) ? Number(forcedId) : forcedId;
+	}
+	return { [def.collection]: refs };
+}
+const NO_STORE = { "Cache-Control": "no-store" };
+function jsonError(status, error, message) {
+	return new Response(JSON.stringify({
+		error,
+		message
+	}), {
+		status,
+		headers: {
+			"Content-Type": "application/json",
+			...NO_STORE
+		}
+	});
+}
+/** `YYYY-MM-DD HH:mm:ss` in UTC, the datetime format Shopwave writes use (e.g. promotions). */
+function shopwaveDateTime(date = /* @__PURE__ */ new Date()) {
+	return date.toISOString().slice(0, 19).replace("T", " ");
+}
+const NULL_BODY_STATUS = new Set([
+	101,
+	103,
+	204,
+	205,
+	304
+]);
+const ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+async function readUpstream(response) {
+	const text = await response.text();
+	if (!text) return {
+		text,
+		json: null
+	};
+	try {
+		return {
+			text,
+			json: JSON.parse(text)
+		};
+	} catch {
+		return {
+			text,
+			json: null
+		};
+	}
+}
+async function routeParam(context, name) {
+	const value = (await context?.params)?.[name];
+	const id = Array.isArray(value) ? value[0] : value;
+	return typeof id === "string" && ID_PATTERN.test(id) ? id : null;
+}
+function createShopwaveApiHandlers(config) {
+	const allowRequestToken = config.allowRequestToken ?? true;
+	const apiVersion = config.apiVersion ?? "2.0";
+	const blocked = new Set([...BLOCKED_EXTRAS, ...(config.blockedExtras ?? []).map((k) => k.toLowerCase())]);
+	const onError = config.onError ?? ((error, ctx) => console.error(`[react-shopwave-connect] Shopwave API ${ctx.method} /${ctx.path} failed:`, error?.message ?? error));
+	function apiBase() {
+		const url = config.apiUrl;
+		if (!url) throw new Error("Shopwave API: apiUrl is not set (e.g. SHOPWAVE_API_SERVER_URL).");
+		return url.replace(/\/+$/, "");
+	}
+	function entity(kind) {
+		const base = SHOPWAVE_ENTITIES[kind];
+		if (!base) throw new Error(`Unknown Shopwave entity "${kind}"`);
+		return {
+			...base,
+			...config.entities?.[kind] ?? {}
+		};
+	}
+	async function forward(request, init) {
+		const method = (init.method ?? "GET").toUpperCase();
+		const path = init.path.replace(/^\/+/, "");
+		const extras = init.forwardExtras === false ? {} : parseExtras(request.headers.get("extras"), blocked);
+		if (!extras) return jsonError(400, "invalid_extras", "The extras header must be a JSON object");
+		const requestToken = allowRequestToken ? readRequestToken(request) : null;
+		let authorization;
+		try {
+			authorization = requestToken ? `OAuth ${requestToken}` : await config.getAuthorization?.() ?? null;
+		} catch (error) {
+			onError(error, {
+				method,
+				path: "oauth/token"
+			});
+			return jsonError(502, "auth_unavailable", "Could not refresh the Shopwave session");
+		}
+		if (!authorization) return jsonError(401, "unauthorized", "Not logged in");
+		const body = init.postBody === void 0 ? void 0 : new URLSearchParams({ postBody: JSON.stringify(init.postBody) });
+		const call = (authz) => {
+			const headers = new Headers(extras);
+			for (const [k, v] of Object.entries(init.headers ?? {})) headers.set(k, v);
+			headers.set("Authorization", authz);
+			headers.set("x-accept-version", apiVersion);
+			if (body) headers.set("Content-Type", "application/x-www-form-urlencoded;charset=UTF-8");
+			return (config.fetch ?? fetch)(`${apiBase()}/${path}`, {
+				method,
+				headers,
+				body,
+				cache: "no-store"
+			});
+		};
+		try {
+			let response = await call(authorization);
+			let upstream = await readUpstream(response);
+			if (!requestToken && config.getAuthorization && isExpiredTokenResponse(response.status, upstream.json)) {
+				const fresh = await config.getAuthorization({ forceRefresh: true });
+				if (!fresh) return jsonError(401, "unauthorized", "The Shopwave session has expired");
+				response = await call(fresh);
+				upstream = await readUpstream(response);
+			}
+			if (NULL_BODY_STATUS.has(response.status) || !upstream.text) return new Response(null, {
+				status: response.status,
+				headers: NO_STORE
+			});
+			return new Response(upstream.text, {
+				status: response.status,
+				headers: {
+					"Content-Type": upstream.json !== null ? "application/json" : response.headers.get("content-type") ?? "text/plain",
+					...NO_STORE
+				}
+			});
+		} catch (error) {
+			onError(error, {
+				method,
+				path
+			});
+			return jsonError(502, "upstream_unavailable", "The Shopwave API could not be reached");
+		}
+	}
+	async function readJsonBody(request) {
+		const text = await request.text();
+		if (!text) throw new RequestBodyError("Request body is empty");
+		try {
+			return JSON.parse(text);
+		} catch {
+			throw new RequestBodyError("Request body is not valid JSON");
+		}
+	}
+	function notSupported(def, what) {
+		return jsonError(405, "method_not_allowed", `The Shopwave API doesn't support ${what} for ${def.collection}`);
+	}
+	async function write(request, def, forcedId) {
+		if (!def.writable) return notSupported(def, "writes");
+		let postBody;
+		try {
+			postBody = normalizeWriteBody(def, await readJsonBody(request), forcedId);
+		} catch (error) {
+			if (error instanceof RequestBodyError) return jsonError(400, "invalid_body", error.message);
+			throw error;
+		}
+		return forward(request, {
+			method: "POST",
+			path: def.upstream,
+			postBody
+		});
+	}
+	function badId() {
+		return jsonError(400, "invalid_id", "Missing or invalid id");
+	}
+	return {
+		forward,
+		entity,
+		collection(kind) {
+			const def = entity(kind);
+			const save = (request) => write(request, def);
+			return {
+				GET: (request) => forward(request, { path: def.upstream }),
+				POST: save,
+				PUT: save
+			};
+		},
+		item(kind, options = {}) {
+			const def = entity(kind);
+			const param = options.param ?? "id";
+			return {
+				async GET(request, context) {
+					const id = await routeParam(context, param);
+					if (!id) return badId();
+					return forward(request, {
+						path: def.upstream,
+						headers: { [def.idsHeader]: id }
+					});
+				},
+				async PUT(request, context) {
+					const id = await routeParam(context, param);
+					if (!id) return badId();
+					return write(request, def, id);
+				},
+				async DELETE(request, context) {
+					const id = await routeParam(context, param);
+					if (!id) return badId();
+					if (def.deleteMode === "none") return notSupported(def, "deletes");
+					if (def.deleteMode === "retire") {
+						const field = def.retireField ?? "exitDate";
+						return forward(request, {
+							method: "POST",
+							path: def.upstream,
+							postBody: { [def.collection]: { 0: {
+								id: /^\d+$/.test(id) ? Number(id) : id,
+								[field]: shopwaveDateTime()
+							} } },
+							forwardExtras: false
+						});
+					}
+					return forward(request, {
+						method: "DELETE",
+						path: def.upstream,
+						headers: { [def.idHeader]: id },
+						forwardExtras: false
+					});
+				}
+			};
+		},
+		passthrough(path) {
+			return { GET: (request) => forward(request, { path }) };
+		}
+	};
+}
+
+//#endregion
+export { BLOCKED_EXTRAS, RequestBodyError, SHOPWAVE_ENTITIES, SHOPWAVE_TOKEN_EXPIRED_ERROR_ID, ShopwaveAuthError, assertOAuthConfig, authorizationHeader, createShopwaveApiHandlers, createShopwaveOAuth, createState, isExpiredTokenResponse, isTokenExpired, normalizeStoredToken, normalizeWriteBody, parseExtras, readRequestToken, safeEqual, sanitizeReturnTo, shopwaveDateTime, tokenFromResponse };
+//# sourceMappingURL=index.js.map