[matnun-br]

• Add support to migrate non expiring offline token to expirng offline token
• Add support to refresh expiring offline token
• Add support to exchange id token for offline and online token
• Add support to exchange code token for offline and online token
• Add HMAC and Shop domain validation
• Add method to build authorization URL
• ShopifyClientOptions.AccessToken can now be set. This is required for token refresh

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[clement911]

Also please confirm these:

Smaller points

• Granted scopes aren't checked. The docs say to confirm that the response's scope contains every required scope, because merchants can change scopes during authorization. A write_x scope also counts as read_x. A helper such as HasScopes(token.scope, required) or a README note would help.

• Wrong code type goes unnoticed. If a per-user (online) code is passed to ExchangeCodeForOfflineAccessTokenAsync, it deserializes as an offline token with no error. The docs warn that writing an online token into the offline record stops background refresh. You could throw when the response contains associated_user.

[matnun-br]

@clement911 comments have all been addressed. This is ready for review